@asenajs/hono-adapter 4.0.0 → 5.0.1

package/dist/lib/middlewares/RateLimiterMiddleware.js

@@ -57,6 +57,9 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import { MiddlewareService } from '../defaults';
 import { OnStop } from '@asenajs/asena/decorators/ioc';
+const MAX_FORWARDED_HEADER_LENGTH = 1024;
+const IPV4_MAPPED_PREFIX = /^::ffff:(?=\d{1,3}(?:\.\d{1,3}){3}$)/i;
+const unmapIPv4 = (address) => address.replace(IPV4_MAPPED_PREFIX, '');
 /**
  * Rate Limiter Middleware
  *
@@ -122,6 +125,14 @@ export class RateLimiterMiddleware extends MiddlewareService {
      * Client key generator function
      */
     keyGenerator;
+    /**
+     * Trusted reverse proxies whose `X-Forwarded-For` may be believed
+     */
+    trustProxy;
+    /**
+     * Upper bound on distinct client buckets held in memory
+     */
+    maxBuckets;
     /**
      * Rate limit exceeded message
      */
@@ -146,6 +157,7 @@ export class RateLimiterMiddleware extends MiddlewareService {
      * Bucket TTL in milliseconds
      */
     bucketTTL;
+    warnedNoForwardedFor = false;
     /**
      * Creates a new rate limiter middleware instance
      *
@@ -173,6 +185,11 @@ export class RateLimiterMiddleware extends MiddlewareService {
         this.capacity = options.capacity ?? 100;
         this.refillRate = options.refillRate ?? 10;
         this.keyGenerator = options.keyGenerator ?? this.defaultKeyGenerator.bind(this);
+        this.trustProxy = options.trustProxy ?? false;
+        this.maxBuckets = options.maxBuckets ?? 10_000;
+        if (!Number.isInteger(this.maxBuckets) || this.maxBuckets < 1) {
+            throw new Error(`RateLimiterMiddleware: maxBuckets must be a positive integer, got ${this.maxBuckets}`);
+        }
         this.message = options.message ?? 'Rate limit exceeded. Please try again later.';
         this.statusCode = options.statusCode ?? 429;
         this.cost = options.cost ?? 1;
@@ -208,13 +225,19 @@ export class RateLimiterMiddleware extends MiddlewareService {
         const key = this.keyGenerator(context);
         // Get or create bucket
         let bucket = this.buckets.get(key);
-        if (!bucket) {
+        if (bucket) {
+            this.buckets.delete(key);
+        }
+        else {
             bucket = {
                 tokens: this.capacity,
                 lastRefill: Date.now(),
             };
-            this.buckets.set(key, bucket);
+            if (this.buckets.size >= this.maxBuckets) {
+                this.buckets.delete(this.buckets.keys().next().value);
+            }
         }
+        this.buckets.set(key, bucket);
         // Refill tokens based on elapsed time
         const now = Date.now();
         const elapsedSeconds = (now - bucket.lastRefill) / 1000;
@@ -286,16 +309,81 @@ export class RateLimiterMiddleware extends MiddlewareService {
         this.buckets.clear();
     }
     /**
-     * Default key generator - uses X-Forwarded-For or CF-Connecting-IP or falls back to 'unknown'
+     * Default key generator - the connecting peer, see `trustProxy`
      *
      * @param context - Hono context
      * @returns Client identifier
      */
     defaultKeyGenerator(context) {
-        const req = context.req;
-        const forwarded = typeof req.header === 'function' ? req.header('x-forwarded-for') : context.headers?.['x-forwarded-for'];
-        const cfIp = typeof req.header === 'function' ? req.header('cf-connecting-ip') : context.headers?.['cf-connecting-ip'];
-        return forwarded || cfIp || context.getRequestIp?.() || 'unknown';
+        return this.resolveClientKey(context);
+    }
+    /**
+     * Resolve the client identifier: the connecting peer, or the client hop of `X-Forwarded-For`
+     * when the peer is a trusted proxy
+     *
+     * @param context - Hono context
+     * @returns Client identifier
+     */
+    resolveClientKey(context) {
+        const peer = context.getRequestIp();
+        if (!this.trusts(peer)) {
+            return peer ?? 'unknown';
+        }
+        const hops = this.forwardedHops(context);
+        if (!hops.length) {
+            this.warnNoForwardedFor(peer);
+            return peer ?? 'unknown';
+        }
+        for (let i = hops.length - 1; i >= 0; i--) {
+            if (!this.trusts(hops[i])) {
+                return hops[i];
+            }
+        }
+        return hops.at(-1);
+    }
+    /**
+     * Warn, once per instance, that a trusted peer forwarded no usable `X-Forwarded-For`
+     *
+     * @param peer - The trusted peer address
+     */
+    warnNoForwardedFor(peer) {
+        if (this.warnedNoForwardedFor)
+            return;
+        this.warnedNoForwardedFor = true;
+        console.warn(`RateLimiterMiddleware: trusted proxy ${peer ?? '(no peer address)'} sent no usable X-Forwarded-For; ` +
+            'every client behind it shares one bucket. Make the proxy append X-Forwarded-For or narrow trustProxy.');
+    }
+    /**
+     * Whether an address is a reverse proxy whose forwarded hops may be believed
+     *
+     * @param address - Peer or forwarded hop address
+     * @returns True when the address is trusted
+     */
+    trusts(address) {
+        if (this.trustProxy === true)
+            return true;
+        if (!this.trustProxy || address === null)
+            return false;
+        if (!Array.isArray(this.trustProxy))
+            return this.trustProxy(address);
+        const normalized = unmapIPv4(address);
+        return this.trustProxy.some((entry) => unmapIPv4(entry) === normalized);
+    }
+    /**
+     * Parse `X-Forwarded-For` into its hops, left to right
+     *
+     * @param context - Hono context
+     * @returns The forwarded hops, or an empty list when the header is absent or over-long
+     */
+    forwardedHops(context) {
+        const header = context.req.header('x-forwarded-for');
+        if (!header || header.length > MAX_FORWARDED_HEADER_LENGTH) {
+            return [];
+        }
+        return header
+            .split(',')
+            .map((hop) => hop.trim())
+            .filter(Boolean);
     }
     /**
      * Setup automatic cleanup of inactive buckets

package/dist/lib/middlewares/RateLimiterMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"RateLimiterMiddleware.js","sourceRoot":"","sources":["../../../lib/middlewares/RateLimiterMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;;;;;;;;;;AAEH,OAAO,EAAgB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAoIvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,OAAO,qBAAsB,SAAQ,iBAAiB;IAC1D;;;;OAIG;IACc,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAErD;;OAEG;IACc,QAAQ,CAAS;IAElC;;OAEG;IACc,UAAU,CAAS;IAEpC;;OAEG;IACc,YAAY,CAA+B;IAE5D;;OAEG;IACc,OAAO,CAAS;IAEjC;;OAEG;IACc,UAAU,CAAS;IAEpC;;OAEG;IACc,IAAI,CAA0C;IAE/D;;OAEG;IACc,IAAI,CAAiC;IAEtD;;OAEG;IACK,YAAY,CAAS;IAE7B;;OAEG;IACc,SAAS,CAAS;IAEnC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAmB,UAA8B,EAAE;QACjD,KAAK,EAAE,CAAC;QAER,sCAAsC;QACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,8CAA8C,CAAC;QACjF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,aAAa;QAE3D,0BAA0B;QAC1B,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,WAAW;QAErE,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,IAAyB;QAC7D,uBAAuB;QACvB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAED,sBAAsB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEvC,uBAAuB;QACvB,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG;gBACP,MAAM,EAAE,IAAI,CAAC,QAAQ;gBACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;aACvB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,sCAAsC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QACxD,MAAM,WAAW,GAAG,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC;QAErD,sBAAsB;QACtB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;QAExB,kCAAkC;QAClC,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAErF,uCAAuC;QACvC,IAAI,MAAM,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YAChC,sBAAsB;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;YAE9E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,IAAI,CAAC,UAAU;gBACvB,OAAO,EAAE;oBACP,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC;oBACjC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,EAAE,sBAAsB;oBACrF,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC1D,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC;iBAC/E;aACF,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC;QAE7B,sDAAsD;QACtD,OAAO,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAElG,sCAAsC;QACtC,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IAEI,OAAO;QACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACI,cAAc,CAAC,GAAW;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACI,YAAY;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,OAAgB;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAU,CAAC;QAC/B,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAC1G,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAE5G,OAAO,SAAS,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,SAAS,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,QAAgB;QACnC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,wBAAwB;YACxB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACnD,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC7C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAED,0BAA0B;YAC1B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEb,uCAAuC;QACvC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AAtEQ;IADN,MAAM,EAAE;;;;oDAQR"}
+{"version":3,"file":"RateLimiterMiddleware.js","sourceRoot":"","sources":["../../../lib/middlewares/RateLimiterMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;;;;;;;;;;AAEH,OAAO,EAAgB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAEvD,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEzC,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AAEnE,MAAM,SAAS,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAuKvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,OAAO,qBAAsB,SAAQ,iBAAiB;IAC1D;;;;OAIG;IACc,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAErD;;OAEG;IACc,QAAQ,CAAS;IAElC;;OAEG;IACc,UAAU,CAAS;IAEpC;;OAEG;IACc,YAAY,CAA+B;IAE5D;;OAEG;IACc,UAAU,CAAsD;IAEjF;;OAEG;IACc,UAAU,CAAS;IAEpC;;OAEG;IACc,OAAO,CAAS;IAEjC;;OAEG;IACc,UAAU,CAAS;IAEpC;;OAEG;IACc,IAAI,CAA0C;IAE/D;;OAEG;IACc,IAAI,CAAiC;IAEtD;;OAEG;IACK,YAAY,CAAS;IAE7B;;OAEG;IACc,SAAS,CAAS;IAE3B,oBAAoB,GAAG,KAAK,CAAC;IAErC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAmB,UAA8B,EAAE;QACjD,KAAK,EAAE,CAAC;QAER,sCAAsC;QACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,qEAAqE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,8CAA8C,CAAC;QACjF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,aAAa;QAE3D,0BAA0B;QAC1B,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,WAAW;QAErE,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,IAAyB;QAC7D,uBAAuB;QACvB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAED,sBAAsB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEvC,uBAAuB;QACvB,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG;gBACP,MAAM,EAAE,IAAI,CAAC,QAAQ;gBACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;aACvB,CAAC;YAEF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE9B,sCAAsC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QACxD,MAAM,WAAW,GAAG,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC;QAErD,sBAAsB;QACtB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;QAExB,kCAAkC;QAClC,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAErF,uCAAuC;QACvC,IAAI,MAAM,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YAChC,sBAAsB;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;YAE9E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,IAAI,CAAC,UAAU;gBACvB,OAAO,EAAE;oBACP,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC;oBACjC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,EAAE,sBAAsB;oBACrF,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC1D,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC;iBAC/E;aACF,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC;QAE7B,sDAAsD;QACtD,OAAO,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAElG,sCAAsC;QACtC,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IAEI,OAAO;QACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACI,cAAc,CAAC,GAAW;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACI,YAAY;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,OAAgB;QAC1C,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,OAAgB;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QAEpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,IAAI,SAAS,CAAC;QAC3B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAE9B,OAAO,IAAI,IAAI,SAAS,CAAC;QAC3B,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,IAAmB;QAC5C,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO;QAEtC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACjC,OAAO,CAAC,IAAI,CACV,wCAAwC,IAAI,IAAI,mBAAmB,mCAAmC;YACpG,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,OAAsB;QACnC,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAErE,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACK,aAAa,CAAC,OAAgB;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAErD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YAC3D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM;aACV,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,QAAgB;QACnC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,wBAAwB;YACxB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACnD,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC7C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAED,0BAA0B;YAC1B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEb,uCAAuC;QACvC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AAlJQ;IADN,MAAM,EAAE;;;;oDAQR"}

package/dist/lib/middlewares/WebSocketOriginMiddleware.d.ts

@@ -0,0 +1,81 @@
+/**
+ * WebSocket Origin Middleware for Hono Adapter
+ *
+ * Closes the cross-site WebSocket hijacking hole by:
+ * - Rejecting a handshake whose `Origin` is not allowed, before `server.upgrade()`
+ * - Deciding explicitly what happens when there is no `Origin` at all
+ * - Uses Hono's native header system
+ *
+ * @module defaults/WebSocketOriginMiddleware
+ *
+ * @example
+ * ```typescript
+ * import { Middleware, WebSocket } from '@asenajs/asena/decorators';
+ * import { WebSocketOriginMiddleware } from '@asenajs/hono-adapter';
+ *
+ * @Middleware()
+ * export class ChatOrigin extends WebSocketOriginMiddleware {
+ *   constructor() {
+ *     super({ allowedOrigins: ['https://app.example.com'] });
+ *   }
+ * }
+ *
+ * @WebSocket({ path: 'chat', middlewares: [ChatOrigin, SessionAuth] })
+ * export class ChatSocket { ... }
+ * ```
+ */
+import { type Context, MiddlewareService } from '../defaults';
+/**
+ * WebSocket origin policy options
+ */
+export interface WebSocketOriginOptions {
+    /** Origins allowed to open a WebSocket: exact `Origin` header values, or a predicate. */
+    allowedOrigins: string[] | ((origin: string) => boolean);
+    /**
+     * Accept handshakes that carry no `Origin` header (non-browser clients). Browsers always send one,
+     * so the default rejects: a missing header is not evidence of a first-party page.
+     *
+     * @default false
+     */
+    allowMissingOrigin?: boolean;
+}
+/**
+ * WebSocket Origin Middleware
+ *
+ * Use it as a `@WebSocket({ middlewares: [...] })` middleware, listed **before** any cookie-based
+ * auth middleware: the browser attaches cookies to a cross-site handshake, so a session is already
+ * authenticated by the time an auth middleware looks at it.
+ *
+ * `CorsMiddleware` is not a WebSocket origin policy - it sets response headers a browser applies to
+ * `fetch`/XHR, and a disallowed origin still upgrades.
+ *
+ * The `Origin` header is compared exactly: `'https://app.example.com'`, scheme included, no trailing
+ * slash.
+ *
+ * It is an ordinary middleware, so on an HTTP route it would reject every request without an
+ * `Origin` - which is why the name says WebSocket.
+ *
+ * @example
+ * ```typescript
+ * // A predicate covers wildcard subdomains; there is no '*' special value
+ * new WebSocketOriginMiddleware({ allowedOrigins: (origin) => origin.endsWith('.example.com') });
+ * ```
+ */
+export declare class WebSocketOriginMiddleware extends MiddlewareService {
+    private readonly allowedOrigins;
+    private readonly allowMissingOrigin;
+    /**
+     * Creates a new WebSocket origin middleware instance
+     *
+     * @param options - Origin policy options
+     */
+    constructor(options: WebSocketOriginOptions);
+    /**
+     * Reject the handshake unless its `Origin` is allowed
+     *
+     * @param context - Hono context wrapper
+     * @param next - Function to call next middleware or handler
+     * @returns A 403 response, or the result of next() for an allowed origin
+     */
+    handle(context: Context, next: () => Promise<void>): Promise<any>;
+}

package/dist/lib/middlewares/WebSocketOriginMiddleware.js

@@ -0,0 +1,81 @@
+/**
+ * WebSocket Origin Middleware for Hono Adapter
+ *
+ * Closes the cross-site WebSocket hijacking hole by:
+ * - Rejecting a handshake whose `Origin` is not allowed, before `server.upgrade()`
+ * - Deciding explicitly what happens when there is no `Origin` at all
+ * - Uses Hono's native header system
+ *
+ * @module defaults/WebSocketOriginMiddleware
+ *
+ * @example
+ * ```typescript
+ * import { Middleware, WebSocket } from '@asenajs/asena/decorators';
+ * import { WebSocketOriginMiddleware } from '@asenajs/hono-adapter';
+ *
+ * @Middleware()
+ * export class ChatOrigin extends WebSocketOriginMiddleware {
+ *   constructor() {
+ *     super({ allowedOrigins: ['https://app.example.com'] });
+ *   }
+ * }
+ *
+ * @WebSocket({ path: 'chat', middlewares: [ChatOrigin, SessionAuth] })
+ * export class ChatSocket { ... }
+ * ```
+ */
+import { MiddlewareService } from '../defaults';
+/**
+ * WebSocket Origin Middleware
+ *
+ * Use it as a `@WebSocket({ middlewares: [...] })` middleware, listed **before** any cookie-based
+ * auth middleware: the browser attaches cookies to a cross-site handshake, so a session is already
+ * authenticated by the time an auth middleware looks at it.
+ *
+ * `CorsMiddleware` is not a WebSocket origin policy - it sets response headers a browser applies to
+ * `fetch`/XHR, and a disallowed origin still upgrades.
+ *
+ * The `Origin` header is compared exactly: `'https://app.example.com'`, scheme included, no trailing
+ * slash.
+ *
+ * It is an ordinary middleware, so on an HTTP route it would reject every request without an
+ * `Origin` - which is why the name says WebSocket.
+ *
+ * @example
+ * ```typescript
+ * // A predicate covers wildcard subdomains; there is no '*' special value
+ * new WebSocketOriginMiddleware({ allowedOrigins: (origin) => origin.endsWith('.example.com') });
+ * ```
+ */
+export class WebSocketOriginMiddleware extends MiddlewareService {
+    allowedOrigins;
+    allowMissingOrigin;
+    /**
+     * Creates a new WebSocket origin middleware instance
+     *
+     * @param options - Origin policy options
+     */
+    constructor(options) {
+        super();
+        this.allowedOrigins = options.allowedOrigins;
+        this.allowMissingOrigin = options.allowMissingOrigin ?? false;
+    }
+    /**
+     * Reject the handshake unless its `Origin` is allowed
+     *
+     * @param context - Hono context wrapper
+     * @param next - Function to call next middleware or handler
+     * @returns A 403 response, or the result of next() for an allowed origin
+     */
+    async handle(context, next) {
+        const origin = context.req.header('Origin');
+        if (!origin) {
+            return this.allowMissingOrigin ? await next() : new Response('Forbidden', { status: 403 });
+        }
+        const allowed = Array.isArray(this.allowedOrigins)
+            ? this.allowedOrigins.includes(origin)
+            : this.allowedOrigins(origin);
+        return allowed ? await next() : new Response('Forbidden', { status: 403 });
+    }
+}
+//# sourceMappingURL=WebSocketOriginMiddleware.js.map

package/dist/lib/middlewares/WebSocketOriginMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebSocketOriginMiddleware.js","sourceRoot":"","sources":["../../../lib/middlewares/WebSocketOriginMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAgB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAkB9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,yBAA0B,SAAQ,iBAAiB;IAC7C,cAAc,CAA2C;IAEzD,kBAAkB,CAAU;IAE7C;;;;OAIG;IACH,YAAmB,OAA+B;QAChD,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,IAAyB;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEhC,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/lib/utils/serveStatic.d.ts

@@ -0,0 +1,3 @@
+import type { MiddlewareHandler } from 'hono';
+import { type ServeStaticOptions } from 'hono/serve-static';
+export declare const serveStatic: (options?: ServeStaticOptions) => MiddlewareHandler;

package/dist/lib/utils/serveStatic.js

@@ -0,0 +1,17 @@
+import { statSync } from 'node:fs';
+import { join } from 'node:path';
+import { serveStatic as baseServeStatic } from 'hono/serve-static';
+const getContent = (async (path) => {
+    const file = Bun.file(path);
+    return (await file.exists()) ? file : null;
+});
+const isDir = (path) => {
+    try {
+        return statSync(path, { throwIfNoEntry: false })?.isDirectory();
+    }
+    catch {
+        return undefined;
+    }
+};
+export const serveStatic = (options = {}) => baseServeStatic({ ...options, getContent, join, isDir });
+//# sourceMappingURL=serveStatic.js.map

package/dist/lib/utils/serveStatic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serveStatic.js","sourceRoot":"","sources":["../../../lib/utils/serveStatic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,IAAI,eAAe,EAA2B,MAAM,mBAAmB,CAAC;AAI5F,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE5B,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC,CAA6B,CAAC;AAE/B,MAAM,KAAK,GAAG,CAAC,IAAY,EAAuB,EAAE;IAClD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAA8B,EAAE,EAAqB,EAAE,CACjF,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC"}

package/package.json

@@ -9,11 +9,11 @@
     "README.md",
     "LICENSE"
   ],
-  "version": "4.0.0",
+  "version": "5.0.1",
   "author": "LibirSoft",
   "repository": {
     "type": "git",
-    "url": "https://github.com/AsenaJs/hono-adapter.git"
+    "url": "git+https://github.com/AsenaJs/hono-adapter.git"
   },
   "license": "MIT",
   "engines": {
@@ -41,7 +41,7 @@
     "release": "bun run build && changeset publish"
   },
   "devDependencies": {
-    "@asenajs/asena": "^0.11.0",
+    "@asenajs/asena": "^0.12.0",
     "@changesets/cli": "^2.31.1",
     "@types/bun": "latest",
     "@typescript-eslint/eslint-plugin": "^8.68.0",
@@ -55,7 +55,7 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@asenajs/asena": "^0.11.0",
+    "@asenajs/asena": "^0.12.0",
     "hono": ">=4.12.9",
     "typescript": "^5.8.2",
     "zod": "^4.3.6"