@nodefony/http 10.0.0-alpha.9 → 10.0.0-beta.2

package/dist/nodefony/service/certificates.js

@@ -1,11 +1,14 @@
+import { asServersConfig } from "../src/servers/kernelServers.js";
+import { SHA1_WITH_RSA_OID, createSelfSignedCertificate, distinguishedNameField, parseSubjectAltName, signatureAlgorithmName, signatureAlgorithmOid } from "./x509.js";
 import { Service, extend } from "nodefony";
-import { randomBytes } from "node:crypto";
+import { X509Certificate, generateKeyPair, randomBytes } from "node:crypto";
 import fsp from "node:fs/promises";
 import path, { resolve } from "node:path";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
 //#region nodefony/service/certificates.ts
 const execFileAsync = promisify(execFile);
+const generateKeyPairAsync = promisify(generateKeyPair);
 /**
 * Vrai si `host` est une IP littérale (IPv4 `n.n.n.n` ou IPv6 — contient `:`).
 * Une IP doit aller en SAN `iPAddress`, jamais en `dNSName` (RFC 6125).
@@ -35,7 +38,7 @@ const defaultOptions = {
 *
 * Trois stratégies : `explicit` (certificat fourni en config — le cas de
 * PRODUCTION), `mkcert` (CA locale trustée, confort de dev) et `selfsigned`
-* (auto-signé node-forge, secours). La génération est réservée au
+* (auto-signé, secours). La génération est réservée au
 * DÉVELOPPEMENT : en production sans certificat fourni, le service crie un
 * avertissement (Nodefony n'est pas une autorité de certification).
 *
@@ -48,7 +51,6 @@ var Certificate = class Certificate extends Service {
 	module;
 	files = [];
 	keysPair = null;
-	certForge = null;
 	ca = "";
 	key = "";
 	cert = "";
@@ -58,13 +60,6 @@ var Certificate = class Certificate extends Service {
 	intermediateCertPem = "";
 	/** CAROOT résolu de mkcert (null tant que non détecté / indisponible). */
 	mkcertCaRoot = null;
-	/**
-	* Backend crypto node-forge, chargé PARESSEUSEMENT. La génération de
-	* certificat est un confort de DÉVELOPPEMENT : en production avec un
-	* certificat fourni (`strategy: "explicit"`), cette grosse dépendance n'est
-	* jamais importée (règle perf-mémoire — pas de dep chargée « au cas où »).
-	*/
-	forge = null;
 	path = resolve(".", "nodefony", "config", "certificates");
 	serverPath = resolve(this.path, "server");
 	caPath = resolve(this.path, "ca", "nodefony-root-ca.crt.pem");
@@ -85,20 +80,6 @@ var Certificate = class Certificate extends Service {
 		return this.kernel?.environment === "development";
 	}
 	/**
-	* Charge node-forge à la demande (idempotent) — uniquement sur le chemin de
-	* GÉNÉRATION (selfsigned / mkcert / inspection). Le chemin `explicit` (prod)
-	* ne l'appelle jamais.
-	*/
-	async loadForge() {
-		if (!this.forge) this.forge = (await import("node-forge")).default;
-		return this.forge;
-	}
-	/** Accès au backend forge déjà chargé (lève si `loadForge` n'a pas été appelé). */
-	get forgeLib() {
-		if (!this.forge) throw new Error("node-forge non chargé — appeler loadForge() avant toute génération.");
-		return this.forge;
-	}
-	/**
 	* Fabrique-t-on un certificat au démarrage ?
 	*
 	* 🔴 Seulement si un serveur TLS est ACTIF. Sans cette question, le hook
@@ -120,7 +101,7 @@ var Certificate = class Certificate extends Service {
 	* exemplaire. La promesse était écrite ; rien ne la tenait.
 	*/
 	get tlsWanted() {
-		return !!this.module.kernel?.options?.servers?.https;
+		return !!asServersConfig(this.module.kernel?.options.servers)?.https;
 	}
 	async init() {
 		if (!this.tlsWanted) return this;
@@ -138,8 +119,8 @@ var Certificate = class Certificate extends Service {
 	*/
 	static generateSerialHex() {
 		const bytes = randomBytes(16);
-		bytes[0] &= 127;
-		if (bytes[0] === 0) bytes[0] = 1;
+		const head = bytes.readUInt8(0) & 127;
+		bytes[0] = head === 0 ? 1 : head;
 		return bytes.toString("hex");
 	}
 	setFiles() {
@@ -179,7 +160,7 @@ var Certificate = class Certificate extends Service {
 			path.dirname(this.certPath),
 			path.dirname(this.fullchainPath)
 		];
-		for await (const directory of directories) try {
+		for (const directory of directories) try {
 			await fsp.access(directory);
 		} catch {
 			await fsp.mkdir(directory, { recursive: true });
@@ -189,7 +170,7 @@ var Certificate = class Certificate extends Service {
 	/**
 	* Génère (ou recharge) le certificat serveur selon la stratégie résolue :
 	* `explicit` (fourni en config / prod), `mkcert` (dev, CA trustée) ou
-	* `selfsigned` (auto-signé node-forge, secours). Régénère automatiquement si
+	* `selfsigned` (auto-signé, secours). Régénère automatiquement si
 	* le certificat présent sur disque n'est pas adéquat pour la stratégie active
 	* (expiré, SHA-1, SAN incomplet).
 	*
@@ -200,17 +181,13 @@ var Certificate = class Certificate extends Service {
 		await this.ensureDirectoriesExist();
 		const strategy = await this.resolveStrategy();
 		if (strategy === "explicit") return this.loadExplicitCert();
-		await this.loadForge();
 		if (await this.checkCertificates() && !force && await this.isCertAdequate(strategy)) return this.readCerticates();
 		if (strategy === "mkcert") await this.generateWithMkcert();
 		else {
-			this.keysPair = this.generateKeys();
-			this.certForge = this.createCertificate();
-			this.setExtension();
-			this.sign();
+			this.keysPair = await this.generateKeys();
 			this.key = this.generatePrivateKeyPem();
 			this.publicKeyPem = this.generatePublickeyPem();
-			const certPem = this.generateCertPem();
+			const certPem = await this.createCertificate();
 			this.cert = certPem;
 			this.ca = certPem;
 			this.fullchainPem = this.createFullChain();
@@ -226,7 +203,7 @@ var Certificate = class Certificate extends Service {
 	*   erreur si absents.
 	* - `mkcert` : dev + binaire mkcert + CA locale présents. Forcé hors dev →
 	*   retombe sur `selfsigned` avec avertissement.
-	* - `selfsigned` : auto-signé node-forge (fallback). En PRODUCTION, crie un
+	* - `selfsigned` : auto-signé (fallback). En PRODUCTION, crie un
 	*   avertissement : la génération n'est pas le rôle d'un serveur de prod.
 	*/
 	async resolveStrategy() {
@@ -237,13 +214,13 @@ var Certificate = class Certificate extends Service {
 		}
 		if (requested === "auto" && this.hasExplicitCert()) return "explicit";
 		if (requested === "mkcert" || requested === "auto") {
-			if (this.isDev() && this.certOptions.dev?.useMkcert !== false) {
+			if (this.isDev() && this.certOptions.dev.useMkcert !== false) {
 				const caRoot = await this.detectMkcert();
 				if (caRoot) {
 					this.mkcertCaRoot = caRoot;
 					return "mkcert";
 				}
-				this.log((requested === "mkcert" ? "strategy='mkcert' mais mkcert introuvable — " : "mkcert introuvable — ") + "fallback certificat auto-signé node-forge (non trusté). `brew install mkcert nss && mkcert -install` pour un HTTPS dev sans erreur (HMR cross-origin/WSS).", "WARNING");
+				this.log((requested === "mkcert" ? "strategy='mkcert' mais mkcert introuvable — " : "mkcert introuvable — ") + "fallback certificat auto-signé (non trusté). `brew install mkcert nss && mkcert -install` pour un HTTPS dev sans erreur (HMR cross-origin/WSS).", "WARNING");
 			} else if (requested === "mkcert") this.log("strategy='mkcert' ignoré hors development → certificat auto-signé.", "WARNING");
 		}
 		if (!this.isDev()) this.log("Aucun certificat TLS fourni en PRODUCTION : génération d'un auto-signé NON trusté (secours). Nodefony n'est PAS une autorité de certification de production — fournissez un vrai certificat (Let's Encrypt, ingress k8s, reverse-proxy edge) via certificates.{ key, cert, ca } (strategy='explicit').", "WARNING");
@@ -320,8 +297,10 @@ var Certificate = class Certificate extends Service {
 		await this.restrictPrivateKey();
 		const rootCaPem = await fsp.readFile(path.join(caRoot, "rootCA.pem"), "utf8");
 		const certPem = await fsp.readFile(this.certPath, "utf8");
-		const { pki } = this.forgeLib;
-		const publicKeyPem = pki.publicKeyToPem(pki.certificateFromPem(certPem).publicKey);
+		const publicKeyPem = new X509Certificate(certPem).publicKey.export({
+			type: "spki",
+			format: "pem"
+		});
 		await fsp.writeFile(this.publicKeyPath, publicKeyPem, "utf8");
 		await fsp.writeFile(this.fullchainPath, `${certPem}${rootCaPem}`, "utf8");
 		await fsp.writeFile(this.caPath, rootCaPem, "utf8");
@@ -338,25 +317,21 @@ var Certificate = class Certificate extends Service {
 	*/
 	async isCertAdequate(strategy) {
 		try {
-			const { pki } = this.forgeLib;
-			const certPem = await fsp.readFile(this.certPath, "utf8");
-			const cert = pki.certificateFromPem(certPem);
-			if (cert.validity.notAfter.getTime() <= Date.now()) return false;
-			const ext = cert.getExtension("subjectAltName");
-			if (!ext || !this.sanCovers(ext.altNames ?? [])) return false;
+			const cert = new X509Certificate(await fsp.readFile(this.certPath));
+			if (cert.validToDate.getTime() <= Date.now()) return false;
+			if (!this.sanCovers(parseSubjectAltName(cert.subjectAltName).dns)) return false;
 			if (strategy === "mkcert") {
-				const org = cert.issuer.getField("O");
-				return Boolean(org && /mkcert/i.test(String(org.value)));
+				const org = distinguishedNameField(cert.issuer, "O");
+				return org !== null && /mkcert/i.test(org);
 			}
-			return cert.signatureOid !== pki.oids.sha1WithRSAEncryption;
+			return signatureAlgorithmOid(cert.raw) !== SHA1_WITH_RSA_OID;
 		} catch {
 			return false;
 		}
 	}
 	/** Le SAN présent couvre-t-il tous les noms DNS requis (RFC 6125) ? */
-	sanCovers(present) {
-		const presentDns = new Set(present.filter((p) => p.type === 2 && p.value).map((p) => p.value));
-		return this.sanDnsNames().every((name) => presentDns.has(name));
+	sanCovers(presentDns) {
+		return this.sanDnsNames().every((name) => presentDns.includes(name));
 	}
 	/** Charge un certificat fourni en config (chemin fichier ou Buffer). */
 	async loadExplicitCert() {
@@ -401,7 +376,7 @@ var Certificate = class Certificate extends Service {
 	}
 	async writeCertificates(force = false) {
 		await this.ensureDirectoriesExist();
-		for await (const file of this.files) try {
+		for (const file of this.files) try {
 			if (file.variable) {
 				const mode = file.path === this.privateKeyPath ? this.certOptions.privateKeyMode ?? 384 : 420;
 				if (force) await fsp.rm(file.path, { force: true });
@@ -442,86 +417,58 @@ var Certificate = class Certificate extends Service {
 			this.log(err, "DEBUG");
 		}
 	}
-	generateKeys() {
-		return this.forgeLib.pki.rsa.generateKeyPair(this.certOptions.selfSigned.size);
+	/** Génère la paire RSA (taille configurée) hors de la boucle d'événements. */
+	async generateKeys() {
+		return generateKeyPairAsync("rsa", { modulusLength: this.certOptions.selfSigned.size });
 	}
+	/** Clé privée en PEM PKCS#1 (`BEGIN RSA PRIVATE KEY`). */
 	generatePrivateKeyPem() {
-		if (this.keysPair) return Buffer.from(this.forgeLib.pki.privateKeyToPem(this.keysPair.privateKey));
-		throw new Error(`pki.rsa.KeyPair  not found`);
+		if (this.keysPair) return Buffer.from(this.keysPair.privateKey.export({
+			type: "pkcs1",
+			format: "pem"
+		}));
+		throw new Error(`KeyPair not found`);
 	}
+	/** Clé publique en PEM SPKI (`BEGIN PUBLIC KEY`). */
 	generatePublickeyPem() {
-		if (this.keysPair) return Buffer.from(this.forgeLib.pki.publicKeyToPem(this.keysPair.publicKey));
-		throw new Error(`pki.rsa.KeyPair  not found`);
+		if (this.keysPair) return Buffer.from(this.keysPair.publicKey.export({
+			type: "spki",
+			format: "pem"
+		}));
+		throw new Error(`KeyPair not found`);
 	}
-	generateCertPem() {
-		if (this.certForge) return Buffer.from(this.forgeLib.pki.certificateToPem(this.certForge));
-		throw new Error(`pki.Certificate  not found`);
-	}
-	createCertificate() {
+	/**
+	* Fabrique et signe le certificat auto-signé avec la paire courante.
+	*
+	* Série aléatoire unique (RFC 5280 §4.1.2.2), `notBefore` reculé (décalage
+	* d'horloge du client), SAN DNS + IP (config explicite sinon dérivé), signé
+	* avec le hachage configuré — jamais SHA-1 (collision SHAttered 2017,
+	* CA/Browser Forum depuis 2016).
+	*
+	* @returns le certificat en PEM
+	* @throws Si la paire de clés n'a pas été générée
+	*/
+	async createCertificate() {
 		if (!this.keysPair) throw new Error(`KeyPair  not found`);
 		const o = this.certOptions.selfSigned;
-		const cert = this.forgeLib.pki.createCertificate();
-		cert.publicKey = this.keysPair.publicKey;
-		cert.serialNumber = Certificate.generateSerialHex();
-		const backdateMs = o.backdateMinutes * 6e4;
-		const start = Date.now() - backdateMs;
-		cert.validity.notBefore = new Date(start);
-		cert.validity.notAfter = new Date(start + o.validityDays * 864e5);
-		cert.setSubject(o.attrs);
-		cert.setIssuer(o.attrs);
-		return cert;
-	}
-	/** subjectAltName de l'auto-signé : DNS + IP (config explicite sinon dérivé). */
-	altNames() {
-		const out = [];
-		for (const dns of this.sanDnsNames()) out.push({
-			type: 2,
-			value: dns
-		});
-		for (const ip of this.sanIps()) out.push({
-			type: 7,
-			ip
+		const start = Date.now() - o.backdateMinutes * 6e4;
+		const pem = await createSelfSignedCertificate({
+			privateKey: this.keysPair.privateKey,
+			publicKey: this.keysPair.publicKey,
+			serialHex: Certificate.generateSerialHex(),
+			notBefore: new Date(start),
+			notAfter: new Date(start + o.validityDays * 864e5),
+			attributes: o.attrs,
+			dns: this.sanDnsNames(),
+			ip: this.sanIps(),
+			hash: this.allowedHash(o.hash)
 		});
-		return out;
-	}
-	setExtension() {
-		if (!this.certForge) throw new Error(`pki.Certificate  not found`);
-		this.certForge.setExtensions([
-			{
-				name: "basicConstraints",
-				cA: false
-			},
-			{
-				name: "keyUsage",
-				digitalSignature: true,
-				keyEncipherment: true
-			},
-			{
-				name: "extKeyUsage",
-				serverAuth: true,
-				clientAuth: true
-			},
-			{
-				name: "subjectAltName",
-				altNames: this.altNames()
-			},
-			{ name: "subjectKeyIdentifier" }
-		]);
-	}
-	/**
-	* Signe le certificat avec le hachage configuré (SHA-256 par défaut).
-	* SHA-1 est INTERDIT (collision SHAttered 2017, CA/Browser Forum depuis 2016) :
-	* `node-forge` signe en SHA-1 par défaut si on ne passe pas de digest → on en
-	* passe toujours un.
-	*/
-	sign() {
-		if (!this.certForge || !this.keysPair) throw new Error(`pki.rsa.KeyPair or pki.Certificate  not found`);
-		this.certForge.sign(this.keysPair.privateKey, this.digestFor(this.certOptions.selfSigned.hash));
+		return Buffer.from(pem);
 	}
 	/**
 	* Résumé introspectable du certificat serveur courant — réutilisé par la
 	* commande CLI `certificates` et un futur endpoint d'admin Studio (parité
-	* CLI ↔ Web). Parse le certificat chargé (charge node-forge à la demande).
+	* CLI ↔ Web).
 	*/
 	async describe() {
 		const info = {
@@ -535,34 +482,30 @@ var Certificate = class Certificate extends Service {
 			info.caPath = this.caPath;
 		} catch {}
 		if (!this.cert) return info;
-		const { pki } = await this.loadForge();
 		try {
-			const cert = pki.certificateFromPem(this.cert.toString());
-			info.serial = cert.serialNumber;
-			info.validFrom = cert.validity.notBefore.toISOString();
-			info.validTo = cert.validity.notAfter.toISOString();
-			info.signatureAlgorithm = this.oidName(cert.signatureOid, pki);
-			const cn = cert.subject.getField("CN");
-			if (cn) info.commonName = String(cn.value);
-			const ext = cert.getExtension("subjectAltName");
-			if (ext?.altNames) info.san = ext.altNames.map((a) => a.type === 7 ? a.ip ?? "" : a.value ?? "");
+			const cert = new X509Certificate(this.cert);
+			info.serial = cert.serialNumber.toLowerCase();
+			info.validFrom = cert.validFromDate.toISOString();
+			info.validTo = cert.validToDate.toISOString();
+			info.signatureAlgorithm = signatureAlgorithmName(signatureAlgorithmOid(cert.raw));
+			const cn = cert.subject ? distinguishedNameField(cert.subject, "CN") : null;
+			if (cn !== null) info.commonName = cn;
+			const san = parseSubjectAltName(cert.subjectAltName);
+			if (san.dns.length > 0 || san.ip.length > 0) info.san = [...san.dns, ...san.ip];
 		} catch {}
 		return info;
 	}
-	/** Nom lisible de l'OID d'algorithme de signature. */
-	oidName(oid, pki) {
-		return pki.oids[oid] ?? oid;
-	}
-	/** Digest node-forge correspondant au hachage configuré (jamais SHA-1). */
-	digestFor(hash) {
-		const { md } = this.forgeLib;
+	/** Hachage configuré, ramené à SHA-256 s'il sort du contrat (jamais SHA-1). */
+	allowedHash(hash) {
 		switch (hash) {
-			case "sha512": return md.sha512.create();
-			case "sha384": return md.sha384.create();
-			case "sha256": return md.sha256.create();
-			default:
-				this.log(`Hachage '${hash}' refusé (SHA-1 interdit) → SHA-256.`, "WARNING");
-				return md.sha256.create();
+			case "sha512":
+			case "sha384":
+			case "sha256": return hash;
+			default: {
+				const refused = hash;
+				this.log(`Hachage '${refused}' refusé (SHA-1 interdit) → SHA-256.`, "WARNING");
+				return "sha256";
+			}
 		}
 	}
 };

package/dist/nodefony/service/error-renderer.js

@@ -111,7 +111,7 @@ function toValidationFields(error) {
 function toValidationError(error, fields) {
 	const summary = fields.map((f) => f.field ? `${f.field}: ${f.message}` : f.message).join(" · ");
 	const validation = new nodefonyError(`Validation failed — ${summary}`, VALIDATION_STATUS);
-	validation.stack = error.stack;
+	if (error.stack !== void 0) validation.stack = error.stack;
 	validation.fields = fields;
 	return validation;
 }
@@ -206,8 +206,11 @@ function malformedIdentifierOf(error) {
 		const candidate = current;
 		if (candidate.name === "CastError" && (candidate.kind === "ObjectId" || candidate.kind === "UUID") && (typeof candidate.value === "string" || typeof candidate.value === "number")) return String(candidate.value);
 		if (String(candidate.code) === "22P02") {
-			const match = PG_INVALID_INPUT.exec(candidate.message ?? "");
-			if (match && IDENTIFIER_COLUMN_TYPES.has(match[1])) return match[2];
+			const match = PG_INVALID_INPUT.exec(candidate.message);
+			if (match) {
+				const [, type = "", value = null] = match;
+				if (IDENTIFIER_COLUMN_TYPES.has(type)) return value;
+			}
 		}
 		current = candidate.cause;
 	}
@@ -307,7 +310,7 @@ function schemaMismatchOf(error) {
 	for (let depth = 0; depth < 5 && current instanceof Error; depth += 1) {
 		const candidate = current;
 		if (candidate.code !== void 0 && SCHEMA_MISMATCH_CODES.has(String(candidate.code)) || candidate.errno !== void 0 && SCHEMA_MISMATCH_CODES.has(String(candidate.errno))) return "certain";
-		if (String(candidate.code) === "SQLITE_ERROR" && SQLITE_SCHEMA_PREFIXES.some((p) => candidate.message?.startsWith(p))) return "probable";
+		if (String(candidate.code) === "SQLITE_ERROR" && SQLITE_SCHEMA_PREFIXES.some((p) => candidate.message.startsWith(p))) return "probable";
 		current = candidate.cause;
 	}
 	return null;
@@ -373,7 +376,7 @@ var DefaultErrorRenderer = class {
 		const httpError = this.toHttpError(error, context);
 		const rawCode = httpError.code;
 		let code = typeof rawCode === "number" && Number.isInteger(rawCode) ? rawCode : 500;
-		if (context && context.rejected === false) code = toWsCloseCode(code);
+		if (context.rejected === false) code = toWsCloseCode(code);
 		else if (code > 599) code = 500;
 		const internal = code === 1011 || code >= 500 && code <= 599;
 		const reason = isProduction() && internal ? OPAQUE_SERVER_ERROR : httpError.message;
@@ -392,20 +395,20 @@ var DefaultErrorRenderer = class {
 		}
 		if (isUniqueViolation(error)) {
 			const conflict = new nodefonyError(UNIQUE_VIOLATION_MESSAGE, CONFLICT_STATUS);
-			conflict.stack = error.stack;
+			if (error.stack !== void 0) conflict.stack = error.stack;
 			return new HttpError(conflict, CONFLICT_STATUS, context);
 		}
 		const referencedBy = referencedByOf(error);
 		if (referencedBy !== null) {
 			const conflict = new nodefonyError(`Conflict — this resource is still referenced by ${referencedBy}`, CONFLICT_STATUS);
-			conflict.stack = error.stack;
+			if (error.stack !== void 0) conflict.stack = error.stack;
 			return new HttpError(conflict, CONFLICT_STATUS, context);
 		}
 		const malformed = malformedIdentifierOf(error);
 		if (malformed !== null) {
 			const status = malformedIdentifierStatus(malformed, context?.url);
 			const refused = new nodefonyError(status === 404 ? "Not Found — this identifier cannot designate any resource" : "Bad Request — malformed identifier", status);
-			refused.stack = error.stack;
+			if (error.stack !== void 0) refused.stack = error.stack;
 			return new HttpError(refused, status, context);
 		}
 		const code = error.code;