@drawbridge/drawbridge-utils 0.0.59 → 0.0.60

package/dist/sanitize.cjs

@@ -0,0 +1,133 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/sanitize.js
+var sanitize_exports = {};
+__export(sanitize_exports, {
+  sanitizeDomain: () => sanitizeDomain,
+  sanitizeEmail: () => sanitizeEmail,
+  sanitizeQueries: () => sanitizeQueries,
+  sanitizeString: () => sanitizeString,
+  sanitizeUrl: () => sanitizeUrl
+});
+module.exports = __toCommonJS(sanitize_exports);
+var import_disposable_email_domains = __toESM(require("disposable-email-domains"), 1);
+var SCOPE_KEYS = ["organization", "account", "user", "owner"];
+var DANGEROUS_OPERATORS = ["$where", "$function", "$accumulator"];
+var disposableBlacklist = new Set(import_disposable_email_domains.default.map((d) => d.toLowerCase()));
+var stripDangerousOperators = (value) => {
+  if (Array.isArray(value)) {
+    return value.map(stripDangerousOperators);
+  }
+  ;
+  if (value && typeof value === "object") {
+    const result = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (DANGEROUS_OPERATORS.includes(key)) continue;
+      result[key] = stripDangerousOperators(child);
+    }
+    ;
+    return result;
+  }
+  ;
+  return value;
+};
+var cleanQueryPart = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const cleaned = stripDangerousOperators(value);
+  for (const key of SCOPE_KEYS) {
+    delete cleaned[key];
+  }
+  ;
+  return cleaned;
+};
+var sanitizeString = (value) => {
+  if (value && value !== null) {
+    return value.trim();
+  } else {
+    return null;
+  }
+};
+var sanitizeDomain = (value, pattern) => {
+  if (!value) return value;
+  const cleaned = value.trim().toLowerCase().replace(/^https?:\/\//i, "").replace(/\/+$/, "");
+  if (pattern) {
+    const match = cleaned.match(pattern);
+    return match ? match[0] : cleaned;
+  }
+  return cleaned;
+};
+var sanitizeUrl = (url) => {
+  var _a, _b;
+  return (_b = (_a = url == null ? void 0 : url.replace(/^http:\/\//, "https://")) == null ? void 0 : _a.replace(/^https:\/\/www\./, "https://")) == null ? void 0 : _b.replace(/\/$/, "");
+};
+var sanitizeEmail = (raw) => {
+  if (typeof raw !== "string") return {
+    valid: false,
+    reason: "format"
+  };
+  const email = raw.trim().toLowerCase();
+  const match = email.match(/^[^\s@]+@([^\s@]+\.[^\s@]+)$/);
+  if (!match) return {
+    valid: false,
+    reason: "format"
+  };
+  if (disposableBlacklist.has(match[1])) return {
+    valid: false,
+    reason: "disposable"
+  };
+  return {
+    email,
+    valid: true
+  };
+};
+var sanitizeQueries = (req, res, next) => {
+  var _a, _b;
+  if (req.path.startsWith("/admin/")) {
+    next();
+    return;
+  }
+  ;
+  if ((_a = req.query) == null ? void 0 : _a.filters) {
+    req.query.filters = cleanQueryPart(req.query.filters);
+  }
+  ;
+  if ((_b = req.query) == null ? void 0 : _b.refine) {
+    req.query.refine = cleanQueryPart(req.query.refine);
+  }
+  ;
+  next();
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  sanitizeDomain,
+  sanitizeEmail,
+  sanitizeQueries,
+  sanitizeString,
+  sanitizeUrl
+});

package/dist/sanitize.d.cts

@@ -0,0 +1,174 @@
+import disposableDomains from 'disposable-email-domains';
+
+const SCOPE_KEYS = [ 'organization', 'account', 'user', 'owner' ];
+const DANGEROUS_OPERATORS = [ '$where', '$function', '$accumulator' ];
+
+// Disposable-domain set, built once at module load (~120K domains, ~6MB RSS).
+// O(1) lookup keeps sanitizeEmail cheap. The npm package auto-updates the list —
+// `npm update` periodically refreshes it. (NOTE: importing this module pulls the
+// 6MB set even for consumers that only use sanitizeUrl/sanitizeString; split
+// sanitizeUrl into its own module later if that footprint matters.)
+const disposableBlacklist = new Set( disposableDomains.map( ( d ) => d.toLowerCase() ) );
+
+const stripDangerousOperators = ( value ) => {
+
+	if( Array.isArray( value ) ){
+
+		return value.map( stripDangerousOperators );
+
+	}
+	if( value && typeof value === 'object' ){
+
+		const result = {};
+
+		for( const [ key, child ] of Object.entries( value ) ){
+
+			if( DANGEROUS_OPERATORS.includes( key ) ) continue;
+
+			result[ key ] = stripDangerousOperators( child );
+
+		}
+		return result;
+
+	}
+	return value;
+
+};
+
+const cleanQueryPart = ( value ) => {
+
+	if( ! value || typeof value !== 'object' || Array.isArray( value ) ) return value;
+
+	const cleaned = stripDangerousOperators( value );
+
+	for( const key of SCOPE_KEYS ){
+
+		delete cleaned[ key ];
+
+	}
+	return cleaned;
+
+};
+
+const sanitizeString = (
+	value
+) => {
+
+	if( value && value !== null ) {
+
+		//for now will just trim value. Making this a helper in case we end up expanding what gets filtered
+		return value.trim();
+
+	} else {
+
+		return null;
+
+	}
+
+};
+
+const sanitizeDomain = ( value, pattern ) => {
+
+	if( ! value ) return value;
+
+	const cleaned = value
+		.trim()
+		.toLowerCase()
+		.replace( /^https?:\/\//i, '' )
+		.replace( /\/+$/, '' );
+
+	if( pattern ){
+
+		const match = cleaned.match( pattern );
+
+		return match ? match[ 0 ] : cleaned;
+
+	}
+
+	return cleaned;
+
+};
+
+const sanitizeUrl = ( url ) => url
+	?.replace( /^http:\/\//, 'https://' )
+	?.replace( /^https:\/\/www\./, 'https://' )
+	?.replace( /\/$/, '' );
+
+// Normalize + validate an email address. Trim, lowercase, basic shape
+// check, and reject disposable-domain providers. Returns the normalized
+// email on success; never throws.
+//
+//   { valid: true,  email: 'darren@cursor.io' }
+//   { valid: false, reason: 'format' }
+//   { valid: false, reason: 'disposable' }
+const sanitizeEmail = ( raw ) => {
+
+	if( typeof raw !== 'string' ) return {
+		valid : false,
+		reason : 'format'
+	};
+
+	const email = raw.trim().toLowerCase();
+
+	// Minimal RFC-ish shape — defers full validation to the email provider
+	// on delivery. We just need to reject obvious garbage and extract a
+	// domain for the disposable-list check.
+	const match = email.match( /^[^\s@]+@([^\s@]+\.[^\s@]+)$/ );
+
+	if( ! match ) return {
+		valid : false,
+		reason : 'format'
+	};
+
+	if( disposableBlacklist.has( match[ 1 ] ) ) return {
+		valid : false,
+		reason : 'disposable'
+	};
+
+	return {
+		email,
+		valid : true
+	};
+
+};
+
+// Express middleware. Strips two specific attack surfaces from `req.query.filters`
+// and `req.query.refine` before they flow into Mongo queries via the
+// `...filters` / `...refine` spread pattern:
+//
+//   1. Scope-key override at the top level — keys that name a tenant scope
+//      (organization, account, user, owner). Without this guard, an attacker can
+//      pass `?filters[organization]=OTHER_ORG_ID` or
+//      `?filters[organization][$ne]=null` and override the route's scope.
+//
+//   2. JS-execution operators ($where, $function, $accumulator) anywhere in the
+//      tree — these run arbitrary server-side JS in Mongo. No client UI builds them.
+//
+// $or / $and / $in / $ne / $regex / etc. on non-scope fields are intentionally
+// allowed — the dashboard's filter builder (components/form-filters.js) produces
+// them and they cannot bypass an outer-scope AND clause.
+//
+// Admin paths (`/admin/...`) bypass entirely.
+const sanitizeQueries = ( req, res, next ) => {
+
+	if( req.path.startsWith( '/admin/' ) ){
+
+		next();
+		return;
+
+	}
+	if( req.query?.filters ){
+
+		req.query.filters = cleanQueryPart( req.query.filters );
+
+	}
+	if( req.query?.refine ){
+
+		req.query.refine = cleanQueryPart( req.query.refine );
+
+	}
+	next();
+
+};
+
+export { sanitizeDomain, sanitizeEmail, sanitizeQueries, sanitizeString, sanitizeUrl };

package/dist/sanitize.d.ts

@@ -0,0 +1,174 @@
+import disposableDomains from 'disposable-email-domains';
+
+const SCOPE_KEYS = [ 'organization', 'account', 'user', 'owner' ];
+const DANGEROUS_OPERATORS = [ '$where', '$function', '$accumulator' ];
+
+// Disposable-domain set, built once at module load (~120K domains, ~6MB RSS).
+// O(1) lookup keeps sanitizeEmail cheap. The npm package auto-updates the list —
+// `npm update` periodically refreshes it. (NOTE: importing this module pulls the
+// 6MB set even for consumers that only use sanitizeUrl/sanitizeString; split
+// sanitizeUrl into its own module later if that footprint matters.)
+const disposableBlacklist = new Set( disposableDomains.map( ( d ) => d.toLowerCase() ) );
+
+const stripDangerousOperators = ( value ) => {
+
+	if( Array.isArray( value ) ){
+
+		return value.map( stripDangerousOperators );
+
+	}
+	if( value && typeof value === 'object' ){
+
+		const result = {};
+
+		for( const [ key, child ] of Object.entries( value ) ){
+
+			if( DANGEROUS_OPERATORS.includes( key ) ) continue;
+
+			result[ key ] = stripDangerousOperators( child );
+
+		}
+		return result;
+
+	}
+	return value;
+
+};
+
+const cleanQueryPart = ( value ) => {
+
+	if( ! value || typeof value !== 'object' || Array.isArray( value ) ) return value;
+
+	const cleaned = stripDangerousOperators( value );
+
+	for( const key of SCOPE_KEYS ){
+
+		delete cleaned[ key ];
+
+	}
+	return cleaned;
+
+};
+
+const sanitizeString = (
+	value
+) => {
+
+	if( value && value !== null ) {
+
+		//for now will just trim value. Making this a helper in case we end up expanding what gets filtered
+		return value.trim();
+
+	} else {
+
+		return null;
+
+	}
+
+};
+
+const sanitizeDomain = ( value, pattern ) => {
+
+	if( ! value ) return value;
+
+	const cleaned = value
+		.trim()
+		.toLowerCase()
+		.replace( /^https?:\/\//i, '' )
+		.replace( /\/+$/, '' );
+
+	if( pattern ){
+
+		const match = cleaned.match( pattern );
+
+		return match ? match[ 0 ] : cleaned;
+
+	}
+
+	return cleaned;
+
+};
+
+const sanitizeUrl = ( url ) => url
+	?.replace( /^http:\/\//, 'https://' )
+	?.replace( /^https:\/\/www\./, 'https://' )
+	?.replace( /\/$/, '' );
+
+// Normalize + validate an email address. Trim, lowercase, basic shape
+// check, and reject disposable-domain providers. Returns the normalized
+// email on success; never throws.
+//
+//   { valid: true,  email: 'darren@cursor.io' }
+//   { valid: false, reason: 'format' }
+//   { valid: false, reason: 'disposable' }
+const sanitizeEmail = ( raw ) => {
+
+	if( typeof raw !== 'string' ) return {
+		valid : false,
+		reason : 'format'
+	};
+
+	const email = raw.trim().toLowerCase();
+
+	// Minimal RFC-ish shape — defers full validation to the email provider
+	// on delivery. We just need to reject obvious garbage and extract a
+	// domain for the disposable-list check.
+	const match = email.match( /^[^\s@]+@([^\s@]+\.[^\s@]+)$/ );
+
+	if( ! match ) return {
+		valid : false,
+		reason : 'format'
+	};
+
+	if( disposableBlacklist.has( match[ 1 ] ) ) return {
+		valid : false,
+		reason : 'disposable'
+	};
+
+	return {
+		email,
+		valid : true
+	};
+
+};
+
+// Express middleware. Strips two specific attack surfaces from `req.query.filters`
+// and `req.query.refine` before they flow into Mongo queries via the
+// `...filters` / `...refine` spread pattern:
+//
+//   1. Scope-key override at the top level — keys that name a tenant scope
+//      (organization, account, user, owner). Without this guard, an attacker can
+//      pass `?filters[organization]=OTHER_ORG_ID` or
+//      `?filters[organization][$ne]=null` and override the route's scope.
+//
+//   2. JS-execution operators ($where, $function, $accumulator) anywhere in the
+//      tree — these run arbitrary server-side JS in Mongo. No client UI builds them.
+//
+// $or / $and / $in / $ne / $regex / etc. on non-scope fields are intentionally
+// allowed — the dashboard's filter builder (components/form-filters.js) produces
+// them and they cannot bypass an outer-scope AND clause.
+//
+// Admin paths (`/admin/...`) bypass entirely.
+const sanitizeQueries = ( req, res, next ) => {
+
+	if( req.path.startsWith( '/admin/' ) ){
+
+		next();
+		return;
+
+	}
+	if( req.query?.filters ){
+
+		req.query.filters = cleanQueryPart( req.query.filters );
+
+	}
+	if( req.query?.refine ){
+
+		req.query.refine = cleanQueryPart( req.query.refine );
+
+	}
+	next();
+
+};
+
+export { sanitizeDomain, sanitizeEmail, sanitizeQueries, sanitizeString, sanitizeUrl };

package/dist/sanitize.js

@@ -0,0 +1,95 @@
+// lib/sanitize.js
+import disposableDomains from "disposable-email-domains";
+var SCOPE_KEYS = ["organization", "account", "user", "owner"];
+var DANGEROUS_OPERATORS = ["$where", "$function", "$accumulator"];
+var disposableBlacklist = new Set(disposableDomains.map((d) => d.toLowerCase()));
+var stripDangerousOperators = (value) => {
+  if (Array.isArray(value)) {
+    return value.map(stripDangerousOperators);
+  }
+  ;
+  if (value && typeof value === "object") {
+    const result = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (DANGEROUS_OPERATORS.includes(key)) continue;
+      result[key] = stripDangerousOperators(child);
+    }
+    ;
+    return result;
+  }
+  ;
+  return value;
+};
+var cleanQueryPart = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const cleaned = stripDangerousOperators(value);
+  for (const key of SCOPE_KEYS) {
+    delete cleaned[key];
+  }
+  ;
+  return cleaned;
+};
+var sanitizeString = (value) => {
+  if (value && value !== null) {
+    return value.trim();
+  } else {
+    return null;
+  }
+};
+var sanitizeDomain = (value, pattern) => {
+  if (!value) return value;
+  const cleaned = value.trim().toLowerCase().replace(/^https?:\/\//i, "").replace(/\/+$/, "");
+  if (pattern) {
+    const match = cleaned.match(pattern);
+    return match ? match[0] : cleaned;
+  }
+  return cleaned;
+};
+var sanitizeUrl = (url) => {
+  var _a, _b;
+  return (_b = (_a = url == null ? void 0 : url.replace(/^http:\/\//, "https://")) == null ? void 0 : _a.replace(/^https:\/\/www\./, "https://")) == null ? void 0 : _b.replace(/\/$/, "");
+};
+var sanitizeEmail = (raw) => {
+  if (typeof raw !== "string") return {
+    valid: false,
+    reason: "format"
+  };
+  const email = raw.trim().toLowerCase();
+  const match = email.match(/^[^\s@]+@([^\s@]+\.[^\s@]+)$/);
+  if (!match) return {
+    valid: false,
+    reason: "format"
+  };
+  if (disposableBlacklist.has(match[1])) return {
+    valid: false,
+    reason: "disposable"
+  };
+  return {
+    email,
+    valid: true
+  };
+};
+var sanitizeQueries = (req, res, next) => {
+  var _a, _b;
+  if (req.path.startsWith("/admin/")) {
+    next();
+    return;
+  }
+  ;
+  if ((_a = req.query) == null ? void 0 : _a.filters) {
+    req.query.filters = cleanQueryPart(req.query.filters);
+  }
+  ;
+  if ((_b = req.query) == null ? void 0 : _b.refine) {
+    req.query.refine = cleanQueryPart(req.query.refine);
+  }
+  ;
+  next();
+};
+export {
+  sanitizeDomain,
+  sanitizeEmail,
+  sanitizeQueries,
+  sanitizeString,
+  sanitizeUrl
+};

package/package.json

@@ -2,10 +2,11 @@
   "type": "module",
   "dependencies": {
     "@drawbridge/drawbridge-agents": "0.0.10",
-    "@drawbridge/drawbridge-telemetry": "0.0.13",
+    "@drawbridge/drawbridge-telemetry": "0.0.14",
     "@google/genai": "1.30.0",
     "axios": "1.16.0",
     "currency-codes": "2.2.0",
+    "disposable-email-domains": "1.0.62",
     "nanoid": "3.3.8",
     "qs": "6.15.2",
     "slugify": "1.6.6",
@@ -93,6 +94,11 @@
       "import": "./dist/redirect.js",
       "require": "./dist/redirect.cjs"
     },
+    "./sanitize": {
+      "types": "./dist/sanitize.d.ts",
+      "import": "./dist/sanitize.js",
+      "require": "./dist/sanitize.cjs"
+    },
     "./cdn": {
       "types": "./dist/cdn.d.ts",
       "import": "./dist/cdn.js",
@@ -154,5 +160,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.59"
+  "version": "0.0.60"
 }