alepha 0.13.0 → 0.13.2

package/dist/api-files/index.js

@@ -1,457 +1,15 @@
-import { $env, $hook, $inject, $module, Alepha, Descriptor, KIND, createDescriptor, isTypeFile, t } from "alepha";
+import { $hook, $inject, $module, Alepha, t } from "alepha";
 import { $bucket, AlephaBucket, FileNotFoundError } from "alepha/bucket";
-import { $cache, AlephaCache } from "alepha/cache";
-import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { AlephaServerCache } from "alepha/server/cache";
+import { AlephaServerMultipart } from "alepha/server/multipart";
+import { $entity, $repository, pageQuerySchema, pg } from "alepha/orm";
+import { $action, NotFoundError, okSchema } from "alepha/server";
+import { createHash } from "node:crypto";
 import { DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
-import { $action, ActionDescriptor, AlephaServer, ForbiddenError, HttpError, NotFoundError, ServerRouterProvider, UnauthorizedError, isMultipart, okSchema } from "alepha/server";
-import { createReadStream } from "node:fs";
-import { readFile, unlink, writeFile } from "node:fs/promises";
-import * as os from "node:os";
-import { ReadableStream } from "node:stream/web";
-import { $entity, $repository, pageQuerySchema, pg } from "alepha/orm";
-import { $permission, $realm, $role, AlephaSecurity, JwtProvider, SecurityProvider, userAccountInfoSchema } from "alepha/security";
+import "alepha/server/security";
 import { $scheduler } from "alepha/scheduler";
 
-//#region src/server-cache/providers/ServerCacheProvider.ts
-ActionDescriptor.prototype.invalidate = async function() {
-	await this.alepha.inject(ServerCacheProvider).invalidate(this.route);
-};
-var ServerCacheProvider = class {
-	log = $logger();
-	alepha = $inject(Alepha);
-	time = $inject(DateTimeProvider);
-	cache = $cache({ provider: "memory" });
-	generateETag(content) {
-		return `"${createHash("md5").update(content).digest("hex")}"`;
-	}
-	async invalidate(route) {
-		if (!route.cache) return;
-		await this.cache.invalidate(this.createCacheKey(route));
-	}
-	onActionRequest = $hook({
-		on: "action:onRequest",
-		handler: async ({ action, request }) => {
-			const cache = action.route.cache;
-			if (this.shouldStore(cache)) {
-				const key = this.createCacheKey(action.route, request);
-				const cached = await this.cache.get(key);
-				if (cached) {
-					const body = cached.contentType === "application/json" ? JSON.parse(cached.body) : cached.body;
-					this.log.trace("Cache hit for action", {
-						key,
-						action: action.name
-					});
-					request.reply.body = body;
-				} else this.log.trace("Cache miss for action", {
-					key,
-					action: action.name
-				});
-			}
-		}
-	});
-	onActionResponse = $hook({
-		on: "action:onResponse",
-		handler: async ({ action, request, response }) => {
-			const cache = action.route.cache;
-			if (!this.shouldStore(cache) || !response) return;
-			if (request.reply.status && request.reply.status >= 400) return;
-			const contentType = typeof response === "string" ? "text/plain" : "application/json";
-			const body = contentType === "text/plain" ? response : JSON.stringify(response);
-			const generatedEtag = this.generateETag(body);
-			const lastModified = this.time.toISOString();
-			const key = this.createCacheKey(action.route, request);
-			this.log.trace("Storing response", {
-				key,
-				action: action.name
-			});
-			await this.cache.set(key, {
-				body,
-				lastModified,
-				contentType,
-				hash: generatedEtag
-			});
-			const cacheControl = this.buildCacheControlHeader(cache);
-			if (cacheControl) request.reply.setHeader("cache-control", cacheControl);
-		}
-	});
-	onRequest = $hook({
-		on: "server:onRequest",
-		handler: async ({ route, request }) => {
-			const cache = route.cache;
-			const shouldStore = this.shouldStore(cache);
-			const shouldUseEtag = this.shouldUseEtag(cache);
-			if (!shouldStore && !shouldUseEtag) return;
-			const key = this.createCacheKey(route, request);
-			const cached = await this.cache.get(key);
-			if (cached) {
-				if (request.headers["if-none-match"] === cached.hash || request.headers["if-modified-since"] === cached.lastModified) {
-					request.reply.status = 304;
-					request.reply.setHeader("etag", cached.hash);
-					request.reply.setHeader("last-modified", cached.lastModified);
-					this.log.trace("ETag match, returning 304", {
-						route: route.path,
-						etag: cached.hash
-					});
-					return;
-				}
-				if (shouldStore) {
-					this.log.trace("Cache hit for route", {
-						key,
-						route: route.path
-					});
-					request.reply.body = cached.body;
-					request.reply.status = cached.status ?? 200;
-					if (cached.contentType) request.reply.setHeader("Content-Type", cached.contentType);
-					request.reply.setHeader("etag", cached.hash);
-					request.reply.setHeader("last-modified", cached.lastModified);
-				}
-			} else if (shouldStore) this.log.trace("Cache miss for route", {
-				key,
-				route: route.path
-			});
-		}
-	});
-	onSend = $hook({
-		on: "server:onSend",
-		handler: async ({ route, request }) => {
-			const cache = route.cache;
-			const shouldStore = this.shouldStore(cache);
-			const shouldUseEtag = this.shouldUseEtag(cache);
-			if (request.reply.headers.etag) return;
-			if (!shouldStore && shouldUseEtag && request.reply.body != null && (typeof request.reply.body === "string" || Buffer.isBuffer(request.reply.body))) {
-				const generatedEtag = this.generateETag(request.reply.body);
-				if (request.headers["if-none-match"] === generatedEtag) {
-					request.reply.status = 304;
-					request.reply.body = void 0;
-					request.reply.setHeader("etag", generatedEtag);
-					this.log.trace("ETag match on send, returning 304", {
-						route: route.path,
-						etag: generatedEtag
-					});
-					return;
-				}
-			}
-		}
-	});
-	onResponse = $hook({
-		on: "server:onResponse",
-		priority: "first",
-		handler: async ({ route, request, response }) => {
-			const cache = route.cache;
-			const cacheControl = this.buildCacheControlHeader(cache);
-			if (cacheControl) response.headers["cache-control"] = cacheControl;
-			const shouldStore = this.shouldStore(cache);
-			const shouldUseEtag = this.shouldUseEtag(cache);
-			if (!shouldStore && !shouldUseEtag) return;
-			if (typeof response.body !== "string") return;
-			if (response.status && response.status >= 400) return;
-			const key = this.createCacheKey(route, request);
-			const generatedEtag = this.generateETag(response.body);
-			const lastModified = this.time.toISOString();
-			response.headers ??= {};
-			if (shouldStore) {
-				this.log.trace("Storing response", {
-					key,
-					route: route.path,
-					cache: !!cache,
-					etag: shouldUseEtag
-				});
-				await this.cache.set(key, {
-					body: response.body,
-					status: response.status,
-					contentType: response.headers?.["content-type"],
-					lastModified,
-					hash: generatedEtag
-				});
-			}
-			if (shouldUseEtag) {
-				response.headers.etag = generatedEtag;
-				response.headers["last-modified"] = lastModified;
-			}
-		}
-	});
-	buildCacheControlHeader(cache) {
-		if (!cache) return;
-		if (cache === true || typeof cache === "string" || typeof cache === "number") return;
-		const control = cache.control;
-		if (!control) return;
-		if (typeof control === "string") return control;
-		if (control === true) return "public, max-age=300";
-		const directives = [];
-		if (control.public) directives.push("public");
-		if (control.private) directives.push("private");
-		if (control.noCache) directives.push("no-cache");
-		if (control.noStore) directives.push("no-store");
-		if (control.maxAge !== void 0) {
-			const maxAgeSeconds = this.durationToSeconds(control.maxAge);
-			directives.push(`max-age=${maxAgeSeconds}`);
-		}
-		if (control.sMaxAge !== void 0) {
-			const sMaxAgeSeconds = this.durationToSeconds(control.sMaxAge);
-			directives.push(`s-maxage=${sMaxAgeSeconds}`);
-		}
-		if (control.mustRevalidate) directives.push("must-revalidate");
-		if (control.proxyRevalidate) directives.push("proxy-revalidate");
-		if (control.immutable) directives.push("immutable");
-		return directives.length > 0 ? directives.join(", ") : void 0;
-	}
-	durationToSeconds(duration) {
-		if (typeof duration === "number") return duration;
-		return this.time.duration(duration).asSeconds();
-	}
-	shouldStore(cache) {
-		if (!cache) return false;
-		if (cache === true) return true;
-		if (typeof cache === "object" && cache.store) return true;
-		return false;
-	}
-	shouldUseEtag(cache) {
-		if (cache === true) return true;
-		if (typeof cache === "object" && cache.etag) return true;
-		return false;
-	}
-	createCacheKey(route, config) {
-		const params = [];
-		for (const [key, value] of Object.entries(config?.params ?? {})) params.push(`${key}=${value}`);
-		for (const [key, value] of Object.entries(config?.query ?? {})) params.push(`${key}=${value}`);
-		return `${route.method}:${route.path.replaceAll(":", "")}:${params.join(",").replaceAll(":", "")}`;
-	}
-};
-
-//#endregion
-//#region src/server-cache/index.ts
-/**
-* Plugin for Alepha Server that provides server-side caching capabilities.
-* It uses the Alepha Cache module to cache responses from server actions ($action).
-* It also provides a ETag-based cache invalidation mechanism.
-*
-* @example
-* ```ts
-* import { Alepha } from "alepha";
-* import { $action } from "alepha/server";
-* import { AlephaServerCache } from "alepha/server/cache";
-*
-* class ApiServer {
-*   hello = $action({
-*     cache: true,
-*     handler: () => "Hello, World!",
-*   });
-* }
-*
-* const alepha = Alepha.create()
-*   .with(AlephaServerCache)
-*   .with(ApiServer);
-*
-* run(alepha);
-* ```
-*
-* @see {@link ServerCacheProvider}
-* @module alepha.server.cache
-*/
-const AlephaServerCache = $module({
-	name: "alepha.server.cache",
-	services: [AlephaCache, ServerCacheProvider]
-});
-
-//#endregion
-//#region src/server-multipart/providers/ServerMultipartProvider.ts
-const envSchema = t.object({
-	SERVER_MULTIPART_LIMIT: t.integer({
-		default: 1e7,
-		min: 0,
-		description: "Maximum total size of multipart request body in bytes."
-	}),
-	SERVER_MULTIPART_FILE_LIMIT: t.integer({
-		default: 5e6,
-		min: 0,
-		description: "Maximum size of a single file in bytes."
-	}),
-	SERVER_MULTIPART_FILE_COUNT: t.integer({
-		default: 10,
-		min: 1,
-		description: "Maximum number of files allowed in a single request."
-	})
-});
-var ServerMultipartProvider = class {
-	alepha = $inject(Alepha);
-	env = $env(envSchema);
-	log = $logger();
-	onRequest = $hook({
-		on: "server:onRequest",
-		handler: async ({ route, request }) => {
-			if (request.body) return;
-			if (!route.schema?.body) return;
-			let webRequest;
-			if (request.raw.web?.req) webRequest = request.raw.web.req;
-			else if (request.raw.node?.req) webRequest = new Request(request.url, {
-				method: request.method,
-				headers: request.headers,
-				body: ReadableStream.from(request.raw.node.req),
-				duplex: "half"
-			});
-			if (!webRequest) return;
-			const contentType = request.headers["content-type"];
-			const contentLength = request.headers["content-length"];
-			if (contentLength) {
-				const size = Number.parseInt(contentLength, 10);
-				if (!Number.isNaN(size) && size > this.env.SERVER_MULTIPART_LIMIT) {
-					this.log.error(`Multipart request size limit exceeded: ${size} > ${this.env.SERVER_MULTIPART_LIMIT}`);
-					throw new HttpError({
-						status: 413,
-						message: `Request body size limit exceeded. Maximum allowed: ${this.env.SERVER_MULTIPART_LIMIT} bytes`
-					});
-				}
-			}
-			if (!contentType?.startsWith("multipart/form-data")) {
-				if (!isMultipart(route)) return;
-				throw new HttpError({
-					status: 415,
-					message: `Invalid content-type: ${contentType} - only "multipart/form-data" is accepted`
-				});
-			}
-			const { body, cleanup } = await this.handleMultipartBodyFromWeb(route, webRequest);
-			request.body = body;
-			request.metadata.multipart = { cleanup };
-		}
-	});
-	onResponse = $hook({
-		on: "server:onResponse",
-		handler: async ({ request }) => {
-			const cleanup = request.metadata.multipart?.cleanup;
-			if (typeof cleanup === "function") await cleanup();
-		}
-	});
-	async handleMultipartBodyFromWeb(route, request) {
-		let formData;
-		try {
-			formData = await request.formData();
-		} catch (error) {
-			throw new HttpError({
-				status: 400,
-				message: "Malformed multipart/form-data"
-			}, error);
-		}
-		const body = {};
-		const tempFiles = [];
-		const cleanupOnError = async () => {
-			for (const file of tempFiles) try {
-				await file.cleanup();
-			} catch {}
-		};
-		try {
-			let fileCount = 0;
-			let totalSize = 0;
-			if (route.schema?.body && t.schema.isObject(route.schema.body)) {
-				for (const [key, value] of Object.entries(route.schema.body.properties)) if (t.schema.isSchema(value)) if (isTypeFile(value)) {
-					const file = formData.get(key);
-					if (file && typeof file === "object" && "arrayBuffer" in file) {
-						const blob = file;
-						fileCount++;
-						if (fileCount > this.env.SERVER_MULTIPART_FILE_COUNT) {
-							this.log.error(`Too many files in multipart request: ${fileCount} > ${this.env.SERVER_MULTIPART_FILE_COUNT}`);
-							throw new HttpError({
-								status: 413,
-								message: `Too many files. Maximum allowed: ${this.env.SERVER_MULTIPART_FILE_COUNT}`
-							});
-						}
-						if (blob.size > this.env.SERVER_MULTIPART_FILE_LIMIT) {
-							this.log.error(`File "${key}" exceeds size limit: ${blob.size} > ${this.env.SERVER_MULTIPART_FILE_LIMIT}`);
-							throw new HttpError({
-								status: 413,
-								message: `File "${key}" exceeds size limit. Maximum allowed: ${this.env.SERVER_MULTIPART_FILE_LIMIT} bytes`
-							});
-						}
-						totalSize += blob.size;
-						if (totalSize > this.env.SERVER_MULTIPART_LIMIT) {
-							this.log.error(`Total multipart size exceeds limit: ${totalSize} > ${this.env.SERVER_MULTIPART_LIMIT}`);
-							throw new HttpError({
-								status: 413,
-								message: `Total request size exceeds limit. Maximum allowed: ${this.env.SERVER_MULTIPART_LIMIT} bytes`
-							});
-						}
-						const hybridFile = await this.createHybridFile(blob, key);
-						body[key] = hybridFile;
-						tempFiles.push(hybridFile);
-					}
-				} else {
-					const fieldValue = formData.get(key);
-					if (fieldValue !== null) {
-						const stringValue = typeof fieldValue === "string" ? fieldValue : "";
-						body[key] = this.alepha.codec.decode(value, stringValue);
-					}
-				}
-			}
-			return {
-				body,
-				cleanup: async () => {
-					for (const file of tempFiles) await file.cleanup();
-				}
-			};
-		} catch (error) {
-			await cleanupOnError();
-			throw error;
-		}
-	}
-	/**
-	* This is a legacy code, previously we used "busboy" to parse multipart in Node.js environment.
-	* Now we rely on Web Request's formData() method, which is supported in modern Node.js versions.
-	* However, we still need to create temporary files for uploaded files to provide a consistent File-like interface.
-	*
-	* TODO: In future, we might want to refactor this to avoid using temporary files if not necessary?
-	*/
-	async createHybridFile(file, fieldName) {
-		const tmpPath = `${os.tmpdir()}/${randomUUID()}`;
-		const arrayBuffer = await file.arrayBuffer();
-		await writeFile(tmpPath, Buffer.from(arrayBuffer));
-		const fileName = file.name || `${fieldName}_${Date.now()}`;
-		return {
-			_state: {
-				cleanup: false,
-				size: file.size,
-				tmpPath
-			},
-			name: fileName,
-			type: file.type || "application/octet-stream",
-			lastModified: file.lastModified || Date.now(),
-			filepath: tmpPath,
-			get size() {
-				return this._state.size;
-			},
-			stream() {
-				return createReadStream(tmpPath);
-			},
-			async arrayBuffer() {
-				const content = await readFile(tmpPath);
-				return content.buffer.slice(content.byteOffset, content.byteOffset + content.byteLength);
-			},
-			text: async () => {
-				return await readFile(tmpPath, "utf-8");
-			},
-			async cleanup() {
-				if (this._state.cleanup) return;
-				await unlink(tmpPath);
-				this._state.cleanup = true;
-			}
-		};
-	}
-};
-
-//#endregion
-//#region src/server-multipart/index.ts
-/**
-* This module provides support for handling multipart/form-data requests.
-* It allows to parse body data containing t.file().
-*
-* @see {@link ServerMultipartProvider}
-* @module alepha.server.multipart
-*/
-const AlephaServerMultipart = $module({
-	name: "alepha.server.multipart",
-	services: [AlephaServer, ServerMultipartProvider]
-});
-
-//#endregion
 //#region src/api-files/schemas/fileQuerySchema.ts
 const fileQuerySchema = t.extend(pageQuerySchema, {
 	bucket: t.optional(t.string()),
@@ -550,14 +108,14 @@ var FileService = class {
 		return hash.digest("hex");
 	}
 	/**
-	* Gets a bucket descriptor by name.
+	* Gets a bucket primitive by name.
 	*
 	* @param bucketName - The name of the bucket to retrieve (defaults to "default")
-	* @returns The bucket descriptor
+	* @returns The bucket primitive
 	* @throws {NotFoundError} If the bucket is not found
 	*/
 	bucket(bucketName = this.defaultBucket.name) {
-		const bucket = this.alepha.descriptors($bucket).find((it) => it.name === bucketName);
+		const bucket = this.alepha.primitives($bucket).find((it) => it.name === bucketName);
 		if (!bucket) throw new NotFoundError(`Bucket '${bucketName}' not found.`);
 		return bucket;
 	}
@@ -871,309 +429,6 @@ var FileController = class {
 	});
 };
 
-//#endregion
-//#region src/server-security/providers/ServerBasicAuthProvider.ts
-var ServerBasicAuthProvider = class {
-	alepha = $inject(Alepha);
-	log = $logger();
-	routerProvider = $inject(ServerRouterProvider);
-	realm = "Secure Area";
-	/**
-	* Registered basic auth descriptors with their configurations
-	*/
-	registeredAuths = [];
-	/**
-	* Register a basic auth configuration (called by descriptors)
-	*/
-	registerAuth(config) {
-		this.registeredAuths.push(config);
-	}
-	onStart = $hook({
-		on: "start",
-		handler: async () => {
-			for (const auth of this.registeredAuths) if (auth.paths) for (const pattern of auth.paths) {
-				const matchedRoutes = this.routerProvider.getRoutes(pattern);
-				for (const route of matchedRoutes) route.secure = { basic: {
-					username: auth.username,
-					password: auth.password
-				} };
-			}
-			if (this.registeredAuths.length > 0) this.log.info(`Initialized with ${this.registeredAuths.length} registered basic-auth configurations.`);
-		}
-	});
-	/**
-	* Hook into server:onRequest to check basic auth
-	*/
-	onRequest = $hook({
-		on: "server:onRequest",
-		handler: async ({ route, request }) => {
-			const routeAuth = route.secure;
-			if (typeof routeAuth === "object" && "basic" in routeAuth && routeAuth.basic) this.checkAuth(request, routeAuth.basic);
-		}
-	});
-	/**
-	* Hook into action:onRequest to check basic auth for actions
-	*/
-	onActionRequest = $hook({
-		on: "action:onRequest",
-		handler: async ({ action, request }) => {
-			const routeAuth = action.route.secure;
-			if (isBasicAuth(routeAuth)) this.checkAuth(request, routeAuth.basic);
-		}
-	});
-	/**
-	* Check basic authentication
-	*/
-	checkAuth(request, options) {
-		const authHeader = request.headers?.authorization;
-		if (!authHeader || !authHeader.startsWith("Basic ")) {
-			this.sendAuthRequired(request);
-			throw new HttpError({
-				status: 401,
-				message: "Authentication required"
-			});
-		}
-		const base64Credentials = authHeader.slice(6);
-		const credentials = Buffer.from(base64Credentials, "base64").toString("utf-8");
-		const colonIndex = credentials.indexOf(":");
-		const username = colonIndex !== -1 ? credentials.slice(0, colonIndex) : credentials;
-		const password = colonIndex !== -1 ? credentials.slice(colonIndex + 1) : "";
-		if (!this.timingSafeCredentialCheck(username, password, options.username, options.password)) {
-			this.sendAuthRequired(request);
-			this.log.warn(`Failed basic auth attempt for user`, { username });
-			throw new HttpError({
-				status: 401,
-				message: "Invalid credentials"
-			});
-		}
-	}
-	/**
-	* Performs a timing-safe comparison of credentials to prevent timing attacks.
-	* Always compares both username and password to avoid leaking which one is wrong.
-	*/
-	timingSafeCredentialCheck(inputUsername, inputPassword, expectedUsername, expectedPassword) {
-		const inputUserBuf = Buffer.from(inputUsername, "utf-8");
-		const expectedUserBuf = Buffer.from(expectedUsername, "utf-8");
-		const inputPassBuf = Buffer.from(inputPassword, "utf-8");
-		const expectedPassBuf = Buffer.from(expectedPassword, "utf-8");
-		return (this.safeCompare(inputUserBuf, expectedUserBuf) & this.safeCompare(inputPassBuf, expectedPassBuf)) === 1;
-	}
-	/**
-	* Compares two buffers in constant time, handling different lengths safely.
-	* Returns 1 if equal, 0 if not equal.
-	*/
-	safeCompare(input, expected) {
-		if (input.length !== expected.length) {
-			timingSafeEqual(input, input);
-			return 0;
-		}
-		return timingSafeEqual(input, expected) ? 1 : 0;
-	}
-	/**
-	* Send WWW-Authenticate header
-	*/
-	sendAuthRequired(request) {
-		request.reply.setHeader("WWW-Authenticate", `Basic realm="${this.realm}"`);
-	}
-};
-const isBasicAuth = (value) => {
-	return typeof value === "object" && !!value && "basic" in value && !!value.basic;
-};
-
-//#endregion
-//#region src/server-security/descriptors/$basicAuth.ts
-/**
-* Declares HTTP Basic Authentication for server routes.
-* This descriptor provides methods to protect routes with username/password authentication.
-*/
-const $basicAuth = (options) => {
-	return createDescriptor(BasicAuthDescriptor, options);
-};
-var BasicAuthDescriptor = class extends Descriptor {
-	serverBasicAuthProvider = $inject(ServerBasicAuthProvider);
-	get name() {
-		return this.options.name ?? `${this.config.propertyKey}`;
-	}
-	onInit() {
-		this.serverBasicAuthProvider.registerAuth(this.options);
-	}
-	/**
-	* Checks basic auth for the given request using this descriptor's configuration.
-	*/
-	check(request, options) {
-		const mergedOptions = {
-			...this.options,
-			...options
-		};
-		this.serverBasicAuthProvider.checkAuth(request, mergedOptions);
-	}
-};
-$basicAuth[KIND] = BasicAuthDescriptor;
-
-//#endregion
-//#region src/server-security/providers/ServerSecurityProvider.ts
-var ServerSecurityProvider = class {
-	log = $logger();
-	securityProvider = $inject(SecurityProvider);
-	jwtProvider = $inject(JwtProvider);
-	alepha = $inject(Alepha);
-	onConfigure = $hook({
-		on: "configure",
-		handler: async () => {
-			for (const action of this.alepha.descriptors($action)) {
-				if (action.options.disabled || action.options.secure === false || this.securityProvider.getRealms().length === 0) continue;
-				if (typeof action.options.secure !== "object") this.securityProvider.createPermission({
-					name: action.name,
-					group: action.group,
-					method: action.route.method,
-					path: action.route.path
-				});
-			}
-		}
-	});
-	onActionRequest = $hook({
-		on: "action:onRequest",
-		handler: async ({ action, request, options }) => {
-			if (action.options.secure === false && !options.user) {
-				this.log.trace("Skipping security check for route");
-				return;
-			}
-			if (isBasicAuth(action.route.secure)) return;
-			const permission = this.securityProvider.getPermissions().find((it) => it.path === action.route.path && it.method === action.route.method);
-			try {
-				request.user = this.createUserFromLocalFunctionContext(options, permission);
-				const route = action.route;
-				if (typeof route.secure === "object") this.check(request.user, route.secure);
-				this.alepha.state.set("alepha.server.request.user", this.alepha.codec.decode(userAccountInfoSchema, request.user));
-			} catch (error) {
-				if (action.options.secure || permission) throw error;
-				this.log.trace("Skipping security check for action");
-			}
-		}
-	});
-	onRequest = $hook({
-		on: "server:onRequest",
-		priority: "last",
-		handler: async ({ request, route }) => {
-			if (route.secure === false) {
-				this.log.trace("Skipping security check for route - explicitly disabled");
-				return;
-			}
-			if (isBasicAuth(route.secure)) return;
-			const permission = this.securityProvider.getPermissions().find((it) => it.path === route.path && it.method === route.method);
-			if (!request.headers.authorization && !route.secure && !permission) {
-				this.log.trace("Skipping security check for route - no authorization header and not secure");
-				return;
-			}
-			try {
-				request.user = await this.securityProvider.createUserFromToken(request.headers.authorization, { permission });
-				if (typeof route.secure === "object") this.check(request.user, route.secure);
-				this.alepha.state.set("alepha.server.request.user", this.alepha.codec.decode(userAccountInfoSchema, request.user));
-				this.log.trace("User set from request token", {
-					user: request.user,
-					permission
-				});
-			} catch (error) {
-				if (route.secure || permission) throw error;
-				this.log.trace("Skipping security check for route - error occurred", error);
-			}
-		}
-	});
-	check(user, secure) {
-		if (secure.realm) {
-			if (user.realm !== secure.realm) throw new ForbiddenError(`User must belong to realm '${secure.realm}' to access this route`);
-		}
-	}
-	/**
-	* Get the user account token for a local action call.
-	* There are three possible sources for the user:
-	* - `options.user`: the user passed in the options
-	* - `"system"`: the system user from the state (you MUST set state `server.security.system.user`)
-	* - `"context"`: the user from the request context (you MUST be in an HTTP request context)
-	*
-	* Priority order: `options.user` > `"system"` > `"context"`.
-	*
-	* In testing environment, if no user is provided, a test user is created based on the SecurityProvider's roles.
-	*/
-	createUserFromLocalFunctionContext(options, permission) {
-		const fromOptions = typeof options.user === "object" ? options.user : void 0;
-		const type = typeof options.user === "string" ? options.user : void 0;
-		let user;
-		const fromContext = this.alepha.context.get("request")?.user;
-		const fromSystem = this.alepha.state.get("alepha.server.security.system.user");
-		if (type === "system") user = fromSystem;
-		else if (type === "context") user = fromContext;
-		else user = fromOptions ?? fromContext ?? fromSystem;
-		if (!user) {
-			if (this.alepha.isTest() && !("user" in options)) return this.createTestUser();
-			throw new UnauthorizedError("User is required for calling this action");
-		}
-		const roles = user.roles ?? (this.alepha.isTest() ? this.securityProvider.getRoles().map((role) => role.name) : []);
-		let ownership;
-		if (permission) {
-			const result = this.securityProvider.checkPermission(permission, ...roles);
-			if (!result.isAuthorized) throw new ForbiddenError(`Permission '${this.securityProvider.permissionToString(permission)}' is required for this route`);
-			ownership = result.ownership;
-		}
-		return {
-			...user,
-			ownership
-		};
-	}
-	createTestUser() {
-		return {
-			id: randomUUID(),
-			name: "Test",
-			roles: this.securityProvider.getRoles().map((role) => role.name)
-		};
-	}
-	onClientRequest = $hook({
-		on: "client:onRequest",
-		handler: async ({ request, options }) => {
-			if (!this.alepha.isTest()) return;
-			if ("user" in options && options.user === void 0) return;
-			request.headers = new Headers(request.headers);
-			if (!request.headers.has("authorization")) {
-				const test = this.createTestUser();
-				const user = typeof options?.user === "object" ? options.user : void 0;
-				const sub = user?.id ?? test.id;
-				const roles = user?.roles ?? test.roles;
-				const token = await this.jwtProvider.create({
-					sub,
-					roles
-				}, user?.realm ?? this.securityProvider.getRealms()[0]?.name);
-				request.headers.set("authorization", `Bearer ${token}`);
-			}
-		}
-	});
-};
-
-//#endregion
-//#region src/server-security/index.ts
-/**
-* Plugin for Alepha Server that provides security features. Based on the Alepha Security module.
-*
-* By default, all $action will be guarded by a permission check.
-*
-* @see {@link ServerSecurityProvider}
-* @module alepha.server.security
-*/
-const AlephaServerSecurity = $module({
-	name: "alepha.server.security",
-	descriptors: [
-		$realm,
-		$role,
-		$permission,
-		$basicAuth
-	],
-	services: [
-		AlephaServer,
-		AlephaSecurity,
-		ServerSecurityProvider,
-		ServerBasicAuthProvider
-	]
-});
-
 //#endregion
 //#region src/api-files/schemas/storageStatsSchema.ts
 const bucketStatsSchema = t.object({