@devmoods/express-extras 0.62.0 → 0.63.1

package/dist/auth/types.d.ts

@@ -48,6 +48,7 @@ export interface AuthProviderContext<UserModel extends AnyUser> {
 export interface AuthProvider<UserModel extends AnyUser> {
     setupRoutes(router: TypedRouter, context: AuthProviderContext<UserModel>): void;
 }
+export type AuthIsAllowedFn<UserModel extends AnyUser> = (user: UserModel) => Promise<boolean> | boolean;
 export type AuthMiddlewareOptions<UserModel extends AnyUser> = false | {
-    isAuthorized?: (user: UserModel) => Promise<boolean> | boolean;
+    isAuthorized?: AuthIsAllowedFn<UserModel>;
 };

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
 import { type RequestHandler, type Response, type Request, type Router } from 'express';
-import { TokenStorage, type AnyUser, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
+import { TokenStorage, type AnyUser, type AuthIsAllowedFn, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
 import { type RedisClient } from './redis.js';
 export * from './auth/types.js';
 export * from './auth/emailAndPassword.js';
@@ -11,6 +11,7 @@ export interface CreateAuth<UserModel extends AnyUser> {
     useCurrentUser: () => UserModel | undefined;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     before: () => RequestHandler;
+    allow: (fn?: AuthIsAllowedFn<UserModel>) => RequestHandler;
     isAuthorized: (fn?: (user: UserModel) => boolean) => RequestHandler;
     createTemporaryToken(user: UserModel): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel | null): Promise<string>;

package/dist/auth.js

@@ -130,7 +130,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             authenticate = options;
             options = {};
         }
-        return async (req, res, next) => {
+        return async function authenticationMiddleware(req, res, next) {
             try {
                 const token = extractAccessTokenFromRequest(req);
                 if (!token) {
@@ -192,6 +192,36 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             }
         };
     }
+    function allow(isAuthorized = () => true) {
+        return async function authorizationMiddleware(req, res, next) {
+            try {
+                const user = useCurrentUser();
+                if (!user) {
+                    throw new InvalidToken('User not logged in');
+                }
+                if (isAuthorized && !(await isAuthorized(user))) {
+                    throw new PermissionDenied('Permission denied');
+                }
+                next();
+            }
+            catch (error) {
+                logger.error(error);
+                if (error instanceof PermissionDenied) {
+                    if (req.accepts('html')) {
+                        return res.redirect(loginUrl);
+                    }
+                    return next(Forbidden('Permission denied'));
+                }
+                if (error instanceof InvalidToken) {
+                    if (req.accepts('html')) {
+                        return res.redirect(loginUrl);
+                    }
+                    return next(Unauthorized(`Invalid token: ${error.message}`));
+                }
+                next(error);
+            }
+        };
+    }
     async function createOtp(user) {
         const otp = crypto.randomInt(100000, 999999).toString();
         await tokenStorage.set(otp, String(user.id), config.value.AUTH_OTP_EXPIRES_IN);
@@ -265,6 +295,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         return storedUid;
     }
     return {
+        allow,
         before: () => middleware(false),
         isAuthorized: (fn) => middleware({ isAuthorized: fn || (() => true) }),
         createRouter: () => createAuthRouter().getRouter(),

package/dist/context.d.ts

@@ -20,3 +20,5 @@ export declare function setContext<T>(key: string, value: T): void;
  * Obtain the requestId from the current async request context.
  */
 export declare function useRequestId(): string | undefined;
+export declare const ANONYMOUS_SESSION_KEY = "anonymous-session";
+export declare function useAnonymousSession(): string | undefined;

package/dist/context.js

@@ -42,3 +42,7 @@ export function setContext(key, value) {
 export function useRequestId() {
     return useContext(REQUEST_ID);
 }
+export const ANONYMOUS_SESSION_KEY = 'anonymous-session';
+export function useAnonymousSession() {
+    return useContext(ANONYMOUS_SESSION_KEY);
+}

package/dist/faktory.js

@@ -82,6 +82,10 @@ export async function createFaktoryWorker({ queueName, jobs, faktory: createFact
                 faktory.use(async (ctx, next) => {
                     const jobId = ctx.job.jid;
                     const timer = startTimer();
+                    logger.info('job started', {
+                        jobName: ctx.job.jobtype,
+                        jobId,
+                    });
                     await context.run(new Map(), async () => {
                         const store = context.getStore();
                         if (store) {

package/dist/logger.js

@@ -1,7 +1,7 @@
 import * as os from 'node:os';
 import * as Sentry from '@sentry/node';
 import { config } from './config.js';
-import { useRequestId } from './context.js';
+import { useAnonymousSession, useRequestId } from './context.js';
 const LEVELS = {
     TRACE: 10,
     DEBUG: 20,
@@ -21,6 +21,7 @@ function defaultGetContext() {
     return {
         app: nameArgIndex > -1 ? process.argv.at(nameArgIndex + 1) : undefined,
         requestId: useRequestId(),
+        sessionId: useAnonymousSession(),
         ..._globalGetContext?.(),
     };
 }

package/dist/middleware.d.ts

@@ -1,6 +1,7 @@
 import { type ServerResponse, type IncomingMessage } from 'node:http';
 import { compose } from 'compose-middleware';
 import { type NextFunction, type RequestHandler, type Request, type Response, json as jsonParser, urlencoded as urlencodedParser } from 'express';
+import { type createAuth } from './auth.js';
 import { type CsrfMiddlewareOptions } from './csrf.js';
 export { urlencodedParser, jsonParser };
 export { asyncMiddleware as route };
@@ -43,12 +44,16 @@ export interface BeforeMiddlewareOptions {
      * Custom CSP directives
      */
     cspDirectives?: (defaults: BeforeMiddlewareCSPDirectives) => BeforeMiddlewareCSPDirectives;
+    /**
+     * Auth middleware needs to be available early before request logging happens.
+     */
+    auth?: ReturnType<typeof createAuth>;
 }
 export declare function useCspNonce(): string;
 /**
  * Register middleware that must come before the app routes.
  */
-export declare function before({ cookies, helmet: useHelmet, json: useJson, csrf: useCsrf, urlencoded: useUrlencoded, allowUnsafeInlineScripts, cspDirectives, }?: BeforeMiddlewareOptions): import("compose-middleware").RequestHandler<any, any, void>;
+export declare function before({ cookies, helmet: useHelmet, json: useJson, csrf: useCsrf, urlencoded: useUrlencoded, allowUnsafeInlineScripts, cspDirectives, auth, }?: BeforeMiddlewareOptions): import("compose-middleware").RequestHandler<any, any, void>;
 /**
  * Middleware that sends a 404
  *
@@ -56,6 +61,10 @@ export declare function before({ cookies, helmet: useHelmet, json: useJson, csrf
  * unknown routes.
  */
 export declare function notFound(): RequestHandler;
+/**
+ * Set a session cookie for the request
+ */
+export declare function setAnonymousCookie(): RequestHandler;
 /**
  * Register middlewares that must come after the app routes.
  */

package/dist/middleware.js

@@ -4,7 +4,9 @@ import { compose } from 'compose-middleware';
 import cookieParser from 'cookie-parser';
 import { json as jsonParser, urlencoded as urlencodedParser, } from 'express';
 import helmet from 'helmet';
-import { setContext, useContext, withRequestContext } from './context.js';
+import {} from './auth.js';
+import { config } from './config.js';
+import { ANONYMOUS_SESSION_KEY, setContext, useContext, withRequestContext, } from './context.js';
 import { csrf, doubleCsrfProtection, } from './csrf.js';
 import { NotFound } from './errors.js';
 import { getLogger } from './logger.js';
@@ -20,14 +22,17 @@ export function useCspNonce() {
 /**
  * Register middleware that must come before the app routes.
  */
-export function before({ cookies = false, helmet: useHelmet = true, json: useJson = true, csrf: useCsrf = false, urlencoded: useUrlencoded = false, allowUnsafeInlineScripts = false, cspDirectives = (x) => x, } = {}) {
-    return compose([
+export function before({ cookies = true, helmet: useHelmet = true, json: useJson = true, csrf: useCsrf = false, urlencoded: useUrlencoded = false, allowUnsafeInlineScripts = false, cspDirectives = (x) => x, auth, } = {}) {
+    const middleware = compose([
         withRequestContext(),
+        (cookies || useCsrf) && cookieParser(),
+        cookies && setAnonymousCookie(),
         typeof useCsrf === 'object' && useCsrf != null
             ? csrf(useCsrf)
             : useCsrf
                 ? csrf()
                 : undefined,
+        auth && auth.before(),
         logRequestDuration(),
         setCspNonce(),
         useHelmet &&
@@ -63,9 +68,12 @@ export function before({ cookies = false, helmet: useHelmet = true, json: useJso
             }),
         useJson && jsonParser(),
         useUrlencoded && urlencodedParser({ extended: true }),
-        (cookies || useCsrf) && cookieParser(),
         analyticsProxy(),
     ].filter(Boolean));
+    Object.defineProperty(middleware, 'name', {
+        value: before.name,
+    });
+    return middleware;
 }
 function logRequestDuration() {
     const FILTERED_PATHS = [
@@ -77,7 +85,7 @@ function logRequestDuration() {
         '/@id',
         '/analytics.js',
     ];
-    return (req, res, next) => {
+    return function logRequestDurationMiddleware(req, res, next) {
         if (FILTERED_PATHS.some((p) => req.path.startsWith(p))) {
             return next();
         }
@@ -86,7 +94,13 @@ function logRequestDuration() {
             method: req.method,
             url: req.originalUrl,
             path: req.path,
+            query: req.query,
             ip: req.ip,
+            userAgent: req.headers['user-agent'] ?? 'unknown',
+            accept: req.headers['accept'] ?? 'unknown',
+            host: req.headers['host'] ?? 'unknown',
+            referer: req.headers['referer'] ?? 'unknown',
+            origin: req.headers['origin'] ?? 'unknown',
         });
         res.on('finish', () => {
             const duration = timer.getDuration();
@@ -108,7 +122,7 @@ function logRequestDuration() {
  * unknown routes.
  */
 export function notFound() {
-    return (req, res, next) => {
+    return function notFoundMiddleware(req, res, next) {
         next(NotFound(`Could not ${req.method} ${req.path}`));
     };
 }
@@ -116,18 +130,41 @@ export function notFound() {
  * Set a CSP nonce for the request
  */
 function setCspNonce() {
-    return (req, res, next) => {
+    return function setCspNonceMiddleware(req, res, next) {
         setContext(CSP_NONCE_KEY, crypto.randomBytes(16).toString('base64'));
         next();
     };
 }
+/**
+ * Set a session cookie for the request
+ */
+export function setAnonymousCookie() {
+    return function setAnonymousCookieMiddleware(req, res, next) {
+        const cookieName = 'aid';
+        let sessionId = req.cookies?.[cookieName];
+        // Generate new sessionId if none exists
+        if (!sessionId) {
+            sessionId = crypto.randomUUID();
+            // Set the cookie
+            res.cookie(cookieName, sessionId, {
+                maxAge: 365 * 24 * 60 * 60 * 1000,
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: config.value.AUTH_COOKIE_SAME_SITE,
+            });
+        }
+        // Store sessionId in request context
+        setContext(ANONYMOUS_SESSION_KEY, sessionId);
+        next();
+    };
+}
 /**
  * In production, we could directly proxy the url
  * to an analytics service from nginx, but in dev
  * we serve a dummy script to avoid 404.
  */
 function analyticsProxy() {
-    return (req, res, next) => {
+    return function analyticsProxyMiddleware(req, res, next) {
         if (req.originalUrl === '/analytics.js') {
             res.setHeader('Content-type', 'text/javascript');
             res.status(200).end('// no-op analytics proxy');

package/dist/postgres.js

@@ -244,7 +244,7 @@ export function createPostgres({ onError, url = config.value.POSTGRES_URL, ...po
     };
 }
 export function withTransaction(postgres) {
-    return async (req, res, next) => {
+    return async function withTransactionMiddleware(req, res, next) {
         try {
             await postgres.transaction(async () => {
                 await new Promise((resolve, reject) => {

package/dist/validate.js

@@ -80,6 +80,9 @@ export function validateStandardSchema(schemas) {
         metadata.responseSchema = toJsonSchema(schemas.response);
     }
     middleware.metadata = metadata;
+    Object.defineProperty(middleware, 'name', {
+        value: validateStandardSchema.name,
+    });
     return middleware;
 }
 function toJsonSchema(standardSchema) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.62.0",
+  "version": "0.63.1",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -59,13 +59,13 @@
     "ts-node": "10.9.2",
     "tsx": "^4.20.5",
     "typescript": "5.9.2",
-    "vite": "^7.1.4",
+    "vite": "^7.1.5",
     "vitest": "^3.2.4",
     "vitest-fail-on-console": "^0.10.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.2.0",
-    "@hey-api/openapi-ts": "^0.82.4",
+    "@hey-api/openapi-ts": "^0.82.5",
     "@sentry/node": "^10.10.0",
     "@sentry/profiling-node": "^10.10.0",
     "@standard-schema/spec": "^1.0.0",
@@ -81,7 +81,7 @@
     "ajv": "^8.17.1",
     "argon2": "^0.44.0",
     "bcrypt": "^6.0.0",
-    "chalk": "^5.6.0",
+    "chalk": "^5.6.2",
     "commander": "^14.0.0",
     "compose-middleware": "^5.0.1",
     "cookie-parser": "^1.4.7",