@vertz/server 0.2.1 → 0.2.4

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { AccumulateProvides, AppBuilder as AppBuilder2, AppConfig as AppConfig2, BootInstruction, BootSequence, CorsConfig, Ctx, DeepReadonly, Deps, EnvConfig, ExtractMethods, HandlerCtx, HttpMethod, HttpStatusCode, Infer, InferSchema, ListenOptions, MiddlewareDef, Module, ModuleBootInstruction, ModuleDef, NamedMiddlewareDef, NamedModule, NamedModuleDef, NamedRouterDef, NamedServiceDef, RawRequest, ResolveInjectMap, RouterDef, ServerAdapter, ServerHandle, ServiceBootInstruction, ServiceDef, ServiceFactory } from "@vertz/core";
-import { BadRequestException, ConflictException, createEnv, createImmutableProxy, createMiddleware, createModule, createModuleDef, deepFreeze, ForbiddenException, InternalServerErrorException, makeImmutable, NotFoundException, ServiceUnavailableException, UnauthorizedException, ValidationException, VertzException, vertz } from "@vertz/core";
+import { AccumulateProvides, AppBuilder as AppBuilder2, AppConfig as AppConfig2, CorsConfig, Ctx, DeepReadonly, Deps, EnvConfig, HandlerCtx, HttpMethod, HttpStatusCode, Infer, InferSchema, ListenOptions, MiddlewareDef, NamedMiddlewareDef, RawRequest, ServerAdapter, ServerHandle } from "@vertz/core";
+import { BadRequestException, ConflictException, createEnv, createImmutableProxy, createMiddleware, deepFreeze, ForbiddenException, InternalServerErrorException, makeImmutable, NotFoundException, ServiceUnavailableException, UnauthorizedException, ValidationException, VertzException, vertz } from "@vertz/core";
 import { ModelDef as ModelDef2, RelationDef, SchemaLike, TableDef } from "@vertz/db";
 import { ModelDef } from "@vertz/db";
 import { EntityDbAdapter, ListOptions } from "@vertz/db";
@@ -205,6 +205,12 @@ interface AuthConfig {
 	* Defaults to true when process.env is unavailable (secure-by-default for edge runtimes).
 	*/
 	isProduction?: boolean;
+	/**
+	* Directory to persist auto-generated dev JWT secret.
+	* Defaults to `.vertz` in the current working directory.
+	* Only used in non-production mode when jwtSecret is not provided.
+	*/
+	devSecretPath?: string;
 }
 interface AuthUser {
 	id: string;
@@ -420,4 +426,4 @@ interface EntityRouteOptions {
 * Operations explicitly disabled (access: false) get a 405 handler.
 */
 declare function generateEntityRoutes(def: EntityDefinition, registry: EntityRegistry, db: EntityDbAdapter2, options?: EntityRouteOptions): EntityRouteEntry[];
-export { vertz, verifyPassword, validatePassword, stripReadOnlyFields, stripHiddenFields, makeImmutable, hashPassword, generateEntityRoutes, entityErrorHandler, entity, enforceAccess, defaultAccess, deepFreeze, createServer, createModuleDef, createModule, createMiddleware, createImmutableProxy, createEnv, createEntityContext, createCrudHandlers, createAuth, createAccess, action, VertzException, ValidationException, UnauthorizedException, SignUpInput, SignInInput, SessionStrategy, SessionPayload, SessionConfig, Session, ServiceUnavailableException, ServiceFactory, ServiceDef, ServiceBootInstruction, ServerHandle, ServerConfig, ServerAdapter, RouterDef, Resource, ResolveInjectMap, RequestInfo, RawRequest, RateLimitResult, RateLimitConfig, PasswordRequirements, NotFoundException, NamedServiceDef, NamedRouterDef, NamedModuleDef, NamedModule, NamedMiddlewareDef, ModuleDef, ModuleBootInstruction, Module, MiddlewareDef, ListenOptions, ListResult, ListOptions2 as ListOptions, InternalServerErrorException, InferSchema, Infer, HttpStatusCode, HttpMethod, HandlerCtx, ForbiddenException, ExtractMethods, EnvConfig, EntityRouteOptions, EntityRelationsConfig, EntityRegistry, EntityOperations, EntityErrorResult, EntityDefinition, EntityDbAdapter2 as EntityDbAdapter, EntityContext, EntityConfig, EntityActionDef, EntitlementDefinition, Entitlement, EmailPasswordConfig, Deps, DeepReadonly, Ctx, CrudResult, CrudHandlers, CorsConfig, CookieConfig, ConflictException, BootSequence, BootInstruction, BaseContext, BadRequestException, AuthorizationError, AuthUser, AuthInstance, AuthContext, AuthConfig, AuthApi, AppConfig2 as AppConfig, AppBuilder2 as AppBuilder, ActionDefinition, ActionContext, ActionConfig, ActionActionDef, AccumulateProvides, AccessRule, AccessInstance, AccessConfig };
+export { vertz, verifyPassword, validatePassword, stripReadOnlyFields, stripHiddenFields, makeImmutable, hashPassword, generateEntityRoutes, entityErrorHandler, entity, enforceAccess, defaultAccess, deepFreeze, createServer, createMiddleware, createImmutableProxy, createEnv, createEntityContext, createCrudHandlers, createAuth, createAccess, action, VertzException, ValidationException, UnauthorizedException, SignUpInput, SignInInput, SessionStrategy, SessionPayload, SessionConfig, Session, ServiceUnavailableException, ServerHandle, ServerConfig, ServerAdapter, Resource, RequestInfo, RawRequest, RateLimitResult, RateLimitConfig, PasswordRequirements, NotFoundException, NamedMiddlewareDef, MiddlewareDef, ListenOptions, ListResult, ListOptions2 as ListOptions, InternalServerErrorException, InferSchema, Infer, HttpStatusCode, HttpMethod, HandlerCtx, ForbiddenException, EnvConfig, EntityRouteOptions, EntityRelationsConfig, EntityRegistry, EntityOperations, EntityErrorResult, EntityDefinition, EntityDbAdapter2 as EntityDbAdapter, EntityContext, EntityConfig, EntityActionDef, EntitlementDefinition, Entitlement, EmailPasswordConfig, Deps, DeepReadonly, Ctx, CrudResult, CrudHandlers, CorsConfig, CookieConfig, ConflictException, BaseContext, BadRequestException, AuthorizationError, AuthUser, AuthInstance, AuthContext, AuthConfig, AuthApi, AppConfig2 as AppConfig, AppBuilder2 as AppBuilder, ActionDefinition, ActionContext, ActionConfig, ActionActionDef, AccumulateProvides, AccessRule, AccessInstance, AccessConfig };

package/dist/index.js

@@ -5,8 +5,6 @@ import {
   createEnv,
   createImmutableProxy,
   createMiddleware,
-  createModule,
-  createModuleDef,
   deepFreeze as deepFreeze3,
   ForbiddenException,
   InternalServerErrorException,
@@ -39,6 +37,8 @@ function action(name, config) {
   return deepFreeze(def);
 }
 // src/auth/index.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import {
   createAuthRateLimitedError,
   createAuthValidationError,
@@ -91,17 +91,20 @@ function createAccess(config) {
       return false;
     const allowedRoles = entitlementRoles.get(entitlement);
     if (!allowedRoles) {
-      return true;
+      return false;
     }
     return allowedRoles.has(user.role) || roleHasEntitlement(user.role, entitlement);
   }
   async function can(entitlement, user) {
     return checkEntitlement(entitlement, user);
   }
-  async function canWithResource(entitlement, _resource, user) {
+  async function canWithResource(entitlement, resource, user) {
     const hasEntitlement = await checkEntitlement(entitlement, user);
     if (!hasEntitlement)
       return false;
+    if (resource.ownerId != null && resource.ownerId !== "" && resource.ownerId !== user?.id) {
+      return false;
+    }
     return true;
   }
   async function authorize(entitlement, user) {
@@ -298,10 +301,27 @@ function createAuth(config) {
   } else if (isProduction) {
     throw new Error('jwtSecret is required in production. Provide it via createAuth({ jwtSecret: "..." }).');
   } else {
-    console.warn("Using insecure default JWT secret. Provide jwtSecret in createAuth() config for production.");
-    jwtSecret = "dev-secret-change-in-production";
+    const secretDir = config.devSecretPath ?? join(process.cwd(), ".vertz");
+    const secretFile = join(secretDir, "jwt-secret");
+    if (existsSync(secretFile)) {
+      jwtSecret = readFileSync(secretFile, "utf-8").trim();
+    } else {
+      jwtSecret = crypto.randomUUID() + crypto.randomUUID();
+      mkdirSync(secretDir, { recursive: true });
+      writeFileSync(secretFile, jwtSecret, "utf-8");
+      console.warn(`[Auth] Auto-generated dev JWT secret at ${secretFile}. Add this path to .gitignore.`);
+    }
   }
   const cookieConfig = { ...DEFAULT_COOKIE_CONFIG, ...session.cookie };
+  if (cookieConfig.sameSite === "none" && cookieConfig.secure !== true) {
+    throw new Error("SameSite=None requires secure=true");
+  }
+  if (isProduction && cookieConfig.secure === false) {
+    throw new Error("Cookie 'secure' flag cannot be disabled in production");
+  }
+  if (!isProduction && cookieConfig.secure === false) {
+    console.warn("Cookie 'secure' flag is disabled. This is allowed in development but must be enabled in production.");
+  }
   const ttlMs = parseDuration(session.ttl);
   const signInLimiter = new RateLimiter(emailPassword?.rateLimit?.window || "15m");
   const signUpLimiter = new RateLimiter("1h");
@@ -468,12 +488,37 @@ function createAuth(config) {
     if (["POST", "PUT", "DELETE", "PATCH"].includes(method)) {
       const origin = request.headers.get("origin");
       const referer = request.headers.get("referer");
-      if (!origin && !referer) {
+      const expectedOrigin = new URL(request.url).origin;
+      let originValid = false;
+      if (origin) {
+        originValid = origin === expectedOrigin;
+      } else if (referer) {
+        try {
+          const refererOrigin = new URL(referer).origin;
+          originValid = refererOrigin === expectedOrigin;
+        } catch {
+          originValid = false;
+        }
+      }
+      if (!originValid) {
         if (isProduction) {
           return new Response(JSON.stringify({ error: "CSRF validation failed" }), {
             status: 403,
             headers: { "Content-Type": "application/json" }
           });
+        } else {
+          console.warn("[Auth] CSRF warning: Origin/Referer missing or mismatched (allowed in development)");
+        }
+      }
+      const vtzHeader = request.headers.get("x-vtz-request");
+      if (vtzHeader !== "1") {
+        if (isProduction) {
+          return new Response(JSON.stringify({ error: "Missing required X-VTZ-Request header" }), {
+            status: 403,
+            headers: { "Content-Type": "application/json" }
+          });
+        } else {
+          console.warn("[Auth] CSRF warning: Missing X-VTZ-Request header (allowed in development)");
         }
       }
     }
@@ -875,7 +920,9 @@ function createActionHandler(def, actionName, actionDef, db, hasId) {
       return err3(new BadRequestError(parseResult.error.message));
     }
     const input = parseResult.data;
-    const result = await actionDef.handler(input, ctx, row);
+    const rawResult = await actionDef.handler(input, ctx, row);
+    const table = def.model.table;
+    const result = rawResult && typeof rawResult === "object" && !Array.isArray(rawResult) ? stripHiddenFields(table, rawResult) : rawResult;
     const afterHooks = def.after;
     const afterHook = afterHooks[actionName];
     if (afterHook) {
@@ -1077,6 +1124,15 @@ function entityErrorHandler(error) {
 
 // src/entity/vertzql-parser.ts
 var MAX_LIMIT = 1000;
+var MAX_Q_BASE64_LENGTH = 10240;
+var ALLOWED_Q_KEYS = new Set([
+  "select",
+  "include",
+  "where",
+  "orderBy",
+  "limit",
+  "offset"
+]);
 function parseVertzQL(query) {
   const result = {};
   for (const [key, value] of Object.entries(query)) {
@@ -1124,9 +1180,18 @@ function parseVertzQL(query) {
     if (key === "q") {
       try {
         const urlDecoded = decodeURIComponent(value);
+        if (urlDecoded.length > MAX_Q_BASE64_LENGTH) {
+          result._qError = "q= parameter exceeds maximum allowed size";
+          continue;
+        }
         const b64 = urlDecoded.replace(/-/g, "+").replace(/_/g, "/");
         const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
         const decoded = JSON.parse(atob(padded));
+        for (const k of Object.keys(decoded)) {
+          if (!ALLOWED_Q_KEYS.has(k)) {
+            delete decoded[k];
+          }
+        }
         if (decoded.select && typeof decoded.select === "object") {
           result.select = decoded.select;
         }
@@ -1644,8 +1709,6 @@ export {
   defaultAccess,
   deepFreeze3 as deepFreeze,
   createServer,
-  createModuleDef,
-  createModule,
   createMiddleware,
   createImmutableProxy,
   createEnv,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vertz/server",
-  "version": "0.2.1",
+  "version": "0.2.4",
   "type": "module",
   "license": "MIT",
   "description": "Vertz server runtime — modules, routing, and auth",
@@ -31,8 +31,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@vertz/core": "0.2.1",
-    "@vertz/db": "0.2.1",
+    "@vertz/core": "0.2.2",
+    "@vertz/db": "0.2.2",
     "@vertz/errors": "0.2.1",
     "bcryptjs": "^3.0.3",
     "jose": "^6.0.11"
@@ -40,7 +40,7 @@
   "devDependencies": {
     "@types/node": "^25.3.1",
     "@vitest/coverage-v8": "^4.0.18",
-    "bunup": "latest",
+    "bunup": "^0.16.31",
     "typescript": "^5.7.0",
     "vitest": "^4.0.18"
   },