create-shibumi 0.0.1 → 0.2.0

package/src/templates/full-stack/src/server.ts

@@ -0,0 +1,30 @@
+import { app } from "./app";
+import { sqlite } from "./db";
+import { bootDatabase } from "./db/lifecycle";
+import { loadEnv } from "./env";
+
+const env = loadEnv();
+
+// Boot ordering: backup (when migrations are pending on an existing
+// database), migrate, then serve. Failure exits before the health check
+// can pass, so the previous deployment stays live.
+await bootDatabase(sqlite, env.DB_PATH);
+
+const server = Bun.serve({
+  port: env.PORT,
+  // Cap request bodies so an unauthenticated client cannot exhaust memory
+  // before a route (or its rate limiter) runs. Raise it for large uploads.
+  maxRequestBodySize: 1024 * 1024,
+  fetch: app.fetch,
+});
+
+console.log(`Listening on http://localhost:${server.port}`);
+
+// Graceful shutdown: stop accepting connections, let in-flight requests
+// finish, then exit. The container runtime sends SIGTERM on replacement.
+async function shutdown(code: number): Promise<void> {
+  await server.stop();
+  process.exit(code);
+}
+process.on("SIGTERM", () => void shutdown(0));
+process.on("SIGINT", () => void shutdown(0));

package/src/templates/full-stack/test/app.test.ts

@@ -0,0 +1,144 @@
+import { describe, expect, it } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// The db module opens DB_PATH at import time, so point it at a scratch
+// database before the app loads.
+process.env.DB_PATH = join(mkdtempSync(join(tmpdir(), "app-test-")), "app.db");
+const { app, createApp } = await import("../src/app");
+const { sqlite } = await import("../src/db");
+const { applyMigrations } = await import("../src/db/lifecycle");
+await applyMigrations(sqlite);
+
+// Independent copy of the required header contract. If src/app.ts weakens a
+// header, this literal makes the test fail instead of silently adapting.
+const REQUIRED_HEADERS: Record<string, string> = {
+  "Content-Security-Policy":
+    "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'",
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin",
+  "Permissions-Policy": "camera=(), geolocation=(), microphone=()",
+  "Cross-Origin-Opener-Policy": "same-origin",
+  "Cross-Origin-Resource-Policy": "same-origin",
+};
+
+async function req(path: string, init?: RequestInit): Promise<Response> {
+  return app.fetch(new Request(`http://localhost${path}`, init));
+}
+
+function expectSecurityHeaders(res: Response): void {
+  for (const [name, value] of Object.entries(REQUIRED_HEADERS)) {
+    expect(res.headers.get(name)).toBe(value);
+  }
+}
+
+describe("routes", () => {
+  it("serves the home page", async () => {
+    const res = await req("/");
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("It persists.");
+    expect(html.indexOf("/public/app.js")).toBeLessThan(
+      html.indexOf("/public/vendor/alpine-csp-3.16.2.min.js")
+    );
+    expectSecurityHeaders(res);
+  });
+
+  it("answers the health check", async () => {
+    const res = await req("/healthz");
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+    expectSecurityHeaders(res);
+  });
+
+  it("serves notes from the migrated database", async () => {
+    const res = await req("/api/notes");
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { notes: Array<{ title: string }> };
+    expect(body.notes.map((note) => note.title)).toContain("It persists.");
+    expectSecurityHeaders(res);
+  });
+
+  it("validates API query input", async () => {
+    const bad = await req(`/api/hello?name=${"x".repeat(101)}`);
+    expect(bad.status).toBe(400);
+    expectSecurityHeaders(bad);
+  });
+
+  it("returns 404 with security headers", async () => {
+    const res = await req("/nope");
+    expect(res.status).toBe(404);
+    expectSecurityHeaders(res);
+  });
+
+  it("serves static assets with security headers", async () => {
+    const res = await req("/public/style.css");
+    expect(res.status).toBe(200);
+    expectSecurityHeaders(res);
+  });
+
+  it("keeps security headers on thrown-error responses", async () => {
+    const probe = createApp();
+    probe.get("/__boom", () => {
+      throw new Error("test explosion");
+    });
+    const res = await probe.fetch(new Request("http://localhost/__boom"));
+    expect(res.status).toBe(500);
+    expectSecurityHeaders(res);
+  });
+});
+
+describe("security", () => {
+  it("registers exactly the expected routes", () => {
+    const routes = app.routes.map((r) => `${r.method} ${r.path}`);
+    expect(routes.sort()).toEqual(
+      [
+        "ALL /*",
+        "GET /public/*",
+        "GET /",
+        "GET /api/hello",
+        "GET /api/notes",
+        "GET /healthz",
+      ].sort()
+    );
+  });
+
+  it("rejects every mutation verb on every route", async () => {
+    for (const path of ["/", "/api/hello", "/api/notes", "/healthz", "/public/style.css"]) {
+      for (const method of ["POST", "PUT", "PATCH", "DELETE"]) {
+        const res = await req(path, { method });
+        expect([404, 405]).toContain(res.status);
+      }
+    }
+  });
+
+  it("pins a CSP without unsafe-inline or unsafe-eval", () => {
+    const csp = REQUIRED_HEADERS["Content-Security-Policy"]!;
+    expect(csp).not.toContain("unsafe-inline");
+    expect(csp).not.toContain("unsafe-eval");
+  });
+
+  it("does not expose files outside public/ via traversal", async () => {
+    for (const path of [
+      "/public/../package.json",
+      "/public/%2e%2e/package.json",
+      "/public/..%2fpackage.json",
+      "/public/../.env",
+    ]) {
+      const res = await req(path);
+      if (res.status === 200) {
+        const body = await res.text();
+        expect(body).not.toContain('"scripts"');
+      } else {
+        expect([400, 404]).toContain(res.status);
+      }
+    }
+  });
+
+  it("ships the pinned Alpine build the page references", async () => {
+    const file = Bun.file(new URL("../public/vendor/alpine-csp-3.16.2.min.js", import.meta.url));
+    expect(await file.exists()).toBe(true);
+  });
+});

package/src/templates/full-stack/test/db.test.ts

@@ -0,0 +1,169 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  applyMigrations,
+  appliedMigrations,
+  backupDatabase,
+  bootDatabase,
+  listMigrations,
+  pendingMigrations,
+  restoreDatabase,
+  openDatabase,
+} from "../src/db/lifecycle";
+
+let dir: string;
+let dbPath: string;
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "db-test-"));
+  dbPath = join(dir, "app.db");
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe("migrations", () => {
+  it("applies every migration to a fresh database and answers representative queries", async () => {
+    const db = openDatabase(dbPath);
+    expect(pendingMigrations(db).length).toBe(listMigrations().length);
+    const applied = await applyMigrations(db);
+    expect(applied).toEqual(listMigrations().map((m) => m.name));
+    expect(pendingMigrations(db)).toEqual([]);
+
+    const titles = db.query<{ title: string }, []>("SELECT title FROM notes ORDER BY id").all();
+    expect(titles.map((row) => row.title)).toContain("It persists.");
+    db.query("INSERT INTO notes (title) VALUES (?)").run("second");
+    expect(db.query<{ n: number }, []>("SELECT count(*) AS n FROM notes").get()?.n).toBe(2);
+  });
+
+  it("is idempotent and journaled", async () => {
+    const db = openDatabase(dbPath);
+    await applyMigrations(db);
+    expect(await applyMigrations(db)).toEqual([]);
+    expect(appliedMigrations(db)).toEqual(listMigrations().map((m) => m.name));
+  });
+
+  it("applies durability pragmas on open", () => {
+    const db = openDatabase(dbPath);
+    expect(db.query<{ journal_mode: string }, []>("PRAGMA journal_mode").get()?.journal_mode).toBe("wal");
+    expect(db.query<{ foreign_keys: number }, []>("PRAGMA foreign_keys").get()?.foreign_keys).toBe(1);
+    expect(db.query<{ timeout: number }, []>("PRAGMA busy_timeout").get()?.timeout).toBe(5000);
+  });
+});
+
+describe("backup and restore", () => {
+  it("backs up with a checksum sidecar and restores after data loss", async () => {
+    const db = openDatabase(dbPath);
+    await applyMigrations(db);
+    db.query("INSERT INTO notes (title) VALUES (?)").run("keep me");
+
+    const backup = await backupDatabase(db, dbPath);
+    expect(existsSync(backup)).toBe(true);
+    expect(existsSync(`${backup}.sha256`)).toBe(true);
+
+    db.query("DELETE FROM notes").run();
+    db.close();
+
+    await restoreDatabase(backup, dbPath);
+    const restored = openDatabase(dbPath);
+    const titles = restored.query<{ title: string }, []>("SELECT title FROM notes").all();
+    expect(titles.map((row) => row.title)).toContain("keep me");
+  });
+
+  it("rejects a corrupted backup by checksum", async () => {
+    const db = openDatabase(dbPath);
+    await applyMigrations(db);
+    const backup = await backupDatabase(db, dbPath);
+    db.close();
+    const raw = new Uint8Array(await Bun.file(backup).arrayBuffer());
+    raw[100] = raw[100]! ^ 0xff;
+    await Bun.write(backup, raw);
+    await expect(restoreDatabase(backup, dbPath)).rejects.toThrow("checksum mismatch");
+  });
+
+  it("keeps only the newest five backups", async () => {
+    const db = openDatabase(dbPath);
+    await applyMigrations(db);
+    for (let index = 0; index < 7; index += 1) {
+      await backupDatabase(db, dbPath);
+      await new Promise((resolveSleep) => setTimeout(resolveSleep, 5));
+    }
+    const backups = readdirSync(join(dir, "backups")).filter((name) => name.endsWith(".sqlite"));
+    expect(backups.length).toBe(5);
+  });
+});
+
+describe("boot ordering", () => {
+  it("backs up before applying pending migrations to an existing database", async () => {
+    const db = openDatabase(dbPath);
+    // Simulate a database predating this tooling: user data exists but no
+    // journal. Boot must back it up before migrating.
+    db.exec("CREATE TABLE legacy (id INTEGER PRIMARY KEY);");
+    db.exec("INSERT INTO legacy (id) VALUES (1);");
+    await bootDatabase(db, dbPath);
+    expect(readdirSync(join(dir, "backups")).some((name) => name.endsWith(".sqlite"))).toBe(true);
+    expect(pendingMigrations(db)).toEqual([]);
+  });
+
+  it("does not back up a brand-new database", async () => {
+    const db = openDatabase(dbPath);
+    await bootDatabase(db, dbPath);
+    expect(existsSync(join(dir, "backups"))).toBe(false);
+    expect(pendingMigrations(db)).toEqual([]);
+  });
+
+  it("rolls back a failing migration and keeps the journal clean", async () => {
+    const db = openDatabase(dbPath);
+    await applyMigrations(db);
+    const before = appliedMigrations(db);
+    const { writeFileSync, mkdirSync } = await import("node:fs");
+    const extraDir = join(dir, "migrations-extra");
+    mkdirSync(extraDir, { recursive: true });
+    writeFileSync(join(extraDir, "9998_good.sql"), "CREATE TABLE extra_ok (id INTEGER PRIMARY KEY);");
+    writeFileSync(join(extraDir, "9999_broken.sql"), "CREATE TABLE broken (;");
+    await expect(applyMigrations(db, extraDir)).rejects.toThrow("9999_broken.sql failed and was rolled back");
+    // The good migration before the broken one committed; the broken one
+    // left no journal row and no partial objects.
+    expect(appliedMigrations(db)).toEqual([...before, "9998_good.sql"].sort());
+    expect(db.query("SELECT name FROM sqlite_master WHERE name = 'broken'").get()).toBeNull();
+  });
+});
+
+describe("migration guards", () => {
+  it("rejects migrations containing transaction control", async () => {
+    const db = openDatabase(dbPath);
+    const { writeFileSync, mkdirSync } = await import("node:fs");
+    const extraDir = join(dir, "migrations-tx");
+    mkdirSync(extraDir, { recursive: true });
+    writeFileSync(join(extraDir, "0001_tx.sql"), "BEGIN;\nCREATE TABLE x (id INTEGER);\nCOMMIT;");
+    await expect(applyMigrations(db, extraDir)).rejects.toThrow("transaction control");
+  });
+
+  it("rejects backfilled migrations sorting before applied ones", async () => {
+    const db = openDatabase(dbPath);
+    await applyMigrations(db);
+    const { writeFileSync, mkdirSync } = await import("node:fs");
+    const extraDir = join(dir, "migrations-backfill");
+    mkdirSync(extraDir, { recursive: true });
+    writeFileSync(join(extraDir, "0000_early.sql"), "CREATE TABLE early (id INTEGER);");
+    expect(() => pendingMigrations(db, extraDir)).toThrow("Rename them to sort last");
+  });
+
+  it("retention never touches unrelated files in the backups directory", async () => {
+    const db = openDatabase(dbPath);
+    await applyMigrations(db);
+    const { writeFileSync, mkdirSync } = await import("node:fs");
+    mkdirSync(join(dir, "backups"), { recursive: true });
+    writeFileSync(join(dir, "backups", "unrelated.sqlite"), "not ours");
+    for (let index = 0; index < 7; index += 1) {
+      await backupDatabase(db, dbPath);
+      await new Promise((resolveSleep) => setTimeout(resolveSleep, 5));
+    }
+    const files = readdirSync(join(dir, "backups"));
+    expect(files).toContain("unrelated.sqlite");
+    expect(files.filter((name) => name.startsWith("app.db.") && name.endsWith(".sqlite")).length).toBe(5);
+  });
+});

package/src/templates/full-stack/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "noEmit": true,
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "types": [
+      "bun-types"
+    ],
+    "skipLibCheck": true
+  },
+  "include": [
+    "src",
+    "test"
+  ]
+}