@njinlabs/njin 0.1.0

package/src/modules/api.ts

@@ -0,0 +1,160 @@
+import { getConfig } from "../core/config";
+import { makeModule } from "../core/module";
+import Elysia from "elysia";
+import z from "zod";
+import auth from "./auth";
+import elysia from "./elysia";
+
+const api = makeModule(() => {
+  const fn = () => {};
+
+  fn.init = async () => {
+    const models = getConfig().models;
+    const authPlugin = await auth();
+
+    const controller = new Elysia({ prefix: "/api/schema" }).use(authPlugin.plugin).get(
+      "/",
+      async () => {
+        const allModels = await Promise.all(
+          models.map((model) =>
+            (async () => {
+              const { default: data } = await model();
+
+              return {
+                name: data.name,
+                prefix: data.prefix,
+                schema: data.validation.toJSONSchema({
+                  unrepresentable: "any",
+                  override: (ctx) => {
+                    if (ctx.jsonSchema.renderAs === "relation") {
+                      ctx.jsonSchema.type = "object";
+                      ctx.jsonSchema.properties = {
+                        id: {
+                          type: "string",
+                        },
+                      };
+                      ctx.jsonSchema.required = ["id"];
+                      ctx.jsonSchema.additionalProperties = {};
+                    } else if (ctx.jsonSchema.renderAs === "multi_relation") {
+                      (ctx.jsonSchema.items! as any).type = "string";
+                    } else if (ctx.jsonSchema.renderAs === "file") {
+                      ctx.jsonSchema.type = "string";
+                    }
+                  },
+                }),
+              };
+            })(),
+          ),
+        );
+
+        return { data: allModels };
+      },
+      {
+        auth: true,
+      },
+    );
+
+    elysia().use(controller);
+
+    for (const promise of models) {
+      const { default: model } = await promise();
+
+      const controller = new Elysia({ prefix: `/api/${model.prefix}` })
+        .use(authPlugin.plugin)
+        .delete(
+          "/:id",
+          async ({ params }) => {
+            const data = await model.destroy(params.id);
+
+            return {
+              data,
+            };
+          },
+          {
+            params: z.object({
+              id: z.coerce.string(),
+            }),
+            auth: true,
+          },
+        )
+        .get(
+          "/:id",
+          async ({ params }) => {
+            const data = await model.show(params.id);
+
+            return {
+              data,
+            };
+          },
+          {
+            params: z.object({
+              id: z.coerce.string(),
+            }),
+            auth: true,
+          },
+        )
+        .put(
+          "/:id",
+          async ({ params, body }) => {
+            const data = await model.update(params.id, body);
+
+            return {
+              data,
+            };
+          },
+          {
+            params: z.object({
+              id: z.coerce.string(),
+            }),
+            auth: true,
+            body: model.validation.partial(),
+          },
+        )
+        .post(
+          "/",
+          async ({ body }) => {
+            const data = await model.create(body);
+
+            return {
+              data,
+            };
+          },
+          {
+            auth: true,
+            body: model.validation,
+          },
+        )
+        .get(
+          "/",
+          async ({ query: { search, page, limit, sort, order, populate, filters } }) => {
+            const populateOpt =
+              populate === "none" ? ("none" as const) : populate ? populate.split(",").map((s) => s.trim()) : undefined;
+
+            return model.read({ search, page, limit, sort, order, populate: populateOpt, filters });
+          },
+          {
+            auth: true,
+            query: z.object({
+              search: z.coerce.string().optional(),
+              page: z.coerce.number().int().positive().default(1),
+              limit: z.coerce.number().int().positive().max(100).default(20),
+              sort: z.coerce.string().optional(),
+              order: z.enum(["asc", "desc"]).default("asc"),
+              populate: z.coerce.string().optional(),
+              filters: z
+                .record(z.string(), z.union([z.coerce.string(), z.record(z.string(), z.coerce.string())]))
+                .optional(),
+            }),
+          },
+        );
+
+      elysia().use(controller);
+    }
+
+    return {};
+  };
+
+  return fn;
+});
+
+export default api;

package/src/modules/auth.ts

@@ -0,0 +1,153 @@
+import bearer from "@elysia/bearer";
+import { makeModule } from "../core/module";
+import Elysia, { status } from "elysia";
+import moment from "moment";
+import { eq, RecordId, Table, Uuid } from "surrealdb";
+import z from "zod";
+import elysia from "./elysia";
+import surreal from "./surreal";
+
+const table = new Table("token");
+
+const auth = makeModule(() => {
+  const fn = async () => {
+    const { default: user } = await import("../models/user");
+
+    type Token = {
+      hash: string;
+      createdAt: string;
+      updatedAt: string;
+      user: Awaited<ReturnType<typeof user.create>>;
+    };
+
+    const plugin = new Elysia({ name: "auth" }).use(bearer()).macro({
+      auth: {
+        resolve: async ({ bearer }) => {
+          try {
+            if (!bearer) {
+              throw new Error("Unauthorized");
+            }
+
+            const [_table, tokenId, plainToken] = bearer.split(":");
+
+            const token = await surreal().select<Token>(new RecordId(table, tokenId!)).fetch("user");
+
+            if (!token) {
+              throw new Error("Unauthorized");
+            }
+
+            const hash = new Bun.CryptoHasher("sha256").update(plainToken!).digest("utf8");
+
+            if (hash !== token.hash) {
+              throw new Error("Unauthorized");
+            }
+
+            const { password: _, ...safeUser } = token.user as typeof token.user & { password: string };
+
+            return {
+              user: { ...safeUser, tokenId: token.id },
+            };
+          } catch (e) {
+            if (e instanceof Error && e.message === "Unauthorized") {
+              return status(401, {
+                message: e.message,
+              });
+            }
+
+            throw e;
+          }
+        },
+      },
+    });
+
+    return {
+      plugin,
+    };
+  };
+
+  fn.init = async () => {
+    const { default: user } = await import("../models/user");
+
+    type Token = {
+      hash: string;
+      createdAt: string;
+      updatedAt: string;
+      user: Awaited<ReturnType<typeof user.create>>;
+    };
+
+    const controller = new Elysia({
+      prefix: "/api/auth",
+    })
+      .use((await fn()).plugin)
+      .get("/check-token", ({ user: { tokenId: _, ...user } }) => ({ data: user }), { auth: true })
+      .delete(
+        "/logout",
+        async ({ user: { tokenId, ...user } }) => {
+          await surreal().delete(tokenId);
+
+          return { data: user };
+        },
+        { auth: true },
+      )
+      .post(
+        "/login",
+        async ({ body }) => {
+          try {
+            const [data] = await surreal().select<Token["user"]>(user.table).where(eq("email", body.email));
+
+            if (!data) {
+              throw new Error("Unauthorized");
+            }
+
+            if (!(await Bun.password.verify(body.password, data.password))) {
+              throw new Error("Unauthorized");
+            }
+
+            const plainToken = Uuid.v7().toString();
+
+            const [token] = await surreal()
+              .create<Token>(table)
+              .content({
+                hash: new Bun.CryptoHasher("sha256").update(plainToken).digest("utf8"),
+                user: data.id as unknown as Token["user"],
+                createdAt: moment().toISOString(),
+                updatedAt: moment().toISOString(),
+              });
+
+            await surreal().relate(token!.id, new Table("user_token"), data.id);
+
+            const { password: _, ...safeData } = data as typeof data & { password: string };
+
+            return {
+              data: {
+                ...safeData,
+                token: `${table.toString()}:${token?.id.id}:${plainToken}`,
+              },
+            };
+          } catch (e) {
+            if (e instanceof Error && e.message === "Unauthorized") {
+              return status(401, {
+                message: "Unauthorized",
+              });
+            }
+
+            throw e;
+          }
+        },
+        {
+          body: z.object({
+            email: z.email(),
+            password: z.string(),
+          }),
+        },
+      );
+
+    elysia().use(controller);
+
+    return {};
+  };
+
+  return fn;
+});
+
+export default auth;

package/src/modules/elysia.ts

@@ -0,0 +1,85 @@
+import cors from "@elysia/cors";
+import { getConfig } from "../core/config";
+import { UniqueConstraintError } from "../core/model";
+import { makeModule } from "../core/module";
+import Elysia, { status, ValidationError, type AnyElysia } from "elysia";
+import logger from "./logger";
+
+// Elysia's query parser only understands object/record-shaped query schemas as a single
+// JSON-encoded string — not the conventional bracket notation (`field[key]=value`,
+// `field[key][op]=value`) that Axios/qs/jQuery produce by default. Parsed here, globally,
+// before validation runs, so every route's Zod query schema "just works" with that notation
+// without any per-route setup.
+const BRACKET_KEY_RE = /^([^[\]]+)\[([^\]]+)\](?:\[([^\]]+)\])?$/;
+
+export const injectBracketQuery = ({ query, request }: { query: Record<string, unknown>; request: Request }) => {
+  const params = new URL(request.url).searchParams;
+
+  for (const [key, value] of params) {
+    const match = BRACKET_KEY_RE.exec(key);
+    if (!match) continue;
+
+    const [, root, sub1, sub2] = match as unknown as [string, string, string, string | undefined];
+    const existingRoot = query[root];
+    const rootObj = typeof existingRoot === "object" && existingRoot !== null ? (existingRoot as Record<string, unknown>) : {};
+
+    if (sub2) {
+      const existingSub = rootObj[sub1];
+      rootObj[sub1] = {
+        ...(typeof existingSub === "object" && existingSub !== null ? (existingSub as Record<string, unknown>) : {}),
+        [sub2]: value,
+      };
+    } else {
+      rootObj[sub1] = value;
+    }
+
+    query[root] = rootObj;
+  }
+};
+
+const elysia = makeModule(() => {
+  let app: AnyElysia;
+
+  const fn = () => {
+    return app;
+  };
+
+  fn.init = () => {
+    app = new Elysia()
+      .use(cors())
+      .onTransform({ as: "global" }, injectBracketQuery)
+      .onError(({ error }) => {
+      if (error instanceof ValidationError) {
+        return status(422, {
+          message: "Validation error",
+          errors: (error.detail("") as { errors: { value: {}; summary: string }[] }).errors.map(({ value, summary, ...err }) => err),
+        });
+      }
+
+      if (error instanceof UniqueConstraintError) {
+        return status(409, {
+          message: error.message,
+          field: error.field,
+        });
+      }
+
+      logger().error(error);
+
+      return status(500, {
+        message: "Internal Server Error",
+      });
+    });
+
+    return {
+      // No startup log here — the CLI prints one consolidated banner after every
+      // module has finished booting (src/core/banner.ts), instead of one line per module.
+      spin: () => {
+        app.listen(getConfig().port);
+      },
+    };
+  };
+
+  return fn;
+});
+
+export default elysia;

package/src/modules/file.ts

@@ -0,0 +1,131 @@
+import { getConfig } from "../core/config";
+import type { makeModel } from "../core/model";
+import { makeModule } from "../core/module";
+import { resolveSafePath } from "../core/path_guard";
+import Elysia from "elysia";
+import { join } from "node:path";
+import { RecordId } from "surrealdb";
+import z from "zod";
+import auth from "./auth";
+import elysia from "./elysia";
+import surreal from "./surreal";
+
+export type FileUpload<Meta> = {
+  id: RecordId;
+  name: string;
+  size: number;
+  type: string;
+  meta: z.infer<Meta>;
+  url: string;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export interface FileAdapter<Meta> {
+  write: (file: File) => Promise<Omit<FileUpload<Meta>, "id" | "createdAt" | "updatedAt">>;
+  unlink: (file: FileUpload<Meta>) => Promise<void>;
+  meta: Meta;
+  // Only set by filesystem-backed adapters — tells this module where to serve
+  // /uploads/* from. Adapters like S3 serve files from their own public URL instead,
+  // so they omit this and the static route below never gets mounted.
+  dir?: string;
+}
+
+const file = makeModule(() => {
+  let model: ReturnType<typeof makeModel>;
+
+  const fn = () => ({ model });
+
+  fn.init = async () => {
+    const { default: baseModel } = await import("../models/file");
+
+    type FileUploadCurrent = Awaited<ReturnType<typeof baseModel.create>>;
+
+    const controller = new Elysia({ prefix: "/api/file" })
+      .use((await auth()).plugin)
+      .get(
+        "/",
+        async ({ query: { search, page, limit, sort, order } }) => {
+          return baseModel.read({ search, page, limit, sort, order });
+        },
+        {
+          auth: true,
+          query: z.object({
+            search: z.coerce.string().optional(),
+            page: z.coerce.number().int().positive().default(1),
+            limit: z.coerce.number().int().positive().max(100).default(20),
+            sort: z.coerce.string().optional(),
+            order: z.enum(["asc", "desc"]).default("asc"),
+          }),
+        },
+      )
+      .delete(
+        "/:id",
+        async ({ params }) => {
+          const data = await surreal().delete<FileUploadCurrent>(new RecordId(baseModel.table, params.id));
+
+          await getConfig().adapters.file.unlink(data);
+
+          return { data };
+        },
+        {
+          params: z.object({
+            id: z.coerce.string(),
+          }),
+          auth: true,
+        },
+      )
+      .post(
+        "/",
+        async ({ body }) => {
+          const data = await surreal()
+            .create<Omit<FileUploadCurrent, "id">>(baseModel.table)
+            .content(await getConfig().adapters.file.write(body.file));
+
+          return { data };
+        },
+        {
+          auth: true,
+          body: z.object({
+            file: z.file(),
+          }),
+        },
+      );
+
+    const adapterDir = getConfig().adapters.file.dir;
+
+    if (adapterDir) {
+      const uploadsDir = join(process.cwd(), adapterDir);
+
+      const uploadsController = new Elysia().get("/uploads/*", async ({ params }) => {
+        // Elysia leaves wildcard params percent-encoded — decode before touching the filesystem.
+        let decoded: string;
+        try {
+          decoded = decodeURIComponent(params["*"]);
+        } catch {
+          return new Response("Not Found", { status: 404 });
+        }
+
+        const requested = resolveSafePath(uploadsDir, decoded);
+        if (!requested) return new Response("Not Found", { status: 404 });
+
+        const file = Bun.file(requested);
+        if (!(await file.exists())) return new Response("Not Found", { status: 404 });
+
+        return file;
+      });
+
+      elysia().use(controller).use(uploadsController);
+    } else {
+      elysia().use(controller);
+    }
+
+    model = baseModel;
+
+    return {};
+  };
+
+  return fn;
+});
+
+export default file;

package/src/modules/img.ts

@@ -0,0 +1,137 @@
+import { getConfig } from "../core/config";
+import { makeModule } from "../core/module";
+import Elysia from "elysia";
+import elysia from "./elysia";
+import view from "./view";
+
+export function isAllowed(imageUrl: string, requestHost: string, allowedHosts: string[] = getConfig().img.hosts): boolean {
+  if (imageUrl.startsWith("/")) return true;
+
+  let parsed: URL;
+  try {
+    parsed = new URL(imageUrl);
+  } catch {
+    return false;
+  }
+
+  const imageHostname = parsed.hostname;
+  // Strip port — host header may include it (e.g. "localhost:3000")
+  const requestHostname = requestHost.split(":")[0];
+
+  // Same host as the incoming request — works across dev, staging, and production
+  if (imageHostname === requestHostname) return true;
+
+  // localhost variants — covers Vite dev server running on a different port (5173)
+  if (imageHostname === "localhost" || imageHostname === "127.0.0.1") return true;
+
+  // Truly external hosts: require explicit whitelist
+  return allowedHosts.includes(imageHostname);
+}
+
+export function extractFilename(url: string): string {
+  try {
+    const pathname = url.startsWith("/") ? url : new URL(url).pathname;
+    const last = pathname.split("/").filter(Boolean).pop() ?? "image";
+    const name = last.replace(/\.[^.]+$/, "") || "image";
+    return `${name}.webp`;
+  } catch {
+    return "image.webp";
+  }
+}
+
+const img = makeModule(() => {
+  const fn = () => {};
+
+  fn.init = async () => {
+    view().global("imgOptimize", (url: string, options?: { w?: number; h?: number; q?: number }) => {
+      const params = new URLSearchParams({ url });
+      if (options?.w != null) params.set("w", String(options.w));
+      if (options?.h != null) params.set("h", String(options.h));
+      if (options?.q != null) params.set("q", String(options.q));
+      return `/img?${params.toString()}`;
+    });
+
+    const controller = new Elysia();
+
+    controller.get("/img", async ({ query, request }) => {
+      const { url, w, h, q = "80" } = query;
+
+      if (!url) {
+        return new Response("Missing url parameter", { status: 400 });
+      }
+
+      const width = w ? parseInt(w) : undefined;
+      const height = h ? parseInt(h) : undefined;
+      const quality = Math.min(100, Math.max(1, parseInt(q)));
+
+      if (isNaN(quality)) {
+        return new Response("Invalid q parameter", { status: 400 });
+      }
+
+      const requestHost = request.headers.get("host") ?? "";
+
+      if (!isAllowed(url, requestHost)) {
+        return new Response("Host not allowed", { status: 403 });
+      }
+
+      // ETag is deterministic from input params — allows 304 without fetching or processing
+      const etag = `"${Bun.hash(`${url}|${w ?? ""}|${h ?? ""}|${quality}`).toString(16)}"`;
+      const cacheControl = "public, max-age=31536000, immutable";
+
+      if (request.headers.get("if-none-match") === etag) {
+        return new Response(null, {
+          status: 304,
+          headers: { ETag: etag, "Cache-Control": cacheControl },
+        });
+      }
+
+      let imageData: ArrayBuffer;
+
+      if (url.startsWith("/")) {
+        const resp = await fetch(`http://localhost:${getConfig().port}${url}`);
+        if (!resp.ok) return new Response("Image not found", { status: 404 });
+        imageData = await resp.arrayBuffer();
+      } else {
+        const resp = await fetch(url);
+        if (!resp.ok) return new Response("Failed to fetch image", { status: 502 });
+        imageData = await resp.arrayBuffer();
+      }
+
+      const pipeline = new Bun.Image(imageData);
+
+      if (width) {
+        // Bun.Image.resize() takes width first and derives height from aspect ratio
+        // when height is omitted — there's no height-only equivalent, so width-only
+        // and width+height both go through this branch unchanged.
+        pipeline.resize(width, height, { fit: "inside", withoutEnlargement: true });
+      } else if (height) {
+        // Height-only request — derive a proportional width from the source dimensions
+        // since resize() requires a width argument.
+        const meta = await pipeline.metadata();
+        const derivedWidth = Math.round((meta.width / meta.height) * height);
+        pipeline.resize(derivedWidth, height, { fit: "inside", withoutEnlargement: true });
+      }
+
+      const output = await pipeline.webp({ quality }).buffer();
+      const filename = extractFilename(url);
+
+      return new Response(new Uint8Array(output), {
+        headers: {
+          "Content-Type": "image/webp",
+          "Content-Length": String(output.byteLength),
+          "Content-Disposition": `inline; filename="${filename}"`,
+          "Cache-Control": cacheControl,
+          ETag: etag,
+          Vary: "Accept",
+        },
+      });
+    });
+
+    elysia().use(controller);
+    return {};
+  };
+
+  return fn;
+});
+
+export default img;

package/src/modules/logger.ts

@@ -0,0 +1,18 @@
+import { makeModule } from "../core/module";
+import pino from "pino";
+import pretty from "pino-pretty";
+
+const logger = makeModule(() => {
+  let p: pino.Logger;
+
+  const fn = () => p;
+
+  fn.init = () => {
+    p = pino({}, pretty({ colorize: true }));
+    return {};
+  };
+
+  return fn;
+});
+
+export default logger;