@fresho/router 0.0.1 → 0.1.0

package/dist/middleware/index.mjs

@@ -0,0 +1,675 @@
+import { t as compose } from "../middleware-BpFh0XrR.mjs";
+
+//#region src/middleware/auth.ts
+/**
+* Creates a Basic HTTP authentication middleware.
+*
+* @example
+* ```typescript
+* const adminRouter = router('/admin', routes,
+*   basicAuth({
+*     verify: async (username, password) => {
+*       if (username === 'admin' && password === 'secret') {
+*         return { user: { name: username } };
+*       }
+*       return null;
+*     }
+*   })
+* );
+* ```
+*/
+function basicAuth(options) {
+	const realm = options.realm || "Secure Area";
+	return async (context, next) => {
+		const { request } = context;
+		const authHeader = request.headers.get("Authorization");
+		if (!authHeader?.startsWith("Basic ")) return new Response("Unauthorized", {
+			status: 401,
+			headers: { "WWW-Authenticate": `Basic realm="${realm}", charset="UTF-8"` }
+		});
+		try {
+			const credentials = atob(authHeader.slice(6));
+			const colonIndex = credentials.indexOf(":");
+			if (colonIndex === -1) throw new Error("Invalid credentials format");
+			const username = credentials.substring(0, colonIndex);
+			const password = credentials.substring(colonIndex + 1);
+			const claims = await options.verify(username, password, context);
+			if (claims === null) return new Response("Invalid credentials", {
+				status: 401,
+				headers: { "WWW-Authenticate": `Basic realm="${realm}", charset="UTF-8"` }
+			});
+			Object.assign(context, claims);
+			return next();
+		} catch (_error) {
+			return new Response("Invalid credentials", {
+				status: 401,
+				headers: { "WWW-Authenticate": `Basic realm="${realm}", charset="UTF-8"` }
+			});
+		}
+	};
+}
+/** Maps JWT algorithm names to Web Crypto hash names. */
+const ALGORITHM_MAP = {
+	HS256: "SHA-256",
+	HS384: "SHA-384",
+	HS512: "SHA-512"
+};
+/**
+* Verifies a JWT token using Web Crypto API.
+*
+* Uses only Web Crypto API, compatible with Cloudflare Workers, Deno, and browsers.
+*
+* @param token - The JWT token string to verify
+* @param secret - The secret used to sign the token (string, ArrayBuffer, or CryptoKey)
+* @param options - Optional verification options
+* @returns The decoded JWT payload
+* @throws Error if the token is invalid, expired, or not yet valid
+*
+* @example
+* ```typescript
+* import { jwtVerify } from '@fresho/router/middleware';
+*
+* try {
+*   const payload = await jwtVerify(token, 'your-secret-key');
+*   console.log(payload.sub); // user ID
+* } catch (error) {
+*   console.error('Invalid token:', error.message);
+* }
+*
+* // With specific algorithms
+* const payload = await jwtVerify(token, secret, { algorithms: ['HS512'] });
+* ```
+*/
+async function jwtVerify(token, secret, options = {}) {
+	const algorithms = options.algorithms || ["HS256"];
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new Error("Invalid JWT format");
+	const [headerB64, payloadB64, signatureB64] = parts;
+	const header = JSON.parse(atob(headerB64.replace(/-/g, "+").replace(/_/g, "/")));
+	if (!algorithms.includes(header.alg)) throw new Error(`Unsupported algorithm: ${header.alg}`);
+	const hashAlg = ALGORITHM_MAP[header.alg];
+	if (!hashAlg) throw new Error(`Unknown algorithm: ${header.alg}`);
+	const payload = JSON.parse(atob(payloadB64.replace(/-/g, "+").replace(/_/g, "/")));
+	const data = `${headerB64}.${payloadB64}`;
+	const signature = Uint8Array.from(atob(signatureB64.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0));
+	let key;
+	if (secret instanceof CryptoKey) key = secret;
+	else {
+		const keyData = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+		key = await crypto.subtle.importKey("raw", keyData, {
+			name: "HMAC",
+			hash: hashAlg
+		}, false, ["verify"]);
+	}
+	if (!await crypto.subtle.verify("HMAC", key, signature, new TextEncoder().encode(data))) throw new Error("Invalid signature");
+	if (payload.exp && payload.exp < Date.now() / 1e3) throw new Error("Token expired");
+	if (payload.nbf && payload.nbf > Date.now() / 1e3) throw new Error("Token not yet valid");
+	return payload;
+}
+/**
+* Parses a duration string (e.g., '1h', '7d', '30m') to seconds.
+*/
+function parseDuration(duration) {
+	if (typeof duration === "number") return duration;
+	const match = duration.match(/^(\d+)\s*(s|m|h|d|w)$/i);
+	if (!match) throw new Error(`Invalid duration format: ${duration}. Use formats like '1h', '7d', '30m', '60s'.`);
+	const value = parseInt(match[1], 10);
+	const unit = match[2].toLowerCase();
+	switch (unit) {
+		case "s": return value;
+		case "m": return value * 60;
+		case "h": return value * 60 * 60;
+		case "d": return value * 60 * 60 * 24;
+		case "w": return value * 60 * 60 * 24 * 7;
+		default: throw new Error(`Unknown duration unit: ${unit}`);
+	}
+}
+/**
+* Base64url encodes a string or Uint8Array.
+*/
+function base64urlEncode(data) {
+	const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+	const binary = String.fromCharCode(...bytes);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/**
+* Signs a JWT token using Web Crypto API.
+*
+* Uses only Web Crypto API, compatible with Cloudflare Workers, Deno, and browsers.
+*
+* @param payload - The JWT payload (custom claims)
+* @param secret - The signing secret (string, ArrayBuffer, or CryptoKey)
+* @param options - Optional signing options (algorithm, expiresIn, issuer, etc.)
+* @returns The signed JWT token string
+*
+* @example
+* ```typescript
+* // Basic usage (HS256 by default)
+* const token = await jwtSign(
+*   { uid: 'user-123', role: 'admin' },
+*   'your-secret-key',
+*   { expiresIn: '1h' }
+* );
+*
+* // With HS512 algorithm
+* const token = await jwtSign(
+*   { uid: 'user-123' },
+*   process.env.JWT_SECRET,
+*   { algorithm: 'HS512', expiresIn: '7d' }
+* );
+* ```
+*/
+async function jwtSign(payload, secret, options = {}) {
+	const algorithm = options.algorithm || "HS256";
+	const hashAlg = ALGORITHM_MAP[algorithm];
+	const now = options.issuedAt ? options.issuedAt instanceof Date ? Math.floor(options.issuedAt.getTime() / 1e3) : options.issuedAt : Math.floor(Date.now() / 1e3);
+	const finalPayload = {
+		...payload,
+		iat: now
+	};
+	if (options.expiresIn !== void 0) finalPayload.exp = now + parseDuration(options.expiresIn);
+	if (options.notBefore !== void 0) finalPayload.nbf = now + parseDuration(options.notBefore);
+	if (options.issuer !== void 0) finalPayload.iss = options.issuer;
+	if (options.audience !== void 0) finalPayload.aud = options.audience;
+	if (options.subject !== void 0) finalPayload.sub = options.subject;
+	const header = {
+		alg: algorithm,
+		typ: "JWT"
+	};
+	const data = `${base64urlEncode(JSON.stringify(header))}.${base64urlEncode(JSON.stringify(finalPayload))}`;
+	let key;
+	if (secret instanceof CryptoKey) key = secret;
+	else {
+		const keyData = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+		key = await crypto.subtle.importKey("raw", keyData, {
+			name: "HMAC",
+			hash: hashAlg
+		}, false, ["sign"]);
+	}
+	const signatureBuffer = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));
+	return `${data}.${base64urlEncode(new Uint8Array(signatureBuffer))}`;
+}
+/**
+* Creates a JWT authentication middleware.
+*
+* @example
+* ```typescript
+* interface AppContext {
+*   env: { JWT_SECRET: string };
+*   user: { id: string; email: string };
+* }
+*
+* jwtAuth<AppContext>({
+*   secret: (ctx) => ctx.env.JWT_SECRET,  // ctx.env is typed
+*   claims: (payload) => ({
+*     user: { id: payload.sub, email: payload.email },
+*   }),
+* })
+*
+* // In your route handler:
+* route.ctx<AppContext>()({
+*   handler: async (c) => {
+*     return { email: c.user.email };  // Fully typed
+*   },
+* })
+* ```
+*/
+function jwtAuth(options) {
+	const getToken = options.getToken || ((req) => {
+		const auth = req.headers.get("Authorization");
+		if (auth?.startsWith("Bearer ")) return auth.slice(7);
+		const cookie = req.headers.get("Cookie");
+		if (cookie) {
+			const match = cookie.match(/(?:^|;\s*)token=([^;]*)/);
+			if (match) return match[1];
+		}
+		return null;
+	});
+	return async (context, next) => {
+		const { request } = context;
+		const token = getToken(request);
+		if (!token) return new Response("Missing token", {
+			status: 401,
+			headers: { "WWW-Authenticate": "Bearer" }
+		});
+		try {
+			const payload = await jwtVerify(token, typeof options.secret === "function" ? options.secret(context) : options.secret, { algorithms: options.algorithms });
+			const claims = options.claims(payload);
+			if (claims === null) throw new Error("Token validation failed");
+			Object.assign(context, claims);
+			return next();
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Invalid token";
+			return new Response(message, {
+				status: 401,
+				headers: { "WWW-Authenticate": `Bearer error="invalid_token", error_description="${message}"` }
+			});
+		}
+	};
+}
+/**
+* Creates a simple bearer token authentication middleware.
+*
+* @example
+* ```typescript
+* const apiRouter = router('/api', routes,
+*   bearerAuth({
+*     verify: async (token) => {
+*       if (token === process.env.API_TOKEN) {
+*         return { apiClient: 'trusted' };
+*       }
+*       return null;
+*     }
+*   })
+* );
+* ```
+*/
+function bearerAuth(options) {
+	return async (context, next) => {
+		const { request } = context;
+		const authHeader = request.headers.get("Authorization");
+		if (!authHeader?.startsWith("Bearer ")) return new Response("Missing token", {
+			status: 401,
+			headers: { "WWW-Authenticate": "Bearer" }
+		});
+		const token = authHeader.slice(7);
+		const claims = await options.verify(token, context);
+		if (claims === null) return new Response("Invalid token", {
+			status: 401,
+			headers: { "WWW-Authenticate": "Bearer error=\"invalid_token\"" }
+		});
+		Object.assign(context, claims);
+		return next();
+	};
+}
+
+//#endregion
+//#region src/middleware/common.ts
+/**
+* HTTP error with status code for use with errorHandler middleware.
+*
+* Throw this in route handlers to return a specific HTTP status code.
+* The errorHandler middleware will catch it and format the response.
+*
+* @example
+* ```typescript
+* import { HttpError } from '@fresho/router/middleware';
+*
+* const getUser = route({
+*   method: 'get',
+*   path: '/users/:id',
+*   handler: async (c) => {
+*     const user = await db.findUser(c.path.id);
+*     if (!user) throw new HttpError('User not found', 404);
+*     return user;
+*   },
+* });
+* ```
+*/
+var HttpError = class extends Error {
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "HttpError";
+	}
+};
+/**
+* Extracts HTTP status code from an error object.
+*
+* Supports errors with `status` or `statusCode` properties (common patterns
+* in frameworks like Express, Koa, Hono, and custom HTTP error classes).
+*/
+function getErrorStatus(error) {
+	if (typeof error !== "object" || error === null) return 500;
+	if ("status" in error && typeof error.status === "number") return error.status;
+	if ("statusCode" in error && typeof error.statusCode === "number") return error.statusCode;
+	return 500;
+}
+/**
+* Creates an error handling middleware that catches and formats errors.
+*
+* @example
+* ```typescript
+* const apiRouter = router('/api', routes, errorHandler({ expose: false }));
+* ```
+*/
+function errorHandler(options = {}) {
+	return async (context, next) => {
+		try {
+			return await next();
+		} catch (error) {
+			const err = error;
+			if (options.log) await options.log(err, context);
+			else console.error(`Error in ${context.request.method} ${context.request.url}:`, err);
+			if (options.formatter) return await options.formatter(err, context);
+			const message = options.expose ? err.message : "Internal Server Error";
+			const status = getErrorStatus(error);
+			const errorBody = {
+				error: message,
+				...options.expose && {
+					stack: err.stack,
+					name: err.name
+				}
+			};
+			return new Response(JSON.stringify(errorBody), {
+				status,
+				headers: { "Content-Type": "application/json" }
+			});
+		}
+	};
+}
+/**
+* Creates a request/response logging middleware.
+*
+* @example
+* ```typescript
+* const apiRouter = router('/api', routes, logger({ includeHeaders: true }));
+* ```
+*/
+function logger(options = {}) {
+	const log = options.log || console.log;
+	return async (context, next) => {
+		const { request } = context;
+		const start = Date.now();
+		const url = new URL(request.url);
+		const info = {
+			method: request.method,
+			url: `${url.pathname}${url.search}`,
+			status: 0,
+			duration: 0
+		};
+		if (options.includeHeaders) info.headers = Object.fromEntries(request.headers.entries());
+		if (options.includeBody && request.body) try {
+			const text = await request.clone().text();
+			try {
+				info.body = JSON.parse(text);
+			} catch {
+				info.body = text;
+			}
+		} catch {
+			info.body = "[Body not readable]";
+		}
+		log(options.formatter ? options.formatter({
+			...info,
+			status: 0,
+			duration: 0
+		}) : `→ ${info.method} ${info.url}`);
+		try {
+			const response = await next();
+			info.status = response.status;
+			info.duration = Date.now() - start;
+			log(options.formatter ? options.formatter(info) : `← ${info.status} ${response.statusText || "OK"} (${info.duration}ms)`);
+			return response;
+		} catch (error) {
+			info.status = 500;
+			info.duration = Date.now() - start;
+			info.error = error;
+			log(options.formatter ? options.formatter(info) : `✗ ${info.status} Error: ${error.message} (${info.duration}ms)`);
+			throw error;
+		}
+	};
+}
+/** In-memory rate limit store with periodic cleanup of expired entries. */
+var MemoryRateLimitStore = class {
+	counts = /* @__PURE__ */ new Map();
+	lastCleanup = Date.now();
+	/** Interval between cleanups (default: 60 seconds). */
+	cleanupIntervalMs;
+	constructor(windowMs, options) {
+		this.windowMs = windowMs;
+		this.cleanupIntervalMs = options?.cleanupIntervalMs ?? Math.max(windowMs, 6e4);
+	}
+	async increment(key) {
+		const now = Date.now();
+		if (now - this.lastCleanup > this.cleanupIntervalMs) this.cleanup(now);
+		const record = this.counts.get(key);
+		if (!record || now > record.resetAt) {
+			this.counts.set(key, {
+				count: 1,
+				resetAt: now + this.windowMs
+			});
+			return 1;
+		}
+		record.count++;
+		return record.count;
+	}
+	async decrement(key) {
+		const record = this.counts.get(key);
+		if (record && record.count > 0) record.count--;
+	}
+	async reset(key) {
+		this.counts.delete(key);
+	}
+	/** Removes all expired entries from the store. */
+	cleanup(now) {
+		for (const [key, record] of this.counts) if (now > record.resetAt) this.counts.delete(key);
+		this.lastCleanup = now;
+	}
+	/** Returns the current number of tracked keys (useful for testing). */
+	get size() {
+		return this.counts.size;
+	}
+};
+/**
+* Creates a rate limiting middleware.
+*
+* @example
+* ```typescript
+* const apiRouter = router('/api', routes, rateLimit({ max: 100, windowMs: 60000 }));
+* ```
+*/
+function rateLimit(options = {}) {
+	const config = {
+		windowMs: 60 * 1e3,
+		max: 100,
+		keyGenerator: (ctx) => {
+			const cfIp = ctx.request.headers.get("CF-Connecting-IP");
+			const xForwardedFor = ctx.request.headers.get("X-Forwarded-For");
+			const xRealIp = ctx.request.headers.get("X-Real-IP");
+			return cfIp || xForwardedFor?.split(",")[0] || xRealIp || "unknown";
+		},
+		...options
+	};
+	const store = config.store || new MemoryRateLimitStore(config.windowMs);
+	return async (context, next) => {
+		const key = config.keyGenerator(context);
+		const current = await store.increment(key);
+		if (current > config.max) {
+			if (config.handler) return await config.handler(context);
+			return new Response("Too many requests", {
+				status: 429,
+				headers: {
+					"Retry-After": String(Math.ceil(config.windowMs / 1e3)),
+					"X-RateLimit-Limit": String(config.max),
+					"X-RateLimit-Remaining": "0",
+					"X-RateLimit-Reset": new Date(Date.now() + config.windowMs).toISOString()
+				}
+			});
+		}
+		const response = await next();
+		if (config.skipSuccessfulRequests && response.status < 400 || config.skipFailedRequests && response.status >= 400) await store.decrement(key);
+		const headers = new Headers(response.headers);
+		headers.set("X-RateLimit-Limit", String(config.max));
+		headers.set("X-RateLimit-Remaining", String(Math.max(0, config.max - current)));
+		headers.set("X-RateLimit-Reset", new Date(Date.now() + config.windowMs).toISOString());
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	};
+}
+/**
+* Creates a middleware that adds a unique request ID to each request.
+*
+* @example
+* ```typescript
+* const apiRouter = router('/api', routes, requestId({ headerName: 'X-Request-ID' }));
+* ```
+*/
+function requestId(options = {}) {
+	const headerName = options.headerName || "X-Request-ID";
+	const generator = options.generator || (() => crypto.randomUUID());
+	return async (context, next) => {
+		let id = context.request.headers.get(headerName);
+		if (!id) id = generator();
+		context.requestId = id;
+		const response = await next();
+		const headers = new Headers(response.headers);
+		headers.set(headerName, id);
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	};
+}
+/**
+* Creates a middleware that times out requests after a specified duration.
+*
+* @example
+* ```typescript
+* const apiRouter = router('/api', routes, timeout({ timeout: 5000 }));
+* ```
+*/
+function timeout(options) {
+	return async (context, next) => {
+		const controller = new AbortController();
+		const timeoutId = setTimeout(() => controller.abort(), options.timeout);
+		try {
+			const responsePromise = next();
+			const timeoutPromise = new Promise((_, reject) => {
+				controller.signal.addEventListener("abort", () => {
+					reject(/* @__PURE__ */ new Error("Request timeout"));
+				});
+			});
+			const response = await Promise.race([responsePromise, timeoutPromise]);
+			clearTimeout(timeoutId);
+			return response;
+		} catch (error) {
+			clearTimeout(timeoutId);
+			if (error.message === "Request timeout") return new Response(options.message || "Request timeout", { status: 408 });
+			throw error;
+		}
+	};
+}
+/**
+* Creates a middleware that validates request content type.
+*
+* @example
+* ```typescript
+* const apiRouter = router('/api', routes, contentType({ types: ['application/json'] }));
+* ```
+*/
+function contentType(options) {
+	const skipMethods = new Set(options.skipMethods?.map((m) => m.toUpperCase()) || [
+		"GET",
+		"HEAD",
+		"OPTIONS"
+	]);
+	return async (context, next) => {
+		if (skipMethods.has(context.request.method.toUpperCase())) return next();
+		const contentType$1 = context.request.headers.get("Content-Type");
+		if (!contentType$1) return new Response(options.message || "Missing Content-Type header", { status: 415 });
+		if (!options.types.some((type) => contentType$1.includes(type))) return new Response(options.message || `Unsupported Media Type. Expected: ${options.types.join(", ")}`, { status: 415 });
+		return next();
+	};
+}
+
+//#endregion
+//#region src/middleware/cors.ts
+/**
+* Determines if an origin is allowed based on the configuration.
+*/
+function getAllowedOrigin(requestOrigin, configOrigin) {
+	if (!requestOrigin) return "*";
+	if (!configOrigin || configOrigin === "*") return "*";
+	if (typeof configOrigin === "string") return configOrigin === requestOrigin ? configOrigin : "false";
+	if (Array.isArray(configOrigin)) return configOrigin.includes(requestOrigin) ? requestOrigin : "false";
+	if (configOrigin instanceof RegExp) return configOrigin.test(requestOrigin) ? requestOrigin : "false";
+	if (typeof configOrigin === "function") return configOrigin(requestOrigin) ? requestOrigin : "false";
+	return "false";
+}
+/**
+* Creates a CORS middleware with the specified options.
+*
+* @example
+* ```typescript
+* const apiRouter = router('/api', routes, cors({ origin: 'https://example.com', credentials: true }));
+* ```
+*/
+function cors(options = {}) {
+	const config = {
+		origin: "*",
+		methods: [
+			"GET",
+			"POST",
+			"PUT",
+			"PATCH",
+			"DELETE",
+			"OPTIONS",
+			"HEAD"
+		],
+		allowedHeaders: ["Content-Type", "Authorization"],
+		exposedHeaders: [],
+		credentials: false,
+		maxAge: 86400,
+		preflightContinue: false,
+		...options
+	};
+	return async (context, next) => {
+		const { request } = context;
+		const allowedOrigin = getAllowedOrigin(request.headers.get("Origin"), config.origin);
+		if (request.method === "OPTIONS") {
+			const headers$1 = {
+				"Access-Control-Allow-Origin": allowedOrigin,
+				"Access-Control-Allow-Methods": config.methods.join(", "),
+				Vary: "Origin"
+			};
+			if (config.allowedHeaders.length > 0) {
+				const requestHeaders = request.headers.get("Access-Control-Request-Headers");
+				if (requestHeaders) {
+					const requested = requestHeaders.split(",").map((h) => h.trim().toLowerCase());
+					const allowed = config.allowedHeaders.map((h) => h.toLowerCase());
+					const toAllow = requested.filter((h) => allowed.includes(h));
+					if (toAllow.length > 0) headers$1["Access-Control-Allow-Headers"] = toAllow.join(", ");
+				} else headers$1["Access-Control-Allow-Headers"] = config.allowedHeaders.join(", ");
+			}
+			if (config.exposedHeaders.length > 0) headers$1["Access-Control-Expose-Headers"] = config.exposedHeaders.join(", ");
+			if (config.credentials) headers$1["Access-Control-Allow-Credentials"] = "true";
+			if (config.maxAge) headers$1["Access-Control-Max-Age"] = String(config.maxAge);
+			const response$1 = new Response(null, {
+				status: 204,
+				headers: headers$1
+			});
+			if (config.preflightContinue) {
+				const nextResponse = await next();
+				const mergedHeaders = new Headers(nextResponse.headers);
+				Object.entries(headers$1).forEach(([key, value]) => {
+					mergedHeaders.set(key, value);
+				});
+				return new Response(nextResponse.body, {
+					status: nextResponse.status,
+					statusText: nextResponse.statusText,
+					headers: mergedHeaders
+				});
+			}
+			return response$1;
+		}
+		const response = await next();
+		const headers = new Headers(response.headers);
+		headers.set("Access-Control-Allow-Origin", allowedOrigin);
+		headers.set("Vary", "Origin");
+		if (config.credentials && allowedOrigin !== "*") headers.set("Access-Control-Allow-Credentials", "true");
+		if (config.exposedHeaders.length > 0) headers.set("Access-Control-Expose-Headers", config.exposedHeaders.join(", "));
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	};
+}
+
+//#endregion
+export { HttpError, MemoryRateLimitStore, basicAuth, bearerAuth, compose, contentType, cors, errorHandler, jwtAuth, jwtSign, jwtVerify, logger, rateLimit, requestId, timeout };
+//# sourceMappingURL=index.mjs.map