@server/next 0.20.50 → 0.21.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.20.50",
+  "version": "0.21.1",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "https://github.com/franciscop/server-next.git",
@@ -10,8 +10,9 @@
   "license": "UNLICENSED",
   "documentation": {
     "title": "Server JS - A modern web server for Bun and Node.js",
+    "home": "./docs/index.html",
     "menu": {
-      "About": "/about",
+      "About": "/",
       "Documentation": "/documentation",
       "Github": "https://github.com/franciscop/server-next"
     }
@@ -34,11 +35,10 @@
     "index.d.ts",
     "jsx-dev-runtime.js"
   ],
-  "dependencies": {},
   "devDependencies": {
     "argon2": "^0.40.3",
     "jest": "^29.7.0",
-    "polystore": "^0.8.0"
+    "polystore": "^0.14.1"
   },
   "engines": {
     "node": ">=20.0.0"

package/src/auth/auth.js

@@ -5,14 +5,14 @@ const validateToken = (authorization) => {
   if (type.toLowerCase() !== "bearer") {
     throw ServerError.AUTH_INVALID_TYPE({ type });
   }
-  if (id.length !== 24) {
+  if (id.length !== 16) {
     throw ServerError.AUTH_INVALID_TOKEN();
   }
   return id;
 };
 
 const validateCookie = (authorization) => {
-  if (authorization.length !== 24) {
+  if (authorization.length !== 16) {
     throw ServerError.AUTH_INVALID_COOKIE();
   }
   return authorization;
@@ -31,15 +31,15 @@ const findSessionId = (ctx) => {
 
   if (type === "cookie") {
     // If the user is not authenticated, there's no auth to retrieve
-    if (!ctx.cookies.authorization) return;
+    if (!ctx.cookies.authentication) return;
 
-    return validateCookie(ctx.cookies.authorization);
+    return validateCookie(ctx.cookies.authentication);
   }
 
-  throw new Error("Invalid auth type " + type);
+  throw new Error(`Invalid auth type "${type}"`);
 };
 
-export default async function findAuth(ctx) {
+export default async function auth(ctx) {
   if (!ctx.options.auth) return; // NO AUTH AT ALL; nothing to do here
   const options = ctx.options.auth;
 
@@ -47,7 +47,10 @@ export default async function findAuth(ctx) {
   if (!sessionId) return; // NO SESSION FOUND; no auth
 
   const auth = await options.session.get(sessionId);
+  // Mmh, which one to do...
   if (!auth) throw ServerError.AUTH_NO_SESSION();
+  // if (!auth) return; // SESSION ALREADY INVALID; no auth
+
   if (!auth.provider) throw ServerError.AUTH_NO_PROVIDER();
   if (!options.provider.includes(auth.provider)) {
     const valid = JSON.stringify(options.provider);

package/src/auth/index.js

@@ -14,6 +14,13 @@ const middle = async (ctx) => {
   if (ctx.options.auth) {
     ctx.app.post("/auth/logout", logout);
 
+    if (ctx.options.auth.provider.includes("github")) {
+      if (!env.GITHUB_ID) throw new Error("GITHUB_ID not defined");
+      if (!env.GITHUB_SECRET) throw new Error("GITHUB_SECRET not defined");
+      ctx.app.get("/auth/login/github", providers.github.login);
+      ctx.app.get("/auth/callback/github", providers.github.callback);
+    }
+
     if (ctx.options.auth.provider.includes("email")) {
       ctx.app.post("/auth/register/email", providers.email.register);
       ctx.app.post("/auth/login/email", providers.email.login);

package/src/auth/index.test.js

@@ -4,7 +4,7 @@ import kv from "polystore";
 
 import server from "../index.js";
 
-const ID = "REqA2l022l8Q0tuIRtqLOPUy";
+const ID = "REqA2l022l8Q0tuI";
 
 describe("auth", () => {
   it("requires a provider", () => {
@@ -24,14 +24,14 @@ describe("auth", () => {
       id: ID,
       type: "token",
       provider: "wrong",
-      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      user: "QypOn5SQApyOPdUp",
       email: "abc@test.com",
       time: "2024-07-01T03:21:40Z",
     });
-    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const authorization = "Bearer REqA2l022l8Q0tuI";
     const req = await api.get("/", { headers: { authorization } });
     expect(req).not.toSucceed(
-      'Invalid provider "wrong", valid ones are: "email"'
+      'Invalid provider "wrong", valid ones are: "email"',
     );
   });
 });
@@ -47,7 +47,7 @@ describe("token", () => {
   });
 
   it("should be Bearer", async () => {
-    const authorization = "Basic REqA2l022l8Q0tuIRtqLOPUy";
+    const authorization = "Basic REqA2l022l8Q0tuI";
     const req = await api.get("/", { headers: { authorization } });
     expect(req).not.toSucceed("Invalid Authorization type, 'Basic'");
   });
@@ -59,7 +59,7 @@ describe("token", () => {
   });
 
   it("cannot get the session", async () => {
-    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const authorization = "Bearer REqA2l022l8Q0tuI";
     const req = await api.get("/", { headers: { authorization } });
     expect(req).not.toSucceed("Invalid session");
   });
@@ -69,29 +69,29 @@ describe("token", () => {
       id: ID,
       type: "token",
       provider: "email",
-      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      user: "QypOn5SQApyOPdUp",
       email: "abc@test.com",
       time: "2024-07-01T03:21:40Z",
     });
-    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const authorization = "Bearer REqA2l022l8Q0tuI";
     const req = await api.get("/", { headers: { authorization } });
     expect(req).not.toSucceed("Credentials do not correspond to a user");
   });
 
   it("cannot get the user", async () => {
-    store.set("auth:REqA2l022l8Q0tuIRtqLOPUy", {
-      id: "REqA2l022l8Q0tuIRtqLOPUy",
+    store.set("auth:REqA2l022l8Q0tuI", {
+      id: "REqA2l022l8Q0tuI",
       type: "token",
       provider: "email",
-      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      user: "QypOn5SQApyOPdUp",
       email: "abc@test.com",
       time: "2024-07-01T03:21:40Z",
     });
-    store.set("user:abc@test.com", {
-      id: "QypOn5SQApyOPdUpIZsO9u2O",
+    store.set("user:QypOn5SQApyOPdUp", {
+      id: "QypOn5SQApyOPdUp",
       email: "abc@test.com",
     });
-    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const authorization = "Bearer REqA2l022l8Q0tuI";
     const req = await api.get("/", { headers: { authorization } });
     expect(req).toSucceed();
   });
@@ -104,19 +104,19 @@ describe("cookie", () => {
     .test();
 
   it("should have the proper token in email", async () => {
-    const cookie = "authorization=hello";
+    const cookie = "authentication=hello";
     const req = await api.get("/", { headers: { cookie } });
     expect(req).not.toSucceed("Invalid Authorization cookie");
   });
 
   it("can get the proper session", async () => {
-    const cookie = "authorization=REqA2l022l8Q0tuIRtqLOPUy";
+    const cookie = "authentication=REqA2l022l8Q0tuI";
     const req = await api.get("/", { headers: { cookie } });
     expect(req).not.toSucceed("Invalid session");
   });
 
   it("can get the proper session", async () => {
-    const cookie = "authorization=REqA2l022l8Q0tuIRtqLOPUy";
+    const cookie = "authentication=REqA2l022l8Q0tuI";
     const req = await api.get("/", { headers: { cookie } });
     expect(req).not.toSucceed();
   });

package/src/auth/providers/email.js

@@ -1,6 +1,5 @@
 import { createId } from "../../helpers/index.js";
 import { ServerError, status } from "../../index.js";
-import findUser from "../findUser.js";
 import updateUser from "../updateUser.js";
 
 const hash = new Proxy(
@@ -12,7 +11,7 @@ const hash = new Proxy(
           self,
           await import("argon2").catch(() => {
             throw new ServerError.AUTH_ARGON_NEEDED();
-          })
+          }),
         );
       if (key === "verify" && !self.verify) {
         return async (hash, pass) => {
@@ -28,29 +27,29 @@ const hash = new Proxy(
       }
       return self[key];
     },
-  }
+  },
 );
 
 const createSession = async (user, ctx) => {
-  const { type, session, cleanUser } = ctx.options.auth;
+  const { type, session, cleanUser, redirect = "/user" } = ctx.options.auth;
   user = cleanUser(user);
-  const token = createId();
+  const id = createId();
   const provider = "email";
   const time = new Date().toISOString().replace(/\.[0-9]*/, "");
   ctx.auth = {
-    id: token,
+    id,
     type,
     provider,
-    user: user.id,
+    user: user.email,
     email: user.email,
     time,
   };
-  await session.set(token, ctx.auth, { expires: "1w" });
+  await session.set(id, ctx.auth, { expires: "1w" });
 
   if (type === "token") {
-    return status(201).json({ ...user, token });
+    return status(201).json({ ...user, token: id });
   } else if (type === "cookie") {
-    return status(201).cookies({ authorization: token }).send(user);
+    return status(302).cookies({ authentication: id }).redirect(redirect);
   } else if (type === "jwt") {
     throw new Error("JWT auth not supported yet");
   } else if (type === "key") {
@@ -87,10 +86,12 @@ async function register(ctx) {
   const store = ctx.options.auth.store;
   if (await store.has(email)) throw ServerError.REGISTER_EMAIL_EXISTS();
 
+  const time = new Date().toISOString().replace(/\.[0-9]*/, "");
   const user = {
-    id: createId(),
+    id: createId(user.email),
     email,
     password: await hash.hash(password),
+    time,
     ...data,
   };
   await store.set(email, user);
@@ -123,7 +124,7 @@ async function reset(ctx) {
 async function password(ctx) {
   const { previous, updated } = ctx.body;
 
-  const fullUser = await findUser(ctx.auth, ctx.options.auth.store);
+  const fullUser = await ctx.options.auth.store.get(ctx.auth.user);
 
   const isValid = await hash.verify(fullUser.password, previous);
   if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();

package/src/auth/providers/github.js

@@ -0,0 +1,82 @@
+import createId from "../../helpers/createId.js";
+import { redirect, status } from "../../reply.js";
+
+const oauth = async (code) => {
+  const fch = async (url, { body, headers = {}, ...rest } = {}) => {
+    headers.accept = "application/json";
+    headers["content-type"] = "application/json";
+    const res = await fetch(url, { ...rest, body, headers });
+    if (!res.ok) throw new Error("Invalid request");
+    return res.json();
+  };
+
+  const res = await fch("https://github.com/login/oauth/access_token", {
+    method: "post",
+    body: JSON.stringify({
+      client_id: env.GITHUB_ID,
+      client_secret: env.GITHUB_SECRET,
+      code,
+    }),
+  });
+  return (path) => {
+    return fch("https://api.github.com" + path, {
+      headers: { Authorization: "Bearer " + res.access_token },
+    });
+  };
+};
+
+const login = (ctx) => {
+  return redirect(
+    `https://github.com/login/oauth/authorize?client_id=${env.GITHUB_ID}&scope=user:email`,
+  );
+};
+
+const getUserProfile = async (code) => {
+  const api = await oauth(code);
+  const [profile, emails] = await Promise.all([
+    api("/user"),
+    api("/user/emails"),
+  ]);
+  const email = emails.sort((a) => (a.primary ? -1 : 1))[0]?.email;
+  return { ...profile, email };
+};
+
+const callback = async (ctx) => {
+  const { type, cleanUser, store, session, redirect } = ctx.options.auth;
+
+  const profile = await getUserProfile(ctx.url.query.code);
+
+  const auth = {
+    id: createId(),
+    type,
+    provider: "github",
+    user: createId(profile.email),
+    email: profile.email,
+    time: new Date().toISOString().replace(/\.[0-9]*/, ""),
+  };
+  const user = cleanUser({
+    id: profile.id,
+    name: profile.name,
+    email: profile.email,
+    picture: profile.avatar_url,
+    location: profile.location,
+    created: profile.created_at,
+  });
+
+  await store.set(auth.user, user);
+  await session.set(auth.id, auth, { expires: "1w" });
+
+  if (auth.type === "token") {
+    return status(201).json({ ...user, token: auth.id });
+  } else if (auth.type === "cookie") {
+    return status(302).cookies({ authentication: auth.id }).redirect(redirect);
+  } else if (auth.type === "jwt") {
+    throw new Error("JWT auth not supported yet");
+  } else if (auth.type === "key") {
+    throw new Error("Key auth not supported yet");
+  } else {
+    throw new Error("Unknown auth type");
+  }
+};
+
+export default { login, callback };

package/src/auth/providers/index.js

@@ -1,3 +1,4 @@
 import { default as email } from "./email.js";
+import { default as github } from "./github.js";
 
-export default { email };
+export default { email, github };

package/src/auth/user.js

@@ -1,10 +1,9 @@
 import ServerError from "../ServerError.js";
-import findUser from "./findUser.js";
 
 export default async function user(ctx) {
   if (!ctx.auth) return;
 
-  const user = await findUser(ctx.auth, ctx.options.auth.store);
+  const user = await ctx.options.auth.store.get(ctx.auth.user);
   if (!user) throw ServerError.AUTH_NO_USER();
   return ctx.options.auth.cleanUser(user);
 }

package/src/context/parseBody.test.js

@@ -41,15 +41,15 @@ describe("parseBody", () => {
     const body = await parseBody(
       getBody(),
       "multipart/form-data; boundary=----WebKitFormBoundaryvef1fLxmoUdYZWXp",
-      { write: (id) => id }
+      { write: (id) => id },
     );
     expect(body).toMatchObject({
       hello: "world",
       test: ["test message 123456", "test message number two"],
     });
 
-    const matchMd = expect.stringMatching(/^\w{24}.md$/);
-    const matchTxt = expect.stringMatching(/^\w{24}.txt$/);
+    const matchMd = expect.stringMatching(/^\w{16}.md$/);
+    const matchTxt = expect.stringMatching(/^\w{16}.txt$/);
     expect(body).toMatchObject({
       profile: matchMd,
       gallery: [matchTxt, matchTxt],

package/src/helpers/config.js

@@ -58,10 +58,13 @@ export default function config(options) {
     }
     if (!options.auth.cleanUser) {
       options.auth.cleanUser = (fullUser) => {
-        const { password, ...user } = fullUser;
+        const { password, token, ...user } = fullUser;
         return user;
       };
     }
+    if (!options.auth.redirect) {
+      options.auth.redirect = "/user";
+    }
   }
 
   return options;

package/src/helpers/cookies.test.js

@@ -12,12 +12,12 @@ describe("set-cookie", () => {
   it("sets the right cookie", async () => {
     const api = app.test();
     const res = await api.get("/hello");
-    expect(res.headers["set-cookie"]).toBe("hello=world");
+    expect(res.headers["set-cookie"]).toBe("hello=world;Path=/");
   });
 
   it("can set multiple cookies", async () => {
     const api = app.test();
     const res = await api.get("/multiple");
-    expect(res.headers["set-cookie"]).toEqual(["a=b", "c=d"]);
+    expect(res.headers["set-cookie"]).toEqual(["a=b;Path=/", "c=d;Path=/"]);
   });
 });

package/src/helpers/createCookies.js

@@ -9,7 +9,7 @@ export default function createCookies(cookies) {
       val = { value: val };
     }
     const { value, path, expires } = val;
-    const pathPart = path ? ";Path=" + path : "";
+    const pathPart = ";Path=" + (path || "/");
     const expiresPart = expires ? ";Expires=" + expires : "";
     return `${key}=${value || ""}${pathPart}${expiresPart}`;
   });

package/src/helpers/createId.js

@@ -1,17 +1,52 @@
-const urlAlphabet =
+const alphabet =
   "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
 
 export let random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
 
-export default function createId() {
-  let size = 24;
+// Credit: https://stackoverflow.com/a/52171480/938236
+const cyrb53 = (str, seed = 0) => {
+  if (typeof str !== "string") str = String(str);
+  let h1 = 0xdeadbeef ^ seed;
+  let h2 = 0x41c6ce57 ^ seed;
+  for (let i = 0, ch; i < str.length; i++) {
+    ch = str.charCodeAt(i);
+    h1 = Math.imul(h1 ^ ch, 2654435761);
+    h2 = Math.imul(h2 ^ ch, 1597334677);
+  }
+  h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507);
+  h1 ^= Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+  h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507);
+  h2 ^= Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+
+  return 4294967296 * (2097151 & h2) + (h1 >>> 0);
+};
+
+const hash = (str, size) => {
+  let chars = "";
+
+  let num = cyrb53(str);
+  for (let i = 0; i < size; i++) {
+    if (num < alphabet.length) num = cyrb53(str, i);
+    chars += alphabet[num % alphabet.length];
+    num = Math.floor(num / alphabet.length);
+  }
+  return chars;
+};
+
+const randomId = (size = 16) => {
   let id = "";
-  let bytes = crypto.getRandomValues(new Uint8Array(size));
+  let bytes = random(size);
   while (size--) {
     // Using the bitwise AND operator to "cap" the value of
     // the random byte from 255 to 63, in that way we can make sure
     // that the value will be a valid index for the "chars" string.
-    id += urlAlphabet[bytes[size] & 61];
+    id += alphabet[bytes[size] & 61];
   }
   return id;
+};
+
+export default function createId(source) {
+  const size = 16;
+  if (source) return hash(source, size);
+  return randomId(size);
 }

package/src/helpers/handleRequest.js

@@ -1,21 +1,9 @@
-import middle from "../middle/index.js";
 import parseResponse from "../parseResponse.js";
 import pathPattern from "../pathPattern.js";
 import define from "./define.js";
 import validate from "./validate.js";
 
-const extendWithDefaults = (ctx) => {
-  // TODO: find a better way of doing this FFS
-  // Only want to execute it once; it needs to happen on a per-request
-  // basis since we only have full access to the options there
-  if (ctx.app.extended) return;
-  middle(ctx);
-  ctx.app.extended = true;
-};
-
 export default async function handleRequest(handlers, ctx) {
-  extendWithDefaults(ctx);
-
   for (let [method, matcher, ...cbs] of handlers[ctx.method]) {
     const match = pathPattern(matcher, ctx.url.pathname || "/");
     // Skip this whole middleware if there was no match

package/src/index.js

@@ -11,6 +11,8 @@ import {
   parseHeaders,
 } from "./helpers/index.js";
 
+import middle from "./middle/index.js";
+
 // Export the reply helpers
 export * from "./reply.js";
 
@@ -71,6 +73,8 @@ export default function server(options = {}) {
   if (this.platform.runtime === "node") {
     this.node();
   }
+
+  this.use(...middle);
 }
 
 server.prototype.self = function () {
@@ -146,6 +150,8 @@ server.prototype.fetch = async function (request, env) {
 // #region HTTP methods
 // INTERNAL
 server.prototype.handle = function (method, path, ...middleware) {
+  // Do not try to optimize, we NEED the method to remain '*' here so that
+  // it doesn't auto-finish
   if (method === "*") {
     for (let m in this.handlers) {
       this.handlers[m].push([method, path, ...middleware]);
@@ -224,17 +230,17 @@ server.prototype.test = function () {
     );
 
     const headers = parseHeaders(res.headers);
-    let data;
+    let body;
     if (headers["set-cookie"]) {
       // TODO: this should really be a smart merge of the 2
       cookie = headers["set-cookie"];
     }
     if (headers["content-type"]?.includes("application/json")) {
-      data = await res.json();
+      body = await res.json();
     } else {
-      data = await res.text();
+      body = await res.text();
     }
-    return { status: res.status, headers, data };
+    return { status: res.status, headers, body, data: body };
   };
   return {
     app: this,

package/src/middle/assets.js

@@ -1,6 +1,8 @@
 import { type } from "../reply.js";
 
 export default async function assets(ctx) {
+  if (!ctx.options.public) return;
+  if (!ctx.method !== "get") return;
   try {
     // TODO: streaming
     // Read it as buffer (null)

package/src/middle/index.js

@@ -1,12 +1,4 @@
 import auth from "../auth/index.js";
 import assets from "./assets.js";
 
-export default async function middle(ctx) {
-  // Serve assets
-  if (ctx.options.public) {
-    // We need these before other endpoints
-    ctx.app.handlers.get.unshift(["*", "*", assets]);
-  }
-
-  await auth.middle(ctx);
-}
+export default [assets, auth.middle];

package/src/parseResponse.js

@@ -19,7 +19,7 @@ export default async function parseResponse(out, ctx) {
 
   // A plain string will be converted to either html or plain
   if (typeof out === "string") {
-    const type = /\s*\</.test(out) ? "text/html" : "text/plain";
+    const type = /^\s*\</.test(out) ? "text/html" : "text/plain";
     out = new Response(out, { headers: { "content-type": type } });
   }
 

package/src/reply.js

@@ -60,6 +60,10 @@ Reply.prototype.json = function (body) {
   }).send(JSON.stringify(body));
 };
 
+Reply.prototype.redirect = function (Location) {
+  return this.headers({ Location }).status(302).send();
+};
+
 Reply.prototype.file = async function (path) {
   try {
     const data = await fs.readFile(path);
@@ -133,4 +137,5 @@ export const cookies = (...args) => new Reply().cookies(...args);
 export const send = (...args) => new Reply().send(...args);
 export const json = (...args) => new Reply().json(...args);
 export const file = (...args) => new Reply().file(...args);
+export const redirect = (...args) => new Reply().redirect(...args);
 export const view = (...args) => new Reply().view(...args);

package/src/router.test.js

@@ -15,7 +15,7 @@ describe("can route properly", () => {
   // INTERNAL - so this might change in the future
   it("has the correct structure", () => {
     const registeredPaths = app.handlers.get.map((h) => h[1]);
-    expect(registeredPaths).toEqual(["/hello", "/api/hello", "/"]);
+    expect(registeredPaths).toEqual(["*", "/hello", "/api/hello", "/"]);
   });
 
   it("can get fallback when nothing matches", async () => {

package/src/auth/findUser.js

@@ -1,5 +0,0 @@
-export default async function findUser(auth, store) {
-  if (auth.provider === "email") {
-    return await store.get(auth.email);
-  }
-}