alepha 0.15.3 → 0.15.5

package/src/server/links/providers/ServerLinksProvider.spec.ts

@@ -0,0 +1,332 @@
+import { randomUUID } from "node:crypto";
+import { Alepha, t } from "alepha";
+import { $issuer, AlephaSecurity } from "alepha/security";
+import { $action, ServerProvider } from "alepha/server";
+import { describe, it } from "vitest";
+import { LinkProvider, ServerLinksProvider } from "../index.ts";
+
+describe("ServerLinksProvider", () => {
+  describe("secured field in links", () => {
+    it("should set secured=undefined for public actions (no secure option)", async ({
+      expect,
+    }) => {
+      class App {
+        publicAction = $action({
+          handler: () => "PUBLIC",
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+      const link = links.find((l) => l.name === "publicAction");
+
+      expect(link).toBeDefined();
+      expect(link?.secured).toBeUndefined();
+    });
+
+    it("should set secured=false for explicitly public actions", async ({
+      expect,
+    }) => {
+      class App {
+        publicAction = $action({
+          secure: false,
+          handler: () => "PUBLIC",
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+      const link = links.find((l) => l.name === "publicAction");
+
+      expect(link).toBeDefined();
+      expect(link?.secured).toBe(false);
+    });
+
+    it("should set secured=true for secured actions", async ({ expect }) => {
+      class App {
+        securedAction = $action({
+          secure: true,
+          handler: () => "SECURED",
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+      const link = links.find((l) => l.name === "securedAction");
+
+      expect(link).toBeDefined();
+      expect(link?.secured).toBe(true);
+    });
+
+    it("should set secured to object for realm-secured actions", async ({
+      expect,
+    }) => {
+      class App {
+        realmAction = $action({
+          secure: { realm: "admin" },
+          handler: () => "REALM",
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+      const link = links.find((l) => l.name === "realmAction");
+
+      expect(link).toBeDefined();
+      expect(link?.secured).toEqual({ realm: "admin" });
+    });
+  });
+
+  describe("/_links endpoint with security", () => {
+    it("should return public actions to unauthenticated users", async ({
+      expect,
+    }) => {
+      class App {
+        publicAction = $action({
+          schema: { response: t.text() },
+          handler: () => "PUBLIC",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [{ name: "user", permissions: [{ name: "*" }] }],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      const res = await fetch(
+        `${alepha.inject(ServerProvider).hostname}/api/_links`,
+      );
+      const data = await res.json();
+
+      expect(data.links).toContainEqual(
+        expect.objectContaining({
+          name: "publicAction",
+          path: "/publicAction",
+        }),
+      );
+    });
+
+    it("should NOT return secured actions to unauthenticated users", async ({
+      expect,
+    }) => {
+      class App {
+        securedAction = $action({
+          secure: true,
+          schema: { response: t.text() },
+          handler: () => "SECURED",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [{ name: "user", permissions: [{ name: "*" }] }],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      const res = await fetch(
+        `${alepha.inject(ServerProvider).hostname}/api/_links`,
+      );
+      const data = await res.json();
+
+      expect(data.links).not.toContainEqual(
+        expect.objectContaining({
+          name: "securedAction",
+        }),
+      );
+    });
+
+    it("should return secured actions to authenticated users with permissions", async ({
+      expect,
+    }) => {
+      class App {
+        securedAction = $action({
+          secure: true,
+          schema: { response: t.text() },
+          handler: () => "SECURED",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [{ name: "user", permissions: [{ name: "*" }] }],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      // Use HttpClient to get a token automatically in test mode
+      const app = alepha.inject(App);
+      const { data } = await app.securedAction.fetch(
+        {},
+        {
+          user: { id: randomUUID(), roles: ["user"] },
+        },
+      );
+      expect(data).toBe("SECURED");
+    });
+
+    it("should return both public and secured actions when user is authenticated", async ({
+      expect,
+    }) => {
+      class App {
+        publicAction = $action({
+          schema: { response: t.text() },
+          handler: () => "PUBLIC",
+        });
+        securedAction = $action({
+          secure: true,
+          schema: { response: t.text() },
+          handler: () => "SECURED",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [{ name: "user", permissions: [{ name: "*" }] }],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      const linksProvider = alepha.inject(ServerLinksProvider);
+      const user = { id: randomUUID(), roles: ["user"] };
+
+      const { links } = await linksProvider.getUserApiLinks({ user });
+
+      expect(links).toContainEqual(
+        expect.objectContaining({ name: "publicAction" }),
+      );
+      expect(links).toContainEqual(
+        expect.objectContaining({ name: "securedAction" }),
+      );
+    });
+
+    it("should filter secured actions based on user permissions", async ({
+      expect,
+    }) => {
+      class App {
+        adminOnly = $action({
+          secure: true,
+          group: "admin",
+          schema: { response: t.text() },
+          handler: () => "ADMIN",
+        });
+        userAction = $action({
+          secure: true,
+          group: "user",
+          schema: { response: t.text() },
+          handler: () => "USER",
+        });
+        issuer = $issuer({
+          secret: "test",
+          roles: [
+            { name: "admin", permissions: [{ name: "*" }] },
+            { name: "user", permissions: [{ name: "user:*" }] },
+          ],
+        });
+      }
+
+      const alepha = Alepha.create()
+        .with(App)
+        .with(ServerLinksProvider)
+        .with(AlephaSecurity);
+      await alepha.start();
+
+      const linksProvider = alepha.inject(ServerLinksProvider);
+
+      // User with "user" role should only see userAction
+      const userLinks = await linksProvider.getUserApiLinks({
+        user: { id: randomUUID(), roles: ["user"] },
+      });
+
+      expect(userLinks.links).toContainEqual(
+        expect.objectContaining({ name: "userAction" }),
+      );
+      expect(userLinks.links).not.toContainEqual(
+        expect.objectContaining({ name: "adminOnly" }),
+      );
+
+      // User with "admin" role should see both
+      const adminLinks = await linksProvider.getUserApiLinks({
+        user: { id: randomUUID(), roles: ["admin"] },
+      });
+
+      expect(adminLinks.links).toContainEqual(
+        expect.objectContaining({ name: "userAction" }),
+      );
+      expect(adminLinks.links).toContainEqual(
+        expect.objectContaining({ name: "adminOnly" }),
+      );
+    });
+  });
+
+  describe("mixed public and secured actions", () => {
+    it("should correctly differentiate public from secured in server links", async ({
+      expect,
+    }) => {
+      class App {
+        getUsers = $action({
+          path: "/users",
+          schema: { response: t.array(t.text()) },
+          handler: () => ["user1", "user2"],
+        });
+        createUser = $action({
+          path: "/users",
+          secure: true,
+          schema: {
+            body: t.object({ name: t.text() }),
+            response: t.text(),
+          },
+          handler: ({ body }) => body.name,
+        });
+        deleteUser = $action({
+          method: "DELETE",
+          path: "/users/:id",
+          secure: true,
+          schema: {
+            params: t.object({ id: t.text() }),
+            response: t.void(),
+          },
+          handler: () => {},
+        });
+      }
+
+      const alepha = Alepha.create().with(App).with(ServerLinksProvider);
+      await alepha.start();
+
+      const links = alepha.inject(LinkProvider).getServerLinks();
+
+      const getUsers = links.find((l) => l.name === "getUsers");
+      const createUser = links.find((l) => l.name === "createUser");
+      const deleteUser = links.find((l) => l.name === "deleteUser");
+
+      // getUsers is public (no secure option)
+      expect(getUsers?.secured).toBeUndefined();
+
+      // createUser and deleteUser are secured
+      expect(createUser?.secured).toBe(true);
+      expect(deleteUser?.secured).toBe(true);
+    });
+  });
+});

package/src/server/links/providers/ServerLinksProvider.ts

@@ -48,7 +48,7 @@ export class ServerLinksProvider {
           group: action.group,
           schema: action.options.schema,
           requestBodyType: action.getBodyContentType(),
-          secured: action.options.secure ?? true,
+          secured: action.options.secure,
           method: action.method === "GET" ? undefined : action.method,
           prefix: action.prefix,
           path: action.path,

package/src/server/metrics/index.ts

@@ -9,9 +9,9 @@ export * from "./providers/ServerMetricsProvider.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | devops | standard | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 2 - beta | 0.14.0 | node, bun|
  *
  * Prometheus-style metrics collection.
  *

package/src/server/multipart/index.ts

@@ -9,9 +9,9 @@ export * from "./providers/ServerMultipartProvider.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | standard | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 3 - stable | 0.5.0 | node, bun|
  *
  * Multipart form data handling for file uploads.
  *

package/src/server/proxy/index.ts

@@ -11,9 +11,9 @@ export * from "./providers/ServerProxyProvider.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | standard | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 2 - beta | 0.12.0 | node, bun|
  *
  * Reverse proxy routing.
  *

package/src/server/rate-limit/index.ts

@@ -54,9 +54,9 @@ export interface RateLimitOptions {
 }
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | standard | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 3 - stable | 0.16.0 | node, bun, workerd|
  *
  * Request rate limiting on actions.
  *

package/src/server/static/index.ts

@@ -11,9 +11,9 @@ export * from "./providers/ServerStaticProvider.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | standard | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 3 - stable | 0.3.0 | node, bun|
  *
  * Static file serving.
  *

package/src/server/swagger/index.ts

@@ -30,9 +30,9 @@ declare module "alepha/server" {
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | standard | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 3 - stable | 0.9.0 | node, bun|
  *
  * Automatic API documentation generation.
  *

package/src/sms/index.ts

@@ -34,9 +34,9 @@ declare module "alepha" {
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | rare | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 3 - stable | 0.15.0 | node, bun|
  *
  * SMS delivery with multiple provider support.
  *

package/src/system/index.ts

@@ -21,9 +21,9 @@ export * from "./services/FileDetector.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | tooling | standard | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 3 - stable | 0.14.0 | node, bun, browser|
  *
  * System-level abstractions for portable code across runtimes.
  *

package/src/thread/index.ts

@@ -22,9 +22,9 @@ Alepha.prototype.isWorkerThread = function (this: Alepha): boolean {
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | standard | experimental |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 1 - experimental | 0.16.0 | node|
  *
  * Multi-threading support.
  *

package/src/topic/core/index.ts

@@ -15,9 +15,9 @@ export * from "./providers/TopicProvider.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | rare | stable |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 3 - stable | 0.7.0 | node, bun|
  *
  * Publish/subscribe messaging for event-driven architectures.
  *

package/src/vite/tasks/generateCloudflare.ts

@@ -1,5 +1,8 @@
 import { access, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
+import type { Alepha } from "alepha";
+import type { CronProvider } from "alepha/scheduler";
+import type { WorkerdCronProvider } from "../../scheduler/providers/WorkerdCronProvider.ts";
 
 export interface GenerateCloudflareOptions {
   /**
@@ -13,6 +16,8 @@ export interface GenerateCloudflareOptions {
    * Additional Wrangler configuration options to merge into wrangler.jsonc.
    */
   config?: WranglerConfig;
+
+  alepha: Alepha;
 }
 
 export interface WranglerConfig {
@@ -31,7 +36,7 @@ const WARNING_COMMENT =
  * - worker.js entry point for Cloudflare Workers
  */
 export async function generateCloudflare(
-  opts: GenerateCloudflareOptions = {},
+  opts: GenerateCloudflareOptions,
 ): Promise<void> {
   const distDir = opts.distDir ?? "dist";
   const root = process.cwd();
@@ -40,6 +45,15 @@ export async function generateCloudflare(
     .then(() => true)
     .catch(() => false);
 
+  let workerdCronProvider: CronProvider | undefined;
+  try {
+    workerdCronProvider = opts.alepha.inject(
+      "CronProvider",
+    ) as WorkerdCronProvider;
+  } catch {}
+
+  const crons = workerdCronProvider?.getCronJobs();
+
   const wrangler: WranglerConfig = {
     name,
     main: "./main.cloudflare.js",
@@ -62,6 +76,12 @@ export async function generateCloudflare(
     };
   }
 
+  if (crons && crons.length > 0) {
+    const cronExpressions = [...new Set(crons.map((c) => c.expression))];
+    wrangler.triggers ??= {};
+    wrangler.triggers.crons = cronExpressions;
+  }
+
   const url = process.env.DATABASE_URL;
   if (url?.startsWith("d1:")) {
     const [name, id] = url.replace("d1://", "").replace("d1:", "").split(":");
@@ -102,7 +122,7 @@ export default {
     try {
       await __alepha.start();
     } catch (err) {
-      console.error(err);
+      console.error("Failed to start Alepha for fetch event", err);
       return new Response("Internal Server Error", { status: 500 });
     }
 
@@ -110,6 +130,22 @@ export default {
 
     return ctx.res;
   },
+
+  scheduled: async (event, env, ctx) => {
+    __alepha.set("cloudflare.env", env);
+
+    try {
+      await __alepha.start();
+    } catch (err) {
+      console.error("Failed to start Alepha for scheduled event", err);
+      throw err;
+    }
+
+    await __alepha.events.emit("cloudflare:scheduled", {
+      cron: event.cron,
+      scheduledTime: event.scheduledTime,
+    });
+  },
 };
 `.trim();
 

package/src/websocket/index.ts

@@ -58,9 +58,9 @@ export * from "./providers/NodeWebSocketServerProvider.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 
 /**
- * | type | quality | stability |
- * |------|---------|-----------|
- * | backend | rare | experimental |
+ * | Stability | Since | Runtime |
+ * |-----------|-------|---------|
+ * | 1 - experimental | 0.19.0 | node, browser|
  *
  * Real-time bidirectional communication.
  *

package/src/cli/templates/webHelloComponentTsx.ts

@@ -1,30 +0,0 @@
-export const webHelloComponentTsx = (options: { auth?: boolean } = {}) => {
-  const imports: string[] = [];
-
-  if (options.auth) {
-    imports.push('import { UserButton } from "@alepha/ui/auth";');
-  }
-  imports.push('import { useState } from "react";');
-
-  const userButton = options.auth ? "\n      <UserButton />" : "";
-
-  return `${imports.join("\n")}
-
-interface Props {
-  message?: string;
-}
-
-const Hello = (props: Props) => {
-  const [message, setMessage] = useState(props.message ?? "");
-  return (
-    <div>
-      <h1>{message}</h1>
-      <input value={message} onChange={(e) => setMessage(e.target.value)} />
-      <p>Edit this component in src/web/components/Hello.tsx</p>${userButton}
-    </div>
-  );
-};
-
-export default Hello;
-`;
-};