@thoughtpivot/flight 2.0.2 → 3.0.1

package/src/bun/session.ts

@@ -0,0 +1,123 @@
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto'
+
+import type { SessionConfig } from './config'
+import { preserveStreaming, type Middleware } from './middleware'
+import type { KVStore } from './store'
+
+/** Request carrying the mutable session object. */
+export interface SessionRequest extends Request {
+    session?: Record<string, unknown>
+}
+
+/**
+ * HMAC-sign a session id. The mac is base64url so it is cookie-safe.
+ */
+function sign(value: string, secret: string): string {
+    const mac = createHmac('sha256', secret).update(value).digest('base64url')
+    return `${value}.${mac}`
+}
+
+/**
+ * Return the value when the HMAC matches. Reject tampered cookies.
+ */
+function unsign(signed: string, secret: string): string | null {
+    const splitAt = signed.lastIndexOf('.')
+    if (splitAt < 0) return null
+    const value = signed.slice(0, splitAt)
+    const mac = signed.slice(splitAt + 1)
+    const expected = createHmac('sha256', secret).update(value).digest('base64url')
+    const actualBytes = Buffer.from(mac)
+    const expectedBytes = Buffer.from(expected)
+    if (actualBytes.length !== expectedBytes.length) return null
+    return timingSafeEqual(actualBytes, expectedBytes) ? value : null
+}
+
+/**
+ * Parse a Cookie header into a name/value map.
+ */
+function parseCookies(header: string | null): Record<string, string> {
+    const cookies: Record<string, string> = {}
+    if (!header) return cookies
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=')
+        if (eq < 0) continue
+        const name = part.slice(0, eq).trim()
+        const value = part.slice(eq + 1).trim()
+        if (name) cookies[name] = decodeURIComponent(value)
+    }
+    return cookies
+}
+
+/**
+ * Serialize one Set-Cookie attribute string.
+ */
+function serializeCookie(name: string, value: string, maxAgeSec: number): string {
+    return [`${name}=${encodeURIComponent(value)}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${maxAgeSec}`].join(
+        '; '
+    )
+}
+
+/**
+ * Append a Set-Cookie header without dropping ones already on the response.
+ */
+function appendSetCookie(response: Response, cookie: string): Response {
+    const headers = new Headers(response.headers)
+    headers.append('set-cookie', cookie)
+    return preserveStreaming(
+        response,
+        new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers
+        })
+    )
+}
+
+/**
+ * Signed-cookie sessions backed by the KV store.
+ * The cookie is issued only after the session holds data, so anonymous requests stay cookie-free.
+ * There is no default secret: sessions stay off until `FLIGHT_SESSION_SECRET` is set.
+ */
+export function session(cfg: SessionConfig, store: KVStore): Middleware {
+    return async (req, next) => {
+        const cookies = parseCookies(req.headers.get('cookie'))
+        const raw = cookies[cfg.cookie]
+        const sessionRequest = req as SessionRequest
+
+        let sid: string | null = null
+        let data: Record<string, unknown> = {}
+        if (raw) {
+            const verified = unsign(raw, cfg.secret)
+            if (verified) {
+                sid = verified
+                const stored = await store.get(`sess:${sid}`)
+                if (stored) {
+                    try {
+                        data = JSON.parse(stored) as Record<string, unknown>
+                    } catch {
+                        data = {}
+                    }
+                }
+            }
+        }
+
+        const before = JSON.stringify(data)
+        sessionRequest.session = data
+        const response = await next()
+        const after = JSON.stringify(sessionRequest.session ?? {})
+        const isEmpty = after === '{}'
+
+        if (sid && isEmpty && before !== '{}') {
+            await store.del(`sess:${sid}`)
+            return appendSetCookie(response, serializeCookie(cfg.cookie, '', 0))
+        }
+        if (isEmpty) return response
+
+        if (!sid) sid = randomUUID()
+        await store.set(`sess:${sid}`, after, cfg.ttlSec)
+        if (!raw || unsign(raw, cfg.secret) !== sid) {
+            return appendSetCookie(response, serializeCookie(cfg.cookie, sign(sid, cfg.secret), cfg.ttlSec))
+        }
+        return response
+    }
+}

package/src/bun/static.ts

@@ -0,0 +1,72 @@
+import { join, resolve, sep } from 'node:path'
+
+/**
+ * True when the last path segment looks like a file name (`app.js`, `secret.txt`).
+ */
+function lastSegmentLooksLikeFile(pathname: string): boolean {
+    const base = pathname.slice(pathname.lastIndexOf('/') + 1)
+    return base.includes('.')
+}
+
+/**
+ * True when `pathname` is exactly `prefix` or a child of it.
+ */
+function hasPrefix(pathname: string, prefix: string): boolean {
+    return pathname === prefix || (prefix !== '/' && pathname.startsWith(`${prefix}/`))
+}
+
+/**
+ * Resolve `pathname` under `root`. Returns null when the target escapes the root.
+ */
+export function safeTarget(root: string, pathname: string): string | null {
+    const base = resolve(root)
+    const target = resolve(base, `.${pathname}`)
+    if (target !== base && !target.startsWith(base + sep)) return null
+    return target
+}
+
+/**
+ * Serve a built SPA from `distPath` with an `index.html` fallback for document navigations.
+ * Development mode returns null so Vite owns the UI. `/api`, `/health`, and `/healthz` never fall back.
+ */
+export function makeStaticHandler(distPath: string, mode: string, denyPrefixes: string[]) {
+    const indexPath = join(distPath, 'index.html')
+    const root = resolve(distPath)
+
+    return async function serveStatic(req: Request): Promise<Response | null> {
+        if (mode !== 'production') return null
+        if (req.method !== 'GET' && req.method !== 'HEAD') return null
+
+        const url = new URL(req.url)
+        let pathname: string
+        try {
+            pathname = decodeURIComponent(url.pathname)
+        } catch {
+            return new Response('Bad Request', { status: 400 })
+        }
+
+        if (denyPrefixes.some((prefix) => hasPrefix(pathname, prefix))) return null
+
+        const target = safeTarget(root, pathname)
+        if (!target) return new Response('Forbidden', { status: 403 })
+
+        if (target !== root) {
+            const file = Bun.file(target)
+            if (await file.exists()) {
+                return new Response(req.method === 'HEAD' ? null : file)
+            }
+        }
+
+        const accept = req.headers.get('accept') || ''
+        const wantsHtml = !accept || accept.includes('text/html') || accept.includes('*/*')
+        if (!wantsHtml || lastSegmentLooksLikeFile(pathname)) return null
+
+        const index = Bun.file(indexPath)
+        if (await index.exists()) {
+            return new Response(req.method === 'HEAD' ? null : index, {
+                headers: { 'content-type': 'text/html; charset=utf-8' }
+            })
+        }
+        return null
+    }
+}

package/src/bun/store.ts

@@ -0,0 +1,128 @@
+/** Key/value store shared by sessions and the response cache. */
+export interface KVStore {
+    get(key: string): Promise<string | null>
+    set(key: string, value: string, ttlSec: number): Promise<void>
+    del(key: string): Promise<void>
+}
+
+/**
+ * In-process store used when Redis is unset or unreachable.
+ */
+class MemoryStore implements KVStore {
+    private entries = new Map<string, { value: string; exp: number }>()
+
+    /** Read a value, dropping it when the TTL has passed. */
+    async get(key: string): Promise<string | null> {
+        const entry = this.entries.get(key)
+        if (!entry) return null
+        if (entry.exp && entry.exp < Date.now()) {
+            this.entries.delete(key)
+            return null
+        }
+        return entry.value
+    }
+
+    /** Store a value. A non-positive TTL means no expiry. */
+    async set(key: string, value: string, ttlSec: number): Promise<void> {
+        this.entries.set(key, { value, exp: ttlSec > 0 ? Date.now() + ttlSec * 1000 : 0 })
+    }
+
+    /** Remove a key. */
+    async del(key: string): Promise<void> {
+        this.entries.delete(key)
+    }
+}
+
+/**
+ * Bun's built-in Redis client. Typed loosely because the surface varies by Bun version.
+ */
+class RedisStore implements KVStore {
+    constructor(private client: any) {}
+
+    /** Read a Redis string. */
+    async get(key: string): Promise<string | null> {
+        return await this.client.get(key)
+    }
+
+    /** Write a Redis string with an optional EX expiry. */
+    async set(key: string, value: string, ttlSec: number): Promise<void> {
+        if (ttlSec > 0) await this.client.send('SET', [key, value, 'EX', String(ttlSec)])
+        else await this.client.set(key, value)
+    }
+
+    /** Delete a Redis key. */
+    async del(key: string): Promise<void> {
+        await this.client.del(key)
+    }
+}
+
+/**
+ * Use Redis until a command fails, then stay on the in-memory store.
+ */
+class FallbackStore implements KVStore {
+    private degraded = false
+
+    constructor(
+        private primary: KVStore,
+        private fallback: KVStore,
+        private label: string
+    ) {}
+
+    /** Log the first Redis failure and switch to memory. */
+    private trip(err: unknown) {
+        if (this.degraded) return
+        this.degraded = true
+        const message = err instanceof Error ? err.message : String(err)
+        console.warn(`flight-bun: ${this.label} store degraded to in-memory (Redis error): ${message}`)
+    }
+
+    /** Read from Redis, or from memory after a failure. */
+    async get(key: string): Promise<string | null> {
+        if (this.degraded) return this.fallback.get(key)
+        try {
+            return await this.primary.get(key)
+        } catch (err) {
+            this.trip(err)
+            return this.fallback.get(key)
+        }
+    }
+
+    /** Write to Redis, or to memory after a failure. */
+    async set(key: string, value: string, ttlSec: number): Promise<void> {
+        if (this.degraded) return this.fallback.set(key, value, ttlSec)
+        try {
+            await this.primary.set(key, value, ttlSec)
+        } catch (err) {
+            this.trip(err)
+            await this.fallback.set(key, value, ttlSec)
+        }
+    }
+
+    /** Delete from Redis, or from memory after a failure. */
+    async del(key: string): Promise<void> {
+        if (this.degraded) return this.fallback.del(key)
+        try {
+            await this.primary.del(key)
+        } catch (err) {
+            this.trip(err)
+            await this.fallback.del(key)
+        }
+    }
+}
+
+/**
+ * Redis when `FLIGHT_REDIS_URL` is set, otherwise memory.
+ * A down Redis degrades the request instead of failing it.
+ */
+export function createStore(redisUrl: string | undefined, label: string): KVStore {
+    const memory = new MemoryStore()
+    if (!redisUrl) return memory
+    try {
+        const client = new Bun.RedisClient(redisUrl)
+        return new FallbackStore(new RedisStore(client), memory, label)
+    } catch (err) {
+        const message = err instanceof Error ? err.message : String(err)
+        console.warn(`flight-bun: ${label} store could not init Redis, using in-memory: ${message}`)
+        return memory
+    }
+}

package/src/flight.ts

@@ -21,6 +21,7 @@ import ratelimit from 'koa-ratelimit'
 import serve from 'koa-static'
 import session from 'koa-session'
 
+import { backendDiscoveryIgnorePatterns, dedupeStrings, mergeExcludePaths } from './backend-discovery.js'
 import {
     applyTrustProxy,
     httpCacheEnabledInSpaPipeline,
@@ -45,45 +46,6 @@ interface FlightArgv {
     exclude_paths?: string[]
 }
 
-function normalizeExcludePaths(value: unknown): string[] {
-    if (value == null || value === '') return []
-    const parts = Array.isArray(value) ? value : [value]
-    const out: string[] = []
-    for (const p of parts) {
-        const s = String(p).trim()
-        if (!s) continue
-        out.push(
-            ...s
-                .split(',')
-                .map((x) => x.trim())
-                .filter(Boolean)
-        )
-    }
-    return out
-}
-
-function dedupeStrings(items: string[]): string[] {
-    return [...new Set(items)]
-}
-
-/** Build fast-glob ignore globs for trees rooted under `appRootAbs`. */
-function backendDiscoveryIgnorePatterns(appRootAbs: string, excludeRelativeDirs: string[]): string[] {
-    const patterns: string[] = []
-    for (const raw of excludeRelativeDirs) {
-        const trimmed = raw.trim()
-        if (!trimmed) continue
-        const resolved = path.resolve(appRootAbs, trimmed)
-        const rel = path.relative(appRootAbs, resolved)
-        const relPosix = rel.replace(/\\/g, '/')
-        if (!relPosix || relPosix.startsWith('..') || path.isAbsolute(rel)) {
-            console.warn(`Flight: exclude_paths entry skipped (outside app_home): ${trimmed}`)
-            continue
-        }
-        patterns.push(`${relPosix}/**`)
-    }
-    return patterns
-}
-
 // tsx (and similar loaders) may expose require('yargs/yargs') as { default: factory } instead of factory.
 interface YargsInstance {
     option(key: string, opts: Record<string, unknown>): YargsInstance
@@ -102,7 +64,7 @@ const argv = yargsEntry(process.argv.slice(2))
     })
     .option('mode', {
         type: 'string',
-        describe: 'development (Vite HMR) or production'
+        describe: 'development (Vite HMR for Vue/React per vite.config) or production'
     })
     .option('port', {
         type: 'number',
@@ -188,10 +150,7 @@ if (argv.disable_vite === undefined) {
 argv.disable_vite = Boolean(argv.disable_vite)
 
 const appHomePath = path.resolve(argv.app_home)
-const excludePathsConfigured = dedupeStrings([
-    ...normalizeExcludePaths(argv.exclude_paths),
-    ...normalizeExcludePaths(process.env.FLIGHT_EXCLUDE_PATHS)
-])
+const excludePathsConfigured = mergeExcludePaths(argv.exclude_paths, process.env.FLIGHT_EXCLUDE_PATHS)
 const backendDiscoveryIgnores = backendDiscoveryIgnorePatterns(appHomePath, excludePathsConfigured)
 
 process.chdir(appHomePath)
@@ -359,12 +318,12 @@ if (cluster.isPrimary) {
         })
 
         viteProcess.on('error', (error) => {
-            console.error('Failed to start vite server:', error)
+            console.error('Failed to start Vite dev server:', error)
         })
 
         viteProcess.on('exit', (code) => {
             if (code !== 0) {
-                console.error(`Vite server exited with code ${code}`)
+                console.error(`Vite dev server exited with code ${code}`)
             }
         })
 
@@ -373,6 +332,6 @@ if (cluster.isPrimary) {
             process.exit(0)
         })
 
-        console.log(`Vite development server with hot module reload ${process.pid} started on 3001`)
+        console.log(`Vite dev server (HMR for Vue/React per your vite.config) for worker ${process.pid} on port 3001`)
     }
 }

package/LICENSE.md

@@ -1,19 +0,0 @@
-# MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.