@morojs/moro 1.6.1 → 1.6.2

package/src/core/docs/zod-to-openapi.ts

@@ -1,41 +1,39 @@
 // Zod to OpenAPI Schema Converter
 // Transforms Zod schemas into OpenAPI 3.0 schema definitions
 
-import { createFrameworkLogger } from '../logger';
+import { createFrameworkLogger } from '../logger/index.js';
+import { createUserRequire, isPackageAvailable } from '../utilities/package-utils.js';
+
+const logger = createFrameworkLogger('ZodToOpenAPI');
 
 // Dynamic Zod imports (optional dependency)
-let ZodSchema: any,
-  ZodType: any,
-  ZodObject: any,
-  ZodArray: any,
-  ZodString: any,
-  ZodNumber: any,
-  ZodBoolean: any,
-  ZodEnum: any,
-  ZodOptional: any,
-  ZodDefault: any,
-  ZodUnion: any,
-  ZodLiteral: any;
-
-try {
-  const zod = require('zod');
-  ZodSchema = zod.ZodSchema;
-  ZodType = zod.ZodType;
-  ZodObject = zod.ZodObject;
-  ZodArray = zod.ZodArray;
-  ZodString = zod.ZodString;
-  ZodNumber = zod.ZodNumber;
-  ZodBoolean = zod.ZodBoolean;
-  ZodEnum = zod.ZodEnum;
-  ZodOptional = zod.ZodOptional;
-  ZodDefault = zod.ZodDefault;
-  ZodUnion = zod.ZodUnion;
-  ZodLiteral = zod.ZodLiteral;
-} catch {
-  // Zod not available - that's fine!
-}
+let zodModule: any = null;
+let zodLoadAttempted = false;
 
-const logger = createFrameworkLogger('ZodToOpenAPI');
+// Lazy synchronous initialization for Zod
+function loadZodSync() {
+  if (zodLoadAttempted) {
+    return zodModule;
+  }
+
+  zodLoadAttempted = true;
+
+  try {
+    if (!isPackageAvailable('zod')) {
+      zodModule = null;
+      return zodModule;
+    }
+
+    // Use synchronous require for immediate availability
+    const userRequire = createUserRequire();
+    zodModule = userRequire('zod');
+  } catch {
+    // Zod not available - that's fine!
+    zodModule = null;
+  }
+
+  return zodModule;
+}
 
 // OpenAPI schema types
 export interface OpenAPISchema {
@@ -72,7 +70,8 @@ export interface ConversionOptions {
 // Main conversion function
 export function zodToOpenAPI(schema: any, options: ConversionOptions = {}): OpenAPISchema {
   // Check if Zod is available
-  if (!ZodSchema) {
+  const zod = loadZodSync();
+  if (!zod) {
     throw new Error('Zod is not installed. Please install zod to use zodToOpenAPI function.');
   }
 
@@ -420,7 +419,8 @@ function hasDefault(type: any): boolean {
 // Generate example data from Zod schema
 export function generateExampleFromSchema(schema: any): any {
   // Check if Zod is available
-  if (!ZodSchema) {
+  const zod = loadZodSync();
+  if (!zod) {
     throw new Error(
       'Zod is not installed. Please install zod to use generateExampleFromSchema function.'
     );

package/src/core/events/event-bus.ts

@@ -8,8 +8,8 @@ import {
   GlobalEventBus,
   EventMetrics,
   EventHandler,
-} from '../../types/events';
-import { createFrameworkLogger } from '../logger';
+} from '../../types/events.js';
+import { createFrameworkLogger } from '../logger/index.js';
 
 export class MoroEventBus implements GlobalEventBus {
   private emitter = new EventEmitter();
@@ -33,7 +33,7 @@ export class MoroEventBus implements GlobalEventBus {
 
   // Global event emission with full context and metrics
   async emit<T = any>(event: string, data: T, context?: Partial<EventContext>): Promise<boolean> {
-    // Fast path: skip processing if no listeners
+    // Skip processing if no listeners
     if (this.emitter.listenerCount(event) === 0) {
       return false;
     }

package/src/core/events/index.ts

@@ -1,5 +1,5 @@
 // Event System - Centralized Exports
-export { MoroEventBus } from './event-bus';
+export { MoroEventBus } from './event-bus.js';
 export type {
   EventContext,
   EventPayload,
@@ -9,4 +9,4 @@ export type {
   EventMetrics,
   SystemEvents,
   EventHandler,
-} from '../../types/events';
+} from '../../types/events.js';

package/src/core/framework.ts

@@ -5,29 +5,29 @@ import {
   createServer as createHttp2Server,
 } from 'http2';
 import { EventEmitter } from 'events';
-import { MoroHttpServer, HttpRequest, HttpResponse, middleware } from './http';
-import { Router } from './http';
-import { Container } from './utilities';
-import { ModuleLoader } from './modules';
-import { WebSocketManager } from './networking';
-import { CircuitBreaker } from './utilities';
-import { MoroEventBus } from './events';
-import { createFrameworkLogger, logger as globalLogger } from './logger';
-import { ModuleConfig, InternalRouteDefinition } from '../types/module';
-import { LogLevel, LoggerOptions } from '../types/logger';
-import { WebSocketAdapter, WebSocketAdapterOptions } from './networking/websocket-adapter';
-
-export interface MoroOptions {
+import { MoroHttpServer, HttpRequest, HttpResponse, middleware } from './http/index.js';
+import { UWebSocketsHttpServer } from './http/uws-http-server.js';
+import { Router } from './routing/router.js';
+import { Container } from './utilities/container.js';
+import { ModuleLoader } from './modules/index.js';
+import { WebSocketManager } from './networking/websocket-manager.js';
+import { CircuitBreaker } from './utilities/circuit-breaker.js';
+import { isPackageAvailable } from './utilities/package-utils.js';
+import { MoroEventBus } from './events/index.js';
+import { createFrameworkLogger, logger as globalLogger } from './logger/index.js';
+import { ModuleConfig, InternalRouteDefinition } from '../types/module.js';
+import { LogLevel, LoggerOptions } from '../types/logger.js';
+import { MoroOptions as CoreMoroOptions } from '../types/core.js';
+import { WebSocketAdapter, WebSocketAdapterOptions } from './networking/websocket-adapter.js';
+
+// Extended MoroOptions that includes both core options and framework-specific options
+export interface MoroOptions extends CoreMoroOptions {
   http2?: boolean;
   https?: {
     key: string | Buffer;
     cert: string | Buffer;
     ca?: string | Buffer;
   };
-  compression?: {
-    enabled?: boolean;
-    threshold?: number;
-  };
   websocket?:
     | {
         enabled?: boolean;
@@ -37,12 +37,12 @@ export interface MoroOptions {
         options?: WebSocketAdapterOptions;
       }
     | false;
-  logger?: LoggerOptions | boolean;
+  config?: any; // Full configuration object
 }
 
 export class Moro extends EventEmitter {
-  private httpServer: MoroHttpServer;
-  private server: Server | any; // HTTP/2 server type
+  private httpServer: MoroHttpServer | UWebSocketsHttpServer;
+  private server: Server | any; // HTTP/2 server type or uWebSockets app
   private websocketAdapter?: WebSocketAdapter;
   private container: Container;
   private moduleLoader: ModuleLoader;
@@ -54,10 +54,15 @@ export class Moro extends EventEmitter {
   // Framework logger
   private logger: any;
   private options: MoroOptions;
+  private config: any;
+  private usingUWebSockets = false;
+  // WebSocket initialization promise to handle async adapter detection
+  private websocketSetupPromise: Promise<void> | null = null;
 
   constructor(options: MoroOptions = {}) {
     super();
     this.options = options;
+    this.config = options.config || {};
 
     // Configure global logger based on options
     if (options.logger !== undefined) {
@@ -77,10 +82,33 @@ export class Moro extends EventEmitter {
     // Initialize framework logger after global configuration
     this.logger = createFrameworkLogger('Core');
 
-    this.httpServer = new MoroHttpServer();
+    // Check if uWebSockets should be used for HTTP and WebSocket
+    const useUWebSockets = this.config.server?.useUWebSockets || false;
+
+    if (useUWebSockets) {
+      try {
+        // Try to use uWebSockets for high performance HTTP and WebSocket
+        const sslOptions = this.config.server?.ssl || options.https;
+        this.httpServer = new UWebSocketsHttpServer({ ssl: sslOptions });
+        this.server = (this.httpServer as UWebSocketsHttpServer).getApp();
+        this.usingUWebSockets = true;
+        this.logger.info('uWebSockets HTTP+WebSocket server created', 'ServerInit');
+      } catch (error) {
+        // Fallback to standard HTTP/1.1 if uWebSockets fails to load
+        this.logger.warn(
+          'uWebSockets failed to initialize, falling back to Node.js http.Server. ' +
+            'Error: ' +
+            (error instanceof Error ? error.message : String(error)),
+          'ServerInit'
+        );
+        this.usingUWebSockets = false;
+        this.httpServer = new MoroHttpServer();
+        this.server = (this.httpServer as MoroHttpServer).getServer();
+      }
+    } else if (options.http2) {
+      // Use HTTP/2
+      this.httpServer = new MoroHttpServer();
 
-    // Create HTTP/2 or HTTP/1.1 server based on options
-    if (options.http2) {
       if (options.https) {
         this.server = createHttp2SecureServer(options.https);
       } else {
@@ -95,20 +123,26 @@ export class Moro extends EventEmitter {
         req.url = headers[':path'];
         req.method = headers[':method'];
         req.headers = headers;
-        this.httpServer['handleRequest'](req, res);
+        (this.httpServer as MoroHttpServer)['handleRequest'](req, res);
       });
 
       this.logger.info('HTTP/2 server created', 'ServerInit');
     } else {
-      this.server = this.httpServer.getServer();
+      // Use standard HTTP/1.1
+      this.httpServer = new MoroHttpServer();
+      this.server = (this.httpServer as MoroHttpServer).getServer();
     }
 
     this.container = new Container();
     this.moduleLoader = new ModuleLoader(this.container);
 
-    // Setup WebSocket adapter if enabled
-    if (options.websocket !== false) {
-      this.setupWebSockets(options.websocket || {});
+    // Setup WebSocket adapter if enabled in config OR options
+    if (
+      this.config.websocket.enabled ||
+      (options.websocket && typeof options.websocket === 'object')
+    ) {
+      // Store the promise so we can await it before using websockets
+      this.websocketSetupPromise = this.setupWebSockets(options.websocket || {});
     }
 
     // Initialize enterprise event bus
@@ -131,19 +165,54 @@ export class Moro extends EventEmitter {
   }
 
   private setupCore() {
-    // Security middleware
-    this.httpServer.use(middleware.helmet());
-    this.httpServer.use(middleware.cors());
+    // PERFORMANCE FIX: Only apply middleware if enabled in config OR options
+
+    // Security middleware - check config enabled property OR options.security.*.enabled === true
+    if (this.config.security.helmet.enabled || this.options.security?.helmet?.enabled === true) {
+      this.httpServer.use(middleware.helmet());
+    }
+
+    if (this.config.security.cors.enabled || this.options.security?.cors?.enabled === true) {
+      const corsOptions =
+        typeof this.options.cors === 'object'
+          ? this.options.cors
+          : this.config.security.cors
+            ? this.config.security.cors
+            : {};
+      this.httpServer.use(middleware.cors(corsOptions));
+    }
 
-    // Performance middleware
-    this.httpServer.use(middleware.compression());
-    this.httpServer.use(middleware.bodySize({ limit: '10mb' }));
+    // Performance middleware - check config enabled property OR options.performance.*.enabled === true
+    if (
+      this.config.performance.compression.enabled ||
+      this.options.performance?.compression?.enabled === true
+    ) {
+      const compressionOptions =
+        typeof this.options.compression === 'object'
+          ? this.options.compression
+          : this.config.performance.compression
+            ? this.config.performance.compression
+            : {};
+      this.httpServer.use(middleware.compression(compressionOptions));
+    }
+
+    // Body size middleware - always enabled with configurable limit
+    this.httpServer.use(middleware.bodySize({ limit: this.config.server.bodySizeLimit }));
 
-    // Request tracking middleware
-    this.httpServer.use(this.requestTrackingMiddleware());
+    // Configure request tracking (ID generation) in HTTP server
+    if (this.httpServer.setRequestTracking) {
+      this.httpServer.setRequestTracking(this.config.server.requestTracking.enabled);
+    }
 
-    // Error boundary middleware
-    this.httpServer.use(this.errorBoundaryMiddleware());
+    // Request logging middleware - separate from request tracking (ID generation)
+    if (this.config.server.requestLogging.enabled) {
+      this.httpServer.use(this.requestLoggingMiddleware());
+    }
+
+    // Error boundary middleware - configurable but recommended to keep enabled
+    if (this.config.server.errorBoundary.enabled) {
+      this.httpServer.use(this.errorBoundaryMiddleware());
+    }
   }
 
   /**
@@ -151,29 +220,47 @@ export class Moro extends EventEmitter {
    */
   private async setupWebSockets(wsConfig: any): Promise<void> {
     try {
-      // Use provided adapter or try to auto-detect
-      if (wsConfig.adapter) {
-        this.websocketAdapter = wsConfig.adapter;
+      // If using uWebSockets HTTP server, automatically use uWebSockets for WebSocket too
+      if (this.usingUWebSockets) {
+        const { UWebSocketsAdapter } = await import('./networking/adapters/index.js');
+        this.websocketAdapter = new UWebSocketsAdapter();
+
+        // For uWebSockets, we need to integrate with the existing app
+        const uwsHttpServer = this.httpServer as UWebSocketsHttpServer;
+        await this.websocketAdapter.initialize(uwsHttpServer.getApp(), wsConfig.options);
+
+        this.logger.info(
+          'uWebSockets adapter initialized (integrated with HTTP server)',
+          'WebSocketSetup'
+        );
       } else {
-        this.websocketAdapter = (await this.detectWebSocketAdapter()) || undefined;
+        // Use provided adapter or try to auto-detect
+        if (wsConfig.adapter) {
+          this.websocketAdapter = wsConfig.adapter;
+        } else {
+          this.websocketAdapter = (await this.detectWebSocketAdapter()) || undefined;
+        }
+
+        if (this.websocketAdapter) {
+          await this.websocketAdapter.initialize(this.server, wsConfig.options);
+
+          this.logger.info(
+            `WebSocket adapter initialized: ${this.websocketAdapter.getAdapterName()}`,
+            'WebSocketSetup'
+          );
+        }
       }
 
+      // Configure adapter features (if adapter was created)
       if (this.websocketAdapter) {
-        await this.websocketAdapter.initialize(this.server, wsConfig.options);
         this.websocketManager = new WebSocketManager(this.websocketAdapter, this.container);
 
-        // Configure adapter features
         if (wsConfig.compression) {
           this.websocketAdapter.setCompression(true);
         }
         if (wsConfig.customIdGenerator) {
           this.websocketAdapter.setCustomIdGenerator(wsConfig.customIdGenerator);
         }
-
-        this.logger.info(
-          `WebSocket adapter initialized: ${this.websocketAdapter.getAdapterName()}`,
-          'WebSocketSetup'
-        );
       }
     } catch (error) {
       this.logger.warn(
@@ -186,40 +273,86 @@ export class Moro extends EventEmitter {
 
   /**
    * Auto-detect available WebSocket adapter
+   * Tests if the library is actually installed by checking require.resolve
    */
   private async detectWebSocketAdapter(): Promise<WebSocketAdapter | null> {
-    // Try socket.io first
-    try {
-      const { SocketIOAdapter } = await import('./networking/adapters');
-      return new SocketIOAdapter();
-    } catch {
-      // socket.io not available
+    // Check if adapter is specified in config
+    if (this.config.websocket?.adapter) {
+      const adapterType = this.config.websocket.adapter;
+
+      if (adapterType === 'uws' && isPackageAvailable('uWebSockets.js')) {
+        try {
+          const { UWebSocketsAdapter } = await import('./networking/adapters/index.js');
+          return new UWebSocketsAdapter();
+        } catch {
+          this.logger.warn('uWebSockets.js specified but failed to load', 'AdapterDetection');
+        }
+      } else if (adapterType === 'socket.io' && isPackageAvailable('socket.io')) {
+        try {
+          const { SocketIOAdapter } = await import('./networking/adapters/index.js');
+          return new SocketIOAdapter();
+        } catch {
+          this.logger.warn('socket.io specified but failed to load', 'AdapterDetection');
+        }
+      } else if (adapterType === 'ws' && isPackageAvailable('ws')) {
+        try {
+          const { WSAdapter } = await import('./networking/adapters/index.js');
+          return new WSAdapter();
+        } catch {
+          this.logger.warn('ws specified but failed to load', 'AdapterDetection');
+        }
+      }
     }
 
-    // Try native ws library
-    try {
-      const { WSAdapter } = await import('./networking/adapters');
-      return new WSAdapter();
-    } catch {
-      // ws not available
+    // Auto-detect: Try uWebSockets.js first (highest performance)
+    if (isPackageAvailable('uWebSockets.js')) {
+      try {
+        const { UWebSocketsAdapter } = await import('./networking/adapters/index.js');
+        this.logger.debug('uWebSockets.js detected and loaded', 'AdapterDetection');
+        return new UWebSocketsAdapter();
+      } catch {
+        // Failed to load adapter
+      }
+    }
+
+    // Try socket.io second
+    if (isPackageAvailable('socket.io')) {
+      try {
+        const { SocketIOAdapter } = await import('./networking/adapters/index.js');
+        this.logger.debug('socket.io detected and loaded', 'AdapterDetection');
+        return new SocketIOAdapter();
+      } catch {
+        // Failed to load adapter
+      }
+    }
+
+    // Try native ws library last
+    if (isPackageAvailable('ws')) {
+      try {
+        const { WSAdapter } = await import('./networking/adapters/index.js');
+        this.logger.debug('ws detected and loaded', 'AdapterDetection');
+        return new WSAdapter();
+      } catch {
+        // Failed to load adapter
+      }
     }
 
     this.logger.warn(
-      'No WebSocket adapter found. Install socket.io or ws for WebSocket support',
+      'No WebSocket adapter found. Install uWebSockets.js, socket.io, or ws for WebSocket support',
       'AdapterDetection'
     );
     return null;
   }
 
-  private requestTrackingMiddleware() {
+  private requestLoggingMiddleware() {
     return (req: HttpRequest, res: HttpResponse, next: () => void) => {
       const startTime = Date.now();
 
       res.on('finish', () => {
         const duration = Date.now() - startTime;
-        this.logger.info(
-          `${req.method} ${req.path} - ${res.statusCode} - ${duration}ms [${req.requestId}]`
-        );
+        // Include request ID in log if request tracking is enabled
+        const idPart = req.requestId ? ` [${req.requestId}]` : '';
+        this.logger.info(`${req.method} ${req.path} - ${res.statusCode} - ${duration}ms${idPart}`);
       });
 
       next();
@@ -284,6 +417,15 @@ export class Moro extends EventEmitter {
     return this.websocketAdapter;
   }
 
+  /**
+   * Ensure WebSocket setup is complete (for async adapter detection)
+   */
+  async ensureWebSocketReady(): Promise<void> {
+    if (this.websocketSetupPromise) {
+      await this.websocketSetupPromise;
+    }
+  }
+
   /**
    * Get the WebSocket manager
    */
@@ -411,6 +553,76 @@ export class Moro extends EventEmitter {
           throw new Error(`Handler ${route.handler} is not a function`);
         }
 
+        // Check authentication if auth configuration is provided
+        if ((route as any).auth) {
+          const auth = (req as any).auth;
+          const authConfig = (route as any).auth;
+
+          if (!auth) {
+            res.status(401);
+            res.json({
+              success: false,
+              error: 'Authentication required',
+              message: 'You must be logged in to access this resource',
+            });
+            return;
+          }
+
+          // Check authentication requirement (default is required unless optional: true)
+          if (!authConfig.optional && !auth.isAuthenticated) {
+            res.status(401);
+            res.json({
+              success: false,
+              error: 'Authentication required',
+              message: 'You must be logged in to access this resource',
+            });
+            return;
+          }
+
+          // Skip further checks if not authenticated but optional
+          if (!auth.isAuthenticated && authConfig.optional) {
+            // Continue to handler
+          } else if (auth.isAuthenticated) {
+            const user = auth.user;
+
+            // Check roles if specified
+            if (authConfig.roles && authConfig.roles.length > 0) {
+              const userRoles = user?.roles || [];
+              const hasRole = authConfig.roles.some((role: string) => userRoles.includes(role));
+
+              if (!hasRole) {
+                res.status(403);
+                res.json({
+                  success: false,
+                  error: 'Insufficient permissions',
+                  message: `Required roles: ${authConfig.roles.join(', ')}`,
+                  userRoles,
+                });
+                return;
+              }
+            }
+
+            // Check permissions if specified
+            if (authConfig.permissions && authConfig.permissions.length > 0) {
+              const userPermissions = user?.permissions || [];
+              const hasPermission = authConfig.permissions.every((permission: string) =>
+                userPermissions.includes(permission)
+              );
+
+              if (!hasPermission) {
+                res.status(403);
+                res.json({
+                  success: false,
+                  error: 'Insufficient permissions',
+                  message: `Required permissions: ${authConfig.permissions.join(', ')}`,
+                  userPermissions,
+                });
+                return;
+              }
+            }
+          }
+        }
+
         // Validate request if validation schema is provided
         if (route.validation) {
           try {
@@ -516,22 +728,61 @@ export class Moro extends EventEmitter {
     this.logger.debug(`Mounting router for basePath: ${basePath}`, 'Router');
 
     // Enterprise-grade middleware integration with performance optimization
+    // IMPORTANT: Module middleware runs AFTER user middleware (like auth) to ensure proper order
     this.httpServer.use(async (req: HttpRequest, res: HttpResponse, next: () => void) => {
       if (req.path.startsWith(basePath)) {
         this.logger.debug(`Module middleware handling: ${req.method} ${req.path}`, 'Middleware', {
           basePath,
         });
 
+        // Mark this request as being handled by a module
+        (req as any).__moduleBasePath = basePath;
+        (req as any).__moduleRouter = router;
+
+        // Continue to next middleware (including auth) first
+        next();
+      } else {
+        next();
+      }
+    });
+
+    this.logger.info(`Router mounted for ${basePath}`, 'Router');
+  }
+
+  private finalModuleHandlerSetup = false;
+
+  // Setup final module handler that runs after all user middleware
+  setupFinalModuleHandler(): void {
+    // Prevent duplicate setup
+    if (this.finalModuleHandlerSetup) {
+      this.logger.debug('Final module handler already set up, skipping', 'ModuleSystem');
+      return;
+    }
+    this.finalModuleHandlerSetup = true;
+
+    this.logger.info(
+      'Setting up final module handler to run after user middleware',
+      'ModuleSystem'
+    );
+
+    this.httpServer.use(async (req: HttpRequest, res: HttpResponse, next: () => void) => {
+      // Check if this request was marked for module handling
+      const moduleBasePath = (req as any).__moduleBasePath;
+      const moduleRouter = (req as any).__moduleRouter;
+
+      if (moduleBasePath && moduleRouter && !res.headersSent) {
+        this.logger.debug(`Final module handler processing: ${req.method} ${req.path}`, 'Router');
+
         try {
-          const handled = await router.handle(req, res, basePath);
-          this.logger.debug(`Route handled: ${handled}`, 'Router');
+          const handled = await moduleRouter.handle(req, res, moduleBasePath);
+          this.logger.debug(`Route handled by module: ${handled}`, 'Router');
 
           if (!handled) {
             next(); // Let other middleware handle it
           }
           // If handled, the router already sent the response, so don't call next()
         } catch (error) {
-          this.logger.error('Router error', 'Router', {
+          this.logger.error('Module router error', 'Router', {
             error: error instanceof Error ? error.message : String(error),
           });
           if (!res.headersSent) {
@@ -542,8 +793,6 @@ export class Moro extends EventEmitter {
         next();
       }
     });
-
-    this.logger.info(`Router mounted for ${basePath}`, 'Router');
   }
 
   private async setupWebSocketHandlers(config: ModuleConfig): Promise<void> {