@holo-js/security 0.3.27 → 0.3.28

package/dist/{chunk-5SCCUNBO.mjs → chunk-26IYURJG.mjs}

@@ -10,6 +10,7 @@ import {
 } from "./chunk-WRMZRO77.mjs";
 
 // src/csrf.ts
+import { resolveRequestUrl } from "@holo-js/kernel";
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 
 // src/runtime.ts
@@ -50,9 +51,22 @@ var securityRuntimeInternals = {
 };
 
 // src/proxy.ts
-function shouldTrustProxyHeaders() {
-  const trustedProxy = typeof process !== "undefined" ? process.env.HOLO_SECURITY_TRUST_PROXY?.trim().toLowerCase() : void 0;
-  return trustedProxy === "1" || trustedProxy === "true" || trustedProxy === "yes" || trustedProxy === "on";
+import { isIP } from "net";
+import { requestUrlInternals } from "@holo-js/kernel";
+function bareClientAddress(value) {
+  if (!value) return void 0;
+  if (isIP(value)) return value;
+  const bracketed = /^\[([^\]]+)\](?::\d+)?$/u.exec(value)?.[1];
+  if (bracketed && isIP(bracketed) === 6) return bracketed;
+  const ipv4 = /^([\d.]+):\d+$/u.exec(value)?.[1];
+  return ipv4 && isIP(ipv4) === 4 ? ipv4 : void 0;
+}
+function resolveTrustedClientIp(request) {
+  const trustedProxyHeaders = requestUrlInternals.resolveTrustedProxyHeaders();
+  if (trustedProxyHeaders === "forwarded") {
+    return bareClientAddress(requestUrlInternals.readForwardedParameter(request.headers, "for")) ?? "unknown";
+  }
+  return ip(request, trustedProxyHeaders === "x-forwarded");
 }
 
 // src/rate-limit.ts
@@ -93,7 +107,7 @@ async function defaultRateLimitKey(request) {
   if (typeof runtimeDefaultKey !== "undefined" && runtimeDefaultKey !== null) {
     return normalizeResolvedLimiterKey(runtimeDefaultKey, "Default rate limiter key resolver");
   }
-  return `ip:${ip(request, shouldTrustProxyHeaders())}`;
+  return `ip:${resolveTrustedClientIp(request)}`;
 }
 async function resolveLimiterKey(name, limiter, options) {
   if (typeof options.key === "string" && options.key.length > 0) {
@@ -224,28 +238,8 @@ function isExcludedPath(request) {
   const pathname = new URL(request.url).pathname;
   return pathname === "/broadcasting/auth" || except.some((pattern) => matchesPathPattern(pathname, pattern));
 }
-function normalizeForwardedValue(value) {
-  return value.trim().replace(/^"|"$/g, "").toLowerCase();
-}
-function getForwardedProto(request) {
-  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",", 1)[0]?.trim();
-  if (forwardedProto) {
-    return normalizeForwardedValue(forwardedProto);
-  }
-  const forwarded = request.headers.get("forwarded")?.split(",", 1)[0];
-  if (!forwarded) {
-    return void 0;
-  }
-  for (const segment of forwarded.split(";")) {
-    const [name, value] = segment.split("=", 2);
-    if (name?.trim().toLowerCase() === "proto" && value) {
-      return normalizeForwardedValue(value);
-    }
-  }
-  return void 0;
-}
 function isSecureRequest(request) {
-  return new URL(request.url).protocol === "https:" || shouldTrustProxyHeaders() && getForwardedProto(request) === "https";
+  return resolveRequestUrl(request).protocol === "https:";
 }
 function createCsrfToken() {
   return randomBytes(32).toString("base64url");
@@ -403,7 +397,6 @@ var csrf = Object.freeze({
 var csrfInternals = {
   createCsrfToken,
   generatedTokenCache,
-  getForwardedProto,
   getCookieToken,
   getHeaderToken,
   isSecureRequest,

package/dist/{chunk-F32JK536.mjs → chunk-PHPA3C6L.mjs}

@@ -3,12 +3,15 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   token
-} from "./chunk-5SCCUNBO.mjs";
+} from "./chunk-26IYURJG.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,
   serializeSecurityClientConfig
 } from "./chunk-PC2YCWDH.mjs";
+import {
+  SecurityCsrfError
+} from "./chunk-FQ4X7X6L.mjs";
 
 // src/cookie-issuance.ts
 async function prepareCsrfCookies(request, getCookie) {
@@ -40,6 +43,22 @@ async function prepareCsrfCookies(request, getCookie) {
   return cookies;
 }
 
+// src/rejection-response.ts
+import { HoloRequestUrlError } from "@holo-js/kernel";
+function isSecurityRejection(error) {
+  return error instanceof SecurityCsrfError || error instanceof HoloRequestUrlError;
+}
+function createSecurityRejectionResponse(error) {
+  return new Response(error.message, {
+    status: error.status,
+    headers: {
+      "content-type": "text/plain; charset=utf-8"
+    }
+  });
+}
+
 export {
-  prepareCsrfCookies
+  prepareCsrfCookies,
+  isSecurityRejection,
+  createSecurityRejectionResponse
 };

package/dist/index.d.ts

@@ -11,7 +11,6 @@ declare function serializeCookie(name: string, value: string, options?: {
 declare function isSafeMethod(method: string): boolean;
 declare function matchesPathPattern$1(pathname: string, pattern: string): boolean;
 declare function isExcludedPath(request: Request): boolean;
-declare function getForwardedProto(request: Request): string | undefined;
 declare function isSecureRequest(request: Request): boolean;
 declare function createCsrfToken(): string;
 declare function getCsrfSigningKey(): string;
@@ -40,7 +39,6 @@ declare const csrf: Readonly<{
 declare const csrfInternals: {
     createCsrfToken: typeof createCsrfToken;
     generatedTokenCache: WeakMap<Request, string>;
-    getForwardedProto: typeof getForwardedProto;
     getCookieToken: typeof getCookieToken;
     getHeaderToken: typeof getHeaderToken;
     isSecureRequest: typeof isSecureRequest;

package/dist/index.mjs

@@ -34,7 +34,7 @@ import {
   token,
   verify,
   verifySignedToken
-} from "./chunk-5SCCUNBO.mjs";
+} from "./chunk-26IYURJG.mjs";
 import {
   SecurityCsrfError,
   SecurityRateLimitError,

package/dist/next/server.mjs

@@ -1,26 +1,18 @@
 import {
+  createSecurityRejectionResponse,
+  isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-F32JK536.mjs";
+} from "../chunk-PHPA3C6L.mjs";
 import {
   cors,
   getSecurityRuntime,
   protect
-} from "../chunk-5SCCUNBO.mjs";
+} from "../chunk-26IYURJG.mjs";
 import "../chunk-PC2YCWDH.mjs";
-import {
-  SecurityCsrfError
-} from "../chunk-FQ4X7X6L.mjs";
+import "../chunk-FQ4X7X6L.mjs";
 import "../chunk-WRMZRO77.mjs";
 
 // src/next/server.ts
-function createCsrfErrorResponse(error) {
-  return new Response(error.message, {
-    status: error.status,
-    headers: {
-      "content-type": "text/plain; charset=utf-8"
-    }
-  });
-}
 function getRequestCookie(request, name) {
   const cookie = request.cookies?.get(name);
   if (typeof cookie === "string") {
@@ -74,15 +66,16 @@ function csrfProtection() {
         headers: { Allow: "GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE" }
       });
     }
+    let response;
     try {
       await protect(await actionRequest(request));
+      response = await issueCsrfCookie(request);
     } catch (error) {
-      if (error instanceof SecurityCsrfError) {
-        return cors.apply(request, createCsrfErrorResponse(error));
+      if (isSecurityRejection(error)) {
+        return cors.apply(request, createSecurityRejectionResponse(error));
       }
       throw error;
     }
-    const response = await issueCsrfCookie(request);
     if (response) return cors.apply(request, response);
     if ([...cors.headers(request)].length === 0) return void 0;
     const { NextResponse } = await import("next/server.js");

package/dist/nuxt/server.mjs

@@ -1,14 +1,13 @@
 import {
+  isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-F32JK536.mjs";
+} from "../chunk-PHPA3C6L.mjs";
 import {
   cors,
   protect
-} from "../chunk-5SCCUNBO.mjs";
+} from "../chunk-26IYURJG.mjs";
 import "../chunk-PC2YCWDH.mjs";
-import {
-  SecurityCsrfError
-} from "../chunk-FQ4X7X6L.mjs";
+import "../chunk-FQ4X7X6L.mjs";
 import "../chunk-WRMZRO77.mjs";
 
 // src/nuxt/server.ts
@@ -79,8 +78,9 @@ function csrfProtection() {
     cors.headers(request).forEach((value, name) => setResponseHeader(event, name, value));
     try {
       await protect(request);
+      await issueCsrfCookie(event, request);
     } catch (error) {
-      if (error instanceof SecurityCsrfError) {
+      if (isSecurityRejection(error)) {
         throw createError({
           statusCode: error.status,
           statusMessage: error.message,
@@ -89,7 +89,6 @@ function csrfProtection() {
       }
       throw error;
     }
-    await issueCsrfCookie(event, request);
     return void 0;
   });
 }

package/dist/sveltekit/server.mjs

@@ -1,14 +1,14 @@
 import {
+  createSecurityRejectionResponse,
+  isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-F32JK536.mjs";
+} from "../chunk-PHPA3C6L.mjs";
 import {
   cors,
   protect
-} from "../chunk-5SCCUNBO.mjs";
+} from "../chunk-26IYURJG.mjs";
 import "../chunk-PC2YCWDH.mjs";
-import {
-  SecurityCsrfError
-} from "../chunk-FQ4X7X6L.mjs";
+import "../chunk-FQ4X7X6L.mjs";
 import "../chunk-WRMZRO77.mjs";
 
 // src/sveltekit/server.ts
@@ -18,14 +18,6 @@ async function issueCsrfCookie(event) {
     event.cookies.set(cookie.name, cookie.value, cookie.options);
   }
 }
-function createCsrfErrorResponse(error) {
-  return new Response(error.message, {
-    status: error.status,
-    headers: {
-      "content-type": "text/plain; charset=utf-8"
-    }
-  });
-}
 function csrfProtection() {
   return async ({ event, resolve }) => {
     const preflight = cors.preflight(event.request);
@@ -38,13 +30,13 @@ function csrfProtection() {
     }
     try {
       await protect(event.request);
+      await issueCsrfCookie(event);
     } catch (error) {
-      if (error instanceof SecurityCsrfError) {
-        return cors.apply(event.request, createCsrfErrorResponse(error));
+      if (isSecurityRejection(error)) {
+        return cors.apply(event.request, createSecurityRejectionResponse(error));
       }
       throw error;
     }
-    await issueCsrfCookie(event);
     return cors.apply(event.request, await resolve(event));
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/security",
-  "version": "0.3.27",
+  "version": "0.3.28",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
@@ -58,8 +58,8 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.3.27",
-    "@holo-js/kernel": "^0.3.27"
+    "@holo-js/config": "^0.3.28",
+    "@holo-js/kernel": "^0.3.28"
   },
   "peerDependencies": {
     "h3": "^1.15.11",