npm - bro-framework - Versions diffs - 2.0.1 → 2.2.0 - Mend

bro-framework 2.0.1 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/README.md CHANGED Viewed

@@ -17,6 +17,7 @@
     <a href="https://brojs.yessindevs.me">Documentation Website</a>
   </p>
 </p>
 ---
 > "NestJS wants four decorators, three modules, and an existential crisis just to handle a GET request. Express makes you write the same 40 lines of CORS, JSON parsing, and auth middleware for every project. bro.js gives you file routing, auto-validation, JWT auth, WebSockets, and live docs out of the box. Be honest: you just want to return an object."

package/bin/bro.js CHANGED Viewed

@@ -9,7 +9,7 @@ register();
 import { createServer } from '../src/server.js';
 import { colors, printBanner, printRoute, printHotReload } from '../src/logger.js';
-import { scanTasks } from '../src/tasks.js';
+import { scanTasks, stopTasks } from '../src/tasks.js';
 import { generateSDK } from '../src/sdk.js';
 import dotenv from 'dotenv';
 import chokidar from 'chokidar';
@@ -122,7 +122,7 @@ if (command === 'init') {
 if (['sdk', 'generate-client', 'client'].includes(command)) {
   generateSDK().then(() => {
-    console.log(`\n  ${colors.green} bro-client.js generated successfully!${colors.reset}\n`);
+    console.log(`\n  ${colors.green} bro-sdk.js generated successfully!${colors.reset}\n`);
     process.exit(0);
   }).catch(err => {
     console.error(`\n  ${colors.red} Error generating SDK:${colors.reset}`, err.message);
@@ -182,6 +182,7 @@ async function bootstrap() {
       console.error("");
       process.exit(1);
     }
+    globalConfig.envData = envResult.data;
   }
   if (!fs.existsSync(routesDir)) {
@@ -236,6 +237,19 @@ async function bootstrap() {
         }
       });
     }
+    const handleShutdown = async (signal) => {
+      console.log(`\n[bro.js] Received ${signal}. Shutting down gracefully...`);
+      stopTasks();
+      if (io) io.close();
+      server.close(() => {
+        console.log('[bro.js] HTTP server closed.');
+        process.exit(0);
+      });
+    };
+    process.on('SIGINT', () => handleShutdown('SIGINT'));
+    process.on('SIGTERM', () => handleShutdown('SIGTERM'));
   });
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "bro-framework",
-  "version": "2.0.1",
+  "version": "2.2.0",
   "description": "The No-BS Backend Framework for Node.js",
   "repository": {
     "type": "git",

package/src/auth.js CHANGED Viewed

@@ -1,31 +1,23 @@
 import jwt from 'jsonwebtoken';
-let secret = 'bro_default_secret_key';
-/**
- * Update the secret used for signing and verifying JWTs.
- * @param {string} newSecret
- */
-export function setJwtSecret(newSecret) {
-  secret = newSecret;
-}
 /**
  * Signs a JWT payload.
  * @param {Object} payload - The data to embed in the token.
+ * @param {string} secret - The JWT secret key.
  * @param {jwt.SignOptions} [options] - jsonwebtoken sign options.
  * @returns {string} The signed JWT token.
  */
-export function signJwt(payload, options = { expiresIn: '1d' }) {
+export function signJwt(payload, secret, options = { expiresIn: '1d' }) {
   return jwt.sign(payload, secret, options);
 }
 /**
  * Verifies and decodes a JWT token.
  * @param {string} token - The JWT token to verify.
+ * @param {string} secret - The JWT secret key.
  * @returns {{ valid: boolean, payload?: any, error?: string }}
  */
-export function verifyJwt(token) {
+export function verifyJwt(token, secret) {
   try {
     const payload = jwt.verify(token, secret);
     return { valid: true, payload };

package/src/index.d.ts CHANGED Viewed

@@ -3,6 +3,8 @@ import { z, ZodTypeAny } from 'zod';
 type InferZod<T> = T extends ZodTypeAny ? z.infer<T> : any;
 export interface BroContext<Body = any, Params = any, Query = any> {
+  env?: any;
+  jwt?: { sign: (payload: any, options?: any) => string };
   body: InferZod<Body>;
   params: InferZod<Params>;
   query: InferZod<Query>;
@@ -15,7 +17,8 @@ export interface BroContext<Body = any, Params = any, Query = any> {
 export interface RouteConfig<Body = any, Params = any, Query = any> {
   auth?: boolean;
-  upload?: boolean;
+  upload?: boolean | { limits?: any, fields?: { name: string, maxCount?: number }[], single?: string, array?: string, fileFilter?: any, storage?: any };
+  schema?: { body?: Body; params?: Params; query?: Query; };
   body?: Body;
   params?: Params;
   query?: Query;
@@ -46,6 +49,14 @@ export interface BroConfig {
     windowMs: number;
     max: number;
   };
+  upload?: {
+    limits?: {
+      fileSize?: number;
+      files?: number;
+      fields?: number;
+      [key: string]: any;
+    };
+  };
   db?: () => Promise<any> | any;
   sockets?: (io: any, db: any) => Promise<void> | void;
 }

package/src/router.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import fs from 'fs';
 import path from 'path';
 import { pathToFileURL } from 'url';
+import crypto from 'crypto';
 import { zodToJsonSchema } from 'zod-to-json-schema';
 /**
@@ -48,10 +49,11 @@ export function parseRouteFile(filePath, routesDir) {
   if (routePath === '/.') routePath = '';
   if (namePart !== 'index') {
-    const formattedName = namePart.replace(/\[(.*?)\]/g, ':$1');
-    routePath += `/${formattedName}`;
+    routePath += `/${namePart}`;
   }
+  routePath = routePath.replace(/\[(.*?)\]/g, ':$1');
   if (routePath === '') routePath = '/';
   return { routePath, method };
@@ -68,6 +70,7 @@ export function parseRouteFile(filePath, routesDir) {
 export async function loadRoutes(app, routesDir, createHandler, openApiSpec) {
   const files = scanDir(routesDir);
   const loadedRoutes = [];
+  const routeModules = [];
   for (const file of files) {
     const routeInfo = parseRouteFile(file, routesDir);
@@ -77,68 +80,92 @@ export async function loadRoutes(app, routesDir, createHandler, openApiSpec) {
     if (typeof app[method] !== 'function') continue;
-    try {
-      const moduleUrl = pathToFileURL(file).href + '?update=' + Date.now();
-      const module = await import(moduleUrl);
-      const config = module.default;
-      if (!config) continue;
+    const moduleUrl = pathToFileURL(file).href + '?update=' + crypto.randomUUID();
+    const module = await import(moduleUrl);
+    const config = module.default;
+    if (!config) continue;
+    routeModules.push({ file, routePath, method, config });
+  }
+  for (const { file, routePath, method, config } of routeModules) {
+    const handler = createHandler(config);
+    app[method](routePath, handler);
+    if (openApiSpec) {
+      const openApiPath = routePath.replace(/:([a-zA-Z0-9_]+)/g, '{$1}');
+      if (!openApiSpec.paths[openApiPath]) openApiSpec.paths[openApiPath] = {};
-      const handler = createHandler(config);
-      app[method](routePath, handler);
+      const operation = {
+        summary: config.summary || `${method.toUpperCase()} ${routePath}`,
+        responses: { '200': { description: 'Successful response' } }
+      };
-      if (openApiSpec) {
-        const openApiPath = routePath.replace(/:([a-zA-Z0-9_]+)/g, '{$1}');
-        if (!openApiSpec.paths[openApiPath]) openApiSpec.paths[openApiPath] = {};
-        const operation = {
-          summary: config.summary || `${method.toUpperCase()} ${routePath}`,
-          responses: { '200': { description: 'Successful response' } }
+      const bodySchema = config.schema?.body || config.body;
+      const paramsSchema = config.schema?.params || config.params;
+      const querySchema = config.schema?.query || config.query;
+      if (bodySchema) {
+        operation.requestBody = {
+          content: { 'application/json': { schema: zodToJsonSchema(bodySchema) } }
         };
-        if (config.body) {
-          operation.requestBody = {
-            content: { 'application/json': { schema: zodToJsonSchema(config.body) } }
-          };
-        }
-        if (config.params) {
-          operation.parameters = operation.parameters || [];
-          const pSchema = zodToJsonSchema(config.params);
-          if (pSchema.properties) {
-            for (const [key, schema] of Object.entries(pSchema.properties)) {
-              operation.parameters.push({ name: key, in: 'path', required: true, schema });
-            }
+      }
+      if (paramsSchema) {
+        operation.parameters = operation.parameters || [];
+        const pSchema = zodToJsonSchema(paramsSchema);
+        if (pSchema.properties) {
+          for (const [key, schema] of Object.entries(pSchema.properties)) {
+            operation.parameters.push({ name: key, in: 'path', required: true, schema });
           }
         }
+      }
-        if (config.query) {
-          operation.parameters = operation.parameters || [];
-          const qSchema = zodToJsonSchema(config.query);
-          if (qSchema.properties) {
-            for (const [key, schema] of Object.entries(qSchema.properties)) {
-              operation.parameters.push({
-                name: key,
-                in: 'query',
-                required: qSchema.required?.includes(key),
-                schema
-              });
-            }
+      if (querySchema) {
+        operation.parameters = operation.parameters || [];
+        const qSchema = zodToJsonSchema(querySchema);
+        if (qSchema.properties) {
+          for (const [key, schema] of Object.entries(qSchema.properties)) {
+            operation.parameters.push({
+              name: key,
+              in: 'query',
+              required: qSchema.required?.includes(key),
+              schema
+            });
           }
         }
-        openApiSpec.paths[openApiPath][method.toLowerCase()] = operation;
       }
-      loadedRoutes.push({
-        method: method.toUpperCase(),
-        path: routePath,
-        auth: !!config.auth
-      });
+      // Auto-inject security definition if auth is true
+      if (config.auth) {
+        operation.security = [{ bearerAuth: [] }];
+      }
+      if (config.upload) {
+        operation.requestBody = operation.requestBody || { content: {} };
+        operation.requestBody.content['multipart/form-data'] = {
+          schema: { type: 'object' }
+        };
+      }
+      if (bodySchema || paramsSchema || querySchema) {
+        operation.responses['400'] = { $ref: '#/components/responses/BadRequest' };
+      }
+      if (config.auth) {
+        operation.responses['401'] = { $ref: '#/components/responses/Unauthorized' };
+      }
+      operation.responses['404'] = { $ref: '#/components/responses/NotFound' };
+      operation.responses['500'] = { $ref: '#/components/responses/ServerError' };
-    } catch (err) {
-      console.error(`[bro.js] Failed to load route ${file}:`, err);
+      openApiSpec.paths[openApiPath][method.toLowerCase()] = operation;
     }
+    loadedRoutes.push({
+      method: method.toUpperCase(),
+      path: routePath,
+      auth: !!config.auth
+    });
   }
   return loadedRoutes;

package/src/sdk.js CHANGED Viewed

@@ -44,7 +44,10 @@ async function request(method, path, data) {
     options.body = JSON.stringify(data);
   } else if (data && ['GET', 'DELETE'].includes(method.toUpperCase())) {
     const params = new URLSearchParams(data);
-    path += '?' + params.toString();
+    const qs = params.toString();
+    if (qs) {
+      path += '?' + qs;
+    }
   }
   const url = CONFIG.baseURL + path;
@@ -113,12 +116,16 @@ function generateApiObject(endpoints) {
   function renderTree(node, indent = '  ') {
     let result = '';
+    const isValidIdentifier = (key) => /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key);
     for (const [key, val] of Object.entries(node)) {
+      const formattedKey = isValidIdentifier(key) ? key : `"${key}"`;
       if (val._isParam) {
-        result += `${indent}${key}: (${key}) => ({\n`;
+        result += `${indent}${formattedKey}: (${key}) => ({\n`;
         for (const [m, p] of Object.entries(val._methods)) {
-          const templatedPath = p.replace(/:([a-zA-Z0-9_]+)/g, '${$1}');
+          const templatedPath = p.replace(/:([a-zA-Z0-9_]+)/g, '${encodeURIComponent($1)}');
           result += `${indent}  ${m}: (data) => request('${m}', \`${templatedPath}\`, data),\n`;
         }
@@ -129,7 +136,7 @@ function generateApiObject(endpoints) {
         result += `${indent}}),\n`;
       } else {
-        result += `${indent}${key}: {\n`;
+        result += `${indent}${formattedKey}: {\n`;
         for (const [m, p] of Object.entries(val._methods)) {
            result += `${indent}  ${m}: (data) => request('${m}', '${p}', data),\n`;
         }

package/src/server.js CHANGED Viewed

@@ -5,11 +5,9 @@ import { Server } from 'socket.io';
 import rateLimit from 'express-rate-limit';
 import multer from 'multer';
 import { apiReference } from '@scalar/express-api-reference';
-import { verifyJwt, signJwt, setJwtSecret } from './auth.js';
+import { verifyJwt, signJwt } from './auth.js';
 import { loadRoutes } from './router.js';
-const upload = multer();
 /**
  * Creates and configures the core Express server.
  * @param {Object} globalConfig - User's bro.config.js configurations.
@@ -18,12 +16,19 @@ const upload = multer();
  * @returns {Promise<{ app: import('express').Application, server: http.Server, routes: Array, reload: Function, io: import('socket.io').Server }>}
  */
 export async function createServer(globalConfig, routesDir, db) {
+  if (process.env.NODE_ENV === 'production' && ['dev_secret_please_change', 'bro_default_secret_key'].includes(globalConfig.jwtSecret)) {
+    throw new Error('CRITICAL SECURITY ERROR: You are running in production with a default JWT secret! Please set auth.jwtSecret in bro.config.js or via JWT_SECRET environment variable.');
+  }
   const app = express();
   const server = http.createServer(app);
   const corsConfig = globalConfig.server?.cors !== undefined ? globalConfig.server.cors : true;
-  app.use(cors(typeof corsConfig === 'object' ? corsConfig : {}));
+  if (corsConfig !== false) {
+    app.use(cors(typeof corsConfig === 'object' ? corsConfig : {}));
+  }
   app.use(express.json());
   if (globalConfig.rateLimit) {
@@ -36,24 +41,49 @@ export async function createServer(globalConfig, routesDir, db) {
     await globalConfig.sockets(io, db);
   }
-  if (globalConfig.jwtSecret) {
-    setJwtSecret(globalConfig.jwtSecret);
-  }
   const createHandler = (routeConfig) => {
     const middlewares = [];
+    const bodySchema = routeConfig.schema?.body || routeConfig.body;
+    const paramsSchema = routeConfig.schema?.params || routeConfig.params;
+    const querySchema = routeConfig.schema?.query || routeConfig.query;
     if (routeConfig.rateLimit) {
       middlewares.push(rateLimit(routeConfig.rateLimit));
     }
     if (routeConfig.upload) {
-      middlewares.push(upload.any());
+      const routeMulterConfig = {
+        limits: globalConfig.upload?.limits || {
+          fileSize: 10 * 1024 * 1024,
+          files: 5,
+          fields: 20
+        }
+      };
+      if (typeof routeConfig.upload === 'object') {
+        if (routeConfig.upload.limits) {
+          routeMulterConfig.limits = { ...routeMulterConfig.limits, ...routeConfig.upload.limits };
+        }
+        if (routeConfig.upload.fileFilter) routeMulterConfig.fileFilter = routeConfig.upload.fileFilter;
+        if (routeConfig.upload.storage) routeMulterConfig.storage = routeConfig.upload.storage;
+      }
+      const uploadParser = multer(routeMulterConfig);
+      if (typeof routeConfig.upload === 'object' && routeConfig.upload.fields) {
+        middlewares.push(uploadParser.fields(routeConfig.upload.fields));
+      } else if (typeof routeConfig.upload === 'object' && routeConfig.upload.single) {
+        middlewares.push(uploadParser.single(routeConfig.upload.single));
+      } else if (typeof routeConfig.upload === 'object' && routeConfig.upload.array) {
+        middlewares.push(uploadParser.array(routeConfig.upload.array));
+      } else {
+        middlewares.push(uploadParser.any());
+      }
     }
     middlewares.push(async (req, res) => {
       try {
         const ctx = {
+          env: globalConfig.envData || process.env,
           db,
           io,
           body: req.body,
@@ -61,7 +91,7 @@ export async function createServer(globalConfig, routesDir, db) {
           query: req.query,
           files: req.files || req.file,
           user: null,
-          jwt: { sign: signJwt },
+          jwt: { sign: (payload, opts) => signJwt(payload, globalConfig.jwtSecret, opts || { expiresIn: globalConfig.auth?.expiresIn || '1d' }) },
           error: (status, message) => {
              const err = new Error(message);
              err.status = status;
@@ -76,7 +106,7 @@ export async function createServer(globalConfig, routesDir, db) {
           }
           const token = authHeader.split(' ')[1];
-          const authResult = verifyJwt(token);
+          const authResult = verifyJwt(token, globalConfig.jwtSecret);
           if (!authResult.valid) {
             return res.status(401).json({ error: 'Unauthorized', details: authResult.error });
@@ -85,24 +115,24 @@ export async function createServer(globalConfig, routesDir, db) {
           ctx.user = authResult.payload;
         }
-        if (routeConfig.params) {
-          const result = routeConfig.params.safeParse(req.params);
+        if (paramsSchema) {
+          const result = paramsSchema.safeParse(req.params);
           if (!result.success) {
             return res.status(400).json({ error: 'Invalid URL Parameters', details: result.error.flatten() });
           }
           ctx.params = result.data;
         }
-        if (routeConfig.body) {
-          const result = routeConfig.body.safeParse(req.body);
+        if (bodySchema) {
+          const result = bodySchema.safeParse(req.body);
           if (!result.success) {
             return res.status(400).json({ error: 'Invalid Request Body', details: result.error.flatten() });
           }
           ctx.body = result.data;
         }
-        if (routeConfig.query) {
-           const result = routeConfig.query.safeParse(req.query);
+        if (querySchema) {
+           const result = querySchema.safeParse(req.query);
            if (!result.success) {
              return res.status(400).json({ error: 'Invalid Query Parameters', details: result.error.flatten() });
            }
@@ -143,6 +173,21 @@ export async function createServer(globalConfig, routesDir, db) {
   let openApiSpec = {
     openapi: '3.0.0',
     info: { title: 'bro.js API', version: '1.0.0' },
+    components: {
+      securitySchemes: {
+        bearerAuth: {
+          type: 'http',
+          scheme: 'bearer',
+          bearerFormat: 'JWT'
+        }
+      },
+      responses: {
+        BadRequest: { description: 'Bad Request', content: { 'application/json': { schema: { type: 'object', properties: { error: { type: 'string' } } } } } },
+        Unauthorized: { description: 'Unauthorized', content: { 'application/json': { schema: { type: 'object', properties: { error: { type: 'string' } } } } } },
+        NotFound: { description: 'Not Found', content: { 'application/json': { schema: { type: 'object', properties: { error: { type: 'string' } } } } } },
+        ServerError: { description: 'Internal Server Error', content: { 'application/json': { schema: { type: 'object', properties: { error: { type: 'string' } } } } } }
+      }
+    },
     paths: {}
   };
@@ -174,10 +219,20 @@ export async function createServer(globalConfig, routesDir, db) {
     routeStack(req, res, next);
   });
+  app.use((req, res) => {
+    res.status(404).json({ error: 'Not Found' });
+  });
+  app.use((err, req, res, next) => {
+    console.error(`[bro.js] Uncaught Error:`, err);
+    res.status(err.status || 500).json({ error: err.message || 'Internal Server Error' });
+  });
   const reload = async () => {
     const newRouter = express.Router();
-    openApiSpec.paths = {};
-    const routes = await loadRoutes(newRouter, routesDir, createHandler, openApiSpec);
+    const tempSpec = { paths: {} };
+    const routes = await loadRoutes(newRouter, routesDir, createHandler, tempSpec);
+    openApiSpec.paths = tempSpec.paths;
     routeStack = newRouter;
     return routes;
   };

package/src/tasks.js CHANGED Viewed

@@ -3,29 +3,39 @@ import path from 'path';
 import { pathToFileURL } from 'url';
 import cron from 'node-cron';
 import { colors } from './logger.js';
+import { scanDir } from './router.js';
+let taskHandles = [];
+export function stopTasks() {
+  taskHandles.forEach(t => t.stop());
+  taskHandles = [];
+}
 export async function scanTasks(ctx) {
   const tasksDir = path.join(process.cwd(), 'tasks');
   if (!fs.existsSync(tasksDir)) return;
-  const files = fs.readdirSync(tasksDir).filter(f => f.endsWith('.js'));
+  stopTasks();
+  const files = scanDir(tasksDir);
   if (files.length === 0) return;
   let count = 0;
   for (const file of files) {
-    const filePath = path.join(tasksDir, file);
     try {
-      const moduleUrl = pathToFileURL(filePath).href;
+      const moduleUrl = pathToFileURL(file).href;
       const taskModule = await import(moduleUrl);
       if (taskModule.cron && typeof taskModule.handler === 'function') {
-        cron.schedule(taskModule.cron, async () => {
+        const task = cron.schedule(taskModule.cron, async () => {
           try {
             await taskModule.handler(ctx);
           } catch (err) {
             console.error(`\n  ${colors.red}❌ Task Error (${file}):${colors.reset}`, err);
           }
         });
+        taskHandles.push(task);
         count++;
       }
     } catch (err) {