@everystack/server 0.1.0

package/src/cdn/features.ts

@@ -0,0 +1,220 @@
+/**
+ * Built-in CFF features. Each factory returns a Feature suitable for
+ * composeViewerRequest.
+ *
+ * Ordering convention (lower runs first):
+ *   - cache-key: 10  (normalize URI/querystring before anything else uses them)
+ *   - geo:       50  (set headers / block by country before auth gates)
+ *   - auth:      80  (last gate before forwarding to origin)
+ */
+
+import { generateCffVerifier, generateCompactCffVerifier } from '@everystack/auth/cff';
+import type { Feature } from './compose';
+
+// ---------- auth ----------
+
+export type Role = string;
+
+export interface AuthRoleEntry {
+  /** Read role required (GET/HEAD). */
+  r: Role;
+  /** Write role required (POST/PUT/PATCH/DELETE). */
+  w: Role;
+}
+
+export interface AuthFeatureOptions {
+  /** HS256 secret — same secret your Lambda mints with. */
+  secret: string;
+  /**
+   * Path prefixes that bypass auth entirely. Default:
+   * ['/api/auth/', '/api/health', '/api/updates', '/api/storage/public'].
+   */
+  publicPaths?: string[];
+  /**
+   * Optional role table. Keyed by table name extracted from /api/<table>/...
+   * Use '*' for default. Requires `tableFromPath: true`.
+   */
+  roles?: Record<string, AuthRoleEntry>;
+  /** Role hierarchy, weakest first. Required when `roles` is set. */
+  roleHierarchy?: Role[];
+  /**
+   * Extract table name from `/api/<table>/...` for role lookup. Default false.
+   */
+  tableFromPath?: boolean;
+  /** Allowed clock skew (seconds). Default 30. */
+  clockSkewSec?: number;
+  /**
+   * Cookie name to check as fallback when no Authorization header is present.
+   * Enables SSR cookie-based auth alongside mobile Bearer tokens.
+   * Set to `false` to disable cookie fallback. Default: `'__es_token'`.
+   */
+  cookieName?: string | false;
+  /**
+   * Use compact verifier (~1.1KB vs ~2.3KB minified). ASCII-only claim values.
+   * Safe for standard JWT claims (sub, role, email, exp, iat). Default false.
+   */
+  compact?: boolean;
+  /** Override `order`. Default 80 (last). */
+  order?: number;
+}
+
+const DEFAULT_AUTH_PUBLIC = [
+  '/api/auth/',
+  '/api/health',
+  '/api/updates',
+  '/api/storage/public',
+];
+
+export function authFeature(opts: AuthFeatureOptions): Feature {
+  const publicPaths = opts.publicPaths ?? DEFAULT_AUTH_PUBLIC;
+  const roles = opts.roles ?? null;
+  const hierarchy = opts.roleHierarchy ?? null;
+  const tableFromPath = opts.tableFromPath === true;
+  const cookieName = opts.cookieName !== false ? (opts.cookieName ?? '__es_token') : '';
+
+  if (roles && !hierarchy) {
+    throw new Error('authFeature: roleHierarchy is required when roles is set');
+  }
+
+  const verifierSrc = opts.compact
+    ? generateCompactCffVerifier({ clockSkewSec: opts.clockSkewSec })
+    : generateCffVerifier({ clockSkewSec: opts.clockSkewSec });
+
+  // Cookie fallback block — only emitted when cookieName is set.
+  const cookieBlock = cookieName
+    ? `
+  if (!__auth_h || __auth_h.indexOf('Bearer ') !== 0) {
+    var __auth_ck = __auth_req.cookies && __auth_req.cookies[__auth_cookieName];
+    if (__auth_ck) __auth_h = 'Bearer ' + __auth_ck.value;
+  }`
+    : '';
+
+  return {
+    name: 'auth',
+    order: opts.order ?? 80,
+    helpers: {
+      // The whole verifier source emits multiple top-level fns; key it as
+      // 'jwt' so re-registration with identical source is idempotent.
+      jwt: verifierSrc,
+    },
+    state: {
+      secret: opts.secret,
+      publicPaths,
+      roles: roles ?? {},
+      hierarchy: hierarchy ?? [],
+      tableFromPath,
+      cookieName,
+    },
+    body: `
+function __auth_isPublic(uri) {
+  for (var i = 0; i < __auth_publicPaths.length; i++) {
+    var p = __auth_publicPaths[i];
+    if (uri === p || uri.indexOf(p) === 0) return true;
+  }
+  return false;
+}
+function __auth_roleLevel(role) {
+  for (var i = 0; i < __auth_hierarchy.length; i++) {
+    if (__auth_hierarchy[i] === role) return i;
+  }
+  return -1;
+}
+function __auth_required(uri, method) {
+  if (!__auth_tableFromPath) return null;
+  var m = uri.match(/^\\/api\\/([^\\/?]+)/);
+  if (!m) return 'public';
+  var entry = __auth_roles[m[1]] || __auth_roles['*'];
+  if (!entry) return null;
+  return (method === 'GET' || method === 'HEAD') ? entry.r : entry.w;
+}
+function __auth_reject(status, message) {
+  return { statusCode: status, statusDescription: status === 401 ? 'Unauthorized' : 'Forbidden', headers: { 'content-type': { value: 'application/json' }, 'cache-control': { value: 'no-store' } }, body: { encoding: 'text', data: JSON.stringify({ message: message }) } };
+}
+var __auth_req = event.request;
+var __auth_uri = __auth_req.uri;
+var __auth_method = __auth_req.method;
+var __auth_reqRole = __auth_required(__auth_uri, __auth_method);
+if (!__auth_isPublic(__auth_uri) && __auth_reqRole !== 'public') {
+  var __auth_h = __auth_req.headers.authorization && __auth_req.headers.authorization.value;${cookieBlock}
+  if (!__auth_h || __auth_h.indexOf('Bearer ') !== 0) return __auth_reject(401, 'Authentication required');
+  var __auth_claims = verifyJwt(__auth_h.slice(7), __auth_secret);
+  if (!__auth_claims) return __auth_reject(401, 'Invalid or expired token');
+  if (__auth_reqRole && __auth_reqRole !== 'authenticated') {
+    var __auth_userRole = __auth_claims.role || 'authenticated';
+    if (__auth_roleLevel(__auth_userRole) < __auth_roleLevel(__auth_reqRole)) return __auth_reject(403, 'Insufficient role');
+  }
+}
+`,
+  };
+}
+
+// ---------- geo ----------
+
+export interface GeoFeatureOptions {
+  /** ISO 3166-1 alpha-2 codes to block with HTTP 451. Default: none. */
+  blockedCountries?: string[];
+  /** Override `order`. Default 50. */
+  order?: number;
+}
+
+export function geoFeature(opts: GeoFeatureOptions = {}): Feature {
+  const blocked = opts.blockedCountries ?? [];
+  return {
+    name: 'geo',
+    order: opts.order ?? 50,
+    state: { blocked },
+    body: `
+var __geo_h = event.request.headers;
+var __geo_country = __geo_h['cloudfront-viewer-country'] && __geo_h['cloudfront-viewer-country'].value;
+var __geo_region = __geo_h['cloudfront-viewer-country-region'] && __geo_h['cloudfront-viewer-country-region'].value;
+var __geo_city = __geo_h['cloudfront-viewer-city'] && __geo_h['cloudfront-viewer-city'].value;
+if (__geo_country) __geo_h['x-geo-country'] = { value: __geo_country };
+if (__geo_region) __geo_h['x-geo-region'] = { value: __geo_region };
+if (__geo_city) __geo_h['x-geo-city'] = { value: __geo_city };
+if (__geo_country && __geo_blocked.length) {
+  for (var __geo_i = 0; __geo_i < __geo_blocked.length; __geo_i++) {
+    if (__geo_blocked[__geo_i] === __geo_country) {
+      return { statusCode: 451, statusDescription: 'Unavailable For Legal Reasons', headers: { 'content-type': { value: 'application/json' } }, body: { encoding: 'text', data: JSON.stringify({ message: 'Service not available in your region' }) } };
+    }
+  }
+}
+`,
+  };
+}
+
+// ---------- cache-key ----------
+
+export interface CacheKeyFeatureOptions {
+  /**
+   * Allowlist of querystring params to retain in the cache key. All other
+   * params are stripped. When omitted, all params are kept (no-op).
+   */
+  allowedQueryParams?: string[];
+  /** Override `order`. Default 10. */
+  order?: number;
+}
+
+export function cacheKeyFeature(opts: CacheKeyFeatureOptions = {}): Feature {
+  const allowed = opts.allowedQueryParams;
+  if (!allowed || allowed.length === 0) {
+    return {
+      name: 'cacheKey',
+      order: opts.order ?? 10,
+      body: '/* cache-key: no allowlist, no-op */',
+    };
+  }
+  return {
+    name: 'cacheKey',
+    order: opts.order ?? 10,
+    state: { allowed },
+    body: `
+var __ck_qs = event.request.querystring;
+var __ck_kept = {};
+for (var __ck_i = 0; __ck_i < __cacheKey_allowed.length; __ck_i++) {
+  var __ck_k = __cacheKey_allowed[__ck_i];
+  if (__ck_qs[__ck_k]) __ck_kept[__ck_k] = __ck_qs[__ck_k];
+}
+event.request.querystring = __ck_kept;
+`,
+  };
+}

package/src/cdn/index.ts

@@ -0,0 +1,77 @@
+/**
+ * @everystack/server/cdn — CloudFront edge composition.
+ *
+ * Two surfaces:
+ *   1. `createAuthFunction(...)` — single-feature shortcut (back-compat).
+ *      Generates an `injection` for sst.aws.Router edge.viewerRequest that
+ *      verifies HS256 JWTs at the edge.
+ *   2. `composeViewerRequest({ features: [...] })` — multi-feature composer.
+ *      Combine `authFeature`, `geoFeature`, `cacheKeyFeature` (or your own)
+ *      into a single CFF source with shared helpers, namespaced state, a
+ *      fail-closed try/catch wrapper, safe minification, and a 10 KB budget.
+ *
+ * The emitted code uses ONLY ES2019 + crypto.createHmac — no Buffer,
+ * TextEncoder, or any Node API. Runs unmodified inside CloudFront Functions
+ * runtime 2.0.
+ */
+
+import { composeViewerRequest } from './compose';
+import { authFeature, type AuthFeatureOptions, type AuthRoleEntry, type Role } from './features';
+
+export {
+  composeViewerRequest,
+  type ComposeOptions,
+  type ComposeResult,
+  type Feature,
+  minifyCff,
+} from './compose';
+export {
+  authFeature,
+  geoFeature,
+  cacheKeyFeature,
+  type AuthFeatureOptions,
+  type AuthRoleEntry,
+  type GeoFeatureOptions,
+  type CacheKeyFeatureOptions,
+  type Role,
+} from './features';
+
+// ---------- Back-compat: createAuthFunction ----------
+
+export interface RoleEntry extends AuthRoleEntry {}
+
+export interface AuthFunctionConfig {
+  /** HS256 secret — same secret your Lambda uses to mint tokens. */
+  secret: string;
+  publicPaths?: string[];
+  roles?: Record<string, RoleEntry>;
+  roleHierarchy?: Role[];
+  tableFromPath?: boolean;
+  clockSkewSec?: number;
+  /** Cookie name for SSR auth fallback. Default: '__es_token'. Set false to disable. */
+  cookieName?: string | false;
+}
+
+export interface AuthFunctionResult {
+  /** Inject body for sst.aws.Router edge.viewerRequest.injection. */
+  injection: string;
+}
+
+/**
+ * Single-feature auth shortcut. Equivalent to
+ *   composeViewerRequest({ features: [authFeature(config)] }).code
+ * Kept for back-compat with existing SST configs.
+ */
+export function createAuthFunction(config: AuthFunctionConfig): AuthFunctionResult {
+  const opts: AuthFeatureOptions = {
+    secret: config.secret,
+    publicPaths: config.publicPaths,
+    roles: config.roles,
+    roleHierarchy: config.roleHierarchy,
+    tableFromPath: config.tableFromPath,
+    clockSkewSec: config.clockSkewSec,
+    cookieName: config.cookieName,
+  };
+  const { code } = composeViewerRequest({ features: [authFeature(opts)] });
+  return { injection: code };
+}

package/src/db.ts

@@ -0,0 +1,59 @@
+/**
+ * @everystack/server/db — SST Resource-linked database helpers.
+ *
+ * Provides a lazy singleton Drizzle connection using SST Resource linking
+ * for database credentials and secrets.
+ */
+
+import { Resource } from 'sst';
+import { drizzle } from 'drizzle-orm/postgres-js';
+import postgres from 'postgres';
+
+export function getDatabaseUrl(): string {
+  return `postgresql://${Resource.Database.username}:${Resource.Database.password}@${Resource.Database.host}:${Resource.Database.port}/${Resource.Database.database}`;
+}
+
+export function getJwtSecret(): Uint8Array {
+  return new TextEncoder().encode(Resource.JwtSecret.value);
+}
+
+// Lazy singleton DB connection
+let dbInstance: ReturnType<typeof drizzle> | null = null;
+let sqlClient: ReturnType<typeof postgres> | null = null;
+
+export function createDb<T extends Record<string, unknown>>(
+  schema: T,
+  options?: { maxConnections?: number }
+): {
+  db: ReturnType<typeof drizzle>;
+  schema: T;
+} {
+  if (dbInstance) return { db: dbInstance, schema };
+
+  const url = getDatabaseUrl();
+  sqlClient = postgres(url, {
+    max: options?.maxConnections ?? 1,
+    idle_timeout: 60,
+    connect_timeout: 5,
+    max_lifetime: 60 * 5,
+    ssl: 'require',
+  });
+  dbInstance = drizzle(sqlClient, { schema });
+  return { db: dbInstance, schema };
+}
+
+/**
+ * Get the raw postgres.js sql client.
+ *
+ * Use this for calling PostgreSQL functions directly via tagged templates,
+ * bypassing drizzle-orm's SQL builder (which expands arrays into individual
+ * params instead of PostgreSQL arrays).
+ *
+ * Must be called after createDb().
+ */
+export function getSql(): ReturnType<typeof postgres> {
+  if (!sqlClient) {
+    throw new Error('getSql() called before createDb() — no database connection');
+  }
+  return sqlClient;
+}

package/src/image.ts

@@ -0,0 +1,215 @@
+/**
+ * @everystack/server/image — On-demand image processing Lambda.
+ *
+ * CloudFront → this Lambda → Sharp → return processed image
+ * CloudFront caches the result. Subsequent requests never hit Lambda.
+ *
+ * URL format:
+ *   /media/{key}?w=400&h=300&fit=cover&fm=webp&q=80&dpr=2
+ *
+ * No params = EXIF-corrected webp at q80 (never exposes S3 URLs).
+ */
+
+import type {
+  APIGatewayProxyEventV2,
+  APIGatewayProxyStructuredResultV2,
+} from 'aws-lambda';
+import { log } from './index.js';
+
+export interface ImageHandlerConfig {
+  /** S3 bucket name for media storage */
+  bucket: string;
+  /** AWS region (defaults to process.env.AWS_REGION) */
+  region?: string;
+  /** URL path prefix to strip (defaults to '/media/') */
+  pathPrefix?: string;
+  /** Cache-Control for image responses.
+   *  Default: 'public, max-age=60, s-maxage=2592000, stale-while-revalidate=5' */
+  cacheControl?: string;
+}
+
+export interface TransformParams {
+  w?: number;
+  h?: number;
+  fit?: 'cover' | 'contain' | 'fill' | 'inside' | 'outside';
+  fm?: 'webp' | 'jpeg' | 'png' | 'avif';
+  q?: number;
+  dpr?: number;
+}
+
+const VALID_FITS = ['cover', 'contain', 'fill', 'inside', 'outside'] as const;
+const VALID_FORMATS = ['webp', 'jpeg', 'png', 'avif'] as const;
+const FORMAT_CONTENT_TYPES: Record<string, string> = {
+  webp: 'image/webp',
+  jpeg: 'image/jpeg',
+  png: 'image/png',
+  avif: 'image/avif',
+};
+const MAX_DIMENSION = 4096;
+
+export function parseParams(query: Record<string, string | undefined>): TransformParams {
+  const params: TransformParams = {};
+
+  if (query.w) {
+    const w = parseInt(query.w, 10);
+    if (w > 0 && w <= MAX_DIMENSION) params.w = w;
+  }
+  if (query.h) {
+    const h = parseInt(query.h, 10);
+    if (h > 0 && h <= MAX_DIMENSION) params.h = h;
+  }
+  if (query.fit && VALID_FITS.includes(query.fit as any)) {
+    params.fit = query.fit as TransformParams['fit'];
+  }
+  if (query.fm && VALID_FORMATS.includes(query.fm as any)) {
+    params.fm = query.fm as TransformParams['fm'];
+  }
+  if (query.q) {
+    const q = parseInt(query.q, 10);
+    if (q >= 1 && q <= 100) params.q = q;
+  }
+  if (query.dpr) {
+    const dpr = parseFloat(query.dpr);
+    if (dpr >= 1 && dpr <= 3) params.dpr = dpr;
+  }
+
+  // Apply DPR multiplier
+  if (params.dpr && params.dpr > 1) {
+    if (params.w) params.w = Math.round(params.w * params.dpr);
+    if (params.h) params.h = Math.round(params.h * params.dpr);
+  }
+
+  return params;
+}
+
+function isNotFound(error: any): boolean {
+  return (
+    error.name === 'NotFound' ||
+    error.name === 'NoSuchKey' ||
+    error.$metadata?.httpStatusCode === 404 ||
+    (error.name === 'AccessDenied' && error.$metadata?.httpStatusCode === 403)
+  );
+}
+
+export async function processImage(
+  data: Buffer,
+  params: TransformParams
+): Promise<{ data: Buffer; contentType: string }> {
+  // Sharp is provided via Lambda layer
+  const sharp = (await import('sharp')).default;
+
+  let pipeline = sharp(data);
+
+  // Auto-orient based on EXIF metadata (fixes rotated portrait thumbnails)
+  pipeline = pipeline.rotate();
+
+  // Resize
+  if (params.w || params.h) {
+    pipeline = pipeline.resize({
+      width: params.w,
+      height: params.h,
+      fit: params.fit || 'cover',
+      withoutEnlargement: true,
+    });
+  }
+
+  // Format conversion
+  const format = params.fm || 'webp';
+  const quality = params.q || 80;
+
+  switch (format) {
+    case 'webp':
+      pipeline = pipeline.webp({ quality });
+      break;
+    case 'jpeg':
+      pipeline = pipeline.jpeg({ quality });
+      break;
+    case 'png':
+      pipeline = pipeline.png();
+      break;
+    case 'avif':
+      pipeline = pipeline.avif({ quality });
+      break;
+  }
+
+  const result = await pipeline.toBuffer();
+  return {
+    data: result,
+    contentType: FORMAT_CONTENT_TYPES[format],
+  };
+}
+
+export function createImageHandler(
+  config: ImageHandlerConfig
+): (event: APIGatewayProxyEventV2) => Promise<APIGatewayProxyStructuredResultV2> {
+  const { bucket, pathPrefix = '/media/' } = config;
+  const region = config.region || process.env.AWS_REGION;
+
+  return async (event: APIGatewayProxyEventV2): Promise<APIGatewayProxyStructuredResultV2> => {
+    try {
+      // Extract key from path: /media/uploads/abc.jpg → uploads/abc.jpg
+      const path = event.rawPath;
+      const key = path.replace(new RegExp(`^${pathPrefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`), '');
+
+      if (!key) {
+        return {
+          statusCode: 400,
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ error: 'Missing image key' }),
+        };
+      }
+
+      const params = parseParams(event.queryStringParameters || {});
+
+      const { S3Client, GetObjectCommand } = await import('@aws-sdk/client-s3');
+      const client = new S3Client({ region });
+
+      // Fetch original from S3 for processing
+      let originalData: Buffer;
+      try {
+        const result = await client.send(
+          new GetObjectCommand({ Bucket: bucket, Key: key })
+        );
+        if (!result.Body) {
+          return {
+            statusCode: 404,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ error: 'Image not found' }),
+          };
+        }
+        const bytes = await result.Body.transformToByteArray();
+        originalData = Buffer.from(bytes);
+      } catch (error: any) {
+        if (isNotFound(error)) {
+          return {
+            statusCode: 404,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ error: 'Image not found' }),
+          };
+        }
+        throw error;
+      }
+
+      // Process with Sharp
+      const processed = await processImage(originalData, params);
+
+      return {
+        statusCode: 200,
+        headers: {
+          'Content-Type': processed.contentType,
+          'Cache-Control': config.cacheControl ?? 'public, max-age=60, s-maxage=2592000, stale-while-revalidate=5',
+          'Vary': 'Accept',
+        },
+        body: processed.data.toString('base64'),
+        isBase64Encoded: true,
+      };
+    } catch (error) {
+      log('error', 'Image processing error', { error: String(error), path: event.rawPath });
+      return {
+        statusCode: 500,
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ error: 'Image processing failed' }),
+      };
+    }
+  };
+}