@selvajs/server 0.2.0-beta.2 → 0.2.0-beta.4

package/src/http/body-size.ts

@@ -1,24 +0,0 @@
-/** Minimal read-side view of a request's headers — `Headers` satisfies it. */
-export interface HeadersLike {
-	get(name: string): string | null;
-}
-
-/**
- * True when the request's declared `Content-Length` exceeds `maxBytes`.
- * Check BEFORE the body is read so a malicious client can't burn memory by
- * sending a huge payload to a small-body endpoint; the route maps a `true`
- * result to its transport's 413.
- *
- * Background: a global body-size limit (e.g. adapter-node's `BODY_SIZE_LIMIT`)
- * has to be set high enough for the largest legitimate upload, which means
- * smaller JSON endpoints inherit that ceiling by default. This check is the
- * per-route lower bound.
- *
- * Caveat: requests without `Content-Length` (chunked transfer encoding) bypass
- * this check. Most browsers and HTTP clients send Content-Length on POST/PUT.
- * The global limit is the backstop for those.
- */
-export function declaredBodySizeExceeds(headers: HeadersLike, maxBytes: number): boolean {
-	const declared = Number(headers.get('content-length'));
-	return Number.isFinite(declared) && declared > maxBytes;
-}

package/src/http/index.ts

@@ -1,10 +0,0 @@
-// HTTP hardening helpers — transport-agnostic request/response guards.
-
-export { safeRedirectTarget } from './redirect.js';
-export { declaredBodySizeExceeds, type HeadersLike } from './body-size.js';
-export { applySecurityHeaders, type SecurityHeaderOptions } from './security-headers.js';
-export {
-	createRouteClassifier,
-	type RouteClassifier,
-	type RouteClassifierConfig
-} from './route-classifier.js';

package/src/http/redirect.ts

@@ -1,16 +0,0 @@
-/**
- * Validate a user-supplied post-login redirect target. Accepts only same-origin
- * relative paths starting with `/` followed by a non-`/` character, so
- * `//evil.com/path` (protocol-relative URL — browser treats as cross-origin)
- * and `/\evil.com` (back-slash variants some browsers normalize) are rejected.
- *
- * Always returns a safe path: the validated target on success, the fallback
- * otherwise. Routes call this with `redirectTo` from form data or query string.
- */
-export function safeRedirectTarget(raw: string | null | undefined, fallback: string): string {
-	if (typeof raw !== 'string' || raw.length < 2) return fallback;
-	if (raw[0] !== '/') return fallback;
-	// Reject protocol-relative (`//host`) and back-slash bypass (`/\host`).
-	if (raw[1] === '/' || raw[1] === '\\') return fallback;
-	return raw;
-}

package/src/http/route-classifier.ts

@@ -1,74 +0,0 @@
-/**
- * Deny-by-default route classification. Every request is gated unless its
- * path matches one of the explicit allowlists supplied here — so adding a new
- * top-level route is safe: forgetting to update the lists makes it gated (a
- * loud 401/redirect), not silently public.
- *
- * The *pattern* is reusable; the *values* are app policy — a consuming app
- * supplies its own route sets. All matching is plain exact/prefix string
- * comparison: cheap enough for the hooks hot path, and no regex to get wrong.
- */
-
-export interface RouteClassifierConfig {
-	/** Exact-match public pages — no session needed (e.g. `/`, `/login`). */
-	publicPages?: Iterable<string>;
-	/**
-	 * Public path prefixes (e.g. `/auth/` for OAuth start + callback — the
-	 * user has no session yet by definition).
-	 */
-	publicPrefixes?: readonly string[];
-	/**
-	 * Exact-match API endpoints that must answer without a session (e.g. a
-	 * load-balancer health probe). Anything added here must be safe to expose
-	 * to anonymous callers.
-	 */
-	publicApis?: Iterable<string>;
-	/**
-	 * A single prefix whose routes apply their own per-request authorization
-	 * (e.g. a blob proxy classifying each asset path). The hook must NOT deny
-	 * these up front; they classify as public (best-effort session attach) and
-	 * the route makes the real decision. Keep this to ONE prefix — every other
-	 * API route stays deny-by-default.
-	 */
-	selfGatingPrefix?: string;
-	/** Static-asset path prefixes the adapter serves directly (e.g. `/_app/`). */
-	staticPrefixes?: readonly string[];
-	/** Exact static-asset paths (e.g. `/favicon.svg`, `/robots.txt`). */
-	staticPaths?: Iterable<string>;
-}
-
-export interface RouteClassifier {
-	/** Static assets bypass auth gating; callers may add cache headers. */
-	isStaticAsset(pathname: string): boolean;
-	/** True for paths under `selfGatingPrefix` — the route gates itself. */
-	isSelfGatingApiRoute(pathname: string): boolean;
-	/** True when the path needs no session: pages, APIs, prefixes, self-gating. */
-	isPublicRoute(pathname: string): boolean;
-}
-
-export function createRouteClassifier(config: RouteClassifierConfig): RouteClassifier {
-	const publicPages = new Set(config.publicPages ?? []);
-	const publicPrefixes = config.publicPrefixes ?? [];
-	const publicApis = new Set(config.publicApis ?? []);
-	const selfGatingPrefix = config.selfGatingPrefix;
-	const staticPrefixes = config.staticPrefixes ?? [];
-	const staticPaths = new Set(config.staticPaths ?? []);
-
-	function isStaticAsset(pathname: string): boolean {
-		if (staticPaths.has(pathname)) return true;
-		return staticPrefixes.some((p) => pathname.startsWith(p));
-	}
-
-	function isSelfGatingApiRoute(pathname: string): boolean {
-		return selfGatingPrefix !== undefined && pathname.startsWith(selfGatingPrefix);
-	}
-
-	function isPublicRoute(pathname: string): boolean {
-		if (publicPages.has(pathname)) return true;
-		if (publicApis.has(pathname)) return true;
-		if (isSelfGatingApiRoute(pathname)) return true;
-		return publicPrefixes.some((p) => pathname.startsWith(p));
-	}
-
-	return { isStaticAsset, isSelfGatingApiRoute, isPublicRoute };
-}

package/src/http/security-headers.ts

@@ -1,42 +0,0 @@
-export interface SecurityHeaderOptions {
-	/**
-	 * Set `Strict-Transport-Security` — production only. Locking dev
-	 * (http://localhost) into HTTPS would brick local development, so the
-	 * caller decides what "production" means (e.g. `NODE_ENV`).
-	 */
-	hsts: boolean;
-}
-
-/**
- * Apply baseline browser-hardening headers to a response. Cheap wins that
- * don't require UI verification:
- *
- *   - X-Content-Type-Options: nosniff — disables MIME sniffing.
- *   - Referrer-Policy: strict-origin-when-cross-origin — strips the path
- *     and query from cross-origin Referer headers; matches modern browser
- *     defaults but pins the behavior in case the default ever drifts.
- *   - Permissions-Policy: opt out of browser APIs Selva-engine apps don't
- *     use, so XSS can't enable them.
- *   - HSTS when `opts.hsts` (production).
- *
- * **Intentionally NOT set here:**
- *   - Content-Security-Policy + frame-ancestors. Selva-engine apps are built
- *     for iframe embedding, so a strict CSP needs UI-phase validation against
- *     real consumer sites before it can ship.
- *   - X-Frame-Options. Same iframe-embedding constraint.
- *   - Cache-Control. Asset-path layout is app policy; set it in the caller.
- *
- * Returns the same response for chaining.
- */
-export function applySecurityHeaders(response: Response, opts: SecurityHeaderOptions): Response {
-	response.headers.set('X-Content-Type-Options', 'nosniff');
-	response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-	response.headers.set(
-		'Permissions-Policy',
-		'accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()'
-	);
-	if (opts.hsts) {
-		response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-	}
-	return response;
-}

package/src/index.ts

@@ -1,27 +0,0 @@
-/**
- * `@selvajs/server` — transport-agnostic compute/solve server building blocks
- * for apps built on the Selva engine.
- *
- * The compute stack (limits, per-key rate limiting, SSRF guard, input
- * transform) that used to live inside the `@selvajs/selva` app, extracted so a
- * consuming app can reuse it instead of copying it. Everything here is
- * env-injected (no ambient `$env` / `process.env`) and framework-agnostic.
- *
- * The full compute subsurface is also available at `@selvajs/server/compute`,
- * the definitions slice (DefinitionService, schema extraction/validation,
- * render loader) at `@selvajs/server/definitions`, the provider wiring
- * (registry-driven `createSelvaProviders`) at `@selvajs/server/providers`,
- * the HMAC token codec at `@selvajs/server/tokens`, error reporting at
- * `@selvajs/server/errors`, HTTP hardening helpers at `@selvajs/server/http`,
- * access-rule input assembly at `@selvajs/server/access`, and deployment/ops
- * helpers at `@selvajs/server/ops`.
- */
-
-export * from './compute/index.js';
-export * from './definitions/index.js';
-export * from './providers/index.js';
-export * from './tokens/index.js';
-export * from './errors/index.js';
-export * from './http/index.js';
-export * from './access/index.js';
-export * from './ops/index.js';

package/src/ops/__tests__/semver.test.ts

@@ -1,42 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { isNewer } from '../semver.js';
-
-describe('isNewer', () => {
-	it('detects a newer patch / minor / major', () => {
-		expect(isNewer('4.3.2', '4.3.1')).toBe(true);
-		expect(isNewer('4.4.0', '4.3.9')).toBe(true);
-		expect(isNewer('5.0.0', '4.9.9')).toBe(true);
-	});
-
-	it('returns false for same or older versions', () => {
-		expect(isNewer('4.3.1', '4.3.1')).toBe(false);
-		expect(isNewer('4.3.0', '4.3.1')).toBe(false);
-		expect(isNewer('3.9.9', '4.0.0')).toBe(false);
-	});
-
-	it('ignores pre-release suffixes on the stable channel (only stable bumps surface)', () => {
-		expect(isNewer('4.3.2-beta.1', '4.3.1')).toBe(true);
-		expect(isNewer('4.3.1-beta.1', '4.3.1')).toBe(false);
-		// Explicit stable channel matches the default.
-		expect(isNewer('4.3.1-beta.1', '4.3.1', 'stable')).toBe(false);
-	});
-
-	it('orders pre-releases on the beta channel', () => {
-		// Successive betas of the same core.
-		expect(isNewer('4.6.0-beta.2', '4.6.0-beta.1', 'beta')).toBe(true);
-		expect(isNewer('4.6.0-beta.1', '4.6.0-beta.2', 'beta')).toBe(false);
-		// A newer core beta beats an older stable.
-		expect(isNewer('4.6.0-beta.1', '4.5.1', 'beta')).toBe(true);
-		// Stable of a core outranks any beta of the same core (promotion).
-		expect(isNewer('4.6.0', '4.6.0-beta.9', 'beta')).toBe(true);
-		expect(isNewer('4.6.0-beta.9', '4.6.0', 'beta')).toBe(false);
-		// Reverting to an OLDER stable is NOT "newer" — the channel switch, not
-		// isNewer, is what makes it actionable.
-		expect(isNewer('4.5.1', '4.6.0-beta.2', 'beta')).toBe(false);
-	});
-
-	it('falls back to a string compare when unparseable', () => {
-		expect(isNewer('weird', 'weird')).toBe(false);
-		expect(isNewer('a', 'b')).toBe(true);
-	});
-});

package/src/ops/index.ts

@@ -1,3 +0,0 @@
-// Deployment/ops helpers — channel-aware semver comparison.
-
-export { parseSemver, isNewer, type ReleaseChannel } from './semver.js';

package/src/ops/semver.ts

@@ -1,60 +0,0 @@
-/**
- * Channel-aware semver comparison for update checks. Understands exactly the
- * two-channel model Selva-engine deployments publish under: a stable line
- * (`x.y.z`, npm `latest`) and a beta line (`x.y.z-beta.N`, npm `beta`).
- * Deliberately not a general semver implementation — no build metadata, no
- * arbitrary pre-release identifiers.
- */
-
-/** Which published line a deployment tracks. */
-export type ReleaseChannel = 'stable' | 'beta';
-
-/**
- * Parse `x.y.z` plus an optional `-beta.N` pre-release counter. The
- * pre-release number is returned separately so beta-channel comparisons can
- * order successive betas of the same x.y.z core. Returns null for anything
- * that doesn't lead with a numeric core.
- */
-export function parseSemver(
-	v: string
-): { core: [number, number, number]; beta: number | null } | null {
-	const m = /^(\d+)\.(\d+)\.(\d+)(?:-beta\.(\d+))?/.exec(v.trim());
-	if (!m) return null;
-	return {
-		core: [Number(m[1]), Number(m[2]), Number(m[3])],
-		beta: m[4] != null ? Number(m[4]) : null
-	};
-}
-
-/**
- * True when `latest` is strictly newer than `current` by semver.
- *
- * Stable channel (default): pre-release suffixes are ignored — only stable
- * core bumps surface.
- *
- * Beta channel: pre-releases participate. A higher core wins; on an equal
- * core, a higher `-beta.N` wins, and a stable (no suffix) outranks any -beta
- * of the same core (4.6.0 > 4.6.0-beta.9). This lets an update UI show
- * "beta.1 → beta.2" and "beta → stable promotion of the same line".
- *
- * Unparseable versions fall back to inequality: different strings count as
- * "newer" so a weird published version still surfaces, identical ones don't.
- */
-export function isNewer(
-	latest: string,
-	current: string,
-	channel: ReleaseChannel = 'stable'
-): boolean {
-	const a = parseSemver(latest);
-	const b = parseSemver(current);
-	if (!a || !b) return latest !== current;
-	for (let i = 0; i < 3; i++) {
-		if (a.core[i] > b.core[i]) return true;
-		if (a.core[i] < b.core[i]) return false;
-	}
-	// Equal core. On the stable channel we don't compare pre-release tails.
-	if (channel !== 'beta') return false;
-	// Stable (beta == null) ranks above any pre-release of the same core.
-	const rank = (beta: number | null) => (beta == null ? Infinity : beta);
-	return rank(a.beta) > rank(b.beta);
-}

package/src/providers/__tests__/create-selva-providers.test.ts

@@ -1,172 +0,0 @@
-/**
- * Tests for `createSelvaProviders` (K5) — registry-driven provider selection,
- * lazy memoized instantiation, config parsing (flags/branding/tenancy), the
- * solve-metrics duck-type pick, and the external config-path override.
- */
-
-import { describe, it, expect, vi } from 'vitest';
-import { fileURLToPath } from 'node:url';
-import type { IAuthProvider, IDataProvider, IStorageProvider } from '@selvajs/platform';
-import { createSelvaProviders, type ProviderRegistry } from '../create-selva-providers.js';
-
-class FakeData {}
-class FakeStorage {}
-
-function makeRegistry() {
-	const authLocal = vi.fn(() => ({ name: 'local-auth' }) as unknown as IAuthProvider);
-	const authSupabase = vi.fn(() => ({ name: 'supabase-auth' }) as unknown as IAuthProvider);
-	const dataLocal = vi.fn(() => new FakeData() as unknown as IDataProvider);
-	const dataSupabase = vi.fn(() => new FakeData() as unknown as IDataProvider);
-	const storageLocal = vi.fn(() => new FakeStorage() as unknown as IStorageProvider);
-	const registry: ProviderRegistry = {
-		auth: { local: authLocal, supabase: authSupabase },
-		data: { local: dataLocal, supabase: dataSupabase },
-		storage: { local: storageLocal }
-	};
-	return { registry, authLocal, authSupabase, dataLocal, dataSupabase, storageLocal };
-}
-
-const noBoot = { onBoot: () => {} };
-
-describe('registry selection', () => {
-	it('falls back to "local" for every slot when env is empty', async () => {
-		const { registry, authLocal, dataLocal, storageLocal } = makeRegistry();
-		const runtime = await createSelvaProviders({}, { registry, ...noBoot });
-		runtime.resolve();
-		expect(authLocal).toHaveBeenCalledTimes(1);
-		expect(dataLocal).toHaveBeenCalledTimes(1);
-		expect(storageLocal).toHaveBeenCalledTimes(1);
-	});
-
-	it('honors SELVA_*_PROVIDER env choices, case-insensitively', async () => {
-		const { registry, authSupabase, dataSupabase } = makeRegistry();
-		const runtime = await createSelvaProviders(
-			{ SELVA_AUTH_PROVIDER: 'Supabase', SELVA_DATA_PROVIDER: 'SUPABASE' },
-			{ registry, ...noBoot }
-		);
-		runtime.resolve();
-		expect(authSupabase).toHaveBeenCalledTimes(1);
-		expect(dataSupabase).toHaveBeenCalledTimes(1);
-	});
-
-	it('honors the defaults option over the built-in "local"', async () => {
-		const { registry, authSupabase } = makeRegistry();
-		const runtime = await createSelvaProviders(
-			{},
-			{ registry, defaults: { auth: 'supabase' }, ...noBoot }
-		);
-		runtime.resolve();
-		expect(authSupabase).toHaveBeenCalledTimes(1);
-	});
-
-	it('rejects an unknown choice, listing the registered names', async () => {
-		const { registry } = makeRegistry();
-		const runtime = await createSelvaProviders(
-			{ SELVA_AUTH_PROVIDER: 'okta' },
-			{ registry, ...noBoot }
-		);
-		expect(() => runtime.resolve()).toThrow(/SELVA_AUTH_PROVIDER="okta".*local \| supabase/);
-	});
-});
-
-describe('laziness and memoization', () => {
-	it('does not instantiate providers until resolve() is called', async () => {
-		const { registry, authLocal } = makeRegistry();
-		await createSelvaProviders({}, { registry, ...noBoot });
-		expect(authLocal).not.toHaveBeenCalled();
-	});
-
-	it('instantiates once and logs the boot summary once across repeated resolves', async () => {
-		const { registry, authLocal } = makeRegistry();
-		const onBoot = vi.fn();
-		const runtime = await createSelvaProviders({}, { registry, onBoot });
-		runtime.resolve();
-		runtime.resolve();
-		runtime.flag('ENABLE_SHARING');
-		expect(authLocal).toHaveBeenCalledTimes(1);
-		expect(onBoot).toHaveBeenCalledTimes(1);
-		expect(onBoot.mock.calls[0][0]).toContain('auth=local-auth');
-		expect(onBoot.mock.calls[0][0]).toContain('data=FakeData');
-		expect(onBoot.mock.calls[0][0]).toContain('tenancy=single');
-	});
-});
-
-describe('config parsing', () => {
-	it('parses flags from SELVA_FLAG_* (omitted → false)', async () => {
-		const { registry } = makeRegistry();
-		const runtime = await createSelvaProviders(
-			{ SELVA_FLAG_ENABLE_SHARING: 'true', SELVA_FLAG_ALLOW_ORG_CREATION: 'no' },
-			{ registry, ...noBoot }
-		);
-		expect(runtime.flag('ENABLE_SHARING')).toBe(true);
-		expect(runtime.flag('ALLOW_ORG_CREATION')).toBe(false);
-		expect(runtime.flag('ALLOW_CROSS_ORG_PUBLIC')).toBe(false);
-	});
-
-	it('parses tenancy and rejects unknown values', async () => {
-		const { registry } = makeRegistry();
-		const multi = await createSelvaProviders({ SELVA_TENANCY: 'multi' }, { registry, ...noBoot });
-		expect(multi.tenancy()).toBe('multi');
-
-		const bad = await createSelvaProviders({ SELVA_TENANCY: 'galactic' }, { registry, ...noBoot });
-		expect(() => bad.tenancy()).toThrow(/SELVA_TENANCY="galactic"/);
-	});
-
-	it('brands with defaults; copyright falls back to the overridden name', async () => {
-		const { registry } = makeRegistry();
-		const plain = await createSelvaProviders({}, { registry, ...noBoot });
-		expect(plain.branding().name).toBe('Selva');
-		expect(plain.branding().copyrightName).toBe('Selva');
-		expect(plain.branding().tagline).toBeTruthy();
-
-		const branded = await createSelvaProviders(
-			{ SELVA_BRAND_NAME: '  Acme  ' },
-			{ registry, ...noBoot }
-		);
-		expect(branded.branding().name).toBe('Acme');
-		expect(branded.branding().copyrightName).toBe('Acme');
-		expect(branded.branding().description).toContain('Acme');
-	});
-});
-
-describe('solve metric sink', () => {
-	it('falls back to a noop sink when the data provider has no solveMetrics', async () => {
-		const { registry } = makeRegistry();
-		const runtime = await createSelvaProviders({}, { registry, ...noBoot });
-		const sink = runtime.solveMetricSink();
-		expect(typeof sink.record).toBe('function');
-		expect(runtime.solveMetricSink()).toBe(sink); // memoized
-	});
-
-	it('reuses a duck-typed solveMetrics sink carried by the data provider', async () => {
-		const { registry } = makeRegistry();
-		const carried = { record: vi.fn() };
-		registry.data.local = vi.fn(() => ({ solveMetrics: carried }) as unknown as IDataProvider);
-		const runtime = await createSelvaProviders({}, { registry, ...noBoot });
-		expect(runtime.solveMetricSink()).toBe(carried);
-	});
-});
-
-describe('config-path override', () => {
-	it('loads the module default export and hands it the env', async () => {
-		const { registry, authLocal } = makeRegistry();
-		const configPath = fileURLToPath(new URL('./fixtures/override-config.mjs', import.meta.url));
-		const runtime = await createSelvaProviders(
-			{ OVERRIDE_MARKER: 'hello' },
-			{ registry, configPath, ...noBoot }
-		);
-		const config = runtime.resolve();
-		expect(config.auth.name).toBe('override-auth');
-		expect((config.data as unknown as { marker: string }).marker).toBe('hello');
-		expect(runtime.tenancy()).toBe('multi');
-		// The registry is bypassed entirely.
-		expect(authLocal).not.toHaveBeenCalled();
-	});
-
-	it('rejects at load time when the path does not exist', async () => {
-		const { registry } = makeRegistry();
-		await expect(
-			createSelvaProviders({}, { registry, configPath: './does-not-exist.js', ...noBoot })
-		).rejects.toThrow(/does-not-exist\.js/);
-	});
-});

package/src/providers/__tests__/fixtures/override-config.mjs

@@ -1,8 +0,0 @@
-// Fixture for the SELVA_CONFIG_PATH override test — a minimal selva.config.js
-// whose default export is a config factory, exactly as an operator would write.
-export default (env) => ({
-	tenancy: 'multi',
-	auth: { name: 'override-auth' },
-	data: { marker: env.OVERRIDE_MARKER },
-	storage: {}
-});