@getstrata/core 0.5.55 → 0.5.56

package/dist/entries/http/metricsMiddleware.js

@@ -86,6 +86,6 @@ function createMetricsMiddleware() {
   };
 }
 export {
-  normalizeMetricPath,
-  createMetricsMiddleware
+  createMetricsMiddleware,
+  normalizeMetricPath
 };

package/dist/entries/http/pagination.js

@@ -174,9 +174,9 @@ function paginatedResponse(data, meta, init = {}) {
   return Response.json({ data, meta }, init);
 }
 export {
-  parsePaginationQuery,
-  paginatedResponse,
-  buildPaginationMeta,
+  DEFAULT_PER_PAGE,
   MAX_PER_PAGE,
-  DEFAULT_PER_PAGE
+  buildPaginationMeta,
+  paginatedResponse,
+  parsePaginationQuery
 };

package/dist/entries/http/parseFormBody.js

@@ -18,6 +18,6 @@ function formDataToRecord(formData) {
   return values;
 }
 export {
-  parseFormBody,
-  formDataToRecord
+  formDataToRecord,
+  parseFormBody
 };

package/dist/entries/http/parseMultipartUpload.js

@@ -76,6 +76,6 @@ async function parseMultipartUpload(request, fieldName = "file") {
   };
 }
 export {
-  sanitizeUploadFileName,
-  parseMultipartUpload
+  parseMultipartUpload,
+  sanitizeUploadFileName
 };

package/dist/entries/http/resources.js

@@ -13,7 +13,7 @@ function toPaginatedResourceCollection(items, meta, transformer) {
   };
 }
 export {
-  toResourceCollection,
+  serializeDate,
   toPaginatedResourceCollection,
-  serializeDate
+  toResourceCollection
 };

package/dist/entries/http/response.js

@@ -84,8 +84,183 @@ function isViewsEnabled() {
 }
 
 // ../../src/core/view/etaViewEngine.ts
-import { join } from "path";
+import { join, relative } from "path";
 import { Eta } from "eta";
+
+// ../../src/core/view/assertEtaHtmlSource.ts
+var HTML_TAGS = new Set([
+  "a",
+  "abbr",
+  "address",
+  "article",
+  "aside",
+  "audio",
+  "b",
+  "blockquote",
+  "body",
+  "button",
+  "canvas",
+  "caption",
+  "cite",
+  "code",
+  "col",
+  "colgroup",
+  "data",
+  "datalist",
+  "dd",
+  "del",
+  "details",
+  "dfn",
+  "dialog",
+  "div",
+  "dl",
+  "dt",
+  "em",
+  "fieldset",
+  "figcaption",
+  "figure",
+  "footer",
+  "form",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "header",
+  "hgroup",
+  "hr",
+  "html",
+  "i",
+  "iframe",
+  "img",
+  "input",
+  "ins",
+  "kbd",
+  "label",
+  "legend",
+  "li",
+  "main",
+  "map",
+  "mark",
+  "menu",
+  "meter",
+  "nav",
+  "object",
+  "ol",
+  "optgroup",
+  "option",
+  "output",
+  "p",
+  "picture",
+  "pre",
+  "progress",
+  "q",
+  "rp",
+  "rt",
+  "ruby",
+  "s",
+  "samp",
+  "script",
+  "search",
+  "section",
+  "select",
+  "slot",
+  "small",
+  "source",
+  "span",
+  "strong",
+  "style",
+  "sub",
+  "summary",
+  "sup",
+  "table",
+  "tbody",
+  "td",
+  "template",
+  "textarea",
+  "tfoot",
+  "th",
+  "thead",
+  "time",
+  "title",
+  "tr",
+  "track",
+  "u",
+  "ul",
+  "var",
+  "video",
+  "wbr"
+]);
+var TAG_PATTERN = "([a-z][a-z0-9]*)";
+var CLASS_OR_ID_PATTERN = "[.#][\\w-]+";
+var CLASS_ID_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})+`);
+var ATTRIBUTE_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})*\\s+[\\w:-]+=`);
+var TAG_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:>|\\s+\\S|$)`);
+function htmlTagName(match) {
+  const tag = match?.[1];
+  return tag && HTML_TAGS.has(tag) ? tag : undefined;
+}
+function describePugLikeLine(line) {
+  if (/^\|(?:\s|$)/.test(line)) {
+    return "piped text";
+  }
+  if (htmlTagName(line.match(CLASS_ID_SHORTHAND))) {
+    return "class/id shorthand";
+  }
+  if (htmlTagName(line.match(ATTRIBUTE_SHORTHAND))) {
+    return "attribute shorthand";
+  }
+  if (htmlTagName(line.match(TAG_SHORTHAND))) {
+    return "tag shorthand";
+  }
+  return;
+}
+function updateSkipBlock(lower, skipBlock) {
+  if (skipBlock) {
+    if (skipBlock === "comment" && lower.includes("-->")) {
+      return null;
+    }
+    if (skipBlock !== "comment" && lower.includes(`</${skipBlock}`)) {
+      return null;
+    }
+    return skipBlock;
+  }
+  if (lower.startsWith("<!--") && !lower.includes("-->")) {
+    return "comment";
+  }
+  if (lower.startsWith("<script") && !lower.includes("</script")) {
+    return "script";
+  }
+  if (lower.startsWith("<style") && !lower.includes("</style")) {
+    return "style";
+  }
+  return null;
+}
+function assertEtaHtmlSource(templateName, source) {
+  let skipBlock = null;
+  for (const rawLine of source.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const lower = trimmed.toLowerCase();
+    const nextSkipBlock = updateSkipBlock(lower, skipBlock);
+    if (skipBlock || nextSkipBlock) {
+      skipBlock = nextSkipBlock;
+      continue;
+    }
+    if (trimmed.startsWith("<") || trimmed.startsWith("<%")) {
+      continue;
+    }
+    const kind = describePugLikeLine(trimmed);
+    if (kind) {
+      throw new Error(`Eta view "${templateName}" contains Pug-like markup (${kind}: ${trimmed}). Eta views must be HTML + <% %> tags, not Pug.`);
+    }
+  }
+}
+
+// ../../src/core/view/etaViewEngine.ts
 var DEFAULT_VIEWS_DIRECTORY = join(process.cwd(), "resources/views");
 var DEFAULT_LAYOUT = "layouts/app.eta";
 
@@ -98,6 +273,12 @@ class EtaViewEngine {
       autoTrim: false
     });
     this.resolveLayoutData = resolveLayoutData;
+    const readFile = this.eta.readFile?.bind(this.eta);
+    this.eta.readFile = (path) => {
+      const source = readFile ? readFile(path) : "";
+      assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
+      return source;
+    };
   }
   async render(name, data = {}, options = {}) {
     const template = name.endsWith(".eta") ? name : `${name}.eta`;
@@ -361,99 +542,6 @@ function resolveAbilitiesForRole(role) {
   return [...MEMBER_ABILITIES];
 }
 
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
-
 // ../../src/modules/user/notificationRepository.ts
 import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
 
@@ -872,9 +960,9 @@ function withErrorHandling(handler) {
   };
 }
 export {
-  withErrorHandling,
-  noContentResponse,
-  jsonResponse,
+  createdResponse,
   errorResponse,
-  createdResponse
+  jsonResponse,
+  noContentResponse,
+  withErrorHandling
 };

package/dist/entries/http/securedRouteModelBinding.js

@@ -282,6 +282,6 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
   };
 }
 export {
-  securedBindRouteModelByKey,
-  securedBindRouteModel
+  securedBindRouteModel,
+  securedBindRouteModelByKey
 };

package/dist/entries/http/throttleMiddleware.js

@@ -37,6 +37,6 @@ function createThrottleMiddleware(options) {
   };
 }
 export {
-  resolveThrottleIdentity,
-  createThrottleMiddleware
+  createThrottleMiddleware,
+  resolveThrottleIdentity
 };

package/dist/entries/http/validation.js

@@ -128,18 +128,18 @@ function parsePositiveIntParam(value, name = "id") {
   return parsed;
 }
 export {
-  readRequiredString,
-  readRequiredPositiveInt,
-  readRequiredEnum,
-  readOptionalString,
-  readOptionalPositiveInt,
-  readOptionalEnum,
-  parsePositiveIntParam,
-  parseOptionalPositiveIntQueryParam,
-  parseOptionalEnumQueryParam,
-  parseOptionalBooleanQueryParam,
-  parseJsonBody,
-  getQueryParams,
+  buildRequestCacheKey,
   expectObject,
-  buildRequestCacheKey
+  getQueryParams,
+  parseJsonBody,
+  parseOptionalBooleanQueryParam,
+  parseOptionalEnumQueryParam,
+  parseOptionalPositiveIntQueryParam,
+  parsePositiveIntParam,
+  readOptionalEnum,
+  readOptionalPositiveInt,
+  readOptionalString,
+  readRequiredEnum,
+  readRequiredPositiveInt,
+  readRequiredString
 };