@blamejs/core 0.4.1

package/lib/middleware/index.js

@@ -0,0 +1,52 @@
+"use strict";
+/**
+ * HTTP middleware — request-lifecycle hardening primitives.
+ *
+ * Exposed as b.middleware.{requestId, securityHeaders, errorHandler,
+ * botGuard, cors, rateLimit}. Each export is a `create(opts)` factory
+ * that returns a 3-arg `(req, res, next)` middleware function compatible
+ * with the framework's Router.
+ *
+ * Recommended mount order:
+ *   1. requestId        — every later middleware should be able to log requestId
+ *   2. securityHeaders  — set headers before any response could be partially sent
+ *   3. cors             — handle preflights before deeper logic
+ *   4. botGuard         — cheap rejection of obviously-bot traffic
+ *   5. rateLimit        — slow down anything still here
+ *   6. (your auth + business middleware + routes)
+ *   7. errorHandler     — must be LAST so it catches everything that throws
+ */
+module.exports = {
+  requestId:       require("./request-id").create,
+  securityHeaders: require("./security-headers").create,
+  errorHandler:    require("./error-handler").create,
+  botGuard:        require("./bot-guard").create,
+  cors:            require("./cors").create,
+  rateLimit:       require("./rate-limit").create,
+  attachUser:      require("./attach-user").create,
+  requireAuth:     require("./require-auth").create,
+  csrfProtect:     require("./csrf-protect").create,
+  bodyParser:      require("./body-parser").create,
+  health:          require("./health").create,
+  compression:     require("./compression").create,
+  cspNonce:        require("./csp-nonce").create,
+  apiEncrypt:      require("./api-encrypt"),
+
+  // Module exports for advanced use (constants, raw factory access)
+  _modules: {
+    requestId:       require("./request-id"),
+    securityHeaders: require("./security-headers"),
+    errorHandler:    require("./error-handler"),
+    botGuard:        require("./bot-guard"),
+    cors:            require("./cors"),
+    rateLimit:       require("./rate-limit"),
+    attachUser:      require("./attach-user"),
+    requireAuth:     require("./require-auth"),
+    csrfProtect:     require("./csrf-protect"),
+    bodyParser:      require("./body-parser"),
+    health:          require("./health"),
+    compression:     require("./compression"),
+    cspNonce:        require("./csp-nonce"),
+    apiEncrypt:      require("./api-encrypt"),
+  },
+};

package/lib/middleware/rate-limit.js

@@ -0,0 +1,319 @@
+"use strict";
+/**
+ * Rate-limit middleware — pluggable backend, default in-memory.
+ *
+ * Per-IP by default; key extractor is configurable (per-user, per-API-key,
+ * per-route). Two built-in backends:
+ *
+ *   - 'memory' (default) — token-bucket, in-process. Each key gets
+ *     `burst` tokens up front; tokens refill at `refillPerSecond`;
+ *     each request costs 1 token. Single-process accuracy only.
+ *
+ *   - 'cluster' — fixed-window counter shared across the cluster
+ *     via `_blamejs_rate_limit_counters`. Atomic INSERT...ON CONFLICT
+ *     increments per key within a window and rolls over when the
+ *     window advances. Multi-process / multi-node accurate.
+ *
+ *     Cluster opt-in switches the algorithm shape from token-bucket
+ *     to fixed-window because that's what models cleanly in SQL —
+ *     the operator-facing config keys change accordingly.
+ *
+ * Operators can also pass a custom `{ take, reset }` object as the
+ * backend for Redis / Memcached / etc.
+ *
+ * Options:
+ *   {
+ *     keyFn:           (req) → 'rate-key'    (default: client IP)
+ *     statusOnLimit:   429
+ *     bodyOnLimit:     'Too Many Requests'
+ *     header:          true                    // set X-RateLimit-* response headers
+ *     skipPaths:       []                      // string-prefix or regex matchers
+ *     scope:           'global' | 'per-route'  (default 'global')
+ *     backend:         'memory' (default) | 'cluster' | { take, reset, gc? }
+ *
+ *     // Memory-backend tuning (token bucket):
+ *     burst:           60                       // initial token bucket size
+ *     refillPerSecond: 10                       // sustained throughput
+ *
+ *     // Cluster-backend tuning (fixed window):
+ *     limit:           60                       // max requests per window
+ *     windowMs:        C.TIME.minutes(1)        // window duration
+ *     pruneIntervalMs: C.TIME.minutes(5)        // how often the leader prunes expired rows
+ *   }
+ *
+ * Audit: every limit hit emits system.ratelimit.block with the key + path.
+ */
+var C = require("../constants");
+var lazyRequire = require("../lazy-require");
+var validateOpts = require("../validate-opts");
+var clusterStorage = require("../cluster-storage");
+
+var audit  = lazyRequire(function () { return require("../audit"); });
+var logger = lazyRequire(function () { return require("../log").boot("rate-limit"); });
+
+function _clientIp(req) {
+  var fwd = req.headers && req.headers["x-forwarded-for"];
+  if (fwd) return String(fwd).split(",")[0].trim();
+  return (req.socket && req.socket.remoteAddress) || "unknown";
+}
+
+// ---- Memory backend (token bucket) ----
+
+function _memoryBackend(opts) {
+  var burst = opts.burst || 60;
+  var refillPerSecond = opts.refillPerSecond || 10;
+  var buckets = new Map();
+
+  // Periodic GC of stale buckets so the map doesn't grow unbounded.
+  var gcInterval = setInterval(function () {
+    var cutoff = Date.now() - C.TIME.hours(1);
+    for (var k of buckets.keys()) {
+      if (buckets.get(k).lastRefillAt < cutoff) buckets.delete(k);
+    }
+  }, C.TIME.minutes(5));
+  if (typeof gcInterval.unref === "function") gcInterval.unref();
+
+  // Memory backend returns verdicts SYNCHRONOUSLY — no awaitable.
+  // The middleware checks `.then` to decide whether to chain. Keeping
+  // the hot path synchronous means single-process apps pay no
+  // microtask cost per request.
+  function take(key, _cost) {
+    var now = Date.now();
+    var b = buckets.get(key);
+    if (!b) {
+      b = { tokens: burst, lastRefillAt: now };
+      buckets.set(key, b);
+    } else {
+      var elapsed = (now - b.lastRefillAt) / 1000;
+      b.tokens = Math.min(burst, b.tokens + elapsed * refillPerSecond);
+      b.lastRefillAt = now;
+    }
+    if (b.tokens >= 1) {
+      b.tokens -= 1;
+      return {
+        allowed:    true,
+        limit:      burst,
+        remaining:  Math.floor(b.tokens),
+        retryAfter: 0,
+      };
+    }
+    var deficit = 1 - b.tokens;
+    var waitMs = Math.ceil((deficit / refillPerSecond) * 1000);
+    return {
+      allowed:    false,
+      limit:      burst,
+      remaining:  0,
+      retryAfter: Math.ceil(waitMs / 1000),
+    };
+  }
+
+  function reset(key) {
+    buckets.delete(key);
+  }
+
+  function close() {
+    try { clearInterval(gcInterval); } catch (_e) {}
+    buckets.clear();
+  }
+
+  return { take: take, reset: reset, close: close };
+}
+
+// ---- Cluster backend (fixed-window counter, SQL-backed) ----
+
+function _clusterBackend(opts) {
+  var limit    = opts.limit    || 60;
+  var windowMs = opts.windowMs || C.TIME.minutes(1);
+  var pruneIntervalMs = opts.pruneIntervalMs || C.TIME.minutes(5);
+  var lastPruneAt = 0;
+
+  // Best-effort prune of expired window rows. Rate-limited at the
+  // call site so we don't hammer the DB on every request.
+  function _maybePrune() {
+    var now = Date.now();
+    if (now - lastPruneAt < pruneIntervalMs) return;
+    lastPruneAt = now;
+    var cutoff = now - windowMs;
+    clusterStorage.execute(
+      "DELETE FROM _blamejs_rate_limit_counters WHERE windowStart < ?",
+      [cutoff]
+    ).catch(function (e) {
+      try {
+        logger().warn("rate-limit prune failed: " + ((e && e.message) || String(e)));
+      } catch (_e) { /* logger best-effort */ }
+    });
+  }
+
+  async function take(key, _cost) {
+    var now = Date.now();
+    var windowStart = Math.floor(now / windowMs) * windowMs;
+
+    // Atomic increment: a fresh window resets count to 1; an existing
+    // row in the same window gets count + 1. Postgres + SQLite both
+    // support ON CONFLICT...DO UPDATE...RETURNING.
+    var result = await clusterStorage.execute(
+      "INSERT INTO _blamejs_rate_limit_counters (key, windowStart, count) " +
+      "VALUES (?, ?, 1) " +
+      "ON CONFLICT (key) DO UPDATE SET " +
+      "  count = CASE " +
+      "    WHEN excluded.windowStart > _blamejs_rate_limit_counters.windowStart " +
+      "    THEN 1 " +
+      "    ELSE _blamejs_rate_limit_counters.count + 1 " +
+      "  END, " +
+      "  windowStart = CASE " +
+      "    WHEN excluded.windowStart > _blamejs_rate_limit_counters.windowStart " +
+      "    THEN excluded.windowStart " +
+      "    ELSE _blamejs_rate_limit_counters.windowStart " +
+      "  END " +
+      "RETURNING count, windowStart",
+      [key, windowStart]
+    );
+    var row = result.rows && result.rows[0];
+    var count = row ? row.count : 1;
+    var rowWindow = row ? row.windowStart : windowStart;
+
+    _maybePrune();
+
+    if (count <= limit) {
+      return {
+        allowed:    true,
+        limit:      limit,
+        remaining:  Math.max(0, limit - count),
+        retryAfter: 0,
+      };
+    }
+    var retryMs = (rowWindow + windowMs) - now;
+    return {
+      allowed:    false,
+      limit:      limit,
+      remaining:  0,
+      retryAfter: Math.max(1, Math.ceil(retryMs / 1000)),
+    };
+  }
+
+  async function reset(key) {
+    await clusterStorage.execute(
+      "DELETE FROM _blamejs_rate_limit_counters WHERE key = ?",
+      [key]
+    );
+  }
+
+  function close() { /* no resources to release */ }
+
+  return { take: take, reset: reset, close: close };
+}
+
+// ---- Backend resolution ----
+
+function _resolveBackend(opts) {
+  var requested = opts.backend;
+  if (requested && typeof requested === "object" && typeof requested.take === "function") {
+    return requested;  // operator-supplied custom backend
+  }
+  if (requested === "cluster") return _clusterBackend(opts);
+  if (!requested || requested === "memory") return _memoryBackend(opts);
+  throw new Error("rate-limit: unknown backend '" + requested +
+                  "' (must be 'memory', 'cluster', or { take, reset })");
+}
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "keyFn", "statusOnLimit", "bodyOnLimit", "header", "skipPaths", "scope",
+    "backend",
+    // memory backend
+    "burst", "refillPerSecond",
+    // cluster backend
+    "limit", "windowMs", "pruneIntervalMs",
+  ], "middleware.rateLimit");
+  var keyFn = opts.keyFn || _clientIp;
+  var statusOnLimit = opts.statusOnLimit || 429;
+  var bodyOnLimit = opts.bodyOnLimit !== undefined ? opts.bodyOnLimit : "Too Many Requests";
+  var emitHeaders = opts.header !== false;
+  var skipPaths = opts.skipPaths || [];
+  var scope = opts.scope || "global";
+
+  var backend = _resolveBackend(opts);
+
+  function _shouldSkip(req) {
+    var path = req.pathname || req.url || "/";
+    for (var i = 0; i < skipPaths.length; i++) {
+      if (typeof skipPaths[i] === "string" ? path.indexOf(skipPaths[i]) === 0 : skipPaths[i].test(path)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  function _writeBlocked(req, res, k, verdict) {
+    if (emitHeaders && typeof res.setHeader === "function") {
+      res.setHeader("X-RateLimit-Limit", String(verdict.limit));
+      res.setHeader("X-RateLimit-Remaining", String(verdict.remaining));
+      if (verdict.retryAfter > 0) res.setHeader("Retry-After", String(verdict.retryAfter));
+    }
+    try {
+      audit().emit({
+        actor:    { ip: _clientIp(req), userAgent: req.headers && req.headers["user-agent"] },
+        action:   "system.ratelimit.block",
+        outcome:  "denied",
+        reason:   "rate limit exceeded",
+        metadata: { key: k, method: req.method, path: req.pathname || req.url, retryAfter: verdict.retryAfter },
+        requestId: req.requestId,
+      });
+    } catch (_e) {}
+    if (typeof res.writeHead === "function") {
+      res.writeHead(statusOnLimit, { "Content-Type": "text/plain" });
+      res.end(bodyOnLimit);
+    }
+  }
+
+  var middleware = function rateLimit(req, res, next) {
+    if (_shouldSkip(req)) return next();
+    var k = keyFn(req);
+    if (scope === "per-route") k = (req.method || "GET") + ":" + (req.pathname || req.url || "/") + "|" + k;
+
+    function _handle(verdict) {
+      if (emitHeaders && typeof res.setHeader === "function") {
+        res.setHeader("X-RateLimit-Limit", String(verdict.limit));
+        res.setHeader("X-RateLimit-Remaining", String(verdict.remaining));
+      }
+      if (!verdict.allowed) return _writeBlocked(req, res, k, verdict);
+      next();
+    }
+    function _onErr(e) {
+      // Fail-open on backend errors. The framework's job is to throttle
+      // attackers, not to crash the request path. Surface the error to
+      // ops via boot logger; the next request retries.
+      try {
+        logger().error("rate-limit backend take() failed: " + ((e && e.message) || String(e)));
+      } catch (_e) { /* best-effort */ }
+      next();
+    }
+
+    // Memory backend returns sync; cluster / custom backends return a
+    // Promise. Detect via `.then` so the hot path stays synchronous.
+    var verdictOrPromise;
+    try {
+      verdictOrPromise = backend.take(k, 1);
+    } catch (e) { return _onErr(e); }
+
+    if (verdictOrPromise && typeof verdictOrPromise.then === "function") {
+      verdictOrPromise.then(_handle, _onErr);
+    } else {
+      _handle(verdictOrPromise);
+    }
+  };
+
+  // Expose a couple of operator hooks on the middleware function.
+  middleware.reset = function (key) { return backend.reset(key); };
+  middleware.close = function ()    { return backend.close && backend.close(); };
+
+  return middleware;
+}
+
+module.exports = {
+  create:           create,
+  // Backends exported for tests + advanced operator wiring.
+  _memoryBackend:   _memoryBackend,
+  _clusterBackend:  _clusterBackend,
+};

package/lib/middleware/request-id.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Request-ID middleware. Propagates an existing X-Request-Id header (or
+ * trace ID from upstream) when present and well-formed; otherwise
+ * generates a fresh 32-hex value. Sets req.requestId AND emits the same
+ * value as a response header so downstream services + auditors can
+ * correlate.
+ *
+ * Threading the request ID into audit.record() metadata is what makes
+ * the cross-event correlation traceable; apps should pass this through
+ * to every audit.record() they call within the request lifecycle.
+ *
+ * Options:
+ *   {
+ *     headerName:    'X-Request-Id'
+ *     trustUpstream: true         // propagate upstream id if it matches
+ *                                 //   the format check; false → always
+ *                                 //   generate fresh
+ *     formatRegex:   /^[A-Za-z0-9._-]{8,128}$/
+ *   }
+ */
+var { generateToken } = require("../crypto");
+var validateOpts = require("../validate-opts");
+
+var DEFAULT_FORMAT = /^[A-Za-z0-9._-]{8,128}$/;
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "headerName", "trustUpstream", "formatRegex",
+  ], "middleware.requestId");
+  var headerName = (opts.headerName || "X-Request-Id");
+  var headerNameLower = headerName.toLowerCase();
+  var trustUpstream = opts.trustUpstream !== false;
+  var format = opts.formatRegex || DEFAULT_FORMAT;
+
+  return function requestId(req, res, next) {
+    var inbound = req.headers && req.headers[headerNameLower];
+    var id;
+    if (trustUpstream && inbound && format.test(inbound)) {
+      id = inbound;
+    } else {
+      id = generateToken(16);  // 32 hex chars
+    }
+    req.requestId = id;
+    if (typeof res.setHeader === "function") {
+      res.setHeader(headerName, id);
+    }
+    next();
+  };
+}
+
+module.exports = { create: create };

package/lib/middleware/require-auth.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * require-auth middleware — gates routes that require an authenticated
+ * user. Mount AFTER attachUser; this middleware reads `req.user` and
+ * either lets the request through or rejects it.
+ *
+ * Rejection shape:
+ *   - JSON-preferring caller (Accept: application/json, or X-Requested-With:
+ *     XMLHttpRequest, or content-type starts application/json):
+ *     401 application/json with { error: "Authentication required." }
+ *   - Browser-preferring caller, when opts.redirectTo is set:
+ *     302 with Location header
+ *   - Otherwise:
+ *     401 text/plain
+ *
+ * Always emits `auth.required.denied` audit event on rejection (when
+ * opts.audit !== false). The event records request method + path +
+ * client IP — keys-only, no body content.
+ *
+ * Options:
+ *   {
+ *     redirectTo:    null         (optional URL for browser redirects;
+ *                                   when set, prefersJson()=false rejections
+ *                                   produce 302 instead of 401 text/plain)
+ *     prefersJson:   function     (optional override; defaults to checking
+ *                                   Accept / X-Requested-With / Content-Type)
+ *     errorMessage:  'Authentication required.'
+ *     audit:         true         (emit auth.required.denied on reject)
+ *   }
+ */
+var lazyRequire = require("../lazy-require");
+var validateOpts = require("../validate-opts");
+var audit = lazyRequire(function () { return require("../audit"); });
+
+function _defaultPrefersJson(req) {
+  var h = req.headers || {};
+  if (typeof h.accept === "string" && h.accept.indexOf("application/json") !== -1) return true;
+  if (h["x-requested-with"] === "XMLHttpRequest") return true;
+  if (typeof h["content-type"] === "string" &&
+      h["content-type"].indexOf("application/json") === 0) return true;
+  return false;
+}
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "redirectTo", "prefersJson", "errorMessage", "audit",
+  ], "middleware.requireAuth");
+  var redirectTo  = opts.redirectTo  || null;
+  var prefersJson = typeof opts.prefersJson === "function"
+    ? opts.prefersJson
+    : _defaultPrefersJson;
+  var msg     = opts.errorMessage || "Authentication required.";
+  var auditOn = opts.audit !== false;
+
+  return function requireAuth(req, res, next) {
+    if (req.user) return next();
+
+    if (auditOn) {
+      try {
+        audit().emit({
+          action:   "auth.required.denied",
+          outcome:  "denied",
+          actor:    { ip: req.socket && req.socket.remoteAddress, userAgent: req.headers && req.headers["user-agent"] },
+          reason:   "no authenticated user on request",
+          metadata: { method: req.method, path: req.pathname || (req.url || "").split("?")[0] },
+        });
+      } catch (_e) { /* audit best-effort */ }
+    }
+
+    if (prefersJson(req)) {
+      if (typeof res.writeHead === "function") {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: msg }));
+      }
+      return;
+    }
+    if (redirectTo) {
+      if (typeof res.writeHead === "function") {
+        res.writeHead(302, { "Location": redirectTo });
+        res.end();
+      }
+      return;
+    }
+    if (typeof res.writeHead === "function") {
+      res.writeHead(401, { "Content-Type": "text/plain" });
+      res.end(msg);
+    }
+  };
+}
+
+module.exports = {
+  create:               create,
+  _defaultPrefersJson:  _defaultPrefersJson,
+};

package/lib/middleware/security-headers.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Security headers middleware. Sets the headers every modern app should
+ * send, regardless of content. Deliberately strict by default — operators
+ * who need to soften a header opt in explicitly per option.
+ *
+ *   Strict-Transport-Security        — force HTTPS (HSTS); 2-year max-age + includeSubDomains + preload
+ *   X-Content-Type-Options: nosniff  — block MIME sniffing
+ *   X-Frame-Options: DENY            — prevent clickjacking via iframes
+ *   Referrer-Policy: no-referrer     — don't leak full URL to outbound links
+ *   Permissions-Policy               — disable common-attack APIs (camera, geolocation, payment, etc.)
+ *   Cross-Origin-Opener-Policy: same-origin
+ *   Cross-Origin-Embedder-Policy: require-corp   (off by default — breaks images from CDNs)
+ *   Cross-Origin-Resource-Policy: same-origin
+ *   Content-Security-Policy          — operator-supplied; framework provides a safe default that
+ *                                       only allows same-origin and prevents inline scripts
+ *
+ * These are the OWASP-aligned defaults. Apps that need different policies
+ * (e.g. allow-list for analytics scripts, embed iframes from a known
+ * partner) override per-option without losing the others.
+ *
+ * Options:
+ *   {
+ *     hsts:           '<value>' or false to disable
+ *     contentTypeOptions: 'nosniff' or false
+ *     frameOptions:   'DENY' | 'SAMEORIGIN' or false
+ *     referrerPolicy: '<value>' or false
+ *     permissionsPolicy: '<value>' or false
+ *     coop / coep / corp: '<value>' or false
+ *     csp:            '<full CSP string>' or false to disable
+ *   }
+ */
+
+var validateOpts = require("../validate-opts");
+
+var DEFAULT_PERMISSIONS = [
+  "accelerometer=()", "ambient-light-sensor=()", "autoplay=()",
+  "camera=()", "display-capture=()", "encrypted-media=()", "fullscreen=(self)",
+  "geolocation=()", "gyroscope=()", "magnetometer=()", "microphone=()",
+  "midi=()", "payment=()", "picture-in-picture=()", "publickey-credentials-get=()",
+  "screen-wake-lock=()", "sync-xhr=()", "usb=()", "web-share=()", "xr-spatial-tracking=()",
+];
+
+var DEFAULT_CSP =
+  "default-src 'self'; " +
+  "script-src 'self'; " +
+  "style-src 'self' 'unsafe-inline'; " +
+  "img-src 'self' data:; " +
+  "font-src 'self'; " +
+  "connect-src 'self'; " +
+  "frame-ancestors 'none'; " +
+  "base-uri 'self'; " +
+  "form-action 'self'; " +
+  "object-src 'none';";
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "hsts", "contentTypeOptions", "frameOptions", "referrerPolicy",
+    "permissionsPolicy", "coop", "coep", "corp", "csp",
+  ], "middleware.securityHeaders");
+  var hsts = opts.hsts === undefined ? "max-age=63072000; includeSubDomains; preload" : opts.hsts;
+  var ctOpts = opts.contentTypeOptions === undefined ? "nosniff" : opts.contentTypeOptions;
+  var frameOpts = opts.frameOptions === undefined ? "DENY" : opts.frameOptions;
+  var refPolicy = opts.referrerPolicy === undefined ? "no-referrer" : opts.referrerPolicy;
+  var permPolicy = opts.permissionsPolicy === undefined ? DEFAULT_PERMISSIONS.join(", ") : opts.permissionsPolicy;
+  var coop  = opts.coop === undefined ? "same-origin" : opts.coop;
+  var coep  = opts.coep === undefined ? false : opts.coep;
+  var corp  = opts.corp === undefined ? "same-origin" : opts.corp;
+  var csp   = opts.csp === undefined ? DEFAULT_CSP : opts.csp;
+
+  return function securityHeaders(req, res, next) {
+    if (typeof res.setHeader !== "function") return next();
+    if (hsts)       res.setHeader("Strict-Transport-Security", hsts);
+    if (ctOpts)     res.setHeader("X-Content-Type-Options", ctOpts);
+    if (frameOpts)  res.setHeader("X-Frame-Options", frameOpts);
+    if (refPolicy)  res.setHeader("Referrer-Policy", refPolicy);
+    if (permPolicy) res.setHeader("Permissions-Policy", permPolicy);
+    if (coop)       res.setHeader("Cross-Origin-Opener-Policy", coop);
+    if (coep)       res.setHeader("Cross-Origin-Embedder-Policy", coep);
+    if (corp)       res.setHeader("Cross-Origin-Resource-Policy", corp);
+    if (csp)        res.setHeader("Content-Security-Policy", csp);
+    next();
+  };
+}
+
+module.exports = {
+  create:               create,
+  DEFAULT_PERMISSIONS:  DEFAULT_PERMISSIONS,
+  DEFAULT_CSP:          DEFAULT_CSP,
+};