webspresso 0.0.106 → 0.0.108

package/core/applySchema.js

@@ -1,73 +1,4 @@
-/**
- * Schema Applicator
- * Parses and validates request input against compiled schemas
- */
-
-const EMPTY_INPUT = Object.freeze({
-  body: undefined,
-  params: undefined,
-  query: undefined,
-});
-
-/**
- * Apply compiled schema to request
- * Parses body, params, and query against their respective schemas
- * Stores validated results in req.input
- * 
- * @param {Object} req - Express request object
- * @param {Object|null} compiledSchema - Compiled schema from compileSchema
- * @returns {void}
- * @throws {ZodError} If validation fails
- */
-function applySchema(req, compiledSchema) {
-  // No schema means no validation
-  if (!compiledSchema) {
-    req.input = EMPTY_INPUT;
-    return;
-  }
-
-  // Initialize req.input
-  req.input = {
-    body: undefined,
-    params: undefined,
-    query: undefined,
-  };
-
-  // Parse body if schema exists
-  if (compiledSchema.body) {
-    req.input.body = compiledSchema.body.parse(req.body);
-  }
-
-  // Parse params if schema exists
-  if (compiledSchema.params) {
-    req.input.params = compiledSchema.params.parse(req.params);
-  }
-
-  // Parse query if schema exists
-  if (compiledSchema.query) {
-    req.input.query = compiledSchema.query.parse(req.query);
-  }
-}
-
-let _translateValidationIssues = null;
-function getTranslateValidationIssues() {
-  if (!_translateValidationIssues) {
-    try {
-      _translateValidationIssues = require('../src/api/validation-i18n').translateValidationIssues;
-    } catch {
-      _translateValidationIssues = (issues) => issues;
-    }
-  }
-  return _translateValidationIssues;
-}
-
-function translateValidationIssues(issues, options) {
-  return getTranslateValidationIssues()(issues, options);
-}
-
-module.exports = {
-  applySchema,
-  translateValidationIssues,
-};
-
+'use strict';
 
+// Backward-compatibility shim
+module.exports = require('./validation/apply');

package/core/auth/index.js

@@ -16,7 +16,7 @@ function getMiddleware() {
   return _middleware;
 }
 const { hash, verify, needsRehash, generateToken, hashToken } = require('./hash');
-const { signJwt, verifyJwt, decodeJwt } = require('./jwt');
+const { signJwt, verifyJwt, decodeJwt, clearJwtCache, HS256_HEADER_BASE64URL, MAX_PAYLOAD_SIZE } = require('./jwt');
 const {
   TOKEN_TYPES,
   createAuthTokensTable,
@@ -271,6 +271,9 @@ module.exports = {
   signJwt,
   verifyJwt,
   decodeJwt,
+  clearJwtCache,
+  HS256_HEADER_BASE64URL,
+  MAX_PAYLOAD_SIZE,
   
   // Migration helpers
   createRememberTokensTable,

package/core/auth/jwt.js

@@ -72,6 +72,17 @@ function signJwt(payload, secret, options = {}) {
   return `${signingInput}.${encodedSignature}`;
 }
 
+const VERIFIED_JWT_CACHE_LIMIT = 1024;
+const MAX_PAYLOAD_SIZE = 1048576; // 1 MB
+const verifiedJwtCache = new Map();
+
+/**
+ * Clear verified JWT cache
+ */
+function clearJwtCache() {
+  verifiedJwtCache.clear();
+}
+
 /**
  * Verify and decode HS256 JWT string
  * @param {string} token - JWT string
@@ -80,6 +91,8 @@ function signJwt(payload, secret, options = {}) {
  * @param {boolean} [options.ignoreExpiration=false] - Ignore token expiration
  * @param {string} [options.issuer] - Expected issuer
  * @param {string} [options.audience] - Expected audience
+ * @param {boolean} [options.cache=true] - Cache verified payload in bounded LRU cache
+ * @param {number} [options.maxPayloadSize=1048576] - Maximum allowed payload length in bytes
  * @returns {Object} Decoded payload
  * @throws {Error} If token is invalid or expired
  */
@@ -92,6 +105,38 @@ function verifyJwt(token, secret, options = {}) {
     throw new Error('JWT token must be a non-empty string');
   }
 
+  // Fast-path: Check bounded verification LRU cache
+  const cacheKey = options.cache !== false && typeof secret === 'string'
+    ? `${token}##${secret}`
+    : null;
+
+  if (cacheKey) {
+    const cached = verifiedJwtCache.get(cacheKey);
+    if (cached) {
+      // Refresh LRU order
+      verifiedJwtCache.delete(cacheKey);
+      verifiedJwtCache.set(cacheKey, cached);
+
+      const nowSec = Math.floor(Date.now() / 1000);
+      if (!options.ignoreExpiration && typeof cached.exp === 'number') {
+        if (nowSec >= cached.exp) {
+          verifiedJwtCache.delete(cacheKey);
+          throw new Error('JWT token has expired');
+        }
+      }
+
+      if (options.issuer && cached.iss !== options.issuer) {
+        throw new Error(`Invalid JWT issuer (expected ${options.issuer}, got ${cached.iss})`);
+      }
+
+      if (options.audience && cached.aud !== options.audience) {
+        throw new Error(`Invalid JWT audience (expected ${options.audience}, got ${cached.aud})`);
+      }
+
+      return { ...cached };
+    }
+  }
+
   const parts = token.split('.');
   if (parts.length !== 3) {
     throw new Error('Invalid JWT format');
@@ -99,26 +144,39 @@ function verifyJwt(token, secret, options = {}) {
 
   const [encodedHeader, encodedPayload, encodedSignature] = parts;
 
+  // 1. Fast-path header check: bypass decoding and JSON parsing for standard HS256 header
   let header;
-  let payload;
+  if (encodedHeader === HS256_HEADER_BASE64URL) {
+    header = { alg: 'HS256', typ: 'JWT' };
+  } else {
+    try {
+      header = JSON.parse(base64UrlDecode(encodedHeader));
+    } catch (e) {
+      throw new Error('Invalid JWT header JSON');
+    }
+  }
 
-  try {
-    header = JSON.parse(base64UrlDecode(encodedHeader));
-  } catch (e) {
-    throw new Error('Invalid JWT header JSON');
+  if (!header || typeof header !== 'object' || header.alg !== 'HS256') {
+    throw new Error(`Unsupported algorithm '${header?.alg}' in JWT header`);
+  }
+
+  // 2. DoS Protection: verify payload size limit before JSON parsing
+  const maxPayloadSize = typeof options.maxPayloadSize === 'number'
+    ? options.maxPayloadSize
+    : MAX_PAYLOAD_SIZE;
+
+  if (encodedPayload.length > maxPayloadSize) {
+    throw new Error('JWT payload exceeds maximum allowed size');
   }
 
+  let payload;
   try {
     payload = JSON.parse(base64UrlDecode(encodedPayload));
   } catch (e) {
     throw new Error('Invalid JWT payload JSON');
   }
 
-  if (header.alg !== 'HS256') {
-    throw new Error(`Unsupported algorithm '${header.alg}' in JWT header`);
-  }
-
-  // Re-compute signature
+  // 3. Re-compute and constant-time compare signature
   const signingInput = `${encodedHeader}.${encodedPayload}`;
   const expectedSignatureBuf = hmacSha256(signingInput, secret, 'buffer');
 
@@ -128,7 +186,7 @@ function verifyJwt(token, secret, options = {}) {
     throw new Error('Invalid JWT signature');
   }
 
-  // Check claims
+  // 4. Check claims
   const nowSec = Math.floor(Date.now() / 1000);
 
   if (!options.ignoreExpiration && typeof payload.exp === 'number') {
@@ -145,7 +203,16 @@ function verifyJwt(token, secret, options = {}) {
     throw new Error(`Invalid JWT audience (expected ${options.audience}, got ${payload.aud})`);
   }
 
-  return payload;
+  // 5. Store in bounded verification LRU cache
+  if (cacheKey) {
+    if (verifiedJwtCache.size >= VERIFIED_JWT_CACHE_LIMIT) {
+      const oldestKey = verifiedJwtCache.keys().next().value;
+      verifiedJwtCache.delete(oldestKey);
+    }
+    verifiedJwtCache.set(cacheKey, payload);
+  }
+
+  return { ...payload };
 }
 
 /**
@@ -159,7 +226,9 @@ function decodeJwt(token) {
   if (parts.length !== 3) return null;
 
   try {
-    const header = JSON.parse(base64UrlDecode(parts[0]));
+    const header = parts[0] === HS256_HEADER_BASE64URL
+      ? { alg: 'HS256', typ: 'JWT' }
+      : JSON.parse(base64UrlDecode(parts[0]));
     const payload = JSON.parse(base64UrlDecode(parts[1]));
     return { header, payload };
   } catch (e) {
@@ -174,4 +243,7 @@ module.exports = {
   base64UrlEncode,
   base64UrlDecode,
   parseDuration,
+  clearJwtCache,
+  HS256_HEADER_BASE64URL,
+  MAX_PAYLOAD_SIZE,
 };

package/core/auth/magic-link.js

@@ -88,10 +88,14 @@ function createMagicLinkVerifyMiddleware(authManager, options = {}) {
   } = options;
 
   return async function magicLinkVerifyMiddleware(req, res, next) {
-    const rawToken = req.query?.[tokenParam] || req.body?.[tokenParam];
+    let rawToken = req.query?.[tokenParam] || req.body?.[tokenParam];
+    if (Array.isArray(rawToken)) {
+      rawToken = rawToken[0];
+    }
+    const token = typeof rawToken === 'string' ? rawToken.trim() : null;
     const isHtml = req.accepts && req.accepts('html') && req.method === 'GET';
 
-    if (!rawToken) {
+    if (!token) {
       if (isHtml) {
         return res.redirect(failureRedirect);
       }
@@ -99,7 +103,7 @@ function createMagicLinkVerifyMiddleware(authManager, options = {}) {
     }
 
     try {
-      const { user } = await authManager.verifyMagicLink(rawToken, { markEmailVerified });
+      const { user } = await authManager.verifyMagicLink(token, { markEmailVerified });
 
       if (req.auth && typeof req.auth.login === 'function') {
         await req.auth.login(user);
@@ -139,21 +143,35 @@ function createMagicLinkVerifyMiddleware(authManager, options = {}) {
  * 
  * @param {import('./manager').AuthManager} authManager 
  * @param {Object} [options]
+ * @param {number} [options.tokenTtlMs]
+ * @param {boolean} [options.hideUserNotFound=true]
  * @returns {Function} Express route handler
  */
 function createMagicLinkRequestHandler(authManager, options = {}) {
   return async function magicLinkRequestHandler(req, res) {
-    const identifier = req.body?.email || req.body?.identifier || req.query?.email;
+    const raw = req.body?.email || req.body?.identifier || req.query?.email;
+    const identifier = typeof raw === 'string' ? raw.trim() : raw;
     if (!identifier) {
       return res.status(400).json({ error: 'Email or identifier is required' });
     }
 
     try {
       const result = await authManager.requestMagicLink(identifier, options);
+
+      if (options.hideUserNotFound === false && result?.userFound === false) {
+        return res.status(404).json({
+          error: 'User not found',
+          code: 'USER_NOT_FOUND',
+        });
+      }
+
+      const tokenTtlMs = options.tokenTtlMs ?? (authManager?.config?.magicLink?.tokenTtlMs || 15 * 60 * 1000);
+      const expiresAt = result.expiresAt || new Date(Date.now() + tokenTtlMs);
+
       return res.status(200).json({
         ok: true,
         message: 'If the account exists, a magic link has been sent.',
-        expiresAt: result.expiresAt,
+        expiresAt,
       });
     } catch (err) {
       return res.status(500).json({ error: err.message || 'Failed to send magic link' });

package/core/auth/manager.js

@@ -145,7 +145,7 @@ class AuthManager extends EventEmitter {
 
     // Session tracking and revocation manager
     const { SessionManager } = require('./session-manager');
-    const { createKnexSessionTracker, createMemorySessionTracker } = require('./sessions');
+    const { createKnexSessionTracker, createMemorySessionTracker, createKvSessionTracker } = require('./sessions');
 
     let tracker = config.sessionTracker || null;
     if (!tracker && (config.sessionTracking || config.trackSessions)) {
@@ -161,6 +161,11 @@ class AuthManager extends EventEmitter {
           client: config.session?.redisClient,
           prefix: config.session?.redisPrefix || 'sess:',
         });
+      } else if (config.session?.storeType === 'kv' || config.session?.kv) {
+        tracker = createKvSessionTracker(config.session?.kv, {
+          prefix: config.session?.kvPrefix || 'sess:',
+          ttlSeconds: config.session?.ttl,
+        });
       } else if (config.db || this.config.db) {
         tracker = createKnexSessionTracker(config.db || this.config.db);
       } else {
@@ -173,6 +178,7 @@ class AuthManager extends EventEmitter {
         tracker: tracker || createMemorySessionTracker(),
         sessionStore: config.sessionStore || this.config.session?.store,
         touchThrottleMs: config.sessionTouchThrottleMs,
+        maxTouchEntries: config.sessionMaxTouchEntries,
         emitter: this,
       });
     } else {

package/core/auth/redis-session.js

@@ -60,7 +60,7 @@ class InMemoryRedisClient extends EventEmitter {
   }
 
   async del(...keys) {
-    const flatKeys = keys.flat();
+    const flatKeys = keys.flat().filter((k) => typeof k !== 'function');
     let count = 0;
     for (const k of flatKeys) {
       const sk = String(k);
@@ -100,6 +100,7 @@ class InMemoryRedisClient extends EventEmitter {
     }
     let added = 0;
     for (const m of members.flat()) {
+      if (typeof m === 'function') continue;
       const sm = String(m);
       if (!set.has(sm)) {
         set.add(sm);
@@ -115,6 +116,7 @@ class InMemoryRedisClient extends EventEmitter {
     if (!set) return 0;
     let removed = 0;
     for (const m of members.flat()) {
+      if (typeof m === 'function') continue;
       if (set.delete(String(m))) removed++;
     }
     if (set.size === 0) {
@@ -205,6 +207,13 @@ class MiniRedisClient extends EventEmitter {
       password = urlOrOptions.password || null;
       db = urlOrOptions.db || 0;
       useTls = Boolean(urlOrOptions.tls);
+      if (typeof urlOrOptions.tls === 'object' && urlOrOptions.tls !== null) {
+        this.tlsOptions = { ...urlOrOptions.tls };
+      } else {
+        this.tlsOptions = {};
+      }
+    } else {
+      this.tlsOptions = {};
     }
 
     this.host = host;
@@ -273,7 +282,15 @@ class MiniRedisClient extends EventEmitter {
 
       try {
         if (this.useTls) {
-          this.socket = tls.connect({ host: this.host, port: this.port, rejectUnauthorized: false }, onConnect);
+          const tlsConnectOpts = {
+            host: this.host,
+            port: this.port,
+            rejectUnauthorized: this.tlsOptions?.rejectUnauthorized !== undefined
+              ? Boolean(this.tlsOptions.rejectUnauthorized)
+              : true,
+            ...(this.tlsOptions || {}),
+          };
+          this.socket = tls.connect(tlsConnectOpts, onConnect);
         } else {
           this.socket = net.createConnection({ host: this.host, port: this.port }, onConnect);
         }
@@ -520,11 +537,18 @@ async function invokeRedis(client, method, args) {
     }
   }
 
+  if (client instanceof InMemoryRedisClient || client instanceof MiniRedisClient || typeof client.sendCommand === 'function') {
+    return await fn.call(client, ...args);
+  }
+
   // Handle callback vs Promise-based clients
   return new Promise((resolve, reject) => {
+    let called = false;
     let result;
     try {
       result = fn.call(client, ...args, (err, val) => {
+        if (called) return;
+        called = true;
         if (err) return reject(err);
         resolve(val);
       });
@@ -533,7 +557,20 @@ async function invokeRedis(client, method, args) {
     }
 
     if (result && typeof result.then === 'function') {
-      result.then(resolve, reject);
+      result.then(
+        (val) => {
+          if (!called) {
+            called = true;
+            resolve(val);
+          }
+        },
+        (err) => {
+          if (!called) {
+            called = true;
+            reject(err);
+          }
+        }
+      );
     }
   });
 }
@@ -679,9 +716,11 @@ class RedisSessionStore extends BaseStore {
         if (!Array.isArray(keys) || keys.length === 0) {
           return callback(null, []);
         }
+        const rawResults = await Promise.all(
+          keys.map((k) => invokeRedis(this.client, 'get', [k]).catch(() => null))
+        );
         const sessions = [];
-        for (const k of keys) {
-          const raw = await invokeRedis(this.client, 'get', [k]);
+        for (const raw of rawResults) {
           if (raw) {
             try {
               sessions.push(this.serializer.parse(raw));
@@ -867,11 +906,18 @@ function createRedisSessionTracker(options = {}) {
       const sids = await invokeRedis(client, 'smembers', [userKey(userId)]);
       if (!Array.isArray(sids) || sids.length === 0) return [];
 
+      const rawResults = await Promise.all(
+        sids.map((sid) =>
+          invokeRedis(client, 'get', [deviceKey(sid)])
+            .then((raw) => ({ sid, raw }))
+            .catch(() => ({ sid, raw: null }))
+        )
+      );
+
       const list = [];
       const expiredSids = [];
 
-      for (const sid of sids) {
-        const raw = await invokeRedis(client, 'get', [deviceKey(sid)]);
+      for (const { sid, raw } of rawResults) {
         if (!raw) {
           expiredSids.push(sid);
           continue;
@@ -951,22 +997,14 @@ function createRedisSessionTracker(options = {}) {
       const sids = await invokeRedis(client, 'smembers', [userKey(userId)]);
       if (!Array.isArray(sids) || sids.length === 0) return 0;
 
-      let count = 0;
-      const toRemove = [];
+      const toRemove = sids.filter((sid) => sid !== currentSessionId);
+      if (toRemove.length === 0) return 0;
 
-      for (const sid of sids) {
-        if (sid !== currentSessionId) {
-          await invokeRedis(client, 'del', [deviceKey(sid)]);
-          toRemove.push(sid);
-          count++;
-        }
-      }
+      const keysToDel = toRemove.map((sid) => deviceKey(sid));
+      await invokeRedis(client, 'del', keysToDel);
+      await invokeRedis(client, 'srem', [userKey(userId), ...toRemove]);
 
-      if (toRemove.length > 0) {
-        await invokeRedis(client, 'srem', [userKey(userId), ...toRemove]);
-      }
-
-      return count;
+      return toRemove.length;
     },
 
     /**
@@ -979,11 +1017,10 @@ function createRedisSessionTracker(options = {}) {
       const sids = await invokeRedis(client, 'smembers', [userKey(userId)]);
       if (!Array.isArray(sids) || sids.length === 0) return 0;
 
-      for (const sid of sids) {
-        await invokeRedis(client, 'del', [deviceKey(sid)]);
-      }
+      const keysToDel = sids.map((sid) => deviceKey(sid));
+      keysToDel.push(userKey(userId));
+      await invokeRedis(client, 'del', keysToDel);
 
-      await invokeRedis(client, 'del', [userKey(userId)]);
       return sids.length;
     },
 

package/core/auth/session-manager.js

@@ -15,17 +15,43 @@ class SessionManager {
    * @param {Object} [options.tracker] - Session tracker adapter (knex or memory)
    * @param {Object} [options.sessionStore] - Optional express-session store instance
    * @param {number} [options.touchThrottleMs=60000] - Throttle last_active_at updates (default 1 min)
+   * @param {number} [options.maxTouchEntries=5000] - Max entries in memory-bounded last touch map
    * @param {import('events').EventEmitter} [options.emitter] - AuthManager instance for event dispatching
    */
   constructor(options = {}) {
     this.tracker = options.tracker || createMemorySessionTracker();
     this.sessionStore = options.sessionStore || null;
     this.touchThrottleMs = options.touchThrottleMs ?? 60000;
+    this.maxTouchEntries = options.maxTouchEntries ?? 5000;
     this.emitter = options.emitter || null;
     /** @type {Map<string, number>} */
     this._lastTouchMap = new Map();
   }
 
+  /**
+   * Record touch timestamp with bounded LRU eviction
+   * @param {string} sessionId
+   * @param {number} [timestamp=Date.now()]
+   * @private
+   */
+  _recordTouch(sessionId, timestamp = Date.now()) {
+    if (!sessionId) return;
+    if (this._lastTouchMap.has(sessionId)) {
+      this._lastTouchMap.delete(sessionId);
+    } else if (this._lastTouchMap.size >= this.maxTouchEntries) {
+      const oldestKey = this._lastTouchMap.keys().next().value;
+      this._lastTouchMap.delete(oldestKey);
+    }
+    this._lastTouchMap.set(sessionId, timestamp);
+  }
+
+  /**
+   * Clear touch throttle cache
+   */
+  clearTouchCache() {
+    this._lastTouchMap.clear();
+  }
+
   /**
    * Record or update session for a user request
    * @param {string} sessionId
@@ -48,7 +74,7 @@ class SessionManager {
       device: parsed.device,
     });
 
-    this._lastTouchMap.set(sessionId, Date.now());
+    this._recordTouch(sessionId, Date.now());
 
     if (this.emitter) {
       this.emitter.emit('session:created', {
@@ -79,7 +105,7 @@ class SessionManager {
       return false; // Throttled
     }
 
-    this._lastTouchMap.set(sessionId, now);
+    this._recordTouch(sessionId, now);
     return await this.tracker.touch(sessionId);
   }