@ismaelsoilet/synapsejs 1.3.0 → 1.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ismaelsoilet/synapsejs",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Bun-only fullstack framework where a feature is a single contiguous file",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/compiler/schema-dag.ts

@@ -25,26 +25,30 @@ export function parseTableDependencies(ddl: string): { created: string[]; refere
   const created: string[] = [];
   const referenced: string[] = [];
 
-  // Match CREATE TABLE [IF NOT EXISTS] <name>
-  const createRegex = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`]?([a-zA-Z0-9_]+)["'`]?/gi;
-  let match: RegExpExecArray | null = createRegex.exec(ddl);
+  // Strip SQL comments to avoid false-positive dependencies
+  const cleanDdl = ddl.replace(/--.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+
+  // Match CREATE TABLE [IF NOT EXISTS] [schema.]<name>
+  const createRegex =
+    /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:["'`]?[a-zA-Z0-9_]+["'`]?\.)?["'`]?([a-zA-Z0-9_]+)["'`]?/gi;
+  let match: RegExpExecArray | null = createRegex.exec(cleanDdl);
   while (match !== null) {
     const tableName = match[1].toLowerCase();
     if (!created.includes(tableName)) {
       created.push(tableName);
     }
-    match = createRegex.exec(ddl);
+    match = createRegex.exec(cleanDdl);
   }
 
-  // Match REFERENCES <name>
-  const refRegex = /REFERENCES\s+["'`]?([a-zA-Z0-9_]+)["'`]?/gi;
-  let refMatch: RegExpExecArray | null = refRegex.exec(ddl);
+  // Match REFERENCES [schema.]<name>[(columns)]
+  const refRegex = /REFERENCES\s+(?:["'`]?[a-zA-Z0-9_]+["'`]?\.)?["'`]?([a-zA-Z0-9_]+)["'`]?/gi;
+  let refMatch: RegExpExecArray | null = refRegex.exec(cleanDdl);
   while (refMatch !== null) {
     const tableName = refMatch[1].toLowerCase();
     if (!created.includes(tableName) && !referenced.includes(tableName)) {
       referenced.push(tableName);
     }
-    refMatch = refRegex.exec(ddl);
+    refMatch = refRegex.exec(cleanDdl);
   }
 
   return { created, referenced };

package/src/compiler/slice-splitter.ts

@@ -75,11 +75,19 @@ const SERVER_ONLY_PATTERNS: Array<{ label: string; pattern: RegExp }> = [
   { label: 'UPDATE statement', pattern: /\bUPDATE\s+\w+\s+SET\b/i },
   { label: 'DELETE statement', pattern: /\bDELETE\s+FROM\b/i },
   { label: 'CREATE TABLE statement', pattern: /\bCREATE\s+TABLE\b/i },
+  { label: 'ALTER TABLE statement', pattern: /\bALTER\s+TABLE\b/i },
+  { label: 'DROP TABLE statement', pattern: /\bDROP\s+TABLE\b/i },
   { label: 'database call', pattern: /\bdb\s*\.\s*(?:query|findMany|findOne|insert|update|delete|sql|sqlOne)\b/ },
   { label: 'sliceSchema symbol', pattern: /\bsliceSchema\b/ },
   { label: 'test runner import', pattern: /from\s+['"]bun:test['"]/ },
-  { label: 'process.env access', pattern: /\bprocess\.env\b/ },
-  { label: 'Bun global', pattern: /\bBun\./ }
+  { label: 'process.env access', pattern: /\bprocess\s*(?:\.\s*env|\[\s*['"]env['"]\s*\])/ },
+  { label: 'process destructuring', pattern: /\b(?:const|let|var)\s*\{[^}]*\benv\b[^}]*\}\s*=\s*process\b/ },
+  { label: 'Bun global', pattern: /\bBun\./ },
+  {
+    label: 'node server module import',
+    pattern: /from\s+['"](?:node:)?(?:fs|child_process|cluster|dgram|dns|net|tls|v8|vm)['"]/
+  },
+  { label: 'dynamic code evaluation', pattern: /\b(?:eval|new\s+Function)\s*\(/ }
 ];
 
 interface DeclEntry {

package/src/core/action-definition.ts

@@ -0,0 +1,89 @@
+/**
+ * SynapseJS - Declarative Action Definition Primitive
+ *
+ * Implements "Secure by Default" (Fail-Closed) semantics and wire-speed automatic
+ * TypeBox schema validation. Prevents inadvertent public exposure of RPC endpoints
+ * and eliminates repetitive manual `Value.Check` and `requireAuth` boilerplate.
+ */
+
+import type { Static, TSchema } from '@sinclair/typebox';
+import { Value } from '@sinclair/typebox/value';
+import type { DatabaseClient } from './database-client';
+import { Err, type Result } from './machine-types';
+import { requireAuth, type SessionContext } from './session-context';
+
+export type ActionAuthRule = 'public' | string[];
+
+export interface ActionDefinitionConfig<TSchemaInput extends TSchema | undefined, TOutput> {
+  /**
+   * Optional TypeBox schema for input payload validation.
+   * If supplied, incoming requests are automatically validated before the handler runs.
+   */
+  input?: TSchemaInput;
+
+  /**
+   * Authorization rules for this action.
+   * - Omitted / undefined: Requires an authenticated user session (Fail-Closed by default).
+   * - Array of strings (e.g. ['admin', 'manager']): Requires the session to possess at least one of these roles.
+   * - 'public': Explicitly marks the action as accessible to unauthenticated callers.
+   */
+  auth?: ActionAuthRule;
+
+  /**
+   * Handler function executing business logic.
+   * Receives strongly-typed validated input, database client and authenticated session context.
+   */
+  handler: (ctx: {
+    input: TSchemaInput extends TSchema ? Static<TSchemaInput> : unknown;
+    db?: DatabaseClient;
+    session?: SessionContext;
+  }) => Promise<TOutput> | TOutput;
+}
+
+export type ActionHandlerFn<TSchemaInput extends TSchema | undefined, TOutput> = {
+  (
+    payload: unknown,
+    db?: DatabaseClient,
+    session?: SessionContext
+  ): Promise<TOutput | Result<never, 'INVALID_SCHEMA' | 'UNAUTHORIZED' | 'FORBIDDEN'>>;
+  readonly __isSynapseAction: true;
+  readonly config: ActionDefinitionConfig<TSchemaInput, TOutput>;
+};
+
+export function defineAction<TSchemaInput extends TSchema | undefined, TOutput>(
+  config: ActionDefinitionConfig<TSchemaInput, TOutput>
+): ActionHandlerFn<TSchemaInput, TOutput> {
+  const actionFn = async (
+    payload: unknown,
+    db?: DatabaseClient,
+    session?: SessionContext
+  ): Promise<TOutput | Result<never, 'INVALID_SCHEMA' | 'UNAUTHORIZED' | 'FORBIDDEN'>> => {
+    // 1. Fail-Closed Authentication Guard
+    if (config.auth !== 'public') {
+      const requiredRoles = Array.isArray(config.auth) ? config.auth : undefined;
+      const auth = requireAuth(session, requiredRoles);
+      if (!auth.ok) {
+        return Err(auth.error);
+      }
+    }
+
+    // 2. Automatic Wire-Speed Schema Validation
+    if (config.input) {
+      if (!Value.Check(config.input, payload)) {
+        return Err('INVALID_SCHEMA');
+      }
+    }
+
+    // 3. Typed Handler Invocation
+    return config.handler({
+      input: payload as TSchemaInput extends TSchema ? Static<TSchemaInput> : unknown,
+      db,
+      session
+    });
+  };
+
+  Object.defineProperty(actionFn, '__isSynapseAction', { value: true, writable: false });
+  Object.defineProperty(actionFn, 'config', { value: config, writable: false });
+
+  return actionFn as ActionHandlerFn<TSchemaInput, TOutput>;
+}

package/src/core/index.ts

@@ -1,4 +1,5 @@
 export * from './action-context';
+export * from './action-definition';
 export * from './config';
 export * from './database-client';
 export * from './database-factory';