@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/lib/middleware/flag-context.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * flag-context middleware — extracts an OpenFeature evaluation context
+ * onto the request so downstream handlers and multiple flag clients
+ * can read a consistent context without re-deriving it per call.
+ *
+ *   var attachCtx = b.middleware.flagContext({
+ *     userKey: "x-user-id",                 // header to pull targetingKey from
+ *     extractAttributes: function (req) {   // operator-supplied augmentation
+ *       return { tenantId: req.tenantId, environment: process.env.NODE_ENV };
+ *     },
+ *   });
+ *   router.use(attachCtx);
+ *
+ *   // Downstream:
+ *   var ctx = req.flagCtx;                       // readonly Frozen object
+ *   var enabled = b.flagClient.getBoolean("foo", ctx);
+ *
+ * The middleware does NOT evaluate flags — it only constructs the
+ * context. Pair with `flag.middleware()` for the request-attached
+ * convenience accessor; or pass `req.flagCtx` directly to a flag
+ * client method for a more decoupled shape (e.g. when several flag
+ * clients with different providers share the same context).
+ */
+
+var validateOpts  = require("../validate-opts");
+var lazyRequire   = require("../lazy-require");
+var { defineClass } = require("../framework-error");
+var FlagError = defineClass("FlagError", { alwaysPermanent: true });
+
+var contextMod = lazyRequire(function () { return require("../flag-evaluation-context"); });
+
+/**
+ * @primitive b.middleware.flagContext
+ * @signature b.middleware.flagContext(opts)
+ * @since     0.1.0
+ * @related   b.flagClient.getBoolean
+ *
+ * Extracts an OpenFeature evaluation context onto `req.flagCtx` so
+ * downstream handlers and multiple flag clients read a consistent
+ * context without re-deriving it per call. The middleware itself
+ * does NOT evaluate flags — pair with `flag.middleware()` for the
+ * request-attached accessor, or pass `req.flagCtx` directly to a
+ * flag client method when several clients with different providers
+ * share the same context. `userKey` (literal) takes precedence over
+ * `userKeyHeader`; `tenantKeyHeader` augments with tenantId; the
+ * operator-supplied `extractAttributes(req)` adds arbitrary fields.
+ *
+ * @opts
+ *   {
+ *     userKey:           string,
+ *     userKeyHeader:     string,
+ *     tenantKeyHeader:   string,
+ *     extractAttributes: function(req): object,
+ *   }
+ *
+ * @example
+ *   var b = require("@blamejs/core");
+ *   var app = b.router.create();
+ *   app.use(b.middleware.flagContext({
+ *     userKeyHeader:    "x-user-id",
+ *     extractAttributes: function (req) {
+ *       return { environment: "prod" };
+ *     },
+ *   }));
+ */
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "userKey", "userKeyHeader", "extractAttributes", "tenantKeyHeader",
+  ], "middleware.flagContext");
+  if (opts.extractAttributes != null && typeof opts.extractAttributes !== "function") {
+    throw new FlagError("flag/bad-opt",
+      "flagContext: extractAttributes must be a function");
+  }
+  var userKeyHeader = (typeof opts.userKeyHeader === "string" && opts.userKeyHeader.length > 0)
+    ? opts.userKeyHeader.toLowerCase()
+    : null;
+  var tenantKeyHeader = (typeof opts.tenantKeyHeader === "string" && opts.tenantKeyHeader.length > 0)
+    ? opts.tenantKeyHeader.toLowerCase()
+    : null;
+  var explicitUserKey = (typeof opts.userKey === "string" && opts.userKey.length > 0)
+    ? opts.userKey
+    : null;
+
+  return function flagContextMiddleware(req, res, next) {
+    var headers = req.headers || {};
+    var headerKey = userKeyHeader && typeof headers[userKeyHeader] === "string"
+      ? headers[userKeyHeader]
+      : null;
+    var fromReqOpts = {};
+    if (explicitUserKey)            fromReqOpts.userKey = explicitUserKey;
+    else if (headerKey)             fromReqOpts.userKey = headerKey;
+    var augment = {};
+    if (typeof opts.extractAttributes === "function") {
+      try {
+        var extra = opts.extractAttributes(req);
+        if (extra && typeof extra === "object") augment = extra;
+      } catch (_e) { /* drop-silent on extraction error */ }
+    }
+    if (tenantKeyHeader && typeof headers[tenantKeyHeader] === "string") {
+      augment.tenantId = headers[tenantKeyHeader];
+    }
+    fromReqOpts.extra = augment;
+    req.flagCtx = contextMod().fromRequest(req, fromReqOpts);
+    return next();
+  };
+}
+
+module.exports = { create: create };

package/lib/vendor/blamejs/lib/middleware/gpc.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * b.middleware.gpc — Sec-GPC (Global Privacy Control) middleware.
+ *
+ * Reads the `Sec-GPC: 1` request header (W3C Privacy Sandbox / IETF
+ * draft-doty-gpc-header) and, when present, sets `req.gpcOptOut =
+ * true` for downstream consumers. Optionally records the opt-out
+ * via `b.consent` (when wired) so the operator's data-flow primitives
+ * can refuse `sale`/`share`/`targeted-ads`/`profiling` purposes for
+ * this session.
+ *
+ * Echoes a `Sec-GPC-Status: honored` response header per the
+ * California Privacy Protection Agency's recommended posture so the
+ * client UA can confirm honoring (and so audits show the
+ * acknowledgement).
+ *
+ * Compliance context — Sec-GPC is **legally required** by:
+ *   - California (CCPA / CPRA) — effective Jan 1 2024
+ *   - Colorado, Connecticut, Texas, Oregon, Delaware, Montana, Iowa,
+ *     Nebraska, New Hampshire, New Jersey, Maryland, Minnesota — effective
+ *     dates vary; most by Jan 1 2026
+ *
+ * Operators handling US user traffic without honoring Sec-GPC face
+ * regulator-action exposure (CPPA fines up to $7,500 per intentional
+ * violation). The framework's posture is to honor by default; operators
+ * who legitimately don't process the listed purposes still emit the
+ * acknowledgement header so audits trace correctly.
+ *
+ *   var gpc = b.middleware.gpc({
+ *     audit:   b.audit,
+ *     consent: b.consent,           // optional — auto-records purpose-withdrawal
+ *     mode:    "enforce",            // "enforce" | "audit-only"
+ *   });
+ *   app.use(gpc);
+ *
+ *   app.get("/api/data", function (req, res) {
+ *     if (req.gpcOptOut) {
+ *       // Don't serve targeted ads, don't share with data brokers, etc.
+ *     }
+ *   });
+ */
+
+var lazyRequire = require("../lazy-require");
+
+var observability = lazyRequire(function () { return require("../observability"); });
+void observability;
+
+// Purposes the operator must NOT process when Sec-GPC: 1 is set, per
+// CCPA/CPRA + the multi-state cohort. Operators consuming `req.gpcOptOut`
+// gate these specific purposes.
+var GPC_OPTOUT_PURPOSES = Object.freeze([
+  "sale",
+  "share",
+  "targeted-ads",
+  "cross-context-behavioral-advertising",
+  "profiling",
+]);
+
+function _emitAudit(audit, action, outcome, metadata) {
+  if (!audit || typeof audit.safeEmit !== "function") return;
+  try {
+    audit.safeEmit({
+      action:   action,
+      actor:    metadata.actor || { kind: "framework", id: "middleware/gpc" },
+      outcome:  outcome,
+      metadata: metadata,
+    });
+  } catch (_e) { /* drop-silent */ }
+}
+
+/**
+ * @primitive b.middleware.gpc
+ * @signature b.middleware.gpc(opts)
+ * @since     0.1.0
+ * @compliance ccpa, modpa
+ * @related   b.middleware.cookies
+ *
+ * Sec-GPC (Global Privacy Control) handler. Reads the `Sec-GPC: 1`
+ * inbound header and sets `req.gpcOptOut = true` for downstream
+ * consumers. Echoes `Sec-GPC-Status: honored` so the UA + auditors
+ * see the acknowledgement. Honoring Sec-GPC is legally required in
+ * California (CCPA/CPRA) and a growing list of US states; operators
+ * who don't process the listed purposes (`sale`, `share`,
+ * `targeted-ads`, `cross-context-behavioral-advertising`,
+ * `profiling`) still emit the acknowledgement so audits trace.
+ * Optional `consent` integration auto-records purpose withdrawal.
+ *
+ * @opts
+ *   {
+ *     mode:         "enforce"|"audit-only",   // default "enforce"
+ *     consent:      object,                    // b.consent instance
+ *     statusHeader: boolean,                   // default true
+ *     audit:        object,
+ *   }
+ *
+ * @example
+ *   var b = require("@blamejs/core");
+ *   var app = b.router.create();
+ *   app.use(b.middleware.gpc({ mode: "enforce" }));
+ *   app.get("/api/data", function (req, res) {
+ *     res.end(req.gpcOptOut ? "minimal" : "full");
+ *   });
+ */
+function create(opts) {
+  opts = opts || {};
+  var mode = opts.mode || "enforce";
+  var audit = opts.audit || null;
+  var consentApi = opts.consent || null;
+  var statusHeader = opts.statusHeader !== false;
+
+  return function gpcMiddleware(req, res, next) {
+    var rawHeader = (req.headers && req.headers["sec-gpc"]) || "";
+    var optOut = rawHeader === "1";
+    req.gpcOptOut = optOut;
+
+    if (optOut) {
+      // Stamp the acknowledgement header so the UA + auditors see we
+      // honored.
+      if (statusHeader && typeof res.setHeader === "function") {
+        res.setHeader("Sec-GPC-Status", mode === "audit-only" ? "audit-only" : "honored");
+      }
+
+      // Optional integration with b.consent — record purpose
+      // withdrawal so downstream consumers see the GPC signal as a
+      // structured opt-out.
+      if (consentApi && typeof consentApi.recordOptOut === "function") {
+        try {
+          consentApi.recordOptOut({
+            req:       req,
+            purposes:  GPC_OPTOUT_PURPOSES,
+            source:    "sec-gpc",
+            mode:      mode,
+          });
+        } catch (e) {
+          _emitAudit(audit, "middleware.gpc.consent-error", "audit", {
+            error: (e && e.message) || String(e),
+          });
+        }
+      }
+
+      _emitAudit(audit, "middleware.gpc.opt-out-honored", "success", {
+        mode:     mode,
+        purposes: GPC_OPTOUT_PURPOSES.slice(),
+      });
+    }
+    return next();
+  };
+}
+
+module.exports = {
+  create:                create,
+  GPC_OPTOUT_PURPOSES:   GPC_OPTOUT_PURPOSES,
+};

package/lib/vendor/blamejs/lib/middleware/headers.js

@@ -0,0 +1,242 @@
+"use strict";
+/**
+ * b.middleware.headers — inbound HTTP header threat detection.
+ *
+ * Sits at the top of the request lifecycle. Validates the inbound
+ * headers against the RFC 9110 §5.1 token grammar and surfaces threat
+ * shapes: CRLF injection, CL+TE request smuggling (RFC 9112 §6.1),
+ * oversized header / count, deprecated trust-header patterns.
+ *
+ * Threat catalog:
+ *   - header-name-shape — header name not a valid RFC 9110 token.
+ *   - header-value-control-byte — CR / LF / NUL inside a header value
+ *     (header-injection defense in depth on top of Node's rejection).
+ *   - header-count-cap — > maxHeaderCount headers (default 100).
+ *   - header-value-cap — single value > maxValueBytes (default 8 KiB).
+ *   - smuggling-cl-te — Content-Length AND Transfer-Encoding both
+ *     present (RFC 9112 §6.1 — CL.TE / TE.CL smuggling shape).
+ *   - smuggling-cl-multi — multiple Content-Length values (proxy-
+ *     desync class).
+ *   - smuggling-te-multi — multiple Transfer-Encoding values.
+ *   - deprecated-trust-header — X-Forwarded-For / X-Forwarded-Proto /
+ *     X-Forwarded-Host present without operator-supplied trustProxy
+ *     opt — the framework warns once that the operator should adopt
+ *     RFC 7239 `Forwarded` or explicit trustProxy.
+ *
+ *   var middleware = b.middleware.headers({
+ *     mode:               "enforce",       // "enforce" | "audit-only" | "log-only"
+ *     audit:              b.audit,
+ *     maxHeaderCount:     100,
+ *     maxValueBytes:      8 * 1024,
+ *     trustProxy:         false,            // whether X-Forwarded-* is allowed
+ *     refuseOnHigh:       true,
+ *   });
+ */
+
+var lazyRequire = require("../lazy-require");
+var safeBuffer = require("../safe-buffer");
+
+var observability = lazyRequire(function () { return require("../observability"); });
+void observability;
+
+// RFC 9110 §5.1 token grammar — tchar set per RFC 7230.
+var TOKEN_RE = safeBuffer.RFC7230_TCHAR_RE;
+
+var DEPRECATED_TRUST_HEADERS = Object.freeze([
+  "x-forwarded-for",
+  "x-forwarded-proto",
+  "x-forwarded-host",
+  "x-forwarded-port",
+  "x-real-ip",
+]);
+
+function _emitAudit(audit, action, outcome, metadata) {
+  if (!audit || typeof audit.safeEmit !== "function") return;
+  try {
+    audit.safeEmit({
+      action:   action,
+      actor:    metadata.actor || { kind: "framework", id: "middleware/headers" },
+      outcome:  outcome,
+      metadata: metadata,
+    });
+  } catch (_e) { /* drop-silent — observability sink */ }
+}
+
+function _detectIssues(headers, opts) {
+  var issues = [];
+  if (!headers || typeof headers !== "object") return issues;
+
+  var names = Object.keys(headers);
+
+  if (names.length > opts.maxHeaderCount) {
+    issues.push({
+      kind: "header-count-cap", severity: "high",
+      snippet: "request has " + names.length + " headers, exceeds " +
+               "maxHeaderCount " + opts.maxHeaderCount,
+    });
+  }
+
+  for (var i = 0; i < names.length; i += 1) {
+    var name = names[i];
+    var value = headers[name];
+
+    // Header name shape — Node lowercases names; the original tchar
+    // grammar covers a-z / 0-9 / `!#$%&'*+-.^_`|~`.
+    if (!TOKEN_RE.test(name)) {                                                  // allow:regex-no-length-cap — Node already caps header name length at 8190 chars by default (HTTP/1.1 line cap)
+      issues.push({
+        kind: "header-name-shape", severity: "high",
+        snippet: "header name `" + name + "` is not a valid RFC 9110 " +
+                 "§5.1 token",
+      });
+    }
+
+    var valueArr = Array.isArray(value) ? value : [value];
+    for (var vi = 0; vi < valueArr.length; vi += 1) {
+      var v = valueArr[vi];
+      if (typeof v !== "string") continue;
+      if (Buffer.byteLength(v, "utf8") > opts.maxValueBytes) {
+        issues.push({
+          kind: "header-value-cap", severity: "high", header: name,
+          snippet: "header `" + name + "` value " + v.length +
+                   " bytes exceeds maxValueBytes " + opts.maxValueBytes,
+        });
+        continue;
+      }
+      for (var ci = 0; ci < v.length; ci += 1) {
+        var cc = v.charCodeAt(ci);
+        if (cc === 0x0D || cc === 0x0A || cc === 0x00) {                         // allow:raw-byte-literal — CR / LF / NUL forbidden in header value
+          issues.push({
+            kind: "header-value-control-byte", severity: "high", header: name,
+            snippet: "header `" + name + "` value contains CR / LF / NUL " +
+                     "— header-injection defense in depth",
+          });
+          break;
+        }
+      }
+    }
+  }
+
+  // Smuggling shapes (RFC 9112 §6.1).
+  var clRaw = headers["content-length"];
+  var teRaw = headers["transfer-encoding"];
+  if (clRaw !== undefined && teRaw !== undefined) {
+    issues.push({
+      kind: "smuggling-cl-te", severity: "high",
+      snippet: "both Content-Length and Transfer-Encoding present " +
+               "(RFC 9112 §6.1 — CL.TE / TE.CL request-smuggling vector)",
+    });
+  }
+  if (Array.isArray(clRaw) && clRaw.length > 1) {
+    issues.push({
+      kind: "smuggling-cl-multi", severity: "high",
+      snippet: "multiple Content-Length values — proxy-desync " +
+               "request-smuggling vector",
+    });
+  }
+  if (Array.isArray(teRaw) && teRaw.length > 1) {
+    issues.push({
+      kind: "smuggling-te-multi", severity: "high",
+      snippet: "multiple Transfer-Encoding values — proxy-desync " +
+               "request-smuggling vector",
+    });
+  }
+
+  // Deprecated trust-header pattern.
+  if (!opts.trustProxy) {
+    for (var di = 0; di < DEPRECATED_TRUST_HEADERS.length; di += 1) {
+      var h = DEPRECATED_TRUST_HEADERS[di];
+      if (headers[h] !== undefined) {
+        issues.push({
+          kind: "deprecated-trust-header", severity: "warn", header: h,
+          snippet: "request carries `" + h + "` but trustProxy is " +
+                   "false — adopt RFC 7239 `Forwarded` or set " +
+                   "trustProxy explicitly",
+        });
+      }
+    }
+  }
+
+  return issues;
+}
+
+/**
+ * @primitive b.middleware.headers
+ * @signature b.middleware.headers(opts)
+ * @since     0.1.0
+ * @related   b.middleware.cookies, b.middleware.bodyParser
+ *
+ * Inbound HTTP header threat detection. Validates header names
+ * against the RFC 9110 §5.1 token grammar and surfaces CRLF
+ * injection, RFC 9112 §6.1 CL+TE request-smuggling shapes, multiple
+ * `Content-Length` / `Transfer-Encoding` values, oversize header
+ * count / value, and deprecated `X-Forwarded-*` patterns when the
+ * operator hasn't opted into `trustProxy`. In `mode: "enforce"`
+ * (default) high-severity issues refuse with HTTP 400 + `Connection:
+ * close`; `audit-only` and `log-only` pass through but still emit
+ * audits.
+ *
+ * @opts
+ *   {
+ *     mode:           "enforce"|"audit-only"|"log-only",  // default "enforce"
+ *     refuseOnHigh:   boolean,    // default true (enforce only)
+ *     maxHeaderCount: number,     // default 100
+ *     maxValueBytes:  number,     // default 8 KiB
+ *     trustProxy:     boolean,
+ *     audit:          object,
+ *   }
+ *
+ * @example
+ *   var b = require("@blamejs/core");
+ *   var app = b.router.create();
+ *   app.use(b.middleware.headers({
+ *     mode:           "enforce",
+ *     maxHeaderCount: 100,
+ *     maxValueBytes:  b.constants.BYTES.kib(8),
+ *   }));
+ */
+function create(opts) {
+  opts = opts || {};
+  var mode = opts.mode || "enforce";
+  var refuseOnHigh = opts.refuseOnHigh !== false && mode === "enforce";
+  var audit = opts.audit || null;
+  var resolved = {
+    maxHeaderCount: opts.maxHeaderCount || 100,                                  // allow:raw-byte-literal — header count ceiling
+    maxValueBytes:  opts.maxValueBytes  || 8 * 1024,                             // allow:raw-byte-literal — header value cap (8 KiB)
+    trustProxy:     !!opts.trustProxy,
+  };
+
+  return function headersMiddleware(req, res, next) {
+    var headers = req && req.headers ? req.headers : {};
+    var issues = _detectIssues(headers, resolved);
+    if (issues.length === 0) return next();
+
+    var hasHigh = false;
+    for (var i = 0; i < issues.length; i += 1) {
+      var iss = issues[i];
+      if (iss.severity === "high") hasHigh = true;
+      _emitAudit(audit, "middleware.headers.threat-detected",
+        iss.severity === "high" ? "blocked" : "audit", {
+          kind:    iss.kind,
+          header:  iss.header || null,
+          snippet: iss.snippet,
+          mode:    mode,
+        });
+    }
+
+    if (hasHigh && refuseOnHigh) {
+      res.statusCode = 400;
+      res.setHeader("Content-Type", "application/json");
+      res.end(JSON.stringify({
+        error:  "header-threat-detected",
+        issues: issues.filter(function (i) { return i.severity === "high"; })
+                      .map(function (i) {
+                        return { kind: i.kind, header: i.header || null };
+                      }),
+      }));
+      return;
+    }
+    return next();
+  };
+}
+
+module.exports = { create: create };