@getstrata/bootstrap 1.0.2 → 1.0.4

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @getstrata/bootstrap changelog
 
+## 1.0.4
+
+- `assertProductionSecrets()` uses `isProductionEnv()`, so `NODE_ENV=production`, `APP_ENV=Production`, and `APP_ENV=staging` cannot skip the guard.
+- Feature flags parse with `envFlagEnabled()` (`=== "true"` only).
+
+## 1.0.3
+
+- Lockstep with `create-strata` 1.0.3. No runtime changes.
+
 ## 1.0.2
 
 - Lockstep with `create-strata` 1.0.2. No runtime changes.

package/README.md

@@ -20,7 +20,7 @@ bun add @getstrata/bootstrap @getstrata/core
 import { coreProviders, createAppContext, createHttpKernel } from "@getstrata/bootstrap";
 ```
 
-`createAppContext()` does not call `assertProductionSecrets`. Call that yourself when `APP_ENV=production`; it is feature-gated, so an HTML app with API tokens off is not asked for token secrets. It rejects empty secrets, short `SESSION_SECRET` values, wildcard `CORS_ALLOWED_ORIGINS`, `AUTH_DEV_HEADERS=true`, `FEATURE_PUBLIC_READS=true`, and any secret still holding a generated `change-me` placeholder.
+`createAppContext()` does not call `assertProductionSecrets`. Call that yourself when `isProductionEnv()` is true (`APP_ENV` or `NODE_ENV` production, `APP_ENV=staging`, or an unrecognized `APP_ENV`); it is feature-gated, so an HTML app with API tokens off is not asked for token secrets. It rejects empty secrets, short `SESSION_SECRET` values, wildcard `CORS_ALLOWED_ORIGINS`, `AUTH_DEV_HEADERS` other than `false`, `FEATURE_PUBLIC_READS=true`, and any secret still holding a generated `change-me` placeholder.
 
 Build routes with `buildWebModuleRoutes` and `buildModuleRoutes`.
 

package/dist/entries/context.js

@@ -105,8 +105,9 @@ import { JwtGuard } from "@getstrata/core/auth/jwtGuard";
 import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 
 // ../../src/config/auth.ts
+import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var authConfig = {
-  allowDevHeaders: process.env.AUTH_DEV_HEADERS === "true",
+  allowDevHeaders: envFlagEnabled(process.env.AUTH_DEV_HEADERS),
   tokenDefaultAbilities: ["*"]
 };
 

package/dist/entries/dependencies.js

@@ -105,8 +105,9 @@ import { JwtGuard } from "@getstrata/core/auth/jwtGuard";
 import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 
 // ../../src/config/auth.ts
+import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var authConfig = {
-  allowDevHeaders: process.env.AUTH_DEV_HEADERS === "true",
+  allowDevHeaders: envFlagEnabled(process.env.AUTH_DEV_HEADERS),
   tokenDefaultAbilities: ["*"]
 };
 

package/dist/entries/providers.js

@@ -11,8 +11,9 @@ import { JwtGuard } from "@getstrata/core/auth/jwtGuard";
 import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 
 // ../../src/config/auth.ts
+import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var authConfig = {
-  allowDevHeaders: process.env.AUTH_DEV_HEADERS === "true",
+  allowDevHeaders: envFlagEnabled(process.env.AUTH_DEV_HEADERS),
   tokenDefaultAbilities: ["*"]
 };
 

package/dist/entries/secretsGuard.js

@@ -1,5 +1,6 @@
 // @bun
 // ../../src/bootstrap/secretsGuard.ts
+import { envFlagEnabled, isProductionEnv } from "@getstrata/core/runtime/appEnv";
 import { isViewsMode, parseFrontendMode } from "@getstrata/core/runtime/frontendMode";
 var PUBLISHED_TEST_ADMIN_API_TOKEN = "strata-admin-test-token";
 var PUBLISHED_TEST_MEMBER_API_TOKEN = "strata-member-test-token";
@@ -29,23 +30,17 @@ function assertNoPlaceholderSecrets(env) {
     throw new Error(`Production startup blocked: replace the generated placeholder values for ${unrotated.join(", ")}.`);
   }
 }
-function isEnabled(value, defaultEnabled) {
-  if (value === undefined) {
-    return defaultEnabled;
-  }
-  return defaultEnabled ? value !== "false" : value === "true";
-}
 function isTokenAuthEnabled(env) {
-  return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || env.FEATURE_API_TOKENS === "true";
+  return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || envFlagEnabled(env.FEATURE_API_TOKENS);
 }
 function isOAuthEnabled(env) {
-  return isEnabled(env.FEATURE_OAUTH, false) || isEnabled(env.FEATURE_SAML, false) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
+  return envFlagEnabled(env.FEATURE_OAUTH) || envFlagEnabled(env.FEATURE_SAML) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
 }
 function isCorsConfigured(env) {
   return env.CORS_ALLOWED_ORIGINS !== undefined;
 }
 function assertAuthDevHeadersDisabled(env) {
-  if (isEnabled(env.AUTH_DEV_HEADERS, true)) {
+  if (env.AUTH_DEV_HEADERS !== "false") {
     throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
 }
@@ -76,16 +71,16 @@ function assertTokenAuthProductionSecrets(env) {
   }
 }
 function assertFeatureProductionSecrets(env) {
-  if (isEnabled(env.FEATURE_SCIM, false)) {
+  if (envFlagEnabled(env.FEATURE_SCIM)) {
     const scimToken = env.SCIM_BEARER_TOKEN ?? PUBLISHED_TEST_SCIM_BEARER_TOKEN;
     if (PUBLISHED_TEST_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
       throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
     }
   }
-  if (isEnabled(env.FEATURE_FIELD_ENCRYPTION, false) && !env.KMS_ENCRYPTION_KEY?.trim()) {
+  if (envFlagEnabled(env.FEATURE_FIELD_ENCRYPTION) && !env.KMS_ENCRYPTION_KEY?.trim()) {
     throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
   }
-  if (isEnabled(env.FEATURE_BILLING, false) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+  if (envFlagEnabled(env.FEATURE_BILLING) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
     throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
   }
   if (isOAuthEnabled(env) && !env.OAUTH_STATE_SECRET?.trim()) {
@@ -97,10 +92,10 @@ function assertFeatureProductionSecrets(env) {
       throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
     }
   }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, false)) {
+  if (envFlagEnabled(env.FEATURE_PUBLIC_READS)) {
     throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
   }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, false)) {
+  if (!env.SIEM_EXPORT_URL?.trim() && envFlagEnabled(env.FEATURE_SIEM_EXPORT)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
 }
@@ -121,8 +116,7 @@ function assertPublicAppUrl(env) {
   }
 }
 function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? "local";
-  if (appEnv !== "production") {
+  if (!isProductionEnv(env)) {
     return;
   }
   assertNoPlaceholderSecrets(env);

package/dist/index.js

@@ -538,8 +538,9 @@ import { JwtGuard } from "@getstrata/core/auth/jwtGuard";
 import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 
 // ../../src/config/auth.ts
+import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var authConfig = {
-  allowDevHeaders: process.env.AUTH_DEV_HEADERS === "true",
+  allowDevHeaders: envFlagEnabled(process.env.AUTH_DEV_HEADERS),
   tokenDefaultAbilities: ["*"]
 };
 
@@ -1139,6 +1140,7 @@ import {
 // ../../src/bootstrap/membershipService.ts
 import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
 // ../../src/bootstrap/secretsGuard.ts
+import { envFlagEnabled as envFlagEnabled2, isProductionEnv } from "@getstrata/core/runtime/appEnv";
 import { isViewsMode, parseFrontendMode } from "@getstrata/core/runtime/frontendMode";
 var PUBLISHED_TEST_ADMIN_API_TOKEN = "strata-admin-test-token";
 var PUBLISHED_TEST_MEMBER_API_TOKEN = "strata-member-test-token";
@@ -1168,23 +1170,17 @@ function assertNoPlaceholderSecrets(env) {
     throw new Error(`Production startup blocked: replace the generated placeholder values for ${unrotated.join(", ")}.`);
   }
 }
-function isEnabled(value, defaultEnabled) {
-  if (value === undefined) {
-    return defaultEnabled;
-  }
-  return defaultEnabled ? value !== "false" : value === "true";
-}
 function isTokenAuthEnabled(env) {
-  return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || env.FEATURE_API_TOKENS === "true";
+  return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || envFlagEnabled2(env.FEATURE_API_TOKENS);
 }
 function isOAuthEnabled(env) {
-  return isEnabled(env.FEATURE_OAUTH, false) || isEnabled(env.FEATURE_SAML, false) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
+  return envFlagEnabled2(env.FEATURE_OAUTH) || envFlagEnabled2(env.FEATURE_SAML) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
 }
 function isCorsConfigured(env) {
   return env.CORS_ALLOWED_ORIGINS !== undefined;
 }
 function assertAuthDevHeadersDisabled(env) {
-  if (isEnabled(env.AUTH_DEV_HEADERS, true)) {
+  if (env.AUTH_DEV_HEADERS !== "false") {
     throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
 }
@@ -1215,16 +1211,16 @@ function assertTokenAuthProductionSecrets(env) {
   }
 }
 function assertFeatureProductionSecrets(env) {
-  if (isEnabled(env.FEATURE_SCIM, false)) {
+  if (envFlagEnabled2(env.FEATURE_SCIM)) {
     const scimToken = env.SCIM_BEARER_TOKEN ?? PUBLISHED_TEST_SCIM_BEARER_TOKEN;
     if (PUBLISHED_TEST_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
       throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
     }
   }
-  if (isEnabled(env.FEATURE_FIELD_ENCRYPTION, false) && !env.KMS_ENCRYPTION_KEY?.trim()) {
+  if (envFlagEnabled2(env.FEATURE_FIELD_ENCRYPTION) && !env.KMS_ENCRYPTION_KEY?.trim()) {
     throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
   }
-  if (isEnabled(env.FEATURE_BILLING, false) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+  if (envFlagEnabled2(env.FEATURE_BILLING) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
     throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
   }
   if (isOAuthEnabled(env) && !env.OAUTH_STATE_SECRET?.trim()) {
@@ -1236,10 +1232,10 @@ function assertFeatureProductionSecrets(env) {
       throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
     }
   }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, false)) {
+  if (envFlagEnabled2(env.FEATURE_PUBLIC_READS)) {
     throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
   }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, false)) {
+  if (!env.SIEM_EXPORT_URL?.trim() && envFlagEnabled2(env.FEATURE_SIEM_EXPORT)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
 }
@@ -1260,8 +1256,7 @@ function assertPublicAppUrl(env) {
   }
 }
 function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? "local";
-  if (appEnv !== "production") {
+  if (!isProductionEnv(env)) {
     return;
   }
   assertNoPlaceholderSecrets(env);
@@ -1436,7 +1431,7 @@ import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/co
 import { currentSqlDialect, sqlTimestamp } from "@getstrata/core/database/dialect";
 import { readRequestCookie } from "@getstrata/core/http/cookies";
 import { currentRequestMeta as currentRequestMeta3 } from "@getstrata/core/http/requestMetaContext";
-import { isProductionEnv } from "@getstrata/core/runtime/appEnv";
+import { isProductionEnv as isProductionEnv2 } from "@getstrata/core/runtime/appEnv";
 import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
 function sqlPlaceholder(index) {
   return currentSqlDialect().placeholder(index);
@@ -1539,7 +1534,7 @@ class CookieSessionStore {
     return sessionId;
   }
   withSecureFlag(header) {
-    if (!isProductionEnv()) {
+    if (!isProductionEnv2()) {
       return header;
     }
     return header.includes("Secure") ? header : `${header}; Secure`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Strata application bootstrap: HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -175,7 +175,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^1.0.2",
+    "@getstrata/core": "^1.0.4",
     "typescript": "^5.9.0"
   },
   "engines": {