@stacksjs/bun-router 0.0.15 → 0.0.16

package/dist/{chunk-j0e7z7hd.js → chunk-0145g1me.js}

@@ -7043,6 +7043,7 @@ class Logger3 {
   }
 }
 var logger3 = new Logger3("stacks");
+
 class BunfigError2 extends Error {
   timestamp;
   context;
@@ -9233,6 +9234,11 @@ class Csrf {
         headers: newHeaders
       });
     }
+    const authHeader = req.headers.get("authorization") ?? req.headers.get("Authorization");
+    if (authHeader && /^Bearer\s+\S/i.test(authHeader)) {
+      const response2 = await next();
+      return response2 || new Response("Not Found", { status: 404 });
+    }
     const token = req.headers.get("X-CSRF-TOKEN") || req.jsonBody?.csrf_token || req.jsonBody?._token || null;
     const cookies = this.parseCookies(req);
     const cookieToken = cookies[csrfConfig?.cookie?.name || "csrf-token"];

package/dist/cli.js

@@ -1,7 +1,7 @@
 // @bun
 import {
   middleware
-} from "./chunk-j0e7z7hd.js";
+} from "./chunk-0145g1me.js";
 
 // src/cli/index.ts
 import process15 from "process";
@@ -572,11 +572,9 @@ class Command {
   isMatched(name) {
     if (this.aliasNames.includes(name))
       return true;
-    if (this.name === name)
-      return true;
-    if (this.namespace && `${this.namespace}:${this.name}` === name)
-      return true;
-    return false;
+    if (this.namespace)
+      return `${this.namespace}:${this.name}` === name;
+    return this.name === name;
   }
   get isDefaultCommand() {
     return this.name === "" || this.aliasNames.includes("!");
@@ -584,6 +582,9 @@ class Command {
   get isGlobalCommand() {
     return this instanceof GlobalCommand;
   }
+  get displayName() {
+    return this.namespace ? `${this.namespace}:${this.name}` : this.name;
+  }
   hasOption(name) {
     name = name.split(".")[0];
     return !!this.options.find((option) => {
@@ -649,7 +650,7 @@ class Command {
       });
       sections.push({
         title: `For more info, run any command with the \`--help\` flag`,
-        body: commands.map((command) => `  $ ${name}${command.name === "" ? "" : ` ${command.name}`} --help`).join(`
+        body: commands.map((command) => `  $ ${name}${command.displayName === "" ? "" : ` ${command.displayName}`} --help`).join(`
 `)
       });
     }
@@ -1004,8 +1005,8 @@ Received ${signal}, cleaning up...`);
     if (this.enableDidYouMean) {
       const allCommandNames = [];
       for (const command of this.commands) {
-        if (command.name) {
-          allCommandNames.push(command.name);
+        if (command.displayName) {
+          allCommandNames.push(command.displayName);
         }
         if (command.aliasNames) {
           allCommandNames.push(...command.aliasNames);
@@ -1961,7 +1962,7 @@ class GroupMultiSelectPrompt extends Prompt {
       this.value = [];
     }
     if (item.group === true) {
-      const group = item.value;
+      const group = String(item.value);
       const groupedItems = this.getGroupItems(group);
       if (this.isGroupSelected(group)) {
         this.value = this.value.filter((v) => groupedItems.findIndex((i) => i.value === v) === -1);
@@ -2044,7 +2045,7 @@ function getPrefix() {
 }
 var prefix = getPrefix();
 // package.json
-var version = "0.0.15";
+var version = "0.0.16";
 
 // src/cli/middleware.ts
 import fs2 from "fs/promises";

package/dist/index.js

@@ -66,7 +66,7 @@ import {
   signRequest,
   singleFileUpload,
   verifySignature
-} from "./chunk-j0e7z7hd.js";
+} from "./chunk-0145g1me.js";
 
 // src/auth.ts
 function base64UrlEncode(str) {
@@ -6199,46 +6199,83 @@ function createPathRegex(pattern) {
   const regexPattern = pattern.replace(/\{([^}]+)\}/g, "([^/]+)");
   return new RegExp(`^${regexPattern}$`);
 }
-function matchPath(pattern, path, params, constraints) {
+var PARAM_SEGMENT_RE = /\{([^}:]+)(?::[^}]+)?(\?)?\}/;
+var OPTIONAL_SEGMENT_RE = /\{[^}]+\?\}/;
+var compiledPatternCache = new Map;
+var constraintRegexCache = new Map;
+function compilePattern(pattern) {
+  const cached = compiledPatternCache.get(pattern);
+  if (cached)
+    return cached;
+  const isWildcard = pattern.endsWith("/*");
   const normalizedPattern = normalizePath(pattern);
-  const normalizedPath = normalizePath(path);
-  if (pattern.endsWith("/*")) {
-    const basePattern = pattern.slice(0, -2);
-    if (path.startsWith(basePattern)) {
-      return true;
-    }
+  let optionalCount = 0;
+  const segments = normalizedPattern.split("/").filter(Boolean).map((seg) => {
+    const isOptional = OPTIONAL_SEGMENT_RE.test(seg);
+    if (isOptional)
+      optionalCount++;
+    const paramMatch = seg.match(PARAM_SEGMENT_RE);
+    return {
+      isParam: !!paramMatch,
+      paramName: paramMatch ? paramMatch[1].replace("?", "") : "",
+      isOptional,
+      literal: seg
+    };
+  });
+  const compiled = {
+    isWildcard,
+    wildcardBase: isWildcard ? pattern.slice(0, -2) : "",
+    segments,
+    optionalCount
+  };
+  compiledPatternCache.set(pattern, compiled);
+  return compiled;
+}
+function getConstraintRegex(constraint) {
+  const cached = constraintRegexCache.get(constraint);
+  if (cached !== undefined)
+    return cached;
+  let regex;
+  try {
+    regex = new RegExp(`^${constraint}$`);
+  } catch {
+    regex = null;
+  }
+  constraintRegexCache.set(constraint, regex);
+  return regex;
+}
+function matchPath(pattern, path, params, constraints) {
+  const compiled = compilePattern(pattern);
+  if (compiled.isWildcard && path.startsWith(compiled.wildcardBase)) {
+    return true;
   }
-  const patternSegments = normalizedPattern.split("/").filter(Boolean);
-  const pathSegments = normalizedPath.split("/").filter(Boolean);
-  const optionalParamCount = (normalizedPattern.match(/\{[^}]+\?\}/g) || []).length;
-  if (pathSegments.length < patternSegments.length - optionalParamCount || pathSegments.length > patternSegments.length) {
+  const patternSegments = compiled.segments;
+  const pathSegments = normalizePath(path).split("/").filter(Boolean);
+  if (pathSegments.length < patternSegments.length - compiled.optionalCount || pathSegments.length > patternSegments.length) {
     return false;
   }
   for (let i = 0;i < patternSegments.length; i++) {
-    const patternSegment = patternSegments[i];
+    const seg = patternSegments[i];
     const pathSegment = pathSegments[i];
     if (pathSegment === undefined) {
-      if (patternSegment.match(/\{[^}]+\?\}/)) {
+      if (seg.isOptional) {
         continue;
-      } else {
-        return false;
       }
+      return false;
     }
-    const paramMatch = patternSegment.match(/\{([^}:]+)(?::[^}]+)?(\?)?\}/);
-    if (paramMatch) {
-      const paramName = paramMatch[1].replace("?", "");
-      params[paramName] = pathSegment;
-      if (constraints && constraints[paramName]) {
-        try {
-          const regex = new RegExp(`^${constraints[paramName]}$`);
+    if (seg.isParam) {
+      params[seg.paramName] = pathSegment;
+      if (constraints && constraints[seg.paramName]) {
+        const regex = getConstraintRegex(constraints[seg.paramName]);
+        if (regex) {
           if (!regex.test(pathSegment)) {
             return false;
           }
-        } catch {
-          console.warn(`Invalid constraint regex for parameter ${paramName}: ${constraints[paramName]}`);
+        } else {
+          console.warn(`Invalid constraint regex for parameter ${seg.paramName}: ${constraints[seg.paramName]}`);
         }
       }
-    } else if (patternSegment !== pathSegment) {
+    } else if (seg.literal !== pathSegment) {
       return false;
     }
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/bun-router",
   "type": "module",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "description": "A fast, type-safe router for Bun.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",

package/src/middleware/csrf.ts

@@ -60,6 +60,16 @@ export default class Csrf {
       })
     }
 
+    // Bearer-authed requests can't be CSRF'd — the token doesn't
+    // ride on cookies, so a hostile origin can't trick a browser into
+    // sending it. Mirrors Laravel Sanctum / Django REST framework /
+    // express-csurf semantics. Filed against stacksjs/stacks#1922.
+    const authHeader = req.headers.get('authorization') ?? req.headers.get('Authorization')
+    if (authHeader && /^Bearer\s+\S/i.test(authHeader)) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
     // For unsafe methods, verify the CSRF token
     // Check for token in headers or in the request body
     const token = req.headers.get('X-CSRF-TOKEN')

package/src/utils.ts

@@ -83,6 +83,83 @@ export function createPathRegex(pattern: string): RegExp {
   return new RegExp(`^${regexPattern}$`)
 }
 
+/**
+ * Per-pattern matching data. A route's pattern never changes, so the
+ * segment split, param-name extraction, and optional-param count are derived
+ * once and cached — turning `matchPath` from "regex + split on every request"
+ * into a tight array walk. Only the incoming `path` is processed per call.
+ */
+interface CompiledSegment {
+  isParam: boolean
+  paramName: string
+  isOptional: boolean
+  literal: string
+}
+
+interface CompiledPattern {
+  isWildcard: boolean
+  wildcardBase: string
+  segments: CompiledSegment[]
+  optionalCount: number
+}
+
+const PARAM_SEGMENT_RE = /\{([^}:]+)(?::[^}]+)?(\?)?\}/
+const OPTIONAL_SEGMENT_RE = /\{[^}]+\?\}/
+
+const compiledPatternCache = new Map<string, CompiledPattern>()
+// Cached compiled constraint regexes; `null` marks an invalid pattern so we
+// don't re-attempt construction on every request.
+const constraintRegexCache = new Map<string, RegExp | null>()
+
+function compilePattern(pattern: string): CompiledPattern {
+  const cached = compiledPatternCache.get(pattern)
+  if (cached)
+    return cached
+
+  const isWildcard = pattern.endsWith('/*')
+  const normalizedPattern = normalizePath(pattern)
+  let optionalCount = 0
+  const segments: CompiledSegment[] = normalizedPattern
+    .split('/')
+    .filter(Boolean)
+    .map((seg) => {
+      const isOptional = OPTIONAL_SEGMENT_RE.test(seg)
+      if (isOptional)
+        optionalCount++
+      const paramMatch = seg.match(PARAM_SEGMENT_RE)
+      return {
+        isParam: !!paramMatch,
+        paramName: paramMatch ? paramMatch[1].replace('?', '') : '',
+        isOptional,
+        literal: seg,
+      }
+    })
+
+  const compiled: CompiledPattern = {
+    isWildcard,
+    wildcardBase: isWildcard ? pattern.slice(0, -2) : '',
+    segments,
+    optionalCount,
+  }
+  compiledPatternCache.set(pattern, compiled)
+  return compiled
+}
+
+function getConstraintRegex(constraint: string): RegExp | null {
+  const cached = constraintRegexCache.get(constraint)
+  if (cached !== undefined)
+    return cached
+  let regex: RegExp | null
+  try {
+    regex = new RegExp(`^${constraint}$`)
+  }
+  catch {
+    regex = null
+  }
+  constraintRegexCache.set(constraint, regex)
+  return regex
+}
+
 /**
  * Matches a path against a pattern and extracts parameters
  * @param pattern The path pattern (e.g., '/users/{id}')
@@ -97,71 +174,59 @@ export function matchPath(
   params: Record<string, string>,
   constraints?: Record<string, string>,
 ): boolean {
-  // Both paths should be normalized
-  const normalizedPattern = normalizePath(pattern)
-  const normalizedPath = normalizePath(path)
+  const compiled = compilePattern(pattern)
 
-  // Special case for wildcard patterns
-  if (pattern.endsWith('/*')) {
-    const basePattern = pattern.slice(0, -2)
-    if (path.startsWith(basePattern)) {
-      return true
-    }
+  // Special case for wildcard patterns. Matches the original semantics:
+  // a prefix hit short-circuits to true, otherwise we fall through to the
+  // per-segment match below.
+  if (compiled.isWildcard && path.startsWith(compiled.wildcardBase)) {
+    return true
   }
 
-  // Handle patterns with parameters
-  const patternSegments = normalizedPattern.split('/').filter(Boolean)
-  const pathSegments = normalizedPath.split('/').filter(Boolean)
+  const patternSegments = compiled.segments
+  const pathSegments = normalizePath(path).split('/').filter(Boolean)
 
   // Quick check - if segments don't match (accounting for optional params) then no match
   // For mandatory parameters, the pattern and path must have same number of segments
-  const optionalParamCount = (normalizedPattern.match(/\{[^}]+\?\}/g) || []).length
-
-  if (pathSegments.length < patternSegments.length - optionalParamCount
+  if (pathSegments.length < patternSegments.length - compiled.optionalCount
     || pathSegments.length > patternSegments.length) {
     return false
   }
 
   // Match each segment
   for (let i = 0; i < patternSegments.length; i++) {
-    const patternSegment = patternSegments[i]
+    const seg = patternSegments[i]
     const pathSegment = pathSegments[i]
 
     // If we've run out of path segments and this is not an optional parameter
     if (pathSegment === undefined) {
-      if (patternSegment.match(/\{[^}]+\?\}/)) {
+      if (seg.isOptional) {
         // This is an optional parameter and we have no path segment for it
         continue
       }
-      else {
-        // Required parameter or static segment with no matching path segment
-        return false
-      }
+      // Required parameter or static segment with no matching path segment
+      return false
     }
 
-    // Check if this segment is a parameter
-    const paramMatch = patternSegment.match(/\{([^}:]+)(?::[^}]+)?(\?)?\}/)
-    if (paramMatch) {
-      // This is a parameter segment, extract param name
-      const paramName = paramMatch[1].replace('?', '')
+    if (seg.isParam) {
       // Store the parameter value
-      params[paramName] = pathSegment
+      params[seg.paramName] = pathSegment
 
       // Check constraints if they exist
-      if (constraints && constraints[paramName]) {
-        try {
-          const regex = new RegExp(`^${constraints[paramName]}$`)
+      if (constraints && constraints[seg.paramName]) {
+        const regex = getConstraintRegex(constraints[seg.paramName])
+        if (regex) {
           if (!regex.test(pathSegment)) {
             return false
           }
         }
-        catch {
+        else {
           // If regex is invalid, treat as no constraint
-          console.warn(`Invalid constraint regex for parameter ${paramName}: ${constraints[paramName]}`)
+          console.warn(`Invalid constraint regex for parameter ${seg.paramName}: ${constraints[seg.paramName]}`)
         }
       }
     }
-    else if (patternSegment !== pathSegment) {
+    else if (seg.literal !== pathSegment) {
       // Static segment doesn't match
       return false
     }