@digilogiclabs/platform-core 1.13.0 → 1.14.0

package/dist/auth.mjs

@@ -1450,6 +1450,209 @@ function createLazyRateLimitStore(getRedis, options = {}) {
   };
 }
 
+// src/auth/secure-handler.ts
+function defaultLogger2(_request, operation) {
+  const prefix = `[${operation}]`;
+  return {
+    info: (msg, meta) => console.log(prefix, msg, meta ? JSON.stringify(meta) : ""),
+    warn: (msg, meta) => console.warn(prefix, msg, meta ? JSON.stringify(meta) : ""),
+    error: (msg, meta) => console.error(prefix, msg, meta ? JSON.stringify(meta) : "")
+  };
+}
+function createSecureHandlerFactory(factoryConfig) {
+  const isDev = factoryConfig.isDevelopment ?? process.env.NODE_ENV === "development";
+  const classify = factoryConfig.classifyError ?? classifyError;
+  const makeLogger = factoryConfig.createLogger ?? defaultLogger2;
+  function getRequestId(request) {
+    const headers = request.headers;
+    return headers.get("x-request-id") || headers.get("x-correlation-id") || crypto.randomUUID();
+  }
+  function checkLegacyToken(request) {
+    if (!factoryConfig.adminSecret) return false;
+    const auth = request.headers.get("authorization");
+    if (!auth?.startsWith("Bearer ")) return false;
+    return constantTimeEqual(auth.slice(7).trim(), factoryConfig.adminSecret);
+  }
+  function createSecureHandler(routeConfig, handler) {
+    return async (request, routeContext) => {
+      const requestId = getRequestId(request);
+      const operation = routeConfig.operation || `${request.method} ${new URL(request.url).pathname}`;
+      const log = makeLogger(request, operation);
+      const params = await routeContext.params;
+      let session = null;
+      let isAdmin = false;
+      let isLegacyToken = false;
+      try {
+        if (routeConfig.requireAuth || routeConfig.requireAdmin || routeConfig.requireRoles?.length) {
+          session = await factoryConfig.getSession();
+          if (session?.user) {
+            isAdmin = factoryConfig.isAdmin(session);
+          } else if (routeConfig.allowLegacyToken && checkLegacyToken(request)) {
+            isLegacyToken = true;
+            isAdmin = true;
+          } else {
+            log.warn("Unauthorized access attempt");
+            return Response.json(
+              { error: "Unauthorized" },
+              { status: 401, headers: { "X-Request-ID": requestId } }
+            );
+          }
+        }
+        if (routeConfig.requireAdmin && !isLegacyToken && !isAdmin) {
+          log.warn("Admin access denied");
+          return Response.json(
+            { error: "Forbidden: Admin access required" },
+            { status: 403, headers: { "X-Request-ID": requestId } }
+          );
+        }
+        if (routeConfig.requireRoles?.length && !isLegacyToken) {
+          const hasRole2 = factoryConfig.hasAnyRole ? factoryConfig.hasAnyRole(session, routeConfig.requireRoles) : routeConfig.requireRoles.some(
+            (r) => session?.user?.roles?.includes(r)
+          );
+          if (!hasRole2) {
+            log.warn("Role-based access denied");
+            return Response.json(
+              { error: "Forbidden: Insufficient permissions" },
+              { status: 403, headers: { "X-Request-ID": requestId } }
+            );
+          }
+        }
+        if (!routeConfig.skipRateLimit && routeConfig.rateLimit && factoryConfig.rateLimiter) {
+          const userId = session?.user?.id ?? void 0;
+          const blocked = await factoryConfig.rateLimiter.enforce(
+            request,
+            operation,
+            routeConfig.rateLimit,
+            userId
+          );
+          if (blocked) return blocked;
+        }
+        let validated = {};
+        if (routeConfig.validate) {
+          let input;
+          if (request.method === "GET") {
+            const url = new URL(request.url);
+            const qs = {};
+            url.searchParams.forEach((v, k) => qs[k] = v);
+            input = qs;
+          } else {
+            const ct = request.headers.get("content-type");
+            input = ct?.includes("application/json") ? await request.json() : {};
+          }
+          const result = routeConfig.validate.safeParse(input);
+          if (!result.success) {
+            const fieldErrors = result.error?.flatten ? result.error.flatten().fieldErrors : void 0;
+            return Response.json(
+              { error: "Validation error", errors: fieldErrors },
+              { status: 400, headers: { "X-Request-ID": requestId } }
+            );
+          }
+          validated = result.data;
+        }
+        const ctx = {
+          session,
+          isLegacyToken,
+          isAdmin,
+          validated,
+          logger: log,
+          requestId,
+          params
+        };
+        const response = await handler(request, ctx);
+        response.headers.set("X-Request-ID", requestId);
+        if (routeConfig.audit && factoryConfig.auditLog) {
+          const actorId = isLegacyToken ? "admin_token" : session?.user?.id || "anonymous";
+          await factoryConfig.auditLog({
+            actor: {
+              id: actorId,
+              type: isLegacyToken ? "admin" : "user",
+              email: session?.user?.email ?? void 0
+            },
+            action: routeConfig.audit,
+            resource: routeConfig.auditResource ? { type: routeConfig.auditResource, id: "unknown" } : void 0,
+            outcome: "success"
+          }).catch(() => {
+          });
+        }
+        return response;
+      } catch (error) {
+        log.error("Request handler error", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+        if (routeConfig.audit && factoryConfig.auditLog) {
+          await factoryConfig.auditLog({
+            actor: {
+              id: session?.user?.id || "unknown",
+              type: "user"
+            },
+            action: routeConfig.audit,
+            outcome: "failure",
+            reason: error instanceof Error ? error.message : "Unknown error"
+          }).catch(() => {
+          });
+        }
+        const { status, body } = classify(error, isDev);
+        return Response.json(
+          { error: body.error, code: body.code },
+          { status, headers: { "X-Request-ID": requestId } }
+        );
+      }
+    };
+  }
+  function withPublicApi(config, handler) {
+    return createSecureHandler(
+      {
+        rateLimit: factoryConfig.rateLimiter?.publicDefault,
+        ...config,
+        requireAuth: false,
+        requireAdmin: false
+      },
+      handler
+    );
+  }
+  function withAuthenticatedApi(config, handler) {
+    return createSecureHandler(
+      {
+        rateLimit: factoryConfig.rateLimiter?.authDefault,
+        ...config,
+        requireAuth: true,
+        requireAdmin: false
+      },
+      handler
+    );
+  }
+  function withAdminApi(config, handler) {
+    return createSecureHandler(
+      {
+        rateLimit: factoryConfig.rateLimiter?.adminDefault,
+        ...config,
+        requireAuth: true,
+        requireAdmin: true
+      },
+      handler
+    );
+  }
+  function withLegacyAdminApi(config, handler) {
+    return createSecureHandler(
+      {
+        rateLimit: factoryConfig.rateLimiter?.adminDefault,
+        ...config,
+        requireAuth: true,
+        requireAdmin: true,
+        allowLegacyToken: true
+      },
+      handler
+    );
+  }
+  return {
+    createSecureHandler,
+    withPublicApi,
+    withAuthenticatedApi,
+    withAdminApi,
+    withLegacyAdminApi
+  };
+}
+
 // src/env.ts
 function getRequiredEnv(key) {
   const value = process.env[key];
@@ -1585,6 +1788,7 @@ export {
   createMemoryRateLimitStore,
   createRedisRateLimitStore,
   createSafeTextSchema,
+  createSecureHandlerFactory,
   detectStage,
   enforceRateLimit,
   errorResponse,