@server/next 0.25.10 → 0.27.0

package/src/auth/logout.js

@@ -1,20 +0,0 @@
-import { cookies } from "../reply.js";
-
-export default async function logout(ctx) {
-  const { id, type } = ctx.auth;
-  await ctx.options.auth.session.del(id);
-
-  if (type === "token") {
-    return { token: null };
-  }
-  if (type === "cookie") {
-    return cookies({ authorization: null }).redirect("/");
-  }
-  if (type === "jwt") {
-    throw new Error("JWT auth not supported yet");
-  }
-  if (type === "key") {
-    throw new Error("Key auth not supported yet");
-  }
-  throw new Error("Unknown auth type");
-}

package/src/auth/providers/email.js

@@ -1,145 +0,0 @@
-import { createId } from "../../helpers/index.js";
-import { ServerError, status } from "../../index.js";
-import updateUser from "../updateUser.js";
-
-const hash = new Proxy(
-  {},
-  {
-    get: (self, key) => {
-      const load = async () =>
-        Object.assign(
-          self,
-          await import("argon2").catch(() => {
-            throw new ServerError.AUTH_ARGON_NEEDED();
-          }),
-        );
-      if (key === "verify" && !self.verify) {
-        return async (hash, pass) => {
-          await load();
-          return self.verify(hash, pass);
-        };
-      }
-      if (key === "hash" && !self.hash) {
-        return async (pass) => {
-          await load();
-          return self.hash(pass);
-        };
-      }
-      return self[key];
-    },
-  },
-);
-
-const createSession = async (user, ctx) => {
-  const { type, session, cleanUser, redirect = "/user" } = ctx.options.auth;
-  user = cleanUser(user);
-  const id = createId();
-  const provider = "email";
-  const time = new Date().toISOString().replace(/\.[0-9]*/, "");
-  ctx.auth = {
-    id,
-    type,
-    provider,
-    user: user.email,
-    email: user.email,
-    time,
-  };
-  await session.set(id, ctx.auth, { expires: "1w" });
-
-  if (type === "token") {
-    return status(201).json({ ...user, token: id });
-  }
-  if (type === "cookie") {
-    return status(302).cookies({ authentication: id }).redirect(redirect);
-  }
-  if (type === "jwt") {
-    throw new Error("JWT auth not supported yet");
-  }
-  if (type === "key") {
-    throw new Error("Key auth not supported yet");
-  }
-  throw new Error("Unknown auth type");
-};
-
-async function emailLogin(ctx) {
-  const { email, password } = ctx.body;
-  if (!email) throw ServerError.LOGIN_NO_EMAIL();
-  if (!/@/.test(email)) throw ServerError.LOGIN_INVALID_EMAIL();
-  if (!password) throw ServerError.LOGIN_NO_PASSWORD();
-  if (password.length < 8) throw ServerError.LOGIN_INVALID_PASSWORD();
-
-  const store = ctx.options.auth.store;
-  if (!(await store.has(email))) throw ServerError.LOGIN_WRONG_EMAIL();
-
-  const user = await store.get(email);
-  const isValid = await hash.verify(user.password, password);
-  if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
-
-  return createSession(user, ctx);
-}
-
-async function emailRegister(ctx) {
-  const { email, password, ...data } = ctx.body;
-  if (!email) throw ServerError.REGISTER_NO_EMAIL();
-  if (!/@/.test(email)) throw ServerError.REGISTER_INVALID_EMAIL();
-  if (!password) throw ServerError.REGISTER_NO_PASSWORD();
-  if (password.length < 8) throw ServerError.REGISTER_INVALID_PASSWORD();
-
-  const store = ctx.options.auth.store;
-  if (await store.has(email)) throw ServerError.REGISTER_EMAIL_EXISTS();
-
-  const time = new Date().toISOString().replace(/\.[0-9]*/, "");
-  const user = {
-    id: createId(email),
-    email,
-    password: await hash.hash(password),
-    time,
-    ...data,
-  };
-  await store.set(email, user);
-
-  return createSession(user, ctx);
-}
-
-async function emailResetPassword(ctx) {
-  // const reset = ctx.options.store.prefix("reset:");
-  // // Already resetting
-  // if (ctx.body.token) {
-  //   const { token, password } = ctx.body;
-  //   const secret = sha256(token);
-  //   const auth = await reset.get(secret);
-  //   const user = await store.get(auth.email);
-  // } else {
-  //   const email = ctx.body.email;
-  //   const user = await store.get(email);
-  //   const token = createId();
-  //   const secret = sha256(token);
-  //   await reset.set(secret, { email }, { expires: "2h" });
-  //   //
-  //   ctx.email.send(
-  //     user.email,
-  //     `Reset email: <a href="${domain}/auth/reset/email?token=${token}">`
-  //   );
-  // }
-}
-
-async function emailUpdatePassword(ctx) {
-  const { previous, updated } = ctx.body;
-
-  const fullUser = await ctx.options.auth.store.get(ctx.auth.user);
-
-  const isValid = await hash.verify(fullUser.password, previous);
-  if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
-
-  fullUser.password = await hash.hash(updated);
-  await updateUser(fullUser, ctx.auth, ctx.options.auth.store);
-
-  return 200;
-}
-
-export default {
-  login: emailLogin,
-  register: emailRegister,
-  reset: emailResetPassword,
-  password: emailUpdatePassword,
-};

package/src/auth/providers/github.js

@@ -1,84 +0,0 @@
-import createId from "../../helpers/createId.js";
-import { redirect, status } from "../../reply.js";
-
-const oauth = async (code) => {
-  const fch = async (url, { body, headers = {}, ...rest } = {}) => {
-    headers.accept = "application/json";
-    headers["content-type"] = "application/json";
-    const res = await fetch(url, { ...rest, body, headers });
-    if (!res.ok) throw new Error("Invalid request");
-    return res.json();
-  };
-
-  const res = await fch("https://github.com/login/oauth/access_token", {
-    method: "post",
-    body: JSON.stringify({
-      client_id: env.GITHUB_ID,
-      client_secret: env.GITHUB_SECRET,
-      code,
-    }),
-  });
-  return (path) => {
-    return fch(`https://api.github.com${path}`, {
-      headers: { Authorization: `Bearer ${res.access_token}` },
-    });
-  };
-};
-
-const login = function githubLogin(ctx) {
-  return redirect(
-    `https://github.com/login/oauth/authorize?client_id=${env.GITHUB_ID}&scope=user:email`,
-  );
-};
-
-const getUserProfile = async (code) => {
-  const api = await oauth(code);
-  const [profile, emails] = await Promise.all([
-    api("/user"),
-    api("/user/emails"),
-  ]);
-  const email = emails.sort((a) => (a.primary ? -1 : 1))[0]?.email;
-  return { ...profile, email };
-};
-
-const callback = async (ctx) => {
-  const { type, cleanUser, store, session, redirect } = ctx.options.auth;
-
-  const profile = await getUserProfile(ctx.url.query.code);
-
-  const auth = {
-    id: createId(),
-    type,
-    provider: "github",
-    user: createId(profile.email),
-    email: profile.email,
-    time: new Date().toISOString().replace(/\.[0-9]*/, ""),
-  };
-  const user = cleanUser({
-    id: profile.id,
-    name: profile.name,
-    email: profile.email,
-    picture: profile.avatar_url,
-    location: profile.location,
-    created: profile.created_at,
-  });
-
-  await store.set(auth.user, user);
-  await session.set(auth.id, auth, { expires: "1w" });
-
-  if (auth.type === "token") {
-    return status(201).json({ ...user, token: auth.id });
-  }
-  if (auth.type === "cookie") {
-    return status(302).cookies({ authentication: auth.id }).redirect(redirect);
-  }
-  if (auth.type === "jwt") {
-    throw new Error("JWT auth not supported yet");
-  }
-  if (auth.type === "key") {
-    throw new Error("Key auth not supported yet");
-  }
-  throw new Error("Unknown auth type");
-};
-
-export default { login, callback };

package/src/auth/providers/index.js

@@ -1,4 +0,0 @@
-import { default as email } from "./email.js";
-import { default as github } from "./github.js";
-
-export default { email, github };

package/src/auth/session.js

@@ -1,18 +0,0 @@
-import NoSession from "./NoSession.js";
-
-export default async function session(ctx) {
-  const store = ctx.options.session?.store;
-
-  // If there's no store at all, we don't have session available;
-  // but that's okay, since it's only a problem if you try to use it
-  if (!store) return NoSession;
-
-  // There's a session cookie; use it as the key to get the data
-  // from the store
-  if (ctx.cookies.session) {
-    const session = await store.get(ctx.cookies.session);
-    if (session) return session;
-  }
-
-  return {};
-}

package/src/auth/updateUser.js

@@ -1,6 +0,0 @@
-// At this point we can assume that "auth" has already been validated
-export default async function updateUser(user, auth, store) {
-  if (auth.provider === "email") {
-    return await store.set(auth.email, user);
-  }
-}

package/src/auth/user.js

@@ -1,9 +0,0 @@
-import ServerError from "../ServerError.js";
-
-export default async function user(ctx) {
-  if (!ctx.auth) return;
-
-  const user = await ctx.options.auth.store.get(ctx.auth.user);
-  if (!user) throw ServerError.AUTH_NO_USER();
-  return ctx.options.auth.cleanUser(user);
-}

package/src/context/node.js

@@ -1,68 +0,0 @@
-import auth from "../auth/index.js";
-import { define, parseHeaders } from "../helpers/index.js";
-import parseBody from "./parseBody.js";
-import parseCookies from "./parseCookies.js";
-
-// Headers come like [title1, value1, title2, value2, ...]
-// https://stackoverflow.com/a/54029307/938236
-const chunkArray = (arr, size) =>
-  arr.length > size
-    ? [arr.slice(0, size), ...chunkArray(arr.slice(size), size)]
-    : [arr];
-
-export default async (request, app) => {
-  const ctx = {};
-  ctx.options = app.opts || {};
-  ctx.req = request;
-  ctx.res = { status: null, headers: {}, cookies: {} };
-  ctx.method = request.method.toLowerCase();
-
-  // Private
-  const events = {};
-  ctx.unstableOn = (name, callback) => {
-    events[name] = events[name] || [];
-    events[name].push(callback);
-  };
-  ctx.unstableFire = (name, data) => {
-    if (!events[name]) return;
-    for (const cb of events[name]) {
-      cb(data);
-    }
-  };
-
-  ctx.headers = parseHeaders(new Headers(chunkArray(request.rawHeaders, 2)));
-  ctx.cookies = parseCookies(ctx.headers.cookie);
-  await auth.load(ctx);
-
-  const https = request.connection.encrypted ? "https" : "http";
-  const host = ctx.headers.host || `localhost:${ctx.options.port}`;
-  const path = request.url.replace(/\/$/, "") || "/";
-  ctx.url = new URL(path, `${https}://${host}`);
-  define(ctx.url, "query", (url) =>
-    Object.fromEntries(url.searchParams.entries()),
-  );
-
-  await new Promise((resolve, reject) => {
-    const body = [];
-    request
-      .on("data", (chunk) => {
-        body.push(chunk);
-      })
-      .on("end", async () => {
-        const type = ctx.headers["content-type"];
-        ctx.body = await parseBody(
-          Buffer.concat(body).toString(),
-          type,
-          ctx.options.uploads,
-        );
-        resolve();
-      })
-      .on("error", reject);
-  });
-
-  ctx.app = app;
-  ctx.platform = app.platform;
-  ctx.machine = app.platform;
-
-  return ctx;
-};

package/src/context/parseBody.js

@@ -1,107 +0,0 @@
-import { createId } from "../helpers/index.js";
-
-function getBoundary(header) {
-  if (!header) return null;
-
-  // When we set the `content-type` manually on fetch(), it won't include the
-  // boundary and it's recommended not to set it manually:
-  // https://stackoverflow.com/q/39280438/938236
-  if (header.includes("multipart/form-data") && !header.includes("boundary=")) {
-    console.error("Do not set the `Content-Type` manually for FormData");
-  }
-
-  const items = header.split(";");
-  for (const item of items) {
-    const trimmedItem = item.trim();
-    if (trimmedItem.startsWith("boundary=")) {
-      return trimmedItem.split("=")[1].trim();
-    }
-  }
-  return null;
-}
-
-function getMatching(string, regex) {
-  const matches = string.match(regex);
-  return matches?.[1] ? matches[1] : "";
-}
-
-const saveFile = async (name, value, bucket) => {
-  const ext = name.split(".").pop();
-  const id = `${createId()}.${ext}`;
-  await bucket.write(id, value, "binary");
-  return id;
-};
-
-// Utility function to split a buffer
-function splitBuffer(buffer, delimiter) {
-  const result = [];
-  let start = 0;
-  let index = buffer.indexOf(delimiter, start);
-
-  while (index !== -1) {
-    result.push(buffer.slice(start, index));
-    start = index + delimiter.length;
-    index = buffer.indexOf(delimiter, start);
-  }
-
-  result.push(buffer.slice(start));
-  return result;
-}
-
-const BREAK = "\r\n\r\n";
-
-export default async function parseBody(raw, contentType, bucket) {
-  const baseBuffer = typeof raw === "string" ? raw : await raw.arrayBuffer();
-  const rawBuffer = Buffer.from(baseBuffer);
-  if (!rawBuffer) return {};
-
-  if (!contentType || /text\/plain/.test(contentType)) {
-    return rawBuffer.toString(); // Return as plain text
-  }
-
-  if (/application\/json/.test(contentType)) {
-    return JSON.parse(rawBuffer.toString()); // Parse JSON
-  }
-
-  const boundary = getBoundary(contentType);
-  if (!boundary) return null;
-
-  const body = {};
-  const boundaryBuffer = Buffer.from(`--${boundary}`);
-  const parts = splitBuffer(rawBuffer, boundaryBuffer);
-
-  for (const part of parts) {
-    if (part.length === 0 || part.equals(Buffer.from("--\r\n"))) continue;
-
-    const partString = part.toString();
-    const name = getMatching(partString, /(?:name=")(.+?)(?:")/)
-      .trim()
-      .replace(/\[\]$/, "");
-    if (!name) continue;
-
-    const filename = getMatching(partString, /(?:filename=")(.*?)(?:")/).trim();
-
-    if (!part.includes(BREAK)) continue;
-
-    // Content starts after headers and "\r\n\r\n",  remove trailing CRLF
-    const content = part.slice(part.indexOf(BREAK) + 4, part.length - 2);
-
-    if (filename) {
-      // Save binary content as a file
-      body[name] = await saveFile(filename, content, bucket);
-    } else {
-      // Treat content as text
-      const value = content.toString().trim();
-      if (body[name]) {
-        if (!Array.isArray(body[name])) {
-          body[name] = [body[name]];
-        }
-        body[name].push(value);
-      } else {
-        body[name] = value;
-      }
-    }
-  }
-
-  return body;
-}

package/src/context/parseBody.test.js

@@ -1,60 +0,0 @@
-import parseBody from "./parseBody.js";
-
-const getBody = () => {
-  let body = "trash1\r\n";
-  body += "------WebKitFormBoundaryvef1fLxmoUdYZWXp\r\n";
-  body += 'Content-Disposition: form-data; name="hello";\r\n\r\n';
-  body += "world\r\n";
-  body += "------WebKitFormBoundaryvef1fLxmoUdYZWXp\r\n";
-  body +=
-    'Content-Disposition: form-data; name="profile"; filename="profile.md"\r\n';
-  body += "Content-Type: text/plain\r\n\r\n";
-  body += "@11X";
-  body += "111Y\r\n";
-  body += "111Z\rCCCC\nCCCC\r\nCCCCC@\r\n\r\n";
-  body += "------WebKitFormBoundaryvef1fLxmoUdYZWXp\r\n";
-  body +=
-    'Content-Disposition: form-data; name="gallery[]"; filename="A.txt"\r\n';
-  body += "Content-Type: text/plain\r\n\r\n";
-  body += "@11X";
-  body += "111Y\r\n";
-  body += "111Z\rCCCC\nCCCC\r\nCCCCC@\r\n\r\n";
-  body += "------WebKitFormBoundaryvef1fLxmoUdYZWXp\r\n";
-  body += 'Content-Disposition: form-data; name="test";\r\n\r\n';
-  body += "test message 123456\r\n";
-  body += "------WebKitFormBoundaryvef1fLxmoUdYZWXp\r\n";
-  body += 'Content-Disposition: form-data; name="test";\r\n\r\n';
-  body += "test message number two\r\n";
-  body += "------WebKitFormBoundaryvef1fLxmoUdYZWXp\r\n";
-  body +=
-    'Content-Disposition: form-data; name="gallery[]"; filename="C.txt"\r\n';
-  body += "Content-Type: text/plain\r\n\r\n";
-  body += "@CCC";
-  body += "CCCY\r\n";
-  body += "CCCZ\rCCCW\nCCC0\r\n666@\r\n";
-  body += "------WebKitFormBoundaryvef1fLxmoUdYZWXp--\r\n";
-  return body;
-};
-
-describe("parseBody", () => {
-  it("can parse the example body", async () => {
-    const body = await parseBody(
-      getBody(),
-      "multipart/form-data; boundary=----WebKitFormBoundaryvef1fLxmoUdYZWXp",
-      { write: (id) => id },
-    );
-    expect(body).toMatchObject({
-      hello: "world",
-      test: ["test message 123456", "test message number two"],
-    });
-
-    const matchMd = expect.stringMatching(/^\w{16}.md$/);
-    const matchTxt = expect.stringMatching(/^\w{16}.txt$/);
-    expect(body).toMatchObject({
-      hello: "world",
-      profile: matchMd,
-      gallery: matchTxt,
-      test: ["test message 123456", "test message number two"],
-    });
-  });
-});

package/src/context/parseCookies.js

@@ -1,9 +0,0 @@
-export default function parseCookies(cookies) {
-  if (!cookies) return {};
-  return Object.fromEntries(
-    cookies.split(/;\s*/).map((part) => {
-      const [key, ...rest] = part.split("=");
-      return [key, decodeURIComponent(rest.join("="))];
-    })
-  );
-}

package/src/context/winter.js

@@ -1,46 +0,0 @@
-import auth from "../auth/index.js";
-import { define, parseHeaders } from "../helpers/index.js";
-import parseBody from "./parseBody.js";
-import parseCookies from "./parseCookies.js";
-
-export default async (request, app) => {
-  const ctx = {};
-  ctx.init = performance.now();
-  ctx.options = app.opts || {};
-  ctx.req = request;
-  ctx.res = { status: null, headers: {}, cookies: {} };
-  ctx.method = request.method.toLowerCase();
-
-  // Private
-  const events = {};
-  ctx.unstableOn = (name, callback) => {
-    events[name] = events[name] || [];
-    events[name].push(callback);
-  };
-  ctx.unstableFire = (name, data) => {
-    if (!events[name]) return;
-    for (const cb of events[name]) {
-      cb(data);
-    }
-  };
-
-  ctx.headers = parseHeaders(request.headers);
-  ctx.cookies = parseCookies(ctx.headers.cookie);
-  await auth.load(ctx);
-
-  ctx.url = new URL(request.url.replace(/\/$/, ""));
-  define(ctx.url, "query", (url) =>
-    Object.fromEntries(url.searchParams.entries()),
-  );
-
-  if (request.body) {
-    const type = ctx.headers["content-type"];
-    ctx.body = await parseBody(request, type, ctx.options.uploads);
-  }
-
-  ctx.app = app;
-  ctx.platform = app.platform;
-  ctx.machine = app.platform;
-
-  return ctx;
-};

package/src/errors/index.js

@@ -1,36 +0,0 @@
-import ServerError from "../ServerError.js";
-
-ServerError.extend({
-  NO_STORE: "You need a 'store' to write 'ctx.session'",
-  NO_STORE_WRITE: "You need a 'store' to write 'ctx.session.{key}'",
-  NO_STORE_READ: "You need a 'store' to read 'ctx.session.{key}'",
-
-  AUTH_ARGON_NEEDED:
-    "Argon2 is needed for the auth module, please install it with 'npm i argon2'",
-  AUTH_INVALID_TYPE: "Invalid Authorization type, '{type}'",
-  AUTH_INVALID_TOKEN: "Invalid Authorization token",
-  AUTH_INVALID_COOKIE: "Invalid Authorization cookie",
-  AUTH_NO_PROVIDER: "No provider passed to the option 'auth.provider'",
-  AUTH_INVALID_PROVIDER:
-    "Invalid provider '{provider}', valid ones are: '{valid}'",
-  AUTH_NO_SESSION: { status: 401, message: "Invalid session" },
-  AUTH_NO_USER: {
-    status: 401,
-    message: "Credentials do not correspond to a user",
-  },
-
-  LOGIN_NO_EMAIL: "The email is required to log in",
-  LOGIN_INVALID_EMAIL: "The email you wrote is not correct",
-  LOGIN_NO_PASSWORD: "The email is required to log in",
-  LOGIN_INVALID_PASSWORD: "The password you wrote is not correct",
-  LOGIN_WRONG_ACCOUNT: "That email does not correspond to any account",
-  LOGIN_WRONG_PASSWORD: "That is not the valid password",
-
-  REGISTER_NO_EMAIL: "Email needed",
-  REGISTER_INVALID_EMAIL: "The email you wrote is not correct",
-  REGISTER_NO_PASSWORD: "Password needed",
-  REGISTER_INVALID_PASSWORD: "The password you wrote is not correct",
-  REGISTER_EMAIL_EXISTS: "Email is already registered",
-});
-
-export default ServerError;

package/src/helpers/StatusError.js

@@ -1,6 +0,0 @@
-export default class StatusError extends Error {
-  constructor(msg, status = 500) {
-    super(msg);
-    this.status = status;
-  }
-}