@nullix/zod-mongoose-studio 3.3.0 → 3.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nullix/zod-mongoose-studio",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "description": "Monaco-powered TypeScript playground for @nullix/zod-mongoose",
   "main": "./nuxt.config.ts",
   "bin": {
@@ -39,12 +39,13 @@
     "provenance": true
   },
   "dependencies": {
+    "acorn": "8.16.0",
     "esbuild": "0.28.0",
     "get-port-please": "3.2.0",
     "mongoose": "9.6.3",
     "open": "11.0.0",
     "zod": "4.3.6",
-    "@nullix/zod-mongoose": "3.3.0"
+    "@nullix/zod-mongoose": "3.3.2"
   },
   "devDependencies": {
     "@nuxt/ui": "4.6.0",
@@ -57,10 +58,12 @@
     "vue-tsc": "3.2.6"
   },
   "scripts": {
-    "build": "nuxt build || echo 'Build finished with warnings'",
+    "generate:editor-types": "node scripts/generate-editor-types.mjs",
+    "build": "nuxt build",
     "dev": "nuxt dev -p 34003",
     "generate": "nuxt generate",
     "preview": "nuxt preview",
+    "test": "node --experimental-strip-types --test test/*.test.ts",
     "postinstall": "nuxt prepare"
   }
 }

package/server/api/editor-types.get.ts

@@ -0,0 +1,7 @@
+import { setHeader } from "h3";
+import editorTypes from "../utils/editor-types.json";
+
+export default defineEventHandler((event) => {
+  setHeader(event, "Cache-Control", "public, max-age=3600");
+  return editorTypes;
+});

package/server/api/parse.post.ts

@@ -1,187 +1,29 @@
-import { defineEventHandler, readBody, createError } from "h3";
-import vm from "node:vm";
-import { transformSync } from "esbuild";
-import util from "node:util";
-import { fileURLToPath } from "node:url";
-import { dirname } from "node:path";
+import { defineEventHandler, createError } from "h3";
+import { executeStudio, StudioExecutionError } from "../utils/studio-execution";
+import { readStudioRequest } from "../utils/parse-request";
 
-import * as zod from "zod";
-import * as mongoose from "mongoose";
-import * as mongooseZod from "@nullix/zod-mongoose";
-
-// Initialize Mongoose in ESM environment
-mongooseZod.setMongoose(mongoose.default || mongoose);
-
-// Shim __filename and __dirname for ESM environments (Nitro)
-let _filename = "/sandbox/main.ts";
-let _dirname = "/sandbox";
-
-try {
-  _filename = fileURLToPath(import.meta.url);
-  _dirname = dirname(_filename);
-} catch {
-  // Fallback if import.meta.url is not available or valid in the current context
-}
-
-// The converter exposes a module-level Hookable instance. User code can add
-// hooks to it, so parse requests must not overlap and must always clean it up
-// before the next request starts.
+const MAX_PENDING_PARSES = 3;
 let parseQueue = Promise.resolve();
+let pendingParses = 0;
 
-async function acquireParseLock(): Promise<() => void> {
+async function acquireLocalLock(): Promise<() => void> {
+  if (pendingParses >= MAX_PENDING_PARSES) throw createError({ statusCode: 503, message: "Studio is busy. Try again shortly." });
+  pendingParses++;
   const previous = parseQueue;
   let release!: () => void;
-
-  parseQueue = new Promise<void>((resolve) => {
-    release = resolve;
-  });
-
+  parseQueue = new Promise<void>((resolve) => { release = () => { pendingParses--; resolve(); }; });
   await previous;
   return release;
 }
 
-function getErrorMessage(error: unknown): string {
-  if (error instanceof Error) return error.message || error.name;
-  return String(error);
-}
-
-// @ts-ignore
-if (typeof __filename === "undefined") {
-  // @ts-ignore
-  globalThis.__filename = _filename;
-}
-// @ts-ignore
-if (typeof __dirname === "undefined") {
-  // @ts-ignore
-  globalThis.__dirname = _dirname;
-}
-
 export default defineEventHandler(async (event) => {
-  const config = useRuntimeConfig(event);
-  const isDocsMode = config.public.isDocsMode;
-  const { sourceCode } = await readBody(event);
-
-  if (!sourceCode) {
-    throw createError({ statusCode: 400, message: "Missing sourceCode" });
-  }
-
-  const releaseParseLock = await acquireParseLock();
-
-  // 1. Transpile exactly what the user wrote
-  try {
-    // A user hook can throw before the converter has completed. Since hooks are
-    // global within the server process, cleanup must happen for both success and
-    // failure, otherwise the user's hook would affect every later visitor.
-    mongooseZod.hooks.removeAllHooks();
-
-    let jsCode: string;
-    try {
-      jsCode = transformSync(sourceCode, {
-        loader: "ts",
-        format: "cjs",
-        target: "esnext",
-        // Provide these globals during transpilation just in case
-        define: {
-          __filename: '"/sandbox/main.ts"',
-          __dirname: '"/sandbox"',
-        },
-      }).code;
-    } catch (error: unknown) {
-      throw createError({
-        statusCode: 400,
-        message: `Compilation Error: ${getErrorMessage(error)}`,
-      });
-    }
-    // 2. Map imports securely
-    const sandboxRequire = (moduleName: string) => {
-      if (moduleName === "zod" || moduleName === "zod/v4") return zod;
-      if (moduleName === "@nullix/zod-mongoose") return mongooseZod;
-      if (moduleName === "mongoose") return mongoose.default || mongoose;
-      throw new Error(`Security Exception: Module "${moduleName}" is blocked.`);
-    };
-
-    const sandbox = {
-      require: sandboxRequire,
-      console: { log: () => {}, warn: () => {}, error: () => {} },
-      __filename: "/sandbox/main.ts",
-      __dirname: "/sandbox",
-    };
-    const context = vm.createContext(sandbox);
-
-    const script = new vm.Script(`
-      ((__filename, __dirname) => {
-        let exports = {};
-        let module = { exports };
-
-        ${jsCode}
-
-        return module.exports;
-      })("/sandbox/main.ts", "/sandbox");
-    `);
-
-    // 3. Execute code and grab the default export
-    const rawExport = script.runInContext(context, {
-      timeout: isDocsMode ? 1000 : 5000,
-    });
-
-    const schema = rawExport.default || rawExport;
-
-    if (!schema || !schema._def) {
-      throw new Error("You must `export default` a valid Zod schema.");
-    }
-
-    // 4. Run BOTH functions on the user's schema
-    const extractedDef = mongooseZod.extractMongooseDef(schema);
-    const mongooseSchema = mongooseZod.toMongooseSchema(schema, { modelName: 'ParsedSchema' });
-
-    // Format the outputs nicely
-    const formatOpts = { depth: null, showHidden: false, colors: false };
-
-    // Mongoose schemas are massive class instances, so we extract the raw .obj definition to display
-    const formatValue = (val: any): any => {
-      if (typeof val === "function") {
-        return val.name || val.toString();
-      }
-      if (Array.isArray(val)) {
-        return val.map(formatValue);
-      }
-      if (
-        val !== null &&
-        typeof val === "object" &&
-        val.constructor === Object
-      ) {
-        const formatted: any = {};
-        for (const key in val) {
-          formatted[key] = formatValue(val[key]);
-        }
-        return formatted;
-      }
-      return val;
-    };
-
-    const formattedDef = formatValue(extractedDef);
-    // schemaObj is a Mongoose Schema instance, we only care about its .obj for display
-    const formattedSchema = formatValue(mongooseSchema.obj);
-    // @ts-ignore
-    const formattedTree = formatValue(mongooseSchema.tree);
-    // @ts-ignore
-    const formattedPaths = formatValue(mongooseSchema.paths);
-
-    return {
-      definition: util.inspect(formattedDef, formatOpts),
-      schemaObj: util.inspect(formattedSchema, formatOpts),
-      schemaTree: util.inspect(formattedTree, formatOpts),
-      schemaPaths: util.inspect(formattedPaths, formatOpts),
-    };
-  } catch (err: any) {
-    const message = getErrorMessage(err);
-    const isCompilationError = err?.statusCode === 400;
-    throw createError({
-      statusCode: isCompilationError ? 400 : 500,
-      message: isCompilationError ? message : `Execution Error: ${message}`,
-    });
-  } finally {
-    mongooseZod.hooks.removeAllHooks();
-    releaseParseLock();
+  if (useRuntimeConfig(event).public.isDocsMode) {
+    throw createError({ statusCode: 403, message: "Local Studio execution is unavailable in docs mode." });
   }
+  const body = await readStudioRequest(event);
+  const release = await acquireLocalLock();
+  try { return executeStudio(body, 5000); }
+  catch (error: any) {
+    throw createError({ statusCode: error instanceof StudioExecutionError ? 400 : 500, message: error?.message || "Studio execution failed." });
+  } finally { release(); }
 });

package/server/api/studio/run.post.ts

@@ -0,0 +1,29 @@
+import { createError, defineEventHandler } from "h3";
+import { readStudioRequest } from "../../utils/parse-request";
+import { runInContainer } from "../../utils/runner-client";
+
+export default defineEventHandler(async (event) => {
+  if (!useRuntimeConfig(event).public.isDocsMode) {
+    throw createError({
+      statusCode: 403,
+      message: "Use the local Studio endpoint in CLI mode.",
+    });
+  }
+  const socketPath =
+    process.env.STUDIO_RUNNER_SOCKET || "/run/zod-studio/runner.sock";
+  if (!socketPath)
+    throw createError({
+      statusCode: 503,
+      message: "Studio runner is not configured.",
+    });
+  const body = await readStudioRequest(event);
+  try {
+    return await runInContainer(body, socketPath);
+  } catch (error: any) {
+    if (error?.statusCode) throw error;
+    throw createError({
+      statusCode: 503,
+      message: "Studio runner is unavailable. Try again shortly.",
+    });
+  }
+});

package/server/middleware/security.ts

@@ -1,14 +1,25 @@
-import { defineEventHandler, createError, getRequestIP } from "h3";
+import { defineEventHandler, createError, getHeader, getRequestIP, setHeader } from "h3";
 
 // Simple in-memory rate limiting map: IP -> array of timestamps
 const rateLimitMap = new Map<string, number[]>();
-const RATE_LIMIT = 2; // 2 requests
+const RATE_LIMIT = 8; // Allow quick edits and shortcut runs without throttling normal use.
 const TIME_WINDOW = 1000; // per 1 second (1000ms)
+const GLOBAL_RATE_LIMIT = 20;
+let globalWindowStart = 0;
+let globalRequests = 0;
 
 export default defineEventHandler((event) => {
-  const isDocsMode = process.env.DOCS_MODE === "true";
+  const isDocsMode = useRuntimeConfig(event).public.isDocsMode;
   const path = event.path;
 
+  if (!isDocsMode && path.startsWith("/api/")) {
+    const host = getHeader(event, "host") || "";
+    const origin = getHeader(event, "origin");
+    const localHost = /^(localhost|127\.0\.0\.1)(:\d+)?$/.test(host);
+    const localOrigin = !origin || /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin);
+    if (!localHost || !localOrigin) throw createError({ statusCode: 403, message: "Local Studio accepts only loopback requests." });
+  }
+
   // 1. Environment Check: Disable local resolving in Docs mode
   if (isDocsMode && path.startsWith("/api/resolve")) {
     throw createError({
@@ -17,8 +28,8 @@ export default defineEventHandler((event) => {
     });
   }
 
-  // 2. Rate Limiting for Parse endpoint in Docs Mode
-  if (isDocsMode && path.startsWith("/api/parse")) {
+  // 2. Rate limiting for the parse endpoint in Docs Mode
+  if (isDocsMode && path === "/api/studio/run") {
     const ip = getRequestIP(event) || "unknown";
     const now = Date.now();
 
@@ -27,14 +38,25 @@ export default defineEventHandler((event) => {
     // Filter timestamps within the current window
     const recentRequests = timestamps.filter((t) => now - t < TIME_WINDOW);
 
-    if (recentRequests.length >= RATE_LIMIT) {
+    if (now - globalWindowStart >= TIME_WINDOW) {
+      globalWindowStart = now;
+      globalRequests = 0;
+    }
+    if (rateLimitMap.size > 1024) {
+      for (const [key, entries] of rateLimitMap) {
+        if (entries.every((time) => now - time >= TIME_WINDOW)) rateLimitMap.delete(key);
+      }
+    }
+    if (recentRequests.length >= RATE_LIMIT || globalRequests >= GLOBAL_RATE_LIMIT || (rateLimitMap.size >= 1024 && !rateLimitMap.has(ip))) {
+      setHeader(event, "Retry-After", 1);
       throw createError({
         statusCode: 429,
-        message: "Too Many Requests. Limit is 2 requests per second.",
+        message: "Too many runs. Wait a moment and try again.",
       });
     }
 
     recentRequests.push(now);
     rateLimitMap.set(ip, recentRequests);
+    globalRequests++;
   }
 });