jskelet 0.3.4 → 0.3.5

package/CHANGELOG.md

@@ -30,12 +30,11 @@ one is listed under a **Breaking** heading.
 - Top-level `logs` config for persistent sinks: daily NDJSON files
   (`logs.file`) and batched S3 PutObject (`logs.s3`) with embedded SigV4 — no
   `@aws-sdk` dependency. `kinds` selects `http` / `event` / `error`; `console`
-  toggles runtime stdout lines. `JSKELET_LOG_BUCKET` (and `logs.s3.bucket`) may
-  be a plain bucket or a `bucket/prefix/…` path. `JSKELET_S3_API_URL` sets the
-  R2/MinIO endpoint (region defaults to `auto`). Missing credentials warn and
-  disable the S3 sink without taking the site down. Env: `JSKELET_LOG_BUCKET`,
-  `JSKELET_S3_ACCESS_KEY_ID`, `JSKELET_S3_SECRET_ACCESS_KEY`,
-  `JSKELET_S3_SESSION_TOKEN`, `JSKELET_S3_REGION`, `JSKELET_S3_API_URL`.
+  toggles runtime stdout lines. `JSKELET_LOG_BUCKET` / `JSKELET_S3_BUCKET`
+  (+ optional `JSKELET_S3_KEY_PREFIX`) may be a plain bucket or a
+  `bucket/prefix/…` path; with credentials present the sink turns on without
+  `enabled: true`. `JSKELET_S3_API_URL` sets the S3-compatible endpoint
+  (region defaults to `auto`). Env: `JSKELET_LOG_BUCKET`, `JSKELET_S3_*`.
 - Admin panel pages under `/_jskelet/admin`: Overview, Cache, Routes, Views,
   Logs and System. Configurable `allowIps` (exact or CIDR), `blockBots` (default
   on — crawler UAs get 404 before login), and `logSize`. Live Logs use an

package/docs/07-yapilandirma.md

@@ -768,8 +768,8 @@ mevcut davranışını korur. Açıldığında HTTP access log ile framework ola
 | `s3.enabled` | `boolean` | `false` | S3 batch PutObject sink'i |
 | `s3.bucket` | `string \| null` | `null` | Bucket ya da `bucket/prefix/…` yolu; `JSKELET_LOG_BUCKET` ezer |
 | `s3.prefix` | `string` | `"jskelet/logs/"` | Nesne anahtarı öneki (yolda verilmediyse) |
-| `s3.region` | `string \| null` | `null` | Bölge; verilmezse `JSKELET_S3_REGION`, endpoint varken `auto` |
-| `s3.endpoint` | `string \| null` | `null` | R2 / MinIO API adresi; `JSKELET_S3_API_URL` ezer |
+| `s3.region` | `string \| null` | `"auto"` | Bölge; verilmezse `JSKELET_S3_REGION`, yoksa `auto` |
+| `s3.endpoint` | `string \| null` | `null` | S3-uyumlu API adresi; `JSKELET_S3_API_URL` ezer |
 | `s3.flushIntervalMs` | `number` | `5000` | Batch flush aralığı |
 | `s3.maxBatch` | `number` | `100` | Bu kadar satırda erken flush |
 
@@ -975,12 +975,14 @@ basılmaz.
 | `JSKELET_SECRET` | `jskelet/cookies` | — | İmzalı cookie sırrı. `security.cookieSecret` verilmediğinde buradan okunur; ikisi de yoksa imzalı cookie API'si hata verir. [12](./12-panel-ve-oturum.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | Ayarlıysa token taşımayan her isteğe 404 döner. Isıtma token'ı çerez olarak taşır. [09](./09-dev-araclari.md) |
 | `JSKELET_ADMIN` | `createApp` | — | Ayarlıysa yönetim panelini açar; `0` config'te açık olan paneli kapatır. Env config'i ezer, çünkü panel genelde bir arıza sırasında tek seferlik açılır. [06](./06-cache.md) |
-| `JSKELET_LOG_BUCKET` | `logs.s3` | — | S3 bucket ya da `ayberkenis/jskelet/logs` gibi `bucket/prefix` yolu; `logs.s3.bucket`'ı ezer (`JSKELET_S3_BUCKET` yedek ad) |
-| `JSKELET_S3_ACCESS_KEY_ID` | `logs.s3` | — | S3 PutObject imzası. Yoksa ve `s3.enabled` ise sink kapanır |
-| `JSKELET_S3_SECRET_ACCESS_KEY` | `logs.s3` | — | S3 imza sırrı |
-| `JSKELET_S3_SESSION_TOKEN` | `logs.s3` | — | Geçici credential'lar için isteğe bağlı |
-| `JSKELET_S3_REGION` | `logs.s3` | — | `logs.s3.region` verilmezse; endpoint varken varsayılan `auto` |
-| `JSKELET_S3_API_URL` | `logs.s3` | — | R2 / MinIO endpoint; `logs.s3.endpoint`'i ezer |
+| `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log hedefi: bucket ya da `bucket/prefix` yolu. Credential ile birlikte varsa sink otomatik açılır |
+| `JSKELET_S3_BUCKET` | `logs.s3` | — | `JSKELET_LOG_BUCKET` yoksa bucket; `JSKELET_S3_KEY_PREFIX` ile birleşir |
+| `JSKELET_S3_KEY_PREFIX` | `logs.s3` | — | `JSKELET_S3_BUCKET` ile kullanılır (`bucket/prefix`) |
+| `JSKELET_S3_ACCESS_KEY_ID` | `logs.s3` | — | PutObject imzası |
+| `JSKELET_S3_SECRET_ACCESS_KEY` | `logs.s3` | — | İmza sırrı (`JSKELET_S3_ACCESS_SECRET` yedek ad) |
+| `JSKELET_S3_SESSION_TOKEN` | `logs.s3` | — | Geçici credential için isteğe bağlı |
+| `JSKELET_S3_REGION` | `logs.s3` | `auto` | Verilmezse `auto` |
+| `JSKELET_S3_API_URL` | `logs.s3` | — | S3-uyumlu endpoint; `logs.s3.endpoint`'i ezer |
 | `JSKELET_CLOUDFLARE_KEY` | Cloudflare cache yüzeyi | — | API token. Verilene kadar CDN purge'ü ve edge analitiği kapalıdır; config'teki `apiToken`'ı ezer. Token hiçbir cevapta dönmez. [06](./06-cache.md) |
 | `JSKELET_CLOUDFLARE_ZONE_ID` | Cloudflare cache yüzeyi | — | Zone kimliği. Token'la birlikte verilmedikçe hiçbir Cloudflare ucu çağrılmaz |
 | `JSKELET_CLOUDFLARE_HOSTNAME` | Cloudflare cache yüzeyi | — | Purge URL'lerinin kökü. Panel iç bir adresten açılıyorsa gerekir |

package/docs/en/07-configuration.md

@@ -784,8 +784,8 @@ events (`event` / `error`) are written as NDJSON lines to a file and/or S3.
 | `s3.enabled` | `boolean` | `false` | S3 batch PutObject sink |
 | `s3.bucket` | `string \| null` | `null` | Bucket or a `bucket/prefix/…` path; `JSKELET_LOG_BUCKET` overrides |
 | `s3.prefix` | `string` | `"jskelet/logs/"` | Object key prefix (when not given in the path) |
-| `s3.region` | `string \| null` | `null` | Region; falls back to `JSKELET_S3_REGION`, or `auto` when an endpoint is set |
-| `s3.endpoint` | `string \| null` | `null` | R2 / MinIO API URL; `JSKELET_S3_API_URL` overrides |
+| `s3.region` | `string \| null` | `"auto"` | Region; falls back to `JSKELET_S3_REGION`, otherwise `auto` |
+| `s3.endpoint` | `string \| null` | `null` | S3-compatible API URL; `JSKELET_S3_API_URL` overrides |
 | `s3.flushIntervalMs` | `number` | `5000` | Batch flush interval |
 | `s3.maxBatch` | `number` | `100` | Flush early after this many lines |
 
@@ -995,12 +995,14 @@ and no warning is printed.
 | `JSKELET_SECRET` | `jskelet/cookies` | — | The signed cookie secret. Read when `security.cookieSecret` is not set; if neither exists, the signed cookie API throws. [12](./12-dashboards-and-sessions.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | If set, every request without a token gets a 404. Prewarming carries the token as a cookie. [09](./09-dev-tools.md) |
 | `JSKELET_ADMIN` | `createApp` | — | When set, turns the admin panel on; `0` turns off a panel enabled in the config. The env wins because the panel is usually opened once during an incident. [06](./06-caching.md) |
-| `JSKELET_LOG_BUCKET` | `logs.s3` | — | S3 bucket or a `bucket/prefix` path like `ayberkenis/jskelet/logs`; overrides `logs.s3.bucket` (`JSKELET_S3_BUCKET` is an alias) |
-| `JSKELET_S3_ACCESS_KEY_ID` | `logs.s3` | — | Signs S3 PutObject. Missing when `s3.enabled` disables the sink |
-| `JSKELET_S3_SECRET_ACCESS_KEY` | `logs.s3` | — | S3 signing secret |
+| `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log target: bucket or `bucket/prefix` path. With credentials, the sink turns on automatically |
+| `JSKELET_S3_BUCKET` | `logs.s3` | — | Bucket when `JSKELET_LOG_BUCKET` is unset; joins with `JSKELET_S3_KEY_PREFIX` |
+| `JSKELET_S3_KEY_PREFIX` | `logs.s3` | — | Used with `JSKELET_S3_BUCKET` (`bucket/prefix`) |
+| `JSKELET_S3_ACCESS_KEY_ID` | `logs.s3` | — | Signs PutObject |
+| `JSKELET_S3_SECRET_ACCESS_KEY` | `logs.s3` | — | Signing secret (`JSKELET_S3_ACCESS_SECRET` is an alias) |
 | `JSKELET_S3_SESSION_TOKEN` | `logs.s3` | — | Optional, for temporary credentials |
-| `JSKELET_S3_REGION` | `logs.s3` | — | Used when `logs.s3.region` is unset; defaults to `auto` when an endpoint is set |
-| `JSKELET_S3_API_URL` | `logs.s3` | — | R2 / MinIO endpoint; overrides `logs.s3.endpoint` |
+| `JSKELET_S3_REGION` | `logs.s3` | `auto` | Defaults to `auto` when unset |
+| `JSKELET_S3_API_URL` | `logs.s3` | — | S3-compatible endpoint; overrides `logs.s3.endpoint` |
 | `JSKELET_CLOUDFLARE_KEY` | Cloudflare cache surface | — | API token. Until it is set, CDN purging and edge analytics stay off; it overrides `apiToken` in the config. The token is never returned in a response. [06](./06-caching.md) |
 | `JSKELET_CLOUDFLARE_ZONE_ID` | Cloudflare cache surface | — | Zone identifier. No Cloudflare endpoint is called unless it is set alongside the token |
 | `JSKELET_CLOUDFLARE_HOSTNAME` | Cloudflare cache surface | — | The root for purge URLs. Required when the panel is opened over an internal address |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "A framework that feels like no framework: Express 5 + EJS server rendering, vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",

package/src/config/defaults.js

@@ -203,7 +203,7 @@ export const DEFAULT_REDIS = {
  * `JSKELET_S3_SECRET_ACCESS_KEY` (ve isteğe bağlı `JSKELET_S3_SESSION_TOKEN`).
  * Bucket için `JSKELET_LOG_BUCKET` (veya `JSKELET_S3_BUCKET`) env'i config'i
  * ezer ve `ayberkenis/jskelet/logs` gibi `bucket/prefix` yolunu kabul eder.
- * Uyumlu API adresi `JSKELET_S3_API_URL` (R2 / MinIO).
+ * Uyumlu API adresi `JSKELET_S3_API_URL` (S3-compatible endpoint).
  */
 export const DEFAULT_LOGS = {
   console: true,

package/src/config/index.js

@@ -430,6 +430,48 @@ export function splitS3BucketPath(value) {
   };
 }
 
+/**
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+function envText(value) {
+  return typeof value === "string" && value ? value : null;
+}
+
+/**
+ * @returns {{ accessKeyId: string, secretAccessKey: string,
+ *   sessionToken: string | null } | null}
+ */
+export function readS3CredentialsFromEnv() {
+  const accessKeyId = envText(process.env.JSKELET_S3_ACCESS_KEY_ID);
+  const secretAccessKey =
+    envText(process.env.JSKELET_S3_SECRET_ACCESS_KEY) ??
+    envText(process.env.JSKELET_S3_ACCESS_SECRET);
+  if (!accessKeyId || !secretAccessKey) return null;
+  return {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken: envText(process.env.JSKELET_S3_SESSION_TOKEN),
+  };
+}
+
+/**
+ * Log hedefi. Öncelik: `JSKELET_LOG_BUCKET` → `JSKELET_S3_BUCKET`
+ * (+ isteğe bağlı `JSKELET_S3_KEY_PREFIX`).
+ *
+ * @returns {string | null}
+ */
+function resolveLogBucketEnv() {
+  const logPath = envText(process.env.JSKELET_LOG_BUCKET);
+  if (logPath) return logPath;
+
+  const bucket = envText(process.env.JSKELET_S3_BUCKET);
+  if (!bucket) return null;
+
+  const prefix = envText(process.env.JSKELET_S3_KEY_PREFIX);
+  return prefix ? `${bucket}/${prefix}` : bucket;
+}
+
 /**
  * Kalıcı log sink'leri. Bozuk bir `kinds` listesi siteyi düşürmemeli —
  * bilinmeyen girdiler atılır; hiç geçerli tür kalmazsa varsayılana dönülür.
@@ -461,13 +503,8 @@ export function normalizeLogs(raw) {
   const flush = Number(s3Raw.flushIntervalMs);
   const batch = Number(s3Raw.maxBatch);
 
-  /** @param {unknown} value */
-  const text = (value) => (typeof value === "string" && value ? value : null);
-
   const bucketPath = splitS3BucketPath(
-    text(process.env.JSKELET_LOG_BUCKET) ??
-      text(process.env.JSKELET_S3_BUCKET) ??
-      text(s3Raw.bucket),
+    resolveLogBucketEnv() ?? envText(s3Raw.bucket),
   );
 
   const configPrefix =
@@ -478,14 +515,28 @@ export function normalizeLogs(raw) {
       : DEFAULT_LOGS.s3.prefix;
 
   const endpoint =
-    text(process.env.JSKELET_S3_API_URL) ?? text(s3Raw.endpoint);
+    envText(process.env.JSKELET_S3_API_URL) ?? envText(s3Raw.endpoint);
 
-  // R2 / uyumlu API'lerde bölge çoğu zaman `auto`; endpoint varken region
-  // zorunlu tutulursa tek satırlık env kurulumu boşa düşer.
+  // Uyumlu API'lerde (Cloudflare R2 vb.) imza bölgesi çoğu zaman `auto`.
+  // Region hiçbir kurulumda zorunlu değil.
   const region =
-    text(s3Raw.region) ??
-    text(process.env.JSKELET_S3_REGION) ??
-    (endpoint ? "auto" : null);
+    envText(s3Raw.region) ??
+    envText(process.env.JSKELET_S3_REGION) ??
+    "auto";
+
+  const credentials = readS3CredentialsFromEnv();
+  // `JSKELET_LOG_BUCKET` (veya S3 bucket) + credential varsa config'te
+  // `enabled: true` unutulmuş olsa bile aç. Açık `enabled: false` ezer.
+  const envWantsLogs = Boolean(
+    envText(process.env.JSKELET_LOG_BUCKET) ||
+      envText(process.env.JSKELET_S3_BUCKET),
+  );
+  const enabled =
+    s3Raw.enabled === true ||
+    (s3Raw.enabled !== false &&
+      envWantsLogs &&
+      Boolean(credentials) &&
+      Boolean(bucketPath.bucket));
 
   return {
     console: source.console !== false,
@@ -499,7 +550,7 @@ export function normalizeLogs(raw) {
       rotate: "daily",
     },
     s3: {
-      enabled: s3Raw.enabled === true,
+      enabled,
       bucket: bucketPath.bucket,
       // Yoldaki önek tek env ile klasör vermeyi mümkün kılar; yoksa config.
       prefix: bucketPath.prefix ?? configPrefix,

package/src/server/logs/pipeline.js

@@ -6,6 +6,7 @@
  */
 import process from "node:process";
 import * as log from "../../log.mjs";
+import { readS3CredentialsFromEnv } from "../../config/index.js";
 import { createFileSink } from "./file-sink.js";
 import { createS3Sink } from "./s3-sink.js";
 
@@ -23,20 +24,6 @@ let sinks = [];
 let kindSet = new Set();
 let accessMounted = false;
 
-/**
- * @returns {import('./s3-put.js').AwsCredentials | null}
- */
-function readCredentials() {
-  const accessKeyId = process.env.JSKELET_S3_ACCESS_KEY_ID;
-  const secretAccessKey = process.env.JSKELET_S3_SECRET_ACCESS_KEY;
-  if (!accessKeyId || !secretAccessKey) return null;
-  return {
-    accessKeyId,
-    secretAccessKey,
-    sessionToken: process.env.JSKELET_S3_SESSION_TOKEN || null,
-  };
-}
-
 /**
  * Access middleware mount edilmeli mi?
  *
@@ -79,25 +66,22 @@ export async function configureLogs(config) {
   }
 
   if (logs.s3.enabled) {
-    const credentials = readCredentials();
+    const credentials = readS3CredentialsFromEnv();
     if (!logs.s3.bucket) {
       console.warn(
-        "[logs] s3.enabled but no bucket (set JSKELET_LOG_BUCKET or logs.s3.bucket)",
-      );
-    } else if (!logs.s3.region) {
-      console.warn(
-        "[logs] s3.enabled but no region (set JSKELET_S3_REGION or logs.s3.region)",
+        "[logs] s3.enabled but no bucket (set JSKELET_LOG_BUCKET, JSKELET_S3_BUCKET or logs.s3.bucket)",
       );
     } else if (!credentials) {
       console.warn(
-        "[logs] s3.enabled but JSKELET_S3_ACCESS_KEY_ID / JSKELET_S3_SECRET_ACCESS_KEY missing — S3 sink disabled",
+        "[logs] s3.enabled but credentials missing — set JSKELET_S3_ACCESS_KEY_ID and JSKELET_S3_SECRET_ACCESS_KEY",
       );
     } else {
+      const region = logs.s3.region || "auto";
       next.push(
         createS3Sink({
           bucket: logs.s3.bucket,
           prefix: logs.s3.prefix,
-          region: logs.s3.region,
+          region,
           endpoint: logs.s3.endpoint,
           credentials,
           flushIntervalMs: logs.s3.flushIntervalMs,