@getstrata/core 0.4.0 → 0.5.0

package/dist/entries/errors/http.js

@@ -0,0 +1,78 @@
+// @bun
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+export {
+  ValidationError,
+  UnprocessableEntityError,
+  UnauthorizedError,
+  PreconditionFailedError,
+  PayloadTooLargeError,
+  NotFoundError,
+  HttpError,
+  ForbiddenError,
+  ConflictError,
+  BadRequestError
+};

package/dist/entries/http/contentNegotiation.js

@@ -0,0 +1,26 @@
+// @bun
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  return pathname.startsWith("/api/");
+}
+export {
+  requestPrefersJson
+};

package/dist/entries/http/csrfToken.js

@@ -0,0 +1,147 @@
+// @bun
+// ../../src/core/http/csrfToken.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage;
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/http/csrfToken.ts
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+}
+function signCsrfToken(token, issuedAt) {
+  const payload = `${token}.${issuedAt}`;
+  const signature = createHmac("sha256", resolveCsrfSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCsrfCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === CSRF_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseSignedCsrfValue(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [token, issuedAtRaw, cookieSignature] = parts;
+  if (!token || !issuedAtRaw || !cookieSignature) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt)) {
+    return null;
+  }
+  if (Date.now() - issuedAt > CSRF_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  return { token, issuedAt };
+}
+function createCsrfTokenCookie() {
+  const token = randomBytes(24).toString("hex");
+  const issuedAt = Date.now();
+  const value = signCsrfToken(token, issuedAt);
+  return {
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+  };
+}
+function resolveCsrfToken(request) {
+  const cookieValue = readCsrfCookie(request);
+  if (cookieValue) {
+    const parsed = parseSignedCsrfValue(cookieValue);
+    if (parsed) {
+      return { token: parsed.token };
+    }
+  }
+  return createCsrfTokenCookie();
+}
+function readSubmittedCsrfToken(request) {
+  const headerToken = request.headers.get("x-csrf-token")?.trim();
+  if (headerToken) {
+    return headerToken;
+  }
+  return null;
+}
+async function readSubmittedCsrfTokenFromBody(request) {
+  const headerToken = readSubmittedCsrfToken(request);
+  if (headerToken) {
+    return headerToken;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    const formData = await request.clone().formData();
+    const field = formData.get("_token");
+    if (typeof field === "string" && field.trim().length > 0) {
+      return field.trim();
+    }
+  }
+  return null;
+}
+function verifyCsrfToken(request, submittedToken) {
+  if (!submittedToken) {
+    return false;
+  }
+  const cookieValue = readCsrfCookie(request);
+  if (!cookieValue) {
+    return false;
+  }
+  const parsed = parseSignedCsrfValue(cookieValue);
+  if (!parsed) {
+    return false;
+  }
+  const submittedBuffer = Buffer.from(submittedToken);
+  const expectedBuffer = Buffer.from(parsed.token);
+  if (submittedBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(submittedBuffer, expectedBuffer);
+}
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
+  }
+  return resolveCsrfToken(request).token;
+}
+export {
+  verifyCsrfToken,
+  resolveCsrfTokenForRequest,
+  resolveCsrfToken,
+  readSubmittedCsrfTokenFromBody,
+  readSubmittedCsrfToken,
+  createCsrfTokenCookie,
+  CSRF_COOKIE
+};

package/dist/entries/http/etag.js

@@ -0,0 +1,170 @@
+// @bun
+// ../../src/core/http/etag.ts
+import { createHash } from "crypto";
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function computeEtagFromJson(data) {
+  const digest = createHash("sha256").update(JSON.stringify(data)).digest("hex").slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = createHash("sha256").update(`${String(resource.id ?? "0")}:${versionText}`).digest("hex").slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+export {
+  notModifiedResponse,
+  isEtagEnabled,
+  ifNoneMatchSatisfied,
+  ifMatchSatisfied,
+  etagValuesMatch,
+  etagFromResource,
+  computeEtagFromJson,
+  assertIfMatch,
+  applyConditionalGet
+};

package/dist/entries/http/flashSession.js

@@ -0,0 +1,106 @@
+// @bun
+// ../../src/core/http/flashSession.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function createFlashCookie(message) {
+  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
+  const issuedAt = Date.now();
+  const value = signFlashPayload(payload, issuedAt);
+  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+function flashResponse(response, message) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", createFlashCookie(message));
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+export {
+  withFlashClear,
+  pullFlash,
+  flashResponse,
+  createFlashCookie,
+  clearFlashCookie
+};

package/dist/entries/http/middleware.js

@@ -0,0 +1,68 @@
+// @bun
+// ../../src/core/http/middleware.ts
+function isRouteHandler(value) {
+  return typeof value === "function";
+}
+function isMethodRouteMap(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const entries = Object.entries(value);
+  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
+}
+function composeMiddleware(...middleware) {
+  return (handler) => {
+    return async (request) => {
+      let index = 0;
+      const dispatch = async () => {
+        if (index >= middleware.length) {
+          return await handler(request);
+        }
+        const current = middleware[index];
+        index += 1;
+        if (!current) {
+          return await handler(request);
+        }
+        return await current(request, dispatch);
+      };
+      return await dispatch();
+    };
+  };
+}
+async function requestIdMiddleware(request, next) {
+  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+  const response = await next();
+  const headers = new Headers(response.headers);
+  headers.set("x-request-id", requestId);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function wrapRouteHandler(handler, middleware) {
+  if (isMethodRouteMap(handler)) {
+    const wrapped = {};
+    for (const [method, routeHandler] of Object.entries(handler)) {
+      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
+    }
+    return wrapped;
+  }
+  if (isRouteHandler(handler)) {
+    return composeMiddleware(...middleware)(handler);
+  }
+  return handler;
+}
+function applyMiddlewareToRoutes(routes, middleware) {
+  const wrapped = {};
+  for (const [path, routeHandler] of Object.entries(routes)) {
+    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
+  }
+  return wrapped;
+}
+export {
+  wrapRouteHandler,
+  requestIdMiddleware,
+  composeMiddleware,
+  applyMiddlewareToRoutes
+};

package/dist/entries/http/parseFormBody.js

@@ -0,0 +1,88 @@
+// @bun
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/http/parseFormBody.ts
+async function parseFormBody(request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded") && !contentType.includes("multipart/form-data")) {
+    throw new BadRequestError("Expected a form submission.");
+  }
+  return formDataToRecord(await request.formData());
+}
+function formDataToRecord(formData) {
+  const values = {};
+  for (const [key, value] of formData.entries()) {
+    if (typeof value === "string") {
+      values[key] = value;
+    }
+  }
+  return values;
+}
+export {
+  parseFormBody,
+  formDataToRecord
+};

package/dist/entries/http/requestMetaContext.js

@@ -0,0 +1,18 @@
+// @bun
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage;
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+export {
+  runWithRequestMeta,
+  requestMetaContext,
+  currentRequestMeta
+};