create-fluxstack 1.0.13 → 1.0.15

package/app/server/middleware/errorHandling.ts

@@ -0,0 +1,250 @@
+/**
+ * Error Handling Middleware
+ * Provides centralized error handling for the application
+ */
+
+import type { Context } from 'elysia'
+
+export interface ErrorResponse {
+  error: string
+  message: string
+  code?: string
+  details?: any
+  timestamp: string
+  requestId?: string
+}
+
+/**
+ * Custom application errors
+ */
+export class AppError extends Error {
+  constructor(
+    message: string,
+    public statusCode: number = 500,
+    public code?: string,
+    public details?: any
+  ) {
+    super(message)
+    this.name = 'AppError'
+  }
+}
+
+export class ValidationError extends AppError {
+  constructor(message: string, details?: any) {
+    super(message, 400, 'VALIDATION_ERROR', details)
+    this.name = 'ValidationError'
+  }
+}
+
+export class NotFoundError extends AppError {
+  constructor(resource: string = 'Resource') {
+    super(`${resource} not found`, 404, 'NOT_FOUND')
+    this.name = 'NotFoundError'
+  }
+}
+
+export class UnauthorizedError extends AppError {
+  constructor(message: string = 'Unauthorized') {
+    super(message, 401, 'UNAUTHORIZED')
+    this.name = 'UnauthorizedError'
+  }
+}
+
+export class ForbiddenError extends AppError {
+  constructor(message: string = 'Forbidden') {
+    super(message, 403, 'FORBIDDEN')
+    this.name = 'ForbiddenError'
+  }
+}
+
+export class ConflictError extends AppError {
+  constructor(message: string, details?: any) {
+    super(message, 409, 'CONFLICT', details)
+    this.name = 'ConflictError'
+  }
+}
+
+/**
+ * Error handling middleware
+ */
+export const errorHandlingMiddleware = {
+  name: 'error-handling',
+  
+  onError: async (context: Context, error: Error): Promise<Response> => {
+    const requestId = context.store?.requestId || 'unknown'
+    
+    // Log the error
+    console.error('🚨 Error occurred', {
+      requestId,
+      method: context.request.method,
+      path: context.path,
+      error: error.message,
+      stack: error.stack,
+      timestamp: new Date().toISOString()
+    })
+
+    // Handle different error types
+    if (error instanceof AppError) {
+      return createErrorResponse(
+        error.statusCode,
+        error.message,
+        error.code,
+        error.details,
+        requestId
+      )
+    }
+
+    // Handle validation errors from Elysia
+    if (error.name === 'ValidationError' || error.message.includes('validation')) {
+      return createErrorResponse(
+        400,
+        'Validation failed',
+        'VALIDATION_ERROR',
+        { originalError: error.message },
+        requestId
+      )
+    }
+
+    // Handle syntax errors (malformed JSON, etc.)
+    if (error instanceof SyntaxError) {
+      return createErrorResponse(
+        400,
+        'Invalid request format',
+        'SYNTAX_ERROR',
+        undefined,
+        requestId
+      )
+    }
+
+    // Handle network/timeout errors
+    if (error.name === 'TimeoutError' || error.message.includes('timeout')) {
+      return createErrorResponse(
+        408,
+        'Request timeout',
+        'TIMEOUT_ERROR',
+        undefined,
+        requestId
+      )
+    }
+
+    // Handle database/external service errors
+    if (error.message.includes('ECONNREFUSED') || error.message.includes('connection')) {
+      return createErrorResponse(
+        503,
+        'Service temporarily unavailable',
+        'SERVICE_UNAVAILABLE',
+        undefined,
+        requestId
+      )
+    }
+
+    // Default to internal server error
+    return createErrorResponse(
+      500,
+      process.env.NODE_ENV === 'production' 
+        ? 'Internal server error' 
+        : error.message,
+      'INTERNAL_ERROR',
+      process.env.NODE_ENV === 'production' 
+        ? undefined 
+        : { stack: error.stack },
+      requestId
+    )
+  }
+}
+
+/**
+ * Create standardized error response
+ */
+function createErrorResponse(
+  statusCode: number,
+  message: string,
+  code?: string,
+  details?: any,
+  requestId?: string
+): Response {
+  const errorResponse: ErrorResponse = {
+    error: getErrorName(statusCode),
+    message,
+    code,
+    details,
+    timestamp: new Date().toISOString(),
+    requestId
+  }
+
+  // Remove undefined fields
+  Object.keys(errorResponse).forEach(key => {
+    if (errorResponse[key as keyof ErrorResponse] === undefined) {
+      delete errorResponse[key as keyof ErrorResponse]
+    }
+  })
+
+  return new Response(
+    JSON.stringify(errorResponse),
+    {
+      status: statusCode,
+      headers: {
+        'Content-Type': 'application/json'
+      }
+    }
+  )
+}
+
+/**
+ * Get error name from status code
+ */
+function getErrorName(statusCode: number): string {
+  const errorNames: Record<number, string> = {
+    400: 'Bad Request',
+    401: 'Unauthorized',
+    403: 'Forbidden',
+    404: 'Not Found',
+    405: 'Method Not Allowed',
+    408: 'Request Timeout',
+    409: 'Conflict',
+    422: 'Unprocessable Entity',
+    429: 'Too Many Requests',
+    500: 'Internal Server Error',
+    502: 'Bad Gateway',
+    503: 'Service Unavailable',
+    504: 'Gateway Timeout'
+  }
+
+  return errorNames[statusCode] || 'Unknown Error'
+}
+
+/**
+ * Async error wrapper for route handlers
+ */
+export const asyncHandler = (fn: Function) => {
+  return async (context: Context) => {
+    try {
+      return await fn(context)
+    } catch (error) {
+      throw error // Let the error middleware handle it
+    }
+  }
+}
+
+/**
+ * Create error response helper
+ */
+export const createError = {
+  badRequest: (message: string, details?: any) => 
+    new ValidationError(message, details),
+  
+  unauthorized: (message?: string) => 
+    new UnauthorizedError(message),
+  
+  forbidden: (message?: string) => 
+    new ForbiddenError(message),
+  
+  notFound: (resource?: string) => 
+    new NotFoundError(resource),
+  
+  conflict: (message: string, details?: any) => 
+    new ConflictError(message, details),
+  
+  internal: (message: string, details?: any) => 
+    new AppError(message, 500, 'INTERNAL_ERROR', details)
+}

package/app/server/middleware/index.ts

@@ -0,0 +1,10 @@
+/**
+ * Middleware Index
+ * Exports all custom middleware for the application
+ */
+
+export { authMiddleware } from './auth'
+export { validationMiddleware } from './validation'
+export { rateLimitMiddleware } from './rateLimit'
+export { requestLoggingMiddleware } from './requestLogging'
+export { errorHandlingMiddleware } from './errorHandling'

package/app/server/middleware/rateLimit.ts

@@ -0,0 +1,193 @@
+/**
+ * Rate Limiting Middleware
+ * Implements rate limiting to prevent abuse
+ */
+
+import type { Context } from 'elysia'
+
+export interface RateLimitConfig {
+  windowMs: number // Time window in milliseconds
+  maxRequests: number // Maximum requests per window
+  keyGenerator?: (context: Context) => string // Custom key generator
+  skipSuccessfulRequests?: boolean // Don't count successful requests
+  skipFailedRequests?: boolean // Don't count failed requests
+  message?: string // Custom error message
+}
+
+interface RateLimitEntry {
+  count: number
+  resetTime: number
+}
+
+/**
+ * In-memory rate limit store
+ * In production, you'd want to use Redis or another distributed store
+ */
+class MemoryStore {
+  private store = new Map<string, RateLimitEntry>()
+
+  get(key: string): RateLimitEntry | undefined {
+    const entry = this.store.get(key)
+    
+    // Clean up expired entries
+    if (entry && entry.resetTime < Date.now()) {
+      this.store.delete(key)
+      return undefined
+    }
+    
+    return entry
+  }
+
+  set(key: string, entry: RateLimitEntry): void {
+    this.store.set(key, entry)
+  }
+
+  increment(key: string, windowMs: number): RateLimitEntry {
+    const now = Date.now()
+    const existing = this.get(key)
+    
+    if (existing) {
+      existing.count++
+      return existing
+    } else {
+      const newEntry: RateLimitEntry = {
+        count: 1,
+        resetTime: now + windowMs
+      }
+      this.set(key, newEntry)
+      return newEntry
+    }
+  }
+
+  cleanup(): void {
+    const now = Date.now()
+    for (const [key, entry] of this.store.entries()) {
+      if (entry.resetTime < now) {
+        this.store.delete(key)
+      }
+    }
+  }
+}
+
+const store = new MemoryStore()
+
+// Cleanup expired entries every minute
+setInterval(() => {
+  store.cleanup()
+}, 60000)
+
+/**
+ * Create rate limiting middleware
+ */
+export const rateLimitMiddleware = (config: RateLimitConfig) => ({
+  name: 'rate-limit',
+  
+  beforeHandle: async (context: Context) => {
+    const key = config.keyGenerator 
+      ? config.keyGenerator(context)
+      : getDefaultKey(context)
+    
+    const entry = store.increment(key, config.windowMs)
+    
+    // Add rate limit headers
+    const headers = {
+      'X-RateLimit-Limit': config.maxRequests.toString(),
+      'X-RateLimit-Remaining': Math.max(0, config.maxRequests - entry.count).toString(),
+      'X-RateLimit-Reset': Math.ceil(entry.resetTime / 1000).toString()
+    }
+
+    // Check if rate limit exceeded
+    if (entry.count > config.maxRequests) {
+      return new Response(
+        JSON.stringify({
+          error: config.message || 'Too many requests',
+          retryAfter: Math.ceil((entry.resetTime - Date.now()) / 1000)
+        }),
+        { 
+          status: 429,
+          headers: {
+            'Content-Type': 'application/json',
+            'Retry-After': Math.ceil((entry.resetTime - Date.now()) / 1000).toString(),
+            ...headers
+          }
+        }
+      )
+    }
+
+    // Add headers to successful responses
+    context.set.headers = { ...context.set.headers, ...headers }
+  }
+})
+
+/**
+ * Default key generator (IP-based)
+ */
+function getDefaultKey(context: Context): string {
+  // Try to get real IP from various headers
+  const forwarded = context.headers['x-forwarded-for']
+  const realIp = context.headers['x-real-ip']
+  const cfConnectingIp = context.headers['cf-connecting-ip']
+  
+  let ip = 'unknown'
+  
+  if (forwarded) {
+    ip = forwarded.split(',')[0].trim()
+  } else if (realIp) {
+    ip = realIp
+  } else if (cfConnectingIp) {
+    ip = cfConnectingIp
+  }
+  
+  return `rate_limit:${ip}`
+}
+
+/**
+ * User-based key generator
+ */
+export const userKeyGenerator = (context: any): string => {
+  const userId = context.user?.id
+  return userId ? `rate_limit:user:${userId}` : getDefaultKey(context)
+}
+
+/**
+ * Endpoint-based key generator
+ */
+export const endpointKeyGenerator = (context: Context): string => {
+  const ip = getDefaultKey(context)
+  const path = context.path
+  return `${ip}:${path}`
+}
+
+/**
+ * Common rate limit configurations
+ */
+export const rateLimitConfigs = {
+  // General API rate limit
+  general: {
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    maxRequests: 100,
+    message: 'Too many requests from this IP, please try again later'
+  },
+
+  // Strict rate limit for authentication endpoints
+  auth: {
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    maxRequests: 5,
+    message: 'Too many authentication attempts, please try again later'
+  },
+
+  // Lenient rate limit for public endpoints
+  public: {
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    maxRequests: 1000,
+    message: 'Rate limit exceeded for public API'
+  },
+
+  // Per-user rate limit
+  perUser: {
+    windowMs: 60 * 1000, // 1 minute
+    maxRequests: 60,
+    keyGenerator: userKeyGenerator,
+    message: 'Too many requests, please slow down'
+  }
+}

package/app/server/middleware/requestLogging.ts

@@ -0,0 +1,215 @@
+/**
+ * Request Logging Middleware
+ * Logs HTTP requests with timing and context information
+ */
+
+import type { Context } from 'elysia'
+
+export interface RequestLogConfig {
+  logLevel?: 'debug' | 'info' | 'warn' | 'error'
+  includeBody?: boolean
+  includeHeaders?: boolean
+  excludePaths?: string[]
+  excludeHeaders?: string[]
+  maxBodyLength?: number
+}
+
+/**
+ * Request logging middleware
+ */
+export const requestLoggingMiddleware = (config: RequestLogConfig = {}) => ({
+  name: 'request-logging',
+  
+  beforeHandle: async (context: Context) => {
+    // Skip logging for excluded paths
+    if (config.excludePaths?.includes(context.path)) {
+      return
+    }
+
+    const startTime = Date.now()
+    
+    // Store start time for duration calculation
+    context.store = { ...context.store, startTime }
+    
+    // Log request start
+    const requestId = generateRequestId()
+    context.store = { ...context.store, requestId }
+    
+    const logData: any = {
+      requestId,
+      method: context.request.method,
+      path: context.path,
+      query: context.query,
+      userAgent: context.headers['user-agent'],
+      ip: getClientIp(context),
+      timestamp: new Date().toISOString()
+    }
+
+    // Include headers if configured
+    if (config.includeHeaders) {
+      const headers = { ...context.headers }
+      
+      // Remove sensitive headers
+      const excludeHeaders = config.excludeHeaders || [
+        'authorization',
+        'cookie',
+        'x-api-key'
+      ]
+      
+      excludeHeaders.forEach(header => {
+        delete headers[header.toLowerCase()]
+      })
+      
+      logData.headers = headers
+    }
+
+    // Include body if configured
+    if (config.includeBody && context.body) {
+      let body = context.body
+      
+      // Truncate large bodies
+      if (config.maxBodyLength && typeof body === 'string') {
+        if (body.length > config.maxBodyLength) {
+          body = body.substring(0, config.maxBodyLength) + '...[truncated]'
+        }
+      }
+      
+      logData.body = body
+    }
+
+    console.log('📥 Request started', logData)
+  },
+  
+  afterHandle: async (context: Context, response: Response) => {
+    const startTime = context.store?.startTime
+    const requestId = context.store?.requestId
+    
+    if (!startTime) return
+    
+    const duration = Date.now() - startTime
+    
+    const logData: any = {
+      requestId,
+      method: context.request.method,
+      path: context.path,
+      status: response.status,
+      duration: `${duration}ms`,
+      timestamp: new Date().toISOString()
+    }
+
+    // Determine log level based on status code
+    let logLevel = config.logLevel || 'info'
+    
+    if (response.status >= 500) {
+      logLevel = 'error'
+    } else if (response.status >= 400) {
+      logLevel = 'warn'
+    }
+
+    // Add performance warning for slow requests
+    if (duration > 1000) {
+      logData.warning = 'Slow request detected'
+      logLevel = 'warn'
+    }
+
+    const logMessage = `📤 Request completed - ${context.request.method} ${context.path} ${response.status} (${duration}ms)`
+    
+    switch (logLevel) {
+      case 'error':
+        console.error(logMessage, logData)
+        break
+      case 'warn':
+        console.warn(logMessage, logData)
+        break
+      case 'debug':
+        console.debug(logMessage, logData)
+        break
+      default:
+        console.log(logMessage, logData)
+    }
+  },
+  
+  onError: async (context: Context, error: Error) => {
+    const startTime = context.store?.startTime
+    const requestId = context.store?.requestId
+    const duration = startTime ? Date.now() - startTime : 0
+    
+    const logData = {
+      requestId,
+      method: context.request.method,
+      path: context.path,
+      error: error.message,
+      stack: error.stack,
+      duration: `${duration}ms`,
+      timestamp: new Date().toISOString()
+    }
+
+    console.error('💥 Request failed', logData)
+  }
+})
+
+/**
+ * Generate unique request ID
+ */
+function generateRequestId(): string {
+  return `req_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`
+}
+
+/**
+ * Get client IP address
+ */
+function getClientIp(context: Context): string {
+  // Try to get real IP from various headers
+  const forwarded = context.headers['x-forwarded-for']
+  const realIp = context.headers['x-real-ip']
+  const cfConnectingIp = context.headers['cf-connecting-ip']
+  
+  if (forwarded) {
+    return forwarded.split(',')[0].trim()
+  }
+  
+  if (realIp) {
+    return realIp
+  }
+  
+  if (cfConnectingIp) {
+    return cfConnectingIp
+  }
+  
+  return 'unknown'
+}
+
+/**
+ * Predefined configurations
+ */
+export const requestLoggingConfigs = {
+  // Development configuration - verbose logging
+  development: {
+    logLevel: 'debug' as const,
+    includeBody: true,
+    includeHeaders: true,
+    maxBodyLength: 1000,
+    excludeHeaders: ['authorization', 'cookie']
+  },
+
+  // Production configuration - minimal logging
+  production: {
+    logLevel: 'info' as const,
+    includeBody: false,
+    includeHeaders: false,
+    excludePaths: ['/health', '/metrics']
+  },
+
+  // Security-focused configuration
+  security: {
+    logLevel: 'warn' as const,
+    includeBody: false,
+    includeHeaders: true,
+    excludeHeaders: [
+      'authorization',
+      'cookie',
+      'x-api-key',
+      'x-auth-token'
+    ]
+  }
+}