@burdenoff/be-sdk 2026.510.79

package/configs/tsconfig/tsconfig.json

@@ -0,0 +1,53 @@
+{
+  "compileOnSave": true,
+  "compilerOptions": {
+    /* Language and Environment */
+    "target": "ES2022",
+    "lib": ["ES2022"],
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
+    "useUnknownInCatchVariables": true,
+
+    /* Modules */
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "allowJs": true,
+
+    /* Emit */
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "removeComments": true,
+    "composite": true,
+    "noEmitOnError": false,
+
+    /* Interop Constraints */
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "forceConsistentCasingInFileNames": true,
+
+    /* Type Checking - Strict Mode */
+    "strict": true,
+    "alwaysStrict": true,
+    "noImplicitAny": true,
+    "strictFunctionTypes": true,
+
+    /* Type Checking - Enhanced */
+    "noUncheckedIndexedAccess": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "noImplicitOverride": true,
+    // noUnusedLocals disabled - ESLint handles this with proper ignores for generated files
+    // TypeScript doesn't support per-file overrides, so we use ESLint for unused var checking
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+
+    /* Performance Optimizations */
+    "skipLibCheck": true,
+    "skipDefaultLibCheck": true,
+
+    /* Constants */
+    "preserveConstEnums": true
+  }
+}

package/dist/EventQueueFactory-6NMSGECR.js

@@ -0,0 +1,8 @@
+export { EventQueueFactory } from './chunk-3O2RQOPV.js';
+import './chunk-L7ZMN2FJ.js';
+import './chunk-OVSYMNCI.js';
+import './chunk-NGMEI42S.js';
+import './chunk-CBZNP6RF.js';
+import './chunk-XE4OXN2W.js';
+//# sourceMappingURL=EventQueueFactory-6NMSGECR.js.map
+//# sourceMappingURL=EventQueueFactory-6NMSGECR.js.map

package/dist/EventQueueFactory-6NMSGECR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"EventQueueFactory-6NMSGECR.js"}

package/dist/auth/index.d.ts

@@ -0,0 +1,66 @@
+import { B as BurdenoffGraphQLClient } from '../graphql-BAVrUgBF.js';
+import { S as SDKContext } from '../index-CHbVw5M7.js';
+import 'graphql-request';
+
+interface CookieOptions {
+    name: string;
+    value: string;
+    maxAge?: number;
+    domain?: string;
+    path?: string;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'Strict' | 'Lax' | 'None';
+}
+
+interface CookieContext {
+    responseHeaders?: Headers;
+    [key: string]: unknown;
+}
+declare const AuthCookieHelper: {
+    setAuthCookies(context: CookieContext, tokens: {
+        accessToken: string;
+        refreshToken: string;
+    }, options?: {
+        rememberMe?: boolean;
+    }): void;
+    clearAuthCookies(context: CookieContext): void;
+};
+interface TokenPayload {
+    jti: string;
+    sub: string;
+    user_id: string;
+    workspace_id?: string;
+    org_id?: string;
+    tenant_endpoint?: string;
+    iat: number;
+    exp: number;
+    scope?: string;
+}
+interface VerifyTokenResult {
+    valid: boolean;
+    payload?: TokenPayload;
+    error?: string;
+}
+interface RefreshTokenResult {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+
+declare class AuthModule {
+    private client;
+    private context;
+    constructor(client: BurdenoffGraphQLClient, context: SDKContext);
+    verifyToken(token: string): Promise<VerifyTokenResult>;
+    decodeToken(token: string): TokenPayload | null;
+    refreshToken(refreshToken: string): Promise<RefreshTokenResult>;
+    validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean>;
+    isTokenValid(token: string): boolean;
+    getUserIdFromToken(token: string): string | null;
+    getWorkspaceIdFromToken(token: string): string | null;
+    getTokenClaims(token: string): Record<string, unknown> | null;
+    willExpireSoon(token: string, withinSeconds?: number): boolean;
+}
+
+export { AuthCookieHelper, AuthModule, type CookieOptions, type RefreshTokenResult, type TokenPayload, type VerifyTokenResult };

package/dist/auth/index.js

@@ -0,0 +1,8 @@
+export { AuthCookieHelper, AuthModule } from '../chunk-SAK2JCA7.js';
+import '../chunk-MOCUBSTW.js';
+import '../chunk-SAG6ZYWQ.js';
+import '../chunk-NGMEI42S.js';
+import '../chunk-CBZNP6RF.js';
+import '../chunk-XE4OXN2W.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/cache/index.d.ts

@@ -0,0 +1,2 @@
+export { B as BaseCacheConfig, a as BatchCacheOptions, C as CacheConfig, b as CacheEntry, c as CacheFactory, d as CacheHealthCheckResult, e as CacheOptions, f as CacheProviderType, g as CacheProviderTypeLiteral, h as CacheStatistics, I as ICache, j as ICacheProvider, M as MemcachedCacheConfig, k as MemoryCacheConfig, l as MemoryCacheProvider, P as PatternOptions, m as PatternResult, V as ValkeyCacheConfig, n as ValkeyGlideClient, o as ValkeyGlideConfig, p as ValkeyGlideProvider, q as closeAllCaches, r as createCache, s as getCache, t as getValkeyClient } from '../index-BODgvRtL.js';
+import '../layer-DDip18KY.js';

package/dist/cache/index.js

@@ -0,0 +1,6 @@
+export { CacheFactory, CacheProviderType, MemoryCacheProvider, ValkeyGlideProvider, closeAllCaches, createCache, getCache, getValkeyClient } from '../chunk-4XGGWW36.js';
+import '../chunk-NGMEI42S.js';
+import '../chunk-CBZNP6RF.js';
+import '../chunk-XE4OXN2W.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/cache/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/captcha/index.d.ts

@@ -0,0 +1 @@
+export { R as RecaptchaVerifyOptions, a as RecaptchaVerifyResult, V as VerifyCaptchaInput, d as VerifyCaptchaResult, b as isCaptchaEnabled, v as verifyCaptcha, c as verifyCaptchaIfEnabled } from '../index-B70b5mYS.js';

package/dist/captcha/index.js

@@ -0,0 +1,4 @@
+export { isCaptchaEnabled, verifyCaptcha, verifyCaptchaIfEnabled } from '../chunk-YMZEUTD2.js';
+import '../chunk-XE4OXN2W.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/captcha/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/chunk-2HANKZZM.js

@@ -0,0 +1,245 @@
+import { logger } from './chunk-CBZNP6RF.js';
+import { __export, __name } from './chunk-XE4OXN2W.js';
+import crypto from 'crypto';
+import { Elysia } from 'elysia';
+
+// src/middleware/index.ts
+var middleware_exports = {};
+__export(middleware_exports, {
+  cleanupExpiredTokens: () => cleanupExpiredTokens,
+  createSecurityPlugin: () => createSecurityPlugin
+});
+var csrfTokens = /* @__PURE__ */ new Map();
+var MAX_CSRF_TOKENS = 1e5;
+var DEFAULT_CSRF_SKIP_ROUTES = [
+  "/graphql",
+  "/webhook/",
+  "/upload/",
+  "/oidc/",
+  "/interaction/"
+];
+var DEFAULT_LOGIN_ENDPOINTS = [
+  "/interaction/",
+  "/oidc/token",
+  "/api/auth/login"
+];
+function generateCSRFToken() {
+  return crypto.randomBytes(32).toString("hex");
+}
+__name(generateCSRFToken, "generateCSRFToken");
+function constantTimeCompare(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}
+__name(constantTimeCompare, "constantTimeCompare");
+function getSessionId(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) return null;
+  const cookies = cookieHeader.split(";").reduce((acc, cookie) => {
+    const [key, value] = cookie.trim().split("=");
+    if (key && value) {
+      acc[key] = value;
+    }
+    return acc;
+  }, {});
+  return cookies["_session"] || null;
+}
+__name(getSessionId, "getSessionId");
+function getCSRFTokenFromRequest(request, body) {
+  const headerToken = request.headers.get("x-csrf-token");
+  if (headerToken) {
+    return headerToken;
+  }
+  if (body && typeof body === "object") {
+    const bodyToken = body["_csrf"];
+    if (bodyToken && typeof bodyToken === "string") {
+      return bodyToken;
+    }
+  }
+  return null;
+}
+__name(getCSRFTokenFromRequest, "getCSRFTokenFromRequest");
+function pruneCSRFTokenStore(maxEntries = MAX_CSRF_TOKENS) {
+  cleanupExpiredTokens();
+  while (csrfTokens.size > maxEntries) {
+    const oldestEntry = csrfTokens.keys().next();
+    if (oldestEntry.done) {
+      break;
+    }
+    csrfTokens.delete(oldestEntry.value);
+  }
+}
+__name(pruneCSRFTokenStore, "pruneCSRFTokenStore");
+function shouldSkipCSRF(request, skipRoutes) {
+  const url = new URL(request.url);
+  const pathname = url.pathname;
+  if ([
+    "GET",
+    "HEAD",
+    "OPTIONS"
+  ].includes(request.method)) {
+    return true;
+  }
+  const shouldSkip = skipRoutes.some((route) => pathname.startsWith(route));
+  if (pathname.includes("/interaction/")) {
+    logger.debug("CSRF Debug:", {
+      url: pathname,
+      shouldSkip,
+      method: request.method
+    });
+  }
+  return shouldSkip;
+}
+__name(shouldSkipCSRF, "shouldSkipCSRF");
+function isLoginEndpoint(request, loginEndpoints) {
+  const url = new URL(request.url);
+  return loginEndpoints.some((path) => url.pathname.includes(path));
+}
+__name(isLoginEndpoint, "isLoginEndpoint");
+function buildSecurityHeaders(isProduction) {
+  const headers = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "X-XSS-Protection": "1; mode=block",
+    "Referrer-Policy": "strict-origin-when-cross-origin"
+  };
+  const cspDirectives = [
+    "default-src 'self'",
+    `script-src 'self' ${!isProduction ? "'unsafe-inline' 'unsafe-eval'" : ""} https://js.stripe.com https://checkout.razorpay.com https://unpkg.com`.trim(),
+    `style-src 'self' ${!isProduction ? "'unsafe-inline'" : ""} https://fonts.googleapis.com https://unpkg.com`.trim(),
+    "img-src 'self' data: https: blob: *.amazonaws.com *.algoshred.com",
+    // eslint-disable-next-line sonarjs/no-clear-text-protocols -- http://localhost:* is only used in development
+    `connect-src 'self' wss: https: ${!isProduction ? "http://localhost:*" : ""} https://*.algoshred.com https://api.stripe.com https://api.razorpay.com`.trim(),
+    "font-src 'self' https://fonts.gstatic.com",
+    "frame-src 'self' https://js.stripe.com https://hooks.stripe.com https://api.razorpay.com",
+    "frame-ancestors 'none'",
+    "base-uri 'self'",
+    "form-action 'self'"
+  ];
+  if (isProduction) {
+    cspDirectives.push("upgrade-insecure-requests");
+  }
+  headers["Content-Security-Policy"] = cspDirectives.join("; ");
+  return headers;
+}
+__name(buildSecurityHeaders, "buildSecurityHeaders");
+function createSecurityPlugin(config) {
+  const finalConfig = {
+    csrfSkipRoutes: config?.csrfSkipRoutes || DEFAULT_CSRF_SKIP_ROUTES,
+    loginEndpoints: config?.loginEndpoints || DEFAULT_LOGIN_ENDPOINTS,
+    cspDirectives: config?.cspDirectives || {},
+    enableCSRF: config?.enableCSRF ?? false,
+    enableSessionSecurity: config?.enableSessionSecurity ?? false,
+    csrfTokenExpiry: config?.csrfTokenExpiry || 60 * 60 * 1e3,
+    helmetConfig: config?.helmetConfig || {
+      }
+  };
+  const nodeEnv = process.env["NODE_ENV"];
+  const isProduction = nodeEnv === "production";
+  const securityHeaders = buildSecurityHeaders(isProduction);
+  return new Elysia({
+    name: "security"
+  }).onAfterHandle(({ set }) => {
+    for (const [key, value] of Object.entries(securityHeaders)) {
+      set.headers[key] = value;
+    }
+  }).get("/api/csrf-token", ({ request, set }) => {
+    const sessionId = getSessionId(request);
+    if (!sessionId) {
+      set.status = 401;
+      return {
+        error: "No session found"
+      };
+    }
+    const csrfToken = generateCSRFToken();
+    const expires = Date.now() + finalConfig.csrfTokenExpiry;
+    if (!csrfTokens.has(sessionId)) {
+      pruneCSRFTokenStore(MAX_CSRF_TOKENS - 1);
+    }
+    if (!csrfTokens.has(sessionId) && csrfTokens.size >= MAX_CSRF_TOKENS) {
+      set.status = 429;
+      return {
+        error: "CSRF token capacity exceeded"
+      };
+    }
+    csrfTokens.set(sessionId, {
+      token: csrfToken,
+      expires
+    });
+    return {
+      csrfToken
+    };
+  }).onBeforeHandle(({ request, body, set }) => {
+    if (!finalConfig.enableCSRF) {
+      return void 0;
+    }
+    if (shouldSkipCSRF(request, finalConfig.csrfSkipRoutes)) {
+      return void 0;
+    }
+    const sessionId = getSessionId(request);
+    const providedToken = getCSRFTokenFromRequest(request, body);
+    if (!sessionId || !providedToken) {
+      set.status = 403;
+      return {
+        error: "CSRF token required",
+        code: "CSRF_TOKEN_MISSING"
+      };
+    }
+    const storedTokenData = csrfTokens.get(sessionId);
+    if (!storedTokenData || storedTokenData.expires < Date.now()) {
+      csrfTokens.delete(sessionId);
+      set.status = 403;
+      return {
+        error: "CSRF token expired",
+        code: "CSRF_TOKEN_EXPIRED"
+      };
+    }
+    if (!constantTimeCompare(providedToken, storedTokenData.token)) {
+      set.status = 403;
+      return {
+        error: "Invalid CSRF token",
+        code: "CSRF_TOKEN_INVALID"
+      };
+    }
+    return void 0;
+  }).onAfterHandle(({ request, set }) => {
+    if (!finalConfig.enableSessionSecurity) {
+      return;
+    }
+    const url = new URL(request.url);
+    if (url.pathname.includes("/interaction/") || url.pathname.includes("/oidc/")) {
+      set.headers["Cache-Control"] = "no-cache, no-store, must-revalidate";
+      set.headers["Pragma"] = "no-cache";
+      set.headers["Expires"] = "0";
+    }
+    if (isLoginEndpoint(request, finalConfig.loginEndpoints)) {
+      logger.debug("[Security] Login endpoint accessed", {
+        path: url.pathname
+      });
+    }
+  });
+}
+__name(createSecurityPlugin, "createSecurityPlugin");
+function cleanupExpiredTokens() {
+  const now = Date.now();
+  for (const [sessionId, tokenData] of csrfTokens.entries()) {
+    if (tokenData.expires < now) {
+      csrfTokens.delete(sessionId);
+    }
+  }
+}
+__name(cleanupExpiredTokens, "cleanupExpiredTokens");
+setInterval(() => {
+  cleanupExpiredTokens();
+}, 10 * 60 * 1e3);
+logger.debug("[Security] Security middleware module loaded");
+
+export { cleanupExpiredTokens, createSecurityPlugin, middleware_exports };
+//# sourceMappingURL=chunk-2HANKZZM.js.map
+//# sourceMappingURL=chunk-2HANKZZM.js.map

package/dist/chunk-2HANKZZM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware/index.ts","../src/middleware/security.ts"],"names":["csrfTokens","Map","MAX_CSRF_TOKENS","DEFAULT_CSRF_SKIP_ROUTES","DEFAULT_LOGIN_ENDPOINTS","generateCSRFToken","crypto","randomBytes","toString","constantTimeCompare","a","b","length","result","i","charCodeAt","getSessionId","request","cookieHeader","headers","get","cookies","split","reduce","acc","cookie","key","value","trim","getCSRFTokenFromRequest","body","headerToken","bodyToken","pruneCSRFTokenStore","maxEntries","cleanupExpiredTokens","size","oldestEntry","keys","next","done","delete","shouldSkipCSRF","skipRoutes","url","URL","pathname","includes","method","shouldSkip","some","route","startsWith","logger","debug","isLoginEndpoint","loginEndpoints","path","buildSecurityHeaders","isProduction","cspDirectives","push","join","createSecurityPlugin","config","finalConfig","csrfSkipRoutes","enableCSRF","enableSessionSecurity","csrfTokenExpiry","helmetConfig","nodeEnv","process","env","securityHeaders","Elysia","name","onAfterHandle","set","Object","entries","sessionId","status","error","csrfToken","expires","Date","now","has","token","onBeforeHandle","undefined","providedToken","code","storedTokenData","tokenData","setInterval"],"mappings":";;;;;;AAAA,IAAA,kBAAA,GAAA;;;;;ACgCA,IAAMA,UAAAA,uBAAiBC,GAAAA,EAAAA;AACvB,IAAMC,eAAAA,GAAkB,GAAA;AAMxB,IAAMC,wBAAAA,GAA2B;AAC/B,EAAA,UAAA;AACA,EAAA,WAAA;AACA,EAAA,UAAA;AACA,EAAA,QAAA;AACA,EAAA;;AAMF,IAAMC,uBAAAA,GAA0B;AAAC,EAAA,eAAA;AAAiB,EAAA,aAAA;AAAe,EAAA;;AAKjE,SAASC,iBAAAA,GAAAA;AACP,EAAA,OAAOC,MAAAA,CAAOC,WAAAA,CAAY,EAAA,CAAA,CAAIC,SAAS,KAAA,CAAA;AACzC;AAFSH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAOT,SAASI,mBAAAA,CAAoBC,GAAWC,CAAAA,EAAS;AAC/C,EAAA,IAAID,CAAAA,CAAEE,MAAAA,KAAWD,CAAAA,CAAEC,MAAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIC,MAAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAASC,CAAAA,GAAI,CAAA,EAAGA,CAAAA,GAAIJ,CAAAA,CAAEE,QAAQE,CAAAA,EAAAA,EAAK;AACjCD,IAAAA,MAAAA,IAAUH,EAAEK,UAAAA,CAAWD,CAAAA,CAAAA,GAAKH,CAAAA,CAAEI,WAAWD,CAAAA,CAAAA;AAC3C,EAAA;AAEA,EAAA,OAAOD,MAAAA,KAAW,CAAA;AACpB;AAXSJ,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAgBT,SAASO,aAAaC,OAAAA,EAAgB;AACpC,EAAA,MAAMC,YAAAA,GAAeD,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA;AACzC,EAAA,IAAI,CAACF,cAAc,OAAO,IAAA;AAE1B,EAAA,MAAMG,OAAAA,GAAUH,aAAaI,KAAAA,CAAM,GAAA,EAAKC,MAAAA,CACtC,CAACC,KAAKC,MAAAA,KAAAA;AACJ,IAAA,MAAM,CAACC,KAAKC,KAAAA,CAAAA,GAASF,OAAOG,IAAAA,EAAI,CAAGN,MAAM,GAAA,CAAA;AACzC,IAAA,IAAII,OAAOC,KAAAA,EAAO;AAChBH,MAAAA,GAAAA,CAAIE,GAAAA,CAAAA,GAAOC,KAAAA;AACb,IAAA;AACA,IAAA,OAAOH,GAAAA;AACT,EAAA,CAAA,EACA,EAAC,CAAA;AAGH,EAAA,OAAOH,OAAAA,CAAQ,UAAA,CAAA,IAAe,IAAA;AAChC;AAhBSL,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAqBT,SAASa,uBAAAA,CAAwBZ,SAAkBa,IAAAA,EAAa;AAE9D,EAAA,MAAMC,WAAAA,GAAcd,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,cAAA,CAAA;AACxC,EAAA,IAAIW,WAAAA,EAAa;AACf,IAAA,OAAOA,WAAAA;AACT,EAAA;AAGA,EAAA,IAAID,IAAAA,IAAQ,OAAOA,IAAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAME,SAAAA,GAAaF,KAAiC,OAAA,CAAA;AACpD,IAAA,IAAIE,SAAAA,IAAa,OAAOA,SAAAA,KAAc,QAAA,EAAU;AAC9C,MAAA,OAAOA,SAAAA;AACT,IAAA;AACF,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAhBSH,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA8BF,SAASI,mBAAAA,CAAoBC,aAAqBhC,eAAAA,EAAe;AACtEiC,EAAAA,oBAAAA,EAAAA;AAEA,EAAA,OAAOnC,UAAAA,CAAWoC,OAAOF,UAAAA,EAAY;AACnC,IAAA,MAAMG,WAAAA,GAAcrC,UAAAA,CAAWsC,IAAAA,EAAI,CAAGC,IAAAA,EAAI;AAC1C,IAAA,IAAIF,YAAYG,IAAAA,EAAM;AACpB,MAAA;AACF,IAAA;AAEAxC,IAAAA,UAAAA,CAAWyC,MAAAA,CAAOJ,YAAYV,KAAK,CAAA;AACrC,EAAA;AACF;AAXgBM,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAgBhB,SAASS,cAAAA,CAAezB,SAAkB0B,UAAAA,EAAoB;AAC5D,EAAA,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAI5B,OAAAA,CAAQ2B,GAAG,CAAA;AAC/B,EAAA,MAAME,WAAWF,GAAAA,CAAIE,QAAAA;AAGrB,EAAA,IAAI;AAAC,IAAA,KAAA;AAAO,IAAA,MAAA;AAAQ,IAAA;IAAWC,QAAAA,CAAS9B,OAAAA,CAAQ+B,MAAM,CAAA,EAAG;AACvD,IAAA,OAAO,IAAA;AACT,EAAA;AAGA,EAAA,MAAMC,UAAAA,GAAaN,WAAWO,IAAAA,CAAK,CAACC,UAAUL,QAAAA,CAASM,UAAAA,CAAWD,KAAAA,CAAAA,CAAAA;AAGlE,EAAA,IAAIL,QAAAA,CAASC,QAAAA,CAAS,eAAA,CAAA,EAAkB;AACtCM,IAAAA,MAAAA,CAAOC,MAAM,aAAA,EAAe;MAC1BV,GAAAA,EAAKE,QAAAA;AACLG,MAAAA,UAAAA;AACAD,MAAAA,MAAAA,EAAQ/B,OAAAA,CAAQ+B;KAClB,CAAA;AACF,EAAA;AAEA,EAAA,OAAOC,UAAAA;AACT;AAtBSP,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AA2BT,SAASa,eAAAA,CAAgBtC,SAAkBuC,cAAAA,EAAwB;AACjE,EAAA,MAAMZ,GAAAA,GAAM,IAAIC,GAAAA,CAAI5B,OAAAA,CAAQ2B,GAAG,CAAA;AAC/B,EAAA,OAAOY,cAAAA,CAAeN,KAAK,CAACO,IAAAA,KAASb,IAAIE,QAAAA,CAASC,QAAAA,CAASU,IAAAA,CAAAA,CAAAA;AAC7D;AAHSF,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAQT,SAASG,qBAAqBC,YAAAA,EAAqB;AACjD,EAAA,MAAMxC,OAAAA,GAAkC;IACtC,wBAAA,EAA0B,SAAA;IAC1B,iBAAA,EAAmB,MAAA;IACnB,kBAAA,EAAoB,eAAA;IACpB,iBAAA,EAAmB;AACrB,GAAA;AAGA,EAAA,MAAMyC,aAAAA,GAA0B;AAC9B,IAAA,oBAAA;AACA,IAAA,CAAA,kBAAA,EAAqB,CAACD,YAAAA,GAAe,+BAAA,GAAkC,EAAA,yEAA2E/B,IAAAA,EAAI;AACtJ,IAAA,CAAA,iBAAA,EAAoB,CAAC+B,YAAAA,GAAe,iBAAA,GAAoB,EAAA,kDAAoD/B,IAAAA,EAAI;AAChH,IAAA,mEAAA;;AAEA,IAAA,CAAA,+BAAA,EAAkC,CAAC+B,YAAAA,GAAe,oBAAA,GAAuB,EAAA,2EAA6E/B,IAAAA,EAAI;AAC1J,IAAA,2CAAA;AACA,IAAA,0FAAA;AACA,IAAA,wBAAA;AACA,IAAA,iBAAA;AACA,IAAA;;AAGF,EAAA,IAAI+B,YAAAA,EAAc;AAChBC,IAAAA,aAAAA,CAAcC,KAAK,2BAAA,CAAA;AACrB,EAAA;AAEA1C,EAAAA,OAAAA,CAAQ,yBAAA,CAAA,GAA6ByC,aAAAA,CAAcE,IAAAA,CAAK,IAAA,CAAA;AAExD,EAAA,OAAO3C,OAAAA;AACT;AA9BSuC,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAsCF,SAASK,qBAAqBC,MAAAA,EAAiC;AACpE,EAAA,MAAMC,WAAAA,GAAkD;AACtDC,IAAAA,cAAAA,EAAgBF,QAAQE,cAAAA,IAAkB/D,wBAAAA;AAC1CqD,IAAAA,cAAAA,EAAgBQ,QAAQR,cAAAA,IAAkBpD,uBAAAA;IAC1CwD,aAAAA,EAAeI,MAAAA,EAAQJ,iBAAiB,EAAC;AACzCO,IAAAA,UAAAA,EAAYH,QAAQG,UAAAA,IAAc,KAAA;AAClCC,IAAAA,qBAAAA,EAAuBJ,QAAQI,qBAAAA,IAAyB,KAAA;IACxDC,eAAAA,EAAiBL,MAAAA,EAAQK,eAAAA,IAAmB,EAAA,GAAK,EAAA,GAAK,GAAA;AACtDC,IAAAA,YAAAA,EAAcN,QAAQM,YAAAA,IAAgB;MAGtC;AACF,GAAA;AAEA,EAAA,MAAMC,OAAAA,GAAUC,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA;AAC5B,EAAA,MAAMd,eAAeY,OAAAA,KAAY,YAAA;AACjC,EAAA,MAAMG,eAAAA,GAAkBhB,qBAAqBC,YAAAA,CAAAA;AAE7C,EAAA,OACE,IAAIgB,MAAAA,CAAO;IAAEC,IAAAA,EAAM;AAAW,GAAA,CAAA,CAE3BC,aAAAA,CAAc,CAAC,EAAEC,KAAG,KAAE;AACrB,IAAA,KAAA,MAAW,CAACpD,GAAAA,EAAKC,KAAAA,KAAUoD,MAAAA,CAAOC,OAAAA,CAAQN,eAAAA,CAAAA,EAAkB;AAC1DI,MAAAA,GAAAA,CAAI3D,OAAAA,CAAQO,GAAAA,CAAAA,GAAOC,KAAAA;AACrB,IAAA;AACF,EAAA,CAAA,EAECP,GAAAA,CAAI,iBAAA,EAAmB,CAAC,EAAEH,OAAAA,EAAS6D,KAAG,KAAE;AACvC,IAAA,MAAMG,SAAAA,GAAYjE,aAAaC,OAAAA,CAAAA;AAE/B,IAAA,IAAI,CAACgE,SAAAA,EAAW;AACdH,MAAAA,GAAAA,CAAII,MAAAA,GAAS,GAAA;AACb,MAAA,OAAO;QAAEC,KAAAA,EAAO;AAAmB,OAAA;AACrC,IAAA;AAEA,IAAA,MAAMC,YAAY/E,iBAAAA,EAAAA;AAClB,IAAA,MAAMgF,OAAAA,GAAUC,IAAAA,CAAKC,GAAAA,EAAG,GAAKtB,WAAAA,CAAYI,eAAAA;AAEzC,IAAA,IAAI,CAACrE,UAAAA,CAAWwF,GAAAA,CAAIP,SAAAA,CAAAA,EAAY;AAC9BhD,MAAAA,mBAAAA,CAAoB/B,kBAAkB,CAAA,CAAA;AACxC,IAAA;AAEA,IAAA,IAAI,CAACF,UAAAA,CAAWwF,GAAAA,CAAIP,SAAAA,CAAAA,IAAcjF,UAAAA,CAAWoC,QAAQlC,eAAAA,EAAiB;AACpE4E,MAAAA,GAAAA,CAAII,MAAAA,GAAS,GAAA;AACb,MAAA,OAAO;QAAEC,KAAAA,EAAO;AAA+B,OAAA;AACjD,IAAA;AAEAnF,IAAAA,UAAAA,CAAW8E,IAAIG,SAAAA,EAAW;MAAEQ,KAAAA,EAAOL,SAAAA;AAAWC,MAAAA;KAAQ,CAAA;AAEtD,IAAA,OAAO;AAAED,MAAAA;AAAU,KAAA;AACrB,EAAA,CAAA,EAECM,cAAAA,CAAe,CAAC,EAAEzE,OAAAA,EAASa,IAAAA,EAAMgD,KAAG,KAAE;AACrC,IAAA,IAAI,CAACb,YAAYE,UAAAA,EAAY;AAC3B,MAAA,OAAOwB,MAAAA;AACT,IAAA;AAGA,IAAA,IAAIjD,cAAAA,CAAezB,OAAAA,EAASgD,WAAAA,CAAYC,cAAc,CAAA,EAAG;AACvD,MAAA,OAAOyB,MAAAA;AACT,IAAA;AAEA,IAAA,MAAMV,SAAAA,GAAYjE,aAAaC,OAAAA,CAAAA;AAC/B,IAAA,MAAM2E,aAAAA,GAAgB/D,uBAAAA,CAAwBZ,OAAAA,EAASa,IAAAA,CAAAA;AAEvD,IAAA,IAAI,CAACmD,SAAAA,IAAa,CAACW,aAAAA,EAAe;AAChCd,MAAAA,GAAAA,CAAII,MAAAA,GAAS,GAAA;AACb,MAAA,OAAO;QACLC,KAAAA,EAAO,qBAAA;QACPU,IAAAA,EAAM;AACR,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,eAAAA,GAAkB9F,UAAAA,CAAWoB,GAAAA,CAAI6D,SAAAA,CAAAA;AAEvC,IAAA,IAAI,CAACa,eAAAA,IAAmBA,eAAAA,CAAgBT,OAAAA,GAAUC,IAAAA,CAAKC,KAAG,EAAI;AAC5DvF,MAAAA,UAAAA,CAAWyC,OAAOwC,SAAAA,CAAAA;AAClBH,MAAAA,GAAAA,CAAII,MAAAA,GAAS,GAAA;AACb,MAAA,OAAO;QACLC,KAAAA,EAAO,oBAAA;QACPU,IAAAA,EAAM;AACR,OAAA;AACF,IAAA;AAEA,IAAA,IAAI,CAACpF,mBAAAA,CAAoBmF,aAAAA,EAAeE,eAAAA,CAAgBL,KAAK,CAAA,EAAG;AAC9DX,MAAAA,GAAAA,CAAII,MAAAA,GAAS,GAAA;AACb,MAAA,OAAO;QACLC,KAAAA,EAAO,oBAAA;QACPU,IAAAA,EAAM;AACR,OAAA;AACF,IAAA;AAEA,IAAA,OAAOF,MAAAA;AACT,EAAA,CAAA,EAECd,aAAAA,CAAc,CAAC,EAAE5D,OAAAA,EAAS6D,KAAG,KAAE;AAC9B,IAAA,IAAI,CAACb,YAAYG,qBAAAA,EAAuB;AACtC,MAAA;AACF,IAAA;AAEA,IAAA,MAAMxB,GAAAA,GAAM,IAAIC,GAAAA,CAAI5B,OAAAA,CAAQ2B,GAAG,CAAA;AAC/B,IAAA,IAAIA,GAAAA,CAAIE,SAASC,QAAAA,CAAS,eAAA,KAAoBH,GAAAA,CAAIE,QAAAA,CAASC,QAAAA,CAAS,QAAA,CAAA,EAAW;AAC7E+B,MAAAA,GAAAA,CAAI3D,OAAAA,CAAQ,eAAA,CAAA,GAAmB,qCAAA;AAC/B2D,MAAAA,GAAAA,CAAI3D,OAAAA,CAAQ,QAAA,CAAA,GAAY,UAAA;AACxB2D,MAAAA,GAAAA,CAAI3D,OAAAA,CAAQ,SAAA,CAAA,GAAa,GAAA;AAC3B,IAAA;AAGA,IAAA,IAAIoC,eAAAA,CAAgBtC,OAAAA,EAASgD,WAAAA,CAAYT,cAAc,CAAA,EAAG;AACxDH,MAAAA,MAAAA,CAAOC,MAAM,oCAAA,EAAsC;AACjDG,QAAAA,IAAAA,EAAMb,GAAAA,CAAIE;OACZ,CAAA;AACF,IAAA;EACF,CAAA,CAAA;AAEN;AAnHgBiB,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwHT,SAAS5B,oBAAAA,GAAAA;AACd,EAAA,MAAMoD,GAAAA,GAAMD,KAAKC,GAAAA,EAAG;AACpB,EAAA,KAAA,MAAW,CAACN,SAAAA,EAAWc,SAAAA,CAAAA,IAAc/F,UAAAA,CAAWgF,SAAO,EAAI;AACzD,IAAA,IAAIe,SAAAA,CAAUV,UAAUE,GAAAA,EAAK;AAC3BvF,MAAAA,UAAAA,CAAWyC,OAAOwC,SAAAA,CAAAA;AACpB,IAAA;AACF,EAAA;AACF;AAPgB9C,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAahB6D,WAAAA,CACE,MAAA;AACE7D,EAAAA,oBAAAA,EAAAA;AACF,CAAA,EACA,EAAA,GAAK,KAAK,GAAA,CAAA;AAIZkB,MAAAA,CAAOC,MAAM,8CAAA,CAAA","file":"chunk-2HANKZZM.js","sourcesContent":["/**\n * Middleware Module\n *\n * Centralized middleware for Elysia applications.\n * Provides reusable, configurable middleware as Elysia plugins:\n * - Security (CSP, CSRF, session security)\n *\n * **Note:** Metrics middleware is exported from the observability module.\n *\n * @module middleware\n */\n\n// Export security middleware plugin\nexport { createSecurityPlugin, cleanupExpiredTokens } from './security.js';\n\n// Export types\nexport type { CSPDirectives, MetricsMiddlewareConfig, MiddlewareConfig, SecurityMiddlewareConfig } from './types.js';\n","/**\n * Security Middleware for Elysia\n *\n * Comprehensive security middleware for Elysia applications.\n * Provides application-level security features including:\n * - Security headers (CSP, X-Frame-Options, etc.)\n * - CSRF protection\n * - Session security\n *\n * **Note:** Rate limiting, DDoS protection, and infrastructure security\n * should be handled at the API Gateway level.\n *\n * @example\n * ```typescript\n * import { createSecurityPlugin } from '@burdenoff/be-sdk';\n *\n * const app = new Elysia()\n *   .use(createSecurityPlugin({\n *     csrfSkipRoutes: ['/graphql', '/webhook/'],\n *     loginEndpoints: ['/auth/login', '/oidc/token'],\n *     enableCSRF: true,\n *     enableSessionSecurity: true,\n *   }));\n * ```\n */\nimport crypto from 'node:crypto';\nimport { Elysia, type AnyElysia } from 'elysia';\n\nimport { logger } from '../logger/index.js';\nimport type { SecurityMiddlewareConfig } from './types.js';\n\n// CSRF Token storage (in production, use Redis or database)\nconst csrfTokens = new Map<string, { token: string; expires: number }>();\nconst MAX_CSRF_TOKENS = 100_000;\n\n/**\n * Default CSRF skip routes\n * These routes typically have alternative authentication or CSRF protection\n */\nconst DEFAULT_CSRF_SKIP_ROUTES = [\n  '/graphql', // GraphQL has its own security\n  '/webhook/', // Webhook endpoints\n  '/upload/', // File upload endpoints\n  '/oidc/', // OIDC provider handles its own CSRF\n  '/interaction/', // OIDC interaction endpoints use OAuth state for CSRF protection\n];\n\n/**\n * Default login endpoint patterns\n */\nconst DEFAULT_LOGIN_ENDPOINTS = ['/interaction/', '/oidc/token', '/api/auth/login'];\n\n/**\n * Generate a cryptographically secure CSRF token\n */\nfunction generateCSRFToken(): string {\n  return crypto.randomBytes(32).toString('hex');\n}\n\n/**\n * Constant-time string comparison to prevent timing attacks\n */\nfunction constantTimeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let i = 0; i < a.length; i++) {\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n\n  return result === 0;\n}\n\n/**\n * Get session ID from request cookies\n */\nfunction getSessionId(request: Request): string | null {\n  const cookieHeader = request.headers.get('cookie');\n  if (!cookieHeader) return null;\n\n  const cookies = cookieHeader.split(';').reduce(\n    (acc, cookie) => {\n      const [key, value] = cookie.trim().split('=');\n      if (key && value) {\n        acc[key] = value;\n      }\n      return acc;\n    },\n    {} as Record<string, string>\n  );\n\n  return cookies['_session'] || null;\n}\n\n/**\n * Extract CSRF token from request\n */\nfunction getCSRFTokenFromRequest(request: Request, body: unknown): string | null {\n  // Check X-CSRF-Token header\n  const headerToken = request.headers.get('x-csrf-token');\n  if (headerToken) {\n    return headerToken;\n  }\n\n  // Check form body for _csrf field\n  if (body && typeof body === 'object') {\n    const bodyToken = (body as Record<string, unknown>)['_csrf'];\n    if (bodyToken && typeof bodyToken === 'string') {\n      return bodyToken;\n    }\n  }\n\n  return null;\n}\n\nexport function clearCSRFTokenStoreForTesting(): void {\n  csrfTokens.clear();\n}\n\nexport function getCSRFTokenStoreSize(): number {\n  return csrfTokens.size;\n}\n\nexport function setCSRFTokenForTesting(sessionId: string, token: string, expires: number): void {\n  csrfTokens.set(sessionId, { token, expires });\n}\n\nexport function pruneCSRFTokenStore(maxEntries: number = MAX_CSRF_TOKENS): void {\n  cleanupExpiredTokens();\n\n  while (csrfTokens.size > maxEntries) {\n    const oldestEntry = csrfTokens.keys().next();\n    if (oldestEntry.done) {\n      break;\n    }\n\n    csrfTokens.delete(oldestEntry.value);\n  }\n}\n\n/**\n * Check if CSRF validation should be skipped\n */\nfunction shouldSkipCSRF(request: Request, skipRoutes: string[]): boolean {\n  const url = new URL(request.url);\n  const pathname = url.pathname;\n\n  // Skip for safe HTTP methods\n  if (['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {\n    return true;\n  }\n\n  // Skip for configured routes\n  const shouldSkip = skipRoutes.some((route) => pathname.startsWith(route));\n\n  // Debug logging for interaction endpoints\n  if (pathname.includes('/interaction/')) {\n    logger.debug('CSRF Debug:', {\n      url: pathname,\n      shouldSkip,\n      method: request.method,\n    });\n  }\n\n  return shouldSkip;\n}\n\n/**\n * Check if this is a login endpoint\n */\nfunction isLoginEndpoint(request: Request, loginEndpoints: string[]): boolean {\n  const url = new URL(request.url);\n  return loginEndpoints.some((path) => url.pathname.includes(path));\n}\n\n/**\n * Build security headers based on environment\n */\nfunction buildSecurityHeaders(isProduction: boolean): Record<string, string> {\n  const headers: Record<string, string> = {\n    'X-Content-Type-Options': 'nosniff',\n    'X-Frame-Options': 'DENY',\n    'X-XSS-Protection': '1; mode=block',\n    'Referrer-Policy': 'strict-origin-when-cross-origin',\n  };\n\n  // Build CSP directives\n  const cspDirectives: string[] = [\n    \"default-src 'self'\",\n    `script-src 'self' ${!isProduction ? \"'unsafe-inline' 'unsafe-eval'\" : ''} https://js.stripe.com https://checkout.razorpay.com https://unpkg.com`.trim(),\n    `style-src 'self' ${!isProduction ? \"'unsafe-inline'\" : ''} https://fonts.googleapis.com https://unpkg.com`.trim(),\n    \"img-src 'self' data: https: blob: *.amazonaws.com *.algoshred.com\",\n    // eslint-disable-next-line sonarjs/no-clear-text-protocols -- http://localhost:* is only used in development\n    `connect-src 'self' wss: https: ${!isProduction ? 'http://localhost:*' : ''} https://*.algoshred.com https://api.stripe.com https://api.razorpay.com`.trim(),\n    \"font-src 'self' https://fonts.gstatic.com\",\n    \"frame-src 'self' https://js.stripe.com https://hooks.stripe.com https://api.razorpay.com\",\n    \"frame-ancestors 'none'\",\n    \"base-uri 'self'\",\n    \"form-action 'self'\",\n  ];\n\n  if (isProduction) {\n    cspDirectives.push('upgrade-insecure-requests');\n  }\n\n  headers['Content-Security-Policy'] = cspDirectives.join('; ');\n\n  return headers;\n}\n\n/**\n * Create Elysia security plugin\n *\n * @param config Security configuration options\n * @returns Elysia plugin instance\n */\nexport function createSecurityPlugin(config?: SecurityMiddlewareConfig): AnyElysia {\n  const finalConfig: Required<SecurityMiddlewareConfig> = {\n    csrfSkipRoutes: config?.csrfSkipRoutes || DEFAULT_CSRF_SKIP_ROUTES,\n    loginEndpoints: config?.loginEndpoints || DEFAULT_LOGIN_ENDPOINTS,\n    cspDirectives: config?.cspDirectives || {},\n    enableCSRF: config?.enableCSRF ?? false, // Disabled by default for GraphQL services\n    enableSessionSecurity: config?.enableSessionSecurity ?? false,\n    csrfTokenExpiry: config?.csrfTokenExpiry || 60 * 60 * 1000, // 1 hour\n    helmetConfig: config?.helmetConfig || {\n      crossOriginEmbedderPolicy: false,\n      crossOriginResourcePolicy: false,\n    },\n  };\n\n  const nodeEnv = process.env['NODE_ENV'];\n  const isProduction = nodeEnv === 'production';\n  const securityHeaders = buildSecurityHeaders(isProduction);\n\n  return (\n    new Elysia({ name: 'security' })\n      // Add security headers to all responses\n      .onAfterHandle(({ set }) => {\n        for (const [key, value] of Object.entries(securityHeaders)) {\n          set.headers[key] = value;\n        }\n      })\n      // CSRF token generation endpoint\n      .get('/api/csrf-token', ({ request, set }) => {\n        const sessionId = getSessionId(request);\n\n        if (!sessionId) {\n          set.status = 401;\n          return { error: 'No session found' };\n        }\n\n        const csrfToken = generateCSRFToken();\n        const expires = Date.now() + finalConfig.csrfTokenExpiry;\n\n        if (!csrfTokens.has(sessionId)) {\n          pruneCSRFTokenStore(MAX_CSRF_TOKENS - 1);\n        }\n\n        if (!csrfTokens.has(sessionId) && csrfTokens.size >= MAX_CSRF_TOKENS) {\n          set.status = 429;\n          return { error: 'CSRF token capacity exceeded' };\n        }\n\n        csrfTokens.set(sessionId, { token: csrfToken, expires });\n\n        return { csrfToken };\n      })\n      // CSRF validation for state-changing operations\n      .onBeforeHandle(({ request, body, set }): { error: string; code: string } | undefined => {\n        if (!finalConfig.enableCSRF) {\n          return undefined;\n        }\n\n        // Skip CSRF for safe methods and specific routes\n        if (shouldSkipCSRF(request, finalConfig.csrfSkipRoutes)) {\n          return undefined;\n        }\n\n        const sessionId = getSessionId(request);\n        const providedToken = getCSRFTokenFromRequest(request, body);\n\n        if (!sessionId || !providedToken) {\n          set.status = 403;\n          return {\n            error: 'CSRF token required',\n            code: 'CSRF_TOKEN_MISSING',\n          };\n        }\n\n        const storedTokenData = csrfTokens.get(sessionId);\n\n        if (!storedTokenData || storedTokenData.expires < Date.now()) {\n          csrfTokens.delete(sessionId);\n          set.status = 403;\n          return {\n            error: 'CSRF token expired',\n            code: 'CSRF_TOKEN_EXPIRED',\n          };\n        }\n\n        if (!constantTimeCompare(providedToken, storedTokenData.token)) {\n          set.status = 403;\n          return {\n            error: 'Invalid CSRF token',\n            code: 'CSRF_TOKEN_INVALID',\n          };\n        }\n\n        return undefined;\n      })\n      // Session security headers for sensitive endpoints\n      .onAfterHandle(({ request, set }) => {\n        if (!finalConfig.enableSessionSecurity) {\n          return;\n        }\n\n        const url = new URL(request.url);\n        if (url.pathname.includes('/interaction/') || url.pathname.includes('/oidc/')) {\n          set.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate';\n          set.headers['Pragma'] = 'no-cache';\n          set.headers['Expires'] = '0';\n        }\n\n        // Log successful login endpoints for audit\n        if (isLoginEndpoint(request, finalConfig.loginEndpoints)) {\n          logger.debug('[Security] Login endpoint accessed', {\n            path: url.pathname,\n          });\n        }\n      })\n  );\n}\n\n/**\n * Clean up expired CSRF tokens (should be called periodically)\n */\nexport function cleanupExpiredTokens(): void {\n  const now = Date.now();\n  for (const [sessionId, tokenData] of csrfTokens.entries()) {\n    if (tokenData.expires < now) {\n      csrfTokens.delete(sessionId);\n    }\n  }\n}\n\n/**\n * Cleanup expired CSRF tokens every 10 minutes\n * This prevents memory leaks from accumulating expired tokens\n */\nsetInterval(\n  () => {\n    cleanupExpiredTokens();\n  },\n  10 * 60 * 1000\n);\n\n// Log when security middleware is loaded\nlogger.debug('[Security] Security middleware module loaded');\n"]}