@devmoods/express-extras 0.76.1 → 0.77.0

package/dist/auth/contentNegotiation.d.ts

@@ -0,0 +1,2 @@
+import { type Request } from 'express';
+export declare function prefersHtml(req: Request): boolean;

package/dist/auth/contentNegotiation.js

@@ -0,0 +1,9 @@
+import {} from 'express';
+const explicitHtmlPattern = /(?:^|,)\s*text\/html\s*(?:;|,|$)/i;
+export function prefersHtml(req) {
+    const accept = req.get('accept');
+    if (!accept || !explicitHtmlPattern.test(accept)) {
+        return false;
+    }
+    return req.accepts(['html', 'json']) === 'html';
+}

package/dist/auth/google.js

@@ -1,5 +1,6 @@
 import { config } from '@devmoods/config';
 import { type } from 'arktype';
+import { prefersHtml } from './contentNegotiation.js';
 import { exchangeGoogleAuthorizationCode, verifyGoogleIdToken, } from './google-client.js';
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
@@ -99,7 +100,7 @@ export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, cl
                 });
                 const accessToken = await context.login(req, res, user);
                 logger.info('google-login', { email: user.email });
-                if (req.accepts('html')) {
+                if (prefersHtml(req)) {
                     return res.redirect('/');
                 }
                 return createTokenResponse(accessToken);

package/dist/auth/passwordless.js

@@ -1,5 +1,6 @@
 import * as crypto from 'node:crypto';
 import { DoesNotExistError } from '@devmoods/postgres';
+import { prefersHtml } from './contentNegotiation.js';
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
 import { BadRequest } from '../errors.js';
@@ -53,7 +54,7 @@ export function PasswordlessAuthProvider(options) {
                 }
                 const accessToken = await context.login(req, res, user);
                 logger.info('passwordless login', { tokenType, uid: user.id });
-                if (req.accepts('html')) {
+                if (prefersHtml(req)) {
                     return res.redirect('/');
                 }
                 return createTokenResponse(accessToken);

package/dist/auth/tokenStorage.d.ts

@@ -4,13 +4,13 @@ export declare class RedisTokenStorage extends TokenStorage {
     redis: RedisClient;
     keyPrefix: string;
     constructor(redis: RedisClient, keyPrefix?: string);
-    set(token: string, userId: string, expiresIn: number): Promise<void>;
+    set(token: string, userId: string, expiresInSeconds: number): Promise<void>;
     get(token: string): Promise<string | null>;
     invalidate(token: string): Promise<void>;
 }
 export declare class MemoryTokenStorage extends TokenStorage {
     #private;
-    set(token: string, userId: string, expiresIn: number): Promise<void>;
+    set(token: string, userId: string, expiresInSeconds: number): Promise<void>;
     get(token: string): Promise<string | null>;
     invalidate(token: string): Promise<void>;
 }

package/dist/auth/tokenStorage.js

@@ -9,9 +9,9 @@ export class RedisTokenStorage extends TokenStorage {
         this.redis = redis;
         this.keyPrefix = keyPrefix;
     }
-    async set(token, userId, expiresIn) {
+    async set(token, userId, expiresInSeconds) {
         await this.redis.set(`${this.keyPrefix}${token}`, userId, {
-            EX: expiresIn,
+            EX: expiresInSeconds,
         });
     }
     async get(token) {
@@ -23,8 +23,8 @@ export class RedisTokenStorage extends TokenStorage {
 }
 export class MemoryTokenStorage extends TokenStorage {
     #tokens = new Map();
-    async set(token, userId, expiresIn) {
-        this.#tokens.set(token, [userId, Date.now() + expiresIn]);
+    async set(token, userId, expiresInSeconds) {
+        this.#tokens.set(token, [userId, Date.now() + expiresInSeconds * 1000]);
     }
     async get(token) {
         const entry = this.#tokens.get(token);

package/dist/auth/types.d.ts

@@ -6,7 +6,8 @@ export interface AnyUser {
     [key: string]: any;
 }
 export declare abstract class TokenStorage {
-    abstract set(token: string, userId: string, expiresIn: number): Promise<void>;
+    /** Store a token for the given number of seconds. */
+    abstract set(token: string, userId: string, expiresInSeconds: number): Promise<void>;
     abstract get(token: string): Promise<string | null>;
     abstract invalidate(token: string): Promise<void>;
 }

package/dist/auth.js

@@ -1,6 +1,7 @@
 import * as crypto from 'node:crypto';
 import { config } from '@devmoods/config';
 import {} from 'express';
+import { prefersHtml } from './auth/contentNegotiation.js';
 import { InvalidToken, PermissionDenied } from './auth/errors.js';
 import { createAccessToken, decodeAccessToken, extractAccessTokenFromRequest, setAccessTokenCookie, tokenSchema, } from './auth/token.js';
 import {} from './auth/types.js';
@@ -35,20 +36,26 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         const accessToken = await createAccessToken({ uid: user.id }, sessionTokenVersion);
         const sessionId = sha256(accessToken.token);
         await tokenStorage.set(sessionId, String(user.id), accessToken.expiresIn);
+        try {
+            if (!isRefresh) {
+                await onUserLoggedIn?.(user, {
+                    /* v8 ignore start -- @preserve */
+                    ip: req.ip ?? '',
+                    userAgent: req.headers['user-agent'] ?? '',
+                    /* v8 ignore end -- @preserve */
+                    sessionId,
+                });
+            }
+        }
+        catch (error) {
+            await tokenStorage.invalidate(sessionId);
+            throw error;
+        }
         if (previousSessionId && previousSessionId !== sessionId) {
             await tokenStorage.invalidate(previousSessionId);
         }
         setAccessTokenCookie(res, accessToken.token);
         setCurrentUser(user);
-        if (!isRefresh) {
-            await onUserLoggedIn?.(user, {
-                /* v8 ignore start -- @preserve */
-                ip: req.ip ?? '',
-                userAgent: req.headers['user-agent'] ?? '',
-                /* v8 ignore end -- @preserve */
-                sessionId,
-            });
-        }
         return accessToken;
     };
     const logout = async (req, res) => {
@@ -171,7 +178,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                 logger.error(error);
                 /* v8 ignore next -- @preserve */
                 if (error instanceof InvalidToken) {
-                    if (req.accepts('html')) {
+                    if (prefersHtml(req)) {
                         return res.redirect(loginUrl);
                     }
                     return next(Unauthorized('Invalid token', { cause: error }));
@@ -197,14 +204,14 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             catch (error) {
                 logger.error(error);
                 if (error instanceof PermissionDenied) {
-                    if (req.accepts('html')) {
+                    if (prefersHtml(req)) {
                         return res.redirect(loginUrl);
                     }
                     return next(Forbidden('Permission denied', { cause: error }));
                 }
                 /* v8 ignore next -- @preserve */
                 if (error instanceof InvalidToken) {
-                    if (req.accepts('html')) {
+                    if (prefersHtml(req)) {
                         return res.redirect(loginUrl);
                     }
                     return next(Unauthorized(`Invalid token: ${error.message}`, { cause: error }));
@@ -265,19 +272,19 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
      */
     async function createTemporaryToken(user) {
         try {
-            const uid = user === null ? 'anonymous' : user.id;
+            const uid = user === null ? 'anonymous' : String(user.id ?? '');
+            if (!uid) {
+                throw new Error('User ID is required to create a token');
+            }
             const randomBytes = crypto.randomBytes(32).toString('hex');
-            const payload = { v: '1', uid: uid, r: randomBytes };
+            const payload = { v: '1', uid, r: randomBytes };
             const signature = crypto
                 .createHmac('sha256', config.AUTH_JWT_SECRET)
                 .update(JSON.stringify(payload))
                 .digest('base64')
                 .slice(0, 12);
-            if (!uid) {
-                throw new Error('User ID is required to create a token');
-            }
             const temporaryToken = Buffer.from(JSON.stringify({ payload, signature })).toString('base64url');
-            await tokenStorage.set(temporaryToken, String(uid), config.AUTH_TEMP_TOKEN_EXPIRES);
+            await tokenStorage.set(temporaryToken, uid, config.AUTH_TEMP_TOKEN_EXPIRES);
             return temporaryToken;
         }
         catch (error) {
@@ -304,14 +311,14 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         if (expectedSignature !== decoded.signature) {
             throw new InvalidToken('Invalid signature');
         }
-        if (user !== null && decoded.payload.uid !== user.id) {
+        if (user !== null && decoded.payload.uid !== String(user.id)) {
             throw new InvalidToken(`Invalid user ${user.id}`);
         }
         const storedUid = await tokenStorage.get(token);
         if (!storedUid) {
             throw new InvalidToken('Invalid token not found');
         }
-        if (user !== null && storedUid !== user.id) {
+        if (user !== null && storedUid !== String(user.id)) {
             throw new InvalidToken(`Invalid user ${user.id}`);
         }
         if (consume) {

package/dist/cache.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { config } from '@devmoods/config';
 import {} from './redis.js';
 const MAX_CACHE_KEY_SIZE_BYTES = 256;
@@ -123,11 +124,10 @@ export function createCache(adapter) {
         return result;
     }
     function cachedFn(options, fn) {
+        const explicitKey = typeof options === 'object' && options != null ? options.key : undefined;
+        const baseKey = explicitKey ?? randomUUID();
         const getCacheKey = (...args) => {
-            const baseKey = typeof options === 'object' && options != null
-                ? options.key
-                : undefined;
-            const cacheKey = `${baseKey ?? Buffer.from(fn.toString()).toString('hex')}-${hashKey(args)}`;
+            const cacheKey = `${baseKey}-${hashKey(args)}`;
             assertCacheKeySize(cacheKey);
             return cacheKey;
         };

package/dist/channels.d.ts

@@ -1,3 +1,4 @@
+import { type Postgres } from '@devmoods/postgres';
 import { type StandardSchemaV1 } from '@standard-schema/spec';
 import { type Request } from 'express';
 import { type RedisClient } from './redis.js';
@@ -7,18 +8,40 @@ export interface EventStreamSseOptions<Schema extends StandardSchemaV1> {
     getIdFromMessage?: (message: StandardSchemaV1.InferOutput<Schema>) => string | undefined;
 }
 export interface EventStreamSubscriber {
+    /** Subscribe to logical channel names; any transport-specific prefixes belong to the backend. */
     subscribe: (channels: string[], listener: (message: string) => void) => Promise<void>;
     close: () => void;
 }
 export interface EventStreamBackend {
-    publish: (channel: string, message: string) => Promise<number>;
+    /** Publish to a logical channel, returning a subscriber count when the backend provides one. */
+    publish: (channel: string, message: string) => Promise<number | void>;
     createSubscriber: () => Promise<EventStreamSubscriber>;
 }
+/** In-process Pub/Sub. Share an instance to share channels; messages are not retained. */
+export declare class MemoryEventStreamBackend implements EventStreamBackend {
+    private subscribers;
+    publish(channel: string, message: string): Promise<number>;
+    createSubscriber(): Promise<EventStreamSubscriber>;
+}
 export declare class RedisEventStreamBackend implements EventStreamBackend {
     redis: RedisClient;
+    private keyPrefix;
     constructor(redis: RedisClient);
     publish(channel: string, message: string): Promise<number>;
-    createSubscriber(): Promise<RedisClient>;
+    createSubscriber(): Promise<EventStreamSubscriber>;
+}
+export interface PostgresEventStreamBackendOptions {
+    /** Isolate streams sharing a database. Defaults to "events". */
+    namespace?: string;
+}
+/** LISTEN/NOTIFY Pub/Sub. Each subscriber holds a pool connection until closed. */
+export declare class PostgresEventStreamBackend implements EventStreamBackend {
+    private postgres;
+    private namespace;
+    constructor(postgres: Postgres, { namespace }?: PostgresEventStreamBackendOptions);
+    private channelName;
+    publish(channel: string, message: string): Promise<void>;
+    createSubscriber(): Promise<EventStreamSubscriber>;
 }
 export interface EventStreamOptions<Schema extends StandardSchemaV1> {
     schema: Schema;
@@ -26,6 +49,6 @@ export interface EventStreamOptions<Schema extends StandardSchemaV1> {
 }
 export declare function createEventStream<Channels extends string, Schema extends StandardSchemaV1>(backend: EventStreamBackend, options: EventStreamOptions<Schema>): {
     sse: <const Path extends string>({ channels, getIdFromMessage, }: EventStreamSseOptions<Schema>) => TypedRequestHandler<ExtractParams<Path>, any, any, any>;
-    publish: (channel: Channels, message: StandardSchemaV1.InferOutput<Schema>) => Promise<number>;
+    publish: (channel: Channels, message: StandardSchemaV1.InferOutput<Schema>) => Promise<number | void>;
     close: () => Promise<void>;
 };

package/dist/channels.js

@@ -1,4 +1,6 @@
+import { createHash } from 'node:crypto';
 import { config } from '@devmoods/config';
+import { escapePostgresIdentifier } from '@devmoods/postgres';
 import {} from '@standard-schema/spec';
 import {} from 'express';
 import { requestContext } from './context.js';
@@ -14,13 +16,59 @@ const defaultGetIdFromMessage = (message) => {
     }
     return undefined;
 };
+/** In-process Pub/Sub. Share an instance to share channels; messages are not retained. */
+export class MemoryEventStreamBackend {
+    subscribers = new Set();
+    async publish(channel, message) {
+        const deliveries = [...this.subscribers].map((subscriptions) => [
+            ...(subscriptions.get(channel) ?? []),
+        ]);
+        let count = 0;
+        for (const listeners of deliveries) {
+            if (listeners.length > 0) {
+                count++;
+                for (const listener of listeners) {
+                    listener(message);
+                }
+            }
+        }
+        return count;
+    }
+    async createSubscriber() {
+        const subscriptions = new Map();
+        let closed = false;
+        return {
+            subscribe: async (channels, listener) => {
+                if (closed) {
+                    throw new Error('Subscriber is closed');
+                }
+                for (const channel of channels) {
+                    let listeners = subscriptions.get(channel);
+                    if (!listeners) {
+                        listeners = new Set();
+                        subscriptions.set(channel, listeners);
+                    }
+                    listeners.add(listener);
+                }
+                this.subscribers.add(subscriptions);
+            },
+            close: () => {
+                closed = true;
+                this.subscribers.delete(subscriptions);
+                subscriptions.clear();
+            },
+        };
+    }
+}
 export class RedisEventStreamBackend {
     redis;
+    keyPrefix;
     constructor(redis) {
         this.redis = redis;
+        this.keyPrefix = `${config.REDIS_KEY_PREFIX}events:`;
     }
     publish(channel, message) {
-        return this.redis.publish(channel, message);
+        return this.redis.publish(`${this.keyPrefix}${channel}`, message);
     }
     async createSubscriber() {
         const subscriber = this.redis.duplicate();
@@ -29,23 +77,181 @@ export class RedisEventStreamBackend {
             logger.error(error);
         });
         await subscriber.connect();
-        return subscriber;
+        let closed = false;
+        return {
+            subscribe: async (channels, listener) => {
+                if (closed) {
+                    throw new Error('Subscriber is closed');
+                }
+                return subscriber.subscribe(channels.map((channel) => `${this.keyPrefix}${channel}`), listener);
+            },
+            close: () => {
+                if (closed) {
+                    return;
+                }
+                closed = true;
+                subscriber.close();
+            },
+        };
+    }
+}
+/** LISTEN/NOTIFY Pub/Sub. Each subscriber holds a pool connection until closed. */
+export class PostgresEventStreamBackend {
+    postgres;
+    namespace;
+    constructor(postgres, { namespace = 'events' } = {}) {
+        this.postgres = postgres;
+        this.namespace = namespace;
+    }
+    channelName(channel) {
+        // Keep arbitrary logical channels within PostgreSQL's 63-byte identifier limit.
+        const hash = createHash('sha256')
+            .update(JSON.stringify([this.namespace, channel]))
+            .digest('base64url');
+        return `events_${hash}`;
+    }
+    async publish(channel, message) {
+        if (Buffer.byteLength(message, 'utf8') >= 8000) {
+            throw new RangeError('Postgres event messages must be smaller than 8000 bytes');
+        }
+        // Use the wrapper so notifications participate in the current transaction.
+        await this.postgres.query('SELECT pg_notify($1, $2)', [
+            this.channelName(channel),
+            message,
+        ]);
+    }
+    async createSubscriber() {
+        // LISTEN needs its own session, independent of request transactions.
+        const client = await this.postgres.getCurrentPool().connect();
+        const subscriptions = new Map();
+        let closed = false;
+        const onNotification = (notification) => {
+            for (const listener of [
+                ...(subscriptions.get(notification.channel) ?? []),
+            ]) {
+                listener(notification.payload ?? '');
+            }
+        };
+        const close = () => {
+            if (closed) {
+                return;
+            }
+            closed = true;
+            subscriptions.clear();
+            client.off('notification', onNotification);
+            client.off('error', onError);
+            client.off('end', close);
+            // Destroy the session so LISTEN state can never leak to another pool user.
+            client.release(true);
+        };
+        const onError = (error) => {
+            logger.error(error);
+            close();
+        };
+        client.on('notification', onNotification);
+        client.on('error', onError);
+        client.on('end', close);
+        return {
+            subscribe: async (channels, listener) => {
+                if (closed) {
+                    throw new Error('Subscriber is closed');
+                }
+                try {
+                    for (const channel of new Set(channels.map((value) => this.channelName(value)))) {
+                        let listeners = subscriptions.get(channel);
+                        if (!listeners) {
+                            listeners = new Set();
+                            subscriptions.set(channel, listeners);
+                        }
+                        listeners.add(listener);
+                        // Repeating LISTEN is harmless and also awaits concurrent subscriptions.
+                        await client.query(`LISTEN ${escapePostgresIdentifier(channel)}`);
+                        if (closed) {
+                            throw new Error('Subscriber is closed');
+                        }
+                    }
+                }
+                catch (error) {
+                    close();
+                    throw error;
+                }
+            },
+            close,
+        };
     }
 }
 export function createEventStream(backend, options) {
-    const keyPrefix = `${config.REDIS_KEY_PREFIX}events:`;
-    const withKeyPrefix = (key) => `${keyPrefix}${key}`;
     const subscribers = new Set();
     const sse = ({ channels, getIdFromMessage = defaultGetIdFromMessage, }) => {
         return async (req, res, next) => {
+            let subscriber;
+            let subscriberClosed = false;
+            let heartbeat;
+            let closed = false;
+            const state = {
+                draining: false,
+                queue: [],
+                maxQueue: 1000,
+            };
+            const store = requestContext.getStore();
+            const closeSubscriber = () => {
+                if (!subscriber || subscriberClosed) {
+                    return;
+                }
+                subscriberClosed = true;
+                subscriber.close();
+            };
+            const close = () => {
+                if (closed) {
+                    closeSubscriber();
+                    return;
+                }
+                closed = true;
+                requestContext.run(store, () => {
+                    logger.info('event stream close');
+                    if (heartbeat) {
+                        clearInterval(heartbeat);
+                    }
+                    closeSubscriber();
+                });
+            };
+            const gracefulClose = () => {
+                /* v8 ignore next -- @preserve */
+                if (closed) {
+                    return;
+                }
+                /* v8 ignore next -- @preserve */
+                if (!res.writableEnded) {
+                    writeChunk(res, 'event: close\ndata: shutdown\n\n', state);
+                    res.end();
+                }
+                close();
+            };
+            const cleanup = () => {
+                res.off('close', cleanup);
+                res.off('finish', cleanup);
+                req.off('aborted', cleanup);
+                req.socket.off('error', cleanup);
+                subscribers.delete(gracefulClose);
+                close();
+            };
+            const isDisconnected = () => closed || req.aborted || res.destroyed || res.writableEnded;
+            subscribers.add(gracefulClose);
+            res.on('close', cleanup);
+            res.on('finish', cleanup);
+            req.on('aborted', cleanup);
+            req.socket.on('error', cleanup);
             try {
-                const subscriber = await backend.createSubscriber();
-                const heartbeat = setInterval(() => {
+                subscriber = await backend.createSubscriber();
+                if (isDisconnected()) {
+                    cleanup();
+                    return;
+                }
+                heartbeat = setInterval(() => {
                     try {
                         /* v8 ignore next -- @preserve */
                         if (!res.writableEnded) {
-                            writeChunk(res, 'event: heartbeat\n', state);
-                            writeChunk(res, 'data: ping\n\n', state);
+                            writeChunk(res, 'event: heartbeat\ndata: ping\n\n', state);
                         }
                     }
                     catch (error) {
@@ -53,23 +259,14 @@ export function createEventStream(backend, options) {
                         logger.error(error);
                     }
                 }, options.heartbeatInterval ?? 15000);
-                const state = {
-                    draining: false,
-                    queue: [],
-                    maxQueue: 1000,
-                };
-                const store = requestContext.getStore();
                 const listener = (value) => {
                     try {
                         requestContext.run(store, () => {
                             /* v8 ignore next -- @preserve */
                             if (!res.writableEnded) {
                                 const id = getIdFromMessage?.(value);
-                                if (id) {
-                                    writeChunk(res, `id: ${id}\n`, state);
-                                }
-                                writeChunk(res, 'event: data\n', state);
-                                writeChunk(res, `data: ${JSON.stringify(value)}\n\n`, state);
+                                const event = `${id ? `id: ${id}\n` : ''}event: data\ndata: ${JSON.stringify(value)}\n\n`;
+                                writeChunk(res, event, state);
                             }
                         });
                     }
@@ -79,7 +276,11 @@ export function createEventStream(backend, options) {
                     }
                 };
                 const _channels = await channels(req);
-                await subscriber.subscribe(_channels.map(withKeyPrefix), (message) => {
+                if (isDisconnected()) {
+                    cleanup();
+                    return;
+                }
+                await subscriber.subscribe(_channels, (message) => {
                     let parsedMessage;
                     try {
                         parsedMessage = JSON.parse(message);
@@ -93,6 +294,10 @@ export function createEventStream(backend, options) {
                         listener(parsedMessage);
                     }
                 });
+                if (isDisconnected()) {
+                    cleanup();
+                    return;
+                }
                 logger.info('event stream subscribe', { channels: _channels });
                 const headers = {
                     'Content-Type': 'text/event-stream',
@@ -102,49 +307,19 @@ export function createEventStream(backend, options) {
                 };
                 res.writeHead(200, headers);
                 writeChunk(res, 'retry: 10000\n', state);
-                let closed = false;
-                const close = () => {
-                    if (closed) {
-                        return;
-                    }
-                    closed = true;
-                    requestContext.run(store, () => {
-                        logger.info('event stream close');
-                        clearInterval(heartbeat);
-                        subscriber.close();
-                    });
-                };
-                const gracefulClose = () => {
-                    /* v8 ignore next -- @preserve */
-                    if (closed) {
-                        return;
-                    }
-                    /* v8 ignore next -- @preserve */
-                    if (!res.writableEnded) {
-                        writeChunk(res, 'event: close\n', state);
-                        writeChunk(res, 'data: shutdown\n\n', state);
-                        res.end();
-                    }
-                    close();
-                };
-                subscribers.add(gracefulClose);
-                const cleanup = () => {
-                    subscribers.delete(gracefulClose);
-                    close();
-                };
-                res.on('close', cleanup);
-                res.on('finish', cleanup);
-                req.on('aborted', cleanup);
-                req.socket.on('error', cleanup);
             }
             catch (error) {
+                const disconnected = isDisconnected();
+                cleanup();
                 /* v8 ignore next -- @preserve */
-                next(error);
+                if (!disconnected) {
+                    next(error);
+                }
             }
         };
     };
     const publish = (channel, message) => {
-        return backend.publish(withKeyPrefix(channel), JSON.stringify(message));
+        return backend.publish(channel, JSON.stringify(message));
     };
     const close = async () => {
         for (const closeSubscriber of subscribers) {

package/dist/cli.js

@@ -36,6 +36,7 @@ export class CLI {
             }
             catch (error) {
                 this.redLine(error.message);
+                process.exitCode = 1;
                 /* v8 ignore next -- @preserve */
                 if (this.options.printStackTraces) {
                     this.writeLine('\nStack trace:\n', stderr);