@expressots/core 2.4.0 → 2.6.0

package/lib/CHANGELOG.md

@@ -1,71 +1,101 @@
 
 
-## [2.4.0](https://github.com/expressots/expressots/compare/2.3.0...2.4.0) (2023-10-01)
+## [2.6.0](https://github.com/expressots/expressots/compare/2.5.0...2.6.0) (2023-10-09)
 
 
 ### Features
 
-* add interface for `express-rate-limit` ([86cf5d2](https://github.com/expressots/expressots/commit/86cf5d2d2bdbdd4acdd6f4a0597634790d99f972))
-* implement `express-rate-limit` in service ([e31a5f4](https://github.com/expressots/expressots/commit/e31a5f47b67ac01795b6ac64e639cd53078f8048))
+* Added express-session middleware for expressots ([9d0c79f](https://github.com/expressots/expressots/commit/9d0c79f7c4b18cfcac17443c7f76c4384a563471))
+* bump vite from 4.4.10 to 4.4.11 ([45c8a80](https://github.com/expressots/expressots/commit/45c8a804e85875743cc18d95ec5441e19b7df7d3))
 
 
 ### Bug Fixes
 
-* add App container all tests ([d6c8212](https://github.com/expressots/expressots/commit/d6c8212ec80fe239b38e4ff592ed0be3e507cd99))
-* add cjs as default build ([d16cfa5](https://github.com/expressots/expressots/commit/d16cfa50238c2e299fffaf079fb62847de94e7d8))
-* add code coverage configuration ([3676e32](https://github.com/expressots/expressots/commit/3676e328833bd92ea7ebe28b567195bbd5c25bb2))
-* adjust reporter to text, html, json ([04acb04](https://github.com/expressots/expressots/commit/04acb04c2e9229f0531ffb990f22665d94506f2c))
-* remove adapter peer dependecy ([bad171b](https://github.com/expressots/expressots/commit/bad171be98f3b2ec58c3793836ba2000c3727dbc))
-* resolves all current issues ([877c121](https://github.com/expressots/expressots/commit/877c1216405e35b3b90f61caf13d73b20202eac5))
-
-
-### Documentation
-
-* add jsdoc to interfaces ([228d190](https://github.com/expressots/expressots/commit/228d190f7ca58c71e5bcd1f03ecf70b2e7fdbe03))
-
-
-### Code Refactoring
-
-* add types to default params ([b366e14](https://github.com/expressots/expressots/commit/b366e14d2b7d9322b4ea92ae3afdfbb834e42e16))
-* eliminate duplicate return statements ([b57fa85](https://github.com/expressots/expressots/commit/b57fa8517c5656fed71b73cc3c2b65834c8d8833))
-* revert changes due to future features ([89fce01](https://github.com/expressots/expressots/commit/89fce01f08ebd1539471e51808040e4383c3e6f4))
+* Auto setup husky with project setup and installation ([dcdc279](https://github.com/expressots/expressots/commit/dcdc279f9dffe82e739396df763f494c97a3e914))
+* remove prepare husky install from lib ([ba9b536](https://github.com/expressots/expressots/commit/ba9b5363904a7d8981ec49705d5fbf22e20c8dbd))
+* typo ([079aad6](https://github.com/expressots/expressots/commit/079aad6c125fcd100cde5cf98ce84125e7381879))
 
-## [2.3.0](https://github.com/expressots/expressots/compare/2.2.1...2.3.0) (2023-09-25)
+## [2.5.0](https://github.com/expressots/expressots/compare/2.4.0...2.5.0) (2023-10-04)
 
 
 ### Features
 
-* add morgan middleware ([ffe5f36](https://github.com/expressots/expressots/commit/ffe5f36b447f7fafd3a44c90a304b3b9c5ec4481))
-* bump vitest from 0.34.4 to 0.34.5 ([e1a1da5](https://github.com/expressots/expressots/commit/e1a1da51ab35bf6bb24ba9073b270a490ab331d8))
+* bump vite from 4.4.9 to 4.4.10 ([5be4adc](https://github.com/expressots/expressots/commit/5be4adc18d84c3affa57d248dd07801bda4dd5b9))
+* bump vitest from 0.34.5 to 0.34.6 ([11ca77f](https://github.com/expressots/expressots/commit/11ca77f29d19d1de05b2ae2a56b9e306311621bf))
+* **core:** add helmet middleware ([7648afb](https://github.com/expressots/expressots/commit/7648afb68054c1e69990f7d33efe35ec4d99b464)), closes [#107](https://github.com/expressots/expressots/issues/107)
 
 
 ### Bug Fixes
 
+* adjust interface, remove duplicated helmet registry ([376c065](https://github.com/expressots/expressots/commit/376c0654d655ee8d29c0649d83ec6fb7cf860791))
+* remove duplicate optionslhelmet interface ([93bfdea](https://github.com/expressots/expressots/commit/93bfdea0057614b0a2e449817fb095ed23112011))
+
+## [2.4.0](https://github.com/expressots/expressots/compare/2.3.0...2.4.0) (2023-10-01)
+
+
+### Features
+
+* add interface for `express-rate-limit` ([86cf5d2](https://github.com/expressots/expressots/commit/86cf5d2d2bdbdd4acdd6f4a0597634790d99f972))
+* implement `express-rate-limit` in service ([e31a5f4](https://github.com/expressots/expressots/commit/e31a5f47b67ac01795b6ac64e639cd53078f8048))
+
+
+### Bug Fixes
+
+* add App container all tests ([d6c8212](https://github.com/expressots/expressots/commit/d6c8212ec80fe239b38e4ff592ed0be3e507cd99))
+* add cjs as default build ([d16cfa5](https://github.com/expressots/expressots/commit/d16cfa50238c2e299fffaf079fb62847de94e7d8))
+* add code coverage configuration ([3676e32](https://github.com/expressots/expressots/commit/3676e328833bd92ea7ebe28b567195bbd5c25bb2))
+* adjust reporter to text, html, json ([04acb04](https://github.com/expressots/expressots/commit/04acb04c2e9229f0531ffb990f22665d94506f2c))
+* remove adapter peer dependecy ([bad171b](https://github.com/expressots/expressots/commit/bad171be98f3b2ec58c3793836ba2000c3727dbc))
+* resolves all current issues ([877c121](https://github.com/expressots/expressots/commit/877c1216405e35b3b90f61caf13d73b20202eac5))
+
+
+### Documentation
+
+* add jsdoc to interfaces ([228d190](https://github.com/expressots/expressots/commit/228d190f7ca58c71e5bcd1f03ecf70b2e7fdbe03))
+
+
+### Code Refactoring
+
+* add types to default params ([b366e14](https://github.com/expressots/expressots/commit/b366e14d2b7d9322b4ea92ae3afdfbb834e42e16))
+* eliminate duplicate return statements ([b57fa85](https://github.com/expressots/expressots/commit/b57fa8517c5656fed71b73cc3c2b65834c8d8833))
+* revert changes due to future features ([89fce01](https://github.com/expressots/expressots/commit/89fce01f08ebd1539471e51808040e4383c3e6f4))
+
+## [2.3.0](https://github.com/expressots/expressots/compare/2.2.1...2.3.0) (2023-09-25)
+
+
+### Features
+
+* add morgan middleware ([ffe5f36](https://github.com/expressots/expressots/commit/ffe5f36b447f7fafd3a44c90a304b3b9c5ec4481))
+* bump vitest from 0.34.4 to 0.34.5 ([e1a1da5](https://github.com/expressots/expressots/commit/e1a1da51ab35bf6bb24ba9073b270a490ab331d8))
+
+
+### Bug Fixes
+
 * add IMorgan interface to serve it types ([adb29e5](https://github.com/expressots/expressots/commit/adb29e505af79cf998f1288085695dfee8e5680d))
 
-## [2.2.0](https://github.com/expressots/expressots/compare/2.1.0...2.2.0) (2023-09-21)
-
-
-### Features
-
-* add middleware based routing ([3d7720e](https://github.com/expressots/expressots/commit/3d7720e21807117333d60e7f2b7bb01789b96060))
-* add serve-favicon middleware ([024bdc4](https://github.com/expressots/expressots/commit/024bdc4d8d4f9890175975d052ca09c5b4e245cf))
-* add serve-favicon middleware ([0733697](https://github.com/expressots/expressots/commit/0733697ed66a7133e60ec6fa09bdaeb0bf1985d7))
-
-
-### Bug Fixes
-
-* add chore message to pre-commit hook ([45ae428](https://github.com/expressots/expressots/commit/45ae428652bb6e4f49cb2a6334686be0dee3669d))
-* add middleware validation based on path ([7035153](https://github.com/expressots/expressots/commit/7035153dededd3ca7c5159544f4ab79baee2c4d7))
-* re-write cp, mv and rm improving performance ([68d68ad](https://github.com/expressots/expressots/commit/68d68ad11385ca783fa5c51e3092937a6f898ac6))
-* update contribute_howto doc ([4bf6e12](https://github.com/expressots/expressots/commit/4bf6e121091e894a7675ff78959ab4647ec04f6d))
-* update contribute_howto doc ([fbbe47d](https://github.com/expressots/expressots/commit/fbbe47d6df76211fadd736fab864aa41e0313ec9))
-* update templates for v2 scaffold ([74811f3](https://github.com/expressots/expressots/commit/74811f3ac54610be7367de75f37363dc0c107dbc))
-
-
-### Build System
-
-* **scripts:** add cross platform build scripts ([e6cecbc](https://github.com/expressots/expressots/commit/e6cecbc6b7a309f00aa6cd60f6d8207dc8d4c5cb))
+## [2.2.0](https://github.com/expressots/expressots/compare/2.1.0...2.2.0) (2023-09-21)
+
+
+### Features
+
+* add middleware based routing ([3d7720e](https://github.com/expressots/expressots/commit/3d7720e21807117333d60e7f2b7bb01789b96060))
+* add serve-favicon middleware ([024bdc4](https://github.com/expressots/expressots/commit/024bdc4d8d4f9890175975d052ca09c5b4e245cf))
+* add serve-favicon middleware ([0733697](https://github.com/expressots/expressots/commit/0733697ed66a7133e60ec6fa09bdaeb0bf1985d7))
+
+
+### Bug Fixes
+
+* add chore message to pre-commit hook ([45ae428](https://github.com/expressots/expressots/commit/45ae428652bb6e4f49cb2a6334686be0dee3669d))
+* add middleware validation based on path ([7035153](https://github.com/expressots/expressots/commit/7035153dededd3ca7c5159544f4ab79baee2c4d7))
+* re-write cp, mv and rm improving performance ([68d68ad](https://github.com/expressots/expressots/commit/68d68ad11385ca783fa5c51e3092937a6f898ac6))
+* update contribute_howto doc ([4bf6e12](https://github.com/expressots/expressots/commit/4bf6e121091e894a7675ff78959ab4647ec04f6d))
+* update contribute_howto doc ([fbbe47d](https://github.com/expressots/expressots/commit/fbbe47d6df76211fadd736fab864aa41e0313ec9))
+* update templates for v2 scaffold ([74811f3](https://github.com/expressots/expressots/commit/74811f3ac54610be7367de75f37363dc0c107dbc))
+
+
+### Build System
+
+* **scripts:** add cross platform build scripts ([e6cecbc](https://github.com/expressots/expressots/commit/e6cecbc6b7a309f00aa6cd60f6d8207dc8d4c5cb))
 * **scripts:** add cross platform build scripts ([8b5c133](https://github.com/expressots/expressots/commit/8b5c133e4e28d67b8a7edca5b04bfe04a6d12540))
 
 ## [2.1.0](https://github.com/expressots/expressots/compare/2.0.0...2.1.0) (2023-09-16)

package/lib/cjs/middleware/interfaces/express-session.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/cjs/middleware/interfaces/helmet.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/cjs/middleware/middleware-resolver.js

@@ -24,7 +24,9 @@ class MiddlewareResolver {
         cookieSession: "cookie-session",
         serveFavicon: "serve-favicon",
         morgan: "morgan",
+        helmet: "helmet",
         rateLimit: "express-rate-limit",
+        session: "express-session",
         // Add other middlewares
     };
     /**

package/lib/cjs/middleware/middleware-service.js

@@ -161,6 +161,38 @@ let Middleware = Middleware_1 = class Middleware {
             });
         }
     }
+    /**
+     * Adds a middleware to enhance security by setting various HTTP headers.
+     *
+     * @param options - Optional configuration options for Helmet.
+     *
+     */
+    addHelmet(options) {
+        const middleware = (0, middleware_resolver_1.middlewareResolver)("helmet", options);
+        const middlewareExist = this.middlewareExists("helmet");
+        if (middleware && !middlewareExist) {
+            this.middlewarePipeline.push({
+                timestamp: new Date(),
+                middleware,
+            });
+        }
+    }
+    /**
+     * Add a middleware to enable express-session.
+     *
+     * @param options - Optional configuration options for Session.
+     *
+     */
+    addSession(options) {
+        const middleware = (0, middleware_resolver_1.middlewareResolver)("session", options);
+        const middlewareExist = this.middlewareExists("session");
+        if (middleware && !middlewareExist) {
+            this.middlewarePipeline.push({
+                timestamp: new Date(),
+                middleware,
+            });
+        }
+    }
     /**
      * Configures the error handling middleware for the application.
      *

package/lib/cjs/types/middleware/index.d.ts

@@ -3,6 +3,8 @@ export { OptionsJson } from "./interfaces/body-parser.interface";
 export { CorsOptions } from "./interfaces/cors.interface";
 export { CompressionOptions } from "./interfaces/compression.interface";
 export { CookieSessionOptions } from "./interfaces/cookie-session/cookie-session.interface";
+export { OptionsHelmet } from "./interfaces/helmet.interface";
+export { SessionOptions } from "./interfaces/express-session.interface";
 export { Keygrip } from "./interfaces/cookie-session/keygrip.interface";
 export { CookieParserOptions } from "./interfaces/cookie-parser.interface";
 export { ServeFaviconOptions } from "./interfaces/serve-favicon.interface";

package/lib/cjs/types/middleware/interfaces/express-session.interface.d.ts

@@ -0,0 +1,208 @@
+/// <reference types="express-serve-static-core" />
+import { Request } from "express";
+interface SessionData {
+    cookie: Cookie;
+}
+interface Cookie extends CookieOptions {
+    /** Returns the original `maxAge` (time-to-live), in milliseconds, of the session cookie. */
+    originalMaxAge: number | null;
+}
+interface Session {
+    id: string;
+    cookie: Cookie;
+    regenerate(callback: (err: any) => void): this;
+    destroy(callback: (err: any) => void): this;
+    reload(callback: (err: any) => void): this;
+    resetMaxAge(): this;
+    save(callback?: (err: any) => void): this;
+    touch(): this;
+}
+interface Store {
+    regenerate(req: Request, callback: (err?: any) => any): void;
+    load(sid: string, callback: (err: any, session?: SessionData) => any): void;
+    createSession(req: Request, session: SessionData): Session & SessionData;
+    get(sid: string, callback: (err: any, session?: SessionData | null) => void): void;
+    set(sid: string, session: SessionData, callback?: (err?: any) => void): void;
+    destroy(sid: string, callback?: (err?: any) => void): void;
+    all?(callback: (err: any, obj?: Array<SessionData> | {
+        [sid: string]: SessionData;
+    } | null) => void): void;
+    length?(callback: (err: any, length?: number) => void): void;
+    clear?(callback?: (err?: any) => void): void;
+    touch?(sid: string, session: SessionData, callback?: () => void): void;
+}
+interface CookieOptions {
+    /**
+     * Specifies the number (in milliseconds) to use when calculating the `Expires Set-Cookie` attribute.
+     * This is done by taking the current server time and adding `maxAge` milliseconds to the value to calculate an `Expires` datetime. By default, no maximum age is set.
+     *
+     * If both `expires` and `maxAge` are set in the options, then the last one defined in the object is what is used.
+     * `maxAge` should be preferred over `expires`.
+     *
+     * @see expires
+     */
+    maxAge?: number | undefined;
+    signed?: boolean | undefined;
+    /**
+     * Specifies the `Date` object to be the value for the `Expires Set-Cookie` attribute.
+     * By default, no expiration is set, and most clients will consider this a "non-persistent cookie" and will delete it on a condition like exiting a web browser application.
+     *
+     * If both `expires` and `maxAge` are set in the options, then the last one defined in the object is what is used.
+     *
+     * @deprecated The `expires` option should not be set directly; instead only use the `maxAge` option
+     * @see maxAge
+     */
+    expires?: Date | null | undefined;
+    /**
+     * Specifies the boolean value for the `HttpOnly Set-Cookie` attribute. When truthy, the `HttpOnly` attribute is set, otherwise it is not.
+     * By default, the `HttpOnly` attribute is set.
+     *
+     * Be careful when setting this to `true`, as compliant clients will not allow client-side JavaScript to see the cookie in `document.cookie`.
+     */
+    httpOnly?: boolean | undefined;
+    /**
+     * Specifies the value for the `Path Set-Cookie` attribute.
+     * By default, this is set to '/', which is the root path of the domain.
+     */
+    path?: string | undefined;
+    /**
+     * Specifies the value for the `Domain Set-Cookie` attribute.
+     * By default, no domain is set, and most clients will consider the cookie to apply to only the current domain.
+     */
+    domain?: string | undefined;
+    /**
+     * Specifies the boolean value for the `Secure Set-Cookie` attribute. When truthy, the `Secure` attribute is set, otherwise it is not. By default, the `Secure` attribute is not set.
+     * Be careful when setting this to true, as compliant clients will not send the cookie back to the server in the future if the browser does not have an HTTPS connection.
+     *
+     * Please note that `secure: true` is a **recommended option**.
+     * However, it requires an https-enabled website, i.e., HTTPS is necessary for secure cookies.
+     * If `secure` is set, and you access your site over HTTP, **the cookie will not be set**.
+     *
+     * The cookie.secure option can also be set to the special value `auto` to have this setting automatically match the determined security of the connection.
+     * Be careful when using this setting if the site is available both as HTTP and HTTPS, as once the cookie is set on HTTPS, it will no longer be visible over HTTP.
+     * This is useful when the Express "trust proxy" setting is properly setup to simplify development vs production configuration.
+     *
+     * If you have your node.js behind a proxy and are using `secure: true`, you need to set "trust proxy" in express. Please see the [README](https://github.com/expressjs/session) for details.
+     *
+     * Please see the [README](https://github.com/expressjs/session) for an example of using secure cookies in production, but allowing for testing in development based on NODE_ENV.
+     */
+    secure?: boolean | "auto" | undefined;
+    encode?: ((val: string) => string) | undefined;
+    /**
+     * Specifies the boolean or string to be the value for the `SameSite Set-Cookie` attribute.
+     * - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+     * - `false` will not set the `SameSite` attribute.
+     * - `lax` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+     * - `none` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
+     * - `strict` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+     *
+     * More information about the different enforcement levels can be found in the specification.
+     *
+     * **Note:** This is an attribute that has not yet been fully standardized, and may change in the future.
+     * This also means many clients may ignore this attribute until they understand it.
+     */
+    sameSite?: boolean | "lax" | "strict" | "none" | undefined;
+}
+interface SessionOptions {
+    /**
+     * This is the secret used to sign the session cookie. This can be either a string for a single secret, or an array of multiple secrets.
+     * If an array of secrets is provided, **only the first element will be used to sign** the session ID cookie,
+     *   while **all the elements will be considered when verifying the signature** in requests.
+     * The secret itself should be not easily parsed by a human and would best be a random set of characters
+     *
+     * Best practices may include:
+     * - The use of environment variables to store the secret, ensuring the secret itself does not exist in your repository.
+     * - Periodic updates of the secret, while ensuring the previous secret is in the array.
+     *
+     * Using a secret that cannot be guessed will reduce the ability to hijack a session to only guessing the session ID (as determined by the `genid` option).
+     *
+     * Changing the secret value will invalidate all existing sessions.
+     * In order to rotate the secret without invalidating sessions, provide an array of secrets,
+     *   with the new secret as first element of the array, and including previous secrets as the later elements.
+     */
+    secret: string | Array<string>;
+    /**
+     * Function to call to generate a new session ID. Provide a function that returns a string that will be used as a session ID.
+     * The function is given the request as the first argument if you want to use some value attached to it when generating the ID.
+     *
+     * The default value is a function which uses the uid-safe library to generate IDs.
+     * Be careful to generate unique IDs so your sessions do not conflict.
+     */
+    genid?(req: Express.Request): string;
+    /**
+     * The name of the session ID cookie to set in the response (and read from in the request).
+     * The default value is 'connect.sid'.
+     *
+     * Note if you have multiple apps running on the same hostname (this is just the name, i.e. `localhost` or `127.0.0.1`; different schemes and ports do not name a different hostname),
+     *   then you need to separate the session cookies from each other.
+     * The simplest method is to simply set different names per app.
+     */
+    name?: string | undefined;
+    /**
+     * The session store instance, defaults to a new `MemoryStore` instance.
+     * @see MemoryStore
+     */
+    store?: Store | undefined;
+    /**
+     * Settings object for the session ID cookie.
+     * @see CookieOptions
+     */
+    cookie?: CookieOptions | undefined;
+    /**
+     * Force the session identifier cookie to be set on every response. The expiration is reset to the original `maxAge`, resetting the expiration countdown.
+     * The default value is `false`.
+     *
+     * With this enabled, the session identifier cookie will expire in `maxAge` *since the last response was sent* instead of in `maxAge` *since the session was last modified by the server*.
+     * This is typically used in conjuction with short, non-session-length `maxAge` values to provide a quick timeout of the session data
+     *   with reduced potential of it occurring during on going server interactions.
+     *
+     * Note that when this option is set to `true` but the `saveUninitialized` option is set to `false`, the cookie will not be set on a response with an uninitialized session.
+     * This option only modifies the behavior when an existing session was loaded for the request.
+     *
+     * @see saveUninitialized
+     */
+    rolling?: boolean | undefined;
+    /**
+     * Forces the session to be saved back to the session store, even if the session was never modified during the request.
+     * Depending on your store this may be necessary, but it can also create race conditions where a client makes two parallel requests to your server
+     *   and changes made to the session in one request may get overwritten when the other request ends, even if it made no changes (this behavior also depends on what store you're using).
+     *
+     * The default value is `true`, but using the default has been deprecated, as the default will change in the future.
+     * Please research into this setting and choose what is appropriate to your use-case. Typically, you'll want `false`.
+     *
+     * How do I know if this is necessary for my store? The best way to know is to check with your store if it implements the `touch` method.
+     * If it does, then you can safely set `resave: false`.
+     * If it does not implement the `touch` method and your store sets an expiration date on stored sessions, then you likely need `resave: true`.
+     */
+    resave?: boolean | undefined;
+    /**
+     * Trust the reverse proxy when setting secure cookies (via the "X-Forwarded-Proto" header).
+     * The default value is undefined.
+     *
+     * - `true`: The `X-Forwarded-Proto` header will be used.
+     * - `false`: All headers are ignored and the connection is considered secure only if there is a direct TLS/SSL connection.
+     * - `undefined`: Uses the "trust proxy" setting from express
+     */
+    proxy?: boolean | undefined;
+    /**
+     * Forces a session that is "uninitialized" to be saved to the store. A session is uninitialized when it is new but not modified.
+     * Choosing `false` is useful for implementing login sessions, reducing server storage usage, or complying with laws that require permission before setting a cookie.
+     * Choosing `false` will also help with race conditions where a client makes multiple parallel requests without a session.
+     *
+     * The default value is `true`, but using the default has been deprecated, as the default will change in the future.
+     * Please research into this setting and choose what is appropriate to your use-case.
+     *
+     * **If you are using `express-session` in conjunction with PassportJS:**
+     * Passport will add an empty Passport object to the session for use after a user is authenticated, which will be treated as a modification to the session, causing it to be saved.
+     * This has been fixed in PassportJS 0.3.0.
+     */
+    saveUninitialized?: boolean | undefined;
+    /**
+     * Control the result of unsetting req.session (through delete, setting to null, etc.).
+     * - `destroy`: The session will be destroyed (deleted) when the response ends.
+     * - `keep`: The session in the store will be kept, but modifications made during the request are ignored and not saved.
+     * @default 'keep'
+     */
+    unset?: "destroy" | "keep" | undefined;
+}
+export { SessionOptions };

package/lib/cjs/types/middleware/interfaces/helmet.interface.d.ts

@@ -0,0 +1,210 @@
+import { Request, Response } from "express";
+/**
+ * @typedef {string} cspDirectiveValue
+ * Possible values for Content Security Policy directives.
+ * Can be 'self', 'none', or a string.
+ */
+type cspDirectiveValue = "self" | "none" | string;
+/**
+ * @interface directiveOptions
+ * Options for defining Content Security Policy directives.
+ */
+interface directiveOptions {
+    "default-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "base-uri"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "font-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "form-action"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "frame-ancestors"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "img-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "object-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "script-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "script-src-attr"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "style-src"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+    "upgrade-insecure-requests"?: Array<cspDirectiveValue> | null | Array<(req: Request, res: Response) => string>;
+}
+/**
+ * @interface ContentSecurityPolicy
+ * Defines a Content Security Policy configuration.
+ */
+interface ContentSecurityPolicy {
+    /**
+     * A function that sets Content Security Policy.
+     *
+     * @param {directiveOptions} options - Optional configuration options for Content Security Policy.
+     * @returns {Function} A middleware function.
+     */
+    useDefaults?: false;
+    directives?: directiveOptions;
+    reportOnly?: boolean;
+}
+/**
+ * @typedef {Object} CrossOriginEmbedderPolicyOptions
+ * An optional policy for Cross-Origin Embedder Policy.
+ */
+interface CrossOriginEmbedderPolicyOptions {
+    /**
+     * An optional policy for Cross-Origin Embedder Policy.
+     */
+    policy?: "require-corp" | "credentialless";
+}
+/**
+ * @typedef {Object} CrossOriginOpenerPolicyOptions
+ * An optional policy for Cross-Origin Opener Policy.
+ */
+interface CrossOriginOpenerPolicyOptions {
+    /**
+     * An optional policy for Cross-Origin Opener Policy.
+     */
+    policy?: "same-origin" | "same-origin-allow-popups" | "unsafe-none";
+}
+/**
+ * @typedef {Object} CrossOriginResourcePolicyOptions
+ * An optional policy for Cross-Origin Resource Policy.
+ */
+interface CrossOriginResourcePolicyOptions {
+    /**
+     * An optional policy for Cross-Origin Resource Policy.
+     */
+    policy?: "same-origin" | "same-site" | "cross-origin";
+}
+/**
+ * @typedef {string} ReferrerPolicyToken
+ * A type alias for Referrer Policy tokens.
+ */
+type ReferrerPolicyToken = "no-referrer" | "no-referrer-when-downgrade" | "no-referrer" | "no-referrer-when-downgrade" | "same-origin" | "origin" | "strict-origin" | "origin-when-cross-origin" | "strict-origin-when-cross-origin" | "unsafe-url" | "";
+/**
+ * @typedef {Object} ReferrerPolicyOptions
+ * An optional policy for Referrer Policy.
+ */
+interface ReferrerPolicyOptions {
+    /**
+     * An optional policy for Referrer Policy.
+     */
+    policy?: ReferrerPolicyToken | Array<ReferrerPolicyToken> | false;
+}
+/**
+ * @typedef {Object} StrictTransportSecurityOptions
+ * Options for Strict Transport Security.
+ */
+interface StrictTransportSecurityOptions {
+    /**
+     * An optional max age for Strict Transport Security.
+     */
+    maxAge?: number;
+    /**
+     * An optional flag to include subdomains.
+     */
+    includeSubDomains?: boolean;
+    /**
+     * An optional flag for preload.
+     */
+    preload?: boolean;
+}
+/**
+ * @typedef {boolean|string} xContentTypeOptions
+ * Options for X-Content-Type-Options.
+ */
+type xContentTypeOptions = false | "nosniff";
+/**
+ * @typedef {Object} XDnsPrefetchControlOptions
+ * Options for X-DNS-Prefetch-Control.
+ */
+interface XDnsPrefetchControlOptions {
+    /**
+     * An optional flag to allow DNS prefetching.
+     */
+    allow?: boolean;
+}
+/**
+ * @typedef {Object} XFrameOptionsOptions
+ * Options for X-Frame-Options.
+ */
+interface XFrameOptionsOptions {
+    /**
+     * An optional action for X-Frame-Options.
+     */
+    action?: "deny" | "sameorigin" | false;
+}
+/**
+ * @typedef {Object} XPermittedCrossDomainPoliciesOptions
+ * Options for X-Permitted-Cross-Domain-Policies.
+ */
+interface XPermittedCrossDomainPoliciesOptions {
+    /**
+     * An optional policy for X-Permitted-Cross-Domain-Policies.
+     */
+    permittedPolicies?: "none" | "master-only" | "by-content-type" | "all";
+}
+/**
+ * @typedef {boolean} xPoweredByOptions
+ * Options for X-Powered-By.
+ */
+type xPoweredByOptions = false;
+/**
+ * @typedef {boolean} xXssProtectionOptions
+ * Options for X-XSS-Protection.
+ */
+type xXssProtectionOptions = false;
+/**
+ * @interface OptionsHelmet
+ * Options for Helmet middleware.
+ */
+export interface OptionsHelmet {
+    /**
+     * An optional Content Security Policy.
+     */
+    contentSecurityPolicy?: ContentSecurityPolicy | false;
+    /**
+     * An optional Cross-Origin Embedder Policy.
+     */
+    crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicyOptions | boolean;
+    /**
+     * An optional Cross-Origin Opener Policy.
+     */
+    crossOriginOpenerPolicy?: boolean | CrossOriginOpenerPolicyOptions;
+    /**
+     * An optional Cross-Origin Resource Policy.
+     */
+    crossOriginResourcePolicy?: boolean | CrossOriginResourcePolicyOptions;
+    /**
+     * An optional flag for originAgentCluster.
+     */
+    originAgentCluster?: false;
+    /**
+     * An optional Referrer Policy.
+     */
+    referrerPolicy?: ReferrerPolicyOptions;
+    /**
+     * An optional Strict Transport Security.
+     */
+    strictTransportSecurity?: StrictTransportSecurityOptions;
+    /**
+     * An optional X-Content-Type-Options.
+     */
+    xContentTypeOptions?: xContentTypeOptions;
+    /**
+     * An optional X-DNS-Prefetch-Control.
+     */
+    xDnsPrefetchControl?: XDnsPrefetchControlOptions;
+    /**
+     * An optional X-Download-Options.
+     */
+    xDownloadOptions?: boolean | "noopen";
+    /**
+     * An optional X-Frame-Options.
+     */
+    xFrameOptions?: XFrameOptionsOptions;
+    /**
+     * An optional X-Permitted-Cross-Domain-Policies.
+     */
+    xPermittedCrossDomainPolicies?: XPermittedCrossDomainPoliciesOptions;
+    /**
+     * An optional X-Powered-By.
+     */
+    xPoweredBy?: xPoweredByOptions;
+    /**
+     * An optional X-XSS-Protection.
+     */
+    xXssProtection?: xXssProtectionOptions;
+}
+export {};

package/lib/cjs/types/middleware/middleware-service.d.ts

@@ -9,6 +9,8 @@ import { CookieSessionOptions } from "./interfaces/cookie-session/cookie-session
 import { ServeFaviconOptions } from "./interfaces/serve-favicon.interface";
 import { FormatFn, OptionsMorgan } from "./interfaces/morgan.interface";
 import { RateLimitOptions } from "./interfaces/express-rate-limit.interface";
+import { OptionsHelmet } from "./interfaces/helmet.interface";
+import { SessionOptions } from "./interfaces/express-session.interface";
 /**
  * ExpressHandler Type
  *
@@ -58,7 +60,7 @@ interface IMiddleware {
      * Adds a Rate Limit middleware to the middleware collection.
      * The rate limiter is responsible for adding dynamic rate limit and request throttling to the application.
      *
-     * @param options - Optional configuration options for the JSON body parser.
+     * @param options - Optional configuration options for the rate limiter.
      */
     addRateLimiter(options?: RateLimitOptions): void;
     /**
@@ -108,6 +110,13 @@ interface IMiddleware {
      * @param options - Optional configuration options for serving the favicon. Defines the behavior of the favicon middleware like cache control, custom headers, etc.
      */
     addServeFavicon(path: string | Buffer, options?: ServeFaviconOptions): void;
+    /**
+     * Add a middleware to enable express-session.
+     *
+     * @param options - Optional configuration options for Session.
+     *
+     */
+    addSession(options: SessionOptions): void;
     /**
      * Configures the error handling middleware for the application.
      *
@@ -141,6 +150,13 @@ interface IMiddleware {
      * @returns The error handler middleware.
      */
     getErrorHandler(): ExpressHandler;
+    /**
+     * Adds Helmet middleware to enhance security by setting various HTTP headers.
+     *
+     * @param options - Optional configuration options for Helmet.
+     * @returns The configuration options for Helmet middleware.
+     */
+    addHelmet(options?: OptionsHelmet): void;
 }
 /**
  * Singleton class that implements the IConfigure interface.
@@ -208,6 +224,20 @@ declare class Middleware implements IMiddleware {
      * @param options - Optional configuration options for serving the favicon. Defines the behavior of the favicon middleware like cache control, custom headers, etc.
      */
     addServeFavicon(path: string | Buffer, options?: ServeFaviconOptions): void;
+    /**
+     * Adds a middleware to enhance security by setting various HTTP headers.
+     *
+     * @param options - Optional configuration options for Helmet.
+     *
+     */
+    addHelmet(options?: OptionsHelmet): void;
+    /**
+     * Add a middleware to enable express-session.
+     *
+     * @param options - Optional configuration options for Session.
+     *
+     */
+    addSession(options: SessionOptions): void;
     /**
      * Configures the error handling middleware for the application.
      *

package/lib/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expressots/core",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "Expressots - modern, fast, lightweight nodejs web framework (@core)",
   "author": "Richard Zampieri",
   "main": "./lib/cjs/index.js",
@@ -88,8 +88,8 @@
     "release-it": "^16.1.5",
     "ts-jest": "^29.0.5",
     "typescript": "^5.0.3",
-    "vite": "4.4.9",
-    "vitest": "0.34.5"
+    "vite": "4.4.11",
+    "vitest": "0.34.6"
   },
   "release-it": {
     "git": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expressots/core",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "Expressots - modern, fast, lightweight nodejs web framework (@core)",
   "author": "Richard Zampieri",
   "main": "./lib/cjs/index.js",
@@ -88,8 +88,8 @@
     "release-it": "^16.1.5",
     "ts-jest": "^29.0.5",
     "typescript": "^5.0.3",
-    "vite": "4.4.9",
-    "vitest": "0.34.5"
+    "vite": "4.4.11",
+    "vitest": "0.34.6"
   },
   "release-it": {
     "git": {