alepha 0.18.2 → 0.18.3

package/src/core/providers/KeylessJsonSchemaCodec.ts

@@ -1,5 +1,4 @@
 import type { TArray, TObject, TSchema, TUnion } from "typebox";
-import { AlephaError } from "../errors/AlephaError.ts";
 import { $hook } from "../primitives/$hook.ts";
 import { SchemaCodec } from "./SchemaCodec.ts";
 import { type Static, t } from "./TypeProvider.ts";
@@ -18,9 +17,6 @@ import { type Static, t } from "./TypeProvider.ts";
 //   Keyless: ["Alice",30,true]                        (17 bytes)
 // =============================================================================
 
-// Security: Keys that could enable prototype pollution attacks
-const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
-
 export interface KeylessCodec<T = any> {
   encode: (value: T) => string;
   decode: (str: string) => T;
@@ -34,30 +30,6 @@ export interface KeylessCodecOptions {
    * @default Auto-detected: false in browser (CSP compatibility), true on server
    */
   useFunctionCompilation?: boolean;
-
-  /**
-   * Maximum allowed array length during encoding/decoding.
-   * Prevents DoS attacks via large arrays.
-   *
-   * @default 10000
-   */
-  maxArrayLength?: number;
-
-  /**
-   * Maximum allowed string length during encoding/decoding.
-   * Prevents DoS attacks via large strings.
-   *
-   * @default 1000000 (1MB)
-   */
-  maxStringLength?: number;
-
-  /**
-   * Maximum recursion depth for nested objects.
-   * Prevents stack overflow attacks.
-   *
-   * @default 50
-   */
-  maxDepth?: number;
 }
 
 /**
@@ -71,12 +43,7 @@ export class KeylessJsonSchemaCodec extends SchemaCodec {
   protected readonly textEncoder = new TextEncoder();
   protected readonly textDecoder = new TextDecoder();
   protected varCounter = 0;
-
-  // Options with defaults
   protected useFunctionCompilation = true;
-  protected maxArrayLength = 10000;
-  protected maxStringLength = 1000000;
-  protected maxDepth = 50;
 
   /**
    * Configure codec options.
@@ -86,15 +53,6 @@ export class KeylessJsonSchemaCodec extends SchemaCodec {
       this.useFunctionCompilation = options.useFunctionCompilation;
       this.cache.clear(); // Clear cache when compilation mode changes
     }
-    if (options.maxArrayLength !== undefined) {
-      this.maxArrayLength = options.maxArrayLength;
-    }
-    if (options.maxStringLength !== undefined) {
-      this.maxStringLength = options.maxStringLength;
-    }
-    if (options.maxDepth !== undefined) {
-      this.maxDepth = options.maxDepth;
-    }
     return this;
   }
 
@@ -152,10 +110,6 @@ export class KeylessJsonSchemaCodec extends SchemaCodec {
     return value as T;
   }
 
-  // ===========================================================================
-  // Security Validation
-  // ===========================================================================
-
   /**
    * Test if `new Function()` is available (not blocked by CSP).
    */
@@ -168,72 +122,6 @@ export class KeylessJsonSchemaCodec extends SchemaCodec {
     }
   }
 
-  /**
-   * Validate schema keys for prototype pollution.
-   * Uses a visited set to avoid infinite recursion on recursive schemas.
-   */
-  protected validateSchemaKeys(
-    schema: TSchema,
-    depth = 0,
-    visited = new Set<TSchema>(),
-  ): void {
-    // Avoid infinite recursion on recursive schemas
-    if (visited.has(schema)) {
-      return;
-    }
-    visited.add(schema);
-
-    if (depth > this.maxDepth) {
-      throw new AlephaError(
-        `Schema depth exceeds maximum allowed (${this.maxDepth})`,
-      );
-    }
-
-    if (t.schema.isObject(schema)) {
-      const objSchema = schema as TObject;
-      const props = objSchema.properties as Record<string, TSchema>;
-
-      for (const key of Object.keys(props)) {
-        if (UNSAFE_KEYS.has(key)) {
-          throw new AlephaError(
-            `Unsafe schema key "${key}" detected. This key is blocked to prevent prototype pollution.`,
-          );
-        }
-        // Depth increases for object properties
-        this.validateSchemaKeys(props[key], depth + 1, visited);
-      }
-    } else if (t.schema.isArray(schema)) {
-      const arrSchema = schema as TArray;
-      // Depth increases for array items
-      this.validateSchemaKeys(arrSchema.items, depth + 1, visited);
-    } else if (t.schema.isUnion(schema) || t.schema.isOptional(schema)) {
-      // Optional/union wrappers don't increase depth - they're type modifiers
-      this.validateSchemaKeys(this.unwrap(schema), depth, visited);
-    }
-  }
-
-  /**
-   * Validate array length.
-   */
-  protected validateArrayLength(arr: unknown[]): void {
-    if (arr.length > this.maxArrayLength) {
-      throw new AlephaError(
-        `Array length (${arr.length}) exceeds maximum allowed (${this.maxArrayLength})`,
-      );
-    }
-  }
-
-  /**
-   * Validate string length.
-   */
-  protected validateStringLength(str: string): void {
-    if (str.length > this.maxStringLength) {
-      throw new AlephaError(
-        `String length (${str.length}) exceeds maximum allowed (${this.maxStringLength})`,
-      );
-    }
-  }
-
   // ===========================================================================
   // Codec Compilation
   // ===========================================================================
@@ -493,12 +381,14 @@ export class KeylessJsonSchemaCodec extends SchemaCodec {
       for (const { key, isOpt, isNullable, inner } of this.getObjectFields(
         schema as TObject,
       )) {
-        const innerEnc = this.genEnc(inner, `${ve}.${key}`);
+        const sk = JSON.stringify(key);
+        const access = `${ve}[${sk}]`;
+        const innerEnc = this.genEnc(inner, access);
 
         if (isOpt) {
-          parts.push(`${ve}.${key}!==undefined?${innerEnc}:null`);
+          parts.push(`${access}!==undefined?${innerEnc}:null`);
         } else if (isNullable) {
-          parts.push(`${ve}.${key}!==null?${innerEnc}:null`);
+          parts.push(`${access}!==null?${innerEnc}:null`);
         } else {
           parts.push(innerEnc);
         }
@@ -557,32 +447,35 @@ export class KeylessJsonSchemaCodec extends SchemaCodec {
       );
 
       if (simple) {
-        const fieldExprs = fields.map(({ key }) => `${key}:a[i++]`);
+        const fieldExprs = fields.map(
+          ({ key }) => `${JSON.stringify(key)}:a[i++]`,
+        );
         return { code: "", result: `{${fieldExprs.join(",")}}` };
       }
 
       let code = `const ${v}={};`;
       for (const { key, isOpt, isNullable, inner } of fields) {
+        const sk = JSON.stringify(key);
         if (isOpt) {
           const nested = this.genDecFromValue(inner, "t");
-          code += `{const t=a[i++];if(t!==null){${v}.${key}=${nested};}}`;
+          code += `{const t=a[i++];if(t!==null){${v}[${sk}]=${nested};}}`;
         } else if (isNullable) {
           const nested = this.genDecFromValue(inner, "t");
-          code += `{const t=a[i++];if(t===null){${v}.${key}=null;}else{${v}.${key}=${nested};}}`;
+          code += `{const t=a[i++];if(t===null){${v}[${sk}]=null;}else{${v}[${sk}]=${nested};}}`;
         } else if (t.schema.isObject(inner)) {
           const nested = this.genDecFromValue(inner, "a[i++]");
-          code += `${v}.${key}=${nested};`;
+          code += `${v}[${sk}]=${nested};`;
         } else if (t.schema.isArray(inner)) {
           // Handle arrays - check if items need transformation
           const arrSchema = inner as TArray;
           if (t.schema.isObject(arrSchema.items)) {
             const itemTransform = this.genDecFromValue(arrSchema.items, "e");
-            code += `${v}.${key}=a[i++].map(e=>${itemTransform});`;
+            code += `${v}[${sk}]=a[i++].map(e=>${itemTransform});`;
           } else {
-            code += `${v}.${key}=a[i++];`;
+            code += `${v}[${sk}]=a[i++];`;
           }
         } else {
-          code += `${v}.${key}=a[i++];`;
+          code += `${v}[${sk}]=a[i++];`;
         }
       }
 
@@ -620,13 +513,14 @@ export class KeylessJsonSchemaCodec extends SchemaCodec {
       const fields = keys.map((k, idx) => {
         const inner = this.unwrap(props[k]);
         const innerExpr = `${v}[${idx}]`;
+        const sk = JSON.stringify(k);
         if (t.schema.isObject(inner)) {
-          return `${k}:${this.genDecFromValue(inner, innerExpr)}`;
+          return `${sk}:${this.genDecFromValue(inner, innerExpr)}`;
         }
         if (t.schema.isBigInt(inner)) {
-          return `${k}:BigInt(${innerExpr}.slice(0,-1))`;
+          return `${sk}:BigInt(${innerExpr}.slice(0,-1))`;
         }
-        return `${k}:${innerExpr}`;
+        return `${sk}:${innerExpr}`;
       });
       return `((${v}=${expr})=>({${fields.join(",")}}))()`;
     }

package/src/core/providers/SchemaValidator.spec.ts

@@ -209,6 +209,42 @@ describe("SchemaValidator", () => {
       expect(result.tags).toEqual(["tag1", "tag2"]);
     });
 
+    test("should unwrap optional arrays and preprocess items", async ({
+      expect,
+    }) => {
+      const alepha = Alepha.create();
+      const validator = alepha.inject(SchemaValidator);
+
+      const schema = t.object({
+        tags: t.optional(t.array(t.text({ trim: true }))),
+      });
+
+      const data = {
+        tags: ["  tag1  ", "  tag2  "],
+      };
+
+      const result = validator.validate(schema, data);
+      expect(result.tags).toEqual(["tag1", "tag2"]);
+    });
+
+    test("should unwrap nullable arrays and preprocess items", async ({
+      expect,
+    }) => {
+      const alepha = Alepha.create();
+      const validator = alepha.inject(SchemaValidator);
+
+      const schema = t.object({
+        tags: t.union([t.array(t.text({ trim: true })), t.null()]),
+      });
+
+      const data = {
+        tags: ["  tag1  ", "  tag2  "],
+      };
+
+      const result = validator.validate(schema, data);
+      expect(result.tags).toEqual(["tag1", "tag2"]);
+    });
+
     test("should delete undefined values when option is enabled", async ({
       expect,
     }) => {

package/src/core/providers/SchemaValidator.ts

@@ -67,6 +67,15 @@ export class SchemaValidator {
       return undefined;
     }
 
+    // Unwrap optional/union to access the inner type schema (e.g. array items, object properties).
+    // Must happen after the null check above which needs the original schema for nullability.
+    if (!schema.type && schema.anyOf) {
+      schema =
+        schema.anyOf.find(
+          (s: any) => s.type !== "null" && s.type !== "undefined",
+        ) || schema;
+    }
+
     if (Array.isArray(value)) {
       return value.map((it) => this.beforeParse(schema.items, it, options));
     }

package/src/crypto/index.ts

@@ -1,7 +1,9 @@
 import { $module } from "alepha";
 import { CryptoProvider } from "./providers/CryptoProvider.ts";
+import { SecretProvider } from "./providers/SecretProvider.ts";
 
 export * from "./providers/CryptoProvider.ts";
+export * from "./providers/SecretProvider.ts";
 
 /**
  * Cryptographic utilities: hashing, HMAC, AES-256-GCM encryption, password hashing, and secure random generation.
@@ -10,5 +12,8 @@ export * from "./providers/CryptoProvider.ts";
  */
 export const AlephaCrypto = $module({
   name: "alepha.crypto",
-  services: [CryptoProvider],
+  services: [CryptoProvider, SecretProvider],
+  register: (alepha) => {
+    alepha.with(CryptoProvider);
+  },
 });

package/src/crypto/providers/SecretProvider.ts

@@ -0,0 +1,36 @@
+import { $env, $hook, $inject, Alepha, t } from "alepha";
+import { $logger } from "alepha/logger";
+
+export const DEFAULT_SECRET_KEY_VALUE = "change-me-in-production";
+
+export const alephaSecretEnvSchema = t.object({
+  APP_SECRET: t.text({
+    default: DEFAULT_SECRET_KEY_VALUE,
+    description:
+      "The secret key used for signing JWTs, encrypting cookies, and other security features.",
+  }),
+});
+
+export class SecretProvider {
+  protected readonly log = $logger();
+  protected readonly alepha = $inject(Alepha);
+  protected readonly env = $env(alephaSecretEnvSchema);
+
+  public get secretKey(): string {
+    return this.env.APP_SECRET;
+  }
+
+  protected readonly configure = $hook({
+    on: "configure",
+    handler: async () => {
+      if (
+        this.secretKey === DEFAULT_SECRET_KEY_VALUE &&
+        this.alepha.isProduction()
+      ) {
+        this.log.warn(
+          "Using default secret key. Please set a secure APP_SECRET environment variable.",
+        );
+      }
+    },
+  });
+}

package/src/devtools/providers/DevToolsProvider.ts

@@ -30,10 +30,8 @@ export class DevToolsProvider {
    */
   protected readonly onLog = $hook({
     on: "log",
-    handler: ({ message, entry }) => {
-      if (message) {
-        this.memoryDestination.write(message, entry);
-      }
+    handler: ({ entry }) => {
+      this.memoryDestination.write("", entry);
     },
   });
 
@@ -106,15 +104,8 @@ export class DevToolsProvider {
       }),
     },
     handler: ({ query }) => {
-      let memoryProvider: MemoryDestinationProvider;
-      try {
-        memoryProvider = this.alepha.inject(MemoryDestinationProvider);
-      } catch {
-        return { logs: [], total: 0 };
-      }
-
       const levelOrder = ["TRACE", "DEBUG", "INFO", "WARN", "ERROR"];
-      let entries = memoryProvider.logs;
+      let entries = this.memoryDestination.logs;
 
       if (query.level) {
         const minIndex = levelOrder.indexOf(query.level.toUpperCase());

package/src/logger/index.ts

@@ -37,7 +37,7 @@ export * from "./services/Logger.ts";
  * - Console destination
  * - Memory destination (for devtools)
  * - Custom handlers
- * - Configuration via `LOG_LEVEL` and `LOG_FORMAT`
+ * - Configuration via `LOG_LEVEL`, `LOG_FORMAT`, and `DEBUG`
  *
  * @module alepha.logger
  */
@@ -56,10 +56,22 @@ export const AlephaLogger = $module({
   register: (alepha) => {
     const env = alepha.parseEnv(envSchema);
 
+    // Support DEBUG env var (debug package convention) as shorthand for LOG_LEVEL/LOG_FORMAT.
+    // DEBUG=alepha:* → LOG_LEVEL=alepha.*:debug,info LOG_FORMAT=pretty
+    let logLevel = env.LOG_LEVEL;
+    let logFormat = env.LOG_FORMAT;
+    if (env.DEBUG) {
+      const patterns = env.DEBUG.split(",")
+        .map((p) => p.trim().replaceAll(":", "."))
+        .filter(Boolean);
+      logLevel ??= `${patterns.map((p) => `${p}:debug`).join(",")},info`;
+      logFormat ??= "pretty";
+    }
+
     const getLogDestinationProvider = () => {
       // in test mode, if no LOG_LEVEL is set, use MemoryDestinationProvider to capture logs for inspection.
       // logs will be printed to console only if the test fails.
-      if (alepha.isTest() && !env.LOG_LEVEL) {
+      if (alepha.isTest() && !logLevel) {
         const printOnError = (ev: any) => {
           if (ev.task?.result?.state === "fail") {
             const output = alepha.inject(MemoryDestinationProvider);
@@ -83,11 +95,11 @@ export const AlephaLogger = $module({
     };
 
     const getLogFormatterProvider = () => {
-      if (env.LOG_FORMAT) {
-        if (env.LOG_FORMAT === "json") {
+      if (logFormat) {
+        if (logFormat === "json") {
           return JsonFormatterProvider;
         }
-        if (env.LOG_FORMAT === "raw") {
+        if (logFormat === "raw") {
           return RawFormatterProvider;
         }
         return PrettyFormatterProvider;
@@ -122,7 +134,7 @@ export const AlephaLogger = $module({
 
     alepha.store.set(
       "alepha.logger.level",
-      env.LOG_LEVEL ?? (alepha.isTest() ? "trace" : "info"),
+      logLevel ?? (alepha.isTest() ? "trace" : "info"),
     );
   },
 });
@@ -130,6 +142,21 @@ export const AlephaLogger = $module({
 // ---------------------------------------------------------------------------------------------------------------------
 
 const envSchema = t.object({
+  /**
+   * Enable debug logging for specific modules using the `debug` package convention.
+   *
+   * @example
+   * DEBUG=alepha:* # Enable debug logging for all alepha modules
+   * DEBUG=alepha:orm:* # Enable debug logging for alepha.orm modules
+   * DEBUG=* # Enable debug logging for all modules
+   */
+  DEBUG: t.optional(
+    t.text({
+      description:
+        "Enable debug logging for specific modules using the debug package convention. Example: DEBUG=alepha:*",
+    }),
+  ),
+
   /**
    * Default log level for the application.
    *

package/src/logger/providers/PrettyFormatterProvider.ts

@@ -18,14 +18,16 @@ export class PrettyFormatterProvider extends LogFormatterProvider {
       details = this.formatError(data);
     } else if (data) {
       let error = "";
+      let jsonData = data;
       if ("error" in data && data.error instanceof Error) {
         error = this.formatError(data.error);
-        delete data.error;
+        const { error: _, ...rest } = data;
+        jsonData = rest;
       }
 
-      if (Object.keys(data).length > 0) {
+      if (Object.keys(jsonData).length > 0) {
         try {
-          details = JSON.stringify(data);
+          details = JSON.stringify(jsonData);
         } catch {
           details = "[Unserializable Object]";
         }