@getstrata/core 0.5.43 → 0.5.44

package/dist/entries/http/securityHeadersMiddleware.js

@@ -0,0 +1,77 @@
+// @bun
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/config/contentSecurityPolicy.ts
+function strictApiContentSecurityPolicy() {
+  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
+}
+function serverHtmxContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self' https://unpkg.com",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function spaContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function resolveContentSecurityPolicy(response) {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("text/html")) {
+    return strictApiContentSecurityPolicy();
+  }
+  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx") {
+    return serverHtmxContentSecurityPolicy();
+  }
+  if (frontendMode === "spa-react") {
+    return spaContentSecurityPolicy();
+  }
+  return strictApiContentSecurityPolicy();
+}
+
+// ../../src/core/http/securityHeadersMiddleware.ts
+function createSecurityHeadersMiddleware() {
+  return async (_request, next) => {
+    const response = await next();
+    const headers = new Headers(response.headers);
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("X-Frame-Options", "DENY");
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    headers.set("X-XSS-Protection", "0");
+    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
+    if (appConfig.env === "production") {
+      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
+}
+export {
+  createSecurityHeadersMiddleware
+};

package/dist/entries/http/throttleMiddleware.js

@@ -0,0 +1,87 @@
+// @bun
+// ../../src/core/http/throttleMiddleware.ts
+var {RedisClient } = globalThis.Bun;
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
+
+// ../../src/core/http/throttleMiddleware.ts
+function resolveThrottleIdentity(request) {
+  const user = currentAuthUser();
+  if (user?.tokenId !== undefined) {
+    return `token:${user.tokenId}`;
+  }
+  if (user) {
+    return `user:${user.id}`;
+  }
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+function createThrottleMiddleware(options) {
+  const client = new RedisClient(options.redisUrl);
+  const prefix = options.keyPrefix ?? "workhub:throttle:";
+  return async (request, next) => {
+    const identity = resolveThrottleIdentity(request);
+    const path = new URL(request.url).pathname;
+    const throttleKey = `${prefix}${identity}:${path}`;
+    const attempts = Number(await client.incr(throttleKey));
+    if (attempts === 1) {
+      await client.expire(throttleKey, options.decaySeconds);
+    }
+    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
+    if (attempts > maxAttempts) {
+      return Response.json({ error: "Too many requests." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
+}
+export {
+  resolveThrottleIdentity,
+  createThrottleMiddleware
+};

package/dist/entries/http/webErrorResponse.js

@@ -2625,6 +2625,7 @@ var db = new Proxy(function database() {}, {
     return typeof value === "function" ? value.bind(connection) : value;
   }
 });
+var connection_default = db;
 
 // ../../src/modules/user/apiTokenTable.ts
 var apiTokenTable = defineTable({
@@ -2766,6 +2767,9 @@ function currentAuthUser() {
 
 // ../../src/core/http/requestMetaContext.ts
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
 function currentRequestMeta() {
   return requestMetaContext.getStore() ?? {
     ipAddress: null,
@@ -2859,6 +2863,16 @@ function currentTenant() {
 function currentTenantId() {
   return currentTenant()?.id ?? 1;
 }
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
 
 // ../../src/domain/abilities.ts
 var MEMBER_ABILITIES = [

package/dist/entries/http/webFormRequest.js

@@ -140,6 +140,16 @@ function currentTenant() {
 function currentTenantId() {
   return currentTenant()?.id ?? 1;
 }
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
 
 // ../../src/core/http/validation.ts
 async function parseJsonBody(request, validator) {

package/dist/entries/logging/requestLoggingMiddleware.js

@@ -0,0 +1,89 @@
+// @bun
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/http/requestMetaContext.ts
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/core/logging/requestLoggingMiddleware.ts
+function createRequestLoggingMiddleware() {
+  return async (request, next) => {
+    return await runWithRequestMeta({
+      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      userAgent: request.headers.get("user-agent"),
+      request
+    }, async () => {
+      const startedAt = performance.now();
+      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+      const response = await next();
+      const durationMs = Math.round(performance.now() - startedAt);
+      appLogger.info("HTTP request completed", {
+        requestId,
+        method: request.method,
+        path: new URL(request.url).pathname,
+        status: response.status,
+        durationMs
+      });
+      return response;
+    });
+  };
+}
+export {
+  createRequestLoggingMiddleware
+};

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -84,6 +84,16 @@ function currentTenant() {
 function currentTenantId() {
   return currentTenant()?.id ?? 1;
 }
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 async function applyTenantContextToTransaction(transaction, tenantId) {

package/dist/entries/tracing/tracingMiddleware.js

@@ -0,0 +1,103 @@
+// @bun
+// ../../src/core/tracing/otel.ts
+import { randomBytes } from "crypto";
+function randomHex(bytes) {
+  return randomBytes(bytes).toString("hex");
+}
+function createSpan(input) {
+  const spanId = randomHex(8);
+  return {
+    traceId: input.traceId,
+    spanId,
+    name: input.name,
+    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
+    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
+    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
+      key,
+      value: { stringValue: value }
+    })),
+    status: { code: 1 }
+  };
+}
+async function exportOtelSpan(span) {
+  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  if (!endpoint) {
+    return;
+  }
+  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
+  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
+  await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      resourceSpans: [
+        {
+          resource: {
+            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
+          },
+          scopeSpans: [{ spans: [span] }]
+        }
+      ]
+    })
+  });
+}
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/tracing/traceContext.ts
+var traceContextStorage = createAsyncContextStore("@getstrata/traceContext");
+function runWithTraceContext(context, callback) {
+  return traceContextStorage.run(context, callback);
+}
+
+// ../../src/core/tracing/tracingMiddleware.ts
+function createTracingMiddleware() {
+  return async (request, next) => {
+    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
+    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+    const startedAt = performance.now();
+    const path = new URL(request.url).pathname;
+    return await runWithTraceContext({ traceId, spanId }, async () => {
+      const response = await next();
+      const endedAt = performance.now();
+      const headers = new Headers(response.headers);
+      headers.set("x-trace-id", traceId);
+      headers.set("x-span-id", spanId);
+      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
+      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
+      exportOtelSpan(createSpan({
+        traceId,
+        name: `${request.method} ${path}`,
+        startedAt,
+        endedAt,
+        attributes: {
+          "http.method": request.method,
+          "http.route": path,
+          "http.status_code": String(response.status)
+        }
+      })).catch(() => {
+        return;
+      });
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    });
+  };
+}
+export {
+  createTracingMiddleware
+};

package/dist/entries/view.js

@@ -2610,6 +2610,7 @@ var db = new Proxy(function database() {}, {
     return typeof value === "function" ? value.bind(connection) : value;
   }
 });
+var connection_default = db;
 
 // ../../src/modules/user/apiTokenTable.ts
 var apiTokenTable = defineTable({
@@ -2751,6 +2752,9 @@ function currentAuthUser() {
 
 // ../../src/core/http/requestMetaContext.ts
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
 function currentRequestMeta() {
   return requestMetaContext.getStore() ?? {
     ipAddress: null,
@@ -2844,6 +2848,16 @@ function currentTenant() {
 function currentTenantId() {
   return currentTenant()?.id ?? 1;
 }
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
 
 // ../../src/domain/abilities.ts
 var MEMBER_ABILITIES = [