@c15t/backend 1.2.0-canary.13 → 1.2.0-canary.2

package/src/middleware/cors/is-origin-trusted.ts

@@ -1,126 +0,0 @@
-/**
- * Origin validation utilities for CORS security
- *
- * @packageDocumentation
- */
-
-import type { Logger } from '@doubletie/logger';
-
-/**
- * Regular expression to strip protocol, trailing slashes, and port numbers from URLs
- * Matches:
- * - http:// or https:// protocol
- * - ws:// or wss:// protocol
- * - trailing slashes
- * - port numbers with colon
- *
- * @internal
- */
-export const STRIP_REGEX = /^(https?:\/\/)|(wss?:\/\/)|(\/+$)|:\d+/g;
-
-/**
- * Checks if a domain matches a wildcard pattern
- *
- * @param hostname - The hostname to check
- * @param wildcardPattern - The wildcard pattern (e.g. *.example.com)
- * @param logger - Optional logger for debugging
- * @returns true if the hostname matches the wildcard pattern
- *
- * @internal
- */
-function matchesWildcard(
-	hostname: string,
-	wildcardPattern: string,
-	logger?: Logger
-): boolean {
-	const wildcardDomain = wildcardPattern.slice(2); // Remove *. prefix
-	const parts = hostname.split('.');
-	const isValid = parts.length > 2 && hostname.endsWith(wildcardDomain);
-
-	logger?.debug(
-		`Wildcard match result: ${isValid} ${hostname} ends with ${wildcardDomain} ${parts.length > 2} ${hostname.endsWith(wildcardDomain)}`
-	);
-
-	return isValid;
-}
-
-/**
- * Validates if a given origin matches any of the trusted domain patterns
- *
- * Supports:
- * - Exact domain matches
- * - Wildcard subdomains (e.g. *.example.com)
- * - Protocol-agnostic matching
- * - Case-insensitive comparison
- *
- * @param origin - The origin URL to validate (e.g. https://example.com)
- * @param trustedDomains - Array of trusted domain patterns. Can include wildcards (e.g. *.example.com)
- * @param logger - Optional logger for debugging validation process
- *
- * @returns `true` if the origin matches any trusted domain pattern, `false` otherwise
- *
- * @throws {Error} When trustedDomains array is empty
- * @throws {TypeError} When origin URL is invalid
- *
- * @example
- * ```ts
- * // Simple domain matching
- * isOriginTrusted('https://example.com', ['example.com']); // true
- *
- * // Wildcard subdomain matching
- * isOriginTrusted('https://api.example.com', ['*.example.com']); // true
- *
- * // Allow all origins
- * isOriginTrusted('https://any-domain.com', ['*']); // true
- * ```
- */
-export function isOriginTrusted(
-	origin: string,
-	trustedDomains: string[],
-	logger?: Logger
-): boolean {
-	try {
-		if (trustedDomains.length === 0) {
-			throw new Error('No trusted domains');
-		}
-
-		logger?.debug(
-			`Checking if origin ${origin} is trusted in ${trustedDomains}`
-		);
-
-		// Special case: if "*" is in trusted domains, allow all origins
-		if (trustedDomains.includes('*')) {
-			logger?.debug('Allowing all origins');
-			return true;
-		}
-
-		// Parse the origin URL to get just the hostname
-		const url = new URL(origin);
-		const originHostname = url.hostname.toLowerCase();
-		logger?.debug(`Parsed origin hostname: ${originHostname}`);
-
-		return trustedDomains.some((domain) => {
-			// Handle empty domains (which might come from splitting empty strings)
-			if (!domain || domain.trim() === '') {
-				logger?.debug('Skipping empty domain');
-				return false;
-			}
-
-			const strippedDomain = domain.replace(STRIP_REGEX, '').toLowerCase();
-			logger?.debug(`Checking against stripped domain: ${strippedDomain}`);
-
-			if (strippedDomain.startsWith('*.')) {
-				return matchesWildcard(originHostname, strippedDomain, logger);
-			}
-
-			const isMatch = originHostname === strippedDomain;
-			logger?.debug(
-				`Exact match result: ${isMatch} ${originHostname} === ${strippedDomain}`
-			);
-			return isMatch;
-		});
-	} catch (error) {
-		logger?.error('Error validating origin:', error);
-		return false;
-	}
-}

package/src/middleware/cors/process-cors.ts

@@ -1,91 +0,0 @@
-/**
- * CORS processing middleware for c15t
- * Handles origin validation and context enrichment
- *
- * @packageDocumentation
- */
-
-import type { C15TContext } from '~/types/context';
-import { isOriginTrusted } from './is-origin-trusted';
-
-/**
- * Result of CORS processing
- * @internal
- */
-interface CORSProcessingResult {
-	/** The origin from the request */
-	origin: string | null;
-	/** Whether the origin is trusted */
-	isTrusted: boolean;
-}
-
-/**
- * Extracts and validates CORS information from a request
- *
- * @param request - The request to process
- * @param trustedOrigins - Array of trusted origins
- * @param logger - Optional logger for debugging
- * @returns CORS processing result
- *
- * @internal
- */
-function extractCORSInfo(
-	request: Request,
-	trustedOrigins?: string[],
-	logger?: C15TContext['logger']
-): CORSProcessingResult {
-	const origin = request.headers.get('origin');
-
-	if (!origin || !trustedOrigins) {
-		return {
-			origin: origin,
-			isTrusted: false,
-		};
-	}
-
-	return {
-		origin,
-		isTrusted: isOriginTrusted(origin, trustedOrigins, logger),
-	};
-}
-
-/**
- * Processes CORS validation for an incoming request and enriches the context
- * with origin information. This middleware function validates the origin against
- * trusted patterns and updates the context with the validation results.
- *
- * @param request - The incoming HTTP request to process
- * @param context - The c15t middleware context to enrich
- * @param trustedOrigins - Array of trusted origin patterns. Can include wildcards ('*')
- *
- * @returns The enriched context with origin validation results
- *
- * @example
- * ```ts
- * const enrichedContext = processCors(
- *   request,
- *   context,
- *   ['https://example.com', '*.trusted-domain.com']
- * );
- * ```
- *
- * @see {@link isOriginTrusted} for origin validation details
- */
-export const processCors = (
-	request: Request,
-	context: C15TContext,
-	trustedOrigins?: string[]
-): C15TContext => {
-	const { origin, isTrusted } = extractCORSInfo(
-		request,
-		trustedOrigins,
-		context.logger
-	);
-
-	if (origin) {
-		context.origin = origin;
-		context.trustedOrigin = isTrusted;
-	}
-
-	return context;
-};

package/src/middleware/openapi/config.ts

@@ -1,28 +0,0 @@
-import type { C15TOptions } from '~/types';
-import packageJson from '../../../package.json';
-
-/**
- * Default OpenAPI configuration
- */
-export const createOpenAPIConfig = (options: C15TOptions) => {
-	const basePath = options.basePath || '';
-	return {
-		enabled: true,
-		specPath: `${basePath}/spec.json`,
-		docsPath: `${basePath}/docs`,
-		...(options.openapi || {}),
-	};
-};
-
-/**
- * Default OpenAPI options
- */
-export const createDefaultOpenAPIOptions = (options: C15TOptions) => ({
-	info: {
-		title: options.appName || 'c15t API',
-		version: packageJson.version,
-		description: 'API for consent management',
-	},
-	servers: [{ url: options.basePath || '/' }],
-	security: [{ bearerAuth: [] }],
-});

package/src/middleware/openapi/handlers.ts

@@ -1,132 +0,0 @@
-import { OpenAPIGenerator } from '@orpc/openapi';
-import { ZodToJsonSchemaConverter } from '@orpc/zod';
-import { router } from '~/router';
-import type { C15TContext, C15TOptions } from '~/types';
-import { createDefaultOpenAPIOptions, createOpenAPIConfig } from './config';
-
-/**
- * Type for the memoized OpenAPI spec function
- */
-type MemoizedSpecFunction = {
-	(): Promise<Record<string, unknown>>;
-	cached?: Record<string, unknown>;
-};
-
-/**
- * Merges user OpenAPI options with default options
- */
-const mergeOpenAPIOptions = (
-	defaultOptions: Record<string, unknown>,
-	userOptions: Record<string, unknown>
-): Record<string, unknown> => {
-	const merged = { ...defaultOptions };
-
-	// Handle nested info object specially
-	if (userOptions.info && typeof userOptions.info === 'object') {
-		merged.info = {
-			...(merged.info as Record<string, unknown>),
-			...userOptions.info,
-		};
-	}
-
-	// For all other top-level properties, override defaults
-	for (const [key, value] of Object.entries(userOptions)) {
-		if (key !== 'info') {
-			merged[key] = value;
-		}
-	}
-
-	return merged;
-};
-
-/**
- * Generate the OpenAPI specification document
- *
- * @param options - Configuration options for the OpenAPI spec generation
- * @returns A memoized function that generates and caches the OpenAPI spec
- *
- * @throws {Error} When the OpenAPI generator fails to create a valid spec
- *
- * @example
- * ```ts
- * const getSpec = createOpenAPISpec(options);
- * const spec = await getSpec();
- * ```
- */
-export const createOpenAPISpec = (
-	context: C15TContext,
-	options: C15TOptions
-) => {
-	// Initialize OpenAPI generator with schema converters
-	const openAPIGenerator = new OpenAPIGenerator({
-		schemaConverters: [new ZodToJsonSchemaConverter()],
-	});
-
-	// Memoise once per process
-	const getOpenAPISpec = (async (): Promise<Record<string, unknown>> => {
-		if (getOpenAPISpec.cached) {
-			return getOpenAPISpec.cached;
-		}
-
-		const defaultOptions = createDefaultOpenAPIOptions(options);
-		const mergedOptions = options.openapi?.options
-			? mergeOpenAPIOptions(
-					defaultOptions,
-					options.openapi.options as Record<string, unknown>
-				)
-			: defaultOptions;
-
-		try {
-			// We need to cast to the expected type due to incompatibilities between the types
-			// This is safe as we control the options format and it's compatible with what the generator expects
-			const spec = await openAPIGenerator.generate(
-				router,
-				mergedOptions as Record<string, unknown>
-			);
-			getOpenAPISpec.cached = spec;
-			return spec;
-		} catch (error) {
-			context.logger?.error('Failed to generate OpenAPI spec:', error);
-			// Return a minimal valid spec to prevent UI errors
-			return {
-				openapi: '3.0.0',
-				info: { title: options.appName || 'c15t API', version: '0.0.0' },
-				paths: {},
-			};
-		}
-	}) as MemoizedSpecFunction;
-
-	return getOpenAPISpec;
-};
-
-/**
- * Generate the default UI for API documentation
- */
-export const createDocsUI = (options: C15TOptions) => {
-	const config = createOpenAPIConfig(options);
-
-	// If a custom template is provided, use it
-	if (config.customUiTemplate) {
-		return config.customUiTemplate;
-	}
-
-	// Otherwise, return the default Scalar UI
-	return `
-    <!doctype html>
-    <html>
-      <head>
-        <title>${options.appName || 'c15t API'} Documentation</title>
-        <meta charset="utf-8" />
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <link rel="icon" type="image/svg+xml" href="https://c15t.com/icon.svg" />
-      </head>
-      <body>
-        <script
-          id="api-reference"
-          data-url="${encodeURI(config.specPath)}">
-        </script>
-        <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
-      </body>
-    </html>
-  `;
-};

package/src/middleware/openapi/index.ts

@@ -1,11 +0,0 @@
-/**
- * OpenAPI middleware for c15t
- *
- * This module provides OpenAPI functionality including:
- * - Configuration management
- * - Specification generation
- * - Documentation UI
- */
-
-export { createOpenAPIConfig, createDefaultOpenAPIOptions } from './config';
-export { createOpenAPISpec, createDocsUI } from './handlers';