@server/next 0.49.0 → 0.49.1

package/index.d.ts

@@ -203,6 +203,7 @@ type AuthOption = string | AuthFunction | AuthConfig<any> | AuthVerify<any> | Au
 type AuthContext = Pick<Context, "options" | "headers" | "cookies" | "platform" | "app">;
 type AuthEntry = {
     name: string;
+    providers?: string[];
     user: (ctx: AuthContext) => Promise<any>;
     routes?: () => Router;
 };
@@ -577,6 +578,10 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             referrerPolicy?: ReferrerPolicy;
             window?: null;
         }) => Promise<Response>;
+        readonly cookies: {
+            [k: string]: string;
+        };
+        clear: () => void;
     };
 }
 declare function server<U = AuthProfile>(options: Omit<Options, "auth"> & {

package/index.js

@@ -245,7 +245,8 @@ function createCookies(key, val) {
   if (val.value === null) val.expires = EXPIRED;
   const { value, path, expires, maxAge, httpOnly, secure, sameSite } = val;
   let str = `${key}=${encodeURIComponent(value ?? "")};Path=${path || "/"}`;
-  if (typeof expires !== "undefined") str += `;Expires=${normalizeExpires(expires)}`;
+  if (typeof expires !== "undefined")
+    str += `;Expires=${normalizeExpires(expires)}`;
   if (typeof maxAge === "number") str += `;Max-Age=${maxAge}`;
   if (httpOnly) str += ";HttpOnly";
   if (secure) str += ";Secure";
@@ -513,7 +514,11 @@ function serialize(body, headers2) {
     return body;
   }
   if (typeof body === "string") {
-    fill(headers2, isHtml(body) ? mimes_default.html : mimes_default.text, Buffer.byteLength(body));
+    fill(
+      headers2,
+      isHtml(body) ? mimes_default.html : mimes_default.text,
+      Buffer.byteLength(body)
+    );
     return body;
   }
   if (body instanceof Uint8Array) {
@@ -676,13 +681,22 @@ var redirect = (...args) => r().redirect(...args);
 // src/body/sniff.ts
 var ascii = (text) => [...text].map((char) => char.charCodeAt(0));
 var SIGNATURES = [
-  { type: "image/png", magic: [137, 80, 78, 71, 13, 10, 26, 10] },
+  {
+    type: "image/png",
+    magic: [137, 80, 78, 71, 13, 10, 26, 10]
+  },
   { type: "image/jpeg", magic: [255, 216, 255] },
   { type: "image/gif", magic: ascii("GIF87a") },
   { type: "image/gif", magic: ascii("GIF89a") },
   // RIFF containers: the format is at byte 8, so the whole thing is one match
-  { type: "image/webp", magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WEBP")] },
-  { type: "audio/wav", magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WAVE")] },
+  {
+    type: "image/webp",
+    magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WEBP")]
+  },
+  {
+    type: "audio/wav",
+    magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WAVE")]
+  },
   { type: "image/bmp", magic: ascii("BM") },
   { type: "image/tiff", magic: [73, 73, 42, 0] },
   { type: "image/tiff", magic: [77, 77, 0, 42] },
@@ -828,7 +842,11 @@ var Router = class _Router {
     }
     const base = method === "socket" ? [] : this.middleware;
     const fns = [...base, ...rest].filter((fn) => fn != null);
-    this.handlers[method].push({ path, options, fns });
+    this.handlers[method].push({
+      path,
+      options,
+      fns
+    });
     return this.self();
   }
   socket(pathOrMid, optionsOrMid, ...middleware) {
@@ -1018,7 +1036,9 @@ function validate(strategy, expires, config2) {
   seconds(expires);
   const { onLogin, getUser, toPublicUser } = config2;
   if (onLogin && !getUser) {
-    throw new Error("`onLogin` needs a `getUser`: something has to resolve the id it returns.");
+    throw new Error(
+      "`onLogin` needs a `getUser`: something has to resolve the id it returns."
+    );
   }
   if (isSigned(strategy)) {
     if (getUser && !toPublicUser) {
@@ -1054,7 +1074,9 @@ async function credentialPayload(config2, strategy, ctx, profile) {
   if (!isSigned(strategy)) return { sub: String(id) };
   const user = await getUser(String(id), ctx);
   if (user === void 0 || user === null) {
-    throw new Error(`getUser returned nothing for the id "${id}" that onLogin just returned`);
+    throw new Error(
+      `getUser returned nothing for the id "${id}" that onLogin just returned`
+    );
   }
   return { user: await toPublicUser(user) };
 }
@@ -1450,7 +1472,12 @@ var callbackRoute = ({ name, options, provider }, redirects, finish) => async (c
   const pending = await readState(ctx, query.state);
   if (!query.code) throw errors_default.AUTH_NO_CODE();
   try {
-    const profile = await provider.exchange(ctx, options, query.code, pending);
+    const profile = await provider.exchange(
+      ctx,
+      options,
+      query.code,
+      pending
+    );
     return spendState(await finish(ctx, profile));
   } catch (error) {
     const message = failureMessage(error, name);
@@ -1477,6 +1504,7 @@ function flowEntry(config2) {
   };
   return {
     name: "flow",
+    providers: list.map((one) => one.name),
     async user(ctx) {
       const payload = await read(ctx, strategy);
       if (!payload) return;
@@ -1489,11 +1517,16 @@ function flowEntry(config2) {
       const r2 = router();
       for (const one of list) {
         r2.get(`/auth/login/${one.name}`, SPEC, loginRoute(one));
-        r2.get(callbackPath(one.name), SPEC, callbackRoute(one, redirects, finish));
+        r2.get(
+          callbackPath(one.name),
+          SPEC,
+          callbackRoute(one, redirects, finish)
+        );
       }
       r2.post("/auth/logout", SPEC, async (ctx) => {
         const payload = await read(ctx, strategy).catch(() => void 0);
-        if (onLogout && payload?.sub) await onLogout(payload.sub, ctx);
+        const id = payload?.sub ?? payload?.user?.id;
+        if (onLogout && id != null) await onLogout(String(id), ctx);
         const to = await target(redirects.logout, "/", null, ctx);
         if (!inCookie(strategy)) return status(204);
         return cookies(NAME, { value: null }).redirect(to);
@@ -1548,7 +1581,9 @@ function keysOf(issuer, refresh = false) {
         if (!algorithm) continue;
         out.set(
           jwk.kid,
-          await crypto.subtle.importKey("jwk", jwk, algorithm, false, ["verify"])
+          await crypto.subtle.importKey("jwk", jwk, algorithm, false, [
+            "verify"
+          ])
         );
       }
       return out;
@@ -1717,7 +1752,7 @@ function toEntry(auth2) {
     if ("handler" in auth2) return instanceEntry(auth2);
   }
   throw new Error(
-    "Invalid `auth`: it takes a string, a function, `{ providers }`, `{ issuer, audience }`, a library instance, or an array of those."
+    "Invalid `auth`: it takes a string, a function, `{ providers }`, `{ issuer, audience }`, or a library instance."
   );
 }
 
@@ -2005,7 +2040,10 @@ function config(options = {}) {
   settings.onError = options.onError || defaultOnError;
   settings.onResponse = options.onResponse;
   const loc = (v) => typeof v === "string" ? v : "enabled";
-  if (settings.auth) log.message("auth", `${settings.auth.name} enabled`);
+  if (settings.auth) {
+    const { name, providers: providers2 } = settings.auth;
+    log.message("auth", `${providers2?.join(",") ?? name} enabled`);
+  }
   if (settings.public) log.message("public", loc(options.public));
   if (settings.uploads) log.message("uploads", loc(options.uploads));
   if (settings.cors) {
@@ -2213,7 +2251,10 @@ var generateOpenApiPaths = async (handlers, specPath) => {
         const schema = await toJsonSchema(meta2.response);
         if (schema) {
           responses = {
-            200: { description: "OK", content: { "application/json": { schema } } }
+            200: {
+              description: "OK",
+              content: { "application/json": { schema } }
+            }
           };
         }
       }
@@ -2354,70 +2395,6 @@ async function socketUser(app, headers2, cookies2) {
   return app.settings.auth.user(ctx);
 }
 
-// src/http/cors.ts
-var localhost = /^https?:\/\/localhost(:\d+)?$/;
-function cors(config2, origin = "") {
-  origin = origin?.toLowerCase();
-  if (config2 === true) return origin || null;
-  if (config2 === "*") return "*";
-  if (!origin) return null;
-  if (localhost.test(origin)) return origin;
-  const arr = typeof config2 === "string" ? config2.split(/\s*,\s*/g) : [];
-  if (arr.includes(origin)) return origin;
-  console.warn(`CORS: Origin "${origin}" not allowed. Allowed "${config2}"`);
-  return null;
-}
-function applyCors(res, ctx) {
-  const settings = ctx.options.cors;
-  if (!settings) return;
-  const requestOrigin = ctx.headers.origin || "";
-  let origin = cors(settings.origin, requestOrigin);
-  if (!origin) return;
-  if (settings.credentials && origin === "*") {
-    if (!requestOrigin) return;
-    origin = requestOrigin.toLowerCase();
-  }
-  res.headers.set("Access-Control-Allow-Origin", origin);
-  res.headers.set("Access-Control-Allow-Methods", settings.methods);
-  res.headers.set("Access-Control-Allow-Headers", settings.headers);
-  if (settings.credentials) {
-    res.headers.set("Access-Control-Allow-Credentials", "true");
-  }
-  if (origin !== "*") res.headers.append("Vary", "Origin");
-  if (ctx.method === "options") {
-    res.headers.set("Access-Control-Max-Age", "86400");
-  }
-}
-
-// src/pipeline/parseResponse.ts
-async function parseResponse(out, ctx) {
-  if (!out && typeof out !== "string") return null;
-  if (typeof out === "function") {
-    out = await out(ctx);
-    if (!out && typeof out !== "string") return null;
-  }
-  if (typeof out === "number") {
-    return new Response(null, { status: out });
-  }
-  if (!(out instanceof Response) || out.url) {
-    out = await send(out);
-  }
-  return out;
-}
-async function finalize(out, ctx) {
-  applyCors(out, ctx);
-  applySecurity(out, ctx);
-  out = await applyCache(out, ctx);
-  const stale = toClear(ctx);
-  if (stale) {
-    out.headers.append("set-cookie", clearCookie(stale));
-  }
-  if (ctx.time?.times?.length > 1) {
-    out.headers.set("Server-Timing", ctx.time.headers());
-  }
-  return out;
-}
-
 // src/body/bodyParts.ts
 var asIterable = (s) => s;
 function getMatching(string, regex) {
@@ -2523,7 +2500,12 @@ function openFile(part) {
     }
   });
   const file2 = part.bucket.file(id);
-  part.opened = { type: type2, file: file2, controller, write: file2.write(readable, { type: type2 }) };
+  part.opened = {
+    type: type2,
+    file: file2,
+    controller,
+    write: file2.write(readable, { type: type2 })
+  };
 }
 async function feedPart(part, data) {
   if (data.length === 0) return;
@@ -2637,7 +2619,12 @@ async function parseMultipart(stream, boundary, bucket2, limits, max = INF) {
       } else if (state === "headers") {
         const i = buf.indexOf(BREAK);
         if (i === -1) break;
-        part = startPart(buf.subarray(0, i).toString("utf-8"), bucket2, limits, budget);
+        part = startPart(
+          buf.subarray(0, i).toString("utf-8"),
+          bucket2,
+          limits,
+          budget
+        );
         buf = buf.subarray(i + BREAK.length);
         state = "body";
         advanced = true;
@@ -2745,7 +2732,8 @@ async function parseBody(input, contentType, dest, max = INF, length) {
     const buf = await toBuffer(input, max);
     return buf.length ? buf : void 0;
   }
-  if (!bucket2) throw errors_default.UPLOAD_NOT_CONFIGURED({ name: "the request body" });
+  if (!bucket2)
+    throw errors_default.UPLOAD_NOT_CONFIGURED({ name: "the request body" });
   const { maxFileSize } = limits;
   if (length != null && maxFileSize != null && length > parseBytes(maxFileSize)) {
     throw errors_default.UPLOAD_TOO_LARGE({
@@ -2804,6 +2792,21 @@ async function resolveBody(ctx, mode = "parse", max = resolveMax(void 0)) {
   return parsed;
 }
 
+// src/context/isValidMethod.ts
+var methods = [
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "head",
+  "options",
+  "socket"
+];
+function isValidMethod(method) {
+  return methods.includes(method);
+}
+
 // src/util/define.ts
 function define(obj, key, cb) {
   Object.defineProperty(obj, key, {
@@ -2820,6 +2823,70 @@ function define(obj, key, cb) {
   });
 }
 
+// src/http/cors.ts
+var localhost = /^https?:\/\/localhost(:\d+)?$/;
+function cors(config2, origin = "") {
+  origin = origin?.toLowerCase();
+  if (config2 === true) return origin || null;
+  if (config2 === "*") return "*";
+  if (!origin) return null;
+  if (localhost.test(origin)) return origin;
+  const arr = typeof config2 === "string" ? config2.split(/\s*,\s*/g) : [];
+  if (arr.includes(origin)) return origin;
+  console.warn(`CORS: Origin "${origin}" not allowed. Allowed "${config2}"`);
+  return null;
+}
+function applyCors(res, ctx) {
+  const settings = ctx.options.cors;
+  if (!settings) return;
+  const requestOrigin = ctx.headers.origin || "";
+  let origin = cors(settings.origin, requestOrigin);
+  if (!origin) return;
+  if (settings.credentials && origin === "*") {
+    if (!requestOrigin) return;
+    origin = requestOrigin.toLowerCase();
+  }
+  res.headers.set("Access-Control-Allow-Origin", origin);
+  res.headers.set("Access-Control-Allow-Methods", settings.methods);
+  res.headers.set("Access-Control-Allow-Headers", settings.headers);
+  if (settings.credentials) {
+    res.headers.set("Access-Control-Allow-Credentials", "true");
+  }
+  if (origin !== "*") res.headers.append("Vary", "Origin");
+  if (ctx.method === "options") {
+    res.headers.set("Access-Control-Max-Age", "86400");
+  }
+}
+
+// src/pipeline/parseResponse.ts
+async function parseResponse(out, ctx) {
+  if (!out && typeof out !== "string") return null;
+  if (typeof out === "function") {
+    out = await out(ctx);
+    if (!out && typeof out !== "string") return null;
+  }
+  if (typeof out === "number") {
+    return new Response(null, { status: out });
+  }
+  if (!(out instanceof Response) || out.url) {
+    out = await send(out);
+  }
+  return out;
+}
+async function finalize(out, ctx) {
+  applyCors(out, ctx);
+  applySecurity(out, ctx);
+  out = await applyCache(out, ctx);
+  const stale = toClear(ctx);
+  if (stale) {
+    out.headers.append("set-cookie", clearCookie(stale));
+  }
+  if (ctx.time?.times?.length > 1) {
+    out.headers.set("Server-Timing", ctx.time.headers());
+  }
+  return out;
+}
+
 // src/errors/ValidationError.ts
 var ValidationError = class extends errors_default {
   source;
@@ -2862,21 +2929,6 @@ function replace2(target2, values) {
   Object.assign(target2, values);
 }
 
-// src/context/isValidMethod.ts
-var methods = [
-  "get",
-  "post",
-  "put",
-  "patch",
-  "delete",
-  "head",
-  "options",
-  "socket"
-];
-function isValidMethod(method) {
-  return methods.includes(method);
-}
-
 // src/pipeline/handleRequest.ts
 async function handleRequest(app, ctx) {
   let res = await getResponse(app, ctx);
@@ -2943,6 +2995,7 @@ async function getResponse(app, ctx) {
     if (ctx.platform.provider === "netlify") return;
     throw errors_default.NOT_FOUND();
   } catch (error) {
+    if (ctx.signal.aborted) return;
     return ctx.options.onError(error, ctx);
   }
 }
@@ -2984,6 +3037,11 @@ var parseHeaders_default = (raw) => {
 
 // src/context/writeResponse.ts
 async function writeResponse(out, response) {
+  if (response.destroyed || response.writableEnded) {
+    out.body?.cancel().catch(() => {
+    });
+    return;
+  }
   response.writeHead(out.status || 200, parseHeaders_default(out.headers));
   try {
     if (out.body instanceof ReadableStream) {
@@ -3240,7 +3298,14 @@ function forwarded(url, headers2, trustProxy) {
 }
 
 // src/context/create.ts
-function createContext(app, { method: rawMethod, headers: rawHeaders, url: rawUrl, signal, remoteAddress, source }) {
+function createContext(app, {
+  method: rawMethod,
+  headers: rawHeaders,
+  url: rawUrl,
+  signal,
+  remoteAddress,
+  source
+}) {
   const init = performance.now();
   const method = rawMethod?.toLowerCase() || "get";
   const headers2 = parseHeaders_default(rawHeaders);
@@ -3354,7 +3419,8 @@ var Node = async (app) => {
         response.end("Server Error");
         return;
       }
-      await writeResponse(out, response);
+      if (out) await writeResponse(out, response);
+      else if (!response.destroyed) response.destroy();
     }
   );
   await attachWebsocket(server2, app);
@@ -3384,8 +3450,27 @@ function isSerializable(body) {
   if (body instanceof URLSearchParams) return false;
   return true;
 }
+var deletes = (attrs) => attrs.some((attr) => {
+  const [rawKey, value = ""] = attr.split("=");
+  const key = rawKey.trim().toLowerCase();
+  if (key === "max-age") return Number(value) <= 0;
+  if (key === "expires")
+    return new Date(value.trim()).getTime() <= Date.now();
+  return false;
+});
 function ServerTest(app) {
   const port = app.settings.port;
+  const jar = /* @__PURE__ */ new Map();
+  const keep = (res) => {
+    for (const line of res.headers.getSetCookie?.() ?? []) {
+      const [pair, ...attrs] = line.split(";");
+      const eq = pair.indexOf("=");
+      if (eq === -1) continue;
+      const name = pair.slice(0, eq).trim();
+      if (deletes(attrs)) jar.delete(name);
+      else jar.set(name, pair.slice(eq + 1).trim());
+    }
+  };
   const fetch2 = async (method, path, options = {}) => {
     const headers2 = new Headers(options.headers);
     let body = options.body;
@@ -3393,13 +3478,17 @@ function ServerTest(app) {
       headers2.set("content-type", "application/json");
       body = JSON.stringify(body);
     }
+    if (jar.size && !headers2.has("cookie")) {
+      const sent = [...jar].map(([name, value]) => `${name}=${value}`);
+      headers2.set("cookie", sent.join("; "));
+    }
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path) && !/^https?:\/\//i.test(path)) {
       throw new Error(
         `Only http(s) URLs can be tested, received "${path}". Pass a path, or the full URL of the host the request should hit.`
       );
     }
     const url = /^https?:\/\//i.test(path) ? path : `http://localhost:${port}${path}`;
-    return await app.fetch(
+    const res = await app.fetch(
       new Request(url, {
         ...options,
         method,
@@ -3407,6 +3496,8 @@ function ServerTest(app) {
         body
       })
     );
+    if (res) keep(res);
+    return res;
   };
   return {
     get: (path, options) => fetch2("get", path, options),
@@ -3415,7 +3506,12 @@ function ServerTest(app) {
     put: (path, body, options) => fetch2("put", path, { body, ...options }),
     patch: (path, body, options) => fetch2("patch", path, { body, ...options }),
     delete: (path, options) => fetch2("delete", path, options),
-    options: (path, options) => fetch2("options", path, options)
+    options: (path, options) => fetch2("options", path, options),
+    // The cookies the app has set so far, and a fresh session on demand
+    get cookies() {
+      return Object.fromEntries(jar);
+    },
+    clear: () => jar.clear()
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.49.0",
+  "version": "0.49.1",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",
@@ -14,11 +14,11 @@
   ],
   "scripts": {
     "build": "bunx tsup src/index.ts --format esm --dts --out-dir . --target node24 --external zod --external @valibot/to-json-schema",
-    "prepare": "mkdir -p node_modules/@server && ln -sfn ../.. node_modules/@server/next",
+    "postinstall": "mkdir -p node_modules/@server && ln -sfn ../.. node_modules/@server/next",
     "start": "bun test --watch",
-    "lint": "npx tsc --noEmit && npx @biomejs/biome lint ./src --error-on-warnings",
-    "test": "npm run test:bun && npm run lint",
-    "test:bun": "bun test src demo"
+    "lint": "npm run prettier && npx tsc --noEmit && npx @biomejs/biome lint ./src --error-on-warnings",
+    "prettier": "prettier --write ./src",
+    "test": "bun test src demo"
   },
   "main": "index.js",
   "type": "module",
@@ -75,6 +75,7 @@
     "arktype": "^2.2.3",
     "bun": "^1.3.13",
     "check-dts": "^0.8.2",
+    "prettier": "^3.9.6",
     "tsup": "^8.5.1",
     "typescript": "^6.0.2",
     "valibot": "^1.4.2",

package/readme.md

@@ -7,7 +7,7 @@ npm install @server/next
 ```
 
 ```js
-import server from '@server/next';
+import server from "@server/next";
 
 export default server({ uploads: './uploads' })
   .get('/', () => 'Hello world')
@@ -15,24 +15,26 @@ export default server({ uploads: './uploads' })
   .post('/avatar', (ctx) => ctx.body.avatar.path);
 ```
 
-Key-value stores and file storage come included, so logins work out of the box and `uploads` takes a folder path. For Redis, S3 and the rest, pass the client straight in:
+File storage comes included, so `uploads` takes a folder path or any bucket. Auth stores nothing of its own: two callbacks put the user wherever you already keep data.
 
 ```js
-import server, { bucket, kv } from '@server/next';
-import { createClient } from 'redis';
+import server, { bucket } from "@server/next";
+import { createClient } from "redis";
 
-const redis = kv(createClient({ url }));
-const uploads = bucket.S3('my-bucket', { id, key });
+const redis = await createClient({ url }).connect();
+const uploads = bucket.S3('my-bucket', { id, secret });
 
 export default server({
   uploads,
   auth: {
-    strategy: 'cookie',
     providers: ['github'],
-    users: redis.prefix('user:'),
-    sessions: redis.prefix('session:'),
+    onLogin: async (profile) => {
+      await redis.set(`user:${profile.id}`, JSON.stringify(profile));
+      return profile.id;
+    },
+    getUser: async (id) => JSON.parse(await redis.get(`user:${id}`)),
   },
 });
 ```
 
-See the [full documentation](https://serverjs.io/documentation).
+See the [full documentation](https://server-js.com/documentation).

package/src/jsx/jsx-runtime.js

@@ -47,18 +47,20 @@ const minifyCss = (str) => {
   // squeezed, then put back. Comments go first and unconditionally, so one
   // written inside a string is stripped along with the rest.
   const quoted = [];
-  return str
-    .replace(/\/\*[\s\S]*?\*\//g, "")
-    .replace(
-      /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g,
-      (match) => `\0${quoted.push(match) - 1}\0`,
-    )
-    .replace(/\s+/g, " ")
-    // `+` is left out on purpose for `calc(100% + 10px)`
-    .replace(/\s*([{}:;,>~])\s*/g, "$1")
-    .replace(/;}/g, "}")
-    .replace(/\0(\d+)\0/g, (_, i) => quoted[i])
-    .trim();
+  return (
+    str
+      .replace(/\/\*[\s\S]*?\*\//g, "")
+      .replace(
+        /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g,
+        (match) => `\0${quoted.push(match) - 1}\0`,
+      )
+      .replace(/\s+/g, " ")
+      // `+` is left out on purpose for `calc(100% + 10px)`
+      .replace(/\s*([{}:;,>~])\s*/g, "$1")
+      .replace(/;}/g, "}")
+      .replace(/\0(\d+)\0/g, (_, i) => quoted[i])
+      .trim()
+  );
 };
 
 // React element detection (safe for custom objects too)