@nano-app/backend 0.6.0 → 0.6.4

package/dist/app.js

@@ -11,6 +11,8 @@ const compression_1 = __importDefault(require("compression"));
 const morgan_1 = __importDefault(require("morgan"));
 const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
 const index_1 = require("./index");
+const ApiKeys_1 = require("./auth/ApiKeys");
+const ApiKeysEndpoint_1 = require("./auth/ApiKeysEndpoint");
 class NanoApp {
     app = (0, express_1.default)();
     router;
@@ -19,12 +21,11 @@ class NanoApp {
         enableEntities: true,
         port: 3000,
         rateLimit: {
-            windowMs: 15 * 60 * 1000, // 15 minutos
-            max: 1000, // Máximo 1000 peticiones por IP
-            message: 'Too many requests, please try again later.'
+            windowMs: 15 * 60 * 1000,
+            max: 1000,
+            message: 'Too many requests, please try again later.',
         },
         morgan: {
-            tokens: {},
             format: 'combined',
         },
         expressConfig: {
@@ -32,55 +33,41 @@ class NanoApp {
         },
     };
     constructor(config) {
-        // Inicializar la configuración
-        this.config = {
-            ...this.config,
-            ...config,
-        };
-        // Inicializar el router
-        this.router = new index_1.Router(this.config.endpoints.concat(this.config.enableEntities ? [new index_1.Entities('/:endpoint{/:id}')] : []));
-        // Inicializar setters
+        this.config = { ...this.config, ...config, apiKeys: config.apiKeys };
+        const apiKeysPath = this.config.apiKeys?.path ?? '/api-keys';
+        const apiKeyEndpoints = this.config.apiKeys?.enabled ? [new ApiKeysEndpoint_1.ApiKeysEndpoint(apiKeysPath)] : [];
+        const entityEndpoints = this.config.enableEntities ? [new index_1.Entities('/:endpoint{/:id}')] : [];
+        console.log('Endpoints registered:');
+        this.router = new index_1.Router([...apiKeyEndpoints, ...this.config.endpoints, ...entityEndpoints]);
         if (this.config.setters) {
-            Object.entries(this.config.setters).forEach(([key, value]) => {
-                this.app.set(key, value);
-            });
+            Object.entries(this.config.setters).forEach(([key, value]) => this.app.set(key, value));
         }
-        // Inicializar morgan
-        Object.entries(this.config.morgan?.tokens || {}).forEach(([key, value]) => {
-            morgan_1.default.token(key, value);
-        });
+        Object.entries(this.config.morgan?.tokens ?? {}).forEach(([key, value]) => morgan_1.default.token(key, value));
         this.app.use((0, morgan_1.default)(this.config.morgan?.format ?? 'combined'));
-        // Inicializar seguridad y optimizacion
         this.app.use((0, cors_1.default)());
         this.app.use((0, helmet_1.default)());
         this.app.use((0, compression_1.default)());
-        // Inicializar proteccion contra ataques
         this.app.use((0, express_rate_limit_1.default)(this.config.rateLimit));
-        // Inicializar limite de tamaño del body
         this.app.use(express_1.default.json(this.config.expressConfig));
+        this.app.use(express_1.default.urlencoded({ extended: false }));
     }
     getApp() { return this.app; }
     async start(listener) {
-        // Middlewares
-        (this.config.middlewares || []).forEach(middleware => this.app.use(middleware));
-        // Registrar las rutas
-        this.app.use('/', this.router.getRoutes());
-        // Middleware de error (debe ir al final)
-        if (this.config.errorMiddleware) {
-            this.app.use(this.config.errorMiddleware);
+        if (this.config.apiKeys?.enabled) {
+            await ApiKeys_1.ApiKeys.init();
+            this.app.use(ApiKeys_1.ApiKeys.buildMiddleware(this.config.apiKeys.middleware));
         }
-        else {
-            this.app.use((err, _, res, __) => {
-                res.status(err.status || 500).json({
-                    success: false,
-                    message: err.message || 'Error interno del servidor'
-                });
+        (this.config.middlewares ?? []).forEach(middleware => this.app.use(middleware));
+        this.app.use('/', this.router.getRoutes());
+        this.app.use(this.config.errorMiddleware ?? ((err, _, res, __) => {
+            res.status(err.status || 500).json({
+                success: false,
+                message: err.message || 'Error interno del servidor',
             });
-        }
-        // Iniciar el servidor
+        }));
         this.app.listen(Number(this.config.port), () => {
             console.log(`Server running on port ${this.config.port}`);
-            listener?.(); // Ejecutar el listener si se proporciona
+            listener?.();
         });
     }
 }

package/dist/auth/ApiKeys.d.ts

@@ -0,0 +1,25 @@
+import type { RequestHandler } from "express";
+export declare class ApiKeys {
+    private static pool;
+    private static initialized;
+    static init(): Promise<void>;
+    /**
+     * Construye el middleware de autenticación:
+     * - Sin customMiddleware → valida solo x-api-key.
+     * - Con customMiddleware → intenta primero el middleware custom.
+     *   Si falla, intenta x-api-key. Si ambos fallan → 401.
+     */
+    static buildMiddleware(customMiddleware?: RequestHandler): RequestHandler;
+    static create(label?: string): Promise<string>;
+    static validate(key: string): Promise<boolean>;
+    static list(): Promise<{
+        id: number;
+        label: string | null;
+        created_at: Date;
+    }[]>;
+    static revoke(id: number): Promise<void>;
+    private static validateApiKey;
+    private static runMiddleware;
+    private static printInitialKey;
+    private static assertInitialized;
+}

package/dist/auth/ApiKeys.js

@@ -0,0 +1,146 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeys = void 0;
+const bcrypt = __importStar(require("bcrypt"));
+const pg_1 = require("pg");
+const crypto_1 = require("crypto");
+const SCHEMA = "nano_auth";
+const TABLE = `${SCHEMA}.api_keys`;
+class ApiKeys {
+    static pool;
+    static initialized = false;
+    static async init() {
+        if (ApiKeys.initialized)
+            return;
+        const connectionString = process.env.DATABASE_URL;
+        if (!connectionString)
+            throw new Error("DATABASE_URL no está configurada");
+        ApiKeys.pool = new pg_1.Pool({ connectionString });
+        ApiKeys.initialized = true;
+        await ApiKeys.pool.query(`CREATE SCHEMA IF NOT EXISTS ${SCHEMA}`);
+        await ApiKeys.pool.query(`
+      CREATE TABLE IF NOT EXISTS ${TABLE} (
+        id         SERIAL PRIMARY KEY,
+        label      TEXT,
+        key_hash   TEXT NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+        await ApiKeys.printInitialKey();
+    }
+    /**
+     * Construye el middleware de autenticación:
+     * - Sin customMiddleware → valida solo x-api-key.
+     * - Con customMiddleware → intenta primero el middleware custom.
+     *   Si falla, intenta x-api-key. Si ambos fallan → 401.
+     */
+    static buildMiddleware(customMiddleware) {
+        return async (req, res, next) => {
+            if (!customMiddleware) {
+                return ApiKeys.validateApiKey(req, res, next);
+            }
+            const customResult = await ApiKeys.runMiddleware(customMiddleware, req, res);
+            if (customResult.passed)
+                return next();
+            const key = req.headers['x-api-key'];
+            if (key && await ApiKeys.validate(key).catch(() => false)) {
+                req.apiKeyAuth = true;
+                return next();
+            }
+            return next(customResult.error ?? { status: 401, message: "No autorizado" });
+        };
+    }
+    static async create(label) {
+        ApiKeys.assertInitialized();
+        const key = `nk_${(0, crypto_1.randomBytes)(32).toString("hex")}`;
+        await ApiKeys.pool.query(`INSERT INTO ${TABLE} (label, key_hash) VALUES ($1, $2)`, [label ?? null, await bcrypt.hash(key, 10)]);
+        return key;
+    }
+    static async validate(key) {
+        ApiKeys.assertInitialized();
+        if (!key?.startsWith("nk_"))
+            return false;
+        const { rows } = await ApiKeys.pool.query(`SELECT key_hash FROM ${TABLE}`);
+        for (const row of rows) {
+            if (await bcrypt.compare(key, row.key_hash))
+                return true;
+        }
+        return false;
+    }
+    static async list() {
+        ApiKeys.assertInitialized();
+        const { rows } = await ApiKeys.pool.query(`SELECT id, label, created_at FROM ${TABLE} ORDER BY created_at DESC`);
+        return rows;
+    }
+    static async revoke(id) {
+        ApiKeys.assertInitialized();
+        await ApiKeys.pool.query(`DELETE FROM ${TABLE} WHERE id = $1`, [id]);
+    }
+    static async validateApiKey(req, _res, next) {
+        const key = req.headers['x-api-key'];
+        if (!key)
+            return next({ status: 401, message: "No autorizado" });
+        const valid = await ApiKeys.validate(key).catch(() => false);
+        if (valid) {
+            req.apiKeyAuth = true;
+            return next();
+        }
+        return next({ status: 401, message: "API key inválida" });
+    }
+    static async runMiddleware(middleware, req, res) {
+        return new Promise((resolve) => {
+            middleware(req, res, (err) => {
+                resolve(err ? { passed: false, error: err } : { passed: true });
+            });
+        });
+    }
+    static async printInitialKey() {
+        const { rows } = await ApiKeys.pool.query(`SELECT id FROM ${TABLE} LIMIT 1`);
+        if (rows.length > 0)
+            return;
+        const key = await ApiKeys.create('default');
+        console.log("\n══════════════════════════════════════════════════════");
+        console.log("           NANO-APP: API Key inicial generada          ");
+        console.log("    Guarda esta key, no se volverá a mostrar.          ");
+        console.log("══════════════════════════════════════════════════════");
+        console.log(`\n   x-api-key: ${key}\n`);
+    }
+    static assertInitialized() {
+        if (!ApiKeys.initialized)
+            throw new Error("ApiKeys no inicializado.");
+    }
+}
+exports.ApiKeys = ApiKeys;

package/dist/auth/ApiKeysEndpoint.d.ts

@@ -0,0 +1,19 @@
+import type { Request, Response } from "express";
+import { Endpoint } from "../http/Endpoint";
+import type { ApiResponse } from "../types/api";
+/**
+ * Endpoint predefinido para gestión de API keys.
+ * Registrado automáticamente por NanoApp en /api-keys.
+ *
+ * GET    /api-keys        — lista todas las keys (id, label, created_at)
+ * POST   /api-keys        — crea una nueva key { label?: string }
+ * DELETE /api-keys        — revoca una key por { id: number }
+ *
+ * Para deshabilitar estos endpoints, usa apiKeys: { enabled: false } en NanoAppConfig.
+ * Para protegerlos con tu propia lógica, subclasifica y sobreescribe VALIDATE o BEFORE.
+ */
+export declare class ApiKeysEndpoint extends Endpoint {
+    protected GET(_req: Request, _res: Response): Promise<ApiResponse>;
+    protected POST(req: Request, _res: Response): Promise<ApiResponse>;
+    protected DELETE(req: Request, _res: Response): Promise<ApiResponse>;
+}

package/dist/auth/ApiKeysEndpoint.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeysEndpoint = void 0;
+const Endpoint_1 = require("../http/Endpoint");
+const ApiKeys_1 = require("./ApiKeys");
+/**
+ * Endpoint predefinido para gestión de API keys.
+ * Registrado automáticamente por NanoApp en /api-keys.
+ *
+ * GET    /api-keys        — lista todas las keys (id, label, created_at)
+ * POST   /api-keys        — crea una nueva key { label?: string }
+ * DELETE /api-keys        — revoca una key por { id: number }
+ *
+ * Para deshabilitar estos endpoints, usa apiKeys: { enabled: false } en NanoAppConfig.
+ * Para protegerlos con tu propia lógica, subclasifica y sobreescribe VALIDATE o BEFORE.
+ */
+class ApiKeysEndpoint extends Endpoint_1.Endpoint {
+    async GET(_req, _res) {
+        const keys = await ApiKeys_1.ApiKeys.list();
+        return { result: keys };
+    }
+    async POST(req, _res) {
+        const { label } = req.body ?? {};
+        const key = await ApiKeys_1.ApiKeys.create(label);
+        return { result: { api_key: key } };
+    }
+    async DELETE(req, _res) {
+        const { id } = req.body ?? {};
+        if (!id || typeof id !== "number") {
+            throw { status: 400, message: "El campo id es requerido y debe ser un número" };
+        }
+        await ApiKeys_1.ApiKeys.revoke(id);
+        return { result: { revoked: id } };
+    }
+}
+exports.ApiKeysEndpoint = ApiKeysEndpoint;

package/dist/auth/ClientCredentials.d.ts

@@ -0,0 +1,15 @@
+import type { RequestHandler } from "express";
+import type { NanoAppAuthConfig } from "../index";
+export declare class ClientCredentials {
+    private static config;
+    private static oauthSecret;
+    private static pool;
+    static init(config: NanoAppAuthConfig): Promise<void>;
+    static middleware: RequestHandler;
+    static generateToken(clientId: string, clientSecret: string): Promise<{
+        access_token: string;
+        token_type: string;
+        expires_in: number;
+    }>;
+    private static parseExpiry;
+}

package/dist/auth/ClientCredentials.js

@@ -0,0 +1,132 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientCredentials = void 0;
+const jwt = __importStar(require("jsonwebtoken"));
+const bcrypt = __importStar(require("bcrypt"));
+const pg_1 = require("pg");
+const crypto_1 = require("crypto");
+const SCHEMA = "nano_auth";
+const TABLE = `${SCHEMA}.oauth_client`;
+class ClientCredentials {
+    static config = {};
+    static oauthSecret;
+    static pool;
+    static async init(config) {
+        // Inicializar la configuración
+        const connectionString = process.env.DATABASE_URL ?? '';
+        ClientCredentials.config = config;
+        ClientCredentials.oauthSecret = process.env.OAUTH_SECRET ?? '';
+        // Crear el pool de conexiones
+        ClientCredentials.pool = new pg_1.Pool({ connectionString });
+        // Crear el schema si no existe
+        await ClientCredentials.pool.query(`CREATE SCHEMA IF NOT EXISTS ${SCHEMA}`);
+        await ClientCredentials.pool.query(`
+      CREATE TABLE IF NOT EXISTS ${TABLE} (
+        id           SERIAL PRIMARY KEY,
+        client_id    TEXT NOT NULL UNIQUE,
+        client_secret TEXT NOT NULL,
+        created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+        // Verificar si existen credenciales
+        const { rows } = await ClientCredentials.pool.query(`SELECT id FROM ${TABLE} LIMIT 1`);
+        if (rows.length === 0) {
+            // Generar credenciales
+            const clientId = (0, crypto_1.randomBytes)(16).toString("hex");
+            const clientSecret = (0, crypto_1.randomBytes)(32).toString("hex");
+            const hashed = await bcrypt.hash(clientSecret, 10);
+            // Insertar credenciales
+            await ClientCredentials.pool.query(`INSERT INTO ${TABLE} (client_id, client_secret) VALUES ($1, $2)`, [clientId, hashed]);
+            // Mostrar credenciales
+            console.log("\n══════════════════════════════════════════════════════");
+            console.log("          NANO-APP: OAuth Client Credentials          ");
+            console.log("   Guarda estas credenciales, no se mostrarán más.    ");
+            console.log("══════════════════════════════════════════════════════\n");
+            console.log(`client_id:     ${clientId}`);
+            console.log(`client_secret: ${clientSecret}\n\n`);
+        }
+    }
+    static middleware = async (req, res, next) => {
+        const publicRoutes = ["/oauth/token", ...(ClientCredentials.config.publicRoutes ?? [])];
+        // Si la ruta es pública, continuar
+        if (publicRoutes.includes(req.path)) {
+            return next();
+        }
+        // Validar que el header de autenticación sea válido
+        const authHeader = req.headers.authorization;
+        if (!authHeader?.startsWith("Bearer ")) {
+            return next({ status: 401, message: "Header de autenticación inválido" });
+        }
+        // Obtener el token y secret
+        const token = authHeader.slice(7);
+        // Verificar que el token sea válido
+        try {
+            const payload = jwt.verify(token, ClientCredentials.oauthSecret);
+            req.oauthClient = { clientId: payload.sub };
+            return next();
+        }
+        catch {
+            return next({ status: 401, message: "Sesión expirada" });
+        }
+    };
+    static async generateToken(clientId, clientSecret) {
+        if (!ClientCredentials.pool) {
+            throw { status: 500, message: "ClientCredentials no inicializado" };
+        }
+        const { rows } = await ClientCredentials.pool.query(`SELECT client_id, client_secret FROM ${TABLE} WHERE client_id = $1 LIMIT 1`, [clientId]);
+        if (rows.length === 0) {
+            throw { status: 401, message: "Credenciales de cliente inválidas" };
+        }
+        const valid = await bcrypt.compare(clientSecret, rows[0].client_secret);
+        if (!valid) {
+            throw { status: 401, message: "Credenciales de cliente inválidas" };
+        }
+        const expiry = ClientCredentials.config.tokenExpiry ?? '1h';
+        const expiresInSeconds = ClientCredentials.parseExpiry(expiry);
+        const access_token = jwt.sign({ sub: rows[0].client_id }, ClientCredentials.oauthSecret, { expiresIn: expiry });
+        return { access_token, token_type: "Bearer", expires_in: expiresInSeconds };
+    }
+    static parseExpiry(expiry) {
+        const match = expiry.match(/^(\d+)(s|m|h|d)$/);
+        if (!match)
+            return 3600;
+        const value = parseInt(match[1], 10);
+        const unit = match[2];
+        const multipliers = { s: 1, m: 60, h: 3600, d: 86400 };
+        return value * (multipliers[unit] ?? 3600);
+    }
+}
+exports.ClientCredentials = ClientCredentials;

package/dist/auth/TokenEndpoint.d.ts

@@ -0,0 +1,5 @@
+import { Endpoint, type ApiResponse } from "../index";
+import type { Request, Response } from "express";
+export declare class TokenEndpoint extends Endpoint {
+    protected POST(req: Request, res: Response): Promise<ApiResponse>;
+}

package/dist/auth/TokenEndpoint.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenEndpoint = void 0;
+const index_1 = require("../index");
+class TokenEndpoint extends index_1.Endpoint {
+    async POST(req, res) {
+        let clientId;
+        let clientSecret;
+        // Authorization: Basic <base64(clientId:clientSecret)>
+        const authHeader = req.headers.authorization;
+        if (authHeader?.startsWith("Basic ")) {
+            const decoded = Buffer.from(authHeader.slice(6), "base64").toString("utf-8");
+            const colon = decoded.indexOf(":");
+            if (colon !== -1) {
+                clientId = decoded.slice(0, colon);
+                clientSecret = decoded.slice(colon + 1);
+            }
+        }
+        // Body: client_id y client_secret (JSON o form-urlencoded)
+        if (!clientId || !clientSecret) {
+            clientId = req.body?.client_id;
+            clientSecret = req.body?.client_secret;
+        }
+        if (!clientId || !clientSecret) {
+            throw { status: 400, message: "client_id y client_secret son campos requeridos" };
+        }
+        const tokenData = await index_1.ClientCredentials.generateToken(clientId, clientSecret);
+        // RFC 6749 §5.1: la respuesta del token endpoint debe ser plana, sin wrappers
+        res.json(tokenData);
+        return {};
+    }
+}
+exports.TokenEndpoint = TokenEndpoint;

package/dist/http/Endpoint.d.ts

@@ -1,23 +1,17 @@
 import { Request, Response } from "express";
-import { PrismaClient, type ApiResponse } from "../index";
+import { PrismaClient } from "../prisma/Client";
+import type { ApiResponse } from "../types/api";
 export declare abstract class Endpoint<BeforeResult = any> {
     protected prismaClient: PrismaClient;
-    private methodMap;
     path: string;
+    private methodMap;
     constructor(path?: string);
-    /** Metodos envoltorios */
+    protected VALIDATE(_req: Request): Promise<void>;
     protected BEFORE(_req: Request): Promise<BeforeResult>;
-    protected AFTER(_result: ApiResponse): Promise<ApiResponse>;
-    /**
-     * Métodos HTTP opcionales - las clases hijas solo implementan los que necesiten
-     * Si no se implementan, se lanza un error por defecto
-     */
-    protected GET(_req: Request, _res: Response, _beforeParams: BeforeResult): Promise<ApiResponse>;
-    protected POST(_req: Request, _res: Response, _beforeParams: BeforeResult): Promise<ApiResponse>;
-    protected PUT(_req: Request, _res: Response, _beforeParams: BeforeResult): Promise<ApiResponse>;
-    protected DELETE(_req: Request, _res: Response, _beforeParams: BeforeResult): Promise<ApiResponse>;
-    /**
-     * Ejecuta la lógica específica del endpoint
-     */
+    protected AFTER(_req: Request, result: ApiResponse): Promise<ApiResponse>;
+    protected GET(_req: Request, _res: Response, _before: BeforeResult): Promise<ApiResponse>;
+    protected POST(_req: Request, _res: Response, _before: BeforeResult): Promise<ApiResponse>;
+    protected PUT(_req: Request, _res: Response, _before: BeforeResult): Promise<ApiResponse>;
+    protected DELETE(_req: Request, _res: Response, _before: BeforeResult): Promise<ApiResponse>;
     execute(req: Request, res: Response): void;
 }

package/dist/http/Endpoint.js

@@ -1,67 +1,59 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Endpoint = void 0;
-const index_1 = require("../index");
+const Client_1 = require("../prisma/Client");
+const Formatter_1 = require("../utils/Formatter");
 class Endpoint {
-    prismaClient = new index_1.PrismaClient();
-    methodMap = {};
+    prismaClient = new Client_1.PrismaClient();
     path = '';
+    methodMap;
     constructor(path) {
-        this.path = path || 'default';
+        this.path = path ?? 'default';
         this.methodMap = {
-            'GET': this.GET.bind(this),
-            'POST': this.POST.bind(this),
-            'PUT': this.PUT.bind(this),
-            'DELETE': this.DELETE.bind(this),
+            GET: this.GET.bind(this),
+            POST: this.POST.bind(this),
+            PUT: this.PUT.bind(this),
+            DELETE: this.DELETE.bind(this),
         };
     }
-    /** Metodos envoltorios */
+    VALIDATE(_req) {
+        return Promise.resolve();
+    }
     BEFORE(_req) {
         return Promise.resolve({});
     }
-    AFTER(_result) {
-        return Promise.resolve(_result);
+    AFTER(_req, result) {
+        return Promise.resolve(result);
     }
-    /**
-     * Métodos HTTP opcionales - las clases hijas solo implementan los que necesiten
-     * Si no se implementan, se lanza un error por defecto
-     */
-    async GET(_req, _res, _beforeParams) {
-        throw { message: `Método GET no implementado para ${this.path}` };
+    async GET(_req, _res, _before) {
+        throw { message: `GET no implementado para ${this.path}` };
     }
-    async POST(_req, _res, _beforeParams) {
-        throw { message: `Método POST no implementado para ${this.path}` };
+    async POST(_req, _res, _before) {
+        throw { message: `POST no implementado para ${this.path}` };
     }
-    async PUT(_req, _res, _beforeParams) {
-        throw { message: `Método PUT no implementado para ${this.path}` };
+    async PUT(_req, _res, _before) {
+        throw { message: `PUT no implementado para ${this.path}` };
     }
-    async DELETE(_req, _res, _beforeParams) {
-        throw { message: `Método DELETE no implementado para ${this.path}` };
+    async DELETE(_req, _res, _before) {
+        throw { message: `DELETE no implementado para ${this.path}` };
     }
-    /**
-     * Ejecuta la lógica específica del endpoint
-     */
     execute(req, res) {
-        try {
-            const method = req.method;
-            const handler = this.methodMap[method];
-            if (!handler) {
-                throw { message: `Método ${method} no soportado` };
-            }
-            this.BEFORE(req)
-                .then((beforeParams) => handler(req, res, beforeParams))
-                .then(result => this.AFTER(result))
-                .then(result => res.json({
-                success: true,
-                ...result
-            }));
+        const handler = this.methodMap[req.method];
+        if (!handler) {
+            res.status(405).json({ success: false, message: `Método ${req.method} no soportado` });
+            return;
         }
-        catch (error) {
-            res.status(500).json({
+        this.VALIDATE(req)
+            .then(() => this.BEFORE(req))
+            .then(before => handler(req, res, before))
+            .then(result => this.AFTER(req, Formatter_1.Formatter.sanitizeAndParse(result)))
+            .then(result => res.json({ success: true, ...result }))
+            .catch((error) => {
+            res.status(error.status || 500).json({
                 success: false,
-                message: error.message ? error.message : error
+                message: error.message || 'Error interno del servidor',
             });
-        }
+        });
     }
 }
 exports.Endpoint = Endpoint;

package/dist/http/Router.js

@@ -8,11 +8,9 @@ const express_1 = __importDefault(require("express"));
 class Router {
     router = express_1.default.Router();
     constructor(endpoints) {
-        // Registrar todos los endpoints
-        console.log(`Endpoints registered:`);
         endpoints.forEach(endpoint => {
             console.log(`  - ${endpoint.path}`);
-            this.router.all(`${endpoint.path}`, endpoint.execute.bind(endpoint));
+            this.router.all(endpoint.path, endpoint.execute.bind(endpoint));
         });
     }
     getRoutes() {

package/dist/index.d.ts

@@ -7,4 +7,6 @@ export * from "./types/api";
 export * from "./types/app";
 export * from "./types/odata";
 export * from "./utils/Formatter";
+export * from "./auth/ApiKeys";
+export * from "./auth/ApiKeysEndpoint";
 export * from "./app";

package/dist/index.js

@@ -23,4 +23,6 @@ __exportStar(require("./types/api"), exports);
 __exportStar(require("./types/app"), exports);
 __exportStar(require("./types/odata"), exports);
 __exportStar(require("./utils/Formatter"), exports);
+__exportStar(require("./auth/ApiKeys"), exports);
+__exportStar(require("./auth/ApiKeysEndpoint"), exports);
 __exportStar(require("./app"), exports);

package/dist/odata/Entities.d.ts

@@ -1,9 +1,10 @@
-import { Endpoint, type ApiResponse, type BeforeResult } from "../index";
+import { Endpoint, type ApiResponse, type AppModels } from "../index";
 import type { Request, Response } from 'express';
-export declare class Entities extends Endpoint<BeforeResult> {
-    protected BEFORE({ params: { endpoint, id }, path }: Request): Promise<BeforeResult>;
-    protected GET(req: Request, _res: Response, { entity, id }: BeforeResult): Promise<ApiResponse>;
-    protected POST({ body }: Request, _res: Response, { entity }: BeforeResult): Promise<ApiResponse>;
-    protected PUT({ body }: Request, _res: Response, { entity, id }: BeforeResult): Promise<ApiResponse>;
-    protected DELETE(_req: Request, _res: Response, { entity, id }: BeforeResult): Promise<ApiResponse>;
+export declare class Entities<BeforeResult = any> extends Endpoint<BeforeResult> {
+    protected entity: AppModels[keyof AppModels];
+    protected VALIDATE({ params: { endpoint }, path }: Request): Promise<void>;
+    protected GET(req: Request, _res: Response): Promise<ApiResponse>;
+    protected POST({ body }: Request, _res: Response): Promise<ApiResponse>;
+    protected PUT({ body, params: { id } }: Request, _res: Response): Promise<ApiResponse>;
+    protected DELETE(req: Request, _res: Response): Promise<ApiResponse>;
 }

package/dist/odata/Entities.js

@@ -3,47 +3,49 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Entities = void 0;
 const index_1 = require("../index");
 class Entities extends index_1.Endpoint {
-    BEFORE({ params: { endpoint, id }, path }) {
+    entity;
+    VALIDATE({ params: { endpoint }, path }) {
         // Valida que la entidad exista
         const entity = this.prismaClient.getModel(endpoint);
         if (!entity) {
             throw { message: `Endpoint ${path} no encontrado` };
         }
-        return Promise.resolve({ entity, id: Number(id) });
+        this.entity = entity;
+        return Promise.resolve();
     }
-    async GET(req, _res, { entity, id }) {
+    async GET(req, _res) {
         const query = req.query;
         let result;
         // Si se proporciona un ID, se busca un registro único
-        if (id) {
-            query.id = id.toString();
-            result = await entity.findUnique(index_1.QueryBuilder.build(query));
+        if (req.params.id) {
+            query.id = req.params.id.toString();
+            result = await this.entity.findUnique(index_1.QueryBuilder.build(query));
         }
         else {
-            result = await entity.findMany(index_1.QueryBuilder.build(query));
+            result = await this.entity.findMany(index_1.QueryBuilder.build(query));
         }
         return { result };
     }
-    async POST({ body }, _res, { entity }) {
-        const result = await entity.create({ data: body });
+    async POST({ body }, _res) {
+        const result = await this.entity.create({ data: body });
         return { result, message: `Registro creado correctamente` };
     }
-    async PUT({ body }, _res, { entity, id }) {
+    async PUT({ body, params: { id } }, _res) {
         if (!id) {
             throw { message: "ID es requerido para actualizar" };
         }
-        const result = await entity.update({
-            where: { id },
+        const result = await this.entity.update({
+            where: { id: Number(id) },
             data: body
         });
         return { result, message: `Registro actualizado correctamente` };
     }
-    async DELETE(_req, _res, { entity, id }) {
+    async DELETE(req, _res) {
         let result;
-        if (!id) {
+        if (!req.params.id) {
             throw { message: "ID es requerido para eliminar" };
         }
-        result = await entity.delete({ where: { id } });
+        result = await this.entity.delete({ where: { id: Number(req.params.id) } });
         return { result, message: `Registro eliminado correctamente` };
     }
 }

package/dist/odata/QueryBuilder.d.ts

@@ -1,33 +1,10 @@
-import type { QueryParams } from "../index";
+import type { QueryParams } from "../types/odata";
 export declare class QueryBuilder {
-    private static readonly OPERATORS;
-    private static parseValue;
-    /**
-     * Construye el objeto expand
-     */
-    private static buildExpand;
-    /**
-     * Parsea una expresión de filtro individual
-     */
-    private static parseExpression;
-    /**
-     * Construye el objeto filter
-     */
-    private static buildFilter;
-    /**
-     * Construye un objeto de ordenamiento
-     * Soporta propiedades encadenadas como "subscription.description"
-     */
-    private static buildOrderBy;
-    /**
-     * Construye el objeto query
-     */
     static build(query: QueryParams): {
-        where: {
-            [x: string]: any;
-        };
+        where: Record<string, any>;
         include: Record<string, boolean> | undefined;
-        take: number;
-        orderBy: any;
+        take: number | undefined;
+        skip: number | undefined;
+        orderBy: Record<string, string> | undefined;
     };
 }

package/dist/odata/QueryBuilder.js

@@ -1,108 +1,59 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.QueryBuilder = void 0;
+const OPERATORS = {
+    eq: (f, v) => ({ [f]: v }),
+    ne: (f, v) => ({ [f]: { not: v } }),
+    ge: (f, v) => ({ [f]: { gte: v } }),
+    le: (f, v) => ({ [f]: { lte: v } }),
+    contains: (f, v) => ({ [f]: { contains: v, mode: 'insensitive' } }),
+    startswith: (f, v) => ({ [f]: { startsWith: v, mode: 'insensitive' } }),
+    endswith: (f, v) => ({ [f]: { endsWith: v, mode: 'insensitive' } }),
+};
+function parseValue(value) {
+    if (!isNaN(Number(value)))
+        return Number(value);
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    return value;
+}
+function parseExpression(expr) {
+    const [field, op, ...rest] = expr.trim().split(' ');
+    if (!OPERATORS[op])
+        throw { message: `Operador '${op}' no soportado` };
+    return OPERATORS[op](field, parseValue(rest.join(' ')));
+}
+function buildFilter(filter) {
+    if (!filter)
+        return {};
+    if (filter.includes(' or '))
+        return { OR: filter.split(' or ').map(parseExpression) };
+    if (filter.includes(' and '))
+        return { AND: filter.split(' and ').map(parseExpression) };
+    return parseExpression(filter);
+}
+function buildExpand(expand) {
+    return expand?.split(',').reduce((acc, key) => ({ ...acc, [key]: true }), {});
+}
+function buildOrderBy(orderby) {
+    if (!orderby)
+        return undefined;
+    const [field, direction] = orderby.split(' ');
+    if (direction !== 'asc' && direction !== 'desc')
+        return undefined;
+    // Soporta campos anidados: "subscription.price desc" → { subscription: { price: 'desc' } }
+    return field.split('.').reduceRight((acc, part) => ({ [part]: acc }), direction);
+}
 class QueryBuilder {
-    static OPERATORS = {
-        eq: (f, v) => ({ [f]: v }),
-        ne: (f, v) => ({ [f]: { not: v } }),
-        ge: (f, v) => ({ [f]: { gte: v } }),
-        le: (f, v) => ({ [f]: { lte: v } }),
-        contains: (f, v) => ({
-            [f]: { contains: v, mode: 'insensitive' }
-        }),
-        startswith: (f, v) => ({
-            [f]: { startsWith: v, mode: 'insensitive' }
-        }),
-        endswith: (f, v) => ({
-            [f]: { endsWith: v, mode: 'insensitive' }
-        }),
-    };
-    static parseValue(value) {
-        if (value === undefined)
-            return value;
-        if (!isNaN(Number(value)))
-            return Number(value);
-        if (value === 'true')
-            return true;
-        if (value === 'false')
-            return false;
-        return value;
-    }
-    /**
-     * Construye el objeto expand
-     */
-    static buildExpand(expand) {
-        return expand?.split(',').reduce((acc, path) => {
-            acc[path] = true;
-            return acc;
-        }, {});
-    }
-    /**
-     * Parsea una expresión de filtro individual
-     */
-    static parseExpression(expr) {
-        const [field, op, ...rest] = expr.trim().split(' ');
-        if (!this.OPERATORS[op])
-            throw { message: `Operador '${op}' no soportado` };
-        const value = this.parseValue(rest.join(' '));
-        return this.OPERATORS[op](field, value);
-    }
-    /**
-     * Construye el objeto filter
-     */
-    static buildFilter(filter) {
-        if (!filter)
-            return {};
-        if (filter.includes(' or ')) {
-            return {
-                OR: filter.split(' or ').map(this.parseExpression.bind(this))
-            };
-        }
-        if (filter.includes(' and ')) {
-            return {
-                AND: filter.split(' and ').map(this.parseExpression.bind(this))
-            };
-        }
-        return this.parseExpression.bind(this)(filter);
-    }
-    /**
-     * Construye un objeto de ordenamiento
-     * Soporta propiedades encadenadas como "subscription.description"
-     */
-    static buildOrderBy(orderby) {
-        if (!orderby)
-            return undefined;
-        // Obtiene el campo y la dirección
-        const [field, direction] = orderby.split(' ');
-        // Solo acepta asc o desc
-        if (direction !== 'asc' && direction !== 'desc')
-            return undefined;
-        // Construye el objeto de ordenamiento
-        const parts = field.split(".");
-        let result = {};
-        let current = result;
-        for (let i = 0; i < parts.length; i++) {
-            if (i === parts.length - 1) {
-                current[parts[i]] = direction;
-            }
-            else {
-                current[parts[i]] = {};
-                current = current[parts[i]];
-            }
-        }
-        return result;
-    }
-    /**
-     * Construye el objeto query
-     */
     static build(query) {
         return {
-            where: {
-                ...this.buildFilter(query.filter)
-            },
-            include: this.buildExpand(query.expand),
-            take: Number(query.top || 10) + Number(query.skip || 0),
-            orderBy: this.buildOrderBy(query.orderby),
+            where: buildFilter(query.filter),
+            include: buildExpand(query.expand),
+            take: query.top ? Number(query.top) : undefined,
+            skip: query.skip ? Number(query.skip) : undefined,
+            orderBy: buildOrderBy(query.orderby),
         };
     }
 }

package/dist/types/app.d.ts

@@ -1,4 +1,4 @@
-import type { Endpoint } from "../http/Endpoint";
+import type { Endpoint } from "../index";
 import type { ErrorRequestHandler, RequestHandler } from "express";
 import type { Options } from "express-rate-limit";
 export type NanoAppConfig = {
@@ -14,4 +14,16 @@ export type NanoAppConfig = {
         tokens?: Record<string, any>;
         format?: string;
     };
+    apiKeys?: {
+        /** Habilita los endpoints y middleware de API keys. Por defecto: false */
+        enabled: boolean;
+        /** Ruta base para los endpoints de gestión. Por defecto: /api-keys */
+        path?: string;
+        /**
+         * Middleware de autenticación custom (ej: JWT de usuario).
+         * Si se provee, se ejecuta primero. Si falla, se intenta validar con API key.
+         * Si ambos fallan, retorna 401.
+         */
+        middleware?: RequestHandler;
+    };
 };

package/dist/types/odata.d.ts

@@ -6,7 +6,3 @@ export type QueryParams = {
     skip?: string;
     orderby?: string;
 };
-export type BeforeResult = {
-    entity: any;
-    id: number;
-};

package/dist/utils/Formatter.d.ts

@@ -1,4 +1,6 @@
+import type { ApiResponse } from "../index";
 export declare class Formatter {
     static price(value: number): string;
     static logDate(date?: Date): string;
+    static sanitizeAndParse(result: ApiResponse): ApiResponse;
 }

package/dist/utils/Formatter.js

@@ -15,5 +15,17 @@ class Formatter {
             second: "2-digit",
         }).format(date);
     }
+    static sanitizeAndParse(result) {
+        const jsonString = JSON.stringify(result);
+        // La expresión regular busca exactamente la clave "password": "cualquier_valor"
+        // donde:
+        //   - "password" se encuentra entre comillas.
+        //   - Puede haber espacios opcionales alrededor de los dos puntos.
+        //   - El valor se asume estar entre comillas.
+        const regex = /("password"\s*:\s*)"[^"]*"/gi;
+        // Reemplazamos el valor por el literal JSON null (sin comillas)
+        const sanitizedString = jsonString.replace(regex, '$1null');
+        return JSON.parse(sanitizedString);
+    }
 }
 exports.Formatter = Formatter;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano-app/backend",
-  "version": "0.6.0",
+  "version": "0.6.4",
   "description": "Backend for nano-app architecture",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -22,20 +22,24 @@
   "dependencies": {
     "@prisma/adapter-pg": "^7.4.0",
     "@prisma/client": "^7.4.0",
+    "bcrypt": "^6.0.0",
     "compression": "^1.8.1",
     "cors": "^2.8.5",
     "dotenv": "^17.2.3",
     "express": "^5.2.1",
     "express-rate-limit": "^8.2.1",
     "helmet": "^8.1.0",
-    "morgan": "^1.10.1"
+    "morgan": "^1.10.1",
+    "pg": "^8.20.0"
   },
   "devDependencies": {
+    "@types/bcrypt": "^6.0.0",
     "@types/compression": "^1.8.1",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.0",
     "@types/morgan": "^1.9.10",
     "@types/node": "^20.0.0",
+    "@types/pg": "^8.18.0",
     "tsx": "^4.7.0",
     "typescript": "^5.3.0"
   }