@server/next 0.20.15 → 0.20.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.20.15",
+  "version": "0.20.16",
   "description": "An experimental reimplementation of server.js focused on the DX",
   "homepage": "https://node-server.com/",
   "repository": "https://github.com/franciscop/server-next.git",
@@ -30,6 +30,7 @@
   },
   "engineStrict": true,
   "devDependencies": {
+    "argon2": "^0.40.3",
     "jest": "^29.7.0",
     "polystore": "^0.8.0"
   },
@@ -37,7 +38,5 @@
     "testEnvironment": "jest-environment-node",
     "transform": {}
   },
-  "dependencies": {
-    "argon2": "^0.40.3"
-  }
+  "dependencies": {}
 }

package/readme.md

@@ -1,116 +1,121 @@
-# Server @ Next
+# Documentation
 
 > **⚠️ WIP** This is an **experimental library** right now!
 
-A fully-fledged web server for Bun and Node.js, with all the basics covered for you:
+A fully-fledged web server for Bun and Node.js, with all the basics built-in:
 
 ```js
 import server from "@server/next";
 
-// Create a running instance of the server
 export default server(options)
   .get("/books", () => Book.list())
-  .post("/books", { body: BookSchema }, (ctx) => {
+  .post("/books", BookSchema, (ctx) => {
     return Book.create(ctx.body).save();
   });
 ```
 
-It includes all the things you would expect from a modern Server framework, like routing, static file serving, body+file parsing, gzip+brotli, streaming, testing, error handling, websockets, etc. We also have integrations with these:
+It includes all the things you would expect from a modern Server framework, like routing, static file serving, body+file parsing, gzip+brotli, streaming, testing, error handling, websockets, etc.
 
-- KV Stores: in-memory, Redis, Consul, DynamoDB.
+We also have integrations and adaptors for these:
+
+- KV Stores: in-memory, Redis, Consul, DynamoDB, [Level](https://github.com/Level/level).
 - Buckets: AWS S3, Cloudflare R2, Backblaze B2.
-- Validation libraries: Zod, Joi, Yup.
+- Validation libraries: [Zod](https://zod.dev/), [Joi](https://joi.dev/), [Yup](https://github.com/jquense/yup), [Validate](https://validatejs.org), etc.
+- Auth: JWT, Session, Cookies, Social login.
 
 ```js
-// Easy testing as well - index.test.js
+// How to test your server - index.test.js
 import app from "./";
 const api = app.test();  // Very convenient helper, AXIOS-like interface
 
-it("can retrieve the homepage", async () => {
+it("can retrieve the book list", async () => {
   const { data: books } = await api.get("/books/");
   expect(books[0]).toEqual({ id: 0, name: ... });
 });
 ```
 
-## Upgrading server
+## Getting started
 
-Why? We live in the era of multi-cloud (Heroku, Workers, Lambda, etc) and multi-runtimes (Node.js, Bun, WinterGC, etc). Desired improvements (WIP!):
+First install it:
 
-- Tiny footprint with few dependencies. Installing and using the full library takes under 10kb (target limit).
-- Faster! Reimplemented from scratch for speed. With raw ES6+ and a tiny code footprint, your server will fly.
-- Modern ES6+ESM syntax for both the library and examples.
-- Not using express underneath anymore. Considering keeping the compatibility layer anyway (since Express itself is a thin layer).
-- Changed the reply logic greatly, including the removal of `render()`. This is the main reason express was removed. Many servers don't need render() at all.
-- **[security]** Removed mandatory CSRF token, since this is only useful for server-rendered pages and not for SPA. Now we provide an `auth` module instead.
+```
+npm install @server/next
+yarn add @server/next
+bun install @server/next
+```
 
-## Progress
+Now you can create your first simple server:
 
-- Router has all verbs, as well as URL pattern matches
-- Full URL parsing, including `query` and `params` in `ctx.url`.
-- Body and Files parsing is working (need testing)
-- The middleware can return:
-  - A number and it'll be set as the status code
-  - A string and it'll be sent as plain text or html (if it starts with "<")
-  - A readStream and it'll be piped to the response
-  - An object with `status`, `body` and `headers` and it'll be set raw.
-- Response compression works
-- Zod light integration
-- Auth work
+```js
+// index.js
+import server from "@server/next";
 
-## Examples
+export default server()
+  .get("/", () => "Hello world")
+  .post("/", (ctx) => {
+    console.log(ctx.body);
+    return 201;
+  });
+```
 
-### Streams
+Then run `node .` or `bun .` and open your browser on http://localhost:3000/ to see the message.
 
-Creating a 100x100px thumbnail on the fly with Sharp:
+There are some major configuration options that you might want to set up though, enumerated in the [Basic Usage](#basic-usage) and explained through the docs.
 
-```js
-// createThumbnail.js
-import sharp from "sharp";
+## Basic usage
 
-export default function createThumbnail(ctx) {
-  // Return a pipe, which will be streamed to the output
-  return sharp(ctx.url.params.name).resize(100, 100, { fit: "cover" }).png();
-}
-```
+Now that you know how to create a barebones server, there are some important bits that you might want to update.
 
-### Breaking Changes
+`SECRET`: create an `.env` file (ignored in git with `.gitignore`) with the `SECRET=` and then a long, unique random secret. It will be used to sign and/or encrypt things as needed.
 
-`import`, `export` and routing are the main changes from your point of view:
+`store`: almost anything you want to persist will need a KV store to do so. For dev you can use an in-memory or a file-based (easy for debugging!) store, but for production systems you would normally use something like Redis. Can be as easy as `const store = new Map();` for dev.
 
-```js
-import server, { status, type, ...reply } from 'server';
+> Note: `bucket` is still _not_ available
 
-export default server({ ...options })
-  .use(mid1)
-  .get('/', cb1)
-  .get('/b', mid2, cb2)
-  .routes({ get: [['/c', mid3, cb3]] });
-```
+`bucket`: if you want to accept user files you will need a place to persist them. By default they are put in the filesystem, but since most cloud providers are ephemeral, provide a `bucket` and it will be used to handle the files directly.
 
-`status()` now it's always partial:
+An example of how that works in practice:
 
 ```js
-// OLD
-return 404;
-return status(404).send("Not here..."); // treated as partial
-return status(404); // treated as final
-
-// NEW
-return 404;
-return status(404).send("Not here..."); // GOOD
-return status(404).send(); // GOOD
-
-// DON'T DO:
-return status(404); // INVALID
-```
+// index.js
+import server from "@server/next";
 
-```js
-import server from "server";
+import Bucket from "bucket/b2";
+import { createClient } from "redis";
 
-export default server()
+const bucket = Bucket("mybucketname", { id, key });
+const store = createClient("...").connect();
+
+export default server({ bucket, store })
   .get("/", () => "Hello world")
   .post("/", (ctx) => {
     console.log(ctx.body);
     return 201;
   });
 ```
+
+## Guides
+
+### Middleware
+
+### Validation
+
+### Stores
+
+### File handling
+
+## Options
+
+Options docs here
+
+## Router
+
+Router docs here
+
+## Context
+
+Context docs here
+
+## Reply
+
+Reply docs here

package/src/auth/providers/email.js

@@ -1,10 +1,36 @@
-import argon2 from "argon2";
-
 import { createId } from "../../helpers/index.js";
 import { ServerError, status } from "../../index.js";
 import findUser from "../findUser.js";
 import updateUser from "../updateUser.js";
 
+const hash = new Proxy(
+  {},
+  {
+    get: (self, key) => {
+      const load = async () =>
+        Object.assign(
+          self,
+          await import("argon2").catch(() => {
+            throw new ServerError.AUTH_ARGON_NEEDED();
+          })
+        );
+      if (key === "verify" && !self.verify) {
+        return async (hash, pass) => {
+          await load();
+          return self.verify(hash, pass);
+        };
+      }
+      if (key === "hash" && !self.hash) {
+        return async (pass) => {
+          await load();
+          return self.hash(pass);
+        };
+      }
+      return self[key];
+    },
+  }
+);
+
 const createSession = async (user, ctx) => {
   const { type, session, cleanUser } = ctx.options.auth;
   user = cleanUser(user);
@@ -45,7 +71,7 @@ async function login(ctx) {
   if (!(await store.has(email))) throw ServerError.LOGIN_WRONG_EMAIL();
 
   const user = await store.get(email);
-  const isValid = await argon2.verify(user.password, password);
+  const isValid = await hash.verify(user.password, password);
   if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
 
   return createSession(user, ctx);
@@ -64,7 +90,7 @@ async function register(ctx) {
   const user = {
     id: createId(),
     email,
-    password: await argon2.hash(password),
+    password: await hash.hash(password),
     ...data,
   };
   await store.set(email, user);
@@ -99,10 +125,10 @@ async function password(ctx) {
 
   const fullUser = await findUser(ctx.auth, ctx.options.auth.store);
 
-  const isValid = await argon2.verify(fullUser.password, previous);
+  const isValid = await hash.verify(fullUser.password, previous);
   if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
 
-  fullUser.password = await argon2.hash(updated);
+  fullUser.password = await hash.hash(updated);
   await updateUser(fullUser, ctx.auth, ctx.options.auth.store);
 
   return 200;

package/src/errors/index.js

@@ -4,6 +4,9 @@ ServerError.extend({
   NO_STORE: `You need a 'store' to write 'ctx.session'`,
   NO_STORE_WRITE: `You need a 'store' to write 'ctx.session.{key}'`,
   NO_STORE_READ: `You need a 'store' to read 'ctx.session.{key}'`,
+
+  AUTH_ARGON_NEEDED:
+    "Argon2 is needed for the auth module, please install it with 'npm i argon2'",
   AUTH_INVALID_TYPE: `Invalid Authorization type, '{type}'`,
   AUTH_INVALID_TOKEN: `Invalid Authorization token`,
   AUTH_INVALID_COOKIE: `Invalid Authorization cookie`,
@@ -18,14 +21,14 @@ ServerError.extend({
   LOGIN_NO_EMAIL: "The email is required to log in",
   LOGIN_INVALID_EMAIL: "The email you wrote is not correct",
   LOGIN_NO_PASSWORD: "The email is required to log in",
-  LOGIN_INVALID_PASSWORD: "The email you wrote is not correct",
+  LOGIN_INVALID_PASSWORD: "The password you wrote is not correct",
   LOGIN_WRONG_ACCOUNT: `That email does not correspond to any account`,
   LOGIN_WRONG_PASSWORD: `That is not the valid password`,
 
   REGISTER_NO_EMAIL: `Email needed`,
   REGISTER_INVALID_EMAIL: "The email you wrote is not correct",
   REGISTER_NO_PASSWORD: `Password needed`,
-  REGISTER_INVALID_PASSWORD: "The email you wrote is not correct",
+  REGISTER_INVALID_PASSWORD: "The password you wrote is not correct",
   REGISTER_EMAIL_EXISTS: `Email is already registered`,
 });