@hasna/shortlinks 0.1.21 → 0.1.23

package/dist/config.d.ts

@@ -12,7 +12,9 @@ export interface ShortlinksConfig {
 export declare function getDataDir(): string;
 export declare function ensureDataDir(): string;
 export declare function getConfigPath(): string;
+export declare function getClickSaltPath(): string;
 export declare function getDatabasePath(explicitPath?: string): string;
+export declare function getClickSalt(): string;
 export declare function loadConfig(): ShortlinksConfig;
 export declare function saveConfig(config: ShortlinksConfig): void;
 export declare function updateConfig(patch: ShortlinksConfig): ShortlinksConfig;

package/dist/index.d.ts

@@ -1,10 +1,12 @@
 export { ShortlinksDatabase, SQLITE_MIGRATIONS, makeId, now } from "./database.js";
 export { ShortlinksStore } from "./store.js";
-export { PgShortlinksStore } from "./pg-store.js";
+export { PgShortlinksStore, applyPostgresMigrations } from "./pg-store.js";
 export { createShortlinksHandler, serveShortlinks } from "./server.js";
 export { createCloudflarePlan, generateWorkerScript, writeWorkerFiles, upsertCloudflareDnsRecord } from "./cloudflare.js";
 export { createLocalSetupPlan, registerMachinesDns } from "./local.js";
 export { PG_MIGRATIONS } from "./pg-migrations.js";
+export { CANONICAL_SHORTLINKS_POSTGRES_CLUSTER, CANONICAL_SHORTLINKS_POSTGRES_DATABASE, CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH, SHORTLINKS_RUNTIME_ENV, SHORTLINKS_RUNTIME_FALLBACK_ENV, assertShortlinksPostgresConfig, getCanonicalShortlinksPostgresConfig, getShortlinksDatabaseSsl, getShortlinksDatabaseUrl, getShortlinksRuntimeEnvName, getShortlinksRuntimeStatus, getShortlinksStoreMode, loadShortlinksRuntimeConfig, parseShortlinksStoreMode, redactDatabaseUrl, } from "./runtime.js";
 export { formatShortUrl, getConfigPath, getDataDir, getDatabasePath, loadConfig, normalizeHostname, saveConfig } from "./config.js";
 export { normalizeSlug, randomToken } from "./slug.js";
 export type { AddDomainInput, Click, ClickInput, CreateLinkInput, Domain, Link, LinkStats } from "./types.js";
+export type { CanonicalShortlinksPostgresConfig, RuntimeEnvStatus, ShortlinksPostgresConfig, ShortlinksRuntimeConfig, ShortlinksRuntimeEnv, ShortlinksRuntimeStatus, ShortlinksStoreMode, } from "./runtime.js";

package/dist/index.js

@@ -1,13 +1,12 @@
 // @bun
-var __require = import.meta.require;
-
 // src/database.ts
 import { Database } from "bun:sqlite";
 import { mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 var SERVICE_NAME = "shortlinks";
@@ -23,6 +22,9 @@ function ensureDataDir() {
 function getConfigPath() {
   return join(ensureDataDir(), "config.json");
 }
+function getClickSaltPath() {
+  return join(ensureDataDir(), "click-salt");
+}
 function getDatabasePath(explicitPath) {
   if (explicitPath)
     return resolve(explicitPath);
@@ -30,6 +32,51 @@ function getDatabasePath(explicitPath) {
     return resolve(process.env.SHORTLINKS_DB);
   return join(ensureDataDir(), `${SERVICE_NAME}.db`);
 }
+function readClickSaltFile(path) {
+  try {
+    const saved = readFileSync(path, "utf-8").trim();
+    return saved || null;
+  } catch {
+    return null;
+  }
+}
+function clickSaltError(path, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return new Error(`Could not initialize click salt at ${path}. Set SHORTLINKS_CLICK_SALT or fix data directory permissions. ${detail}`);
+}
+function getClickSalt() {
+  const explicit = process.env.SHORTLINKS_CLICK_SALT?.trim();
+  if (explicit)
+    return explicit;
+  const path = getClickSaltPath();
+  const saved = readClickSaltFile(path);
+  if (saved)
+    return saved;
+  const generated = randomBytes(32).toString("hex");
+  const tempPath = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, `${generated}
+`, { flag: "wx", mode: 384 });
+    try {
+      linkSync(tempPath, path);
+      return generated;
+    } catch (error) {
+      const winner = readClickSaltFile(path);
+      if (winner)
+        return winner;
+      throw clickSaltError(path, error);
+    } finally {
+      try {
+        unlinkSync(tempPath);
+      } catch {}
+    }
+  } catch (error) {
+    const winner = readClickSaltFile(path);
+    if (winner)
+      return winner;
+    throw clickSaltError(path, error);
+  }
+}
 function loadConfig() {
   const path = getConfigPath();
   if (!existsSync(path))
@@ -203,13 +250,13 @@ import { hostname } from "os";
 import { join as join2 } from "path";
 
 // src/slug.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 var SLUG_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
 var DEFAULT_SLUG_LENGTH = 7;
 function randomToken(length = DEFAULT_SLUG_LENGTH) {
   if (length < 1 || length > 128)
     throw new Error("Token length must be between 1 and 128.");
-  const bytes = randomBytes(length);
+  const bytes = randomBytes2(length);
   let out = "";
   for (let i = 0;i < length; i += 1) {
     out += SLUG_ALPHABET[bytes[i] % SLUG_ALPHABET.length];
@@ -529,12 +576,177 @@ class ShortlinksStore {
     throw new Error("Could not generate an unused slug after 32 attempts.");
   }
   hashIp(ip) {
-    const salt = process.env.SHORTLINKS_CLICK_SALT || "shortlinks-local";
-    return createHash("sha256").update(`${salt}:${ip}`).digest("hex");
+    return createHash("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
 }
 // src/pg-store.ts
 import { createHash as createHash2 } from "crypto";
+
+// src/runtime.ts
+var SHORTLINKS_RUNTIME_ENV = {
+  store: "HASNA_SHORTLINKS_STORE",
+  databaseUrl: "HASNA_SHORTLINKS_DATABASE_URL",
+  databaseSsl: "HASNA_SHORTLINKS_DATABASE_SSL"
+};
+var SHORTLINKS_RUNTIME_FALLBACK_ENV = {
+  store: "SHORTLINKS_STORE",
+  databaseUrl: "SHORTLINKS_DATABASE_URL",
+  databaseSsl: "SHORTLINKS_DATABASE_SSL"
+};
+var CANONICAL_SHORTLINKS_POSTGRES_CLUSTER = "hasna-xyz-infra-apps-prod-postgres";
+var CANONICAL_SHORTLINKS_POSTGRES_DATABASE = "shortlinks";
+var CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH = "hasna/xyz/opensource/shortlinks/prod/postgres";
+function getCanonicalShortlinksPostgresConfig() {
+  return {
+    cluster: CANONICAL_SHORTLINKS_POSTGRES_CLUSTER,
+    database: CANONICAL_SHORTLINKS_POSTGRES_DATABASE,
+    runtimeSecretPath: CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH,
+    primaryEnv: SHORTLINKS_RUNTIME_ENV.databaseUrl,
+    fallbackEnv: SHORTLINKS_RUNTIME_FALLBACK_ENV.databaseUrl
+  };
+}
+function parseShortlinksStoreMode(value) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return "local";
+  if (normalized === "local" || normalized === "postgres")
+    return normalized;
+  if (normalized === "pg")
+    return "postgres";
+  throw new Error(`${SHORTLINKS_RUNTIME_ENV.store} must be local or postgres`);
+}
+function getShortlinksStoreMode(env = process.env) {
+  return parseShortlinksStoreMode(readRuntimeEnv(env, "store").value);
+}
+function getShortlinksDatabaseUrl(env = process.env) {
+  return readRuntimeEnv(env, "databaseUrl").value;
+}
+function getShortlinksDatabaseSsl(env = process.env) {
+  return parseBoolean(readRuntimeEnv(env, "databaseSsl").value, true);
+}
+function getShortlinksRuntimeEnvName(env, key) {
+  const primary = SHORTLINKS_RUNTIME_ENV[key];
+  if (clean(env[primary]))
+    return primary;
+  return SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
+}
+function loadShortlinksRuntimeConfig(env = process.env) {
+  const mode = getShortlinksStoreMode(env);
+  const databaseUrl = getShortlinksDatabaseUrl(env);
+  return {
+    service: "shortlinks",
+    mode,
+    ...databaseUrl ? {
+      database: {
+        provider: "postgres",
+        url: databaseUrl,
+        ssl: getShortlinksDatabaseSsl(env)
+      }
+    } : {}
+  };
+}
+function assertShortlinksPostgresConfig(config) {
+  if (config.mode !== "postgres")
+    return;
+  if (!config.database?.url) {
+    throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseUrl} is required when ${SHORTLINKS_RUNTIME_ENV.store}=postgres`);
+  }
+}
+function getShortlinksRuntimeStatus(env = process.env) {
+  const issues = [];
+  const warnings = [];
+  let config;
+  try {
+    config = loadShortlinksRuntimeConfig(env);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+    config = { service: "shortlinks", mode: "local" };
+  }
+  try {
+    assertShortlinksPostgresConfig(config);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+  }
+  if (config.mode === "local" && config.database?.url) {
+    warnings.push(`${SHORTLINKS_RUNTIME_ENV.store}=local ignores configured Postgres database settings`);
+  }
+  return {
+    ok: issues.length === 0,
+    service: "shortlinks",
+    mode: config.mode,
+    local_default: config.mode === "local",
+    postgres_enabled: config.mode === "postgres",
+    database: {
+      configured: Boolean(config.database?.url),
+      provider: config.database?.provider ?? null,
+      redacted_url: redactDatabaseUrl(config.database?.url),
+      ssl: config.database?.ssl ?? null
+    },
+    env: runtimeEnvStatus(env),
+    canonical: getCanonicalShortlinksPostgresConfig(),
+    issues,
+    warnings,
+    no_network: true
+  };
+}
+function redactDatabaseUrl(value) {
+  if (!value)
+    return null;
+  try {
+    const url = new URL(value);
+    if (url.username)
+      url.username = "***";
+    if (url.password)
+      url.password = "***";
+    for (const key of Array.from(url.searchParams.keys())) {
+      if (isSensitiveQueryKey(key))
+        url.searchParams.set(key, "***");
+    }
+    return url.toString();
+  } catch {
+    return "(redacted)";
+  }
+}
+function runtimeEnvStatus(env) {
+  return Object.fromEntries(Object.entries(SHORTLINKS_RUNTIME_ENV).map(([key, name]) => {
+    const activeName = getShortlinksRuntimeEnvName(env, key);
+    return [
+      key,
+      {
+        name,
+        active_name: activeName,
+        configured: Boolean(clean(env[activeName]))
+      }
+    ];
+  }));
+}
+function readRuntimeEnv(env, key) {
+  const primary = SHORTLINKS_RUNTIME_ENV[key];
+  const primaryValue = clean(env[primary]);
+  if (primaryValue)
+    return { name: primary, value: primaryValue };
+  const fallback = SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
+  return { name: fallback, value: clean(env[fallback]) };
+}
+function parseBoolean(value, fallback) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return fallback;
+  if (["1", "true", "yes", "on"].includes(normalized))
+    return true;
+  if (["0", "false", "no", "off"].includes(normalized))
+    return false;
+  throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseSsl} must be true or false`);
+}
+function isSensitiveQueryKey(key) {
+  return /(?:^|[_-])(pass(?:word)?|pwd|secret|token|credential|auth|api[_-]?key|access[_-]?key)(?:$|[_-])/i.test(key);
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+// src/pg-store.ts
 function parseJsonObject2(value) {
   if (!value)
     return {};
@@ -547,6 +759,47 @@ function parseJsonObject2(value) {
     return {};
   }
 }
+async function loadPgPool() {
+  const importer = new Function("specifier", "return import(specifier)");
+  const module = await importer("pg");
+  return module.Pool;
+}
+function toPostgresSql(sql) {
+  let index = 0;
+  return sql.replace(/\?/g, () => `$${++index}`);
+}
+function createPgPoolConfig(connectionString, options = {}) {
+  const ssl = options.ssl ?? true;
+  return {
+    connectionString,
+    ...ssl ? { ssl: { rejectUnauthorized: true } } : { ssl: false }
+  };
+}
+
+class PgPoolAdapter {
+  pool;
+  constructor(pool) {
+    this.pool = pool;
+  }
+  static async create(connectionString, options = {}) {
+    const Pool = await loadPgPool();
+    return new PgPoolAdapter(new Pool(createPgPoolConfig(connectionString, options)));
+  }
+  async get(sql, ...params) {
+    const result = await this.pool.query(toPostgresSql(sql), params);
+    return result.rows[0] ?? null;
+  }
+  async all(sql, ...params) {
+    const result = await this.pool.query(toPostgresSql(sql), params);
+    return result.rows;
+  }
+  async run(sql, ...params) {
+    return this.pool.query(toPostgresSql(sql), params);
+  }
+  async close() {
+    await this.pool.end();
+  }
+}
 function toIsoString(value) {
   if (value instanceof Date)
     return value.toISOString();
@@ -615,13 +868,15 @@ class PgShortlinksStore {
   constructor(pg) {
     this.pg = pg;
   }
-  static async fromConnectionString(connectionString) {
-    const { PgAdapterAsync } = await import("@hasna/cloud");
-    return new PgShortlinksStore(new PgAdapterAsync(connectionString));
+  static async fromConnectionString(connectionString, options = {}) {
+    return new PgShortlinksStore(await PgPoolAdapter.create(connectionString, options));
   }
-  static async fromCloud(service = "shortlinks") {
-    const { getConnectionString } = await import("@hasna/cloud");
-    return PgShortlinksStore.fromConnectionString(getConnectionString(service));
+  static async fromEnv(env = process.env) {
+    const connectionString = getShortlinksDatabaseUrl(env);
+    if (!connectionString) {
+      throw new Error("HASNA_SHORTLINKS_DATABASE_URL is required when shortlinks uses the postgres store");
+    }
+    return PgShortlinksStore.fromConnectionString(connectionString, { ssl: getShortlinksDatabaseSsl(env) });
   }
   async close() {
     await this.pg.close?.();
@@ -837,8 +1092,7 @@ class PgShortlinksStore {
     };
   }
   hashIp(ip) {
-    const salt = process.env.SHORTLINKS_CLICK_SALT || "shortlinks-cloud";
-    return createHash2("sha256").update(`${salt}:${ip}`).digest("hex");
+    return createHash2("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
   async generateAvailableSlug(domainId, length) {
     for (let attempt = 0;attempt < 32; attempt += 1) {
@@ -852,6 +1106,52 @@ class PgShortlinksStore {
     throw new Error("Could not generate an unused slug after 32 attempts.");
   }
 }
+async function applyPostgresMigrations(connectionString, migrations, options = {}) {
+  const Pool = await loadPgPool();
+  const pool = new Pool(createPgPoolConfig(connectionString, options));
+  const client = await pool.connect();
+  const run = (sql, ...params) => client.query(toPostgresSql(sql), params);
+  const get = async (sql, ...params) => {
+    const result = await run(sql, ...params);
+    return result.rows[0] ?? null;
+  };
+  const applied = [];
+  const skipped = [];
+  try {
+    await run("BEGIN");
+    await run(`
+      SELECT pg_advisory_xact_lock(hashtext(?))
+    `, "shortlinks:migrations");
+    await run(`
+      CREATE TABLE IF NOT EXISTS _shortlinks_migrations (
+        id INTEGER PRIMARY KEY,
+        service TEXT NOT NULL DEFAULT 'shortlinks',
+        applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `);
+    for (let i = 0;i < migrations.length; i += 1) {
+      const id = i + 1;
+      const existing = await get("SELECT id FROM _shortlinks_migrations WHERE id = ? LIMIT 1", id);
+      if (existing) {
+        skipped.push(id);
+        continue;
+      }
+      await run(migrations[i]);
+      await run("INSERT INTO _shortlinks_migrations (id, service, applied_at) VALUES (?, ?, now())", id, "shortlinks");
+      applied.push(id);
+    }
+    await run("COMMIT");
+    return { service: "shortlinks", applied, skipped };
+  } catch (error) {
+    try {
+      await run("ROLLBACK");
+    } catch {}
+    throw error;
+  } finally {
+    client.release();
+    await pool.end();
+  }
+}
 // src/server.ts
 var REDIRECT_ALLOW_HEADER = "GET, HEAD";
 function json(data, status = 200, headers) {
@@ -1202,23 +1502,39 @@ export {
   serveShortlinks,
   saveConfig,
   registerMachinesDns,
+  redactDatabaseUrl,
   randomToken,
+  parseShortlinksStoreMode,
   now,
   normalizeSlug,
   normalizeHostname,
   makeId,
+  loadShortlinksRuntimeConfig,
   loadConfig,
+  getShortlinksStoreMode,
+  getShortlinksRuntimeStatus,
+  getShortlinksRuntimeEnvName,
+  getShortlinksDatabaseUrl,
+  getShortlinksDatabaseSsl,
   getDatabasePath,
   getDataDir,
   getConfigPath,
+  getCanonicalShortlinksPostgresConfig,
   generateWorkerScript,
   formatShortUrl,
   createShortlinksHandler,
   createLocalSetupPlan,
   createCloudflarePlan,
+  assertShortlinksPostgresConfig,
+  applyPostgresMigrations,
   ShortlinksStore,
   ShortlinksDatabase,
   SQLITE_MIGRATIONS,
+  SHORTLINKS_RUNTIME_FALLBACK_ENV,
+  SHORTLINKS_RUNTIME_ENV,
   PgShortlinksStore,
-  PG_MIGRATIONS
+  PG_MIGRATIONS,
+  CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH,
+  CANONICAL_SHORTLINKS_POSTGRES_DATABASE,
+  CANONICAL_SHORTLINKS_POSTGRES_CLUSTER
 };

package/dist/pg-store.d.ts

@@ -5,11 +5,14 @@ type PgAdapterLike = {
     run(sql: string, ...params: unknown[]): Promise<unknown>;
     close?: () => Promise<void>;
 };
+export interface PgConnectionOptions {
+    ssl?: boolean;
+}
 export declare class PgShortlinksStore {
     private readonly pg;
     constructor(pg: PgAdapterLike);
-    static fromConnectionString(connectionString: string): Promise<PgShortlinksStore>;
-    static fromCloud(service?: string): Promise<PgShortlinksStore>;
+    static fromConnectionString(connectionString: string, options?: PgConnectionOptions): Promise<PgShortlinksStore>;
+    static fromEnv(env?: NodeJS.ProcessEnv): Promise<PgShortlinksStore>;
     close(): Promise<void>;
     addDomain(input: AddDomainInput): Promise<Domain>;
     listDomains(): Promise<Domain[]>;
@@ -35,4 +38,9 @@ export declare class PgShortlinksStore {
     private hashIp;
     private generateAvailableSlug;
 }
+export declare function applyPostgresMigrations(connectionString: string, migrations: string[], options?: PgConnectionOptions): Promise<{
+    service: "shortlinks";
+    applied: number[];
+    skipped: number[];
+}>;
 export {};