@de-otio/trellis 0.4.0

package/dist/lib/middleware.js

@@ -0,0 +1,375 @@
+"use strict";
+/**
+ * Middleware
+ *
+ * Provides middleware functionality for the route abstraction layer.
+ * Middleware can modify requests, responses, or short-circuit the request.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.composeMiddleware = composeMiddleware;
+exports.corsMiddleware = corsMiddleware;
+exports.securityHeadersMiddleware = securityHeadersMiddleware;
+exports.rateLimitMiddleware = rateLimitMiddleware;
+exports.csrfMiddleware = csrfMiddleware;
+exports.mfaMiddleware = mfaMiddleware;
+/**
+ * Compose multiple middleware functions
+ */
+function composeMiddleware(middlewares) {
+    return async (context, next) => {
+        let index = -1;
+        async function dispatch(i) {
+            if (i <= index) {
+                throw new Error("next() called multiple times");
+            }
+            index = i;
+            if (i === middlewares.length) {
+                return next();
+            }
+            const middleware = middlewares[i];
+            return middleware(context, () => dispatch(i + 1));
+        }
+        return dispatch(0);
+    };
+}
+/**
+ * CORS middleware
+ */
+function corsMiddleware() {
+    return async (context, next) => {
+        const { request, env } = context;
+        const { CorsHandler } = await Promise.resolve().then(() => __importStar(require("./cors-handler")));
+        // Handle OPTIONS requests
+        if (request.method === "OPTIONS") {
+            const allowedOrigin = CorsHandler.getAllowedOrigin(request, env);
+            const headers = {
+                "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+                "Access-Control-Allow-Headers": "Content-Type, Authorization, X-CSRF-Token, X-Retry-Count",
+                "Access-Control-Allow-Credentials": "true",
+            };
+            if (allowedOrigin) {
+                headers["Access-Control-Allow-Origin"] = allowedOrigin;
+            }
+            return new Response(null, {
+                status: 204,
+                headers,
+            });
+        }
+        const response = await next();
+        // Add CORS headers to response
+        const allowedOrigin = CorsHandler.getAllowedOrigin(request, env);
+        if (allowedOrigin) {
+            response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+        }
+        response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
+        response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-CSRF-Token, X-Retry-Count");
+        response.headers.set("Access-Control-Allow-Credentials", "true");
+        return response;
+    };
+}
+/**
+ * Security headers middleware
+ */
+function securityHeadersMiddleware(env) {
+    return async (context, next) => {
+        const { SecurityHeaders } = await Promise.resolve().then(() => __importStar(require("./security-headers")));
+        const securityHeaders = new SecurityHeaders(env);
+        const response = await next();
+        return securityHeaders.addSecurityHeaders(response);
+    };
+}
+/**
+ * Rate limiting middleware
+ *
+ * Limits the number of requests a user can make within a time window.
+ * Uses sliding window algorithm with KV storage.
+ *
+ * @param options - Configuration options
+ * @param options.maxRequests - Maximum requests allowed in the window (default: 20)
+ * @param options.windowMs - Time window in milliseconds (default: 60000 = 1 minute)
+ * @param options.keyPrefix - KV key prefix (default: 'rate_limit')
+ */
+function rateLimitMiddleware(options) {
+    const maxRequests = options?.maxRequests ?? 20;
+    const windowMs = options?.windowMs ?? 60000; // 1 minute default
+    const keyPrefix = options?.keyPrefix ?? "rate_limit";
+    return async (context, next) => {
+        const { request, env, requestContext } = context;
+        // Get user identifier (userId from session or IP address as fallback)
+        const { SessionManager } = await Promise.resolve().then(() => __importStar(require("./session-manager")));
+        const { Secrets } = await Promise.resolve().then(() => __importStar(require("./secret-resolver")));
+        const sessionManager = new SessionManager();
+        let userIdentifier;
+        try {
+            const sessionSecret = Secrets.getSessionSecret(env);
+            const session = await sessionManager.getSession(request, sessionSecret, env);
+            userIdentifier = session?.userId ?? request.headers.get("CF-Connecting-IP") ?? "unknown";
+        }
+        catch {
+            // Fallback to IP if session retrieval fails
+            userIdentifier = request.headers.get("CF-Connecting-IP") ?? "unknown";
+        }
+        // Skip rate limiting if no KV namespace configured
+        if (!env.FEED_CACHE_KV) {
+            return next();
+        }
+        // Create rate limit key
+        const rateLimitKey = `${keyPrefix}:${userIdentifier}:${context.pathname}`;
+        const now = Date.now();
+        try {
+            // Get current request count from KV
+            const data = await env.FEED_CACHE_KV.get(rateLimitKey);
+            let requestCount = 0;
+            let windowStart = now;
+            if (data) {
+                const parsed = JSON.parse(data);
+                requestCount = parsed.count;
+                windowStart = parsed.windowStart;
+                // Check if window has expired
+                if (now - windowStart >= windowMs) {
+                    // Reset window
+                    requestCount = 0;
+                    windowStart = now;
+                }
+            }
+            // Check if rate limit exceeded
+            if (requestCount >= maxRequests) {
+                const retryAfter = Math.ceil((windowStart + windowMs - now) / 1000);
+                const { Logger } = await Promise.resolve().then(() => __importStar(require("./logger")));
+                Logger.getInstance(env).warn("[Rate Limit] Request rate limit exceeded", {
+                    pathname: context.pathname,
+                    userIdentifier,
+                    requestCount,
+                    maxRequests,
+                    retryAfter,
+                });
+                return new Response(JSON.stringify({
+                    error: "Rate limit exceeded",
+                    retryAfter,
+                    maxRequests,
+                    windowMs,
+                }), {
+                    status: 429,
+                    headers: {
+                        "content-type": "application/json",
+                        "retry-after": retryAfter.toString(),
+                        "x-ratelimit-limit": maxRequests.toString(),
+                        "x-ratelimit-remaining": "0",
+                        "x-ratelimit-reset": Math.ceil((windowStart + windowMs) / 1000).toString(),
+                    },
+                });
+            }
+            // Increment request count
+            requestCount++;
+            // Store updated count in KV
+            await env.FEED_CACHE_KV.put(rateLimitKey, JSON.stringify({ count: requestCount, windowStart }), { expirationTtl: Math.ceil(windowMs / 1000) + 10 });
+            // Proceed with request
+            const response = await next();
+            // Add rate limit headers to response
+            response.headers.set("x-ratelimit-limit", maxRequests.toString());
+            response.headers.set("x-ratelimit-remaining", Math.max(0, maxRequests - requestCount).toString());
+            response.headers.set("x-ratelimit-reset", Math.ceil((windowStart + windowMs) / 1000).toString());
+            return response;
+        }
+        catch (error) {
+            // Fail-closed for sensitive routes (admin and auth) — deny request if rate limiting fails
+            if (context.pathname.startsWith("/api/admin") || context.pathname.startsWith("/api/auth")) {
+                const { Logger } = await Promise.resolve().then(() => __importStar(require("./logger")));
+                Logger.getInstance(env).error("[Rate Limit] Rate limiting error on sensitive route, denying request", error);
+                return new Response(JSON.stringify({ error: "Service temporarily unavailable" }), {
+                    status: 503,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+            // Fail-open for other routes — log error and continue
+            const { Logger } = await Promise.resolve().then(() => __importStar(require("./logger")));
+            Logger.getInstance(env).error("[Rate Limit] Rate limiting error, allowing request", error);
+            return next();
+        }
+    };
+}
+/**
+ * CSRF protection middleware
+ *
+ * Validates CSRF tokens for state-changing operations (POST, PUT, DELETE, PATCH).
+ * Uses Double Submit Cookie pattern: token stored in session cookie, validated against header.
+ * Skips validation for safe methods (GET, HEAD, OPTIONS).
+ *
+ * Requires:
+ * - Valid session (user must be authenticated)
+ * - X-CSRF-Token header with valid token
+ * - CSRF token in session (or KV fallback if configured)
+ */
+function csrfMiddleware() {
+    return async (context, next) => {
+        const { request, env } = context;
+        // Skip for safe methods
+        if (["GET", "HEAD", "OPTIONS"].includes(request.method)) {
+            return next();
+        }
+        // Skip CSRF for JWT-authenticated requests (Bearer token with 3 dot-separated parts).
+        // CSRF protection is only needed for cookie-based auth where the browser auto-sends cookies.
+        // JWT in Authorization header is not vulnerable to CSRF since the attacker cannot set headers.
+        // SECURITY INVARIANT: This bypass is safe because all state-changing routes
+        // require authentication and reject unauthenticated requests BEFORE performing
+        // any side effects. An invalid JWT (e.g., "a.b.c") will pass CSRF but fail auth.
+        const bearerHeader = request.headers.get("Authorization");
+        if (bearerHeader?.startsWith("Bearer ")) {
+            const bearerToken = bearerHeader.slice(7);
+            if (bearerToken.split(".").length === 3) {
+                return next();
+            }
+        }
+        // Get session
+        const { SessionManager } = await Promise.resolve().then(() => __importStar(require("./session-manager")));
+        const { Secrets } = await Promise.resolve().then(() => __importStar(require("./secret-resolver")));
+        const sessionManager = new SessionManager();
+        // Get session secret with proper error handling
+        let sessionSecret;
+        try {
+            sessionSecret = Secrets.getSessionSecret(env);
+            if (!sessionSecret || typeof sessionSecret !== "string") {
+                // If we can't get the secret, skip CSRF validation (let auth middleware handle it)
+                return next();
+            }
+        }
+        catch (error) {
+            // If secret retrieval fails, skip CSRF validation (let auth middleware handle it)
+            return next();
+        }
+        const authHeader = request.headers.get("Authorization");
+        const session = await sessionManager.getSession(request, sessionSecret, env);
+        // If no session, let authentication middleware handle it
+        // CSRF protection only applies to authenticated requests
+        if (!session) {
+            const { Logger } = await Promise.resolve().then(() => __importStar(require("./logger")));
+            Logger.getInstance(env).debug("[CSRF Middleware] No session found, skipping CSRF check", {
+                pathname: context.pathname,
+                hasCookie: !!request.headers.get("Cookie"),
+                hasAuthHeader: !!authHeader,
+            });
+            return next();
+        }
+        // Validate CSRF token
+        const token = request.headers.get("X-CSRF-Token");
+        if (!token) {
+            const { Logger } = await Promise.resolve().then(() => __importStar(require("./logger")));
+            Logger.getInstance(env).warn("[CSRF Middleware] CSRF token required but missing", {
+                pathname: context.pathname,
+                userId: session.userId,
+                hasCookie: !!request.headers.get("Cookie"),
+                hasAuthHeader: !!authHeader,
+            });
+            return new Response(JSON.stringify({ error: "CSRF token required" }), {
+                status: 403,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        const { CSRFProtection } = await Promise.resolve().then(() => __importStar(require("./csrf")));
+        const isValid = await CSRFProtection.validateToken(token, session, env);
+        if (!isValid) {
+            const { Logger } = await Promise.resolve().then(() => __importStar(require("./logger")));
+            Logger.getInstance(env).warn("[CSRF Middleware] Token validation failed", {
+                pathname: context.pathname,
+                method: request.method,
+                userId: session.userId,
+                hasTokenInHeader: !!token,
+                hasTokenInSession: !!session.csrfToken,
+                tokenPreview: token?.substring(0, 8) + "...",
+                sessionTokenPreview: session.csrfToken?.substring(0, 8) + "...",
+            });
+            return new Response(JSON.stringify({ error: "Invalid CSRF token" }), {
+                status: 403,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        return next();
+    };
+}
+/**
+ * MFA enforcement middleware (AUTH-1)
+ *
+ * Checks if the authenticated user has a role that requires MFA
+ * and whether their session has been MFA-verified. If MFA is
+ * required but not verified, returns 403 with an mfa_required error.
+ *
+ * This middleware should be placed AFTER authentication middleware
+ * on admin/sensitive routes.
+ */
+function mfaMiddleware() {
+    return async (context, next) => {
+        const { request, env } = context;
+        const { SessionManager } = await Promise.resolve().then(() => __importStar(require("./session-manager")));
+        const { Secrets } = await Promise.resolve().then(() => __importStar(require("./secret-resolver")));
+        const sessionManager = new SessionManager();
+        let sessionSecret;
+        try {
+            sessionSecret = Secrets.getSessionSecret(env);
+            if (!sessionSecret)
+                return next();
+        }
+        catch {
+            return next();
+        }
+        const session = await sessionManager.getSession(request, sessionSecret, env);
+        if (!session)
+            return next(); // Let auth middleware handle missing session
+        // Check if the user's role requires MFA
+        const MFA_REQUIRED_ROLES = ["SUPER_ADMIN", "PARTNER_ADMIN"];
+        if (!session.role || !MFA_REQUIRED_ROLES.includes(session.role)) {
+            return next(); // MFA not required for this role
+        }
+        // Check if session is MFA-verified
+        if (session.mfaVerified) {
+            return next();
+        }
+        // MFA required but not verified
+        const { Logger } = await Promise.resolve().then(() => __importStar(require("./logger")));
+        Logger.getInstance(env).warn("[MFA Middleware] MFA required but not verified", {
+            pathname: context.pathname,
+            userId: session.userId,
+            role: session.role,
+        });
+        return new Response(JSON.stringify({
+            error: "MFA verification required",
+            code: "mfa_required",
+        }), {
+            status: 403,
+            headers: { "content-type": "application/json" },
+        });
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/lib/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/lib/middleware.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBH,8CAoBC;AAKD,wCA6CC;AAKD,8DAQC;AAaD,kDAgJC;AAcD,wCA2GC;AAYD,sCAwDC;AAhbD;;GAEG;AACH,SAAgB,iBAAiB,CAAC,WAAyB;IACzD,OAAO,KAAK,EAAE,OAA0B,EAAE,IAA6B,EAAE,EAAE;QACzE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QAEf,KAAK,UAAU,QAAQ,CAAC,CAAS;YAC/B,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,KAAK,GAAG,CAAC,CAAC;YAEV,IAAI,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc;IAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACjC,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,gBAAgB,GAAC,CAAC;QAEvD,0BAA0B;QAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,OAAO,GAA2B;gBACtC,8BAA8B,EAC5B,wCAAwC;gBAC1C,8BAA8B,EAC5B,0DAA0D;gBAC5D,kCAAkC,EAAE,MAAM;aAC3C,CAAC;YAEF,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;YACzD,CAAC;YAED,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAE9B,+BAA+B;QAC/B,MAAM,aAAa,GAAG,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,aAAa,EAAE,CAAC;YAClB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAClB,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAClB,8BAA8B,EAC9B,0DAA0D,CAC3D,CAAC;QACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;QAEjE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CAAC,GAAQ;IAChD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,eAAe,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,OAInC;IACC,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,KAAK,CAAC,CAAC,mBAAmB;IAChE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,YAAY,CAAC;IAErD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAEjD,sEAAsE;QACtE,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;QAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;QACtD,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAE5C,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,aAAa,EACb,GAAG,CACJ,CAAC;YACF,cAAc,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;YAC5C,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QACxE,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,wBAAwB;QACxB,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,cAAc,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC;YACH,oCAAoC;YACpC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACvD,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,WAAW,GAAG,GAAG,CAAC;YAEtB,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC5B,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAEjC,8BAA8B;gBAC9B,IAAI,GAAG,GAAG,WAAW,IAAI,QAAQ,EAAE,CAAC;oBAClC,eAAe;oBACf,YAAY,GAAG,CAAC,CAAC;oBACjB,WAAW,GAAG,GAAG,CAAC;gBACpB,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACpE,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;gBAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,0CAA0C,EAC1C;oBACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc;oBACd,YAAY;oBACZ,WAAW;oBACX,UAAU;iBACX,CACF,CAAC;gBAEF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,qBAAqB;oBAC5B,UAAU;oBACV,WAAW;oBACX,QAAQ;iBACT,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE;wBACpC,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE;wBAC3C,uBAAuB,EAAE,GAAG;wBAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAC3E;iBACF,CACF,CAAC;YACJ,CAAC;YAED,0BAA0B;YAC1B,YAAY,EAAE,CAAC;YAEf,4BAA4B;YAC5B,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CACzB,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,EACpD,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CACnD,CAAC;YAEF,uBAAuB;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;YAE9B,qCAAqC;YACrC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAClB,uBAAuB,EACvB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CACnD,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAClB,mBAAmB,EACnB,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CACtD,CAAC;YAEF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1F,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;gBAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,sEAAsE,EACtE,KAAK,CACN,CAAC;gBACF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,EAC5D;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YACD,sDAAsD;YACtD,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;YAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,oDAAoD,EACpD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,cAAc;IAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAEjC,wBAAwB;QACxB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,sFAAsF;QACtF,6FAA6F;QAC7F,+FAA+F;QAC/F,4EAA4E;QAC5E,+EAA+E;QAC/E,iFAAiF;QACjF,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QAED,cAAc;QACd,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;QAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;QACtD,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAE5C,gDAAgD;QAChD,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACxD,mFAAmF;gBACnF,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kFAAkF;YAClF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,aAAa,EACb,GAAG,CACJ,CAAC;QAEF,yDAAyD;QACzD,yDAAyD;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;YAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,yDAAyD,EACzD;gBACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC1C,aAAa,EAAE,CAAC,CAAC,UAAU;aAC5B,CACF,CAAC;YACF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,sBAAsB;QACtB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;YAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,mDAAmD,EACnD;gBACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC1C,aAAa,EAAE,CAAC,CAAC,UAAU;aAC5B,CACF,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,EAAE;gBACpE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,QAAQ,GAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAExE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;YAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,2CAA2C,EAC3C;gBACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,gBAAgB,EAAE,CAAC,CAAC,KAAK;gBACzB,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS;gBACtC,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gBAC5C,mBAAmB,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aAChE,CACF,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;gBACnE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,aAAa;IAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAEjC,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;QAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;QACtD,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAE5C,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,aAAa;gBAAE,OAAO,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,aAAa,EACb,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC,CAAC,6CAA6C;QAE1E,wCAAwC;QACxC,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,EAAE,CAAC,CAAC,iCAAiC;QAClD,CAAC;QAED,mCAAmC;QACnC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,gCAAgC;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,gDAAgD,EAChD;YACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CACF,CAAC;QAEF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,cAAc;SACrB,CAAC,EACF;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/lib/moderation-handler.d.ts

@@ -0,0 +1,55 @@
+import type { KVNamespace } from "../types/cloudflare-compat";
+export interface Env {
+    OPENAI_API_KEY?: string;
+    MODERATION_CACHE_KV?: KVNamespace;
+    FEED_CACHE_KV?: KVNamespace;
+}
+export interface ModerationResult {
+    approved: boolean;
+    score?: number;
+    details?: {
+        categories: {
+            hate: boolean;
+            hate_threatening: boolean;
+            harassment: boolean;
+            harassment_threatening: boolean;
+            self_harm: boolean;
+            self_harm_intent: boolean;
+            self_harm_instructions: boolean;
+            sexual: boolean;
+            sexual_minors: boolean;
+            violence: boolean;
+            violence_graphic: boolean;
+        };
+        categoryScores: {
+            [key: string]: number;
+        };
+    };
+    error?: string;
+    /** True when moderation was skipped due to budget. Caller should flag content for deferred review. */
+    budgetExceeded?: boolean;
+}
+export declare class ModerationHandler {
+    private readonly OPENAI_API_URL;
+    /**
+     * Moderate text content using OpenAI Moderation API
+     */
+    moderateText(text: string, env: Env): Promise<ModerationResult>;
+    /**
+     * Get cache key for text content
+     */
+    private getCacheKey;
+    /**
+     * Simple hash function for cache keys
+     */
+    private simpleHash;
+    /**
+     * Get cached moderation result
+     */
+    private getCachedResult;
+    /**
+     * Cache moderation result
+     */
+    private cacheResult;
+}
+//# sourceMappingURL=moderation-handler.d.ts.map

package/dist/lib/moderation-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"moderation-handler.d.ts","sourceRoot":"","sources":["../../src/lib/moderation-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AAczF,MAAM,WAAW,GAAG;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,aAAa,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QACR,UAAU,EAAE;YACV,IAAI,EAAE,OAAO,CAAC;YACd,gBAAgB,EAAE,OAAO,CAAC;YAC1B,UAAU,EAAE,OAAO,CAAC;YACpB,sBAAsB,EAAE,OAAO,CAAC;YAChC,SAAS,EAAE,OAAO,CAAC;YACnB,gBAAgB,EAAE,OAAO,CAAC;YAC1B,sBAAsB,EAAE,OAAO,CAAC;YAChC,MAAM,EAAE,OAAO,CAAC;YAChB,aAAa,EAAE,OAAO,CAAC;YACvB,QAAQ,EAAE,OAAO,CAAC;YAClB,gBAAgB,EAAE,OAAO,CAAC;SAC3B,CAAC;QACF,cAAc,EAAE;YACd,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;SACvB,CAAC;KACH,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sGAAsG;IACtG,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2C;IAE1E;;OAEG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAqLrE;;OAEG;IACH,OAAO,CAAC,WAAW;IAOnB;;OAEG;IACH,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,eAAe;IAgB7B;;OAEG;YACW,WAAW;CAkB1B"}