@njinlabs/njin 0.1.2 → 0.2.0

package/src/modules/img.ts

@@ -1,137 +1,141 @@
-import { getConfig } from "../core/config";
-import { makeModule } from "../core/module";
-import Elysia from "elysia";
-import elysia from "./elysia";
-import view from "./view";
-
-export function isAllowed(imageUrl: string, requestHost: string, allowedHosts: string[] = getConfig().img.hosts): boolean {
-  if (imageUrl.startsWith("/")) return true;
-
-  let parsed: URL;
-  try {
-    parsed = new URL(imageUrl);
-  } catch {
-    return false;
-  }
-
-  const imageHostname = parsed.hostname;
-  // Strip port — host header may include it (e.g. "localhost:3000")
-  const requestHostname = requestHost.split(":")[0];
-
-  // Same host as the incoming request — works across dev, staging, and production
-  if (imageHostname === requestHostname) return true;
-
-  // localhost variants — covers Vite dev server running on a different port (5173)
-  if (imageHostname === "localhost" || imageHostname === "127.0.0.1") return true;
-
-  // Truly external hosts: require explicit whitelist
-  return allowedHosts.includes(imageHostname);
-}
-
-export function extractFilename(url: string): string {
-  try {
-    const pathname = url.startsWith("/") ? url : new URL(url).pathname;
-    const last = pathname.split("/").filter(Boolean).pop() ?? "image";
-    const name = last.replace(/\.[^.]+$/, "") || "image";
-    return `${name}.webp`;
-  } catch {
-    return "image.webp";
-  }
-}
-
-const img = makeModule(() => {
-  const fn = () => {};
-
-  fn.init = async () => {
-    view().global("imgOptimize", (url: string, options?: { w?: number; h?: number; q?: number }) => {
-      const params = new URLSearchParams({ url });
-      if (options?.w != null) params.set("w", String(options.w));
-      if (options?.h != null) params.set("h", String(options.h));
-      if (options?.q != null) params.set("q", String(options.q));
-      return `/img?${params.toString()}`;
-    });
-
-    const controller = new Elysia();
-
-    controller.get("/img", async ({ query, request }) => {
-      const { url, w, h, q = "80" } = query;
-
-      if (!url) {
-        return new Response("Missing url parameter", { status: 400 });
-      }
-
-      const width = w ? parseInt(w) : undefined;
-      const height = h ? parseInt(h) : undefined;
-      const quality = Math.min(100, Math.max(1, parseInt(q)));
-
-      if (isNaN(quality)) {
-        return new Response("Invalid q parameter", { status: 400 });
-      }
-
-      const requestHost = request.headers.get("host") ?? "";
-
-      if (!isAllowed(url, requestHost)) {
-        return new Response("Host not allowed", { status: 403 });
-      }
-
-      // ETag is deterministic from input params — allows 304 without fetching or processing
-      const etag = `"${Bun.hash(`${url}|${w ?? ""}|${h ?? ""}|${quality}`).toString(16)}"`;
-      const cacheControl = "public, max-age=31536000, immutable";
-
-      if (request.headers.get("if-none-match") === etag) {
-        return new Response(null, {
-          status: 304,
-          headers: { ETag: etag, "Cache-Control": cacheControl },
-        });
-      }
-
-      let imageData: ArrayBuffer;
-
-      if (url.startsWith("/")) {
-        const resp = await fetch(`http://localhost:${getConfig().port}${url}`);
-        if (!resp.ok) return new Response("Image not found", { status: 404 });
-        imageData = await resp.arrayBuffer();
-      } else {
-        const resp = await fetch(url);
-        if (!resp.ok) return new Response("Failed to fetch image", { status: 502 });
-        imageData = await resp.arrayBuffer();
-      }
-
-      const pipeline = new Bun.Image(imageData);
-
-      if (width) {
-        // Bun.Image.resize() takes width first and derives height from aspect ratio
-        // when height is omitted — there's no height-only equivalent, so width-only
-        // and width+height both go through this branch unchanged.
-        pipeline.resize(width, height, { fit: "inside", withoutEnlargement: true });
-      } else if (height) {
-        // Height-only request — derive a proportional width from the source dimensions
-        // since resize() requires a width argument.
-        const meta = await pipeline.metadata();
-        const derivedWidth = Math.round((meta.width / meta.height) * height);
-        pipeline.resize(derivedWidth, height, { fit: "inside", withoutEnlargement: true });
-      }
-
-      const output = await pipeline.webp({ quality }).buffer();
-      const filename = extractFilename(url);
-
-      return new Response(new Uint8Array(output), {
-        headers: {
-          "Content-Type": "image/webp",
-          "Content-Length": String(output.byteLength),
-          "Content-Disposition": `inline; filename="${filename}"`,
-          "Cache-Control": cacheControl,
-          ETag: etag,
-          Vary: "Accept",
-        },
-      });
-    });
-
-    elysia().use(controller);
-    return {};
-  };
-
-  return fn;
-});
-
-export default img;
+import { getConfig } from "../core/config";
+import { makeModule } from "../core/module";
+import Elysia from "elysia";
+import elysia from "./elysia";
+import view from "./view";
+
+export function isAllowed(imageUrl: string, allowedHosts: string[] = getConfig().img.hosts): boolean {
+  if (imageUrl.startsWith("/")) return true;
+
+  let parsed: URL;
+  try {
+    parsed = new URL(imageUrl);
+  } catch {
+    return false;
+  }
+
+  const imageHostname = parsed.hostname;
+
+  // localhost variants are only trusted outside production — covers the Vite dev
+  // server running on a different port (5173). Trusting the client-supplied `Host`
+  // header, or allowing loopback unconditionally, would turn this into an SSRF
+  // primitive (an attacker controls both the `url` query param and their own
+  // request's `Host` header), so neither is honored here.
+  if (process.env.NODE_ENV !== "production" && (imageHostname === "localhost" || imageHostname === "127.0.0.1")) return true;
+
+  // Every other host: require explicit whitelist
+  return allowedHosts.includes(imageHostname);
+}
+
+export function extractFilename(url: string): string {
+  try {
+    const pathname = url.startsWith("/") ? url : new URL(url).pathname;
+    const last = pathname.split("/").filter(Boolean).pop() ?? "image";
+    const name = last.replace(/\.[^.]+$/, "") || "image";
+    return `${name}.webp`;
+  } catch {
+    return "image.webp";
+  }
+}
+
+const img = makeModule(() => {
+  const fn = () => {};
+
+  fn.init = async () => {
+    view().global("imgOptimize", (url: string, options?: { w?: number; h?: number; q?: number }) => {
+      const params = new URLSearchParams({ url });
+      if (options?.w != null) params.set("w", String(options.w));
+      if (options?.h != null) params.set("h", String(options.h));
+      if (options?.q != null) params.set("q", String(options.q));
+      return `/img?${params.toString()}`;
+    });
+
+    const controller = new Elysia();
+
+    controller.get("/img", async ({ query, request }) => {
+      const { url, w, h, q = "80" } = query;
+
+      if (!url) {
+        return new Response("Missing url parameter", { status: 400 });
+      }
+
+      const width = w ? parseInt(w) : undefined;
+      const height = h ? parseInt(h) : undefined;
+      const quality = Math.min(100, Math.max(1, parseInt(q)));
+
+      if (isNaN(quality)) {
+        return new Response("Invalid q parameter", { status: 400 });
+      }
+
+      if (!isAllowed(url)) {
+        return new Response("Host not allowed", { status: 403 });
+      }
+
+      // ETag is deterministic from input params — allows 304 without fetching or processing
+      const etag = `"${Bun.hash(`${url}|${w ?? ""}|${h ?? ""}|${quality}`).toString(16)}"`;
+      const cacheControl = "public, max-age=31536000, immutable";
+
+      if (request.headers.get("if-none-match") === etag) {
+        return new Response(null, {
+          status: 304,
+          headers: { ETag: etag, "Cache-Control": cacheControl },
+        });
+      }
+
+      let imageData: ArrayBuffer;
+
+      if (url.startsWith("/")) {
+        const resp = await fetch(`http://localhost:${getConfig().port}${url}`);
+        if (!resp.ok) return new Response("Image not found", { status: 404 });
+        imageData = await resp.arrayBuffer();
+      } else {
+        // `redirect: "error"` — a validated host redirecting to an unvalidated
+        // (e.g. internal) one would otherwise silently defeat the isAllowed() check above.
+        let resp: Response;
+        try {
+          resp = await fetch(url, { redirect: "error" });
+        } catch {
+          return new Response("Failed to fetch image", { status: 502 });
+        }
+        if (!resp.ok) return new Response("Failed to fetch image", { status: 502 });
+        imageData = await resp.arrayBuffer();
+      }
+
+      const pipeline = new Bun.Image(imageData);
+
+      if (width) {
+        // Bun.Image.resize() takes width first and derives height from aspect ratio
+        // when height is omitted — there's no height-only equivalent, so width-only
+        // and width+height both go through this branch unchanged.
+        pipeline.resize(width, height, { fit: "inside", withoutEnlargement: true });
+      } else if (height) {
+        // Height-only request — derive a proportional width from the source dimensions
+        // since resize() requires a width argument.
+        const meta = await pipeline.metadata();
+        const derivedWidth = Math.round((meta.width / meta.height) * height);
+        pipeline.resize(derivedWidth, height, { fit: "inside", withoutEnlargement: true });
+      }
+
+      const output = await pipeline.webp({ quality }).buffer();
+      const filename = extractFilename(url);
+
+      return new Response(new Uint8Array(output), {
+        headers: {
+          "Content-Type": "image/webp",
+          "Content-Length": String(output.byteLength),
+          "Content-Disposition": `inline; filename="${filename}"`,
+          "Cache-Control": cacheControl,
+          ETag: etag,
+          Vary: "Accept",
+        },
+      });
+    });
+
+    elysia().use(controller);
+    return {};
+  };
+
+  return fn;
+});
+
+export default img;

package/src/modules/plugin.ts

@@ -0,0 +1,17 @@
+import { getConfig } from "../core/config";
+import { makeModule } from "../core/module";
+
+const plugin = makeModule(() => {
+  const fn = () => {};
+
+  fn.init = async () => {
+    // Sequential, awaited, and never caught — a plugin whose init() throws must fail
+    // boot loudly, same contract as hook/event side-effect imports in api.ts.
+    for (const init of getConfig().pluginInits) await init();
+    return {};
+  };
+
+  return fn;
+});
+
+export default plugin;

package/src/modules/surreal.ts

@@ -1,7 +1,12 @@
 import { getConfig } from "../core/config";
 import { makeModule } from "../core/module";
-import { createNodeEngines } from "@surrealdb/node";
-import { Surreal } from "surrealdb";
+import { Surreal, createRemoteEngines } from "surrealdb";
+import type { Engines } from "surrealdb";
+
+const REMOTE_SCHEMES = ["ws://", "wss://", "http://", "https://"];
+const EMBEDDED_SCHEMES = ["mem://", "rocksdb://", "surrealkv://"];
+
+export const isRemotePath = (path: string) => REMOTE_SCHEMES.some((scheme) => path.startsWith(scheme));
 
 // SurrealDB's `GROUP ALL` aggregate (used for count queries) throws NotFoundError
 // on a table that has never had a row created, unlike plain SELECT. Defining every
@@ -10,7 +15,7 @@ const ensureTables = async (db: Surreal) => {
   const { default: userModel } = await import("../models/user");
   const { default: fileModel } = await import("../models/file");
 
-  const prefixes = new Set<string>([userModel.prefix, fileModel.prefix]);
+  const prefixes = new Set<string>([userModel.prefix, fileModel.prefix, "vars"]);
 
   for (const factory of getConfig().models) {
     const { default: model } = await factory();
@@ -29,18 +34,38 @@ const surreal = makeModule(() => {
     return db;
   };
 
-  fn.init = () => {
-    db = new Surreal({
-      engines: createNodeEngines(),
-    });
+  // Connect during init(), not spin() — init() calls for every module run (in
+  // src/config/module.ts's array construction) before any module's spin() runs, and a
+  // plugin's own init() (src/modules/plugin.ts) may query the DB (e.g. reading its own
+  // vars group) as part of its own setup. Deferring the actual connect to spin() left a
+  // window where `surreal()` returned an instance that existed but had never connected,
+  // so any DB call made from a plugin's init() failed with ConnectionUnavailableError.
+  fn.init = async () => {
+    const { db: dbConfig } = getConfig();
 
-    return {
-      spin: async () => {
-        const { db: dbConfig } = getConfig();
-        await db.connect(dbConfig.path);
-        await db.use({ namespace: dbConfig.namespace, database: dbConfig.database });
-        await ensureTables(db);
+    let engines: Engines;
+    if (isRemotePath(dbConfig.path)) {
+      engines = createRemoteEngines();
+    } else if (EMBEDDED_SCHEMES.some((scheme) => dbConfig.path.startsWith(scheme))) {
+      // Dynamically imported (not a static top-level import) so a compiled build whose
+      // config resolves to a remote db.path can exclude @surrealdb/node entirely — see
+      // src/cli/build.ts, which externalizes this package for remote-only builds since its
+      // native binding loader runs eagerly on import, not lazily on first use.
+      const { createNodeEngines } = await import("@surrealdb/node");
+      engines = createNodeEngines();
+    } else {
+      throw new Error(
+        `Unrecognized db.path scheme: "${dbConfig.path}" — expected one of ${EMBEDDED_SCHEMES.join(", ")} (embedded) or ${REMOTE_SCHEMES.join(", ")} (remote)`,
+      );
+    }
 
+    db = new Surreal({ engines });
+    await db.connect(dbConfig.path, { authentication: dbConfig.auth });
+    await db.use({ namespace: dbConfig.namespace, database: dbConfig.database });
+    await ensureTables(db);
+
+    return {
+      spin: () => {
         const shutdown = async () => {
           await db.close();
           process.exit(0);

package/src/modules/vars.ts

@@ -0,0 +1,34 @@
+import { getConfig } from "../core/config";
+import { makeModule } from "../core/module";
+import Elysia from "elysia";
+import auth from "./auth";
+import elysia from "./elysia";
+
+const vars = makeModule(() => {
+  const fn = () => {};
+
+  fn.init = async () => {
+    const groups = getConfig().vars;
+    const authPlugin = await auth();
+
+    for (const promise of groups) {
+      const { default: group } = await promise();
+
+      const controller = new Elysia({ prefix: `/api/vars/${group.prefix}` })
+        .use(authPlugin.plugin)
+        .get("/", async () => ({ data: await group.get() }), { auth: true })
+        .put("/", async ({ body }) => ({ data: await group.update(body) }), {
+          auth: true,
+          body: group.validation.partial(),
+        });
+
+      elysia().use(controller);
+    }
+
+    return {};
+  };
+
+  return fn;
+});
+
+export default vars;

package/src/modules/view.ts

@@ -20,7 +20,7 @@ type ViteGlobal = {
   static: (path: string) => string;
 };
 
-const buildViteGlobal = async (): Promise<ViteGlobal> => {
+export const buildViteGlobal = async (): Promise<ViteGlobal> => {
   if (isDev) {
     const { createServer } = await import("vite");
     const server = await createServer();
@@ -97,6 +97,11 @@ const view = makeModule(() => {
       edge.global(model.prefix, model);
     }
 
+    for (const varsPromise of getConfig().vars) {
+      const { default: group } = await varsPromise();
+      edge.global(group.prefix, group);
+    }
+
     const controller = new Elysia();
 
     if (!isDev) {
@@ -188,7 +193,7 @@ const view = makeModule(() => {
   return fn;
 });
 
-async function renderHttpError(edge: Edge, viewsDir: string, error: HttpError): Promise<string> {
+export async function renderHttpError(edge: Edge, viewsDir: string, error: HttpError): Promise<string> {
   const templateFile = Bun.file(join(viewsDir, `errors/${error.statusCode}.edge`));
   if (await templateFile.exists()) {
     try {
@@ -207,7 +212,7 @@ async function renderHttpError(edge: Edge, viewsDir: string, error: HttpError):
 </head><body><div class="c"><div class="n">${code}</div><p class="m">${error.message}</p><a href="/">← Back to home</a></div></body></html>`;
 }
 
-function renderErrorPage(error: Error, template: string, path: string): string {
+export function renderErrorPage(error: Error, template: string, path: string): string {
   const stack = (error.stack ?? "").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   const message = error.message.replace(/</g, "&lt;").replace(/>/g, "&gt;");
 
@@ -237,7 +242,7 @@ function renderErrorPage(error: Error, template: string, path: string): string {
 </html>`;
 }
 
-function fileToRoute(file: string): string {
+export function fileToRoute(file: string): string {
   let route = file.replace(/\\/g, "/").replace(/\.edge$/, "");
   route = route.replace(/\[([^\]]+)\]/g, ":$1");
   route = route.replace(/\/index$|^index$/, "");