@clipr/worker 0.0.5 → 0.0.10

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @clipr/worker
 
+## 0.0.10
+
+### Patch Changes
+
+- Updated dependencies
+  - @clipr/core@0.0.11
+
+## 0.0.9
+
+### Patch Changes
+
+- Updated dependencies
+  - @clipr/core@0.0.10
+
+## 0.0.8
+
+### Patch Changes
+
+- Updated dependencies
+  - @clipr/core@0.0.9
+
+## 0.0.7
+
+### Patch Changes
+
+- Updated dependencies
+  - @clipr/core@0.0.8
+
+## 0.0.6
+
+### Patch Changes
+
+- Updated dependencies
+  - @clipr/core@0.0.7
+
 ## 0.0.5
 
 ### Patch Changes

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@clipr/worker",
-  "version": "0.0.5",
+  "version": "0.0.10",
   "description": "Cloudflare Worker for clipr URL redirects",
   "type": "module",
   "main": "./src/index.ts",
   "dependencies": {
     "hono": "^4.7.0",
     "qrcode": "^1.5.4",
-    "@clipr/core": "0.0.6"
+    "@clipr/core": "0.0.11"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250327.0",

package/src/crypto.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest';
+import { hashPassword, verifyPassword } from './crypto.js';
+
+describe('hashPassword', () => {
+  it('returns a string in salt:hash format', async () => {
+    const result = await hashPassword('mypassword');
+    const parts = result.split(':');
+    expect(parts).toHaveLength(2);
+    // Salt is 16 bytes = 32 hex chars
+    expect(parts[0]).toMatch(/^[0-9a-f]{32}$/);
+    // Hash is 256 bits = 32 bytes = 64 hex chars
+    expect(parts[1]).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it('produces different hashes for the same password (random salt)', async () => {
+    const a = await hashPassword('same');
+    const b = await hashPassword('same');
+    expect(a).not.toBe(b);
+  });
+});
+
+describe('verifyPassword', () => {
+  it('returns true for correct password', async () => {
+    const stored = await hashPassword('correct');
+    expect(await verifyPassword('correct', stored)).toBe(true);
+  });
+
+  it('returns false for wrong password', async () => {
+    const stored = await hashPassword('correct');
+    expect(await verifyPassword('wrong', stored)).toBe(false);
+  });
+
+  it('returns false for malformed stored hash (no colon)', async () => {
+    expect(await verifyPassword('anything', 'nocolonhere')).toBe(false);
+  });
+
+  it('returns false for malformed stored hash (empty parts)', async () => {
+    expect(await verifyPassword('anything', ':')).toBe(false);
+  });
+});

package/src/index.ts

@@ -1,6 +1,7 @@
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { authMiddleware } from './middleware/auth.js';
+import { rateLimitMiddleware } from './middleware/rate-limit.js';
 import { handleHealth } from './routes/health.js';
 import { handleExport, handleImport } from './routes/import-export.js';
 import {
@@ -37,8 +38,8 @@ app.get('/health', handleHealth);
 app.get('/password/:code', handlePasswordPage);
 app.post('/password/:code', handlePasswordVerify);
 
-// --- API routes (protected by auth middleware) ---
-app.post('/api/shorten', handleShorten);
+// --- Public API (rate-limited, no auth) ---
+app.post('/api/shorten', rateLimitMiddleware, handleShorten);
 
 app.get('/api/links', handleListLinks);
 app.get('/api/links/:code', handleGetLink);

package/src/middleware/auth.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, it } from 'vitest';
+import app from '../index.js';
+import { createMockKV } from '../test-utils.js';
+
+const ENV = (kv: KVNamespace) => ({
+  URLS: kv,
+  API_TOKEN: 'test-token',
+  BASE_URL: 'https://test.sh',
+});
+
+describe('auth middleware', () => {
+  // --- Public routes pass without token ---
+  it('allows GET /health without token', async () => {
+    const kv = createMockKV();
+    const res = await app.request('/health', {}, ENV(kv));
+    expect(res.status).toBe(200);
+  });
+
+  it('allows GET /:slug without token (redirect/404)', async () => {
+    const kv = createMockKV();
+    const res = await app.request('/some-slug', {}, ENV(kv));
+    // No entry seeded, so it returns 404 — but NOT 401
+    expect(res.status).toBe(404);
+  });
+
+  // --- API routes require token ---
+  it('returns 401 for API route without Authorization header', async () => {
+    const kv = createMockKV();
+    const res = await app.request('/api/links', {}, ENV(kv));
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toMatch(/Missing Authorization/);
+  });
+
+  it('returns 401 for API route with wrong token', async () => {
+    const kv = createMockKV();
+    const res = await app.request(
+      '/api/links',
+      { headers: { Authorization: 'Bearer wrong-token' } },
+      ENV(kv),
+    );
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toMatch(/Invalid API token/);
+  });
+
+  it('returns 401 for malformed Authorization header', async () => {
+    const kv = createMockKV();
+    const res = await app.request(
+      '/api/links',
+      { headers: { Authorization: 'Basic abc123' } },
+      ENV(kv),
+    );
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toMatch(/Invalid Authorization format/);
+  });
+
+  it('allows API route with correct Bearer token', async () => {
+    const kv = createMockKV();
+    const res = await app.request(
+      '/api/links',
+      { headers: { Authorization: 'Bearer test-token' } },
+      ENV(kv),
+    );
+    expect(res.status).toBe(200);
+  });
+
+  it('allows POST /password/:code without token', async () => {
+    const kv = createMockKV();
+    const res = await app.request(
+      '/password/some-code',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: 'password=test',
+      },
+      ENV(kv),
+    );
+    // The route may return 404 if link not found, but NOT 401
+    expect(res.status).not.toBe(401);
+  });
+});

package/src/middleware/auth.ts

@@ -5,6 +5,7 @@ import type { Env } from '../types.js';
 const PUBLIC_PATTERNS = [
   /^\/health$/,
   /^\/password\/[^/]+$/,
+  /^\/api\/shorten$/, // POST /api/shorten is public (rate-limited separately)
   /^\/[^/]+$/, // GET /:slug redirect
 ];
 
@@ -20,22 +21,16 @@ export async function authMiddleware(
   const path = new URL(c.req.url).pathname;
   const method = c.req.method;
 
-  // Skip auth for public routes
-  if (method === 'GET') {
-    for (const pattern of PUBLIC_PATTERNS) {
-      if (pattern.test(path)) {
+  // Skip auth for public routes (GET + specific POST routes)
+  for (const pattern of PUBLIC_PATTERNS) {
+    if (pattern.test(path)) {
+      if (method === 'GET' || method === 'POST') {
         await next();
         return;
       }
     }
   }
 
-  // POST /password/:code is also public
-  if (method === 'POST' && /^\/password\/[^/]+$/.test(path)) {
-    await next();
-    return;
-  }
-
   const authHeader = c.req.header('Authorization');
   if (!authHeader) {
     return c.json({ error: 'Missing Authorization header' }, 401);

package/src/middleware/rate-limit.ts

@@ -0,0 +1,33 @@
+import type { Context, Next } from 'hono';
+import type { Env } from '../types.js';
+
+const RATE_LIMIT = 100; // requests per window
+const WINDOW_SECONDS = 3600; // 1 hour
+
+/**
+ * Rate limiting middleware for public endpoints.
+ * Uses Cloudflare KV with TTL expiration.
+ * Limits by IP address: 100 requests per hour.
+ */
+export async function rateLimitMiddleware(
+  c: Context<{ Bindings: Env }>,
+  next: Next,
+): Promise<undefined | Response> {
+  const ip = c.req.header('cf-connecting-ip') || c.req.header('x-forwarded-for') || 'unknown';
+  const key = `ratelimit:${ip}`;
+
+  const current = await c.env.URLS.get(key, 'text');
+  const count = current ? Number.parseInt(current, 10) : 0;
+
+  if (count >= RATE_LIMIT) {
+    return c.json({ error: 'Rate limit exceeded. Maximum 100 URLs per hour.' }, 429);
+  }
+
+  await c.env.URLS.put(key, String(count + 1), { expirationTtl: WINDOW_SECONDS });
+
+  // Set rate limit headers
+  c.header('X-RateLimit-Limit', String(RATE_LIMIT));
+  c.header('X-RateLimit-Remaining', String(RATE_LIMIT - count - 1));
+
+  await next();
+}