@yunsoft/yuncms-api 0.1.3 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-api",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Express API runtime and bundled Studio server for YunCMS.",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,7 @@
     "test": "node --test"
   },
   "dependencies": {
-    "@yunsoft/yuncms-core": "0.1.3",
+    "@yunsoft/yuncms-core": "0.1.5",
     "express": "5.2.1"
   }
 }

package/src/app.js

@@ -7,6 +7,8 @@ import {
 
 import { createAuthenticationMiddleware } from './authentication.js';
 import { apiErrorHandler } from './error-response.js';
+import { createPressureLimit } from './pressure-limit.js';
+import { createFixedWindowRateLimit } from './rate-limit.js';
 import { createAuditRouter } from './routes/audit.js';
 import { createAuthRouter } from './routes/auth.js';
 import { createFilesRouter } from './routes/files.js';
@@ -20,6 +22,21 @@ import { createUsersRouter } from './routes/users.js';
 import { createStudioMiddleware } from './studio.js';
 
 const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]{1,64}$/;
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "base-uri 'self'",
+  "object-src 'none'",
+  "frame-ancestors 'none'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob: https://yunsoft.com",
+  "font-src 'self' data:",
+  "connect-src 'self'",
+  "media-src 'self' blob:",
+  "frame-src 'self' blob:",
+  "worker-src 'self' blob:",
+  "form-action 'self'",
+].join('; ');
 
 function securityHeaders(req, res, next) {
   res.set('x-content-type-options', 'nosniff');
@@ -27,6 +44,12 @@ function securityHeaders(req, res, next) {
   res.set('referrer-policy', 'no-referrer');
   res.set('permissions-policy', 'camera=(), microphone=(), geolocation=(), payment=(), usb=()');
   res.set('cross-origin-resource-policy', 'same-origin');
+  res.set('cross-origin-opener-policy', 'same-origin');
+  res.set('x-dns-prefetch-control', 'off');
+  res.set('content-security-policy', CONTENT_SECURITY_POLICY);
+  if (req.secure === true) {
+    res.set('strict-transport-security', 'max-age=15552000; includeSubDomains');
+  }
   next();
 }
 
@@ -54,12 +77,23 @@ function requestIdentity(req, res, next) {
   next();
 }
 
+function createApiRateLimit(config) {
+  const limits = config?.server?.rateLimit;
+  if (!limits?.enabled) return null;
+  return createFixedWindowRateLimit({
+    windowMs: limits.windowMs,
+    max: limits.max,
+    maxBuckets: limits.maxBuckets,
+  });
+}
+
 export function createApp({
   pool,
   config,
   logger = console,
   serviceRegistry = createCoreServiceRegistry(),
   schemaCache = null,
+  permissionCache = null,
   emitter = null,
   storage = null,
   mailer = null,
@@ -100,12 +134,19 @@ export function createApp({
 
   app.use(createStudioMiddleware({ root: studioRoot }));
 
+  const pressureLimit = createPressureLimit(config.server?.pressure);
+  if (pressureLimit) app.use(pressureLimit);
+
+  const apiRateLimit = createApiRateLimit(config);
+  if (apiRateLimit) app.use(apiRateLimit);
+
   app.use(createAuthenticationMiddleware({
     pool,
     config,
     logger,
     services,
     schemaCache,
+    permissionCache,
     emitter,
     storage,
   }));
@@ -137,4 +178,10 @@ export function createApp({
   return app;
 }
 
-export { requestIdentity, securityHeaders, studioCors };
+export {
+  CONTENT_SECURITY_POLICY,
+  createApiRateLimit,
+  requestIdentity,
+  securityHeaders,
+  studioCors,
+};

package/src/audit-events.js

@@ -0,0 +1,18 @@
+export const INTERNAL_AUDIT_EVENTS = Object.freeze([
+  'items.create',
+  'items.update',
+  'items.delete',
+  'files.create',
+  'files.update',
+  'files.delete',
+  'users.create',
+  'users.update',
+  'users.delete',
+  'users.password.update',
+  'roles.create',
+  'roles.update',
+  'roles.delete',
+  'permissions.create',
+  'permissions.update',
+  'permissions.delete',
+]);

package/src/authentication.js

@@ -25,6 +25,7 @@ export function createAuthenticationMiddleware({
   logger,
   services,
   schemaCache = null,
+  permissionCache = null,
   emitter = null,
   storage = null,
 }) {
@@ -79,6 +80,7 @@ export function createAuthenticationMiddleware({
         env: config,
         emitter,
         storage,
+        permissionCache,
         requestId: req.id,
       });
       next();

package/src/pressure-limit.js

@@ -0,0 +1,51 @@
+function assertPositiveInteger(value, name) {
+  if (!Number.isInteger(value) || value < 1) throw new Error(`${name} must be a positive integer`);
+}
+
+export function createPressureLimit({
+  enabled = true,
+  maxConcurrent = 250,
+  maxHeapPercent = 95,
+  retryAfterSeconds = 1,
+  memoryUsage = () => process.memoryUsage(),
+} = {}) {
+  if (!enabled) return null;
+  assertPositiveInteger(maxConcurrent, 'Pressure maxConcurrent');
+  assertPositiveInteger(maxHeapPercent, 'Pressure maxHeapPercent');
+  if (maxHeapPercent > 100) throw new Error('Pressure maxHeapPercent cannot exceed 100');
+  assertPositiveInteger(retryAfterSeconds, 'Pressure retryAfterSeconds');
+  if (typeof memoryUsage !== 'function') throw new Error('Pressure memoryUsage must be a function');
+
+  let inFlight = 0;
+
+  return (req, res, next) => {
+    const memory = memoryUsage();
+    const heapPercent = memory.heapTotal > 0
+      ? (memory.heapUsed / memory.heapTotal) * 100
+      : 0;
+    const overloaded = inFlight >= maxConcurrent || heapPercent >= maxHeapPercent;
+
+    if (overloaded) {
+      res.set('retry-after', String(retryAfterSeconds));
+      res.status(503).json({
+        errors: [{
+          code: 'SERVER_PRESSURE',
+          message: 'Server is temporarily under pressure',
+          request_id: req.id ?? null,
+        }],
+      });
+      return;
+    }
+
+    inFlight += 1;
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      inFlight = Math.max(0, inFlight - 1);
+    };
+    res.once('finish', release);
+    res.once('close', release);
+    next();
+  };
+}

package/src/server.js

@@ -1,5 +1,6 @@
 import {
   assertDatabaseCompatible,
+  assertMaintenanceStartupAllowed,
   closeDatabasePool,
   createCoreServiceRegistry,
   createDatabasePool,
@@ -10,14 +11,20 @@ import {
   loadConfig,
   loadEnvFileIfPresent,
   LocalStorageDriver,
+  MemoryCacheStore,
   S3StorageDriver,
   SchemaCache,
   SmtpMailer,
 } from '@yunsoft/yuncms-core';
 import { createApp } from './app.js';
+import { INTERNAL_AUDIT_EVENTS } from './audit-events.js';
 import { loadExtensionRuntime } from './extensions/runtime.js';
 
 loadEnvFileIfPresent();
+await assertMaintenanceStartupAllowed({
+  cwd: process.cwd(),
+  env: process.env,
+});
 const config = loadConfig();
 const logger = createJsonLogger({ level: config.logging.level });
 const pool = createDatabasePool(config.database);
@@ -35,6 +42,12 @@ if (config.storage.s3.bucket) {
   });
 }
 const storage = createStorageRegistry(storageDrivers);
+const permissionCache = config.cache.enabled
+  ? new MemoryCacheStore({
+    ttlMs: config.cache.ttlMs,
+    maxEntries: config.cache.maxEntries,
+  })
+  : null;
 
 const hasAnyMailConfig = Boolean(
   config.mail.host || config.mail.from || config.mail.user || config.mail.password,
@@ -59,16 +72,8 @@ let shuttingDown = false;
 function registerInternalAudit({ emitter, services }) {
   const AuditService = services.AuditService;
   const systemAccountability = createSystemAccountability();
-  const events = [
-    'items.create',
-    'items.update',
-    'items.delete',
-    'files.create',
-    'files.update',
-    'files.delete',
-  ];
 
-  for (const event of events) {
+  for (const event of INTERNAL_AUDIT_EVENTS) {
     emitter.registerAction(event, async (payload, context) => {
       try {
         const audit = new AuditService({
@@ -122,6 +127,7 @@ async function start() {
     logger,
     serviceRegistry,
     schemaCache,
+    permissionCache,
     emitter,
     storage,
     mailer,