@getstrata/bootstrap 1.0.8 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/bootstrap changelog
 
+## 1.1.0
+
+Lockstep with `@getstrata/core` 1.1.0. Cookie sessions select `s.created_at AS session_created_at` so `users.created_at` from `u.*` cannot clobber the session issued-at. API group always includes session-mutating CSRF. `buildModuleRoutes` maps thrown API middleware errors (including CSRF `ForbiddenError`) to JSON. `HttpKernel.wrap("api")` does the same for routes used outside that builder. Path confinement on the web server and safer production defaults. The rls role denylist checks the runtime URL (`APP_DATABASE_URL` when set, otherwise `DATABASE_URL`) so fixture admin `DATABASE_URL` can stay `postgres`.
+
+## 1.0.9
+
+Label HiroApp as internal e2e dogfood and seed notes via Model
+
 ## 1.0.8
 
 - Container image starts and ships production dependencies only.

package/dist/bootstrap/secretsGuard.d.ts

@@ -1,2 +1,14 @@
+type LivePostgresRoleInspector = () => Promise<{
+    rolname: string;
+    rolsuper: boolean;
+    rolbypassrls: boolean;
+} | null>;
+declare function setLivePostgresRoleInspectorForTests(inspect: LivePostgresRoleInspector | null): void;
+/**
+ * After the runtime pool is open, refuse rolsuper / rolbypassrls whenever
+ * TENANCY_DRIVER=rls, including local. Fail closed if the live query cannot run.
+ * MIGRATION_DATABASE_URL may stay a superuser.
+ */
+declare function assertRlsLiveDatabaseRole(env?: Record<string, string | undefined>, inspect?: LivePostgresRoleInspector): Promise<void>;
 declare function assertProductionSecrets(env?: Record<string, string | undefined>): void;
-export { assertProductionSecrets };
+export { assertProductionSecrets, assertRlsLiveDatabaseRole, setLivePostgresRoleInspectorForTests };

package/dist/bootstrap/web/session.d.ts

@@ -42,6 +42,7 @@ export declare class CookieSessionStore {
     private sql;
     create(user: SessionUser, meta?: SessionCreateMeta): Promise<string>;
     destroy(sessionId: string): Promise<void>;
+    destroyAllSessions(userId: number): Promise<void>;
     destroyOtherSessions(userId: number, keepSessionId: string): Promise<void>;
     listForUser(userId: number): Promise<BrowserSessionRecord[]>;
     touch(sessionId: string): Promise<void>;

package/dist/entries/buildModuleRoutes.js

@@ -2,6 +2,7 @@
 // ../../src/bootstrap/buildModuleRoutes.ts
 import { conditionalJsonResponse } from "@getstrata/core/http/conditionalResponse";
 import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
+import { createJsonErrorMiddleware } from "@getstrata/core/http/response";
 
 // ../../src/bootstrap/httpKernel.ts
 import {
@@ -138,8 +139,9 @@ class HttpKernel {
       case "web":
         return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
       case "api": {
+        const csrf = createCsrfMiddleware();
         if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
+          return [csrf];
         }
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
@@ -149,7 +151,8 @@ class HttpKernel {
             createMemoryThrottleMiddleware({
               maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
-            })
+            }),
+            csrf
           ];
         }
         const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
@@ -158,7 +161,8 @@ class HttpKernel {
             redisUrl,
             maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
             decaySeconds: 60
-          })
+          }),
+          csrf
         ];
       }
       default:
@@ -168,13 +172,14 @@ class HttpKernel {
   wrap(groups, handler) {
     const names = Array.isArray(groups) ? groups : [groups];
     const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
+    const wrapped = middleware.length === 0 ? handler : withMiddleware(...middleware)(handler);
+    if (names.includes("api")) {
+      return withJsonErrorHandling(wrapped);
     }
-    return withMiddleware(...middleware)(handler);
+    return wrapped;
   }
   wrapApi(handler) {
-    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
+    return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -283,41 +288,28 @@ class HttpKernel {
     return [createRequireVerifiedMiddleware(auth)];
   }
   wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
     const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
+    const redisUrl = this.dependencies.container.has(CORE_CONFIG_TOKEN) ? this.dependencies.container.resolve(CORE_CONFIG_TOKEN).get(REDIS_URL_CONFIG_KEY)?.trim() ?? "" : "";
+    if (scope === "login") {
+      return withMiddleware(createLoginThrottleMiddleware({
+        ...redisUrl ? { redisUrl } : {},
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds
+      }))(handler);
+    }
+    if (redisUrl) {
+      return withMiddleware(createThrottleMiddleware({
+        redisUrl,
         maxAttempts: rateLimit.maxAttempts,
         decaySeconds: rateLimit.decaySeconds,
         keyPrefix: memoryKeyPrefix
-      }));
-    }
-    if (middleware.length === 0) {
-      return handler;
+      }))(handler);
     }
-    return withMiddleware(...middleware)(handler);
+    return withMiddleware(createMemoryThrottleMiddleware({
+      maxAttempts: rateLimit.maxAttempts,
+      decaySeconds: rateLimit.decaySeconds,
+      keyPrefix: memoryKeyPrefix
+    }))(handler);
   }
 }
 function createHttpKernel(dependencies) {
@@ -462,7 +454,11 @@ function buildModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("api")];
+  const middleware = [
+    ...kernel.globalMiddleware(),
+    createJsonErrorMiddleware(),
+    ...kernel.group("api")
+  ];
   const cachedJson = createCachedJson(dependencies);
   const moduleRoutes = {};
   for (const module of modules) {

package/dist/entries/buildWebModuleRoutes.js

@@ -5,6 +5,7 @@ import { applyMiddlewareToRoutes as applyMiddlewareToRoutes2 } from "@getstrata/
 // ../../src/bootstrap/buildModuleRoutes.ts
 import { conditionalJsonResponse } from "@getstrata/core/http/conditionalResponse";
 import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
+import { createJsonErrorMiddleware } from "@getstrata/core/http/response";
 
 // ../../src/bootstrap/httpKernel.ts
 import {
@@ -141,8 +142,9 @@ class HttpKernel {
       case "web":
         return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
       case "api": {
+        const csrf = createCsrfMiddleware();
         if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
+          return [csrf];
         }
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
@@ -152,7 +154,8 @@ class HttpKernel {
             createMemoryThrottleMiddleware({
               maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
-            })
+            }),
+            csrf
           ];
         }
         const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
@@ -161,7 +164,8 @@ class HttpKernel {
             redisUrl,
             maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
             decaySeconds: 60
-          })
+          }),
+          csrf
         ];
       }
       default:
@@ -171,13 +175,14 @@ class HttpKernel {
   wrap(groups, handler) {
     const names = Array.isArray(groups) ? groups : [groups];
     const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
+    const wrapped = middleware.length === 0 ? handler : withMiddleware(...middleware)(handler);
+    if (names.includes("api")) {
+      return withJsonErrorHandling(wrapped);
     }
-    return withMiddleware(...middleware)(handler);
+    return wrapped;
   }
   wrapApi(handler) {
-    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
+    return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -286,41 +291,28 @@ class HttpKernel {
     return [createRequireVerifiedMiddleware(auth)];
   }
   wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
     const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
+    const redisUrl = this.dependencies.container.has(CORE_CONFIG_TOKEN) ? this.dependencies.container.resolve(CORE_CONFIG_TOKEN).get(REDIS_URL_CONFIG_KEY)?.trim() ?? "" : "";
+    if (scope === "login") {
+      return withMiddleware(createLoginThrottleMiddleware({
+        ...redisUrl ? { redisUrl } : {},
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds
+      }))(handler);
+    }
+    if (redisUrl) {
+      return withMiddleware(createThrottleMiddleware({
+        redisUrl,
         maxAttempts: rateLimit.maxAttempts,
         decaySeconds: rateLimit.decaySeconds,
         keyPrefix: memoryKeyPrefix
-      }));
-    }
-    if (middleware.length === 0) {
-      return handler;
+      }))(handler);
     }
-    return withMiddleware(...middleware)(handler);
+    return withMiddleware(createMemoryThrottleMiddleware({
+      maxAttempts: rateLimit.maxAttempts,
+      decaySeconds: rateLimit.decaySeconds,
+      keyPrefix: memoryKeyPrefix
+    }))(handler);
   }
 }
 function createHttpKernel(dependencies) {
@@ -465,7 +457,11 @@ function buildModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("api")];
+  const middleware = [
+    ...kernel.globalMiddleware(),
+    createJsonErrorMiddleware(),
+    ...kernel.group("api")
+  ];
   const cachedJson = createCachedJson(dependencies);
   const moduleRoutes = {};
   for (const module of modules) {

package/dist/entries/context.js

@@ -108,7 +108,7 @@ import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var authConfig = {
   allowDevHeaders: envFlagEnabled(process.env.AUTH_DEV_HEADERS),
-  tokenDefaultAbilities: ["*"]
+  tokenDefaultAbilities: []
 };
 
 // ../../src/bootstrap/config.ts
@@ -144,7 +144,7 @@ var authProvider = {
     config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
     const apiGuard = new DatabaseTokenGuard(container);
     const sessionGuard = new SessionGuard(container);
-    const jwtGuard = new JwtGuard;
+    const jwtGuard = new JwtGuard(container);
     const basicGuard = new BasicAuthGuard(container);
     const guards = [apiGuard, jwtGuard, basicGuard, sessionGuard];
     if (authConfig.allowDevHeaders) {
@@ -189,7 +189,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 var appConfig = {
   name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  debug: (process.env.APP_DEBUG ?? "false") === "true",
   url: process.env.APP_URL ?? "http://localhost:3000",
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };

package/dist/entries/createSpaRoutes.js

@@ -3,6 +3,7 @@
 import { join } from "path";
 import { jsonResponse } from "@getstrata/core/http/response";
 import { isSpaEnabled, isViewsEnabled, readSpaPrefix } from "@getstrata/core/runtime/frontendMode";
+import { assertPathUnderRoot } from "@getstrata/core/security/safePath";
 var SPA_DIST_DIRECTORY = join(process.cwd(), "frontend/dist");
 function relativeSpaPath(pathname, prefix) {
   if (pathname === prefix || pathname === `${prefix}/`) {
@@ -21,9 +22,15 @@ function createSpaDocumentHandler(prefix, distDirectory) {
       return new Response("Not found", { status: 404 });
     }
     const relativePath = relativeSpaPath(pathname, prefix);
-    const assetFile = Bun.file(join(distDirectory, relativePath));
-    if (relativePath.length > 0 && await assetFile.exists()) {
-      return new Response(assetFile);
+    if (relativePath.length > 0) {
+      try {
+        const assetFile = Bun.file(assertPathUnderRoot(distDirectory, relativePath));
+        if (await assetFile.exists()) {
+          return new Response(assetFile);
+        }
+      } catch {
+        return new Response("Not found", { status: 404 });
+      }
     }
     const indexFile = Bun.file(indexFilePath);
     if (await indexFile.exists()) {

package/dist/entries/createWebRoutes.js

@@ -2,6 +2,7 @@
 // ../../src/bootstrap/createWebRoutes.ts
 import { join as join2 } from "path";
 import { isViewsEnabled as isViewsEnabled2 } from "@getstrata/core/runtime/frontendMode";
+import { assertUrlPathUnderRoot } from "@getstrata/core/security/safePath";
 import { notFoundHtmlResponse } from "@getstrata/core/view";
 
 // ../../src/bootstrap/buildWebModuleRoutes.ts
@@ -10,6 +11,7 @@ import { applyMiddlewareToRoutes as applyMiddlewareToRoutes2 } from "@getstrata/
 // ../../src/bootstrap/buildModuleRoutes.ts
 import { conditionalJsonResponse } from "@getstrata/core/http/conditionalResponse";
 import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
+import { createJsonErrorMiddleware } from "@getstrata/core/http/response";
 
 // ../../src/bootstrap/httpKernel.ts
 import {
@@ -146,8 +148,9 @@ class HttpKernel {
       case "web":
         return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
       case "api": {
+        const csrf = createCsrfMiddleware();
         if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
+          return [csrf];
         }
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
@@ -157,7 +160,8 @@ class HttpKernel {
             createMemoryThrottleMiddleware({
               maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
-            })
+            }),
+            csrf
           ];
         }
         const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
@@ -166,7 +170,8 @@ class HttpKernel {
             redisUrl,
             maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
             decaySeconds: 60
-          })
+          }),
+          csrf
         ];
       }
       default:
@@ -176,13 +181,14 @@ class HttpKernel {
   wrap(groups, handler) {
     const names = Array.isArray(groups) ? groups : [groups];
     const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
+    const wrapped = middleware.length === 0 ? handler : withMiddleware(...middleware)(handler);
+    if (names.includes("api")) {
+      return withJsonErrorHandling(wrapped);
     }
-    return withMiddleware(...middleware)(handler);
+    return wrapped;
   }
   wrapApi(handler) {
-    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
+    return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -291,41 +297,28 @@ class HttpKernel {
     return [createRequireVerifiedMiddleware(auth)];
   }
   wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
     const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
+    const redisUrl = this.dependencies.container.has(CORE_CONFIG_TOKEN) ? this.dependencies.container.resolve(CORE_CONFIG_TOKEN).get(REDIS_URL_CONFIG_KEY)?.trim() ?? "" : "";
+    if (scope === "login") {
+      return withMiddleware(createLoginThrottleMiddleware({
+        ...redisUrl ? { redisUrl } : {},
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds
+      }))(handler);
+    }
+    if (redisUrl) {
+      return withMiddleware(createThrottleMiddleware({
+        redisUrl,
         maxAttempts: rateLimit.maxAttempts,
         decaySeconds: rateLimit.decaySeconds,
         keyPrefix: memoryKeyPrefix
-      }));
+      }))(handler);
     }
-    if (middleware.length === 0) {
-      return handler;
-    }
-    return withMiddleware(...middleware)(handler);
+    return withMiddleware(createMemoryThrottleMiddleware({
+      maxAttempts: rateLimit.maxAttempts,
+      decaySeconds: rateLimit.decaySeconds,
+      keyPrefix: memoryKeyPrefix
+    }))(handler);
   }
 }
 function createHttpKernel(dependencies) {
@@ -470,7 +463,11 @@ function buildModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("api")];
+  const middleware = [
+    ...kernel.globalMiddleware(),
+    createJsonErrorMiddleware(),
+    ...kernel.group("api")
+  ];
   const cachedJson = createCachedJson(dependencies);
   const moduleRoutes = {};
   for (const module of modules) {
@@ -518,12 +515,16 @@ function createWebRoutes(dependencies, options = {}) {
   wrappedRoutes["/assets/*"] = async (request) => {
     registerRoute("GET", "/assets/*", ["global", "web"]);
     const pathname = new URL(request.url).pathname;
-    const relativePath = pathname.replace(/^\//, "");
-    const file = Bun.file(join2(process.cwd(), "public", relativePath));
-    if (!await file.exists()) {
+    try {
+      const filePath = assertUrlPathUnderRoot(join2(process.cwd(), "public"), pathname);
+      const file = Bun.file(filePath);
+      if (!await file.exists()) {
+        return notFoundHtmlResponse();
+      }
+      return new Response(file);
+    } catch {
       return notFoundHtmlResponse();
     }
-    return new Response(file);
   };
   registerRoute("GET", "/assets/*", ["global", "web"]);
   return wrappedRoutes;

package/dist/entries/dependencies.js

@@ -108,7 +108,7 @@ import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var authConfig = {
   allowDevHeaders: envFlagEnabled(process.env.AUTH_DEV_HEADERS),
-  tokenDefaultAbilities: ["*"]
+  tokenDefaultAbilities: []
 };
 
 // ../../src/bootstrap/config.ts
@@ -144,7 +144,7 @@ var authProvider = {
     config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
     const apiGuard = new DatabaseTokenGuard(container);
     const sessionGuard = new SessionGuard(container);
-    const jwtGuard = new JwtGuard;
+    const jwtGuard = new JwtGuard(container);
     const basicGuard = new BasicAuthGuard(container);
     const guards = [apiGuard, jwtGuard, basicGuard, sessionGuard];
     if (authConfig.allowDevHeaders) {
@@ -189,7 +189,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 var appConfig = {
   name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  debug: (process.env.APP_DEBUG ?? "false") === "true",
   url: process.env.APP_URL ?? "http://localhost:3000",
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };

package/dist/entries/health.js

@@ -3,6 +3,7 @@
 import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
 import { jsonResponse } from "@getstrata/core/http/response";
+import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var {RedisClient } = globalThis.Bun;
 
 // ../../src/bootstrap/config.ts
@@ -114,10 +115,10 @@ function createHealthRoutes(dependencies, options = {}) {
     "/ready": async () => {
       const extra = await resolveExtraFields(options.extra);
       const { checks, ready } = await collectDependencyChecks(dependencies);
+      const debug = envFlagEnabled(process.env.APP_DEBUG);
       return jsonResponse({
         status: ready ? "ready" : "not_ready",
-        checks,
-        ...extra
+        ...debug ? { checks, ...extra } : {}
       }, { status: ready ? 200 : 503 });
     }
   };

package/dist/entries/httpKernel.js

@@ -134,8 +134,9 @@ class HttpKernel {
       case "web":
         return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
       case "api": {
+        const csrf = createCsrfMiddleware();
         if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
+          return [csrf];
         }
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
@@ -145,7 +146,8 @@ class HttpKernel {
             createMemoryThrottleMiddleware({
               maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
-            })
+            }),
+            csrf
           ];
         }
         const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
@@ -154,7 +156,8 @@ class HttpKernel {
             redisUrl,
             maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
             decaySeconds: 60
-          })
+          }),
+          csrf
         ];
       }
       default:
@@ -164,13 +167,14 @@ class HttpKernel {
   wrap(groups, handler) {
     const names = Array.isArray(groups) ? groups : [groups];
     const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
+    const wrapped = middleware.length === 0 ? handler : withMiddleware(...middleware)(handler);
+    if (names.includes("api")) {
+      return withJsonErrorHandling(wrapped);
     }
-    return withMiddleware(...middleware)(handler);
+    return wrapped;
   }
   wrapApi(handler) {
-    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
+    return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -279,41 +283,28 @@ class HttpKernel {
     return [createRequireVerifiedMiddleware(auth)];
   }
   wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
     const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
+    const redisUrl = this.dependencies.container.has(CORE_CONFIG_TOKEN) ? this.dependencies.container.resolve(CORE_CONFIG_TOKEN).get(REDIS_URL_CONFIG_KEY)?.trim() ?? "" : "";
+    if (scope === "login") {
+      return withMiddleware(createLoginThrottleMiddleware({
+        ...redisUrl ? { redisUrl } : {},
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds
+      }))(handler);
+    }
+    if (redisUrl) {
+      return withMiddleware(createThrottleMiddleware({
+        redisUrl,
         maxAttempts: rateLimit.maxAttempts,
         decaySeconds: rateLimit.decaySeconds,
         keyPrefix: memoryKeyPrefix
-      }));
-    }
-    if (middleware.length === 0) {
-      return handler;
+      }))(handler);
     }
-    return withMiddleware(...middleware)(handler);
+    return withMiddleware(createMemoryThrottleMiddleware({
+      maxAttempts: rateLimit.maxAttempts,
+      decaySeconds: rateLimit.decaySeconds,
+      keyPrefix: memoryKeyPrefix
+    }))(handler);
   }
 }
 function createHttpKernel(dependencies) {