@angular-helpers/security 21.4.2 → 21.5.0

package/fesm2022/angular-helpers-security-signal-forms.mjs

@@ -108,12 +108,12 @@ function hibpPassword(path, options) {
     validateAsync(path, {
         params: ({ value }) => {
             const raw = value();
-            return raw && raw.length >= 8 ? raw : undefined;
+            return { password: raw && raw.length >= 8 ? raw : '' };
         },
-        factory: (passwordSignal) => {
+        factory: (paramsSignal) => {
             const hibp = inject(HibpService);
             return resource({
-                params: () => passwordSignal(),
+                params: () => paramsSignal()?.password,
                 loader: async ({ params: password, abortSignal }) => {
                     if (!password)
                         return undefined;

package/fesm2022/angular-helpers-security.mjs

@@ -1,55 +1,137 @@
 import * as i0 from '@angular/core';
-import { inject, DestroyRef, Injectable, PLATFORM_ID, InjectionToken, signal, computed, NgZone, Injector, makeEnvironmentProviders } from '@angular/core';
+import { Injectable, inject, PLATFORM_ID, InjectionToken, DestroyRef, signal, computed, NgZone, Injector, makeEnvironmentProviders } from '@angular/core';
+import { injectWorkerPool } from '@angular-helpers/core';
 import { isPlatformBrowser, DOCUMENT } from '@angular/common';
 import { Observable, Subject, fromEvent, merge } from 'rxjs';
 import { throttleTime } from 'rxjs/operators';
 
 /**
- * Security service for regular expressions that prevents ReDoS
- * using Web Workers for safe execution with timeout
+ * Builder pattern to construct safe regular expressions
  */
-class RegexSecurityService {
-    destroyRef = inject(DestroyRef);
-    workers = new Map();
+class RegexSecurityBuilder {
+    patternValue = '';
+    optionsValue = {};
+    securityConfigValue = {};
     /**
-     * Builder pattern to construct safe regular expressions
+     * Defines the base pattern
      */
-    static builder() {
-        return new RegexSecurityBuilder();
+    pattern(pattern) {
+        this.patternValue = pattern;
+        return this;
     }
     /**
-     * Executes a regular expression safely with a timeout
+     * Appends text to the current pattern
      */
-    async testRegex(pattern, text, config = {}) {
-        const startTime = performance.now();
-        const finalConfig = this.mergeConfig(config);
-        try {
-            // First, analyze pattern security
-            const securityCheck = await this.analyzePatternSecurity(pattern);
-            if (!securityCheck.safe && !finalConfig.safeMode) {
-                return {
-                    match: false,
-                    executionTime: performance.now() - startTime,
-                    timeout: false,
-                    error: `Pattern rejected: ${securityCheck.warnings.join(', ')}`,
-                };
-            }
-            // Execute in Web Worker with timeout
-            const result = await this.executeInWorker(pattern, text, finalConfig);
-            return {
-                ...result,
-                executionTime: performance.now() - startTime,
-            };
+    append(text) {
+        this.patternValue += text;
+        return this;
+    }
+    /**
+     * Adds a capturing group
+     */
+    group(content, name) {
+        if (name) {
+            this.patternValue += `(?<${name}>${content})`;
         }
-        catch (error) {
-            return {
-                match: false,
-                executionTime: performance.now() - startTime,
-                timeout: false,
-                error: error instanceof Error ? error.message : 'Unknown error',
-            };
+        else {
+            this.patternValue += `(${content})`;
         }
+        return this;
+    }
+    /**
+     * Adds a non-capturing group
+     */
+    nonCapturingGroup(content) {
+        this.patternValue += `(?:${content})`;
+        return this;
+    }
+    /**
+     * Adds an alternative
+     */
+    or(alternative) {
+        this.patternValue += `|${alternative}`;
+        return this;
     }
+    /**
+     * Adds a quantifier
+     */
+    quantifier(quantifier) {
+        this.patternValue += quantifier;
+        return this;
+    }
+    /**
+     * Adds a character set
+     */
+    characterSet(chars, negate = false) {
+        this.patternValue += `[${negate ? '^' : ''}${chars}]`;
+        return this;
+    }
+    /**
+     * Adds a start of line anchor
+     */
+    startOfLine() {
+        this.patternValue += '^';
+        return this;
+    }
+    /**
+     * Adds an end of line anchor
+     */
+    endOfLine() {
+        this.patternValue += '$';
+        return this;
+    }
+    /**
+     * Configures regular expression options
+     */
+    options(options) {
+        this.optionsValue = { ...this.optionsValue, ...options };
+        return this;
+    }
+    /**
+     * Configures security options
+     */
+    security(config) {
+        this.securityConfigValue = { ...this.securityConfigValue, ...config };
+        return this;
+    }
+    /**
+     * Configures timeout
+     */
+    timeout(ms) {
+        this.securityConfigValue.timeout = ms;
+        return this;
+    }
+    /**
+     * Activates safe mode
+     */
+    safeMode() {
+        this.securityConfigValue.safeMode = true;
+        return this;
+    }
+    /**
+     * Builds the final regular expression
+     */
+    build() {
+        return {
+            pattern: this.patternValue,
+            options: this.optionsValue,
+            security: this.securityConfigValue,
+        };
+    }
+    /**
+     * Builds and executes the regular expression
+     */
+    async execute(text, service) {
+        const { pattern, security } = this.build();
+        return service.testRegex(pattern, text, security);
+    }
+}
+
+/**
+ * Service responsible for statically analyzing regular expressions
+ * to detect ReDoS vulnerabilities and complexity issues.
+ */
+class RegexAnalyzerService {
     /**
      * Analyzes the security of a regular expression pattern
      */
@@ -114,131 +196,6 @@ class RegexSecurityService {
             recommendations,
         };
     }
-    /**
-     * Executes the regular expression in a Web Worker
-     */
-    async executeInWorker(pattern, text, config) {
-        return new Promise((resolve) => {
-            const workerName = `regex-worker-${Date.now()}`;
-            try {
-                // Create temporary worker
-                const workerCode = this.generateWorkerCode();
-                const blob = new Blob([workerCode], { type: 'application/javascript' });
-                const worker = new Worker(URL.createObjectURL(blob));
-                this.workers.set(workerName, worker);
-                const taskId = `regex_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
-                const task = {
-                    id: taskId,
-                    type: 'regex-test',
-                    data: {
-                        pattern,
-                        text,
-                        timeout: config.timeout || 5000,
-                    },
-                };
-                // Timeout for execution
-                const timeoutId = setTimeout(() => {
-                    worker.terminate();
-                    this.workers.delete(workerName);
-                    resolve({
-                        match: false,
-                        executionTime: 0,
-                        timeout: true,
-                        error: 'Execution timeout',
-                    });
-                }, config.timeout || 5000);
-                worker.onmessage = (event) => {
-                    clearTimeout(timeoutId);
-                    worker.terminate();
-                    this.workers.delete(workerName);
-                    if (event.data.id === taskId) {
-                        resolve(event.data.data);
-                    }
-                };
-                worker.onerror = (error) => {
-                    clearTimeout(timeoutId);
-                    worker.terminate();
-                    this.workers.delete(workerName);
-                    resolve({
-                        match: false,
-                        executionTime: 0,
-                        timeout: false,
-                        error: `Worker error: ${error.message || 'Unknown error'}`,
-                    });
-                };
-                worker.postMessage(task);
-            }
-            catch (error) {
-                resolve({
-                    match: false,
-                    executionTime: 0,
-                    timeout: false,
-                    error: `Failed to create worker: ${error instanceof Error ? error.message : 'Unknown error'}`,
-                });
-            }
-        });
-    }
-    /**
-     * Generates the Web Worker code
-     */
-    generateWorkerCode() {
-        return `
-      self.addEventListener('message', function(event) {
-        const task = event.data;
-        
-        if (task.type === 'regex-test') {
-          const { pattern, text, timeout } = task.data;
-          const startTime = performance.now();
-          
-          try {
-            const regex = new RegExp(pattern, 'g');
-            const matches = [];
-            let match;
-            
-            while ((match = regex.exec(text)) !== null) {
-              matches.push([...match]);
-              
-              // Prevention of infinite loops
-              if (matches.length > 1000) {
-                throw new Error('Too many matches - possible infinite loop');
-              }
-            }
-            
-            const groups = {};
-            if (matches.length > 0) {
-              const firstMatch = matches[0];
-              for (let i = 1; i < firstMatch.length; i++) {
-                groups[\`group\${i}\`] = firstMatch[i];
-              }
-            }
-            
-            self.postMessage({
-              id: task.id,
-              type: 'regex-result',
-              data: {
-                match: matches.length > 0,
-                matches,
-                groups,
-                executionTime: performance.now() - startTime,
-                timeout: false
-              }
-            });
-          } catch (error) {
-            self.postMessage({
-              id: task.id,
-              type: 'regex-result',
-              data: {
-                match: false,
-                executionTime: performance.now() - startTime,
-                timeout: false,
-                error: error.message || 'Execution error'
-              }
-            });
-          }
-        }
-      });
-    `;
-    }
     /**
      * Calculates the complexity of a pattern
      */
@@ -266,153 +223,146 @@ class RegexSecurityService {
         const levels = { low: 1, medium: 2, high: 3, critical: 4 };
         return levels[risk] || 0;
     }
-    /**
-     * Merges configuration with default values
-     */
-    mergeConfig(config) {
-        return {
-            timeout: config.timeout || 5000,
-            maxComplexity: config.maxComplexity || 10,
-            allowBacktracking: config.allowBacktracking || false,
-            safeMode: config.safeMode || false,
-        };
-    }
-    /**
-     * Cleans up resources when the service is destroyed
-     */
-    ngOnDestroy() {
-        this.workers.forEach((worker) => {
-            worker.terminate();
-        });
-        this.workers.clear();
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexSecurityService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexSecurityService });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexAnalyzerService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexAnalyzerService });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexSecurityService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexAnalyzerService, decorators: [{
             type: Injectable
         }] });
+
 /**
- * Builder pattern to construct safe regular expressions
+ * Service responsible for managing Web Workers for safe regex execution.
+ * Avoids creating a new worker for every single execution.
  */
-class RegexSecurityBuilder {
-    patternValue = '';
-    optionsValue = {};
-    securityConfigValue = {};
-    /**
-     * Defines the base pattern
-     */
-    pattern(pattern) {
-        this.patternValue = pattern;
-        return this;
-    }
-    /**
-     * Appends text to the current pattern
-     */
-    append(text) {
-        this.patternValue += text;
-        return this;
+class RegexWorkerPoolService {
+    pool;
+    constructor() {
+        this.pool = injectWorkerPool(new URL('../workers/regex.worker', import.meta.url), {
+            defaultTimeout: 5000,
+            fallbackExecutor: async (type, data) => {
+                if (type !== 'regex-test')
+                    throw new Error(`Unknown task type: ${type}`);
+                const { pattern, text } = data;
+                try {
+                    const start = Date.now();
+                    const regex = new RegExp(pattern);
+                    const match = regex.test(text);
+                    return {
+                        match,
+                        executionTime: Date.now() - start,
+                        timeout: false,
+                    };
+                }
+                catch (e) {
+                    return {
+                        match: false,
+                        executionTime: 0,
+                        timeout: false,
+                        error: e.message,
+                    };
+                }
+            },
+        });
     }
     /**
-     * Adds a capturing group
+     * Executes the regular expression in a Web Worker
      */
-    group(content, name) {
-        if (name) {
-            this.patternValue += `(?<${name}>${content})`;
+    async executeInWorker(pattern, text, config) {
+        try {
+            return await this.pool.execute('regex-test', {
+                pattern,
+                text,
+                timeout: config.timeout || 5000,
+            }, config.timeout || 5000);
         }
-        else {
-            this.patternValue += `(${content})`;
+        catch (err) {
+            return {
+                match: false,
+                executionTime: 0,
+                timeout: err.message === 'Execution timeout',
+                error: err.message,
+            };
         }
-        return this;
     }
-    /**
-     * Adds a non-capturing group
-     */
-    nonCapturingGroup(content) {
-        this.patternValue += `(?:${content})`;
-        return this;
-    }
-    /**
-     * Adds an alternative
-     */
-    or(alternative) {
-        this.patternValue += `|${alternative}`;
-        return this;
-    }
-    /**
-     * Adds a quantifier
-     */
-    quantifier(quantifier) {
-        this.patternValue += quantifier;
-        return this;
-    }
-    /**
-     * Adds a character set
-     */
-    characterSet(chars, negate = false) {
-        this.patternValue += `[${negate ? '^' : ''}${chars}]`;
-        return this;
-    }
-    /**
-     * Adds a start of line anchor
-     */
-    startOfLine() {
-        this.patternValue += '^';
-        return this;
-    }
-    /**
-     * Adds an end of line anchor
-     */
-    endOfLine() {
-        this.patternValue += '$';
-        return this;
-    }
-    /**
-     * Configures regular expression options
-     */
-    options(options) {
-        this.optionsValue = { ...this.optionsValue, ...options };
-        return this;
+    ngOnDestroy() {
+        this.pool.terminate();
     }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexWorkerPoolService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexWorkerPoolService });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexWorkerPoolService, decorators: [{
+            type: Injectable
+        }], ctorParameters: () => [] });
+
+/**
+ * Security service for regular expressions that prevents ReDoS
+ * Facade pattern that delegates to Analyzer and Worker Pool.
+ */
+class RegexSecurityService {
+    analyzer = inject(RegexAnalyzerService);
+    workerPool = inject(RegexWorkerPoolService);
     /**
-     * Configures security options
+     * Builder pattern to construct safe regular expressions
      */
-    security(config) {
-        this.securityConfigValue = { ...this.securityConfigValue, ...config };
-        return this;
+    static builder() {
+        return new RegexSecurityBuilder();
     }
     /**
-     * Configures timeout
+     * Executes a regular expression safely with a timeout
      */
-    timeout(ms) {
-        this.securityConfigValue.timeout = ms;
-        return this;
+    async testRegex(pattern, text, config = {}) {
+        const startTime = performance.now();
+        const finalConfig = this.mergeConfig(config);
+        try {
+            // First, analyze pattern security
+            const securityCheck = await this.analyzePatternSecurity(pattern);
+            if (!securityCheck.safe && !finalConfig.safeMode) {
+                return {
+                    match: false,
+                    executionTime: performance.now() - startTime,
+                    timeout: false,
+                    error: `Pattern rejected: ${securityCheck.warnings.join(', ')}`,
+                };
+            }
+            // Execute in Web Worker with timeout
+            const result = await this.workerPool.executeInWorker(pattern, text, finalConfig);
+            return {
+                ...result,
+                executionTime: performance.now() - startTime,
+            };
+        }
+        catch (error) {
+            return {
+                match: false,
+                executionTime: performance.now() - startTime,
+                timeout: false,
+                error: error instanceof Error ? error.message : 'Unknown error',
+            };
+        }
     }
     /**
-     * Activates safe mode
+     * Analyzes the security of a regular expression pattern
      */
-    safeMode() {
-        this.securityConfigValue.safeMode = true;
-        return this;
+    async analyzePatternSecurity(pattern) {
+        return this.analyzer.analyzePatternSecurity(pattern);
     }
     /**
-     * Builds the final regular expression
+     * Merges configuration with default values
      */
-    build() {
+    mergeConfig(config) {
         return {
-            pattern: this.patternValue,
-            options: this.optionsValue,
-            security: this.securityConfigValue,
+            timeout: config.timeout || 5000,
+            maxComplexity: config.maxComplexity || 10,
+            allowBacktracking: config.allowBacktracking || false,
+            safeMode: config.safeMode || false,
         };
     }
-    /**
-     * Builds and executes the regular expression
-     */
-    async execute(text, service) {
-        const { pattern, security } = this.build();
-        return service.testRegex(pattern, text, security);
-    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexSecurityService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexSecurityService });
 }
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RegexSecurityService, decorators: [{
+            type: Injectable
+        }] });
 
 class WebCryptoService {
     platformId = inject(PLATFORM_ID);
@@ -922,6 +872,7 @@ const DEFAULT_ALLOWED_TAGS = [
 const DEFAULT_ALLOWED_ATTRIBUTES = {
     a: ['href'],
 };
+const URL_ATTRIBUTES = new Set(['href', 'src', 'action', 'formaction', 'data', 'poster']);
 /**
  * Sanitizes an HTML string by allowlist. Browser-only: requires DOMParser.
  *
@@ -980,7 +931,7 @@ function sanitizeElementAttributes(element, tagName, allowedAttributes) {
             attrsToRemove.push(attr.name);
             continue;
         }
-        if (attr.name === 'href' && sanitizeUrlString(attr.value) === null) {
+        if (URL_ATTRIBUTES.has(attr.name) && sanitizeUrlString(attr.value) === null) {
             attrsToRemove.push(attr.name);
         }
     }
@@ -1512,13 +1463,23 @@ class RateLimiterService {
                 this.configure(key, policy);
             }
         }
-        this.destroyRef.onDestroy(() => this.buckets.clear());
+        this.destroyRef.onDestroy(() => {
+            for (const bucket of this.buckets.values()) {
+                if (bucket.timerId)
+                    clearTimeout(bucket.timerId);
+            }
+            this.buckets.clear();
+        });
     }
     /**
      * Registers or updates the policy for `key`. Re-configuring an existing key resets its state.
      */
     configure(key, policy) {
         validatePolicy(policy);
+        const existing = this.buckets.get(key);
+        if (existing && existing.timerId) {
+            clearTimeout(existing.timerId);
+        }
         const now = Date.now();
         const initialRemaining = policy.type === 'token-bucket' ? policy.capacity : policy.max;
         this.buckets.set(key, {
@@ -1553,6 +1514,7 @@ class RateLimiterService {
             }
             bucket.tokens -= tokens;
             bucket.remaining.set(Math.floor(bucket.tokens));
+            this.scheduleAutoRefill(key, bucket);
             return;
         }
         // sliding-window
@@ -1566,6 +1528,7 @@ class RateLimiterService {
         for (let i = 0; i < tokens; i++)
             bucket.timestamps.push(now);
         bucket.remaining.set(bucket.policy.max - bucket.timestamps.length);
+        this.scheduleAutoRefill(key, bucket);
     }
     /**
      * Reactive signal indicating whether a single unit can be consumed from `key` right now.
@@ -1594,6 +1557,10 @@ class RateLimiterService {
         const bucket = this.buckets.get(key);
         if (!bucket)
             return;
+        if (bucket.timerId) {
+            clearTimeout(bucket.timerId);
+            bucket.timerId = undefined;
+        }
         bucket.timestamps = [];
         if (bucket.policy.type === 'token-bucket') {
             bucket.tokens = bucket.policy.capacity;
@@ -1615,6 +1582,41 @@ class RateLimiterService {
         bucket.lastRefillAt = now;
         bucket.remaining.set(Math.floor(bucket.tokens));
     }
+    scheduleAutoRefill(key, bucket) {
+        if (bucket.timerId) {
+            clearTimeout(bucket.timerId);
+            bucket.timerId = undefined;
+        }
+        const now = Date.now();
+        if (bucket.policy.type === 'token-bucket') {
+            if (bucket.tokens >= bucket.policy.capacity) {
+                return;
+            }
+            const currentFloor = Math.floor(bucket.tokens);
+            const nextInteger = currentFloor + 1;
+            const deficit = nextInteger - bucket.tokens;
+            const timeToNextTokenMs = Math.max(10, Math.ceil((deficit / bucket.policy.refillPerSecond) * 1000));
+            bucket.timerId = setTimeout(() => {
+                const tNow = Date.now();
+                this.refillTokenBucket(bucket, tNow);
+                this.scheduleAutoRefill(key, bucket);
+            }, timeToNextTokenMs);
+        }
+        else {
+            // sliding-window
+            const windowStart = now - bucket.policy.windowMs;
+            bucket.timestamps = bucket.timestamps.filter((t) => t > windowStart);
+            bucket.remaining.set(bucket.policy.max - bucket.timestamps.length);
+            if (bucket.timestamps.length === 0) {
+                return;
+            }
+            const oldest = bucket.timestamps[0];
+            const timeToExpiryMs = Math.max(10, oldest + bucket.policy.windowMs - now);
+            bucket.timerId = setTimeout(() => {
+                this.scheduleAutoRefill(key, bucket);
+            }, timeToExpiryMs);
+        }
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RateLimiterService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.13", ngImport: i0, type: RateLimiterService });
 }
@@ -1969,7 +1971,7 @@ function provideSecurity(config = {}) {
     const mergedConfig = { ...defaultSecurityConfig, ...config };
     const providers = [];
     if (mergedConfig.enableRegexSecurity)
-        providers.push(RegexSecurityService);
+        providers.push(RegexAnalyzerService, RegexWorkerPoolService, RegexSecurityService);
     if (mergedConfig.enableWebCrypto)
         providers.push(WebCryptoService);
     if (mergedConfig.enableSecureStorage)
@@ -1997,7 +1999,11 @@ function provideSecurity(config = {}) {
     return makeEnvironmentProviders(providers);
 }
 function provideRegexSecurity() {
-    return makeEnvironmentProviders([RegexSecurityService]);
+    return makeEnvironmentProviders([
+        RegexAnalyzerService,
+        RegexWorkerPoolService,
+        RegexSecurityService,
+    ]);
 }
 function provideWebCrypto() {
     return makeEnvironmentProviders([WebCryptoService]);
@@ -2054,4 +2060,4 @@ function provideSecureMessage() {
  * Generated bundle index. Do not edit.
  */
 
-export { CSRF_CONFIG, ClipboardUnsupportedError, CsrfService, DEFAULT_ALLOWED_ATTRIBUTES, DEFAULT_ALLOWED_TAGS, HIBP_CONFIG, HibpService, InputSanitizerService, InvalidJwtError, JwtService, PasswordStrengthService, RATE_LIMITER_CONFIG, RateLimitExceededError, RateLimiterService, RegexSecurityBuilder, RegexSecurityService, SANITIZER_CONFIG, SECURE_STORAGE_CONFIG, SecureMessageService, SecureStorageService, SensitiveClipboardService, SessionIdleService, WebCryptoService, assessPasswordStrength, containsScriptInjection, containsSqlInjectionHints, defaultSecurityConfig, isHtmlSafe, isUrlSafe, provideCsrf, provideHibp, provideInputSanitizer, provideJwt, providePasswordStrength, provideRateLimiter, provideRegexSecurity, provideSecureMessage, provideSecureStorage, provideSecurity, provideSensitiveClipboard, provideSessionIdle, provideWebCrypto, sanitizeHtmlString, sanitizeUrlString, withCsrfHeader };
+export { CSRF_CONFIG, ClipboardUnsupportedError, CsrfService, DEFAULT_ALLOWED_ATTRIBUTES, DEFAULT_ALLOWED_TAGS, HIBP_CONFIG, HibpService, InputSanitizerService, InvalidJwtError, JwtService, PasswordStrengthService, RATE_LIMITER_CONFIG, RateLimitExceededError, RateLimiterService, RegexAnalyzerService, RegexSecurityBuilder, RegexSecurityService, RegexWorkerPoolService, SANITIZER_CONFIG, SECURE_STORAGE_CONFIG, SecureMessageService, SecureStorageService, SensitiveClipboardService, SessionIdleService, WebCryptoService, assessPasswordStrength, containsScriptInjection, containsSqlInjectionHints, defaultSecurityConfig, isHtmlSafe, isUrlSafe, provideCsrf, provideHibp, provideInputSanitizer, provideJwt, providePasswordStrength, provideRateLimiter, provideRegexSecurity, provideSecureMessage, provideSecureStorage, provideSecurity, provideSensitiveClipboard, provideSessionIdle, provideWebCrypto, sanitizeHtmlString, sanitizeUrlString, withCsrfHeader };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@angular-helpers/security",
-  "version": "21.4.2",
+  "version": "21.5.0",
   "description": "Angular security helpers for preventing ReDoS and other security vulnerabilities",
   "keywords": [
     "angular",
@@ -40,6 +40,7 @@
     "@angular/common": "^21.0.0",
     "@angular/core": "^21.0.0",
     "@angular/forms": "^21.0.0",
+    "@angular-helpers/core": "workspace:*",
     "rxjs": "^7.0.0 || ^8.0.0"
   },
   "peerDependenciesMeta": {

package/types/angular-helpers-security.d.ts

@@ -1,5 +1,5 @@
 import * as i0 from '@angular/core';
-import { InjectionToken, Signal, EnvironmentProviders } from '@angular/core';
+import { InjectionToken, Signal, EnvironmentProviders, OnDestroy } from '@angular/core';
 import { Observable } from 'rxjs';
 import { HttpInterceptorFn } from '@angular/common/http';
 
@@ -34,52 +34,7 @@ interface RegexBuilderOptions {
     unicode?: boolean;
     sticky?: boolean;
 }
-/**
- * Security service for regular expressions that prevents ReDoS
- * using Web Workers for safe execution with timeout
- */
-declare class RegexSecurityService {
-    private destroyRef;
-    private workers;
-    /**
-     * Builder pattern to construct safe regular expressions
-     */
-    static builder(): RegexSecurityBuilder;
-    /**
-     * Executes a regular expression safely with a timeout
-     */
-    testRegex(pattern: string, text: string, config?: RegexSecurityConfig): Promise<RegexTestResult>;
-    /**
-     * Analyzes the security of a regular expression pattern
-     */
-    analyzePatternSecurity(pattern: string): Promise<RegexSecurityResult>;
-    /**
-     * Executes the regular expression in a Web Worker
-     */
-    private executeInWorker;
-    /**
-     * Generates the Web Worker code
-     */
-    private generateWorkerCode;
-    /**
-     * Calculates the complexity of a pattern
-     */
-    private calculateComplexity;
-    /**
-     * Gets numeric risk level
-     */
-    private getRiskLevel;
-    /**
-     * Merges configuration with default values
-     */
-    private mergeConfig;
-    /**
-     * Cleans up resources when the service is destroyed
-     */
-    ngOnDestroy(): void;
-    static ɵfac: i0.ɵɵFactoryDeclaration<RegexSecurityService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<RegexSecurityService>;
-}
+
 /**
  * Builder pattern to construct safe regular expressions
  */
@@ -153,6 +108,33 @@ declare class RegexSecurityBuilder {
     execute(text: string, service: RegexSecurityService): Promise<RegexTestResult>;
 }
 
+/**
+ * Security service for regular expressions that prevents ReDoS
+ * Facade pattern that delegates to Analyzer and Worker Pool.
+ */
+declare class RegexSecurityService {
+    private analyzer;
+    private workerPool;
+    /**
+     * Builder pattern to construct safe regular expressions
+     */
+    static builder(): RegexSecurityBuilder;
+    /**
+     * Executes a regular expression safely with a timeout
+     */
+    testRegex(pattern: string, text: string, config?: RegexSecurityConfig): Promise<RegexTestResult>;
+    /**
+     * Analyzes the security of a regular expression pattern
+     */
+    analyzePatternSecurity(pattern: string): Promise<RegexSecurityResult>;
+    /**
+     * Merges configuration with default values
+     */
+    private mergeConfig;
+    static ɵfac: i0.ɵɵFactoryDeclaration<RegexSecurityService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<RegexSecurityService>;
+}
+
 type HashAlgorithm = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512';
 type HmacAlgorithm = 'HMAC-SHA-256' | 'HMAC-SHA-384' | 'HMAC-SHA-512';
 type AesKeyLength = 128 | 192 | 256;
@@ -675,6 +657,7 @@ declare class RateLimiterService {
      */
     reset(key: string): void;
     private refillTokenBucket;
+    private scheduleAutoRefill;
     static ɵfac: i0.ɵɵFactoryDeclaration<RateLimiterService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<RateLimiterService>;
 }
@@ -856,5 +839,42 @@ declare function provideCsrf(config?: CsrfConfig): EnvironmentProviders;
 declare function provideSessionIdle(): EnvironmentProviders;
 declare function provideSecureMessage(): EnvironmentProviders;
 
-export { CSRF_CONFIG, ClipboardUnsupportedError, CsrfService, DEFAULT_ALLOWED_ATTRIBUTES, DEFAULT_ALLOWED_TAGS, HIBP_CONFIG, HibpService, InputSanitizerService, InvalidJwtError, JwtService, PasswordStrengthService, RATE_LIMITER_CONFIG, RateLimitExceededError, RateLimiterService, RegexSecurityBuilder, RegexSecurityService, SANITIZER_CONFIG, SECURE_STORAGE_CONFIG, SecureMessageService, SecureStorageService, SensitiveClipboardService, SessionIdleService, WebCryptoService, assessPasswordStrength, containsScriptInjection, containsSqlInjectionHints, defaultSecurityConfig, isHtmlSafe, isUrlSafe, provideCsrf, provideHibp, provideInputSanitizer, provideJwt, providePasswordStrength, provideRateLimiter, provideRegexSecurity, provideSecureMessage, provideSecureStorage, provideSecurity, provideSensitiveClipboard, provideSessionIdle, provideWebCrypto, sanitizeHtmlString, sanitizeUrlString, withCsrfHeader };
+/**
+ * Service responsible for statically analyzing regular expressions
+ * to detect ReDoS vulnerabilities and complexity issues.
+ */
+declare class RegexAnalyzerService {
+    /**
+     * Analyzes the security of a regular expression pattern
+     */
+    analyzePatternSecurity(pattern: string): Promise<RegexSecurityResult>;
+    /**
+     * Calculates the complexity of a pattern
+     */
+    private calculateComplexity;
+    /**
+     * Gets numeric risk level
+     */
+    private getRiskLevel;
+    static ɵfac: i0.ɵɵFactoryDeclaration<RegexAnalyzerService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<RegexAnalyzerService>;
+}
+
+/**
+ * Service responsible for managing Web Workers for safe regex execution.
+ * Avoids creating a new worker for every single execution.
+ */
+declare class RegexWorkerPoolService implements OnDestroy {
+    private pool;
+    constructor();
+    /**
+     * Executes the regular expression in a Web Worker
+     */
+    executeInWorker(pattern: string, text: string, config: RegexSecurityConfig): Promise<RegexTestResult>;
+    ngOnDestroy(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<RegexWorkerPoolService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<RegexWorkerPoolService>;
+}
+
+export { CSRF_CONFIG, ClipboardUnsupportedError, CsrfService, DEFAULT_ALLOWED_ATTRIBUTES, DEFAULT_ALLOWED_TAGS, HIBP_CONFIG, HibpService, InputSanitizerService, InvalidJwtError, JwtService, PasswordStrengthService, RATE_LIMITER_CONFIG, RateLimitExceededError, RateLimiterService, RegexAnalyzerService, RegexSecurityBuilder, RegexSecurityService, RegexWorkerPoolService, SANITIZER_CONFIG, SECURE_STORAGE_CONFIG, SecureMessageService, SecureStorageService, SensitiveClipboardService, SessionIdleService, WebCryptoService, assessPasswordStrength, containsScriptInjection, containsSqlInjectionHints, defaultSecurityConfig, isHtmlSafe, isUrlSafe, provideCsrf, provideHibp, provideInputSanitizer, provideJwt, providePasswordStrength, provideRateLimiter, provideRegexSecurity, provideSecureMessage, provideSecureStorage, provideSecurity, provideSensitiveClipboard, provideSessionIdle, provideWebCrypto, sanitizeHtmlString, sanitizeUrlString, withCsrfHeader };
 export type { AesEncryptResult, AesKeyLength, CopyStatus, CsrfConfig, CsrfHeaderOptions, CsrfStorageTarget, HashAlgorithm, HibpConfig, HibpResult, HmacAlgorithm, HtmlSanitizerOptions, HttpMethod, JwtStandardClaims, PasswordAssessment, PasswordLabel, PasswordScore, PasswordStrengthResult, RateLimitPolicy, RateLimiterConfig, RegexBuilderOptions, RegexSecurityConfig, RegexSecurityResult, RegexTestResult, SanitizerConfig, SecureMessage, SecureMessageConfig, SecureStorageConfig, SecurityConfig, SensitiveCopyOptions, SessionIdleConfig, StorageTarget };