@expressots/core 2.4.0 → 2.5.0

package/lib/CHANGELOG.md

@@ -1,71 +1,86 @@
 
 
-## [2.4.0](https://github.com/expressots/expressots/compare/2.3.0...2.4.0) (2023-10-01)
+## [2.5.0](https://github.com/expressots/expressots/compare/2.4.0...2.5.0) (2023-10-04)
 
 
 ### Features
 
-* add interface for `express-rate-limit` ([86cf5d2](https://github.com/expressots/expressots/commit/86cf5d2d2bdbdd4acdd6f4a0597634790d99f972))
-* implement `express-rate-limit` in service ([e31a5f4](https://github.com/expressots/expressots/commit/e31a5f47b67ac01795b6ac64e639cd53078f8048))
+* bump vite from 4.4.9 to 4.4.10 ([5be4adc](https://github.com/expressots/expressots/commit/5be4adc18d84c3affa57d248dd07801bda4dd5b9))
+* bump vitest from 0.34.5 to 0.34.6 ([11ca77f](https://github.com/expressots/expressots/commit/11ca77f29d19d1de05b2ae2a56b9e306311621bf))
+* **core:** add helmet middleware ([7648afb](https://github.com/expressots/expressots/commit/7648afb68054c1e69990f7d33efe35ec4d99b464)), closes [#107](https://github.com/expressots/expressots/issues/107)
 
 
 ### Bug Fixes
 
-* add App container all tests ([d6c8212](https://github.com/expressots/expressots/commit/d6c8212ec80fe239b38e4ff592ed0be3e507cd99))
-* add cjs as default build ([d16cfa5](https://github.com/expressots/expressots/commit/d16cfa50238c2e299fffaf079fb62847de94e7d8))
-* add code coverage configuration ([3676e32](https://github.com/expressots/expressots/commit/3676e328833bd92ea7ebe28b567195bbd5c25bb2))
-* adjust reporter to text, html, json ([04acb04](https://github.com/expressots/expressots/commit/04acb04c2e9229f0531ffb990f22665d94506f2c))
-* remove adapter peer dependecy ([bad171b](https://github.com/expressots/expressots/commit/bad171be98f3b2ec58c3793836ba2000c3727dbc))
-* resolves all current issues ([877c121](https://github.com/expressots/expressots/commit/877c1216405e35b3b90f61caf13d73b20202eac5))
-
-
-### Documentation
-
-* add jsdoc to interfaces ([228d190](https://github.com/expressots/expressots/commit/228d190f7ca58c71e5bcd1f03ecf70b2e7fdbe03))
-
-
-### Code Refactoring
-
-* add types to default params ([b366e14](https://github.com/expressots/expressots/commit/b366e14d2b7d9322b4ea92ae3afdfbb834e42e16))
-* eliminate duplicate return statements ([b57fa85](https://github.com/expressots/expressots/commit/b57fa8517c5656fed71b73cc3c2b65834c8d8833))
+* adjust interface, remove duplicated helmet registry ([376c065](https://github.com/expressots/expressots/commit/376c0654d655ee8d29c0649d83ec6fb7cf860791))
+* remove duplicate optionslhelmet interface ([93bfdea](https://github.com/expressots/expressots/commit/93bfdea0057614b0a2e449817fb095ed23112011))
+
+## [2.4.0](https://github.com/expressots/expressots/compare/2.3.0...2.4.0) (2023-10-01)
+
+
+### Features
+
+* add interface for `express-rate-limit` ([86cf5d2](https://github.com/expressots/expressots/commit/86cf5d2d2bdbdd4acdd6f4a0597634790d99f972))
+* implement `express-rate-limit` in service ([e31a5f4](https://github.com/expressots/expressots/commit/e31a5f47b67ac01795b6ac64e639cd53078f8048))
+
+
+### Bug Fixes
+
+* add App container all tests ([d6c8212](https://github.com/expressots/expressots/commit/d6c8212ec80fe239b38e4ff592ed0be3e507cd99))
+* add cjs as default build ([d16cfa5](https://github.com/expressots/expressots/commit/d16cfa50238c2e299fffaf079fb62847de94e7d8))
+* add code coverage configuration ([3676e32](https://github.com/expressots/expressots/commit/3676e328833bd92ea7ebe28b567195bbd5c25bb2))
+* adjust reporter to text, html, json ([04acb04](https://github.com/expressots/expressots/commit/04acb04c2e9229f0531ffb990f22665d94506f2c))
+* remove adapter peer dependecy ([bad171b](https://github.com/expressots/expressots/commit/bad171be98f3b2ec58c3793836ba2000c3727dbc))
+* resolves all current issues ([877c121](https://github.com/expressots/expressots/commit/877c1216405e35b3b90f61caf13d73b20202eac5))
+
+
+### Documentation
+
+* add jsdoc to interfaces ([228d190](https://github.com/expressots/expressots/commit/228d190f7ca58c71e5bcd1f03ecf70b2e7fdbe03))
+
+
+### Code Refactoring
+
+* add types to default params ([b366e14](https://github.com/expressots/expressots/commit/b366e14d2b7d9322b4ea92ae3afdfbb834e42e16))
+* eliminate duplicate return statements ([b57fa85](https://github.com/expressots/expressots/commit/b57fa8517c5656fed71b73cc3c2b65834c8d8833))
 * revert changes due to future features ([89fce01](https://github.com/expressots/expressots/commit/89fce01f08ebd1539471e51808040e4383c3e6f4))
 
-## [2.3.0](https://github.com/expressots/expressots/compare/2.2.1...2.3.0) (2023-09-25)
-
-
-### Features
-
-* add morgan middleware ([ffe5f36](https://github.com/expressots/expressots/commit/ffe5f36b447f7fafd3a44c90a304b3b9c5ec4481))
-* bump vitest from 0.34.4 to 0.34.5 ([e1a1da5](https://github.com/expressots/expressots/commit/e1a1da51ab35bf6bb24ba9073b270a490ab331d8))
-
-
-### Bug Fixes
-
+## [2.3.0](https://github.com/expressots/expressots/compare/2.2.1...2.3.0) (2023-09-25)
+
+
+### Features
+
+* add morgan middleware ([ffe5f36](https://github.com/expressots/expressots/commit/ffe5f36b447f7fafd3a44c90a304b3b9c5ec4481))
+* bump vitest from 0.34.4 to 0.34.5 ([e1a1da5](https://github.com/expressots/expressots/commit/e1a1da51ab35bf6bb24ba9073b270a490ab331d8))
+
+
+### Bug Fixes
+
 * add IMorgan interface to serve it types ([adb29e5](https://github.com/expressots/expressots/commit/adb29e505af79cf998f1288085695dfee8e5680d))
 
-## [2.2.0](https://github.com/expressots/expressots/compare/2.1.0...2.2.0) (2023-09-21)
-
-
-### Features
-
-* add middleware based routing ([3d7720e](https://github.com/expressots/expressots/commit/3d7720e21807117333d60e7f2b7bb01789b96060))
-* add serve-favicon middleware ([024bdc4](https://github.com/expressots/expressots/commit/024bdc4d8d4f9890175975d052ca09c5b4e245cf))
-* add serve-favicon middleware ([0733697](https://github.com/expressots/expressots/commit/0733697ed66a7133e60ec6fa09bdaeb0bf1985d7))
-
-
-### Bug Fixes
-
-* add chore message to pre-commit hook ([45ae428](https://github.com/expressots/expressots/commit/45ae428652bb6e4f49cb2a6334686be0dee3669d))
-* add middleware validation based on path ([7035153](https://github.com/expressots/expressots/commit/7035153dededd3ca7c5159544f4ab79baee2c4d7))
-* re-write cp, mv and rm improving performance ([68d68ad](https://github.com/expressots/expressots/commit/68d68ad11385ca783fa5c51e3092937a6f898ac6))
-* update contribute_howto doc ([4bf6e12](https://github.com/expressots/expressots/commit/4bf6e121091e894a7675ff78959ab4647ec04f6d))
-* update contribute_howto doc ([fbbe47d](https://github.com/expressots/expressots/commit/fbbe47d6df76211fadd736fab864aa41e0313ec9))
-* update templates for v2 scaffold ([74811f3](https://github.com/expressots/expressots/commit/74811f3ac54610be7367de75f37363dc0c107dbc))
-
-
-### Build System
-
-* **scripts:** add cross platform build scripts ([e6cecbc](https://github.com/expressots/expressots/commit/e6cecbc6b7a309f00aa6cd60f6d8207dc8d4c5cb))
+## [2.2.0](https://github.com/expressots/expressots/compare/2.1.0...2.2.0) (2023-09-21)
+
+
+### Features
+
+* add middleware based routing ([3d7720e](https://github.com/expressots/expressots/commit/3d7720e21807117333d60e7f2b7bb01789b96060))
+* add serve-favicon middleware ([024bdc4](https://github.com/expressots/expressots/commit/024bdc4d8d4f9890175975d052ca09c5b4e245cf))
+* add serve-favicon middleware ([0733697](https://github.com/expressots/expressots/commit/0733697ed66a7133e60ec6fa09bdaeb0bf1985d7))
+
+
+### Bug Fixes
+
+* add chore message to pre-commit hook ([45ae428](https://github.com/expressots/expressots/commit/45ae428652bb6e4f49cb2a6334686be0dee3669d))
+* add middleware validation based on path ([7035153](https://github.com/expressots/expressots/commit/7035153dededd3ca7c5159544f4ab79baee2c4d7))
+* re-write cp, mv and rm improving performance ([68d68ad](https://github.com/expressots/expressots/commit/68d68ad11385ca783fa5c51e3092937a6f898ac6))
+* update contribute_howto doc ([4bf6e12](https://github.com/expressots/expressots/commit/4bf6e121091e894a7675ff78959ab4647ec04f6d))
+* update contribute_howto doc ([fbbe47d](https://github.com/expressots/expressots/commit/fbbe47d6df76211fadd736fab864aa41e0313ec9))
+* update templates for v2 scaffold ([74811f3](https://github.com/expressots/expressots/commit/74811f3ac54610be7367de75f37363dc0c107dbc))
+
+
+### Build System
+
+* **scripts:** add cross platform build scripts ([e6cecbc](https://github.com/expressots/expressots/commit/e6cecbc6b7a309f00aa6cd60f6d8207dc8d4c5cb))
 * **scripts:** add cross platform build scripts ([8b5c133](https://github.com/expressots/expressots/commit/8b5c133e4e28d67b8a7edca5b04bfe04a6d12540))
 
 ## [2.1.0](https://github.com/expressots/expressots/compare/2.0.0...2.1.0) (2023-09-16)

package/lib/cjs/middleware/interfaces/helmet.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/cjs/middleware/middleware-resolver.js

@@ -24,6 +24,7 @@ class MiddlewareResolver {
         cookieSession: "cookie-session",
         serveFavicon: "serve-favicon",
         morgan: "morgan",
+        helmet: "helmet",
         rateLimit: "express-rate-limit",
         // Add other middlewares
     };

package/lib/cjs/middleware/middleware-service.js

@@ -161,6 +161,22 @@ let Middleware = Middleware_1 = class Middleware {
             });
         }
     }
+    /**
+     * Adds a middleware to enhance security by setting various HTTP headers.
+     *
+     * @param options - Optional configuration options for Helmet.
+     *
+     */
+    addHelmet(options) {
+        const middleware = (0, middleware_resolver_1.middlewareResolver)("helmet", options);
+        const middlewareExist = this.middlewareExists("helmet");
+        if (middleware && !middlewareExist) {
+            this.middlewarePipeline.push({
+                timestamp: new Date(),
+                middleware,
+            });
+        }
+    }
     /**
      * Configures the error handling middleware for the application.
      *

package/lib/cjs/types/middleware/index.d.ts

@@ -3,6 +3,7 @@ export { OptionsJson } from "./interfaces/body-parser.interface";
 export { CorsOptions } from "./interfaces/cors.interface";
 export { CompressionOptions } from "./interfaces/compression.interface";
 export { CookieSessionOptions } from "./interfaces/cookie-session/cookie-session.interface";
+export { OptionsHelmet } from "./interfaces/helmet.interface";
 export { Keygrip } from "./interfaces/cookie-session/keygrip.interface";
 export { CookieParserOptions } from "./interfaces/cookie-parser.interface";
 export { ServeFaviconOptions } from "./interfaces/serve-favicon.interface";

package/lib/cjs/types/middleware/interfaces/helmet.interface.d.ts

@@ -0,0 +1,210 @@
+import { Request, Response } from "express";
+/**
+ * @typedef {string} cspDirectiveValue
+ * Possible values for Content Security Policy directives.
+ * Can be 'self', 'none', or a string.
+ */
+type cspDirectiveValue = "self" | "none" | string;
+/**
+ * @interface directiveOptions
+ * Options for defining Content Security Policy directives.
+ */
+interface directiveOptions {
+    "default-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "base-uri"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "font-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "form-action"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "frame-ancestors"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "img-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "object-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "script-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "script-src-attr"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "style-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "upgrade-insecure-requests"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+}
+/**
+ * @interface ContentSecurityPolicy
+ * Defines a Content Security Policy configuration.
+ */
+interface ContentSecurityPolicy {
+    /**
+     * A function that sets Content Security Policy.
+     *
+     * @param {directiveOptions} options - Optional configuration options for Content Security Policy.
+     * @returns {Function} A middleware function.
+     */
+    useDefaults?: false;
+    directives?: directiveOptions;
+    reportOnly?: boolean;
+}
+/**
+ * @typedef {Object} CrossOriginEmbedderPolicyOptions
+ * An optional policy for Cross-Origin Embedder Policy.
+ */
+interface CrossOriginEmbedderPolicyOptions {
+    /**
+     * An optional policy for Cross-Origin Embedder Policy.
+     */
+    policy?: "require-corp" | "credentialless";
+}
+/**
+ * @typedef {Object} CrossOriginOpenerPolicyOptions
+ * An optional policy for Cross-Origin Opener Policy.
+ */
+interface CrossOriginOpenerPolicyOptions {
+    /**
+     * An optional policy for Cross-Origin Opener Policy.
+     */
+    policy?: "same-origin" | "same-origin-allow-popups" | "unsafe-none";
+}
+/**
+ * @typedef {Object} CrossOriginResourcePolicyOptions
+ * An optional policy for Cross-Origin Resource Policy.
+ */
+interface CrossOriginResourcePolicyOptions {
+    /**
+     * An optional policy for Cross-Origin Resource Policy.
+     */
+    policy?: "same-origin" | "same-site" | "cross-origin";
+}
+/**
+ * @typedef {string} ReferrerPolicyToken
+ * A type alias for Referrer Policy tokens.
+ */
+type ReferrerPolicyToken = "no-referrer" | "no-referrer-when-downgrade" | "no-referrer" | "no-referrer-when-downgrade" | "same-origin" | "origin" | "strict-origin" | "origin-when-cross-origin" | "strict-origin-when-cross-origin" | "unsafe-url" | "";
+/**
+ * @typedef {Object} ReferrerPolicyOptions
+ * An optional policy for Referrer Policy.
+ */
+interface ReferrerPolicyOptions {
+    /**
+     * An optional policy for Referrer Policy.
+     */
+    policy?: ReferrerPolicyToken | Array<ReferrerPolicyToken> | false;
+}
+/**
+ * @typedef {Object} StrictTransportSecurityOptions
+ * Options for Strict Transport Security.
+ */
+interface StrictTransportSecurityOptions {
+    /**
+     * An optional max age for Strict Transport Security.
+     */
+    maxAge?: number;
+    /**
+     * An optional flag to include subdomains.
+     */
+    includeSubDomains?: boolean;
+    /**
+     * An optional flag for preload.
+     */
+    preload?: boolean;
+}
+/**
+ * @typedef {boolean|string} xContentTypeOptions
+ * Options for X-Content-Type-Options.
+ */
+type xContentTypeOptions = false | "nosniff";
+/**
+ * @typedef {Object} XDnsPrefetchControlOptions
+ * Options for X-DNS-Prefetch-Control.
+ */
+interface XDnsPrefetchControlOptions {
+    /**
+     * An optional flag to allow DNS prefetching.
+     */
+    allow?: boolean;
+}
+/**
+ * @typedef {Object} XFrameOptionsOptions
+ * Options for X-Frame-Options.
+ */
+interface XFrameOptionsOptions {
+    /**
+     * An optional action for X-Frame-Options.
+     */
+    action?: "deny" | "sameorigin" | false;
+}
+/**
+ * @typedef {Object} XPermittedCrossDomainPoliciesOptions
+ * Options for X-Permitted-Cross-Domain-Policies.
+ */
+interface XPermittedCrossDomainPoliciesOptions {
+    /**
+     * An optional policy for X-Permitted-Cross-Domain-Policies.
+     */
+    permittedPolicies?: "none" | "master-only" | "by-content-type" | "all";
+}
+/**
+ * @typedef {boolean} xPoweredByOptions
+ * Options for X-Powered-By.
+ */
+type xPoweredByOptions = false;
+/**
+ * @typedef {boolean} xXssProtectionOptions
+ * Options for X-XSS-Protection.
+ */
+type xXssProtectionOptions = false;
+/**
+ * @interface OptionsHelmet
+ * Options for Helmet middleware.
+ */
+export interface OptionsHelmet {
+    /**
+     * An optional Content Security Policy.
+     */
+    contentSecurityPolicy?: ContentSecurityPolicy | false;
+    /**
+     * An optional Cross-Origin Embedder Policy.
+     */
+    crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicyOptions | boolean;
+    /**
+     * An optional Cross-Origin Opener Policy.
+     */
+    crossOriginOpenerPolicy?: boolean | CrossOriginOpenerPolicyOptions;
+    /**
+     * An optional Cross-Origin Resource Policy.
+     */
+    crossOriginResourcePolicy?: boolean | CrossOriginResourcePolicyOptions;
+    /**
+     * An optional flag for originAgentCluster.
+     */
+    originAgentCluster?: false;
+    /**
+     * An optional Referrer Policy.
+     */
+    referrerPolicy?: ReferrerPolicyOptions;
+    /**
+     * An optional Strict Transport Security.
+     */
+    strictTransportSecurity?: StrictTransportSecurityOptions;
+    /**
+     * An optional X-Content-Type-Options.
+     */
+    xContentTypeOptions?: xContentTypeOptions;
+    /**
+     * An optional X-DNS-Prefetch-Control.
+     */
+    xDnsPrefetchControl?: XDnsPrefetchControlOptions;
+    /**
+     * An optional X-Download-Options.
+     */
+    xDownloadOptions?: boolean | "noopen";
+    /**
+     * An optional X-Frame-Options.
+     */
+    xFrameOptions?: XFrameOptionsOptions;
+    /**
+     * An optional X-Permitted-Cross-Domain-Policies.
+     */
+    xPermittedCrossDomainPolicies?: XPermittedCrossDomainPoliciesOptions;
+    /**
+     * An optional X-Powered-By.
+     */
+    xPoweredBy?: xPoweredByOptions;
+    /**
+     * An optional X-XSS-Protection.
+     */
+    xXssProtection?: xXssProtectionOptions;
+}
+export {};

package/lib/cjs/types/middleware/middleware-service.d.ts

@@ -9,6 +9,7 @@ import { CookieSessionOptions } from "./interfaces/cookie-session/cookie-session
 import { ServeFaviconOptions } from "./interfaces/serve-favicon.interface";
 import { FormatFn, OptionsMorgan } from "./interfaces/morgan.interface";
 import { RateLimitOptions } from "./interfaces/express-rate-limit.interface";
+import { OptionsHelmet } from "./interfaces/helmet.interface";
 /**
  * ExpressHandler Type
  *
@@ -58,7 +59,7 @@ interface IMiddleware {
      * Adds a Rate Limit middleware to the middleware collection.
      * The rate limiter is responsible for adding dynamic rate limit and request throttling to the application.
      *
-     * @param options - Optional configuration options for the JSON body parser.
+     * @param options - Optional configuration options for the rate limiter.
      */
     addRateLimiter(options?: RateLimitOptions): void;
     /**
@@ -141,6 +142,13 @@ interface IMiddleware {
      * @returns The error handler middleware.
      */
     getErrorHandler(): ExpressHandler;
+    /**
+     * Adds Helmet middleware to enhance security by setting various HTTP headers.
+     *
+     * @param options - Optional configuration options for Helmet.
+     * @returns The configuration options for Helmet middleware.
+     */
+    addHelmet(options?: OptionsHelmet): void;
 }
 /**
  * Singleton class that implements the IConfigure interface.
@@ -208,6 +216,13 @@ declare class Middleware implements IMiddleware {
      * @param options - Optional configuration options for serving the favicon. Defines the behavior of the favicon middleware like cache control, custom headers, etc.
      */
     addServeFavicon(path: string | Buffer, options?: ServeFaviconOptions): void;
+    /**
+     * Adds a middleware to enhance security by setting various HTTP headers.
+     *
+     * @param options - Optional configuration options for Helmet.
+     *
+     */
+    addHelmet(options?: OptionsHelmet): void;
     /**
      * Configures the error handling middleware for the application.
      *

package/lib/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expressots/core",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Expressots - modern, fast, lightweight nodejs web framework (@core)",
   "author": "Richard Zampieri",
   "main": "./lib/cjs/index.js",
@@ -88,8 +88,8 @@
     "release-it": "^16.1.5",
     "ts-jest": "^29.0.5",
     "typescript": "^5.0.3",
-    "vite": "4.4.9",
-    "vitest": "0.34.5"
+    "vite": "4.4.10",
+    "vitest": "0.34.6"
   },
   "release-it": {
     "git": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expressots/core",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Expressots - modern, fast, lightweight nodejs web framework (@core)",
   "author": "Richard Zampieri",
   "main": "./lib/cjs/index.js",
@@ -88,8 +88,8 @@
     "release-it": "^16.1.5",
     "ts-jest": "^29.0.5",
     "typescript": "^5.0.3",
-    "vite": "4.4.9",
-    "vitest": "0.34.5"
+    "vite": "4.4.10",
+    "vitest": "0.34.6"
   },
   "release-it": {
     "git": {