@njinlabs/njin 0.1.0

package/src/modules/setup.ts

@@ -0,0 +1,89 @@
+import { makeModule } from "../core/module";
+import Elysia, { status } from "elysia";
+import moment from "moment";
+import { RecordId, Table, Uuid } from "surrealdb";
+import z from "zod";
+import elysia from "./elysia";
+import surreal from "./surreal";
+
+const tokenTable = new Table("token");
+
+const setup = makeModule(() => {
+  const fn = () => {};
+
+  fn.init = async () => {
+    const { default: user } = await import("../models/user");
+
+    type Token = {
+      hash: string;
+      createdAt: string;
+      updatedAt: string;
+      user: RecordId;
+    };
+
+    const hasUsers = async () => {
+      const [[row]] = await surreal().query<[{ count: number }[]]>(
+        `SELECT count() as count FROM ${user.prefix} GROUP ALL`,
+      );
+      return (row?.count ?? 0) > 0;
+    };
+
+    const controller = new Elysia({ prefix: "/api/setup" })
+
+      // Status — admin panel calls this on startup
+      .get("/status", async () => {
+        return { needsSetup: !(await hasUsers()) };
+      })
+
+      // Create first admin — locked once any user exists
+      .post(
+        "/",
+        async ({ body }) => {
+          if (await hasUsers()) {
+            return status(403, { message: "Setup already completed" });
+          }
+
+          const created = await user.create({
+            ...body,
+            password: Bun.password.hashSync(body.password),
+          });
+
+          const plainToken = Uuid.v7().toString();
+          const [token] = await surreal()
+            .create<Token>(tokenTable)
+            .content({
+              hash: new Bun.CryptoHasher("sha256").update(plainToken).digest("utf8"),
+              user: created.id,
+              createdAt: moment().toISOString(),
+              updatedAt: moment().toISOString(),
+            });
+
+          await surreal().relate(token!.id, new Table("user_token"), created.id);
+
+          const { password: _, ...safeUser } = created as typeof created & { password: string };
+
+          return {
+            data: {
+              token: `${tokenTable.toString()}:${token!.id.id}:${plainToken}`,
+              user: safeUser,
+            },
+          };
+        },
+        {
+          body: z.object({
+            name: z.string().min(1),
+            email: z.email(),
+            password: z.string().min(8),
+          }),
+        },
+      );
+
+    elysia().use(controller);
+
+    return {};
+  };
+
+  return fn;
+});
+
+export default setup;

package/src/modules/surreal.ts

@@ -0,0 +1,58 @@
+import { getConfig } from "../core/config";
+import { makeModule } from "../core/module";
+import { createNodeEngines } from "@surrealdb/node";
+import { Surreal } from "surrealdb";
+
+// SurrealDB's `GROUP ALL` aggregate (used for count queries) throws NotFoundError
+// on a table that has never had a row created, unlike plain SELECT. Defining every
+// table up front avoids that first-run failure (e.g. /api/setup/status before any user exists).
+const ensureTables = async (db: Surreal) => {
+  const { default: userModel } = await import("../models/user");
+  const { default: fileModel } = await import("../models/file");
+
+  const prefixes = new Set<string>([userModel.prefix, fileModel.prefix]);
+
+  for (const factory of getConfig().models) {
+    const { default: model } = await factory();
+    prefixes.add(model.prefix);
+  }
+
+  for (const prefix of prefixes) {
+    await db.query(`DEFINE TABLE IF NOT EXISTS ${prefix} SCHEMALESS;`);
+  }
+};
+
+const surreal = makeModule(() => {
+  let db: Surreal;
+
+  const fn = () => {
+    return db;
+  };
+
+  fn.init = () => {
+    db = new Surreal({
+      engines: createNodeEngines(),
+    });
+
+    return {
+      spin: async () => {
+        const { db: dbConfig } = getConfig();
+        await db.connect(dbConfig.path);
+        await db.use({ namespace: dbConfig.namespace, database: dbConfig.database });
+        await ensureTables(db);
+
+        const shutdown = async () => {
+          await db.close();
+          process.exit(0);
+        };
+
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+      },
+    };
+  };
+
+  return fn;
+});
+
+export default surreal;

package/src/modules/users.ts

@@ -0,0 +1,94 @@
+import { makeModule } from "../core/module";
+import Elysia, { status } from "elysia";
+import z from "zod";
+import auth from "./auth";
+import elysia from "./elysia";
+
+const stripPassword = <T extends { password: unknown }>({ password: _, ...rest }: T) => rest;
+
+const users = makeModule(() => {
+  const fn = () => {};
+
+  fn.init = async () => {
+    const { default: user } = await import("../models/user");
+    const authPlugin = (await auth()).plugin;
+
+    const controller = new Elysia({ prefix: "/api/user" })
+      .use(authPlugin)
+      .get(
+        "/",
+        async ({ query: { search, page, limit, sort, order, filters } }) => {
+          const result = await user.read({ search, page, limit, sort, order, filters });
+
+          return { data: result.data.map(stripPassword), meta: result.meta };
+        },
+        {
+          auth: true,
+          query: z.object({
+            search: z.coerce.string().optional(),
+            page: z.coerce.number().int().positive().default(1),
+            limit: z.coerce.number().int().positive().max(100).default(20),
+            sort: z.coerce.string().optional(),
+            order: z.enum(["asc", "desc"]).default("asc"),
+            filters: z
+              .record(z.string(), z.union([z.coerce.string(), z.record(z.string(), z.coerce.string())]))
+              .optional(),
+          }),
+        },
+      )
+      .get(
+        "/:id",
+        async ({ params }) => {
+          const data = await user.show(params.id);
+
+          return { data: data ? stripPassword(data) : null };
+        },
+        { auth: true, params: z.object({ id: z.coerce.string() }) },
+      )
+      .post(
+        "/",
+        async ({ body }) => {
+          const created = await user.create(body);
+
+          return { data: stripPassword(created) };
+        },
+        { auth: true, body: user.validation },
+      )
+      .put(
+        "/:id",
+        async ({ params, body }) => {
+          const updated = await user.update(params.id, body);
+
+          return { data: stripPassword(updated) };
+        },
+        {
+          auth: true,
+          params: z.object({ id: z.coerce.string() }),
+          body: user.validation.partial(),
+        },
+      )
+      .delete(
+        "/:id",
+        async ({ params, user: actingUser }) => {
+          // The only recovery path for a locked-out instance is a manual DB edit —
+          // setup is permanently disabled once any user exists, so block self-delete.
+          if (params.id === actingUser.id.id) {
+            return status(400, { message: "You cannot delete your own account" });
+          }
+
+          const deleted = await user.destroy(params.id);
+
+          return { data: stripPassword(deleted) };
+        },
+        { auth: true, params: z.object({ id: z.coerce.string() }) },
+      );
+
+    elysia().use(controller);
+
+    return {};
+  };
+
+  return fn;
+});
+
+export default users;

package/src/modules/view.ts

@@ -0,0 +1,247 @@
+import { getConfig } from "../core/config";
+import { HttpError } from "../core/http_error";
+import { makeModule } from "../core/module";
+import { Edge } from "edge.js";
+import Elysia from "elysia";
+import { join } from "path";
+import elysia from "./elysia";
+
+const isDev = process.env.NODE_ENV !== "production";
+const publicDir = join(process.cwd(), "public");
+
+type ViteManifestChunk = {
+  file: string;
+  css?: string[];
+  isEntry?: boolean;
+};
+
+type ViteGlobal = {
+  asset: (entry: string) => string;
+  static: (path: string) => string;
+};
+
+const buildViteGlobal = async (): Promise<ViteGlobal> => {
+  if (isDev) {
+    const { createServer } = await import("vite");
+    const server = await createServer();
+    await server.listen();
+    server.printUrls();
+
+    const url = server.resolvedUrls?.local[0]?.replace(/\/$/, "") ?? "http://localhost:5173";
+
+    process.once("SIGINT", () => server.close());
+    process.once("SIGTERM", () => server.close());
+
+    return {
+      asset: (entry) => {
+        if (entry.endsWith(".css")) {
+          return `<link rel="stylesheet" href="${url}/${entry}">`;
+        }
+        return (
+          `<script type="module" src="${url}/@vite/client"></script>\n` +
+          `<script type="module" src="${url}/${entry}"></script>`
+        );
+      },
+      static: (path) => `${url}/${path.replace(/^\//, "")}`,
+    };
+  }
+
+  const manifestFile = Bun.file(join(publicDir, "manifest.json"));
+
+  if (!(await manifestFile.exists())) {
+    return {
+      asset: () => "<!-- vite manifest not found, run: bun run build -->",
+      static: (path) => `/${path.replace(/^\//, "")}`,
+    };
+  }
+
+  const manifest = (await manifestFile.json()) as Record<string, ViteManifestChunk>;
+
+  return {
+    asset: (entry) => {
+      const chunk = manifest[entry];
+      if (!chunk) return `<!-- vite entry "${entry}" not found in manifest -->`;
+      if (entry.endsWith(".css")) {
+        return `<link rel="stylesheet" href="/${chunk.file}">`;
+      }
+      const styles = chunk.css?.map((f) => `<link rel="stylesheet" href="/${f}">`).join("\n") ?? "";
+      const script = `<script type="module" src="/${chunk.file}"></script>`;
+      return [styles, script].filter(Boolean).join("\n");
+    },
+    static: (path) => `/${path.replace(/^\//, "")}`,
+  };
+};
+
+const view = makeModule(() => {
+  const edge = new Edge();
+
+  const fn = () => edge;
+
+  fn.init = async () => {
+    // process.cwd()-based, not import.meta.dir — once view.ts lives inside node_modules/njin,
+    // import.meta.dir would point at the package's own location, not the consuming project's views.
+    const viewsDir = join(process.cwd(), "src/views");
+    const pagesDir = join(viewsDir, "pages");
+
+    edge.mount(viewsDir);
+
+    edge.global("vite", await buildViteGlobal());
+    // Fallback abort for non-page contexts (components, error templates).
+    // Pages get a per-request override that saves the error before EdgeJS wraps it.
+    edge.global("abort", (statusCode: number, message?: string) => {
+      throw new HttpError(statusCode, message);
+    });
+
+    for (const modelPromise of getConfig().models) {
+      const { default: model } = await modelPromise();
+      edge.global(model.prefix, model);
+    }
+
+    const controller = new Elysia();
+
+    if (!isDev) {
+      controller.get("/assets/*", async ({ params }) => {
+        const file = Bun.file(join(publicDir, "assets", params["*"]));
+        if (!(await file.exists())) return new Response("Not Found", { status: 404 });
+        return file;
+      });
+    }
+
+    const files: string[] = [];
+
+    try {
+      const glob = new Bun.Glob("**/*.edge");
+      for await (const file of glob.scan({ cwd: pagesDir })) {
+        files.push(file);
+      }
+    } catch {
+      elysia().use(controller);
+      return {};
+    }
+
+    for (const file of files) {
+      const route = fileToRoute(file);
+      const template = `pages/${file.replace(/\\/g, "/").replace(/\.edge$/, "")}`;
+
+      controller.get(route, async ({ params, query, path, request, server }) => {
+        // Object property — avoids TypeScript's overly-aggressive narrowing of
+        // closure-assigned variables to `never`.
+        const ctx: { abortErr: HttpError | null } = { abortErr: null };
+
+        try {
+          const html = await edge.render(template, {
+            params,
+            query,
+            request: { path, url: request.url },
+            abort: (statusCode: number, message?: string) => {
+              ctx.abortErr = new HttpError(statusCode, message);
+              throw ctx.abortErr;
+            },
+          });
+
+          // Fire-and-forget — never awaited, so it can't add latency to the response.
+          import("./analytics").then(({ default: analytics, resolveClientIp }) =>
+            analytics().track({
+              path,
+              referrer: request.headers.get("referer"),
+              userAgent: request.headers.get("user-agent"),
+              ip: resolveClientIp(request, server),
+              requestUrl: request.url,
+            }),
+          );
+
+          return new Response(html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
+        } catch (err) {
+          if (ctx.abortErr) {
+            return new Response(await renderHttpError(edge, viewsDir, ctx.abortErr), {
+              status: ctx.abortErr.statusCode,
+              headers: { "Content-Type": "text/html; charset=utf-8" },
+            });
+          }
+          if (!isDev) throw err;
+          return new Response(renderErrorPage(err as Error, template, path), {
+            status: 500,
+            headers: { "Content-Type": "text/html; charset=utf-8" },
+          });
+        }
+      });
+    }
+
+    // Catch-all — must be registered last so specific routes take priority
+    controller.get("/*", async ({ path }) => {
+      if (!isDev) {
+        const staticFile = Bun.file(join(publicDir, path));
+        if (await staticFile.exists()) return staticFile;
+      }
+
+      return new Response(await renderHttpError(edge, viewsDir, new HttpError(404)), {
+        status: 404,
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      });
+    });
+
+    elysia().use(controller);
+
+    return {};
+  };
+
+  return fn;
+});
+
+async function renderHttpError(edge: Edge, viewsDir: string, error: HttpError): Promise<string> {
+  const templateFile = Bun.file(join(viewsDir, `errors/${error.statusCode}.edge`));
+  if (await templateFile.exists()) {
+    try {
+      return await edge.render(`errors/${error.statusCode}`, {
+        statusCode: error.statusCode,
+        message: error.message,
+      });
+    } catch (e) {
+      console.error(`[view] failed to render errors/${error.statusCode}.edge:`, e);
+    }
+  }
+  const code = error.statusCode;
+  return `<!DOCTYPE html><html><head><meta charset="UTF-8"><title>${code} — ${error.message}</title>
+<style>*{margin:0;padding:0;box-sizing:border-box}body{background:#0f172a;color:#e2e8f0;font-family:system-ui,sans-serif;min-height:100vh;display:flex;align-items:center;justify-content:center}
+.c{text-align:center}.n{font-size:6rem;font-weight:700;color:#1e293b;line-height:1}.m{color:#64748b;margin-top:.5rem}a{color:#818cf8;text-decoration:none;margin-top:1.5rem;display:inline-block}</style>
+</head><body><div class="c"><div class="n">${code}</div><p class="m">${error.message}</p><a href="/">← Back to home</a></div></body></html>`;
+}
+
+function renderErrorPage(error: Error, template: string, path: string): string {
+  const stack = (error.stack ?? "").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  const message = error.message.replace(/</g, "&lt;").replace(/>/g, "&gt;");
+
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <title>Error — ${path}</title>
+  <style>
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    body { background: #0f172a; color: #e2e8f0; font-family: ui-monospace, monospace; padding: 2rem; min-height: 100vh; }
+    .badge { display: inline-block; background: #ef4444; color: #fff; font-size: .7rem; font-weight: 700; padding: .2rem .5rem; border-radius: .25rem; letter-spacing: .05em; margin-bottom: 1.5rem; }
+    h1 { font-size: 1.25rem; color: #f87171; margin-bottom: .5rem; word-break: break-word; }
+    .meta { font-size: .8rem; color: #64748b; margin-bottom: 2rem; }
+    .meta span { color: #94a3b8; }
+    pre { background: #1e293b; border: 1px solid #334155; border-radius: .5rem; padding: 1.5rem; font-size: .8rem; line-height: 1.7; overflow-x: auto; white-space: pre-wrap; word-break: break-word; }
+    .label { font-size: .7rem; color: #64748b; text-transform: uppercase; letter-spacing: .1em; margin-bottom: .5rem; }
+  </style>
+</head>
+<body>
+  <div class="badge">500 — DEV MODE</div>
+  <h1>${message}</h1>
+  <p class="meta">Template: <span>${template}</span> &nbsp;·&nbsp; Route: <span>${path}</span></p>
+  <p class="label">Stack trace</p>
+  <pre>${stack}</pre>
+</body>
+</html>`;
+}
+
+function fileToRoute(file: string): string {
+  let route = file.replace(/\\/g, "/").replace(/\.edge$/, "");
+  route = route.replace(/\[([^\]]+)\]/g, ":$1");
+  route = route.replace(/\/index$|^index$/, "");
+  return "/" + route;
+}
+
+export default view;

package/src/spin.ts

@@ -0,0 +1,3 @@
+import { boot } from "./core/boot";
+
+await boot();