@getstrata/core 1.0.3 → 1.0.4

package/dist/entries/http/securityHeadersMiddleware.js

@@ -7,6 +7,26 @@ import {
 } from "@getstrata/core/http/contentSecurityPolicy";
 import { currentRequestMeta, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -17,6 +37,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -34,9 +66,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/signedUrl.js

@@ -4,6 +4,26 @@ import { createHmac } from "crypto";
 import { ForbiddenError } from "@getstrata/core/errors/http";
 import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -14,6 +34,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -31,9 +63,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -60,7 +89,7 @@ function sdkClientClassName() {
 
 // ../../src/core/http/signedUrl.ts
 function resolveSignedUrlSecret() {
-  return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("signed-url-secret");
+  return requireConfiguredSecret(["SIGNED_URL_SECRET", "SESSION_SECRET", "OAUTH_STATE_SECRET"], "signed-url-secret");
 }
 function resolveSignedUrlOrigin() {
   return (process.env.APP_URL ?? "http://localhost:3000").replace(/\/$/, "");

package/dist/entries/http/throttleMiddleware.js

@@ -4,6 +4,26 @@ import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentTenant, rateLimitMultiplierForPlan } from "@getstrata/core/tenant/tenantContext";
 var {RedisClient } = globalThis.Bun;
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -14,6 +34,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -31,9 +63,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -133,9 +162,6 @@ function readSpaPrefix() {
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
-function withCharset(contentType) {
-  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
-}
 function htmlResponse(html, init = {}) {
   return new Response(html, {
     status: init.status ?? 200,
@@ -145,42 +171,9 @@ function htmlResponse(html, init = {}) {
     }
   });
 }
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-function redirectResponse(location, status = 302) {
-  return new Response(null, {
-    status,
-    headers: {
-      Location: location
-    }
-  });
-}
-function textResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": "text/plain; charset=utf-8"
-    }
-  });
-}
-function xmlResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": withCharset(init.contentType ?? "application/xml")
-    }
-  });
-}
-function rssResponse(body, init = {}) {
-  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
-}
 
 // ../../src/core/view/webErrorView.ts
 var configuredErrorView = {};
-function configureWebErrorView(options) {
-  configuredErrorView = { ...options };
-}
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
@@ -214,15 +207,6 @@ function renderKernelErrorChrome(input) {
 </html>
 `;
 }
-function errorTemplateName(status) {
-  if (status === 404) {
-    return "errors/not-found";
-  }
-  if (status === 403) {
-    return "errors/forbidden";
-  }
-  return "errors/error";
-}
 async function renderWebErrorHtml(input) {
   const render = configuredErrorView.render;
   if (!render) {
@@ -240,16 +224,6 @@ async function renderWebErrorHtml(input) {
 async function htmlErrorResponse(input) {
   return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
 }
-async function notFoundHtmlResponse(body) {
-  if (body !== undefined) {
-    return htmlResponse(body, { status: 404 });
-  }
-  return htmlErrorResponse({
-    status: 404,
-    title: "Not Found",
-    message: "The page you requested was not found."
-  });
-}
 
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {

package/dist/entries/http/webErrorResponse.js

@@ -1,401 +1 @@
-// @bun
-// ../../src/core/http/webErrorResponse.ts
-import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/errors/http";
-import { appLogger } from "@getstrata/core/logging/logger";
-
-// ../../src/core/database/errors.ts
-import {
-  BadRequestError,
-  ConflictError,
-  InternalServerError,
-  toHttpError,
-  UnprocessableEntityError
-} from "@getstrata/core/errors/http";
-function isPostgresError(error) {
-  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
-}
-function getPostgresSqlState(error) {
-  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
-    return error.errno;
-  }
-  if (typeof error.errno === "number") {
-    return String(error.errno).padStart(5, "0");
-  }
-  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
-    return error.code;
-  }
-  return;
-}
-var MYSQL_ERRNO_MESSAGES = {
-  1062: () => new ConflictError("A record with these values already exists."),
-  1451: () => new UnprocessableEntityError("Record is still referenced by other records."),
-  1452: () => new UnprocessableEntityError("Referenced record does not exist."),
-  1048: () => new BadRequestError("Required field is missing."),
-  3819: () => new BadRequestError("Value violates a database constraint.")
-};
-function mapSqliteError(error) {
-  const code = typeof error.code === "string" ? error.code : "";
-  if (!code.startsWith("SQLITE_")) {
-    return null;
-  }
-  if (code === "SQLITE_CONSTRAINT_UNIQUE" || code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
-    return new ConflictError("A record with these values already exists.");
-  }
-  if (code === "SQLITE_CONSTRAINT_FOREIGNKEY") {
-    return new UnprocessableEntityError("Referenced record does not exist.");
-  }
-  if (code === "SQLITE_CONSTRAINT_NOTNULL") {
-    return new BadRequestError("Required field is missing.");
-  }
-  if (code.startsWith("SQLITE_CONSTRAINT")) {
-    return new BadRequestError("Value violates a database constraint.");
-  }
-  return new InternalServerError("Database operation failed.");
-}
-function mapMysqlError(error) {
-  const code = typeof error.code === "string" ? error.code : "";
-  if (!code.startsWith("ER_")) {
-    return null;
-  }
-  const factory = typeof error.errno === "number" ? MYSQL_ERRNO_MESSAGES[error.errno] : undefined;
-  return factory ? factory() : new InternalServerError("Database operation failed.");
-}
-function mapDatabaseError(error) {
-  const httpError = toHttpError(error);
-  if (httpError) {
-    return httpError;
-  }
-  if (!isPostgresError(error)) {
-    return new InternalServerError;
-  }
-  const sqlite = mapSqliteError(error);
-  if (sqlite) {
-    return sqlite;
-  }
-  const mysql = mapMysqlError(error);
-  if (mysql) {
-    return mysql;
-  }
-  const sqlState = getPostgresSqlState(error);
-  switch (sqlState) {
-    case "23505":
-      return new ConflictError(error.detail ?? "A record with these values already exists.", {
-        constraint: error.constraint
-      });
-    case "23503":
-      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
-        constraint: error.constraint
-      });
-    case "23502":
-      return new BadRequestError(error.detail ?? "Required field is missing.", {
-        constraint: error.constraint
-      });
-    case "23514":
-      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
-        constraint: error.constraint
-      });
-    default:
-      return new InternalServerError("Database operation failed.");
-  }
-}
-async function withDatabaseErrorHandling(operation) {
-  try {
-    return await operation();
-  } catch (error) {
-    throw mapDatabaseError(error);
-  }
-}
-
-// ../../src/core/runtime/appEnv.ts
-function isProductionEnv(env = process.env) {
-  return env.APP_ENV === "production" || env.NODE_ENV === "production";
-}
-
-// ../../src/core/runtime/frontendMode.ts
-var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
-var DEFAULT_SPA_PREFIX = "/app";
-var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
-function parseFrontendMode(value) {
-  const mode = (value ?? "api").trim();
-  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
-    return mode;
-  }
-  return "api";
-}
-function readFrontendMode() {
-  return parseFrontendMode(process.env.FRONTEND_MODE);
-}
-function isViewsMode(mode) {
-  return mode === "server-htmx" || mode === "hybrid";
-}
-function isSpaMode(mode) {
-  return mode === "spa-react" || mode === "hybrid";
-}
-function isViewsEnabled() {
-  return isViewsMode(readFrontendMode());
-}
-function isSpaEnabled() {
-  return isSpaMode(readFrontendMode());
-}
-function normalizeSpaPrefix(value) {
-  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  const trimmed = withSlash.replace(/\/+$/, "");
-  if (trimmed.length === 0 || trimmed === "/") {
-    return DEFAULT_SPA_PREFIX;
-  }
-  return trimmed;
-}
-function readSpaPrefix() {
-  return normalizeSpaPrefix(process.env.SPA_PREFIX);
-}
-
-// ../../src/core/view/webErrorView.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
-
-// ../../src/core/view/htmlResponse.ts
-function withCharset(contentType) {
-  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
-}
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-function redirectResponse(location, status = 302) {
-  return new Response(null, {
-    status,
-    headers: {
-      Location: location
-    }
-  });
-}
-function textResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": "text/plain; charset=utf-8"
-    }
-  });
-}
-function xmlResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": withCharset(init.contentType ?? "application/xml")
-    }
-  });
-}
-function rssResponse(body, init = {}) {
-  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
-}
-
-// ../../src/core/view/webErrorView.ts
-var configuredErrorView = {};
-function configureWebErrorView(options) {
-  configuredErrorView = { ...options };
-}
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
-}
-function renderKernelErrorChrome(input) {
-  const title = escapeHtml(input.title);
-  const message = escapeHtml(input.message);
-  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
-  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
-  const goBack = input.status === 422 ? `<p><a href="javascript:history.back()">Go back</a></p>` : "";
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>${title}</title>
-    <link rel="stylesheet" href="/assets/app.css" />
-  </head>
-  <body>
-    <header class="site-header">
-      <a class="brand" href="/">Home</a>
-    </header>
-    <main class="site-main">
-      <section class="page-header">
-        <h1>${title}</h1>
-        <p>${message}</p>
-        ${details}
-        ${goBack}
-      </section>
-    </main>
-  </body>
-</html>
-`;
-}
-function errorTemplateName(status) {
-  if (status === 404) {
-    return "errors/not-found";
-  }
-  if (status === 403) {
-    return "errors/forbidden";
-  }
-  return "errors/error";
-}
-async function renderWebErrorHtml(input) {
-  const render = configuredErrorView.render;
-  if (!render) {
-    return renderKernelErrorChrome(input);
-  }
-  try {
-    return await render({
-      ...input,
-      request: input.request ?? currentRequestMeta().request
-    });
-  } catch {
-    return renderKernelErrorChrome(input);
-  }
-}
-async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
-}
-async function notFoundHtmlResponse(body) {
-  if (body !== undefined) {
-    return htmlResponse(body, { status: 404 });
-  }
-  return htmlErrorResponse({
-    status: 404,
-    title: "Not Found",
-    message: "The page you requested was not found."
-  });
-}
-
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  if (pathname.startsWith("/api/")) {
-    return true;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  return false;
-}
-
-// ../../src/core/http/safeInternalPath.ts
-function looksLikeExternalTarget(value) {
-  const trimmed = value.trim();
-  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
-    return true;
-  }
-  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
-    return true;
-  }
-  try {
-    const decoded = decodeURIComponent(trimmed);
-    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
-      return true;
-    }
-  } catch {
-    return true;
-  }
-  return false;
-}
-function sanitizeInternalPath(raw, fallback = "/") {
-  if (looksLikeExternalTarget(raw)) {
-    return fallback;
-  }
-  return raw;
-}
-function safeInternalRedirectPath(request, fallback = "/") {
-  const url = new URL(request.url);
-  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
-}
-function loginRedirectLocation(request) {
-  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
-}
-
-// ../../src/core/http/webErrorResponse.ts
-function normalizeFieldErrors(details) {
-  if (!details || typeof details !== "object" || Array.isArray(details)) {
-    return {};
-  }
-  const errors = {};
-  for (const [field, messages] of Object.entries(details)) {
-    if (Array.isArray(messages)) {
-      errors[field] = messages.map(String);
-      continue;
-    }
-    if (typeof messages === "string") {
-      errors[field] = [messages];
-    }
-  }
-  return errors;
-}
-function errorPageTitle(status, message) {
-  if (status === 404) {
-    return "Not Found";
-  }
-  if (status === 403) {
-    return "Forbidden";
-  }
-  if (status >= 500) {
-    return "Server Error";
-  }
-  return message;
-}
-function publicErrorMessage(status, message) {
-  if (status >= 500 && isProductionEnv()) {
-    return "Something went wrong.";
-  }
-  return message;
-}
-function logServerError(error, mappedError) {
-  if (mappedError.status < 500) {
-    return;
-  }
-  appLogger.error("Unhandled request error", {
-    status: mappedError.status,
-    error: error instanceof Error ? error.message : String(error),
-    stack: error instanceof Error ? error.stack : undefined
-  });
-}
-async function webErrorResponse(error, request) {
-  if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
-    return null;
-  }
-  const mappedError = toHttpError2(error) ?? mapDatabaseError(error);
-  logServerError(error, mappedError);
-  if (mappedError.status === 401) {
-    return Response.redirect(loginRedirectLocation(request), 302);
-  }
-  const errors = mappedError instanceof ValidationError || mappedError.name === "ValidationError" ? normalizeFieldErrors(mappedError.details) : undefined;
-  return htmlErrorResponse({
-    status: mappedError.status,
-    title: errorPageTitle(mappedError.status, mappedError.message),
-    message: publicErrorMessage(mappedError.status, mappedError.message),
-    errors,
-    request
-  });
-}
-export {
-  logServerError,
-  normalizeFieldErrors,
-  webErrorResponse
-};
+export * from "../../index.js";