jskelet 0.6.1 → 0.6.3

package/src/server/admin/auth.js

@@ -1,125 +1,125 @@
-/**
- * Admin paneli oturum ve şifre yönetimi.
- *
- * Şifre süreç ömrü kadar; kalıcı sır yok. Cookie parse framework'ün
- * `parseCookies()` yolunu kullanmaz — o yol isteği "kişiselleştirilmiş"
- * işaretler.
- */
-import crypto from "node:crypto";
-import process from "node:process";
-import { safeEqual } from "../../http/cookies.js";
-
-export const COOKIE_NAME = "jskelet_admin_sid";
-
-/**
- * Aksiyon isteklerinde beklenen başlık. Tarayıcı bu başlığı çapraz site bir
- * formla gönderemez (preflight gerekir), yani panelin kendi CSRF freni.
- */
-export const ACTION_HEADER = "x-jskelet-admin";
-
-/** 32 haneli, süreç ömrü kadar geçerli şifre. */
-export const PASSWORD = crypto.randomBytes(16).toString("hex");
-
-/** @type {Map<string, number>} token → son kullanma zamanı. */
-const sessions = new Map();
-
-/**
- * @param {import('express').Request} req
- * @param {string} name
- * @returns {string | null}
- */
-export function readCookie(req, name) {
-  const header = req.headers.cookie;
-  if (!header) return null;
-
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq === -1) continue;
-    if (part.slice(0, eq).trim() !== name) continue;
-    return decodeURIComponent(part.slice(eq + 1).trim());
-  }
-
-  return null;
-}
-
-/**
- * Süresi geçmiş oturumları eler.
- */
-export function pruneSessions() {
-  const now = Date.now();
-  for (const [token, expiresAt] of sessions) {
-    if (now >= expiresAt) sessions.delete(token);
-  }
-}
-
-/**
- * @param {import('express').Request} req
- * @returns {boolean}
- */
-export function authenticated(req) {
-  const token = readCookie(req, COOKIE_NAME);
-  if (!token) return false;
-
-  const expiresAt = sessions.get(token);
-  if (expiresAt === undefined) return false;
-
-  if (Date.now() >= expiresAt) {
-    sessions.delete(token);
-    return false;
-  }
-
-  return true;
-}
-
-/**
- * @param {string} password
- * @returns {boolean}
- */
-export function passwordMatches(password) {
-  return Boolean(password) && safeEqual(password, PASSWORD);
-}
-
-/**
- * @param {number} sessionHours
- * @returns {{ token: string, maxAge: number }}
- */
-export function createSession(sessionHours) {
-  pruneSessions();
-  const token = crypto.randomBytes(32).toString("base64url");
-  const maxAge = Math.round(sessionHours * 3600);
-  sessions.set(token, Date.now() + maxAge * 1000);
-  return { token, maxAge };
-}
-
-/**
- * @param {import('express').Request} req
- */
-export function destroySession(req) {
-  const token = readCookie(req, COOKIE_NAME);
-  if (token) sessions.delete(token);
-}
-
-/**
- * @param {string} basePath
- * @param {string} token
- * @param {number} maxAge
- * @returns {string}
- */
-export function sessionCookie(basePath, token, maxAge) {
-  return [
-    `${COOKIE_NAME}=${token}`,
-    `Path=${basePath}`,
-    `Max-Age=${maxAge}`,
-    "HttpOnly",
-    "SameSite=Strict",
-    ...(process.env.NODE_ENV === "development" ? [] : ["Secure"]),
-  ].join("; ");
-}
-
-/**
- * @param {string} basePath
- * @returns {string}
- */
-export function clearSessionCookie(basePath) {
-  return `${COOKIE_NAME}=; Path=${basePath}; Max-Age=0`;
-}
+/**
+ * Admin paneli oturum ve şifre yönetimi.
+ *
+ * Şifre süreç ömrü kadar; kalıcı sır yok. Cookie parse framework'ün
+ * `parseCookies()` yolunu kullanmaz — o yol isteği "kişiselleştirilmiş"
+ * işaretler.
+ */
+import crypto from "node:crypto";
+import process from "node:process";
+import { safeEqual } from "../../http/cookies.js";
+
+export const COOKIE_NAME = "jskelet_admin_sid";
+
+/**
+ * Aksiyon isteklerinde beklenen başlık. Tarayıcı bu başlığı çapraz site bir
+ * formla gönderemez (preflight gerekir), yani panelin kendi CSRF freni.
+ */
+export const ACTION_HEADER = "x-jskelet-admin";
+
+/** 32 haneli, süreç ömrü kadar geçerli şifre. */
+export const PASSWORD = crypto.randomBytes(16).toString("hex");
+
+/** @type {Map<string, number>} token → son kullanma zamanı. */
+const sessions = new Map();
+
+/**
+ * @param {import('express').Request} req
+ * @param {string} name
+ * @returns {string | null}
+ */
+export function readCookie(req, name) {
+  const header = req.headers.cookie;
+  if (!header) return null;
+
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() !== name) continue;
+    return decodeURIComponent(part.slice(eq + 1).trim());
+  }
+
+  return null;
+}
+
+/**
+ * Süresi geçmiş oturumları eler.
+ */
+export function pruneSessions() {
+  const now = Date.now();
+  for (const [token, expiresAt] of sessions) {
+    if (now >= expiresAt) sessions.delete(token);
+  }
+}
+
+/**
+ * @param {import('express').Request} req
+ * @returns {boolean}
+ */
+export function authenticated(req) {
+  const token = readCookie(req, COOKIE_NAME);
+  if (!token) return false;
+
+  const expiresAt = sessions.get(token);
+  if (expiresAt === undefined) return false;
+
+  if (Date.now() >= expiresAt) {
+    sessions.delete(token);
+    return false;
+  }
+
+  return true;
+}
+
+/**
+ * @param {string} password
+ * @returns {boolean}
+ */
+export function passwordMatches(password) {
+  return Boolean(password) && safeEqual(password, PASSWORD);
+}
+
+/**
+ * @param {number} sessionHours
+ * @returns {{ token: string, maxAge: number }}
+ */
+export function createSession(sessionHours) {
+  pruneSessions();
+  const token = crypto.randomBytes(32).toString("base64url");
+  const maxAge = Math.round(sessionHours * 3600);
+  sessions.set(token, Date.now() + maxAge * 1000);
+  return { token, maxAge };
+}
+
+/**
+ * @param {import('express').Request} req
+ */
+export function destroySession(req) {
+  const token = readCookie(req, COOKIE_NAME);
+  if (token) sessions.delete(token);
+}
+
+/**
+ * @param {string} basePath
+ * @param {string} token
+ * @param {number} maxAge
+ * @returns {string}
+ */
+export function sessionCookie(basePath, token, maxAge) {
+  return [
+    `${COOKIE_NAME}=${token}`,
+    `Path=${basePath}`,
+    `Max-Age=${maxAge}`,
+    "HttpOnly",
+    "SameSite=Strict",
+    ...(process.env.NODE_ENV === "development" ? [] : ["Secure"]),
+  ].join("; ");
+}
+
+/**
+ * @param {string} basePath
+ * @returns {string}
+ */
+export function clearSessionCookie(basePath) {
+  return `${COOKIE_NAME}=; Path=${basePath}; Max-Age=0`;
+}

package/src/server/admin/event-log.js

@@ -1,151 +1,151 @@
-/**
- * Admin paneli için süreç içi olay kuyruğu.
- *
- * Kaynaklar: HTTP `finish` middleware'i ve `log.mjs` aboneliği. Gövde yok —
- * yalnızca meta. Admin kapalıyken bu modül yüklenmez.
- */
-import * as log from "../../log.mjs";
-import { getConfig } from "../../config/index.js";
-
-/** @typedef {{ kind: string, id: number, at: number, [key: string]: unknown }} LogEntry */
-
-/** @type {LogEntry[]} */
-const ring = [];
-
-/** @type {Set<(entry: LogEntry) => void>} */
-const live = new Set();
-
-let nextId = 1;
-/** @type {(() => void) | null} */
-let unsubscribeLog = null;
-/** @type {string} */
-let basePath = "/_jskelet/admin";
-/** @type {string} */
-let prewarmUa = "jskelet-prewarm";
-let maxSize = 500;
-
-/**
- * @param {{ basePath: string, logSize: number, prewarmUserAgent?: string }} options
- */
-export function configureEventLog(options) {
-  basePath = options.basePath;
-  maxSize = options.logSize;
-  if (options.prewarmUserAgent) prewarmUa = options.prewarmUserAgent;
-
-  if (!unsubscribeLog) {
-    unsubscribeLog = log.subscribe((raw) => {
-      // HTTP finish middleware zaten kendi kaydını yazıyor; log.http
-      // çift kayıt üretmesin.
-      if (raw.kind === "http") return;
-      push({
-        kind: typeof raw.kind === "string" ? raw.kind : "event",
-        scope: raw.scope ?? null,
-        message: raw.message ?? "",
-        note: raw.note ?? null,
-        ms: raw.ms ?? null,
-      });
-    });
-  }
-}
-
-/**
- * @param {Omit<LogEntry, "id" | "at"> & { kind: string }} partial
- * @returns {LogEntry}
- */
-export function push(partial) {
-  /** @type {LogEntry} */
-  const entry = {
-    ...partial,
-    id: nextId++,
-    at: Date.now(),
-  };
-
-  ring.push(entry);
-  while (ring.length > maxSize) ring.shift();
-
-  for (const listener of live) {
-    try {
-      listener(entry);
-    } catch {
-      // SSE dinleyicisi paneli düşürmesin.
-    }
-  }
-
-  return entry;
-}
-
-/**
- * @param {number} [afterId]
- * @param {number} [limit]
- * @returns {LogEntry[]}
- */
-export function list(afterId = 0, limit = 200) {
-  const capped = Math.min(Math.max(1, limit), maxSize);
-  const filtered = afterId > 0 ? ring.filter((entry) => entry.id > afterId) : ring;
-  return filtered.slice(-capped);
-}
-
-/**
- * @param {(entry: LogEntry) => void} listener
- * @returns {() => void}
- */
-export function subscribeLive(listener) {
-  live.add(listener);
-  return () => live.delete(listener);
-}
-
-/**
- * HTTP yanıt bitiminde ring'e yazar. Admin yolları ve prewarm UA atlanır.
- *
- * @returns {import('express').RequestHandler}
- */
-export function requestLogMiddleware() {
-  const brand = getConfig().brand;
-
-  /** @type {import('express').RequestHandler} */
-  return (req, res, next) => {
-    const pathname = req.path || "";
-    if (pathname === basePath || pathname.startsWith(`${basePath}/`)) {
-      return next();
-    }
-
-    if (req.headers["user-agent"] === (brand.prewarmUserAgent || prewarmUa)) {
-      return next();
-    }
-
-    const started = process.hrtime.bigint();
-
-    res.on("finish", () => {
-      const routePath = matchedRoute(req);
-      push({
-        kind: "http",
-        method: req.method,
-        url: req.originalUrl,
-        path: req.path,
-        route: routePath,
-        status: res.statusCode,
-        ms: Number(process.hrtime.bigint() - started) / 1e6,
-        cache: /** @type {string | null} */ (
-          res.getHeader(brand.cacheHeader) ?? null
-        ),
-      });
-    });
-
-    next();
-  };
-}
-
-/**
- * Express'in eşleştirdiği route deseni (mount + path). Yoksa null.
- *
- * @param {import('express').Request} req
- * @returns {string | null}
- */
-function matchedRoute(req) {
-  const layer = /** @type {any} */ (req).route;
-  if (!layer || typeof layer.path !== "string") return null;
-
-  const base = /** @type {any} */ (req).baseUrl || "";
-  const pattern = layer.path === "/" ? base || "/" : `${base}${layer.path}`;
-  return pattern || null;
-}
+/**
+ * Admin paneli için süreç içi olay kuyruğu.
+ *
+ * Kaynaklar: HTTP `finish` middleware'i ve `log.mjs` aboneliği. Gövde yok —
+ * yalnızca meta. Admin kapalıyken bu modül yüklenmez.
+ */
+import * as log from "../../log.mjs";
+import { getConfig } from "../../config/index.js";
+
+/** @typedef {{ kind: string, id: number, at: number, [key: string]: unknown }} LogEntry */
+
+/** @type {LogEntry[]} */
+const ring = [];
+
+/** @type {Set<(entry: LogEntry) => void>} */
+const live = new Set();
+
+let nextId = 1;
+/** @type {(() => void) | null} */
+let unsubscribeLog = null;
+/** @type {string} */
+let basePath = "/_jskelet/admin";
+/** @type {string} */
+let prewarmUa = "jskelet-prewarm";
+let maxSize = 500;
+
+/**
+ * @param {{ basePath: string, logSize: number, prewarmUserAgent?: string }} options
+ */
+export function configureEventLog(options) {
+  basePath = options.basePath;
+  maxSize = options.logSize;
+  if (options.prewarmUserAgent) prewarmUa = options.prewarmUserAgent;
+
+  if (!unsubscribeLog) {
+    unsubscribeLog = log.subscribe((raw) => {
+      // HTTP finish middleware zaten kendi kaydını yazıyor; log.http
+      // çift kayıt üretmesin.
+      if (raw.kind === "http") return;
+      push({
+        kind: typeof raw.kind === "string" ? raw.kind : "event",
+        scope: raw.scope ?? null,
+        message: raw.message ?? "",
+        note: raw.note ?? null,
+        ms: raw.ms ?? null,
+      });
+    });
+  }
+}
+
+/**
+ * @param {Omit<LogEntry, "id" | "at"> & { kind: string }} partial
+ * @returns {LogEntry}
+ */
+export function push(partial) {
+  /** @type {LogEntry} */
+  const entry = {
+    ...partial,
+    id: nextId++,
+    at: Date.now(),
+  };
+
+  ring.push(entry);
+  while (ring.length > maxSize) ring.shift();
+
+  for (const listener of live) {
+    try {
+      listener(entry);
+    } catch {
+      // SSE dinleyicisi paneli düşürmesin.
+    }
+  }
+
+  return entry;
+}
+
+/**
+ * @param {number} [afterId]
+ * @param {number} [limit]
+ * @returns {LogEntry[]}
+ */
+export function list(afterId = 0, limit = 200) {
+  const capped = Math.min(Math.max(1, limit), maxSize);
+  const filtered = afterId > 0 ? ring.filter((entry) => entry.id > afterId) : ring;
+  return filtered.slice(-capped);
+}
+
+/**
+ * @param {(entry: LogEntry) => void} listener
+ * @returns {() => void}
+ */
+export function subscribeLive(listener) {
+  live.add(listener);
+  return () => live.delete(listener);
+}
+
+/**
+ * HTTP yanıt bitiminde ring'e yazar. Admin yolları ve prewarm UA atlanır.
+ *
+ * @returns {import('express').RequestHandler}
+ */
+export function requestLogMiddleware() {
+  const brand = getConfig().brand;
+
+  /** @type {import('express').RequestHandler} */
+  return (req, res, next) => {
+    const pathname = req.path || "";
+    if (pathname === basePath || pathname.startsWith(`${basePath}/`)) {
+      return next();
+    }
+
+    if (req.headers["user-agent"] === (brand.prewarmUserAgent || prewarmUa)) {
+      return next();
+    }
+
+    const started = process.hrtime.bigint();
+
+    res.on("finish", () => {
+      const routePath = matchedRoute(req);
+      push({
+        kind: "http",
+        method: req.method,
+        url: req.originalUrl,
+        path: req.path,
+        route: routePath,
+        status: res.statusCode,
+        ms: Number(process.hrtime.bigint() - started) / 1e6,
+        cache: /** @type {string | null} */ (
+          res.getHeader(brand.cacheHeader) ?? null
+        ),
+      });
+    });
+
+    next();
+  };
+}
+
+/**
+ * Express'in eşleştirdiği route deseni (mount + path). Yoksa null.
+ *
+ * @param {import('express').Request} req
+ * @returns {string | null}
+ */
+function matchedRoute(req) {
+  const layer = /** @type {any} */ (req).route;
+  if (!layer || typeof layer.path !== "string") return null;
+
+  const base = /** @type {any} */ (req).baseUrl || "";
+  const pattern = layer.path === "/" ? base || "/" : `${base}${layer.path}`;
+  return pattern || null;
+}