@pablozaiden/webapp 0.0.1

package/src/server/routes.ts

@@ -0,0 +1,67 @@
+import type { Server } from "bun";
+import type { AuthenticatedRequestState } from "./auth/types";
+import type { RealtimeBus } from "./realtime/bus";
+
+export type RouteAuth = "required" | "public" | "optional";
+export type SameOriginMode = "mutations" | "always" | "never";
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+
+export interface RouteContext<TParams extends Record<string, string> = Record<string, string>, TEvent = unknown> {
+  params: TParams;
+  auth: AuthenticatedRequestState;
+  realtime: RealtimeBus<TEvent>;
+  server?: Server<unknown>;
+}
+
+export type WebAppRouteHandler<TParams extends Record<string, string> = Record<string, string>, TEvent = unknown> = (
+  req: Request,
+  ctx: RouteContext<TParams, TEvent>,
+) => Response | Promise<Response>;
+
+export type RouteDefinition<TEvent = unknown> = {
+  auth?: RouteAuth;
+  sameOrigin?: SameOriginMode;
+  scopes?: string[];
+} & Partial<Record<HttpMethod, WebAppRouteHandler<Record<string, string>, TEvent>>>;
+
+export type RouteTable<TEvent = unknown> = Record<string, RouteDefinition<TEvent>>;
+
+export function defineRoutes<TEvent = unknown>(routes: RouteTable<TEvent>): RouteTable<TEvent> {
+  return routes;
+}
+
+export interface MatchedRoute<TEvent = unknown> {
+  pattern: string;
+  route: RouteDefinition<TEvent>;
+  params: Record<string, string>;
+}
+
+function splitPath(pathname: string): string[] {
+  return pathname.split("/").filter(Boolean);
+}
+
+export function matchRoute<TEvent>(routes: RouteTable<TEvent>, pathname: string): MatchedRoute<TEvent> | undefined {
+  const requestParts = splitPath(pathname);
+  for (const [pattern, route] of Object.entries(routes)) {
+    const patternParts = splitPath(pattern);
+    if (patternParts.length !== requestParts.length) {
+      continue;
+    }
+    const params: Record<string, string> = {};
+    let matched = true;
+    for (let index = 0; index < patternParts.length; index += 1) {
+      const patternPart = patternParts[index]!;
+      const requestPart = requestParts[index]!;
+      if (patternPart.startsWith(":")) {
+        params[patternPart.slice(1)] = decodeURIComponent(requestPart);
+      } else if (patternPart !== requestPart) {
+        matched = false;
+        break;
+      }
+    }
+    if (matched) {
+      return { pattern, route, params };
+    }
+  }
+  return undefined;
+}

package/src/server/runtime-config.ts

@@ -0,0 +1,101 @@
+import type { LogLevelName } from "../contracts";
+
+export interface RuntimeConfig {
+  appName: string;
+  envPrefix: string;
+  host: string;
+  port: number;
+  dataDir: string;
+  logLevel: LogLevelName;
+  logLevelFromEnv: boolean;
+  passkeyDisabled: boolean;
+  sameOriginDisabled: boolean;
+  publicBaseUrl?: string;
+  authIssuer?: string;
+  development: false | { hmr: true; console: true };
+}
+
+const LOG_LEVELS = new Set(["trace", "debug", "info", "warn", "error"]);
+
+export function isTruthyEnv(value: string | undefined): boolean {
+  const normalized = value?.trim().toLowerCase();
+  return normalized === "true" || normalized === "1" || normalized === "yes";
+}
+
+export function assertEnvPrefix(prefix: string): string {
+  if (!/^[A-Z][A-Z0-9_]*$/.test(prefix)) {
+    throw new Error(`envPrefix must match /^[A-Z][A-Z0-9_]*$/; received "${prefix}"`);
+  }
+  return prefix;
+}
+
+function envName(prefix: string, name: string): string {
+  return `${prefix}_${name}`;
+}
+
+function readEnv(prefix: string, name: string): string | undefined {
+  return process.env[envName(prefix, name)]?.trim();
+}
+
+function parsePort(raw: string | undefined, name: string): number {
+  const value = raw || "3000";
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`${name} must be an integer between 0 and 65535; received "${value}"`);
+  }
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error(`${name} must be an integer between 0 and 65535; received "${value}"`);
+  }
+  return port;
+}
+
+function parseLogLevel(raw: string | undefined, fallback: LogLevelName, name: string): LogLevelName {
+  if (!raw) {
+    return fallback;
+  }
+  if (!LOG_LEVELS.has(raw)) {
+    throw new Error(`${name} must be one of trace, debug, info, warn, error; received "${raw}"`);
+  }
+  return raw as LogLevelName;
+}
+
+export function readRuntimeConfig(input: {
+  appName: string;
+  envPrefix: string;
+  defaultLogLevel?: LogLevelName;
+}): RuntimeConfig {
+  const envPrefix = assertEnvPrefix(input.envPrefix);
+  const logLevelRaw = readEnv(envPrefix, "LOG_LEVEL");
+  const logLevel = parseLogLevel(logLevelRaw, input.defaultLogLevel ?? "info", envName(envPrefix, "LOG_LEVEL"));
+  return {
+    appName: input.appName,
+    envPrefix,
+    host: readEnv(envPrefix, "HOST") || "127.0.0.1",
+    port: parsePort(readEnv(envPrefix, "PORT"), envName(envPrefix, "PORT")),
+    dataDir: readEnv(envPrefix, "DATA_DIR") || "./data",
+    logLevel,
+    logLevelFromEnv: Boolean(logLevelRaw),
+    passkeyDisabled: isTruthyEnv(readEnv(envPrefix, "DISABLE_PASSKEY")),
+    sameOriginDisabled: isTruthyEnv(readEnv(envPrefix, "DISABLE_SAME_ORIGIN_CHECK")),
+    publicBaseUrl: readEnv(envPrefix, "PUBLIC_BASE_URL"),
+    authIssuer: readEnv(envPrefix, "AUTH_ISSUER"),
+    development: process.env["NODE_ENV"] === "production" ? false : { hmr: true, console: true },
+  };
+}
+
+export function safeRuntimeConfig(config: RuntimeConfig): Record<string, unknown> {
+  return {
+    appName: config.appName,
+    envPrefix: config.envPrefix,
+    host: config.host,
+    port: config.port,
+    dataDir: config.dataDir,
+    logLevel: config.logLevel,
+    logLevelFromEnv: config.logLevelFromEnv,
+    passkeyDisabled: config.passkeyDisabled,
+    sameOriginDisabled: config.sameOriginDisabled,
+    publicBaseUrl: config.publicBaseUrl,
+    authIssuer: config.authIssuer,
+    production: config.development === false,
+  };
+}

package/src/server/same-origin.ts

@@ -0,0 +1,35 @@
+import type { AuthenticatedRequestState } from "./auth/types";
+import { getRequestOriginInfo } from "./auth/request-origin";
+import type { RuntimeConfig } from "./runtime-config";
+import { errorResponse } from "./responses";
+import type { SameOriginMode } from "./routes";
+
+const MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+
+export function checkSameOrigin(req: Request, config: RuntimeConfig, auth: AuthenticatedRequestState, mode: SameOriginMode = "mutations"): Response | undefined {
+  if (config.sameOriginDisabled || mode === "never") {
+    return undefined;
+  }
+  const mutating = MUTATING.has(req.method.toUpperCase());
+  const websocket = req.headers.get("upgrade")?.toLowerCase() === "websocket";
+  if (mode !== "always" && !mutating && !websocket) {
+    return undefined;
+  }
+  if (mode !== "always" && (auth.kind === "api-key" || auth.kind === "bearer")) {
+    return undefined;
+  }
+  const expectedOrigin = getRequestOriginInfo(req, config.publicBaseUrl).origin;
+  const origin = req.headers.get("origin");
+  if (origin) {
+    return origin === expectedOrigin ? undefined : errorResponse(403, "same_origin_required", "Request origin is not allowed");
+  }
+  const referer = req.headers.get("referer");
+  if (referer) {
+    try {
+      return new URL(referer).origin === expectedOrigin ? undefined : errorResponse(403, "same_origin_required", "Request origin is not allowed");
+    } catch {
+      return errorResponse(403, "same_origin_required", "Request origin is not allowed");
+    }
+  }
+  return errorResponse(403, "same_origin_required", "Request origin is not allowed");
+}

package/src/types.d.ts

@@ -0,0 +1,11 @@
+declare const WEBAPP_VERSION: string | undefined;
+
+declare module "*.html" {
+  const value: Response;
+  export default value;
+}
+
+declare module "*.css" {
+  const value: string;
+  export default value;
+}