nibula 2.5.0 → 3.0.1

package/src/backend/_core/index.js

@@ -1,230 +0,0 @@
-"use strict";
-
-const http = require("http");
-const fs = require("fs");
-const path = require("path");
-const crypto = require("crypto");
-
-const { createResponse, HALT } = require("./modules/Response");
-const RateLimiter = require("./modules/RateLimiter");
-const { loadConfig, handleException } = require("./init");
-
-const CORE_PATH = __dirname;
-
-const config = loadConfig();
-
-const APP_ENV = config.APP_ENV || "production";
-
-const DOCUMENT_ROOT =
-  process.env.DOCUMENT_ROOT || path.join(CORE_PATH, "..", "..");
-
-const basePublic = path.join(CORE_PATH, "..", "api", "public");
-const baseProtected = path.join(CORE_PATH, "..", "api", "protected");
-
-function hashEquals(known, given) {
-  const a = Buffer.from(String(known));
-  const b = Buffer.from(String(given));
-  if (a.length !== b.length) {
-    return false;
-  }
-  return crypto.timingSafeEqual(a, b);
-}
-
-function send404(res) {
-  res.statusCode = 404;
-  const errorPage = DOCUMENT_ROOT ? path.join(DOCUMENT_ROOT, "404.html") : "";
-  if (errorPage && fs.existsSync(errorPage)) {
-    res.setHeader("Content-Type", "text/html; charset=UTF-8");
-    res.end(fs.readFileSync(errorPage));
-  } else {
-    res.setHeader("Content-Type", "text/html; charset=UTF-8");
-    res.end(
-      "<h1>404 Not Found</h1>The requested URL was not found on this server.",
-    );
-  }
-}
-
-function readBody(req) {
-  return new Promise((resolve) => {
-    const chunks = [];
-    req.on("data", (c) => chunks.push(c));
-    req.on("end", () => {
-      const raw = Buffer.concat(chunks).toString("utf8");
-      if (!raw) return resolve({ raw: "", json: null });
-      let json = null;
-      try {
-        json = JSON.parse(raw);
-      } catch (e) {
-        json = null;
-      }
-      resolve({ raw, json });
-    });
-    req.on("error", () => resolve({ raw: "", json: null }));
-  });
-}
-
-async function handleRequest(req, res) {
-  const Response = createResponse(res);
-
-  try {
-    const method = req.method;
-    const parsedUrl = new URL(req.url, "http://localhost");
-    let uri = parsedUrl.pathname;
-
-    uri = uri.replace(/^\/api/, "");
-    uri = uri.replace(/\/+$/, "");
-    if (uri === "") uri = "/";
-
-    const parts = uri.split("/").filter((p) => p !== "");
-
-    for (const part of parts) {
-      if (part === ".." || part === ".") {
-        Response.error("Bad Request", 400);
-      }
-    }
-
-    let endpointFile = null;
-    let isProtected = false;
-
-    const checkParts = parts.slice();
-    const params = [];
-
-    while (checkParts.length > 0) {
-      const relativePath = checkParts.join("/") + ".js";
-
-      const publicCandidate = path.join(basePublic, relativePath);
-      if (fs.existsSync(publicCandidate)) {
-        endpointFile = publicCandidate;
-        isProtected = false;
-        break;
-      }
-
-      const protectedCandidate = path.join(baseProtected, relativePath);
-      if (fs.existsSync(protectedCandidate)) {
-        endpointFile = protectedCandidate;
-        isProtected = true;
-        break;
-      }
-
-      params.unshift(checkParts.pop());
-    }
-
-    if (!endpointFile) {
-      send404(res);
-      return;
-    }
-
-    const base = isProtected ? baseProtected : basePublic;
-    let endpointPath = endpointFile
-      .split(path.sep)
-      .join("/")
-      .replace(base.split(path.sep).join("/"), "")
-      .replace(/\.js$/, "")
-      .replace(/^\//, "");
-
-    res.setHeader("Content-Type", "application/json; charset=UTF-8");
-    res.setHeader("X-Content-Type-Options", "nosniff");
-    res.setHeader("X-Frame-Options", "DENY");
-    res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
-    res.setHeader(
-      "Access-Control-Allow-Methods",
-      "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-    );
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, X-Api-Key");
-
-    const originsForEndpoint =
-      (config.CUSTOM_ENDPOINT_ORIGINS &&
-        config.CUSTOM_ENDPOINT_ORIGINS[endpointPath]) ||
-      config.GENERAL_ALLOWED_ORIGINS ||
-      [];
-
-    const origin = req.headers["origin"] || "";
-
-    if (origin !== "" && originsForEndpoint.includes(origin)) {
-      res.setHeader("Access-Control-Allow-Origin", origin);
-      res.setHeader("Vary", "Origin");
-    } else if (originsForEndpoint.includes("*")) {
-      res.setHeader("Access-Control-Allow-Origin", "*");
-    }
-
-    if (method === "OPTIONS") {
-      res.statusCode = 204;
-      res.end();
-      return;
-    }
-
-    // Rate limit: 60 requests / 60 seconds per IP
-    const ip =
-      (req.headers["x-forwarded-for"] || "").split(",")[0].trim() ||
-      req.socket.remoteAddress ||
-      "";
-    RateLimiter.check(ip, 60, 60, Response, res);
-
-    if (isProtected) {
-      const validKey =
-        (config.CUSTOM_ENDPOINT_KEYS &&
-          config.CUSTOM_ENDPOINT_KEYS[endpointPath]) ||
-        config.GENERAL_API_KEY ||
-        "";
-      const apiKey = req.headers["x-api-key"] || "";
-
-      if (validKey === "" || !hashEquals(validKey, apiKey)) {
-        Response.error("Unauthorized. X_API_KEY is incorrect or missing", 403);
-      }
-    }
-
-    const handler = require(endpointFile);
-
-    const context = {
-      method, // HTTP method
-      requestParams: params, // leftover URL segments (route params)
-      Response, // request-bound Response helper
-      query: Object.fromEntries(parsedUrl.searchParams), // parsed query string
-      body: body.json, // parsed JSON body (or null)
-      rawBody: body.raw, // raw body string
-      headers: req.headers,
-      req,
-      res,
-      config,
-      CORE_PATH,
-    };
-
-    await handler(context);
-
-    if (!res.writableEnded) {
-      res.end();
-    }
-  } catch (err) {
-    if (err === HALT) {
-      return;
-    }
-    try {
-      handleException(err, config, Response);
-    } catch (inner) {
-      if (inner === HALT) return;
-      if (!res.writableEnded) {
-        res.statusCode = 500;
-        res.end(
-          JSON.stringify({
-            status: "error",
-            message: "Internal server error",
-            code: 500,
-          }),
-        );
-      }
-    }
-  }
-}
-
-const HOST = process.env.HOST || "127.0.0.1";
-const PORT = parseInt(process.env.PORT || "3000", 10);
-
-const server = http.createServer(handleRequest);
-
-server.listen(PORT, HOST, () => {
-  console.log(
-    `[backend-node] listening on http://${HOST}:${PORT} (env: ${APP_ENV})`,
-  );
-});
-
-module.exports = server;

package/src/backend/_core/index.php

@@ -1,118 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-define('CORE_ACCESS', true);
-define('CORE_PATH', __DIR__);
-
-require_once __DIR__ . '/init.php';
-require_once __DIR__ . '/modules/Response.php';
-
-$method = $_SERVER['REQUEST_METHOD'];
-$uri    = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
-
-$uri    = rtrim(preg_replace('#^/api#', '', $uri), '/') ?: '/';
-$parts  = array_values(array_filter(explode('/', $uri)));
-
-foreach ($parts as $part) {
-    if ($part === '..' || $part === '.') {
-        Response::error('Bad Request', 400);
-    }
-}
-
-$basePublic    = __DIR__ . '/../api/public/';
-$baseProtected = __DIR__ . '/../api/protected/';
-
-$endpointFile  = null;
-$isProtected   = false;
-$requestParams = [];
-$checkParts = $parts;
-$params     = [];
-
-while (count($checkParts) > 0) {
-    $relativePath = implode('/', $checkParts) . '.php';
-
-    // Check first whether this is a public route
-    if (file_exists($basePublic . $relativePath)) {
-        $endpointFile = $basePublic . $relativePath;
-        $isProtected  = false;
-        break;
-    }
-
-    if (file_exists($baseProtected . $relativePath)) {
-        $endpointFile = $baseProtected . $relativePath;
-        $isProtected  = true;
-        break;
-    }
-
-    array_unshift($params, array_pop($checkParts));
-}
-
-if (!$endpointFile) {
-    http_response_code(404);
-    header_remove('WWW-Authenticate');
-
-    $documentRoot = $_SERVER['DOCUMENT_ROOT'] ?? '';
-    $errorPage    = $documentRoot . '/404.html';
-
-    if (!file_exists($errorPage)) {
-        $errorPage = __DIR__ . '/../../404.html';
-    }
-
-    header('Content-Type: text/html; charset=UTF-8');
-
-    if (file_exists($errorPage)) {
-        echo file_get_contents($errorPage);
-    } else {
-        echo "<h1>404 Not Found</h1>";
-        echo "The requested URL was not found on this server.";
-    }
-    exit;
-}
-
-$base         = $isProtected ? $baseProtected : $basePublic;
-$base         = str_replace('\\', '/', $base);
-$endpointPath = str_replace('\\', '/', $endpointFile);
-$endpointPath = preg_replace('#\.php$#', '', str_replace($base, '', $endpointPath));
-
-header('Content-Type: application/json; charset=UTF-8');
-header_remove('WWW-Authenticate');
-header('X-Content-Type-Options: nosniff');
-header('X-Frame-Options: DENY');
-header('Referrer-Policy: strict-origin-when-cross-origin');
-header('Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS');
-header('Access-Control-Allow-Headers: Content-Type, X-Api-Key');
-
-$originsForEndpoint = $config['CUSTOM_ENDPOINT_ORIGINS'][$endpointPath]
-    ?? $config['GENERAL_ALLOWED_ORIGINS']
-    ?? [];
-
-$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
-
-if ($origin !== '' && in_array($origin, $originsForEndpoint, true)) {
-    header('Access-Control-Allow-Origin: ' . $origin);
-    header('Vary: Origin');
-} elseif (in_array('*', $originsForEndpoint, true)) {
-    header('Access-Control-Allow-Origin: *');
-}
-
-if ($method === 'OPTIONS') {
-    http_response_code(204);
-    exit;
-}
-
-require_once __DIR__ . '/modules/RateLimiter.php';
-RateLimiter::check($_SERVER['REMOTE_ADDR'] ?? '', 60, 60);
-
-if ($isProtected) {
-    $validKey = $config['CUSTOM_ENDPOINT_KEYS'][$endpointPath] ?? $config['GENERAL_API_KEY'] ?? '';
-    $apiKey   = $_SERVER['HTTP_X_API_KEY'] ?? '';
-
-    if ($validKey === '' || !hash_equals($validKey, $apiKey)) {
-        Response::error('Unauthorized. X_API_KEY is incorrect or missing', 403);
-    }
-}
-
-$requestParams = $params;
-
-require $endpointFile;

package/src/backend/_core/init.js

@@ -1,32 +0,0 @@
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-
-function loadConfig() {
-  const backendRoot = path.join(__dirname, "..");
-  const configPath = path.join(backendRoot, "config.js");
-  const examplePath = path.join(backendRoot, "example.config.js");
-
-  if (fs.existsSync(configPath)) {
-    return require(configPath);
-  }
-  return require(examplePath);
-}
-
-/**
- * Turn any thrown error into a 500 response, mirroring set_exception_handler.
- * @param {Error} exception
- * @param {object} config
- * @param {object} Response request-bound helper
- */
-function handleException(exception, config, Response) {
-  const isDebug = (config.APP_ENV || "production") !== "production";
-  Response.error(
-    isDebug ? exception.message : "Internal server error",
-    500,
-    isDebug ? { stack: exception.stack } : null,
-  );
-}
-
-module.exports = { loadConfig, handleException };

package/src/backend/_core/init.php

@@ -1,30 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-require_once __DIR__ . '/vendor/autoload.php';
-require_once __DIR__ . '/modules/Response.php';
-
-set_exception_handler(function ($exception) use (&$config) {
-    $isDebug = ($config['APP_ENV'] ?? 'production') !== 'production';
-    Response::error(
-        $isDebug ? $exception->getMessage() : 'Internal server error',
-        500,
-        $isDebug ? ['file' => $exception->getFile(), 'line' => $exception->getLine()] : null
-    );
-});
-
-set_error_handler(function ($severity, $message, $file, $line) {
-    if (!(error_reporting() & $severity)) return;
-    throw new ErrorException($message, 0, $severity, $file, $line);
-});
-
-$config = require dirname(__DIR__) . '/config.php';
-
-if (($config['APP_ENV'] ?? 'production') === 'production') {
-    ini_set('display_errors', '0');
-    error_reporting(0);
-} else {
-    ini_set('display_errors', '1');
-    error_reporting(E_ALL);
-}

package/src/backend/_core/modules/RateLimiter.js

@@ -1,47 +0,0 @@
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-const crypto = require("crypto");
-
-class RateLimiter {
-  /**
-   * @param {string} ip
-   * @param {number} maxRequests
-   * @param {number} windowSeconds
-   * @param {object} Response  request-bound helper from createResponse(res)
-   * @param {object} res       raw http response (to set Retry-After)
-   */
-  static check(ip, maxRequests = 60, windowSeconds = 60, Response, res) {
-    const cacheDir = path.join(__dirname, "..", "..", "cache");
-
-    if (!fs.existsSync(cacheDir)) {
-      fs.mkdirSync(cacheDir, { recursive: true, mode: 0o755 });
-    }
-
-    const hash = crypto.createHash("md5").update(ip).digest("hex");
-    const cacheFile = path.join(cacheDir, "rl_" + hash + ".json");
-    const now = Math.floor(Date.now() / 1000);
-    let data = [];
-
-    if (fs.existsSync(cacheFile)) {
-      try {
-        data = JSON.parse(fs.readFileSync(cacheFile, "utf8")) || [];
-      } catch (e) {
-        data = [];
-      }
-    }
-
-    data = data.filter((ts) => ts > now - windowSeconds);
-    data.push(now);
-
-    fs.writeFileSync(cacheFile, JSON.stringify(data));
-
-    if (data.length > maxRequests) {
-      res.setHeader("Retry-After", String(windowSeconds));
-      Response.error("Too Many Requests", 429);
-    }
-  }
-}
-
-module.exports = RateLimiter;

package/src/backend/_core/modules/RateLimiter.php

@@ -1,31 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-class RateLimiter {
-    public static function check(string $ip, int $maxRequests = 60, int $windowSeconds = 60): void {
-        $cacheDir = __DIR__ . '/../../cache';
-        
-        if (!is_dir($cacheDir)) {
-            mkdir($cacheDir, 0755, true);
-        }
-
-        $cacheFile = $cacheDir . '/rl_' . md5($ip) . '.json';
-        $now = time();
-        $data = [];
-
-        if (file_exists($cacheFile)) {
-            $data = json_decode(file_get_contents($cacheFile), true) ?: [];
-        }
-
-        $data = array_filter($data, fn($ts) => $ts > ($now - $windowSeconds));
-        $data[] = $now;
-
-        file_put_contents($cacheFile, json_encode(array_values($data)), LOCK_EX);
-
-        if (count($data) > $maxRequests) {
-            header('Retry-After: ' . $windowSeconds);
-            Response::error('Too Many Requests', 429);
-        }
-    }
-}

package/src/backend/api/protected/example-protected.js

@@ -1,16 +0,0 @@
-"use strict";
-
-module.exports = ({ method, requestParams, Response }) => {
-  if (method !== "GET") {
-    Response.error("Method not allowed", 405);
-  }
-
-  //
-  // Your endpoint logic here. You can access route parameters in requestParams
-  //
-
-  Response.success({
-    message: "Protected endpoint is working",
-    params: requestParams,
-  });
-};

package/src/backend/api/protected/example-protected.php

@@ -1,17 +0,0 @@
-<?php
-declare(strict_types=1);
-
-require_once CORE_PATH . '/modules/Response.php';
-
-if ($method !== 'GET') {
-    Response::error('Method not allowed', 405);
-}
-
-//
-// Your endpoint logic here. You can access route parameters in $requestParams array
-//
-
-Response::success([
-    'message'    => 'Protected endpoint is working',
-    'params'     => $requestParams,
-]);

package/src/backend/api/public/example-public.js

@@ -1,16 +0,0 @@
-"use strict";
-
-module.exports = ({ method, requestParams, Response }) => {
-  if (method !== "GET") {
-    Response.error("Method not allowed", 405);
-  }
-
-  //
-  // Your endpoint logic here. You can access route parameters in requestParams
-  //
-
-  Response.success({
-    message: "Public endpoint is working",
-    params: requestParams,
-  });
-};

package/src/backend/api/public/example-public.php

@@ -1,17 +0,0 @@
-<?php
-declare(strict_types=1);
-
-require_once CORE_PATH . '/modules/Response.php';
-
-if ($method !== 'GET') {
-    Response::error('Method not allowed', 405);
-}
-
-//
-// Your endpoint logic here. You can access route parameters in $requestParams array
-//
-
-Response::success([
-    'message'    => 'Public endpoint is working',
-    'params'     => $requestParams,
-]);