@starklabs/backend-core 1.1.1 → 1.2.1

package/dist/js/core/auth/auth.validation.js

@@ -0,0 +1,95 @@
+import { z } from "zod";
+import { userIdSchema } from "../../utils/userIdValidation.js";
+
+const emailSchema = z
+  .string()
+  .trim()
+  .min(1, "Email is required")
+  .email("Invalid email");
+
+const passwordSchema = z
+  .string()
+  .min(12, "Password must be at least 12 characters");
+
+const providerSchema = z.string().min(1, "Provider is required");
+
+const nameSchema = (field) =>
+  z
+    .string()
+    .trim()
+    .min(1, `${field} is required`)
+    .min(3, `${field} must be at least 3 characters`)
+    .max(50, `${field} too long`);
+
+// signup schema
+const signupSchema = z
+  .object({
+    firstName: nameSchema("FirstName"),
+
+    lastName: nameSchema("LastName"),
+
+    email: emailSchema,
+
+    password: passwordSchema,
+
+    role: z.string().default("user"),
+  })
+  .strict();
+
+// 2fa schema
+const twoFactorAuthSchema = z
+  .object({
+    email: emailSchema,
+
+    otp: z.string().length(6, "OTP must be exactly 6 characters"),
+  })
+  .strict();
+
+// resend OTP schema
+const resendOTPSchema = z
+  .object({
+    email: emailSchema,
+  })
+  .strict();
+
+// login schema
+const loginSchema = z
+  .object({
+    email: emailSchema,
+    password: passwordSchema,
+  })
+  .strict();
+
+// forgot password schema
+const forgotPasswordSchema = z
+  .object({
+    email: emailSchema,
+  })
+  .strict();
+
+// reset password schema
+const resetPasswordSchema = z
+  .object({
+    email: emailSchema,
+    password: passwordSchema,
+  })
+  .strict();
+
+// logout schema
+const logoutSchema = z
+  .object({
+    email: emailSchema,
+    provider: providerSchema,
+    userId: userIdSchema,
+  })
+  .strict();
+
+export default {
+  loginSchema,
+  signupSchema,
+  twoFactorAuthSchema,
+  resendOTPSchema,
+  forgotPasswordSchema,
+  resetPasswordSchema,
+  logoutSchema,
+};

package/dist/js/core/crud/crud.controller.js

@@ -0,0 +1,95 @@
+import { app } from "../app.js";
+import mongoose, { model } from "mongoose";
+import asyncHandler from "../../utils/asyncHandler.js";
+import crudService from "./crud.service.js";
+import registerModel from "../../lib/model.registry.js";
+import AppError from "../../utils/AppError.js";
+import zodValidations from "../../lib/zod.validations.js";
+import z from "zod";
+import protect from "../../middleware/auth.middleware.js";
+
+const validateCookie = async (validations, user, isValidCookie) => {
+  const zodCookieObj = z.object(validations.cookieValidation);
+  isValidCookie = await zodCookieObj.safeParse(user);
+
+  if (!isValidCookie.success) {
+    const issue = isValidCookie.error.issues[0];
+    if (issue.code === "invalid_type")
+      throw new AppError(`${issue.path.join(".")} is required`);
+
+    throw new AppError(issue.message, 409);
+  }
+
+  return isValidCookie;
+};
+
+const crud = (route, routes, modelName, validations, apiVersion) => {
+  routes.forEach((el) => {
+    const middlewares = [];
+    if (el.method !== "get" || el.path !== "/") middlewares.push(protect);
+    if (el.middleware) middlewares.push(el.middleware);
+    if (el.middlewares) middlewares.push(...el.middlewares);
+
+    app[el.method](
+      `/api/v${apiVersion}/${route}${el.path}`,
+      ...middlewares,
+      asyncHandler(async (req, res) => {
+        const Model = registerModel[modelName];
+        if (!Model && el.modelName)
+          throw new Error(`Model not found for endpoint: ${el.path}`);
+
+        // if not getAll and cookie - validation
+        let isValidCookie = undefined;
+        if (el.method !== "get" || el.path !== "/") {
+          isValidCookie = await validateCookie(
+            validations,
+            req.user,
+            isValidCookie,
+          );
+        }
+
+        // req.body - validation
+        const payload = {
+          ...req.body,
+          image: req.file,
+        };
+
+        const validationObj =
+          validations && validations[el.handler]
+            ? z.object(validations[el.handler])
+            : z.object({});
+
+        const zodBodyObj = validationObj;
+
+        const isValidBody = zodBodyObj.safeParse(payload || {});
+
+        if (!isValidBody.success) {
+          const issue = isValidBody.error.issues[0];
+          if (issue.code === "invalid_type")
+            throw new AppError(`${issue.path.join(".")} is required`);
+
+          throw new AppError(issue.message, 409);
+        }
+
+        // send data to service
+        const result = await crudService[el.handler]({
+          Model,
+          modelName,
+          body: isValidBody?.data,
+          userData: isValidCookie?.data,
+          id: req?.params?.id,
+          fileType: el?.fileType,
+          metaDataName: el?.metaDataName,
+        });
+
+        return res.json({
+          success: true,
+          data: result?.data,
+          message: result?.msg,
+        });
+      }),
+    );
+  });
+};
+
+export default crud;

package/dist/js/core/crud/crud.service.js

@@ -0,0 +1,296 @@
+import { getConfig } from "../../config/config.js";
+import { hash } from "../../utils/libsodium.js";
+import { AppError, uploadFile, deleteFile } from "../../utils/index.js";
+
+const sanitize = (doc) => {
+  if (!doc) return doc;
+  const { __v, password, ...clean } = doc;
+  return clean;
+};
+
+const authorizeAccess = ({ ownerEmail, dataEmail, role }) => {
+  const { internalRoles } = getConfig();
+
+  if (!internalRoles?.length)
+    throw new AppError("internalRoles is missing in StarkCore({})");
+
+  const isInternalRuler = internalRoles.includes(role);
+  const isOwner = ownerEmail === dataEmail;
+
+  if (!isInternalRuler && !isOwner) throw new AppError("Unauthorized", 401);
+};
+
+const assertInternalRole = (role) => {
+  const { internalRoles } = getConfig();
+
+  const isInternalRuler = internalRoles.includes(role);
+  if (!isInternalRuler) throw new AppError("Unauthorized", 401);
+};
+
+const showHealth = () => {
+  return {
+    msg: "All clear!",
+  };
+};
+
+const getAll = async ({ Model, modelName }) => {
+  const data = await Model.find().lean();
+
+  if (!data.length) {
+    throw new AppError(`${modelName} not found`, 404);
+  }
+
+  return {
+    data: data.map(sanitize),
+    msg: "Fetched all successfully",
+  };
+};
+
+const getById = async ({ Model, modelName, id, userData, body }) => {
+  const data = await Model.findById(id).lean();
+
+  if (!data) {
+    throw new AppError(`${modelName} with id ${id} not found`, 404);
+  }
+
+  authorizeAccess({
+    ownerEmail: userData.email,
+    dataEmail: data.email,
+    role: userData.role,
+  });
+
+  return {
+    data: sanitize(data),
+    msg: "Fetched successfully",
+  };
+};
+
+const create = async ({ Model, modelName, userData, body }) => {
+  assertInternalRole(userData.role);
+
+  const { cloudinaryFolderName } = getConfig();
+
+  // if image
+  let imageMetaData = undefined;
+  if (body.image) {
+    imageMetaData = await uploadFile(body.image, cloudinaryFolderName);
+  }
+
+  // if user
+  if (body.email) {
+    const exists = await Model.findOne({ email: body.email });
+    if (exists) {
+      throw new AppError(`${modelName} with this email already exists`, 409);
+    }
+  }
+
+  if (body.password) body.password = await hash(body.password);
+
+  const newItem = await Model.create({
+    ...body,
+    role: "user",
+    imageMetaData,
+  });
+
+  return {
+    data: sanitize(newItem.toObject()),
+    msg: "Created successfully",
+  };
+};
+
+const update = async ({ Model, modelName, id, body, userData }) => {
+  assertInternalRole(userData.role);
+
+  if (body.password) {
+    body.password = await hash(body.password);
+  }
+
+  const existing = await Model.findById(id);
+
+  if (!existing) {
+    throw new AppError(`${modelName} not found for update`, 404);
+  }
+
+  const { cloudinaryFolderName } = getConfig();
+
+  let imageMetaData;
+  if (body.image) {
+    imageMetaData = await uploadFile(body.image, cloudinaryFolderName);
+  }
+
+  try {
+    const replacementDoc = {
+      ...body,
+      ...(imageMetaData && { imageMetaData }),
+    };
+
+    // Prevent storing raw file object/base64/etc.
+    delete replacementDoc.image;
+
+    const updated = await Model.findOneAndReplace({ _id: id }, replacementDoc, {
+      returnDocument: "after",
+    }).lean();
+
+    // Delete old image after successful replacement
+    if (imageMetaData && existing.imageMetaData?.public_id) {
+      await deleteFile(existing.imageMetaData.public_id);
+    }
+
+    return {
+      data: sanitize(updated),
+      msg: "Updated successfully",
+    };
+  } catch (error) {
+    // Rollback newly uploaded image
+    if (imageMetaData?.public_id) {
+      await deleteFile(imageMetaData.public_id).catch(() => {});
+    }
+
+    if (error.message.includes("duplicate key error")) {
+      throw new AppError(`${modelName} with these detail already exists`);
+    }
+
+    throw error;
+  }
+};
+
+const patch = async ({ Model, modelName, id, body, userData }) => {
+  assertInternalRole(userData.role);
+
+  if (body.password) {
+    body.password = await hash(body.password);
+  }
+
+  const existing = await Model.findById(id);
+
+  if (!existing) {
+    throw new AppError(`${modelName} not found for patch`, 404);
+  }
+
+  const { cloudinaryFolderName } = getConfig();
+
+  let imageMetaData;
+  if (body.image) {
+    // Upload new image first
+    imageMetaData = await uploadFile(body.image, cloudinaryFolderName);
+  }
+
+  try {
+    const updated = await Model.findByIdAndUpdate(
+      id,
+      {
+        $set: {
+          ...body,
+          ...(imageMetaData && { imageMetaData }),
+        },
+      },
+      { returnDocument: "after" },
+    ).lean();
+
+    // Delete old image only after successful DB update
+    if (imageMetaData && existing.imageMetaData?.public_id) {
+      await deleteFile(existing.imageMetaData.public_id);
+    }
+
+    return {
+      data: sanitize(updated),
+      msg: "Updated successfully!",
+    };
+  } catch (error) {
+    // Rollback newly uploaded image if DB update fails
+    if (imageMetaData?.public_id) {
+      await deleteFile(imageMetaData.public_id).catch(() => {});
+    }
+
+    if (error.message.includes("duplicate key error")) {
+      throw new AppError(`${modelName} with these detail already exists`);
+    }
+
+    throw error;
+  }
+};
+
+const remove = async ({ Model, modelName, id, userData }) => {
+  assertInternalRole(userData.role);
+
+  const deleted = await Model.findByIdAndDelete(id).lean();
+
+  if (!deleted) {
+    throw new AppError(`${modelName} not found for delete`, 404);
+  }
+
+  return {
+    data: sanitize(deleted),
+    msg: "Deleted successfully",
+  };
+};
+
+const removeFile = async ({
+  Model,
+  modelName,
+  id,
+  userData,
+  fileType,
+  metaDataName,
+}) => {
+  if (!fileType)
+    throw new AppError(
+      `fileType is required in ${modelName.toLowerCase()} collection`,
+    );
+
+  if (!metaDataName)
+    throw new AppError(
+      `metaDataName is required in ${modelName.toLowerCase()} collection`,
+    );
+
+  assertInternalRole(userData.role);
+
+  const item = await Model.findById(id);
+  if (!item) throw new AppError(`${modelName} not found to delete file`);
+
+  if (Object.keys(item[metaDataName]).length === 0)
+    throw new AppError(`${fileType} not found to delete`);
+
+  if (Object.keys(item[metaDataName].toObject()).length === 0)
+    throw new AppError(`${fileType} not found to delete`);
+
+  const deleted = await deleteFile(item[metaDataName].public_id, fileType);
+
+  item[metaDataName] = undefined;
+
+  item.save();
+
+  return {
+    data: item,
+    msg: "File deleted successfully",
+  };
+};
+
+const removeAll = async ({ Model, modelName, id, userData }) => {
+  assertInternalRole(userData.role);
+
+  const deleted = await Model.deleteMany();
+
+  if (!deleted) {
+    throw new AppError(`${modelName} not found for delete`, 404);
+  }
+
+  return {
+    data: sanitize(deleted),
+    msg: "Deleted all successfully",
+  };
+};
+
+// by deleting all, also delete the images from cloudinary 1/1
+
+export default {
+  showHealth,
+  getAll,
+  getById,
+  create,
+  update,
+  patch,
+  remove,
+  removeFile,
+  removeAll,
+};

package/dist/js/core/index.js

@@ -0,0 +1,3 @@
+export { startServer, app } from "./app.js";
+export { default as crud } from "./crud/crud.controller.js";
+export { default as auth } from "./auth/auth.controller.js";

package/dist/js/index.js

@@ -1,66 +1,55 @@
-// connectDB - connects MongoDB database
-import connectDB from "./db.js";
+import { setConfig } from "./config/config.js";
+
+/**
+ * @typedef {Object} StarkCoreConfig
+ * @property {number} port - *Server listening port number*
+ * @property {Array<object>} collections - *Routes detail*
+ * @property {string} apiVersion - *Current API version*
+ * @property {string} jwtSecret - *Used for JSON Web Token functionalities*
+ * @property {boolean} isOffline - *Connects to local MongoDB instance*
+ * @property {string} masterKey - *Used for encryption/decryption operations*
+ * @property {string} ENV - *Current application environment (e.g. development, production)*
+ * @property {string} tokenExpiry - *JWT/token expiration duration*
+ * @property {Array<string>} internalRoles - *List of internal roles with elevated permissions*
+ * @property {string} resendAPIKey - *API key used for Resend email services*
+ * @property {string|number} rateLimitDuration - *Duration for rate limiting window*
+ * @property {number} maxReqLimit - *Maximum allowed requests within rate limit duration*
+ * @property {string} rateLimitMsg - *Message returned when rate limit is exceeded*
+ * @property {string} cloudinaryAPIKey - *Cloudinary API key*
+ * @property {string} cloudinaryCloudName - *Cloudinary cloud name*
+ * @property {string} cloudinaryAPISecret - *Cloudinary API secret*
+ * @property {string} cloudinaryFolderName - *Default Cloudinary folder for uploads*
+ */
+
+class StarkCore {
+  /**
+   * @param {StarkCoreConfig} config
+   */
 
-// seal/unSeal - encrypt and decrypt data
-import { seal, unSeal } from "./utils/libsodium.js";
-import { signJWT, verifyJWT } from "./utils/jwt.js";
-
-class StarkAuth {
-  #_masterKey;
-  #_JWT_SECRET;
-  #_JWT_EXPIRY;
-
-  // constructor - store keys etc.
   constructor(config) {
-    this.#_masterKey = config.MASTER_KEY;
-    this.#_JWT_SECRET = config.JWT_SECRET;
-    this.#_JWT_EXPIRY = config.JWT_EXPIRY;
-  }
-
-  // create - initializes DB and auth instance
-  static async create(config) {
-    await connectDB(config.MONGODB_URI, config.DB_NAME);
-    return new StarkAuth(config);
-  }
-
-  // encrypt - encrypts string using master key
-  async encrypt(str) {
-    return seal(str, this.#_masterKey);
-  }
-
-  // decrypt - decrypts string using master key
-  async decrypt(str, nonce, publicKey, securedPrivateKey) {
-    return unSeal(str, nonce, publicKey, securedPrivateKey, this.#_masterKey);
+    setConfig(config);
   }
 
-  // signJWT
-  signJWT(payLoad) {
-    return signJWT(payLoad, this.#_JWT_SECRET, this.#_JWT_EXPIRY);
-  }
+  /**
+   * @param {StarkCoreConfig} config
+   * @returns {StarkCore}
+   */
 
-  // verifyJWT
-  verifyJWT(token) {
-    return verifyJWT(token, this.#_JWT_SECRET);
+  static create(config) {
+    return new StarkCore(config);
   }
 }
 
-export default StarkAuth;
-
-// crypto - exports hashing utilities
-import { generateMasterKey, generateJWTSecret, hash, verifyHash } from "./utils/libsodium.js";
-
-export const crypto = {
-  generateMasterKey,
+export default StarkCore;
+export { startServer } from "./core/index.js";
+export { default as fieldTypes } from "./lib/field.types.js";
+export { default as zodValidations } from "./lib/zod.validations.js";
+export {
+  AppLog,
   generateJWTSecret,
+  generateMasterKey,
   hash,
+  seal,
+  unSeal,
   verifyHash,
-};
-
-// AppError - custom application error class
-export { default as AppError } from "./utils/AppError.js";
-
-// AppLog - structured logging utility
-export { default as AppLog } from "./utils/AppLog.js";
-
-// async handler - AppError in async functions
-export { default as asyncHandler } from "./utils/asyncHandler.js";
+} from "./utils/index.js";

package/dist/js/lib/db.js

@@ -0,0 +1,40 @@
+// module imports
+import mongoose from "mongoose";
+
+import AppLog from "../utils/AppLog.js";
+
+const connectLocally = async () => {
+  await mongoose.connect(`mongodb://localhost:27017/offline-db`);
+  AppLog("check", "db", "Connected to OFFLINE-DB!");
+};
+
+// connecting to db
+/**
+ *
+ * @param {"MONGODB_URI"} uri
+ * @param {"DATABASE_NAME"} database
+ * @param {true | false} NETWORK
+ * @returns
+ */
+const connectDB = async (
+  MONGODB_URI = "",
+  DATABASE_NAME = "starklabs",
+  NETWORK = false,
+) => {
+  const mongodbUri = MONGODB_URI || "mongodb://localhost:27017";
+  try {
+    if (!NETWORK) {
+      await connectLocally();
+      return;
+    }
+
+    await mongoose.connect(`${mongodbUri}/${DATABASE_NAME}`);
+    AppLog("check", "db", "Connected successfully!");
+  } catch (error) {
+    AppLog("X", "db", "Error while connecting!");
+    AppLog("X", "db", error.message);
+  }
+};
+
+// export
+export default connectDB;