@shivaedev/server 0.0.0-stage → 0.1.0

package/src/runtime/makePlatform.ts

@@ -0,0 +1,75 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { Layer } from "effect";
+import { Cause, Config, Context, Effect, Exit, ManagedRuntime } from "effect";
+import type { PlatformRuntime, PlatformRuntimeOptions } from "./types.ts";
+
+const RuntimeCacheKey = Symbol.for("@shivaedev/server/runtime-cache");
+const sharedCache: unknown = Reflect.get(globalThis, RuntimeCacheKey);
+const runtimeCache: Map<string | symbol, unknown> = sharedCache instanceof Map ? sharedCache : new Map<string | symbol, unknown>();
+Reflect.set(globalThis, RuntimeCacheKey, runtimeCache);
+// One development cache key belongs to one makePlatformRuntime call site, so its entry has that site's services and build error.
+function cachedEntry<TServices, TBuildError>(runtime: unknown): PlatformRuntime<TServices, TBuildError>;
+function cachedEntry(runtime: unknown): unknown {
+	return runtime;
+}
+function make<TServices, TBuildError>(layer: Layer.Layer<TServices, TBuildError>): PlatformRuntime<TServices, TBuildError> {
+	const managed = ManagedRuntime.make(layer);
+	const services = new AsyncLocalStorage<Context.Context<never>>();
+	function currentServices() {
+		return services.getStore();
+	}
+	function withAmbient<A, E, TRequirements extends TServices>(
+		effect: Effect.Effect<A, E, TRequirements>,
+	): Effect.Effect<A, E | TBuildError, TRequirements> {
+		const ambient = currentServices();
+		return ambient === undefined
+			? effect
+			: Effect.flatMap(managed.contextEffect, (base) => Effect.provideContext(effect, Context.merge(base, ambient)));
+	}
+	const runPromiseExit: PlatformRuntime<TServices, TBuildError>["runPromiseExit"] = (effect, options) =>
+		managed.runPromiseExit(withAmbient(effect), options);
+	const runtime: PlatformRuntime<TServices, TBuildError> = {
+		contextEffect: Effect.map(managed.contextEffect, (base) => {
+			const ambient = currentServices();
+			return ambient === undefined ? base : Context.merge(base, ambient);
+		}),
+		currentServices,
+		dispose: () => managed.dispose(),
+		runPromise: async (effect, options) => {
+			const exit = await runPromiseExit(effect, options);
+			if (Exit.isSuccess(exit)) {
+				return exit.value;
+			}
+			throw Cause.squash(exit.cause);
+		},
+		runPromiseExit,
+		runWithServices: (context, evaluate) => services.run(context, evaluate),
+	};
+	return runtime;
+}
+const production = Effect.map(Effect.orDie(Config.String("NODE_ENV").pipe(Config.withDefault(""))), (environment) => environment === "production");
+export function makePlatformRuntime<TServices, TBuildError>(
+	layer: Layer.Layer<TServices, TBuildError>,
+	options: PlatformRuntimeOptions = {},
+): PlatformRuntime<TServices, TBuildError> {
+	const key = Effect.runSync(production) ? undefined : options.developmentCacheKey;
+	if (key === undefined) {
+		return make(layer);
+	}
+	const cached = runtimeCache.get(key);
+	if (cached !== undefined) {
+		return cachedEntry<TServices, TBuildError>(cached);
+	}
+	const runtime = make(layer);
+	const cachedRuntime: PlatformRuntime<TServices, TBuildError> = {
+		...runtime,
+		dispose: async () => {
+			if (runtimeCache.get(key) === cachedRuntime) {
+				runtimeCache.delete(key);
+			}
+			await runtime.dispose();
+		},
+	};
+	runtimeCache.set(key, cachedRuntime);
+	return cachedRuntime;
+}

package/src/runtime/types.ts

@@ -0,0 +1,24 @@
+import type { Context, Effect, Exit } from "effect";
+export interface PlatformRuntimeOptions {
+	readonly developmentCacheKey?: string | symbol;
+}
+export interface PlatformRuntime<TServices, TBuildError> {
+	readonly contextEffect: Effect.Effect<Context.Context<TServices>, TBuildError>;
+	readonly currentServices: () => Context.Context<never> | undefined;
+	readonly dispose: () => Promise<void>;
+	readonly runPromise: <A, E, TRequirements extends TServices>(
+		effect: Effect.Effect<A, E, TRequirements>,
+		options?: {
+			readonly signal?: AbortSignal;
+		},
+	) => Promise<A>;
+	readonly runPromiseExit: <A, E, TRequirements extends TServices>(
+		effect: Effect.Effect<A, E, TRequirements>,
+		options?: {
+			readonly signal?: AbortSignal;
+		},
+	) => Promise<Exit.Exit<A, E | TBuildError>>;
+	readonly runWithServices: <TProvided, TValue>(services: Context.Context<TProvided>, evaluate: () => TValue) => TValue;
+}
+export type PlatformRuntimeServices<TRuntime> = TRuntime extends PlatformRuntime<infer TServices, infer _TBuildError> ? TServices : never;
+export type PlatformRuntimeBuildError<TRuntime> = TRuntime extends PlatformRuntime<infer _TServices, infer TBuildError> ? TBuildError : never;

package/src/safeOtlpSerialization.ts

@@ -0,0 +1,73 @@
+import { Effect, Layer } from "effect";
+import type { OtlpResource, OtlpTracer } from "effect/observability";
+import { OtlpSerialization } from "effect/observability";
+import { isSensitiveKey, REDACTED, redactText, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { RedactionPolicy } from "#RedactionPolicy.ts";
+import { redactOtlpUrl } from "#redactOtlpUrl.ts";
+
+function otlpSensitive(sensitive: SensitiveKey): SensitiveKey {
+	return (key) => sensitive(key) || ["db.user", "db.user.name", "db.connection_string"].includes(key.toLowerCase());
+}
+export function redactOtlpText(value: string, key = "", sensitive: SensitiveKey = isSensitiveKey) {
+	return redactText(redactOtlpUrl(value, key), otlpSensitive(sensitive));
+}
+function attributeValue(value: OtlpResource.AnyValue, key: string, sensitive: SensitiveKey): OtlpResource.AnyValue {
+	return {
+		...value,
+		...(typeof value.stringValue === "string" ? { stringValue: redactOtlpText(value.stringValue, key, sensitive) } : {}),
+		...(value.arrayValue ? { arrayValue: { values: value.arrayValue.values.map((item) => attributeValue(item, key, sensitive)) } } : {}),
+		...(value.kvlistValue ? { kvlistValue: { values: attributes(value.kvlistValue.values, sensitive) } } : {}),
+	};
+}
+function attributes(values: OtlpResource.KeyValue[], sensitive: SensitiveKey): OtlpResource.KeyValue[] {
+	return values.map(({ key, value }) => ({
+		key,
+		value: sensitive(key) ? { stringValue: REDACTED } : attributeValue(value, key, sensitive),
+	}));
+}
+
+function spanName(span: { readonly name: string; readonly kind: number; readonly attributes: OtlpResource.KeyValue[] }) {
+	if (span.kind === 2) {
+		const method = span.attributes.find(({ key }) => key === "http.request.method")?.value.stringValue;
+		const route = span.attributes.find(({ key }) => key === "http.route")?.value.stringValue;
+		if (typeof method === "string") {
+			return typeof route === "string" ? `${method} ${route}` : method;
+		}
+	}
+	return span.name;
+}
+
+function redactTraces(data: OtlpTracer.TraceData, sensitive: SensitiveKey): OtlpTracer.TraceData {
+	function text(value: string) {
+		return redactOtlpText(value, "", sensitive);
+	}
+	return {
+		...data,
+		resourceSpans: data.resourceSpans.map((resource) => ({
+			...resource,
+			resource: { ...resource.resource, attributes: attributes(resource.resource.attributes, sensitive) },
+			scopeSpans: resource.scopeSpans.map((scope) => ({
+				...scope,
+				spans: scope.spans.map((span) => ({
+					...span,
+					attributes: attributes(span.attributes, sensitive),
+					events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes, sensitive), name: text(event.name) })),
+					links: span.links.map((link) => ({ ...link, attributes: attributes(link.attributes, sensitive) })),
+					name: text(spanName(span)),
+					status: { ...span.status, ...(span.status.message === undefined ? {} : { message: text(span.status.message) }) },
+				})),
+			})),
+		})),
+	};
+}
+export const safeOtlpSerialization = Layer.effect(
+	OtlpSerialization.OtlpSerialization,
+	Effect.gen(function* () {
+		const serialization = yield* OtlpSerialization.OtlpSerialization;
+		const sensitive = otlpSensitive(yield* RedactionPolicy);
+		return OtlpSerialization.OtlpSerialization.of({
+			...serialization,
+			traces: (data) => serialization.traces(redactTraces(data, sensitive)),
+		});
+	}),
+);

package/src/schemaSensitiveKeys.ts

@@ -0,0 +1,148 @@
+import { Predicate, type Schema, type SchemaAST } from "effect";
+import { Rpc, type RpcGroup } from "effect/rpc";
+import { isSensitiveKey } from "@shivaedev/errors/sensitive.ts";
+
+function children(ast: SchemaAST.AST): readonly SchemaAST.AST[] {
+	switch (ast._tag) {
+		case "Objects":
+			return [...ast.propertySignatures.map((property) => property.type), ...ast.indexSignatures.flatMap((index) => [index.parameter, index.type])];
+		case "Arrays":
+			return [...ast.elements, ...ast.rest];
+		case "Union":
+			return ast.types;
+		case "Declaration":
+			return ast.typeParameters;
+		case "Suspend":
+			return [ast.thunk()];
+		default:
+			return [];
+	}
+}
+function sensitiveCheck(check: SchemaAST.Check<never>): boolean {
+	return check.annotations?.sensitive === true || (check._tag === "FilterGroup" && check.checks.some(sensitiveCheck));
+}
+function marked(ast: SchemaAST.AST, seen = new Set<SchemaAST.AST>()): boolean {
+	if (seen.has(ast)) {
+		return false;
+	}
+	seen.add(ast);
+	if (
+		ast.annotations?.sensitive === true
+		|| ast.context?.annotations?.sensitive === true
+		|| ast.checks?.some(sensitiveCheck)
+		|| (Predicate.hasProperty(ast.annotations?.representation, "id") && ast.annotations.representation.id === "effect/schema/Redacted")
+	) {
+		return true;
+	}
+	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+	return (ast.encoding?.some((link) => marked(link.to, seen)) ?? false) || nested.some((type) => marked(type, seen));
+}
+function containsSensitive(ast: SchemaAST.AST, keys: ReadonlySet<string>): boolean {
+	return (
+		marked(ast)
+		|| propertiesOf(ast).some((property) => typeof property.name === "string" && (keys.has(property.name) || isSensitiveKey(property.name)))
+	);
+}
+function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>) {
+	let source = ast;
+	let sensitive = false;
+	for (const link of ast.encoding ?? []) {
+		sensitive ||= containsSensitive(source, keys);
+		if (sensitive) {
+			for (const property of propertiesOf(link.to)) {
+				if (typeof property.name === "string") {
+					keys.add(property.name);
+				}
+			}
+		}
+		source = link.to;
+	}
+}
+function fixedOutput(ast: SchemaAST.AST): boolean {
+	if (ast._tag === "Union") {
+		return ast.types.every(fixedOutput);
+	}
+	return ast._tag === "Objects" && ast.indexSignatures.length === 0;
+}
+function maskedValue(ast: SchemaAST.AST, keys: ReadonlySet<string>, seen = new Set<SchemaAST.AST>()): boolean {
+	if (seen.has(ast)) {
+		return false;
+	}
+	seen.add(ast);
+	if (marked(ast)) {
+		return true;
+	}
+	let source = ast;
+	let sensitive = false;
+	for (const link of ast.encoding ?? []) {
+		sensitive ||= containsSensitive(source, keys);
+		if (sensitive && !fixedOutput(link.to)) {
+			return true;
+		}
+		source = link.to;
+	}
+	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+	return nested.some((type) => maskedValue(type, keys, seen));
+}
+function collect(ast: SchemaAST.AST, nodes: Set<SchemaAST.AST>, encodings = true) {
+	if (nodes.has(ast)) {
+		return;
+	}
+	nodes.add(ast);
+	for (const child of [...children(ast), ...(encodings ? (ast.encoding?.map((link) => link.to) ?? []) : [])]) {
+		collect(child, nodes, encodings);
+	}
+}
+function propertiesOf(ast: SchemaAST.AST) {
+	const nodes = new Set<SchemaAST.AST>();
+	collect(ast, nodes, false);
+	return [...nodes].flatMap((node) => (node._tag === "Objects" ? node.propertySignatures : []));
+}
+function collectFieldKeys(properties: SchemaAST.Objects["propertySignatures"], keys: Set<string>, sensitive: (ast: SchemaAST.AST) => boolean) {
+	for (const property of properties) {
+		if (typeof property.name === "string" && sensitive(property.type)) {
+			keys.add(property.name);
+		}
+	}
+}
+export function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, extra: readonly string[] = []) {
+	const keys = new Set(extra);
+	const nodes = new Set<SchemaAST.AST>();
+	const requests: Rpc.AnyWithProps[] = [];
+	for (const rpc of group.requests.values()) {
+		if (Rpc.isRpc(rpc)) {
+			requests.push(rpc);
+		}
+	}
+	for (const rpc of requests) {
+		const schemas: Schema.Top[] = [
+			rpc.payloadSchema,
+			rpc.successSchema,
+			rpc.errorSchema,
+			rpc.defectSchema,
+			...[...rpc.middlewares].map((m) => m.error),
+		];
+		for (const schema of schemas) {
+			collect(schema.ast, nodes);
+		}
+	}
+	const properties = [...nodes].flatMap((ast) => (ast._tag === "Objects" ? ast.propertySignatures : []));
+	collectFieldKeys(properties, keys, marked);
+	let previousSize: number;
+	do {
+		previousSize = keys.size;
+		collectFieldKeys(properties, keys, (ast) => maskedValue(ast, keys));
+		for (const ast of nodes) {
+			collectEncodedKeys(ast, keys);
+		}
+	} while (keys.size !== previousSize);
+	const roots = requests.map((rpc) => ({
+		die: maskedValue(rpc.defectSchema.ast, keys),
+		fail: [rpc.errorSchema, ...[...rpc.middlewares].map((m) => m.error)].some((schema) => maskedValue(schema.ast, keys)),
+		tag: rpc._tag,
+	}));
+	return Object.assign((key: string) => keys.has(key) || isSensitiveKey(key), {
+		maskFailure: (tag: string | undefined, reason: "Fail" | "Die") =>
+			roots.some((root) => (tag === undefined || tag === root.tag) && (reason === "Fail" ? root.fail : root.die)),
+	});
+}

package/src/setupDatabases.ts

@@ -0,0 +1,12 @@
+import { Config, Effect } from "effect";
+import { localPostgres } from "@shivaedev/local-postgres/server/localPostgres.ts";
+
+export const setupDatabases = Effect.fn("Platform.setupDatabases")(function* () {
+	const config = yield* Config.all({
+		"DATABASE_URL": Config.String("DATABASE_URL"),
+		"DOCKER_CONTEXT": Config.String("DOCKER_CONTEXT").pipe(Config.withDefault("")),
+		"DOCKER_HOST": Config.String("DOCKER_HOST").pipe(Config.withDefault("")),
+		"TEST_DATABASE_URL": Config.String("TEST_DATABASE_URL"),
+	});
+	yield* Effect.sync(() => localPostgres(config).prepareDatabases([config.DATABASE_URL, config.TEST_DATABASE_URL]));
+});

package/src/tracedGroup.ts

@@ -0,0 +1,14 @@
+import type { Rpc, RpcGroup } from "effect/rpc";
+import { RequestTracing } from "@shivaedev/identity/middleware.ts";
+
+export function tracedGroup<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>) {
+	const traced = group.middleware(RequestTracing);
+	for (const rpc of traced.requests.values()) {
+		const middlewares = new Set(rpc.middlewares);
+		middlewares.delete(RequestTracing);
+		middlewares.add(RequestTracing);
+		// Native middleware() clones each RPC but cannot move an existing middleware to the outermost position.
+		Object.assign(rpc, { middlewares });
+	}
+	return traced;
+}