proteum 2.1.0 → 2.1.2

package/server/services/router/http/index.ts

@@ -17,12 +17,14 @@ import helmet from 'helmet'; // Diverses protections
 import compression from 'compression';
 import fileUpload from 'express-fileupload';
 import cookieParser from 'cookie-parser';
-import * as csp from 'express-csp-header';
 
 // Core
 import Container from '@server/app/container';
+import type CronManager from '@server/services/cron';
+import type CronTask from '@server/services/cron/CronTask';
 import type { TServerRouter } from '..';
 import { serverHotReloadMessageType } from '@common/dev/serverHotReload';
+import { explainSectionNames } from '@common/dev/diagnostics';
 
 // Middlewaees (core)
 import { isMutipart, MiddlewareFormData } from './multipart';
@@ -50,6 +52,27 @@ export type Config = {
 
 export type Hooks = {};
 
+type TContentSecurityPolicyOptions = NonNullable<Parameters<typeof helmet.contentSecurityPolicy>[0]>;
+type TContentSecurityPolicyDirectives = NonNullable<TContentSecurityPolicyOptions['directives']>;
+
+const createContentSecurityPolicy = (config: Config['csp']): TContentSecurityPolicyOptions => {
+    const directives: TContentSecurityPolicyDirectives = {
+        defaultSrc:
+            config.default && config.default.length > 0
+                ? [...config.default]
+                : helmet.contentSecurityPolicy.dangerouslyDisableDefaultSrc,
+        scriptSrc: ["'unsafe-inline'", "'self'", "'unsafe-eval'", ...config.scripts],
+    };
+
+    if (config.styles && config.styles.length > 0) directives.styleSrc = [...config.styles];
+    if (config.images && config.images.length > 0) directives.imgSrc = [...config.images];
+
+    return {
+        useDefaults: false,
+        directives,
+    };
+};
+
 /*----------------------------------
 - FUNCTION
 ----------------------------------*/
@@ -200,12 +223,9 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
 
         if (this.config.cors !== undefined) routes.use(cors(this.config.cors));
 
-        routes.use(
-            csp.expressCspHeader({
-                directives: { 'script-src': [csp.INLINE, csp.SELF, csp.UNSAFE_EVAL, ...this.config.csp.scripts] },
-            }),
-        );
+        routes.use(helmet.contentSecurityPolicy(createContentSecurityPolicy(this.config.csp)));
 
+        this.registerDevTraceRoutes(routes);
         routes.use(routeRequest);
 
         /*----------------------------------
@@ -227,4 +247,151 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
     public async cleanup() {
         this.http.close();
     }
+
+    private registerDevTraceRoutes(routes: express.Express) {
+        if (!__DEV__ || this.app.env.profile !== 'dev') return;
+
+        if (this.app.container.Trace.isEnabled()) {
+            routes.get('/__proteum/trace/requests', (req, res) => {
+                const rawLimit = Array.isArray(req.query.limit) ? req.query.limit[0] : req.query.limit;
+                const parsedLimit = typeof rawLimit === 'string' ? Number.parseInt(rawLimit, 10) : NaN;
+                const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? parsedLimit : 20;
+
+                res.json({ requests: this.app.container.Trace.listRequests(limit) });
+            });
+
+            routes.get('/__proteum/trace/latest', (_req, res) => {
+                const request = this.app.container.Trace.getLatestRequest();
+                if (!request) {
+                    res.status(404).json({ error: 'No request trace is available yet.' });
+                    return;
+                }
+
+                res.json({ request });
+            });
+
+            routes.get('/__proteum/trace/requests/:id', (req, res) => {
+                const request = this.app.container.Trace.getRequest(req.params.id);
+                if (!request) {
+                    res.status(404).json({ error: `Trace ${req.params.id} was not found.` });
+                    return;
+                }
+
+                res.json({ request });
+            });
+
+            routes.post('/__proteum/trace/arm', (req, res) => {
+                const rawCapture = typeof req.body.capture === 'string' ? req.body.capture : 'deep';
+                const capture = this.app.container.Trace.armNextRequest(rawCapture);
+
+                res.json({ armed: true, capture });
+            });
+        }
+
+        routes.get('/__proteum/explain', (req, res) => {
+            const rawSections = [
+                ...(Array.isArray(req.query.section) ? req.query.section : req.query.section ? [req.query.section] : []),
+                ...(Array.isArray(req.query.sections)
+                    ? req.query.sections.flatMap((value) => (typeof value === 'string' ? value.split(',') : []))
+                    : typeof req.query.sections === 'string'
+                      ? req.query.sections.split(',')
+                      : []),
+            ]
+                .map((value) => (typeof value === 'string' ? value.trim() : ''))
+                .filter(Boolean);
+
+            try {
+                const diagnostics = this.app.getDevDiagnostics();
+                const sections = diagnostics.normalizeExplainSections(rawSections);
+                res.json(diagnostics.explain(sections));
+            } catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                const isBadRequest = explainSectionNames.some((sectionName) => message.includes(sectionName)) || message.includes('Unknown explain section');
+                res.status(isBadRequest ? 400 : 500).json({ error: message });
+            }
+        });
+
+        routes.get('/__proteum/doctor', (req, res) => {
+            const rawStrict = Array.isArray(req.query.strict) ? req.query.strict[0] : req.query.strict;
+            const strict = rawStrict === '1' || rawStrict === 'true';
+
+            try {
+                res.json(this.app.getDevDiagnostics().doctor(strict));
+            } catch (error) {
+                res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
+            }
+        });
+
+        routes.get('/__proteum/cron/tasks', (_req, res) => {
+            const cron = this.getCronManager();
+            res.json({
+                automaticExecution: cron?.isAutomaticExecutionEnabled() ?? false,
+                tasks: cron?.listTasks() ?? [],
+            });
+        });
+
+        routes.get('/__proteum/commands', (_req, res) => {
+            res.json({ commands: this.app.getDevCommands().list() });
+        });
+
+        routes.post('/__proteum/commands/run', async (req, res) => {
+            const commandPath = typeof req.body?.path === 'string' ? req.body.path.trim() : '';
+            if (!commandPath) {
+                res.status(400).json({ error: 'Command path is required.' });
+                return;
+            }
+
+            try {
+                const execution = await this.app.getDevCommands().run(commandPath);
+                res.json({ execution });
+            } catch (error) {
+                const execution =
+                    error instanceof Error && 'execution' in error && typeof error.execution === 'object'
+                        ? error.execution
+                        : undefined;
+                const statusCode = error instanceof Error && error.name === 'NotFound' ? 404 : 500;
+
+                res.status(statusCode).json({
+                    error: error instanceof Error ? error.message : String(error),
+                    execution,
+                });
+            }
+        });
+
+        routes.post('/__proteum/cron/tasks/run', async (req, res) => {
+            const cron = this.getCronManager();
+            if (!cron) {
+                res.status(404).json({ error: 'Cron service is not registered for this app.' });
+                return;
+            }
+
+            const name = typeof req.body?.name === 'string' ? req.body.name.trim() : '';
+            if (!name) {
+                res.status(400).json({ error: 'Cron task name is required.' });
+                return;
+            }
+
+            let task: CronTask;
+            try {
+                task = cron.get(name);
+            } catch (error) {
+                res.status(404).json({ error: error instanceof Error ? error.message : String(error) });
+                return;
+            }
+
+            try {
+                await cron.exec(name);
+                res.json({ task: task.toProfilerTask() });
+            } catch (error) {
+                res.status(500).json({
+                    error: error instanceof Error ? error.message : String(error),
+                    task: task.toProfilerTask(),
+                });
+            }
+        });
+    }
+
+    private getCronManager() {
+        return (this.app as typeof this.app & { Cron?: CronManager }).Cron;
+    }
 }

package/server/services/router/index.ts

@@ -32,11 +32,16 @@ import BaseRouter, {
     defaultOptions,
     matchRoute,
     buildUrl,
-    TDomainsList,
 } from '@common/router';
 import type { TSsrUnresolvedRoute, TRegisterPageArgs } from '@common/router/contracts';
 import { buildRegex, getRegisterPageArgs } from '@common/router/register';
 import { layoutsList, getLayout } from '@common/router/layouts';
+import {
+    profilerOriginHeader,
+    profilerParentRequestIdHeader,
+    profilerSessionIdHeader,
+    profilerTraceRequestIdHeader,
+} from '@common/dev/profiler';
 import { TFetcherList } from '@common/router/request/api';
 import type { TFrontRenderer } from '@common/router/response/page';
 
@@ -108,7 +113,7 @@ export type Config<
 
     disk?: string; // Disk driver ID
 
-    domains: TDomainsList;
+    currentDomain: string;
 
     http: HttpServiceConfig;
 
@@ -356,7 +361,7 @@ export default class ServerRouter<
     }
 
     public url = (path: string, params: {} = {}, absolute: boolean = true) =>
-        buildUrl(path, params, this.config.domains, absolute);
+        buildUrl(path, params, this.config.currentDomain, absolute);
 
     /*----------------------------------
     - REGISTER
@@ -581,14 +586,33 @@ export default class ServerRouter<
             this,
         );
 
+        this.app.container.Trace.startRequest({
+            id: request.id,
+            method: request.method,
+            path: request.path,
+            url: request.url,
+            headers: request.headers,
+            data: request.data,
+            profilerSessionId: request.headers[profilerSessionIdHeader] || undefined,
+            profilerOrigin: request.headers[profilerOriginHeader] || undefined,
+            profilerParentRequestId: request.headers[profilerParentRequestIdHeader] || undefined,
+        });
+        if (this.app.container.Trace.isEnabled()) res.setHeader(profilerTraceRequestIdHeader, request.id);
+
         let response: ServerResponse<this>;
         try {
             // Hook
             await this.runHook('request', request);
+            this.app.container.Trace.setRequestUser(request.id, request.user?.email);
 
             // Bulk API Requests
             if (request.path === '/api' && typeof request.data.fetchers === 'object') {
-                return await this.resolveApiBatch(request.data.fetchers, request);
+                await this.resolveApiBatch(request.data.fetchers, request);
+                this.app.container.Trace.finishRequest(request.id, {
+                    statusCode: request.res.statusCode || 200,
+                    user: request.user?.email,
+                });
+                return;
             } else {
                 response = await this.resolve(
                     request,
@@ -604,7 +628,17 @@ export default class ServerRouter<
             // Static pages
             if (cachedPage) {
                 console.log('[router] Get static page from cache', req.path);
+                this.app.container.Trace.record(
+                    request.id,
+                    'response.send',
+                    { cached: true, statusCode: response.statusCode, contentType: 'text/html' },
+                    'summary',
+                );
                 res.send(cachedPage.rendered);
+                this.app.container.Trace.finishRequest(request.id, {
+                    statusCode: response.statusCode,
+                    user: request.user?.email,
+                });
                 return;
             }
 
@@ -613,9 +647,34 @@ export default class ServerRouter<
             // Headers
             res.header(response.headers);
             // Data
+            this.app.container.Trace.record(
+                request.id,
+                'response.send',
+                {
+                    cached: false,
+                    statusCode: response.statusCode,
+                    contentType: response.headers['Content-Type'] || '',
+                    headerKeys: Object.keys(response.headers),
+                },
+                'summary',
+            );
             res.send(response.data);
+            this.app.container.Trace.finishRequest(request.id, {
+                statusCode: response.statusCode,
+                user: request.user?.email,
+            });
         } else if (response.data !== 'true') {
+            this.app.container.Trace.finishRequest(request.id, {
+                statusCode: res.statusCode || response.statusCode,
+                user: request.user?.email,
+                errorMessage: "Can't return data from the controller since response has already been sent via express.",
+            });
             throw new Error("Can't return data from the controller since response has already been sent via express.");
+        } else {
+            this.app.container.Trace.finishRequest(request.id, {
+                statusCode: res.statusCode || response.statusCode,
+                user: request.user?.email,
+            });
         }
     }
 
@@ -655,6 +714,16 @@ export default class ServerRouter<
                 },
                 async () => {
                     const timeStart = Date.now();
+                    const routeStats = {
+                        total: this.routes.length,
+                        staticSkipped: 0,
+                        methodMismatch: 0,
+                        acceptMismatch: 0,
+                        pathMismatch: 0,
+                        matched: 0,
+                    };
+
+                    this.app.container.Trace.record(request.id, 'resolve.start', { isStatic: Boolean(isStatic) }, 'summary');
 
                     if (this.status === 'starting') {
                         console.log(LogPrefix, `Waiting for servert to be resdy before resolving request`);
@@ -669,6 +738,16 @@ export default class ServerRouter<
                         // Controller route
                         const controllerRoute = this.controllers[request.path];
                         if (controllerRoute !== undefined) {
+                            this.app.container.Trace.record(
+                                request.id,
+                                'resolve.controller-route',
+                                {
+                                    path: request.path,
+                                    accept: controllerRoute.options.accept || '',
+                                    filepath: controllerRoute.options.filepath || '',
+                                },
+                                'summary',
+                            );
                             // Create response
                             await response.runController(controllerRoute);
                             if (response.wasProvided) return resolve(response);
@@ -679,21 +758,81 @@ export default class ServerRouter<
 
                         // Classic routes
                         for (const route of this.routes) {
-                            if (isStatic && !route.options.whenStatic) continue;
+                            if (isStatic && !route.options.whenStatic) {
+                                routeStats.staticSkipped++;
+                                continue;
+                            }
 
                             // Match Method
-                            if (request.method !== route.method && route.method !== '*') continue;
+                            if (request.method !== route.method && route.method !== '*') {
+                                routeStats.methodMismatch++;
+                                if (this.app.container.Trace.shouldCapture(request.id, 'deep')) {
+                                    this.app.container.Trace.record(
+                                        request.id,
+                                        'resolve.route-skip',
+                                        {
+                                            reason: 'method',
+                                            routeMethod: route.method,
+                                            requestMethod: request.method,
+                                            routePath: route.path || '',
+                                            routeId: route.options.id || '',
+                                            filepath: route.options.filepath || '',
+                                        },
+                                        'deep',
+                                    );
+                                }
+                                continue;
+                            }
 
                             // Match Response format
-                            if (!request.accepts(route.options.accept)) continue;
+                            if (!request.accepts(route.options.accept)) {
+                                routeStats.acceptMismatch++;
+                                if (this.app.container.Trace.shouldCapture(request.id, 'deep')) {
+                                    this.app.container.Trace.record(
+                                        request.id,
+                                        'resolve.route-skip',
+                                        {
+                                            reason: 'accept',
+                                            routeAccept: route.options.accept || '',
+                                            routePath: route.path || '',
+                                            routeId: route.options.id || '',
+                                            filepath: route.options.filepath || '',
+                                        },
+                                        'deep',
+                                    );
+                                }
+                                continue;
+                            }
 
                             const isMatching = matchRoute(route, request);
-                            if (!isMatching) continue;
+                            if (!isMatching) {
+                                routeStats.pathMismatch++;
+                                if (this.app.container.Trace.shouldCapture(request.id, 'deep')) {
+                                    this.app.container.Trace.record(
+                                        request.id,
+                                        'resolve.route-skip',
+                                        {
+                                            reason: 'path',
+                                            routePath: route.path || '',
+                                            routeId: route.options.id || '',
+                                            filepath: route.options.filepath || '',
+                                        },
+                                        'deep',
+                                    );
+                                }
+                                continue;
+                            }
 
+                            routeStats.matched++;
                             await this.resolvedRoute(route, response, timeStart);
-                            if (response.wasProvided) return resolve(response);
+                            if (response.wasProvided) {
+                                this.app.container.Trace.record(request.id, 'resolve.routes-evaluated', routeStats, 'resolve');
+                                return resolve(response);
+                            }
                         }
 
+                        this.app.container.Trace.record(request.id, 'resolve.routes-evaluated', routeStats, 'resolve');
+                        this.app.container.Trace.record(request.id, 'resolve.not-found', { path: request.path }, 'summary');
                         reject(new NotFound());
                     } catch (error) {
                         const typedError =
@@ -721,6 +860,19 @@ export default class ServerRouter<
     private async resolvedRoute(route: TMatchedRoute, response: ServerResponse<this>, timeStart: number) {
         route = await response.resolveRouteOptions(route);
 
+        this.app.container.Trace.record(
+            response.request.id,
+            'resolve.route-match',
+            {
+                routePath: route.path || '',
+                routeId: route.options.id || '',
+                filepath: route.options.filepath || '',
+                accept: route.options.accept || '',
+                method: route.method,
+            },
+            'summary',
+        );
+
         // Run on resolution hooks. Ex: authentication check
         await this.runHook('resolved', route, response.request, response);
 
@@ -757,10 +909,36 @@ export default class ServerRouter<
             if (!fetcher || !('method' in fetcher)) continue;
 
             const { method, path, data } = fetcher;
+            const callId = this.app.container.Trace.startCall(request.id, {
+                origin: 'api-batch-fetcher',
+                label: id,
+                method,
+                path,
+                fetcherId: id,
+                requestDataKeys: data && typeof data === 'object' ? Object.keys(data) : [],
+                requestData: data,
+            });
 
-            const response = await this.resolve(request.children(method, path, data));
-
-            responseData[id] = response.data;
+            try {
+                const response = await this.resolve(request.children(method, path, data));
+                responseData[id] = response.data;
+                this.app.container.Trace.finishCall(request.id, callId, {
+                    statusCode: response.statusCode,
+                    resultKeys:
+                        response.data && typeof response.data === 'object' && !Array.isArray(response.data)
+                            ? Object.keys(response.data as Record<string, unknown>)
+                            : [],
+                    result: response.data,
+                });
+            } catch (error) {
+                const typedError = error instanceof Error ? error : new Error(typeof error === 'string' ? error : 'Unknown error');
+                const statusCode = 'http' in typedError ? Number((typedError as Error & { http?: number }).http) : undefined;
+                this.app.container.Trace.finishCall(request.id, callId, {
+                    statusCode: Number.isFinite(statusCode) ? statusCode : undefined,
+                    errorMessage: typedError.message,
+                });
+                throw error;
+            }
 
             // TODO: merge response.headers ?
         }
@@ -782,6 +960,16 @@ export default class ServerRouter<
 
         const response = new ServerResponse(request).status(code);
 
+        this.app.container.Trace.record(
+            request.id,
+            'error',
+            {
+                code,
+                error,
+            },
+            'summary',
+        );
+
         // Rapport / debug
         if (code === 500) {
             // Print the error here so the stacktrace appears in the bug report logs

package/server/services/router/request/api.ts

@@ -80,7 +80,36 @@ export default class ApiClientRequest extends RequestService implements ApiClien
 
             // Create a children request to resolve the api data
             const request = this.request.children(method, path, data);
-            fetchedData[id] = await request.router.resolve(request).then((res) => res.data);
+            const callId = this.request.router.app.container.Trace.startCall(this.request.id, {
+                origin: 'ssr-fetcher',
+                label: id,
+                method,
+                path,
+                fetcherId: id,
+                requestDataKeys: data && typeof data === 'object' ? Object.keys(data) : [],
+                requestData: data,
+            });
+
+            try {
+                const response = await request.router.resolve(request);
+                fetchedData[id] = response.data;
+                this.request.router.app.container.Trace.finishCall(this.request.id, callId, {
+                    statusCode: response.statusCode,
+                    resultKeys:
+                        response.data && typeof response.data === 'object' && !Array.isArray(response.data)
+                            ? Object.keys(response.data as Record<string, unknown>)
+                            : [],
+                    result: response.data,
+                });
+            } catch (error) {
+                const typedError = error instanceof Error ? error : new Error(typeof error === 'string' ? error : 'Unknown error');
+                const statusCode = 'http' in typedError ? Number((typedError as Error & { http?: number }).http) : undefined;
+                this.request.router.app.container.Trace.finishCall(this.request.id, callId, {
+                    statusCode: Number.isFinite(statusCode) ? statusCode : undefined,
+                    errorMessage: typedError.message,
+                });
+                throw error;
+            }
         }
 
         return fetchedData;