@spfn/core 0.2.0-beta.9 → 0.3.0-beta.2

package/dist/authz/index.js

@@ -0,0 +1,810 @@
+import { format } from 'util';
+
+// src/errors/error-registry.ts
+var ErrorRegistry = class _ErrorRegistry {
+  errors = /* @__PURE__ */ new Map();
+  constructor(initialErrors) {
+    if (initialErrors) {
+      for (const input of initialErrors) {
+        if (input instanceof _ErrorRegistry) {
+          this.concat(input);
+        } else if (Array.isArray(input)) {
+          this.append(input);
+        } else {
+          this.append(input);
+        }
+      }
+    }
+  }
+  /**
+   * Append error class(es) to the registry
+   *
+   * @param input - Error constructor or array of constructors
+   * @returns This registry for chaining
+   */
+  append(input) {
+    if (Array.isArray(input)) {
+      for (const ErrorClass of input) {
+        this.errors.set(ErrorClass.name, ErrorClass);
+      }
+    } else {
+      this.errors.set(input.name, input);
+    }
+    return this;
+  }
+  /**
+   * Concatenate another ErrorRegistry into this one
+   *
+   * @param registry - Another ErrorRegistry to merge
+   * @returns This registry for chaining
+   */
+  concat(registry) {
+    for (const [name, ErrorClass] of registry.errors) {
+      this.errors.set(name, ErrorClass);
+    }
+    return this;
+  }
+  /**
+   * Check if error type is registered
+   *
+   * @param name - Error class name
+   */
+  has(name) {
+    return this.errors.has(name);
+  }
+  /**
+   * Deserialize error from JSON data
+   *
+   * @param data - Serialized error data with __type field
+   * @returns Deserialized error instance
+   * @throws Error if error type is not registered
+   */
+  deserialize(data) {
+    const ErrorClass = this.errors.get(data.__type);
+    if (!ErrorClass) {
+      throw new Error(`Unknown error type: ${data.__type}`);
+    }
+    const { __type: _type, error: _envelope, ...fields } = data;
+    return new ErrorClass(fields);
+  }
+  /**
+   * Try to deserialize error, return null if type unknown
+   *
+   * @param data - Serialized error data
+   * @returns Deserialized error or null
+   */
+  tryDeserialize(data) {
+    if (!data.__type || !this.has(data.__type)) {
+      return null;
+    }
+    try {
+      return this.deserialize(data);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Get all registered error types
+   */
+  getRegisteredTypes() {
+    return Array.from(this.errors.keys());
+  }
+};
+
+// src/logger/types.ts
+var LOG_LEVEL_PRIORITY = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3,
+  fatal: 4
+};
+
+// src/logger/formatters.ts
+var SENSITIVE_KEYS = [
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "token",
+  "apikey",
+  "api_key",
+  "accesstoken",
+  "access_token",
+  "refreshtoken",
+  "refresh_token",
+  "authorization",
+  "auth",
+  "cookie",
+  "session",
+  "sessionid",
+  "session_id",
+  "privatekey",
+  "private_key",
+  "creditcard",
+  "credit_card",
+  "cardnumber",
+  "card_number",
+  "cvv",
+  "ssn",
+  "pin"
+];
+var MASKED_VALUE = "***MASKED***";
+function isSensitiveKey(key) {
+  const lowerKey = key.toLowerCase();
+  return SENSITIVE_KEYS.some((sensitive) => lowerKey.includes(sensitive));
+}
+function maskSensitiveData(data, seen = /* @__PURE__ */ new WeakSet()) {
+  if (data === null || data === void 0) {
+    return data;
+  }
+  if (typeof data !== "object") {
+    return data;
+  }
+  if (seen.has(data)) {
+    return "[Circular]";
+  }
+  seen.add(data);
+  if (Array.isArray(data)) {
+    return data.map((item) => maskSensitiveData(item, seen));
+  }
+  const masked = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (isSensitiveKey(key)) {
+      masked[key] = MASKED_VALUE;
+    } else if (typeof value === "object" && value !== null) {
+      masked[key] = maskSensitiveData(value, seen);
+    } else {
+      masked[key] = value;
+    }
+  }
+  return masked;
+}
+var COLORS = {
+  reset: "\x1B[0m",
+  bright: "\x1B[1m",
+  dim: "\x1B[2m",
+  // 로그 레벨 컬러
+  debug: "\x1B[36m",
+  // cyan
+  info: "\x1B[32m",
+  // green
+  warn: "\x1B[33m",
+  // yellow
+  error: "\x1B[31m",
+  // red
+  fatal: "\x1B[35m",
+  // magenta
+  // 추가 컬러
+  gray: "\x1B[90m"
+};
+function formatTimestampHuman(date) {
+  const year = date.getFullYear();
+  const month = String(date.getMonth() + 1).padStart(2, "0");
+  const day = String(date.getDate()).padStart(2, "0");
+  const hours = String(date.getHours()).padStart(2, "0");
+  const minutes = String(date.getMinutes()).padStart(2, "0");
+  const seconds = String(date.getSeconds()).padStart(2, "0");
+  const ms = String(date.getMilliseconds()).padStart(3, "0");
+  return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}.${ms}`;
+}
+function formatError(error) {
+  const lines = [];
+  lines.push(`${error.name}: ${error.message}`);
+  if (error.stack) {
+    const stackLines = error.stack.split("\n").slice(1);
+    lines.push(...stackLines);
+  }
+  if (error.cause instanceof Error) {
+    lines.push(`Caused by: ${formatError(error.cause)}`);
+  } else if (error.cause !== void 0) {
+    lines.push(`Caused by: ${String(error.cause)}`);
+  }
+  return lines.join("\n");
+}
+function formatConsole(metadata, colorize = true) {
+  const parts = [];
+  const timestamp = formatTimestampHuman(metadata.timestamp);
+  if (colorize) {
+    parts.push(`${COLORS.gray}[${timestamp}]${COLORS.reset}`);
+  } else {
+    parts.push(`[${timestamp}]`);
+  }
+  const pid = process.pid;
+  if (colorize) {
+    parts.push(`${COLORS.dim}[pid=${pid}]${COLORS.reset}`);
+  } else {
+    parts.push(`[pid=${pid}]`);
+  }
+  if (metadata.module) {
+    if (colorize) {
+      parts.push(`${COLORS.dim}[module=${metadata.module}]${COLORS.reset}`);
+    } else {
+      parts.push(`[module=${metadata.module}]`);
+    }
+  }
+  if (metadata.context && Object.keys(metadata.context).length > 0) {
+    Object.entries(metadata.context).forEach(([key, value]) => {
+      let valueStr;
+      if (typeof value === "string") {
+        valueStr = value;
+      } else if (typeof value === "object" && value !== null) {
+        try {
+          valueStr = JSON.stringify(value);
+        } catch (error) {
+          valueStr = "[circular]";
+        }
+      } else {
+        valueStr = String(value);
+      }
+      if (colorize) {
+        parts.push(`${COLORS.dim}[${key}=${valueStr}]${COLORS.reset}`);
+      } else {
+        parts.push(`[${key}=${valueStr}]`);
+      }
+    });
+  }
+  const levelStr = metadata.level.toUpperCase();
+  if (colorize) {
+    const color = COLORS[metadata.level];
+    parts.push(`${color}(${levelStr})${COLORS.reset}:`);
+  } else {
+    parts.push(`(${levelStr}):`);
+  }
+  if (colorize) {
+    parts.push(`${COLORS.bright}${metadata.message}${COLORS.reset}`);
+  } else {
+    parts.push(metadata.message);
+  }
+  let output = parts.join(" ");
+  if (metadata.error) {
+    output += "\n" + formatError(metadata.error);
+  }
+  return output;
+}
+
+// src/logger/logger.ts
+var FORMAT_PATTERN = /%[sdifjoOc%]/;
+var Logger = class _Logger {
+  config;
+  module;
+  constructor(config) {
+    this.config = config;
+    this.module = config.module;
+  }
+  /**
+   * Convert unknown error to Error object
+   */
+  toError(error) {
+    if (error instanceof Error) return error;
+    if (typeof error === "string") return new Error(error);
+    if (typeof error === "object" && error !== null) {
+      return new Error(JSON.stringify(error));
+    }
+    return new Error(String(error));
+  }
+  /**
+   * Check if value is a context object (not an error)
+   */
+  isContext(value) {
+    if (typeof value !== "object" || value === null) return false;
+    if (value instanceof Error) return false;
+    const hasStack = "stack" in value && typeof value.stack === "string";
+    if (hasStack) {
+      return false;
+    }
+    return true;
+  }
+  /**
+   * Get current log level
+   */
+  get level() {
+    return this.config.level;
+  }
+  /**
+   * Create child logger (per module)
+   */
+  child(module) {
+    return new _Logger({
+      ...this.config,
+      module
+    });
+  }
+  /**
+   * Common log method with error/context detection
+   */
+  logWithLevel(level, message, errorOrContext, context) {
+    if (errorOrContext !== void 0 && FORMAT_PATTERN.test(message)) {
+      this.log(level, format(message, errorOrContext), void 0, context);
+      return;
+    }
+    if (errorOrContext instanceof Error) {
+      this.log(level, message, errorOrContext, context);
+    } else if (errorOrContext !== void 0 && typeof errorOrContext === "object" && !this.isContext(errorOrContext)) {
+      this.log(level, message, this.toError(errorOrContext), context);
+    } else if (typeof errorOrContext === "string" || typeof errorOrContext === "number" || typeof errorOrContext === "boolean") {
+      this.log(level, message, this.toError(errorOrContext), context);
+    } else {
+      this.log(level, message, void 0, errorOrContext);
+    }
+  }
+  debug(message, errorOrContext, context) {
+    this.logWithLevel("debug", message, errorOrContext, context);
+  }
+  info(message, errorOrContext, context) {
+    this.logWithLevel("info", message, errorOrContext, context);
+  }
+  warn(message, errorOrContext, context) {
+    this.logWithLevel("warn", message, errorOrContext, context);
+  }
+  error(message, errorOrContext, context) {
+    this.logWithLevel("error", message, errorOrContext, context);
+  }
+  fatal(message, errorOrContext, context) {
+    this.logWithLevel("fatal", message, errorOrContext, context);
+  }
+  /**
+   * Log processing (internal)
+   */
+  log(level, message, error, context) {
+    if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[this.config.level]) {
+      return;
+    }
+    const metadata = {
+      timestamp: /* @__PURE__ */ new Date(),
+      level,
+      message,
+      module: this.module,
+      error,
+      // Mask sensitive information in context to prevent credential leaks
+      context: context ? maskSensitiveData(context) : void 0
+    };
+    this.processTransports(metadata);
+  }
+  /**
+   * Process Transports
+   */
+  processTransports(metadata) {
+    const promises = this.config.transports.filter((transport) => transport.enabled).map((transport) => this.safeTransportLog(transport, metadata));
+    Promise.all(promises).catch((error) => {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`[Logger] Transport error: ${errorMessage}
+`);
+    });
+  }
+  /**
+   * Transport log (error-safe)
+   */
+  async safeTransportLog(transport, metadata) {
+    try {
+      await transport.log(metadata);
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`[Logger] Transport "${transport.name}" failed: ${errorMessage}
+`);
+    }
+  }
+  /**
+   * Close all Transports
+   */
+  async close() {
+    const closePromises = this.config.transports.filter((transport) => transport.close).map((transport) => transport.close());
+    await Promise.all(closePromises);
+  }
+};
+
+// src/logger/transports/console.ts
+var ConsoleTransport = class {
+  name = "console";
+  level;
+  enabled;
+  colorize;
+  constructor(config) {
+    this.level = config.level;
+    this.enabled = config.enabled;
+    this.colorize = config.colorize ?? true;
+  }
+  async log(metadata) {
+    if (!this.enabled) {
+      return;
+    }
+    if (LOG_LEVEL_PRIORITY[metadata.level] < LOG_LEVEL_PRIORITY[this.level]) {
+      return;
+    }
+    const message = formatConsole(metadata, this.colorize);
+    if (metadata.level === "warn" || metadata.level === "error" || metadata.level === "fatal") {
+      console.error(message);
+    } else {
+      console.log(message);
+    }
+  }
+};
+
+// src/logger/config.ts
+function getConsoleConfig() {
+  const isProduction = process.env.NODE_ENV === "production";
+  return {
+    level: "debug",
+    enabled: true,
+    colorize: !isProduction
+    // Dev: colored output, Production: plain text
+  };
+}
+function validateEnvironment() {
+  const nodeEnv = process.env.NODE_ENV;
+  if (!nodeEnv) {
+    process.stderr.write(
+      "[Logger] Warning: NODE_ENV is not set. Defaulting to test environment.\n"
+    );
+  }
+}
+function validateConfig() {
+  validateEnvironment();
+}
+
+// src/logger/factory.ts
+function initializeTransports() {
+  const transports = [];
+  const consoleConfig = getConsoleConfig();
+  transports.push(new ConsoleTransport(consoleConfig));
+  return transports;
+}
+function getLogLevel() {
+  const envLevel = process.env.SPFN_LOG_LEVEL || process.env.NEXT_PUBLIC_SPFN_LOG_LEVEL || "info";
+  if (envLevel in LOG_LEVEL_PRIORITY) {
+    return envLevel;
+  }
+  process.stderr.write(
+    `[Logger] Invalid log level "${envLevel}", defaulting to "info"
+`
+  );
+  return "info";
+}
+function initializeLogger() {
+  validateConfig();
+  return new Logger({
+    level: getLogLevel(),
+    transports: initializeTransports()
+  });
+}
+var logger = initializeLogger();
+
+// src/errors/serializable-error.ts
+var RESERVED_RESPONSE_KEYS = /* @__PURE__ */ new Set(["__type", "message", "error"]);
+var AUTHORING_ENVIRONMENTS = /* @__PURE__ */ new Set(["local", "development", "test"]);
+function refuseReservedKey(className, key) {
+  const detail = `${className} declares the reserved field "${key}". Reserved response keys: ${[...RESERVED_RESPONSE_KEYS].join(", ")}. Rename the field.`;
+  if (AUTHORING_ENVIRONMENTS.has(process.env.NODE_ENV ?? "local")) {
+    throw new Error(detail);
+  }
+  logger.error(`[SerializableError] ${detail} The field is omitted from the response.`);
+}
+var SerializableError = class extends Error {
+  /**
+   * Serialize error to JSON-compatible object
+   *
+   * Automatically includes:
+   * - __type: Constructor name for deserialization
+   * - message: Error message
+   * - All public instance properties (except name, stack)
+   */
+  toJSON() {
+    const json = {
+      __type: this.constructor.name,
+      message: this.message
+    };
+    for (const key of Object.keys(this)) {
+      if (key === "name" || key === "stack" || key === "statusCode") {
+        continue;
+      }
+      if (RESERVED_RESPONSE_KEYS.has(key)) {
+        refuseReservedKey(this.constructor.name, key);
+        continue;
+      }
+      json[key] = this[key];
+    }
+    return json;
+  }
+};
+
+// src/errors/http-errors.ts
+var HttpError = class extends SerializableError {
+  statusCode;
+  details;
+  constructor(data) {
+    super(data.message);
+    this.name = "HttpError";
+    this.statusCode = data.statusCode;
+    if (data.details) {
+      this.details = data.details;
+    }
+    Error.captureStackTrace(this, this.constructor);
+  }
+};
+var BadRequestError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Bad request",
+      statusCode: 400,
+      details: data.details
+    });
+    this.name = "BadRequestError";
+  }
+};
+var ValidationError = class extends HttpError {
+  fields;
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: 400,
+      details: data.details
+    });
+    this.name = "ValidationError";
+    if (data.fields) {
+      this.fields = data.fields;
+    }
+  }
+};
+var UnauthorizedError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Authentication required",
+      statusCode: 401,
+      details: data.details
+    });
+    this.name = "UnauthorizedError";
+  }
+};
+var ForbiddenError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Access forbidden",
+      statusCode: 403,
+      details: data.details
+    });
+    this.name = "ForbiddenError";
+  }
+};
+var NotFoundError = class extends HttpError {
+  resource;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource not found",
+      statusCode: 404,
+      details: data.details
+    });
+    this.name = "NotFoundError";
+    if (data.resource) {
+      this.resource = data.resource;
+    }
+  }
+};
+var ConflictError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource conflict",
+      statusCode: 409,
+      details: data.details
+    });
+    this.name = "ConflictError";
+  }
+};
+var GoneError = class extends HttpError {
+  resource;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource permanently deleted",
+      statusCode: 410,
+      details: data.details
+    });
+    this.name = "GoneError";
+    if (data.resource) {
+      this.resource = data.resource;
+    }
+  }
+};
+var TooManyRequestsError = class extends HttpError {
+  retryAfter;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Too many requests",
+      statusCode: 429,
+      details: data.details
+    });
+    this.name = "TooManyRequestsError";
+    if (data.retryAfter) {
+      this.retryAfter = data.retryAfter;
+    }
+  }
+};
+var InternalServerError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Internal server error",
+      statusCode: 500,
+      details: data.details
+    });
+    this.name = "InternalServerError";
+  }
+};
+var UnsupportedMediaTypeError = class extends HttpError {
+  mediaType;
+  supportedTypes;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Unsupported media type",
+      statusCode: 415,
+      details: data.details
+    });
+    this.name = "UnsupportedMediaTypeError";
+    if (data.mediaType) {
+      this.mediaType = data.mediaType;
+    }
+    if (data.supportedTypes) {
+      this.supportedTypes = data.supportedTypes;
+    }
+  }
+};
+var UnprocessableEntityError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Unprocessable entity",
+      statusCode: 422,
+      details: data.details
+    });
+    this.name = "UnprocessableEntityError";
+  }
+};
+var ServiceUnavailableError = class extends HttpError {
+  retryAfter;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Service unavailable",
+      statusCode: 503,
+      details: data.details
+    });
+    this.name = "ServiceUnavailableError";
+    if (data.retryAfter) {
+      this.retryAfter = data.retryAfter;
+    }
+  }
+};
+
+// src/errors/database-errors.ts
+var DatabaseError = class extends SerializableError {
+  statusCode;
+  details;
+  constructor(data) {
+    super(data.message);
+    this.name = "DatabaseError";
+    this.statusCode = data.statusCode ?? 500;
+    this.details = data.details;
+    Error.captureStackTrace(this, this.constructor);
+  }
+  /**
+   * Whether this error's message/details are derived from the raw database
+   * driver (SQL text, table/column/constraint names, parameter values) and
+   * therefore must NOT be exposed to clients in production. Defined as a
+   * prototype getter so it is never serialized into the response by toJSON().
+   * Subclasses with a safe, constructed message override this to `false`.
+   */
+  get internal() {
+    return true;
+  }
+};
+var ConnectionError = class extends DatabaseError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 503, details: data.details });
+    this.name = "ConnectionError";
+  }
+};
+var QueryError = class extends DatabaseError {
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: data.statusCode ?? 500,
+      details: data.details
+    });
+    this.name = "QueryError";
+  }
+};
+var EntityNotFoundError = class extends QueryError {
+  resource;
+  id;
+  constructor(data) {
+    super({
+      message: `${data.resource} with id ${data.id} not found`,
+      statusCode: 404,
+      details: { resource: data.resource, id: data.id }
+    });
+    this.name = "EntityNotFoundError";
+    this.resource = data.resource;
+    this.id = data.id;
+  }
+  // Message/details are constructed from the resource + id, not driver text
+  get internal() {
+    return false;
+  }
+};
+var ConstraintViolationError = class extends QueryError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 400, details: data.details });
+    this.name = "ConstraintViolationError";
+  }
+};
+var TransactionError = class extends DatabaseError {
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: data.statusCode ?? 500,
+      details: data.details
+    });
+    this.name = "TransactionError";
+  }
+};
+var DeadlockError = class extends TransactionError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 409, details: data.details });
+    this.name = "DeadlockError";
+  }
+};
+var DuplicateEntryError = class extends QueryError {
+  field;
+  value;
+  constructor(data) {
+    super({
+      message: `${data.field} already exists`,
+      statusCode: 409,
+      details: { field: data.field }
+    });
+    this.name = "DuplicateEntryError";
+    this.field = data.field;
+    this.value = data.value;
+  }
+  // Field-only message/details — safe to surface to the client (not internal)
+  get internal() {
+    return false;
+  }
+};
+
+// src/errors/index.ts
+var errorRegistry = new ErrorRegistry();
+errorRegistry.append([
+  HttpError,
+  BadRequestError,
+  ValidationError,
+  UnauthorizedError,
+  ForbiddenError,
+  NotFoundError,
+  ConflictError,
+  GoneError,
+  TooManyRequestsError,
+  UnsupportedMediaTypeError,
+  UnprocessableEntityError,
+  InternalServerError,
+  ServiceUnavailableError
+]);
+errorRegistry.append([
+  DatabaseError,
+  ConnectionError,
+  QueryError,
+  EntityNotFoundError,
+  ConstraintViolationError,
+  TransactionError,
+  DeadlockError,
+  DuplicateEntryError
+]);
+
+// src/authz/index.ts
+function requireOwner(resource, ownerId, options = {}) {
+  const ownerKey = options.ownerKey ?? "ownerId";
+  const value = resource ? resource[ownerKey] : void 0;
+  if (!resource || value === null || value === void 0 || String(value) !== String(ownerId)) {
+    throw new NotFoundError({ message: options.message ?? "not found" });
+  }
+  return resource;
+}
+
+export { requireOwner };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map