npm - @vulkano/core - Versions diffs - 1.27.0 → 1.30.0 - Mend

@vulkano/core 1.27.0 → 1.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/AGENTS.md CHANGED Viewed

@@ -2,7 +2,7 @@
 ## Overview
-`@vulkano/core` (v1.27.0) is the engine of the Vulkano MVC framework. It bootstraps the environment, connects to the database, and auto-loads all models, controllers, services, and responses before starting the Express server. The user app only calls `require('@vulkano/core')`.
+`@vulkano/core` (v1.30.0) is the engine of the Vulkano MVC framework. It bootstraps the environment, connects to the database, and auto-loads all models, controllers, services, and responses before starting the Express server. The user app only calls `require('@vulkano/core')`.
 ```
 /**
@@ -39,7 +39,7 @@ core/
 │   ├── models.js                 ← Loads user models, merges lifecycle callbacks and scaffold methods
 │   └── scaffold.js               ← Base CRUD methods: getAll, getByField, create, update, delete, subdocs
 ├── libs/
-│   ├── ApiClient.js              ← Axios wrapper for outbound HTTP requests
+│   ├── ApiClient.js              ← fetch/undici wrapper for outbound HTTP requests (SSL-verified by default)
 │   ├── Crontab.js                ← node-cron wrapper for scheduled tasks
 │   ├── Download.js               ← File download helper
 │   ├── Encrypter.js              ← AES-256-CBC encrypt/decrypt
@@ -291,7 +291,7 @@ These are set automatically — never import them manually:
 | `Jwt` | `services.js` | JWT encode/decode library |
 | `Encrypter` | `services.js` | AES-256-CBC encrypt/decrypt |
 | `ApiClient` | `services.js` | Outbound HTTP client |
-| `Crontab` | `services.js` | Cron job scheduler |
+| `Crontab` | `services.js` | Cron job scheduler (`timeZone` defaults to `UTC`) |
 | `i18n` | `services.js` | i18next instance |
 | `View` | `services.js` | `View.render(view, data)` → Promise<html>, renders outside the request/response cycle |
 | `_` | `app.js` | Underscore.js |
@@ -589,7 +589,7 @@ All sources are deep-merged with `deepmerge`. Final result is in `app.config`.
 **Key config files:**
 - `settings.js` — port, database connection, paths
-- `express/cors.js`, `express/jwt.js`, `express/csp.js`, `express/cookies.js`
+- `express/cors.js`, `express/jwt.js`, `express/csp.js`, `express/cookies.js`, `express/multer.js` (default `limits.fileSize` 25MB)
 - `routes.js` — explicit route mappings
 - `bootstrap.js` — startup hook (**required**)
 - `sockets/` — Socket.io config and adapters
@@ -616,11 +616,7 @@ Available globally as `io` and `app.socket`.
 ## Known issues / tech debt
-- **`services.js`** — All libs/services are injected into `global`. Makes unit testing hard without mocking globals.
-- **`bluebird`** — Still imported in a few places. Not needed in Node 18+ where `Promise` is native.
-- **`ApiClient`** — `rejectUnauthorized: false` disables SSL verification by default for all outbound requests.
-- **`Crontab`** — Default timezone is `America/New_York` instead of UTC.
-- **`path` and `fs` npm packages** — These are Node.js built-ins and should not be in `package.json` dependencies.
+- **`services.js`** — All libs/services are injected into `global`. Makes unit testing hard without mocking globals; core libs also depend on each other via the global instead of `require()`-ing one another directly (e.g. `ApiClient` assumes `global.VSError` exists rather than requiring `./VSError`).
 ---
@@ -648,3 +644,22 @@ Requires `core/.env.test` with `TEST_DB_URI`, `TEST_PORT`, and `JWT_SECRET_KEY`
 - Starts a full Vulkano fixture server as a child process
 - Drops and rebuilds the test database on every run
 - Covers: VSR response format, routing (params + query strings), scaffold CRUD, pagination, model validation, ReDoS protection, file uploads, sockets (handshake auth + event routing)
+### Unit tests (`test/unit/`) — testing a core lib in isolation
+Core libs (`core/libs/*.js`) read globals (`app`, `VSError`, `CORE_PATH`, `APP_PATH`, …) that are
+normally set by `bootstrap/services.js` at framework boot — a unit test skips that boot to test one
+lib alone, so those globals don't exist yet. Use the shared helper instead of hand-rolling a fake
+per file:
+```js
+const { setupGlobals, setupEncrypter, setupFilter } = require('../helpers/globals');
+setupGlobals();                                  // app, VSError (the real one), CORE_PATH, APP_PATH
+setupGlobals({ app: { config: { jwt: {...} } } }); // override app (shallow) for lib-specific config
+setupEncrypter();                                // only if the lib under test needs global.Encrypter
+setupFilter();                                   // only if the lib under test needs global.Filter
+```
+`setupGlobals()` always installs the real `libs/VSError.js`, not a per-file stand-in — keeps unit
+tests honest about its actual behavior instead of drifting from a hand-copied fake.

package/CHANGELOG.md ADDED Viewed

@@ -0,0 +1,92 @@
+# Changelog
+All notable changes to `@vulkano/core` are documented here.
+## [1.30.0]
+### Added
+- `bootstrap/express.js` — default multer `limits.fileSize` of **25MB**. Previously unbounded:
+  an upload could buffer to disk in full before `Upload.js`'s own `maxSize` check ever ran,
+  a real DoS surface (disk/memory/bandwidth) for any controller receiving uploads without an
+  explicit limit. Override via `app/config/express/multer.js` (`limits.fileSize`) — deep-merges,
+  doesn't drop the existing `fieldNestingDepth: 5` default.
+### Tests
+- `test/unit/bootstrap/express.test.js` — default `fileSize`, override, and that
+  `fieldNestingDepth` survives a partial `limits` override (deep merge).
+### Docs
+- `README.md` / `AGENTS.md`: documented the default and the override path.
+## [1.29.0]
+### Changed — BREAKING (default behavior)
+- `Crontab.schedule()` default `timeZone` is now `UTC`, was `America/New_York`. Any job that
+  relied on the implicit New York default without passing `timeZone` explicitly now runs on a
+  different schedule relative to wall-clock time in that zone — pass `timeZone: 'America/New_York'`
+  explicitly to keep the old behavior. A job with an explicit `timeZone` is unaffected.
+### Tests
+- `test/unit/libs/Crontab.test.js` — default/override timezone, `start: true/false`, manual tick.
+### Docs
+- `AGENTS.md` / `README.md`: documented the `UTC` default; removed the now-resolved
+  `Crontab` timezone known-issue entry.
+## [1.28.1]
+### Changed (internal, no runtime/public API impact)
+- `test/unit/` — added `test/unit/helpers/globals.js`, a shared `setupGlobals()` /
+  `setupEncrypter()` / `setupFilter()` bootstrap for unit-testing a core lib in isolation.
+  Replaces 4 duplicated, hand-rolled `VSError` stand-in classes across
+  `ApiClient.test.js` / `Encrypter.test.js` / `Jwt.test.js` with the real `libs/VSError.js`,
+  and a fragile `delete global.app` pattern in `Encrypter.test.js` with restoring the
+  baseline via `setupGlobals()`.
+- Removed two stale `Known issues / tech debt` entries from `AGENTS.md` (`bluebird` and
+  `path`/`fs` as dependencies) — neither is present in the codebase or `package.json` anymore.
+## [1.28.0]
+### Changed
+- `ApiClient` — SSL verification stays enabled (secure) by default, but the default itself can
+  now be flipped app-wide via `.env` with `API_CLIENT_REJECT_UNAUTHORIZED=false` (e.g. same-server
+  calls to other internal services on self-signed certs). A per-call `rejectUnauthorized` still
+  always wins over the env default, in either direction.
+### Tests
+- Env-driven default, per-call override in both directions, and non-`"false"` values keeping
+  verification on.
+### Docs
+- `AGENTS.md` / `README.md`: documented `API_CLIENT_REJECT_UNAUTHORIZED`; removed the stale
+  "SSL disabled by default" known-issue entry and the outdated "Axios wrapper" description.
+## [1.27.0]
+### Added
+- Global `View` lib — `View.render(view, data)` returns a Promise<html>, rendering a view
+  outside the normal request/response cycle (email bodies, PDF generation, etc.), without
+  the `req.app.render` boilerplate.
+### Tests
+- Nunjucks and Handlebars coverage for `View.render()`, verifying markup matches `res.render()`
+  on the same template.
+### Docs
+- `AGENTS.md` / `README.md`: documented the `View` global.
+## [1.26.0]
+### Added
+- Controllers support **arbitrary nesting depth** under `app/controllers/` (e.g.
+  `api/config/VatTypesController.js` → `/api/config/vat-types/...`), not just one subfolder
+  level — ideal for grouping controllers by module/domain. The route loader
+  (`controllers/controllers.js`) now walks the folder tree recursively instead of handling
+  a single hardcoded nesting level.
+### Tests
+- `test/integration/nested-modules.test.js` — same controller name (`VatTypesController`) at
+  root, one, and two levels of nesting, all 5 CRUD methods, verifying full route isolation.
+### Docs
+- `AGENTS.md` / `README.md`: documented multi-level controller nesting.

package/README.md CHANGED Viewed

@@ -354,6 +354,18 @@ All files in `app/services/` are auto-loaded as globals. The framework also expo
 | `Upload`    | Validate, save and return the local path of an uploaded file    |
 | `i18n`      | Internationalization via i18next                                |
 | `mongoose`  | Mongoose instance                                               |
+| `View`      | `View.render(view, data)` → Promise<html>, renders outside the request/response cycle |
+`ApiClient` verifies SSL by default. A single call can opt out with `rejectUnauthorized: false`
+(and force it back on with `rejectUnauthorized: true`), and the default itself can be flipped for
+the whole app via `.env`:
+```
+# .env — disables SSL verification by default for every ApiClient call
+# (e.g. calling other services on the same server over self-signed certs).
+# A per-call rejectUnauthorized always overrides this, in either direction.
+API_CLIENT_REJECT_UNAUTHORIZED=false
+```
 ---
@@ -361,6 +373,17 @@ All files in `app/services/` are auto-loaded as globals. The framework also expo
 Vulkano uses [Multer](https://github.com/expressjs/multer) v2. Files are available on `req.files` after a `multipart/form-data` POST — Multer writes them straight into `PUBLIC_PATH/files` under a temporary name.
+Multer rejects any single file over **25MB** by default (`limits.fileSize`) — before it's fully
+buffered to disk, unlike `Upload.file()`'s own `maxSize` check which only runs after. Override it
+in `app/config/express/multer.js`:
+```js
+// app/config/express/multer.js
+module.exports = {
+  limits: { fileSize: 100 * 1024 * 1024 } // 100MB
+};
+```
 ### The `Upload` lib
 `Upload.file(files, opts)` validates a single uploaded file (mimetype, extension, size, write
@@ -512,6 +535,9 @@ const { _id } = Jwt.decode(Jwt.getToken(req)) || {};
 When Vulkano starts, you can configure your own tasks to run at a given time.
+`timeZone` defaults to `UTC` when omitted — pass it explicitly (e.g. `'America/New_York'`) for a
+task that should run relative to a specific local time instead.
 ```js
 // app/config/bootstrap.js
 module.exports = (start) => {

package/bootstrap/express.js CHANGED Viewed

@@ -55,7 +55,13 @@ module.exports = function getExpressConfiguration() {
       limits: {
         // Prevents DoS via deeply nested field names (e.g. a[b][c][d]...),
         // which multer forwards to append-field's unbounded recursive parser.
-        fieldNestingDepth: 5
+        fieldNestingDepth: 5,
+        // Rejects an oversized upload mid-stream instead of buffering the
+        // whole file to disk first — Upload.js's own maxSize check only runs
+        // after multer has already written the file. Override via
+        // app/config/express/multer.js (limits.fileSize) if a project needs
+        // a different ceiling.
+        fileSize: 25 * 1024 * 1024
       }
     },
     morgan: {

package/libs/ApiClient.js CHANGED Viewed

@@ -67,8 +67,12 @@ module.exports = {
       ? { url: props, method: 'GET' }
       : (props || {});
-    // SSL verification is enabled by default; pass rejectUnauthorized: false to disable
-    const sslVerify = rejectUnauthorized !== false;
+    // SSL verification is enabled by default (secure). It can be turned off globally via
+    // API_CLIENT_REJECT_UNAUTHORIZED=false in .env (e.g. internal calls to other services on
+    // the same server using self-signed certs) — a per-call `rejectUnauthorized` always wins
+    // over the env default, in either direction.
+    const envDefault = process.env.API_CLIENT_REJECT_UNAUTHORIZED !== 'false';
+    const sslVerify = rejectUnauthorized !== undefined ? rejectUnauthorized !== false : envDefault;
     const optHeaders = {
       'Content-Type': 'application/json',

package/libs/Crontab.js CHANGED Viewed

@@ -16,7 +16,7 @@ module.exports = {
       cronTime: time,
       onTick: task || ( () => {} ),
       onComplete: onComplete || ( () => {} ),
-      timeZone: timeZone || 'America/New_York',
+      timeZone: timeZone || 'UTC',
       start: typeof start !== 'undefined' ? start : true
     };

package/libs/Upload.js CHANGED Viewed

@@ -70,6 +70,10 @@ const MIME_EXTENSION_MAP = {
   'video/x-mpg': 'mpg'
 };
+// This only rejects a file after multer has already buffered it to disk —
+// it never runs on an upload multer already rejected via its own
+// limits.fileSize (bootstrap/express.js, default 25MB). Set maxSize below
+// that ceiling for it to ever actually apply.
 const DEFAULT_MAX_SIZE = 10 * 1024 * 1024;
 module.exports = {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@vulkano/core",
-  "version": "1.27.0",
+  "version": "1.30.0",
   "description": "A MVC framework using Express 4",
   "license": "MIT",
   "author": "Vulkano Team",