bro-framework 3.0.3 → 3.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bro-framework",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "The No-BS Backend Framework for Node.js",
   "repository": {
     "type": "git",

package/src/edge.js

@@ -8,8 +8,8 @@ export async function hashIdentity(identity) {
   const hash = await crypto.subtle.digest('SHA-256', data);
   return Array.from(new Uint8Array(hash)).map(b => b.toString(16).padStart(2, '0')).join('');
 }
-export function generateRateLimitKey(req, config, prefix = 'route') { const identity = resolveIdentity(req, config); return `bro:rate_limit:${prefix}:${originalUrl}:${hashIdentity(identity)}`; }
-export function generateCacheKey(req, config, locale) { const identity = resolveIdentity(req, config); return `bro:cache:${method}:${originalUrl}:${locale}:${hashIdentity(identity)}`; }
+export async function generateRateLimitKey(req, config, prefix = 'route') { const identity = resolveIdentity(req, config); const hash = await hashIdentity(identity); return `bro:rate_limit:${prefix}:${req.originalUrl || req.url}:${hash}`; }
+export async function generateCacheKey(req, config, locale) { const identity = resolveIdentity(req, config); const hash = await hashIdentity(identity); return `bro:cache:${req.method}:${req.originalUrl || req.url}:${locale}:${hash}`; }
 
 export { z };
 

package/src/engine.js

@@ -1,4 +1,6 @@
 
+import crypto from 'node:crypto';
+
 export function resolveIdentity(req, config = {}) {
   const headers = req.headers || {};
   let ip = req.ip || (req.socket && req.socket.remoteAddress) || 'anonymous';
@@ -116,7 +118,7 @@ export async function executeRequest(routeConfig, requestData, globalConfig, ctx
     const redisClient = ctxExtras.redis;
 
     if (activeRateLimit && redisClient) {
-      const rlKey = generateRateLimitKey ? await generateRateLimitKey(requestData, globalConfig) : `bro:rl:${requestData.originalUrl}:${requestData.ip}`;
+      const rlKey = ctxExtras.generateRateLimitKey ? await ctxExtras.generateRateLimitKey(requestData, globalConfig) : `bro:rl:${requestData.originalUrl}:${requestData.ip}`;
       try {
         const current = await redisClient.incr(rlKey);
         const windowSeconds = Math.floor(activeRateLimit.windowMs / 1000);
@@ -246,6 +248,12 @@ export async function executeRequest(routeConfig, requestData, globalConfig, ctx
     const status = err.status || 500;
     const title = status === 500 ? 'Internal Server Error' : err.message;
     const isProd = process.env.NODE_ENV === 'production';
+    
+    if (status >= 500) {
+      console.error(`[bro.js] Execution Error in route:`);
+      console.error(err.stack || err);
+    }
+    
     return { status, headers: errorHeaders, body: formatErrorEnvelope(status, isProd && status >= 500 ? 'Internal Server Error' : title, isProd && status >= 500 ? null : err.details, reqId, requestData.originalUrl), error: status >= 500 ? err : undefined };
   }
 }

package/src/next.js

@@ -6,8 +6,8 @@ import { createClient } from 'redis';
 import { createLogger } from './logger.js';
 import { executeRequest, RouteRegistry, resolveIdentity } from './engine.js';
 export function hashIdentity(identity) { return crypto.createHash('sha256').update(String(identity)).digest('hex'); }
-export function generateRateLimitKey(req, config, prefix = 'route') { const identity = resolveIdentity(req, config); return `bro:rate_limit:${prefix}:${originalUrl}:${hashIdentity(identity)}`; }
-export function generateCacheKey(req, config, locale) { const identity = resolveIdentity(req, config); return `bro:cache:${method}:${originalUrl}:${locale}:${hashIdentity(identity)}`; }
+export function generateRateLimitKey(req, config, prefix = 'route') { const identity = resolveIdentity(req, config); return `bro:rate_limit:${prefix}:${req.originalUrl}:${hashIdentity(identity)}`; }
+export function generateCacheKey(req, config, locale) { const identity = resolveIdentity(req, config); return `bro:cache:${req.method}:${req.originalUrl}:${locale}:${hashIdentity(identity)}`; }
 
 export { z };
 

package/src/server.js

@@ -12,13 +12,13 @@ import { createAdapter } from '@socket.io/redis-adapter';
 import { apiReference } from '@scalar/express-api-reference';
 import { verifyJwt, signJwt } from './auth.js';
 import { loadLocale } from './locale.js';
-import { loadRoutes } from './router.js';
-import { executeRequest, resolveIdentity, RouteRegistry } from './engine.js';
-
-export function hashIdentity(identity) { return crypto.createHash('sha256').update(String(identity)).digest('hex'); }
-export function generateRateLimitKey(req, config, prefix = 'route') { const identity = resolveIdentity(req, config); return `bro:rate_limit:${prefix}:${originalUrl}:${hashIdentity(identity)}`; }
-export function generateCacheKey(req, config, locale) { const identity = resolveIdentity(req, config); return `bro:cache:${method}:${originalUrl}:${locale}:${hashIdentity(identity)}`; }
-import { createLogger } from './logger.js';
+import { loadRoutes } from './router.js';
+import { executeRequest, resolveIdentity, RouteRegistry } from './engine.js';
+
+export function hashIdentity(identity) { return crypto.createHash('sha256').update(String(identity)).digest('hex'); }
+export function generateRateLimitKey(req, config, prefix = 'route') { const identity = resolveIdentity(req, config); return `bro:rate_limit:${prefix}:${req.originalUrl || req.url}:${hashIdentity(identity)}`; }
+export function generateCacheKey(req, config, locale) { const identity = resolveIdentity(req, config); return `bro:cache:${req.method}:${req.originalUrl || req.url}:${locale}:${hashIdentity(identity)}`; }
+import { createLogger } from './logger.js';
 import { PluginManager } from './plugins.js';
 import { scanTasks } from './tasks.js';
 
@@ -29,33 +29,33 @@ import { scanTasks } from './tasks.js';
  * @param {any} db - Initialized database instance.
  * @returns {Promise<{ app: import('express').Application, server: http.Server, routes: Array, reload: Function, reloadLocale: Function, io: import('socket.io').Server, shutdown: Function }>}
  */
-export async function createServer(globalConfig, routesDir, db) {
-  if (db && typeof db.isReady !== 'function') {
-     throw new Error('[bro.js] CRITICAL: In v3.0.0, the \'db\' passed to createServer MUST extend BaseDatabaseAdapter and implement isReady(), transaction(), healthCheck(), and shutdown().');
-  }
-  const globalLogger = createLogger(globalConfig.logger || { level: process.env.NODE_ENV === 'production' ? 'info' : 'debug' });
+export async function createServer(globalConfig, routesDir, db) {
+  if (db && typeof db.isReady !== 'function') {
+     throw new Error('[bro.js] CRITICAL: In v3.0.0, the \'db\' passed to createServer MUST extend BaseDatabaseAdapter and implement isReady(), transaction(), healthCheck(), and shutdown().');
+  }
+  const globalLogger = createLogger(globalConfig.logger || { level: process.env.NODE_ENV === 'production' ? 'info' : 'debug' });
 
   if (process.env.NODE_ENV === 'production' && (!globalConfig.jwtSecret || globalConfig.jwtSecret.length < 32 || ['dev_secret_please_change', 'bro_default_secret_key', 'your_jwt_secret_here'].includes(globalConfig.jwtSecret))) {
     throw new Error('CRITICAL SECURITY ERROR: You are running in production without a secure JWT secret! Provide a secret of at least 32 characters.');
   }
 
-    const routeRegistry = new RouteRegistry();
-    const pluginManager = new PluginManager();
-  if (Array.isArray(globalConfig.plugins)) {
-    for (const plugin of globalConfig.plugins) {
-      pluginManager.register(plugin);
-    }
-  }
-
-  const app = express();
-  await pluginManager.runOnInit(globalConfig, app);
-  if (db) {
-    if (!await db.isReady()) {
-      throw new Error('[bro.js] Database adapter failed readiness check during boot.');
-    }
+    const routeRegistry = new RouteRegistry();
+    const pluginManager = new PluginManager();
+  if (Array.isArray(globalConfig.plugins)) {
+    for (const plugin of globalConfig.plugins) {
+      pluginManager.register(plugin);
+    }
+  }
+
+  const app = express();
+  await pluginManager.runOnInit(globalConfig, app);
+  if (db) {
+    if (!await db.isReady()) {
+      throw new Error('[bro.js] Database adapter failed readiness check during boot.');
+    }
   }
-  const server = http.createServer(app);
-  server.requestTimeout = globalConfig.server?.timeoutMs || 30000;
+  const server = http.createServer(app);
+  server.requestTimeout = globalConfig.server?.timeoutMs || 30000;
   server.headersTimeout = globalConfig.server?.headersTimeoutMs || 35000;
   const localeDirectory = globalConfig.locale?.directory || path.join(process.cwd(), 'locale');
   let locale = await loadLocale(localeDirectory, globalConfig.locale);
@@ -75,14 +75,14 @@ export async function createServer(globalConfig, routesDir, db) {
     }));
   }
 
-  const corsConfig = globalConfig.server?.cors !== undefined ? globalConfig.server.cors : false;
-  if (corsConfig === true) {
-    if (process.env.NODE_ENV === 'production') {
-      throw new Error('CRITICAL SECURITY ERROR: Permissive CORS (cors: true) is forbidden in production in v3.0.0. Provide an explicit origin allowlist.');
-    }
-    app.use(cors());
-  } else if (corsConfig) {
-    app.use(cors(corsConfig));
+  const corsConfig = globalConfig.server?.cors !== undefined ? globalConfig.server.cors : false;
+  if (corsConfig === true) {
+    if (process.env.NODE_ENV === 'production') {
+      throw new Error('CRITICAL SECURITY ERROR: Permissive CORS (cors: true) is forbidden in production in v3.0.0. Provide an explicit origin allowlist.');
+    }
+    app.use(cors());
+  } else if (corsConfig) {
+    app.use(cors(corsConfig));
   }
   
   app.use((req, res, next) => {
@@ -91,36 +91,36 @@ export async function createServer(globalConfig, routesDir, db) {
     next();
   });
 
-  const sendError = (res, status, message, details = null, req) => {
-    let finalMessage = message;
-    let finalDetails = details;
-    if (status >= 500 && process.env.NODE_ENV === 'production') {
-      finalMessage = 'Internal Server Error';
-      finalDetails = null;
-    }
-    const codeMap = { 400: 'BAD_REQUEST', 401: 'UNAUTHORIZED', 403: 'FORBIDDEN', 404: 'NOT_FOUND', 429: 'TOO_MANY_REQUESTS' };
-    const code = codeMap[status] || (status >= 500 ? 'INTERNAL_ERROR' : 'ERROR');
-
-    // v3.0.0 ALWAYS uses RFC 9457 Problem Details
-    const payload = {
-      type: `https://brojs.dev/errors/${code.toLowerCase()}`,
-      title: finalMessage,
-      status,
-      instance: req.originalUrl || req.url,
-      requestId: req.id
-    };
-    if (finalDetails) {
-      if (typeof finalDetails === 'string') payload.detail = finalDetails;
-      else payload.errors = finalDetails;
-    }
-    return res.status(status).type('application/problem+json').json(payload);
+  const sendError = (res, status, message, details = null, req) => {
+    let finalMessage = message;
+    let finalDetails = details;
+    if (status >= 500 && process.env.NODE_ENV === 'production') {
+      finalMessage = 'Internal Server Error';
+      finalDetails = null;
+    }
+    const codeMap = { 400: 'BAD_REQUEST', 401: 'UNAUTHORIZED', 403: 'FORBIDDEN', 404: 'NOT_FOUND', 429: 'TOO_MANY_REQUESTS' };
+    const code = codeMap[status] || (status >= 500 ? 'INTERNAL_ERROR' : 'ERROR');
+
+    // v3.0.0 ALWAYS uses RFC 9457 Problem Details
+    const payload = {
+      type: `errors/${code.toLowerCase()}`,
+      title: finalMessage,
+      status,
+      instance: req.originalUrl || req.url,
+      requestId: req.id
+    };
+    if (finalDetails) {
+      if (typeof finalDetails === 'string') payload.detail = finalDetails;
+      else payload.errors = finalDetails;
+    }
+    return res.status(status).type('application/problem+json').json(payload);
   };
 
   const formatZodError = (error) => error.issues.map(i => ({ path: i.path.join('.'), message: i.message, code: i.code }));
 
-  
-
-  app.use(pluginManager.getRequestMiddleware());
+  
+
+  app.use(pluginManager.getRequestMiddleware());
   app.use(express.json());
   
   const safeConnect = async (client) => {
@@ -239,55 +239,55 @@ export async function createServer(globalConfig, routesDir, db) {
       }
     }
     
-    middlewares.push(async (req, res) => {
-      const requestData = {
-        method: req.method,
-        originalUrl: req.originalUrl,
-        headers: req.headers,
-        body: req.body,
-        query: req.query,
-        params: req.params,
-        files: req.files || req.file,
-        ip: req.ip,
-        locale: locale.resolveLocale(req)
-      };
-      
-      const ctxExtras = {
-      verifyJwt,
-      generateRateLimitKey,
-      generateCacheKey,
-      generateId: () => crypto.randomUUID(),
-        req,
-        res,
-        db,
-        redis: redisClient,
-        io,
-        pluginManager,
-        t: (key, values) => locale.translate(requestData.locale, key, values),
-        logger: globalLogger,
-        jwt: { sign: (payload, opts) => signJwt(payload, globalConfig.jwtSecret, opts || { expiresIn: globalConfig.auth?.expiresIn || '1d' }) },
-        error: (status, message) => {
-          const err = new Error(message);
-          err.status = status;
-          throw err;
-        },
-        fixtures: globalConfig.fixtures || {},
-        stores: globalConfig.stores || {}
-      };
-
-      const response = await executeRequest(routeConfig, requestData, globalConfig, ctxExtras);
-
-      if (response.headers && !res.headersSent) {
-        for (const [k, v] of Object.entries(response.headers)) {
-          res.setHeader(k, v);
-        }
-      }
-
-      if (!res.headersSent) {
-        res.status(response.status).json(response.body);
-      }
-    });
-
+    middlewares.push(async (req, res) => {
+      const requestData = {
+        method: req.method,
+        originalUrl: req.originalUrl,
+        headers: req.headers,
+        body: req.body,
+        query: req.query,
+        params: req.params,
+        files: req.files || req.file,
+        ip: req.ip,
+        locale: locale.resolveLocale(req)
+      };
+      
+      const ctxExtras = {
+      verifyJwt,
+      generateRateLimitKey,
+      generateCacheKey,
+      generateId: () => crypto.randomUUID(),
+        req,
+        res,
+        db,
+        redis: redisClient,
+        io,
+        pluginManager,
+        t: (key, values) => locale.translate(requestData.locale, key, values),
+        logger: globalLogger,
+        jwt: { sign: (payload, opts) => signJwt(payload, globalConfig.jwtSecret, opts || { expiresIn: globalConfig.auth?.expiresIn || '1d' }) },
+        error: (status, message) => {
+          const err = new Error(message);
+          err.status = status;
+          throw err;
+        },
+        fixtures: globalConfig.fixtures || {},
+        stores: globalConfig.stores || {}
+      };
+
+      const response = await executeRequest(routeConfig, requestData, globalConfig, ctxExtras);
+
+      if (response.headers && !res.headersSent) {
+        for (const [k, v] of Object.entries(response.headers)) {
+          res.setHeader(k, v);
+        }
+      }
+
+      if (!res.headersSent) {
+        res.status(response.status).json(response.body);
+      }
+    });
+
     return middlewares;
   };
 
@@ -339,52 +339,52 @@ export async function createServer(globalConfig, routesDir, db) {
     app.use('/docs', docsAuthMiddleware, apiReference({ spec: { url: '/docs/json' } }));
   }
 
-  if (globalConfig.health) {
-    app.get('/health/live', (req, res) => {
-      res.status(200).json({ status: 'ok', timestamp: new Date().toISOString() });
-    });
-    
-    app.get('/health/ready', async (req, res) => {
-      let isReady = true;
-      const checks = {};
-      
-      const timeoutPromise = (ms, promise) => {
-        return new Promise((resolve, reject) => {
-          const timer = setTimeout(() => reject(new Error('timeout')), ms);
-          promise.then(val => { clearTimeout(timer); resolve(val); }).catch(err => { clearTimeout(timer); reject(err); });
-        });
-      };
-
-      if (redisClient) {
-        try {
-          await timeoutPromise(2000, redisClient.ping());
-          checks.redis = 'up';
-        } catch (err) {
-          checks.redis = 'down';
-          isReady = false;
-        }
-      }
-      
-      if (globalConfig.health === true || typeof globalConfig.health.dbCheck !== 'function') {
-         if (db) checks.db = 'unknown (provide health.dbCheck)';
-      } else if (db) {
-        try {
-          await timeoutPromise(2000, globalConfig.health.dbCheck(db));
-          checks.db = 'up';
-        } catch (err) {
-          checks.db = 'down';
-          isReady = false;
-        }
-      }
-
-      res.status(isReady ? 200 : 503).json({
-        status: isReady ? 'ready' : 'unavailable',
-        checks,
-        timestamp: new Date().toISOString()
-      });
-    });
-  }
-
+  if (globalConfig.health) {
+    app.get('/health/live', (req, res) => {
+      res.status(200).json({ status: 'ok', timestamp: new Date().toISOString() });
+    });
+    
+    app.get('/health/ready', async (req, res) => {
+      let isReady = true;
+      const checks = {};
+      
+      const timeoutPromise = (ms, promise) => {
+        return new Promise((resolve, reject) => {
+          const timer = setTimeout(() => reject(new Error('timeout')), ms);
+          promise.then(val => { clearTimeout(timer); resolve(val); }).catch(err => { clearTimeout(timer); reject(err); });
+        });
+      };
+
+      if (redisClient) {
+        try {
+          await timeoutPromise(2000, redisClient.ping());
+          checks.redis = 'up';
+        } catch (err) {
+          checks.redis = 'down';
+          isReady = false;
+        }
+      }
+      
+      if (globalConfig.health === true || typeof globalConfig.health.dbCheck !== 'function') {
+         if (db) checks.db = 'unknown (provide health.dbCheck)';
+      } else if (db) {
+        try {
+          await timeoutPromise(2000, globalConfig.health.dbCheck(db));
+          checks.db = 'up';
+        } catch (err) {
+          checks.db = 'down';
+          isReady = false;
+        }
+      }
+
+      res.status(isReady ? 200 : 503).json({
+        status: isReady ? 'ready' : 'unavailable',
+        checks,
+        timestamp: new Date().toISOString()
+      });
+    });
+  }
+
   let routeStack = express.Router();
   
   app.use((req, res, next) => {
@@ -395,7 +395,7 @@ export async function createServer(globalConfig, routesDir, db) {
     sendError(res, 404, 'Not Found', null, req);
   });
 
-  app.use(pluginManager.getErrorMiddleware());
+  app.use(pluginManager.getErrorMiddleware());
   app.use((err, req, res, next) => {
     console.error(`[bro.js] Uncaught Error:`, err);
     sendError(res, err.status || 500, err.message || 'Internal Server Error', null, req);
@@ -420,7 +420,7 @@ export async function createServer(globalConfig, routesDir, db) {
   let taskManager = await scanTasks({ db, io });
 
   const reloadTasks = async () => {
-    if (taskManager) taskManager.stopAll();
+    if (taskManager) taskManager.stopAll();
     await pluginManager.runOnShutdown();
     taskManager = await scanTasks({ db, io });
   };