@guren/server 1.0.0-rc.24 → 1.0.0-rc.26

package/dist/{chunk-F3664MFN.js → chunk-2T6JN4VR.js}

@@ -455,11 +455,31 @@ var ModelUserProvider = class extends BaseUserProvider {
   getId(user) {
     return user[this.idColumn];
   }
+  /**
+   * Strip the password hash, remember token, and the model's `hidden`
+   * fields before the record leaves the auth layer. Credential
+   * validation happens on the raw record before sanitizing, so this
+   * never affects login — only what `auth.user()` exposes.
+   */
+  sanitize(user) {
+    const blocked = /* @__PURE__ */ new Set([
+      this.passwordColumn,
+      this.rememberTokenColumn,
+      ...this.model.hidden ?? []
+    ]);
+    const clean = {};
+    for (const [key, value] of Object.entries(user)) {
+      if (!blocked.has(key)) {
+        clean[key] = value;
+      }
+    }
+    return clean;
+  }
   async setRememberToken(user, token) {
     if (typeof user[this.rememberTokenColumn] !== "undefined") {
       ;
       user[this.rememberTokenColumn] = token;
-      await this.model.update({ [this.idColumn]: this.getId(user) }, { [this.rememberTokenColumn]: token });
+      await this.model.forceUpdate({ [this.idColumn]: this.getId(user) }, { [this.rememberTokenColumn]: token });
     }
   }
   async getRememberToken(user) {
@@ -554,9 +574,14 @@ var SessionGuard = class {
       this.currentSession.forget(this.rememberSessionKey());
       return null;
     }
-    this.cachedUser = user;
     await this.provider.setRememberToken?.(user, rememberToken);
-    return user;
+    const sanitized = this.sanitizeUser(user);
+    this.cachedUser = sanitized;
+    return sanitized;
+  }
+  /** Strip auth-internal fields before a record is cached or exposed. */
+  sanitizeUser(user) {
+    return this.provider.sanitize ? this.provider.sanitize(user) : user;
   }
   async resolveUser() {
     if (this.cachedUser !== void 0) {
@@ -579,8 +604,9 @@ var SessionGuard = class {
       this.cachedUser = null;
       return null;
     }
-    this.cachedUser = user;
-    return user;
+    const sanitized = this.sanitizeUser(user);
+    this.cachedUser = sanitized;
+    return sanitized;
   }
   async check() {
     return await this.resolveUser() !== null;
@@ -616,7 +642,7 @@ var SessionGuard = class {
     session.regenerate();
     const identifier = this.provider.getId(castUser);
     session.set(this.sessionKey(), identifier);
-    this.cachedUser = castUser;
+    this.cachedUser = this.sanitizeUser(castUser);
     if (remember) {
       await this.remember(castUser);
     } else {
@@ -1250,9 +1276,29 @@ var DEFAULT_STATE_LENGTH = 24;
 var DEFAULT_STATE_HASH_ALGORITHM = "sha256";
 var MemoryOAuthStateStore = class {
   states = /* @__PURE__ */ new Map();
+  maxEntries;
+  constructor(options = {}) {
+    this.maxEntries = options.maxEntries ?? 1e4;
+  }
   async store(stateHash, payload) {
+    if (this.states.size >= this.maxEntries) {
+      this.sweepExpired();
+    }
+    while (this.states.size >= this.maxEntries) {
+      const oldest = this.states.keys().next().value;
+      if (oldest === void 0) break;
+      this.states.delete(oldest);
+    }
     this.states.set(stateHash, payload);
   }
+  sweepExpired() {
+    const now = Date.now();
+    for (const [hash, payload] of this.states) {
+      if (payload.expiresAt.getTime() <= now) {
+        this.states.delete(hash);
+      }
+    }
+  }
   async find(stateHash) {
     const payload = this.states.get(stateHash);
     if (!payload) return null;

package/dist/{chunk-IM6XKMP5.js → chunk-NRLZJILN.js}

@@ -6,7 +6,7 @@ import standard from "figlet/importable-fonts/Standard.js";
 // package.json
 var package_default = {
   name: "@guren/server",
-  version: "1.0.0-rc.24",
+  version: "1.0.0-rc.26",
   type: "module",
   license: "MIT",
   repository: {
@@ -102,6 +102,10 @@ var package_default = {
     "./lambda": {
       types: "./dist/lambda/index.d.ts",
       default: "./dist/lambda/index.js"
+    },
+    "./redis": {
+      types: "./dist/redis/index.d.ts",
+      default: "./dist/redis/index.js"
     }
   },
   scripts: {
@@ -111,21 +115,21 @@ var package_default = {
     test: "bun test"
   },
   dependencies: {
-    "@guren/inertia-client": "^1.0.0-rc.23",
-    "@guren/orm": "^1.0.0-rc.25",
+    "@guren/orm": "^1.0.0-rc.27",
     "@modelcontextprotocol/sdk": "^1.27.1",
     chalk: "^5.3.0",
     consola: "^3.4.2",
     figlet: "^1.7.0",
     hono: "^4.12.18",
     ioredis: "^5.9.1",
-    nodemailer: "^8.0.4"
+    nodemailer: "^9.0.1"
   },
   peerDependencies: {
     "@aws-sdk/client-s3": "^3.0.0",
     "@aws-sdk/client-sqs": "^3.0.0",
     "@aws-sdk/s3-request-presigner": "^3.0.0",
-    vite: ">=7.0.0"
+    vite: ">=7.0.0",
+    "@guren/inertia-client": "^1.0.0-rc.25"
   },
   peerDependenciesMeta: {
     "@aws-sdk/client-s3": {
@@ -136,6 +140,9 @@ var package_default = {
     },
     "@aws-sdk/s3-request-presigner": {
       optional: true
+    },
+    "@guren/inertia-client": {
+      optional: true
     }
   },
   devDependencies: {

package/dist/chunk-UY3AZSYL.js

@@ -0,0 +1,14 @@
+// src/redis/client.ts
+import Redis from "ioredis";
+function createRedisClient(options = {}) {
+  const { url, ...redisOptions } = options;
+  if (url) {
+    return new Redis(url, redisOptions);
+  }
+  return new Redis(redisOptions);
+}
+
+export {
+  Redis,
+  createRedisClient
+};

package/dist/client-CKXJLsTe.d.ts

@@ -0,0 +1,232 @@
+import { Context, MiddlewareHandler } from 'hono';
+import Redis, { RedisOptions } from 'ioredis';
+
+/**
+ * Rate limit entry stored in the backing store.
+ */
+interface RateLimitEntry {
+    count: number;
+    resetAt: number;
+}
+/**
+ * Store interface for rate limit data.
+ * Implement this for Redis or database-backed storage.
+ */
+interface RateLimitStore {
+    /**
+     * Get the current rate limit entry for a key.
+     */
+    get(key: string): Promise<RateLimitEntry | null>;
+    /**
+     * Increment the count for a key and return the new entry.
+     * If the key doesn't exist, create it with count=1.
+     */
+    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
+    /**
+     * Reset the count for a key.
+     */
+    reset(key: string): Promise<void>;
+}
+/**
+ * Base class for in-memory rate limit stores with automatic cleanup.
+ */
+declare abstract class BaseMemoryStore implements RateLimitStore {
+    protected cleanupInterval?: ReturnType<typeof setInterval>;
+    constructor(cleanupIntervalMs?: number);
+    abstract get(key: string): Promise<RateLimitEntry | null>;
+    abstract increment(key: string, windowMs: number): Promise<RateLimitEntry>;
+    abstract reset(key: string): Promise<void>;
+    abstract cleanup(): void;
+    abstract clear(): void;
+    abstract get size(): number;
+    destroy(): void;
+}
+/**
+ * In-memory rate limit store.
+ * Suitable for single-process development, not for production clusters.
+ */
+declare class MemoryRateLimitStore extends BaseMemoryStore {
+    private entries;
+    get(key: string): Promise<RateLimitEntry | null>;
+    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
+    reset(key: string): Promise<void>;
+    cleanup(): void;
+    clear(): void;
+    get size(): number;
+}
+/**
+ * Configuration options for rate limiting.
+ */
+interface RateLimitOptions {
+    /**
+     * Maximum number of requests allowed in the time window.
+     * @default 100
+     */
+    limit?: number;
+    /**
+     * Time window in milliseconds.
+     * @default 60000 (1 minute)
+     */
+    windowMs?: number;
+    /**
+     * Function to extract the rate limit key from the request.
+     * Defaults to using the client IP address.
+     */
+    keyGenerator?: (ctx: Context) => string | Promise<string>;
+    /**
+     * Rate limit store implementation.
+     * Defaults to in-memory store.
+     */
+    store?: RateLimitStore;
+    /**
+     * Whether to skip rate limiting for certain requests.
+     */
+    skip?: (ctx: Context) => boolean | Promise<boolean>;
+    /**
+     * Custom handler when rate limit is exceeded.
+     */
+    onRateLimited?: (ctx: Context, retryAfter: number) => Response | Promise<Response>;
+    /**
+     * Whether to add rate limit headers to all responses.
+     * @default true
+     */
+    headers?: boolean;
+    /**
+     * Custom message when rate limit is exceeded.
+     * @default 'Too many requests, please try again later.'
+     */
+    message?: string;
+    /**
+     * HTTP status code when rate limit is exceeded.
+     * @default 429
+     */
+    statusCode?: number;
+    /**
+     * Prefix for rate limit keys.
+     * @default 'rl:'
+     */
+    keyPrefix?: string;
+    /**
+     * Trust reverse-proxy headers for client IP resolution, checked in order:
+     * `CF-Connecting-IP`, `True-Client-IP`, `X-Real-IP`, then the first entry
+     * of `X-Forwarded-For`. Falls back to `server.requestIP()` when none are set.
+     *
+     * Enable ONLY when every request passes through a proxy that sets or strips
+     * these headers — on direct deployments clients can spoof them to bypass
+     * per-client limits. Ignored when a custom `keyGenerator` is supplied.
+     * @default false
+     */
+    trustProxy?: boolean;
+}
+/**
+ * Create a rate limiting middleware.
+ *
+ * @example
+ * ```ts
+ * // Basic usage - 100 requests per minute per IP
+ * app.use('*', createRateLimitMiddleware())
+ *
+ * // Stricter limit for login endpoint
+ * router.post('/login', [AuthController, 'login'],
+ *   createRateLimitMiddleware({
+ *     limit: 5,
+ *     windowMs: 15 * 60 * 1000, // 15 minutes
+ *   })
+ * )
+ *
+ * // Custom key based on authenticated user
+ * app.use('/api/*', createRateLimitMiddleware({
+ *   limit: 1000,
+ *   windowMs: 60 * 60 * 1000, // 1 hour
+ *   keyGenerator: async (ctx) => {
+ *     const user = await ctx.get('user')
+ *     return user?.id?.toString() ?? defaultKeyGenerator(ctx)
+ *   },
+ * }))
+ * ```
+ */
+declare function createRateLimitMiddleware(options?: RateLimitOptions): MiddlewareHandler;
+/**
+ * Rate limit result information.
+ */
+interface RateLimitInfo {
+    limit: number;
+    remaining: number;
+    resetAt: Date;
+    isLimited: boolean;
+}
+/**
+ * Get rate limit information for a key without incrementing.
+ *
+ * @example
+ * ```ts
+ * const info = await getRateLimitInfo('user:123', store, { limit: 100 })
+ * console.log(`${info.remaining} requests remaining`)
+ * ```
+ */
+declare function getRateLimitInfo(key: string, store: RateLimitStore, options?: {
+    limit: number;
+    keyPrefix?: string;
+}): Promise<RateLimitInfo>;
+/**
+ * Reset rate limit for a specific key.
+ *
+ * @example
+ * ```ts
+ * // Reset rate limit after successful captcha
+ * await resetRateLimit(clientIp, store)
+ * ```
+ */
+declare function resetRateLimit(key: string, store: RateLimitStore, options?: {
+    keyPrefix?: string;
+}): Promise<void>;
+/**
+ * Sliding window rate limit store.
+ * More accurate than fixed window but uses more memory.
+ */
+declare class SlidingWindowRateLimitStore extends BaseMemoryStore {
+    private requests;
+    get(key: string): Promise<RateLimitEntry | null>;
+    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
+    reset(key: string): Promise<void>;
+    cleanup(): void;
+    clear(): void;
+    get size(): number;
+}
+
+/**
+ * Options for creating a Redis client.
+ */
+interface RedisClientOptions extends RedisOptions {
+    /**
+     * Redis connection URL (e.g., 'redis://localhost:6379').
+     * If provided, overrides host/port/password.
+     */
+    url?: string;
+    /**
+     * Key prefix for all operations.
+     * @default ''
+     */
+    keyPrefix?: string;
+}
+/**
+ * Create a Redis client with the given options.
+ *
+ * @example
+ * ```ts
+ * // Using URL
+ * const redis = createRedisClient({ url: 'redis://localhost:6379' })
+ *
+ * // Using host/port
+ * const redis = createRedisClient({ host: 'localhost', port: 6379 })
+ *
+ * // With key prefix
+ * const redis = createRedisClient({
+ *   url: process.env.REDIS_URL,
+ *   keyPrefix: 'myapp:',
+ * })
+ * ```
+ */
+declare function createRedisClient(options?: RedisClientOptions): Redis;
+
+export { MemoryRateLimitStore as M, type RateLimitStore as R, SlidingWindowRateLimitStore as S, type RateLimitEntry as a, type RedisClientOptions as b, createRedisClient as c, type RateLimitInfo as d, type RateLimitOptions as e, createRateLimitMiddleware as f, getRateLimitInfo as g, resetRateLimit as r };