@c15t/backend 1.8.0 → 2.0.0-rc.1

package/src/middleware/cors/cors.ts

@@ -4,6 +4,19 @@
  * @packageDocumentation
  */
 
+/**
+ * CORS configuration options compatible with Hono's cors middleware
+ */
+export interface CorsOptions {
+	origin: string | string[] | ((origin: string) => string | null);
+	methods?: string[];
+	allowMethods?: string[];
+	allowHeaders?: string[];
+	maxAge?: number;
+	credentials?: boolean;
+	exposeHeaders?: string[];
+}
+
 /** Regular expression to match www prefix in domain names */
 const WWW_REGEX = /^www\./;
 
@@ -35,56 +48,89 @@ const SUPPORTED_HEADERS = [
 ] as const;
 
 /**
- * CORS configuration options type
+ * Normalizes an origin string by removing protocol and www prefix
+ *
+ * @param origin - The origin URL to normalize
+ * @returns Normalized origin string without protocol and www prefix
  */
-export interface CORSConfig {
-	/** Origin validation function */
-	origin: (origin: string) => Promise<string | null>;
-	/** Whether to allow credentials */
-	credentials: boolean;
-	/** Allowed headers */
-	allowHeaders: readonly string[];
-	/** Max age for preflight requests */
-	maxAge: number;
-	/** Allowed HTTP methods */
-	methods: readonly string[];
+function normalizeOrigin(origin: string): string {
+	try {
+		// Handle bare domains like 'localhost' or 'example.com'
+		if (
+			!origin.includes('://') &&
+			!origin.includes(':') &&
+			!origin.includes('/')
+		) {
+			return origin.toLowerCase();
+		}
+		// Add protocol if missing
+		const originWithProtocol =
+			origin.startsWith('http://') ||
+			origin.startsWith('https://') ||
+			origin.startsWith('ws://') ||
+			origin.startsWith('wss://')
+				? origin
+				: `http://${origin}`;
+		const url = new URL(originWithProtocol);
+		const hostname = url.hostname.replace(WWW_REGEX, '');
+		// Return without protocol to match both http and https
+		return `${hostname}${url.port ? `:${url.port}` : ''}`;
+	} catch {
+		// Fallback: remove www manually and protocol
+		return origin.replace(PROTOCOL_WWW_REGEX, '').replace(WWW_REGEX, '');
+	}
 }
 
 /**
- * Default CORS configuration for unrestricted access
+ * Expands a list of origins to include www variants
+ *
+ * @param origins - Array of origin strings to expand
+ * @returns Array of origins including www variants
  */
-const DEFAULT_CORS_CONFIG: CORSConfig = {
-	origin: async (origin: string) => {
-		// For default config, always return the origin if it exists, or '*' if it doesn't
-		return await Promise.resolve(origin || '*');
-	},
-	credentials: true,
-	allowHeaders: SUPPORTED_HEADERS,
-	maxAge: 600,
-	methods: SUPPORTED_METHODS,
-} as const;
+function expandWithWWW(origins: string[]): string[] {
+	const expanded = new Set<string>();
+	for (const origin of origins) {
+		if (origin === '*') {
+			expanded.add('*');
+			continue;
+		}
+		const normalized = normalizeOrigin(origin);
+		expanded.add(normalized);
+		// Add www version if not already present
+		if (!normalized.includes('www.')) {
+			expanded.add(`www.${normalized}`);
+		}
+	}
+	return Array.from(expanded);
+}
 
 /**
- * Creates CORS options configuration for the c15t middleware
+ * Creates CORS options configuration for Hono's cors middleware
  *
  * @param trustedOrigins - Array of allowed origin patterns or single string. Can include wildcards ('*').
  * If undefined, defaults to allowing all origins without credentials.
  *
- * @returns CORS configuration object with origin validation function and header settings
+ * @returns Hono CORS configuration object
  *
  * @example
  * ```ts
  * const corsOptions = createCORSOptions(['http://localhost:3000', 'https://example.com']);
+ * app.use('*', cors(corsOptions));
  * ```
- *
- * @throws {TypeError} When URL parsing fails in origin validation
  */
 export function createCORSOptions(
 	trustedOrigins?: string[] | string
-): CORSConfig {
+): CorsOptions {
 	// If trustedOrigins is undefined or empty, return default config that allows all origins
 	if (!trustedOrigins) {
-		return DEFAULT_CORS_CONFIG;
+		return {
+			origin: '*',
+			credentials: true,
+			allowHeaders: [...SUPPORTED_HEADERS],
+			maxAge: 600,
+			allowMethods: [...SUPPORTED_METHODS],
+			methods: [...SUPPORTED_METHODS],
+		};
 	}
 
 	// Convert string to array if needed
@@ -92,74 +138,20 @@ export function createCORSOptions(
 		? trustedOrigins
 		: [trustedOrigins];
 	if (origins.length === 0) {
-		return DEFAULT_CORS_CONFIG;
-	}
-
-	/**
-	 * Normalizes an origin string by removing protocol and www prefix
-	 *
-	 * @param origin - The origin URL to normalize
-	 * @returns Normalized origin string without protocol and www prefix
-	 *
-	 * @internal
-	 */
-	function normalizeOrigin(origin: string): string {
-		try {
-			// Handle bare domains like 'localhost' or 'example.com'
-			if (
-				!origin.includes('://') &&
-				!origin.includes(':') &&
-				!origin.includes('/')
-			) {
-				return origin.toLowerCase();
-			}
-			// Add protocol if missing
-			const originWithProtocol =
-				origin.startsWith('http://') ||
-				origin.startsWith('https://') ||
-				origin.startsWith('ws://') ||
-				origin.startsWith('wss://')
-					? origin
-					: `http://${origin}`;
-			const url = new URL(originWithProtocol);
-			const hostname = url.hostname.replace(WWW_REGEX, '');
-			// Return without protocol to match both http and https
-			return `${hostname}${url.port ? `:${url.port}` : ''}`;
-		} catch {
-			// Fallback: remove www manually and protocol
-			return origin.replace(PROTOCOL_WWW_REGEX, '').replace(WWW_REGEX, '');
-		}
-	}
-
-	/**
-	 * Expands a list of origins to include www variants
-	 *
-	 * @param origins - Array of origin strings to expand
-	 * @returns Array of origins including www variants
-	 *
-	 * @internal
-	 */
-	function expandWithWWW(origins: string[]): string[] {
-		const expanded = new Set<string>();
-		for (const origin of origins) {
-			if (origin === '*') {
-				expanded.add('*');
-				continue;
-			}
-			const normalized = normalizeOrigin(origin);
-			expanded.add(normalized);
-			// Add www version if not already present
-			if (!normalized.includes('www.')) {
-				expanded.add(`www.${normalized}`);
-			}
-		}
-		return Array.from(expanded);
+		return {
+			origin: '*',
+			credentials: true,
+			allowHeaders: [...SUPPORTED_HEADERS],
+			maxAge: 600,
+			allowMethods: [...SUPPORTED_METHODS],
+			methods: [...SUPPORTED_METHODS],
+		};
 	}
 
 	const expandedTrusted = expandWithWWW(origins);
 
-	const returnConfig = {
-		origin: async (origin: string) => {
+	return {
+		origin: (origin) => {
 			if (!origin) {
 				return '*';
 			}
@@ -186,10 +178,9 @@ export function createCORSOptions(
 			return isTrusted ? origin : null;
 		},
 		credentials: true,
-		allowHeaders: SUPPORTED_HEADERS,
+		allowHeaders: [...SUPPORTED_HEADERS],
 		maxAge: 600,
-		methods: SUPPORTED_METHODS,
+		allowMethods: [...SUPPORTED_METHODS],
+		methods: [...SUPPORTED_METHODS],
 	};
-
-	return returnConfig;
 }

package/src/middleware/cors/is-origin-trusted.ts

@@ -16,7 +16,8 @@ import type { Logger } from '@c15t/logger';
  *
  * @internal
  */
-export const STRIP_REGEX = /^(https?:\/\/)|(wss?:\/\/)|(\/+$)|:\d+/g;
+export const STRIP_REGEX =
+	/^(?:https?:\/\/)|^(?:wss?:\/\/)|(?:\/+$)|(?::\d+$)/g;
 
 /**
  * Checks if a domain matches a wildcard pattern

package/src/middleware/cors/process-cors.ts

@@ -5,7 +5,7 @@
  * @packageDocumentation
  */
 
-import type { C15TContext } from '~/types/context';
+import type { C15TContext } from '~/types';
 import { isOriginTrusted } from './is-origin-trusted';
 
 /**

package/src/middleware/openapi/config.ts

@@ -1,15 +1,17 @@
 import type { C15TOptions } from '~/types';
-import { version } from '../../version';
+import { version } from '~/version';
 /**
  * Default OpenAPI configuration
+ *
+ * Note: specPath and docsPath should NOT include the basePath,
+ * as the basePath is stripped from incoming requests before routing.
  */
 export const createOpenAPIConfig = (options: C15TOptions) => {
-	const basePath = options.basePath || '';
 	return {
-		enabled: true,
-		specPath: `${basePath}/spec.json`,
-		docsPath: `${basePath}/docs`,
-		...(options.openapi || {}),
+		enabled: options.advanced?.openapi?.enabled !== false,
+		specPath: '/spec.json',
+		docsPath: '/docs',
+		...(options.advanced?.openapi || {}),
 	};
 };
 

package/src/middleware/openapi/handlers.ts

@@ -1,103 +1,5 @@
-import { OpenAPIGenerator } from '@orpc/openapi';
-import { ZodToJsonSchemaConverter } from '@orpc/zod';
-import { router } from '~/router';
-import type { C15TContext, C15TOptions } from '~/types';
-import { createDefaultOpenAPIOptions, createOpenAPIConfig } from './config';
-
-/**
- * Type for the memoized OpenAPI spec function
- */
-type MemoizedSpecFunction = {
-	(): Promise<Record<string, unknown>>;
-	cached?: Record<string, unknown>;
-};
-
-/**
- * Merges user OpenAPI options with default options
- */
-const mergeOpenAPIOptions = (
-	defaultOptions: Record<string, unknown>,
-	userOptions: Record<string, unknown>
-): Record<string, unknown> => {
-	const merged = { ...defaultOptions };
-
-	// Handle nested info object specially
-	if (userOptions.info && typeof userOptions.info === 'object') {
-		merged.info = {
-			...(merged.info as Record<string, unknown>),
-			...userOptions.info,
-		};
-	}
-
-	// For all other top-level properties, override defaults
-	for (const [key, value] of Object.entries(userOptions)) {
-		if (key !== 'info') {
-			merged[key] = value;
-		}
-	}
-
-	return merged;
-};
-
-/**
- * Generate the OpenAPI specification document
- *
- * @param options - Configuration options for the OpenAPI spec generation
- * @returns A memoized function that generates and caches the OpenAPI spec
- *
- * @throws {Error} When the OpenAPI generator fails to create a valid spec
- *
- * @example
- * ```ts
- * const getSpec = createOpenAPISpec(options);
- * const spec = await getSpec();
- * ```
- */
-export const createOpenAPISpec = (
-	context: C15TContext,
-	options: C15TOptions
-) => {
-	// Initialize OpenAPI generator with schema converters
-	const openAPIGenerator = new OpenAPIGenerator({
-		schemaConverters: [new ZodToJsonSchemaConverter()],
-	});
-
-	// Memoise once per process
-	const getOpenAPISpec = (async (): Promise<Record<string, unknown>> => {
-		if (getOpenAPISpec.cached) {
-			return getOpenAPISpec.cached;
-		}
-
-		const defaultOptions = createDefaultOpenAPIOptions(options);
-		const mergedOptions = options.openapi?.options
-			? mergeOpenAPIOptions(
-					defaultOptions,
-					options.openapi.options as Record<string, unknown>
-				)
-			: defaultOptions;
-
-		try {
-			// We need to cast to the expected type due to incompatibilities between the types
-			// This is safe as we control the options format and it's compatible with what the generator expects
-			const spec = await openAPIGenerator.generate(
-				router,
-				mergedOptions as Record<string, unknown>
-			);
-			getOpenAPISpec.cached = spec;
-			return spec;
-		} catch (error) {
-			context.logger?.error('Failed to generate OpenAPI spec:', error);
-			// Return a minimal valid spec to prevent UI errors
-			return {
-				openapi: '3.0.0',
-				info: { title: options.appName || 'c15t API', version: '0.0.0' },
-				paths: {},
-			};
-		}
-	}) as MemoizedSpecFunction;
-
-	return getOpenAPISpec;
-};
+import type { C15TOptions } from '~/types';
+import { createOpenAPIConfig } from './config';
 
 /**
  * Generate the default UI for API documentation

package/src/middleware/openapi/index.ts

@@ -3,9 +3,10 @@
  *
  * This module provides OpenAPI functionality including:
  * - Configuration management
- * - Specification generation
  * - Documentation UI
+ *
+ * Note: OpenAPI spec generation is now handled by hono-openapi middleware.
  */
 
 export { createDefaultOpenAPIOptions, createOpenAPIConfig } from './config';
-export { createDocsUI, createOpenAPISpec } from './handlers';
+export { createDocsUI } from './handlers';

package/src/middleware/process-ip/index.test.ts

@@ -0,0 +1,195 @@
+import { describe, expect, it } from 'vitest';
+import type { C15TOptions } from '~/types';
+import { getIpAddress, maskIpAddress } from './index';
+
+describe('maskIpAddress', () => {
+	describe('IPv4 addresses', () => {
+		it('should mask the last octet of a standard IPv4 address', () => {
+			expect(maskIpAddress('192.168.1.100')).toBe('192.168.1.0');
+		});
+
+		it('should mask the last octet of localhost', () => {
+			expect(maskIpAddress('127.0.0.1')).toBe('127.0.0.0');
+		});
+
+		it('should mask the last octet of a public IP', () => {
+			expect(maskIpAddress('8.8.8.8')).toBe('8.8.8.0');
+		});
+
+		it('should handle IP with last octet already zero', () => {
+			expect(maskIpAddress('10.0.0.0')).toBe('10.0.0.0');
+		});
+
+		it('should handle IP with max values', () => {
+			expect(maskIpAddress('255.255.255.255')).toBe('255.255.255.0');
+		});
+	});
+
+	describe('IPv6 addresses', () => {
+		it('should mask the last 80 bits of a full IPv6 address', () => {
+			const result = maskIpAddress('2001:0db8:85a3:0000:0000:8a2e:0370:7334');
+			expect(result).toBe('2001:db8:85a3::');
+		});
+
+		it('should mask a compressed IPv6 address', () => {
+			const result = maskIpAddress('2001:db8:85a3::1');
+			expect(result).toBe('2001:db8:85a3::');
+		});
+
+		it('should handle localhost IPv6', () => {
+			const result = maskIpAddress('::1');
+			expect(result).toBe('::');
+		});
+
+		it('should handle full zeros IPv6', () => {
+			const result = maskIpAddress('::');
+			expect(result).toBe('::');
+		});
+
+		it('should mask IPv6 with leading zeros compressed', () => {
+			const result = maskIpAddress('::ffff:0:0:1');
+			expect(result).toBe('::');
+		});
+	});
+
+	describe('IPv4-mapped IPv6 addresses', () => {
+		it('should mask the IPv4 portion of IPv4-mapped IPv6', () => {
+			const result = maskIpAddress('::ffff:192.168.1.100');
+			expect(result).toBe('::ffff:192.168.1.0');
+		});
+
+		it('should handle IPv4-mapped IPv6 localhost', () => {
+			const result = maskIpAddress('::ffff:127.0.0.1');
+			expect(result).toBe('::ffff:127.0.0.0');
+		});
+	});
+
+	describe('edge cases', () => {
+		it('should return null for null input', () => {
+			expect(maskIpAddress(null)).toBeNull();
+		});
+
+		it('should return null for empty string', () => {
+			expect(maskIpAddress('')).toBeNull();
+		});
+
+		it('should handle malformed IPv4 gracefully', () => {
+			expect(maskIpAddress('192.168.1')).toBe('192.168.1');
+		});
+	});
+});
+
+describe('getIpAddress', () => {
+	const createMockHeaders = (headers: Record<string, string>): Headers => {
+		return new Headers(headers);
+	};
+
+	const createBaseOptions = (
+		ipAddressOverrides?: NonNullable<C15TOptions['advanced']>['ipAddress']
+	): C15TOptions => ({
+		trustedOrigins: ['http://localhost'],
+		adapter: {} as C15TOptions['adapter'],
+		advanced: {
+			ipAddress: ipAddressOverrides,
+		},
+	});
+
+	describe('IP extraction', () => {
+		it('should extract and mask IP from x-forwarded-for header by default', () => {
+			const headers = createMockHeaders({
+				'x-forwarded-for': '192.168.1.100, 10.0.0.1',
+			});
+			const options = createBaseOptions();
+
+			expect(getIpAddress(headers, options)).toBe('192.168.1.0');
+		});
+
+		it('should extract and mask IP from cf-connecting-ip header by default', () => {
+			const headers = createMockHeaders({
+				'cf-connecting-ip': '8.8.8.8',
+			});
+			const options = createBaseOptions();
+
+			expect(getIpAddress(headers, options)).toBe('8.8.8.0');
+		});
+
+		it('should return null when no IP headers present', () => {
+			const headers = createMockHeaders({});
+			const options = createBaseOptions();
+
+			expect(getIpAddress(headers, options)).toBeNull();
+		});
+	});
+
+	describe('IP tracking disabled', () => {
+		it('should return null when IP tracking is disabled', () => {
+			const headers = createMockHeaders({
+				'x-forwarded-for': '192.168.1.100',
+			});
+			const options = createBaseOptions({
+				tracking: false,
+			});
+
+			expect(getIpAddress(headers, options)).toBeNull();
+		});
+	});
+
+	describe('IP masking enabled', () => {
+		it('should mask IPv4 address when masking is enabled', () => {
+			const headers = createMockHeaders({
+				'x-forwarded-for': '192.168.1.100',
+			});
+			const options = createBaseOptions({
+				masking: true,
+			});
+
+			expect(getIpAddress(headers, options)).toBe('192.168.1.0');
+		});
+
+		it('should mask IPv6 address when masking is enabled', () => {
+			const headers = createMockHeaders({
+				'x-forwarded-for': '2001:db8:85a3::8a2e:370:7334',
+			});
+			const options = createBaseOptions({
+				masking: true,
+			});
+
+			expect(getIpAddress(headers, options)).toBe('2001:db8:85a3::');
+		});
+
+		it('should mask by default when masking is not explicitly disabled', () => {
+			const headers = createMockHeaders({
+				'x-forwarded-for': '192.168.1.100',
+			});
+			const options = createBaseOptions();
+
+			expect(getIpAddress(headers, options)).toBe('192.168.1.0');
+		});
+
+		it('should not mask when masking is explicitly false', () => {
+			const headers = createMockHeaders({
+				'x-forwarded-for': '192.168.1.100',
+			});
+			const options = createBaseOptions({
+				masking: false,
+			});
+
+			expect(getIpAddress(headers, options)).toBe('192.168.1.100');
+		});
+	});
+
+	describe('custom headers', () => {
+		it('should use custom IP headers when provided', () => {
+			const headers = createMockHeaders({
+				'x-custom-ip': '10.0.0.1',
+				'x-forwarded-for': '192.168.1.100',
+			});
+			const options = createBaseOptions({
+				ipAddressHeaders: ['x-custom-ip'],
+			});
+
+			// Masking is on by default, so last octet is zeroed
+			expect(getIpAddress(headers, options)).toBe('10.0.0.0');
+		});
+	});
+});