@luckystack/server 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +75 -56
  2. package/dist/index.js +189 -24
  3. package/dist/index.js.map +1 -1
  4. package/docs/http-routes.md +14 -7
  5. package/package.json +10 -10
package/docs/http-routes.md CHANGED
@@ -18,12 +18,14 @@ Pre-params handlers (no body parse) run first so probes, favicon, and CSRF stay
18
18
  Post-params handlers (after body parsing) run next:
19
19
 
20
20
  1. `handleUploadsRoute` — `/uploads/*`
21
- 2. `handleAuthApiRoute` — `/auth/api/*`
22
- 3. `handleAuthCallbackRoute` — `/auth/callback/*`
23
- 4. `handleApiRoute` — `/api/*` (delegates to `@luckystack/api`)
24
- 5. `handleSyncRoute` — `/sync/*` (delegates to `@luckystack/sync`)
25
- 6. `handleCustomRoutes` — every handler from `registerCustomRoute(...)` + `options.customRoutes`
26
- 7. `handleStaticAndSpaFallback` — `/assets/*`, known extensions, SPA `index.html`
21
+ 2. `handleAuthEmailCodeRoute` — `/auth/api/email-code/request|verify` (ADR 0024; BEFORE the `/auth/api/*` catch-all)
22
+ 3. `handleAuthTwoFactorRoute` — `/auth/api/2fa` + `/auth/api/2fa/*` (ADR 0024; BEFORE the `/auth/api/*` catch-all)
23
+ 4. `handleAuthApiRoute` — `/auth/api/*`
24
+ 5. `handleAuthCallbackRoute` — `/auth/callback/*`
25
+ 6. `handleApiRoute` — `/api/*` (delegates to `@luckystack/api`)
26
+ 7. `handleSyncRoute` — `/sync/*` (delegates to `@luckystack/sync`)
27
+ 8. `handleCustomRoutes` — every handler from `registerCustomRoute(...)` + `options.customRoutes`
28
+ 9. `handleStaticAndSpaFallback` — `/assets/*`, known extensions, SPA `index.html`
27
29
 
28
30
  A custom-route registry sits in front of the static fallback. Both the legacy `customRoutes` option on `CreateLuckyStackServerOptions` and the global `registerCustomRoute(...)` registry are honored. Errors in custom handlers are caught and reported as `500 server.customRouteFailed`; the request loop is never crashed by a misbehaving handler.
29
31
 
@@ -38,7 +40,12 @@ A custom-route registry sits in front of the static fallback. Both the legacy `c
38
40
  | `/_health` | GET | `handleHealthRoute` | `200 { status: 'ok', bootUuid, envKey, synchronizedHashes }` | `503 { status: 'degraded', ... }` when boot UUID is missing |
39
41
  | `/_test/reset` | POST | `handleTestResetRoute` | `200 { status: 'success', cleared: string[] }` | `404 notFound` or `403 auth.forbidden` — see `security-defaults.md` |
40
42
  | `/uploads/*` | GET | `handleUploadsRoute` | Avatar bytes via `@luckystack/core` `serveAvatar` | `404` from `serveAvatar` when missing |
41
- | `/auth/api/*` | POST | `handleAuthApiRoute` | OAuth redirect (`302`) or credentials login envelope | Rate-limited envelope, `200` envelope with `status:false, reason` |
43
+ | `/auth/api/email-code/request` | POST | `handleAuthEmailCodeRoute` | `200 { status: true }` (anti-enumeration: also for unknown addresses) | `200 { status:false, reason }`, `429` per-IP |
44
+ | `/auth/api/email-code/verify` | POST | `handleAuthEmailCodeRoute` | Login envelope + session transport, or 2FA-challenge envelope | `200 { status:false, reason }`, `429` per-IP |
45
+ | `/auth/api/2fa` | POST | `handleAuthTwoFactorRoute` | Login envelope + session transport (completes the challenge) | `200 { status:false, reason }`, `429` per-IP |
46
+ | `/auth/api/2fa/email-code` | POST | `handleAuthTwoFactorRoute` | `200 { status: true }` (fallback code sent) | `200 { status:false, reason }`, `429` per-IP |
47
+ | `/auth/api/2fa/setup\|enable\|disable\|recovery-codes` | POST (authed) | `handleAuthTwoFactorRoute` | `200 { status:true, secret/otpauthUri \| recoveryCodes[] }` | `401 api.unauthorized` without session; `200 { status:false, reason }` |
48
+ | `/auth/api/*` | POST | `handleAuthApiRoute` | OAuth redirect (`302`) or credentials login envelope (may carry `requiresTwoFactor` + `challengeToken`) | Rate-limited envelope, `200` envelope with `status:false, reason` |
42
49
  | `/auth/callback/*` | GET | `handleAuthCallbackRoute` | `302` to `redirectUrl` with session cookie or token | `401 'Login failed'` plain text |
43
50
  | `/api/*` | GET / POST / PUT / DELETE | `handleApiRoute` | JSON envelope from `@luckystack/api` `handleHttpApiRequest`, or SSE stream | `400 api.invalidName`, `500 api.invalidRequestFormat` |
44
51
  | `/sync/*` | POST | `handleSyncRoute` | JSON envelope from `@luckystack/sync` `handleHttpSyncRequest`, or SSE stream | `405 sync.methodNotAllowed`, `400 sync.invalidName`, `500 sync.invalidRequestFormat` |
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@luckystack/server",
3
- "version": "0.5.0",
3
+ "version": "0.6.0",
4
4
  "private": false,
5
5
  "publishConfig": {
6
6
  "access": "public",
@@ -57,19 +57,19 @@
57
57
  "test": "vitest run"
58
58
  },
59
59
  "dependencies": {
60
- "@luckystack/api": "^0.5.0",
61
- "@luckystack/core": "^0.5.0"
60
+ "@luckystack/api": "^0.6.0",
61
+ "@luckystack/core": "^0.6.0"
62
62
  },
63
63
  "peerDependencies": {
64
64
  "@prisma/client": "^6.19.0",
65
65
  "socket.io": "^4.8.0",
66
- "@luckystack/devkit": "^0.5.0",
67
- "@luckystack/docs-ui": "^0.5.0",
68
- "@luckystack/email": "^0.5.0",
69
- "@luckystack/error-tracking": "^0.5.0",
70
- "@luckystack/login": "^0.5.0",
71
- "@luckystack/presence": "^0.5.0",
72
- "@luckystack/sync": "^0.5.0"
66
+ "@luckystack/devkit": "^0.6.0",
67
+ "@luckystack/docs-ui": "^0.6.0",
68
+ "@luckystack/email": "^0.6.0",
69
+ "@luckystack/error-tracking": "^0.6.0",
70
+ "@luckystack/login": "^0.6.0",
71
+ "@luckystack/presence": "^0.6.0",
72
+ "@luckystack/sync": "^0.6.0"
73
73
  },
74
74
  "peerDependenciesMeta": {
75
75
  "@prisma/client": {