bro-framework 2.1.0 → 2.2.1

package/README.md

@@ -17,6 +17,7 @@
     <a href="https://brojs.yessindevs.me">Documentation Website</a>
   </p>
 </p>
+
 ---
 
 > "NestJS wants four decorators, three modules, and an existential crisis just to handle a GET request. Express makes you write the same 40 lines of CORS, JSON parsing, and auth middleware for every project. bro.js gives you file routing, auto-validation, JWT auth, WebSockets, and live docs out of the box. Be honest: you just want to return an object."
@@ -108,7 +109,7 @@ Stop importing singleton database connections and socket instances into every fi
 If you've ever hand-written OpenAPI YAML, you know the pain. `bro.js` parses your Zod schemas and automatically serves a stunning, interactive [Scalar](https://scalar.com/) API playground at `/docs`. It's highly secure: by default, these internal docs are disabled in production mode.
 
 ### The Frontend SDK Generator
-Tired of writing frontend `fetch` wrappers? Run `bro sdk`. The CLI will parse your backend routes and compile a `bro-client.js` file for your frontend. It features built-in token management, request stringification, and type-safe deep tree traversal (e.g., `api.users.id("123").post(data)`).
+Tired of writing frontend `fetch` wrappers? Run `bro sdk`. The CLI will parse your backend routes and compile a `bro-sdk.js` file for your frontend. It features built-in token management, request stringification, and type-safe deep tree traversal (e.g., `api.users.id("123").post(data)`).
 
 ### Background Task Scheduler
 Don't spin up a separate worker server. Drop a JavaScript file anywhere in the `tasks/` folder, export a cron string (e.g., `"0 0 * * *"`), and an async handler. `bro.js` natively schedules it as a background worker with full access to your injected database and WebSocket contexts.

package/bin/bro.js

@@ -122,7 +122,7 @@ if (command === 'init') {
 
 if (['sdk', 'generate-client', 'client'].includes(command)) {
   generateSDK().then(() => {
-    console.log(`\n  ${colors.green} bro-client.js generated successfully!${colors.reset}\n`);
+    console.log(`\n  ${colors.green} bro-sdk.js generated successfully!${colors.reset}\n`);
     process.exit(0);
   }).catch(err => {
     console.error(`\n  ${colors.red} Error generating SDK:${colors.reset}`, err.message);
@@ -185,12 +185,6 @@ async function bootstrap() {
     globalConfig.envData = envResult.data;
   }
 
-  if (process.env.NODE_ENV === 'production' && ['dev_secret_please_change', 'bro_default_secret_key'].includes(globalConfig.jwtSecret)) {
-    console.error(`\n  ✗ CRITICAL SECURITY ERROR: You are running in production with a default JWT secret!`);
-    console.error(`  Please set auth.jwtSecret in bro.config.js or via JWT_SECRET environment variable.`);
-    process.exit(1);
-  }
-
   if (!fs.existsSync(routesDir)) {
     console.error(`✗ Error: 'routes' directory not found in ${cwd}`);
     console.error(`  Please create a 'routes/' folder and add your first route.`);
@@ -210,7 +204,7 @@ async function bootstrap() {
       console.log(`[bro.js] Server running in production on port ${port}`);
     }
     
-    await scanTasks({ db, io });
+    let taskManager = await scanTasks({ db, io });
     
     if (command === 'dev') {
       const printCurrentRoutes = (routesToPrint) => {
@@ -243,6 +237,19 @@ async function bootstrap() {
         }
       });
     }
+
+    const handleShutdown = async (signal) => {
+      console.log(`\n[bro.js] Received ${signal}. Shutting down gracefully...`);
+      if (taskManager) taskManager.stopAll();
+      if (io) io.close();
+      server.close(() => {
+        console.log('[bro.js] HTTP server closed.');
+        process.exit(0);
+      });
+    };
+
+    process.on('SIGINT', () => handleShutdown('SIGINT'));
+    process.on('SIGTERM', () => handleShutdown('SIGTERM'));
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bro-framework",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "description": "The No-BS Backend Framework for Node.js",
   "repository": {
     "type": "git",

package/src/index.d.ts

@@ -3,6 +3,8 @@ import { z, ZodTypeAny } from 'zod';
 type InferZod<T> = T extends ZodTypeAny ? z.infer<T> : any;
 
 export interface BroContext<Body = any, Params = any, Query = any> {
+  env?: any;
+  jwt?: { sign: (payload: any, options?: any) => string };
   body: InferZod<Body>;
   params: InferZod<Params>;
   query: InferZod<Query>;
@@ -15,7 +17,8 @@ export interface BroContext<Body = any, Params = any, Query = any> {
 
 export interface RouteConfig<Body = any, Params = any, Query = any> {
   auth?: boolean;
-  upload?: boolean;
+  upload?: boolean | { limits?: any, fields?: { name: string, maxCount?: number }[], single?: string, array?: string, fileFilter?: any, storage?: any };
+  schema?: { body?: Body; params?: Params; query?: Query; };
   body?: Body;
   params?: Params;
   query?: Query;
@@ -46,6 +49,14 @@ export interface BroConfig {
     windowMs: number;
     max: number;
   };
+  upload?: {
+    limits?: {
+      fileSize?: number;
+      files?: number;
+      fields?: number;
+      [key: string]: any;
+    };
+  };
   db?: () => Promise<any> | any;
   sockets?: (io: any, db: any) => Promise<void> | void;
 }

package/src/logger.js

@@ -1,3 +1,7 @@
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
 export const colors = {
   reset: "\x1b[0m",
   bold: "\x1b[1m",
@@ -25,7 +29,16 @@ export function formatMethod(method) {
 
 export function printBanner(port, durationMs) {
   const time = durationMs.toFixed(0);
-  const version = "2.0.1";
+  
+  let version = "2.2.0";
+  try {
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = path.dirname(__filename);
+    const pkgPath = path.join(__dirname, '..', 'package.json');
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+    version = pkg.version;
+  } catch(e) {}
+  
   const innerWidth = 47;
 
   const stripAnsi = (str) => str.replace(/\x1B\[[0-9;]*[a-zA-Z]/g, "");

package/src/router.js

@@ -43,6 +43,12 @@ export function parseRouteFile(filePath, routesDir) {
   if (parts.length < 2) return null; 
   
   const method = parts.pop().toLowerCase();
+  
+  const allowedMethods = new Set(['get', 'post', 'put', 'delete', 'patch', 'options', 'head']);
+  if (!allowedMethods.has(method)) {
+    throw new Error(`Invalid HTTP method "${method}" in file: ${filePath}`);
+  }
+  
   const namePart = parts.join('.');
   
   let routePath = '/' + path.dirname(relativePath).replace(/\\/g, '/');
@@ -52,6 +58,15 @@ export function parseRouteFile(filePath, routesDir) {
     routePath += `/${namePart}`;
   }
   
+  const bracketRegex = /\[(.*?)\]/g;
+  let match;
+  while ((match = bracketRegex.exec(routePath)) !== null) {
+    const paramName = match[1];
+    if (!/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(paramName)) {
+      throw new Error(`Invalid dynamic parameter "[${paramName}]" in file: ${filePath}. Must be a valid JavaScript identifier.`);
+    }
+  }
+  
   routePath = routePath.replace(/\[(.*?)\]/g, ':$1');
   
   if (routePath === '') routePath = '/';
@@ -142,6 +157,22 @@ export async function loadRoutes(app, routesDir, createHandler, openApiSpec) {
         operation.security = [{ bearerAuth: [] }];
       }
       
+      if (config.upload) {
+        operation.requestBody = operation.requestBody || { content: {} };
+        operation.requestBody.content['multipart/form-data'] = {
+          schema: { type: 'object' }
+        };
+      }
+      
+      if (bodySchema || paramsSchema || querySchema) {
+        operation.responses['400'] = { $ref: '#/components/responses/BadRequest' };
+      }
+      if (config.auth) {
+        operation.responses['401'] = { $ref: '#/components/responses/Unauthorized' };
+      }
+      operation.responses['404'] = { $ref: '#/components/responses/NotFound' };
+      operation.responses['500'] = { $ref: '#/components/responses/ServerError' };
+      
       openApiSpec.paths[openApiPath][method.toLowerCase()] = operation;
     }
     

package/src/sdk.js

@@ -98,6 +98,10 @@ function generateApiObject(endpoints) {
       
       if (!current[name]) {
         current[name] = { _isParam: isParam, _methods: {}, _children: {}, _path: pathAcc };
+      } else {
+        if (current[name]._isParam !== isParam) {
+          throw new Error(`SDK Collision: Route segment "${name}" conflicts between static and dynamic parameters at path "${pathAcc}"`);
+        }
       }
       
       if (i === parts.length - 1) {
@@ -116,9 +120,13 @@ function generateApiObject(endpoints) {
   function renderTree(node, indent = '  ') {
     let result = '';
     
+    const isValidIdentifier = (key) => /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key);
+    
     for (const [key, val] of Object.entries(node)) {
+      const formattedKey = isValidIdentifier(key) ? key : `"${key}"`;
+      
       if (val._isParam) {
-        result += `${indent}"${key}": (${key}) => ({\n`;
+        result += `${indent}${formattedKey}: (${key}) => ({\n`;
         
         for (const [m, p] of Object.entries(val._methods)) {
           const templatedPath = p.replace(/:([a-zA-Z0-9_]+)/g, '${encodeURIComponent($1)}');
@@ -132,7 +140,7 @@ function generateApiObject(endpoints) {
         
         result += `${indent}}),\n`;
       } else {
-        result += `${indent}"${key}": {\n`;
+        result += `${indent}${formattedKey}: {\n`;
         for (const [m, p] of Object.entries(val._methods)) {
            result += `${indent}  ${m}: (data) => request('${m}', '${p}', data),\n`;
         }

package/src/server.js

@@ -16,6 +16,10 @@ import { loadRoutes } from './router.js';
  * @returns {Promise<{ app: import('express').Application, server: http.Server, routes: Array, reload: Function, io: import('socket.io').Server }>}
  */
 export async function createServer(globalConfig, routesDir, db) {
+  if (process.env.NODE_ENV === 'production' && ['dev_secret_please_change', 'bro_default_secret_key'].includes(globalConfig.jwtSecret)) {
+    throw new Error('CRITICAL SECURITY ERROR: You are running in production with a default JWT secret! Please set auth.jwtSecret in bro.config.js or via JWT_SECRET environment variable.');
+  }
+
   const app = express();
   const server = http.createServer(app);
   
@@ -39,6 +43,9 @@ export async function createServer(globalConfig, routesDir, db) {
   
   const createHandler = (routeConfig) => {
     const middlewares = [];
+    const bodySchema = routeConfig.schema?.body || routeConfig.body;
+    const paramsSchema = routeConfig.schema?.params || routeConfig.params;
+    const querySchema = routeConfig.schema?.query || routeConfig.query;
     
     if (routeConfig.rateLimit) {
       middlewares.push(rateLimit(routeConfig.rateLimit));
@@ -52,10 +59,25 @@ export async function createServer(globalConfig, routesDir, db) {
           fields: 20
         }
       };
-      if (typeof routeConfig.upload === 'object' && routeConfig.upload.limits) {
-        routeMulterConfig.limits = { ...routeMulterConfig.limits, ...routeConfig.upload.limits };
+      if (typeof routeConfig.upload === 'object') {
+        if (routeConfig.upload.limits) {
+          routeMulterConfig.limits = { ...routeMulterConfig.limits, ...routeConfig.upload.limits };
+        }
+        if (routeConfig.upload.fileFilter) routeMulterConfig.fileFilter = routeConfig.upload.fileFilter;
+        if (routeConfig.upload.storage) routeMulterConfig.storage = routeConfig.upload.storage;
+      }
+      
+      const uploadParser = multer(routeMulterConfig);
+      
+      if (typeof routeConfig.upload === 'object' && routeConfig.upload.fields) {
+        middlewares.push(uploadParser.fields(routeConfig.upload.fields));
+      } else if (typeof routeConfig.upload === 'object' && routeConfig.upload.single) {
+        middlewares.push(uploadParser.single(routeConfig.upload.single));
+      } else if (typeof routeConfig.upload === 'object' && routeConfig.upload.array) {
+        middlewares.push(uploadParser.array(routeConfig.upload.array));
+      } else {
+        middlewares.push(uploadParser.any());
       }
-      middlewares.push(multer(routeMulterConfig).any());
     }
     
     middlewares.push(async (req, res) => {
@@ -93,24 +115,24 @@ export async function createServer(globalConfig, routesDir, db) {
           ctx.user = authResult.payload;
         }
 
-        if (routeConfig.params) {
-          const result = routeConfig.params.safeParse(req.params);
+        if (paramsSchema) {
+          const result = paramsSchema.safeParse(req.params);
           if (!result.success) {
             return res.status(400).json({ error: 'Invalid URL Parameters', details: result.error.flatten() });
           }
           ctx.params = result.data;
         }
         
-        if (routeConfig.body) {
-          const result = routeConfig.body.safeParse(req.body);
+        if (bodySchema) {
+          const result = bodySchema.safeParse(req.body);
           if (!result.success) {
             return res.status(400).json({ error: 'Invalid Request Body', details: result.error.flatten() });
           }
           ctx.body = result.data;
         }
 
-        if (routeConfig.query) {
-           const result = routeConfig.query.safeParse(req.query);
+        if (querySchema) {
+           const result = querySchema.safeParse(req.query);
            if (!result.success) {
              return res.status(400).json({ error: 'Invalid Query Parameters', details: result.error.flatten() });
            }
@@ -208,8 +230,9 @@ export async function createServer(globalConfig, routesDir, db) {
 
   const reload = async () => {
     const newRouter = express.Router();
-    openApiSpec.paths = {};
-    const routes = await loadRoutes(newRouter, routesDir, createHandler, openApiSpec);
+    const tempSpec = { paths: {} };
+    const routes = await loadRoutes(newRouter, routesDir, createHandler, tempSpec);
+    openApiSpec.paths = tempSpec.paths;
     routeStack = newRouter;
     return routes;
   };

package/src/tasks.js

@@ -5,21 +5,24 @@ import cron from 'node-cron';
 import { colors } from './logger.js';
 import { scanDir } from './router.js';
 
-let taskHandles = [];
-
-export function stopTasks() {
-  taskHandles.forEach(t => t.stop());
-  taskHandles = [];
+export class TaskManager {
+  constructor() {
+    this.taskHandles = [];
+  }
+  
+  stopAll() {
+    this.taskHandles.forEach(t => t.stop());
+    this.taskHandles = [];
+  }
 }
 
 export async function scanTasks(ctx) {
+  const manager = new TaskManager();
   const tasksDir = path.join(process.cwd(), 'tasks');
-  if (!fs.existsSync(tasksDir)) return;
+  if (!fs.existsSync(tasksDir)) return manager;
   
-  stopTasks();
-
   const files = scanDir(tasksDir);
-  if (files.length === 0) return;
+  if (files.length === 0) return manager;
   
   let count = 0;
   for (const file of files) {
@@ -35,7 +38,7 @@ export async function scanTasks(ctx) {
             console.error(`\n  ${colors.red}❌ Task Error (${file}):${colors.reset}`, err);
           }
         });
-        taskHandles.push(task);
+        manager.taskHandles.push(task);
         count++;
       }
     } catch (err) {
@@ -46,4 +49,6 @@ export async function scanTasks(ctx) {
   if (count > 0) {
     console.log(`  ${colors.dim}├──${colors.reset} ${colors.cyan}Scheduled ${count} background task(s)${colors.reset}`);
   }
+  
+  return manager;
 }