hapta 1.0.5 → 1.0.7

package/bun.lock

@@ -4,9 +4,10 @@
   "workspaces": {
     "": {
       "dependencies": {
+        "hapta": "^1.0.5",
         "jsonwebtoken": "^9.0.2",
-        "pocketbase": "^0.26.1",
-        "zod": "^4.0.5",
+        "pocketbase": "latest",
+        "zod": "latest",
       },
     },
   },
@@ -15,6 +16,8 @@
 
     "ecdsa-sig-formatter": ["ecdsa-sig-formatter@1.0.11", "", { "dependencies": { "safe-buffer": "^5.0.1" } }, "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ=="],
 
+    "hapta": ["hapta@1.0.5", "", { "dependencies": { "jsonwebtoken": "^9.0.2", "pocketbase": "latest", "zod": "latest" }, "bin": { "hapta": "index.ts" } }, "sha512-yvow9I/Vbnusn24clSeMUtIo036ImE/i3p5a6XsWDJgUDbl3xQkxY5+/VrkyQC7zwgQiUK5XluZPn2HkMFk9gg=="],
+
     "jsonwebtoken": ["jsonwebtoken@9.0.3", "", { "dependencies": { "jws": "^4.0.1", "lodash.includes": "^4.3.0", "lodash.isboolean": "^3.0.3", "lodash.isinteger": "^4.0.4", "lodash.isnumber": "^3.0.3", "lodash.isplainobject": "^4.0.6", "lodash.isstring": "^4.0.1", "lodash.once": "^4.0.0", "ms": "^2.1.1", "semver": "^7.5.4" } }, "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g=="],
 
     "jwa": ["jwa@2.0.1", "", { "dependencies": { "buffer-equal-constant-time": "^1.0.1", "ecdsa-sig-formatter": "1.0.11", "safe-buffer": "^5.0.1" } }, "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg=="],
@@ -37,12 +40,12 @@
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
-    "pocketbase": ["pocketbase@0.26.5", "", {}, "sha512-SXcq+sRvVpNxfLxPB1C+8eRatL7ZY4o3EVl/0OdE3MeR9fhPyZt0nmmxLqYmkLvXCN9qp3lXWV/0EUYb3MmMXQ=="],
+    "pocketbase": ["pocketbase@0.26.8", "", {}, "sha512-aQ/ewvS7ncvAE8wxoW10iAZu6ElgbeFpBhKPnCfvRovNzm2gW8u/sQNPGN6vNgVEagz44kK//C61oKjfa+7Low=="],
 
     "safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
 
     "semver": ["semver@7.7.3", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q=="],
 
-    "zod": ["zod@4.3.5", "", {}, "sha512-k7Nwx6vuWx1IJ9Bjuf4Zt1PEllcwe7cls3VNzm4CQ1/hgtFUK2bRNG3rvnpPUhFjmqJKAKtjV576KnUkHocg/g=="],
+    "zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
   }
 }

package/index.ts

@@ -52,7 +52,65 @@ interface RouteHandler {
     PATCH?: (ctx: Context, db: DatabaseService) => Promise<Response>;
     DELETE?: (ctx: Context, db: DatabaseService) => Promise<Response>;
     onError?: (request: Request, error: any) => Promise<Response> | Response;
-    [key: string]: any; // Allow for other properties
+    [key: string]: any;
+}
+
+// --- CORS Configuration ---
+interface CorsConfig {
+    origins: string[] | "*";
+    methods: string[];
+    allowedHeaders: string[];
+    exposedHeaders: string[];
+    credentials: boolean;
+    maxAge: number;
+}
+
+const defaultCorsConfig: CorsConfig = {
+    origins: config.Server.origin === "*" ? "*" : [config.Server.origin],
+    methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"],
+    allowedHeaders: ["Content-Type", "Authorization", "X-Requested-With", "Accept", "Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers"],
+    exposedHeaders: ["Content-Range", "X-Content-Range"],
+    credentials: true,
+    maxAge: 86400,
+};
+
+// Helper to check if origin is allowed
+function isOriginAllowed(origin: string | null, corsConfig: CorsConfig): boolean {
+    if (!origin) return false;
+    if (corsConfig.origins === "*") return true;
+    if (Array.isArray(corsConfig.origins)) {
+        return corsConfig.origins.includes(origin);
+    }
+    return false;
+}
+
+// Build CORS headers
+function buildCorsHeaders(origin: string | null, corsConfig: CorsConfig): Record<string, string> {
+    const headers: Record<string, string> = {};
+    
+    if (origin && isOriginAllowed(origin, corsConfig)) {
+        headers["Access-Control-Allow-Origin"] = origin;
+    } else if (corsConfig.origins === "*") {
+        headers["Access-Control-Allow-Origin"] = "*";
+    } else if (Array.isArray(corsConfig.origins) && corsConfig.origins.length > 0) {
+        // Use first origin as fallback
+        headers["Access-Control-Allow-Origin"] = corsConfig.origins[0];
+    }
+    
+    if (corsConfig.credentials) {
+        headers["Access-Control-Allow-Credentials"] = "true";
+    }
+    
+    headers["Access-Control-Allow-Methods"] = corsConfig.methods.join(", ");
+    headers["Access-Control-Allow-Headers"] = corsConfig.allowedHeaders.join(", ");
+    
+    if (corsConfig.exposedHeaders.length > 0) {
+        headers["Access-Control-Expose-Headers"] = corsConfig.exposedHeaders.join(", ");
+    }
+    
+    headers["Access-Control-Max-Age"] = corsConfig.maxAge.toString();
+    
+    return headers;
 }
 
 // --- Server Configuration Builder ---
@@ -106,24 +164,25 @@ async function createServeConfig(): Promise<Serve> {
     return {
         port: config.port,
         async fetch(req: Request) {
+            const url = new URL(req.url);
+            const origin = req.headers.get("origin");
+            const corsHeaders = buildCorsHeaders(origin, defaultCorsConfig);
+
             // Handle CORS preflight
             if (req.method === "OPTIONS") {
                 return new Response(null, {
                     status: 204,
-                    headers: {
-                        "Access-Control-Allow-Origin": config.origin,
-                        "Access-Control-Allow-Methods": "OPTIONS, GET, POST, PUT, PATCH, DELETE",
-                        "Access-Control-Allow-Headers": "Content-Type, Authorization",
-                        "Access-Control-Max-Age": "86400",
-                    },
+                    headers: corsHeaders,
                 });
             }
 
-            const url = new URL(req.url);
             const routeMatch = router.match(url.href);
 
             if (!routeMatch) {
-                return new Response("404 Not Found", { status: 404 });
+                return new Response("404 Not Found", { 
+                    status: 404,
+                    headers: corsHeaders 
+                });
             }
 
             const routeHandler = routeHandlers.get(routeMatch.name);
@@ -131,7 +190,10 @@ async function createServeConfig(): Promise<Serve> {
             const schema = schemas.get(routeMatch.name);
 
             if (!routeHandler) {
-                return new Response(`Route handler for ${routeMatch.name} not found.`, { status: 404 });
+                return new Response(`Route handler for ${routeMatch.name} not found.`, { 
+                    status: 404,
+                    headers: corsHeaders 
+                });
             }
 
             try {
@@ -143,8 +205,22 @@ async function createServeConfig(): Promise<Serve> {
                 // Run middleware if exists
                 if (middleware) {
                     const result = await middleware(context);
-                    if (result instanceof Response) return result;
-                    if (result === false) return new Response("Forbidden", { status: 403 });
+                    if (result instanceof Response) {
+                        // Add CORS headers to middleware response
+                        const responseHeaders = new Headers(result.headers);
+                        for (const [key, value] of Object.entries(corsHeaders)) {
+                            responseHeaders.set(key, value);
+                        }
+                        return new Response(result.body, {
+                            status: result.status,
+                            statusText: result.statusText,
+                            headers: responseHeaders,
+                        });
+                    }
+                    if (result === false) return new Response("Forbidden", { 
+                        status: 403,
+                        headers: corsHeaders 
+                    });
                 }
 
                 // Schema validation
@@ -157,6 +233,11 @@ async function createServeConfig(): Promise<Serve> {
                     
                     for (const key of ["body", "query", "headers"] as const) {
                         if (validation[key] && !validation[key]?.success) {
+                            routeHandler.onError && routeHandler.onError(req, {
+                                name: "ValidationError",
+                                message: `Invalid ${key} format`,
+                                details: validation[key]?.error.flatten(),
+                            });
                             return new Response(
                                 JSON.stringify({ 
                                     success: false, 
@@ -164,7 +245,10 @@ async function createServeConfig(): Promise<Serve> {
                                 }), 
                                 { 
                                     status: 400, 
-                                    headers: { "Content-Type": "application/json" } 
+                                    headers: {
+                                        "Content-Type": "application/json",
+                                        ...corsHeaders
+                                    } 
                                 }
                             );
                         }
@@ -174,49 +258,103 @@ async function createServeConfig(): Promise<Serve> {
                 // Get method-specific handler
                 const method = req.method.toUpperCase();
                 const methodHandler = routeHandler[method] || routeHandler.default;
+                console.log(`➡️ ${method} ${url.pathname} -> ${routeMatch.name}`);
                 
                 if (!methodHandler) {
                     return new Response(
                         `Method ${method} not allowed for ${routeMatch.name}`, 
-                        { status: 405 }
+                        { 
+                            status: 405,
+                            headers: {
+                                "Allow": Object.keys(routeHandler)
+                                    .filter(key => typeof routeHandler[key] === 'function')
+                                    .join(", "),
+                                ...corsHeaders
+                            }
+                        }
                     );
                 }
 
                 // Execute the route handler
-                return await methodHandler(context, db);
+                const response = await methodHandler(context, db);
+                
+                // Add CORS headers to the response
+                if (response instanceof Response) {
+                    const responseHeaders = new Headers(response.headers);
+                    for (const [key, value] of Object.entries(corsHeaders)) {
+                        responseHeaders.set(key, value);
+                    }
+                    return new Response(response.body, {
+                        status: response.status,
+                        statusText: response.statusText,
+                        headers: responseHeaders,
+                    });
+                }
+                
+                return response;
             } catch (err) {
                 console.error(`❌ Error handling ${url.pathname}:`, err);
                 
                 // Check if route handler has custom error handler
                 if (routeHandler.onError) {
                     try {
-                        return await routeHandler.onError(req, err);
+                        const errorResponse = await routeHandler.onError(req, err);
+                        // Add CORS headers to error response
+                        if (errorResponse instanceof Response) {
+                            const responseHeaders = new Headers(errorResponse.headers);
+                            for (const [key, value] of Object.entries(corsHeaders)) {
+                                responseHeaders.set(key, value);
+                            }
+                            return new Response(errorResponse.body, {
+                                status: errorResponse.status,
+                                statusText: errorResponse.statusText,
+                                headers: responseHeaders,
+                            });
+                        }
                     } catch (errorHandlerErr) {
                         console.error(`❌ Error handler also failed:`, errorHandlerErr);
                     }
                 }
                 
-                return new Response("Internal Server Error", { status: 500 });
+                return new Response("Internal Server Error", { 
+                    status: 500,
+                    headers: corsHeaders 
+                });
             }
         },
         error(error) {
             const url = new URL(error.request.url);
+            const origin = error.request.headers.get("origin");
+            const corsHeaders = buildCorsHeaders(origin, defaultCorsConfig);
+            
             const routeMatch = router.match(url.href);
             
             if (routeMatch) {
                 const routeHandler = routeHandlers.get(routeMatch.name);
-                // Use the route's onError if available
                 if (routeHandler && typeof routeHandler.onError === "function") {
                     try {
-                        return routeHandler.onError(error.request, error);
+                        const errorResponse = routeHandler.onError(error.request, error);
+                        if (errorResponse instanceof Response) {
+                            const responseHeaders = new Headers(errorResponse.headers);
+                            for (const [key, value] of Object.entries(corsHeaders)) {
+                                responseHeaders.set(key, value);
+                            }
+                            return new Response(errorResponse.body, {
+                                status: errorResponse.status,
+                                statusText: errorResponse.statusText,
+                                headers: responseHeaders,
+                            });
+                        }
                     } catch (e) {
                         console.error("❌ Route error handler failed:", e);
                     }
                 }
             }
             
-            // Default error response
-            return new Response("Something went wrong!", { status: 500 });
+            return new Response("Something went wrong!", { 
+                status: 500,
+                headers: corsHeaders 
+            });
         },
     };
 }
@@ -283,7 +421,23 @@ async function buildRequestContext(req: Request, headers: Headers): Promise<Cont
 
     return {
         principal: { ...principal, isAuthenticated },
-        services: {},
+        services: {
+            async Authenticate(options) {
+                const  { type } = options;
+                if (type === "passwordAuth") {
+                    const { emailOrUsername, password } = options  
+                    const login  = await pb.collection("users").authWithPassword(emailOrUsername, password) as unknown as Promise<{ record: any }>; 
+                    // make a token 
+                    const token = jwt.sign({ id: (await login).record.id, username: (await login).record.username } , config.Server.JWT_Secret, { expiresIn: '1h' });
+                    
+                    if (login) {
+                        return { isAuthenticated: true, token, ...(await login).record };
+                    } else {
+                        return { isAuthenticated: false };
+                    }
+                }
+             },
+        },
         metadata: {
             requestID: crypto.randomUUID(),
             timestamp: new Date(),
@@ -296,11 +450,6 @@ async function buildRequestContext(req: Request, headers: Headers): Promise<Cont
             return Response.json(value, {
                 ...(status && { status }),
                 ...(statusText && { statusText }),
-                headers: {
-                    "Access-Control-Allow-Origin": config.origin,
-                    "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-                    "Access-Control-Allow-Headers": "Content-Type, Authorization"
-                }
             });
         },
         html: (value: string, status?: number, statusText?: string) => {
@@ -309,9 +458,6 @@ async function buildRequestContext(req: Request, headers: Headers): Promise<Cont
                 ...(statusText && { statusText }),
                 headers: {
                     "Content-Type": "text/html",
-                    "Access-Control-Allow-Origin": config.origin,
-                    "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-                    "Access-Control-Allow-Headers": "Content-Type, Authorization"
                 }
             });
         }
@@ -321,6 +467,8 @@ async function buildRequestContext(req: Request, headers: Headers): Promise<Cont
 // --- Initial Server Start --- 
 server = Bun.serve(await createServeConfig());
 console.log(`🚀 Hapta listening at http://localhost:${server.port}`);
+console.log(`🌐 CORS configured for origins: ${defaultCorsConfig.origins === "*" ? "* (all)" : defaultCorsConfig.origins.join(", ")}`);
+console.log(`🔧 Allowed methods: ${defaultCorsConfig.methods.join(", ")}`);
 watchFiles();
 
 const Hapta = {

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "hapta",
   "bin": {
-    "hapta":"./index.ts"
+    "hapta": "./index.ts"
   },
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "modular, scalable, and feature-rich backend framework designed to extend Pocketbase with authentication, schema validation, caching, and tenant-based service orchestration.",
   "dependencies": {
+    "hapta": "^1.0.5",
     "jsonwebtoken": "^9.0.2",
     "pocketbase": "latest",
     "zod": "latest"
   }
-}
+}

package/src/core/config.ts

@@ -15,7 +15,7 @@ export interface AppConfig {
     Server: {
         port: number;
         origin?: string;
-        JWT_SECRET: String,
+        JWT_Secret: String,
     } 
     }