@devmoods/express-extras 0.38.0 → 0.39.0

package/dist/csrf.d.ts

@@ -1,12 +1,16 @@
 import { type RequestHandler, type Request, type Response } from 'express';
 export interface CsrfMiddlewareOptions {
     excempt?: boolean;
+    cookieName?: string;
+    sessionIdentifier?: (req: Request) => string;
 }
-export declare function csrf({ excempt, }?: CsrfMiddlewareOptions): RequestHandler;
-export declare function setCsrfIdentifier(identifier: string): void;
-export declare function useCsrfIdentifier(): string;
-export declare function setCsrfProtectionEnabled(enabled: boolean): void;
-export declare function useCsrfProtectionEnabled(): boolean | undefined;
+interface CsrfOptions {
+    excempt: boolean;
+    cookieName: string;
+    sessionIdentifier: string;
+}
+export declare function csrf({ excempt, sessionIdentifier, cookieName, }?: CsrfMiddlewareOptions): RequestHandler;
+export declare function setCsrfOptions(options: CsrfOptions): void;
 interface TokenOptions {
     overwrite?: boolean;
 }

package/dist/csrf.js

@@ -3,31 +3,39 @@ import {} from 'express';
 import { setContext, useContext } from './context.js';
 import { Forbidden } from './errors.js';
 import { readEnv } from './utils.js';
-export function csrf({ excempt = false, } = {}) {
+const ignoredMethods = new Set(['GET', 'HEAD', 'OPTIONS']);
+const defaultCookieName = () => {
+    return process.env.NODE_ENV === 'production'
+        ? '__Host-devmoods.x-csrf-token'
+        : 'devmoods.x-csrf-token';
+};
+export function csrf({ excempt = false, sessionIdentifier, cookieName, } = {}) {
     return (req, res, next) => {
-        setCsrfProtectionEnabled(!excempt);
+        const existingOptions = useCsrfOptions();
+        setCsrfOptions({
+            cookieName: cookieName ?? existingOptions.cookieName ?? defaultCookieName(),
+            sessionIdentifier: sessionIdentifier
+                ? sessionIdentifier(req)
+                : existingOptions.sessionIdentifier,
+            excempt,
+        });
         next();
     };
 }
-const CSRF_IDENTIFIER_CONTEXT_KEY = '@csrfRequestIdentifier';
-export function setCsrfIdentifier(identifier) {
-    setContext(CSRF_IDENTIFIER_CONTEXT_KEY, identifier);
-}
-export function useCsrfIdentifier() {
-    return useContext(CSRF_IDENTIFIER_CONTEXT_KEY) ?? '';
+const CSRF_CONTEXT_KEY = '@csrfConfig';
+export function setCsrfOptions(options) {
+    setContext(CSRF_CONTEXT_KEY, options);
 }
-const CSRF_REQUIRED = '@csrfProtectionEnabled';
-export function setCsrfProtectionEnabled(enabled) {
-    setContext(CSRF_REQUIRED, enabled);
-}
-export function useCsrfProtectionEnabled() {
-    return useContext(CSRF_REQUIRED);
+function useCsrfOptions() {
+    return (useContext(CSRF_CONTEXT_KEY) || {
+        excempt: true,
+        cookieName: defaultCookieName(),
+        sessionIdentifier: '',
+    });
 }
-const ignoredMethods = new Set(['GET', 'HEAD', 'OPTIONS']);
-const cookieName = '__Host-devmoods.x-csrf-token';
 const generateTokenAndHash = (req, { overwrite = false } = {}) => {
     const secret = readEnv('CSRF_SECRET', '');
-    const sessionIdentifier = useCsrfIdentifier();
+    const { sessionIdentifier, cookieName } = useCsrfOptions();
     const csrfCookie = req.cookies[cookieName];
     if (typeof csrfCookie === 'string' && !overwrite) {
         const [csrfToken, csrfTokenHash] = csrfCookie.split('|');
@@ -50,6 +58,7 @@ const generateTokenAndHash = (req, { overwrite = false } = {}) => {
 export const generateCsrfToken = (req, res, options = {}) => {
     const { csrfToken, csrfTokenHash } = generateTokenAndHash(req, options);
     const cookieContent = `${csrfToken}|${csrfTokenHash}`;
+    const { cookieName } = useCsrfOptions();
     res.cookie(cookieName, cookieContent, {
         sameSite: 'lax',
         path: '/',
@@ -68,6 +77,7 @@ const validateTokenHash = ({ csrfToken, csrfTokenHash, secret, sessionIdentifier
     return csrfTokenHash === expectedHash;
 };
 const validateRequest = (req) => {
+    const { cookieName, sessionIdentifier } = useCsrfOptions();
     const csrfCookie = req.cookies[cookieName];
     if (typeof csrfCookie !== 'string') {
         throw Forbidden('Missing CSRF cookie');
@@ -85,15 +95,15 @@ const validateRequest = (req) => {
         csrfToken: csrfTokenFromRequest,
         csrfTokenHash,
         secret,
-        sessionIdentifier: useCsrfIdentifier(),
+        sessionIdentifier,
     })) {
         throw Forbidden('Invalid CSRF token');
     }
 };
 export function doubleCsrfProtection(req) {
     return async () => {
-        const isCsrfProtectionEnabled = useCsrfProtectionEnabled();
-        if (!isCsrfProtectionEnabled) {
+        const { excempt } = useCsrfOptions();
+        if (excempt) {
             return;
         }
         if (ignoredMethods.has(req.method)) {

package/dist/logger.js

@@ -56,7 +56,7 @@ export function createLogger({ name, getContext, level = readEnv('LOG_LEVEL', 'I
             v: 1,
         });
         if (level >= logLevel) {
-            output.write(payload + '\n');
+            output.write(`${payload}\n`);
         }
     }
     const api = {

package/dist/manage.js

@@ -21,8 +21,9 @@ export function registerDefaultCommands(app) {
         .option('--openapi', 'Output OpenAPI schema')
         .option('--json', 'Output JSON')
         .action(cli.wrap(async (options) => {
-        if (!app)
+        if (!app) {
             return;
+        }
         if (options.openapi) {
             console.error('Not implemented yet');
             return;

package/dist/middleware.d.ts

@@ -1,5 +1,6 @@
 import bodyParser from 'body-parser';
 import { type NextFunction, type RequestHandler, type Request, type Response } from 'express';
+import { type CsrfMiddlewareOptions } from './csrf.js';
 type UrlencodedParser = typeof bodyParser.urlencoded;
 type JsonParser = typeof bodyParser.json;
 export declare const urlencodedParser: UrlencodedParser;
@@ -15,7 +16,7 @@ export interface BeforeMiddlewareOptions {
     cookies?: boolean;
     helmet?: boolean;
     json?: boolean;
-    csrf?: boolean;
+    csrf?: boolean | CsrfMiddlewareOptions;
     allowUnsafeInlineScripts?: boolean;
     cspDirectives?: (defaults: BeforeMiddlewareCSPDirectives) => BeforeMiddlewareCSPDirectives;
 }

package/dist/middleware.js

@@ -4,7 +4,7 @@ import cookieParser from 'cookie-parser';
 import {} from 'express';
 import helmet from 'helmet';
 import { withRequestContext } from './context.js';
-import { csrf, doubleCsrfProtection } from './csrf.js';
+import { csrf, doubleCsrfProtection, } from './csrf.js';
 import { NotFound } from './errors.js';
 import { getLogger } from './logger.js';
 import { startTimer } from './utils.js';
@@ -18,7 +18,11 @@ export { asyncMiddleware as route };
 export function before({ cookies = false, helmet: useHelmet = true, json: useJson = true, csrf: useCsrf = false, allowUnsafeInlineScripts = false, cspDirectives = (x) => x, } = {}) {
     return compose([
         withRequestContext(),
-        useCsrf && csrf(),
+        typeof useCsrf === 'object' && useCsrf != null
+            ? csrf(useCsrf)
+            : useCsrf
+                ? csrf()
+                : undefined,
         logRequestDuration(),
         useHelmet &&
             helmet({

package/dist/postgres.js

@@ -88,8 +88,9 @@ export function createPostgres({ onError, url = readEnv('POSTGRES_URL'), ...conf
      * Wipe the database schema
      */
     async function clear(force = false) {
-        if (!force)
+        if (!force) {
             return;
+        }
         return withConnection(async (connection) => {
             await connection.query('DROP SCHEMA public CASCADE');
             await connection.query(`CREATE SCHEMA public`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,7 +18,7 @@
   ],
   "license": "ISC",
   "devDependencies": {
-    "@devmoods/eslint-config": "^1.14.0",
+    "@devmoods/eslint-config": "^1.15.0",
     "@types/koa-compose": "^3.2.8",
     "@types/node": "22.8.6",
     "@types/supertest": "^6.0.2",