@getstrata/bootstrap 0.2.2 → 0.2.3

package/dist/bootstrap/web/forms.d.ts

@@ -1,10 +1,6 @@
+export { type CsrfProtectionOptions, createCsrfProtection, } from "../../core/http/csrfProtection.ts";
 export interface ParsedForm {
     fields: Record<string, string>;
     files: Record<string, File>;
 }
 export declare function parseFormBody(request: Request): Promise<ParsedForm>;
-export declare function createCsrfProtection(secret: string): {
-    generate: (sessionKey: string) => string;
-    verify: (token: string | undefined, maxAgeMs?: number) => boolean;
-    secret: string;
-};

package/dist/bootstrap/web/index.d.ts

@@ -2,6 +2,6 @@
  * Web-focused bootstrap utilities for sibling apps (getstrata, marketing sites).
  */
 export { createCsrfProtection, type ParsedForm, parseFormBody } from "./forms.ts";
-export { createWebServer, type WebServerOptions } from "./server.ts";
+export { convertAppRoutesToBunRoutes, createWebServer, type WebServerOptions } from "./server.ts";
 export { CookieSessionStore, type SessionUser } from "./session.ts";
 export { slugify } from "./slug.ts";

package/dist/bootstrap/web/server.d.ts

@@ -1,7 +1,13 @@
+import type { BunRequest } from "bun";
+import type { AppRouteMap } from "../contracts.ts";
 export interface WebServerOptions {
     port: number;
-    handle: (request: Request) => Promise<Response | null> | Response | null;
+    handle?: (request: Request) => Promise<Response | null> | Response | null;
+    routes?: AppRouteMap;
     publicDir?: string;
     onRequest?: (request: Request) => Promise<void> | void;
 }
+type BunRouteHandler = (request: BunRequest) => Response | Promise<Response>;
+declare function convertAppRoutesToBunRoutes(routes: AppRouteMap): Record<string, Record<string, BunRouteHandler>>;
 export declare function createWebServer(options: WebServerOptions): Bun.Server<undefined>;
+export { convertAppRoutesToBunRoutes };

package/dist/bootstrap/web/session.d.ts

@@ -20,6 +20,5 @@ export declare class CookieSessionStore {
     destroy(sessionId: string): Promise<void>;
     read(request: Request): Promise<SessionUser | null>;
     private sign;
-    private parseCookie;
 }
 export {};

package/dist/core/crypto/nonCryptographicHash.d.ts

@@ -0,0 +1,2 @@
+declare function nonCryptographicDigest(input: string): string;
+export { nonCryptographicDigest };

package/dist/core/http/cookies.d.ts

@@ -0,0 +1,4 @@
+import type { BunRequest } from "bun";
+declare function readRequestCookie(request: Request, name: string): string | null;
+declare function readBunRequestCookie(request: BunRequest, name: string): string | null;
+export { readBunRequestCookie, readRequestCookie };

package/dist/core/http/csrfProtection.d.ts

@@ -0,0 +1,12 @@
+declare const DEFAULT_CSRF_TTL_MS: number;
+interface CsrfProtectionOptions {
+    expiresIn?: number;
+    maxAge?: number;
+}
+declare function createCsrfProtection(secret: string, options?: CsrfProtectionOptions): {
+    generate(_sessionKey?: string): string;
+    verify(token: string | undefined, _sessionKey?: string): boolean;
+    secret: string;
+};
+export type { CsrfProtectionOptions };
+export { createCsrfProtection, DEFAULT_CSRF_TTL_MS };

package/dist/framework/public-api.d.ts

@@ -14,6 +14,7 @@ export { CACHE_TAGS } from "../core/cache/tags.ts";
 export type { DatabaseConnection } from "../core/database/baseRepository.ts";
 export { default as BaseRepository } from "../core/database/baseRepository.ts";
 export { bindDatabaseConnection } from "../core/database/bindConnection.ts";
+export { createDatabaseConnection } from "../core/database/connection.ts";
 export { getActiveDatabaseConnection, runWithDatabaseConnection, } from "../core/database/connectionContext.ts";
 export { withMigrationLock } from "../core/database/migrations/advisoryLock.ts";
 export { freshDatabase, getMigrationStatus, loadMigrationsFromDirectory, migrateDatabase, rollbackDatabase, } from "../core/database/migrations/runner.ts";
@@ -36,7 +37,10 @@ export { BadRequestError, ConflictError, ForbiddenError, NotFoundError, Precondi
 export { EventBus } from "../core/events/eventBus.ts";
 export { auth, cache, config, events, log, mail, policyGate, queue, storage, } from "../core/facades/index.ts";
 export { createBodySizeLimitMiddleware } from "../core/http/bodySizeLimitMiddleware.ts";
+export { readBunRequestCookie, readRequestCookie } from "../core/http/cookies.ts";
 export { createCsrfMiddleware } from "../core/http/csrfMiddleware.ts";
+export { createCsrfProtection } from "../core/http/csrfProtection.ts";
+export { createCsrfTokenCookie, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, } from "../core/http/csrfToken.ts";
 export { assertIfMatch, etagFromResource, isEtagEnabled, } from "../core/http/etag.ts";
 export { FormRequest } from "../core/http/formRequest.ts";
 export { applyMiddlewareToRoutes, composeMiddleware, createAuthMiddleware, createAuthorizeMiddleware, createdResponse, createRequireAuthMiddleware, jsonResponse, noContentResponse, paginatedResponse, parsePaginationQuery, securedBindRouteModel, securedBindRouteModelByKey, withErrorHandling, withMiddleware, } from "../core/http/index.ts";

package/dist/index.js

@@ -3748,76 +3748,61 @@ function htmlResponse(html, init = {}) {
   });
 }
 // ../../src/core/http/csrfToken.ts
-import { createHmac as createHmac3, randomBytes, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+
+// ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
-function signCsrfToken(token, issuedAt) {
-  const payload = `${token}.${issuedAt}`;
-  const signature = createHmac3("sha256", resolveCsrfSecret()).update(payload).digest("hex");
-  return `${payload}.${signature}`;
-}
-function readCsrfCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === CSRF_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function parseSignedCsrfValue(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const [token, issuedAtRaw, cookieSignature] = parts;
-  if (!token || !issuedAtRaw || !cookieSignature) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt)) {
-    return null;
-  }
-  if (Date.now() - issuedAt > CSRF_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(cookieSignature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
   }
-  return { token, issuedAt };
+  return timingSafeEqual2(leftBuffer, rightBuffer);
 }
 function createCsrfTokenCookie() {
-  const token = randomBytes(24).toString("hex");
-  const issuedAt = Date.now();
-  const value = signCsrfToken(token, issuedAt);
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readCsrfCookie(request);
-  if (cookieValue) {
-    const parsed = parseSignedCsrfValue(cookieValue);
-    if (parsed) {
-      return { token: parsed.token };
-    }
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
   }
   return createCsrfTokenCookie();
 }
@@ -3840,6 +3825,10 @@ async function readSubmittedCsrfTokenFromBody(request) {
     if (typeof field === "string" && field.trim().length > 0) {
       return field.trim();
     }
+    const legacyField = formData.get("_csrf");
+    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
+      return legacyField.trim();
+    }
   }
   return null;
 }
@@ -3847,20 +3836,14 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readCsrfCookie(request);
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
   if (!cookieValue) {
     return false;
   }
-  const parsed = parseSignedCsrfValue(cookieValue);
-  if (!parsed) {
+  if (!tokensMatch(submittedToken, cookieValue)) {
     return false;
   }
-  const submittedBuffer = Buffer.from(submittedToken);
-  const expectedBuffer = Buffer.from(parsed.token);
-  if (submittedBuffer.length !== expectedBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual2(submittedBuffer, expectedBuffer);
+  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
 }
 function resolveCsrfTokenForRequest(request) {
   const metaToken = currentRequestMeta().csrfToken;
@@ -3871,14 +3854,14 @@ function resolveCsrfTokenForRequest(request) {
 }
 
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
 function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  const signature = createHmac3("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
   return `${payload}.${issuedAt}.${signature}`;
 }
 function readFlashCookie(request) {
@@ -4967,9 +4950,9 @@ function createTenantMiddleware() {
 }
 
 // ../../src/core/tracing/otel.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes } from "crypto";
 function randomHex(bytes) {
-  return randomBytes2(bytes).toString("hex");
+  return randomBytes(bytes).toString("hex");
 }
 function createSpan(input) {
   const spanId = randomHex(8);
@@ -5302,6 +5285,25 @@ function prefixRouteMap(prefix, routes) {
   }
   return prefixed;
 }
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+function createCsrfProtection(secret, options = {}) {
+  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
+  const maxAge = options.maxAge ?? expiresIn;
+  return {
+    generate(_sessionKey) {
+      return Bun.CSRF.generate(secret, { expiresIn });
+    },
+    verify(token, _sessionKey) {
+      if (!token) {
+        return false;
+      }
+      return Bun.CSRF.verify(token, { secret, maxAge });
+    },
+    secret
+  };
+}
+
 // ../../src/bootstrap/web/forms.ts
 async function parseFormBody(request) {
   const contentType = request.headers.get("content-type") ?? "";
@@ -5331,30 +5333,41 @@ async function parseFormBody(request) {
   }
   return { fields, files };
 }
-function createCsrfProtection(secret) {
-  const tokenCache = new Map;
-  function generate(sessionKey) {
-    const token = `${sessionKey}.${Date.now().toString(36)}.${Math.random().toString(36).slice(2)}`;
-    tokenCache.set(token, Date.now());
-    return token;
-  }
-  function verify(token, maxAgeMs = 60 * 60 * 1000) {
-    if (!token || !tokenCache.has(token))
-      return false;
-    const created = tokenCache.get(token) ?? 0;
-    if (Date.now() - created > maxAgeMs) {
-      tokenCache.delete(token);
-      return false;
+// ../../src/bootstrap/web/server.ts
+function wrapRouteHandler2(handler) {
+  return async (request) => {
+    const response = await handler(request);
+    return response ?? new Response("Not Found", { status: 404 });
+  };
+}
+function convertAppRoutesToBunRoutes(routes) {
+  const bunRoutes = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    if (typeof handler === "function") {
+      bunRoutes[path] = { GET: wrapRouteHandler2(handler) };
+      continue;
+    }
+    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
+      const methods = {};
+      for (const [method, methodHandler] of Object.entries(handler)) {
+        if (typeof methodHandler !== "function") {
+          continue;
+        }
+        methods[method.toUpperCase()] = wrapRouteHandler2(methodHandler);
+      }
+      if (Object.keys(methods).length > 0) {
+        bunRoutes[path] = methods;
+      }
     }
-    return true;
   }
-  return { generate, verify, secret };
+  return bunRoutes;
 }
-// ../../src/bootstrap/web/server.ts
 function createWebServer(options) {
   const publicDir = options.publicDir ?? "./public";
+  const bunRoutes = options.routes ? convertAppRoutesToBunRoutes(options.routes) : undefined;
   return Bun.serve({
     port: options.port,
+    ...bunRoutes ? { routes: bunRoutes } : {},
     async fetch(request) {
       await options.onRequest?.(request);
       const url = new URL(request.url);
@@ -5364,14 +5377,16 @@ function createWebServer(options) {
           return new Response(file);
         }
       }
-      const response = await options.handle(request);
-      return response ?? new Response("Not Found", { status: 404 });
+      if (options.handle) {
+        const response = await options.handle(request);
+        return response ?? new Response("Not Found", { status: 404 });
+      }
+      return new Response("Not Found", { status: 404 });
     }
   });
 }
 // ../../src/bootstrap/web/session.ts
-import { createHash, randomBytes as randomBytes3 } from "crypto";
-
+import { createHash, randomBytes as randomBytes2 } from "crypto";
 class CookieSessionStore {
   sql;
   secret;
@@ -5397,7 +5412,7 @@ class CookieSessionStore {
     return header.includes("Secure") ? header : `${header}; Secure`;
   }
   async create(user) {
-    const id = randomBytes3(32).toString("hex");
+    const id = randomBytes2(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
     await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
       id,
@@ -5410,8 +5425,8 @@ class CookieSessionStore {
     await this.sql.unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
   }
   async read(request) {
-    const cookie = this.parseCookie(request.headers.get("cookie") ?? "");
-    const raw = cookie[this.cookieName];
+    const cookie = readRequestCookie(request, this.cookieName);
+    const raw = cookie ?? null;
     if (!raw)
       return null;
     const [sessionId, signature] = raw.split(".");
@@ -5435,16 +5450,6 @@ class CookieSessionStore {
   sign(value) {
     return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
   }
-  parseCookie(header) {
-    const out = {};
-    for (const part of header.split(";")) {
-      const idx = part.indexOf("=");
-      if (idx === -1)
-        continue;
-      out[part.slice(0, idx).trim()] = decodeURIComponent(part.slice(idx + 1).trim());
-    }
-    return out;
-  }
 }
 // ../../src/bootstrap/web/slug.ts
 function slugify(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.5",
+    "@getstrata/core": "^0.5.6",
     "typescript": "^5.9.0"
   }
 }