fullstx 1.0.0

package/lib/middlewares/apiKey.js

@@ -0,0 +1,14 @@
+module.exports = function apiKey(key) {
+    const crypto = require('crypto');
+    return (req, res, next) => {
+        const reqKey = req.headers['x-api-key'] || (req.query && req.query.api_key);
+        const a = Buffer.from(reqKey || '');
+        const b = Buffer.from(key || '');
+        if (reqKey && a.length === b.length && crypto.timingSafeEqual(a, b)) {
+            return next();
+        }
+        if (res.json) return res.json({ error: 'Invalid API Key' }, 401);
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid API Key' }));
+    };
+};

package/lib/middlewares/authorize.js

@@ -0,0 +1,10 @@
+module.exports = function authorize(roles = []) {
+    return (req, res, next) => {
+        if (!req.user || !req.user.role || !roles.includes(req.user.role)) {
+            if (res.json) return res.json({ error: 'Forbidden: Insufficient role privileges' }, 403);
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            return res.end(JSON.stringify({ error: 'Forbidden: Insufficient role privileges' }));
+        }
+        next();
+    };
+};

package/lib/middlewares/basicAuth.js

@@ -0,0 +1,21 @@
+module.exports = function basicAuth(credentials) {
+    const crypto = require('crypto');
+    return (req, res, next) => {
+        const b64auth = (req.headers.authorization || '').split(' ')[1] || '';
+        const [login, password] = Buffer.from(b64auth, 'base64').toString().split(':');
+        const reqPass = Buffer.from(password || '');
+        const expectedPass = Buffer.from(credentials[login] || '');
+        if (
+            login &&
+            password &&
+            credentials[login] &&
+            reqPass.length === expectedPass.length &&
+            crypto.timingSafeEqual(reqPass, expectedPass)
+        ) {
+            req.user = { username: login };
+            return next();
+        }
+        res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="Protected"' });
+        res.end('Authentication required.');
+    };
+};

package/lib/middlewares/csp.js

@@ -0,0 +1,13 @@
+module.exports = function csp(options = {}) {
+    return (req, res, next) => {
+        const policies = [];
+        for (const [key, value] of Object.entries(options)) {
+            const directive = Array.isArray(value) ? value.join(' ') : value;
+            policies.push(`${key} ${directive}`);
+        }
+        if (policies.length > 0) {
+            res.setHeader('Content-Security-Policy', policies.join('; '));
+        }
+        next();
+    };
+};

package/lib/middlewares/csrf.js

@@ -0,0 +1,31 @@
+module.exports = function csrf() {
+    const crypto = require('crypto');
+    return (req, res, next) => {
+        if (!req.session) {
+            console.warn('[!] CSRF middleware requires Session middleware to be registered before it.');
+            return next();
+        }
+
+        if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') {
+            if (!req.session._csrfToken) {
+                req.session._csrfToken = crypto.randomBytes(16).toString('hex');
+            }
+            res.locals = res.locals || {};
+            res.locals.csrfToken = req.session._csrfToken;
+            req.csrfToken = () => req.session._csrfToken;
+            return next();
+        }
+
+        const token = (req.body && req.body._csrf) || req.headers['x-csrf-token'] || req.headers['x-xsrf-token'];
+        const tokenBuf = Buffer.from(token || '');
+        const sessionBuf = Buffer.from(req.session._csrfToken || '');
+
+        if (!token || tokenBuf.length !== sessionBuf.length || !crypto.timingSafeEqual(tokenBuf, sessionBuf)) {
+            if (res.json) return res.json({ error: 'Invalid CSRF Token' }, 403);
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            return res.end(JSON.stringify({ error: 'Invalid CSRF Token' }));
+        }
+
+        next();
+    };
+};

package/lib/middlewares/htmx.js

@@ -0,0 +1,24 @@
+module.exports = function htmx() {
+    return (req, res, next) => {
+        req.htmx = req.headers['hx-request'] === 'true';
+
+        res.hxTrigger = (event) => res.setHeader('HX-Trigger', event);
+        res.hxRedirect = (url) => {
+            res.setHeader('HX-Redirect', url);
+            res.writeHead(200);
+            res.end();
+        };
+        res.hxRefresh = () => {
+            res.setHeader('HX-Refresh', 'true');
+            res.writeHead(200);
+            res.end();
+        };
+        res.hxLocation = (url) => res.setHeader('HX-Location', url);
+        res.hxPushUrl = (url) => res.setHeader('HX-Push-Url', url);
+        res.hxReplaceUrl = (url) => res.setHeader('HX-Replace-Url', url);
+        res.hxReswap = (swapType) => res.setHeader('HX-Reswap', swapType);
+        res.hxRetarget = (target) => res.setHeader('HX-Retarget', target);
+
+        next();
+    };
+};

package/lib/middlewares/i18n.js

@@ -0,0 +1,30 @@
+module.exports = function i18n(config = { defaultLocale: 'en', locales: {} }) {
+    return (req, res, next) => {
+        const langHeader = req.headers['accept-language'];
+        let locale = config.defaultLocale;
+        if (req.query && req.query.lang && config.locales[req.query.lang]) {
+            locale = req.query.lang;
+        } else if (langHeader) {
+            const parsed = langHeader.split(',')[0].split('-')[0];
+            if (config.locales[parsed]) {
+                locale = parsed;
+            }
+        }
+
+        req.locale = locale;
+        res.t = function (key, params = {}) {
+            const dict = config.locales[locale] || {};
+            let str = dict[key] || key;
+            for (const [k, v] of Object.entries(params)) {
+                str = str.replace(new RegExp(`{${k}}`, 'g'), v);
+            }
+            return str;
+        };
+
+        res.locals = res.locals || {};
+        res.locals.t = res.t;
+        res.locals.locale = locale;
+
+        next();
+    };
+};

package/lib/middlewares/rateLimit.js

@@ -0,0 +1,28 @@
+module.exports = function rateLimit({
+    windowMs = 60000,
+    max = 100,
+    message = 'Too many requests, please try again later.'
+} = {}) {
+    const hits = new Map();
+    return (req, res, next) => {
+        const ip = req.headers['x-forwarded-for'] || req.socket.remoteAddress || 'unknown';
+        const now = Date.now();
+        if (!hits.has(ip)) {
+            hits.set(ip, { count: 1, resetTime: now + windowMs });
+        } else {
+            const record = hits.get(ip);
+            if (now > record.resetTime) {
+                record.count = 1;
+                record.resetTime = now + windowMs;
+            } else {
+                record.count++;
+                if (record.count > max) {
+                    if (res.json) return res.json({ error: message }, 429);
+                    res.writeHead(429, { 'Content-Type': 'application/json' });
+                    return res.end(JSON.stringify({ error: message }));
+                }
+            }
+        }
+        next();
+    };
+};

package/lib/middlewares/redisCache.js

@@ -0,0 +1,23 @@
+module.exports = function redisCache(redisClient, { prefix = 'cache:', expire = 3600 } = {}) {
+    return async (req, res, next) => {
+        if (req.method !== 'GET') return next();
+        const key = prefix + req.url;
+        try {
+            const cached = await redisClient.get(key);
+            if (cached) {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                return res.end(cached);
+            }
+            const originalEnd = res.end;
+            res.end = function (chunk, encoding, callback) {
+                if (res.statusCode === 200 && chunk) {
+                    redisClient.set(key, chunk.toString(), { EX: expire }).catch(console.error);
+                }
+                originalEnd.call(res, chunk, encoding, callback);
+            };
+            next();
+        } catch {
+            next();
+        }
+    };
+};

package/lib/middlewares/requirePermission.js

@@ -0,0 +1,11 @@
+module.exports = function requirePermission(permission) {
+    return (req, res, next) => {
+        const perms = req.user && req.user.permissions ? req.user.permissions : [];
+        if (!perms.includes(permission)) {
+            if (res.json) return res.json({ error: `Forbidden: Missing required permission '${permission}'` }, 403);
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            return res.end(JSON.stringify({ error: `Forbidden: Missing required permission '${permission}'` }));
+        }
+        next();
+    };
+};

package/lib/middlewares/routeLocalization.js

@@ -0,0 +1,11 @@
+module.exports = function routeLocalization(supportedLocales = ['en']) {
+    return (req, res, next) => {
+        const parts = req.url.split('/');
+        if (parts.length > 1 && supportedLocales.includes(parts[1])) {
+            req.locale = parts[1];
+            req.url = '/' + parts.slice(2).join('/');
+            if (req.url === '') req.url = '/';
+        }
+        next();
+    };
+};

package/lib/middlewares/session.js

@@ -0,0 +1,16 @@
+module.exports = function session({ cookieName = 'session_id', maxAge = 86400000 } = {}) {
+    const crypto = require('crypto');
+    const store = new Map();
+    return (req, res, next) => {
+        let sessionId = req.cookies && req.cookies[cookieName];
+        if (!sessionId || !store.has(sessionId)) {
+            sessionId = crypto.randomUUID();
+            store.set(sessionId, { _createdAt: Date.now() });
+            if (res.cookie) {
+                res.cookie(cookieName, sessionId, { maxAge: maxAge / 1000, httpOnly: true });
+            }
+        }
+        req.session = store.get(sessionId);
+        next();
+    };
+};

package/lib/middlewares.js

@@ -0,0 +1,85 @@
+module.exports = function setupMiddlewares(opts, router, sanitizeHtml) {
+    if (opts.healthCheck) {
+        router.get('/health', (req, res) => {
+            const data = { status: 'ok', uptime: process.uptime(), timestamp: Date.now() };
+            if (res.json) {
+                return res.json(data);
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(data));
+        });
+    }
+
+    if (opts.logger) {
+        router.middlewares.unshift((req, res, next) => {
+            const start = Date.now();
+            res.on('finish', () => {
+                const duration = Date.now() - start;
+                console.log(`[${req.method}] ${req.url} - ${res.statusCode} (${duration}ms)`);
+            });
+            next();
+        });
+    }
+
+    if (opts.cors) {
+        router.middlewares.unshift((req, res, next) => {
+            const corsOpts = typeof opts.cors === 'object' ? opts.cors : {};
+            res.setHeader('Access-Control-Allow-Origin', corsOpts.origin || '*');
+            res.setHeader('Access-Control-Allow-Methods', corsOpts.methods || 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', corsOpts.headers || 'Content-Type, Authorization');
+
+            if (req.method === 'OPTIONS') {
+                res.writeHead(204);
+                return res.end();
+            }
+            next();
+        });
+    }
+
+    if (opts.helmet) {
+        router.middlewares.unshift((req, res, next) => {
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+            res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+            res.setHeader('X-XSS-Protection', '1; mode=block');
+            res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+            next();
+        });
+    }
+
+    if (opts.xss) {
+        if (!sanitizeHtml) throw new Error('Please install sanitize-html to use xss middleware');
+        router.middlewares.unshift((req, res, next) => {
+            const clean = (obj) => {
+                for (let key in obj) {
+                    if (typeof obj[key] === 'string') {
+                        obj[key] = sanitizeHtml(obj[key]);
+                    } else if (typeof obj[key] === 'object' && obj[key] !== null) {
+                        clean(obj[key]);
+                    }
+                }
+            };
+            if (req.body) clean(req.body);
+            if (req.query) clean(req.query);
+            if (req.params) clean(req.params);
+            next();
+        });
+    }
+
+    if (opts.session) {
+        const createSessionMiddleware = require('../session');
+        const sessionMiddleware = createSessionMiddleware(opts);
+        if (sessionMiddleware) {
+            router.middlewares.push(sessionMiddleware);
+        }
+    }
+
+    if (opts.compression) {
+        const compression = require('compression');
+        router.middlewares.unshift(compression(typeof opts.compression === 'object' ? opts.compression : {}));
+    }
+
+    if (opts.htmx) {
+        const htmxMiddleware = require('./middlewares/htmx');
+        router.middlewares.unshift(htmxMiddleware());
+    }
+};

package/lib/radix-router.js

@@ -0,0 +1,111 @@
+class TrieNode {
+    constructor() {
+        this.children = new Map();
+        this.paramChild = null;
+        this.paramName = null;
+        this.wildcardChild = null;
+        this.wildcardName = null;
+        this.handlers = {};
+    }
+}
+
+class RadixRouter {
+    constructor() {
+        this.root = new TrieNode();
+        this.staticRoutes = new Map();
+    }
+
+    insert(method, path, routeConfig) {
+        if (typeof path !== 'string') return;
+
+        if (typeof routeConfig === 'function') {
+            routeConfig = { handler: routeConfig };
+        }
+
+        let serializer = null;
+        if (routeConfig.schema && routeConfig.schema.response) {
+            try {
+                const fastJson = require('fast-json-stringify');
+                serializer = fastJson(routeConfig.schema.response);
+            } catch (e) {
+                console.error('[fullstx] Schema serializer compilation error:', e);
+            }
+        }
+
+        const finalConfig = { ...routeConfig, serializer };
+
+        if (!path.includes(':') && !path.includes('*')) {
+            this.staticRoutes.set(method + path, finalConfig);
+            return;
+        }
+
+        let current = this.root;
+        const segments = path.split('/').filter(Boolean);
+
+        for (let i = 0; i < segments.length; i++) {
+            const segment = segments[i];
+
+            if (segment.startsWith('*')) {
+                if (!current.wildcardChild) {
+                    current.wildcardChild = new TrieNode();
+                    current.wildcardChild.wildcardName = segment.length > 1 ? segment.slice(1) : 'wildcard';
+                }
+                current = current.wildcardChild;
+
+                break;
+            } else if (segment.startsWith(':')) {
+                if (!current.paramChild) {
+                    current.paramChild = new TrieNode();
+                    current.paramChild.paramName = segment.slice(1);
+                }
+                current = current.paramChild;
+            } else {
+                if (!current.children.has(segment)) {
+                    current.children.set(segment, new TrieNode());
+                }
+                current = current.children.get(segment);
+            }
+        }
+        current.handlers[method] = finalConfig;
+    }
+
+    lookup(method, path) {
+        if (typeof path !== 'string') return null;
+
+        const staticKey = method + path;
+        if (this.staticRoutes.has(staticKey)) {
+            const finalConfig = this.staticRoutes.get(staticKey);
+            return { routeConfig: finalConfig, handler: finalConfig.handler, params: {} };
+        }
+
+        const segments = path.split('/').filter(Boolean);
+        const params = {};
+
+        let current = this.root;
+
+        for (let i = 0; i < segments.length; i++) {
+            const segment = segments[i];
+
+            if (current.children.has(segment)) {
+                current = current.children.get(segment);
+            } else if (current.paramChild) {
+                current = current.paramChild;
+                params[current.paramName] = decodeURIComponent(segment);
+            } else if (current.wildcardChild) {
+                current = current.wildcardChild;
+                params[current.wildcardName] = decodeURIComponent(segments.slice(i).join('/'));
+                break;
+            } else {
+                return null;
+            }
+        }
+
+        if (current.handlers[method]) {
+            const finalConfig = current.handlers[method];
+            return { routeConfig: finalConfig, handler: finalConfig.handler, params };
+        }
+        return null;
+    }
+}
+
+module.exports = RadixRouter;

package/lib/request.js

@@ -0,0 +1,81 @@
+const url = require('url');
+
+const REQUEST_POOL = [];
+const POOL_SIZE = 1000;
+
+class FullstxRequest {
+    constructor() {
+        this.raw = null;
+        this.body = {};
+        this.query = {};
+        this.params = {};
+        this.cookies = {};
+        this.pathname = '';
+        this.route = null;
+    }
+
+    init(rawReq) {
+        this.raw = rawReq;
+        this.body = {};
+        this.query = {};
+        this.params = {};
+        this.cookies = {};
+        this.route = null;
+
+        const parsedUrl = url.parse(this.raw.url, true);
+
+        this.query = parsedUrl.query;
+        this.pathname = parsedUrl.pathname;
+
+        const rc = this.raw.headers.cookie;
+        if (rc) {
+            rc.split(';').forEach((cookie) => {
+                const parts = cookie.split('=');
+                this.cookies[parts.shift().trim()] = decodeURI(parts.join('='));
+            });
+        }
+    }
+
+    get url() {
+        return this.raw.url;
+    }
+    get method() {
+        return this.raw.method;
+    }
+    get headers() {
+        return this.raw.headers;
+    }
+    get socket() {
+        return this.raw.socket;
+    }
+
+    on(event, listener) {
+        this.raw.on(event, listener);
+        return this;
+    }
+}
+
+function getRequest(rawReq) {
+    if (REQUEST_POOL.length > 0) {
+        const req = REQUEST_POOL.pop();
+        req.init(rawReq);
+        return req;
+    }
+    const req = new FullstxRequest();
+    req.init(rawReq);
+    return req;
+}
+
+function releaseRequest(req) {
+    req.raw = null;
+    req.route = null;
+    if (REQUEST_POOL.length < POOL_SIZE) {
+        REQUEST_POOL.push(req);
+    }
+}
+
+module.exports = {
+    FullstxRequest,
+    getRequest,
+    releaseRequest
+};