alepha 0.15.2 → 0.15.4

package/src/server/links/providers/ServerLinksProvider.spec.ts

@@ -0,0 +1,332 @@
+import { randomUUID } from "node:crypto";
+import { Alepha, t } from "alepha";
+import { $issuer, AlephaSecurity } from "alepha/security";
+import { $action, ServerProvider } from "alepha/server";
+import { describe, it } from "vitest";
+import { LinkProvider, ServerLinksProvider } from "../index.ts";
+
+describe("ServerLinksProvider", () => {
+  describe("secured field in links", () => {
+    it("should set secured=undefined for public actions (no secure option)", async ({
+      expect,
+    }) => {
+      class App {
+        publicAction = $action({
+          handler: () => "PUBLIC",
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+      const link = links.find((l) => l.name === "publicAction");
+
+      expect(link).toBeDefined();
+      expect(link?.secured).toBeUndefined();
+    });
+
+    it("should set secured=false for explicitly public actions", async ({
+      expect,
+    }) => {
+      class App {
+        publicAction = $action({
+          secure: false,
+          handler: () => "PUBLIC",
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+      const link = links.find((l) => l.name === "publicAction");
+
+      expect(link).toBeDefined();
+      expect(link?.secured).toBe(false);
+    });
+
+    it("should set secured=true for secured actions", async ({ expect }) => {
+      class App {
+        securedAction = $action({
+          secure: true,
+          handler: () => "SECURED",
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+      const link = links.find((l) => l.name === "securedAction");
+
+      expect(link).toBeDefined();
+      expect(link?.secured).toBe(true);
+    });
+
+    it("should set secured to object for realm-secured actions", async ({
+      expect,
+    }) => {
+      class App {
+        realmAction = $action({
+          secure: { realm: "admin" },
+          handler: () => "REALM",
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+      const link = links.find((l) => l.name === "realmAction");
+
+      expect(link).toBeDefined();
+      expect(link?.secured).toEqual({ realm: "admin" });
+    });
+  });
+
+  describe("/_links endpoint with security", () => {
+    it("should return public actions to unauthenticated users", async ({
+      expect,
+    }) => {
+      class App {
+        publicAction = $action({
+          schema: { response: t.text() },
+          handler: () => "PUBLIC",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [{ name: "user", permissions: [{ name: "*" }] }],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      const res = await fetch(
+        `${alepha.inject(ServerProvider).hostname}/api/_links`,
+      );
+      const data = await res.json();
+
+      expect(data.links).toContainEqual(
+        expect.objectContaining({
+          name: "publicAction",
+          path: "/publicAction",
+        }),
+      );
+    });
+
+    it("should NOT return secured actions to unauthenticated users", async ({
+      expect,
+    }) => {
+      class App {
+        securedAction = $action({
+          secure: true,
+          schema: { response: t.text() },
+          handler: () => "SECURED",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [{ name: "user", permissions: [{ name: "*" }] }],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      const res = await fetch(
+        `${alepha.inject(ServerProvider).hostname}/api/_links`,
+      );
+      const data = await res.json();
+
+      expect(data.links).not.toContainEqual(
+        expect.objectContaining({
+          name: "securedAction",
+        }),
+      );
+    });
+
+    it("should return secured actions to authenticated users with permissions", async ({
+      expect,
+    }) => {
+      class App {
+        securedAction = $action({
+          secure: true,
+          schema: { response: t.text() },
+          handler: () => "SECURED",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [{ name: "user", permissions: [{ name: "*" }] }],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      // Use HttpClient to get a token automatically in test mode
+      const app = alepha.inject(App);
+      const { data } = await app.securedAction.fetch(
+        {},
+        {
+          user: { id: randomUUID(), roles: ["user"] },
+        },
+      );
+      expect(data).toBe("SECURED");
+    });
+
+    it("should return both public and secured actions when user is authenticated", async ({
+      expect,
+    }) => {
+      class App {
+        publicAction = $action({
+          schema: { response: t.text() },
+          handler: () => "PUBLIC",
+        });
+        securedAction = $action({
+          secure: true,
+          schema: { response: t.text() },
+          handler: () => "SECURED",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [{ name: "user", permissions: [{ name: "*" }] }],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      const linksProvider = alepha.inject(ServerLinksProvider);
+      const user = { id: randomUUID(), roles: ["user"] };
+
+      const { links } = await linksProvider.getUserApiLinks({ user });
+
+      expect(links).toContainEqual(
+        expect.objectContaining({ name: "publicAction" }),
+      );
+      expect(links).toContainEqual(
+        expect.objectContaining({ name: "securedAction" }),
+      );
+    });
+
+    it("should filter secured actions based on user permissions", async ({
+      expect,
+    }) => {
+      class App {
+        adminOnly = $action({
+          secure: true,
+          group: "admin",
+          schema: { response: t.text() },
+          handler: () => "ADMIN",
+        });
+        userAction = $action({
+          secure: true,
+          group: "user",
+          schema: { response: t.text() },
+          handler: () => "USER",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [
+            { name: "admin", permissions: [{ name: "*" }] },
+            { name: "user", permissions: [{ name: "user:*" }] },
+          ],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      const linksProvider = alepha.inject(ServerLinksProvider);
+
+      // User with "user" role should only see userAction
+      const userLinks = await linksProvider.getUserApiLinks({
+        user: { id: randomUUID(), roles: ["user"] },
+      });
+
+      expect(userLinks.links).toContainEqual(
+        expect.objectContaining({ name: "userAction" }),
+      );
+      expect(userLinks.links).not.toContainEqual(
+        expect.objectContaining({ name: "adminOnly" }),
+      );
+
+      // User with "admin" role should see both
+      const adminLinks = await linksProvider.getUserApiLinks({
+        user: { id: randomUUID(), roles: ["admin"] },
+      });
+
+      expect(adminLinks.links).toContainEqual(
+        expect.objectContaining({ name: "userAction" }),
+      );
+      expect(adminLinks.links).toContainEqual(
+        expect.objectContaining({ name: "adminOnly" }),
+      );
+    });
+  });
+
+  describe("mixed public and secured actions", () => {
+    it("should correctly differentiate public from secured in server links", async ({
+      expect,
+    }) => {
+      class App {
+        getUsers = $action({
+          path: "/users",
+          schema: { response: t.array(t.text()) },
+          handler: () => ["user1", "user2"],
+        });
+        createUser = $action({
+          path: "/users",
+          secure: true,
+          schema: {
+            body: t.object({ name: t.text() }),
+            response: t.text(),
+          },
+          handler: ({ body }) => body.name,
+        });
+        deleteUser = $action({
+          method: "DELETE",
+          path: "/users/:id",
+          secure: true,
+          schema: {
+            params: t.object({ id: t.text() }),
+            response: t.void(),
+          },
+          handler: () => {},
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+
+      const getUsers = links.find((l) => l.name === "getUsers");
+      const createUser = links.find((l) => l.name === "createUser");
+      const deleteUser = links.find((l) => l.name === "deleteUser");
+
+      // getUsers is public (no secure option)
+      expect(getUsers?.secured).toBeUndefined();
+
+      // createUser and deleteUser are secured
+      expect(createUser?.secured).toBe(true);
+      expect(deleteUser?.secured).toBe(true);
+    });
+  });
+});

package/src/server/links/providers/ServerLinksProvider.ts

@@ -48,7 +48,7 @@ export class ServerLinksProvider {
           group: action.group,
           schema: action.options.schema,
           requestBodyType: action.getBodyContentType(),
-          secured: action.options.secure ?? true,
+          secured: action.options.secure,
           method: action.method === "GET" ? undefined : action.method,
           prefix: action.prefix,
           path: action.path,

package/src/system/index.browser.ts

@@ -1,11 +1,36 @@
 import { $module } from "alepha";
+import { FileSystemProvider } from "./providers/FileSystemProvider.ts";
+import { MemoryFileSystemProvider } from "./providers/MemoryFileSystemProvider.ts";
+import { MemoryShellProvider } from "./providers/MemoryShellProvider.ts";
+import { ShellProvider } from "./providers/ShellProvider.ts";
+import { FileDetector } from "./services/FileDetector.ts";
 
 export * from "./errors/FileError.ts";
 export * from "./providers/FileSystemProvider.ts";
 export * from "./providers/MemoryFileSystemProvider.ts";
 export * from "./providers/MemoryShellProvider.ts";
 export * from "./providers/ShellProvider.ts";
+export * from "./services/FileDetector.ts";
 
 export const AlephaSystem = $module({
   name: "alepha.system",
+  services: [
+    FileDetector,
+    FileSystemProvider,
+    MemoryFileSystemProvider,
+    ShellProvider,
+    MemoryShellProvider,
+  ],
+  register: (alepha) =>
+    alepha
+      .with({
+        optional: true,
+        provide: FileSystemProvider,
+        use: MemoryFileSystemProvider,
+      })
+      .with({
+        optional: true,
+        provide: ShellProvider,
+        use: MemoryShellProvider,
+      }),
 });

package/src/system/index.workerd.ts

@@ -0,0 +1 @@
+export * from "./index.browser.ts";

package/src/system/providers/FileSystemProvider.ts

@@ -196,8 +196,16 @@ export interface CpOptions {
 export interface MkdirOptions {
   /**
    * If true, creates parent directories as needed
+   *
+   * @default true
    */
   recursive?: boolean;
+  /**
+   * If true, does not throw an error if the directory already exists
+   *
+   * @default true
+   */
+  force?: boolean;
   /**
    * File mode (permission and sticky bits)
    */

package/src/system/providers/NodeFileSystemProvider.ts

@@ -291,8 +291,17 @@ export class NodeFileSystemProvider implements FileSystemProvider {
    * await fs.mkdir("/tmp/mydir", { mode: 0o755 });
    * ```
    */
-  async mkdir(path: string, options?: MkdirOptions): Promise<void> {
-    await fsMkdir(path, options);
+  async mkdir(path: string, options: MkdirOptions = {}): Promise<void> {
+    const p = fsMkdir(path, {
+      recursive: options.recursive ?? true,
+      mode: options.mode,
+    });
+
+    if (options.force === false) {
+      await p;
+    } else {
+      await p.catch(() => {});
+    }
   }
 
   /**

package/src/vite/tasks/buildServer.ts

@@ -23,7 +23,7 @@ export interface BuildServerOptions {
 
   /**
    * Optional client directory name (relative to distDir).
-   * If provided, the client template will be embedded in the server output.
+   * If provided, the SSR manifest will be embedded in the server output.
    */
   clientDir?: string;
 
@@ -167,16 +167,6 @@ export async function buildServer(
 
   const entryFile = extractEntryFromBundle(opts.entry, result);
 
-  // Embed client template if client was built
-  let template = "";
-  if (opts.clientDir) {
-    const index = await readFile(
-      `${opts.distDir}/${opts.clientDir}/index.html`,
-      "utf-8",
-    );
-    template = `__alepha.set("alepha.react.server.template", \`${index.replace(/>\s*</g, "><").trim()}\`);\n`;
-  }
-
   // Embed SSR manifests if client was built
   // This bundles all manifest data into index.js for serverless deployments
   let manifest = "";
@@ -230,7 +220,7 @@ export async function buildServer(
 
   await writeFile(
     `${opts.distDir}/index.js`,
-    `${warning}\n${template}${manifest}import './server/${entryFile}';\n`.trim(),
+    `${warning}\n${manifest}import './server/${entryFile}';\n`.trim(),
   );
 
   return { entryFile, manifest: manifestData };

package/src/vite/tasks/generateCloudflare.ts

@@ -1,5 +1,8 @@
 import { access, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
+import type { Alepha } from "alepha";
+import type { CronProvider } from "alepha/scheduler";
+import type { WorkerdCronProvider } from "../../scheduler/providers/WorkerdCronProvider.ts";
 
 export interface GenerateCloudflareOptions {
   /**
@@ -13,6 +16,8 @@ export interface GenerateCloudflareOptions {
    * Additional Wrangler configuration options to merge into wrangler.jsonc.
    */
   config?: WranglerConfig;
+
+  alepha: Alepha;
 }
 
 export interface WranglerConfig {
@@ -31,7 +36,7 @@ const WARNING_COMMENT =
  * - worker.js entry point for Cloudflare Workers
  */
 export async function generateCloudflare(
-  opts: GenerateCloudflareOptions = {},
+  opts: GenerateCloudflareOptions,
 ): Promise<void> {
   const distDir = opts.distDir ?? "dist";
   const root = process.cwd();
@@ -40,6 +45,15 @@ export async function generateCloudflare(
     .then(() => true)
     .catch(() => false);
 
+  let workerdCronProvider: CronProvider | undefined;
+  try {
+    workerdCronProvider = opts.alepha.inject(
+      "CronProvider",
+    ) as WorkerdCronProvider;
+  } catch {}
+
+  const crons = workerdCronProvider?.getCronJobs();
+
   const wrangler: WranglerConfig = {
     name,
     main: "./main.cloudflare.js",
@@ -62,12 +76,15 @@ export async function generateCloudflare(
     };
   }
 
+  if (crons && crons.length > 0) {
+    const cronExpressions = [...new Set(crons.map((c) => c.expression))];
+    wrangler.triggers ??= {};
+    wrangler.triggers.crons = cronExpressions;
+  }
+
   const url = process.env.DATABASE_URL;
-  if (url?.startsWith("cloudflare-d1:")) {
-    const [name, id] = url
-      .replace("cloudflare-d1://", "")
-      .replace("cloudflare-d1:", "")
-      .split(":");
+  if (url?.startsWith("d1:")) {
+    const [name, id] = url.replace("d1://", "").replace("d1:", "").split(":");
     wrangler.d1_databases = wrangler.d1_databases || [];
     wrangler.d1_databases.push({
       binding: name,
@@ -75,7 +92,7 @@ export async function generateCloudflare(
       database_id: id,
     });
     wrangler.vars ??= {};
-    wrangler.vars.DATABASE_URL = `cloudflare-d1://${name}:${id}`;
+    wrangler.vars.DATABASE_URL = `d1://${name}:${id}`;
   }
 
   await writeFile(
@@ -102,11 +119,33 @@ export default {
 
     __alepha.set("cloudflare.env", env);
 
-    await __alepha.start();
+    try {
+      await __alepha.start();
+    } catch (err) {
+      console.error("Failed to start Alepha for fetch event", err);
+      return new Response("Internal Server Error", { status: 500 });
+    }
+
     await __alepha.events.emit("web:request", ctx);
 
     return ctx.res;
   },
+
+  scheduled: async (event, env, ctx) => {
+    __alepha.set("cloudflare.env", env);
+
+    try {
+      await __alepha.start();
+    } catch (err) {
+      console.error("Failed to start Alepha for scheduled event", err);
+      throw err;
+    }
+
+    await __alepha.events.emit("cloudflare:scheduled", {
+      cron: event.cron,
+      scheduledTime: event.scheduledTime,
+    });
+  },
 };
 `.trim();
 

package/src/vite/tasks/generateDocker.ts

@@ -67,6 +67,10 @@ WORKDIR /app
 
 COPY . .
 
+RUN ${command === "bun" ? "bun" : "npm"} install
+
+ENV SERVER_HOST=0.0.0.0
+
 CMD ["${command}", "index.js"]
 `;