@getstrata/bootstrap 0.2.13 → 0.2.17

package/dist/entries/web/forms.js

@@ -0,0 +1,53 @@
+// @bun
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+function createCsrfProtection(secret, options = {}) {
+  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
+  const maxAge = options.maxAge ?? expiresIn;
+  return {
+    generate(_sessionKey) {
+      return Bun.CSRF.generate(secret, { expiresIn });
+    },
+    verify(token, _sessionKey) {
+      if (!token) {
+        return false;
+      }
+      return Bun.CSRF.verify(token, { secret, maxAge });
+    },
+    secret
+  };
+}
+
+// ../../src/bootstrap/web/forms.ts
+async function parseFormBody(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  const fields = {};
+  const files = {};
+  if (contentType.includes("application/x-www-form-urlencoded")) {
+    const text = await request.text();
+    for (const pair of text.split("&")) {
+      const idx = pair.indexOf("=");
+      if (idx === -1)
+        continue;
+      const key = decodeURIComponent(pair.slice(0, idx).replace(/\+/g, " "));
+      const value = decodeURIComponent(pair.slice(idx + 1).replace(/\+/g, " "));
+      fields[key] = value;
+    }
+    return { fields, files };
+  }
+  if (contentType.includes("multipart/form-data")) {
+    const form = await request.formData();
+    for (const [key, value] of form.entries()) {
+      if (value instanceof File) {
+        files[key] = value;
+      } else {
+        fields[key] = String(value);
+      }
+    }
+  }
+  return { fields, files };
+}
+export {
+  parseFormBody,
+  createCsrfProtection
+};

package/dist/entries/web/routing.js

@@ -0,0 +1,624 @@
+// @bun
+// ../../src/bootstrap/web/routing.ts
+import { withErrorHandling } from "@getstrata/core";
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/contracts/applicationContext.ts
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${String(key)}" is not registered.`);
+  }
+  return dependency;
+}
+
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/core/runtime/applicationRegistry.ts
+var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
+var activeContext;
+function readStoredApplicationContext() {
+  if (activeContext) {
+    return activeContext;
+  }
+  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
+  if (globalContext) {
+    activeContext = globalContext;
+  }
+  return activeContext;
+}
+function setActiveApplicationContext(context) {
+  activeContext = context;
+  globalThis[APPLICATION_CONTEXT_KEY] = context;
+}
+function requireActiveApplicationContext() {
+  const context = readStoredApplicationContext();
+  if (!context) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return context;
+}
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
+}
+function resolveApplicationQueue() {
+  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
+}
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
+function resolveApplicationConfig() {
+  return requireActiveApplicationContext().config;
+}
+function resolveApplicationLogger() {
+  return appLogger;
+}
+function resolveApplicationDependencies() {
+  return requireActiveApplicationContext().dependencies;
+}
+
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+
+// ../../src/core/http/validation.ts
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/core/http/securedRouteModelBinding.ts
+function isMutatingPolicyAction(action) {
+  return action === "update" || action === "delete";
+}
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+function securedBindRouteModelByKey(param, resolver, authorization, handler) {
+  return async (request) => {
+    const key = String(request.params[param] ?? "").trim();
+    if (!key) {
+      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
+    }
+    const model = await resolver(key, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
+
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/config/rateLimit.ts
+var LOCAL_LOGIN_RATE_LIMIT = {
+  maxAttempts: 100,
+  decaySeconds: 60
+};
+var PRODUCTION_LOGIN_RATE_LIMIT = {
+  maxAttempts: 5,
+  decaySeconds: 900
+};
+function isLocalAppEnv() {
+  return (process.env.APP_ENV ?? "local") === "local";
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return fallback;
+  }
+  return Math.trunc(parsed);
+}
+function resolveLoginRateLimit() {
+  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
+  return {
+    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+  };
+}
+function resolveRegisterRateLimit() {
+  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
+  return {
+    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+  };
+}
+
+// ../../src/bootstrap/config.ts
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/httpKernel.ts
+class HttpKernel {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  globalMiddleware() {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return [
+      createCorsMiddleware(),
+      createSecurityHeadersMiddleware(),
+      createBodySizeLimitMiddleware(),
+      createTracingMiddleware(),
+      createMetricsMiddleware(),
+      createRequestLoggingMiddleware(),
+      requestIdMiddleware,
+      createAuthMiddleware(auth),
+      createMembershipMiddleware(),
+      createTenantMiddleware()
+    ];
+  }
+  group(name) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    switch (name) {
+      case "authenticated":
+        return [createRequireAuthMiddleware(auth)];
+      case "web":
+        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
+      case "api": {
+        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+          return [];
+        }
+        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+        if (!redisUrl) {
+          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          return [
+            createMemoryThrottleMiddleware({
+              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              decaySeconds: 60
+            })
+          ];
+        }
+        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+        return [
+          createThrottleMiddleware({
+            redisUrl,
+            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
+            decaySeconds: 60
+          })
+        ];
+      }
+      default:
+        throw new Error(`Unknown middleware group "${name}".`);
+    }
+  }
+  wrap(groups, handler) {
+    const names = Array.isArray(groups) ? groups : [groups];
+    const middleware = names.flatMap((name) => this.group(name));
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapApi(handler) {
+    return this.wrap(["api", "authenticated"], handler);
+  }
+  wrapWeb(handler) {
+    return handler;
+  }
+  wrapWebPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return this.wrapWeb(handler);
+    }
+    return this.wrapWebAuthenticated(handler);
+  }
+  wrapWebAuthenticated(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+  }
+  wrapWebAbility(ability, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapWebGlobalAdmin(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAuthenticated(handler) {
+    return this.wrap("authenticated", handler);
+  }
+  wrapPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return handler;
+    }
+    return this.wrapAuthenticated(handler);
+  }
+  wrapGlobalAdmin(handler) {
+    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAbility(ability, handler) {
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [...this.group("authenticated"), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapPolicy(resource, action, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
+    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
+  }
+  wrapLogin(handler) {
+    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
+  }
+  wrapRegister(handler) {
+    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
+  }
+  wrapThrottle(scope, rateLimit, handler) {
+    const middleware = [];
+    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
+    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+      if (redisUrl) {
+        const throttle = scope === "login" ? createLoginThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds
+        }) : createThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        });
+        middleware.push(throttle);
+      } else {
+        middleware.push(createMemoryThrottleMiddleware({
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        }));
+      }
+    } else {
+      middleware.push(createMemoryThrottleMiddleware({
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds,
+        keyPrefix: memoryKeyPrefix
+      }));
+    }
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+}
+function createHttpKernel(dependencies) {
+  return new HttpKernel(dependencies);
+}
+
+// ../../src/bootstrap/web/routing.ts
+function routeParams(request) {
+  const normalized = {};
+  const raw = request.params;
+  if (raw && typeof raw === "object") {
+    for (const [key, value] of Object.entries(raw)) {
+      normalized[key] = decodeURIComponent(String(value));
+    }
+  }
+  return normalized;
+}
+function toRouteRequest(request) {
+  const params = routeParams(request);
+  Object.defineProperty(request, "params", {
+    value: params,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+  return request;
+}
+function wrapSecuredRouteModelByKey(param, resolver, authorization, handler) {
+  const bound = withErrorHandling(securedBindRouteModelByKey(param, resolver, authorization, handler));
+  return async (request) => bound(toRouteRequest(request));
+}
+function wrapWebLogin(kernel, handler, onThrottled) {
+  return wrapWebThrottle(kernel, "login", handler, onThrottled);
+}
+function wrapWebRegister(kernel, handler, onThrottled) {
+  return wrapWebThrottle(kernel, "register", handler, onThrottled);
+}
+function wrapWebThrottle(kernel, scope, handler, onThrottled) {
+  const throttled = scope === "login" ? kernel.wrapLogin(handler) : kernel.wrapRegister(handler);
+  return async (request) => {
+    const response = await throttled(request);
+    if (response.status === 429) {
+      return onThrottled(request);
+    }
+    return response;
+  };
+}
+function createRouteKernel(dependencies) {
+  return createHttpKernel(dependencies);
+}
+export {
+  wrapWebRegister,
+  wrapWebLogin,
+  wrapSecuredRouteModelByKey,
+  toRouteRequest,
+  routeParams,
+  createRouteKernel
+};