@flaghoist/server 0.2.3 → 0.3.1

package/dist/index.cjs

@@ -64,7 +64,10 @@ function buildFlag(key, body, identity, existing) {
     return { ok: false, error: `Description exceeds ${import_core.LIMITS.maxDescriptionLength} characters` };
   }
   const inputRules = Array.isArray(b.rules) ? b.rules : [];
-  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const nowMs = Date.now();
+  const prevMs = existing ? Date.parse(existing.metadata.updatedAt) : 0;
+  const updatedAt = new Date(nowMs > prevMs ? nowMs : prevMs + 1).toISOString();
+  const createdAt = existing?.metadata.createdAt ?? new Date(nowMs).toISOString();
   const candidate = {
     key,
     enabled,
@@ -73,9 +76,9 @@ function buildFlag(key, body, identity, existing) {
     description,
     metadata: {
       createdBy: existing?.metadata.createdBy ?? identity,
-      createdAt: existing?.metadata.createdAt ?? now,
+      createdAt,
       updatedBy: identity,
-      updatedAt: now
+      updatedAt
     }
   };
   const validated = (0, import_core.parseFlag)(candidate);
@@ -85,6 +88,9 @@ function buildFlag(key, body, identity, existing) {
   }
   return { ok: true, flag: validated };
 }
+function flagEtag(flag) {
+  return `"${flag.metadata.updatedAt}"`;
+}
 
 // src/openapi.ts
 var openApiDocument = {
@@ -473,17 +479,19 @@ async function safeEqual(a, b) {
 }
 var MIN_SECRET_LENGTH = 16;
 var warnedWeakSecrets = /* @__PURE__ */ new Set();
+function weakSecretKey(secret) {
+  let hash = 5381;
+  for (let i = 0; i < secret.length; i++) hash = (hash << 5) + hash ^ secret.charCodeAt(i);
+  return hash >>> 0;
+}
 function warnIfWeakSecret(kind, secret) {
   if (secret.length >= MIN_SECRET_LENGTH) return;
-  void (async () => {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-    const id = Array.from(new Uint8Array(digest).slice(0, 6)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    if (warnedWeakSecrets.has(id)) return;
-    warnedWeakSecrets.add(id);
-    console.warn(
-      `[flaghoist] the ${kind} is ${secret.length} characters. Use a long random value (for example \`openssl rand -hex 32\`); a short secret is guessable, especially since Flaghoist does not rate limit authentication.`
-    );
-  })();
+  const key = weakSecretKey(secret);
+  if (warnedWeakSecrets.has(key)) return;
+  warnedWeakSecrets.add(key);
+  console.warn(
+    `[flaghoist] the ${kind} is ${secret.length} characters. Use a long random value (for example \`openssl rand -hex 32\`); a short secret is guessable, especially since Flaghoist does not rate limit authentication.`
+  );
 }
 function apiKey(expected) {
   warnIfWeakSecret("read API key", expected);
@@ -690,6 +698,7 @@ function createFlagServer(config) {
       if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
       const flag = await cfg.storage.get(c.req.param("key"));
       if (!flag) return c.json({ error: "Flag not found" }, 404);
+      c.header("ETag", flagEtag(flag));
       return c.json(flag);
     });
     app.put(`${prefix}/flags/:key`, async (c) => {
@@ -697,17 +706,24 @@ function createFlagServer(config) {
       const auth = await cfg.auth.admin(c.req.raw.headers);
       if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
       const key = c.req.param("key");
+      const existing = await cfg.storage.get(key);
+      const ifMatch = c.req.header("If-Match")?.trim();
+      if (ifMatch !== void 0) {
+        const precondition = ifMatch === "*" ? existing !== null : existing !== null && flagEtag(existing) === ifMatch;
+        if (!precondition) {
+          return c.json(
+            { error: "This flag changed since you loaded it. Reload and reapply your change." },
+            412
+          );
+        }
+      }
       const parsed = await readJsonBody(await c.req.text());
       if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
-      const built = buildFlag(
-        key,
-        parsed.value,
-        auth.identity ?? "unknown",
-        await cfg.storage.get(key)
-      );
+      const built = buildFlag(key, parsed.value, auth.identity ?? "unknown", existing);
       if (!built.ok) return c.json({ error: built.error }, 400);
       await cfg.storage.put(key, built.flag);
       cache.invalidate();
+      c.header("ETag", flagEtag(built.flag));
       return c.json(built.flag);
     });
     app.delete(`${prefix}/flags/:key`, async (c) => {

package/dist/index.js

@@ -34,7 +34,10 @@ function buildFlag(key, body, identity, existing) {
     return { ok: false, error: `Description exceeds ${LIMITS.maxDescriptionLength} characters` };
   }
   const inputRules = Array.isArray(b.rules) ? b.rules : [];
-  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const nowMs = Date.now();
+  const prevMs = existing ? Date.parse(existing.metadata.updatedAt) : 0;
+  const updatedAt = new Date(nowMs > prevMs ? nowMs : prevMs + 1).toISOString();
+  const createdAt = existing?.metadata.createdAt ?? new Date(nowMs).toISOString();
   const candidate = {
     key,
     enabled,
@@ -43,9 +46,9 @@ function buildFlag(key, body, identity, existing) {
     description,
     metadata: {
       createdBy: existing?.metadata.createdBy ?? identity,
-      createdAt: existing?.metadata.createdAt ?? now,
+      createdAt,
       updatedBy: identity,
-      updatedAt: now
+      updatedAt
     }
   };
   const validated = parseFlag(candidate);
@@ -55,6 +58,9 @@ function buildFlag(key, body, identity, existing) {
   }
   return { ok: true, flag: validated };
 }
+function flagEtag(flag) {
+  return `"${flag.metadata.updatedAt}"`;
+}
 
 // src/openapi.ts
 var openApiDocument = {
@@ -443,17 +449,19 @@ async function safeEqual(a, b) {
 }
 var MIN_SECRET_LENGTH = 16;
 var warnedWeakSecrets = /* @__PURE__ */ new Set();
+function weakSecretKey(secret) {
+  let hash = 5381;
+  for (let i = 0; i < secret.length; i++) hash = (hash << 5) + hash ^ secret.charCodeAt(i);
+  return hash >>> 0;
+}
 function warnIfWeakSecret(kind, secret) {
   if (secret.length >= MIN_SECRET_LENGTH) return;
-  void (async () => {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-    const id = Array.from(new Uint8Array(digest).slice(0, 6)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    if (warnedWeakSecrets.has(id)) return;
-    warnedWeakSecrets.add(id);
-    console.warn(
-      `[flaghoist] the ${kind} is ${secret.length} characters. Use a long random value (for example \`openssl rand -hex 32\`); a short secret is guessable, especially since Flaghoist does not rate limit authentication.`
-    );
-  })();
+  const key = weakSecretKey(secret);
+  if (warnedWeakSecrets.has(key)) return;
+  warnedWeakSecrets.add(key);
+  console.warn(
+    `[flaghoist] the ${kind} is ${secret.length} characters. Use a long random value (for example \`openssl rand -hex 32\`); a short secret is guessable, especially since Flaghoist does not rate limit authentication.`
+  );
 }
 function apiKey(expected) {
   warnIfWeakSecret("read API key", expected);
@@ -660,6 +668,7 @@ function createFlagServer(config) {
       if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
       const flag = await cfg.storage.get(c.req.param("key"));
       if (!flag) return c.json({ error: "Flag not found" }, 404);
+      c.header("ETag", flagEtag(flag));
       return c.json(flag);
     });
     app.put(`${prefix}/flags/:key`, async (c) => {
@@ -667,17 +676,24 @@ function createFlagServer(config) {
       const auth = await cfg.auth.admin(c.req.raw.headers);
       if (!auth.ok) return c.json({ error: auth.message ?? "Unauthorized" }, auth.status ?? 401);
       const key = c.req.param("key");
+      const existing = await cfg.storage.get(key);
+      const ifMatch = c.req.header("If-Match")?.trim();
+      if (ifMatch !== void 0) {
+        const precondition = ifMatch === "*" ? existing !== null : existing !== null && flagEtag(existing) === ifMatch;
+        if (!precondition) {
+          return c.json(
+            { error: "This flag changed since you loaded it. Reload and reapply your change." },
+            412
+          );
+        }
+      }
       const parsed = await readJsonBody(await c.req.text());
       if (!parsed.ok) return c.json({ error: parsed.message }, parsed.status);
-      const built = buildFlag(
-        key,
-        parsed.value,
-        auth.identity ?? "unknown",
-        await cfg.storage.get(key)
-      );
+      const built = buildFlag(key, parsed.value, auth.identity ?? "unknown", existing);
       if (!built.ok) return c.json({ error: built.error }, 400);
       await cfg.storage.put(key, built.flag);
       cache.invalidate();
+      c.header("ETag", flagEtag(built.flag));
       return c.json(built.flag);
     });
     app.delete(`${prefix}/flags/:key`, async (c) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaghoist/server",
-  "version": "0.2.3",
+  "version": "0.3.1",
   "description": "Hono app factory for Flaghoist: OFREP evaluate, admin CRUD, and pluggable auth.",
   "license": "Apache-2.0",
   "type": "module",
@@ -49,8 +49,8 @@
     "@flaghoist/core": "0.1.2"
   },
   "devDependencies": {
-    "@flaghoist/dashboard": "0.0.0",
-    "@flaghoist/adapter-memory": "0.1.2"
+    "@flaghoist/adapter-memory": "0.1.2",
+    "@flaghoist/dashboard": "0.0.0"
   },
   "publishConfig": {
     "access": "public"