gorsee 0.2.3 → 0.2.5

package/src/server/ws.ts

@@ -1,56 +0,0 @@
-// WebSocket support for real-time features
-// Routes can export a `ws` handler for WebSocket connections
-
-export interface WSContext {
-  send(data: string | ArrayBuffer): void
-  close(code?: number, reason?: string): void
-  id: string
-}
-
-export type WSHandler = {
-  open?: (ws: WSContext) => void
-  message?: (ws: WSContext, data: string | ArrayBuffer) => void
-  close?: (ws: WSContext) => void
-}
-
-// Room-based pub/sub for common real-time patterns
-const rooms = new Map<string, Set<WSContext>>()
-
-export function joinRoom(room: string, ws: WSContext): void {
-  let members = rooms.get(room)
-  if (!members) {
-    members = new Set()
-    rooms.set(room, members)
-  }
-  members.add(ws)
-}
-
-export function leaveRoom(room: string, ws: WSContext): void {
-  const members = rooms.get(room)
-  if (!members) return
-  members.delete(ws)
-  if (members.size === 0) rooms.delete(room)
-}
-
-export function broadcastToRoom(room: string, data: string, exclude?: WSContext): void {
-  const members = rooms.get(room)
-  if (!members) return
-  for (const ws of members) {
-    if (ws === exclude) continue
-    try { ws.send(data) } catch {}
-  }
-}
-
-export function getRoomSize(room: string): number {
-  return rooms.get(room)?.size ?? 0
-}
-
-let wsIdCounter = 0
-
-export function createWSContext(ws: { send(data: string | ArrayBuffer): void; close(code?: number, reason?: string): void }): WSContext {
-  return {
-    send: (data) => ws.send(data),
-    close: (code, reason) => ws.close(code, reason),
-    id: `ws_${++wsIdCounter}`,
-  }
-}

package/src/server-entry.ts

@@ -1,36 +0,0 @@
-// Explicit server-facing public entrypoint.
-// Use this in loaders, middleware, API routes, and server services.
-
-export * from "./server/index.ts"
-export {
-  createAuth,
-  createMemorySessionStore,
-  createNamespacedSessionStore,
-  createRedisSessionStore,
-  createSQLiteSessionStore,
-  type AuthConfig,
-  type Session,
-  type SessionStore,
-} from "./auth/index.ts"
-export { createDB, type DB, runMigrations, createMigration, type MigrationResult } from "./db/index.ts"
-export {
-  securityHeaders,
-  type SecurityConfig,
-  csrfProtection,
-  generateCSRFToken,
-  validateCSRFToken,
-  createRateLimiter,
-  type RateLimiter,
-  cors,
-  type CORSOptions,
-} from "./security/index.ts"
-export { env, getPublicEnv, loadEnv } from "./env/index.ts"
-export { log, setLogLevel } from "./log/index.ts"
-export {
-  createNodeRedisLikeClient,
-  createIORedisLikeClient,
-  deleteExpiredRedisKeys,
-  type RedisLikeClient,
-  type NodeRedisClientLike,
-  type IORedisClientLike,
-} from "./server/redis-client.ts"

package/src/testing/index.ts

@@ -1,74 +0,0 @@
-// Testing utilities for Gorsee.js applications
-
-import { createContext, type Context, type MiddlewareFn, runMiddlewareChain } from "../server/middleware.ts"
-import { renderToString, ssrJsx } from "../runtime/server.ts"
-
-/** Create a mock request for testing */
-export function createTestRequest(
-  path: string,
-  options: {
-    method?: string
-    headers?: Record<string, string>
-    body?: string | Record<string, unknown>
-  } = {},
-): Request {
-  const { method = "GET", headers = {}, body } = options
-  const url = `http://localhost${path}`
-  const init: RequestInit = { method, headers }
-  if (body) {
-    if (typeof body === "object") {
-      init.body = JSON.stringify(body)
-      ;(init.headers as Record<string, string>)["Content-Type"] = "application/json"
-    } else {
-      init.body = body
-    }
-  }
-  return new Request(url, init)
-}
-
-/** Create a test context for middleware/loader testing */
-export function createTestContext(
-  path: string,
-  options: {
-    method?: string
-    headers?: Record<string, string>
-    params?: Record<string, string>
-    body?: string | Record<string, unknown>
-  } = {},
-): Context {
-  const { params = {}, ...reqOpts } = options
-  const request = createTestRequest(path, reqOpts)
-  return createContext(request, params)
-}
-
-/** Run a middleware function with a test context and handler */
-export async function runTestMiddleware(
-  middleware: MiddlewareFn,
-  ctx: Context,
-  handler?: () => Promise<Response>,
-): Promise<Response> {
-  const defaultHandler = async () => new Response("OK")
-  return runMiddlewareChain([middleware], ctx, handler ?? defaultHandler)
-}
-
-/** Render a component to HTML string for snapshot/assertion testing */
-export function renderComponent(
-  component: Function,
-  props: Record<string, unknown> = {},
-): string {
-  const vnode = ssrJsx(component as any, props)
-  return renderToString(vnode)
-}
-
-/** Test a loader function directly */
-export async function testLoader<T>(
-  loader: (ctx: Context) => Promise<T>,
-  path: string,
-  options: {
-    params?: Record<string, string>
-    headers?: Record<string, string>
-  } = {},
-): Promise<T> {
-  const ctx = createTestContext(path, options)
-  return loader(ctx)
-}

package/src/types/index.ts

@@ -1,4 +0,0 @@
-export { SafeSQL, type SafeSQLValue } from "./safe-sql.ts"
-export { SafeHTML, sanitize } from "./safe-html.ts"
-export { SafeURL, validateURL } from "./safe-url.ts"
-export { type UserInput, validate } from "./user-input.ts"

package/src/types/safe-html.ts

@@ -1,32 +0,0 @@
-declare const __safeHTMLBrand: unique symbol
-
-export type SafeHTMLValue = string & { readonly [__safeHTMLBrand]: true }
-
-const ESCAPE_MAP: Record<string, string> = {
-  "&": "&amp;",
-  "<": "&lt;",
-  ">": "&gt;",
-  '"': "&quot;",
-  "'": "&#x27;",
-}
-
-const ESCAPE_RE = /[&<>"']/g
-
-export function sanitize(raw: string): SafeHTMLValue {
-  const escaped = raw.replace(ESCAPE_RE, (ch) => ESCAPE_MAP[ch] ?? ch)
-  return escaped as SafeHTMLValue
-}
-
-export function SafeHTML(
-  strings: TemplateStringsArray,
-  ...values: unknown[]
-): SafeHTMLValue {
-  const parts: string[] = []
-  for (let i = 0; i < strings.length; i++) {
-    parts.push(strings[i]!)
-    if (i < values.length) {
-      parts.push(sanitize(String(values[i])) as string)
-    }
-  }
-  return parts.join("") as SafeHTMLValue
-}

package/src/types/safe-sql.ts

@@ -1,28 +0,0 @@
-declare const __safeSQLBrand: unique symbol
-
-export interface SafeSQLValue {
-  readonly text: string
-  readonly params: readonly unknown[]
-  readonly [__safeSQLBrand]: true
-}
-
-export function SafeSQL(
-  strings: TemplateStringsArray,
-  ...values: unknown[]
-): SafeSQLValue {
-  const parts: string[] = []
-  const params: unknown[] = []
-
-  for (let i = 0; i < strings.length; i++) {
-    parts.push(strings[i]!)
-    if (i < values.length) {
-      params.push(values[i])
-      parts.push("?")
-    }
-  }
-
-  return {
-    text: parts.join(""),
-    params,
-  } as unknown as SafeSQLValue
-}

package/src/types/safe-url.ts

@@ -1,40 +0,0 @@
-declare const __safeURLBrand: unique symbol
-
-export type SafeURLValue = string & { readonly [__safeURLBrand]: true }
-
-const ALLOWED_PROTOCOLS = ["http:", "https:", "mailto:"]
-const DANGEROUS_PROTOCOLS = ["javascript:", "data:", "vbscript:", "blob:"]
-
-export function validateURL(raw: string): SafeURLValue {
-  // Check dangerous protocols before URL parsing (handles case-insensitive)
-  const lower = raw.trim().toLowerCase()
-  for (const proto of DANGEROUS_PROTOCOLS) {
-    if (lower.startsWith(proto)) {
-      throw new Error(`[GORSEE E005] Dangerous URL protocol: "${proto}" is not allowed`)
-    }
-  }
-
-  let url: URL
-  try {
-    url = new URL(raw)
-  } catch {
-    // Relative URLs are allowed (they don't parse as absolute URLs)
-    return raw as SafeURLValue
-  }
-
-  if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
-    throw new Error(
-      `[GORSEE E005] Disallowed URL protocol: "${url.protocol}". Allowed: ${ALLOWED_PROTOCOLS.join(", ")}`
-    )
-  }
-
-  return raw as SafeURLValue
-}
-
-export function SafeURL(
-  strings: TemplateStringsArray,
-  ...values: unknown[]
-): SafeURLValue {
-  const raw = String.raw(strings, ...values.map(String))
-  return validateURL(raw)
-}

package/src/types/user-input.ts

@@ -1,12 +0,0 @@
-declare const __userInputBrand: unique symbol
-
-export type UserInput<T> = T & { readonly [__userInputBrand]: true }
-
-export interface ValidationSchema<T> {
-  parse(raw: unknown): T
-}
-
-export function validate<T>(schema: ValidationSchema<T>, raw: unknown): UserInput<T> {
-  const parsed = schema.parse(raw)
-  return parsed as UserInput<T>
-}

package/src/unsafe/index.ts

@@ -1,18 +0,0 @@
-import type { SafeSQLValue } from "../types/safe-sql.ts"
-import type { SafeHTMLValue } from "../types/safe-html.ts"
-
-/**
- * DANGER: Bypasses SQL safety. Only use when you know the string is safe.
- * This function exists as an explicit escape hatch -- its name signals danger.
- */
-export function unsafeSQL(raw: string): SafeSQLValue {
-  return { text: raw, params: [] } as unknown as SafeSQLValue
-}
-
-/**
- * DANGER: Bypasses HTML sanitization. Only use for trusted content.
- * This function exists as an explicit escape hatch -- its name signals danger.
- */
-export function unsafeHTML(raw: string): SafeHTMLValue {
-  return raw as unknown as SafeHTMLValue
-}