create-jen-app 1.2.2 → 1.2.4

package/templates/static/lib/api/loader.js

@@ -0,0 +1,234 @@
+import { readdirSync } from "fs";
+import { join, resolve } from "path";
+/**
+ * Loader for scanning and loading API route files
+ *
+ * @example
+ * ```ts
+ * const loader = new ApiLoader();
+ * const routes = await loader.loadRoutes('./src/api');
+ * // Routes format: [
+ * //   { path: '/api/hello', handler: ..., config: ... },
+ * //   { path: '/api/posts/[id]', handler: ..., config: ... },
+ * //   { path: '/api/files/[...slug]', handler: ..., config: ... }
+ * // ]
+ * ```
+ */
+export class ApiLoader {
+  /**
+   * Load all API routes from a directory
+   *
+   * @param apiDir Directory to scan for route files (e.g., 'src/api')
+   * @param baseRoute Base route prefix (default: '/api')
+   * @returns Array of loaded routes
+   */
+  async loadRoutes(apiDir, baseRoute = "/api") {
+    const routes = [];
+    const fullPath = resolve(apiDir);
+    try {
+      await this.scanDirectory(fullPath, baseRoute, routes);
+    } catch (err) {
+      console.error(`Failed to load API routes from ${apiDir}:`, err);
+    }
+    // Sort routes by specificity: exact > dynamic > catch-all
+    routes.sort((a, b) => {
+      const aIsCatchAll = a.path.includes("[...");
+      const bIsCatchAll = b.path.includes("[...");
+      const aIsDynamic = a.path.includes("[");
+      const bIsDynamic = b.path.includes("[");
+      if (aIsCatchAll && !bIsCatchAll) return 1;
+      if (!aIsCatchAll && bIsCatchAll) return -1;
+      if (aIsDynamic && !bIsDynamic) return 1;
+      if (!aIsDynamic && bIsDynamic) return -1;
+      return a.path.length - b.path.length;
+    });
+    return routes;
+  }
+  /**
+   * Recursively scan directory for API route files
+   *
+   * @private
+   */
+  async scanDirectory(dir, baseRoute, routes) {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      // Skip hidden files and directories
+      if (entry.name.startsWith(".")) continue;
+      if (entry.isDirectory()) {
+        await this.scanDirectory(fullPath, baseRoute, routes);
+      } else if (this.isRouteFile(entry.name)) {
+        const routePath = this.filePathToRoute(fullPath, baseRoute);
+        const module = await this.loadModule(fullPath);
+        if (module && typeof module.default === "function") {
+          routes.push({
+            path: routePath,
+            handler: module.default,
+            config: module.config,
+          });
+        }
+      }
+    }
+  }
+  /**
+   * Check if file is a valid route file
+   *
+   * @private
+   */
+  isRouteFile(filename) {
+    return (
+      /^[^.][^/]*\.(ts|tsx|js|jsx)$/.test(filename) &&
+      !filename.endsWith(".d.ts")
+    );
+  }
+  /**
+   * Convert file path to API route path
+   *
+   * @private
+   * @example
+   * ```
+   * src/api/hello.ts -> /api/hello
+   * src/api/posts/[id].ts -> /api/posts/[id]
+   * src/api/files/[...slug].ts -> /api/files/[...slug]
+   * ```
+   */
+  filePathToRoute(filePath, baseRoute) {
+    let route = filePath
+      .replace(/\\/g, "/") // Windows path separator
+      .replace(/\.(ts|tsx|js|jsx)$/, "") // Remove extension
+      .replace(/\/index$/, ""); // Remove /index
+    // Extract path after 'api' directory
+    const apiIndex = route.lastIndexOf("/api");
+    if (apiIndex !== -1) {
+      route = route.slice(apiIndex);
+    }
+    return baseRoute + route;
+  }
+  /**
+   * Dynamically import a module
+   *
+   * @private
+   */
+  async loadModule(filePath) {
+    try {
+      // Convert Windows path to file:// URL
+      let importPath = filePath;
+      if (process.platform === "win32") {
+        // Normalize: backslashes → forward slashes
+        const normalized = filePath.replace(/\\/g, "/");
+        // Add file:// scheme (with third slash for absolute paths)
+        importPath = "file:///" + normalized;
+      }
+      // Handle both CommonJS and ESM
+      const module = await import(importPath);
+      return module;
+    } catch (err) {
+      console.error(`Failed to load API route ${filePath}:`, err);
+      return null;
+    }
+  }
+}
+/**
+ * Create a middleware function for Express-like servers
+ *
+ * @param routes Loaded API routes
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import { createApiMiddleware } from '../api/loader';
+ * import { ApiRouter } from '../api/router';
+ *
+ * const app = express();
+ * const loader = new ApiLoader();
+ * const routes = await loader.loadRoutes('./src/api');
+ *
+ * const router = new ApiRouter();
+ * routes.forEach(route => router.register(route.path, route.handler));
+ *
+ * app.use(createApiMiddleware(routes));
+ * ```
+ */
+export function createApiMiddleware(routes) {
+  return async (req, res, next) => {
+    // Only handle API routes
+    if (!req.url.startsWith("/api")) {
+      return next();
+    }
+    // Find matching route
+    const match = findMatchingRoute(req.path, routes);
+    if (!match) {
+      return next(); // Let next middleware handle 404
+    }
+    try {
+      // Set up request/response
+      req.params = match.params;
+      // Execute handler
+      await match.route.handler(req, res);
+    } catch (err) {
+      console.error("API handler error:", err);
+      res.status(500).json({ error: "Internal server error" });
+    }
+  };
+}
+/**
+ * Find matching route using simple path matching
+ *
+ * @private
+ */
+function findMatchingRoute(requestPath, routes) {
+  for (const route of routes) {
+    const match = matchPath(requestPath, route.path);
+    if (match) {
+      return { route, params: match };
+    }
+  }
+  return null;
+}
+/**
+ * Match a request path against a route pattern
+ *
+ * @private
+ */
+function matchPath(requestPath, routePath) {
+  const routeParts = routePath.split("/").filter(Boolean);
+  const requestParts = requestPath.split("/").filter(Boolean);
+  // Skip 'api' prefix
+  if (routeParts[0] === "api") routeParts.shift();
+  if (requestParts[0] === "api") requestParts.shift();
+  const params = {};
+  let routeIndex = 0;
+  let requestIndex = 0;
+  while (routeIndex < routeParts.length && requestIndex < requestParts.length) {
+    const routePart = routeParts[routeIndex];
+    const requestPart = requestParts[requestIndex];
+    if (routePart.startsWith("[...")) {
+      // Catch-all
+      const paramName = routePart.slice(4, -1);
+      const remaining = requestParts.slice(requestIndex);
+      params[paramName] = remaining;
+      requestIndex = requestParts.length;
+    } else if (routePart.startsWith("[")) {
+      // Dynamic segment
+      const paramName = routePart.slice(1, -1);
+      params[paramName] = requestPart;
+      requestIndex++;
+    } else if (routePart === requestPart) {
+      // Exact match
+      requestIndex++;
+    } else {
+      // No match
+      return null;
+    }
+    routeIndex++;
+  }
+  // Check if all parts matched
+  if (
+    routeIndex === routeParts.length &&
+    requestIndex === requestParts.length
+  ) {
+    return params;
+  }
+  return null;
+}

package/templates/static/lib/api/router.js

@@ -0,0 +1,259 @@
+import { URL } from "url";
+/**
+ * API Router for matching requests to handlers
+ */
+export class ApiRouter {
+  routes = new Map();
+  /**
+   * Register an API route handler
+   *
+   * @param path Route path (e.g., '/api/posts', '/api/posts/[id]', '/api/posts/[...slug]')
+   * @param handler Request handler function
+   *
+   * @example
+   * ```ts
+   * router.register('/api/posts', handler);
+   * router.register('/api/posts/[id]', handler);
+   * router.register('/api/files/[...path]', handler);
+   * ```
+   */
+  register(path, handler) {
+    const pattern = this.pathToRegex(path);
+    const isDynamic = path.includes("[");
+    const isCatchAll = path.includes("[...");
+    this.routes.set(path, { handler, pattern, isDynamic, isCatchAll });
+  }
+  /**
+   * Match a request path to a registered route
+   *
+   * @param requestPath Request path
+   * @returns Matched handler and extracted params, or null if no match
+   */
+  match(requestPath) {
+    // First try exact matches (non-dynamic routes)
+    for (const [path, route] of this.routes) {
+      if (!route.isDynamic && path === requestPath) {
+        return { handler: route.handler, params: {} };
+      }
+    }
+    // Then try dynamic routes (sort by specificity)
+    const dynamicRoutes = Array.from(this.routes.entries())
+      .filter(([, route]) => route.isDynamic)
+      .sort(([a], [b]) => {
+        // Predefined routes before catch-all
+        if (a.includes("[...")) return 1;
+        if (b.includes("[...")) return -1;
+        // More specific before less specific
+        return a.split("/").length - b.split("/").length;
+      });
+    for (const [path, route] of dynamicRoutes) {
+      const match = requestPath.match(route.pattern);
+      if (match) {
+        const params = this.extractParams(path, requestPath);
+        return { handler: route.handler, params };
+      }
+    }
+    return null;
+  }
+  /**
+   * Convert a path pattern to a regex
+   *
+   * @private
+   */
+  pathToRegex(path) {
+    // Convert /api/posts/[id] to /api/posts/([^/]+)
+    // Convert /api/files/[...slug] to /api/files/(.+)
+    // Convert /api/items/[[...optional]] to /api/items(/.*)?
+    let pattern = path
+      .replace(/\//g, "\\/")
+      .replace(/\[\[\.\.\.([^\]]+)\]\]/g, "(?:\\/(.+))?") // Optional catch-all (do first)
+      .replace(/\[\.\.\.([^\]]+)\]/g, "(.+)") // Required catch-all
+      .replace(/\[([^\]]+)\]/g, "([^\\/]+)"); // Dynamic segment
+    return new RegExp(`^${pattern}$`);
+  }
+  /**
+   * Extract parameters from a matched route
+   *
+   * @private
+   */
+  extractParams(routePath, requestPath) {
+    const params = {};
+    // Extract parameter names from route
+    const paramMatches = routePath.matchAll(/\[\.{0,3}(\w+)\]/g);
+    const paramNames = Array.from(paramMatches, (m) => m[1]);
+    // Match request path and extract values
+    const pattern = this.pathToRegex(routePath);
+    const match = requestPath.match(pattern);
+    if (!match) return params;
+    for (let i = 0; i < paramNames.length; i++) {
+      const name = paramNames[i];
+      const value = match[i + 1];
+      if (
+        routePath.includes(`[...${name}]`) ||
+        routePath.includes(`[[...${name}]]`)
+      ) {
+        // Catch-all: convert to array
+        params[name] = value ? value.split("/").filter(Boolean) : [];
+      } else {
+        params[name] = value;
+      }
+    }
+    return params;
+  }
+}
+/**
+ * Parse query string into object
+ *
+ * @private
+ */
+export function parseQuery(queryString) {
+  const params = {};
+  if (!queryString) return params;
+  const pairs = queryString.split("&");
+  for (const pair of pairs) {
+    const [key, value] = pair.split("=");
+    const decodedKey = decodeURIComponent(key || "");
+    const decodedValue = decodeURIComponent(value || "");
+    if (params[decodedKey]) {
+      if (Array.isArray(params[decodedKey])) {
+        params[decodedKey].push(decodedValue);
+      } else {
+        params[decodedKey] = [params[decodedKey], decodedValue];
+      }
+    } else {
+      params[decodedKey] = decodedValue;
+    }
+  }
+  return params;
+}
+/**
+ * Parse cookies from request headers
+ *
+ * @private
+ */
+export function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  const pairs = cookieHeader.split(";");
+  for (const pair of pairs) {
+    const [key, value] = pair.trim().split("=");
+    if (key) cookies[key] = decodeURIComponent(value || "");
+  }
+  return cookies;
+}
+/**
+ * Create enhanced request object
+ *
+ * @private
+ */
+export async function createApiRequest(req, params = {}) {
+  const url = new URL(req.url || "", `http://${req.headers.host}`);
+  const query = parseQuery(url.search.slice(1));
+  const cookies = parseCookies(req.headers.cookie || "");
+  let body = null;
+  // Parse body if present
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    body = await new Promise((resolve, reject) => {
+      let data = "";
+      req.on("data", (chunk) => {
+        data += chunk.toString();
+      });
+      req.on("end", () => {
+        try {
+          const contentType = req.headers["content-type"] || "";
+          if (contentType.includes("application/json")) {
+            resolve(data ? JSON.parse(data) : null);
+          } else if (
+            contentType.includes("application/x-www-form-urlencoded")
+          ) {
+            resolve(parseQuery(data));
+          } else {
+            resolve(data || null);
+          }
+        } catch (err) {
+          reject(err);
+        }
+      });
+      req.on("error", reject);
+    });
+  }
+  return {
+    ...req,
+    method: req.method || "GET",
+    url: req.url || "/",
+    query,
+    body,
+    params,
+    cookies,
+  };
+}
+/**
+ * Create enhanced response object
+ *
+ * @private
+ */
+export function createApiResponse(res) {
+  const apiRes = res;
+  let statusCode = 200;
+  let headersSent = false;
+  apiRes.status = function (code) {
+    statusCode = code;
+    res.statusCode = code;
+    return apiRes;
+  };
+  apiRes.header = function (key, value) {
+    res.setHeader(key, value);
+    return apiRes;
+  };
+  apiRes.json = function (body) {
+    if (!headersSent) {
+      res.setHeader("Content-Type", "application/json");
+      res.statusCode = statusCode;
+      headersSent = true;
+    }
+    res.end(JSON.stringify(body));
+  };
+  apiRes.send = function (body) {
+    if (!headersSent) {
+      if (typeof body === "object" && !(body instanceof Buffer)) {
+        res.setHeader("Content-Type", "application/json");
+        res.end(JSON.stringify(body));
+      } else {
+        res.end(body);
+      }
+      headersSent = true;
+    }
+  };
+  apiRes.redirect = function (statusOrPath, path) {
+    const redirectPath =
+      typeof statusOrPath === "string" ? statusOrPath : path || "/";
+    const code = typeof statusOrPath === "number" ? statusOrPath : 307;
+    res.statusCode = code;
+    res.setHeader("Location", redirectPath);
+    res.end();
+    headersSent = true;
+  };
+  apiRes.download = function (filepath, filename) {
+    res.setHeader(
+      "Content-Disposition",
+      `attachment; filename="${filename || filepath}"`,
+    );
+    apiRes.sendFile(filepath);
+  };
+  apiRes.sendFile = function (filepath) {
+    // Dynamic import for sendFile functionality
+    (async () => {
+      try {
+        const { createReadStream } = await import("fs");
+        const file = createReadStream(filepath);
+        file.pipe(res);
+        headersSent = true;
+      } catch (err) {
+        console.error("Error sending file:", err);
+        res.statusCode = 500;
+        res.end("Error sending file");
+      }
+    })();
+  };
+  return apiRes;
+}

package/templates/static/lib/assets/types.js

@@ -0,0 +1 @@
+export {};

package/templates/static/lib/auth/cookie-utils.js

@@ -1,99 +1,83 @@
-/*
- * This file is part of Jen.js.
- * Copyright (C) 2026 oopsio
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <https://www.gnu.org/licenses/>.
+/**
+ * Secure cookie utilities for session management
+ * Ensures cookies have proper security flags
  */
 /**
  * Generate secure cookie header value
  */
 export function createSecureCookie(name, value, options = {}) {
-    const defaults = {
-        httpOnly: true, // Prevent XSS token theft
-        secure: process.env.NODE_ENV === "production", // HTTPS only in production
-        sameSite: "Strict", // CSRF protection
-        maxAge: 24 * 60 * 60, // 24 hours
-        path: "/",
-    };
-    const opts = { ...defaults, ...options };
-    let cookieStr = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
-    if (opts.maxAge !== undefined) {
-        cookieStr += `; Max-Age=${opts.maxAge}`;
-    }
-    if (opts.path) {
-        cookieStr += `; Path=${opts.path}`;
-    }
-    if (opts.domain) {
-        cookieStr += `; Domain=${opts.domain}`;
-    }
-    if (opts.secure) {
-        cookieStr += "; Secure";
-    }
-    if (opts.httpOnly) {
-        cookieStr += "; HttpOnly";
-    }
-    if (opts.sameSite) {
-        cookieStr += `; SameSite=${opts.sameSite}`;
-    }
-    return cookieStr;
+  const defaults = {
+    httpOnly: true, // Prevent XSS token theft
+    secure: process.env.NODE_ENV === "production", // HTTPS only in production
+    sameSite: "Strict", // CSRF protection
+    maxAge: 24 * 60 * 60, // 24 hours
+    path: "/",
+  };
+  const opts = { ...defaults, ...options };
+  let cookieStr = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+  if (opts.maxAge !== undefined) {
+    cookieStr += `; Max-Age=${opts.maxAge}`;
+  }
+  if (opts.path) {
+    cookieStr += `; Path=${opts.path}`;
+  }
+  if (opts.domain) {
+    cookieStr += `; Domain=${opts.domain}`;
+  }
+  if (opts.secure) {
+    cookieStr += "; Secure";
+  }
+  if (opts.httpOnly) {
+    cookieStr += "; HttpOnly";
+  }
+  if (opts.sameSite) {
+    cookieStr += `; SameSite=${opts.sameSite}`;
+  }
+  return cookieStr;
 }
 /**
-  * Parse cookies from request header
-  */
+ * Parse cookies from request header
+ */
 export function parseCookies(cookieHeader) {
-    const cookies = {};
-    if (!cookieHeader || !cookieHeader.trim())
-        return cookies;
-    cookieHeader.split(";").forEach((cookie) => {
-        const trimmed = cookie.trim();
-        if (!trimmed)
-            return;
-        const eqIndex = trimmed.indexOf("=");
-        if (eqIndex === -1)
-            return;
-        const name = trimmed.substring(0, eqIndex).trim();
-        const value = trimmed.substring(eqIndex + 1).trim();
-        if (name && value) {
-            try {
-                cookies[decodeURIComponent(name)] = decodeURIComponent(value);
-            }
-            catch (err) {
-                // Skip cookies with invalid URI encoding
-                console.warn(`Failed to decode cookie ${name}:`, err instanceof Error ? err.message : String(err));
-            }
-        }
-    });
-    return cookies;
+  const cookies = {};
+  if (!cookieHeader || !cookieHeader.trim()) return cookies;
+  cookieHeader.split(";").forEach((cookie) => {
+    const trimmed = cookie.trim();
+    if (!trimmed) return;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) return;
+    const name = trimmed.substring(0, eqIndex).trim();
+    const value = trimmed.substring(eqIndex + 1).trim();
+    if (name && value) {
+      try {
+        cookies[decodeURIComponent(name)] = decodeURIComponent(value);
+      } catch (err) {
+        // Skip cookies with invalid URI encoding
+        console.warn(
+          `Failed to decode cookie ${name}:`,
+          err instanceof Error ? err.message : String(err),
+        );
+      }
+    }
+  });
+  return cookies;
 }
 /**
  * Validate session cookie - check all security properties
  */
 export function validateSessionCookie(header, expectedName = "sessionId") {
-    if (!header)
-        return false;
-    const parts = header.split(";").map((p) => p.trim());
-    const [cookiePair, ...flags] = parts;
-    if (!cookiePair || !cookiePair.includes("="))
-        return false;
-    const [name] = cookiePair.split("=");
-    if (decodeURIComponent(name) !== expectedName)
-        return false;
-    // Check required security flags
-    const hasHttpOnly = flags.some((f) => f.toLowerCase() === "httponly");
-    const hasSameSite = flags.some((f) => f.toLowerCase().startsWith("samesite"));
-    const isSecure = process.env.NODE_ENV === "production"
-        ? flags.some((f) => f.toLowerCase() === "secure")
-        : true;
-    return hasHttpOnly && hasSameSite && isSecure;
+  if (!header) return false;
+  const parts = header.split(";").map((p) => p.trim());
+  const [cookiePair, ...flags] = parts;
+  if (!cookiePair || !cookiePair.includes("=")) return false;
+  const [name] = cookiePair.split("=");
+  if (decodeURIComponent(name) !== expectedName) return false;
+  // Check required security flags
+  const hasHttpOnly = flags.some((f) => f.toLowerCase() === "httponly");
+  const hasSameSite = flags.some((f) => f.toLowerCase().startsWith("samesite"));
+  const isSecure =
+    process.env.NODE_ENV === "production"
+      ? flags.some((f) => f.toLowerCase() === "secure")
+      : true;
+  return hasHttpOnly && hasSameSite && isSecure;
 }

package/templates/static/lib/auth/index.js

@@ -1,19 +1,2 @@
-/*
- * This file is part of Jen.js.
- * Copyright (C) 2026 oopsio
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <https://www.gnu.org/licenses/>.
- */
 export * from "./jwt";
 export * from "./session";