@blamejs/blamejs-shop 0.3.7 → 0.3.9

package/lib/vendor/blamejs/lib/middleware/fetch-metadata.js

@@ -36,20 +36,25 @@
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var lazyRequire = require("../lazy-require");
+var denyResponse = require("./deny-response").denyResponse;
 
 var audit = lazyRequire(function () { return require("../audit"); });
 var observability = lazyRequire(function () { return require("../observability"); });
 
 var DEFAULT_METHODS = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
 
-function _writeReject(res, message) {
-  if (res.headersSent) return;
-  var body = JSON.stringify({ error: message });
-  res.writeHead(requestHelpers.HTTP_STATUS.FORBIDDEN, {
-    "Content-Type":   "application/json; charset=utf-8",
-    "Content-Length": Buffer.byteLength(body),
+function _writeReject(req, res, message, reason, onDeny, problemMode) {
+  denyResponse(req, res, {
+    onDeny:        onDeny,
+    problem:       problemMode,
+    status:        requestHelpers.HTTP_STATUS.FORBIDDEN,
+    info:          { status: 403, reason: reason },
+    problemCode:   "fetch-metadata-refused",
+    problemTitle:  "Forbidden",
+    problemDetail: message,
+    contentType:   "application/json; charset=utf-8",
+    body:          JSON.stringify({ error: message }),
   });
-  res.end(body);
 }
 
 /**
@@ -79,6 +84,8 @@ function _writeReject(res, message) {
  *     allowedNavigate: boolean,    // default true
  *     methods:         string[],   // default POST/PUT/DELETE/PATCH
  *     audit:           boolean,    // default true
+ *     onDeny:          function(req, res, info): void,  // own the 403; info = { status, reason }
+ *     problemDetails:  boolean,    // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
  *
  * @example
@@ -95,9 +102,11 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "allowSameSite", "allowCrossSite", "allowMissing",
-    "allowedDest", "allowedNavigate", "methods", "audit",
+    "allowedDest", "allowedNavigate", "methods", "audit", "onDeny", "problemDetails",
   ], "middleware.fetchMetadata");
 
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
   var allowSameSite   = opts.allowSameSite !== false;
   var allowCrossSite  = opts.allowCrossSite === true;
   var allowMissing    = opts.allowMissing !== false;
@@ -135,7 +144,7 @@ function create(opts) {
       // Defer to other auth/CSRF layers per allowMissing.
       if (!allowMissing) {
         _emitDenied(req, "fetch-metadata-missing");
-        return _writeReject(res, "Fetch-metadata required.");
+        return _writeReject(req, res, "Fetch-metadata required.", "fetch-metadata-missing", onDeny, problemMode);
       }
       return next();
     }
@@ -144,7 +153,7 @@ function create(opts) {
     if (site === "none") {
       if (allowedNavigate) return next();
       _emitDenied(req, "navigate-disallowed");
-      return _writeReject(res, "Direct navigation not allowed for this method.");
+      return _writeReject(req, res, "Direct navigation not allowed for this method.", "navigation-not-allowed", onDeny, problemMode);
     }
 
     if (site === "same-origin") return next();
@@ -152,7 +161,7 @@ function create(opts) {
     if (site === "same-site") {
       if (allowSameSite) return next();
       _emitDenied(req, "same-site-disallowed");
-      return _writeReject(res, "Same-site request not allowed.");
+      return _writeReject(req, res, "Same-site request not allowed.", "same-site-not-allowed", onDeny, problemMode);
     }
 
     // cross-site
@@ -164,7 +173,7 @@ function create(opts) {
                      ", dest=" + (dest || "?") + ")");
     try { observability().count("auth.fetch_metadata.cross_site_refused", 1, {}); }
     catch (_e) { /* best-effort */ }
-    return _writeReject(res, "Cross-site request refused.");
+    return _writeReject(req, res, "Cross-site request refused.", "cross-site-refused", onDeny, problemMode);
   };
 }
 

package/lib/vendor/blamejs/lib/middleware/host-allowlist.js

@@ -41,6 +41,7 @@
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 
 var HostAllowlistError = defineClass("HostAllowlistError", { alwaysPermanent: true });
@@ -102,6 +103,8 @@ function _matches(entry, actual) {
  *     denyStatus: number,     // default 421
  *     denyBody:   string,
  *     audit:      boolean,    // default true
+ *     onDeny:     function(req, res, info): void,  // own the refusal; info = { status, reason, host }
+ *     problemDetails: boolean, // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
  *
  * @example
@@ -114,7 +117,7 @@ function _matches(entry, actual) {
 function create(opts) {
   validateOpts.requireObject(opts, "middleware.hostAllowlist", HostAllowlistError);
   validateOpts(opts, [
-    "hosts", "denyStatus", "denyBody", "audit",
+    "hosts", "denyStatus", "denyBody", "audit", "onDeny", "problemDetails",
   ], "middleware.hostAllowlist");
 
   if (!Array.isArray(opts.hosts) || opts.hosts.length === 0) {
@@ -134,6 +137,8 @@ function create(opts) {
   var denyStatus = (typeof opts.denyStatus === "number") ? opts.denyStatus : 421;  // HTTP 421 status
   var denyBody = typeof opts.denyBody === "string" ? opts.denyBody : "Misdirected Request";
   var auditOn = opts.audit !== false;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
 
   return function hostAllowlistMiddleware(req, res, next) {
     var raw = req.headers && req.headers.host;
@@ -141,7 +146,7 @@ function create(opts) {
       // RFC 7230 §5.4 — a request without a Host header is malformed
       // for HTTP/1.1; HTTP/2 maps :authority into req.headers.host
       // automatically. Reject either shape.
-      _deny(res, denyStatus, denyBody);
+      _deny(req, res, "missing-host", null);
       _emitDenied(req, "missing-host");
       return;
     }
@@ -151,20 +156,26 @@ function create(opts) {
       if (_matches(hosts[hi], actual)) { matched = true; break; }
     }
     if (!matched) {
-      _deny(res, denyStatus, denyBody);
+      _deny(req, res, "host-not-in-allowlist", actual);
       _emitDenied(req, "host-not-in-allowlist", actual);
       return;
     }
     return next();
   };
 
-  function _deny(res, status, body) {
+  function _deny(req, res, reason, host) {
     if (res.headersSent) return;
-    res.writeHead(status, {
-      "Content-Type":   "text/plain; charset=utf-8",
-      "Content-Length": Buffer.byteLength(body),
+    denyResponse(req, res, {
+      onDeny:        onDeny,
+      problem:       problemMode,
+      status:        denyStatus,
+      info:          { status: denyStatus, reason: reason, host: host },
+      problemCode:   "misdirected-request",
+      problemTitle:  "Misdirected Request",
+      problemDetail: "The request Host header is not served by this endpoint.",
+      contentType:   "text/plain; charset=utf-8",
+      body:          denyBody,
     });
-    res.end(body);
   }
 
   function _emitDenied(req, reason, actual) {

package/lib/vendor/blamejs/lib/middleware/index.js

@@ -53,6 +53,7 @@ var requireAal = require("./require-aal");
 var requireAuth = require("./require-auth");
 var requireContentType = require("./require-content-type");
 var ageGate = require("./age-gate");
+var requireBoundKey = require("./require-bound-key");
 var requireMethods = require("./require-methods");
 var requireMtls = require("./require-mtls");
 var requireStepUp = require("./require-step-up");
@@ -85,6 +86,7 @@ module.exports = {
   requireAuth:      requireAuth.create,
   requireContentType: requireContentType.create,
   ageGate:          ageGate.create,
+  requireBoundKey:  requireBoundKey.create,
   requireMethods:   requireMethods.create,
   requireMtls:      requireMtls.create,
   requireStepUp:    requireStepUp.create,
@@ -145,6 +147,7 @@ module.exports = {
     requireAuth:      requireAuth,
     requireContentType: requireContentType,
     ageGate:          ageGate,
+    requireBoundKey:  requireBoundKey,
     requireMethods:   requireMethods,
     requireMtls:      requireMtls,
     requireStepUp:    requireStepUp,

package/lib/vendor/blamejs/lib/middleware/network-allowlist.js

@@ -48,6 +48,7 @@ var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var ssrfGuard = require("../ssrf-guard");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 
 var audit = lazyRequire(function () { return require("../audit"); });
@@ -98,6 +99,8 @@ function _validateCidr(cidr) {
  *     denyStatus:   number,     // default 404
  *     denyBody:     string,     // default "Not Found"
  *     audit:        object,
+ *     onDeny:       function(req, res, info): void,  // own the refusal; info = { status, reason, clientIp, route }
+ *     problemDetails: boolean,  // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
  *
  * @example
@@ -113,7 +116,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "paths", "allowedCidrs", "deniedCidrs", "trustProxy",
-    "denyStatus", "denyBody", "audit",
+    "denyStatus", "denyBody", "audit", "onDeny", "problemDetails",
   ], "middleware.networkAllowlist");
 
   if (!Array.isArray(opts.paths) || opts.paths.length === 0) {
@@ -156,6 +159,23 @@ function create(opts) {
   var denyBody     = typeof opts.denyBody === "string" ? opts.denyBody : "Not Found";
   var auditOn      = opts.audit !== false && opts.audit != null;
   var auditInstance = opts.audit === true ? null : opts.audit;  // null → use lazy-required default
+  var onDeny       = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode  = opts.problemDetails === true;
+
+  function _deny(req, res, ip, route) {
+    _emitDeny(req, ip, route);
+    denyResponse(req, res, {
+      onDeny:        onDeny,
+      problem:       problemMode,
+      status:        denyStatus,
+      info:          { status: denyStatus, reason: "ip-not-in-allowlist", clientIp: ip, route: route },
+      problemCode:   "network-gate-denied",
+      problemTitle:  denyBody,
+      problemDetail: "Access to this resource is restricted by network policy.",
+      contentType:   "text/plain",
+      body:          denyBody,
+    });
+  }
 
   function _emitDeny(req, ip, route) {
     if (!auditOn) return;
@@ -196,9 +216,7 @@ function create(opts) {
     if (!ip) {
       // Fail closed: a request we can't even derive an IP for shouldn't
       // bypass the gate.
-      _emitDeny(req, "<unknown>", pathname);
-      res.writeHead(denyStatus, { "Content-Type": "text/plain" });
-      res.end(denyBody);
+      _deny(req, res, "<unknown>", pathname);
       return;
     }
 
@@ -208,9 +226,7 @@ function create(opts) {
     for (var dii = 0; dii < deniedCidrs.length; dii++) {
       try {
         if (ssrfGuard.cidrContains(deniedCidrs[dii], ip)) {
-          _emitDeny(req, ip, pathname);
-          res.writeHead(denyStatus, { "Content-Type": "text/plain" });
-          res.end(denyBody);
+          _deny(req, res, ip, pathname);
           return;
         }
       } catch (_e) { /* skip malformed at runtime — caught at config */ }
@@ -222,9 +238,7 @@ function create(opts) {
       } catch (_e) { /* skip malformed at runtime — caught at config */ }
     }
     if (!allowed) {
-      _emitDeny(req, ip, pathname);
-      res.writeHead(denyStatus, { "Content-Type": "text/plain" });
-      res.end(denyBody);
+      _deny(req, res, ip, pathname);
       return;
     }
     return next();

package/lib/vendor/blamejs/lib/middleware/rate-limit.js

@@ -62,6 +62,7 @@ var requestHelpers = require("../request-helpers");
 var safeAsync = require("../safe-async");
 var validateOpts = require("../validate-opts");
 var clusterStorage = require("../cluster-storage");
+var denyResponse = require("./deny-response").denyResponse;
 
 var audit  = lazyRequire(function () { return require("../audit"); });
 var logger = lazyRequire(function () { return require("../log").boot("rate-limit"); });
@@ -363,6 +364,8 @@ function _resolveBackend(opts) {
  *     keyFn:           function(req): string,
  *     statusOnLimit:   number,           // default 429
  *     bodyOnLimit:     string,           // default "Too Many Requests"
+ *     onDeny:          function(req, res, info): void,  // own the refusal response; info = { status, reason, limit, remaining, retryAfter, key }
+ *     problemDetails:  boolean,          // default false — emit RFC 9457 application/problem+json instead of text/plain
  *     header:          boolean,          // default true
  *     headerPrefix:    string,           // default "X-RateLimit-" — builds <prefix>Limit / <prefix>Remaining (e.g. "RateLimit-" for the IETF draft names)
  *     skipPaths:       Array<string|RegExp>,
@@ -391,7 +394,8 @@ function _resolveBackend(opts) {
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
-    "keyFn", "statusOnLimit", "bodyOnLimit", "header", "headerPrefix", "skipPaths", "scope",
+    "keyFn", "statusOnLimit", "bodyOnLimit", "onDeny", "problemDetails",
+    "header", "headerPrefix", "skipPaths", "scope",
     "backend", "trustProxy", "algorithm",
     // memory backend (token-bucket)
     "burst", "refillPerSecond",
@@ -404,6 +408,8 @@ function create(opts) {
   var keyFn = opts.keyFn || _clientIp;
   var statusOnLimit = opts.statusOnLimit || 429;
   var bodyOnLimit = opts.bodyOnLimit !== undefined ? opts.bodyOnLimit : "Too Many Requests";
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
   var emitHeaders = opts.header !== false;
   // headerPrefix (default "X-RateLimit-") builds the limit/remaining header
   // names as <prefix>Limit / <prefix>Remaining. The X-RateLimit-* family is a
@@ -455,10 +461,21 @@ function create(opts) {
         requestId: req.requestId,
       });
     } catch (_e) { /* audit best-effort */ }
-    if (typeof res.writeHead === "function") {
-      res.writeHead(statusOnLimit, { "Content-Type": "text/plain" });
-      res.end(bodyOnLimit);
-    }
+    var retryAfter = verdict.retryAfter > 0 ? verdict.retryAfter : null;
+    denyResponse(req, res, {
+      onDeny:        onDeny,
+      problem:       problemMode,
+      status:        statusOnLimit,
+      info:          { status: statusOnLimit, reason: "rate-limit-exceeded",
+        limit: verdict.limit, remaining: verdict.remaining,
+        retryAfter: verdict.retryAfter, key: k },
+      problemCode:   "rate-limit-exceeded",
+      problemTitle:  "Too Many Requests",
+      problemDetail: "Request rate limit exceeded; retry after the indicated interval.",
+      problemExt:    retryAfter !== null ? { retryAfter: retryAfter } : null,
+      contentType:   "text/plain",
+      body:          bodyOnLimit,
+    });
   }
 
   var middleware = function rateLimit(req, res, next) {

package/lib/vendor/blamejs/lib/middleware/require-aal.js

@@ -21,12 +21,13 @@
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 var { AuthError } = require("../framework-error");
 
 var aal = lazyRequire(function () { return require("../auth/aal"); });
 var audit = lazyRequire(function () { return require("../audit"); });
 
-function _writeUnauthorized(res, requiredBand, actualBand, realm) {
+function _writeUnauthorized(req, res, requiredBand, actualBand, realm, onDeny, problemMode) {
   if (res.headersSent) return;
   var body = JSON.stringify({
     error:             "step_up_required",
@@ -36,14 +37,24 @@ function _writeUnauthorized(res, requiredBand, actualBand, realm) {
   });
   var realmStr = realm ? ' realm="' + realm + '"' : "";
   var challenge = "AAL-StepUp" + realmStr + ', required="' + requiredBand + '"';
-  res.writeHead(401, {                                                             // HTTP 401 status
-    "Content-Type":     "application/json; charset=utf-8",
-    "Content-Length":   Buffer.byteLength(body),
-    "WWW-Authenticate": challenge,
-    // RFC 9111 §5.2.2.5 — auth-gated 401 must not be cached.
-    "Cache-Control":    "no-store",
+  denyResponse(req, res, {
+    onDeny:        onDeny,
+    problem:       problemMode,
+    status:        401,                                                            // HTTP 401 status
+    info:          { status: 401, reason: "step_up_required",
+      required_aal: requiredBand, actual_aal: actualBand || null },
+    problemCode:   "step-up-required",
+    problemTitle:  "Step-Up Authentication Required",
+    problemDetail: "AAL " + requiredBand + " is required for this resource.",
+    problemExt:    { required_aal: requiredBand, actual_aal: actualBand || null },
+    headers:       {
+      "WWW-Authenticate": challenge,
+      // RFC 9111 §5.2.2.5 — auth-gated 401 must not be cached.
+      "Cache-Control":    "no-store",
+    },
+    contentType:   "application/json; charset=utf-8",
+    body:          body,
   });
-  res.end(body);
 }
 
 /**
@@ -68,6 +79,8 @@ function _writeUnauthorized(res, requiredBand, actualBand, realm) {
  *     getAal:  function(req): string,
  *     realm:   string,
  *     audit:   boolean,                // default true
+ *     onDeny:  function(req, res, info): void,  // own the 401; info = { status, reason, required_aal, actual_aal }
+ *     problemDetails: boolean,         // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
  *
  * @example
@@ -78,7 +91,7 @@ function _writeUnauthorized(res, requiredBand, actualBand, realm) {
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
-    "minimum", "getAal", "audit", "realm",
+    "minimum", "getAal", "audit", "realm", "onDeny", "problemDetails",
   ], "middleware.requireAal");
 
   var minimum = opts.minimum;
@@ -92,6 +105,8 @@ function create(opts) {
 
   var auditOn = opts.audit !== false;
   var realm = (typeof opts.realm === "string" && opts.realm.length > 0) ? opts.realm : null;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
 
   return function requireAalMiddleware(req, res, next) {
     var actual = null;
@@ -116,7 +131,7 @@ function create(opts) {
           });
         } catch (_ignored) { /* drop-silent */ }
       }
-      return _writeUnauthorized(res, minimum, actual, realm);
+      return _writeUnauthorized(req, res, minimum, actual, realm, onDeny, problemMode);
     }
 
     if (auditOn) {

package/lib/vendor/blamejs/lib/middleware/require-auth.js

@@ -39,6 +39,7 @@
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 var audit = lazyRequire(function () { return require("../audit"); });
 
 function _defaultPrefersJson(req) {
@@ -72,6 +73,8 @@ function _defaultPrefersJson(req) {
  *     prefersJson:  function(req): boolean,
  *     errorMessage: string,                            // default "Authentication required."
  *     audit:        boolean,                           // default true
+ *     onDeny:       function(req, res, info): void,    // own any refusal shape; info = { status, reason, redirectTo }
+ *     problemDetails: boolean,                         // default false — emit RFC 9457 application/problem+json for the 401 (redirect path unaffected)
  *   }
  *
  * @example
@@ -83,7 +86,7 @@ function _defaultPrefersJson(req) {
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
-    "redirectTo", "prefersJson", "errorMessage", "audit",
+    "redirectTo", "prefersJson", "errorMessage", "audit", "onDeny", "problemDetails",
   ], "middleware.requireAuth");
   var redirectTo  = opts.redirectTo  || null;
   var prefersJson = typeof opts.prefersJson === "function"
@@ -91,6 +94,8 @@ function create(opts) {
     : _defaultPrefersJson;
   var msg     = opts.errorMessage || "Authentication required.";
   var auditOn = opts.audit !== false;
+  var onDeny  = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
 
   return function requireAuth(req, res, next) {
     if (req.user) return next();
@@ -107,6 +112,18 @@ function create(opts) {
       } catch (_e) { /* audit best-effort */ }
     }
 
+    // Operator hook owns ANY refusal shape (json / redirect / text)
+    // before the default content-negotiation runs.
+    if (onDeny) {
+      try {
+        var returned = onDeny(req, res, { status: 401, reason: "no-authenticated-user", redirectTo: redirectTo });
+        if (res.writableEnded) return returned;
+      } catch (_e) {
+        if (res.writableEnded) return;
+        // fall through to default
+      }
+    }
+
     // RFC 9111 §5.2.2.5 — auth-gated paths SHOULD emit
     // Cache-Control: no-store so a shared cache (or browser
     // back-button cache) can't replay a 401 / redirect / payload
@@ -115,27 +132,26 @@ function create(opts) {
     // cache directive, leaving the operator to set it themselves;
     // forgetting it under a CDN that respects Cache-Control was
     // a routine misconfiguration.
-    if (prefersJson(req)) {
-      if (typeof res.writeHead === "function") {
-        res.writeHead(requestHelpers.HTTP_STATUS.UNAUTHORIZED,
-          { "Content-Type": "application/json", "Cache-Control": "no-store" });
-        res.end(JSON.stringify({ error: msg }));
-      }
-      return;
-    }
-    if (redirectTo) {
-      if (typeof res.writeHead === "function") {
+    var wantsJson = prefersJson(req);
+    if (!wantsJson && redirectTo) {
+      if (!res.writableEnded && typeof res.writeHead === "function") {
         // 302 Found — RFC 7231 §6.4.3. Not in HTTP_STATUS table.
         res.writeHead(302, { "Location": redirectTo, "Cache-Control": "no-store" });
         res.end();
       }
       return;
     }
-    if (typeof res.writeHead === "function") {
-      res.writeHead(requestHelpers.HTTP_STATUS.UNAUTHORIZED,
-        { "Content-Type": "text/plain", "Cache-Control": "no-store" });
-      res.end(msg);
-    }
+    denyResponse(req, res, {
+      problem:       problemMode,
+      status:        requestHelpers.HTTP_STATUS.UNAUTHORIZED,
+      info:          { status: 401, reason: "no-authenticated-user" },
+      problemCode:   "authentication-required",
+      problemTitle:  "Unauthorized",
+      problemDetail: msg,
+      headers:       { "Cache-Control": "no-store" },
+      contentType:   wantsJson ? "application/json" : "text/plain",
+      body:          wantsJson ? JSON.stringify({ error: msg }) : msg,
+    });
   };
 }