@getstrata/core 0.5.5 → 0.5.6

package/dist/index.js

@@ -1487,6 +1487,14 @@ var baseRepository_default = BaseRepository;
 function bindDatabaseConnection2(connection) {
   bindDatabaseConnection(connection);
 }
+// ../../src/core/database/connection.ts
+function createDatabaseConnection2(source) {
+  return {
+    async unsafe(query, params = []) {
+      return await source.unsafe(query, params);
+    }
+  };
+}
 // ../../src/core/database/migrations/advisoryLock.ts
 var MIGRATION_LOCK_KEY = 42424242;
 async function withMigrationLock(db2, callback, lockKey = MIGRATION_LOCK_KEY) {
@@ -1739,26 +1747,26 @@ class Model {
     throw new Error(`${this.constructor.name}.primaryKey() is not implemented.`);
   }
   static primaryKeyField() {
-    return resolveModelRepository(this).getTable().primaryKey;
+    return resolveModelRepository(Model).getTable().primaryKey;
   }
   static hydrateAttributes(attributes) {
-    const casts = modelStatics(this).$casts ?? {};
+    const casts = modelStatics(Model).$casts ?? {};
     return applyCasts(attributes, casts, "hydrate");
   }
   static dehydrateAttributes(attributes) {
-    const casts = modelStatics(this).$casts ?? {};
+    const casts = modelStatics(Model).$casts ?? {};
     return applyCasts(attributes, casts, "dehydrate");
   }
   static fromRecord(record, repository, exists = true) {
-    const statics = modelStatics(this);
+    const statics = modelStatics(Model);
     const hydrated = statics.hydrateAttributes(record);
     return new statics(hydrated, repository, exists);
   }
   static boot() {}
   static addGlobalScope(_name, scope) {
-    ensureBooted(this);
-    const existing = modelGlobalScopes.get(this) ?? [];
-    modelGlobalScopes.set(this, [
+    ensureBooted(Model);
+    const existing = modelGlobalScopes.get(Model) ?? [];
+    modelGlobalScopes.set(Model, [
       ...existing,
       scope
     ]);
@@ -1768,17 +1776,17 @@ class Model {
   }
   static query() {
     ensureBooted(this);
-    const repository = resolveModelRepository(this);
+    const repository = resolveModelRepository(Model);
     let query = repository.query();
-    for (const scope of getGlobalScopes(this)) {
+    for (const scope of getGlobalScopes(Model)) {
       query = scope(query);
     }
     return query;
   }
   static async create(attributes) {
     const statics = modelStatics(this);
-    ensureBooted(this);
-    const repository = resolveModelRepository(this);
+    ensureBooted(Model);
+    const repository = resolveModelRepository(Model);
     const table = repository.getTable();
     const timestamps = statics.$timestamps ?? true;
     const assignable = filterMassAssignable(statics.$fillable, statics.$guarded, attributes);
@@ -1788,23 +1796,23 @@ class Model {
     return statics.fromRecord(record, repository, true);
   }
   static async find(id) {
-    const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
+    const statics = modelStatics(Model);
+    const repository = resolveModelRepository(Model);
     const primaryKey = repository.getTable().primaryKey;
-    const record = await Model.query.call(this).where({ [primaryKey]: id }).first();
+    const record = await Model.query.call(Model).where({ [primaryKey]: id }).first();
     return record ? statics.fromRecord(record, repository, true) : null;
   }
   static async findOrFail(id, errorFactory) {
-    const model = await Model.find.call(this, id);
+    const model = await Model.find.call(Model, id);
     if (model) {
       return model;
     }
-    throw errorFactory?.(id) ?? new NotFoundError(`${this.name} ${String(id)} not found.`);
+    throw errorFactory?.(id) ?? new NotFoundError(`${Model.name} ${String(id)} not found.`);
   }
   static async all(options = {}) {
     const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    let query = Model.query.call(this);
+    const repository = resolveModelRepository(Model);
+    let query = Model.query.call(Model);
     if (options.orderBy) {
       query = query.orderBy(options.orderBy);
     }
@@ -1816,8 +1824,8 @@ class Model {
   }
   static async firstWhere(where, options = {}) {
     const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    let query = Model.query.call(this).where(where);
+    const repository = resolveModelRepository(Model);
+    let query = Model.query.call(Model).where(where);
     if (options.orderBy) {
       query = query.orderBy(options.orderBy);
     }
@@ -2564,15 +2572,6 @@ async function runSeedersFromDirectory(directory, db2, options) {
 function defineTable(definition) {
   return definition;
 }
-// ../../src/core/database/connection.ts
-function createDatabaseConnection2(source) {
-  return {
-    async unsafe(query, params = []) {
-      return await source.unsafe(query, params);
-    }
-  };
-}
-
 // ../../src/core/database/transaction.ts
 async function runInTransaction(operation) {
   return await connection_default.begin(async (transaction) => {
@@ -2927,8 +2926,35 @@ function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
     return await next();
   };
 }
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
 // ../../src/core/http/csrfToken.ts
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { timingSafeEqual } from "crypto";
 
 // ../../src/core/http/requestMetaContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
@@ -2949,70 +2975,28 @@ var CSRF_TTL_MS = 60 * 60 * 1000;
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
-function signCsrfToken(token, issuedAt) {
-  const payload = `${token}.${issuedAt}`;
-  const signature = createHmac("sha256", resolveCsrfSecret()).update(payload).digest("hex");
-  return `${payload}.${signature}`;
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function readCsrfCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === CSRF_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseSignedCsrfValue(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const [token, issuedAtRaw, cookieSignature] = parts;
-  if (!token || !issuedAtRaw || !cookieSignature) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt)) {
-    return null;
-  }
-  if (Date.now() - issuedAt > CSRF_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(cookieSignature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
-    return null;
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
   }
-  return { token, issuedAt };
+  return timingSafeEqual(leftBuffer, rightBuffer);
 }
 function createCsrfTokenCookie() {
-  const token = randomBytes(24).toString("hex");
-  const issuedAt = Date.now();
-  const value = signCsrfToken(token, issuedAt);
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readCsrfCookie(request);
-  if (cookieValue) {
-    const parsed = parseSignedCsrfValue(cookieValue);
-    if (parsed) {
-      return { token: parsed.token };
-    }
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
   }
   return createCsrfTokenCookie();
 }
@@ -3035,6 +3019,10 @@ async function readSubmittedCsrfTokenFromBody(request) {
     if (typeof field === "string" && field.trim().length > 0) {
       return field.trim();
     }
+    const legacyField = formData.get("_csrf");
+    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
+      return legacyField.trim();
+    }
   }
   return null;
 }
@@ -3042,20 +3030,14 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readCsrfCookie(request);
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
   if (!cookieValue) {
     return false;
   }
-  const parsed = parseSignedCsrfValue(cookieValue);
-  if (!parsed) {
+  if (!tokensMatch(submittedToken, cookieValue)) {
     return false;
   }
-  const submittedBuffer = Buffer.from(submittedToken);
-  const expectedBuffer = Buffer.from(parsed.token);
-  if (submittedBuffer.length !== expectedBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual(submittedBuffer, expectedBuffer);
+  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
 }
 function resolveCsrfTokenForRequest(request) {
   const metaToken = currentRequestMeta().csrfToken;
@@ -3096,8 +3078,30 @@ function createCsrfMiddleware() {
     return await next();
   };
 }
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+function createCsrfProtection(secret, options = {}) {
+  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
+  const maxAge = options.maxAge ?? expiresIn;
+  return {
+    generate(_sessionKey) {
+      return Bun.CSRF.generate(secret, { expiresIn });
+    },
+    verify(token, _sessionKey) {
+      if (!token) {
+        return false;
+      }
+      return Bun.CSRF.verify(token, { secret, maxAge });
+    },
+    secret
+  };
+}
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
+
 // ../../src/core/http/etag.ts
-import { createHash } from "crypto";
 function isEtagEnabled() {
   return (process.env.FEATURE_ETAG ?? "true") !== "false";
 }
@@ -3105,13 +3109,13 @@ function formatWeakEtag(digest) {
   return `W/"${digest}"`;
 }
 function computeEtagFromJson(data) {
-  const digest = createHash("sha256").update(JSON.stringify(data)).digest("hex").slice(0, 32);
+  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
   return formatWeakEtag(digest);
 }
 function etagFromResource(resource) {
   const version = resource.updated_at ?? resource.created_at ?? "";
   const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
-  const digest = createHash("sha256").update(`${String(resource.id ?? "0")}:${versionText}`).digest("hex").slice(0, 32);
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
   return formatWeakEtag(digest);
 }
 function normalizeEtag(value) {
@@ -3598,7 +3602,7 @@ async function verifyPassword(password, passwordHash) {
 }
 
 // ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac as createHmac2, randomBytes as randomBytes2 } from "crypto";
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
 var ENCRYPTION_PREFIX = "enc:v1:";
 var IV_LENGTH = 12;
 var TAG_LENGTH = 16;
@@ -3627,7 +3631,7 @@ function isFieldEncryptionEnabled() {
   return (process.env.APP_ENV ?? "local") === "production";
 }
 function encryptField(plaintext, key) {
-  const iv = randomBytes2(IV_LENGTH);
+  const iv = randomBytes(IV_LENGTH);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
   const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
@@ -3647,7 +3651,7 @@ function decryptField(value, key) {
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
 function hashLookupValue(normalizedValue, key) {
-  return createHmac2("sha256", key).update(normalizedValue).digest("hex");
+  return createHmac("sha256", key).update(normalizedValue).digest("hex");
 }
 function normalizeEmail(email) {
   return email.trim().toLowerCase();
@@ -3727,7 +3731,7 @@ function resolveDefaultTokenExpiryDays() {
 }
 
 // ../../src/core/security/totp.ts
-import { createHmac as createHmac3 } from "crypto";
+import { createHmac as createHmac2 } from "crypto";
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
   const normalized = input.replace(/=+$/u, "").toUpperCase();
@@ -3749,7 +3753,7 @@ function generateTotp(secret, counter, digits = 6) {
   const key = decodeBase32(secret);
   const buffer = Buffer.alloc(8);
   buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac3("sha1", key).update(buffer).digest();
+  const digest = createHmac2("sha1", key).update(buffer).digest();
   const lastByte = digest[digest.length - 1] ?? 0;
   const offset = lastByte & 15;
   const b0 = digest[offset] ?? 0;
@@ -3941,30 +3945,30 @@ var userTable = defineTable({
 });
 
 // ../../src/core/auth/tokenHash.ts
-import { createHash as createHash2, createHmac as createHmac4 } from "crypto";
+import { createHash, createHmac as createHmac3 } from "crypto";
 function resolveTokenPepper() {
   return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
 }
 function hashApiToken(token) {
   const pepper = resolveTokenPepper();
   if (pepper && pepper !== "workhub-dev-token-pepper") {
-    return createHmac4("sha256", pepper).update(token).digest("hex");
+    return createHmac3("sha256", pepper).update(token).digest("hex");
   }
-  return createHash2("sha256").update(token).digest("hex");
+  return createHash("sha256").update(token).digest("hex");
 }
 
 // ../../src/modules/user/provider.ts
 var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
 function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac5("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
   return `${payload}.${issuedAt}.${signature}`;
 }
 function readFlashCookie(request) {
@@ -5362,6 +5366,7 @@ export {
   withMigrationLock,
   withMiddleware,
   withErrorHandling,
+  verifyCsrfToken,
   validateObject,
   toResourceCollection,
   toPaginatedResourceCollection,
@@ -5381,6 +5386,8 @@ export {
   resolveWebLayoutData,
   resolveService,
   resolveDatabaseDriver,
+  resolveCsrfTokenForRequest,
+  resolveCsrfToken,
   resolveApplicationQueue,
   resolveApplicationPolicyGate,
   resolveApplicationLogger,
@@ -5391,6 +5398,10 @@ export {
   required,
   registerShutdownHandler,
   registerModelRepository,
+  readSubmittedCsrfTokenFromBody,
+  readSubmittedCsrfToken,
+  readRequestCookie,
+  readBunRequestCookie,
   queue,
   prometheusRegistry,
   policyGate,
@@ -5445,6 +5456,9 @@ export {
   createMemoryThrottleMiddleware,
   createLoginThrottleMiddleware,
   createFailedJobService,
+  createDatabaseConnection2 as createDatabaseConnection,
+  createCsrfTokenCookie,
+  createCsrfProtection,
   createCsrfMiddleware,
   createBodySizeLimitMiddleware,
   createAuthorizeMiddleware,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -317,6 +317,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "eta": "^4.6.0"
+  },
   "peerDependencies": {
     "typescript": "^5.9.0"
   }