@server/next 0.32.0 → 0.34.0

package/index.d.ts

@@ -104,17 +104,16 @@ type AuthUser<T = Record<string, any>> = T & {
     strategy: Strategy;
     email: string;
 };
-type ProviderString = Provider | `${Provider}|${Provider}`;
-type AuthOption = `${Strategy}:${Provider | ProviderString}` | {
-    provider: Provider | ProviderString | Provider[];
+type AuthOption = `${Strategy}:${Provider}` | {
     strategy: Strategy;
+    providers: Provider | Provider[];
     session?: KVStore;
     store?: KVStore;
     redirect?: string;
     cleanUser?: <T = AuthUser>(user: T) => T | Promise<T>;
 };
 type AuthSettings = {
-    provider: Provider[];
+    providers: Provider[];
     strategy: Strategy;
     store: KVStore;
     session: KVStore;
@@ -130,9 +129,20 @@ type Logger = {
 };
 type SecurityOptions = {
     trustProxy?: boolean;
+    frameguard?: boolean | string;
+    noSniff?: boolean;
+    referrerPolicy?: boolean | string;
+    hsts?: boolean | string;
+    xssProtection?: boolean;
+    csp?: boolean | string;
+    coop?: boolean | string;
+    corp?: boolean | string;
+    permissionsPolicy?: string;
 };
 type SecuritySettings = {
     trustProxy: boolean;
+    headers: Record<string, string>;
+    hsts: string | null;
 };
 type OnError = (error: Error, ctx: Context) => Response | Promise<Response>;
 type Options = {
@@ -151,7 +161,7 @@ type Options = {
     onError?: OnError;
     log?: LogLevel | boolean;
     favicon?: string | Bucket;
-    security?: SecurityOptions;
+    security?: boolean | SecurityOptions;
     body?: BodyMode;
 };
 type Settings = {
@@ -197,11 +207,6 @@ type PathToParams<Path extends string> = ParamsToObject<ExtractPathParams<Path>>
 type BunEnv = Record<string, string> & {
     upgrade?: (req: Request) => boolean;
 };
-type EventCallback = (data: Context & SerializableValue) => void;
-type Events = Record<string, EventCallback[]> & {
-    on?: (key: string, cb: (value?: Context & SerializableValue) => void) => void;
-    trigger?: (key: string, value?: Partial<Context & SerializableValue>) => void;
-};
 type Context<Params extends Record<string, string | undefined> = Record<string, string>, O extends ServerConfig = object> = {
     method: Method;
     ip: string;
@@ -224,7 +229,6 @@ type Context<Params extends Record<string, string | undefined> = Record<string,
         User?: infer U;
     } ? U extends Record<"User", infer Inner> ? Inner : AuthUser : AuthUser;
     init: number;
-    events: Events;
     req?: Request;
     res?: Response & {
         cookies?: Record<string, string>;
@@ -458,4 +462,4 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
 }
 declare function server<Session extends Record<string, any> = {}, User extends Record<string, any> = {}>(options?: Options): Server<ServerConfig<Session, User>>;
 
-export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type Bucket, type BunEnv, type Context, type Cookie, type CorsSettings, type EventCallback, type ExtractPathParams, type InferParamType, type InlineReply, type KVStore, type LimitOptions, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type Strategy, type Time, UploadPipeline, type UploadedFile, cookies, server as default, download, file, headers, json, redirect, router, send, status, type, upload };
+export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type Bucket, type BunEnv, type Context, type Cookie, type CorsSettings, type ExtractPathParams, type InferParamType, type InlineReply, type KVStore, type LimitOptions, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type Strategy, type Time, UploadPipeline, type UploadedFile, cookies, server as default, download, file, headers, json, redirect, router, send, status, type, upload };

package/index.js

@@ -54,7 +54,7 @@ ServerError_default.extend({
     message: "Invalid Authorization type '{strategy}', valid one is '{valid}'"
   },
   AUTH_INVALID_STATE: { status: 403, message: "Invalid OAuth state" },
-  AUTH_NO_PROVIDER: "No provider passed to the option 'auth.provider'",
+  AUTH_NO_PROVIDER: "No provider passed to the option 'auth.providers'",
   AUTH_INVALID_PROVIDER: {
     status: 401,
     message: "Invalid provider '{provider}', valid ones are: '{valid}'"
@@ -1113,37 +1113,27 @@ function defaultCleanUser(fullUser) {
   const { password: _password, ...user } = fullUser;
   return user;
 }
-var providersKeys = Object.keys(providers_default);
-function getProviders(provider) {
-  if (typeof provider === "string") {
-    provider = provider.split("|");
-  }
-  const invalidProvider = provider.find((p) => !providersKeys.includes(p));
-  if (invalidProvider) {
-    throw new Error(
-      `Provider "${invalidProvider}" not found, available ones are "${providersKeys.join('", "')}"`
-    );
-  }
-  return provider;
-}
+var available = Object.keys(providers_default);
 function parseAuthOptions(auth2, all) {
   if (!auth2) return null;
   if (typeof auth2 === "string") {
-    const [strategy2, providerRaw] = auth2.split(":");
-    const provider2 = providerRaw && providerRaw.split("|");
-    auth2 = { strategy: strategy2, provider: provider2 };
-  }
-  if (!auth2.strategy) {
-    throw new Error("Auth options needs a strategy");
+    const [strategy2, provider] = auth2.split(":");
+    auth2 = { strategy: strategy2, providers: provider ? [provider] : [] };
   }
-  if (!auth2.strategy.length) {
+  if (!auth2.strategy?.length) {
     throw new Error("Auth options needs a strategy");
   }
   const strategy = auth2.strategy;
-  if (!auth2.provider?.length) {
+  const list = Array.isArray(auth2.providers) ? auth2.providers : auth2.providers ? [auth2.providers] : [];
+  if (!list.length) {
     throw new Error("Auth options needs a provider");
   }
-  const provider = getProviders(auth2.provider);
+  const invalid = list.find((p) => !available.includes(p));
+  if (invalid) {
+    throw new Error(
+      `Provider "${invalid}" not found, available ones are "${available.join('", "')}"`
+    );
+  }
   const redirect2 = auth2.redirect || defaultRedirect;
   const cleanUser = auth2.cleanUser || defaultCleanUser;
   if (!auth2.store && !all.store) {
@@ -1155,13 +1145,10 @@ function parseAuthOptions(auth2, all) {
   const store = auth2.store || all.store.prefix("user:");
   const session2 = auth2.session || all.store.prefix("auth:");
   return {
-    // Base main configuration
     strategy,
-    provider,
-    // Extra configuration
+    providers: list,
     redirect: redirect2,
     cleanUser,
-    // Stores for the auth session and users
     store,
     session: session2
   };
@@ -1371,6 +1358,47 @@ function createLogger(level) {
   };
 }
 
+// src/helpers/security.ts
+function resolveSecurity(security) {
+  const off = security === false;
+  const o = security && typeof security === "object" ? security : {};
+  const val = (v, def) => v === false ? null : v === true || v == null ? def : v;
+  const map2 = off ? {} : {
+    "x-frame-options": val(o.frameguard, "SAMEORIGIN"),
+    "x-content-type-options": o.noSniff === false ? null : "nosniff",
+    "referrer-policy": val(
+      o.referrerPolicy,
+      "strict-origin-when-cross-origin"
+    ),
+    "x-xss-protection": o.xssProtection === false ? null : "0",
+    // Opt-in: default off
+    "content-security-policy": val(o.csp, null),
+    "cross-origin-opener-policy": val(o.coop, null),
+    "cross-origin-resource-policy": val(o.corp, null),
+    "permissions-policy": o.permissionsPolicy ?? null
+  };
+  const headers2 = {};
+  for (const key in map2) {
+    const value = map2[key];
+    if (value) headers2[key] = value;
+  }
+  return {
+    trustProxy: o.trustProxy ?? true,
+    headers: headers2,
+    hsts: off ? null : val(o.hsts, "max-age=15552000; includeSubDomains")
+  };
+}
+function applySecurity(res, ctx) {
+  const security = ctx.options.security;
+  if (!security) return;
+  for (const key in security.headers) {
+    if (!res.headers.has(key)) res.headers.set(key, security.headers[key]);
+  }
+  if (security.hsts && ctx.platform.production && !res.headers.has("strict-transport-security")) {
+    res.headers.set("strict-transport-security", security.hsts);
+  }
+}
+
 // src/helpers/config.ts
 function config(options = {}) {
   const env2 = globalThis.env;
@@ -1384,11 +1412,9 @@ function config(options = {}) {
     // How request bodies are read: parsed into ctx.body by default; `raw` keeps
     // the Buffer, `stream` hands the handler the unread web ReadableStream.
     body: options.body ?? "parse",
-    // Trust X-Forwarded-* headers for ctx.ip (on by default; set it to false
-    // when clients connect directly so a client can't spoof its IP).
-    security: {
-      trustProxy: options.security?.trustProxy ?? true
-    }
+    // Secure-by-default response headers + trustProxy for ctx.ip. `false` turns
+    // the added headers off; see resolveSecurity for the defaults.
+    security: resolveSecurity(options.security)
   };
   options.cors = options.cors || env2.CORS || null;
   if (options.cors) {
@@ -1452,7 +1478,7 @@ function config(options = {}) {
   });
   const loc = (v) => typeof v === "string" ? v : "enabled";
   if (settings.auth) {
-    log.message("auth", `${settings.auth.provider.join(", ")} auth enabled`);
+    log.message("auth", `${settings.auth.providers.join(", ")} auth enabled`);
   }
   if (settings.public) log.message("public", loc(options.public));
   if (settings.uploads) log.message("uploads", loc(options.uploads));
@@ -1613,6 +1639,7 @@ async function parseResponse(out, ctx) {
     throw new Error(`Invalid response type ${out}`);
   }
   applyCors(out, ctx);
+  applySecurity(out, ctx);
   if (ctx.time?.times?.length > 1) {
     out.headers.set("Server-Timing", ctx.time.headers());
   }
@@ -1769,6 +1796,7 @@ async function getResponse(app, ctx) {
   } catch (error) {
     const res = await ctx.options.onError(error, ctx);
     applyCors(res, ctx);
+    applySecurity(res, ctx);
     return res;
   }
 }
@@ -2062,10 +2090,10 @@ async function getUser(ctx) {
       valid: options.strategy
     });
   }
-  if (!options.provider.includes(auth2.provider)) {
+  if (!options.providers.includes(auth2.provider)) {
     throw ServerError_default.AUTH_INVALID_PROVIDER({
       provider: auth2.provider,
-      valid: options.provider
+      valid: options.providers
     });
   }
   const user = await ctx.options.auth.store.get(auth2.user);
@@ -2109,7 +2137,7 @@ function auth(app) {
     ctx.user = await getUser(ctx);
   });
   app.post("/auth/logout", logout);
-  const enabled = app.settings.auth.provider;
+  const enabled = app.settings.auth.providers;
   for (const name of oauth2) {
     if (!enabled.includes(name)) continue;
     const key = name.toUpperCase();
@@ -2384,22 +2412,6 @@ function timer(ctx) {
 // src/context/node.ts
 import { TLSSocket } from "tls";
 
-// src/context/createEvents.ts
-function createEvents() {
-  const events = {};
-  events.on = (name, callback3) => {
-    events[name] = events[name] || [];
-    events[name].push(callback3);
-  };
-  events.trigger = (name, data) => {
-    if (!events[name]) return;
-    for (const cb of events[name]) {
-      cb(data);
-    }
-  };
-  return events;
-}
-
 // src/context/isValidMethod.ts
 var methods = [
   "get",
@@ -2443,7 +2455,6 @@ async function createNode(req, app) {
     }),
     getStream: () => toWeb(req)
   };
-  const events = createEvents();
   const ctx = {
     options: app.settings,
     platform: app.platform,
@@ -2454,7 +2465,6 @@ async function createNode(req, app) {
     cookies: cookies2,
     session: {},
     init,
-    events,
     app,
     ip: clientIp(headers2, {
       remoteAddress: req.socket.remoteAddress || "",
@@ -2485,7 +2495,6 @@ async function createWinter(req, app, server2) {
     getBuffer: async () => Buffer.from(await req.arrayBuffer()),
     getStream: () => req.body ?? void 0
   };
-  const events = createEvents();
   const ctx = {
     options: app.settings,
     platform: app.platform,
@@ -2496,7 +2505,6 @@ async function createWinter(req, app, server2) {
     cookies: cookies2,
     session: {},
     init,
-    events,
     app,
     ip: clientIp(headers2, {
       remoteAddress: server2?.requestIP?.(req)?.address || "",
@@ -2513,7 +2521,6 @@ var Winter = async (app, request, env2) => {
   Object.assign(globalThis.env, env2);
   const ctx = await createWinter(request, app, env2);
   const res = await handleRequest(app, ctx);
-  ctx.events.trigger("finish", { ...ctx, res, end: performance.now() });
   return res;
 };
 var Node = async (app) => {
@@ -2545,7 +2552,6 @@ var Netlify = async (app, request, context) => {
   }
   const ctx = await createWinter(request, app);
   const res = await handleRequest(app, ctx);
-  ctx.events.trigger("finish", { ...ctx, res, end: performance.now() });
   return res;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",