odac 1.1.0 → 1.3.0

package/src/Server.js

@@ -7,13 +7,17 @@ module.exports = {
   init: function () {
     let args = process.argv.slice(2)
     if (args[0] == 'framework' && args[1] == 'run') args = args.slice(2)
-    let port = parseInt(args[0] ?? '1071')
+    let port = parseInt(args[0])
+    if (isNaN(port)) port = parseInt(process.env.PORT || '1071')
 
     if (cluster.isPrimary) {
-      const numCPUs = os.cpus().length
+      const numCPUs = Odac.Config.debug ? 1 : os.cpus().length
       let isShuttingDown = false
 
-      console.log(`Odac Server running on \x1b]8;;http://127.0.0.1:${port}\x1b\\\x1b[4mhttp://127.0.0.1:${port}\x1b[0m\x1b]8;;\x1b\\.`)
+      const mode = Odac.Config.debug ? '\x1b[33mDevelopment\x1b[0m' : '\x1b[32mProduction\x1b[0m'
+      console.log(
+        `Odac Server running on \x1b]8;;http://127.0.0.1:${port}\x1b\\\x1b[4mhttp://127.0.0.1:${port}\x1b[0m\x1b]8;;\x1b\\ in ${mode} mode.`
+      )
 
       // Start session garbage collector (runs every hour, expires after 7 days)
       Odac.Storage.startSessionGC()
@@ -68,6 +72,39 @@ module.exports = {
         return Odac.Route.request(req, res)
       })
 
+      /**
+       * ENTERPRISE PERFORMANCE CONFIGURATION
+       * ------------------------------------
+       * 1. Keep-Alive: Set higher than the upstream Load Balancer/Proxy (usually 60s).
+       *    This prevents the "502 Bad Gateway" race condition where Node closes
+       *    an idle connection while the proxy attempts to reuse it.
+       */
+      server.keepAliveTimeout = 65000 // 65 seconds
+      server.headersTimeout = 66000 // 66 seconds (Must be > keepAliveTimeout)
+
+      /**
+       * 2. Low Latency: Disable Nagle's Algorithm.
+       *    We want to send data immediately, even if the packet is small.
+       *    Critical for sub-millisecond API responses.
+       */
+      server.on('connection', socket => {
+        socket.setNoDelay(true)
+      })
+
+      /**
+       * 3. Connection Rotation: Force reset after 10k requests.
+       *    - Helps with Load Balancing (clients are forced to reconnect and potentially pick a new pod/worker).
+       *    - Mitigates long-term memory leaks in the TLS/Socket layer.
+       */
+      server.maxRequestsPerSocket = 10000
+
+      /**
+       * 4. Hard Timeout: Kill connection if request processing (headers + body) takes too long.
+       *    - Defaults to 0 (unlimited) or 5min in older Node.
+       *    - 30s is more than enough for an API; fail fast if the client is stuck.
+       */
+      server.requestTimeout = 30000 // 30 seconds
+
       server.on('upgrade', (req, socket, head) => {
         const id = nodeCrypto.randomBytes(16).toString('hex')
         const param = Odac.instance(id, req, null)

package/src/Storage.js

@@ -22,6 +22,10 @@ class OdacStorage {
       this.db = open({
         path: dbPath,
         compression: true
+        // CLUSTER SAFETY NOTE:
+        // LMDB uses memory-mapped files with OS-level locking logic.
+        // Multiple workers can safely read/write to this DB simultaneously.
+        // Data committed by Worker A is immediately visible to Worker B.
       })
       this.ready = true
     } catch (error) {

package/src/Token.js

@@ -1,6 +1,9 @@
 const nodeCrypto = require('crypto')
 
 class Token {
+  // CLUSTER SAFETY NOTE:
+  // This is a request-scoped local cache (debounce) for performance.
+  // Valid tokens represent state persisted in Session (LMDB), shared across all workers.
   confirmed = []
 
   constructor(Request) {
@@ -22,10 +25,9 @@ class Token {
 
   // - GENERATE TOKEN
   generate() {
-    let token = nodeCrypto
-      .createHash('md5')
-      .update(this.Request.id + Date.now().toString() + Math.random().toString())
-      .digest('hex')
+    // Enterprise Standard: Use CSPRNG (Cryptographically Secure Pseudo-Random Number Generator)
+    // Replaced weak MD5(Math.random) with randomBytes(32)
+    let token = nodeCrypto.randomBytes(32).toString('hex')
     let tokens = this.Request.session('_token') || []
     tokens.push(token)
     if (tokens.length > 50) tokens = tokens.slice(-50)

package/src/Validator.js

@@ -1,10 +1,10 @@
 const https = require('https')
 const fs = require('fs')
-const os = require('os')
+const fsPromises = fs.promises
 const path = require('path')
 
 let disposableDomains = null
-const CACHE_FILE = path.join(os.tmpdir(), 'odac_disposable_domains.conf')
+const CACHE_FILE = path.join(global.__dir || process.cwd(), 'storage', '.cache', 'odac_disposable_domains.conf')
 const SOURCE_URL = 'https://hub.odac.run/blocklist/disposable-emails'
 
 async function loadDisposableDomains() {
@@ -16,16 +16,16 @@ async function loadDisposableDomains() {
 
   try {
     try {
-      const fd = fs.openSync(CACHE_FILE, 'r')
+      const handle = await fsPromises.open(CACHE_FILE, 'r')
       try {
-        const stats = fs.fstatSync(fd)
+        const stats = await handle.stat()
         const ageInHours = (new Date() - stats.mtime) / (1000 * 60 * 60)
         if (ageInHours < 24) {
-          content = fs.readFileSync(fd, 'utf8')
+          content = await handle.readFile('utf8')
           shouldUpdate = false
         }
       } finally {
-        fs.closeSync(fd)
+        await handle.close()
       }
     } catch {
       // Cache error check failed, proceed to validation update
@@ -48,18 +48,25 @@ async function loadDisposableDomains() {
           req.end()
         })
         const tempFile = `${CACHE_FILE}_${Date.now()}_${Math.random().toString(36).slice(2)}`
-        const fd = fs.openSync(tempFile, 'wx')
+        await fsPromises.mkdir(path.dirname(CACHE_FILE), {recursive: true})
+        const handle = await fsPromises.open(tempFile, 'wx', 0o600)
         try {
-          // Sanitize content before writing to file to avoid injection attacks
+          // SECURITY NOTE: Supply Chain Attack Mitigation
+          // We strictly sanitize the content fetched from the remote source before writing it to the local file system.
+          // The regex whitelist /[^a-zA-Z0-9.\-\n\r]/g restricts the content to only alphanumeric characters, dots, hyphens, and newlines.
+          // This aggressively neutralizes any potential malicious payloads (e.g., specific code injection, shell commands, or scrips)
+          // even if the remote source (hub.odac.run) is compromised.
           const sanitizedContent = content.replace(/[^a-zA-Z0-9.\-\n\r]/g, '')
-          fs.writeSync(fd, sanitizedContent)
+          await handle.write(sanitizedContent)
         } finally {
-          fs.closeSync(fd)
+          await handle.close()
         }
-        fs.renameSync(tempFile, CACHE_FILE)
+        await fsPromises.rename(tempFile, CACHE_FILE)
       } catch {
-        if (fs.existsSync(CACHE_FILE)) {
-          content = fs.readFileSync(CACHE_FILE, 'utf8')
+        try {
+          content = await fsPromises.readFile(CACHE_FILE, 'utf8')
+        } catch {
+          // No cache file available
         }
       }
     }
@@ -73,7 +80,9 @@ async function loadDisposableDomains() {
       })
     }
   } catch (error) {
-    console.error('Validator Warning: Could not load disposable domains.', error.message)
+    console.error(
+      JSON.stringify({level: 'error', tag: 'ODAC Validator', message: 'Could not load disposable domains.', error: error.message})
+    )
   }
 }
 
@@ -278,7 +287,7 @@ class Validator {
                       error = true
                     } else {
                       const userData = Odac.Auth.user(vars[1])
-                      if (Odac.Var(userData).is('bcrypt')) {
+                      if (Odac.Var(userData).is('hash')) {
                         error = !Odac.Var(userData).hashCheck(value)
                       } else {
                         error = value !== userData

package/src/Var.js

@@ -1,6 +1,5 @@
 const fs = require('fs')
 const nodeCrypto = require('crypto')
-const bcrypt = require('bcrypt')
 
 class Var {
   #value = null
@@ -79,17 +78,34 @@ class Var {
     return encrypted.toString('base64')
   }
 
-  hash(salt = 10) {
-    return bcrypt.hashSync(this.#value, bcrypt.genSaltSync(salt))
+  hash() {
+    const salt = nodeCrypto.randomBytes(16).toString('hex')
+    const derivedKey = nodeCrypto.scryptSync(this.#value, salt, 64)
+    return `$scrypt$${salt}$${derivedKey.toString('hex')}`
   }
 
   hashCheck(check) {
-    return bcrypt.compareSync(check, this.#value)
+    if (!this.#value.startsWith('$scrypt$')) return false
+    const parts = this.#value.split('$')
+    if (parts.length < 4) return false
+
+    const salt = parts[2]
+    const originalHash = Buffer.from(parts[3], 'hex')
+
+    const derivedKey = nodeCrypto.scryptSync(check, salt, 64)
+    return nodeCrypto.timingSafeEqual(originalHash, derivedKey)
   }
 
   html() {
     if (this.#value === null || this.#value === undefined) return ''
-    return String(this.#value).replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    const map = {
+      '&': '&amp;',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      "'": '&#39;'
+    }
+    return String(this.#value).replace(/[&<>"']/g, m => map[m])
   }
 
   is(...args) {
@@ -102,7 +118,7 @@ class Var {
     if (args.includes('alphaspace')) result = (result || any) && ((any && result) || /^[A-Za-z\s]+$/.test(this.#value))
     if (args.includes('alphanumeric')) result = (result || any) && ((any && result) || /^[A-Za-z0-9]+$/.test(this.#value))
     if (args.includes('alphanumericspace')) result = (result || any) && ((any && result) || /^[A-Za-z0-9\s]+$/.test(this.#value))
-    if (args.includes('bcrypt')) result = (result || any) && ((any && result) || /^\$2[ayb]\$.{56}$/.test(this.#value))
+    if (args.includes('hash')) result = (result || any) && ((any && result) || /^\$scrypt\$[a-f0-9]+\$[a-f0-9]+$/.test(this.#value))
     if (args.includes('date')) result = (result || any) && ((any && result) || !isNaN(Date.parse(this.#value)))
     if (args.includes('domain')) result = (result || any) && ((any && result) || /^([a-z0-9-]+\.){1,2}[a-z]{2,6}$/i.test(this.#value))
     if (args.includes('email'))

package/src/View/EarlyHints.js

@@ -1,4 +1,4 @@
-const fs = require('fs')
+const fs = require('fs').promises
 const path = require('path')
 
 class EarlyHints {
@@ -15,61 +15,71 @@ class EarlyHints {
     }
   }
 
-  init() {
+  async init() {
     if (this.#initialized) return
     this.#initialized = true
 
     if (!this.#config.enabled) return
 
-    this.#buildManifest()
+    await this.#buildManifest()
   }
 
-  #buildManifest() {
+  async #buildManifest() {
     const viewDir = path.join(process.cwd(), 'view')
     const skeletonDir = path.join(process.cwd(), 'skeleton')
 
     try {
-      if (fs.existsSync(viewDir)) {
-        const files = this.#getAllViewFiles(viewDir)
-        for (const file of files) {
-          const html = fs.readFileSync(file, 'utf8')
-          const resources = this.#extractResources(html)
-
-          const relativePath = path.relative(viewDir, file)
-          const viewName = 'view/' + relativePath.replace(/\.html$/, '').replace(/\\/g, '/')
-
-          if (resources.length > 0) {
-            this.#manifest[viewName] = resources
-          }
-        }
+      try {
+        await fs.access(viewDir)
+        const files = await this.#getAllViewFiles(viewDir)
+        await Promise.all(
+          files.map(async file => {
+            const html = await fs.readFile(file, 'utf8')
+            const resources = this.#extractResources(html)
+
+            const relativePath = path.relative(viewDir, file)
+            const viewName = 'view/' + relativePath.replace(/\.html$/, '').replace(/\\/g, '/')
+
+            if (resources.length > 0) {
+              this.#manifest[viewName] = resources
+            }
+          })
+        )
+      } catch {
+        // viewDir might not exist
       }
 
-      if (fs.existsSync(skeletonDir)) {
-        const files = this.#getAllViewFiles(skeletonDir)
-        for (const file of files) {
-          const html = fs.readFileSync(file, 'utf8')
-          const resources = this.#extractResources(html)
-
-          const relativePath = path.relative(skeletonDir, file)
-          const viewName = 'skeleton/' + relativePath.replace(/\.html$/, '').replace(/\\/g, '/')
-
-          if (resources.length > 0) {
-            this.#manifest[viewName] = resources
-          }
-        }
+      try {
+        await fs.access(skeletonDir)
+        const files = await this.#getAllViewFiles(skeletonDir)
+        await Promise.all(
+          files.map(async file => {
+            const html = await fs.readFile(file, 'utf8')
+            const resources = this.#extractResources(html)
+
+            const relativePath = path.relative(skeletonDir, file)
+            const viewName = 'skeleton/' + relativePath.replace(/\.html$/, '').replace(/\\/g, '/')
+
+            if (resources.length > 0) {
+              this.#manifest[viewName] = resources
+            }
+          })
+        )
+      } catch {
+        // skeletonDir might not exist
       }
     } catch {
       // Silently fail, manifest building is optional
     }
   }
 
-  #getAllViewFiles(dir, files = []) {
-    const entries = fs.readdirSync(dir, {withFileTypes: true})
+  async #getAllViewFiles(dir, files = []) {
+    const entries = await fs.readdir(dir, {withFileTypes: true})
 
     for (const entry of entries) {
       const fullPath = path.join(dir, entry.name)
       if (entry.isDirectory()) {
-        this.#getAllViewFiles(fullPath, files)
+        await this.#getAllViewFiles(fullPath, files)
       } else if (entry.isFile() && entry.name.endsWith('.html')) {
         files.push(fullPath)
       }

package/src/View/Form.js

@@ -12,20 +12,26 @@ class Form {
 
   static parseFormType(content, Odac, type) {
     const regex = new RegExp(`<odac:${type}[\\s\\S]*?<\\/odac:${type}>`, 'g')
-    const matches = content.match(regex)
-    if (!matches) return content
+    return content.replace(regex, match => {
+      const formConfig = this.extractConfig(match, null, type)
+      const configStr = JSON.stringify(formConfig)
+      const matchStr = JSON.stringify(match)
+      return `<script:odac>html += await Odac.View.Form.runtime(Odac, '${type}', ${configStr}, ${matchStr});</script:odac>`
+    })
+  }
 
-    for (const match of matches) {
-      const formToken = nodeCrypto.randomBytes(32).toString('hex')
-      const formConfig = this.extractConfig(match, formToken, type)
+  /**
+   * Generates the form at runtime to ensure a fresh token is created and stored
+   * in the current session for every request. This prevents "session expired"
+   * errors caused by caching the form token in the compiled view.
+   */
+  static async runtime(Odac, type, config, originalHtml) {
+    const token = nodeCrypto.randomBytes(32).toString('hex')
+    config.token = token
 
-      this.storeConfig(formToken, formConfig, Odac, type)
+    this.storeConfig(token, config, Odac, type)
 
-      const generatedForm = this.generateForm(match, formConfig, formToken, type)
-      content = content.replace(match, generatedForm)
-    }
-
-    return content
+    return this.generateForm(originalHtml, config, token, type)
   }
 
   static extractConfig(html, formToken, type) {

package/src/View.js

@@ -1,5 +1,6 @@
 const nodeCrypto = require('crypto')
 const fs = require('fs')
+const fsPromises = fs.promises
 const Form = require('./View/Form')
 const EarlyHints = require('./View/EarlyHints')
 
@@ -8,7 +9,6 @@ const TITLE_REGEX = /<title[^>]*>([^<]*)<\/title>/i
 const CACHE_DIR = './storage/.cache'
 
 class View {
-  #cache = {}
   #earlyHints = null
   #functions = {
     '{!!': {
@@ -116,6 +116,8 @@ class View {
     } else {
       this.#earlyHints = global.Odac.View.EarlyHints
     }
+    global.Odac.View.Form = Form
+    this.Form = Form
   }
 
   all(name) {
@@ -147,7 +149,7 @@ class View {
         if (this.#part[element]) {
           let viewPath = this.#part[element]
           if (viewPath.includes('.')) viewPath = viewPath.replace(/\./g, '/')
-          if (fs.existsSync(`./view/${element}/${viewPath}.html`)) {
+          if (await this.#exists(`./view/${element}/${viewPath}.html`)) {
             const html = await this.#render(`./view/${element}/${viewPath}.html`)
             output[element] = html
 
@@ -167,7 +169,7 @@ class View {
           if (this.#part[key] && !this.#odac.Request.ajaxLoad.includes(key)) {
             let viewPath = this.#part[key]
             if (viewPath.includes('.')) viewPath = viewPath.replace(/\./g, '/')
-            if (fs.existsSync(`./view/${key}/${viewPath}.html`)) {
+            if (await this.#exists(`./view/${key}/${viewPath}.html`)) {
               try {
                 const partHtml = await this.#render(`./view/${key}/${viewPath}.html`)
                 const titleMatch = partHtml.match(TITLE_REGEX)
@@ -205,8 +207,8 @@ class View {
 
     // Normal page rendering
     let result = ''
-    if (this.#part.skeleton && fs.existsSync(`./skeleton/${this.#part.skeleton}.html`)) {
-      result = fs.readFileSync(`./skeleton/${this.#part.skeleton}.html`, 'utf8')
+    if (this.#part.skeleton && (await this.#exists(`./skeleton/${this.#part.skeleton}.html`))) {
+      result = await this.#readSkeleton(`./skeleton/${this.#part.skeleton}.html`)
 
       // Add data-odac-navigate to content wrapper for auto-navigation
       result = this.#addNavigateAttribute(result)
@@ -215,7 +217,7 @@ class View {
         if (['all', 'skeleton'].includes(key)) continue
         if (!this.#part[key]) continue
         if (this.#part[key].includes('.')) this.#part[key] = this.#part[key].replace(/\./g, '/')
-        if (fs.existsSync(`./view/${key}/${this.#part[key]}.html`)) {
+        if (await this.#exists(`./view/${key}/${this.#part[key]}.html`)) {
           result = result.replace(`{{ ${key.toUpperCase()} }}`, await this.#render(`./view/${key}/${this.#part[key]}.html`))
         }
       }
@@ -227,7 +229,7 @@ class View {
             let file = this.#part.all.split('.')
             file.splice(-1, 0, part.toLowerCase())
             file = file.join('/')
-            if (fs.existsSync(`./view/${file}.html`)) {
+            if (await this.#exists(`./view/${file}.html`)) {
               result = result.replace(`{{ ${part.toUpperCase()} }}`, await this.#render(`./view/${file}.html`))
             }
           }
@@ -363,10 +365,42 @@ class View {
   }
 
   async #render(file) {
-    let mtime = fs.statSync(file).mtimeMs
-    let content = fs.readFileSync(file, 'utf8')
+    if (!global.Odac.View) global.Odac.View = {}
+    if (!global.Odac.View.cache) global.Odac.View.cache = {}
+
+    // Performance: In Production, skip stat check if cached
+    if (!this.#odac.Config?.debug && global.Odac.View.cache[file]) {
+      try {
+        return await require(`${__dir}/${CACHE_DIR}/${global.Odac.View.cache[file].cache}`)(
+          this.#odac,
+          key => this.#odac.Request.get(key),
+          (...args) => this.#odac.Lang.get(...args)
+        )
+      } catch {
+        // Fallback if cache file missing
+      }
+    }
+
+    let mtime
+    let content = null
+
+    try {
+      const handle = await fsPromises.open(file, 'r')
+      try {
+        const stats = await handle.stat()
+        mtime = stats.mtimeMs
+
+        if (global.Odac.View.cache[file]?.mtime !== mtime) {
+          content = await handle.readFile('utf8')
+        }
+      } finally {
+        await handle.close()
+      }
+    } catch {
+      return ''
+    }
 
-    if (this.#cache[file]?.mtime !== mtime) {
+    if (content !== null) {
       content = Form.parse(content, this.#odac)
 
       const jsBlocks = []
@@ -451,8 +485,8 @@ class View {
         }
       }
       let cache = `${nodeCrypto.createHash('md5').update(file).digest('hex')}`
-      if (!fs.existsSync(CACHE_DIR)) fs.mkdirSync(CACHE_DIR, {recursive: true})
-      fs.writeFileSync(
+      await fsPromises.mkdir(CACHE_DIR, {recursive: true})
+      await fsPromises.writeFile(
         `${CACHE_DIR}/${cache}`,
         `module.exports = async (Odac, get, __) => {\nlet html = '';\n${result}\nreturn html.trim()\n}`
       )
@@ -550,6 +584,28 @@ class View {
       this.#odac.Request.setEarlyHints(hints)
     }
   }
+
+  async #exists(path) {
+    try {
+      await fsPromises.access(path)
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  async #readSkeleton(path) {
+    if (!global.Odac.View.skeletons) global.Odac.View.skeletons = {}
+
+    // In production (debug=false), cache logic
+    if (!this.#odac.Config?.debug && global.Odac.View.skeletons[path]) {
+      return global.Odac.View.skeletons[path]
+    }
+
+    const content = await fsPromises.readFile(path, 'utf8')
+    global.Odac.View.skeletons[path] = content
+    return content
+  }
 }
 
 module.exports = View