@stacksjs/bun-router 0.0.17 → 0.0.18

package/src/index.ts

@@ -1,66 +0,0 @@
-/**
- * @stacksjs/bun-router — a fast, type-safe router for Bun.
- *
- * Main entry point. The most commonly used exports:
- * - `Router` — the primary router class (from `./router`)
- * - `FluentRouter` / `router` — chainable routing API
- * - `Auth`, `JWT`, `ApiKeyManager`, `OAuth2Helper` — auth helpers
- * - `Container`, `createContainer` — dependency-injection container
- * - `url()` / `registerNamedRoute()` — named-route URL generation
- * - `Errors` — namespaced error/exception types
- */
-
-// Authentication (JWT, API keys, OAuth2)
-export { default as Auth } from './auth'
-export * from './auth'
-
-// Runtime configuration
-export * from './config'
-
-// Dependency-injection container. Exported by name — the decorator module
-// (`Get`, `Post`, `Controller`, …) would collide with router exports if
-// star-exported; import those from `@stacksjs/bun-router/container/decorators`.
-export {
-  BindingBuilder,
-  Container,
-  createContainer,
-  getContainer,
-  setContainer,
-} from './container/container'
-export type { Binding, BindingScope, ContainerOptions, ResolutionContext, Token } from './container/container'
-export { ContextualContainer, EnvironmentManager } from './container/contextual-binding'
-export { DefaultServiceProviderManager } from './container/service-provider'
-
-// Error types and helpers (namespaced — many generic names)
-export * as Errors from './errors'
-
-// Built-in middleware (CORS, CSRF, sessions, rate limiting, …)
-export * from './middleware'
-
-// Request context (AsyncLocalStorage-backed current request; lazy — see enableRequestContext)
-export { enableRequestContext, getCurrentRequest, request, runWithRequest, setCurrentRequest } from './request/context'
-
-// Session stores and manager
-export * from './session'
-
-// Response factory helpers
-export * from './response/response-factory'
-
-// The Router class and routing features (fluent API, throttling, caching, …)
-export * from './router'
-export { MiddlewareGroupRegistry, middlewareGroups } from './router/middleware-groups'
-
-// Testing utilities
-export * from './testing'
-
-// Public types
-export * from './types'
-
-// Validation (Laravel-style rules, custom rules, middleware)
-export * from './validation/validator'
-
-// Named-route URL generation
-export { clearNamedRoutes, getNamedRoutePath, getNamedRoutes, registerNamedRoute, url, type UrlOptions } from './url'
-
-// Path/template utilities
-export * from './utils'

package/src/middleware/auth.ts

@@ -1,220 +0,0 @@
-import type { EnhancedRequest, Middleware, NextFunction } from '../types'
-
-export interface AuthOptions {
-  /**
-   * Authentication type to use
-   */
-  type: 'basic' | 'bearer' | 'api-key' | 'oauth2' | 'jwt' | 'custom'
-
-  /**
-   * Function to validate credentials
-   */
-  validator: (credentials: any, req: EnhancedRequest) => Promise<boolean> | boolean
-
-  /**
-   * Extract user information after successful authentication
-   */
-  userExtractor?: (credentials: any, req: EnhancedRequest) => Promise<any> | any
-
-  /**
-   * Where to look for auth information
-   */
-  source?: 'header' | 'query' | 'cookie'
-
-  /**
-   * Key name for the source (header name, query param, cookie name)
-   */
-  key?: string
-
-  /**
-   * Realm for Basic authentication
-   */
-  realm?: string
-
-  /**
-   * Custom credentials extractor
-   */
-  credentialsExtractor?: (req: EnhancedRequest) => Promise<any> | any
-
-  /**
-   * Whether to attach user info to request
-   */
-  attachUser?: boolean
-}
-
-/**
- * Extracts and decodes Basic Auth credentials from Authorization header
- */
-export function extractBasicAuth(authHeader: string): { username: string, password: string } | null {
-  if (!authHeader || !authHeader.startsWith('Basic ')) {
-    return null
-  }
-
-  try {
-    const base64Credentials = authHeader.split(' ')[1]
-    const credentials = atob(base64Credentials)
-    const [username, password] = credentials.split(':')
-
-    return { username, password }
-  }
-  catch (error) {
-    void error
-
-    return null
-  }
-}
-
-/**
- * Extracts Bearer token from Authorization header
- */
-export function extractBearerToken(authHeader: string): string | null {
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    return null
-  }
-
-  return authHeader.split(' ')[1]
-}
-
-/**
- * Extracts API key from various sources
- */
-export function extractApiKey(req: EnhancedRequest, source: 'header' | 'query' | 'cookie' = 'header', key: string = 'X-API-Key'): string | null {
-  switch (source) {
-    case 'header':
-      return req.headers.get(key) || null
-    case 'query':
-      return new URL(req.url).searchParams.get(key)
-    case 'cookie':
-      // Handle both Map-like cookies (with .get()) and plain object cookies
-      if (req.cookies) {
-        if (typeof req.cookies.get === 'function') {
-          return req.cookies.get(key) || null
-        }
-        return (req.cookies as unknown as Record<string, string>)[key] || null
-      }
-      return null
-    default:
-      return null
-  }
-}
-
-export default class AuthMiddleware implements Middleware {
-  private options: AuthOptions
-
-  constructor(options: AuthOptions) {
-    this.options = {
-      source: 'header',
-      key: 'Authorization',
-      attachUser: true,
-      ...options,
-    }
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    let credentials: any = null
-
-    // Extract credentials based on auth type
-    if (this.options.credentialsExtractor) {
-      credentials = await this.options.credentialsExtractor(req)
-    }
-    else {
-      switch (this.options.type) {
-        case 'basic': {
-          const authHeader = req.headers.get(this.options.key || 'Authorization')
-          credentials = extractBasicAuth(authHeader || '')
-          break
-        }
-        case 'bearer':
-        case 'jwt': {
-          const authHeader = req.headers.get(this.options.key || 'Authorization')
-          credentials = extractBearerToken(authHeader || '')
-          break
-        }
-        case 'api-key': {
-          credentials = extractApiKey(req, this.options.source, this.options.key)
-          break
-        }
-        case 'oauth2': {
-          // OAuth tokens are typically sent as Bearer tokens
-          const authHeader = req.headers.get(this.options.key || 'Authorization')
-          credentials = extractBearerToken(authHeader || '')
-          break
-        }
-      }
-    }
-
-    // If no credentials were found, return 401
-    if (!credentials) {
-      const headers: Record<string, string> = {}
-
-      // For Basic auth, include WWW-Authenticate header
-      if (this.options.type === 'basic') {
-        const realm = this.options.realm || 'Secure Area'
-        headers['WWW-Authenticate'] = `Basic realm="${realm}"`
-      }
-
-      return new Response('Unauthorized', {
-        status: 401,
-        headers,
-      })
-    }
-
-    // Validate credentials
-    const isValid = await this.options.validator(credentials, req)
-
-    if (!isValid) {
-      return new Response('Unauthorized', { status: 401 })
-    }
-
-    // If user extractor provided and attachUser is true, attach user to request
-    if (this.options.userExtractor && this.options.attachUser) {
-      const user = await this.options.userExtractor(credentials, req)
-      ;(req as any).user = user
-    }
-
-    // Authentication successful, continue to next middleware or route handler
-    const response = await next()
-    return response || new Response('Not Found', { status: 404 })
-  }
-}
-
-// Convenience factory functions for common auth types
-export function basicAuth(validator: (credentials: { username: string, password: string }, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'basic',
-    validator,
-    ...options,
-  })
-}
-
-export function bearerAuth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'bearer',
-    validator,
-    ...options,
-  })
-}
-
-export function jwtAuth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'jwt',
-    validator,
-    ...options,
-  })
-}
-
-export function apiKeyAuth(validator: (apiKey: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'api-key',
-    validator,
-    ...options,
-  })
-}
-
-export function oauth2Auth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'oauth2',
-    validator,
-    ...options,
-  })
-}

package/src/middleware/content_security_policy.ts

@@ -1,215 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-export interface CSPDirectives {
-  'default-src'?: string[]
-  'script-src'?: string[]
-  'script-src-elem'?: string[]
-  'script-src-attr'?: string[]
-  'style-src'?: string[]
-  'style-src-elem'?: string[]
-  'style-src-attr'?: string[]
-  'img-src'?: string[]
-  'font-src'?: string[]
-  'connect-src'?: string[]
-  'media-src'?: string[]
-  'object-src'?: string[]
-  'child-src'?: string[]
-  'frame-src'?: string[]
-  'worker-src'?: string[]
-  'frame-ancestors'?: string[]
-  'form-action'?: string[]
-  'base-uri'?: string[]
-  'manifest-src'?: string[]
-  'prefetch-src'?: string[]
-  'navigate-to'?: string[]
-  'report-uri'?: string[]
-  'report-to'?: string[]
-  'require-trusted-types-for'?: string[]
-  'trusted-types'?: string[]
-  'upgrade-insecure-requests'?: boolean
-  'block-all-mixed-content'?: boolean
-  'plugin-types'?: string[]
-  'sandbox'?: string[]
-  'disown-opener'?: boolean
-}
-
-export interface CSPOptions {
-  directives?: CSPDirectives
-  reportOnly?: boolean
-  reportUri?: string
-  reportTo?: string
-  useNonces?: boolean
-  nonceLength?: number
-  upgradeInsecureRequests?: boolean
-  blockAllMixedContent?: boolean
-}
-
-export default class ContentSecurityPolicy {
-  private options: CSPOptions
-  private nonces: Map<string, string> = new Map()
-
-  constructor(options: CSPOptions = {}) {
-    const cspConfig = config.server?.security?.helmet?.contentSecurityPolicy
-    const defaultDirectives: CSPDirectives = {
-      'default-src': ['\'self\''],
-      'script-src': ['\'self\''],
-      'style-src': ['\'self\''],
-      'img-src': ['\'self\'', 'data:', 'https:'],
-      'font-src': ['\'self\''],
-      'connect-src': ['\'self\''],
-      'media-src': ['\'self\''],
-      'object-src': ['\'none\''],
-      'child-src': ['\'self\''],
-      'worker-src': ['\'self\''],
-      'frame-ancestors': ['\'none\''],
-      'form-action': ['\'self\''],
-      'base-uri': ['\'self\''],
-      'manifest-src': ['\'self\''],
-    }
-
-    this.options = {
-      directives: options.directives || (typeof cspConfig === 'object' && cspConfig.directives) || defaultDirectives,
-      reportOnly: options.reportOnly ?? (typeof cspConfig === 'object' && cspConfig.reportOnly) ?? false,
-      reportUri: options.reportUri,
-      reportTo: options.reportTo,
-      useNonces: options.useNonces ?? false,
-      nonceLength: options.nonceLength ?? 16,
-      upgradeInsecureRequests: options.upgradeInsecureRequests ?? true,
-      blockAllMixedContent: options.blockAllMixedContent ?? false,
-    }
-  }
-
-  private generateNonce(): string {
-    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
-    let result = ''
-    for (let i = 0; i < (this.options.nonceLength || 16); i++) {
-      result += chars.charAt(Math.floor(Math.random() * chars.length))
-    }
-    return result
-  }
-
-  private buildCSPHeader(): string {
-    const directives: string[] = []
-    const dirs = this.options.directives || {}
-
-    // Handle regular directives
-    for (const [directive, values] of Object.entries(dirs)) {
-      if (directive === 'upgrade-insecure-requests' || directive === 'block-all-mixed-content' || directive === 'disown-opener') {
-        if (values === true) {
-          directives.push(directive.replace(/([A-Z])/g, '-$1').toLowerCase())
-        }
-        continue
-      }
-
-      if (Array.isArray(values) && values.length > 0) {
-        const directiveName = directive.replace(/([A-Z])/g, '-$1').toLowerCase()
-        directives.push(`${directiveName} ${values.join(' ')}`)
-      }
-    }
-
-    // Add upgrade-insecure-requests if enabled
-    if (this.options.upgradeInsecureRequests) {
-      directives.push('upgrade-insecure-requests')
-    }
-
-    // Add block-all-mixed-content if enabled
-    if (this.options.blockAllMixedContent) {
-      directives.push('block-all-mixed-content')
-    }
-
-    // Add report-uri if specified
-    if (this.options.reportUri) {
-      directives.push(`report-uri ${this.options.reportUri}`)
-    }
-
-    // Add report-to if specified
-    if (this.options.reportTo) {
-      directives.push(`report-to ${this.options.reportTo}`)
-    }
-
-    return directives.join('; ')
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const helmetConfig = (config.server?.security?.helmet || {}) as any
-
-    // If CSP is disabled, continue to next middleware
-    if (helmetConfig.contentSecurityPolicy === false) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    // Generate nonce if needed
-    let nonce: string | undefined
-    if (this.options.useNonces) {
-      nonce = this.generateNonce()
-      this.nonces.set(req.url, nonce)
-
-      // Add nonce to script-src and style-src if they exist
-      if (this.options.directives?.['script-src']) {
-        this.options.directives['script-src'] = [
-          ...this.options.directives['script-src'],
-          `'nonce-${nonce}'`,
-        ]
-      }
-      if (this.options.directives?.['style-src']) {
-        this.options.directives['style-src'] = [
-          ...this.options.directives['style-src'],
-          `'nonce-${nonce}'`,
-        ]
-      }
-    }
-
-    // Add nonce to request context for use in templates
-    if (nonce) {
-      req.nonce = nonce
-    }
-
-    const response = await next()
-    if (!response) {
-      return new Response('Not Found', { status: 404 })
-    }
-
-    const headers = new Headers(response.headers)
-    const cspHeader = this.buildCSPHeader()
-
-    if (cspHeader) {
-      const headerName = this.options.reportOnly
-        ? 'Content-Security-Policy-Report-Only'
-        : 'Content-Security-Policy'
-      headers.set(headerName, cspHeader)
-    }
-
-    // Set up reporting endpoint if specified
-    if (this.options.reportTo) {
-      headers.set('Report-To', JSON.stringify({
-        group: this.options.reportTo,
-        max_age: 10886400,
-        endpoints: [{ url: this.options.reportUri || '/csp-report' }],
-      }))
-    }
-
-    // Clean up nonce after use
-    if (nonce) {
-      this.nonces.delete(req.url)
-    }
-
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    })
-  }
-
-  // Helper method to get nonce for templates
-  getNonce(url: string): string | undefined {
-    return this.nonces.get(url)
-  }
-}
-
-// Factory function for easy use
-export function contentSecurityPolicy(options: CSPOptions = {}): (req: EnhancedRequest, next: NextFunction) => Promise<Response> {
-  const instance = new ContentSecurityPolicy(options)
-  return async (req: EnhancedRequest, next: NextFunction) => instance.handle(req, next)
-}

package/src/middleware/cors.ts

@@ -1,142 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-// Default CORS headers.
-//
-// IMPORTANT: when credentials are NOT enabled it is safe to allow any origin
-// with `*`. The default config below deliberately keeps credentials disabled.
-// The `*` + `Allow-Credentials: true` combination is forbidden by the CORS
-// spec and is dangerous (it lets any site read credentialed responses), so the
-// logic in `getCorsHeaders` guarantees that combination can never be emitted.
-const DEFAULT_CORS_HEADERS: Record<string, string> = {
-  'Access-Control-Allow-Origin': '*',
-  'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, OPTIONS',
-  'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With, Accept, Origin',
-  'Access-Control-Max-Age': '86400',
-}
-
-export default class Cors {
-  /**
-   * Resolve the `Access-Control-Allow-Origin` value for a request.
-   *
-   * Supports a string origin (`'*'` or an explicit origin) or an array of
-   * allowed origins. For an allowlist, the request `Origin` is reflected back
-   * only when it is present in the list. When credentials are enabled a literal
-   * `*` is never returned (it would be both spec-violating and dangerous).
-   */
-  private resolveAllowOrigin(
-    configuredOrigin: string | string[] | undefined,
-    credentials: boolean,
-    requestOrigin: string | null,
-  ): { value: string | null, vary: boolean } {
-    // Explicit allowlist: only reflect the request origin when it matches.
-    if (Array.isArray(configuredOrigin)) {
-      if (requestOrigin && configuredOrigin.includes(requestOrigin)) {
-        return { value: requestOrigin, vary: true }
-      }
-      // Origin not allowed: do not emit an Allow-Origin header at all.
-      return { value: null, vary: true }
-    }
-
-    const origin = configuredOrigin || '*'
-
-    if (origin === '*') {
-      // The `*` wildcard cannot be combined with credentials. When credentials
-      // are enabled, reflect the specific request origin instead (which is the
-      // only spec-compliant way to support credentialed cross-origin requests).
-      if (credentials) {
-        if (requestOrigin) {
-          return { value: requestOrigin, vary: true }
-        }
-        // No request origin to reflect — omit the header rather than send `*`.
-        return { value: null, vary: true }
-      }
-      return { value: '*', vary: false }
-    }
-
-    // A single explicit origin was configured.
-    return { value: origin, vary: false }
-  }
-
-  private getCorsHeaders(req: EnhancedRequest): Record<string, string> {
-    const corsConfig = config.server?.cors
-    const requestOrigin = req.headers.get('origin')
-
-    if (corsConfig && corsConfig.enabled) {
-      const credentials = Boolean(corsConfig.credentials)
-      const { value: allowOrigin, vary } = this.resolveAllowOrigin(corsConfig.origin, credentials, requestOrigin)
-
-      const headers: Record<string, string> = {
-        'Access-Control-Allow-Methods': Array.isArray(corsConfig.methods) ? corsConfig.methods.join(', ') : DEFAULT_CORS_HEADERS['Access-Control-Allow-Methods'],
-        'Access-Control-Allow-Headers': Array.isArray(corsConfig.allowedHeaders) ? corsConfig.allowedHeaders.join(', ') : DEFAULT_CORS_HEADERS['Access-Control-Allow-Headers'],
-        'Access-Control-Max-Age': String(corsConfig.maxAge || 86400),
-      }
-
-      if (allowOrigin !== null) {
-        headers['Access-Control-Allow-Origin'] = allowOrigin
-      }
-
-      // Only advertise credentials when an origin is actually allowed. Never
-      // pair credentials with a `*` wildcard.
-      if (credentials && allowOrigin !== null && allowOrigin !== '*') {
-        headers['Access-Control-Allow-Credentials'] = 'true'
-      }
-
-      if (vary) {
-        headers.Vary = 'Origin'
-      }
-
-      return headers
-    }
-
-    // No CORS config: fall back to the permissive (but credential-free) defaults.
-    return { ...DEFAULT_CORS_HEADERS }
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const corsHeaders = this.getCorsHeaders(req)
-
-    // Handle preflight OPTIONS request
-    if (req.method === 'OPTIONS') {
-      return new Response(null, { status: 204, headers: corsHeaders })
-    }
-
-    // Helper to add CORS headers to any response
-    const addCorsHeaders = (response: Response): Response => {
-      const newHeaders = new Headers(response.headers)
-      Object.entries(corsHeaders).forEach(([key, value]) => {
-        newHeaders.set(key, value)
-      })
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: newHeaders,
-      })
-    }
-
-    try {
-      // For non-OPTIONS requests, add CORS headers to the response
-      const response = await next()
-      if (!response) {
-        return new Response(JSON.stringify({ error: 'Not Found' }), {
-          status: 404,
-          headers: { ...corsHeaders, 'Content-Type': 'application/json' },
-        })
-      }
-
-      // Add CORS headers to the response
-      return addCorsHeaders(response)
-    }
-    catch (error) {
-      // Error occurred - return error response WITH CORS headers
-      console.error('[CORS] Error in middleware chain:', error)
-      return new Response(JSON.stringify({
-        error: 'Internal Server Error',
-        message: error instanceof Error ? error.message : String(error),
-      }), {
-        status: 500,
-        headers: { ...corsHeaders, 'Content-Type': 'application/json' },
-      })
-    }
-  }
-}