@server/next 0.38.0 → 0.40.0

package/index.d.ts

@@ -1,4 +1,6 @@
 import * as http from 'http';
+export { default as kv } from 'polystore';
+export { default as bucket } from 'bucket';
 
 type LimitOptions = {
     maxSize?: number | string;
@@ -128,6 +130,7 @@ type BasicValue = string | number | boolean | null;
 type SerializableValue = BasicValue | {
     [key: string]: SerializableValue;
 } | Array<SerializableValue>;
+type StoreSource = KVStore | Map<string, any> | string | Record<string, any>;
 type KVStore = {
     name?: string;
     prefix: (prefix?: string) => KVStore;
@@ -140,7 +143,7 @@ type KVStore = {
     keys: () => Promise<string[]>;
 };
 type Provider = "email" | "github" | "google" | "microsoft" | "discord" | "facebook" | "apple";
-type Strategy = "cookie" | "jwt" | "token" | "key";
+type Strategy = "cookie" | "jwt" | "token";
 type AuthSession = {
     id: string;
     provider: Provider;
@@ -153,22 +156,30 @@ type AuthUser<T = Record<string, any>> = T & {
     strategy: Strategy;
     email: string;
 };
-type AuthOption = `${Strategy}:${Provider}` | "key" | {
+type ProfileUser = {
+    id: string | number;
+    email: string;
+} & Record<string, any>;
+type AuthOption = `${Strategy}:${Provider}` | {
     strategy: Strategy;
     providers?: Provider | Provider[];
-    key?: string;
-    session?: KVStore;
-    store?: KVStore;
+    session?: StoreSource;
+    store?: StoreSource;
     redirect?: string;
-    cleanUser?: <T = AuthUser>(user: T) => T | Promise<T>;
+    onProfile?: (raw: any, provider: Provider) => ProfileUser | Promise<ProfileUser>;
+    onLogin?: (loginUser: AuthUser, existingUser: AuthUser | null, ctx: Context) => ProfileUser | Promise<ProfileUser>;
+    onUser?: <T = AuthUser>(user: T, ctx: Context) => T | Promise<T>;
+    onLogout?: (ctx: Context) => unknown;
 };
 type AuthSettings = {
     providers: Provider[];
     strategy: Strategy;
     store: KVStore;
     session: KVStore;
-    key?: string;
-    cleanUser: <T = AuthUser>(user: T) => T | Promise<T>;
+    onProfile?: (raw: any, provider: Provider) => ProfileUser | Promise<ProfileUser>;
+    onLogin?: (loginUser: AuthUser, existingUser: AuthUser | null, ctx: Context) => ProfileUser | Promise<ProfileUser>;
+    onUser: <T = AuthUser>(user: T, ctx: Context) => T | Promise<T>;
+    onLogout?: (ctx: Context) => unknown;
     redirect: string;
 };
 type LogLevel = "info";
@@ -204,10 +215,9 @@ type Options = {
     secret?: string;
     public?: string | Bucket;
     uploads?: string | Bucket | UploadOptions;
-    store?: KVStore;
-    cookies?: KVStore;
-    session?: KVStore | {
-        store: KVStore;
+    store?: StoreSource;
+    session?: StoreSource | {
+        store: StoreSource;
     };
     cors?: CorsOptions;
     auth?: AuthOption;
@@ -228,7 +238,6 @@ type Settings = {
         bucket: Bucket;
     } & LimitOptions) | null;
     store?: KVStore;
-    cookies?: KVStore;
     session?: {
         store: KVStore;
     };
@@ -500,4 +509,4 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
 }
 declare function server<Session extends Record<string, any> = {}, User extends Record<string, any> = {}>(options?: Options): Server<ServerConfig<Session, User>>;
 
-export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type BodyOption, type Bucket, type BucketFile, type BunEnv, type CacheOption, type Context, type Cookie, type CorsSettings, type ExtractPathParams, type FileInfo, type InferParamType, type InlineReply, type KVStore, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type Strategy, type Time, type UploadOptions, type UploadedFile, cache, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };
+export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type BodyOption, type Bucket, type BucketFile, type BunEnv, type CacheOption, type Context, type Cookie, type CorsSettings, type ExtractPathParams, type FileInfo, type InferParamType, type InlineReply, type KVStore, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type ProfileUser, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type StoreSource, type Strategy, type Time, type UploadOptions, type UploadedFile, cache, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };

package/index.js

@@ -68,6 +68,10 @@ ServerError_default.extend({
     status: 401,
     message: "Credentials do not correspond to a user"
   },
+  AUTH_INVALID_USER: {
+    status: 500,
+    message: "{callback} must return a user with an 'id' and an 'email'"
+  },
   LOGIN_NO_EMAIL: "The email is required to log in",
   LOGIN_INVALID_EMAIL: "The email you wrote is not correct",
   LOGIN_NO_PASSWORD: "The email is required to log in",
@@ -175,7 +179,7 @@ async function saveFileToBucket(originalName, data, bucket2, contentType) {
   };
 }
 function validateFile(originalName, data, contentType, limits) {
-  const { maxSize, minSize, fileType } = limits;
+  const { maxSize, minSize, fileType: fileType2 } = limits;
   if (maxSize !== void 0 && data.length > parseBytes(maxSize)) {
     throw new Error(
       `File "${originalName}" is too large (${data.length} bytes, limit is ${maxSize})`
@@ -186,15 +190,15 @@ function validateFile(originalName, data, contentType, limits) {
       `File "${originalName}" is too small (${data.length} bytes, minimum is ${minSize})`
     );
   }
-  if (fileType && fileType.length > 0) {
+  if (fileType2 && fileType2.length > 0) {
     const ext2 = getExt(originalName);
     const mime = contentType.toLowerCase();
-    const allowed = fileType.some(
+    const allowed = fileType2.some(
       (t) => t.toLowerCase() === mime || t.toLowerCase() === ext2
     );
     if (!allowed) {
       throw new Error(
-        `File type not allowed for "${originalName}" (got "${contentType}", allowed: ${fileType.join(", ")})`
+        `File type not allowed for "${originalName}" (got "${contentType}", allowed: ${fileType2.join(", ")})`
       );
     }
   }
@@ -531,9 +535,9 @@ async function parseBody(input, contentType, dest, max = INF) {
   let limits;
   if (dest && "bucket" in dest) {
     bucket2 = dest.bucket;
-    const { maxSize, minSize, fileType } = dest;
-    if (maxSize != null || minSize != null || fileType != null) {
-      limits = { maxSize, minSize, fileType };
+    const { maxSize, minSize, fileType: fileType2 } = dest;
+    if (maxSize != null || minSize != null || fileType2 != null) {
+      limits = { maxSize, minSize, fileType: fileType2 };
     }
   } else {
     bucket2 = dest;
@@ -661,8 +665,8 @@ function normalizeExpires(expires) {
 }
 function createCookies(key, val) {
   if (val.value === null) val.expires = EXPIRED;
-  const { value, path: path2, expires, maxAge, httpOnly, secure, sameSite } = val;
-  let str = `${key}=${encodeURIComponent(value ?? "")};Path=${path2 || "/"}`;
+  const { value, path, expires, maxAge, httpOnly, secure, sameSite } = val;
+  let str = `${key}=${encodeURIComponent(value ?? "")};Path=${path || "/"}`;
   if (typeof expires !== "undefined") str += `;Expires=${normalizeExpires(expires)}`;
   if (typeof maxAge === "number") str += `;Max-Age=${maxAge}`;
   if (httpOnly) str += ";HttpOnly";
@@ -725,6 +729,16 @@ function clientIp(headers2, opts = {}) {
   return normalize(remoteAddress);
 }
 
+// src/helpers/store.ts
+import kv from "polystore";
+function toStore(source) {
+  const store = source;
+  if (store && typeof store.prefix === "function" && typeof store.get === "function" && typeof store.set === "function") {
+    return store;
+  }
+  return kv(source);
+}
+
 // src/helpers/disposition.ts
 var encodeExt = (name) => encodeURIComponent(name).replace(
   /['()*]/g,
@@ -740,6 +754,14 @@ function disposition(name) {
   return `${value}; filename*=UTF-8''${encodeExt(clean)}`;
 }
 
+// src/helpers/fileType.ts
+function fileType(file2) {
+  if (file2.type) return file2.type;
+  const name = file2.path || file2.name || "";
+  const ext2 = name.split(".").pop()?.toLowerCase();
+  return ext2 ? mimes_default[ext2] : void 0;
+}
+
 // src/helpers/isHtml.ts
 var TAG = /^\s*<[a-zA-Z!/]/;
 function isHtml(body) {
@@ -817,22 +839,22 @@ var Reply = class {
     }
     return this.send(JSON.stringify(body));
   }
-  redirect(path2) {
-    this.headers("location", path2);
+  redirect(path) {
+    this.headers("location", path);
     if (this.res.status == null) this.res.status = 302;
     return this.send();
   }
-  async file(path2) {
-    if (typeof path2 !== "string") {
-      if (!await path2.exists()) return this.status(404).send();
-      return this.type(path2.type).send(path2.stream());
+  async file(path) {
+    if (typeof path !== "string") {
+      if (!await path.exists()) return this.status(404).send();
+      return this.type(fileType(path)).send(path.stream());
     }
-    if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(path2)) return this.status(404).send();
+    if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(path)) return this.status(404).send();
     try {
-      const fs2 = await import("fs");
-      const ext2 = path2.split(".").pop();
-      await fs2.promises.access(path2);
-      const stream = fs2.createReadStream(path2);
+      const fs = await import("fs");
+      const ext2 = path.split(".").pop();
+      await fs.promises.access(path);
+      const stream = fs.createReadStream(path);
       return this.type(ext2).send(stream);
     } catch (error) {
       if (error.code === "ENOENT" || error.code === "EISDIR") {
@@ -894,6 +916,13 @@ var json = (...args) => r().json(...args);
 var file = (...args) => r().file(...args);
 var redirect = (...args) => r().redirect(...args);
 
+// src/auth/assertUser.ts
+function assertUser(user, callback3) {
+  if (!user || typeof user !== "object" || user.id == null || !user.email) {
+    throw ServerError_default.AUTH_INVALID_USER({ callback: callback3 });
+  }
+}
+
 // src/helpers/jwt.ts
 var enc = new TextEncoder();
 var dec = new TextDecoder();
@@ -964,7 +993,7 @@ async function verifyJwt(token, secret) {
 // src/auth/finishLogin.ts
 async function finishLogin(ctx, input) {
   const settings = ctx.options.auth;
-  const { strategy, cleanUser } = settings;
+  const { strategy, onLogin, onUser } = settings;
   const key = String(input.key);
   const auth2 = {
     id: createId(),
@@ -974,22 +1003,28 @@ async function finishLogin(ctx, input) {
     email: input.email,
     time: (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "")
   };
-  let user = input.user;
-  if (input.store !== false) {
-    const existing = await settings.store.get(key);
-    user = { ...existing ?? {}, ...input.user };
-  }
-  user = await cleanUser(user);
-  if (input.store !== false) await settings.store.set(key, user);
+  const loginUser = {
+    ...input.user,
+    provider: input.provider,
+    strategy
+  };
+  const existingUser = await settings.store.get(key) ?? null;
+  const user = onLogin ? await onLogin(loginUser, existingUser, ctx) : { ...existingUser ?? {}, ...loginUser };
+  assertUser(user, "onLogin");
+  await settings.store.set(key, user);
   if (!strategy.includes("jwt")) {
     await settings.session.set(auth2.id, auth2, { expires: "1w" });
   }
   if (strategy.includes("jwt")) {
     const token = await signJwt(auth2, ctx.options.secret, 7 * 24 * 60 * 60);
-    return status(201).json({ ...user, token });
+    const exposed = await onUser(user, ctx);
+    assertUser(exposed, "onUser");
+    return status(201).json({ ...exposed, token });
   }
   if (strategy.includes("token")) {
-    return status(201).json({ ...user, token: auth2.id });
+    const exposed = await onUser(user, ctx);
+    assertUser(exposed, "onUser");
+    return status(201).json({ ...exposed, token: auth2.id });
   }
   if (strategy.includes("cookie")) {
     return cookies("authentication", {
@@ -1000,7 +1035,6 @@ async function finishLogin(ctx, input) {
       sameSite: "Lax"
     }).redirect(settings.redirect);
   }
-  if (strategy.includes("key")) throw new Error("Key auth not supported yet");
   throw new Error("Unknown auth type");
 }
 
@@ -1110,11 +1144,15 @@ var callback = async (ctx) => {
     const parsed = JSON.parse(body.user).name;
     if (parsed) name = `${parsed.firstName} ${parsed.lastName}`.trim();
   }
+  const raw = { ...claims, name };
+  const { onProfile } = ctx.options.auth;
+  const profile = onProfile ? await onProfile(raw, "apple") : { id: raw.sub, name: raw.name, email: raw.email };
+  assertUser(profile, "onProfile");
   const res = await finishLogin(ctx, {
     provider: "apple",
-    key: claims.sub,
-    email: claims.email,
-    user: { id: claims.sub, name, email: claims.email }
+    key: profile.id,
+    email: profile.email,
+    user: profile
   });
   res.headers.append("set-cookie", clearState());
   return res;
@@ -1163,17 +1201,15 @@ function oauthProvider(config2) {
       }
     });
     if (!profileRes.ok) throw new Error(`${config2.name}: profile fetch failed`);
-    const profile = config2.profile(await profileRes.json());
+    const raw = await profileRes.json();
+    const { onProfile } = ctx.options.auth;
+    const profile = onProfile ? await onProfile(raw, config2.name) : config2.profile(raw);
+    assertUser(profile, "onProfile");
     const res = await finishLogin(ctx, {
       provider: config2.name,
       key: profile.id,
       email: profile.email,
-      user: {
-        id: profile.id,
-        name: profile.name,
-        email: profile.email,
-        picture: profile.picture
-      }
+      user: profile
     });
     res.headers.append("set-cookie", clearState());
     return res;
@@ -1219,8 +1255,7 @@ async function emailLogin(ctx) {
     provider: "email",
     key: user.email,
     email: user.email,
-    user,
-    store: false
+    user
   });
 }
 async function emailRegister(ctx) {
@@ -1241,13 +1276,11 @@ async function emailRegister(ctx) {
     time,
     ...data
   };
-  await store.set(email, user);
   return finishLogin(ctx, {
     provider: "email",
     key: email,
     email,
-    user,
-    store: false
+    user
   });
 }
 async function emailResetPassword() {
@@ -1301,8 +1334,8 @@ var oauth = async (code) => {
       code
     })
   });
-  return (path2) => {
-    return fch(`https://api.github.com${path2}`, {
+  return (path) => {
+    return fch(`https://api.github.com${path}`, {
       headers: { Authorization: `Bearer ${res.access_token}` }
     });
   };
@@ -1327,21 +1360,25 @@ var getUserProfile = async (code) => {
   const email = emails.sort((a) => a.primary ? -1 : 1)[0]?.email;
   return { ...profile, email };
 };
+var defaultProfile = (raw) => ({
+  id: raw.id,
+  name: raw.name,
+  email: raw.email,
+  picture: raw.avatar_url,
+  location: raw.location,
+  created: raw.created_at
+});
 var callback2 = async (ctx) => {
   checkState(ctx, ctx.url.query.state);
-  const profile = await getUserProfile(ctx.url.query.code);
+  const raw = await getUserProfile(ctx.url.query.code);
+  const { onProfile } = ctx.options.auth;
+  const profile = onProfile ? await onProfile(raw, "github") : defaultProfile(raw);
+  assertUser(profile, "onProfile");
   const res = await finishLogin(ctx, {
     provider: "github",
     key: profile.id,
     email: profile.email,
-    user: {
-      id: profile.id,
-      name: profile.name,
-      email: profile.email,
-      picture: profile.avatar_url,
-      location: profile.location,
-      created: profile.created_at
-    }
+    user: profile
   });
   res.headers.append("set-cookie", clearState());
   return res;
@@ -1391,7 +1428,7 @@ var providers_default = {
 
 // src/auth/parseAuthOptions.ts
 var defaultRedirect = "/user";
-function defaultCleanUser(fullUser) {
+function defaultOnUser(fullUser) {
   const { password: _password, ...user } = fullUser;
   return user;
 }
@@ -1406,19 +1443,6 @@ function parseAuthOptions(auth2, all) {
     throw new Error("Auth options needs a strategy");
   }
   const strategy = auth2.strategy;
-  if (strategy === "key") {
-    const key = auth2.key || env.AUTH_KEY;
-    if (!key) {
-      throw new Error("`key` auth needs the AUTH_KEY env var (or auth.key)");
-    }
-    return {
-      strategy,
-      providers: [],
-      key,
-      redirect: auth2.redirect || defaultRedirect,
-      cleanUser: auth2.cleanUser || defaultCleanUser
-    };
-  }
   const list = Array.isArray(auth2.providers) ? auth2.providers : auth2.providers ? [auth2.providers] : [];
   if (!list.length) {
     throw new Error("Auth options needs a provider");
@@ -1430,119 +1454,35 @@ function parseAuthOptions(auth2, all) {
     );
   }
   const redirect2 = auth2.redirect || defaultRedirect;
-  const cleanUser = auth2.cleanUser || defaultCleanUser;
+  const { onProfile, onLogin, onLogout } = auth2;
+  const onUser = auth2.onUser || defaultOnUser;
   if (!auth2.store && !all.store) {
     throw new Error("Need a userStore store for Auth");
   }
   if (!auth2.session && !all.store) {
     throw new Error("Need a sessionStore store for Auth");
   }
-  const store = auth2.store || all.store.prefix("user:");
-  const session2 = auth2.session || all.store.prefix("auth:");
+  const store = all.store ? toStore(all.store) : null;
+  const authStore = auth2.store ? toStore(auth2.store) : store.prefix("user:");
+  const sessionStore = auth2.session ? toStore(auth2.session) : store.prefix("auth:");
   return {
     strategy,
     providers: list,
     redirect: redirect2,
-    cleanUser,
-    store,
-    session: session2
+    onProfile,
+    onLogin,
+    onUser,
+    onLogout,
+    store: authStore,
+    session: sessionStore
   };
 }
 
 // src/helpers/bucket.ts
-import * as fs from "fs";
-import * as fsp from "fs/promises";
-import * as path from "path";
-function localBucket(root, prefix = "") {
-  const base = path.resolve(root);
-  const resolveKey = (name) => {
-    if (!name) throw new Error("File name is required");
-    const full = path.resolve(base, name.replace(/^\/+/, ""));
-    if (full !== base && !full.startsWith(base + path.sep)) {
-      throw new Error(`Path "${name}" escapes the bucket root`);
-    }
-    return full;
-  };
-  const file2 = (name, win) => {
-    const full = resolveKey(name);
-    const key = prefix + name.replace(/^\/+/, "");
-    const type2 = mimes_default[path.extname(name).slice(1).toLowerCase()];
-    const read = () => {
-      let opts;
-      if (win) {
-        opts = { start: win.start };
-        if (Number.isFinite(win.end)) opts.end = Math.max(win.start, win.end - 1);
-      }
-      const nodeStream = fs.createReadStream(full, opts);
-      return new ReadableStream({
-        start(controller) {
-          nodeStream.on("data", (chunk) => controller.enqueue(chunk));
-          nodeStream.on("end", () => controller.close());
-          nodeStream.on("error", (err) => controller.error(err));
-        },
-        cancel() {
-          nodeStream.destroy();
-        }
-      });
-    };
-    return {
-      path: key,
-      name: path.basename(name),
-      type: type2,
-      async exists() {
-        const stats = await fsp.stat(full).catch(() => null);
-        return !!stats?.isFile();
-      },
-      async info() {
-        const stats = await fsp.stat(full).catch(() => null);
-        if (!stats?.isFile()) return null;
-        const size = win ? Math.max(0, Math.min(win.end, stats.size) - win.start) : stats.size;
-        return { size, type: type2 ?? null, modified: stats.mtime };
-      },
-      // Read-only view of [start, end), composed relative to the current window.
-      slice(start, end) {
-        const base2 = win?.start ?? 0;
-        const cap = win?.end ?? Number.POSITIVE_INFINITY;
-        const s = Math.min(cap, base2 + Math.max(0, start));
-        const e = end === void 0 ? cap : Math.min(cap, base2 + end);
-        return file2(name, { start: s, end: e });
-      },
-      async write(content) {
-        await fsp.mkdir(path.dirname(full), { recursive: true });
-        if (content instanceof ReadableStream) {
-          const writable = fs.createWriteStream(full);
-          for await (const chunk of content) {
-            writable.write(chunk);
-          }
-          await new Promise((resolve2, reject) => {
-            writable.on("error", reject);
-            writable.end(() => resolve2());
-          });
-          return;
-        }
-        await fsp.writeFile(full, content);
-      },
-      stream() {
-        return read();
-      },
-      async bytes() {
-        if (win) return new Uint8Array(await new Response(read()).arrayBuffer());
-        return new Uint8Array(await fsp.readFile(full));
-      },
-      async remove() {
-        await fsp.unlink(full).catch(() => {
-        });
-      }
-    };
-  };
-  return {
-    file: file2,
-    folder: (sub) => localBucket(path.join(base, sub), `${prefix}${sub.replace(/^\/+|\/+$/g, "")}/`)
-  };
-}
+import FileSystem from "bucket/fs";
 function bucket(root) {
   if (!root) return null;
-  if (typeof root === "string") return localBucket(root);
+  if (typeof root === "string") return FileSystem(root);
   if (typeof root.file === "function") return root;
   throw new Error(
     "Invalid bucket: pass a directory path or a `bucket` instance (with .file())"
@@ -1638,14 +1578,14 @@ function createLogger(level) {
   const request = (ctx, res) => {
     if (!enabled) return;
     const method = ctx.method.toUpperCase();
-    const path2 = ctx.url.pathname;
+    const path = ctx.url.pathname;
     const reqLen = Number(ctx.headers["content-length"]) || 0;
     const resLen = Number(res.headers.get("content-length")) || 0;
     const status2 = res.status;
     const text = STATUS_TEXT[status2] || "";
     const reqSize = reqLen ? ` ${formatBytes(reqLen)}` : "";
     const resSize = resLen ? ` ${formatBytes(resLen)}` : "";
-    let line = `${method} ${path2}${reqSize} \u2192 ${status2}${text ? ` ${text}` : ""}${resSize}`;
+    let line = `${method} ${path}${reqSize} \u2192 ${status2}${text ? ` ${text}` : ""}${resSize}`;
     const location = res.headers.get("location");
     if (location) line += ` \u2192 ${location}`;
     message("api", line);
@@ -1772,22 +1712,22 @@ function config(options = {}) {
   if (!up) {
     settings.uploads = null;
   } else if (typeof up === "object" && "bucket" in up) {
-    const { bucket: bucket2, maxSize, minSize, fileType } = up;
+    const { bucket: bucket2, maxSize, minSize, fileType: fileType2 } = up;
     if (maxSize != null) parseBytes(maxSize);
     if (minSize != null) parseBytes(minSize);
-    settings.uploads = { bucket: bucket(bucket2), maxSize, minSize, fileType };
+    settings.uploads = { bucket: bucket(bucket2), maxSize, minSize, fileType: fileType2 };
   } else {
     settings.uploads = { bucket: bucket(up) };
   }
   const favicon2 = options.favicon || env2.FAVICON;
   if (favicon2) settings.favicon = favicon2;
-  settings.store = options.store ?? null;
-  settings.cookies = options.cookies ?? null;
+  settings.store = options.store ? toStore(options.store) : null;
   if (options.session) {
-    settings.session = "store" in options.session ? options.session : { store: options.session };
+    const store = typeof options.session === "object" && "store" in options.session ? options.session.store : options.session;
+    settings.session = { store: toStore(store) };
   }
-  if (options.store && !options.session) {
-    settings.session = { store: options.store.prefix("session:") };
+  if (settings.store && !options.session) {
+    settings.session = { store: settings.store.prefix("session:") };
   }
   if (options.auth || env2.AUTH) {
     settings.auth = parseAuthOptions(options.auth || env2.AUTH || null, options);
@@ -1940,9 +1880,10 @@ async function parseResponse(out, ctx) {
     if (!await out.exists()) {
       out = new Response(null, { status: 404 });
     } else {
+      const type2 = fileType(out);
       out = new Response(
         out.stream(),
-        out.type ? { headers: { "content-type": out.type } } : void 0
+        type2 ? { headers: { "content-type": type2 } } : void 0
       );
     }
   }
@@ -2011,13 +1952,6 @@ async function parseResponse(out, ctx) {
     }
     ctx.options.session.store.set(id, ctx.session);
   }
-  if (ctx.options.cookies) {
-    if (Object.keys(ctx.res?.cookies || {}).length) {
-      for (const cookie of Object.values(ctx.res.cookies)) {
-        ctx.res.headers.append("set-cookie", cookie);
-      }
-    }
-  }
   if (ctx?.res?.headers) {
     for (const key in ctx.res.headers) {
       out.headers[key] = ctx.res.headers[key];
@@ -2027,14 +1961,14 @@ async function parseResponse(out, ctx) {
 }
 
 // src/pathPattern.ts
-function pathPattern(pattern, path2) {
-  if (pattern === "*" && path2 === "/") return {};
+function pathPattern(pattern, path) {
+  if (pattern === "*" && path === "/") return {};
   pattern = `/${pattern.replace(/^\//, "")}`;
   pattern = pattern.replace(/\/$/, "") || "/";
-  path2 = path2.replace(/\/$/, "") || "/";
-  if (pattern === path2) return {};
+  path = path.replace(/\/$/, "") || "/";
+  if (pattern === path) return {};
   const params = {};
-  const pathParts = path2.split("/").slice(1).map((u) => decodeURIComponent(u));
+  const pathParts = path.split("/").slice(1).map((u) => decodeURIComponent(u));
   const pattParts = pattern.split("/").slice(1);
   let allSame = true;
   for (let i = 0; i < Math.max(pathParts.length, pattParts.length); i++) {
@@ -2093,7 +2027,7 @@ function validate(ctx, schema) {
   } catch (error) {
     if (error.name === "ZodError" || error.constructor.name === "ZodError") {
       const message = error.issues.map(
-        ({ path: path2, message: message2 }) => `[${base}.${path2.join(".")}]: ${message2}`
+        ({ path, message: message2 }) => `[${base}.${path.join(".")}]: ${message2}`
       ).sort().join("\n");
       throw new StatusError(message, 422);
     }
@@ -2289,7 +2223,7 @@ async function verify(password, hash3) {
   const [, variant, , memory, passes, parallelism, saltB64, hashB64] = match;
   const nonce = Buffer.from(saltB64, "base64");
   const expected = Buffer.from(hashB64, "base64");
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     crypto3.argon2(
       `argon2${variant}`,
       {
@@ -2303,23 +2237,15 @@ async function verify(password, hash3) {
       (err, derivedKey) => {
         if (err) return reject(err);
         if (derivedKey.length === expected.length && timingSafeEqual(derivedKey, expected)) {
-          resolve2(true);
+          resolve(true);
         } else {
-          resolve2(false);
+          resolve(false);
         }
       }
     );
   });
 }
 
-// src/helpers/safeEqual.ts
-function safeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-
 // src/auth/findSessionId.ts
 var validateToken = (authorization) => {
   const [type2, id] = authorization.trim().split(" ");
@@ -2352,19 +2278,6 @@ function findSessionId(ctx) {
 }
 
 // src/auth/getUser.ts
-function getKeyUser(ctx) {
-  const expected = ctx.options.auth.key;
-  const header = ctx.headers.authorization;
-  if (!header) return;
-  const [type2, provided] = header.trim().split(" ");
-  if (type2?.toLowerCase() !== "bearer" || !provided) {
-    throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
-  }
-  if (!expected || !safeEqual(provided, expected)) {
-    throw ServerError_default.AUTH_INVALID_TOKEN();
-  }
-  return { id: "key", strategy: "key", provider: "key" };
-}
 async function getAuthSession(ctx) {
   const strategy = ctx.options.auth.strategy;
   if (strategy.includes("jwt")) {
@@ -2385,7 +2298,6 @@ async function getAuthSession(ctx) {
 async function getUser(ctx) {
   if (!ctx.options.auth) return;
   const options = ctx.options.auth;
-  if (options.strategy === "key") return getKeyUser(ctx);
   const auth2 = await getAuthSession(ctx);
   if (!auth2) return;
   if (options.strategy !== auth2.strategy) {
@@ -2404,7 +2316,9 @@ async function getUser(ctx) {
   if (!user) throw ServerError_default.AUTH_NO_USER();
   user.strategy = auth2.strategy;
   user.provider = auth2.provider;
-  return ctx.options.auth.cleanUser(user);
+  const exposed = await ctx.options.auth.onUser(user, ctx);
+  assertUser(exposed, "onUser");
+  return exposed;
 }
 
 // src/auth/logout.ts
@@ -2414,15 +2328,13 @@ async function logout(ctx) {
   if (!strategy.includes("jwt")) {
     await ctx.options.auth.session.del(findSessionId(ctx));
   }
+  if (ctx.options.auth.onLogout) await ctx.options.auth.onLogout(ctx);
   if (strategy.includes("token") || strategy.includes("jwt")) {
     return { token: null };
   }
   if (strategy.includes("cookie")) {
     return cookies({ authentication: null }).redirect("/");
   }
-  if (strategy.includes("key")) {
-    throw new Error("Key auth not supported yet");
-  }
   throw new Error("Unknown auth type");
 }
 
@@ -2438,7 +2350,6 @@ function auth(app) {
   app.use(async function middle(ctx) {
     ctx.user = await getUser(ctx);
   });
-  if (app.settings.auth.strategy === "key") return;
   app.post("/auth/logout", logout);
   const enabled = app.settings.auth.providers;
   for (const name of oauth2) {
@@ -2500,8 +2411,8 @@ async function assets(ctx) {
     const info = file2.info?.bind(file2);
     const meta = info ? await info() : null;
     if (info ? !meta : !await file2.exists()) return;
-    const ext2 = ctx.url.pathname.split(".").pop();
-    const ctype = meta?.type || ext2;
+    const ext2 = ctx.url.pathname.split(".").pop()?.toLowerCase();
+    const ctype = ext2 && mimes_default[ext2] || meta?.type || ext2;
     const headers2 = { "cache-control": CACHE_CONTROL };
     let tag;
     if (meta) {
@@ -2564,7 +2475,7 @@ async function favicon(ctx) {
 }
 
 // src/middle/openapi.ts
-import * as fsp2 from "fs/promises";
+import * as fsp from "fs/promises";
 var entities = {
   "&": "&amp;",
   "<": "&lt;",
@@ -2610,7 +2521,7 @@ function zodToSchema(schema) {
   }
   return { type: type2 };
 }
-var pkgProm = fsp2.readFile("package.json", "utf-8").then((data) => JSON.parse(data)).catch(() => ({}));
+var pkgProm = fsp.readFile("package.json", "utf-8").then((data) => JSON.parse(data)).catch(() => ({}));
 var getTag = (name, fn) => {
   const found = fn.toString().split("\n").filter((l) => /\s+\/\/\s/.test(l)).map((l) => l.trim().replace("// ", "")).find((l) => l.startsWith(name));
   if (!found) return "";
@@ -2622,14 +2533,14 @@ var generateOpenApiPaths = (handlers) => {
   const paths = {};
   for (const [method, routes] of Object.entries(handlers)) {
     for (const route of routes) {
-      const path2 = route.path;
+      const path = route.path;
       const fn = route.fns.find((p) => typeof p === "function");
       const meta = route.fns.find((p) => typeof p === "object");
       const config2 = getConfig(route.options);
-      if (typeof path2 !== "string" || path2 === "*" || path2 === "/docs" || !fn) {
+      if (typeof path !== "string" || path === "*" || path === "/docs" || !fn) {
         continue;
       }
-      const normalizedPath = path2.replace(/\(\w+\)/gi, "").replace(/:([a-zA-Z0-9_]+)/g, "{$1}");
+      const normalizedPath = path.replace(/\(\w+\)/gi, "").replace(/:([a-zA-Z0-9_]+)/g, "{$1}");
       if (!paths[normalizedPath]) {
         paths[normalizedPath] = {};
       }
@@ -2656,7 +2567,7 @@ var generateOpenApiPaths = (handlers) => {
         };
       }
       const parameters = [];
-      const matched = Array.from(path2.matchAll(/:[\w()]+/gi));
+      const matched = Array.from(path.matchAll(/:[\w()]+/gi));
       matched.forEach((match) => {
         const [name, type2 = "string"] = match[0].slice(1).replace(/\)/, "").split("(");
         parameters.push({
@@ -2995,18 +2906,18 @@ async function createNode(req, app) {
   const cookies2 = parseCookies(headers2.cookie);
   const scheme = req.socket instanceof TLSSocket ? "https" : "http";
   const host = headers2.host || `localhost:${app.settings.port}`;
-  const path2 = (req.url || "/").replace(/\/$/, "") || "/";
+  const path = (req.url || "/").replace(/\/$/, "") || "/";
   const baseUrl = `${scheme}://${host}`;
-  const url = new URL(path2, baseUrl);
+  const url = new URL(path, baseUrl);
   define(
     url,
     "query",
     (url2) => Object.fromEntries(url2.searchParams.entries())
   );
   const source = {
-    getBuffer: () => new Promise((resolve2, reject) => {
+    getBuffer: () => new Promise((resolve, reject) => {
       const chunks2 = [];
-      req.on("data", (chunk) => chunks2.push(chunk)).on("end", () => resolve2(Buffer.concat(chunks2))).on("error", reject);
+      req.on("data", (chunk) => chunks2.push(chunk)).on("end", () => resolve(Buffer.concat(chunks2))).on("error", reject);
     }),
     getStream: () => toWeb(req)
   };
@@ -3158,9 +3069,9 @@ var Router = class _Router {
   // functions into a single flat `fns` list. A plain options object may sit
   // between the path and the handlers, and it's pulled out here.
   handle(method, pathOrFn, ...rest) {
-    let path2 = "*";
+    let path = "*";
     if (typeof pathOrFn === "string") {
-      path2 = pathOrFn;
+      path = pathOrFn;
     } else if (pathOrFn != null) {
       rest.unshift(pathOrFn);
     }
@@ -3170,7 +3081,7 @@ var Router = class _Router {
     }
     const base = method === "socket" ? [] : this.middleware;
     const fns = [...base, ...rest].filter((fn) => fn != null);
-    this.handlers[method].push({ path: path2, options, fns });
+    this.handlers[method].push({ path, options, fns });
     return this.self();
   }
   socket(pathOrMid, optionsOrMid, ...middleware) {
@@ -3235,31 +3146,33 @@ function isSerializable(body) {
 }
 function ServerTest(app) {
   const port = app.settings.port;
-  const fetch2 = async (method, path2, options = {}) => {
+  const fetch2 = async (method, path, options = {}) => {
     if (!options.headers) options.headers = {};
     if (isSerializable(options.body)) {
       options.headers["content-type"] = "application/json";
       options.body = JSON.stringify(options.body);
     }
     return await app.fetch(
-      new Request(`http://localhost:${port}${path2}`, {
+      new Request(`http://localhost:${port}${path}`, {
         method,
         ...options
       })
     );
   };
   return {
-    get: (path2, options) => fetch2("get", path2, options),
-    head: (path2, options) => fetch2("head", path2, options),
-    post: (path2, body, options) => fetch2("post", path2, { body, ...options }),
-    put: (path2, body, options) => fetch2("put", path2, { body, ...options }),
-    patch: (path2, body, options) => fetch2("patch", path2, { body, ...options }),
-    delete: (path2, options) => fetch2("delete", path2, options),
-    options: (path2, options) => fetch2("options", path2, options)
+    get: (path, options) => fetch2("get", path, options),
+    head: (path, options) => fetch2("head", path, options),
+    post: (path, body, options) => fetch2("post", path, { body, ...options }),
+    put: (path, body, options) => fetch2("put", path, { body, ...options }),
+    patch: (path, body, options) => fetch2("patch", path, { body, ...options }),
+    delete: (path, options) => fetch2("delete", path, options),
+    options: (path, options) => fetch2("options", path, options)
   };
 }
 
 // src/index.ts
+import { default as default2 } from "polystore";
+import { default as default3 } from "bucket";
 var Server = class extends Router {
   settings;
   platform;
@@ -3327,6 +3240,7 @@ function server(options) {
 export {
   Server,
   ServerError_default as ServerError,
+  default3 as bucket,
   cache,
   cookies,
   server as default,
@@ -3334,6 +3248,7 @@ export {
   file,
   headers,
   json,
+  default2 as kv,
   redirect,
   router,
   send,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",
@@ -17,8 +17,7 @@
     "start": "bun test --watch",
     "lint": "npx tsc --noEmit && npx @biomejs/biome lint ./src --skip=lint/suspicious/noExplicitAny --skip=lint/style/noParameterAssign --skip=lint/suspicious/noConfusingVoidType --skip=lint/complexity/noBannedTypes",
     "test": "npm run test:bun && tsc --noEmit",
-    "test:bun": "bun test",
-    "test:jest": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
+    "test:bun": "bun test"
   },
   "main": "index.js",
   "type": "module",
@@ -64,20 +63,16 @@
     },
     "tutorials": "docs/tutorials"
   },
+  "dependencies": {
+    "bucket": "^0.7.1",
+    "polystore": "^0.23.3"
+  },
   "devDependencies": {
     "@types/bun": "^1.3.0",
-    "@types/jest": "^30.0.0",
     "@types/node": "^24.10.0",
-    "bucket": "^0.5.0",
     "bun": "^1.3.13",
     "check-dts": "^0.8.2",
-    "jest": "^29.7.0",
-    "polystore": "^0.21.1",
     "tsup": "^8.5.1",
     "typescript": "^6.0.2"
-  },
-  "jest": {
-    "testEnvironment": "jest-environment-node",
-    "transform": {}
   }
 }

package/readme.md

@@ -1 +1,29 @@
 # Server JS [![@server/next](https://img.shields.io/npm/v/@server/next?label=@server/next&color=greenlime)](https://www.npmjs.com/package/@server/next) [![tests](https://github.com/franciscop/server-next/workflows/tests/badge.svg)](https://github.com/franciscop/server-next/actions)
+
+A modern web server for Bun and Node, with routing, authentication, uploads, WebSockets and testing built in.
+
+```bash
+npm install @server/next
+```
+
+```js
+import server from '@server/next';
+
+export default server({ store: new Map(), uploads: './uploads' })
+  .get('/', () => 'Hello world')
+  .get('/users/:id', (ctx) => db.users.find(ctx.url.params.id))
+  .post('/avatar', (ctx) => ctx.body.avatar.path);
+```
+
+Key-value stores and file storage come included, so `store` takes a plain `Map` and `uploads` takes a folder path. For Redis, S3 and the rest, `kv` and `bucket` are exported too:
+
+```js
+import server, { kv, bucket } from '@server/next';
+
+const store = kv(createClient({ url }).connect());
+const uploads = bucket.S3('my-bucket', { id, key });
+
+export default server({ store, uploads });
+```
+
+See the [full documentation](https://serverjs.io/documentation).