@lastshotlabs/bunshot 0.0.27 → 0.1.0

package/dist/routes/uploads.js

@@ -1,227 +0,0 @@
-import { z } from "zod";
-import { createRouter } from "../lib/context";
-import { createRoute } from "../lib/createRoute";
-import { userAuth } from "../middleware/userAuth";
-import { getStorageAdapter, generateUploadKeyFromFilename } from "../lib/upload";
-import { getSigningConfig, getSigningSecret } from "../lib/appConfig";
-import { createPresignedUrl } from "../lib/signing";
-import { getUploadRecord, deleteUploadRecord, registerUpload } from "../lib/uploadRegistry";
-const tags = ["Uploads"];
-async function checkUploadAccess(action, key, userId, tenantId, config) {
-    const record = await getUploadRecord(key);
-    const authorize = config.authorization?.authorize;
-    const allowExternalKeys = config.allowExternalKeys ?? false;
-    if (record) {
-        // If the registry record has a tenantId, the requester must match — period.
-        if (record.tenantId && record.tenantId !== tenantId) {
-            return { allowed: false, notFound: false };
-        }
-        // Owner match → allow
-        if (record.ownerUserId && record.ownerUserId === userId) {
-            return { allowed: true, notFound: false };
-        }
-        // No owner or owner mismatch → try callback
-        if (authorize) {
-            const ok = await authorize({ action, key, userId: userId ?? undefined, tenantId: tenantId ?? undefined });
-            return { allowed: ok, notFound: false };
-        }
-        return { allowed: false, notFound: false };
-    }
-    // Record not in registry
-    if (allowExternalKeys) {
-        if (authorize) {
-            const ok = await authorize({ action, key, userId: userId ?? undefined, tenantId: tenantId ?? undefined });
-            return { allowed: ok, notFound: false };
-        }
-        return { allowed: false, notFound: false };
-    }
-    return { allowed: false, notFound: true };
-}
-export const createUploadsRouter = (config) => {
-    const router = createRouter();
-    const basePath = (config.path ?? "/uploads").replace(/\/$/, "");
-    router.use(`${basePath}/*`, userAuth);
-    const BLOCKED_MIME_TYPES = new Set([
-        "application/x-executable",
-        "application/x-sh",
-        "application/x-msdownload",
-        "text/html",
-        "application/x-httpd-php",
-        "application/javascript",
-        "text/javascript",
-    ]);
-    const presignRoute = createRoute({
-        method: "post",
-        path: `${basePath}/presign`,
-        tags,
-        summary: "Generate presigned upload URL",
-        request: {
-            body: {
-                content: {
-                    "application/json": {
-                        schema: z.object({
-                            filename: z.string().optional().describe("Original filename (used to derive the storage key extension)"),
-                            mimeType: z.string().optional().describe("MIME type of the file"),
-                            expirySeconds: z.number().int().positive().optional().describe("URL expiry in seconds"),
-                            maxBytes: z.number().int().positive().max(100 * 1024 * 1024).optional()
-                                .describe("Maximum allowed file size in bytes (client-enforced via Content-Length header). Defaults to 10MB. Maximum: 100MB."),
-                        }),
-                    },
-                },
-            },
-        },
-        responses: {
-            200: {
-                description: "Presigned URL generated",
-                content: { "application/json": { schema: z.object({ url: z.string(), key: z.string(), maxBytes: z.number().optional() }) } },
-            },
-            400: {
-                description: "File type not allowed",
-                content: { "application/json": { schema: z.object({ error: z.string() }) } },
-            },
-            501: {
-                description: "Not implemented by adapter",
-                content: { "application/json": { schema: z.object({ error: z.string() }) } },
-            },
-        },
-    });
-    router.openapi(presignRoute, async (c) => {
-        const adapter = getStorageAdapter();
-        if (!adapter?.presignPut) {
-            return c.json({ error: "Presigned URLs not supported by the configured storage adapter" }, 501);
-        }
-        const { filename, mimeType, expirySeconds, maxBytes } = c.req.valid("json");
-        if (mimeType && BLOCKED_MIME_TYPES.has(mimeType)) {
-            return c.json({ error: "File type not allowed." }, 400);
-        }
-        const userId = c.get("authUserId") ?? undefined;
-        const tenantId = c.get("tenantId") ?? undefined;
-        // Server-generates the key — client cannot control the storage path
-        const key = generateUploadKeyFromFilename(filename, { userId, tenantId });
-        const expiry = expirySeconds ?? (typeof config.expirySeconds === "number" ? config.expirySeconds : 3600);
-        const url = await adapter.presignPut(key, { expirySeconds: expiry, mimeType });
-        // Register the upload for ownership tracking
-        await registerUpload({
-            key,
-            ownerUserId: userId,
-            tenantId,
-            mimeType,
-            bucket: c.get("uploadBucket") ?? undefined,
-            createdAt: Date.now(),
-        });
-        return c.json({ url, key, ...(maxBytes !== undefined ? { maxBytes } : {}) }, 200);
-    });
-    const presignGetRoute = createRoute({
-        method: "get",
-        path: `${basePath}/presign/:key{.+}`,
-        tags,
-        summary: "Generate presigned download URL",
-        request: {
-            params: z.object({ key: z.string() }),
-            query: z.object({
-                expiry: z.string().optional().describe("URL expiry in seconds (default: 3600)"),
-            }),
-        },
-        responses: {
-            200: {
-                description: "Presigned download URL",
-                content: {
-                    "application/json": {
-                        schema: z.object({
-                            url: z.string(),
-                            expiresAt: z.number().describe("Unix timestamp (seconds) when the URL expires"),
-                        }),
-                    },
-                },
-            },
-            403: {
-                description: "Forbidden — not the owner or unauthorized",
-                content: { "application/json": { schema: z.object({ error: z.string() }) } },
-            },
-            404: {
-                description: "Key not found in upload registry",
-                content: { "application/json": { schema: z.object({ error: z.string() }) } },
-            },
-            501: {
-                description: "Not implemented",
-                content: { "application/json": { schema: z.object({ error: z.string() }) } },
-            },
-        },
-    });
-    router.openapi(presignGetRoute, async (c) => {
-        const { key } = c.req.valid("param");
-        const { expiry: expiryStr } = c.req.valid("query");
-        const userId = c.get("authUserId");
-        const tenantId = c.get("tenantId");
-        const { allowed, notFound } = await checkUploadAccess("read", key, userId, tenantId, config);
-        if (notFound)
-            return c.json({ error: "Not found" }, 404);
-        if (!allowed)
-            return c.json({ error: "Forbidden" }, 403);
-        const expirySeconds = expiryStr ? parseInt(expiryStr, 10) : (typeof config.expirySeconds === "number" ? config.expirySeconds : 3600);
-        const signingCfg = getSigningConfig();
-        if (signingCfg?.presignedUrls) {
-            const secret = getSigningSecret();
-            if (!secret)
-                return c.json({ error: "Signing secret not configured" }, 501);
-            const defaultExpiry = typeof signingCfg.presignedUrls === "object"
-                ? (signingCfg.presignedUrls.defaultExpiry ?? expirySeconds)
-                : expirySeconds;
-            const base = new URL(c.req.url);
-            base.pathname = `${basePath}/download/${key}`;
-            base.search = "";
-            const url = createPresignedUrl(base.toString(), key, { method: "GET", expiry: defaultExpiry }, secret);
-            const expiresAt = Math.floor(Date.now() / 1000) + defaultExpiry;
-            return c.json({ url, expiresAt }, 200);
-        }
-        // Fallback: adapter.presignGet (S3 only)
-        const adapter = getStorageAdapter();
-        if (!adapter?.presignGet) {
-            return c.json({ error: "Presigned download URLs not supported. Enable signing.presignedUrls or use an S3 adapter." }, 501);
-        }
-        const url = await adapter.presignGet(key, { expirySeconds });
-        const expiresAt = Math.floor(Date.now() / 1000) + expirySeconds;
-        return c.json({ url, expiresAt }, 200);
-    });
-    const deleteRoute = createRoute({
-        method: "delete",
-        path: `${basePath}/:key{.+}`,
-        tags,
-        summary: "Delete an uploaded file",
-        request: {
-            params: z.object({ key: z.string() }),
-        },
-        responses: {
-            204: { description: "Deleted" },
-            403: {
-                description: "Forbidden — not the owner or unauthorized",
-                content: { "application/json": { schema: z.object({ error: z.string() }) } },
-            },
-            404: {
-                description: "Key not found in upload registry",
-                content: { "application/json": { schema: z.object({ error: z.string() }) } },
-            },
-            500: {
-                description: "No storage adapter configured",
-                content: { "application/json": { schema: z.object({ error: z.string() }) } },
-            },
-        },
-    });
-    router.openapi(deleteRoute, async (c) => {
-        const adapter = getStorageAdapter();
-        if (!adapter)
-            return c.json({ error: "No storage adapter configured" }, 500);
-        const { key } = c.req.valid("param");
-        const userId = c.get("authUserId");
-        const tenantId = c.get("tenantId");
-        const { allowed, notFound } = await checkUploadAccess("delete", key, userId, tenantId, config);
-        if (notFound)
-            return c.json({ error: "Not found" }, 404);
-        if (!allowed)
-            return c.json({ error: "Forbidden" }, 403);
-        await adapter.delete(key);
-        await deleteUploadRecord(key);
-        return c.body(null, 204);
-    });
-    return router;
-};

package/dist/schemas/auth.js

@@ -1,30 +0,0 @@
-import { z } from "zod";
-import { getPasswordPolicy } from "../lib/appConfig";
-/** Build a Zod schema for the password field based on the configured policy.
- *  Applied to registration and reset-password. Login uses min(1) intentionally
- *  to avoid locking out users registered under older/weaker policies. */
-const passwordSchema = () => {
-    const policy = getPasswordPolicy();
-    const minLen = policy.minLength ?? 8;
-    let schema = z.string().min(minLen, `Password must be at least ${minLen} characters`);
-    if (policy.requireLetter !== false) {
-        schema = schema.regex(/[a-zA-Z]/, "Password must contain at least one letter");
-    }
-    if (policy.requireDigit !== false) {
-        schema = schema.regex(/\d/, "Password must contain at least one digit");
-    }
-    if (policy.requireSpecial) {
-        schema = schema.regex(/[^a-zA-Z0-9]/, "Password must contain at least one special character");
-    }
-    return schema;
-};
-export const makeRegisterSchema = (primaryField) => z.object({
-    [primaryField]: primaryField === "email" ? z.string().email() : z.string().min(3),
-    password: passwordSchema(),
-});
-export const makeLoginSchema = (primaryField) => z.object({
-    [primaryField]: primaryField === "email" ? z.string().email() : z.string().min(1),
-    password: z.string().min(1),
-});
-/** Password schema for reset-password — same policy as registration. */
-export const resetPasswordSchema = () => passwordSchema();

package/dist/server.d.ts

@@ -1,57 +0,0 @@
-import type { Server, ServerWebSocket, WebSocketHandler } from "bun";
-import { type CreateAppConfig } from "./app";
-import { type SocketData } from "./ws/index";
-import { type HeartbeatConfig } from "./lib/wsHeartbeat";
-import { type WsMessageStore, type WsMessageDefaults } from "./lib/wsMessages";
-export interface WsConfig<T extends object = object> {
-    /** Override or extend the default WebSocket handler */
-    handler?: WebSocketHandler<SocketData<T>>;
-    /** Override the default /ws upgrade handler (auth + upgrade logic) */
-    upgradeHandler?: (req: Request, server: Server<SocketData<T>>) => Promise<Response | undefined>;
-    /**
-     * Guard called before a socket joins a room via the subscribe action.
-     * Return true to allow, false to deny (client receives { event: "subscribe_denied", room }).
-     * ws.data.userId is available for auth checks.
-     */
-    onRoomSubscribe?: (ws: ServerWebSocket<SocketData<T>>, room: string) => boolean | Promise<boolean>;
-    /**
-     * Maximum allowed WebSocket message size in bytes.
-     * Messages exceeding this limit will cause the connection to be closed with code 1009.
-     * Defaults to 65536 (64 KB).
-     */
-    maxMessageSize?: number;
-    /**
-     * Heartbeat / ping-pong keepalive. Set `true` for defaults (30s interval, 10s timeout)
-     * or provide an object to customize intervals.
-     */
-    heartbeat?: boolean | HeartbeatConfig;
-    /**
-     * Presence tracking. Set `true` for defaults or provide config.
-     * When enabled, `presence_join`/`presence_leave` events are broadcast to rooms.
-     */
-    presence?: boolean | {
-        broadcastEvents?: boolean;
-    };
-    /**
-     * Message persistence. Opt rooms in via `configureRoom()`.
-     */
-    persistence?: {
-        store?: WsMessageStore;
-        defaults?: WsMessageDefaults;
-    };
-}
-export interface CreateServerConfig<T extends object = object> extends CreateAppConfig {
-    port?: number;
-    /** Absolute path to the service's workers directory — auto-imports all .ts files */
-    workersDir?: string;
-    /** Set false to disable auto-loading workers. Defaults to true */
-    enableWorkers?: boolean;
-    /** WebSocket configuration */
-    ws?: WsConfig<T>;
-    /**
-     * Maximum request body size in bytes. Defaults to the upload config limit when present
-     * (maxFileSize * maxFiles), otherwise Bun's default (128 MB).
-     */
-    maxRequestBodySize?: number;
-}
-export declare const createServer: <T extends object = object>(config: CreateServerConfig<T>) => Promise<Server<SocketData<T>>>;

package/dist/server.js

@@ -1,112 +0,0 @@
-import { createApp } from "./app";
-import { websocket as defaultWebsocket, createWsUpgradeHandler } from "./ws/index";
-import { setWsServer, handleRoomActions, cleanupSocket, setPresenceEnabled } from "./lib/ws";
-import { registerSocket, deregisterSocket, handlePong, startHeartbeat, stopHeartbeat } from "./lib/wsHeartbeat";
-import { trackSocket, untrackSocket } from "./lib/wsPresence";
-import { setWsMessageStore, setWsMessageDefaults } from "./lib/wsMessages";
-import { log } from "./lib/logger";
-export const createServer = async (config) => {
-    const app = await createApp(config);
-    const port = Number(process.env.PORT ?? config.port ?? 3000);
-    const { workersDir, enableWorkers = true, ws: wsConfig = {} } = config;
-    // Compute maxRequestBodySize: explicit config wins, else derive from upload config
-    let maxRequestBodySize = config.maxRequestBodySize;
-    if (maxRequestBodySize === undefined && config.upload) {
-        const maxFileSize = config.upload.maxFileSize ?? 10 * 1024 * 1024;
-        const maxFiles = config.upload.maxFiles ?? 10;
-        maxRequestBodySize = maxFileSize * maxFiles;
-    }
-    const { handler: userWs, upgradeHandler: wsUpgradeHandler, onRoomSubscribe, maxMessageSize = 65_536, heartbeat: heartbeatConfig, presence: presenceConfig, persistence: persistenceConfig, } = wsConfig;
-    // Configure presence
-    if (presenceConfig)
-        setPresenceEnabled(true);
-    // Configure message persistence
-    if (persistenceConfig) {
-        if (persistenceConfig.store)
-            setWsMessageStore(persistenceConfig.store);
-        if (persistenceConfig.defaults)
-            setWsMessageDefaults(persistenceConfig.defaults);
-    }
-    const defaultOpen = defaultWebsocket.open;
-    const defaultClose = defaultWebsocket.close;
-    const defaultDrain = defaultWebsocket.drain;
-    const heartbeatEnabled = !!heartbeatConfig;
-    const ws = {
-        open(socket) {
-            if (heartbeatEnabled)
-                registerSocket(socket, socket.data.id);
-            if (presenceConfig)
-                trackSocket(socket.data.id, socket.data.userId);
-            (userWs?.open ?? defaultOpen)(socket);
-        },
-        async message(socket, message) {
-            const size = typeof message === "string" ? message.length : message.byteLength;
-            if (size > maxMessageSize) {
-                socket.close(1009, "Message too large");
-                return;
-            }
-            if (!await handleRoomActions(socket, message, onRoomSubscribe)) {
-                if (userWs?.message) {
-                    userWs.message(socket, message);
-                }
-                // No default echo — without a custom handler, non-room messages are silently dropped
-            }
-        },
-        close(socket, code, reason) {
-            if (heartbeatEnabled)
-                deregisterSocket(socket.data.id);
-            if (presenceConfig)
-                untrackSocket(socket.data.id);
-            cleanupSocket(socket.data.id, socket.data.rooms);
-            socket.data.rooms.clear();
-            (userWs?.close ?? defaultClose)(socket, code, reason);
-        },
-        pong(socket) {
-            if (heartbeatEnabled)
-                handlePong(socket.data.id);
-        },
-        drain: userWs?.drain ?? defaultDrain,
-    };
-    let server;
-    server = Bun.serve({
-        port,
-        routes: {
-            "/ws": (req) => wsUpgradeHandler
-                ? wsUpgradeHandler(req, server)
-                : createWsUpgradeHandler(server)(req),
-        },
-        fetch: app.fetch,
-        websocket: ws,
-        ...(maxRequestBodySize !== undefined ? { maxRequestBodySize } : {}),
-        error(err) {
-            console.error(err);
-            return Response.json({ error: "Internal Server Error" }, { status: 500 });
-        },
-    });
-    setWsServer(server);
-    // Start heartbeat after server is ready
-    if (heartbeatEnabled)
-        startHeartbeat(heartbeatConfig);
-    // Graceful shutdown — stop heartbeat alongside existing cleanup
-    const gracefulShutdown = () => { stopHeartbeat(); };
-    process.on("SIGTERM", gracefulShutdown);
-    process.on("SIGINT", gracefulShutdown);
-    if (enableWorkers && workersDir) {
-        const glob = new Bun.Glob("**/*.ts");
-        for await (const file of glob.scan({ cwd: workersDir })) {
-            await import(`${workersDir}/${file}`);
-        }
-        // Clean up ghost cron schedulers after all workers are loaded
-        try {
-            const { getRegisteredCronNames, cleanupStaleSchedulers } = await import("./lib/queue");
-            const activeNames = [...getRegisteredCronNames()];
-            if (activeNames.length > 0) {
-                await cleanupStaleSchedulers(activeNames);
-            }
-        }
-        catch { /* bullmq not installed or no cron workers */ }
-    }
-    log(`[server] running at http://localhost:${server.port}`);
-    log(`[server] API docs at http://localhost:${server.port}/docs`);
-    return server;
-};

package/dist/services/auth.d.ts

@@ -1,29 +0,0 @@
-import type { SessionMetadata } from "../lib/session";
-export interface AuthResult {
-    token: string;
-    userId: string;
-    email?: string;
-    emailVerified?: boolean;
-    googleLinked?: boolean;
-    refreshToken?: string;
-    mfaRequired?: boolean;
-    mfaToken?: string;
-    mfaMethods?: string[];
-    webauthnOptions?: Record<string, unknown>;
-}
-/** Create a session for a user (used internally and by MFA verify). */
-export declare const createSessionForUser: (userId: string, metadata?: SessionMetadata) => Promise<{
-    token: string;
-    refreshToken?: string;
-    sessionId: string;
-}>;
-export declare const register: (identifier: string, password: string, metadata?: SessionMetadata) => Promise<AuthResult>;
-export declare const login: (identifier: string, password: string, metadata?: SessionMetadata) => Promise<AuthResult>;
-export declare const refresh: (refreshTokenValue: string) => Promise<{
-    token: string;
-    refreshToken: string;
-    userId: string;
-}>;
-export declare const deleteAccount: (userId: string, password?: string) => Promise<void>;
-export declare const logout: (token: string | null) => Promise<void>;
-export declare const passkeyLogin: (passkeyToken: string, assertionResponse: any, metadata?: SessionMetadata) => Promise<AuthResult>;