@digilogiclabs/platform-core 1.9.0 → 1.10.0

package/dist/auth.mjs

@@ -562,6 +562,12 @@ var CommonRateLimits = {
     limit: 10,
     windowSeconds: 3600,
     blockDurationSeconds: 3600
+  },
+  /** Beta code validation: 5/min with 5min block (prevents brute force guessing) */
+  betaValidation: {
+    limit: 5,
+    windowSeconds: 60,
+    blockDurationSeconds: 300
   }
 };
 function createMemoryRateLimitStore() {
@@ -1105,6 +1111,71 @@ function isValidBearerToken(request, secret) {
   if (!token) return false;
   return constantTimeEqual(token, secret);
 }
+function verifyCronAuth(request, secret) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader?.startsWith("Bearer ")) {
+    return new Response(
+      JSON.stringify({ error: "Missing authorization" }),
+      { status: 401, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  const token = authHeader.slice(7);
+  const expectedSecret = secret ?? process.env.CRON_SECRET;
+  if (!expectedSecret) {
+    console.error("[verifyCronAuth] CRON_SECRET not configured");
+    return new Response(
+      JSON.stringify({ error: "Server configuration error" }),
+      { status: 500, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  if (!constantTimeEqual(token, expectedSecret)) {
+    return new Response(
+      JSON.stringify({ error: "Invalid authorization" }),
+      { status: 401, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  return null;
+}
+function getClientIp(request) {
+  return request.headers.get("cf-connecting-ip") || request.headers.get("x-real-ip") || request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || "unknown";
+}
+function rateLimitResponse(result) {
+  const retryAfter = Math.ceil(result.resetMs / 1e3);
+  const resetTimestamp = Math.ceil(Date.now() / 1e3 + result.resetMs / 1e3);
+  return new Response(
+    JSON.stringify({ error: "Too many requests", retryAfter }),
+    {
+      status: 429,
+      headers: {
+        "Content-Type": "application/json",
+        "X-RateLimit-Limit": String(result.limit),
+        "X-RateLimit-Remaining": "0",
+        "X-RateLimit-Reset": String(resetTimestamp),
+        "Retry-After": String(retryAfter)
+      }
+    }
+  );
+}
+function addRateLimitHeaders(response, result) {
+  const resetTimestamp = Math.ceil(Date.now() / 1e3 + result.resetMs / 1e3);
+  response.headers.set("X-RateLimit-Limit", String(result.limit));
+  response.headers.set("X-RateLimit-Remaining", String(result.remaining));
+  response.headers.set("X-RateLimit-Reset", String(resetTimestamp));
+  return response;
+}
+function safeValidate(schema, data) {
+  const result = schema.safeParse(data);
+  if (result.success) {
+    return { success: true, data: result.data };
+  }
+  return {
+    success: false,
+    errors: (result.error?.issues || []).map((issue) => ({
+      field: issue.path.join("."),
+      message: issue.message
+    }))
+  };
+}
 
 // src/auth/beta-client.ts
 var DEFAULT_CONFIG = {
@@ -1322,6 +1393,7 @@ export {
   StandardAuditActions,
   StandardRateLimitPresets,
   WrapperPresets,
+  addRateLimitHeaders,
   buildAllowlist,
   buildAuthCookies,
   buildErrorBody,
@@ -1356,6 +1428,7 @@ export {
   extractClientIp,
   fetchBetaSettings,
   getBoolEnv,
+  getClientIp,
   getCorrelationId,
   getEndSessionEndpoint,
   getEnvSummary,
@@ -1373,15 +1446,18 @@ export {
   isTokenExpired,
   isValidBearerToken,
   parseKeycloakRoles,
+  rateLimitResponse,
   refreshKeycloakToken,
   resetRateLimitForKey,
   resolveIdentifier,
   resolveRateLimitIdentifier,
+  safeValidate,
   sanitizeApiError,
   storeBetaCode,
   stripHtml,
   validateBetaCode,
   validateEnvVars,
+  verifyCronAuth,
   zodErrorResponse
 };
 //# sourceMappingURL=auth.mjs.map