@nextsparkjs/core 0.1.0-beta.7 → 0.1.0-beta.70

package/dist/lib/api/helpers.js

@@ -1,12 +1,13 @@
 import { NextResponse } from "next/server";
-import { validateApiKey } from "./auth";
-import { mutateWithRLS, queryWithRLS } from "../db";
-import { checkRateLimit, addRateLimitHeaders } from "./rate-limit";
-import { getApplicationConfig } from "../config";
-import { auth } from "../auth";
-import { MetaService } from "../services/meta.service";
-import { ScopeService } from "../services/scope.service";
-import { getChildEntities } from "../entities/queries";
+import { validateApiKey } from "./auth.js";
+import { mutateWithRLS, queryWithRLS } from "../db.js";
+import { checkRateLimit, addRateLimitHeaders } from "./rate-limit.js";
+import { getApplicationConfig } from "../config/index.js";
+import { auth } from "../auth.js";
+import { MetaService } from "../services/meta.service.js";
+import { ScopeService } from "../services/scope.service.js";
+import { getChildEntities } from "../entities/queries.js";
+import { getCorsOrigins, normalizeOrigin } from "../utils/cors.js";
 async function validateAndAuthenticateRequest(request) {
   var _a;
   const cookieHeader = request.headers.get("cookie");
@@ -103,10 +104,19 @@ function getApiAuth(request) {
   if (!userId || !keyId || !scopesHeader) {
     throw new Error("Missing API authentication headers");
   }
+  let scopes = [];
+  try {
+    const parsed = JSON.parse(scopesHeader);
+    if (Array.isArray(parsed)) {
+      scopes = parsed.filter((s) => typeof s === "string");
+    }
+  } catch {
+    console.warn("[API] Invalid scopes header format");
+  }
   return {
     userId,
     keyId,
-    scopes: JSON.parse(scopesHeader)
+    scopes
   };
 }
 function checkScope(auth2, requiredScope) {
@@ -256,19 +266,23 @@ async function addCorsHeaders(response, request) {
   if (request) {
     const origin = request.headers.get("origin");
     if (origin) {
+      const normalizedOrigin = normalizeOrigin(origin);
       if (env === "development" && corsConfig.allowAllOrigins.development) {
-        allowedOrigin = origin;
+        allowedOrigin = normalizedOrigin;
       } else {
-        const allowedOrigins = corsConfig.allowedOrigins[env] || [];
-        if (allowedOrigins.includes(origin)) {
-          allowedOrigin = origin;
+        const allowedOrigins = getCorsOrigins(config, env);
+        if (allowedOrigins.includes(normalizedOrigin)) {
+          allowedOrigin = normalizedOrigin;
         }
       }
     }
+  } else if (env === "development" && corsConfig.allowAllOrigins.development) {
+    const allowedOrigins = getCorsOrigins(config, env);
+    allowedOrigin = allowedOrigins[0] || "http://localhost:3000";
   }
   response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
   response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
-  response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key");
+  response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key, x-team-id, x-builder-source");
   response.headers.set("Access-Control-Allow-Credentials", "true");
   response.headers.set("Access-Control-Max-Age", "86400");
   return response;
@@ -277,6 +291,33 @@ async function handleCorsPreflightRequest(request) {
   const response = new NextResponse(null, { status: 200 });
   return await addCorsHeaders(response, request);
 }
+async function wrapAuthHandlerWithCors(handler, request) {
+  const response = await handler();
+  const newResponse = new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: new Headers(response.headers)
+  });
+  const env = process.env.NODE_ENV || "development";
+  const config = await getApplicationConfig();
+  const corsConfig = config.api.cors;
+  const origin = request.headers.get("origin");
+  if (origin) {
+    const normalizedOrigin = normalizeOrigin(origin);
+    let allowedOrigin = "null";
+    if (env === "development" && corsConfig.allowAllOrigins.development) {
+      allowedOrigin = normalizedOrigin;
+    } else {
+      const allowedOrigins = getCorsOrigins(config, env);
+      if (allowedOrigins.includes(normalizedOrigin)) {
+        allowedOrigin = normalizedOrigin;
+      }
+    }
+    newResponse.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+    newResponse.headers.set("Access-Control-Allow-Credentials", "true");
+  }
+  return newResponse;
+}
 function parseMetaParams(request) {
   const url = new URL(request.url);
   const metasParam = url.searchParams.get("metas");
@@ -513,5 +554,6 @@ export {
   sanitizeSearchQuery,
   validateAndAuthenticateApiRequest,
   validateAndAuthenticateRequest,
-  withApiLogging
+  withApiLogging,
+  wrapAuthHandlerWithCors
 };

package/dist/lib/api/index.js

@@ -1,5 +1,6 @@
-export * from "./auth";
-export * from "./keys";
-export * from "./helpers";
-export * from "./rate-limit";
-export * from "./cache";
+export * from "./auth.js";
+export * from "./keys.js";
+export * from "./helpers.js";
+export * from "./rate-limit.js";
+export * from "./cache.js";
+export * from "./distributed-cache.js";

package/dist/lib/api/meta.middleware.js

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
-import { MetaService } from "../services/meta.service";
-import { validateBasicMetas } from "../helpers/entity-meta.helpers";
+import { MetaService } from "../services/meta.service.js";
+import { validateBasicMetas } from "../helpers/entity-meta.helpers.js";
 function withUnifiedMeta(entityType) {
   return function(handler) {
     return async function(req, context) {

package/dist/lib/api/permission-middleware.js

@@ -1,4 +1,4 @@
-import { checkPermission } from "../permissions/check";
+import { checkPermission } from "../permissions/check.js";
 import { NextResponse } from "next/server";
 const HTTP_TO_ACTION = {
   "GET": "read",

package/dist/lib/api/rate-limit.js

@@ -1,6 +1,10 @@
 import { NextResponse } from "next/server";
-import { getRateLimitForScopes } from "./keys";
-import { rateLimitCache, getCacheKey } from "./cache";
+import { getRateLimitForScopes } from "./keys.js";
+import { rateLimitCache, getCacheKey } from "./cache.js";
+import {
+  checkRateLimit as checkRedisRateLimit,
+  maybeRedisConfigured
+} from "../rate-limit-redis.js";
 function checkRateLimit(identifier, limit = 1e3, windowMs = 6e4) {
   const now = Date.now();
   const cacheKey = getCacheKey("rate_limit", identifier);
@@ -34,6 +38,71 @@ function checkRateLimit(identifier, limit = 1e3, windowMs = 6e4) {
     limit
   };
 }
+async function checkDistributedRateLimit(identifier, type = "api") {
+  if (maybeRedisConfigured()) {
+    const result2 = await checkRedisRateLimit(identifier, type);
+    const defaultLimits = {
+      auth: 5,
+      api: 100,
+      strict: 10,
+      read: 200,
+      write: 50
+    };
+    return {
+      allowed: result2.success,
+      remaining: result2.remaining,
+      resetTime: result2.reset,
+      limit: result2.limit ?? defaultLimits[type],
+      retryAfter: result2.retryAfter
+    };
+  }
+  const limits = {
+    auth: { limit: 5, windowMs: 15 * 60 * 1e3 },
+    // 5 requests per 15 minutes
+    api: { limit: 100, windowMs: 60 * 1e3 },
+    // 100 requests per minute
+    strict: { limit: 10, windowMs: 60 * 60 * 1e3 },
+    // 10 requests per hour
+    read: { limit: 200, windowMs: 60 * 1e3 },
+    // 200 requests per minute
+    write: { limit: 50, windowMs: 60 * 1e3 }
+    // 50 requests per minute
+  };
+  const config = limits[type];
+  const result = checkRateLimit(`${type}:${identifier}`, config.limit, config.windowMs);
+  return {
+    ...result,
+    retryAfter: result.allowed ? void 0 : Math.ceil((result.resetTime - Date.now()) / 1e3)
+  };
+}
+function createRateLimitErrorResponse(result) {
+  return NextResponse.json(
+    {
+      success: false,
+      error: "Rate limit exceeded",
+      message: "Too many requests. Please try again later.",
+      code: "RATE_LIMIT_EXCEEDED",
+      meta: {
+        limit: result.limit,
+        remaining: result.remaining,
+        resetTime: new Date(result.resetTime).toISOString(),
+        retryAfter: result.retryAfter ?? Math.ceil((result.resetTime - Date.now()) / 1e3)
+      }
+    },
+    {
+      status: 429,
+      headers: {
+        "X-RateLimit-Limit": result.limit.toString(),
+        "X-RateLimit-Remaining": result.remaining.toString(),
+        "X-RateLimit-Reset": result.resetTime.toString(),
+        "Retry-After": (result.retryAfter ?? Math.ceil((result.resetTime - Date.now()) / 1e3)).toString()
+      }
+    }
+  );
+}
+function isDistributedRateLimitAvailable() {
+  return maybeRedisConfigured();
+}
 function applyRateLimit(request, keyId, scopes) {
   const rateLimits = getRateLimitForScopes(scopes);
   const rateLimit = checkRateLimit(keyId, rateLimits.requests, rateLimits.windowMs);
@@ -80,7 +149,15 @@ function withRateLimit(handler) {
       if (!keyId || !scopesHeader) {
         return handler(request, ...args);
       }
-      const scopes = JSON.parse(scopesHeader);
+      let scopes = [];
+      try {
+        const parsed = JSON.parse(scopesHeader);
+        if (Array.isArray(parsed)) {
+          scopes = parsed.filter((s) => typeof s === "string");
+        }
+      } catch {
+        console.warn("[RateLimit] Invalid scopes header format");
+      }
       const rateLimitResponse = applyRateLimit(request, keyId, scopes);
       if (rateLimitResponse) {
         return rateLimitResponse;
@@ -122,13 +199,66 @@ function getAllRateLimitStats() {
 function getRateLimitCacheStats() {
   return rateLimitCache.getStats();
 }
+function getClientIp(request) {
+  const forwardedFor = request.headers.get("x-forwarded-for");
+  if (forwardedFor) {
+    const ips = forwardedFor.split(",").map((ip) => ip.trim());
+    if (ips[0]) return ips[0];
+  }
+  const realIp = request.headers.get("x-real-ip");
+  if (realIp) return realIp;
+  const cfIp = request.headers.get("cf-connecting-ip");
+  if (cfIp) return cfIp;
+  const trueClientIp = request.headers.get("true-client-ip");
+  if (trueClientIp) return trueClientIp;
+  return "unknown";
+}
+function getUserIdentifier(request) {
+  const apiKey = request.headers.get("x-api-key");
+  if (apiKey) {
+    return `apikey:${apiKey.substring(0, 16)}`;
+  }
+  return null;
+}
+let rateLimitDisabledWarningLogged = false;
+function isRateLimitingDisabled() {
+  const disabled = process.env.DISABLE_RATE_LIMITING === "true";
+  if (disabled && !rateLimitDisabledWarningLogged) {
+    console.warn("[RateLimit] WARNING: Rate limiting is DISABLED via DISABLE_RATE_LIMITING=true. Do not use in production!");
+    rateLimitDisabledWarningLogged = true;
+  }
+  return disabled;
+}
+function withRateLimitTier(handler, tier = "api") {
+  return async (request, ...args) => {
+    if (isRateLimitingDisabled()) {
+      return handler(request, ...args);
+    }
+    const userIdentifier = getUserIdentifier(request);
+    const clientIp = getClientIp(request);
+    const identifier = userIdentifier ? `${tier}:${userIdentifier}` : `${tier}:ip:${clientIp}`;
+    const rateLimitResult = await checkDistributedRateLimit(identifier, tier);
+    if (!rateLimitResult.allowed) {
+      return createRateLimitErrorResponse(rateLimitResult);
+    }
+    const response = await handler(request, ...args);
+    response.headers.set("X-RateLimit-Limit", rateLimitResult.limit.toString());
+    response.headers.set("X-RateLimit-Remaining", Math.max(0, rateLimitResult.remaining).toString());
+    response.headers.set("X-RateLimit-Reset", rateLimitResult.resetTime.toString());
+    return response;
+  };
+}
 export {
   addRateLimitHeaders,
   applyRateLimit,
+  checkDistributedRateLimit,
   checkRateLimit,
   clearRateLimit,
+  createRateLimitErrorResponse,
   getAllRateLimitStats,
   getRateLimitCacheStats,
   getRateLimitStats,
-  withRateLimit
+  isDistributedRateLimitAvailable,
+  withRateLimit,
+  withRateLimitTier
 };

package/dist/lib/api/routes/index.js

@@ -0,0 +1,4 @@
+import { createPatternUsagesHandlers } from "./patterns-usages.js";
+export {
+  createPatternUsagesHandlers
+};

package/dist/lib/api/routes/patterns-usages.js

@@ -0,0 +1,83 @@
+import { NextResponse } from "next/server";
+import {
+  createApiResponse,
+  createApiError,
+  createPaginationMeta,
+  withApiLogging,
+  handleCorsPreflightRequest,
+  addCorsHeaders
+} from "../helpers.js";
+import { authenticateRequest, hasRequiredScope } from "../auth/dual-auth.js";
+import { PatternUsageService } from "../../services/index.js";
+import { queryOneWithRLS } from "../../db.js";
+function createPatternUsagesHandlers() {
+  async function OPTIONS() {
+    return handleCorsPreflightRequest();
+  }
+  const GET = withApiLogging(
+    async (req, { params }) => {
+      try {
+        const authResult = await authenticateRequest(req);
+        if (!authResult.success) {
+          return NextResponse.json(
+            { success: false, error: "Authentication required", code: "AUTHENTICATION_FAILED" },
+            { status: 401 }
+          );
+        }
+        if (authResult.rateLimitResponse) {
+          return authResult.rateLimitResponse;
+        }
+        if (!hasRequiredScope(authResult, "patterns:read")) {
+          const response2 = createApiError("Insufficient permissions", 403);
+          return addCorsHeaders(response2);
+        }
+        const { id: patternId } = await params;
+        const userId = authResult.user.id;
+        if (!patternId || patternId.trim() === "") {
+          const response2 = createApiError("Pattern ID is required", 400, null, "MISSING_PATTERN_ID");
+          return addCorsHeaders(response2);
+        }
+        const pattern = await queryOneWithRLS(
+          'SELECT id FROM "patterns" WHERE id = $1',
+          [patternId],
+          userId
+        );
+        if (!pattern) {
+          const response2 = createApiError("Pattern not found", 404, null, "PATTERN_NOT_FOUND");
+          return addCorsHeaders(response2);
+        }
+        const url = new URL(req.url);
+        const entityType = url.searchParams.get("entityType") || void 0;
+        const limit = Math.min(parseInt(url.searchParams.get("limit") || "50", 10), 100);
+        const page = Math.max(parseInt(url.searchParams.get("page") || "1", 10), 1);
+        const offset = (page - 1) * limit;
+        const result = await PatternUsageService.getUsagesWithEntityInfo(
+          patternId,
+          userId,
+          { entityType, limit, offset }
+        );
+        const totalPages = Math.ceil(result.total / limit);
+        const paginationMeta = createPaginationMeta(page, limit, result.total);
+        const response = createApiResponse({
+          usages: result.usages,
+          counts: result.counts,
+          total: result.total
+        }, {
+          ...paginationMeta,
+          totalPages,
+          patternId,
+          entityType: entityType || "all"
+        });
+        return addCorsHeaders(response);
+      } catch (error) {
+        console.error("Error fetching pattern usages:", error);
+        const response = createApiError("Internal server error", 500);
+        return addCorsHeaders(response);
+      }
+    }
+  );
+  return { GET, OPTIONS };
+}
+export {
+  createPatternUsagesHandlers
+};

package/dist/lib/auth.js

@@ -1,11 +1,13 @@
 import { betterAuth } from "better-auth";
 import { Pool } from "pg";
 import { nextCookies } from "better-auth/next-js";
-import { EmailFactory, emailTemplates } from "./email";
-import { I18N_CONFIG, USER_ROLES_CONFIG, TEAMS_CONFIG } from "./config";
-import { getUserFlags } from "./services/user-flags.service";
-import { TeamService } from "./services/team.service";
-import { shouldSkipTeamCreation } from "./auth-context";
+import { parseSSLConfig } from "./db.js";
+import { EmailFactory, emailTemplates } from "./email/index.js";
+import { I18N_CONFIG, USER_ROLES_CONFIG, TEAMS_CONFIG, APP_CONFIG_MERGED } from "./config/index.js";
+import { getUserFlags } from "./services/user-flags.service.js";
+import { TeamService } from "./services/team.service.js";
+import { shouldSkipTeamCreation } from "./auth-context.js";
+import { getCorsOrigins } from "./utils/cors.js";
 const isProd = process.env.NODE_ENV === "production";
 const baseUrl = process.env.BETTER_AUTH_URL || process.env.NEXT_PUBLIC_APP_URL || "http://localhost:5173";
 const emailService = EmailFactory.create();
@@ -13,7 +15,7 @@ const databaseUrl = process.env.DATABASE_URL;
 const connectionString = databaseUrl.includes("?") ? `${databaseUrl}&pgbouncer=true` : `${databaseUrl}?pgbouncer=true`;
 const pool = new Pool({
   connectionString,
-  ssl: { rejectUnauthorized: false },
+  ssl: parseSSLConfig(databaseUrl),
   connectionTimeoutMillis: 1e4,
   idleTimeoutMillis: 3e4,
   max: 20
@@ -136,20 +138,8 @@ const auth = betterAuth({
     }
   },
   baseURL: baseUrl,
-  trustedOrigins: [
-    baseUrl,
-    process.env.NEXT_PUBLIC_APP_URL,
-    // Additional public URL
-    "http://localhost:5173",
-    "http://localhost:3000",
-    // Ionic app
-    "http://localhost:3008",
-    // Ionic app (puerto actual)
-    "http://127.0.0.1:3000",
-    // Alternative localhost
-    "http://127.0.0.1:3008"
-    // Alternative localhost actual
-  ].filter((origin) => Boolean(origin)),
+  // Use unified CORS configuration from app.config.ts + theme extensions + env vars
+  trustedOrigins: getCorsOrigins(APP_CONFIG_MERGED),
   plugins: [
     nextCookies()
     // MUST be the last plugin for Next.js cookie handling

package/dist/lib/billing/enforcement.js

@@ -1,4 +1,4 @@
-import { SubscriptionService } from "../services/subscription.service";
+import { SubscriptionService } from "../services/subscription.service.js";
 import { BILLING_REGISTRY } from "@nextsparkjs/registries/billing-registry";
 async function checkDowngrade(teamId, targetPlanSlug) {
   const subscription = await SubscriptionService.getActive(teamId);

package/dist/lib/billing/jobs.js

@@ -1,4 +1,4 @@
-import { queryWithRLS } from "../db";
+import { queryWithRLS } from "../db.js";
 async function expireTrials() {
   const result = { processed: 0, errors: [] };
   const expiredTrials = await queryWithRLS(

package/dist/lib/blocks/pattern-resolver.js

@@ -0,0 +1,32 @@
+import { isPatternReference } from "../../types/pattern-reference.js";
+function resolvePatternReferences(blocks, patternCache) {
+  const resolved = [];
+  for (const block of blocks) {
+    if (isPatternReference(block)) {
+      const pattern = patternCache.get(block.ref);
+      if (pattern) {
+        resolved.push(...pattern.blocks);
+      } else {
+        console.warn(
+          `[pattern-resolver] Pattern not found: ${block.ref} (instance: ${block.id})`
+        );
+      }
+    } else {
+      resolved.push(block);
+    }
+  }
+  return resolved;
+}
+function extractPatternIds(blocks) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const block of blocks) {
+    if (isPatternReference(block)) {
+      ids.add(block.ref);
+    }
+  }
+  return Array.from(ids);
+}
+export {
+  extractPatternIds,
+  resolvePatternReferences
+};

package/dist/lib/blocks/patterns-resolver.service.js

@@ -0,0 +1,67 @@
+import { query } from "../db.js";
+class PatternsResolverService {
+  /**
+   * Get multiple patterns by IDs (batch fetch)
+   *
+   * Used for resolving pattern references in public pages.
+   * Only fetches PUBLISHED patterns (drafts are not shown publicly).
+   *
+   * @param ids - Array of pattern IDs
+   * @returns Array of published patterns
+   *
+   * @example
+   * const patternRefs = [{ ref: 'uuid-1' }, { ref: 'uuid-2' }]
+   * const patterns = await PatternsResolverService.getByIds(
+   *   patternRefs.map(p => p.ref)
+   * )
+   */
+  static async getByIds(ids) {
+    try {
+      if (!Array.isArray(ids) || ids.length === 0) {
+        return [];
+      }
+      const validIds = ids.filter((id) => id && id.trim());
+      if (validIds.length === 0) {
+        return [];
+      }
+      const placeholders = validIds.map((_, i) => `$${i + 1}`).join(", ");
+      const result = await query(
+        `
+        SELECT
+          id,
+          "userId",
+          "teamId",
+          title,
+          slug,
+          blocks,
+          status,
+          description,
+          "createdAt",
+          "updatedAt"
+        FROM "patterns"
+        WHERE id IN (${placeholders})
+          AND status = 'published'
+        `,
+        validIds
+      );
+      return result.rows.map((pattern) => ({
+        id: pattern.id,
+        userId: pattern.userId,
+        teamId: pattern.teamId,
+        title: pattern.title,
+        slug: pattern.slug,
+        blocks: Array.isArray(pattern.blocks) ? pattern.blocks : [],
+        status: pattern.status,
+        description: pattern.description ?? void 0,
+        createdAt: pattern.createdAt,
+        updatedAt: pattern.updatedAt
+      }));
+    } catch (error) {
+      console.error("[PatternsResolverService.getByIds] Error:", error);
+      return [];
+    }
+  }
+}
+export {
+  PatternsResolverService
+};

package/dist/lib/config/config-loader.js

@@ -1,4 +1,4 @@
-import { APP_CONFIG_MERGED } from "./config-sync";
+import { APP_CONFIG_MERGED } from "./config-sync.js";
 async function loadApplicationConfig() {
   return {
     ...APP_CONFIG_MERGED,