@server/next 0.20.8 → 0.20.10

package/index.d.ts

@@ -15,6 +15,7 @@ type ServerOptions = {
   views?: string | Bucket;
   public?: string | Bucket;
   uploads?: string | Bucket;
+  auth?: string | { type: string; provider: string };
 };
 
 type Context = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.20.8",
+  "version": "0.20.10",
   "description": "An experimental reimplementation of server.js focused on the DX",
   "homepage": "https://node-server.com/",
   "repository": "https://github.com/franciscop/server-next.git",
@@ -9,7 +9,6 @@
   "author": "Francisco Presencia <public@francisco.io> (https://francisco.io/)",
   "license": "UNLICENSED",
   "scripts": {
-    "demo": "nodemon ./demo/src/index.js",
     "start": "bun test --watch",
     "test": "bun test",
     "test:jest": "node --experimental-vm-modules node_modules/jest/bin/jest.js"

package/readme.md

@@ -2,8 +2,6 @@
 
 > **⚠️ WIP** This is an **experimental library** right now!
 
-[**Documentation Here**](https://node-server.com/documentation/)
-
 A fully-fledged web server for Bun and Node.js, with all the basics covered for you:
 
 ```js
@@ -26,11 +24,11 @@ It includes all the things you would expect from a modern Server framework, like
 ```js
 // Easy testing as well - index.test.js
 import app from "./";
+const api = app.test();  // Very convenient helper, AXIOS-like interface
 
 it("can retrieve the homepage", async () => {
-  const res = await app.fetch(new Request("http://localhost:3000/books/"));
-  const books = await res.json();
-  expect(books[0]).toEqual({ id: 0, name: 'The Catcher In The Rye', ... });
+  const { data: books } = await api.get("/books/");
+  expect(books[0]).toEqual({ id: 0, name: ... });
 });
 ```
 
@@ -56,6 +54,8 @@ Why? We live in the era of multi-cloud (Heroku, Workers, Lambda, etc) and multi-
   - A readStream and it'll be piped to the response
   - An object with `status`, `body` and `headers` and it'll be set raw.
 - Response compression works
+- Zod light integration
+- Auth work
 
 ## Examples
 

package/src/auth/NoSession.js

@@ -0,0 +1,18 @@
+import { ServerError } from "../index.js";
+
+class NoSession {}
+
+export default new Proxy(NoSession, {
+  get(target, key) {
+    if (target[key]) return target[key];
+    if (key === "then") return target[key];
+    throw ServerError.NO_STORE_READ({ key });
+  },
+  set(target, key, value) {
+    if (target[key] || key === "then") {
+      target[key] = value;
+    } else {
+      throw ServerError.NO_STORE_WRITE({ key });
+    }
+  },
+});

package/src/auth/auth-cookie.test.js

@@ -0,0 +1,41 @@
+import "../test/toSucceed.js";
+
+import kv from "polystore";
+
+import server from "../index.js";
+
+describe("user creation flow", () => {
+  // These are obviously mock data
+  const EMAIL = "abc@test.com";
+  const PASS = "11111111";
+  const CREDENTIALS = { email: EMAIL, password: PASS };
+
+  const store = kv(new Map());
+  const api = server({ store, auth: "cookie:email" })
+    .get("/me", (ctx) => ctx.user || "No data")
+    .test();
+
+  it("can create a new user", async () => {
+    const register = await api.post("/auth/register/email", CREDENTIALS);
+    expect(register).toSucceed();
+    expect(await store.keys()).toEqual([
+      "user:abc@test.com",
+      "auth:" + register.headers["set-cookie"].split("=")[1],
+    ]);
+
+    const me = await api.get("/me");
+    expect(me).toSucceed();
+    expect(me.data.email).toEqual(EMAIL);
+
+    const logout = await api.post("/auth/logout");
+    expect(logout).toSucceed();
+    expect(await store.keys()).toEqual(["user:abc@test.com"]);
+
+    const login = await api.post("/auth/login/email", CREDENTIALS);
+    expect(login).toSucceed();
+    expect(await store.keys()).toEqual([
+      "user:abc@test.com",
+      "auth:" + login.headers["set-cookie"].split("=")[1],
+    ]);
+  });
+});

package/src/auth/auth-token.test.js

@@ -0,0 +1,42 @@
+import "../test/toSucceed.js";
+
+import kv from "polystore";
+
+import server from "../index.js";
+
+describe("user creation flow", () => {
+  // These are obviously mock data
+  const EMAIL = "abc@test.com";
+  const PASS = "11111111";
+  const CREDENTIALS = { email: EMAIL, password: PASS };
+
+  const store = kv(new Map());
+  const api = server({ store, auth: "token:email" })
+    .get("/me", (ctx) => ctx.user || "No data")
+    .test();
+
+  it("can create a new user", async () => {
+    const register = await api.post("/auth/register/email", CREDENTIALS);
+    expect(register).toSucceed();
+    expect(await store.keys()).toEqual([
+      "user:abc@test.com",
+      "auth:" + register.data.token,
+    ]);
+
+    const headers = { authorization: "Bearer " + register.data.token };
+    const me = await api.get("/me", { headers });
+    expect(me).toSucceed();
+    expect(me.data.email).toEqual(EMAIL);
+
+    const logout = await api.post("/auth/logout", {}, { headers });
+    expect(logout).toSucceed();
+    expect(await store.keys()).toEqual(["user:abc@test.com"]);
+
+    const login = await api.post("/auth/login/email", CREDENTIALS);
+    expect(login).toSucceed();
+    expect(await store.keys()).toEqual([
+      "user:abc@test.com",
+      "auth:" + login.data.token,
+    ]);
+  });
+});

package/src/auth/auth.js

@@ -0,0 +1,52 @@
+import { ServerError } from "../index.js";
+
+const validateToken = (authorization) => {
+  const [type, id] = authorization.trim().split(" ");
+  if (type.toLowerCase() !== "bearer") {
+    throw ServerError.AUTH_INVALID_TYPE({ type });
+  }
+  if (id.length !== 24) {
+    throw ServerError.AUTH_INVALID_TOKEN();
+  }
+  return id;
+};
+
+const validateCookie = (authorization) => {
+  if (authorization.length !== 24) {
+    throw ServerError.AUTH_INVALID_COOKIE();
+  }
+  return authorization;
+};
+
+const findSessionId = (ctx) => {
+  const type = ctx.options.auth.type;
+
+  if (type === "token") {
+    // If the user is not authenticated, there's no auth to retrieve
+    if (!ctx.headers.authorization) return;
+
+    // Check the authentication header
+    return validateToken(ctx.headers.authorization);
+  }
+
+  if (type === "cookie") {
+    // If the user is not authenticated, there's no auth to retrieve
+    if (!ctx.cookies.authorization) return;
+
+    return validateCookie(ctx.cookies.authorization);
+  }
+
+  throw new Error("Invalid auth type " + type);
+};
+
+export default async function findAuth(ctx) {
+  if (!ctx.options.auth) return; // NO AUTH AT ALL; nothing to do here
+  const options = ctx.options.auth;
+
+  const sessionId = findSessionId(ctx);
+  if (!sessionId) return; // NO SESSION FOUND; no auth
+
+  const auth = await options.session.get(sessionId);
+  if (!auth) throw ServerError.AUTH_NO_SESSION();
+  return auth;
+}

package/src/auth/index.js

@@ -0,0 +1,24 @@
+import auth from "./auth.js";
+import logout from "./logout.js";
+import providers from "./providers/index.js";
+import session from "./session.js";
+import user from "./user.js";
+
+const load = async (ctx) => {
+  ctx.session = await session(ctx);
+  ctx.auth = await auth(ctx);
+  ctx.user = await user(ctx);
+};
+
+const middle = async (ctx) => {
+  if (ctx.options.auth) {
+    ctx.app.post("/auth/logout", logout);
+
+    if (ctx.options.auth.provider.includes("email")) {
+      ctx.app.post("/auth/register/email", providers.email.register);
+      ctx.app.post("/auth/login/email", providers.email.login);
+    }
+  }
+};
+
+export default { load, middle };

package/src/auth/index.test.js

@@ -0,0 +1,123 @@
+import "../test/toSucceed.js";
+
+import kv from "polystore";
+
+import server from "../index.js";
+
+const ID = "REqA2l022l8Q0tuIRtqLOPUy";
+
+describe("auth", () => {
+  it("requires a provider", () => {
+    const store = kv(new Map());
+    const api = server({ store, auth: "token:email" })
+      .get("/", (ctx) => ctx.auth)
+      .test();
+  });
+
+  it("provider must belong", async () => {
+    const store = kv(new Map());
+    const api = server({ store, auth: "token:email" })
+      .get("/", (ctx) => ctx.auth)
+      .test();
+
+    store.set(`auth:${ID}`, {
+      id: ID,
+      type: "token",
+      provider: "wrong",
+      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      email: "abc@test.com",
+      time: "2024-07-01T03:21:40Z",
+    });
+    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed(
+      'Invalid provider "wrong", valid ones are: "email"'
+    );
+  });
+});
+
+describe("token", () => {
+  const store = kv(new Map());
+  const api = server({ store, auth: "token:email" })
+    .get("/", (ctx) => ctx.auth)
+    .test();
+
+  afterEach(async () => {
+    await store.del(`auth:${ID}`);
+  });
+
+  it("should be Bearer", async () => {
+    const authorization = "Basic REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed("Invalid Authorization type, 'Basic'");
+  });
+
+  it("should have the proper token", async () => {
+    const authorization = "Bearer hola";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed("Invalid Authorization token");
+  });
+
+  it("cannot get the session", async () => {
+    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed("Invalid session");
+  });
+
+  it("cannot get the user", async () => {
+    store.set(`auth:${ID}`, {
+      id: ID,
+      type: "token",
+      provider: "email",
+      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      email: "abc@test.com",
+      time: "2024-07-01T03:21:40Z",
+    });
+    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed("Credentials do not correspond to a user");
+  });
+
+  it("cannot get the user", async () => {
+    store.set("auth:REqA2l022l8Q0tuIRtqLOPUy", {
+      id: "REqA2l022l8Q0tuIRtqLOPUy",
+      type: "token",
+      provider: "email",
+      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      email: "abc@test.com",
+      time: "2024-07-01T03:21:40Z",
+    });
+    store.set("user:abc@test.com", {
+      id: "QypOn5SQApyOPdUpIZsO9u2O",
+      email: "abc@test.com",
+    });
+    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).toSucceed();
+  });
+});
+
+describe("cookie", () => {
+  const store = kv(new Map());
+  const api = server({ store, auth: "cookie:email" })
+    .get("/", (ctx) => ctx.auth)
+    .test();
+
+  it("should have the proper token in email", async () => {
+    const cookie = "authorization=hello";
+    const req = await api.get("/", { headers: { cookie } });
+    expect(req).not.toSucceed("Invalid Authorization cookie");
+  });
+
+  it("can get the proper session", async () => {
+    const cookie = "authorization=REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { cookie } });
+    expect(req).not.toSucceed("Invalid session");
+  });
+
+  it("can get the proper session", async () => {
+    const cookie = "authorization=REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { cookie } });
+    expect(req).not.toSucceed();
+  });
+});

package/src/auth/logout.js

@@ -0,0 +1,18 @@
+import { cookies } from "../reply.js";
+
+export default async function logout(ctx) {
+  const { id, type } = ctx.auth;
+  await ctx.options.auth.session.del(id);
+
+  if (type === "token") {
+    return { token: null };
+  } else if (type === "cookie") {
+    return cookies({ authorization: null }).send({});
+  } else if (type === "jwt") {
+    throw new Error("JWT auth not supported yet");
+  } else if (type === "key") {
+    throw new Error("Key auth not supported yet");
+  } else {
+    throw new Error("Unknown auth type");
+  }
+}

package/src/auth/providers/email.js

@@ -0,0 +1,73 @@
+import argon2 from "argon2";
+
+import { createId } from "../../helpers/index.js";
+import { ServerError, status } from "../../index.js";
+
+const createSession = async (user, ctx) => {
+  const { type, session, cleanUser } = ctx.options.auth;
+  user = cleanUser(user);
+  const token = createId();
+  const provider = "email";
+  const time = new Date().toISOString().replace(/\.[0-9]*/, "");
+  ctx.auth = {
+    id: token,
+    type,
+    provider,
+    user: user.id,
+    email: user.email,
+    time,
+  };
+  await session.set(token, ctx.auth, { expires: "1w" });
+
+  if (type === "token") {
+    return status(201).json({ ...user, token });
+  } else if (type === "cookie") {
+    return status(201).cookies({ authorization: token }).send(user);
+  } else if (type === "jwt") {
+    throw new Error("JWT auth not supported yet");
+  } else if (type === "key") {
+    throw new Error("Key auth not supported yet");
+  } else {
+    throw new Error("Unknown auth type");
+  }
+};
+
+async function login(ctx) {
+  const { email, password } = ctx.body;
+  if (!email) throw ServerError.LOGIN_NO_EMAIL();
+  if (!/@/.test(email)) throw ServerError.LOGIN_INVALID_EMAIL();
+  if (!password) throw ServerError.LOGIN_NO_PASSWORD();
+  if (password.length < 8) throw ServerError.LOGIN_INVALID_PASSWORD();
+
+  const store = ctx.options.auth.store;
+  if (!(await store.has(email))) throw ServerError.LOGIN_WRONG_EMAIL();
+
+  const user = await store.get(email);
+  const isValid = await argon2.verify(user.password, password);
+  if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
+
+  return createSession(user, ctx);
+}
+
+async function register(ctx) {
+  const { email, password, ...data } = ctx.body;
+  if (!email) throw ServerError.REGISTER_NO_EMAIL();
+  if (!/@/.test(email)) throw ServerError.REGISTER_INVALID_EMAIL();
+  if (!password) throw ServerError.REGISTER_NO_PASSWORD();
+  if (password.length < 8) throw ServerError.REGISTER_INVALID_PASSWORD();
+
+  const store = ctx.options.auth.store;
+  if (await store.has(email)) throw ServerError.REGISTER_EMAIL_EXISTS();
+
+  const user = {
+    id: createId(),
+    email,
+    password: await argon2.hash(password),
+    ...data,
+  };
+  await store.set(email, user);
+
+  return createSession(user, ctx);
+}
+
+export default { login, register };

package/src/auth/providers/index.js

@@ -0,0 +1,3 @@
+import { default as email } from "./email.js";
+
+export default { email };

package/src/auth/session.js

@@ -0,0 +1,18 @@
+import NoSession from "./NoSession.js";
+
+export default async function session(ctx) {
+  const store = ctx.options.session?.store;
+
+  // If there's no store at all, we don't have session available;
+  // but that's okay, since it's only a problem if you try to use it
+  if (!store) return NoSession;
+
+  // There's a session cookie; use it as the key to get the data
+  // from the store
+  if (ctx.cookies.session) {
+    const session = await store.get(ctx.cookies.session);
+    if (session) return session;
+  }
+
+  return {};
+}

package/src/auth/user.js

@@ -0,0 +1,21 @@
+import ServerError from "../ServerError";
+
+const findUser = async (auth, options) => {
+  if (!auth.provider) throw ServerError.AUTH_NO_PROVIDER();
+  if (!options.provider.includes(auth.provider)) {
+    const valid = JSON.stringify(options.provider);
+    throw ServerError.AUTH_INVALID_PROVIDER({ provider: auth.provider, valid });
+  }
+
+  if (auth.provider === "email") {
+    return await options.store.get(auth.email);
+  }
+};
+
+export default async function user(ctx) {
+  if (!ctx.auth) return;
+
+  const user = await findUser(ctx.auth, ctx.options.auth);
+  if (!user) throw ServerError.AUTH_NO_USER();
+  return ctx.options.auth.cleanUser(user);
+}

package/src/context/node.js

@@ -1,9 +1,14 @@
+import auth from "../auth/index.js";
 import { define } from "../helpers/index.js";
-import findAuth from "./findAuth.js";
-import findSession from "./findSession.js";
 import parseBody from "./parseBody.js";
 import parseCookies from "./parseCookies.js";
 
+// https://stackoverflow.com/a/54029307/938236
+const chunkArray = (arr, size) =>
+  arr.length > size
+    ? [arr.slice(0, size), ...chunkArray(arr.slice(size), size)]
+    : [arr];
+
 export default async (request, options = {}, app) => {
   const ctx = {};
   ctx.options = options;
@@ -11,10 +16,9 @@ export default async (request, options = {}, app) => {
   ctx.res = { status: null, headers: {}, cookies: {} };
   ctx.method = request.method.toLowerCase();
 
-  ctx.headers = request.headers;
+  ctx.headers = parseHeaders(new Headers(chunkArray(request.rawHeaders, 2)));
   ctx.cookies = parseCookies(ctx.headers.cookie);
-  ctx.session = await findSession(ctx);
-  await findAuth(ctx);
+  await auth.load(ctx);
 
   const https = request.connection.encrypted ? "https" : "http";
   const host = ctx.headers.host || "localhost" + options.port;

package/src/context/winter.js

@@ -1,6 +1,5 @@
-import { define } from "../helpers/index.js";
-import findAuth from "./findAuth.js";
-import findSession from "./findSession.js";
+import auth from "../auth/index.js";
+import { define, parseHeaders } from "../helpers/index.js";
 import parseBody from "./parseBody.js";
 import parseCookies from "./parseCookies.js";
 
@@ -11,10 +10,9 @@ export default async (request, options = {}, app) => {
   ctx.res = { status: null, headers: {}, cookies: {} };
   ctx.method = request.method.toLowerCase();
 
-  ctx.headers = Object.fromEntries(request.headers.entries());
+  ctx.headers = parseHeaders(request.headers);
   ctx.cookies = parseCookies(ctx.headers.cookie);
-  ctx.session = await findSession(ctx);
-  await findAuth(ctx);
+  await auth.load(ctx);
 
   ctx.url = new URL(request.url.replace(/\/$/, ""));
   define(ctx.url, "query", (url) =>

package/src/errors/index.js

@@ -6,6 +6,14 @@ ServerError.extend({
   NO_STORE_READ: `You need a 'store' to read 'ctx.session.{key}'`,
   AUTH_INVALID_TYPE: `Invalid Authorization type, '{type}'`,
   AUTH_INVALID_TOKEN: `Invalid Authorization token`,
+  AUTH_INVALID_COOKIE: `Invalid Authorization cookie`,
+  AUTH_NO_PROVIDER: `No provider passed to the option "auth.provider"`,
+  AUTH_INVALID_PROVIDER: `Invalid provider "{provider}", valid ones are: {valid}`,
+  AUTH_NO_SESSION: { status: 401, message: "Invalid session" },
+  AUTH_NO_USER: {
+    status: 401,
+    message: "Credentials do not correspond to a user",
+  },
 
   LOGIN_NO_EMAIL: "The email is required to log in",
   LOGIN_INVALID_EMAIL: "The email you wrote is not correct",
@@ -13,6 +21,12 @@ ServerError.extend({
   LOGIN_INVALID_PASSWORD: "The email you wrote is not correct",
   LOGIN_WRONG_ACCOUNT: `That email does not correspond to any account`,
   LOGIN_WRONG_PASSWORD: `That is not the valid password`,
+
+  REGISTER_NO_EMAIL: `Email needed`,
+  REGISTER_INVALID_EMAIL: "The email you wrote is not correct",
+  REGISTER_NO_PASSWORD: `Password needed`,
+  REGISTER_INVALID_PASSWORD: "The email you wrote is not correct",
+  REGISTER_EMAIL_EXISTS: `Email is already registered`,
 });
 
 export default ServerError;

package/src/helpers/cookies.test.js

@@ -0,0 +1,23 @@
+import server, { cookies } from "../index.js";
+
+describe("set-cookie", () => {
+  const app = server()
+    .get("/hello", () => {
+      return cookies({ hello: "world" }).send();
+    })
+    .get("/multiple", () => {
+      return cookies({ a: "b", c: "d" }).send();
+    });
+
+  it("sets the right cookie", async () => {
+    const api = app.test();
+    const res = await api.get("/hello");
+    expect(res.headers["set-cookie"]).toBe("hello=world");
+  });
+
+  it("can set multiple cookies", async () => {
+    const api = app.test();
+    const res = await api.get("/multiple");
+    expect(res.headers["set-cookie"]).toEqual(["a=b", "c=d"]);
+  });
+});

package/src/helpers/createCookies.js

@@ -1,13 +1,16 @@
 // Takes an object and returns a string with the proper cookie values
 export default function createCookies(cookies) {
-  if (!cookies || !Object.keys(cookies).length) return "";
-  return Object.entries(cookies)
-    .map(([key, val]) => {
-      if (typeof val === "string") {
-        val = { value: val, path: "/" };
-      }
-      const { value, path } = val;
-      return `${key}=${value};Path=${path}`;
-    })
-    .join(";");
+  if (!cookies || !Object.keys(cookies).length) return [];
+  return Object.entries(cookies).map(([key, val]) => {
+    if (!val) {
+      val = { value: "", expires: new Date(0).toUTCString() };
+    }
+    if (typeof val === "string") {
+      val = { value: val };
+    }
+    const { value, path, expires } = val;
+    const pathPart = path ? ";Path=" + path : "";
+    const expiresPart = expires ? ";Expires=" + expires : "";
+    return `${key}=${value || ""}${pathPart}${expiresPart}`;
+  });
 }

package/src/helpers/index.js

@@ -4,4 +4,5 @@ export { default as define } from "./define.js";
 export { default as getMachine } from "./getMachine.js";
 export { default as handleRequest } from "./handleRequest.js";
 export { default as iterate } from "./iterate.js";
+export { default as parseHeaders } from "./parseHeaders.js";
 export { default as types } from "./types.js";

package/src/helpers/parseHeaders.js

@@ -0,0 +1,15 @@
+export default (raw) => {
+  const headers = {};
+  for (let [key, value] of raw.entries()) {
+    key = key.toLowerCase();
+    if (headers[key]) {
+      if (!Array.isArray(headers[key])) {
+        headers[key] = [headers[key]];
+      }
+      headers[key].push(value);
+    } else {
+      headers[key] = value;
+    }
+  }
+  return headers;
+};