@getstrata/bootstrap 0.2.47 → 0.2.49

package/dist/entries/metricsRoutes.js

@@ -2,15 +2,41 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/metricsRoutes.ts
+import { timingSafeEqual } from "crypto";
 import { prometheusRegistry } from "@getstrata/core/metrics/prometheus";
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function authorizeMetrics(request) {
+  const expected = process.env.METRICS_TOKEN?.trim();
+  const authorization = request.headers.get("authorization") ?? "";
+  const presented = authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length) : "";
+  if (expected) {
+    return presented.length > 0 && tokensMatch(presented, expected);
+  }
+  if ((process.env.APP_ENV ?? "local") === "production") {
+    return false;
+  }
+  return true;
+}
 function createMetricsRoutes() {
   return {
-    "/metrics": async () => new Response(prometheusRegistry.renderMetrics(), {
-      status: 200,
-      headers: {
-        "content-type": "text/plain; version=0.0.4; charset=utf-8"
+    "/metrics": async (request) => {
+      if (!authorizeMetrics(request)) {
+        return new Response("Not Found", { status: 404 });
       }
-    })
+      return new Response(prometheusRegistry.renderMetrics(), {
+        status: 200,
+        headers: {
+          "content-type": "text/plain; version=0.0.4; charset=utf-8"
+        }
+      });
+    }
   };
 }
 export {

package/dist/entries/providers/view.js

@@ -38,7 +38,7 @@ var viewProvider = {
   }
 };
 export {
-  viewProvider,
+  CORE_VIEW_TOKEN,
   VIEW_DIRECTORY_CONFIG_KEY,
-  CORE_VIEW_TOKEN
+  viewProvider
 };

package/dist/entries/providers.js

@@ -293,7 +293,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join2(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -327,6 +327,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 
 // ../../src/bootstrap/cache/modelCacheTags.ts
 function cacheTagsForModelWrite(tableName, action) {

package/dist/entries/routeRegistry.js

@@ -26,6 +26,6 @@ function readSharedRouteRegistry() {
 }
 var routeRegistry = readSharedRouteRegistry();
 export {
-  routeRegistry,
-  RouteRegistry
+  RouteRegistry,
+  routeRegistry
 };

package/dist/entries/secretsGuard.js

@@ -1,64 +1,28 @@
 // @bun
 var __jsonParse = (a) => JSON.parse(a);
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/domain/auth.ts
-var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
-
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
-var SCIM_SCHEMAS = {
-  user: "urn:ietf:params:scim:schemas:core:2.0:User",
-  group: "urn:ietf:params:scim:schemas:core:2.0:Group",
-  listResponse: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
-  patchOp: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
-  serviceProviderConfig: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
-};
-
 // ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
+var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
+function isEnabled(value, defaultEnabled) {
+  if (value === undefined) {
+    return defaultEnabled;
+  }
+  return defaultEnabled ? value !== "false" : value === "true";
+}
 function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? appConfig.env;
+  const appEnv = env.APP_ENV ?? "local";
   if (appEnv !== "production") {
     return;
   }
-  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
+  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
   const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
-  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
+  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
+  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
   if (devHeadersEnabled) {
     throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
@@ -71,18 +35,17 @@ function assertProductionSecrets(env = process.env) {
   if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
     throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
   }
-  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
+  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
-  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
-  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
     throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
   }
   const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
   if (corsOrigins.includes("*")) {
     throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
   }
-  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
+  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
     throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
   }
   if (!env.OAUTH_STATE_SECRET?.trim()) {
@@ -94,6 +57,10 @@ function assertProductionSecrets(env = process.env) {
   if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
+  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
+  }
 }
 export {
   assertProductionSecrets

package/dist/entries/web/forms.js

@@ -34,6 +34,6 @@ async function parseFormBody(request) {
   return { fields, files };
 }
 export {
-  parseFormBody,
-  createCsrfProtection
+  createCsrfProtection,
+  parseFormBody
 };

package/dist/entries/web/routing.js

@@ -2,7 +2,7 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/web/routing.ts
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling as withErrorHandling2 } from "@getstrata/core/http/response";
 
 // ../../src/bootstrap/http/securedRouteModelBinding.ts
 import {
@@ -26,6 +26,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -178,7 +179,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -188,19 +189,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -296,14 +297,14 @@ function toRouteRequest(request) {
   return request;
 }
 function wrapSecuredRouteModelByKey(param, resolver, authorization, handler) {
-  const bound = withErrorHandling(securedBindRouteModelByKey(param, resolver, authorization, handler));
+  const bound = withErrorHandling2(securedBindRouteModelByKey(param, resolver, authorization, handler));
   return async (request) => bound(toRouteRequest(request));
 }
 function wrapWebLogin(kernel, handler, onThrottled) {
-  return wrapWebThrottle(kernel, "login", handler, onThrottled);
+  return kernel.wrapWeb(wrapWebThrottle(kernel, "login", handler, onThrottled));
 }
 function wrapWebRegister(kernel, handler, onThrottled) {
-  return wrapWebThrottle(kernel, "register", handler, onThrottled);
+  return kernel.wrapWeb(wrapWebThrottle(kernel, "register", handler, onThrottled));
 }
 function wrapWebThrottle(kernel, scope, handler, onThrottled) {
   const throttled = scope === "login" ? kernel.wrapLogin(handler) : kernel.wrapRegister(handler);
@@ -319,10 +320,10 @@ function createRouteKernel(dependencies) {
   return createHttpKernel(dependencies);
 }
 export {
-  wrapWebRegister,
-  wrapWebLogin,
-  wrapSecuredRouteModelByKey,
-  toRouteRequest,
+  createRouteKernel,
   routeParams,
-  createRouteKernel
+  toRouteRequest,
+  wrapSecuredRouteModelByKey,
+  wrapWebLogin,
+  wrapWebRegister
 };

package/dist/entries/web/server.js

@@ -54,6 +54,6 @@ function createWebServer(options) {
   });
 }
 export {
-  createWebServer,
-  convertAppRoutesToBunRoutes
+  convertAppRoutesToBunRoutes,
+  createWebServer
 };