@guren/server 1.0.0-rc.9 → 1.1.0

package/dist/chunk-ZRBLZY3M.js

@@ -0,0 +1,462 @@
+import {
+  AuthorizationException
+} from "./chunk-THSX7OOR.js";
+
+// src/authorization/Gate.ts
+var Response = {
+  allow(message) {
+    return { allowed: true, message };
+  },
+  deny(message, code) {
+    return { allowed: false, message: message ?? "This action is unauthorized.", code };
+  },
+  denyWithStatus(status, message) {
+    return { allowed: false, message: message ?? "This action is unauthorized.", status };
+  },
+  denyAsNotFound(message) {
+    return { allowed: false, message: message ?? "Not found.", status: 404 };
+  }
+};
+var Gate = class {
+  /**
+   * Defined gates.
+   */
+  gates = /* @__PURE__ */ new Map();
+  /**
+   * Registered policies.
+   */
+  policies = /* @__PURE__ */ new Map();
+  /**
+   * Policy instances cache.
+   */
+  policyInstances = /* @__PURE__ */ new Map();
+  /**
+   * Before callbacks.
+   */
+  beforeCallbacks = [];
+  /**
+   * After callbacks.
+   */
+  afterCallbacks = [];
+  /**
+   * User resolver function.
+   */
+  userResolver;
+  /**
+   * Current user for checks.
+   */
+  currentUser = null;
+  constructor(options = {}) {
+    this.userResolver = options.userResolver;
+  }
+  /**
+   * Define a new gate.
+   */
+  define(ability, callback) {
+    this.gates.set(ability, { callback });
+    return this;
+  }
+  /**
+   * Register a policy for a model class.
+   */
+  policy(modelClass, policyClass) {
+    this.policies.set(modelClass, policyClass);
+    return this;
+  }
+  /**
+   * Register a before callback.
+   * Return true to allow, false to deny, undefined to continue.
+   */
+  before(callback) {
+    this.beforeCallbacks.push(callback);
+    return this;
+  }
+  /**
+   * Register an after callback.
+   */
+  after(callback) {
+    this.afterCallbacks.push(callback);
+    return this;
+  }
+  /**
+   * Set the current user for authorization checks.
+   */
+  forUser(user) {
+    const clone = Object.assign(
+      Object.create(Object.getPrototypeOf(this)),
+      this
+    );
+    clone.currentUser = user;
+    return clone;
+  }
+  /**
+   * Resolve the user from context.
+   */
+  async resolveUser(ctx) {
+    if (this.currentUser !== null) {
+      return this.currentUser;
+    }
+    if (this.userResolver) {
+      return this.userResolver(ctx);
+    }
+    const user = ctx.get("user");
+    return user ?? null;
+  }
+  /**
+   * Check if the user has the given ability.
+   */
+  async allows(ability, ...args) {
+    return this.check(ability, this.currentUser, ...args);
+  }
+  /**
+   * Check if the user doesn't have the given ability.
+   */
+  async denies(ability, ...args) {
+    return !await this.allows(ability, ...args);
+  }
+  /**
+   * Check if the user has any of the given abilities.
+   */
+  async any(abilities, ...args) {
+    for (const ability of abilities) {
+      if (await this.allows(ability, ...args)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Check if the user has all of the given abilities.
+   */
+  async all(abilities, ...args) {
+    for (const ability of abilities) {
+      if (!await this.allows(ability, ...args)) {
+        return false;
+      }
+    }
+    return true;
+  }
+  /**
+   * Check if the user has none of the given abilities.
+   */
+  async none(abilities, ...args) {
+    return !await this.any(abilities, ...args);
+  }
+  /**
+   * Authorize the ability or throw an exception.
+   */
+  async authorize(ability, ...args) {
+    const allowed = await this.allows(ability, ...args);
+    if (!allowed) {
+      throw new AuthorizationException(`This action is unauthorized.`);
+    }
+  }
+  /**
+   * Get the authorization response.
+   */
+  async inspect(ability, ...args) {
+    const allowed = await this.check(ability, this.currentUser, ...args);
+    return allowed ? Response.allow() : Response.deny();
+  }
+  /**
+   * Check the ability with a specific user.
+   */
+  async check(ability, user, ...args) {
+    for (const beforeCallback of this.beforeCallbacks) {
+      const result = await beforeCallback(user, ability, ...args);
+      if (typeof result === "boolean") {
+        await this.runAfterCallbacks(user, ability, result, args);
+        return result;
+      }
+    }
+    const model = args[0];
+    if (model !== void 0 && model !== null) {
+      const policyResult = await this.checkPolicy(ability, user, model, args.slice(1));
+      if (policyResult !== void 0) {
+        await this.runAfterCallbacks(user, ability, policyResult, args);
+        return policyResult;
+      }
+    }
+    const gate = this.gates.get(ability);
+    if (gate) {
+      const result = await gate.callback(user, ...args);
+      await this.runAfterCallbacks(user, ability, result, args);
+      return result;
+    }
+    await this.runAfterCallbacks(user, ability, false, args);
+    return false;
+  }
+  /**
+   * Check a policy for the given ability.
+   *
+   * The subject may be a class instance (policy resolved via its constructor)
+   * or a `[ModelClass, record]` / `['key', record]` tuple. The tuple form is
+   * required for plain records returned by the ORM, which carry no constructor
+   * information.
+   */
+  async checkPolicy(ability, user, model, additionalArgs) {
+    let policyKey;
+    let subject = model;
+    let hasSubject = true;
+    if (Array.isArray(model) && model.length === 2 && (typeof model[0] === "function" || typeof model[0] === "string")) {
+      policyKey = model[0];
+      subject = model[1];
+    } else if (typeof model === "function") {
+      policyKey = model;
+      hasSubject = false;
+    } else {
+      policyKey = model?.constructor;
+    }
+    if (!policyKey) {
+      return void 0;
+    }
+    const policyClass = this.policies.get(policyKey);
+    if (!policyClass) {
+      return void 0;
+    }
+    const policy = this.getPolicyInstance(policyClass);
+    if (policy.before) {
+      const beforeResult = await policy.before(user, ability);
+      if (typeof beforeResult === "boolean") {
+        return beforeResult;
+      }
+    }
+    const method = policy[ability];
+    if (typeof method === "function") {
+      return hasSubject ? method.call(policy, user, subject, ...additionalArgs) : method.call(policy, user, ...additionalArgs);
+    }
+    return void 0;
+  }
+  /**
+   * Get or create a policy instance.
+   */
+  getPolicyInstance(policyClass) {
+    let instance = this.policyInstances.get(policyClass);
+    if (!instance) {
+      instance = new policyClass();
+      this.policyInstances.set(policyClass, instance);
+    }
+    return instance;
+  }
+  /**
+   * Run after callbacks.
+   */
+  async runAfterCallbacks(user, ability, result, args) {
+    for (const afterCallback of this.afterCallbacks) {
+      await afterCallback(user, ability, result, args);
+    }
+  }
+  /**
+   * Get all defined abilities.
+   */
+  abilities() {
+    return Array.from(this.gates.keys());
+  }
+  /**
+   * Check if an ability is defined.
+   */
+  has(ability) {
+    return this.gates.has(ability);
+  }
+  /**
+   * Get the policy for a model.
+   */
+  getPolicyFor(model) {
+    const modelConstructor = model?.constructor;
+    if (!modelConstructor) {
+      return void 0;
+    }
+    const policyClass = this.policies.get(modelConstructor);
+    if (!policyClass) {
+      return void 0;
+    }
+    return this.getPolicyInstance(policyClass);
+  }
+};
+var globalGate = null;
+function createGate(options) {
+  return new Gate(options);
+}
+function setGate(gate) {
+  globalGate = gate;
+}
+function getGate() {
+  if (!globalGate) {
+    throw new Error("Gate not initialized. Call setGate() first.");
+  }
+  return globalGate;
+}
+function defineGate(ability, callback) {
+  getGate().define(ability, callback);
+}
+async function can(ability, ...args) {
+  return getGate().allows(ability, ...args);
+}
+async function cannot(ability, ...args) {
+  return getGate().denies(ability, ...args);
+}
+async function authorize(ability, ...args) {
+  return getGate().authorize(ability, ...args);
+}
+
+// src/authorization/Policy.ts
+var Policy = class {
+  /**
+   * Allow the action.
+   */
+  allow(message) {
+    return Response.allow(message);
+  }
+  /**
+   * Deny the action.
+   */
+  deny(message, code) {
+    return Response.deny(message, code);
+  }
+  /**
+   * Deny with a specific HTTP status.
+   */
+  denyWithStatus(status, message) {
+    return Response.denyWithStatus(status, message);
+  }
+  /**
+   * Deny as not found (404).
+   */
+  denyAsNotFound(message) {
+    return Response.denyAsNotFound(message);
+  }
+};
+function definePolicy(definition) {
+  return class extends Policy {
+    before = definition.before;
+    viewAny(user) {
+      return definition.viewAny?.(user) ?? false;
+    }
+    view(user, model) {
+      return definition.view?.(user, model) ?? false;
+    }
+    create(user) {
+      return definition.create?.(user) ?? false;
+    }
+    update(user, model) {
+      return definition.update?.(user, model) ?? false;
+    }
+    delete(user, model) {
+      return definition.delete?.(user, model) ?? false;
+    }
+    restore(user, model) {
+      return definition.restore?.(user, model) ?? false;
+    }
+    forceDelete(user, model) {
+      return definition.forceDelete?.(user, model) ?? false;
+    }
+  };
+}
+
+// src/authorization/middleware.ts
+function authorizeMiddleware(ability, modelResolver, options = {}) {
+  return async (ctx, next) => {
+    const gate = getGate();
+    const user = await gate.resolveUser(ctx);
+    const gateForUser = gate.forUser(user);
+    const abilities = Array.isArray(ability) ? ability : [ability];
+    const model = modelResolver ? await modelResolver(ctx) : void 0;
+    let authorized = false;
+    if (Array.isArray(ability)) {
+      authorized = await gateForUser.any(abilities, model);
+    } else {
+      authorized = await gateForUser.allows(ability, model);
+    }
+    if (!authorized) {
+      throw new AuthorizationException(
+        options.message ?? "This action is unauthorized."
+      );
+    }
+    await next();
+  };
+}
+function authorizeAllMiddleware(abilities, modelResolver, options = {}) {
+  return async (ctx, next) => {
+    const gate = getGate();
+    const user = await gate.resolveUser(ctx);
+    const gateForUser = gate.forUser(user);
+    const model = modelResolver ? await modelResolver(ctx) : void 0;
+    const authorized = await gateForUser.all(abilities, model);
+    if (!authorized) {
+      throw new AuthorizationException(
+        options.message ?? "This action is unauthorized."
+      );
+    }
+    await next();
+  };
+}
+function authorizeResourceMiddleware(modelResolver, options = {}) {
+  return async (ctx, next) => {
+    const method = ctx.req.method.toUpperCase();
+    let ability;
+    switch (method) {
+      case "GET":
+      case "HEAD":
+        ability = "view";
+        break;
+      case "POST":
+        ability = "create";
+        break;
+      case "PUT":
+      case "PATCH":
+        ability = "update";
+        break;
+      case "DELETE":
+        ability = "delete";
+        break;
+      default:
+        ability = "view";
+    }
+    const gate = getGate();
+    const user = await gate.resolveUser(ctx);
+    const gateForUser = gate.forUser(user);
+    const model = await modelResolver(ctx);
+    const authorized = await gateForUser.allows(ability, model);
+    if (!authorized) {
+      throw new AuthorizationException(
+        options.message ?? "This action is unauthorized."
+      );
+    }
+    await next();
+  };
+}
+function withAuthorization(gate) {
+  return async (ctx, next) => {
+    const user = await gate.resolveUser(ctx);
+    const gateForUser = gate.forUser(user);
+    ctx.set("gate", gateForUser);
+    ctx.set("can", async (ability, ...args) => {
+      return gateForUser.allows(ability, ...args);
+    });
+    ctx.set("cannot", async (ability, ...args) => {
+      return gateForUser.denies(ability, ...args);
+    });
+    ctx.set("authorize", async (ability, ...args) => {
+      return gateForUser.authorize(ability, ...args);
+    });
+    await next();
+  };
+}
+
+export {
+  Response,
+  Gate,
+  createGate,
+  setGate,
+  getGate,
+  defineGate,
+  can,
+  cannot,
+  authorize,
+  Policy,
+  definePolicy,
+  authorizeMiddleware,
+  authorizeAllMiddleware,
+  authorizeResourceMiddleware,
+  withAuthorization
+};

package/dist/client-CKXJLsTe.d.ts

@@ -0,0 +1,232 @@
+import { Context, MiddlewareHandler } from 'hono';
+import Redis, { RedisOptions } from 'ioredis';
+
+/**
+ * Rate limit entry stored in the backing store.
+ */
+interface RateLimitEntry {
+    count: number;
+    resetAt: number;
+}
+/**
+ * Store interface for rate limit data.
+ * Implement this for Redis or database-backed storage.
+ */
+interface RateLimitStore {
+    /**
+     * Get the current rate limit entry for a key.
+     */
+    get(key: string): Promise<RateLimitEntry | null>;
+    /**
+     * Increment the count for a key and return the new entry.
+     * If the key doesn't exist, create it with count=1.
+     */
+    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
+    /**
+     * Reset the count for a key.
+     */
+    reset(key: string): Promise<void>;
+}
+/**
+ * Base class for in-memory rate limit stores with automatic cleanup.
+ */
+declare abstract class BaseMemoryStore implements RateLimitStore {
+    protected cleanupInterval?: ReturnType<typeof setInterval>;
+    constructor(cleanupIntervalMs?: number);
+    abstract get(key: string): Promise<RateLimitEntry | null>;
+    abstract increment(key: string, windowMs: number): Promise<RateLimitEntry>;
+    abstract reset(key: string): Promise<void>;
+    abstract cleanup(): void;
+    abstract clear(): void;
+    abstract get size(): number;
+    destroy(): void;
+}
+/**
+ * In-memory rate limit store.
+ * Suitable for single-process development, not for production clusters.
+ */
+declare class MemoryRateLimitStore extends BaseMemoryStore {
+    private entries;
+    get(key: string): Promise<RateLimitEntry | null>;
+    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
+    reset(key: string): Promise<void>;
+    cleanup(): void;
+    clear(): void;
+    get size(): number;
+}
+/**
+ * Configuration options for rate limiting.
+ */
+interface RateLimitOptions {
+    /**
+     * Maximum number of requests allowed in the time window.
+     * @default 100
+     */
+    limit?: number;
+    /**
+     * Time window in milliseconds.
+     * @default 60000 (1 minute)
+     */
+    windowMs?: number;
+    /**
+     * Function to extract the rate limit key from the request.
+     * Defaults to using the client IP address.
+     */
+    keyGenerator?: (ctx: Context) => string | Promise<string>;
+    /**
+     * Rate limit store implementation.
+     * Defaults to in-memory store.
+     */
+    store?: RateLimitStore;
+    /**
+     * Whether to skip rate limiting for certain requests.
+     */
+    skip?: (ctx: Context) => boolean | Promise<boolean>;
+    /**
+     * Custom handler when rate limit is exceeded.
+     */
+    onRateLimited?: (ctx: Context, retryAfter: number) => Response | Promise<Response>;
+    /**
+     * Whether to add rate limit headers to all responses.
+     * @default true
+     */
+    headers?: boolean;
+    /**
+     * Custom message when rate limit is exceeded.
+     * @default 'Too many requests, please try again later.'
+     */
+    message?: string;
+    /**
+     * HTTP status code when rate limit is exceeded.
+     * @default 429
+     */
+    statusCode?: number;
+    /**
+     * Prefix for rate limit keys.
+     * @default 'rl:'
+     */
+    keyPrefix?: string;
+    /**
+     * Trust reverse-proxy headers for client IP resolution, checked in order:
+     * `CF-Connecting-IP`, `True-Client-IP`, `X-Real-IP`, then the first entry
+     * of `X-Forwarded-For`. Falls back to `server.requestIP()` when none are set.
+     *
+     * Enable ONLY when every request passes through a proxy that sets or strips
+     * these headers — on direct deployments clients can spoof them to bypass
+     * per-client limits. Ignored when a custom `keyGenerator` is supplied.
+     * @default false
+     */
+    trustProxy?: boolean;
+}
+/**
+ * Create a rate limiting middleware.
+ *
+ * @example
+ * ```ts
+ * // Basic usage - 100 requests per minute per IP
+ * app.use('*', createRateLimitMiddleware())
+ *
+ * // Stricter limit for login endpoint
+ * router.post('/login', [AuthController, 'login'],
+ *   createRateLimitMiddleware({
+ *     limit: 5,
+ *     windowMs: 15 * 60 * 1000, // 15 minutes
+ *   })
+ * )
+ *
+ * // Custom key based on authenticated user
+ * app.use('/api/*', createRateLimitMiddleware({
+ *   limit: 1000,
+ *   windowMs: 60 * 60 * 1000, // 1 hour
+ *   keyGenerator: async (ctx) => {
+ *     const user = await ctx.get('user')
+ *     return user?.id?.toString() ?? defaultKeyGenerator(ctx)
+ *   },
+ * }))
+ * ```
+ */
+declare function createRateLimitMiddleware(options?: RateLimitOptions): MiddlewareHandler;
+/**
+ * Rate limit result information.
+ */
+interface RateLimitInfo {
+    limit: number;
+    remaining: number;
+    resetAt: Date;
+    isLimited: boolean;
+}
+/**
+ * Get rate limit information for a key without incrementing.
+ *
+ * @example
+ * ```ts
+ * const info = await getRateLimitInfo('user:123', store, { limit: 100 })
+ * console.log(`${info.remaining} requests remaining`)
+ * ```
+ */
+declare function getRateLimitInfo(key: string, store: RateLimitStore, options?: {
+    limit: number;
+    keyPrefix?: string;
+}): Promise<RateLimitInfo>;
+/**
+ * Reset rate limit for a specific key.
+ *
+ * @example
+ * ```ts
+ * // Reset rate limit after successful captcha
+ * await resetRateLimit(clientIp, store)
+ * ```
+ */
+declare function resetRateLimit(key: string, store: RateLimitStore, options?: {
+    keyPrefix?: string;
+}): Promise<void>;
+/**
+ * Sliding window rate limit store.
+ * More accurate than fixed window but uses more memory.
+ */
+declare class SlidingWindowRateLimitStore extends BaseMemoryStore {
+    private requests;
+    get(key: string): Promise<RateLimitEntry | null>;
+    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
+    reset(key: string): Promise<void>;
+    cleanup(): void;
+    clear(): void;
+    get size(): number;
+}
+
+/**
+ * Options for creating a Redis client.
+ */
+interface RedisClientOptions extends RedisOptions {
+    /**
+     * Redis connection URL (e.g., 'redis://localhost:6379').
+     * If provided, overrides host/port/password.
+     */
+    url?: string;
+    /**
+     * Key prefix for all operations.
+     * @default ''
+     */
+    keyPrefix?: string;
+}
+/**
+ * Create a Redis client with the given options.
+ *
+ * @example
+ * ```ts
+ * // Using URL
+ * const redis = createRedisClient({ url: 'redis://localhost:6379' })
+ *
+ * // Using host/port
+ * const redis = createRedisClient({ host: 'localhost', port: 6379 })
+ *
+ * // With key prefix
+ * const redis = createRedisClient({
+ *   url: process.env.REDIS_URL,
+ *   keyPrefix: 'myapp:',
+ * })
+ * ```
+ */
+declare function createRedisClient(options?: RedisClientOptions): Redis;
+
+export { MemoryRateLimitStore as M, type RateLimitStore as R, SlidingWindowRateLimitStore as S, type RateLimitEntry as a, type RedisClientOptions as b, createRedisClient as c, type RateLimitInfo as d, type RateLimitOptions as e, createRateLimitMiddleware as f, getRateLimitInfo as g, resetRateLimit as r };