@zintrust/core 0.1.48 → 0.1.50

package/app/Controllers/UserQueryBuilderController.js

@@ -1,404 +0,0 @@
-/**
- * User QueryBuilder Controller
- * QueryBuilder-backed controller for the users resource.
- */
-import { Logger, QueryBuilder, Sanitizer, Schema, Validator, getValidatedBody, nowIso, randomBytes, useDatabase, } from '../../src/index.js';
-const isValidationError = (error) => {
-    if (typeof error !== 'object' || error === null)
-        return false;
-    const maybe = error;
-    return maybe.name === 'ValidationError' && typeof maybe.toObject === 'function';
-};
-const isSanitizerError = (error) => {
-    if (typeof error !== 'object' || error === null)
-        return false;
-    const maybe = error;
-    return maybe.name === 'SanitizerError';
-};
-const toJsonRecord = (value) => {
-    if (typeof value !== 'object' || value === null)
-        return {};
-    if (Array.isArray(value))
-        return {};
-    return value;
-};
-const resolveBody = (req) => {
-    return toJsonRecord(getValidatedBody(req) ?? req.body ?? {});
-};
-const getParamCompat = (req, name) => {
-    try {
-        const anyReq = req;
-        if (typeof anyReq.getParam === 'function')
-            return anyReq.getParam(name);
-    }
-    catch {
-        // ignore
-    }
-    const anyReq = req;
-    const params = anyReq.params;
-    if (typeof params === 'object' && params !== null)
-        return params[name];
-    return undefined;
-};
-const requireSelf = (req, res, userId) => {
-    if (typeof userId !== 'string' || userId.length === 0) {
-        res.status(400).json({ error: 'Missing user id' });
-        return false;
-    }
-    const subject = typeof req.user?.sub === 'string' ? req.user.sub : undefined;
-    if (subject === undefined || subject.length === 0) {
-        res.status(401).json({ error: 'Unauthorized' });
-        return false;
-    }
-    if (subject !== userId) {
-        res.status(403).json({ error: 'Forbidden' });
-        return false;
-    }
-    return true;
-};
-const randomInt = (min, max) => {
-    const lo = Math.ceil(min);
-    const hi = Math.floor(max);
-    return Math.floor(lo + Math.random() * (hi - lo + 1)); // NOSONAR is just a test utility
-};
-const randomName = () => {
-    const first = ['Alex', 'Jordan', 'Taylor', 'Sam', 'Casey', 'Riley', 'Morgan'];
-    const last = ['Lee', 'Kim', 'Patel', 'Garcia', 'Brown', 'Nguyen', 'Smith'];
-    return `${first[randomInt(0, first.length - 1)]} ${last[randomInt(0, last.length - 1)]}`;
-};
-const randomEmail = () => {
-    const n = randomInt(10000, 99999);
-    return `user${n}@example.com`;
-};
-const randomPassword = () => {
-    // Not cryptographically perfect UX-wise, but avoids hard-coded credentials.
-    // `base64url` keeps it URL-safe and reasonably short.
-    return randomBytes(12).toString('base64url');
-};
-const pickAllowed = (body, allowed) => {
-    const out = {};
-    for (const [k, v] of Object.entries(body)) {
-        if (allowed.has(k))
-            out[k] = v;
-    }
-    return out;
-};
-const hasUnknownKeys = (body, allowed) => {
-    for (const k of Object.keys(body)) {
-        if (!allowed.has(k))
-            return k;
-    }
-    return null;
-};
-const sanitizeUserUpdateBody = (updateBody) => {
-    const sanitizedUpdateBody = {};
-    if ('name' in updateBody) {
-        sanitizedUpdateBody['name'] = Sanitizer.nameText(updateBody['name']).trim();
-    }
-    if ('email' in updateBody) {
-        sanitizedUpdateBody['email'] = Sanitizer.email(updateBody['email']).trim().toLowerCase();
-    }
-    if ('password' in updateBody) {
-        sanitizedUpdateBody['password'] = Sanitizer.safePasswordChars(updateBody['password']);
-    }
-    return sanitizedUpdateBody;
-};
-const buildUserUpdateSchema = () => {
-    return Schema.create()
-        .custom('name', (v) => v === undefined || typeof v === 'string', 'name must be a string')
-        .minLength('name', 1)
-        .custom('email', (v) => v === undefined || typeof v === 'string', 'email must be a string')
-        .custom('password', (v) => v === undefined || typeof v === 'string', 'password must be a string')
-        .minLength('password', 8);
-};
-const buildUserStoreSchema = () => {
-    return Schema.create()
-        .custom('name', (v) => typeof v === 'string', 'name must be a string')
-        .minLength('name', 1)
-        .custom('email', (v) => typeof v === 'string', 'email must be a string')
-        .email('email')
-        .custom('password', (v) => typeof v === 'string', 'password must be a string')
-        .minLength('password', 8);
-};
-/**
- * User Controller Methods
- */
-const userControllerMethods = {
-    /**
-     * List all users
-     * GET /users
-     */
-    async index(req, res) {
-        try {
-            const subject = typeof req.user?.sub === 'string' ? req.user.sub : undefined;
-            if (subject === undefined || subject.length === 0) {
-                res.status(401).json({ error: 'Unauthorized' });
-                return;
-            }
-            const db = useDatabase();
-            const users = await QueryBuilder.create('users', db)
-                .select('id', 'name', 'email', 'created_at', 'updated_at')
-                .where('id', '=', subject)
-                .limit(1)
-                .get();
-            res.json({ data: users });
-        }
-        catch (error) {
-            Logger.error('Error fetching users:', error);
-            res.status(500).json({ error: 'Failed to fetch users' });
-        }
-    },
-    /**
-     * Show a specific user
-     * GET /users/:id
-     */
-    async show(req, res) {
-        try {
-            const db = useDatabase();
-            const rawId = getParamCompat(req, 'id');
-            const id = Sanitizer.digitsOnly(rawId); // Zero trust protection for db id
-            if (typeof id !== 'string' || id.length === 0) {
-                // ✅ Good
-                res.status(400).json({ error: 'Missing user id' });
-                return;
-            }
-            if (!requireSelf(req, res, id))
-                return;
-            const user = await QueryBuilder.create('users', db)
-                .select('id', 'name', 'email', 'created_at', 'updated_at')
-                .where('id', '=', id)
-                .limit(1)
-                .first();
-            if (user === null) {
-                res.status(404).json({ error: 'User not found' });
-                return;
-            }
-            res.json({ data: user });
-        }
-        catch (error) {
-            if (isSanitizerError(error)) {
-                res.status(400).json({ error: error.message });
-                return;
-            }
-            Logger.error('Error fetching user:', error);
-            res.status(500).json({ error: 'Failed to fetch user' });
-        }
-    },
-    /**
-     * Show create form
-     * GET /users/create
-     */
-    async create(_req, res) {
-        res.json({ form: 'Create User Form' });
-    },
-    /**
-     * Store a new user
-     * POST /users
-     */
-    async store(req, res) {
-        try {
-            // Use validated body if available (already sanitized by middleware), otherwise fallback to raw
-            const body = resolveBody(req);
-            const required = ['name', 'email', 'password'];
-            const missing = {};
-            for (const key of required) {
-                const val = body[key];
-                if (typeof val !== 'string' || val.trim() === '') {
-                    missing[key] = ['Required'];
-                }
-            }
-            if (Object.keys(missing).length > 0) {
-                res.status(422).json({ errors: missing });
-                return;
-            }
-            // Trust middleware for sanitization if validation passed.
-            // If we are here, validation ostensibly passed or we are in a context where we must self-validate.
-            // To satisfy defense-in-depth without double-sanitization bottleneck:
-            // We assume body is safe-ish if it came from resolved validated body.
-            // But to be explicit and type-safe, we cast or read fields directly.
-            const db = useDatabase();
-            const ts = nowIso();
-            // Apply bulletproof sanitization for defense-in-depth
-            const name = Sanitizer.nameText(body['name']);
-            const email = Sanitizer.email(body['email']);
-            const password = Sanitizer.safePasswordChars(body['password']);
-            Validator.validate({ name, email, password }, buildUserStoreSchema());
-            await QueryBuilder.create('users', db).insert({
-                name,
-                email,
-                password, // Hashing should be handled by model/service or here if raw
-                created_at: ts,
-                updated_at: ts,
-            });
-            res.status(201).json({ message: 'User created' });
-        }
-        catch (error) {
-            if (isSanitizerError(error)) {
-                res.status(400).json({ error: error.message });
-                return;
-            }
-            if (isValidationError(error)) {
-                res.status(422).json({ errors: error.toObject?.() ?? {} });
-                return;
-            }
-            Logger.error('Error creating user:', error);
-            res.status(500).json({ error: 'Failed to create user' });
-        }
-    },
-    /**
-     * Fill users table with random users
-     * POST /users/fill
-     */
-    async fill(req, res) {
-        try {
-            const body = resolveBody(req);
-            const countVal = body['count'];
-            // Ensure count is a number (middleware validation handles this, but we double check or default)
-            let count = typeof countVal === 'number' ? countVal : 10;
-            if (count < 1)
-                count = 1;
-            if (count > 100)
-                count = 100;
-            const db = useDatabase();
-            const ts = nowIso();
-            // Optimize: Bulk insert instead of N+1 inserts to reduce IO bottleneck and memory overhead
-            const users = Array.from({ length: count }, () => ({
-                name: randomName(),
-                email: randomEmail(),
-                password: randomPassword(),
-                created_at: ts,
-                updated_at: ts,
-            }));
-            await QueryBuilder.create('users', db).insert(users);
-            res.status(201).json({ message: 'Users filled', count });
-        }
-        catch (error) {
-            Logger.error('Error filling users:', error);
-            res.status(500).json({ error: 'Failed to fill users' });
-        }
-    },
-    /**
-     * Show edit form
-     * GET /users/:id/edit
-     */
-    async edit(_req, res) {
-        try {
-            res.json({ form: 'Edit User Form' });
-        }
-        catch (error) {
-            Logger.error('Error loading edit form:', error);
-            res.status(500).json({ error: 'Failed to load edit form' });
-        }
-    },
-    /**
-     * Update a user
-     * PUT /users/:id
-     */
-    async update(req, res) {
-        // NOSONAR bulletproof sanitization requires explicit validation steps
-        try {
-            const db = useDatabase();
-            const rawId = getParamCompat(req, 'id');
-            const id = Sanitizer.digitsOnly(rawId);
-            if (typeof id !== 'string' || id.length === 0) {
-                res.status(400).json({ error: 'Missing user id' });
-                return;
-            }
-            if (!requireSelf(req, res, id))
-                return;
-            const allowed = new Set(['name', 'email', 'password']);
-            const body = resolveBody(req);
-            const unknown = hasUnknownKeys(body, allowed);
-            if (unknown !== null) {
-                res.status(422).json({ errors: { [unknown]: ['Unknown field'] } });
-                return;
-            }
-            const updateBody = pickAllowed(body, allowed);
-            if (Object.keys(updateBody).length === 0) {
-                res.status(422).json({ errors: { body: ['No fields to update'] } });
-                return;
-            }
-            const sanitizedUpdateBody = sanitizeUserUpdateBody(updateBody);
-            Validator.validate(sanitizedUpdateBody, buildUserUpdateSchema());
-            const existing = await QueryBuilder.create('users', db)
-                .select('id')
-                .where('id', '=', id)
-                .limit(1)
-                .first();
-            if (existing === null) {
-                res.status(404).json({ error: 'User not found' });
-                return;
-            }
-            const ts = nowIso();
-            await QueryBuilder.create('users', db)
-                .where('id', '=', id)
-                .update({ ...sanitizedUpdateBody, updated_at: ts });
-            const user = await QueryBuilder.create('users', db)
-                .select('id', 'name', 'email', 'created_at', 'updated_at')
-                .where('id', '=', id)
-                .limit(1)
-                .first();
-            res.json({ message: 'User updated', user });
-        }
-        catch (error) {
-            if (isSanitizerError(error)) {
-                res.status(400).json({ error: error.message });
-                return;
-            }
-            if (isValidationError(error)) {
-                res.status(422).json({ errors: error.toObject?.() ?? {} });
-                return;
-            }
-            Logger.error('Error updating user:', error);
-            res.status(500).json({ error: 'Failed to update user' });
-        }
-    },
-    /**
-     * Delete a user
-     * DELETE /users/:id
-     */
-    async destroy(req, res) {
-        try {
-            const db = useDatabase();
-            const rawId = getParamCompat(req, 'id');
-            const id = Sanitizer.digitsOnly(rawId);
-            if (typeof id !== 'string' || id.length === 0) {
-                res.status(400).json({ error: 'Missing user id' });
-                return;
-            }
-            if (!requireSelf(req, res, id))
-                return;
-            const existing = await QueryBuilder.create('users', db)
-                .select('id')
-                .where('id', '=', id)
-                .limit(1)
-                .first();
-            if (existing === null) {
-                res.status(404).json({ error: 'User not found' });
-                return;
-            }
-            await QueryBuilder.create('users', db).where('id', '=', id).delete();
-            res.json({ message: 'User deleted' });
-        }
-        catch (error) {
-            if (isSanitizerError(error)) {
-                res.status(400).json({ error: error.message });
-                return;
-            }
-            Logger.error('Error deleting user:', error);
-            res.status(500).json({ error: 'Failed to delete user' });
-        }
-    },
-};
-/**
- * User QueryBuilder Controller Factory
- */
-export const UserQueryBuilderController = {
-    /**
-     * Create a new user controller instance
-     */
-    create() {
-        return userControllerMethods;
-    },
-};
-export default UserQueryBuilderController;

package/app/Middleware/ProfilerMiddleware.d.ts

@@ -1,12 +0,0 @@
-/**
- * Profiler Middleware
- * Enables request profiling when ENABLE_PROFILER environment variable is set
- */
-import type { Middleware } from '../../src/middleware/MiddlewareStack';
-/**
- * ProfilerMiddleware wraps request execution with performance profiling
- * Enabled via ENABLE_PROFILER=true environment variable
- * Attaches profiling report to response headers
- */
-export declare const ProfilerMiddleware: Middleware;
-//# sourceMappingURL=ProfilerMiddleware.d.ts.map

package/app/Middleware/ProfilerMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ProfilerMiddleware.d.ts","sourceRoot":"","sources":["../../../app/Middleware/ProfilerMiddleware.ts"],"names":[],"mappings":"AACA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAwChC,CAAC"}

package/app/Middleware/ProfilerMiddleware.js

@@ -1,47 +0,0 @@
-// @ts-nocheck - Example middleware - WIP
-/**
- * Profiler Middleware
- * Enables request profiling when ENABLE_PROFILER environment variable is set
- */
-import { Logger } from '../../src/config/logger.js';
-import { RequestProfiler } from '../../src/profiling/RequestProfiler.js';
-/**
- * ProfilerMiddleware wraps request execution with performance profiling
- * Enabled via ENABLE_PROFILER=true environment variable
- * Attaches profiling report to response headers
- */
-export const ProfilerMiddleware = async (req, res, next) => {
-    const isEnabled = process.env.ENABLE_PROFILER === 'true';
-    if (!isEnabled) {
-        // Pass through without profiling
-        await next();
-        return;
-    }
-    const profiler = RequestProfiler.create();
-    const queryLogger = profiler.getQueryLogger();
-    // Set up query logging if database is available
-    const db = req.context.db;
-    if (db !== undefined && db !== null && typeof db.onAfterQuery === 'function') {
-        db.onAfterQuery((sql, params, duration) => {
-            queryLogger.logQuery(sql, params, duration, 'middleware-profiling');
-        });
-    }
-    // Capture request execution
-    const profile = await profiler.captureRequest(async () => next());
-    // Attach profile to response
-    res.locals.profile = profile;
-    // Add profiling report to response header
-    try {
-        const report = profiler.generateReport(profile);
-        res.setHeader('X-Profiler-Report', Buffer.from(report).toString('base64'));
-        res.setHeader('X-Profiler-Queries', profile.queriesExecuted.toString());
-        res.setHeader('X-Profiler-Duration', profile.duration.toString());
-        if (profile.n1Patterns.length > 0) {
-            res.setHeader('X-Profiler-N1-Patterns', profile.n1Patterns.length.toString());
-        }
-    }
-    catch (error) {
-        // Silently fail if header encoding fails
-        Logger.error('Failed to encode profiler report header:', error);
-    }
-};

package/app/Middleware/index.d.ts

@@ -1,59 +0,0 @@
-/**
- * Example Middleware
- * Common middleware patterns for ZinTrust
- */
-import type { IRequest } from '../../src/http/Request';
-import type { IResponse } from '../../src/http/Response';
-import type { CsrfTokenManagerType, ICsrfTokenManager } from '../../src/security/CsrfTokenManager';
-import type { IJwtManager, JwtAlgorithm, JwtManagerType } from '../../src/security/JwtManager';
-import type { SchemaType } from '../../src/validation/Validator';
-type JwtManagerInput = IJwtManager | JwtManagerType;
-type CsrfManagerInput = ICsrfTokenManager | CsrfTokenManagerType;
-/**
- * Authentication Middleware
- * Verify user is authenticated
- */
-export declare const authMiddleware: (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-/**
- * CORS Middleware
- * Handle CORS headers
- */
-export declare const corsMiddleware: (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-/**
- * JSON Request Middleware
- * Parse JSON request bodies
- */
-export declare const jsonMiddleware: (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-/**
- * Logging Middleware
- * Log all requests
- */
-export declare const loggingMiddleware: (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-export declare const rateLimitMiddleware: (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-/**
- * Trailing Slash Middleware
- * Redirect URLs with trailing slashes
- */
-export declare const trailingSlashMiddleware: (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-/**
- * JWT Authentication Middleware
- * Verify JWT token and extract claims
- */
-export declare const jwtMiddleware: (jwtManager: JwtManagerInput, algorithm?: JwtAlgorithm) => (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-/**
- * CSRF Protection Middleware
- * Validate CSRF tokens for state-changing requests
- */
-export declare const csrfMiddleware: (csrfManager: CsrfManagerInput) => (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-/**
- * Input Validation Middleware
- * Validate request body against schema
- */
-export declare const validationMiddleware: (schema: SchemaType) => (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-/**
- * XSS Protection Middleware
- * Sanitize and escape user input
- */
-export declare const xssProtectionMiddleware: (req: IRequest, res: IResponse, next: () => Promise<void>) => Promise<void>;
-export {};
-//# sourceMappingURL=index.d.ts.map

package/app/Middleware/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../app/Middleware/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtF,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGjE,KAAK,eAAe,GAAG,WAAW,GAAG,cAAc,CAAC;AACpD,KAAK,gBAAgB,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAajE;;;GAGG;AACH,eAAO,MAAM,cAAc,GACzB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,IAAI,CASd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GACzB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GACzB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,IAAI,CAYd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,IAAI,CAYd,CAAC;AAQF,eAAO,MAAM,mBAAmB,GAC9B,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,IAAI,CAsBd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,IAAI,CAUd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,YAAY,eAAe,EAAE,YAAW,YAAsB,MAC5E,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,IAAI,CAiCtF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,aAAa,gBAAgB,MAC5C,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,IAAI,CAmCtF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,UAAU,MACvC,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,IAAI,CAwBtF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,IAAI,CAiBd,CAAC"}