@getstrata/core 1.0.3 → 1.0.5

package/dist/entries/http/flashMiddleware.js

@@ -2,6 +2,26 @@
 // ../../src/core/http/flashSession.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -63,7 +92,7 @@ function flashCookieName() {
   return process.env.FLASH_COOKIE_NAME?.trim() || appCookieName("flash");
 }
 function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("flash-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET"], "flash-secret");
 }
 function signFlashPayload(payload, issuedAt) {
   const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");

package/dist/entries/http/flashSession.js

@@ -2,6 +2,26 @@
 // ../../src/core/http/flashSession.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -12,6 +32,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -29,9 +61,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -63,7 +92,7 @@ function flashCookieName() {
   return process.env.FLASH_COOKIE_NAME?.trim() || appCookieName("flash");
 }
 function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("flash-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET"], "flash-secret");
 }
 function signFlashPayload(payload, issuedAt) {
   const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");

package/dist/entries/http/loginThrottleMiddleware.js

@@ -1,373 +1 @@
-// @bun
-// ../../src/core/http/loginThrottleMiddleware.ts
-var {RedisClient } = globalThis.Bun;
-
-// ../../src/core/runtime/appKeyPrefix.ts
-function appKeyPrefix() {
-  return process.env.APP_KEY_PREFIX?.trim() || "strata";
-}
-function appCookieName(kind) {
-  return `${appKeyPrefix()}_${kind}`;
-}
-function appDevSecret(kind) {
-  return `${appKeyPrefix()}-dev-${kind}`;
-}
-function namespacedRedisKey(kind) {
-  return `${appKeyPrefix()}:${kind}`;
-}
-function smtpEhloHost() {
-  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
-  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
-  return safe || "strata.local";
-}
-function siemEventType() {
-  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
-}
-function appUserAgent() {
-  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
-}
-function otelServiceName() {
-  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
-}
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
-function appDisplayName() {
-  return process.env.APP_NAME?.trim() || "Strata";
-}
-function appEnv() {
-  return process.env.APP_ENV?.trim() || "local";
-}
-function appUrl() {
-  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
-}
-function apiPrefix() {
-  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  const trimmed = withSlash.replace(/\/+$/, "");
-  return trimmed || "/api/v1";
-}
-function sdkClientClassName() {
-  const override = process.env.APP_SDK_CLASS?.trim();
-  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
-    return override;
-  }
-  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
-  return fromName ? `${fromName}Client` : "AppClient";
-}
-
-// ../../src/core/http/clientIp.ts
-import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
-function trustForwardedFor(env = process.env) {
-  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
-}
-function isPrivateAddress(address) {
-  const ip = address.replace(/^::ffff:/i, "");
-  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
-}
-function forwardedClientIp(request) {
-  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
-  for (let index = hops.length - 1;index >= 0; index -= 1) {
-    const hop = hops[index];
-    if (hop && !isPrivateAddress(hop)) {
-      return hop;
-    }
-  }
-  if (hops.length > 0) {
-    return hops[hops.length - 1];
-  }
-  return request.headers.get("x-real-ip")?.trim() || undefined;
-}
-function readClientIp(request, env = process.env) {
-  if (trustForwardedFor(env)) {
-    const forwarded = forwardedClientIp(request);
-    if (forwarded) {
-      return forwarded;
-    }
-  }
-  return currentRequestMeta().ipAddress ?? undefined;
-}
-
-// ../../src/core/runtime/frontendMode.ts
-var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
-var DEFAULT_SPA_PREFIX = "/app";
-var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
-function parseFrontendMode(value) {
-  const mode = (value ?? "api").trim();
-  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
-    return mode;
-  }
-  return "api";
-}
-function readFrontendMode() {
-  return parseFrontendMode(process.env.FRONTEND_MODE);
-}
-function isViewsMode(mode) {
-  return mode === "server-htmx" || mode === "hybrid";
-}
-function isSpaMode(mode) {
-  return mode === "spa-react" || mode === "hybrid";
-}
-function isViewsEnabled() {
-  return isViewsMode(readFrontendMode());
-}
-function isSpaEnabled() {
-  return isSpaMode(readFrontendMode());
-}
-function normalizeSpaPrefix(value) {
-  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  const trimmed = withSlash.replace(/\/+$/, "");
-  if (trimmed.length === 0 || trimmed === "/") {
-    return DEFAULT_SPA_PREFIX;
-  }
-  return trimmed;
-}
-function readSpaPrefix() {
-  return normalizeSpaPrefix(process.env.SPA_PREFIX);
-}
-
-// ../../src/core/view/webErrorView.ts
-import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
-
-// ../../src/core/view/htmlResponse.ts
-function withCharset(contentType) {
-  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
-}
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-function redirectResponse(location, status = 302) {
-  return new Response(null, {
-    status,
-    headers: {
-      Location: location
-    }
-  });
-}
-function textResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": "text/plain; charset=utf-8"
-    }
-  });
-}
-function xmlResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": withCharset(init.contentType ?? "application/xml")
-    }
-  });
-}
-function rssResponse(body, init = {}) {
-  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
-}
-
-// ../../src/core/view/webErrorView.ts
-var configuredErrorView = {};
-function configureWebErrorView(options) {
-  configuredErrorView = { ...options };
-}
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
-}
-function renderKernelErrorChrome(input) {
-  const title = escapeHtml(input.title);
-  const message = escapeHtml(input.message);
-  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
-  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
-  const goBack = input.status === 422 ? `<p><a href="javascript:history.back()">Go back</a></p>` : "";
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>${title}</title>
-    <link rel="stylesheet" href="/assets/app.css" />
-  </head>
-  <body>
-    <header class="site-header">
-      <a class="brand" href="/">Home</a>
-    </header>
-    <main class="site-main">
-      <section class="page-header">
-        <h1>${title}</h1>
-        <p>${message}</p>
-        ${details}
-        ${goBack}
-      </section>
-    </main>
-  </body>
-</html>
-`;
-}
-function errorTemplateName(status) {
-  if (status === 404) {
-    return "errors/not-found";
-  }
-  if (status === 403) {
-    return "errors/forbidden";
-  }
-  return "errors/error";
-}
-async function renderWebErrorHtml(input) {
-  const render = configuredErrorView.render;
-  if (!render) {
-    return renderKernelErrorChrome(input);
-  }
-  try {
-    return await render({
-      ...input,
-      request: input.request ?? currentRequestMeta2().request
-    });
-  } catch {
-    return renderKernelErrorChrome(input);
-  }
-}
-async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
-}
-async function notFoundHtmlResponse(body) {
-  if (body !== undefined) {
-    return htmlResponse(body, { status: 404 });
-  }
-  return htmlErrorResponse({
-    status: 404,
-    title: "Not Found",
-    message: "The page you requested was not found."
-  });
-}
-
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  if (pathname.startsWith("/api/")) {
-    return true;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  return false;
-}
-
-// ../../src/core/http/throttleResponse.ts
-async function tooManyRequestsResponse(request, message, decaySeconds) {
-  const retryAfter = { "retry-after": String(decaySeconds) };
-  if (requestPrefersJson(request) || !isViewsEnabled()) {
-    return Response.json({ error: message }, {
-      status: 429,
-      headers: retryAfter
-    });
-  }
-  const html = await htmlErrorResponse({
-    status: 429,
-    title: "Too Many Requests",
-    message,
-    request
-  });
-  const headers = new Headers(html.headers);
-  headers.set("retry-after", String(decaySeconds));
-  return new Response(html.body, { status: 429, headers });
-}
-
-// ../../src/core/http/loginThrottleMiddleware.ts
-var memoryLoginBuckets = new Map;
-function resolveLoginIdentity(request) {
-  return readClientIp(request) ?? "unknown";
-}
-async function resolveLoginEmail(request) {
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  try {
-    if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-      const formData = await request.clone().formData();
-      const email = formData.get("email");
-      return typeof email === "string" ? email.trim().toLowerCase() : "unknown";
-    }
-    const payload = await request.clone().json();
-    return typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-function consumeMemoryAttempt(key, decaySeconds) {
-  const now = Date.now();
-  const existing = memoryLoginBuckets.get(key);
-  if (!existing || existing.resetAt <= now) {
-    memoryLoginBuckets.set(key, { count: 1, resetAt: now + decaySeconds * 1000 });
-    return 1;
-  }
-  existing.count += 1;
-  return existing.count;
-}
-function createMemoryLoginThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
-  return async (request, next) => {
-    const identity = resolveLoginIdentity(request);
-    const email = await resolveLoginEmail(request);
-    const throttleKey = `${prefix}${identity}:${email}`;
-    const attempts = consumeMemoryAttempt(throttleKey, options.decaySeconds);
-    if (attempts > options.maxAttempts) {
-      return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
-    }
-    return await next();
-  };
-}
-function createRedisLoginThrottleMiddleware(options) {
-  const client = new RedisClient(options.redisUrl);
-  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
-  return async (request, next) => {
-    const identity = resolveLoginIdentity(request);
-    const email = await resolveLoginEmail(request);
-    const throttleKey = `${prefix}${identity}:${email}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    if (attempts > options.maxAttempts) {
-      return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
-    }
-    return await next();
-  };
-}
-function createLoginThrottleMiddleware(options) {
-  const redisUrl = options.redisUrl?.trim() ?? "";
-  if (redisUrl) {
-    return createRedisLoginThrottleMiddleware({ ...options, redisUrl });
-  }
-  return createMemoryLoginThrottleMiddleware(options);
-}
-function resetMemoryLoginThrottleForTests() {
-  memoryLoginBuckets.clear();
-}
-export {
-  createLoginThrottleMiddleware,
-  createMemoryLoginThrottleMiddleware,
-  resetMemoryLoginThrottleForTests,
-  resolveLoginEmail,
-  resolveLoginIdentity
-};
+export * from "../../index.js";

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -1,4 +1,24 @@
 // @bun
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -9,6 +29,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -26,9 +58,6 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
-function webhookSignatureHeader() {
-  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
-}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -128,9 +157,6 @@ function readSpaPrefix() {
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/view/htmlResponse.ts
-function withCharset(contentType) {
-  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
-}
 function htmlResponse(html, init = {}) {
   return new Response(html, {
     status: init.status ?? 200,
@@ -140,42 +166,9 @@ function htmlResponse(html, init = {}) {
     }
   });
 }
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-function redirectResponse(location, status = 302) {
-  return new Response(null, {
-    status,
-    headers: {
-      Location: location
-    }
-  });
-}
-function textResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": "text/plain; charset=utf-8"
-    }
-  });
-}
-function xmlResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": withCharset(init.contentType ?? "application/xml")
-    }
-  });
-}
-function rssResponse(body, init = {}) {
-  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
-}
 
 // ../../src/core/view/webErrorView.ts
 var configuredErrorView = {};
-function configureWebErrorView(options) {
-  configuredErrorView = { ...options };
-}
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
@@ -209,15 +202,6 @@ function renderKernelErrorChrome(input) {
 </html>
 `;
 }
-function errorTemplateName(status) {
-  if (status === 404) {
-    return "errors/not-found";
-  }
-  if (status === 403) {
-    return "errors/forbidden";
-  }
-  return "errors/error";
-}
 async function renderWebErrorHtml(input) {
   const render = configuredErrorView.render;
   if (!render) {
@@ -235,16 +219,6 @@ async function renderWebErrorHtml(input) {
 async function htmlErrorResponse(input) {
   return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
 }
-async function notFoundHtmlResponse(body) {
-  if (body !== undefined) {
-    return htmlResponse(body, { status: 404 });
-  }
-  return htmlErrorResponse({
-    status: 404,
-    title: "Not Found",
-    message: "The page you requested was not found."
-  });
-}
 
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {