@de-otio/trellis 0.4.0

package/dist/lib/mfa/totp-service.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * TOTP Service (AUTH-1)
+ *
+ * Implements RFC 6238 TOTP generation and verification using Web Crypto API.
+ * No external dependencies — uses only the Web Crypto API available in
+ * Cloudflare Workers and modern runtimes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSecret = generateSecret;
+exports.generateTOTP = generateTOTP;
+exports.verifyTOTP = verifyTOTP;
+exports.buildOTPAuthURI = buildOTPAuthURI;
+exports.generateBackupCodes = generateBackupCodes;
+exports.hashBackupCode = hashBackupCode;
+exports.encryptSecret = encryptSecret;
+exports.decryptSecret = decryptSecret;
+const TOTP_PERIOD = 30; // seconds
+const TOTP_DIGITS = 6;
+const SECRET_LENGTH = 20; // bytes (160-bit, standard for TOTP)
+/**
+ * Generate a random TOTP secret (base32-encoded).
+ */
+function generateSecret() {
+    const bytes = crypto.getRandomValues(new Uint8Array(SECRET_LENGTH));
+    return base32Encode(bytes);
+}
+/**
+ * Generate a TOTP code for a given secret and time.
+ */
+async function generateTOTP(secret, time) {
+    const now = time ?? Math.floor(Date.now() / 1000);
+    const counter = Math.floor(now / TOTP_PERIOD);
+    return hmacBasedOTP(secret, counter);
+}
+/**
+ * Verify a TOTP code against a secret.
+ * Allows a window of ±1 period to account for clock skew.
+ */
+async function verifyTOTP(secret, code, window = 1) {
+    if (!code || code.length !== TOTP_DIGITS)
+        return false;
+    const now = Math.floor(Date.now() / 1000);
+    const currentCounter = Math.floor(now / TOTP_PERIOD);
+    for (let i = -window; i <= window; i++) {
+        const expected = await hmacBasedOTP(secret, currentCounter + i);
+        if (constantTimeEqual(code, expected)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Build an otpauth:// URI for QR code generation.
+ */
+function buildOTPAuthURI(secret, email, issuer = "Trellis") {
+    const encodedIssuer = encodeURIComponent(issuer);
+    const encodedEmail = encodeURIComponent(email);
+    return `otpauth://totp/${encodedIssuer}:${encodedEmail}?secret=${secret}&issuer=${encodedIssuer}&algorithm=SHA1&digits=${TOTP_DIGITS}&period=${TOTP_PERIOD}`;
+}
+/**
+ * Generate backup codes (10 codes, 8 alphanumeric chars each).
+ */
+function generateBackupCodes(count = 10) {
+    const codes = [];
+    const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"; // no ambiguous I/O/0/1
+    for (let i = 0; i < count; i++) {
+        const bytes = crypto.getRandomValues(new Uint8Array(8));
+        let code = "";
+        for (const b of bytes) {
+            code += chars[b % chars.length];
+        }
+        // Format as XXXX-XXXX for readability
+        codes.push(`${code.slice(0, 4)}-${code.slice(4)}`);
+    }
+    return codes;
+}
+/**
+ * Hash a backup code for storage using SHA-256.
+ */
+async function hashBackupCode(code) {
+    const normalized = code.replace(/-/g, "").toUpperCase();
+    const encoded = new TextEncoder().encode(normalized);
+    const hash = await crypto.subtle.digest("SHA-256", encoded);
+    return arrayToHex(new Uint8Array(hash));
+}
+/**
+ * Encrypt a TOTP secret for database storage using AES-GCM.
+ */
+async function encryptSecret(secret, encryptionKey) {
+    const keyData = new TextEncoder().encode(encryptionKey.padEnd(32, "0").slice(0, 32));
+    const key = await crypto.subtle.importKey("raw", keyData, { name: "AES-GCM" }, false, ["encrypt"]);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const encoded = new TextEncoder().encode(secret);
+    const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, encoded);
+    // Combine IV + ciphertext and base64 encode
+    const combined = new Uint8Array(iv.length + encrypted.byteLength);
+    combined.set(iv);
+    combined.set(new Uint8Array(encrypted), iv.length);
+    return btoa(String.fromCharCode(...combined));
+}
+/**
+ * Decrypt a TOTP secret from database storage.
+ */
+async function decryptSecret(encryptedSecret, encryptionKey) {
+    const keyData = new TextEncoder().encode(encryptionKey.padEnd(32, "0").slice(0, 32));
+    const key = await crypto.subtle.importKey("raw", keyData, { name: "AES-GCM" }, false, ["decrypt"]);
+    const combined = Uint8Array.from(atob(encryptedSecret), (c) => c.charCodeAt(0));
+    const iv = combined.slice(0, 12);
+    const ciphertext = combined.slice(12);
+    const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
+    return new TextDecoder().decode(decrypted);
+}
+// --- Internal helpers ---
+async function hmacBasedOTP(base32Secret, counter) {
+    const secretBytes = base32Decode(base32Secret);
+    const key = await crypto.subtle.importKey("raw", secretBytes.buffer, { name: "HMAC", hash: "SHA-1" }, false, ["sign"]);
+    // Counter as 8-byte big-endian
+    const counterBytes = new ArrayBuffer(8);
+    const view = new DataView(counterBytes);
+    view.setUint32(4, counter, false); // low 32 bits
+    const hmac = await crypto.subtle.sign("HMAC", key, counterBytes);
+    const hmacBytes = new Uint8Array(hmac);
+    // Dynamic truncation (RFC 4226)
+    const offset = hmacBytes[hmacBytes.length - 1] & 0x0f;
+    const code = ((hmacBytes[offset] & 0x7f) << 24) |
+        ((hmacBytes[offset + 1] & 0xff) << 16) |
+        ((hmacBytes[offset + 2] & 0xff) << 8) |
+        (hmacBytes[offset + 3] & 0xff);
+    return String(code % 10 ** TOTP_DIGITS).padStart(TOTP_DIGITS, "0");
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+}
+// Base32 encoding/decoding (RFC 4648)
+const BASE32_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(data) {
+    let bits = 0;
+    let value = 0;
+    let output = "";
+    for (const byte of data) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_CHARS[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_CHARS[(value << (5 - bits)) & 31];
+    }
+    return output;
+}
+function base32Decode(encoded) {
+    const cleaned = encoded.replace(/=+$/, "").toUpperCase();
+    const output = [];
+    let bits = 0;
+    let value = 0;
+    for (const char of cleaned) {
+        const idx = BASE32_CHARS.indexOf(char);
+        if (idx === -1)
+            continue;
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            output.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return new Uint8Array(output);
+}
+function arrayToHex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+//# sourceMappingURL=totp-service.js.map

package/dist/lib/mfa/totp-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-service.js","sourceRoot":"","sources":["../../../src/lib/mfa/totp-service.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AASH,wCAGC;AAKD,oCAOC;AAMD,gCAkBC;AAKD,0CAQC;AAKD,kDAaC;AAKD,wCAKC;AAKD,sCA0BC;AAKD,sCA0BC;AArJD,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,UAAU;AAClC,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC,qCAAqC;AAE/D;;GAEG;AACH,SAAgB,cAAc;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACpE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,IAAa;IAEb,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC;IAC9C,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAY,EACZ,SAAiB,CAAC;IAElB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAEvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC;IAErD,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAC7B,MAAc,EACd,KAAa,EACb,SAAiB,SAAS;IAE1B,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,kBAAkB,aAAa,IAAI,YAAY,WAAW,MAAM,WAAW,aAAa,0BAA0B,WAAW,WAAW,WAAW,EAAE,CAAC;AAC/J,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,QAAgB,EAAE;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,kCAAkC,CAAC,CAAC,uBAAuB;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,IAAI,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,sCAAsC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,aAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,OAAO,CACR,CAAC;IAEF,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CACjC,eAAuB,EACvB,aAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC5D,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAChB,CAAC;IACF,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,UAAU,CACX,CAAC;IAEF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,2BAA2B;AAE3B,KAAK,UAAU,YAAY,CACzB,YAAoB,EACpB,OAAe;IAEf,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,WAAW,CAAC,MAAqB,EACjC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAC/B,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,+BAA+B;IAC/B,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc;IAEjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAEvC,gCAAgC;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IACtD,MAAM,IAAI,GACR,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEjC,OAAO,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,sCAAsC;AACtC,MAAM,YAAY,GAAG,kCAAkC,CAAC;AAExD,SAAS,YAAY,CAAC,IAAgB;IACpC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACpD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAS;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}

package/dist/lib/middleware/comment-rate-limit.d.ts

@@ -0,0 +1,19 @@
+import type { KVNamespace } from "../../types/cloudflare-compat";
+export interface RateLimitResult {
+    allowed: boolean;
+    retryAfter?: number;
+    remaining?: number;
+}
+export interface CommentRateLimitEnv {
+    RATE_LIMIT_KV?: KVNamespace;
+}
+/**
+ * Check rate limits for comment creation
+ *
+ * @param userId - User ID creating the comment
+ * @param postId - Post ID the comment is on
+ * @param env - Environment with KV binding
+ * @returns Rate limit result with allowed status and retry information
+ */
+export declare function commentRateLimit(userId: string, postId: string, env: CommentRateLimitEnv): Promise<RateLimitResult>;
+//# sourceMappingURL=comment-rate-limit.d.ts.map

package/dist/lib/middleware/comment-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/middleware/comment-rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,+BAA+B,CAAC;AAmB5F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,eAAe,CAAC,CAkH1B"}

package/dist/lib/middleware/comment-rate-limit.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commentRateLimit = commentRateLimit;
+/**
+ * Comment Rate Limiting Middleware
+ *
+ * Implements distributed rate limiting for comment creation using Cloudflare KV.
+ *
+ * Rate Limits:
+ * - Per-post: 1 comment per user per 30 seconds (prevents rapid duplicate posts)
+ * - Per-user global: 10 comments per minute (prevents spam across posts)
+ *
+ * Design:
+ * - Uses Cloudflare KV for distributed state across Workers
+ * - Fail-open strategy: If KV is unavailable, allow the request (don't block legitimate users)
+ * - Returns retry-after time for HTTP 429 responses
+ */
+const logger_1 = require("../logger");
+/**
+ * Check rate limits for comment creation
+ *
+ * @param userId - User ID creating the comment
+ * @param postId - Post ID the comment is on
+ * @param env - Environment with KV binding
+ * @returns Rate limit result with allowed status and retry information
+ */
+async function commentRateLimit(userId, postId, env) {
+    const kv = env.RATE_LIMIT_KV;
+    // Fail-open if KV not available - don't block users due to infrastructure issues
+    if (!kv) {
+        logger_1.Logger.getInstance(env).warn("[CommentRateLimit] RATE_LIMIT_KV not configured - rate limiting disabled");
+        return { allowed: true };
+    }
+    try {
+        const now = Date.now();
+        // Check 1: Per-post rate limit (30 seconds between comments on same post)
+        const postKey = `rate:comment:post:${postId}:${userId}`;
+        const lastPostComment = await kv.get(postKey);
+        if (lastPostComment) {
+            const lastTime = parseInt(lastPostComment, 10);
+            const timeSince = now - lastTime;
+            const waitTime = 30000; // 30 seconds in milliseconds
+            if (timeSince < waitTime) {
+                const retryAfter = Math.ceil((waitTime - timeSince) / 1000);
+                logger_1.Logger.getInstance(env).info(`[CommentRateLimit] Per-post limit hit for user ${userId} on post ${postId}. Wait ${retryAfter}s`, { userId, postId, timeSince, retryAfter });
+                return {
+                    allowed: false,
+                    retryAfter,
+                    remaining: 0,
+                };
+            }
+        }
+        // Check 2: Per-user global rate limit (10 comments per minute across all posts)
+        const userKey = `rate:comment:user:${userId}`;
+        const userLimitData = await kv.get(userKey);
+        let commentCount = 0;
+        let windowStart = now;
+        if (userLimitData) {
+            try {
+                const parsed = JSON.parse(userLimitData);
+                windowStart = parsed.windowStart;
+                commentCount = parsed.count || 0;
+                // Check if window has expired (60 seconds)
+                const windowAge = now - windowStart;
+                if (windowAge > 60000) {
+                    // Window expired, reset counter
+                    commentCount = 0;
+                    windowStart = now;
+                }
+            }
+            catch (parseError) {
+                // If parsing fails, reset the window
+                logger_1.Logger.getInstance(env).warn("[CommentRateLimit] Failed to parse user limit data - resetting", parseError);
+                commentCount = 0;
+                windowStart = now;
+            }
+        }
+        const maxPerMinute = 10;
+        if (commentCount >= maxPerMinute) {
+            const windowAge = now - windowStart;
+            const retryAfter = Math.ceil((60000 - windowAge) / 1000);
+            logger_1.Logger.getInstance(env).info(`[CommentRateLimit] Per-user global limit hit for user ${userId}. Wait ${retryAfter}s`, { userId, commentCount, maxPerMinute, retryAfter });
+            return {
+                allowed: false,
+                retryAfter,
+                remaining: 0,
+            };
+        }
+        // Rate limits passed - update KV entries
+        // Update per-post rate limit (expires in 60 seconds)
+        await kv.put(postKey, now.toString(), {
+            expirationTtl: 60,
+        });
+        // Update per-user global rate limit (expires in 60 seconds)
+        const newCount = commentCount + 1;
+        await kv.put(userKey, JSON.stringify({
+            windowStart,
+            count: newCount,
+        }), {
+            expirationTtl: 60,
+        });
+        return {
+            allowed: true,
+            remaining: maxPerMinute - newCount,
+        };
+    }
+    catch (error) {
+        // Fail-open on errors - log but allow request
+        logger_1.Logger.getInstance(env).error("[CommentRateLimit] Error checking rate limit - allowing request", error);
+        return { allowed: true };
+    }
+}
+//# sourceMappingURL=comment-rate-limit.js.map

package/dist/lib/middleware/comment-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-rate-limit.js","sourceRoot":"","sources":["../../../src/lib/middleware/comment-rate-limit.ts"],"names":[],"mappings":";;AAqCA,4CAsHC;AA1JD;;;;;;;;;;;;;GAaG;AAGH,sCAAmC;AAYnC;;;;;;;GAOG;AACI,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,MAAc,EACd,GAAwB;IAExB,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC;IAE7B,iFAAiF;IACjF,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,eAAM,CAAC,WAAW,CAAC,GAAU,CAAC,CAAC,IAAI,CACjC,0EAA0E,CAC3E,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,0EAA0E;QAC1E,MAAM,OAAO,GAAG,qBAAqB,MAAM,IAAI,MAAM,EAAE,CAAC;QACxD,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE9C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC;YACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,6BAA6B;YAErD,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC5D,eAAM,CAAC,WAAW,CAAC,GAAU,CAAC,CAAC,IAAI,CACjC,kDAAkD,MAAM,YAAY,MAAM,UAAU,UAAU,GAAG,EACjG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1C,CAAC;gBACF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,UAAU;oBACV,SAAS,EAAE,CAAC;iBACb,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,MAAM,OAAO,GAAG,qBAAqB,MAAM,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,WAAW,GAAG,GAAG,CAAC;QAEtB,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACzC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBACjC,YAAY,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;gBAEjC,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,GAAG,GAAG,WAAW,CAAC;gBACpC,IAAI,SAAS,GAAG,KAAK,EAAE,CAAC;oBACtB,gCAAgC;oBAChC,YAAY,GAAG,CAAC,CAAC;oBACjB,WAAW,GAAG,GAAG,CAAC;gBACpB,CAAC;YACH,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,qCAAqC;gBACrC,eAAM,CAAC,WAAW,CAAC,GAAU,CAAC,CAAC,IAAI,CACjC,gEAAgE,EAChE,UAAU,CACX,CAAC;gBACF,YAAY,GAAG,CAAC,CAAC;gBACjB,WAAW,GAAG,GAAG,CAAC;YACpB,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,CAAC;QACxB,IAAI,YAAY,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,GAAG,GAAG,WAAW,CAAC;YACpC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;YACzD,eAAM,CAAC,WAAW,CAAC,GAAU,CAAC,CAAC,IAAI,CACjC,yDAAyD,MAAM,UAAU,UAAU,GAAG,EACtF,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,CACnD,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU;gBACV,SAAS,EAAE,CAAC;aACb,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,qDAAqD;QACrD,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE;YACpC,aAAa,EAAE,EAAE;SAClB,CAAC,CAAC;QAEH,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,YAAY,GAAG,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,IAAI,CAAC,SAAS,CAAC;YACb,WAAW;YACX,KAAK,EAAE,QAAQ;SAChB,CAAC,EACF;YACE,aAAa,EAAE,EAAE;SAClB,CACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,YAAY,GAAG,QAAQ;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8CAA8C;QAC9C,eAAM,CAAC,WAAW,CAAC,GAAU,CAAC,CAAC,KAAK,CAClC,iEAAiE,EACjE,KAAK,CACN,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/lib/middleware/feature-toggle-rate-limit.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Feature Toggle Rate Limiting Middleware
+ *
+ * Rate limiting middleware specifically for feature toggle API endpoints.
+ * Uses the existing RateLimiter class with Cloudflare KV for distributed state.
+ *
+ * Strategy:
+ * - Public API: 100 requests/minute per IP (complemented by Cloudflare edge rules)
+ * - Admin API: 1000 requests/minute per user (requires authentication)
+ *
+ * Note: Cloudflare Rate Limiting Rules should be configured at the edge level
+ * for IP-based protection. This middleware provides per-user limits and
+ * rate limit headers for API consumers.
+ */
+import type { Env } from "../../env";
+/**
+ * Rate limit result with headers
+ */
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    resetAt: number;
+    headers: Record<string, string>;
+}
+/**
+ * Rate limit the public feature toggle API
+ *
+ * Limits: 100 requests/minute per IP address
+ *
+ * @param request - Request object
+ * @param env - Environment variables
+ * @returns Rate limit result with headers, or null if rate limit exceeded
+ */
+export declare function rateLimitFeatureToggleAPI(request: Request, env: Env): Promise<RateLimitResult | null>;
+/**
+ * Rate limit the admin feature toggle API
+ *
+ * Limits: 1000 requests/minute per authenticated user
+ *
+ * @param request - Request object
+ * @param env - Environment variables
+ * @param userId - Authenticated user ID (required for admin API)
+ * @returns Rate limit result with headers, or null if rate limit exceeded
+ */
+export declare function rateLimitAdminFeatureToggleAPI(request: Request, env: Env, userId: string): Promise<RateLimitResult | null>;
+/**
+ * Create rate limit error response
+ *
+ * @param rateLimitResult - Rate limit result with headers
+ * @returns HTTP 429 response with rate limit information
+ */
+export declare function createRateLimitErrorResponse(rateLimitResult: RateLimitResult): Response;
+//# sourceMappingURL=feature-toggle-rate-limit.d.ts.map

package/dist/lib/middleware/feature-toggle-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-toggle-rate-limit.d.ts","sourceRoot":"","sources":["../../../src/lib/middleware/feature-toggle-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAoBrC;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAkDjC;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAsEjC;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,eAAe,EAAE,eAAe,GAC/B,QAAQ,CAiBV"}

package/dist/lib/middleware/feature-toggle-rate-limit.js

@@ -0,0 +1,164 @@
+"use strict";
+/**
+ * Feature Toggle Rate Limiting Middleware
+ *
+ * Rate limiting middleware specifically for feature toggle API endpoints.
+ * Uses the existing RateLimiter class with Cloudflare KV for distributed state.
+ *
+ * Strategy:
+ * - Public API: 100 requests/minute per IP (complemented by Cloudflare edge rules)
+ * - Admin API: 1000 requests/minute per user (requires authentication)
+ *
+ * Note: Cloudflare Rate Limiting Rules should be configured at the edge level
+ * for IP-based protection. This middleware provides per-user limits and
+ * rate limit headers for API consumers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rateLimitFeatureToggleAPI = rateLimitFeatureToggleAPI;
+exports.rateLimitAdminFeatureToggleAPI = rateLimitAdminFeatureToggleAPI;
+exports.createRateLimitErrorResponse = createRateLimitErrorResponse;
+const rate_limit_1 = require("../rate-limit");
+const logger_1 = require("../logger");
+/**
+ * Rate limit configuration for feature toggle endpoints
+ */
+const RATE_LIMIT_CONFIG = {
+    // Public API limits (per IP)
+    public: {
+        limit: 100, // requests
+        windowSeconds: 60, // 1 minute
+    },
+    // Admin API limits (per user)
+    admin: {
+        limit: 1000, // requests
+        windowSeconds: 60, // 1 minute
+    },
+};
+/**
+ * Rate limit the public feature toggle API
+ *
+ * Limits: 100 requests/minute per IP address
+ *
+ * @param request - Request object
+ * @param env - Environment variables
+ * @returns Rate limit result with headers, or null if rate limit exceeded
+ */
+async function rateLimitFeatureToggleAPI(request, env) {
+    const rateLimiter = new rate_limit_1.RateLimiter();
+    const endpoint = "/api/feature-toggles";
+    // Get IP address from Cloudflare headers
+    const ip = request.headers.get("CF-Connecting-IP") ||
+        request.headers.get("X-Forwarded-For")?.split(",")[0] ||
+        "unknown";
+    // Check rate limit using KV (distributed)
+    const result = await rateLimiter.checkRateLimitKV(env, request, endpoint, RATE_LIMIT_CONFIG.public.limit, RATE_LIMIT_CONFIG.public.windowSeconds, undefined, // sessionId
+    undefined, // email
+    undefined);
+    // Build rate limit headers
+    const headers = {
+        "X-RateLimit-Limit": RATE_LIMIT_CONFIG.public.limit.toString(),
+        "X-RateLimit-Remaining": result.remaining.toString(),
+        "X-RateLimit-Reset": new Date(result.resetAt).toISOString(),
+    };
+    if (!result.allowed) {
+        // Rate limit exceeded - return result with headers for error response
+        return {
+            allowed: false,
+            remaining: 0,
+            resetAt: result.resetAt,
+            headers: {
+                ...headers,
+                "Retry-After": Math.ceil((result.resetAt - Date.now()) / 1000).toString(),
+            },
+        };
+    }
+    return {
+        allowed: true,
+        remaining: result.remaining,
+        resetAt: result.resetAt,
+        headers,
+    };
+}
+/**
+ * Rate limit the admin feature toggle API
+ *
+ * Limits: 1000 requests/minute per authenticated user
+ *
+ * @param request - Request object
+ * @param env - Environment variables
+ * @param userId - Authenticated user ID (required for admin API)
+ * @returns Rate limit result with headers, or null if rate limit exceeded
+ */
+async function rateLimitAdminFeatureToggleAPI(request, env, userId) {
+    // Validate userId is a non-empty string
+    if (!userId || typeof userId !== "string" || userId.length === 0) {
+        logger_1.Logger.getInstance(env).error(`[RateLimit] Invalid userId provided: ${typeof userId}`, userId);
+        // Return null to allow request (graceful degradation)
+        return null;
+    }
+    const rateLimiter = new rate_limit_1.RateLimiter();
+    const endpoint = "/api/admin/feature-toggles";
+    // Check rate limit using KV (distributed) - per user
+    const result = await rateLimiter.checkRateLimitKV(env, request, endpoint, RATE_LIMIT_CONFIG.admin.limit, RATE_LIMIT_CONFIG.admin.windowSeconds, undefined, // sessionId
+    undefined, // email
+    userId);
+    // If result is null or undefined, allow the request (graceful degradation)
+    if (!result) {
+        return {
+            allowed: true,
+            remaining: RATE_LIMIT_CONFIG.admin.limit,
+            resetAt: Date.now() + RATE_LIMIT_CONFIG.admin.windowSeconds * 1000,
+            headers: {
+                "X-RateLimit-Limit": RATE_LIMIT_CONFIG.admin.limit.toString(),
+                "X-RateLimit-Remaining": RATE_LIMIT_CONFIG.admin.limit.toString(),
+                "X-RateLimit-Reset": new Date(Date.now() + RATE_LIMIT_CONFIG.admin.windowSeconds * 1000).toISOString(),
+            },
+        };
+    }
+    // Build rate limit headers
+    const headers = {
+        "X-RateLimit-Limit": RATE_LIMIT_CONFIG.admin.limit.toString(),
+        "X-RateLimit-Remaining": result.remaining.toString(),
+        "X-RateLimit-Reset": new Date(result.resetAt).toISOString(),
+    };
+    if (!result.allowed) {
+        // Rate limit exceeded - return result with headers for error response
+        return {
+            allowed: false,
+            remaining: 0,
+            resetAt: result.resetAt,
+            headers: {
+                ...headers,
+                "Retry-After": Math.ceil((result.resetAt - Date.now()) / 1000).toString(),
+            },
+        };
+    }
+    return {
+        allowed: true,
+        remaining: result.remaining,
+        resetAt: result.resetAt,
+        headers,
+    };
+}
+/**
+ * Create rate limit error response
+ *
+ * @param rateLimitResult - Rate limit result with headers
+ * @returns HTTP 429 response with rate limit information
+ */
+function createRateLimitErrorResponse(rateLimitResult) {
+    return new Response(JSON.stringify({
+        error: {
+            code: "RATE_LIMIT_EXCEEDED",
+            message: "Rate limit exceeded. Please try again later.",
+            retryAfter: Math.ceil((rateLimitResult.resetAt - Date.now()) / 1000),
+        },
+    }), {
+        status: 429,
+        headers: {
+            "content-type": "application/json",
+            ...rateLimitResult.headers,
+        },
+    });
+}
+//# sourceMappingURL=feature-toggle-rate-limit.js.map

package/dist/lib/middleware/feature-toggle-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-toggle-rate-limit.js","sourceRoot":"","sources":["../../../src/lib/middleware/feature-toggle-rate-limit.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAyCH,8DAqDC;AAYD,wEA0EC;AAQD,oEAmBC;AA5MD,8CAA4C;AAC5C,sCAAmC;AAEnC;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACxB,6BAA6B;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,GAAG,EAAE,WAAW;QACvB,aAAa,EAAE,EAAE,EAAE,WAAW;KAC/B;IACD,8BAA8B;IAC9B,KAAK,EAAE;QACL,KAAK,EAAE,IAAI,EAAE,WAAW;QACxB,aAAa,EAAE,EAAE,EAAE,WAAW;KAC/B;CACO,CAAC;AAYX;;;;;;;;GAQG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,GAAQ;IAER,MAAM,WAAW,GAAG,IAAI,wBAAW,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;IAExC,yCAAyC;IACzC,MAAM,EAAE,GACN,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,SAAS,CAAC;IAEZ,0CAA0C;IAC1C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAC/C,GAAG,EACH,OAAO,EACP,QAAQ,EACR,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAC9B,iBAAiB,CAAC,MAAM,CAAC,aAAa,EACtC,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,QAAQ;IACnB,SAAS,CACV,CAAC;IAEF,2BAA2B;IAC3B,MAAM,OAAO,GAA2B;QACtC,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC9D,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE;QACpD,mBAAmB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;KAC5D,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,sEAAsE;QACtE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,aAAa,EAAE,IAAI,CAAC,IAAI,CACtB,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CACrC,CAAC,QAAQ,EAAE;aACb;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,GAAQ,EACR,MAAc;IAEd,wCAAwC;IACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,wCAAwC,OAAO,MAAM,EAAE,EACvD,MAAM,CACP,CAAC;QACF,sDAAsD;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,wBAAW,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,4BAA4B,CAAC;IAE9C,qDAAqD;IACrD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAC/C,GAAG,EACH,OAAO,EACP,QAAQ,EACR,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAC7B,iBAAiB,CAAC,KAAK,CAAC,aAAa,EACrC,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,QAAQ;IACnB,MAAM,CACP,CAAC;IAEF,2EAA2E;IAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK;YACxC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI;YAClE,OAAO,EAAE;gBACP,mBAAmB,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAC7D,uBAAuB,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE;gBACjE,mBAAmB,EAAE,IAAI,IAAI,CAC3B,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAC1D,CAAC,WAAW,EAAE;aAChB;SACF,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,MAAM,OAAO,GAA2B;QACtC,mBAAmB,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC7D,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE;QACpD,mBAAmB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;KAC5D,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,sEAAsE;QACtE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,aAAa,EAAE,IAAI,CAAC,IAAI,CACtB,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CACrC,CAAC,QAAQ,EAAE;aACb;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,eAAgC;IAEhC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,8CAA8C;YACvD,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;SACrE;KACF,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,eAAe,CAAC,OAAO;SAC3B;KACF,CACF,CAAC;AACJ,CAAC"}

package/dist/lib/middleware.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Middleware
+ *
+ * Provides middleware functionality for the route abstraction layer.
+ * Middleware can modify requests, responses, or short-circuit the request.
+ */
+import type { Env } from "../env";
+import type { RequestContext } from "./request-context";
+export interface MiddlewareContext {
+    request: Request;
+    env: Env;
+    requestContext?: RequestContext;
+    url: URL;
+    pathname: string;
+    method: string;
+}
+export type Middleware = (context: MiddlewareContext, next: () => Promise<Response>) => Promise<Response>;
+/**
+ * Compose multiple middleware functions
+ */
+export declare function composeMiddleware(middlewares: Middleware[]): Middleware;
+/**
+ * CORS middleware
+ */
+export declare function corsMiddleware(): Middleware;
+/**
+ * Security headers middleware
+ */
+export declare function securityHeadersMiddleware(env: Env): Middleware;
+/**
+ * Rate limiting middleware
+ *
+ * Limits the number of requests a user can make within a time window.
+ * Uses sliding window algorithm with KV storage.
+ *
+ * @param options - Configuration options
+ * @param options.maxRequests - Maximum requests allowed in the window (default: 20)
+ * @param options.windowMs - Time window in milliseconds (default: 60000 = 1 minute)
+ * @param options.keyPrefix - KV key prefix (default: 'rate_limit')
+ */
+export declare function rateLimitMiddleware(options?: {
+    maxRequests?: number;
+    windowMs?: number;
+    keyPrefix?: string;
+}): Middleware;
+/**
+ * CSRF protection middleware
+ *
+ * Validates CSRF tokens for state-changing operations (POST, PUT, DELETE, PATCH).
+ * Uses Double Submit Cookie pattern: token stored in session cookie, validated against header.
+ * Skips validation for safe methods (GET, HEAD, OPTIONS).
+ *
+ * Requires:
+ * - Valid session (user must be authenticated)
+ * - X-CSRF-Token header with valid token
+ * - CSRF token in session (or KV fallback if configured)
+ */
+export declare function csrfMiddleware(): Middleware;
+/**
+ * MFA enforcement middleware (AUTH-1)
+ *
+ * Checks if the authenticated user has a role that requires MFA
+ * and whether their session has been MFA-verified. If MFA is
+ * required but not verified, returns 403 with an mfa_required error.
+ *
+ * This middleware should be placed AFTER authentication middleware
+ * on admin/sensitive routes.
+ */
+export declare function mfaMiddleware(): Middleware;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/lib/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/lib/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC1B,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAoBvE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,UAAU,CA6C3C;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,CAQ9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,UAAU,CA4Ib;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,IAAI,UAAU,CA2G3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,IAAI,UAAU,CAwD1C"}