@holo-js/security 0.3.16 → 0.3.17

package/dist/chunk-5M3RHQIG.mjs

@@ -0,0 +1,45 @@
+import {
+  csrfInternals,
+  getSecurityRuntime,
+  isSecureRequest,
+  token
+} from "./chunk-G3HBF4Q5.mjs";
+import {
+  SECURITY_CLIENT_CONFIG_COOKIE,
+  createSecurityClientConfig,
+  serializeSecurityClientConfig
+} from "./chunk-FUOZWKHK.mjs";
+
+// src/cookie-issuance.ts
+async function prepareCsrfCookies(request, getCookie) {
+  const { config } = getSecurityRuntime();
+  const method = request.method.trim().toUpperCase();
+  if (!config.csrf.enabled || method !== "GET" && method !== "HEAD") {
+    return [];
+  }
+  const existingToken = getCookie(config.csrf.cookie);
+  const clientConfig = serializeSecurityClientConfig(createSecurityClientConfig(config));
+  const shouldIssueToken = !existingToken || !csrfInternals.isValidSignedCsrfToken(existingToken);
+  const shouldIssueClientConfig = getCookie(SECURITY_CLIENT_CONFIG_COOKIE) !== clientConfig;
+  if (!shouldIssueToken && !shouldIssueClientConfig) {
+    return [];
+  }
+  const options = {
+    httpOnly: false,
+    path: "/",
+    sameSite: "lax",
+    secure: isSecureRequest(request)
+  };
+  const cookies = [];
+  if (shouldIssueToken) {
+    cookies.push({ name: config.csrf.cookie, value: await token(request), options });
+  }
+  if (shouldIssueClientConfig) {
+    cookies.push({ name: SECURITY_CLIENT_CONFIG_COOKIE, value: clientConfig, options });
+  }
+  return cookies;
+}
+
+export {
+  prepareCsrfCookies
+};

package/dist/{chunk-AGICNQRJ.mjs → chunk-FQ4X7X6L.mjs}

@@ -1,7 +1,7 @@
 import {
   normalizeCorsConfig,
   normalizeSecurityConfig
-} from "./chunk-WDTNP5YU.mjs";
+} from "./chunk-WRMZRO77.mjs";
 
 // src/contracts.ts
 var SecurityCsrfError = class extends Error {

package/dist/{chunk-YIBZOYSR.mjs → chunk-G3HBF4Q5.mjs}

@@ -3,11 +3,11 @@ import {
   SecurityRateLimitError,
   ip,
   limit
-} from "./chunk-AGICNQRJ.mjs";
+} from "./chunk-FQ4X7X6L.mjs";
 import {
   normalizeCorsConfig,
   normalizeSecurityConfig
-} from "./chunk-WDTNP5YU.mjs";
+} from "./chunk-WRMZRO77.mjs";
 
 // src/csrf.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";

package/dist/{chunk-WDTNP5YU.mjs → chunk-WRMZRO77.mjs}

@@ -3,6 +3,7 @@ import {
   DEFAULT_REDIS_DB,
   DEFAULT_REDIS_HOST,
   DEFAULT_REDIS_PORT,
+  normalizeRedisConfig,
   resolveNormalizedRedisConnection
 } from "@holo-js/kernel";
 import { registerConfigNormalizer } from "@holo-js/config/registry";
@@ -149,7 +150,10 @@ function normalizeSecurityRateLimitConfig(config, redisConfig) {
         redisConfig,
         connectionName,
         "Security rate-limit Redis connection"
-      ) : driver === "redis" ? (() => {
+      ) : typeof redis.host === "string" && typeof redis.port === "number" && typeof redis.db === "number" ? resolveNormalizedRedisConnection(normalizeRedisConfig({
+        default: connectionName,
+        connections: { [connectionName]: redis }
+      }), connectionName, "Security rate-limit Redis connection") : driver === "redis" ? (() => {
         throw new Error(
           `[@holo-js/security] Rate-limit Redis config references shared connection "${connectionName}" without top-level Redis config.`
         );

package/dist/config.mjs

@@ -16,7 +16,7 @@ import {
   holoSecurityDefaults,
   normalizeCorsConfig,
   normalizeSecurityConfig
-} from "./chunk-WDTNP5YU.mjs";
+} from "./chunk-WRMZRO77.mjs";
 export {
   DEFAULT_CORS_HEADERS,
   DEFAULT_CORS_MAX_AGE,

package/dist/contracts.mjs

@@ -9,8 +9,8 @@ import {
   ip,
   limit,
   securityInternals
-} from "./chunk-AGICNQRJ.mjs";
-import "./chunk-WDTNP5YU.mjs";
+} from "./chunk-FQ4X7X6L.mjs";
+import "./chunk-WRMZRO77.mjs";
 export {
   SecurityCsrfError,
   SecurityRateLimitError,

package/dist/index.mjs

@@ -34,7 +34,7 @@ import {
   token,
   verify,
   verifySignedToken
-} from "./chunk-YIBZOYSR.mjs";
+} from "./chunk-G3HBF4Q5.mjs";
 import {
   SecurityCsrfError,
   SecurityRateLimitError,
@@ -46,7 +46,7 @@ import {
   ip,
   limit,
   securityInternals
-} from "./chunk-AGICNQRJ.mjs";
+} from "./chunk-FQ4X7X6L.mjs";
 import {
   defineCorsConfig,
   defineSecurityConfig,
@@ -54,7 +54,7 @@ import {
   holoSecurityDefaults,
   normalizeCorsConfig,
   normalizeSecurityConfig
-} from "./chunk-WDTNP5YU.mjs";
+} from "./chunk-WRMZRO77.mjs";
 export {
   SecurityCsrfError,
   SecurityRateLimitError,

package/dist/next/server.mjs

@@ -1,25 +1,16 @@
 import {
-  csrf,
-  csrfInternals,
-  getSecurityRuntime,
-  isSecureRequest,
-  protect
-} from "../chunk-YIBZOYSR.mjs";
+  prepareCsrfCookies
+} from "../chunk-5M3RHQIG.mjs";
 import {
-  SECURITY_CLIENT_CONFIG_COOKIE,
-  createSecurityClientConfig,
-  serializeSecurityClientConfig
-} from "../chunk-FUOZWKHK.mjs";
+  protect
+} from "../chunk-G3HBF4Q5.mjs";
+import "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
-} from "../chunk-AGICNQRJ.mjs";
-import "../chunk-WDTNP5YU.mjs";
+} from "../chunk-FQ4X7X6L.mjs";
+import "../chunk-WRMZRO77.mjs";
 
 // src/next/server.ts
-function isSafeMethod(method) {
-  const normalized = method.trim().toUpperCase();
-  return normalized === "GET" || normalized === "HEAD";
-}
 function createCsrfErrorResponse(error) {
   return new Response(error.message, {
     status: error.status,
@@ -36,30 +27,14 @@ function getRequestCookie(request, name) {
   return typeof cookie?.value === "string" ? cookie.value : void 0;
 }
 async function issueCsrfCookie(request) {
-  const { config } = getSecurityRuntime();
-  if (!config.csrf.enabled || !isSafeMethod(request.method)) {
-    return void 0;
-  }
-  const existingCsrfToken = getRequestCookie(request, config.csrf.cookie);
-  const shouldIssueCsrfToken = !existingCsrfToken || !csrfInternals.isValidSignedCsrfToken(existingCsrfToken);
-  const clientConfig = serializeSecurityClientConfig(createSecurityClientConfig(config));
-  const shouldIssueClientConfig = getRequestCookie(request, SECURITY_CLIENT_CONFIG_COOKIE) !== clientConfig;
-  if (!shouldIssueCsrfToken && !shouldIssueClientConfig) {
+  const cookies = await prepareCsrfCookies(request, (name) => getRequestCookie(request, name));
+  if (cookies.length === 0) {
     return void 0;
   }
   const { NextResponse } = await import("next/server.js");
   const response = NextResponse.next();
-  const cookieOptions = {
-    httpOnly: false,
-    path: "/",
-    sameSite: "lax",
-    secure: isSecureRequest(request)
-  };
-  if (shouldIssueCsrfToken) {
-    response.cookies.set(config.csrf.cookie, await csrf.token(request), cookieOptions);
-  }
-  if (shouldIssueClientConfig) {
-    response.cookies.set(SECURITY_CLIENT_CONFIG_COOKIE, clientConfig, cookieOptions);
+  for (const cookie of cookies) {
+    response.cookies.set(cookie.name, cookie.value, cookie.options);
   }
   return response;
 }

package/dist/nuxt/server.mjs

@@ -1,19 +1,14 @@
 import {
-  csrf,
-  csrfInternals,
-  getSecurityRuntime,
-  isSecureRequest,
-  protect
-} from "../chunk-YIBZOYSR.mjs";
+  prepareCsrfCookies
+} from "../chunk-5M3RHQIG.mjs";
 import {
-  SECURITY_CLIENT_CONFIG_COOKIE,
-  createSecurityClientConfig,
-  serializeSecurityClientConfig
-} from "../chunk-FUOZWKHK.mjs";
+  protect
+} from "../chunk-G3HBF4Q5.mjs";
+import "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
-} from "../chunk-AGICNQRJ.mjs";
-import "../chunk-WDTNP5YU.mjs";
+} from "../chunk-FQ4X7X6L.mjs";
+import "../chunk-WRMZRO77.mjs";
 
 // src/nuxt/server.ts
 import {
@@ -58,28 +53,9 @@ async function createRequest(event) {
   });
 }
 async function issueCsrfCookie(event, request) {
-  const { config } = getSecurityRuntime();
-  if (!config.csrf.enabled || !isSafeMethod(request.method)) {
-    return;
-  }
-  const existingCsrfToken = getCookie(event, config.csrf.cookie);
-  const shouldIssueCsrfToken = !existingCsrfToken || !csrfInternals.isValidSignedCsrfToken(existingCsrfToken);
-  const clientConfig = serializeSecurityClientConfig(createSecurityClientConfig(config));
-  const shouldIssueClientConfig = getCookie(event, SECURITY_CLIENT_CONFIG_COOKIE) !== clientConfig;
-  if (!shouldIssueCsrfToken && !shouldIssueClientConfig) {
-    return;
-  }
-  const cookieOptions = {
-    httpOnly: false,
-    path: "/",
-    sameSite: "lax",
-    secure: isSecureRequest(request)
-  };
-  if (shouldIssueCsrfToken) {
-    setCookie(event, config.csrf.cookie, await csrf.token(request), cookieOptions);
-  }
-  if (shouldIssueClientConfig) {
-    setCookie(event, SECURITY_CLIENT_CONFIG_COOKIE, clientConfig, cookieOptions);
+  const cookies = await prepareCsrfCookies(request, (name) => getCookie(event, name));
+  for (const cookie of cookies) {
+    setCookie(event, cookie.name, cookie.value, cookie.options);
   }
 }
 function csrfProtection() {

package/dist/sveltekit/server.mjs

@@ -1,42 +1,21 @@
 import {
-  csrf,
-  getSecurityRuntime,
-  isSecureRequest,
-  protect
-} from "../chunk-YIBZOYSR.mjs";
+  prepareCsrfCookies
+} from "../chunk-5M3RHQIG.mjs";
 import {
-  SECURITY_CLIENT_CONFIG_COOKIE,
-  createSecurityClientConfig,
-  serializeSecurityClientConfig
-} from "../chunk-FUOZWKHK.mjs";
+  protect
+} from "../chunk-G3HBF4Q5.mjs";
+import "../chunk-FUOZWKHK.mjs";
 import {
   SecurityCsrfError
-} from "../chunk-AGICNQRJ.mjs";
-import "../chunk-WDTNP5YU.mjs";
+} from "../chunk-FQ4X7X6L.mjs";
+import "../chunk-WRMZRO77.mjs";
 
 // src/sveltekit/server.ts
-function isSafeMethod(method) {
-  const normalized = method.trim().toUpperCase();
-  return normalized === "GET" || normalized === "HEAD";
-}
 async function issueCsrfCookie(event) {
-  const runtime = getSecurityRuntime();
-  const { config } = runtime;
-  if (!config.csrf.enabled || !isSafeMethod(event.request.method)) {
-    return;
+  const cookies = await prepareCsrfCookies(event.request, (name) => event.cookies.get(name));
+  for (const cookie of cookies) {
+    event.cookies.set(cookie.name, cookie.value, cookie.options);
   }
-  event.cookies.set(config.csrf.cookie, await csrf.token(event.request), {
-    httpOnly: false,
-    path: "/",
-    sameSite: "lax",
-    secure: isSecureRequest(event.request)
-  });
-  event.cookies.set(SECURITY_CLIENT_CONFIG_COOKIE, serializeSecurityClientConfig(createSecurityClientConfig(config)), {
-    httpOnly: false,
-    path: "/",
-    sameSite: "lax",
-    secure: isSecureRequest(event.request)
-  });
 }
 function createCsrfErrorResponse(error) {
   return new Response(error.message, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/security",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
@@ -58,8 +58,8 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.3.16",
-    "@holo-js/kernel": "^0.3.16"
+    "@holo-js/config": "^0.3.17",
+    "@holo-js/kernel": "^0.3.17"
   },
   "peerDependencies": {
     "h3": "^1.15.11",