@nano-app/backend 0.12.4 → 0.13.0

package/README.md

@@ -58,7 +58,7 @@ export default createRoute({
 });
 ```
 
-Each handler receives `(req, params)` and returns an `ApiResponse` without `success`: its `status` is the HTTP status (`200` by default) and the framework sets `success` to `status < 400`. `params` holds the plugin's `options`, `db` (the Prisma client when a database is enabled, see [Database](#database)) and `onBeforeResult` (see [Callbacks](#callbacks)):
+Each handler receives `(req, params)` and returns an `ApiResponse` without `success`: its `status` is the HTTP status (`200` by default) and the framework sets `success` to `status < 400`. `params` holds the plugin's `options`, `db` (the Prisma client when a database is enabled, see [Database](#database); a plugin without its own gets the app's) and `onBeforeResult` (see [Callbacks](#callbacks)):
 
 ```ts
 type ApiResponse<T> = {
@@ -82,26 +82,34 @@ Every option is optional.
 |---|---|---|
 | `port` | `3000` | Listening port. |
 | `listener` | `() => {}` | Callback once the server is listening. |
-| `settings` | `{}` | Values for `app.set()` (e.g. `{ "trust proxy": 1 }`). |
+| `settings` | `{ "trust proxy": <private networks> }` | Values for `app.set()`: see [Client IP](#client-ip). |
 | `packages` | see below | Framework base middlewares. |
 | `mainPlugin` | `{ routesDir: "src/routes" }` | Your routes (`routesDir`, relative to `cwd`), `basePath` (e.g. `/api`, no trailing slash) and database: see [Database](#database). |
 | `plugins` | `[]` | Plugins mounted around your routes, in order: see [Plugins](#plugins). |
 
-`packages` accepts `morgan`, `cors`, `helmet`, `compression`, `rateLimit`, `express` (`express.json` options), `urlencoded` and `betterAuth` (off by default: see [Better Auth](#better-auth)). The merge is **per section**: passing one key keeps the others; pass `false` to disable one.
+`packages` accepts `morgan`, `cors`, `helmet`, `compression`, `express` (`express.json` options), `urlencoded` and `betterAuth` (off by default: see [Better Auth](#better-auth)). The merge is **per section**: passing one key keeps the others; pass `false` to disable one.
 
 `morgan` logs `:timestamp | :method :path :status` by default: `:path` is the path without its query string, so tokens sent there stay out of the logs. Set `format` with `:url` to log the full URL.
 
 ```ts
 createNanoApp({
-  settings: { 'trust proxy': 1 },
   packages: {
     cors: { origin: 'https://my-app.com' },
     helmet: false,
-    rateLimit: { windowMs: 60_000, max: 120 },
   },
 });
 ```
 
+### Client IP
+
+The [`rate-limit` plugin](../plugins/README.md) and Better Auth count each client by its IP. Behind a proxy (the frontend of `@nano-app/frontend`, nginx, a load balancer, a CDN, Tailscale Funnel), the IP of the request is the proxy's: the client's is the last one the proxies appended to `X-Forwarded-For`.
+
+By default the backend reads that header only when the request comes from loopback or a private network (`127.0.0.0/8`, `::1`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `fc00::/7`), and takes the last address that is not one of them. A request from a public IP is counted by that IP, whatever header it sends. Better Auth gets the same networks as `advanced.ipAddress.trustedProxies`.
+
+- A public proxy in front (a CDN): set its addresses in `settings['trust proxy']` (any [Express value](https://expressjs.com/en/guide/behind-proxies.html)) and in Better Auth's `advanced.ipAddress.trustedProxies`.
+- No proxy at all, or one you do not trust: `settings: { 'trust proxy': false }` and `advanced.ipAddress.trustedProxies: []`.
+- Anything that can reach the backend from a private network can choose the IP it is counted by: keep the backend reachable only from its proxies.
+
 ## Database
 
 Off until enabled: at startup nano-app generates the Prisma client of your schema, checks that its tables can be read and passes it to your handlers as their second parameter. **It never modifies your schemas**: applying them (`prisma db push`, `prisma migrate dev`, `prisma migrate deploy`) is up to you, with Prisma.
@@ -165,20 +173,21 @@ pnpm add better-auth
 ```
 
 ```ts
-// src/auth.ts: the options, and an instance only for the Better Auth CLI
-import { betterAuth, type BetterAuthOptions } from 'better-auth';
+// src/auth.ts: the options; nano-app creates the instance, the Better Auth CLI reads `options`
+import type { BetterAuthOptions } from 'better-auth';
 
-export const authOptions = { emailAndPassword: { enabled: true } } satisfies BetterAuthOptions;
-export const auth = betterAuth(authOptions);
+export default {
+  options: { emailAndPassword: { enabled: true } } satisfies BetterAuthOptions,
+};
 ```
 
 ```ts
 // src/app.ts
 import { createNanoApp } from '@nano-app/backend';
-import { authOptions } from './auth';
+import auth from './auth';
 
 createNanoApp({
-  packages: { betterAuth: authOptions },
+  packages: { betterAuth: auth.options },
   mainPlugin: { database: { enabled: true } },
 });
 ```
@@ -193,13 +202,33 @@ npx prisma migrate dev
 - It needs the database: `packages.betterAuth` without `mainPlugin.database.enabled` fails at startup.
 - Startup also fails if your schema lacks a model the options need (`user`, `session`, ...), naming them.
 - Its endpoints are mounted with your routes, at its `basePath` (default `/api/auth`), and stay public.
+- In production, Better Auth limits sign-in, sign-up and password reset to a few attempts per client IP (its `rateLimit`): see [Client IP](#client-ip).
 - Every route of yours and of the `after` plugins needs a session: without one, 401. The `before` plugins stay public (a landing, an about page).
 - Handlers and `onBefore` receive the session in `params.session` (`{ user, session }`).
 - Sign-up works as Better Auth sets it: with `emailAndPassword` anyone can sign up and reach your routes. Close it with `disableSignUp: true`, or check roles in your handlers.
 - Relate your models to `User` in the same schema, as any Prisma relation. Extra user fields go in its `user.additionalFields`.
 - With several PostgreSQL schemas, add `@@schema(...)` to the generated models.
 - Set `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` in the environment, as Better Auth asks.
+- With it on, every route of the app and of the plugins mounted after it (`stage: 'after'`) needs a session: without one it answers 401 `Not authenticated`. The handlers receive it in `session`.
+- `createRoute({ public: true, ... })` answers without a session; its handlers still receive `session` when the request has one. An unknown path answers 404.
+- Its own endpoints, the plugins mounted before the app and the middlewares a plugin adds with `app.use` in `onMount` are not checked: a plugin that exposes something public says it in its README.
 - Better Auth is loaded only when it is on.
+- nano-app creates the one instance the app uses: do not call `betterAuth()` in `src/auth.ts`. The CLI's `generate` only reads `options` of its default export.
+
+### Permissions
+
+A route asks for permissions of Better Auth's [admin plugin](https://www.better-auth.com/docs/plugins/admin): add `admin()` to the `plugins` of your options, with your roles (`ac` and `roles`), and generate its fields with `npx auth generate`. A user without them gets 403:
+
+```ts
+export default createRoute({
+  permissions: { notes: ['read'] },
+  GET: async (_req, { db }) => ({ result: await db.note.findMany() }),
+});
+```
+
+A method may ask for its own permissions instead of the route's: `POST: { handler, permissions: { notes: ['create'] } }`. A plain function takes those of the route. Without any, a session is enough. In a handler of your own, `isGranted(params, permissions)` asks Better Auth the same.
+
+A public route does not check them. Without Better Auth the route answers anyway, with a warning at startup. Handlers and callbacks receive Better Auth's instance as `auth`, next to `db`; these params are read-only.
 
 ## Plugins
 
@@ -273,7 +302,9 @@ The framework mounts the 404 and the error handler: an unmatched request becomes
 ```ts
 throw { status: 409, message: 'Already exists' };   // → 409 { success: false, warning: false, message: "Already exists" }
 throw 'Field name is required';                     // → 400 { success: false, message: "Field name is required" }
-throw new Error('boom');                            // → 500, logged to stderr
+throw new Error('boom');                            // → 500 "Internal server error", logged to stderr
+// A Prisma error the request caused answers without its message, which names tables and columns:
+// P2025 → 404 "Not found", P2002 and P2003 → 409 "Conflict", validation → 400 "Invalid request"
 GET /unknown                                        // → 404 { success: false, warning: false, message: "/unknown not found" }
 ```
 

package/build/index.d.ts

@@ -1,6 +1,5 @@
 import express, { Express, Request, Request as Request$1 } from "express";
 import { CorsOptions } from "cors";
-import { Options } from "express-rate-limit";
 import "dotenv/config";
 import "jiti";
 import { BetterAuthOptions } from "better-auth";
@@ -9,6 +8,8 @@ type ApiResponse<T = any> = {
   status?: number;
   success?: boolean;
   result?: T;
+  /** Total of a list, for a table to paginate */
+  count?: number;
   message?: string;
   warning?: boolean;
 };
@@ -21,48 +22,61 @@ type QueryParams = {
   filter?: NanoObject;
   orderby?: NanoObject<'asc' | 'desc'>;
   select?: string;
+  /** Relations to load, dot notation for nested ones: `"user,posts.comments"` */
+  expand?: string;
 };
-/** Extra params of handlers and callbacks */
-type Params<DB = any> = Partial<NanoObject & {
-  db?: DB;
+/** Extra params of handlers and callbacks: what the app injects (options, `db`) and the framework adds */
+type Params<Deps = NanoObject<any>> = Deps & {
+  /** Better Auth's instance, when it is on */
+  auth?: NanoObject;
   onBeforeResult?: NanoObject;
-  /** `{ user, session }` of Better Auth, on the routes behind its guard */
+  /** `{ user, session }` of Better Auth, when the request has one */
   session?: NanoObject;
-}>;
+};
 /** Endpoint handler */
-type Handler<DB> = (req: Request$1, params: Params<DB>) => ApiPromise;
-/** Endpoint handlers, one per HTTP method */
-type Handlers<DB = any> = {
-  GET?: Handler<DB>;
-  POST?: Handler<DB>;
-  PUT?: Handler<DB>;
-  DELETE?: Handler<DB>;
-  QUERY?: Handler<DB>;
+type Handler<Deps> = (req: Request$1, params: Params<Deps>) => ApiPromise;
+/** A method with its own permissions, instead of those of the route */
+type MethodEntry<Deps = NanoObject<any>> = {
+  handler: Handler<Deps>;
+  /** With Better Auth on, the permissions this method needs instead of the route's */
+  permissions?: NanoObject<string[]>;
+};
+/** Endpoint handlers, one per HTTP method: the handler, or it with its permissions */
+type Handlers<Deps = NanoObject<any>> = {
+  GET?: Handler<Deps> | MethodEntry<Deps>;
+  POST?: Handler<Deps> | MethodEntry<Deps>;
+  PUT?: Handler<Deps> | MethodEntry<Deps>;
+  DELETE?: Handler<Deps> | MethodEntry<Deps>;
+  QUERY?: Handler<Deps> | MethodEntry<Deps>;
 };
 /** Callback run with the params */
-type Callback<DB> = (params: Params<DB>) => Promise<void>;
+type Callback<Deps> = (params: Params<Deps>) => Promise<void>;
 /** Callback run before a method, with its request */
-type CallbackMethod<DB> = (req: Request$1, method: string, params: Params<DB>) => Promise<NanoObject>;
+type CallbackMethod<Deps> = (req: Request$1, method: string, params: Params<Deps>) => Promise<NanoObject>;
 /** Callback run with the Express app */
-type CallbackMount<DB> = (app: Express, params: Params<DB>) => Promise<void>;
+type CallbackMount<Deps> = (app: Express, params: Params<Deps>) => Promise<void>;
 /** Callbacks of an endpoint. They never receive the app: what affects the whole app goes in the plugin's onMount */
-type Callbacks<DB = any> = {
+type Callbacks<Deps = NanoObject<any>> = {
   /** Run once, when the endpoint is mounted */
-  onInit?: Callback<DB>;
+  onInit?: Callback<Deps>;
   /** Run before the endpoint is executed */
-  onBefore?: CallbackMethod<DB>;
+  onBefore?: CallbackMethod<Deps>;
 };
 /** Callbacks of a plugin */
-type PluginCallbacks<DB = any> = {
+type PluginCallbacks<Deps = NanoObject<any>> = {
   /** Run once with the Express app, after its database and before its endpoints (e.g. app-level middlewares) */
-  onMount?: CallbackMount<DB>;
+  onMount?: CallbackMount<Deps>;
 };
 /** Entry of a route file (`*.route.ts`) */
-type RouteEntry<DB = any> = {
+type RouteEntry<Deps = NanoObject<any>> = {
   /** Express route expression appended to the path (e.g. `/:id`) */
   expression?: string;
-  callbacks?: Callbacks<DB>;
-} & Handlers<DB>;
+  /** With Better Auth on, answers without a session; the handlers still receive it when there is one */
+  public?: boolean;
+  /** With Better Auth on, the permissions of its admin plugin the user needs (`{ notes: ['read'] }`) */
+  permissions?: NanoObject<string[]>;
+  callbacks?: Callbacks<Deps>;
+} & Handlers<Deps>;
 /** Generic object */
 type NanoObject<T = any> = Record<string, T>;
 /** Database client configuration. */
@@ -124,8 +138,6 @@ type PackagesConfig = {
   helmet?: boolean;
   /** Compression configuration */
   compression?: boolean;
-  /** Rate-limit configuration */
-  rateLimit?: Partial<Options> | false;
   /** express.json configuration */
   express?: Partial<Parameters<typeof express.json>[0]> | false;
   /** urlencoded configuration */
@@ -166,11 +178,13 @@ declare class NanoApp {
 }
 /** Creates a new NanoApp instance */
 export declare function createNanoApp(oConfig?: NanoAppConfig): NanoApp;
-/** Creates and types a route object. */
-export declare function createRoute<DB>(oRoute: RouteEntry<DB>): RouteEntry<DB>;
+/** Creates a route object, typed with what the app injects in its params. */
+export declare function createRoute<Deps = NanoObject<any>>(oRoute: RouteEntry<Deps>): RouteEntry<Deps>;
 /** Creates a plugin: a function of the plugin's own options that returns its configuration. */
 type Creator<Options> = (options?: Options) => PluginConfig<Options>;
 export declare function createPlugin<Options>(fnCreator: Creator<Options>): Creator<Options>;
-/** Creates and types the callbacks of a plugin. */
-export declare function createPluginCallbacks<DB>(oCallbacks: PluginCallbacks<DB>): PluginCallbacks<DB>;
-export { type ApiPromise, type ApiResponse, type Callbacks, type DatabaseConfig, type Handler, type Handlers, type MainPluginConfig, NanoApp, type NanoAppConfig, type NanoObject, type PackagesConfig, type Params, type PluginCallbacks, type PluginConfig, type PluginStage, type QueryParams, type Request, type RouteEntry };
+/** Creates the callbacks of a plugin, typed with what it injects in its params. */
+export declare function createPluginCallbacks<Deps = NanoObject<any>>(oCallbacks: PluginCallbacks<Deps>): PluginCallbacks<Deps>;
+/** Whether the session's user has the permissions; always without Better Auth or permissions */
+declare function isGranted({ auth, session }: Params, oPermissions?: NanoObject<string[]>): Promise<boolean>;
+export { type ApiPromise, type ApiResponse, type Callbacks, type DatabaseConfig, type Handler, type Handlers, type MainPluginConfig, type MethodEntry, NanoApp, type NanoAppConfig, type NanoObject, type PackagesConfig, type Params, type PluginCallbacks, type PluginConfig, type PluginStage, type QueryParams, type Request, type RouteEntry, isGranted };

package/build/index.js

@@ -4,7 +4,6 @@ import morgan from "morgan";
 import cors from "cors";
 import helmet from "helmet";
 import compression from "compression";
-import rateLimit from "express-rate-limit";
 import "dotenv/config";
 import { glob } from "glob";
 import { dirname, isAbsolute, join, resolve } from "node:path";
@@ -25,6 +24,15 @@ const HTTP_METHODS = [
 const OFFICIAL_PLUGINS = "@nano-app/plugins";
 /** Error when the database URL is missing at startup */
 const MISSING_DATABASE_URL = "[nano-app] [ERROR] The DATABASE_URL environment variable is not defined.";
+/** Loopback and private networks: the proxies the backend trusts by default */
+const PRIVATE_NETWORKS = [
+	"127.0.0.0/8",
+	"::1/128",
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+	"fc00::/7"
+];
 // ../core/loader/Validator.ts
 const STORE_TYPES = ["app", "api"];
 /** Checks the consumer's files: invalid ones are warned about and discarded */
@@ -48,7 +56,11 @@ var Validator = class Validator {
 	static isRoute(oEntry, sFilePath) {
 		if (!Validator.isObject(oEntry, sFilePath)) return false;
 		if (oEntry.expression && typeof oEntry.expression !== "string") return Validator.warn(sFilePath, "\"expression\" must be a string.");
-		for (const sMethod of HTTP_METHODS) if (oEntry[sMethod] && typeof oEntry[sMethod] !== "function") return Validator.warn(sFilePath, `"${sMethod}" must be a function.`);
+		if (oEntry.public !== void 0 && typeof oEntry.public !== "boolean") return Validator.warn(sFilePath, "\"public\" must be a boolean.");
+		for (const sMethod of HTTP_METHODS) {
+			const oMethod = oEntry[sMethod];
+			if (oMethod && typeof oMethod !== "function" && typeof oMethod.handler !== "function") return Validator.warn(sFilePath, `"${sMethod}" must be a function or { handler, permissions }.`);
+		}
 		if (!HTTP_METHODS.some((sMethod) => oEntry[sMethod])) return Validator.warn(sFilePath, "defines no HTTP method.");
 		return true;
 	}
@@ -153,28 +165,52 @@ var FileLoader = class {
 		return Validator.validate(oEntries, extension);
 	}
 };
+// src/auth/permissions.ts
+/** Whether the session's user has the permissions; always without Better Auth or permissions */
+async function isGranted({ auth, session }, oPermissions) {
+	if (!auth || !oPermissions) return true;
+	const { success } = await auth.api.userHasPermission({ body: {
+		userId: session?.user.id,
+		role: session?.user.role,
+		permissions: oPermissions
+	} });
+	return success;
+}
 // src/routes/Endpoint.ts
 /** Base class for all endpoints */
 var Endpoint = class {
 	oMethods;
 	oCallbacks;
-	/** Allowed methods */
-	constructor(oMethods, oCallbacks = {}) {
-		this.oMethods = oMethods;
-		this.oCallbacks = oCallbacks;
+	isPublic;
+	/** Allowed methods and the options of the route */
+	constructor(oMethods, { callbacks = {}, public: isPublic = false, permissions }) {
+		this.oMethods = Object.fromEntries(Object.entries(oMethods).map(([sMethod, oMethod]) => [sMethod, typeof oMethod === "function" ? {
+			handler: oMethod,
+			permissions
+		} : {
+			permissions,
+			...oMethod
+		}]));
+		this.oCallbacks = callbacks;
+		this.isPublic = isPublic;
 	}
 	/** Handler for all methods */
-	async mount(oParams) {
+	async mount(oParams, sPath) {
+		if (!oParams.auth && Object.values(this.oMethods).some(({ permissions }) => permissions)) console.warn(`[nano-app] [WARNING] ${sPath}: its permissions are not checked without Better Auth. Turn on packages.betterAuth.`);
 		await this.oCallbacks.onInit?.(oParams);
 		return this.createHandler(oParams);
 	}
 	/** Express handler: onBefore, then the method of the request */
 	createHandler(oParams) {
 		return (oReq, oRes, fnNext) => {
+			if (oParams.auth && !oRes.locals.session && !this.isPublic) return fnNext({
+				status: 401,
+				message: "Not authenticated"
+			});
 			const sMethod = oReq.method.toUpperCase();
 			const sHandled = HTTP_METHODS.find((sHttpMethod) => sHttpMethod === sMethod);
-			const fnMethod = sHandled && this.oMethods[sHandled];
-			if (!fnMethod) return fnNext({
+			const oMethod = sHandled && this.oMethods[sHandled];
+			if (!oMethod) return fnNext({
 				status: 405,
 				message: `Method ${sMethod} not implemented`
 			});
@@ -182,7 +218,13 @@ var Endpoint = class {
 				...oParams,
 				session: oRes.locals.session
 			};
-			(this.oCallbacks.onBefore?.(oReq, sMethod, oRequestParams) ?? Promise.resolve({})).then((onBeforeResult) => fnMethod(oReq, {
+			isGranted(oRequestParams, this.isPublic ? void 0 : oMethod.permissions).then((isAllowed) => {
+				if (!isAllowed) throw {
+					status: 403,
+					message: "Forbidden"
+				};
+				return this.oCallbacks.onBefore?.(oReq, sMethod, oRequestParams) ?? {};
+			}).then((onBeforeResult) => oMethod.handler(oReq, {
 				...oRequestParams,
 				onBeforeResult
 			})).then((oResponse) => {
@@ -212,12 +254,16 @@ var Router = class {
 			sourceDir: this.sRoutesDir,
 			extension: "route"
 		});
-		return Object.entries(this.oRoutes).map(([sFilePath, { expression, callbacks, ...methods }]) => {
+		return Object.entries(this.oRoutes).map(([sFilePath, { expression, callbacks, public: isPublic, permissions, ...methods }]) => {
 			const sPath = this.createPath(sFilePath, expression);
 			console.log(`[nano-app] [INFO] ${sPath}`);
 			return {
 				path: sPath,
-				endpoint: new Endpoint(methods, callbacks)
+				endpoint: new Endpoint(methods, {
+					callbacks,
+					public: isPublic,
+					permissions
+				})
 			};
 		});
 	}
@@ -227,9 +273,14 @@ var Router = class {
 	}
 };
 // src/auth/BetterAuth.ts
-/** Better Auth on the app's Prisma client: the instance, its handler and a session guard */
+/** Better Auth on the app's Prisma client: the instance, its handler and the session lookup */
 var BetterAuth = class {
-	/** Creates the instance on the app's client, its handler and the guard */
+	static oAuth;
+	/** The instance, once the app's plugin created it */
+	static get() {
+		return this.oAuth;
+	}
+	/** Creates the instance on the app's client, its handler and the session lookup */
 	static async create(oOptions, oDb) {
 		const { betterAuth } = await import("better-auth");
 		const { prismaAdapter } = await import("better-auth/adapters/prisma");
@@ -239,21 +290,25 @@ var BetterAuth = class {
 		if (aMissing.length) throw new Error(`[nano-app] [ERROR] Better Auth needs the models ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with Prisma.`);
 		const oAuth = betterAuth({
 			...oOptions,
+			advanced: {
+				...oOptions.advanced,
+				ipAddress: {
+					trustedProxies: PRIVATE_NETWORKS,
+					...oOptions.advanced?.ipAddress
+				}
+			},
 			database: prismaAdapter(oDb, { provider: "postgresql" })
 		});
-		const fnGuard = (oReq, oRes, fnNext) => {
+		this.oAuth = oAuth;
+		const fnSession = (oReq, oRes, fnNext) => {
 			oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
-				if (!oSession) return fnNext({
-					status: 401,
-					message: "Not authenticated"
-				});
-				oRes.locals.session = oSession;
+				oRes.locals.session = oSession ?? void 0;
 				fnNext();
 			}).catch(fnNext);
 		};
 		return {
 			oHandler: toNodeHandler(oAuth),
-			fnGuard,
+			fnSession,
 			sPath: `${oOptions.basePath ?? "/api/auth"}/{*path}`
 		};
 	}
@@ -405,20 +460,21 @@ var Plugin = class {
 	/** Mounts its endpoints on express app */
 	async mount(oApp) {
 		const { name, routesDir, basePath, database, options, callbacks } = this.oConfig;
-		const oDb = database?.enabled ? await Database.mount(name, database) : void 0;
-		const oParams = {
-			...options,
-			db: oDb
-		};
+		const oDb = database?.enabled ? await Database.mount(name, database) : Database.get("app");
 		if (this.oAuthOptions) {
 			if (!oDb) throw new Error("[nano-app] [ERROR] packages.betterAuth needs the database of the app: set mainPlugin.database.enabled to true.");
-			const { sPath, oHandler, fnGuard } = await BetterAuth.create(this.oAuthOptions, oDb);
+			const { sPath, oHandler, fnSession } = await BetterAuth.create(this.oAuthOptions, oDb);
 			oApp.all(sPath, oHandler);
-			oApp.use(fnGuard);
+			oApp.use(fnSession);
 		}
+		const oParams = Object.freeze({
+			...options,
+			db: oDb,
+			auth: BetterAuth.get()
+		});
 		await callbacks?.onMount?.(oApp, oParams);
 		const oRouter = new Router(routesDir, basePath);
-		for (const { path, endpoint } of await oRouter.mount()) oApp.all(path, await endpoint.mount(oParams));
+		for (const { path, endpoint } of await oRouter.mount()) oApp.all(path, await endpoint.mount(oParams, path));
 	}
 };
 // src/app/config.ts
@@ -428,8 +484,8 @@ const INITIAL_CONFIG = {
 	port: 3e3,
 	/** Application listener */
 	listener: () => {},
-	/** Express settings */
-	settings: {},
+	/** Express settings: the client IP comes from `X-Forwarded-For` only through private proxies */
+	settings: { "trust proxy": PRIVATE_NETWORKS },
 	/** Initial middlewares */
 	packages: {
 		morgan: {
@@ -449,10 +505,6 @@ const INITIAL_CONFIG = {
 		] },
 		helmet: true,
 		compression: true,
-		rateLimit: {
-			max: 1e3,
-			message: "Too many requests, please try again later."
-		},
 		express: { limit: "10kb" },
 		urlencoded: { extended: false },
 		betterAuth: false
@@ -500,7 +552,26 @@ function mergeConfig(oConfig = {}) {
 	};
 }
 // src/app/errors.ts
-/** Whether anything thrown is an object, read as a HandlerError */
+/** Prisma errors the request caused; their own messages name tables and columns */
+const PRISMA_ERRORS = {
+	P2025: {
+		status: 404,
+		message: "Not found"
+	},
+	P2002: {
+		status: 409,
+		message: "Conflict"
+	},
+	P2003: {
+		status: 409,
+		message: "Conflict"
+	},
+	PrismaClientValidationError: {
+		status: 400,
+		message: "Invalid request"
+	}
+};
+/** Whether anything thrown is an object, read as a HandlerError or a Prisma error */
 function isHandlerError(oError) {
 	return typeof oError === "object" && oError !== null;
 }
@@ -513,13 +584,15 @@ function normalize(oError) {
 			message: oError
 		}
 	};
-	const { status, message, warning } = isHandlerError(oError) ? oError : {};
+	const oThrown = isHandlerError(oError) ? oError : {};
+	const { status, message, warning } = PRISMA_ERRORS[oThrown.code ?? oThrown.name ?? ""] ?? oThrown;
+	const iStatus = status ?? 500;
 	return {
-		status: status ?? 500,
+		status: iStatus,
 		body: {
 			success: false,
 			warning: warning ?? false,
-			message: message || "Internal server error"
+			message: iStatus < 500 && message || "Internal server error"
 		}
 	};
 }
@@ -585,7 +658,6 @@ var NanoApp = class {
 		if (oConfig.cors) this.oApp.use(cors(oConfig.cors));
 		if (oConfig.helmet) this.oApp.use(helmet());
 		if (oConfig.compression) this.oApp.use(compression());
-		if (oConfig.rateLimit) this.oApp.use(rateLimit(oConfig.rateLimit));
 		if (oConfig.express) this.oApp.use(express.json(oConfig.express));
 		if (oConfig.urlencoded) this.oApp.use(express.urlencoded(oConfig.urlencoded));
 	}
@@ -595,15 +667,15 @@ var NanoApp = class {
 function createNanoApp(oConfig) {
 	return new NanoApp(oConfig);
 }
-/** Creates and types a route object. */
+/** Creates a route object, typed with what the app injects in its params. */
 function createRoute(oRoute) {
 	return oRoute;
 }
 function createPlugin(fnCreator) {
 	return fnCreator;
 }
-/** Creates and types the callbacks of a plugin. */
+/** Creates the callbacks of a plugin, typed with what it injects in its params. */
 function createPluginCallbacks(oCallbacks) {
 	return oCallbacks;
 }
-export { NanoApp, createNanoApp, createPlugin, createPluginCallbacks, createRoute };
+export { NanoApp, createNanoApp, createPlugin, createPluginCallbacks, createRoute, isGranted };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano-app/backend",
-  "version": "0.12.4",
+  "version": "0.13.0",
   "description": "Express server with file-convention routes, plugins and an optional PostgreSQL layer",
   "type": "module",
   "main": "build/index.js",
@@ -47,7 +47,6 @@
     "cors": "^2.8.6",
     "dotenv": "^18.0.9",
     "express": "^5.3.0",
-    "express-rate-limit": "^8.7.2",
     "glob": "^14.0.3",
     "helmet": "^8.3.0",
     "jiti": "^2.7.0",