@webstir-io/webstir-backend 0.1.15 → 0.1.16

package/templates/backend/env.ts

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -6,6 +7,8 @@ export type LogLevel = 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'fatal';
 
 export interface AuthSecrets {
   jwtSecret?: string;
+  jwtPublicKey?: string;
+  jwksUrl?: string;
   jwtIssuer?: string;
   jwtAudience?: string;
   serviceTokens: string[];
@@ -26,6 +29,17 @@ export interface DatabaseConfig {
   migrationsTable: string;
 }
 
+export interface HttpConfig {
+  bodyLimitBytes: number;
+}
+
+export interface SessionConfig {
+  secret: string;
+  cookieName: string;
+  secure: boolean;
+  maxAgeSeconds: number;
+}
+
 export interface AppEnv {
   NODE_ENV: string;
   PORT: number;
@@ -34,10 +48,15 @@ export interface AppEnv {
   logging: LoggingConfig;
   metrics: MetricsConfig;
   database: DatabaseConfig;
+  http: HttpConfig;
+  sessions: SessionConfig;
 }
 
 const ENV_FILES = ['.env.local', '.env'];
+const WORKSPACE_ROOT_PATTERN = /^(.*)[/\\](?:src|build)[/\\]backend(?:[/\\].*)?$/;
 const WORKSPACE_ROOT = resolveWorkspaceRoot();
+const DEFAULT_REQUEST_BODY_MAX_BYTES = 1024 * 1024;
+const GENERATED_SESSION_SECRET = crypto.randomBytes(32).toString('hex');
 let envLoaded = false;
 
 export function loadEnv(): AppEnv {
@@ -46,26 +65,40 @@ export function loadEnv(): AppEnv {
     envLoaded = true;
   }
 
-  const NODE_ENV = process.env.NODE_ENV ?? 'development';
+  const NODE_ENV = readNodeEnv();
   const PORT = parsePort(process.env.PORT ?? '4000');
   const API_BASE_URL = requireEnv('API_BASE_URL', 'http://localhost:4000');
   const auth: AuthSecrets = {
     jwtSecret: process.env.AUTH_JWT_SECRET,
+    jwtPublicKey: resolveJwtPublicKey(),
+    jwksUrl: normalizeOptionalText(process.env.AUTH_JWKS_URL),
     jwtIssuer: process.env.AUTH_JWT_ISSUER,
     jwtAudience: process.env.AUTH_JWT_AUDIENCE,
-    serviceTokens: parseList(process.env.AUTH_SERVICE_TOKENS)
+    serviceTokens: parseList(process.env.AUTH_SERVICE_TOKENS),
   };
   const logging: LoggingConfig = {
     level: parseLogLevel(process.env.LOG_LEVEL),
-    serviceName: process.env.LOG_SERVICE_NAME ?? 'backend-template'
+    serviceName: process.env.LOG_SERVICE_NAME ?? 'backend-template',
   };
   const metrics: MetricsConfig = {
     enabled: parseBoolean(process.env.METRICS_ENABLED, true),
-    windowSize: parsePositiveInt(process.env.METRICS_WINDOW, 200)
+    windowSize: parsePositiveInt(process.env.METRICS_WINDOW, 200),
   };
   const database: DatabaseConfig = {
     url: process.env.DATABASE_URL ?? 'file:./data/dev.sqlite',
-    migrationsTable: process.env.DATABASE_MIGRATIONS_TABLE ?? '_webstir_migrations'
+    migrationsTable: process.env.DATABASE_MIGRATIONS_TABLE ?? '_webstir_migrations',
+  };
+  const http: HttpConfig = {
+    bodyLimitBytes: parsePositiveInt(
+      process.env.REQUEST_BODY_MAX_BYTES,
+      DEFAULT_REQUEST_BODY_MAX_BYTES,
+    ),
+  };
+  const sessions: SessionConfig = {
+    secret: resolveSessionSecret(NODE_ENV),
+    cookieName: process.env.SESSION_COOKIE_NAME ?? 'webstir_session',
+    secure: parseBoolean(process.env.SESSION_COOKIE_SECURE, NODE_ENV === 'production'),
+    maxAgeSeconds: parsePositiveInt(process.env.SESSION_MAX_AGE, 60 * 60 * 24),
   };
 
   return {
@@ -75,10 +108,53 @@ export function loadEnv(): AppEnv {
     auth,
     logging,
     metrics,
-    database
+    database,
+    http,
+    sessions,
   };
 }
 
+function resolveSessionSecret(nodeEnv: string): string {
+  const explicitSecret = normalizeOptionalText(process.env.SESSION_SECRET);
+  if (explicitSecret) {
+    return explicitSecret;
+  }
+
+  if (nodeEnv.trim().toLowerCase() === 'production') {
+    throw new Error('SESSION_SECRET is required when NODE_ENV=production.');
+  }
+
+  return process.env.AUTH_JWT_SECRET ?? GENERATED_SESSION_SECRET;
+}
+
+function readNodeEnv(): string {
+  const value = Reflect.get(process.env, 'NODE_ENV');
+  return typeof value === 'string' && value.length > 0 ? value : 'development';
+}
+
+function resolveJwtPublicKey(): string | undefined {
+  const inline = normalizeOptionalText(process.env.AUTH_JWT_PUBLIC_KEY);
+  if (inline) {
+    return inline;
+  }
+
+  const filePath = normalizeOptionalText(process.env.AUTH_JWT_PUBLIC_KEY_FILE);
+  if (!filePath) {
+    return undefined;
+  }
+
+  const resolvedPath = path.isAbsolute(filePath)
+    ? path.resolve(filePath)
+    : path.resolve(WORKSPACE_ROOT, filePath);
+  try {
+    return readFileSync(resolvedPath, 'utf8');
+  } catch (error) {
+    throw new Error(
+      `Failed to read AUTH_JWT_PUBLIC_KEY_FILE at ${resolvedPath}: ${(error as Error).message}`,
+    );
+  }
+}
+
 function loadEnvFiles(): void {
   for (const file of ENV_FILES) {
     const full = path.resolve(WORKSPACE_ROOT, file);
@@ -100,7 +176,10 @@ function applyEnvFile(filePath: string): void {
     const key = line.slice(0, idx).trim();
     if (!key || process.env[key] !== undefined) continue;
     let value = line.slice(idx + 1).trim();
-    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith('\'') && value.endsWith('\''))) {
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
       value = value.slice(1, -1);
     }
     process.env[key] = value;
@@ -131,9 +210,21 @@ function parseList(value: string | undefined): string[] {
     .filter((item) => item.length > 0);
 }
 
+function normalizeOptionalText(value: string | undefined): string | undefined {
+  const normalized = value?.trim();
+  return normalized || undefined;
+}
+
 function parseLogLevel(value: string | undefined): LogLevel {
   const normalized = (value ?? 'info').toLowerCase();
-  if (normalized === 'trace' || normalized === 'debug' || normalized === 'info' || normalized === 'warn' || normalized === 'error' || normalized === 'fatal') {
+  if (
+    normalized === 'trace' ||
+    normalized === 'debug' ||
+    normalized === 'info' ||
+    normalized === 'warn' ||
+    normalized === 'error' ||
+    normalized === 'fatal'
+  ) {
     return normalized;
   }
   return 'info';
@@ -155,20 +246,41 @@ function parsePositiveInt(value: string | undefined, fallback: number): number {
 }
 
 export function resolveWorkspaceRoot(): string {
-  if (process.env.WORKSPACE_ROOT) {
-    return process.env.WORKSPACE_ROOT;
+  const envWorkspaceRoot = resolveEnvWorkspaceRoot(process.env);
+  if (envWorkspaceRoot) {
+    return path.resolve(envWorkspaceRoot);
+  }
+  const inferredRoot = inferWorkspaceRootFromImportMetaUrl(import.meta.url);
+  if (inferredRoot) {
+    return inferredRoot;
+  }
+  return path.resolve(process.cwd());
+}
+
+function resolveEnvWorkspaceRoot(env: NodeJS.ProcessEnv): string | undefined {
+  const workspaceRoot = env.WORKSPACE_ROOT?.trim();
+  if (workspaceRoot) {
+    return workspaceRoot;
   }
+
+  const webstirWorkspaceRoot = env.WEBSTIR_WORKSPACE_ROOT?.trim();
+  return webstirWorkspaceRoot || undefined;
+}
+
+function inferWorkspaceRootFromImportMetaUrl(importMetaUrl: string): string | undefined {
   try {
-    const filePath = fileURLToPath(import.meta.url);
-    const dir = path.dirname(filePath);
-    if (dir.endsWith(`${path.sep}src${path.sep}backend`)) {
-      return path.resolve(dir, '..', '..');
-    }
-    if (dir.endsWith(`${path.sep}build${path.sep}backend`)) {
-      return path.resolve(dir, '..', '..');
-    }
+    return inferWorkspaceRootFromFilePath(fileURLToPath(importMetaUrl));
   } catch {
-    // ignore
+    return undefined;
   }
-  return process.cwd();
+}
+
+function inferWorkspaceRootFromFilePath(filePath: string): string | undefined {
+  const normalizedFilePath = path.resolve(path.dirname(filePath));
+  const match = normalizedFilePath.match(WORKSPACE_ROOT_PATTERN);
+  if (!match) {
+    return undefined;
+  }
+
+  return match[1] || path.parse(normalizedFilePath).root;
 }

package/templates/backend/functions/hello/index.ts

@@ -7,7 +7,7 @@ export async function run(): Promise<void> {
   console.info('[function:hello] ran at', new Date().toISOString());
 }
 
-// Execute when launched directly: `node build/backend/functions/hello/index.js`
+// Execute when launched directly: `bun build/backend/functions/hello/index.js`
 const isMain = (() => {
   try {
     const argv1 = process.argv?.[1];
@@ -26,4 +26,3 @@ if (isMain) {
     process.exitCode = 1;
   });
 }
-