@devmoods/express-extras 0.37.0 → 0.38.0

package/dist/cache.js

@@ -78,6 +78,7 @@ export function createCache(adapter) {
             const expiresMs = typeof options === 'number' || options == null
                 ? options
                 : options.expiresMs;
+            console.log({ expiresMs });
             const result = await fn(...args);
             await adapter.set(cacheKey, result, expiresMs);
             return result;

package/dist/cli.js

@@ -16,7 +16,7 @@ export class CLI {
     redLine(message, output = stderr) {
         output.write(`${chalk.red(message)}\n`);
     }
-    /* v8 ignore next 10 */
+    /* c8 ignore next 10 */
     readInput(question) {
         const rl = readline.createInterface({ input: stdin, output: stderr });
         return new Promise((resolve) => {

package/dist/csrf.d.ts

@@ -0,0 +1,15 @@
+import { type RequestHandler, type Request, type Response } from 'express';
+export interface CsrfMiddlewareOptions {
+    excempt?: boolean;
+}
+export declare function csrf({ excempt, }?: CsrfMiddlewareOptions): RequestHandler;
+export declare function setCsrfIdentifier(identifier: string): void;
+export declare function useCsrfIdentifier(): string;
+export declare function setCsrfProtectionEnabled(enabled: boolean): void;
+export declare function useCsrfProtectionEnabled(): boolean | undefined;
+interface TokenOptions {
+    overwrite?: boolean;
+}
+export declare const generateCsrfToken: (req: Request<any, any, any, any>, res: Response, options?: TokenOptions) => string;
+export declare function doubleCsrfProtection(req: Request<any, any, any, any>): () => Promise<void>;
+export {};

package/dist/csrf.js

@@ -0,0 +1,104 @@
+import { createHash, randomBytes } from 'node:crypto';
+import {} from 'express';
+import { setContext, useContext } from './context.js';
+import { Forbidden } from './errors.js';
+import { readEnv } from './utils.js';
+export function csrf({ excempt = false, } = {}) {
+    return (req, res, next) => {
+        setCsrfProtectionEnabled(!excempt);
+        next();
+    };
+}
+const CSRF_IDENTIFIER_CONTEXT_KEY = '@csrfRequestIdentifier';
+export function setCsrfIdentifier(identifier) {
+    setContext(CSRF_IDENTIFIER_CONTEXT_KEY, identifier);
+}
+export function useCsrfIdentifier() {
+    return useContext(CSRF_IDENTIFIER_CONTEXT_KEY) ?? '';
+}
+const CSRF_REQUIRED = '@csrfProtectionEnabled';
+export function setCsrfProtectionEnabled(enabled) {
+    setContext(CSRF_REQUIRED, enabled);
+}
+export function useCsrfProtectionEnabled() {
+    return useContext(CSRF_REQUIRED);
+}
+const ignoredMethods = new Set(['GET', 'HEAD', 'OPTIONS']);
+const cookieName = '__Host-devmoods.x-csrf-token';
+const generateTokenAndHash = (req, { overwrite = false } = {}) => {
+    const secret = readEnv('CSRF_SECRET', '');
+    const sessionIdentifier = useCsrfIdentifier();
+    const csrfCookie = req.cookies[cookieName];
+    if (typeof csrfCookie === 'string' && !overwrite) {
+        const [csrfToken, csrfTokenHash] = csrfCookie.split('|');
+        if (validateTokenHash({
+            csrfToken,
+            csrfTokenHash,
+            secret,
+            sessionIdentifier,
+        })) {
+            return { csrfToken, csrfTokenHash };
+        }
+        throw Forbidden('Invalid CSRF token');
+    }
+    const csrfToken = randomBytes(64).toString('hex');
+    const csrfTokenHash = createHash('sha256')
+        .update(`${sessionIdentifier}${csrfToken}${secret}`)
+        .digest('hex');
+    return { csrfToken, csrfTokenHash };
+};
+export const generateCsrfToken = (req, res, options = {}) => {
+    const { csrfToken, csrfTokenHash } = generateTokenAndHash(req, options);
+    const cookieContent = `${csrfToken}|${csrfTokenHash}`;
+    res.cookie(cookieName, cookieContent, {
+        sameSite: 'lax',
+        path: '/',
+        secure: process.env.NODE_ENV === 'production',
+        httpOnly: true,
+    });
+    return csrfToken;
+};
+const validateTokenHash = ({ csrfToken, csrfTokenHash, secret, sessionIdentifier, }) => {
+    if (typeof csrfToken !== 'string' || typeof csrfTokenHash !== 'string') {
+        return false;
+    }
+    const expectedHash = createHash('sha256')
+        .update(`${sessionIdentifier}${csrfToken}${secret}`)
+        .digest('hex');
+    return csrfTokenHash === expectedHash;
+};
+const validateRequest = (req) => {
+    const csrfCookie = req.cookies[cookieName];
+    if (typeof csrfCookie !== 'string') {
+        throw Forbidden('Missing CSRF cookie');
+    }
+    const [csrfToken, csrfTokenHash] = csrfCookie.split('|');
+    const csrfTokenFromRequest = req.headers['x-csrf-token'];
+    const secret = readEnv('CSRF_SECRET', '');
+    if (!csrfTokenFromRequest) {
+        throw Forbidden('Missing CSRF token');
+    }
+    if (csrfToken !== csrfTokenFromRequest) {
+        throw Forbidden('CSRF token mismatch');
+    }
+    if (!validateTokenHash({
+        csrfToken: csrfTokenFromRequest,
+        csrfTokenHash,
+        secret,
+        sessionIdentifier: useCsrfIdentifier(),
+    })) {
+        throw Forbidden('Invalid CSRF token');
+    }
+};
+export function doubleCsrfProtection(req) {
+    return async () => {
+        const isCsrfProtectionEnabled = useCsrfProtectionEnabled();
+        if (!isCsrfProtectionEnabled) {
+            return;
+        }
+        if (ignoredMethods.has(req.method)) {
+            return;
+        }
+        validateRequest(req);
+    };
+}

package/dist/faktory.js

@@ -11,7 +11,7 @@ export function createJobs({ queueName, faktory: createFactory = create, }) {
         const fn = typeof optionsOrFn === 'function' ? optionsOrFn : fnOrUndefined;
         const options = typeof optionsOrFn === 'function' ? {} : optionsOrFn;
         if (!fn) {
-            throw new Error('job() must get a function has the first or second argument');
+            throw new Error('job() must get a function as the first or second argument');
         }
         const jobName = fn.name;
         let executionCount = 0;

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from './auth.js';
 export * from './cache.js';
 export * from './cli.js';
 export * from './context.js';
+export * from './csrf.js';
 export * from './email.js';
 export * from './errors.js';
 export * from './faktory.js';

package/dist/index.js

@@ -1,8 +1,9 @@
-/* v8 ignore next 100 */
+/* c8 ignore next 100 */
 export * from './auth.js';
 export * from './cache.js';
 export * from './cli.js';
 export * from './context.js';
+export * from './csrf.js';
 export * from './email.js';
 export * from './errors.js';
 export * from './faktory.js';

package/dist/middleware.d.ts

@@ -15,13 +15,14 @@ export interface BeforeMiddlewareOptions {
     cookies?: boolean;
     helmet?: boolean;
     json?: boolean;
+    csrf?: boolean;
     allowUnsafeInlineScripts?: boolean;
     cspDirectives?: (defaults: BeforeMiddlewareCSPDirectives) => BeforeMiddlewareCSPDirectives;
 }
 /**
  * Register middleware that must come before the app routes.
  */
-export declare function before({ cookies, helmet: useHelmet, json: useJson, allowUnsafeInlineScripts, cspDirectives, }?: BeforeMiddlewareOptions): import("compose-middleware").RequestHandler<unknown, unknown, void>;
+export declare function before({ cookies, helmet: useHelmet, json: useJson, csrf: useCsrf, allowUnsafeInlineScripts, cspDirectives, }?: BeforeMiddlewareOptions): import("compose-middleware").RequestHandler<unknown, unknown, void>;
 /**
  * Middleware that sends a 404
  *

package/dist/middleware.js

@@ -4,6 +4,7 @@ import cookieParser from 'cookie-parser';
 import {} from 'express';
 import helmet from 'helmet';
 import { withRequestContext } from './context.js';
+import { csrf, doubleCsrfProtection } from './csrf.js';
 import { NotFound } from './errors.js';
 import { getLogger } from './logger.js';
 import { startTimer } from './utils.js';
@@ -14,9 +15,10 @@ export { asyncMiddleware as route };
 /**
  * Register middleware that must come before the app routes.
  */
-export function before({ cookies = false, helmet: useHelmet = true, json: useJson = true, allowUnsafeInlineScripts = false, cspDirectives = (x) => x, } = {}) {
+export function before({ cookies = false, helmet: useHelmet = true, json: useJson = true, csrf: useCsrf = false, allowUnsafeInlineScripts = false, cspDirectives = (x) => x, } = {}) {
     return compose([
         withRequestContext(),
+        useCsrf && csrf(),
         logRequestDuration(),
         useHelmet &&
             helmet({
@@ -48,7 +50,7 @@ export function before({ cookies = false, helmet: useHelmet = true, json: useJso
                 },
             }),
         useJson && jsonParser(),
-        cookies && cookieParser(),
+        (cookies || useCsrf) && cookieParser(),
         analyticsProxy(),
     ].filter(Boolean));
 }
@@ -111,7 +113,9 @@ export function after() {
  */
 export function asyncMiddleware(fn) {
     const handler = (req, res, next) => {
-        return Promise.resolve(fn(req, res, next))
+        return Promise.resolve()
+            .then(doubleCsrfProtection(req))
+            .then(() => fn(req, res, next))
             .then((result) => {
             if (Array.isArray(result) &&
                 (result.length === 2 || result.length === 3) &&

package/dist/routes.js

@@ -45,40 +45,24 @@ const buildPathParamsSchema = (pathParams) => {
         required,
     };
 };
+// Fork of express-route-parser
 class ExpressPathParser {
     getPaths() {
         return this._appPaths;
     }
     constructor(app) {
-        /**
-         * Recursive traversal method for the express router and middleware tree.
-         *
-         * @param path The current path segment that we have traversed so far
-         * @param layer The current 'layer' of the router tree
-         * @param keys The keys for the parameter's in the current path branch of the traversal
-         * @returns void - base case saves result to internal object
-         */
         this.traverse = (path, layer, keys) => {
             keys = [...keys, ...layer.keys];
             if (layer.name === 'router' && layer.handle) {
-                layer.handle.stack.forEach((l) => {
-                    path = path || '';
-                    this.traverse(`${path}/${pathRegexParser(layer.regexp, layer.keys)}`, l, keys);
-                });
+                for (const l of layer.handle.stack) {
+                    this.traverse(`${path || ''}/${pathRegexParser(layer.regexp, layer.keys)}`, l, keys);
+                }
             }
             if (!layer.route || !layer.route.stack.length) {
                 return;
             }
             this._appPaths.push(this.parseRouteLayer(layer, keys, path));
         };
-        /**
-         * Parses a route object. Route objects are the leafs of an express router tree
-         *
-         * @param layer The layer of this route object - represents the stack of middleware and other meta data
-         * @param keys The full set of keys for this particular route
-         * @param basePath The base path as it was initial declared for this route
-         * @returns A ExpressPath object holding the meta data for a given route
-         */
         this.parseRouteLayer = (layer, keys, basePath) => {
             const lastRequestHandler = layer.route.stack[layer.route.stack.length - 1];
             const pathParams = keys.map((key) => {
@@ -105,14 +89,6 @@ class ExpressPathParser {
         }
     }
 }
-/** Parses an express layer's regex and converts it to the original format seen in code.
- *
- * @param layerRegexPath The layer's regex pattern
- * @param keys The keys that represent the layer's path parameters
- * @returns The path string for that layer
- * Code inspired and modify from:
- * https://github.com/expressjs/express/issues/3308#issuecomment-300957572
- */
 const pathRegexParser = (layerRegexPath, keys) => {
     if (typeof layerRegexPath === 'string') {
         return layerRegexPath;
@@ -140,13 +116,6 @@ const pathRegexParser = (layerRegexPath, keys) => {
     }
     return layerRegexPath.toString();
 };
-/**
- * Map's the keys/path variables to the regex inside a given path
- *
- * @param layerRegexPath The regex for a react router with path parameters
- * @param keys The keys that represent the path parameters
- * @returns The regex for a path variable converted to original string on the express route
- */
 const mapKeysToPath = (layerRegexPath, keys) => {
     if (!keys || keys.length === 0) {
         throw Error('must include atleast one key to map');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -20,12 +20,12 @@
   "devDependencies": {
     "@devmoods/eslint-config": "^1.14.0",
     "@types/koa-compose": "^3.2.8",
-    "@types/node": "22.8.1",
+    "@types/node": "22.8.6",
     "@types/supertest": "^6.0.2",
-    "@typescript-eslint/eslint-plugin": "^8.11.0",
-    "@typescript-eslint/parser": "^8.11.0",
-    "@vitest/coverage-v8": "^2.1.3",
-    "chalk": "^5.3.0",
+    "@typescript-eslint/eslint-plugin": "^8.12.2",
+    "@typescript-eslint/parser": "^8.12.2",
+    "@vitest/coverage-v8": "^2.1.4",
+    "cookiejar": "^2.1.4",
     "eslint": "^8.57.0",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-prettier": "^5.2.1",
@@ -33,15 +33,15 @@
     "prettier": "3.3.3",
     "supertest": "7.0.0",
     "ts-node": "10.9.2",
-    "tsx": "^4.19.1",
+    "tsx": "^4.19.2",
     "typescript": "5.6.3",
-    "vitest": "^2.1.3",
+    "vitest": "^2.1.4",
     "vitest-fail-on-console": "^0.7.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^8.35.0",
-    "@sentry/profiling-node": "^8.35.0",
+    "@sentry/node": "^8.36.0",
+    "@sentry/profiling-node": "^8.36.0",
     "@types/bcrypt": "^5.0.2",
     "@types/body-parser": "^1.19.5",
     "@types/cookie-parser": "^1.4.7",
@@ -54,6 +54,7 @@
     "ajv": "^8.17.1",
     "bcrypt": "^5.1.1",
     "body-parser": "^1.20.3",
+    "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "compose-middleware": "^5.0.1",
     "cookie-parser": "^1.4.7",
@@ -61,11 +62,11 @@
     "express": "^4.21.1",
     "helmet": "^8.0.0",
     "jsonwebtoken": "^9.0.2",
-    "nodemailer": "^6.9.15",
+    "nodemailer": "^6.9.16",
     "pg": "^8.13.1",
     "redis": "^4.7.0",
     "sql-template-strings": "^2.2.2",
-    "uuid": "^10.0.0"
+    "uuid": "^11.0.2"
   },
   "prettier": {
     "singleQuote": true