@rebasepro/server-core 0.4.0 → 0.6.0

package/src/storage/S3StorageController.ts

@@ -213,8 +213,7 @@ export class S3StorageController implements StorageController {
 
             // Convert stream to buffer
             const chunks: Uint8Array[] = [];
-            // @ts-ignore - Body is a ReadableStream in Node.js
-            for await (const chunk of response.Body) {
+            for await (const chunk of response.Body as AsyncIterable<Uint8Array>) {
                 chunks.push(chunk);
             }
             const buffer = Buffer.concat(chunks);

package/src/storage/image-transform.ts

@@ -13,7 +13,6 @@ let sharpFactory: ((input: Buffer | Uint8Array) => any) | undefined;
 async function getSharp(): Promise<(input: Buffer | Uint8Array) => any> {
     if (!sharpFactory) {
         try {
-            // @ts-ignore - sharp is an optional dependency
             const mod = await import("sharp");
             sharpFactory = mod.default;
         } catch (err) {
@@ -95,7 +94,7 @@ const FORMAT_CONTENT_TYPES: Record<string, string> = {
     webp: "image/webp",
     avif: "image/avif",
     jpeg: "image/jpeg",
-    png: "image/png",
+    png: "image/png"
 };
 
 /** Check whether a content type is a transformable image. */
@@ -122,7 +121,7 @@ export async function transformImage(
             width: options.width,
             height: options.height,
             fit: options.fit || "cover",
-            withoutEnlargement: true,
+            withoutEnlargement: true
         });
     }
 
@@ -145,7 +144,8 @@ export async function transformImage(
     }
 
     const data = await pipeline.toBuffer();
-    return { data, contentType: FORMAT_CONTENT_TYPES[format] };
+    return { data,
+contentType: FORMAT_CONTENT_TYPES[format] };
 }
 
 // ---------------------------------------------------------------------------
@@ -168,10 +168,13 @@ export class TransformCache {
     private cache = new Map<string, CacheEntry>();
     private readonly maxEntries: number;
     private readonly maxAgeMs: number;
+    private readonly maxTotalBytes: number;
+    private totalBytes = 0;
 
-    constructor(maxEntries = 500, maxAgeMs = 3_600_000) {
+    constructor(maxEntries = 500, maxAgeMs = 3_600_000, maxTotalBytes = 256 * 1024 * 1024) {
         this.maxEntries = maxEntries;
         this.maxAgeMs = maxAgeMs;
+        this.maxTotalBytes = maxTotalBytes;
     }
 
     /** Build a deterministic cache key from file key + transform options. */
@@ -183,21 +186,33 @@ export class TransformCache {
         const entry = this.cache.get(cacheKey);
         if (!entry) return null;
         if (Date.now() - entry.timestamp > this.maxAgeMs) {
+            this.totalBytes -= entry.data.length;
             this.cache.delete(cacheKey);
             return null;
         }
         // Move to end (most recently used)
         this.cache.delete(cacheKey);
         this.cache.set(cacheKey, entry);
-        return { data: entry.data, contentType: entry.contentType };
+        return { data: entry.data,
+contentType: entry.contentType };
     }
 
     set(cacheKey: string, data: Buffer, contentType: string): void {
-        // Evict oldest if at capacity
-        if (this.cache.size >= this.maxEntries) {
+        // Evict oldest entries while over capacity (entry count or total bytes)
+        while (
+            (this.cache.size >= this.maxEntries || this.totalBytes + data.length > this.maxTotalBytes)
+            && this.cache.size > 0
+        ) {
             const oldest = this.cache.keys().next().value;
-            if (oldest !== undefined) this.cache.delete(oldest);
+            if (oldest !== undefined) {
+                const evicted = this.cache.get(oldest);
+                if (evicted) this.totalBytes -= evicted.data.length;
+                this.cache.delete(oldest);
+            }
         }
-        this.cache.set(cacheKey, { data, contentType, timestamp: Date.now() });
+        this.totalBytes += data.length;
+        this.cache.set(cacheKey, { data,
+contentType,
+timestamp: Date.now() });
     }
 }

package/src/storage/routes.ts

@@ -3,7 +3,8 @@
  */
 
 import { Hono } from "hono";
-import * as fs from "fs";
+import fs from "node:fs";
+import fsp from "node:fs/promises";
 import { StorageController } from "./types";
 import { LocalStorageController } from "./LocalStorageController";
 import { requireAuth as jwtRequireAuth, optionalAuth } from "../auth/middleware";
@@ -48,6 +49,23 @@ export function extractWildcardPath(c: { req: { path: string; routePath: string
     return fullPath.substring(idx + prefix.length + 1);
 }
 
+/**
+ * Sanitize a user-supplied storage key to prevent path traversal and other attacks.
+ * Removes null bytes, ../ sequences, leading slashes, and limits length.
+ */
+function sanitizeStorageKey(key: string): string {
+    let sanitized = key;
+    // Remove null bytes
+    sanitized = sanitized.replace(/\0/g, "");
+    // Remove ../ sequences (and ..\ on Windows)
+    sanitized = sanitized.replace(/\.\.\/|\.\.\\/g, "");
+    // Remove leading slashes
+    sanitized = sanitized.replace(/^\/+/, "");
+    // Limit length
+    sanitized = sanitized.slice(0, 1024);
+    return sanitized;
+}
+
 /**
  * Create storage REST API routes
  */
@@ -99,7 +117,7 @@ export function createStorageRoutes(config: StorageRoutesConfig): Hono<HonoEnv>
         const key = typeof body["key"] === "string" ? body["key"] : "";
         const bucket = typeof body["bucket"] === "string" ? body["bucket"] : undefined;
 
-        const finalKey = key || uploadedFile.name || "unnamed";
+        const finalKey = sanitizeStorageKey(key || uploadedFile.name || "unnamed");
 
         // Extract custom metadata from request body
         const metadata: Record<string, unknown> = {};
@@ -145,23 +163,24 @@ export function createStorageRoutes(config: StorageRoutesConfig): Hono<HonoEnv>
             const absolutePath = localController.getAbsolutePath(resolvedPath, bucket);
 
             // Check if file exists
-            if (!fs.existsSync(absolutePath)) {
+            try {
+                await fsp.access(absolutePath);
+            } catch {
                 throw ApiError.notFound("File not found");
             }
 
             // Get content type from metadata or infer from extension
             let contentType = "application/octet-stream";
             const metadataPath = `${absolutePath}.metadata.json`;
-            if (fs.existsSync(metadataPath)) {
-                try {
-                    const metadata = JSON.parse(fs.readFileSync(metadataPath, "utf-8"));
-                    contentType = metadata.contentType || contentType;
-                } catch {
-                    // Ignore metadata errors
-                }
+            try {
+                const metadataRaw = await fsp.readFile(metadataPath, "utf-8");
+                const metadata = JSON.parse(metadataRaw);
+                contentType = metadata.contentType || contentType;
+            } catch {
+                // Ignore metadata errors (file may not exist)
             }
 
-            const fileContent = fs.readFileSync(absolutePath);
+            const fileContent = await fsp.readFile(absolutePath);
 
             // Apply image transforms if requested and the file is a transformable image
             if (transformOpts && isTransformableImage(contentType)) {

package/src/storage/storage-registry.ts

@@ -12,6 +12,7 @@
  */
 
 import { StorageController } from "./types";
+import { logger } from "../utils/logger";
 
 /**
  * The default storage identifier used when:
@@ -98,7 +99,7 @@ export class DefaultStorageRegistry implements StorageRegistry {
                 // If no explicit "(default)", use the first one as default
                 const firstId = Object.keys(input).find(k => isStorageController(input[k]));
                 if (firstId) {
-                    console.warn(
+                    logger.warn(
                         `[StorageRegistry] No "${DEFAULT_STORAGE_ID}" storage provided. ` +
                         `Using "${firstId}" as the default.`
                     );
@@ -112,7 +113,7 @@ export class DefaultStorageRegistry implements StorageRegistry {
 
     register(id: string, controller: StorageController): void {
         if (this.controllers.has(id)) {
-            console.warn(`[StorageRegistry] Overwriting storage with id "${id}"`);
+            logger.warn(`[StorageRegistry] Overwriting storage with id "${id}"`);
         }
         this.controllers.set(id, controller);
     }
@@ -148,7 +149,7 @@ export class DefaultStorageRegistry implements StorageRegistry {
         }
 
         // Fallback to default with warning
-        console.warn(
+        logger.warn(
             `[StorageRegistry] Storage "${id}" not found, falling back to "${DEFAULT_STORAGE_ID}"`
         );
         return this.getDefault();

package/src/storage/tus-handler.ts

@@ -57,7 +57,7 @@ export class TusHandler {
 
     constructor(
         storageBaseDir: string,
-        private storageController?: StorageController,
+        private storageController?: StorageController
     ) {
         this.tusDir = join(storageBaseDir, ".tus-uploads");
     }
@@ -126,8 +126,8 @@ export class TusHandler {
                 "Tus-Resumable": "1.0.0",
                 "Tus-Version": "1.0.0",
                 "Tus-Extension": "creation,termination",
-                "Tus-Max-Size": String(MAX_UPLOAD_SIZE),
-            },
+                "Tus-Max-Size": String(MAX_UPLOAD_SIZE)
+            }
         });
     }
 
@@ -164,7 +164,7 @@ export class TusHandler {
             filePath,
             bucket: metadata.bucket || undefined,
             key: metadata.key || metadata.filename || undefined,
-            completed: false,
+            completed: false
         };
         this.uploads.set(id, upload);
 
@@ -177,8 +177,8 @@ export class TusHandler {
             headers: {
                 Location: location,
                 "Tus-Resumable": "1.0.0",
-                "Upload-Offset": "0",
-            },
+                "Upload-Offset": "0"
+            }
         });
     }
 
@@ -195,8 +195,8 @@ export class TusHandler {
                 "Tus-Resumable": "1.0.0",
                 "Upload-Offset": String(upload.offset),
                 "Upload-Length": String(upload.size),
-                "Cache-Control": "no-store",
-            },
+                "Cache-Control": "no-store"
+            }
         });
     }
 
@@ -252,8 +252,8 @@ export class TusHandler {
             status: 204,
             headers: {
                 "Tus-Resumable": "1.0.0",
-                "Upload-Offset": String(upload.offset),
-            },
+                "Upload-Offset": String(upload.offset)
+            }
         });
     }
 
@@ -269,7 +269,7 @@ export class TusHandler {
 
         return new Response(null, {
             status: 204,
-            headers: { "Tus-Resumable": "1.0.0" },
+            headers: { "Tus-Resumable": "1.0.0" }
         });
     }
 
@@ -300,7 +300,7 @@ export class TusHandler {
             await this.storageController.putObject({
                 file,
                 key: fileName,
-                bucket: upload.bucket,
+                bucket: upload.bucket
             });
 
             // Clean up temp file

package/src/utils/request-id.ts

@@ -0,0 +1,40 @@
+/**
+ * X-Request-ID Middleware for Hono.
+ *
+ * Generates a unique request identifier (UUID v4) for every inbound
+ * request, or propagates an existing `X-Request-ID` header from the
+ * caller. The ID is:
+ *
+ * 1. Stored in the Hono context (`c.get("requestId")`)
+ * 2. Echoed back on the response as `X-Request-ID`
+ *
+ * Downstream middleware and handlers (request logger, error handler,
+ * etc.) read the ID from context to include it in log entries and
+ * error responses, enabling end-to-end request tracing across services.
+ *
+ * @example
+ * ```ts
+ * import { requestId } from "@rebasepro/server-core";
+ * app.use("/*", requestId());
+ * ```
+ */
+import { randomUUID } from "node:crypto";
+import type { MiddlewareHandler } from "hono";
+import type { HonoEnv } from "../api/types";
+
+export const REQUEST_ID_HEADER = "X-Request-ID";
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export function requestId(): MiddlewareHandler<HonoEnv> {
+    return async (c, next) => {
+        const incoming = c.req.header(REQUEST_ID_HEADER);
+        const id = incoming && UUID_RE.test(incoming) ? incoming : randomUUID();
+
+        c.set("requestId", id);
+
+        await next();
+
+        c.header(REQUEST_ID_HEADER, id);
+    };
+}

package/src/utils/request-logger.ts

@@ -45,6 +45,12 @@ export function requestLogger(options?: RequestLoggerOptions): MiddlewareHandler
             latencyMs
         };
 
+        // Include request correlation ID if available
+        const reqId = c.get("requestId");
+        if (reqId) {
+            data.requestId = reqId;
+        }
+
         if (contentLength) {
             data.contentLength = parseInt(contentLength, 10);
         }

package/test/api-generator.test.ts

@@ -46,6 +46,12 @@ describe("RestApiGenerator", () => {
     function createApp() {
         const app = new Hono();
         app.onError(errorHandler);
+        // RestApiGenerator.getScopedDriver reads from c.get("driver") which is
+        // normally set by auth middleware. Replicate that here for tests.
+        app.use("/api/*", async (c, next) => {
+            c.set("driver", mockDriver);
+            await next();
+        });
         const generator = new RestApiGenerator(mockCollections, mockDriver);
         app.route("/api", generator.generateRoutes());
         return app;
@@ -56,9 +62,14 @@ describe("RestApiGenerator", () => {
      * so we can reliably test route matching without nesting interference.
      */
     function createFlatApp() {
-        const generator = new RestApiGenerator(mockCollections, mockDriver);
-        const app = generator.generateRoutes();
+        const app = new Hono();
         app.onError(errorHandler);
+        app.use("/*", async (c, next) => {
+            c.set("driver", mockDriver);
+            await next();
+        });
+        const generator = new RestApiGenerator(mockCollections, mockDriver);
+        app.route("/", generator.generateRoutes());
         return app;
     }
 
@@ -497,4 +508,81 @@ values: { title: "UUID" } } as any
             expect(mockDriver.deleteEntity).not.toHaveBeenCalled();
         });
     });
+
+    describe("Auth Hook Overrides (onAdminCreateUser via AuthAdapter)", () => {
+
+        it("calls adapter.prepareUserCreation and saves user with returned values", async () => {
+            const mockPrepare = jest.fn().mockResolvedValue({
+                values: { email: "custom@example.com",
+name: "Custom Name",
+passwordHash: "custom-hash" },
+                clearPassword: "custom-temp-password",
+                hookHandledEmail: true,
+                invitationSent: true
+            });
+
+            const mockAuthAdapter = {
+                id: "test-adapter",
+                verifyRequest: jest.fn(),
+                getCapabilities: jest.fn(),
+                prepareUserCreation: mockPrepare
+            };
+
+            const app = new Hono();
+            app.onError(errorHandler);
+            app.use("/api/*", async (c, next) => {
+                c.set("driver", mockDriver);
+                await next();
+            });
+
+            const authCollections = [
+                {
+                    slug: "users",
+                    name: "Users",
+                    singularName: "User",
+                    auth: true,
+                    properties: {}
+                } as any
+            ];
+
+            const generator = new RestApiGenerator(authCollections, mockDriver, undefined, mockAuthAdapter as any);
+            app.route("/api", generator.generateRoutes());
+
+            mockDriver.saveEntity.mockResolvedValue({
+                id: "custom-id",
+                path: "users",
+                values: { email: "custom@example.com",
+name: "Custom Name",
+passwordHash: "custom-hash" }
+            } as any);
+
+            const res = await app.request("/api/users", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ email: "original@example.com",
+name: "Original Name" })
+            });
+
+            expect(res.status).toBe(201);
+            const body = await res.json() as any;
+            expect(body.email).toBe("custom@example.com");
+            expect(body.invitationSent).toBe(true);
+            expect(body.temporaryPassword).toBe("custom-temp-password");
+
+            expect(mockPrepare).toHaveBeenCalledWith(
+                expect.objectContaining({ email: "original@example.com",
+name: "Original Name" }),
+                undefined // auth: true → collectionAuthConfig is undefined
+            );
+            expect(mockDriver.saveEntity).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    path: "users",
+                    values: { email: "custom@example.com",
+name: "Custom Name",
+passwordHash: "custom-hash" },
+                    status: "new"
+                })
+            );
+        });
+    });
 });

package/test/api-key-permission-guard.test.ts

@@ -51,7 +51,8 @@ describe("httpMethodToOperation", () => {
 describe("isOperationAllowed", () => {
     it("allows operation with exact collection match", () => {
         const permissions: ApiKeyPermission[] = [
-            { collection: "users", operations: ["read", "write"] }
+            { collection: "users",
+operations: ["read", "write"] }
         ];
         expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
         expect(isOperationAllowed(permissions, "users", "write")).toBe(true);
@@ -59,7 +60,8 @@ describe("isOperationAllowed", () => {
 
     it("denies operation not in the operations list", () => {
         const permissions: ApiKeyPermission[] = [
-            { collection: "users", operations: ["read"] }
+            { collection: "users",
+operations: ["read"] }
         ];
         expect(isOperationAllowed(permissions, "users", "write")).toBe(false);
         expect(isOperationAllowed(permissions, "users", "delete")).toBe(false);
@@ -67,14 +69,16 @@ describe("isOperationAllowed", () => {
 
     it("denies operation for non-matching collection", () => {
         const permissions: ApiKeyPermission[] = [
-            { collection: "users", operations: ["read", "write", "delete"] }
+            { collection: "users",
+operations: ["read", "write", "delete"] }
         ];
         expect(isOperationAllowed(permissions, "posts", "read")).toBe(false);
     });
 
     it("allows wildcard collection '*' to match any collection", () => {
         const permissions: ApiKeyPermission[] = [
-            { collection: "*", operations: ["read"] }
+            { collection: "*",
+operations: ["read"] }
         ];
         expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
         expect(isOperationAllowed(permissions, "posts", "read")).toBe(true);
@@ -83,7 +87,8 @@ describe("isOperationAllowed", () => {
 
     it("wildcard collection still checks operations", () => {
         const permissions: ApiKeyPermission[] = [
-            { collection: "*", operations: ["read"] }
+            { collection: "*",
+operations: ["read"] }
         ];
         expect(isOperationAllowed(permissions, "users", "write")).toBe(false);
         expect(isOperationAllowed(permissions, "users", "delete")).toBe(false);
@@ -95,9 +100,12 @@ describe("isOperationAllowed", () => {
 
     it("checks all permission entries and grants if any match", () => {
         const permissions: ApiKeyPermission[] = [
-            { collection: "users", operations: ["read"] },
-            { collection: "posts", operations: ["write"] },
-            { collection: "comments", operations: ["read", "write", "delete"] }
+            { collection: "users",
+operations: ["read"] },
+            { collection: "posts",
+operations: ["write"] },
+            { collection: "comments",
+operations: ["read", "write", "delete"] }
         ];
         expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
         expect(isOperationAllowed(permissions, "posts", "write")).toBe(true);
@@ -108,8 +116,10 @@ describe("isOperationAllowed", () => {
 
     it("handles overlapping permissions correctly", () => {
         const permissions: ApiKeyPermission[] = [
-            { collection: "users", operations: ["read"] },
-            { collection: "users", operations: ["write"] }
+            { collection: "users",
+operations: ["read"] },
+            { collection: "users",
+operations: ["write"] }
         ];
         expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
         expect(isOperationAllowed(permissions, "users", "write")).toBe(true);
@@ -118,8 +128,10 @@ describe("isOperationAllowed", () => {
 
     it("handles mixed wildcard and specific permissions", () => {
         const permissions: ApiKeyPermission[] = [
-            { collection: "*", operations: ["read"] },
-            { collection: "users", operations: ["write", "delete"] }
+            { collection: "*",
+operations: ["read"] },
+            { collection: "users",
+operations: ["write", "delete"] }
         ];
         // Wildcard read for everything
         expect(isOperationAllowed(permissions, "posts", "read")).toBe(true);

package/test/auth-routes.test.ts

@@ -193,7 +193,7 @@ accessExpiresIn: "1h" });
 
     describe("Configuration Security", () => {
         it("throws an error when defaultRole is set to 'admin'", () => {
-            expect(() => createApp({ defaultRole: "admin" })).toThrowError(/CRITICAL SECURITY ERROR/);
+            expect(() => createApp({ defaultRole: "admin" })).toThrow(/CRITICAL SECURITY ERROR/);
         });
     });
 
@@ -885,7 +885,8 @@ ipAddress: "1.2.3.4" }
         });
 
         it("returns needsSetup=false when isBootstrapCompleted returns true", async () => {
-            const app = createApp({ allowRegistration: false, isBootstrapCompleted: async () => true });
+            const app = createApp({ allowRegistration: false,
+isBootstrapCompleted: async () => true });
 
             const res = await app.request("/auth/config");
             expect(res.status).toBe(200);
@@ -1029,7 +1030,8 @@ withEmail: false });
             // this test documents the current behavior — it would assign admin.
             // The fix is in the config validation at startup (outside routes).
             // Here we verify the defaultRole IS what's passed, and the auto-escalation is gone.
-            const app = createApp({ allowRegistration: true, defaultRole: "viewer" });
+            const app = createApp({ allowRegistration: true,
+defaultRole: "viewer" });
 
             await app.request("/auth/register", json({
                 email: "new@test.com",