odac 1.0.1 → 1.2.0

package/src/Server.js

@@ -1,22 +1,128 @@
-const http = require(`http`)
+const http = require('http')
+const nodeCrypto = require('crypto')
+const cluster = require('node:cluster')
+const os = require('node:os')
 
 module.exports = {
   init: function () {
     let args = process.argv.slice(2)
     if (args[0] == 'framework' && args[1] == 'run') args = args.slice(2)
-    let port = parseInt(args[0] ?? '1071')
-    console.log(`Odac Server running on \x1b]8;;http://127.0.0.1:${port}\x1b\\\x1b[4mhttp://127.0.0.1:${port}\x1b[0m\x1b]8;;\x1b\\.`)
+    let port = parseInt(args[0])
+    if (isNaN(port)) port = parseInt(process.env.PORT || '1071')
 
-    const server = http.createServer((req, res) => {
-      return Odac.Route.request(req, res)
-    })
+    if (cluster.isPrimary) {
+      const numCPUs = Odac.Config.debug ? 1 : os.cpus().length
+      let isShuttingDown = false
 
-    server.on('upgrade', (req, socket, head) => {
-      const id = `${Date.now()}${Math.random().toString(36).substr(2, 9)}`
-      const param = Odac.instance(id, req, null)
-      Odac.Route.handleWebSocketUpgrade(req, socket, head, param)
-    })
+      const mode = Odac.Config.debug ? '\x1b[33mDevelopment\x1b[0m' : '\x1b[32mProduction\x1b[0m'
+      console.log(
+        `Odac Server running on \x1b]8;;http://127.0.0.1:${port}\x1b\\\x1b[4mhttp://127.0.0.1:${port}\x1b[0m\x1b]8;;\x1b\\ in ${mode} mode.`
+      )
 
-    server.listen(port)
+      // Start session garbage collector (runs every hour, expires after 7 days)
+      Odac.Storage.startSessionGC()
+
+      for (let i = 0; i < numCPUs; i++) {
+        cluster.fork()
+      }
+
+      cluster.on('exit', () => {
+        // Don't restart workers during shutdown
+        if (!isShuttingDown) {
+          cluster.fork()
+        }
+      })
+
+      // Graceful shutdown handler for primary
+      const gracefulShutdown = signal => {
+        if (isShuttingDown) return
+        isShuttingDown = true
+
+        console.log(`\n\x1b[33m[Shutdown]\x1b[0m ${signal} received, shutting down gracefully...`)
+
+        // Disconnect all workers
+        for (const id in cluster.workers) {
+          cluster.workers[id].send('shutdown')
+          cluster.workers[id].disconnect()
+        }
+
+        let workersAlive = Object.keys(cluster.workers).length
+
+        cluster.on('exit', () => {
+          workersAlive--
+          if (workersAlive === 0) {
+            console.log('\x1b[32m[Shutdown]\x1b[0m All workers stopped.')
+            Odac.Storage.close()
+            console.log('\x1b[32m[Shutdown]\x1b[0m Storage closed. Goodbye!')
+            process.exit(0)
+          }
+        })
+
+        // Force exit after 30 seconds
+        setTimeout(() => {
+          console.error('\x1b[31m[Shutdown]\x1b[0m Timeout! Forcing exit...')
+          process.exit(1)
+        }, 30000)
+      }
+
+      process.on('SIGTERM', () => gracefulShutdown('SIGTERM'))
+      process.on('SIGINT', () => gracefulShutdown('SIGINT'))
+    } else {
+      const server = http.createServer((req, res) => {
+        return Odac.Route.request(req, res)
+      })
+
+      /**
+       * ENTERPRISE PERFORMANCE CONFIGURATION
+       * ------------------------------------
+       * 1. Keep-Alive: Set higher than the upstream Load Balancer/Proxy (usually 60s).
+       *    This prevents the "502 Bad Gateway" race condition where Node closes
+       *    an idle connection while the proxy attempts to reuse it.
+       */
+      server.keepAliveTimeout = 65000 // 65 seconds
+      server.headersTimeout = 66000 // 66 seconds (Must be > keepAliveTimeout)
+
+      /**
+       * 2. Low Latency: Disable Nagle's Algorithm.
+       *    We want to send data immediately, even if the packet is small.
+       *    Critical for sub-millisecond API responses.
+       */
+      server.on('connection', socket => {
+        socket.setNoDelay(true)
+      })
+
+      /**
+       * 3. Connection Rotation: Force reset after 10k requests.
+       *    - Helps with Load Balancing (clients are forced to reconnect and potentially pick a new pod/worker).
+       *    - Mitigates long-term memory leaks in the TLS/Socket layer.
+       */
+      server.maxRequestsPerSocket = 10000
+
+      /**
+       * 4. Hard Timeout: Kill connection if request processing (headers + body) takes too long.
+       *    - Defaults to 0 (unlimited) or 5min in older Node.
+       *    - 30s is more than enough for an API; fail fast if the client is stuck.
+       */
+      server.requestTimeout = 30000 // 30 seconds
+
+      server.on('upgrade', (req, socket, head) => {
+        const id = nodeCrypto.randomBytes(16).toString('hex')
+        const param = Odac.instance(id, req, null)
+        Odac.Route.handleWebSocketUpgrade(req, socket, head, param)
+      })
+
+      server.listen(port)
+
+      // Graceful shutdown handler for worker
+      process.on('message', msg => {
+        if (msg === 'shutdown') {
+          console.log(`\x1b[36m[Worker ${process.pid}]\x1b[0m Closing server...`)
+          server.close(() => {
+            console.log(`\x1b[36m[Worker ${process.pid}]\x1b[0m Server closed.`)
+            process.exit(0)
+          })
+        }
+      })
+    }
   }
 }

package/src/Storage.js

@@ -0,0 +1,169 @@
+const fs = require('fs')
+const path = require('path')
+
+class OdacStorage {
+  constructor() {
+    this.db = null
+    this.ready = false
+  }
+
+  init() {
+    const {open} = require('lmdb')
+
+    const storagePath = path.join(global.__dir, 'storage')
+    const dbPath = path.join(storagePath, 'sessions.db')
+
+    try {
+      // Ensure storage directory exists
+      if (!fs.existsSync(storagePath)) {
+        fs.mkdirSync(storagePath, {recursive: true})
+      }
+
+      this.db = open({
+        path: dbPath,
+        compression: true
+        // CLUSTER SAFETY NOTE:
+        // LMDB uses memory-mapped files with OS-level locking logic.
+        // Multiple workers can safely read/write to this DB simultaneously.
+        // Data committed by Worker A is immediately visible to Worker B.
+      })
+      this.ready = true
+    } catch (error) {
+      console.error('\x1b[31m[Storage Error]\x1b[0m Failed to initialize LMDB:', error.message)
+      console.error('\x1b[33m[Storage]\x1b[0m Path:', dbPath)
+      this.ready = false
+    }
+  }
+
+  // --- Basic KV Operations ---
+
+  get(key) {
+    if (!this.ready) return null
+    return this.db.get(key) ?? null
+  }
+
+  put(key, value) {
+    if (!this.ready) return false
+    return this.db.put(key, value)
+  }
+
+  remove(key) {
+    if (!this.ready) return false
+    return this.db.remove(key)
+  }
+
+  // --- Range Operations ---
+
+  getRange(options = {}) {
+    if (!this.ready) return []
+    return this.db.getRange(options)
+  }
+
+  getKeys(options = {}) {
+    if (!this.ready) return []
+    return this.db.getKeys(options)
+  }
+
+  // --- Session Garbage Collector ---
+
+  startSessionGC(intervalMs = 60 * 60 * 1000, expirationMs = 7 * 24 * 60 * 60 * 1000) {
+    if (!this.ready) {
+      console.warn('[Storage] GC not started: Storage not ready')
+      return null
+    }
+
+    const BATCH_THRESHOLD = 10000
+    const BATCH_SIZE = 1000
+
+    return setInterval(() => {
+      try {
+        // Count sessions to decide mode
+        let sessionCount = 0
+        // eslint-disable-next-line
+        for (const _ of this.db.getKeys({start: 'sess:', end: 'sess:~', limit: BATCH_THRESHOLD + 1})) {
+          sessionCount++
+          if (sessionCount > BATCH_THRESHOLD) break
+        }
+
+        if (sessionCount > BATCH_THRESHOLD) {
+          this._cleanSessionsBatch(expirationMs, BATCH_SIZE)
+        } else {
+          this._cleanSessionsSimple(expirationMs)
+        }
+      } catch (error) {
+        console.error('\x1b[31m[Storage GC Error]\x1b[0m', error.message)
+      }
+    }, intervalMs)
+  }
+
+  // Simple mode: Load all sessions at once (fast for small datasets)
+  _cleanSessionsSimple(expirationMs) {
+    const now = Date.now()
+    let count = 0
+
+    for (const {key, value} of this.db.getRange({start: 'sess:', end: 'sess:~', snapshot: false})) {
+      if (key.endsWith(':_created') && now - value > expirationMs) {
+        const prefix = key.replace(':_created', '')
+        for (const subKey of this.db.getKeys({start: prefix, end: prefix + '~'})) {
+          this.db.remove(subKey)
+        }
+        count++
+      }
+    }
+
+    if (count > 0) {
+      console.log(`\x1b[36m[Storage GC]\x1b[0m Cleaned ${count} expired sessions.`)
+    }
+  }
+
+  // Batch mode: Process sessions in chunks (memory-safe for large datasets)
+  _cleanSessionsBatch(expirationMs, batchSize) {
+    const now = Date.now()
+    let count = 0
+    let cursor = 'sess:'
+    let hasMore = true
+
+    console.log('\x1b[36m[Storage GC]\x1b[0m Running in batch mode...')
+
+    while (hasMore) {
+      hasMore = false
+      let lastKey = null
+
+      for (const {key, value} of this.db.getRange({start: cursor, end: 'sess:~', limit: batchSize, snapshot: false})) {
+        lastKey = key
+        hasMore = true
+
+        if (key.endsWith(':_created') && now - value > expirationMs) {
+          const prefix = key.replace(':_created', '')
+          for (const subKey of this.db.getKeys({start: prefix, end: prefix + '~'})) {
+            this.db.remove(subKey)
+          }
+          count++
+        }
+      }
+
+      if (lastKey) {
+        cursor = lastKey + '\0'
+      }
+    }
+
+    if (count > 0) {
+      console.log(`\x1b[36m[Storage GC]\x1b[0m Cleaned ${count} expired sessions (batch mode).`)
+    }
+  }
+
+  // --- Utility ---
+
+  close() {
+    if (this.db) {
+      this.db.close()
+      this.ready = false
+    }
+  }
+
+  isReady() {
+    return this.ready
+  }
+}
+
+module.exports = new OdacStorage()

package/src/Token.js

@@ -1,6 +1,9 @@
 const nodeCrypto = require('crypto')
 
 class Token {
+  // CLUSTER SAFETY NOTE:
+  // This is a request-scoped local cache (debounce) for performance.
+  // Valid tokens represent state persisted in Session (LMDB), shared across all workers.
   confirmed = []
 
   constructor(Request) {
@@ -22,10 +25,9 @@ class Token {
 
   // - GENERATE TOKEN
   generate() {
-    let token = nodeCrypto
-      .createHash('md5')
-      .update(this.Request.id + Date.now().toString() + Math.random().toString())
-      .digest('hex')
+    // Enterprise Standard: Use CSPRNG (Cryptographically Secure Pseudo-Random Number Generator)
+    // Replaced weak MD5(Math.random) with randomBytes(32)
+    let token = nodeCrypto.randomBytes(32).toString('hex')
     let tokens = this.Request.session('_token') || []
     tokens.push(token)
     if (tokens.length > 50) tokens = tokens.slice(-50)

package/src/Validator.js

@@ -1,3 +1,82 @@
+const https = require('https')
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+
+let disposableDomains = null
+const CACHE_FILE = path.join(os.tmpdir(), 'odac_disposable_domains.conf')
+const SOURCE_URL = 'https://hub.odac.run/blocklist/disposable-emails'
+
+async function loadDisposableDomains() {
+  if (disposableDomains instanceof Set) return
+
+  disposableDomains = new Set()
+  let content = ''
+  let shouldUpdate = true
+
+  try {
+    try {
+      const fd = fs.openSync(CACHE_FILE, 'r')
+      try {
+        const stats = fs.fstatSync(fd)
+        const ageInHours = (new Date() - stats.mtime) / (1000 * 60 * 60)
+        if (ageInHours < 24) {
+          content = fs.readFileSync(fd, 'utf8')
+          shouldUpdate = false
+        }
+      } finally {
+        fs.closeSync(fd)
+      }
+    } catch {
+      // Cache error check failed, proceed to validation update
+    }
+
+    if (shouldUpdate) {
+      try {
+        content = await new Promise((resolve, reject) => {
+          const req = https.get(SOURCE_URL, res => {
+            if (res.statusCode !== 200) {
+              res.resume()
+              reject(new Error(`Failed to fetch: ${res.statusCode}`))
+              return
+            }
+            let data = ''
+            res.on('data', chunk => (data += chunk))
+            res.on('end', () => resolve(data))
+          })
+          req.on('error', reject)
+          req.end()
+        })
+        const tempFile = `${CACHE_FILE}_${Date.now()}_${Math.random().toString(36).slice(2)}`
+        const fd = fs.openSync(tempFile, 'wx')
+        try {
+          // Sanitize content before writing to file to avoid injection attacks
+          const sanitizedContent = content.replace(/[^a-zA-Z0-9.\-\n\r]/g, '')
+          fs.writeSync(fd, sanitizedContent)
+        } finally {
+          fs.closeSync(fd)
+        }
+        fs.renameSync(tempFile, CACHE_FILE)
+      } catch {
+        if (fs.existsSync(CACHE_FILE)) {
+          content = fs.readFileSync(CACHE_FILE, 'utf8')
+        }
+      }
+    }
+
+    if (content) {
+      content.split('\n').forEach(line => {
+        const domain = line.trim().toLowerCase()
+        if (domain && !domain.startsWith('#')) {
+          disposableDomains.add(domain)
+        }
+      })
+    }
+  } catch (error) {
+    console.error('Validator Warning: Could not load disposable domains.', error.message)
+  }
+}
+
 class Validator {
   #checklist = {}
   #completed = false
@@ -88,9 +167,12 @@ class Validator {
           } else {
             for (const rule of rules.includes('|') ? rules.split('|') : [rules]) {
               let vars = rule.split(':')
-              let inverse = vars[0].startsWith('!')
+              let ruleName = vars[0].trim()
+              let inverse = ruleName.startsWith('!')
+              if (inverse) ruleName = ruleName.substr(1)
+
               if (!error) {
-                switch (inverse ? vars[0].substr(1) : vars[0]) {
+                switch (ruleName) {
                   case 'required':
                     error = value === undefined || value === '' || value === null
                     break
@@ -196,7 +278,7 @@ class Validator {
                       error = true
                     } else {
                       const userData = Odac.Auth.user(vars[1])
-                      if (Odac.Var(userData).is('bcrypt')) {
+                      if (Odac.Var(userData).is('hash')) {
                         error = !Odac.Var(userData).hashCheck(value)
                       } else {
                         error = value !== userData
@@ -204,6 +286,9 @@ class Validator {
                     }
                     break
                   }
+                  case 'disposable':
+                    error = value && value !== '' && !(await Validator.isDisposable(value))
+                    break
                 }
                 if (inverse) error = !error
               }
@@ -220,6 +305,13 @@ class Validator {
     this.#completed = true
   }
 
+  static async isDisposable(email) {
+    if (!email || typeof email !== 'string') return false
+    await loadDisposableDomains()
+    const domain = email.split('@').pop().toLowerCase()
+    return disposableDomains && disposableDomains.has(domain)
+  }
+
   var(name, value = null) {
     if (this.#completed) this.#completed = false
     this.#method = 'VAR'

package/src/Var.js

@@ -1,6 +1,5 @@
 const fs = require('fs')
 const nodeCrypto = require('crypto')
-const bcrypt = require('bcrypt')
 
 class Var {
   #value = null
@@ -79,17 +78,34 @@ class Var {
     return encrypted.toString('base64')
   }
 
-  hash(salt = 10) {
-    return bcrypt.hashSync(this.#value, bcrypt.genSaltSync(salt))
+  hash() {
+    const salt = nodeCrypto.randomBytes(16).toString('hex')
+    const derivedKey = nodeCrypto.scryptSync(this.#value, salt, 64)
+    return `$scrypt$${salt}$${derivedKey.toString('hex')}`
   }
 
   hashCheck(check) {
-    return bcrypt.compareSync(check, this.#value)
+    if (!this.#value.startsWith('$scrypt$')) return false
+    const parts = this.#value.split('$')
+    if (parts.length < 4) return false
+
+    const salt = parts[2]
+    const originalHash = Buffer.from(parts[3], 'hex')
+
+    const derivedKey = nodeCrypto.scryptSync(check, salt, 64)
+    return nodeCrypto.timingSafeEqual(originalHash, derivedKey)
   }
 
   html() {
     if (this.#value === null || this.#value === undefined) return ''
-    return String(this.#value).replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    const map = {
+      '&': '&amp;',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      "'": '&#39;'
+    }
+    return String(this.#value).replace(/[&<>"']/g, m => map[m])
   }
 
   is(...args) {
@@ -102,7 +118,7 @@ class Var {
     if (args.includes('alphaspace')) result = (result || any) && ((any && result) || /^[A-Za-z\s]+$/.test(this.#value))
     if (args.includes('alphanumeric')) result = (result || any) && ((any && result) || /^[A-Za-z0-9]+$/.test(this.#value))
     if (args.includes('alphanumericspace')) result = (result || any) && ((any && result) || /^[A-Za-z0-9\s]+$/.test(this.#value))
-    if (args.includes('bcrypt')) result = (result || any) && ((any && result) || /^\$2[ayb]\$.{56}$/.test(this.#value))
+    if (args.includes('hash')) result = (result || any) && ((any && result) || /^\$scrypt\$[a-f0-9]+\$[a-f0-9]+$/.test(this.#value))
     if (args.includes('date')) result = (result || any) && ((any && result) || !isNaN(Date.parse(this.#value)))
     if (args.includes('domain')) result = (result || any) && ((any && result) || /^([a-z0-9-]+\.){1,2}[a-z]{2,6}$/i.test(this.#value))
     if (args.includes('email'))

package/src/View/EarlyHints.js

@@ -1,4 +1,4 @@
-const fs = require('fs')
+const fs = require('fs').promises
 const path = require('path')
 
 class EarlyHints {
@@ -15,61 +15,71 @@ class EarlyHints {
     }
   }
 
-  init() {
+  async init() {
     if (this.#initialized) return
     this.#initialized = true
 
     if (!this.#config.enabled) return
 
-    this.#buildManifest()
+    await this.#buildManifest()
   }
 
-  #buildManifest() {
+  async #buildManifest() {
     const viewDir = path.join(process.cwd(), 'view')
     const skeletonDir = path.join(process.cwd(), 'skeleton')
 
     try {
-      if (fs.existsSync(viewDir)) {
-        const files = this.#getAllViewFiles(viewDir)
-        for (const file of files) {
-          const html = fs.readFileSync(file, 'utf8')
-          const resources = this.#extractResources(html)
-
-          const relativePath = path.relative(viewDir, file)
-          const viewName = 'view/' + relativePath.replace(/\.html$/, '').replace(/\\/g, '/')
-
-          if (resources.length > 0) {
-            this.#manifest[viewName] = resources
-          }
-        }
+      try {
+        await fs.access(viewDir)
+        const files = await this.#getAllViewFiles(viewDir)
+        await Promise.all(
+          files.map(async file => {
+            const html = await fs.readFile(file, 'utf8')
+            const resources = this.#extractResources(html)
+
+            const relativePath = path.relative(viewDir, file)
+            const viewName = 'view/' + relativePath.replace(/\.html$/, '').replace(/\\/g, '/')
+
+            if (resources.length > 0) {
+              this.#manifest[viewName] = resources
+            }
+          })
+        )
+      } catch {
+        // viewDir might not exist
       }
 
-      if (fs.existsSync(skeletonDir)) {
-        const files = this.#getAllViewFiles(skeletonDir)
-        for (const file of files) {
-          const html = fs.readFileSync(file, 'utf8')
-          const resources = this.#extractResources(html)
-
-          const relativePath = path.relative(skeletonDir, file)
-          const viewName = 'skeleton/' + relativePath.replace(/\.html$/, '').replace(/\\/g, '/')
-
-          if (resources.length > 0) {
-            this.#manifest[viewName] = resources
-          }
-        }
+      try {
+        await fs.access(skeletonDir)
+        const files = await this.#getAllViewFiles(skeletonDir)
+        await Promise.all(
+          files.map(async file => {
+            const html = await fs.readFile(file, 'utf8')
+            const resources = this.#extractResources(html)
+
+            const relativePath = path.relative(skeletonDir, file)
+            const viewName = 'skeleton/' + relativePath.replace(/\.html$/, '').replace(/\\/g, '/')
+
+            if (resources.length > 0) {
+              this.#manifest[viewName] = resources
+            }
+          })
+        )
+      } catch {
+        // skeletonDir might not exist
       }
     } catch {
       // Silently fail, manifest building is optional
     }
   }
 
-  #getAllViewFiles(dir, files = []) {
-    const entries = fs.readdirSync(dir, {withFileTypes: true})
+  async #getAllViewFiles(dir, files = []) {
+    const entries = await fs.readdir(dir, {withFileTypes: true})
 
     for (const entry of entries) {
       const fullPath = path.join(dir, entry.name)
       if (entry.isDirectory()) {
-        this.#getAllViewFiles(fullPath, files)
+        await this.#getAllViewFiles(fullPath, files)
       } else if (entry.isFile() && entry.name.endsWith('.html')) {
         files.push(fullPath)
       }