bonescript-compiler 0.2.1 → 0.4.0

package/src/emit_auth.ts

@@ -0,0 +1,67 @@
+/**
+ * BoneScript Auth Emitter
+ * Generates auth.ts — JWT middleware with production safety checks.
+ */
+
+import * as IR from "./ir";
+
+export function emitAuthMiddleware(_system: IR.IRSystem): string {
+  return `// Generated by BoneScript compiler. DO NOT EDIT.
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+// JWT_SECRET must be set in production. The server will refuse to start without it
+// when NODE_ENV is "production" to prevent accidental use of a weak fallback.
+const JWT_SECRET = (() => {
+  const secret = process.env.JWT_SECRET;
+  if (!secret) {
+    if (process.env.NODE_ENV === "production") {
+      console.error("[FATAL] JWT_SECRET environment variable is not set. Refusing to start in production.");
+      process.exit(1);
+    }
+    console.warn("[WARN] JWT_SECRET is not set. Using insecure default — do not use in production.");
+    return "bonescript-dev-secret-do-not-use-in-production";
+  }
+  if (secret.length < 32) {
+    console.warn("[WARN] JWT_SECRET is shorter than 32 characters. Use a longer secret in production.");
+  }
+  return secret;
+})();
+
+export interface AuthContext {
+  authenticated: boolean;
+  actor_id: string | null;
+  trace_id: string;
+}
+
+export function authMiddleware(req: Request, res: Response, next: NextFunction): void {
+  const header = req.headers.authorization;
+  if (!header || !header.startsWith("Bearer ")) {
+    (req as any).auth = { authenticated: false, actor_id: null, trace_id: req.headers["x-trace-id"] as string || "" };
+    next();
+    return;
+  }
+  try {
+    const token = header.slice(7);
+    const decoded = jwt.verify(token, JWT_SECRET) as { sub: string };
+    (req as any).auth = {
+      authenticated: true,
+      actor_id: decoded.sub,
+      trace_id: req.headers["x-trace-id"] as string || "",
+    };
+  } catch {
+    (req as any).auth = { authenticated: false, actor_id: null, trace_id: req.headers["x-trace-id"] as string || "" };
+  }
+  next();
+}
+
+export function requireAuth(req: Request, res: Response, next: NextFunction): void {
+  const auth: AuthContext = (req as any).auth;
+  if (!auth || !auth.authenticated) {
+    res.status(401).json({ error: { code: "UNAUTHORIZED", message: "Authentication required" } });
+    return;
+  }
+  next();
+}
+`;
+}

package/src/emit_batch.ts

@@ -1,140 +1,140 @@
-/**
- * BoneScript Batch Executor Emitter
- * Generates a batch processing module for sync: batch capabilities.
- * Batch capabilities are queued and processed in configurable intervals.
- */
-
-import * as IR from "./ir";
-
-export function emitBatchExecutor(system: IR.IRSystem): string {
-  // Collect all batch capabilities
-  const batchMethods: { modName: string; method: IR.IRMethod }[] = [];
-  for (const mod of system.modules) {
-    for (const iface of mod.interfaces) {
-      for (const method of iface.methods) {
-        if (method.sync === "batch") {
-          batchMethods.push({ modName: mod.name, method });
-        }
-      }
-    }
-  }
-
-  if (batchMethods.length === 0) return "";
-
-  const lines: string[] = [];
-  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
-  lines.push(`// Batch executor for sync: batch capabilities.`);
-  lines.push(`// Set BATCH_INTERVAL_MS to control flush frequency (default: 5000ms).`);
-  lines.push(``);
-  lines.push(`import { query } from "./db";`);
-  lines.push(`import { logger } from "./logger";`);
-  lines.push(`import { counter, histogram } from "./metrics";`);
-  lines.push(``);
-
-  // Batch queue type
-  lines.push(`interface BatchItem {`);
-  lines.push(`  capability: string;`);
-  lines.push(`  payload: Record<string, unknown>;`);
-  lines.push(`  enqueuedAt: Date;`);
-  lines.push(`  resolve: (result: any) => void;`);
-  lines.push(`  reject: (err: Error) => void;`);
-  lines.push(`}`);
-  lines.push(``);
-
-  // Per-capability queues
-  lines.push(`const queues: Map<string, BatchItem[]> = new Map([`);
-  for (const { modName, method } of batchMethods) {
-    lines.push(`  ["${modName}.${method.name}", []],`);
-  }
-  lines.push(`]);`);
-  lines.push(``);
-
-  // Enqueue function
-  lines.push(`export function enqueueBatch(capability: string, payload: Record<string, unknown>): Promise<any> {`);
-  lines.push(`  return new Promise((resolve, reject) => {`);
-  lines.push(`    const queue = queues.get(capability);`);
-  lines.push(`    if (!queue) {`);
-  lines.push(`      reject(new Error(\`Unknown batch capability: \${capability}\`));`);
-  lines.push(`      return;`);
-  lines.push(`    }`);
-  lines.push(`    queue.push({ capability, payload, enqueuedAt: new Date(), resolve, reject });`);
-  lines.push(`    counter("batch.enqueued", { capability });`);
-  lines.push(`  });`);
-  lines.push(`}`);
-  lines.push(``);
-
-  // Flush function — processes all queued items
-  lines.push(`async function flushBatch(capability: string, items: BatchItem[]): Promise<void> {`);
-  lines.push(`  if (items.length === 0) return;`);
-  lines.push(`  const start = Date.now();`);
-  lines.push(`  logger.info("batch_flush_started", { event: capability, metadata: { count: items.length } });`);
-  lines.push(``);
-  lines.push(`  // Process items in a single DB transaction`);
-  lines.push(`  const { pool } = require("./db");`);
-  lines.push(`  const client = await pool.connect();`);
-  lines.push(`  try {`);
-  lines.push(`    await client.query("BEGIN");`);
-  lines.push(`    for (const item of items) {`);
-  lines.push(`      try {`);
-  lines.push(`        // Execute the batch item`);
-  lines.push(`        // Each capability's batch handler is registered below`);
-  lines.push(`        const handler = batchHandlers.get(capability);`);
-  lines.push(`        if (handler) {`);
-  lines.push(`          const result = await handler(item.payload, client);`);
-  lines.push(`          item.resolve(result);`);
-  lines.push(`        } else {`);
-  lines.push(`          item.reject(new Error(\`No batch handler for \${capability}\`));`);
-  lines.push(`        }`);
-  lines.push(`      } catch (e: any) {`);
-  lines.push(`        item.reject(e);`);
-  lines.push(`      }`);
-  lines.push(`    }`);
-  lines.push(`    await client.query("COMMIT");`);
-  lines.push(`    histogram("batch.duration_ms", Date.now() - start, { capability });`);
-  lines.push(`    counter("batch.processed", { capability, count: String(items.length) });`);
-  lines.push(`    logger.info("batch_flush_completed", { event: capability, metadata: { count: items.length, duration_ms: Date.now() - start } });`);
-  lines.push(`  } catch (e: any) {`);
-  lines.push(`    await client.query("ROLLBACK");`);
-  lines.push(`    for (const item of items) item.reject(e);`);
-  lines.push(`    logger.error("batch_flush_failed", { event: capability, metadata: { error: e.message } });`);
-  lines.push(`  } finally {`);
-  lines.push(`    client.release();`);
-  lines.push(`  }`);
-  lines.push(`}`);
-  lines.push(``);
-
-  // Batch handler registry
-  lines.push(`type BatchHandler = (payload: Record<string, unknown>, client: any) => Promise<any>;`);
-  lines.push(`const batchHandlers: Map<string, BatchHandler> = new Map();`);
-  lines.push(``);
-  lines.push(`export function registerBatchHandler(capability: string, handler: BatchHandler): void {`);
-  lines.push(`  batchHandlers.set(capability, handler);`);
-  lines.push(`}`);
-  lines.push(``);
-
-  // Batch worker — flushes all queues on interval
-  lines.push(`export function startBatchWorker(intervalMs: number = parseInt(process.env.BATCH_INTERVAL_MS || "5000")): NodeJS.Timeout {`);
-  lines.push(`  logger.info("batch_worker_started", { event: "startup", metadata: { interval_ms: intervalMs } });`);
-  lines.push(`  return setInterval(async () => {`);
-  lines.push(`    for (const [capability, queue] of queues) {`);
-  lines.push(`      if (queue.length === 0) continue;`);
-  lines.push(`      const batch = queue.splice(0, queue.length); // drain queue atomically`);
-  lines.push(`      await flushBatch(capability, batch).catch(e => {`);
-  lines.push(`        logger.error("batch_worker_error", { event: capability, metadata: { error: e.message } });`);
-  lines.push(`      });`);
-  lines.push(`    }`);
-  lines.push(`  }, intervalMs);`);
-  lines.push(`}`);
-  lines.push(``);
-
-  // Capability-specific stub handlers
-  for (const { modName, method } of batchMethods) {
-    const key = `${modName}.${method.name}`;
-    lines.push(`// Batch handler for ${key}`);
-    lines.push(`// Register your implementation:`);
-    lines.push(`// registerBatchHandler("${key}", async (payload, client) => { ... });`);
-    lines.push(``);
-  }
-
-  return lines.join("\n");
-}
+/**
+ * BoneScript Batch Executor Emitter
+ * Generates a batch processing module for sync: batch capabilities.
+ * Batch capabilities are queued and processed in configurable intervals.
+ */
+
+import * as IR from "./ir";
+
+export function emitBatchExecutor(system: IR.IRSystem): string {
+  // Collect all batch capabilities
+  const batchMethods: { modName: string; method: IR.IRMethod }[] = [];
+  for (const mod of system.modules) {
+    for (const iface of mod.interfaces) {
+      for (const method of iface.methods) {
+        if (method.sync === "batch") {
+          batchMethods.push({ modName: mod.name, method });
+        }
+      }
+    }
+  }
+
+  if (batchMethods.length === 0) return "";
+
+  const lines: string[] = [];
+  lines.push(`// Generated by BoneScript compiler. DO NOT EDIT.`);
+  lines.push(`// Batch executor for sync: batch capabilities.`);
+  lines.push(`// Set BATCH_INTERVAL_MS to control flush frequency (default: 5000ms).`);
+  lines.push(``);
+  lines.push(`import { query } from "./db";`);
+  lines.push(`import { logger } from "./logger";`);
+  lines.push(`import { counter, histogram } from "./metrics";`);
+  lines.push(``);
+
+  // Batch queue type
+  lines.push(`interface BatchItem {`);
+  lines.push(`  capability: string;`);
+  lines.push(`  payload: Record<string, unknown>;`);
+  lines.push(`  enqueuedAt: Date;`);
+  lines.push(`  resolve: (result: any) => void;`);
+  lines.push(`  reject: (err: Error) => void;`);
+  lines.push(`}`);
+  lines.push(``);
+
+  // Per-capability queues
+  lines.push(`const queues: Map<string, BatchItem[]> = new Map([`);
+  for (const { modName, method } of batchMethods) {
+    lines.push(`  ["${modName}.${method.name}", []],`);
+  }
+  lines.push(`]);`);
+  lines.push(``);
+
+  // Enqueue function
+  lines.push(`export function enqueueBatch(capability: string, payload: Record<string, unknown>): Promise<any> {`);
+  lines.push(`  return new Promise((resolve, reject) => {`);
+  lines.push(`    const queue = queues.get(capability);`);
+  lines.push(`    if (!queue) {`);
+  lines.push(`      reject(new Error(\`Unknown batch capability: \${capability}\`));`);
+  lines.push(`      return;`);
+  lines.push(`    }`);
+  lines.push(`    queue.push({ capability, payload, enqueuedAt: new Date(), resolve, reject });`);
+  lines.push(`    counter("batch.enqueued", { capability });`);
+  lines.push(`  });`);
+  lines.push(`}`);
+  lines.push(``);
+
+  // Flush function — processes all queued items
+  lines.push(`async function flushBatch(capability: string, items: BatchItem[]): Promise<void> {`);
+  lines.push(`  if (items.length === 0) return;`);
+  lines.push(`  const start = Date.now();`);
+  lines.push(`  logger.info("batch_flush_started", { event: capability, metadata: { count: items.length } });`);
+  lines.push(``);
+  lines.push(`  // Process items in a single DB transaction`);
+  lines.push(`  const { pool } = require("./db");`);
+  lines.push(`  const client = await pool.connect();`);
+  lines.push(`  try {`);
+  lines.push(`    await client.query("BEGIN");`);
+  lines.push(`    for (const item of items) {`);
+  lines.push(`      try {`);
+  lines.push(`        // Execute the batch item`);
+  lines.push(`        // Each capability's batch handler is registered below`);
+  lines.push(`        const handler = batchHandlers.get(capability);`);
+  lines.push(`        if (handler) {`);
+  lines.push(`          const result = await handler(item.payload, client);`);
+  lines.push(`          item.resolve(result);`);
+  lines.push(`        } else {`);
+  lines.push(`          item.reject(new Error(\`No batch handler for \${capability}\`));`);
+  lines.push(`        }`);
+  lines.push(`      } catch (e: any) {`);
+  lines.push(`        item.reject(e);`);
+  lines.push(`      }`);
+  lines.push(`    }`);
+  lines.push(`    await client.query("COMMIT");`);
+  lines.push(`    histogram("batch.duration_ms", Date.now() - start, { capability });`);
+  lines.push(`    counter("batch.processed", { capability, count: String(items.length) });`);
+  lines.push(`    logger.info("batch_flush_completed", { event: capability, metadata: { count: items.length, duration_ms: Date.now() - start } });`);
+  lines.push(`  } catch (e: any) {`);
+  lines.push(`    await client.query("ROLLBACK");`);
+  lines.push(`    for (const item of items) item.reject(e);`);
+  lines.push(`    logger.error("batch_flush_failed", { event: capability, metadata: { error: e.message } });`);
+  lines.push(`  } finally {`);
+  lines.push(`    client.release();`);
+  lines.push(`  }`);
+  lines.push(`}`);
+  lines.push(``);
+
+  // Batch handler registry
+  lines.push(`type BatchHandler = (payload: Record<string, unknown>, client: any) => Promise<any>;`);
+  lines.push(`const batchHandlers: Map<string, BatchHandler> = new Map();`);
+  lines.push(``);
+  lines.push(`export function registerBatchHandler(capability: string, handler: BatchHandler): void {`);
+  lines.push(`  batchHandlers.set(capability, handler);`);
+  lines.push(`}`);
+  lines.push(``);
+
+  // Batch worker — flushes all queues on interval
+  lines.push(`export function startBatchWorker(intervalMs: number = parseInt(process.env.BATCH_INTERVAL_MS || "5000")): NodeJS.Timeout {`);
+  lines.push(`  logger.info("batch_worker_started", { event: "startup", metadata: { interval_ms: intervalMs } });`);
+  lines.push(`  return setInterval(async () => {`);
+  lines.push(`    for (const [capability, queue] of queues) {`);
+  lines.push(`      if (queue.length === 0) continue;`);
+  lines.push(`      const batch = queue.splice(0, queue.length); // drain queue atomically`);
+  lines.push(`      await flushBatch(capability, batch).catch(e => {`);
+  lines.push(`        logger.error("batch_worker_error", { event: capability, metadata: { error: e.message } });`);
+  lines.push(`      });`);
+  lines.push(`    }`);
+  lines.push(`  }, intervalMs);`);
+  lines.push(`}`);
+  lines.push(``);
+
+  // Capability-specific stub handlers
+  for (const { modName, method } of batchMethods) {
+    const key = `${modName}.${method.name}`;
+    lines.push(`// Batch handler for ${key}`);
+    lines.push(`// Register your implementation:`);
+    lines.push(`// registerBatchHandler("${key}", async (payload, client) => { ... });`);
+    lines.push(``);
+  }
+
+  return lines.join("\n");
+}