create-jen-app 1.0.0 → 1.2.1

package/templates/static/lib/jdb/utils.js

@@ -0,0 +1,141 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import fs from "fs/promises";
+import crypto from "crypto";
+export async function ensureDir(dir) {
+    try {
+        await fs.access(dir);
+    }
+    catch {
+        await fs.mkdir(dir, { recursive: true });
+    }
+}
+export async function readJSON(file) {
+    try {
+        const data = await fs.readFile(file, "utf-8");
+        return JSON.parse(data);
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return null;
+        throw e;
+    }
+}
+export async function writeJSON(file, data) {
+    const tempFile = `${file}.tmp`;
+    await fs.writeFile(tempFile, JSON.stringify(data, null, 2));
+    await fs.rename(tempFile, file);
+}
+export function generateId() {
+    return crypto.randomUUID();
+}
+export function matchFilter(doc, filter) {
+    for (const key in filter) {
+        if (key === "$or") {
+            if (!filter.$or.some((f) => matchFilter(doc, f)))
+                return false;
+            continue;
+        }
+        if (key === "$and") {
+            if (!filter.$and.every((f) => matchFilter(doc, f)))
+                return false;
+            continue;
+        }
+        const val = doc[key];
+        const cond = filter[key];
+        if (typeof cond === "object" && cond !== null && !Array.isArray(cond)) {
+            for (const op in cond) {
+                const target = cond[op];
+                switch (op) {
+                    case "$eq":
+                        if (val !== target)
+                            return false;
+                        break;
+                    case "$ne":
+                        if (val === target)
+                            return false;
+                        break;
+                    case "$gt":
+                        if (!(val > target))
+                            return false;
+                        break;
+                    case "$gte":
+                        if (!(val >= target))
+                            return false;
+                        break;
+                    case "$lt":
+                        if (!(val < target))
+                            return false;
+                        break;
+                    case "$lte":
+                        if (!(val <= target))
+                            return false;
+                        break;
+                    case "$in":
+                        if (!target.includes(val))
+                            return false;
+                        break;
+                    case "$nin":
+                        if (target.includes(val))
+                            return false;
+                        break;
+                    case "$regex":
+                        if (!new RegExp(target).test(val))
+                            return false;
+                        break;
+                }
+            }
+        }
+        else {
+            if (val !== cond)
+                return false;
+        }
+    }
+    return true;
+}
+export function applyUpdate(doc, update) {
+    const now = Date.now();
+    doc._updated = now;
+    for (const op in update) {
+        const fields = update[op];
+        for (const key in fields) {
+            const val = fields[key];
+            switch (op) {
+                case "$set":
+                    doc[key] = val;
+                    break;
+                case "$unset":
+                    delete doc[key];
+                    break;
+                case "$inc":
+                    doc[key] = (doc[key] || 0) + val;
+                    break;
+                case "$push":
+                    if (!Array.isArray(doc[key]))
+                        doc[key] = [];
+                    doc[key].push(val);
+                    break;
+                case "$pull":
+                    if (Array.isArray(doc[key])) {
+                        doc[key] = doc[key].filter((item) => item !== val);
+                    }
+                    break;
+            }
+        }
+    }
+}

package/templates/static/lib/middleware/builtins/body-parser.d.ts

@@ -0,0 +1 @@
+export function bodyParser(ctx: any, next: any): Promise<any>;

package/templates/static/lib/middleware/builtins/body-parser.js

@@ -0,0 +1,55 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+export async function bodyParser(ctx, next) {
+    if (ctx.req.method === "GET" || ctx.req.method === "HEAD") {
+        return next();
+    }
+    const chunks = [];
+    await new Promise((resolve, reject) => {
+        ctx.req.on("data", (chunk) => chunks.push(chunk));
+        ctx.req.on("end", () => {
+            const data = Buffer.concat(chunks).toString();
+            const contentType = ctx.req.headers["content-type"] || "";
+            try {
+                if (contentType.includes("application/json")) {
+                    if (!data || data.trim() === "") {
+                        ctx.body = {};
+                    }
+                    else {
+                        ctx.body = JSON.parse(data);
+                    }
+                }
+                else if (contentType.includes("application/x-www-form-urlencoded")) {
+                    ctx.body = new URLSearchParams(data);
+                }
+                else {
+                    ctx.body = data;
+                }
+            }
+            catch (e) {
+                const error = e instanceof Error ? e.message : String(e);
+                console.error("Body parser error:", error);
+                ctx.parseError = error;
+                ctx.body = data; // Raw string on failure
+            }
+            resolve();
+        });
+        ctx.req.on("error", reject);
+    });
+    await next();
+}

package/templates/static/lib/middleware/builtins/cors.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CORS middleware with security defaults
+ * Prevents insecure origin sharing with credentials
+ */
+interface CORSOptions {
+    origin?: string | string[] | ((origin: string) => boolean) | "*";
+    methods?: string[];
+    allowedHeaders?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+}
+export declare function cors(options?: CORSOptions): (ctx: any, next: () => Promise<void>) => Promise<void>;
+export {};

package/templates/static/lib/middleware/builtins/cors.js

@@ -0,0 +1,67 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+export function cors(options = {}) {
+    const defaults = {
+        origin: ["http://localhost:3000", "http://localhost:5173"],
+        methods: ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE"],
+        allowedHeaders: ["Content-Type", "Authorization"],
+        credentials: false, // Changed: credentials should be false with CORS by default for security
+        maxAge: 86400,
+    };
+    const opts = { ...defaults, ...options };
+    return async (ctx, next) => {
+        const origin = ctx.req.headers.origin;
+        // Validate origin against whitelist
+        let allowOrigin = false;
+        if (Array.isArray(opts.origin)) {
+            allowOrigin = origin && opts.origin.includes(origin);
+        }
+        else if (typeof opts.origin === "function") {
+            allowOrigin = origin && opts.origin(origin);
+        }
+        else if (opts.origin === "*") {
+            // DANGEROUS: only use with credentials: false
+            if (opts.credentials) {
+                console.warn("SECURITY WARNING: CORS origin '*' with credentials=true is insecure. Origin set to empty.");
+                allowOrigin = false;
+            }
+            else {
+                allowOrigin = true;
+            }
+        }
+        else if (opts.origin === origin) {
+            allowOrigin = true;
+        }
+        if (allowOrigin && origin) {
+            ctx.response.header("Access-Control-Allow-Origin", origin);
+        }
+        if (opts.credentials) {
+            ctx.response.header("Access-Control-Allow-Credentials", "true");
+        }
+        if (ctx.req.method === "OPTIONS") {
+            ctx.response.header("Access-Control-Allow-Methods", opts.methods?.join(","));
+            ctx.response.header("Access-Control-Allow-Headers", opts.allowedHeaders?.join(","));
+            if (opts.maxAge) {
+                ctx.response.header("Access-Control-Max-Age", opts.maxAge);
+            }
+            ctx.response.status(204).send();
+            return;
+        }
+        await next();
+    };
+}

package/templates/static/lib/middleware/builtins/logger.d.ts

@@ -0,0 +1 @@
+export function logger(ctx: any, next: any): Promise<void>;

package/templates/static/lib/middleware/builtins/logger.js

@@ -0,0 +1,33 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import { log } from "../../shared/log.js";
+export async function logger(ctx, next) {
+    const start = performance.now();
+    // Log request
+    const method = ctx.req.method;
+    const url = ctx.url.pathname;
+    const id = ctx.state.requestId ? `[${ctx.state.requestId}]` : "";
+    log.info(`${id} -> ${method} ${url}`);
+    try {
+        await next();
+    }
+    finally {
+        const ms = (performance.now() - start).toFixed(2);
+        log.info(`${id} <- ${method} ${url} ${ctx.res.statusCode} (${ms}ms)`);
+    }
+}

package/templates/static/lib/middleware/builtins/rate-limit.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Rate limiting middleware
+ * Protects against brute force and DDoS attacks
+ */
+export function rateLimit(options?: {}): (ctx: any, next: any) => Promise<void>;

package/templates/static/lib/middleware/builtins/rate-limit.js

@@ -0,0 +1,76 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * Rate limiting middleware
+ * Protects against brute force and DDoS attacks
+ */
+export function rateLimit(options = {}) {
+    const defaults = {
+        windowMs: 15 * 60 * 1000, // 15 minutes
+        max: 100, // 100 requests per window
+        message: "Too many requests, please try again later.",
+        statusCode: 429,
+    };
+    const opts = { ...defaults, ...options };
+    const hits = new Map();
+    // Cleanup old records every minute to prevent memory leak
+    const cleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [key, record] of hits.entries()) {
+            if (now > record.resetTime) {
+                hits.delete(key);
+            }
+        }
+    }, 60 * 1000);
+    return async (ctx, next) => {
+        // Get IP address - check for X-Forwarded-For header (proxy)
+        let ip = ctx.req.headers["x-forwarded-for"];
+        if (typeof ip === "string") {
+            ip = ip.split(",")[0].trim(); // Get first IP if multiple
+        }
+        else {
+            ip = ctx.req.socket.remoteAddress || "unknown";
+        }
+        const now = Date.now();
+        let record = hits.get(ip);
+        if (!record || now > record.resetTime) {
+            record = {
+                count: 0,
+                resetTime: now + opts.windowMs,
+                firstRequest: now,
+            };
+            hits.set(ip, record);
+        }
+        record.count++;
+        const remaining = opts.max - record.count;
+        // Set rate limit headers (similar to GitHub API)
+        ctx.response.header("RateLimit-Limit", opts.max);
+        ctx.response.header("RateLimit-Remaining", Math.max(0, remaining));
+        ctx.response.header("RateLimit-Reset", Math.ceil(record.resetTime / 1000));
+        if (record.count > opts.max) {
+            const retryAfter = Math.ceil((record.resetTime - now) / 1000);
+            ctx.response.header("Retry-After", retryAfter);
+            ctx.response.status(opts.statusCode).json({
+                error: opts.message,
+                retryAfter,
+            });
+            return;
+        }
+        await next();
+    };
+}

package/templates/static/lib/middleware/builtins/request-id.d.ts

@@ -0,0 +1 @@
+export function requestId(ctx: any, next: any): Promise<void>;

package/templates/static/lib/middleware/builtins/request-id.js

@@ -0,0 +1,25 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import { randomUUID } from "node:crypto";
+export async function requestId(ctx, next) {
+    const id = ctx.req.headers["x-request-id"] || randomUUID();
+    ctx.response.header("X-Request-ID", id);
+    // Also attach to context for logger
+    ctx.state.requestId = id;
+    await next();
+}

package/templates/static/lib/middleware/builtins/security-headers.d.ts

@@ -0,0 +1 @@
+export function securityHeaders(ctx: any, next: any): Promise<void>;

package/templates/static/lib/middleware/builtins/security-headers.js

@@ -0,0 +1,39 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+export async function securityHeaders(ctx, next) {
+    // Prevent DNS prefetch (privacy)
+    ctx.response.header("X-DNS-Prefetch-Control", "off");
+    // Clickjacking protection
+    ctx.response.header("X-Frame-Options", "DENY"); // Changed from SAMEORIGIN for stronger protection
+    // HTTPS enforcement
+    ctx.response.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+    // Prevent opening files in browser (IE)
+    ctx.response.header("X-Download-Options", "noopen");
+    // MIME type sniffing protection
+    ctx.response.header("X-Content-Type-Options", "nosniff");
+    // XSS protection (obsolete but still useful for older browsers)
+    ctx.response.header("X-XSS-Protection", "1; mode=block");
+    // Referrer policy
+    ctx.response.header("Referrer-Policy", "strict-origin-when-cross-origin");
+    // Content Security Policy - NEW
+    // Adjust directives based on your application needs
+    ctx.response.header("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';");
+    // Permissions Policy (formerly Feature Policy) - NEW
+    ctx.response.header("Permissions-Policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
+    await next();
+}

package/templates/static/lib/middleware/context.d.ts

@@ -0,0 +1,18 @@
+export class Context {
+    constructor(req: any, res: any);
+    req: any;
+    res: any;
+    url: URL;
+    state: {};
+    response: ResponseBuilder;
+    body: any;
+    query: {
+        [k: string]: string;
+    };
+    params: {};
+    get cookies(): {
+        [k: string]: any;
+    };
+    json(data: any, status?: number): void;
+}
+import { ResponseBuilder } from "./response.js";

package/templates/static/lib/middleware/context.js

@@ -0,0 +1,50 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import { ResponseBuilder } from "./response.js";
+export class Context {
+    req;
+    res;
+    url;
+    state;
+    response;
+    body; // For parsed body
+    query;
+    params;
+    constructor(req, res) {
+        this.req = req;
+        this.res = res;
+        this.url = new URL(req.url ?? "/", `http://${req.headers.host || "localhost"}`);
+        this.state = {};
+        this.response = new ResponseBuilder(res);
+        this.body = null;
+        this.query = Object.fromEntries(this.url.searchParams);
+        this.params = {};
+    }
+    get cookies() {
+        const header = this.req.headers.cookie;
+        if (!header)
+            return {};
+        return Object.fromEntries(header.split(";").map((c) => {
+            const [key, ...v] = c.trim().split("=");
+            return [key, decodeURIComponent(v.join("="))];
+        }));
+    }
+    json(data, status = 200) {
+        return this.response.status(status).json(data).send();
+    }
+}

package/templates/static/lib/middleware/decorators.d.ts

@@ -0,0 +1,2 @@
+export function UseMiddleware(...middleware: any[]): (target: any, propertyKey: any, descriptor: any) => void;
+export const MIDDLEWARE_METADATA_KEY: unique symbol;

package/templates/static/lib/middleware/decorators.js

@@ -0,0 +1,61 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+// Simple in-memory storage for metadata if Reflect is not available
+// This avoids the 'reflect-metadata' dependency
+const MetadataStorage = new WeakMap();
+function getMetadata(key, target, propertyKey) {
+    // @ts-ignore
+    if (typeof Reflect !== "undefined" && Reflect.getMetadata) {
+        // @ts-ignore
+        return Reflect.getMetadata(key, target, propertyKey);
+    }
+    const targetMap = MetadataStorage.get(target);
+    if (!targetMap)
+        return undefined;
+    const mapKey = propertyKey ? `${String(key)}:${String(propertyKey)}` : key;
+    return targetMap.get(mapKey);
+}
+function defineMetadata(key, value, target, propertyKey) {
+    // @ts-ignore
+    if (typeof Reflect !== "undefined" && Reflect.defineMetadata) {
+        // @ts-ignore
+        return Reflect.defineMetadata(key, value, target, propertyKey);
+    }
+    let targetMap = MetadataStorage.get(target);
+    if (!targetMap) {
+        targetMap = new Map();
+        MetadataStorage.set(target, targetMap);
+    }
+    const mapKey = propertyKey ? `${String(key)}:${String(propertyKey)}` : key;
+    targetMap.set(mapKey, value);
+}
+export const MIDDLEWARE_METADATA_KEY = Symbol("jen:middleware");
+export function UseMiddleware(...middleware) {
+    return function (target, propertyKey, descriptor) {
+        if (descriptor) {
+            // Method decorator
+            const existing = getMetadata(MIDDLEWARE_METADATA_KEY, target, propertyKey) || [];
+            defineMetadata(MIDDLEWARE_METADATA_KEY, [...existing, ...middleware], target, propertyKey);
+        }
+        else {
+            // Class decorator
+            const existing = getMetadata(MIDDLEWARE_METADATA_KEY, target) || [];
+            defineMetadata(MIDDLEWARE_METADATA_KEY, [...existing, ...middleware], target);
+        }
+    };
+}

package/templates/static/lib/middleware/errors/handler.d.ts

@@ -0,0 +1 @@
+export function errorHandler(ctx: any, next: any): Promise<void>;