@flaghoist/server 0.2.2 → 0.3.0

package/dist/index.cjs

@@ -64,7 +64,10 @@ function buildFlag(key, body, identity, existing) {
     return { ok: false, error: `Description exceeds ${import_core.LIMITS.maxDescriptionLength} characters` };
   }
   const inputRules = Array.isArray(b.rules) ? b.rules : [];
-  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const nowMs = Date.now();
+  const prevMs = existing ? Date.parse(existing.metadata.updatedAt) : 0;
+  const updatedAt = new Date(nowMs > prevMs ? nowMs : prevMs + 1).toISOString();
+  const createdAt = existing?.metadata.createdAt ?? new Date(nowMs).toISOString();
   const candidate = {
     key,
     enabled,
@@ -73,9 +76,9 @@ function buildFlag(key, body, identity, existing) {
     description,
     metadata: {
       createdBy: existing?.metadata.createdBy ?? identity,
-      createdAt: existing?.metadata.createdAt ?? now,
+      createdAt,
       updatedBy: identity,
-      updatedAt: now
+      updatedAt
     }
   };
   const validated = (0, import_core.parseFlag)(candidate);
@@ -85,6 +88,9 @@ function buildFlag(key, body, identity, existing) {
   }
   return { ok: true, flag: validated };
 }
+function flagEtag(flag) {
+  return `"${flag.metadata.updatedAt}"`;
+}
 
 // src/openapi.ts
 var openApiDocument = {
@@ -574,6 +580,14 @@ function createFlagServer(config) {
   const cache = createDefinitionCache();
   const resolve = (env) => typeof config === "function" ? config(env) : config;
   const app = new import_hono.Hono();
+  app.use("*", async (c, next) => {
+    await next();
+    c.header("X-Content-Type-Options", "nosniff");
+    c.header("X-Frame-Options", "DENY");
+    c.header("Content-Security-Policy", "frame-ancestors 'none'");
+    c.header("Referrer-Policy", "no-referrer");
+    c.header("Permissions-Policy", "geolocation=(), microphone=(), camera=(), payment=(), usb=()");
+  });
   app.use("*", async (c, next) => {
     const cfg = resolve(c.env);
     const origin = c.req.header("Origin");
@@ -682,6 +696,7 @@ function createFlagServer(config) {
       if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
       const flag = await cfg.storage.get(c.req.param("key"));
       if (!flag) return c.json({ error: "Flag not found" }, 404);
+      c.header("ETag", flagEtag(flag));
       return c.json(flag);
     });
     app.put(`${prefix}/flags/:key`, async (c) => {
@@ -689,17 +704,24 @@ function createFlagServer(config) {
       const auth = await cfg.auth.admin(c.req.raw.headers);
       if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
       const key = c.req.param("key");
+      const existing = await cfg.storage.get(key);
+      const ifMatch = c.req.header("If-Match")?.trim();
+      if (ifMatch !== void 0) {
+        const precondition = ifMatch === "*" ? existing !== null : existing !== null && flagEtag(existing) === ifMatch;
+        if (!precondition) {
+          return c.json(
+            { error: "This flag changed since you loaded it. Reload and reapply your change." },
+            412
+          );
+        }
+      }
       const parsed = await readJsonBody(await c.req.text());
       if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
-      const built = buildFlag(
-        key,
-        parsed.value,
-        auth.identity ?? "unknown",
-        await cfg.storage.get(key)
-      );
+      const built = buildFlag(key, parsed.value, auth.identity ?? "unknown", existing);
       if (!built.ok) return c.json({ error: built.error }, 400);
       await cfg.storage.put(key, built.flag);
       cache.invalidate();
+      c.header("ETag", flagEtag(built.flag));
       return c.json(built.flag);
     });
     app.delete(`${prefix}/flags/:key`, async (c) => {

package/dist/index.js

@@ -34,7 +34,10 @@ function buildFlag(key, body, identity, existing) {
     return { ok: false, error: `Description exceeds ${LIMITS.maxDescriptionLength} characters` };
   }
   const inputRules = Array.isArray(b.rules) ? b.rules : [];
-  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const nowMs = Date.now();
+  const prevMs = existing ? Date.parse(existing.metadata.updatedAt) : 0;
+  const updatedAt = new Date(nowMs > prevMs ? nowMs : prevMs + 1).toISOString();
+  const createdAt = existing?.metadata.createdAt ?? new Date(nowMs).toISOString();
   const candidate = {
     key,
     enabled,
@@ -43,9 +46,9 @@ function buildFlag(key, body, identity, existing) {
     description,
     metadata: {
       createdBy: existing?.metadata.createdBy ?? identity,
-      createdAt: existing?.metadata.createdAt ?? now,
+      createdAt,
       updatedBy: identity,
-      updatedAt: now
+      updatedAt
     }
   };
   const validated = parseFlag(candidate);
@@ -55,6 +58,9 @@ function buildFlag(key, body, identity, existing) {
   }
   return { ok: true, flag: validated };
 }
+function flagEtag(flag) {
+  return `"${flag.metadata.updatedAt}"`;
+}
 
 // src/openapi.ts
 var openApiDocument = {
@@ -544,6 +550,14 @@ function createFlagServer(config) {
   const cache = createDefinitionCache();
   const resolve = (env) => typeof config === "function" ? config(env) : config;
   const app = new Hono();
+  app.use("*", async (c, next) => {
+    await next();
+    c.header("X-Content-Type-Options", "nosniff");
+    c.header("X-Frame-Options", "DENY");
+    c.header("Content-Security-Policy", "frame-ancestors 'none'");
+    c.header("Referrer-Policy", "no-referrer");
+    c.header("Permissions-Policy", "geolocation=(), microphone=(), camera=(), payment=(), usb=()");
+  });
   app.use("*", async (c, next) => {
     const cfg = resolve(c.env);
     const origin = c.req.header("Origin");
@@ -652,6 +666,7 @@ function createFlagServer(config) {
       if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
       const flag = await cfg.storage.get(c.req.param("key"));
       if (!flag) return c.json({ error: "Flag not found" }, 404);
+      c.header("ETag", flagEtag(flag));
       return c.json(flag);
     });
     app.put(`${prefix}/flags/:key`, async (c) => {
@@ -659,17 +674,24 @@ function createFlagServer(config) {
       const auth = await cfg.auth.admin(c.req.raw.headers);
       if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
       const key = c.req.param("key");
+      const existing = await cfg.storage.get(key);
+      const ifMatch = c.req.header("If-Match")?.trim();
+      if (ifMatch !== void 0) {
+        const precondition = ifMatch === "*" ? existing !== null : existing !== null && flagEtag(existing) === ifMatch;
+        if (!precondition) {
+          return c.json(
+            { error: "This flag changed since you loaded it. Reload and reapply your change." },
+            412
+          );
+        }
+      }
       const parsed = await readJsonBody(await c.req.text());
       if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
-      const built = buildFlag(
-        key,
-        parsed.value,
-        auth.identity ?? "unknown",
-        await cfg.storage.get(key)
-      );
+      const built = buildFlag(key, parsed.value, auth.identity ?? "unknown", existing);
       if (!built.ok) return c.json({ error: built.error }, 400);
       await cfg.storage.put(key, built.flag);
       cache.invalidate();
+      c.header("ETag", flagEtag(built.flag));
       return c.json(built.flag);
     });
     app.delete(`${prefix}/flags/:key`, async (c) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaghoist/server",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Hono app factory for Flaghoist: OFREP evaluate, admin CRUD, and pluggable auth.",
   "license": "Apache-2.0",
   "type": "module",
@@ -49,8 +49,8 @@
     "@flaghoist/core": "0.1.2"
   },
   "devDependencies": {
-    "@flaghoist/adapter-memory": "0.1.2",
-    "@flaghoist/dashboard": "0.0.0"
+    "@flaghoist/dashboard": "0.0.0",
+    "@flaghoist/adapter-memory": "0.1.2"
   },
   "publishConfig": {
     "access": "public"