@holo-js/security 0.1.3

package/dist/index.d.ts

@@ -0,0 +1,199 @@
+import * as _holo_js_config from '@holo-js/config';
+import { NormalizedSecurityLimiterConfig, HoloSecurityConfig, NormalizedHoloSecurityConfig } from '@holo-js/config';
+export { HoloSecurityConfig, HoloSecurityCsrfConfig, HoloSecurityRateLimitConfig, NormalizedHoloSecurityConfig, NormalizedHoloSecurityCsrfConfig, NormalizedHoloSecurityRateLimitConfig, NormalizedSecurityLimiterConfig, SecurityLimiterConfig, SecurityRateLimitContext, SecurityRateLimitDriver, SecurityRateLimitFileConfig, SecurityRateLimitKeyResolver, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, defineSecurityConfig } from '@holo-js/config';
+import { SecurityCsrfField, SecurityProtectOptions, SecurityClearRateLimitOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRateLimitRedisDriverAdapter, SecurityRuntimeBindings, SecurityRuntimeFacade, ip } from './contracts.js';
+export { SecurityClientBindings, SecurityClientConfig, SecurityCsrfError, SecurityCsrfFacade, SecurityDefaultRateLimitKeyResolver, SecurityRateLimitBucketSnapshot, SecurityRateLimitError, createFileRateLimitStoreConfig, createMemoryRateLimitStoreConfig, createRedisRateLimitStoreConfig, defineRateLimiter, defineSecurityRuntimeBindings, limit, securityInternals } from './contracts.js';
+
+declare function parseCookieHeader(header: string | null | undefined): Readonly<Record<string, string>>;
+declare function serializeCookie(name: string, value: string, options?: {
+    readonly secure?: boolean;
+}): string;
+declare function isSafeMethod(method: string): boolean;
+declare function matchesPathPattern(pathname: string, pattern: string): boolean;
+declare function isExcludedPath(request: Request): boolean;
+declare function createCsrfToken(): string;
+declare function getCsrfSigningKey(): string;
+declare function encodeCsrfToken(nonce: string): string;
+declare function decodeCsrfToken(token: string): {
+    readonly nonce: string;
+    readonly signature: string;
+} | null;
+declare function isValidSignedCsrfToken(token: string): boolean;
+declare function getCookieToken(request: Request): string | undefined;
+declare function getRequestToken(request: Request): Promise<string | undefined>;
+declare function token(request: Request): Promise<string>;
+declare function field(request: Request): Promise<SecurityCsrfField>;
+declare function cookie(request: Request, explicitToken?: string): Promise<string>;
+declare function verify(request: Request): Promise<void>;
+declare function protect(request: Request, options?: SecurityProtectOptions): Promise<void>;
+declare const csrf: Readonly<{
+    token: typeof token;
+    field: typeof field;
+    cookie: typeof cookie;
+    verify: typeof verify;
+}>;
+declare const csrfInternals: {
+    createCsrfToken: typeof createCsrfToken;
+    generatedTokenCache: WeakMap<Request, string>;
+    getCookieToken: typeof getCookieToken;
+    getRequestToken: typeof getRequestToken;
+    isExcludedPath: typeof isExcludedPath;
+    isSafeMethod: typeof isSafeMethod;
+    matchesPathPattern: typeof matchesPathPattern;
+    parseCookieHeader: typeof parseCookieHeader;
+    serializeCookie: typeof serializeCookie;
+    decodeCsrfToken: typeof decodeCsrfToken;
+    encodeCsrfToken: typeof encodeCsrfToken;
+    getCsrfSigningKey: typeof getCsrfSigningKey;
+    isValidSignedCsrfToken: typeof isValidSignedCsrfToken;
+};
+
+declare function encodeBucketPart(value: string): string;
+declare function createLimiterPrefix(limiter: string): string;
+declare function createBucketKey(limiter: string, key: string): string;
+declare function getRateLimitStore(): SecurityRateLimitStore;
+declare function resolveLimiterConfig(name: string): NormalizedSecurityLimiterConfig;
+declare function normalizeResolvedLimiterKey(value: string | number | null | undefined, label: string): string;
+declare function defaultRateLimitKey(request: Request): Promise<string>;
+declare function resolveLimiterKey(name: string, limiter: NormalizedSecurityLimiterConfig, options: SecurityRateLimitCallOptions): Promise<string>;
+declare function rateLimit(name: string, options: SecurityRateLimitCallOptions): Promise<SecurityRateLimitHitResult>;
+declare function clearRateLimit(options: SecurityClearRateLimitOptions): Promise<boolean | number>;
+declare const rateLimitInternals: {
+    createBucketKey: typeof createBucketKey;
+    createLimiterPrefix: typeof createLimiterPrefix;
+    encodeBucketPart: typeof encodeBucketPart;
+    defaultRateLimitKey: typeof defaultRateLimitKey;
+    getRateLimitStore: typeof getRateLimitStore;
+    normalizeResolvedLimiterKey: typeof normalizeResolvedLimiterKey;
+    resolveLimiterConfig: typeof resolveLimiterConfig;
+    resolveLimiterKey: typeof resolveLimiterKey;
+};
+
+declare function normalizeStoreConfig(config: HoloSecurityConfig | NormalizedHoloSecurityConfig): NormalizedHoloSecurityConfig;
+declare function createRateLimitStoreFromConfig(config: HoloSecurityConfig | NormalizedHoloSecurityConfig, options?: SecurityRateLimitStoreFactoryOptions): SecurityRateLimitStore;
+declare const securityStoreInternals: {
+    normalizeStoreConfig: typeof normalizeStoreConfig;
+};
+
+type FileRateLimitBucket = {
+    namespace: string;
+    keyHash: string;
+    prefixHashes: readonly string[];
+    attempts: number;
+    expiresAt: Date;
+};
+interface FileRateLimitStoreOptions {
+    readonly now?: () => Date;
+    readonly lockRetryDelayMs?: number;
+    readonly lockTimeoutMs?: number;
+}
+declare function createBucketHash(key: string): string;
+declare function getBucketPath(root: string, key: string): string;
+declare function serializeBucket(bucket: FileRateLimitBucket): string;
+declare function deserializeBucket(raw: string): FileRateLimitBucket;
+declare function readBucket(path: string): Promise<FileRateLimitBucket | null>;
+declare function isExpired$1(bucket: FileRateLimitBucket, now: Date): boolean;
+declare function writeBucket(path: string, bucket: FileRateLimitBucket): Promise<void>;
+declare function deleteBucket(path: string): Promise<void>;
+declare function getBucketLockPath(path: string): string;
+declare function sleep(delayMs: number): Promise<void>;
+declare function withBucketLock<TValue>(path: string, options: {
+    readonly retryDelayMs: number;
+    readonly timeoutMs: number;
+}, operation: () => Promise<TValue>): Promise<TValue>;
+declare function listBucketPaths(root: string): Promise<string[]>;
+declare function createSnapshot$2(key: string, bucket: FileRateLimitBucket, maxAttempts: number): SecurityRateLimitHitResult['snapshot'];
+declare function createFileRateLimitStore(root: string, options?: FileRateLimitStoreOptions): SecurityRateLimitStore;
+declare const fileRateLimitDriverInternals: {
+    createBucketHash: typeof createBucketHash;
+    createSnapshot: typeof createSnapshot$2;
+    deleteBucket: typeof deleteBucket;
+    deserializeBucket: typeof deserializeBucket;
+    getBucketPath: typeof getBucketPath;
+    isExpired: typeof isExpired$1;
+    listBucketPaths: typeof listBucketPaths;
+    readBucket: typeof readBucket;
+    serializeBucket: typeof serializeBucket;
+    sleep: typeof sleep;
+    getBucketLockPath: typeof getBucketLockPath;
+    withBucketLock: typeof withBucketLock;
+    writeBucket: typeof writeBucket;
+};
+
+type MemoryRateLimitBucket = {
+    key: string;
+    attempts: number;
+    expiresAt: Date;
+};
+interface MemoryRateLimitStoreOptions {
+    readonly now?: () => Date;
+    readonly maxBuckets?: number;
+    readonly pruneIntervalMs?: number;
+}
+declare function createSnapshot$1(key: string, bucket: MemoryRateLimitBucket, maxAttempts: number): SecurityRateLimitHitResult['snapshot'];
+declare function isExpired(bucket: MemoryRateLimitBucket, now: Date): boolean;
+declare function createMemoryRateLimitStore(options?: MemoryRateLimitStoreOptions): SecurityRateLimitStore;
+declare const memoryRateLimitDriverInternals: {
+    createSnapshot: typeof createSnapshot$1;
+    isExpired: typeof isExpired;
+};
+
+interface RedisRateLimitStoreOptions {
+    readonly now?: () => Date;
+}
+declare function assertNonNegativeInteger(value: unknown, label: string): number;
+declare function createSnapshot(key: string, attempts: number, maxAttempts: number, expiresAt: Date): SecurityRateLimitHitResult['snapshot'];
+declare function createRedisRateLimitStore(adapter: SecurityRateLimitRedisDriverAdapter, options?: RedisRateLimitStoreOptions): SecurityRateLimitStore;
+declare const redisRateLimitDriverInternals: {
+    assertNonNegativeInteger: typeof assertNonNegativeInteger;
+    createSnapshot: typeof createSnapshot;
+};
+
+type RuntimeSecurityState = {
+    bindings?: SecurityRuntimeFacade;
+};
+declare function getSecurityRuntimeState(): RuntimeSecurityState;
+declare class SecurityRuntimeNotConfiguredError extends Error {
+    constructor();
+}
+declare function configureSecurityRuntime(bindings?: SecurityRuntimeBindings): void;
+declare function getSecurityRuntime(): SecurityRuntimeFacade;
+declare function getSecurityRuntimeBindings(): SecurityRuntimeFacade | undefined;
+declare function resetSecurityRuntime(): void;
+declare const securityRuntimeInternals: {
+    getSecurityRuntimeState: typeof getSecurityRuntimeState;
+};
+
+declare const security: Readonly<{
+    configureSecurityRuntime: typeof configureSecurityRuntime;
+    getSecurityRuntime: typeof getSecurityRuntime;
+    getSecurityRuntimeBindings: typeof getSecurityRuntimeBindings;
+    resetSecurityRuntime: typeof resetSecurityRuntime;
+    csrf: Readonly<{
+        token: typeof token;
+        field: typeof field;
+        cookie: typeof cookie;
+        verify: typeof verify;
+    }>;
+    protect: typeof protect;
+    defaultRateLimitKey: typeof defaultRateLimitKey;
+    rateLimit: typeof rateLimit;
+    clearRateLimit: typeof clearRateLimit;
+    limit: Readonly<{
+        perMinute(maxAttempts: number): {
+            readonly maxAttempts: number;
+            readonly decaySeconds: number;
+            by(key: _holo_js_config.SecurityRateLimitKeyResolver<Readonly<Record<string, unknown>> | undefined>): _holo_js_config.SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
+            define(): _holo_js_config.SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
+        };
+        perHour(maxAttempts: number): {
+            readonly maxAttempts: number;
+            readonly decaySeconds: number;
+            by(key: _holo_js_config.SecurityRateLimitKeyResolver<Readonly<Record<string, unknown>> | undefined>): _holo_js_config.SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
+            define(): _holo_js_config.SecurityLimiterConfig<Readonly<Record<string, unknown>> | undefined>;
+        };
+    }>;
+    ip: typeof ip;
+}>;
+
+export { SecurityClearRateLimitOptions, SecurityCsrfField, SecurityProtectOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitRedisDriverAdapter, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRuntimeBindings, SecurityRuntimeFacade, SecurityRuntimeNotConfiguredError, clearRateLimit, configureSecurityRuntime, cookie as createCsrfCookie, field as createCsrfField, token as createCsrfToken, createFileRateLimitStore, createMemoryRateLimitStore, createRateLimitStoreFromConfig, createRedisRateLimitStore, csrf, csrfInternals, security as default, defaultRateLimitKey, fileRateLimitDriverInternals, getSecurityRuntime, getSecurityRuntimeBindings, ip, memoryRateLimitDriverInternals, protect, rateLimit, rateLimitInternals, redisRateLimitDriverInternals, resetSecurityRuntime, securityRuntimeInternals, securityStoreInternals, verify as verifyCsrfRequest };