@devmoods/express-extras 0.66.1 → 0.68.0

package/dist/auth/emailAndPassword.js

@@ -1,7 +1,6 @@
 import { startTimer } from '@devmoods/observability';
 import argon2 from 'argon2';
 import bcrypt from 'bcrypt';
-import {} from 'express';
 import { createTokenResponse, tokenSchema } from './token.js';
 import {} from './types.js';
 import { Unauthorized } from '../errors.js';

package/dist/auth/google.js

@@ -1,6 +1,5 @@
 import { config } from '@devmoods/config';
 import { type } from 'arktype';
-import {} from 'express';
 import { OAuth2Client } from 'google-auth-library';
 import { BadRequest, Unauthorized } from '../errors.js';
 import { getLogger } from '../logger.js';

package/dist/auth/passwordless.js

@@ -1,5 +1,4 @@
 import { DoesNotExistError } from '@devmoods/postgres';
-import {} from 'express';
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
 import { getLogger } from '../logger.js';

package/dist/auth/token.d.ts

@@ -6,28 +6,28 @@ export declare function createTokenResponse(accessToken: AccessToken): readonly
 }, {
     readonly 'Cache-Control': "no-store";
 }];
-export type AccessToken = ReturnType<typeof createAccessToken>;
+export type AccessToken = Awaited<ReturnType<typeof createAccessToken>>;
 /**
  * Returns a signed JWT token.
  */
-export declare function createAccessToken(payload: any, version?: string, secret?: string): {
+export declare function createAccessToken(payload: any, version?: string, secret?: string): Promise<{
     token: string;
     tokenType: "Bearer";
     expiresIn: number;
-};
+}>;
 /**
  * Decode the given JWT token.
  */
-export declare function decodeAccessToken(token: string, secret?: string): {
-    [key: string]: any;
-    iss?: string | undefined;
-    sub?: string | undefined;
-    aud?: string | string[] | undefined;
-    exp?: number | undefined;
-    nbf?: number | undefined;
-    iat?: number | undefined;
-    jti?: string | undefined;
-};
+export declare function decodeAccessToken(token: string, secret?: string): Promise<{
+    [propName: string]: unknown;
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    jti?: string;
+    nbf?: number;
+    exp?: number;
+    iat?: number;
+}>;
 /**
  * Extract a Bearer token from the HTTP Authorization header
  * of `req`.

package/dist/auth/token.js

@@ -1,6 +1,6 @@
 import { config } from '@devmoods/config';
 import {} from 'express';
-import jwt from 'jsonwebtoken';
+import { SignJWT, jwtVerify } from 'jose';
 import { v4 } from 'uuid';
 import { InvalidToken } from './errors.js';
 import {} from '../validate.js';
@@ -24,24 +24,24 @@ export function createTokenResponse(accessToken) {
 /**
  * Returns a signed JWT token.
  */
-export function createAccessToken(payload, version = '1', secret = config.AUTH_JWT_SECRET) {
+export async function createAccessToken(payload, version = '1', secret = config.AUTH_JWT_SECRET) {
     const expiresIn = config.AUTH_TOKEN_EXPIRES;
-    const token = jwt.sign({ v: version, ...payload }, secret, {
-        expiresIn,
-    });
+    const secretKey = new TextEncoder().encode(secret);
+    const token = await new SignJWT({ v: version, ...payload })
+        .setProtectedHeader({ alg: 'HS256' })
+        .setExpirationTime(`${expiresIn}s`)
+        .setIssuedAt(new Date())
+        .sign(secretKey);
     return { token, tokenType: 'Bearer', expiresIn };
 }
 /**
  * Decode the given JWT token.
  */
-export function decodeAccessToken(token, secret = config.AUTH_JWT_SECRET) {
+export async function decodeAccessToken(token, secret = config.AUTH_JWT_SECRET) {
     try {
-        const decoded = jwt.verify(token.trim(), secret);
-        /* c8 ignore next 3 */
-        if (typeof decoded === 'string') {
-            throw new Error('decoded value not an object');
-        }
-        return { ...decoded };
+        const secretKey = new TextEncoder().encode(secret);
+        const { payload } = await jwtVerify(token.trim(), secretKey);
+        return { ...payload };
     }
     catch (error) {
         throw new InvalidToken(`Failed to decode auth token: ${error.message}`, {

package/dist/auth.js

@@ -22,7 +22,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
     const useCurrentUser = () => useRequestContext('currentUser');
     const setCurrentUser = (user) => setRequestContext('currentUser', user);
     const login = async (req, res, user, isRefresh = false) => {
-        const accessToken = createAccessToken({ uid: user.id }, sessionTokenVersion);
+        const accessToken = await createAccessToken({ uid: user.id }, sessionTokenVersion);
         const sessionId = sha256(accessToken.token);
         await tokenStorage.set(sessionId, String(user.id), accessToken.expiresIn);
         setAccessTokenCookie(res, accessToken.token);
@@ -138,7 +138,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     await logout(req, res);
                     throw new InvalidToken('session token expired');
                 }
-                const decoded = decodeAccessToken(token);
+                const decoded = await decodeAccessToken(token);
                 if (decoded.v !== sessionTokenVersion) {
                     await logout(req, res);
                     throw new InvalidToken('Invalid token version');

package/dist/faktory.js

@@ -65,6 +65,14 @@ export async function createFaktoryWorker({ queues, jobs, faktory: createFactory
             return job.execute(...args, jobContext);
         });
     }
+    /* c8 ignore start */
+    const onSignal = async (signal) => {
+        logger.info('faktory worker received signal', { signal });
+    };
+    for (const signal of ['SIGTERM', 'SIGINT']) {
+        process.once(signal, onSignal);
+    }
+    /* c8 ignore end */
     return {
         async start(workerOptions = {}) {
             try {

package/dist/middleware.d.ts

@@ -1,5 +1,5 @@
 import { type ServerResponse, type IncomingMessage } from 'node:http';
-import { type NextFunction, type RequestHandler, type Request, type Response, json as jsonParser, urlencoded as urlencodedParser } from 'express';
+import { type NextFunction, type RequestHandler, type Request, type Response, json as jsonParser, urlencoded as urlencodedParser, static as staticMiddleware } from 'express';
 import { type createAuth } from './auth.js';
 import { compose } from './composeMiddleware.js';
 import { type CsrfMiddlewareOptions } from './csrf.js';
@@ -82,3 +82,4 @@ export declare function asyncMiddleware<RequestBody, RequestQuery extends Record
 export declare function withTransaction(wrapper: {
     transaction: (fn: () => Promise<void>) => Promise<void>;
 }): RequestHandler;
+export { staticMiddleware };

package/dist/middleware.js

@@ -3,7 +3,7 @@ import {} from 'node:http';
 import { config } from '@devmoods/config';
 import { startTimer } from '@devmoods/observability';
 import cookieParser from 'cookie-parser';
-import { json as jsonParser, urlencoded as urlencodedParser, } from 'express';
+import { json as jsonParser, urlencoded as urlencodedParser, static as staticMiddleware, } from 'express';
 import helmet from 'helmet';
 import {} from './auth.js';
 import { compose } from './composeMiddleware.js';
@@ -236,3 +236,4 @@ export function withTransaction(wrapper) {
         }
     };
 }
+export { staticMiddleware };

package/dist/router.d.ts

@@ -12,7 +12,7 @@ export type ExtractParams<Path extends string> = Prettify<Path extends `${string
 } & ExtractParams<`/${Rest}`> : Path extends `${string}:${infer Param}` ? {
     [K in Param extends `${infer P}?` ? P : Param]: string;
 } : {}>;
-export type TypedRequestHandler<Params, ResponseBodySchema extends StandardSchemaV1 | undefined, RequestBodySchema extends StandardSchemaV1 | undefined, RequestQuery extends StandardSchemaV1 | undefined, RequestParamsSchema extends StandardSchemaV1 | undefined = undefined> = (req: Request<Params, never, RequestBodySchema extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<RequestBodySchema> : unknown, RequestQuery extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<RequestQuery> : Record<string, string | string[]>>, res: Response<ResponseBodySchema extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<ResponseBodySchema> : unknown>, next: NextFunction) => ResponseWrapper<ResponseBodySchema extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<ResponseBodySchema> : unknown> | Promise<ResponseWrapper<ResponseBodySchema extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<ResponseBodySchema> : unknown>>;
+export type TypedRequestHandler<Params, ResponseBodySchema extends StandardSchemaV1 | undefined, RequestBodySchema extends StandardSchemaV1 | undefined, RequestQuery extends StandardSchemaV1 | undefined, RequestParamsSchema extends StandardSchemaV1 | undefined = undefined> = (req: Request<Params, any, RequestBodySchema extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<RequestBodySchema> : unknown, RequestQuery extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<RequestQuery> : Record<string, string | string[]>>, res: Response<ResponseBodySchema extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<ResponseBodySchema> : unknown>, next: NextFunction) => ResponseWrapper<ResponseBodySchema extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<ResponseBodySchema> : unknown> | Promise<ResponseWrapper<ResponseBodySchema extends StandardSchemaV1<any> ? StandardSchemaV1.InferOutput<ResponseBodySchema> : unknown>>;
 export declare class TypedRouter {
     #private;
     router: import("express-serve-static-core").Router;

package/dist/vite/ssr.js

@@ -2,7 +2,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { config } from '@devmoods/config';
 import express, {} from 'express';
-import { createServer as createViteServer } from 'vite';
+import {} from 'vite';
 import {} from '../composeMiddleware.js';
 import {} from './types.js';
 import { generateCsrfToken } from '../csrf.js';
@@ -16,30 +16,28 @@ import { createFetchRequest } from '../webapi.js';
 export async function createSsrMiddleware({ root = process.cwd(), getInitialData, useDevServer = config.VITE_USE_DEV_SERVER, } = {}) {
     const resolve = (p) => path.resolve(root, p);
     let vite;
+    let render;
+    let assetLinks = { preload: '', css: '', js: '' };
     const middlewares = [];
     if (useDevServer) {
-        vite = await createViteServer({
+        vite = await import('vite').then((mod) => mod.createServer({
             root,
             server: { middlewareMode: true },
             appType: 'custom',
-        });
+        }));
+        render = (await vite.ssrLoadModule('/src/entry-server.tsx')).render;
         middlewares.push(vite.middlewares);
     }
     else {
+        const result = await import(path.join(root, 'dist/server/entry-server.js'));
+        render = result.render;
+        assetLinks = await getAssetLinks(resolve('dist/client/.vite/manifest.json'), 'src/entry-client.tsx');
         middlewares.push(express.static(resolve('dist/client'), { index: false }));
     }
     middlewares.push(route(async (req, res) => {
         try {
-            let render;
-            if (useDevServer) {
-                render = (await vite.ssrLoadModule('/src/entry-server.tsx')).render;
-            }
-            else {
-                const result = await import(path.join(root, 'dist/server/entry-server.js'));
-                render = result.render;
-            }
             const nonce = useCspNonce();
-            const rendered = await render(createFetchRequest(req), {
+            const rendered = await render(createFetchRequest(req, res), {
                 useDevServer,
                 getInitialData: getInitialData || (async () => ({})),
                 placeholders: `
@@ -61,13 +59,6 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
                 publicUrl: new URL(config.PUBLIC_URL),
                 csrfToken: generateCsrfToken(req, res),
             });
-            const readManifest = async () => {
-                if (useDevServer) {
-                    return { preload: '', css: '', js: '' };
-                }
-                const manifestPath = path.resolve(root, 'dist/client/.vite/manifest.json');
-                return getAssetLinks(manifestPath, 'src/entry-client.tsx');
-            };
             let html = rendered.html;
             const context = Object.assign({
                 fouc: `
@@ -76,7 +67,7 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
                 setTimeout(() => { document.getElementById('fouc').remove(); }, 2000);
               </script>
             `,
-            }, rendered.context, await readManifest());
+            }, rendered.context, assetLinks);
             const ssrPlaceholders = Object.fromEntries(Object.entries(context).map(([k, v]) => [`ssr-${k}`, v.toString()]));
             // Add nonce to all bare script tags
             html = html.replace(/<script>/g, `<script nonce="${nonce}">`);

package/dist/webapi.d.ts

@@ -1,3 +1,3 @@
-import { type Request as ExpressRequest } from 'express';
+import { type Request as ExpressRequest, type Response as ExpressResponse } from 'express';
 export declare function createFetchHeaders(requestHeaders: ExpressRequest['headers']): Headers;
-export declare function createFetchRequest(req: ExpressRequest): Request;
+export declare function createFetchRequest(req: ExpressRequest, res: ExpressResponse): Request;

package/dist/webapi.js

@@ -1,5 +1,4 @@
 import {} from 'express';
-import { BadRequest } from './errors.js';
 export function createFetchHeaders(requestHeaders) {
     const headers = new Headers();
     for (const [key, values] of Object.entries(requestHeaders)) {
@@ -17,32 +16,25 @@ export function createFetchHeaders(requestHeaders) {
     }
     return headers;
 }
-export function createFetchRequest(req) {
-    try {
-        const origin = `${req.protocol}://${req.get('host')}`;
-        // Note: This had to take originalUrl into account for presumably vite's proxying
-        /* c8 ignore next 1 */
-        const url = new URL(req.originalUrl || req.url, origin);
-        const controller = new AbortController();
-        /* c8 ignore next 3 */
-        req.on('close', () => {
-            controller.abort();
-        });
-        const init = {
-            method: req.method,
-            headers: createFetchHeaders(req.headers),
-            signal: controller.signal,
-        };
-        if (req.method !== 'GET' && req.method !== 'HEAD') {
-            init.body = req.body;
-        }
-        return new Request(url.href, init);
-        /* c8 ignore next 7 */
-    }
-    catch (error) {
-        if (error instanceof TypeError) {
-            throw BadRequest('Invalid request');
-        }
-        throw error;
+export function createFetchRequest(req, res) {
+    const origin = `${req.protocol}://${req.get('host')}`;
+    /* c8 ignore next 1 */
+    const url = new URL(req.originalUrl || req.url, origin);
+    let controller = new AbortController();
+    const init = {
+        method: req.method,
+        headers: createFetchHeaders(req.headers),
+        signal: controller.signal,
+    };
+    /* c8 ignore next 6 */
+    res.on('finish', () => {
+        controller = null;
+    });
+    res.on('close', () => {
+        controller?.abort();
+    });
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+        init.body = req.body;
     }
+    return new Request(url.href, init);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.66.1",
+  "version": "0.68.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -61,26 +61,25 @@
   "license": "ISC",
   "devDependencies": {
     "@vitejs/plugin-react": "^5.0.4",
-    "arktype": "^2.1.22",
+    "arktype": "^2.1.23",
     "faktory-worker": "^4.7.1",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
-    "vite": "^7.1.9"
+    "vite": "^7.1.11"
   },
   "dependencies": {
     "@devmoods/config": "0.2.0",
     "@devmoods/fetch": "^4.2.0",
     "@devmoods/observability": "0.1.1",
-    "@devmoods/postgres": "0.2.0",
-    "@hey-api/openapi-ts": "^0.85.1",
-    "@sentry/node": "^10.19.0",
-    "@sentry/node-native": "^10.19.0",
-    "@sentry/profiling-node": "^10.19.0",
+    "@devmoods/postgres": "0.2.1",
+    "@hey-api/openapi-ts": "^0.86.1",
+    "@sentry/node": "^10.21.0",
+    "@sentry/node-native": "^10.21.0",
+    "@sentry/profiling-node": "^10.21.0",
     "@standard-schema/spec": "^1.0.0",
     "@types/bcrypt": "^6.0.0",
     "@types/cookie-parser": "^1.4.9",
     "@types/express": "^5.0.3",
-    "@types/jsonwebtoken": "^9.0.10",
     "@types/koa-compose": "^3.2.8",
     "@types/nodemailer": "^7.0.2",
     "@types/qs": "^6.14.0",
@@ -92,9 +91,9 @@
     "cookie-parser": "^1.4.7",
     "dotenv": "^17.2.3",
     "express": "^4.21.2",
-    "google-auth-library": "^10.4.0",
+    "google-auth-library": "^10.4.1",
     "helmet": "^8.1.0",
-    "jsonwebtoken": "^9.0.2",
+    "jose": "^6.1.0",
     "nodemailer": "^7.0.9",
     "redis": "^5.8.3",
     "sonda": "^0.9.0",
@@ -112,5 +111,5 @@
   "engines": {
     "node": ">=20 <25"
   },
-  "gitHead": "cc2eac4d3a68e9d2530ccffddaff0eee190381d0"
+  "gitHead": "721a709c087904a5cc1332d28a62857a82295fea"
 }