@hasna/shortlinks 0.1.21 → 0.1.23

package/dist/runtime.js

@@ -0,0 +1,181 @@
+// @bun
+// src/runtime.ts
+var SHORTLINKS_RUNTIME_ENV = {
+  store: "HASNA_SHORTLINKS_STORE",
+  databaseUrl: "HASNA_SHORTLINKS_DATABASE_URL",
+  databaseSsl: "HASNA_SHORTLINKS_DATABASE_SSL"
+};
+var SHORTLINKS_RUNTIME_FALLBACK_ENV = {
+  store: "SHORTLINKS_STORE",
+  databaseUrl: "SHORTLINKS_DATABASE_URL",
+  databaseSsl: "SHORTLINKS_DATABASE_SSL"
+};
+var CANONICAL_SHORTLINKS_POSTGRES_CLUSTER = "hasna-xyz-infra-apps-prod-postgres";
+var CANONICAL_SHORTLINKS_POSTGRES_DATABASE = "shortlinks";
+var CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH = "hasna/xyz/opensource/shortlinks/prod/postgres";
+function getCanonicalShortlinksPostgresConfig() {
+  return {
+    cluster: CANONICAL_SHORTLINKS_POSTGRES_CLUSTER,
+    database: CANONICAL_SHORTLINKS_POSTGRES_DATABASE,
+    runtimeSecretPath: CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH,
+    primaryEnv: SHORTLINKS_RUNTIME_ENV.databaseUrl,
+    fallbackEnv: SHORTLINKS_RUNTIME_FALLBACK_ENV.databaseUrl
+  };
+}
+function parseShortlinksStoreMode(value) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return "local";
+  if (normalized === "local" || normalized === "postgres")
+    return normalized;
+  if (normalized === "pg")
+    return "postgres";
+  throw new Error(`${SHORTLINKS_RUNTIME_ENV.store} must be local or postgres`);
+}
+function getShortlinksStoreMode(env = process.env) {
+  return parseShortlinksStoreMode(readRuntimeEnv(env, "store").value);
+}
+function getShortlinksDatabaseUrl(env = process.env) {
+  return readRuntimeEnv(env, "databaseUrl").value;
+}
+function getShortlinksDatabaseSsl(env = process.env) {
+  return parseBoolean(readRuntimeEnv(env, "databaseSsl").value, true);
+}
+function getShortlinksRuntimeEnvName(env, key) {
+  const primary = SHORTLINKS_RUNTIME_ENV[key];
+  if (clean(env[primary]))
+    return primary;
+  return SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
+}
+function loadShortlinksRuntimeConfig(env = process.env) {
+  const mode = getShortlinksStoreMode(env);
+  const databaseUrl = getShortlinksDatabaseUrl(env);
+  return {
+    service: "shortlinks",
+    mode,
+    ...databaseUrl ? {
+      database: {
+        provider: "postgres",
+        url: databaseUrl,
+        ssl: getShortlinksDatabaseSsl(env)
+      }
+    } : {}
+  };
+}
+function assertShortlinksPostgresConfig(config) {
+  if (config.mode !== "postgres")
+    return;
+  if (!config.database?.url) {
+    throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseUrl} is required when ${SHORTLINKS_RUNTIME_ENV.store}=postgres`);
+  }
+}
+function getShortlinksRuntimeStatus(env = process.env) {
+  const issues = [];
+  const warnings = [];
+  let config;
+  try {
+    config = loadShortlinksRuntimeConfig(env);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+    config = { service: "shortlinks", mode: "local" };
+  }
+  try {
+    assertShortlinksPostgresConfig(config);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+  }
+  if (config.mode === "local" && config.database?.url) {
+    warnings.push(`${SHORTLINKS_RUNTIME_ENV.store}=local ignores configured Postgres database settings`);
+  }
+  return {
+    ok: issues.length === 0,
+    service: "shortlinks",
+    mode: config.mode,
+    local_default: config.mode === "local",
+    postgres_enabled: config.mode === "postgres",
+    database: {
+      configured: Boolean(config.database?.url),
+      provider: config.database?.provider ?? null,
+      redacted_url: redactDatabaseUrl(config.database?.url),
+      ssl: config.database?.ssl ?? null
+    },
+    env: runtimeEnvStatus(env),
+    canonical: getCanonicalShortlinksPostgresConfig(),
+    issues,
+    warnings,
+    no_network: true
+  };
+}
+function redactDatabaseUrl(value) {
+  if (!value)
+    return null;
+  try {
+    const url = new URL(value);
+    if (url.username)
+      url.username = "***";
+    if (url.password)
+      url.password = "***";
+    for (const key of Array.from(url.searchParams.keys())) {
+      if (isSensitiveQueryKey(key))
+        url.searchParams.set(key, "***");
+    }
+    return url.toString();
+  } catch {
+    return "(redacted)";
+  }
+}
+function runtimeEnvStatus(env) {
+  return Object.fromEntries(Object.entries(SHORTLINKS_RUNTIME_ENV).map(([key, name]) => {
+    const activeName = getShortlinksRuntimeEnvName(env, key);
+    return [
+      key,
+      {
+        name,
+        active_name: activeName,
+        configured: Boolean(clean(env[activeName]))
+      }
+    ];
+  }));
+}
+function readRuntimeEnv(env, key) {
+  const primary = SHORTLINKS_RUNTIME_ENV[key];
+  const primaryValue = clean(env[primary]);
+  if (primaryValue)
+    return { name: primary, value: primaryValue };
+  const fallback = SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
+  return { name: fallback, value: clean(env[fallback]) };
+}
+function parseBoolean(value, fallback) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return fallback;
+  if (["1", "true", "yes", "on"].includes(normalized))
+    return true;
+  if (["0", "false", "no", "off"].includes(normalized))
+    return false;
+  throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseSsl} must be true or false`);
+}
+function isSensitiveQueryKey(key) {
+  return /(?:^|[_-])(pass(?:word)?|pwd|secret|token|credential|auth|api[_-]?key|access[_-]?key)(?:$|[_-])/i.test(key);
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+export {
+  redactDatabaseUrl,
+  parseShortlinksStoreMode,
+  loadShortlinksRuntimeConfig,
+  getShortlinksStoreMode,
+  getShortlinksRuntimeStatus,
+  getShortlinksRuntimeEnvName,
+  getShortlinksDatabaseUrl,
+  getShortlinksDatabaseSsl,
+  getCanonicalShortlinksPostgresConfig,
+  assertShortlinksPostgresConfig,
+  SHORTLINKS_RUNTIME_FALLBACK_ENV,
+  SHORTLINKS_RUNTIME_ENV,
+  CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH,
+  CANONICAL_SHORTLINKS_POSTGRES_DATABASE,
+  CANONICAL_SHORTLINKS_POSTGRES_CLUSTER
+};

package/dist/server.js

@@ -8,7 +8,8 @@ import { mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 var SERVICE_NAME = "shortlinks";
@@ -24,6 +25,9 @@ function ensureDataDir() {
 function getConfigPath() {
   return join(ensureDataDir(), "config.json");
 }
+function getClickSaltPath() {
+  return join(ensureDataDir(), "click-salt");
+}
 function getDatabasePath(explicitPath) {
   if (explicitPath)
     return resolve(explicitPath);
@@ -31,6 +35,51 @@ function getDatabasePath(explicitPath) {
     return resolve(process.env.SHORTLINKS_DB);
   return join(ensureDataDir(), `${SERVICE_NAME}.db`);
 }
+function readClickSaltFile(path) {
+  try {
+    const saved = readFileSync(path, "utf-8").trim();
+    return saved || null;
+  } catch {
+    return null;
+  }
+}
+function clickSaltError(path, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return new Error(`Could not initialize click salt at ${path}. Set SHORTLINKS_CLICK_SALT or fix data directory permissions. ${detail}`);
+}
+function getClickSalt() {
+  const explicit = process.env.SHORTLINKS_CLICK_SALT?.trim();
+  if (explicit)
+    return explicit;
+  const path = getClickSaltPath();
+  const saved = readClickSaltFile(path);
+  if (saved)
+    return saved;
+  const generated = randomBytes(32).toString("hex");
+  const tempPath = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, `${generated}
+`, { flag: "wx", mode: 384 });
+    try {
+      linkSync(tempPath, path);
+      return generated;
+    } catch (error) {
+      const winner = readClickSaltFile(path);
+      if (winner)
+        return winner;
+      throw clickSaltError(path, error);
+    } finally {
+      try {
+        unlinkSync(tempPath);
+      } catch {}
+    }
+  } catch (error) {
+    const winner = readClickSaltFile(path);
+    if (winner)
+      return winner;
+    throw clickSaltError(path, error);
+  }
+}
 function loadConfig() {
   const path = getConfigPath();
   if (!existsSync(path))
@@ -202,13 +251,13 @@ import { hostname } from "os";
 import { join as join2 } from "path";
 
 // src/slug.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 var SLUG_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
 var DEFAULT_SLUG_LENGTH = 7;
 function randomToken(length = DEFAULT_SLUG_LENGTH) {
   if (length < 1 || length > 128)
     throw new Error("Token length must be between 1 and 128.");
-  const bytes = randomBytes(length);
+  const bytes = randomBytes2(length);
   let out = "";
   for (let i = 0;i < length; i += 1) {
     out += SLUG_ALPHABET[bytes[i] % SLUG_ALPHABET.length];
@@ -528,8 +577,7 @@ class ShortlinksStore {
     throw new Error("Could not generate an unused slug after 32 attempts.");
   }
   hashIp(ip) {
-    const salt = process.env.SHORTLINKS_CLICK_SALT || "shortlinks-local";
-    return createHash("sha256").update(`${salt}:${ip}`).digest("hex");
+    return createHash("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
 }
 

package/infra/aws-ec2-user-data.sh

@@ -4,9 +4,7 @@ set -euo pipefail
 export AWS_REGION="${AWS_REGION:-us-east-1}"
 export SHORTLINKS_HOME="/var/lib/shortlinks"
 export SHORTLINKS_PACKAGE="@hasna/shortlinks@latest"
-export RDS_SECRET_ID="rds!db-7a451ce6-83a9-40fa-b24a-81e5d5943511"
-export RDS_HOST="hasnaxyz-prod-opensource.c4limg0qgqvk.us-east-1.rds.amazonaws.com"
-export RDS_USERNAME="hasna_admin"
+export SHORTLINKS_DATABASE_SECRET_ID="${SHORTLINKS_DATABASE_SECRET_ID:-hasna/xyz/opensource/shortlinks/prod/postgres}"
 
 dnf update -y
 dnf install -y awscli jq tar gzip shadow-utils libcap
@@ -15,28 +13,14 @@ if ! id shortlinks >/dev/null 2>&1; then
   useradd --system --create-home --home-dir "${SHORTLINKS_HOME}" --shell /sbin/nologin shortlinks
 fi
 
-install -d -o shortlinks -g shortlinks "${SHORTLINKS_HOME}/.hasna/cloud"
 install -d -o shortlinks -g shortlinks "${SHORTLINKS_HOME}/.hasna/shortlinks"
-
-cat > "${SHORTLINKS_HOME}/.hasna/cloud/config.json" <<CLOUD_CONFIG
-{
-  "rds": {
-    "host": "${RDS_HOST}",
-    "port": 5432,
-    "username": "${RDS_USERNAME}",
-    "password_env": "HASNA_RDS_PASSWORD",
-    "ssl": true
-  },
-  "mode": "hybrid",
-  "feedback_endpoint": "https://feedback.hasna.com/api/v1/feedback",
-  "auto_sync_interval_minutes": 0,
-  "sync": {
-    "schedule_minutes": 0
-  }
-}
-CLOUD_CONFIG
-chown shortlinks:shortlinks "${SHORTLINKS_HOME}/.hasna/cloud/config.json"
-chmod 600 "${SHORTLINKS_HOME}/.hasna/cloud/config.json"
+cat > /etc/shortlinks.env <<ENV
+SHORTLINKS_DATABASE_SECRET_ID=${SHORTLINKS_DATABASE_SECRET_ID}
+HASNA_SHORTLINKS_STORE=postgres
+HASNA_SHORTLINKS_DATABASE_SSL=true
+ENV
+chown root:shortlinks /etc/shortlinks.env
+chmod 640 /etc/shortlinks.env
 
 su -s /bin/bash shortlinks -c 'curl -fsSL https://bun.sh/install | bash'
 su -s /bin/bash shortlinks -c "${SHORTLINKS_HOME}/.bun/bin/bun install -g ${SHORTLINKS_PACKAGE} --no-cache"
@@ -48,16 +32,32 @@ set -euo pipefail
 export AWS_REGION="${AWS_REGION:-us-east-1}"
 export HOME="/var/lib/shortlinks"
 export PATH="/var/lib/shortlinks/.bun/bin:/usr/local/bin:/usr/bin:/bin"
-export NODE_TLS_REJECT_UNAUTHORIZED="0"
+export HASNA_SHORTLINKS_STORE="postgres"
+export HASNA_SHORTLINKS_DATABASE_SSL="${HASNA_SHORTLINKS_DATABASE_SSL:-true}"
 
 secret_json="$(aws secretsmanager get-secret-value \
   --region "${AWS_REGION}" \
-  --secret-id "rds!db-7a451ce6-83a9-40fa-b24a-81e5d5943511" \
+  --secret-id "${SHORTLINKS_DATABASE_SECRET_ID:-hasna/xyz/opensource/shortlinks/prod/postgres}" \
   --query SecretString \
   --output text)"
 
-export HASNA_RDS_PASSWORD
-HASNA_RDS_PASSWORD="$(jq -r '.password' <<<"${secret_json}")"
+connection_url="$(jq -r '(.connectionString // .connection_string // .url // .database_url // empty)' <<<"${secret_json}")"
+if [[ -z "${connection_url}" ]]; then
+  db_host="$(jq -r '.host // empty' <<<"${secret_json}")"
+  db_port="$(jq -r '.port // 5432' <<<"${secret_json}")"
+  db_name="$(jq -r '.database // .dbname // "shortlinks"' <<<"${secret_json}")"
+  db_user="$(jq -r '.username // .user // empty' <<<"${secret_json}")"
+  db_password="$(jq -r '.password // empty' <<<"${secret_json}")"
+  if [[ -z "${db_host}" || -z "${db_user}" || -z "${db_password}" ]]; then
+    echo "Shortlinks database secret must include connectionString/url or host, username, and password." >&2
+    exit 1
+  fi
+  db_user_encoded="$(jq -nr --arg value "${db_user}" '$value|@uri')"
+  db_password_encoded="$(jq -nr --arg value "${db_password}" '$value|@uri')"
+  connection_url="postgres://${db_user_encoded}:${db_password_encoded}@${db_host}:${db_port}/${db_name}"
+fi
+
+export HASNA_SHORTLINKS_DATABASE_URL="${connection_url}"
 
 exec "$@"
 RUNNER
@@ -90,8 +90,9 @@ Group=shortlinks
 WorkingDirectory=/var/lib/shortlinks
 Environment=HOME=/var/lib/shortlinks
 Environment=PATH=/var/lib/shortlinks/.bun/bin:/usr/local/bin:/usr/bin:/bin
-Environment=SHORTLINKS_STORE=cloud
-ExecStart=/usr/local/bin/shortlinks-env-exec shortlinks serve --cloud --host 127.0.0.1 --port 8787 --default-host has.na
+EnvironmentFile=/etc/shortlinks.env
+ExecStartPre=/usr/local/bin/shortlinks-env-exec shortlinks postgres migrate
+ExecStart=/usr/local/bin/shortlinks-env-exec shortlinks --store postgres serve --host 127.0.0.1 --port 8787 --default-host has.na
 Restart=always
 RestartSec=5
 
@@ -133,4 +134,4 @@ CADDY
 systemctl daemon-reload
 systemctl enable shortlinks.service caddy.service
 systemctl start shortlinks.service
-systemctl start caddy.service || true
+systemctl start caddy.service

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hasna/shortlinks",
-  "version": "0.1.21",
-  "description": "CLI-only shortlink manager for custom domains, click tracking, Cloudflare setup, and @hasna cloud sync",
+  "version": "0.1.23",
+  "description": "CLI-only shortlink manager for custom domains, click tracking, Cloudflare setup, and app-owned Postgres runtime support",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -20,6 +20,14 @@
     "./cloudflare": {
       "types": "./dist/cloudflare.d.ts",
       "import": "./dist/cloudflare.js"
+    },
+    "./postgres": {
+      "types": "./dist/pg-store.d.ts",
+      "import": "./dist/pg-store.js"
+    },
+    "./runtime": {
+      "types": "./dist/runtime.d.ts",
+      "import": "./dist/runtime.js"
     }
   },
   "files": [
@@ -31,11 +39,11 @@
     "SECURITY.md"
   ],
   "scripts": {
-    "build": "rm -rf dist && bun build src/cli/index.ts --outdir dist/cli --target bun --external @hasna/cloud && bun build src/index.ts --outdir dist --target bun --external @hasna/cloud && bun build src/server.ts --outdir dist --target bun --external @hasna/cloud && bun build src/cloudflare.ts --outdir dist --target bun && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
+    "build": "rm -rf dist && bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/index.ts --outdir dist --target bun && bun build src/server.ts --outdir dist --target bun && bun build src/cloudflare.ts --outdir dist --target bun && bun build src/runtime.ts --outdir dist --target bun && bun build src/pg-store.ts --outdir dist --target bun && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
     "typecheck": "tsc --noEmit",
     "test": "bun test",
     "dev:cli": "bun run src/cli/index.ts",
-    "prepublishOnly": "bun run test && bun run build"
+    "prepublishOnly": "bun run typecheck && bun run test && bun run build"
   },
   "keywords": [
     "shortlinks",
@@ -66,12 +74,13 @@
   "author": "Andrei Hasna <andrei@hasna.com>",
   "license": "Apache-2.0",
   "dependencies": {
-    "@hasna/cloud": "0.1.30",
     "@hasna/events": "^0.1.6",
     "chalk": "^5.4.1",
-    "commander": "^13.1.0"
+    "commander": "^13.1.0",
+    "pg": "^8.13.3"
   },
   "devDependencies": {
+    "@types/pg": "^8.11.11",
     "@types/bun": "^1.2.4",
     "typescript": "^5.7.3"
   }