@stacksjs/router 0.70.87 → 0.70.90

package/dist/response.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The `response` factory is re-exported from `@stacksjs/bun-router` —
+ * see `./index.ts`'s `export * from '@stacksjs/bun-router'` line. Look
+ * there (or at the bun-router source) for the canonical shape:
+ *
+ *     response.json(data, options?)
+ *     response.text(content, status?, headers?)
+ *     response.xml(content, status?, headers?)
+ *     response.html(content, status?, headers?)
+ *     response.redirect(url, status?)
+ *     response.notFound(message?)
+ *     response.unauthorized(message?)
+ *     response.forbidden(message?)
+ *     response.tooManyRequests(message?, retryAfter?)
+ *     response.success(data?, message?, status?)
+ *     response.error(message, status?, errors?)
+ *     response.paginate(data, { page, perPage, total, path })
+ *     response.download(filePath, filename?, headers?)
+ *     response.streamDownload(generator, filename, options?)
+ *     ...
+ *
+ * Note that bun-router uses *positional* args for status/headers on
+ * `text`/`xml`/`html`/`view` (`text(content, status, headers)`) — NOT
+ * options-object. There used to be a competing `response` defined here
+ * in stacks/router with an options-object shape (`text(content, { status, headers })`).
+ * It was dead code (nothing imported it) but its existence misled
+ * readers and produced runtime crashes when a caller copy-pasted the
+ * wrong shape (e.g. the `response.send()` ghost method). Removed —
+ * use the bun-router factory directly.
+ */
+export {};

package/dist/response.js

@@ -0,0 +1 @@
+export {};

package/dist/route-loader.js

@@ -0,0 +1,72 @@
+import { log } from "@stacksjs/logging";
+import { route } from "./stacks-router";
+const NO_PREFIX_KEYS = ["web"];
+export async function loadRoutes(registry) {
+  for (const [key, definition] of Object.entries(registry)) {
+    const config = normalizeDefinition(definition), prefix = config.prefix !== void 0 ? config.prefix ? config.prefix.startsWith("/") ? config.prefix : `/${config.prefix}` : void 0 : NO_PREFIX_KEYS.includes(key) ? void 0 : `/${key}`, middleware = normalizeMiddleware(config.middleware);
+    log.debug(`[route-loader] Loading: ${config.path} prefix=${prefix || "/"} middleware=[${middleware.join(", ")}]`);
+    try {
+      if (prefix || middleware.length > 0)
+        await route.group({
+          prefix,
+          middleware: middleware.length > 0 ? middleware : void 0
+        }, async () => {
+          await importRouteFile(config.path);
+        });
+      else
+        await importRouteFile(config.path);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[Routes] Failed to load route file '${config.path}': ${message}`);
+      throw Error(`Route loading failed for '${config.path}': ${message}`);
+    }
+  }
+  await loadFrameworkRoutes();
+}
+async function loadFrameworkRoutes() {
+  if (process.env.STACKS_SKIP_DEFAULT_ROUTES === "1")
+    return;
+  try {
+    const { frameworkPath } = await import("@stacksjs/path"), bootstrapPath = frameworkPath("defaults/bootstrap.ts");
+    if (await Bun.file(bootstrapPath).exists())
+      await import(bootstrapPath);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!message.includes("Cannot find module") && !message.includes("MODULE_NOT_FOUND"))
+      console.error(`[Routes] Failed to load framework bootstrap: ${message}`);
+  }
+}
+function assertSafeRouteName(routeName) {
+  if (typeof routeName !== "string" || routeName.length === 0)
+    throw Error("[route-loader] Invalid route path: empty or non-string");
+  if (routeName.includes("\x00"))
+    throw Error("[route-loader] Invalid route path: null byte");
+  let decoded;
+  try {
+    decoded = decodeURIComponent(routeName);
+  } catch {
+    throw Error("[route-loader] Invalid route path: malformed URL encoding");
+  }
+  const cleanPath = decoded.replace(/\.ts$/, "");
+  if (cleanPath.startsWith("/") || /^[A-Za-z]:[\\/]/.test(cleanPath))
+    throw Error(`[route-loader] Invalid route path: absolute paths not allowed (${cleanPath})`);
+  if (cleanPath.split(/[/\\]/).some((s) => s === ".."))
+    throw Error(`[route-loader] Invalid route path: '..' segment not allowed (${cleanPath})`);
+  return cleanPath;
+}
+async function importRouteFile(routeName) {
+  const cleanPath = assertSafeRouteName(routeName), { projectPath } = await import("@stacksjs/path");
+  await import(projectPath(`routes/${cleanPath}`));
+}
+function normalizeDefinition(def) {
+  if (typeof def === "string")
+    return { path: def };
+  return def;
+}
+function normalizeMiddleware(middleware) {
+  if (!middleware)
+    return [];
+  if (typeof middleware === "string")
+    return [middleware];
+  return middleware;
+}

package/dist/security-headers.js

@@ -0,0 +1,46 @@
+import process from "node:process";
+let _isProductionCache, _isDisabledCache, _cspCache;
+function isProduction() {
+  if (_isProductionCache !== void 0)
+    return _isProductionCache;
+  _isProductionCache = (process.env.APP_ENV ?? process.env.NODE_ENV ?? "").toLowerCase() === "production";
+  return _isProductionCache;
+}
+function isDisabled() {
+  if (_isDisabledCache !== void 0)
+    return _isDisabledCache;
+  _isDisabledCache = process.env.STACKS_SECURITY_HEADERS_DISABLE === "true";
+  return _isDisabledCache;
+}
+function resolveCsp() {
+  if (_cspCache !== void 0)
+    return _cspCache;
+  const enforce = process.env.STACKS_CSP, report = process.env.STACKS_CSP_REPORT_ONLY;
+  if (enforce)
+    _cspCache = { header: "Content-Security-Policy", value: enforce };
+  else if (report)
+    _cspCache = { header: "Content-Security-Policy-Report-Only", value: report };
+  else
+    _cspCache = null;
+  return _cspCache;
+}
+export function applySecurityHeaders(headers) {
+  if (isDisabled())
+    return;
+  if (!headers.has("X-Content-Type-Options"))
+    headers.set("X-Content-Type-Options", "nosniff");
+  if (!headers.has("X-Frame-Options"))
+    headers.set("X-Frame-Options", "SAMEORIGIN");
+  if (!headers.has("Referrer-Policy"))
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+  if (isProduction() && !headers.has("Strict-Transport-Security"))
+    headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+  const csp = resolveCsp();
+  if (csp && !headers.has(csp.header))
+    headers.set(csp.header, csp.value);
+}
+export function __resetSecurityHeadersCache() {
+  _isProductionCache = void 0;
+  _isDisabledCache = void 0;
+  _cspCache = void 0;
+}

package/dist/session-factory.js

@@ -0,0 +1,26 @@
+import process from "node:process";
+import { createSessionStore } from "@stacksjs/bun-router";
+import { EncryptedSessionStore } from "./encrypted-session-store";
+export function createStacksSessionStore(config) {
+  const base = createSessionStore(config);
+  if (!resolveEncryptionMode(config.encrypt))
+    return base;
+  const appKey = config.appKey ?? process.env.APP_KEY;
+  if (!appKey || appKey.length < 16)
+    throw Error("[session] createStacksSessionStore: encryption requested but APP_KEY is missing or too short " + "(need \u226516 chars). Either set APP_KEY in env, pass `appKey` in config, or set `encrypt: false` to opt out.");
+  return new EncryptedSessionStore(base, { appKey });
+}
+function resolveEncryptionMode(mode) {
+  if (mode === !0)
+    return !0;
+  if (mode === !1)
+    return !1;
+  return (process.env.APP_ENV ?? process.env.NODE_ENV ?? "").toLowerCase() === "production";
+}
+export {
+  DatabaseSessionStore,
+  FileSessionStore,
+  MemorySessionStore,
+  RedisSessionStore,
+  createSessionStore
+} from "@stacksjs/bun-router";

package/dist/signed-url.js

@@ -0,0 +1,76 @@
+import { timingSafeEqual } from "node:crypto";
+import { Buffer } from "node:buffer";
+import process from "node:process";
+import { url as buildUrl } from "./stacks-router";
+const SIGNATURE_PARAM = "signature", EXPIRES_PARAM = "expires";
+function getSigningSecret() {
+  const secret = process.env.APP_KEY || process.env.STACKS_SIGNED_URL_SECRET;
+  if (!secret || secret.length < 16)
+    throw Error("[router] signed URLs require APP_KEY (\u2265 16 chars) or STACKS_SIGNED_URL_SECRET. " + "Run `./buddy key:generate` or set the env var.");
+  return secret;
+}
+function hmacHex(payload, secret) {
+  return new Bun.CryptoHasher("sha256", secret).update(payload).digest("hex");
+}
+function safeEqualHex(a, b) {
+  const ba = Buffer.from(a.toLowerCase(), "hex"), bb = Buffer.from(b.toLowerCase(), "hex");
+  if (ba.length !== bb.length)
+    return !1;
+  return timingSafeEqual(ba, bb);
+}
+function stripSignatureParam(input) {
+  const u = new URL(input.toString());
+  u.searchParams.delete(SIGNATURE_PARAM);
+  return u;
+}
+function buildSignaturePayload(input) {
+  const stripped = stripSignatureParam(input);
+  stripped.searchParams.sort();
+  return stripped.toString();
+}
+export function signUrl(input, options = {}) {
+  const secret = getSigningSecret(), url = input.startsWith("http") ? new URL(input) : new URL(input.startsWith("/") ? input : `/${input}`, process.env.APP_URL || "https://localhost");
+  if (options.ttl !== void 0 && options.expiresAt !== void 0)
+    warnOnce("dual-expiry", "[router] signUrl: both `ttl` and `expiresAt` provided \u2014 using `ttl`.");
+  if (options.ttl !== void 0)
+    url.searchParams.set(EXPIRES_PARAM, String(Math.floor(Date.now() / 1000) + options.ttl));
+  else if (options.expiresAt !== void 0)
+    url.searchParams.set(EXPIRES_PARAM, String(Math.floor(options.expiresAt)));
+  const payload = buildSignaturePayload(url);
+  url.searchParams.set(SIGNATURE_PARAM, hmacHex(payload, secret));
+  return url.toString();
+}
+const _warnedKeys = new Set;
+function warnOnce(key, message) {
+  if (_warnedKeys.has(key))
+    return;
+  _warnedKeys.add(key);
+  console.warn(message);
+}
+export function signedUrl(routeName, params = {}, options = {}) {
+  return signUrl(buildUrl(routeName, params), options);
+}
+export function verifySignedUrl(input) {
+  const url = typeof input === "string" ? new URL(input, process.env.APP_URL || "https://localhost") : input, presented = url.searchParams.get(SIGNATURE_PARAM);
+  if (!presented)
+    return { valid: !1, reason: "missing-signature" };
+  const expiresRaw = url.searchParams.get(EXPIRES_PARAM);
+  if (expiresRaw !== null) {
+    const expires = Number.parseInt(expiresRaw, 10);
+    if (!Number.isFinite(expires) || Date.now() / 1000 > expires)
+      return { valid: !1, reason: "expired" };
+  }
+  try {
+    const expected = hmacHex(buildSignaturePayload(url), getSigningSecret());
+    return safeEqualHex(presented, expected) ? { valid: !0 } : { valid: !1, reason: "invalid-signature" };
+  } catch {
+    return { valid: !1, reason: "invalid-signature" };
+  }
+}
+export async function verifySignedUrlMiddleware(req) {
+  const result = verifySignedUrl(req.url);
+  if (result.valid)
+    return;
+  const status = result.reason === "expired" ? 410 : 401;
+  throw Response.json({ error: result.reason }, { status });
+}