@selvajs/server 0.2.0-beta.2 → 0.2.0-beta.4

package/src/providers/create-selva-providers.ts

@@ -1,241 +0,0 @@
-// Configurable provider wiring (K5) — the reusable core of the app's
-// composition root, extracted so any app built on the engine gets the same
-// env-driven provider selection, `selva.config.js` override hook, and lazy
-// instantiation without copying it.
-//
-// The provider IMPLEMENTATIONS are not bundled: the caller passes a
-// `ProviderRegistry` mapping choice names (the `SELVA_*_PROVIDER` env values)
-// to `fromEnv`-style factories. That keeps this package free of dependencies
-// on `@selvajs/local-provider` / `@selvajs/supabase-provider` — a consuming
-// app registers exactly the providers it ships.
-//
-// Two wiring modes (unchanged from the app):
-//
-//   Default — providers are picked from env vars (SELVA_AUTH_PROVIDER etc.)
-//   via the registry. New deployments need only a .env file.
-//
-//   Override — pass `configPath` (e.g. env.SELVA_CONFIG_PATH) pointing at an
-//   external `selva.config.js` (absolute or CWD-relative). It is loaded
-//   dynamically at boot and replaces the env-driven wiring entirely. The path
-//   must resolve to an actual `.js` file — there's no TS compiler at runtime.
-
-import { pathToFileURL } from 'node:url';
-import { resolve as resolvePath } from 'node:path';
-import { existsSync } from 'node:fs';
-import type {
-	IAuthProvider,
-	IDataProvider,
-	IStorageProvider,
-	ISolveMetricSink,
-	SelvaBranding,
-	SelvaConfig,
-	SelvaConfigFactory,
-	SelvaFlags,
-	TenancyMode
-} from '@selvajs/platform';
-import { isFlagEnabled, NoopSolveMetricSink } from '@selvajs/platform';
-import { readBool, type EnvRecord } from '../compute/limits.js';
-
-export type ProviderFactory<T> = (env: EnvRecord) => T;
-
-/**
- * The provider implementations available to this deployment, keyed by the
- * (lowercase) choice name used in `SELVA_AUTH_PROVIDER` / `SELVA_DATA_PROVIDER`
- * / `SELVA_STORAGE_PROVIDER`.
- */
-export interface ProviderRegistry {
-	auth: Record<string, ProviderFactory<IAuthProvider>>;
-	data: Record<string, ProviderFactory<IDataProvider>>;
-	storage: Record<string, ProviderFactory<IStorageProvider>>;
-}
-
-export interface CreateSelvaProvidersOptions {
-	registry: ProviderRegistry;
-	/** Fallback choice per slot when the env var is unset. Default: `'local'`. */
-	defaults?: Partial<Record<'auth' | 'data' | 'storage', string>>;
-	/**
-	 * Path to an external `selva.config.js` override (absolute or CWD-relative).
-	 * Pass `env.SELVA_CONFIG_PATH` through; when set, the module's default
-	 * export (a `SelvaConfig` or factory) replaces the env-driven wiring.
-	 */
-	configPath?: string;
-	/** Boot-summary sink, called once on first `resolve()`. Default: `console.info`. */
-	onBoot?: (summary: string) => void;
-}
-
-export interface SelvaProviderRuntime {
-	/**
-	 * Memoized provider wiring. The first call instantiates providers from env
-	 * (and may throw if required secrets are missing); subsequent calls return
-	 * the cached config. Never call at build time — provider `fromEnv`
-	 * factories validate required secrets.
-	 */
-	resolve(): SelvaConfig;
-	tenancy(): TenancyMode;
-	/** Resolved branding — every field defaulted so the UI never null-checks. */
-	branding(): Required<SelvaBranding>;
-	/** Safe flag accessor — omitted flags resolve to false. */
-	flag(name: keyof SelvaFlags): boolean;
-	/** Per-solve timing sink; `NoopSolveMetricSink` when the config omits one. */
-	solveMetricSink(): ISolveMetricSink;
-}
-
-// Every SelvaFlags key, mapped from `SELVA_FLAG_<KEY>`. The `satisfies` +
-// exhaustiveness check below make adding a platform flag without listing it
-// here a compile error.
-const FLAG_KEYS = [
-	'ALLOW_CROSS_ORG_PUBLIC',
-	'ALLOW_ORG_COMPUTE_OVERRIDE',
-	'ALLOW_ORG_CREATION',
-	'ENABLE_PLATFORM_PROJECTS',
-	'ENABLE_SHARING'
-] as const satisfies readonly (keyof SelvaFlags)[];
-
-type AllFlagsListed =
-	Exclude<keyof SelvaFlags, (typeof FLAG_KEYS)[number]> extends never ? true : never;
-
-const _allFlagsListed: AllFlagsListed = true;
-
-function pick<T>(
-	env: EnvRecord,
-	envVar: string,
-	slot: Record<string, ProviderFactory<T>>,
-	fallback: string
-): T {
-	const choice = (env[envVar] ?? fallback).toLowerCase();
-	const factory = slot[choice];
-	if (!factory) {
-		throw new Error(`Unknown ${envVar}="${choice}". Expected: ${Object.keys(slot).join(' | ')}.`);
-	}
-	return factory(env);
-}
-
-function pickTenancy(env: EnvRecord): TenancyMode {
-	const choice = (env.SELVA_TENANCY ?? 'single').toLowerCase();
-	if (choice !== 'single' && choice !== 'multi') {
-		throw new Error(`Unknown SELVA_TENANCY="${choice}". Expected: single | multi.`);
-	}
-	return choice;
-}
-
-/**
- * Per-solve metric sink. Supabase's data provider carries a `solveMetrics`
- * sink built from its own client bundle — reuse it so timings persist
- * automatically. Backends without a metrics table leave it undefined, which
- * falls back to `NoopSolveMetricSink` in `solveMetricSink()`.
- */
-function pickSolveMetrics(data: IDataProvider): ISolveMetricSink | undefined {
-	const candidate = (data as { solveMetrics?: unknown }).solveMetrics;
-	if (candidate && typeof (candidate as { record?: unknown }).record === 'function') {
-		return candidate as ISolveMetricSink;
-	}
-	return undefined;
-}
-
-function buildDefaultFactory(options: CreateSelvaProvidersOptions): SelvaConfigFactory {
-	const { registry, defaults } = options;
-	return (env) => {
-		const data = pick(env, 'SELVA_DATA_PROVIDER', registry.data, defaults?.data ?? 'local');
-		return {
-			tenancy: pickTenancy(env),
-			flags: Object.fromEntries(
-				FLAG_KEYS.map((key) => [key, readBool(env, `SELVA_FLAG_${key}`, false)])
-			),
-			branding: {
-				name: env.SELVA_BRAND_NAME,
-				copyrightName: env.SELVA_BRAND_COPYRIGHT_NAME,
-				tagline: env.SELVA_BRAND_TAGLINE,
-				description: env.SELVA_BRAND_DESCRIPTION
-			},
-			auth: pick(env, 'SELVA_AUTH_PROVIDER', registry.auth, defaults?.auth ?? 'local'),
-			data,
-			storage: pick(env, 'SELVA_STORAGE_PROVIDER', registry.storage, defaults?.storage ?? 'local'),
-			solveMetrics: pickSolveMetrics(data)
-		};
-	};
-}
-
-async function loadConfigSource(
-	options: CreateSelvaProvidersOptions
-): Promise<SelvaConfig | SelvaConfigFactory> {
-	if (!options.configPath) {
-		return buildDefaultFactory(options);
-	}
-	const abs = resolvePath(process.cwd(), options.configPath);
-	if (!existsSync(abs)) {
-		throw new Error(
-			`Config override path ${options.configPath} resolved to ${abs} which does not exist.`
-		);
-	}
-	// Dynamic specifier — a bundler must not pre-resolve this at build time,
-	// hence @vite-ignore. pathToFileURL keeps Windows absolute paths valid as
-	// ESM specifiers.
-	const mod = (await import(/* @vite-ignore */ pathToFileURL(abs).href)) as {
-		default: SelvaConfig | SelvaConfigFactory;
-	};
-	return mod.default;
-}
-
-/**
- * Build the provider runtime. Loading the *config source* (default factory,
- * or the `configPath` override module) happens here and is cheap and
- * secret-free — a factory is just a function. The factory is NOT invoked:
- * that runs the registry's `fromEnv` factories, which validate required
- * secrets, and doing it at import/build time would make merely building the
- * app require a full runtime env. Provider instantiation is deferred to the
- * first `resolve()`.
- */
-export async function createSelvaProviders(
-	env: EnvRecord,
-	options: CreateSelvaProvidersOptions
-): Promise<SelvaProviderRuntime> {
-	const raw = await loadConfigSource(options);
-	const onBoot = options.onBoot ?? console.info;
-
-	let config: SelvaConfig | undefined;
-	let solveMetricSink: ISolveMetricSink | undefined;
-
-	function resolve(): SelvaConfig {
-		if (config) return config;
-		config = typeof raw === 'function' ? raw(env) : raw;
-
-		// One-line boot summary so operators can confirm at a glance what got
-		// wired without grepping env vars or reading the config file. Provider
-		// names come from the IAuthProvider.name field; data/storage adapters
-		// don't expose a name, so we infer from the constructor.
-		onBoot(
-			`[selva] providers wired: ` +
-				`auth=${config.auth.name} ` +
-				`data=${config.data.constructor.name} ` +
-				`storage=${config.storage.constructor.name} ` +
-				`tenancy=${config.tenancy ?? 'single'}` +
-				(options.configPath ? ` config=${options.configPath}` : '')
-		);
-
-		return config;
-	}
-
-	return {
-		resolve,
-		tenancy: () => resolve().tenancy ?? 'single',
-		branding: () => {
-			const brand = resolve().branding ?? {};
-			const name = brand.name?.trim() || 'Selva';
-			return {
-				name,
-				copyrightName: brand.copyrightName?.trim() || name,
-				tagline: brand.tagline?.trim() || 'Turn Grasshopper definitions into tools anyone can use.',
-				description:
-					brand.description?.trim() ||
-					`Build and deploy interactive web applications powered by Grasshopper definitions with ${name}.`
-			};
-		},
-		flag: (name) => isFlagEnabled(resolve(), name),
-		solveMetricSink: () => {
-			if (!solveMetricSink) {
-				solveMetricSink = resolve().solveMetrics ?? new NoopSolveMetricSink();
-			}
-			return solveMetricSink;
-		}
-	};
-}

package/src/providers/index.ts

@@ -1,12 +0,0 @@
-// Configurable provider wiring — env-driven provider selection over a
-// caller-supplied registry, `selva.config.js` override hook, lazy memoized
-// instantiation. The app keeps its own getters (services, error reporting) as
-// its composition root; this is the reusable core underneath.
-
-export {
-	createSelvaProviders,
-	type CreateSelvaProvidersOptions,
-	type ProviderFactory,
-	type ProviderRegistry,
-	type SelvaProviderRuntime
-} from './create-selva-providers.js';

package/src/tokens/__tests__/token-codec.test.ts

@@ -1,63 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { createTokenCodec, MIN_TOKEN_SECRET_LENGTH } from '../token-codec.js';
-
-const SECRET = 'unit-test-secret-that-is-long-enough-to-pass';
-
-describe('createTokenCodec', () => {
-	it('rejects a secret shorter than the minimum', () => {
-		expect(() => createTokenCodec({ prefix: 'share_', secret: 'short' })).toThrow(
-			/at least 32 characters/
-		);
-		expect(() =>
-			createTokenCodec({ prefix: 'share_', secret: 'x'.repeat(MIN_TOKEN_SECRET_LENGTH - 1) })
-		).toThrow(/got 31/);
-	});
-
-	it('accepts a secret at exactly the minimum length', () => {
-		expect(() =>
-			createTokenCodec({ prefix: 'share_', secret: 'x'.repeat(MIN_TOKEN_SECRET_LENGTH) })
-		).not.toThrow();
-	});
-
-	it('mints prefixed, unique, URL-safe tokens', () => {
-		const codec = createTokenCodec({ prefix: 'share_', secret: SECRET });
-		const a = codec.mintRawToken();
-		const b = codec.mintRawToken();
-		expect(a).toMatch(/^share_[A-Za-z0-9_-]{43}$/); // 32 bytes → 43 base64url chars
-		expect(a).not.toBe(b);
-	});
-
-	it('hashes deterministically, never echoing the raw token', () => {
-		const codec = createTokenCodec({ prefix: 'share_', secret: SECRET });
-		const raw = codec.mintRawToken();
-		const hash = codec.hashToken(raw);
-		expect(codec.hashToken(raw)).toBe(hash);
-		expect(hash).not.toContain(raw);
-		expect(hash).toMatch(/^[A-Za-z0-9_-]+$/); // base64url
-	});
-
-	it('produces different hashes under different secrets (rotation invalidates)', () => {
-		const a = createTokenCodec({ prefix: 'share_', secret: SECRET });
-		const b = createTokenCodec({ prefix: 'share_', secret: SECRET + '-rotated' });
-		const raw = a.mintRawToken();
-		expect(a.hashToken(raw)).not.toBe(b.hashToken(raw));
-	});
-
-	it('hashesEqual: equal, unequal, and length-mismatch inputs', () => {
-		const codec = createTokenCodec({ prefix: 'invite_', secret: SECRET });
-		const hash = codec.hashToken(codec.mintRawToken());
-		const other = codec.hashToken(codec.mintRawToken());
-		expect(codec.hashesEqual(hash, hash)).toBe(true);
-		expect(codec.hashesEqual(hash, other)).toBe(false);
-		expect(codec.hashesEqual(hash, hash.slice(0, -1))).toBe(false);
-	});
-
-	it('looksLikeToken recognizes only its own prefix', () => {
-		const share = createTokenCodec({ prefix: 'share_', secret: SECRET });
-		const invite = createTokenCodec({ prefix: 'invite_', secret: SECRET });
-		const raw = share.mintRawToken();
-		expect(share.looksLikeToken(raw)).toBe(true);
-		expect(invite.looksLikeToken(raw)).toBe(false);
-		expect(share.looksLikeToken('random-string')).toBe(false);
-	});
-});

package/src/tokens/index.ts

@@ -1,8 +0,0 @@
-// HMAC token codec for capability-URL tokens (share links, invites, …).
-
-export {
-	createTokenCodec,
-	MIN_TOKEN_SECRET_LENGTH,
-	type TokenCodec,
-	type TokenCodecConfig
-} from './token-codec.js';

package/src/tokens/token-codec.ts

@@ -1,86 +0,0 @@
-import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
-
-/**
- * HMAC token codec — the primitive behind capability-URL tokens (share links,
- * invites, and anything shaped like them).
- *
- * ## Two-part design
- *
- * Each minted token involves TWO secrets:
- *
- *   1. **Per-token secret** — generated in `mintRawToken()` from 32 random
- *      bytes, returned to the caller exactly once at mint time. Different
- *      every token. This is what end-users carry in `?token=…`.
- *
- *   2. **Instance-wide HMAC secret** (`config.secret`) — used to hash tokens
- *      for storage. The store sees only `HMAC-SHA256(secret, token)`. A
- *      DB-only leak therefore can't be replayed: the attacker would need the
- *      secret too, and it lives in env, not the database.
- *
- * ## Format
- *   raw    = `<prefix><base64url(32 random bytes)>`
- *   hash   = base64url( HMAC-SHA256(secret, raw) )
- *
- * The resolution path hashes the supplied token with the same secret and looks
- * up by exact match against the stored hash.
- *
- * Rotating the secret invalidates every token minted under it — give each
- * token family (each prefix) its own secret so they rotate independently.
- */
-
-/**
- * Minimum accepted secret length. Matches the "random ≥32-byte string"
- * guidance everywhere these secrets are documented; enforced here so a
- * short dev secret can't reach production silently (presence-only checks
- * let a 4-char secret through).
- */
-export const MIN_TOKEN_SECRET_LENGTH = 32;
-
-export interface TokenCodecConfig {
-	/** Token-family marker prepended to every raw token, e.g. `share_`. */
-	prefix: string;
-	/** Instance-wide HMAC secret. Must be at least 32 characters. */
-	secret: string;
-}
-
-export interface TokenCodec {
-	/** Mint: generate a fresh raw token. Show to the caller exactly once. */
-	mintRawToken(): string;
-	/** Hash a raw token to its store-side representation. */
-	hashToken(raw: string): string;
-	/** Constant-time equality for two stored hashes. */
-	hashesEqual(a: string, b: string): boolean;
-	/** Recognize this codec's token format on inbound requests. */
-	looksLikeToken(value: string): boolean;
-	/** The configured prefix, for callers that build URLs or error copy. */
-	readonly prefix: string;
-}
-
-export function createTokenCodec(config: TokenCodecConfig): TokenCodec {
-	const { prefix, secret } = config;
-	if (secret.length < MIN_TOKEN_SECRET_LENGTH) {
-		throw new Error(
-			`Secret for "${prefix}" tokens must be at least ${MIN_TOKEN_SECRET_LENGTH} characters ` +
-				`(got ${secret.length}). Generate one with: openssl rand -base64 32`
-		);
-	}
-
-	return {
-		prefix,
-		mintRawToken(): string {
-			return prefix + randomBytes(32).toString('base64url');
-		},
-		hashToken(raw: string): string {
-			return createHmac('sha256', secret).update(raw).digest('base64url');
-		},
-		hashesEqual(a: string, b: string): boolean {
-			const ab = Buffer.from(a);
-			const bb = Buffer.from(b);
-			if (ab.length !== bb.length) return false;
-			return timingSafeEqual(ab, bb);
-		},
-		looksLikeToken(value: string): boolean {
-			return value.startsWith(prefix);
-		}
-	};
-}