bazis 0.96.6 → 0.97.1

package/cli/templates/module.ts

@@ -194,23 +194,24 @@ export class ${n.module}DbContext extends DbContext {
 }
 
 function serviceInterfaceFile(n: ModuleNaming): string {
-  return `import { createToken } from "bazis/core/di";
-import type { PageResult } from "bazis/core/orm";
+  return `import type { PageResult } from "bazis/core/orm";
 import type { ListQuery } from "bazis/library/jsonapi";
 import type { Create${n.entity}Request, Update${n.entity}Request } from "../http/contracts/${n.module}.requests";
 import type { ${n.entity}Response, ${n.module}Summary } from "../http/contracts/${n.module}.responses";
 
-export interface I${n.module}Service {
-  getAll(query: ListQuery): Promise<PageResult<${n.entity}Response>>;
-  summary(): Promise<${n.module}Summary>;
-  count(): Promise<number>;
-  getById(id: string): Promise<${n.entity}Response | null>;
-  create(body: Create${n.entity}Request): Promise<${n.entity}Response>;
-  update(id: string, body: Update${n.entity}Request): Promise<${n.entity}Response | null>;
-  delete(id: string): Promise<boolean>;
+/**
+ * Service contract. An abstract class, not an interface: it exists at runtime,
+ * so it is the DI token itself: \`scoped(I${n.module}Service, ${n.module}Service)\`.
+ */
+export abstract class I${n.module}Service {
+  abstract getAll(query: ListQuery): Promise<PageResult<${n.entity}Response>>;
+  abstract summary(): Promise<${n.module}Summary>;
+  abstract count(): Promise<number>;
+  abstract getById(id: string): Promise<${n.entity}Response | null>;
+  abstract create(body: Create${n.entity}Request): Promise<${n.entity}Response>;
+  abstract update(id: string, body: Update${n.entity}Request): Promise<${n.entity}Response | null>;
+  abstract delete(id: string): Promise<boolean>;
 }
-
-export const I${n.module}Service = createToken<I${n.module}Service>("I${n.module}Service");
 `;
 }
 

package/cli/templates/passport.ts

@@ -51,7 +51,7 @@ adapters that access it.
 | ${n.moduleClass} | [${n.module}.module.ts](${n.module}.module.ts) | host imports | ORM, DI, HTTP${profile === "full" ? ", background, AI" : ""} |
 | ${e} | [model/${m}.model.ts](model/${m}.model.ts) | Fields below | Table ${n.route} |
 | ${m}DbContext | [model/${m}.dbContext.ts](model/${m}.dbContext.ts) | Shared host ORM provider | DbSet ${n.collection} |
-| I${m}Service / ${m}Service | [services/${m}.service.ts](services/${m}.service.ts), [token](services/I${m}.service.ts) | ${m}DbContext${profile === "full" ? ", ICache" : ""} | CRUD, count, summary |
+| I${m}Service / ${m}Service | [services/${m}.service.ts](services/${m}.service.ts), [contract](services/I${m}.service.ts) | ${m}DbContext${profile === "full" ? ", ICache" : ""} | CRUD, count, summary |
 | ${m}Controller | [http/${m}.controller.ts](http/${m}.controller.ts) | I${m}Service, HTTP request | HTTP operations below |
 | Create${e}Request / Update${e}Request | [requests](http/contracts/${m}.requests.ts) | JSON body | RequestModel + Validator |
 | ${e}Response / ${m}Summary / to${e}Response | [responses](http/contracts/${m}.responses.ts) | ORM entity | Public data projection |

package/core/di/README.md

@@ -14,7 +14,7 @@ contracts are described in [MODULE.md](MODULE.md).
 - `ServiceCollection.ts`: service registration.
 - `ServiceScope.ts`: scoped resolve and scoped dispose.
 - `container.ts`: a compatible alias wrapper over `ServiceProvider`.
-- `token.ts`: DI tokens (`createToken`, open generic family).
+- `token.ts`: DI tokens: classes, abstract classes as service contracts, `createToken`, open generic family.
 
 ## Internals (do not use directly)
 

package/core/di/index.ts

@@ -75,6 +75,7 @@ export {
 export {
   createOpenGenericTokenFamily,
   createToken,
+  type AbstractClass,
   type Class,
   type InjectionToken,
   type OpenGenericTokenFamily,

package/core/di/token.ts

@@ -3,6 +3,14 @@
 // constructor deps is still validated by the container.
 export type Class<T> = new (...args: any[]) => T;
 
+/**
+ * A class usable only as a key: an abstract class declared as a contract
+ * (`export abstract class IClock { abstract now(): Date }`) and registered with
+ * `scoped(IClock, SystemClock)`. Unlike an interface it exists at runtime, so it
+ * needs no `createToken`. The container never constructs it.
+ */
+export type AbstractClass<T> = abstract new (...args: any[]) => T;
+
 export interface InjectionToken<T> {
   readonly id: symbol;
   readonly description: string;
@@ -18,7 +26,7 @@ export function createToken<T>(description: string): InjectionToken<T> {
   };
 }
 
-export type Token<T> = Class<T> | InjectionToken<T>;
+export type Token<T> = Class<T> | AbstractClass<T> | InjectionToken<T>;
 
 export interface OpenGenericTokenFamily<TArg, TResult> {
   readonly id: symbol;

package/core/http/Authorization/Authorize.ts

@@ -17,7 +17,8 @@ type ClassOrMethodDecorator = (
  * Protects a controller or a single action: the route gets the
  * {@link AuthorizeCheck} function. The HTTP kernel does not know *what* it
  * checks: JWT, login/password, Telegram sign-in and so on. Several checks
- * can be passed; all of them must pass.
+ * can be passed; all of them must pass. On a method of a protected controller
+ * the checks are added to the controller's ones: the class checks run first.
  *
  * ```ts
  * @Authorize(requireTokenKind(TokenKind.Admin))   // access token kind
@@ -40,7 +41,7 @@ export function Authorize(check: AuthorizeCheck, ...rest: AuthorizeCheck[]): Cla
   };
 }
 
-/** Public route: overrides `@Authorize` declared on the controller. */
+/** Public route: on a method, removes every check, including the controller's `@Authorize`. */
 export function AllowAnonymous(): ClassOrMethodDecorator {
   return (_value, context) => {
     if (context.kind === "class") {

package/core/http/Authorization/metadata.ts

@@ -122,15 +122,22 @@ export function setActionAllowAnonymous(metadata: object, methodName: string | s
   delete action.authorize;
 }
 
-/** Effective route requirement (the method overrides the controller). */
+/** Effective route requirement: the class and method checks combined. */
 export interface ResolvedAuthorizeMeta {
   readonly allowAnonymous: boolean;
   readonly authorize?: AuthorizeOptions;
 }
 
 /**
- * Resolves the authorization requirement of a specific action. Precedence:
- * `@AllowAnonymous`/`@Authorize` on the method override those declared on the class.
+ * Resolves the authorization requirement of a specific action:
+ *
+ * - `@AllowAnonymous` on the method opens it, whatever the class declares;
+ * - `@Authorize` on the class and on the method combine: the class checks run
+ *   first, then the method checks (a check repeated on both runs once);
+ * - `@AllowAnonymous` on the class opens the methods without their own `@Authorize`.
+ *
+ * Inheritance is different: a subclass's own class-level declaration replaces
+ * the base class's, and an overriding method's declaration replaces the base method's.
  */
 export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol): ResolvedAuthorizeMeta {
   const metadata = (ctor as { [key: symbol]: unknown })[Symbol.metadata as unknown as symbol] as
@@ -145,14 +152,13 @@ export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol):
   if (action?.allowAnonymous) {
     return { allowAnonymous: true };
   }
-  if (action?.authorize) {
-    return { allowAnonymous: false, authorize: action.authorize };
-  }
-  if (meta.allowAnonymous) {
+  const classChecks = meta.authorize?.checks ?? [];
+  const actionChecks = action?.authorize?.checks ?? [];
+  if (actionChecks.length === 0 && meta.allowAnonymous) {
     return { allowAnonymous: true };
   }
-  if (meta.authorize) {
-    return { allowAnonymous: false, authorize: meta.authorize };
-  }
-  return { allowAnonymous: false };
+  const checks = [...new Set([...classChecks, ...actionChecks])];
+  return checks.length === 0
+    ? { allowAnonymous: false }
+    : { allowAnonymous: false, authorize: { checks } };
 }

package/core/http/HttpServer.ts

@@ -150,8 +150,15 @@ export class HttpServer implements HostedService {
     if (this.options.securityHeaders !== false) {
       serverChain.push(securityHeaders(this.options.securityHeaders ?? {}));
     }
+    // Unexpected errors go to the application logger, like the access log.
+    const errorLogger = this.resolver.tryResolve(LOGGER);
     serverChain.push(
-      errorHandler({ exposeDetails, ...this.options.errorHandler, onUnexpectedError: this.collectErrorHook() }),
+      errorHandler({
+        exposeDetails,
+        ...(errorLogger ? { logger: errorLogger } : {}),
+        ...this.options.errorHandler,
+        onUnexpectedError: this.collectErrorHook(),
+      }),
     );
     this.shortCircuitChain = [...serverChain];
     serverChain.push(...this.collectServerMiddleware());

package/core/http/Middleware/errorHandler.ts

@@ -1,4 +1,5 @@
-import { redactSensitive } from "../../../library/redaction";
+import { REQUEST_ID_STATE_KEY, type Logger } from "../../kernel";
+import { redactSensitive, redactSensitiveText } from "../../../library/redaction";
 import type { HttpContext } from "../HttpContext/HttpContext";
 import { HttpError } from "../Errors/HttpError";
 import type { HttpMiddleware } from "./types";
@@ -9,10 +10,20 @@ export interface ErrorHandlerOptions {
    * never enable in production).
    */
   exposeDetails?: boolean;
-  /** Called for non-{@link HttpError} failures (self-wired via `HTTP_ERROR_HOOK`, e.g. the logging module). */
+  /**
+   * Notified of every non-{@link HttpError} failure, for example to send it to
+   * an error tracker; `HTTP_ERROR_HOOK` registrations are merged in. It does not
+   * replace logging: the error is logged as well.
+   */
   onUnexpectedError?: (ctx: HttpContext, error: unknown) => void;
-  /** Fallback when {@link onUnexpectedError} is omitted or does not handle the error. */
+  /** Replaces the built-in logging of unexpected errors. */
   logError?: (error: unknown) => void;
+  /**
+   * Logger for unexpected errors when {@link logError} is absent: one `error`
+   * line with the method, path, request id and the redacted error. The server
+   * passes the application `LOGGER`; without either, `console.error` is used.
+   */
+  logger?: Logger;
 }
 
 function jsonResponse(status: number, body: unknown, extraHeaders?: readonly [string, string][]): Response {
@@ -33,9 +44,30 @@ function safeJsonResponse(status: number, body: unknown, extraHeaders?: readonly
   }
 }
 
+type ErrorLog = (ctx: HttpContext, error: unknown) => void;
+
+function resolveErrorLog(options: ErrorHandlerOptions): ErrorLog {
+  const { logError, logger } = options;
+  if (logError) {
+    return (_ctx, error) => logError(error);
+  }
+  if (logger) {
+    return (ctx, error) => {
+      const requestId = ctx.state.get(REQUEST_ID_STATE_KEY);
+      logger.error(`${ctx.method} ${ctx.path} failed`, {
+        method: ctx.method,
+        path: ctx.path,
+        ...(typeof requestId === "string" ? { requestId } : {}),
+        error: redactSensitive(error),
+      });
+    };
+  }
+  return (_ctx, error) => console.error("[http] unhandled error:", redactSensitive(error));
+}
+
 function safelyReportUnexpected(
   options: ErrorHandlerOptions,
-  fallback: (error: unknown) => void,
+  log: ErrorLog,
   ctx: HttpContext,
   error: unknown,
 ): void {
@@ -43,13 +75,13 @@ function safelyReportUnexpected(
     options.onUnexpectedError?.(ctx, error);
   } catch (hookError) {
     try {
-      fallback(hookError);
+      log(ctx, hookError);
     } catch {
       // Logging hooks are best-effort; response safety is primary.
     }
   }
   try {
-    fallback(error);
+    log(ctx, error);
   } catch {
     // A broken sink must not escape the HTTP error boundary.
   }
@@ -61,7 +93,7 @@ function safelyReportUnexpected(
  * else becomes 500 Internal Server Error.
  */
 export function errorHandler(options: ErrorHandlerOptions = {}): HttpMiddleware {
-  const fallback = options.logError ?? ((error: unknown) => console.error("[http] unhandled error:", redactSensitive(error)));
+  const log = resolveErrorLog(options);
   return async (ctx, next) => {
     try {
       await next();
@@ -87,12 +119,14 @@ export function errorHandler(options: ErrorHandlerOptions = {}): HttpMiddleware
         );
         return;
       }
-      safelyReportUnexpected(options, fallback, ctx, error);
+      safelyReportUnexpected(options, log, ctx, error);
       ctx.response = options.exposeDetails
         ? safeJsonResponse(500, {
             error: "Internal Server Error",
-            message: error instanceof Error ? error.message : String(error),
-            stack: error instanceof Error ? error.stack : undefined,
+            // Development only, but redacted like the log: a secret in an error
+            // message must not reach a browser or a shared screenshot.
+            message: redactSensitiveText(error instanceof Error ? error.message : String(error)),
+            stack: error instanceof Error && error.stack !== undefined ? redactSensitiveText(error.stack) : undefined,
           })
         : safeJsonResponse(500, { error: "Internal Server Error" });
     }

package/core/http/SPEC.md

@@ -405,9 +405,10 @@ Exported from `bazis/core/http`. They are connected through `@Middleware(...)`,
 
 | `ErrorHandlerOptions` field | Type | Default | Description |
 | --- | --- | --- | --- |
-| `exposeDetails` | `boolean` | `httpModule({ exposeErrorDetails })` / environment | message/stack in 500 responses; never enable in production |
-| `onUnexpectedError` | `(ctx, error) => void` | DI `HTTP_ERROR_HOOK` hooks | called for non-`HttpError` failures |
-| `logError` | `(error) => void` | `console.error` | fallback when no hook handles the error |
+| `exposeDetails` | `boolean` | `httpModule({ exposeErrorDetails })` / environment | redacted message/stack in 500 responses; never enable in production |
+| `onUnexpectedError` | `(ctx, error) => void` | DI `HTTP_ERROR_HOOK` hooks | notification for non-`HttpError` failures (e.g. an error tracker); the error is still logged |
+| `logError` | `(error) => void` | — | replaces the built-in logging of unexpected errors |
+| `logger` | `Logger` | the application `LOGGER` | one `error` line: `"<METHOD> <path> failed"` with `method`, `path`, `requestId` and the redacted `error`; `console.error` when there is no logger |
 
 `HttpError` → JSON with its status; anything else → 500.
 
@@ -804,8 +805,13 @@ Do not create a **new** middleware function per request, only at load/startup.
 `@Authorize(check, ...checks)` on a controller or a method compiles into the built-in
 authorization link [6]. A check is `(ctx) => boolean | Promise<boolean>`: `true` lets the
 request through, `false` gives `403`, and a thrown `HttpError` defines the response
-itself (for example `UnauthorizedError` → `401`). A method-level `@Authorize` or
-`@AllowAnonymous` overrides the controller's.
+itself (for example `UnauthorizedError` → `401`). Checks of the controller and of the
+method combine: the controller's run first, then the method's; a check repeated on both
+runs once. A method-level `@AllowAnonymous` removes every check, including the
+controller's. On an `@AllowAnonymous` controller only methods with their own
+`@Authorize` are protected. Inheritance replaces instead: a subclass's own class-level
+declaration replaces the base class's (since 0.97.0; before it a method-level
+`@Authorize` replaced the controller's checks).
 
 ```ts
 const isSignedIn: AuthorizeCheck = (ctx) => {

package/core/http/middlewareTokens.ts

@@ -31,8 +31,8 @@ export const ROUTE_MIDDLEWARE_COMPOSER = createToken<RouteMiddlewareComposerRegi
 
 /**
  * Hook invoked by the built-in error boundary on a non-{@link HttpError}
- * failure. Self-wiring: e.g. the logging module registers one to record the
- * error, keeping `@/core/http` free of logging imports. Collected via `resolveAll`.
+ * failure, for example to report it to an error tracker. It is a notification:
+ * the error is still logged and answered with 500. Collected via `resolveAll`.
  */
 export type HttpErrorHook = (ctx: HttpContext, error: unknown) => void;
 

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.96.6" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.97.1" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.96.6",
+  "version": "0.97.1",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",