@holo-js/security 0.3.27 → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Holo-JS contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/.holo-build-fingerprint

@@ -0,0 +1 @@
+3659fb6c9af3ebac67b4d8337c00b81aa27f5427378340742f731a12f964746e

package/dist/{chunk-WRMZRO77.mjs → chunk-D3ZN5MLJ.mjs}

@@ -7,9 +7,97 @@ import {
   resolveNormalizedRedisConnection
 } from "@holo-js/kernel";
 import { registerConfigNormalizer } from "@holo-js/config/registry";
+import { DEFAULT_MAX_REQUEST_BODY_BYTES, DEFAULT_MAX_UPLOAD_BODY_BYTES } from "@holo-js/kernel";
+
+// src/trusted-proxies.ts
+import { BlockList, isIP } from "net";
+var ipv4MappedPrefix = "::ffff:";
+function canonicalAddress(address) {
+  const lowered = address.toLowerCase();
+  if (lowered.startsWith(ipv4MappedPrefix) && isIP(lowered.slice(ipv4MappedPrefix.length)) === 4) {
+    return lowered.slice(ipv4MappedPrefix.length);
+  }
+  return address;
+}
+function bareAddress(value) {
+  const trimmed = value.trim();
+  if (isIP(trimmed)) return canonicalAddress(trimmed);
+  const bracketed = /^\[([^\]]+)\](?::\d+)?$/u.exec(trimmed)?.[1];
+  if (bracketed && isIP(bracketed) === 6) return canonicalAddress(bracketed);
+  const ipv4 = /^([\d.]+):\d+$/u.exec(trimmed)?.[1];
+  return ipv4 && isIP(ipv4) === 4 ? ipv4 : void 0;
+}
+function parseRange(entry) {
+  const [address = "", prefix, ...rest] = entry.trim().split("/");
+  const family = isIP(address);
+  if (!family || rest.length > 0) return void 0;
+  if (prefix === void 0) return { address };
+  if (!/^\d+$/u.test(prefix)) return void 0;
+  const bits = Number(prefix);
+  return bits <= (family === 4 ? 32 : 128) ? { address, prefix: bits } : void 0;
+}
+function normalizeTrustedProxies(value) {
+  if (value === void 0) return Object.freeze([]);
+  if (value === "*") return value;
+  return Object.freeze(value.map((entry) => {
+    if (!parseRange(entry)) {
+      throw new TypeError(`[@holo-js/security] trustedProxies entries must be IP addresses or CIDR ranges, received "${entry}".`);
+    }
+    return entry.trim();
+  }));
+}
+function createTrustedAddressMatcher(trustedProxies, connectionAddress) {
+  const entries = trustedProxies !== "*" ? trustedProxies : connectionAddress && isIP(connectionAddress) ? [connectionAddress] : [];
+  const ranges = new BlockList();
+  for (const entry of entries) {
+    const range = parseRange(entry);
+    if (!range) continue;
+    const family = isIP(range.address) === 4 ? "ipv4" : "ipv6";
+    if (range.prefix === void 0) ranges.addAddress(range.address, family);
+    else ranges.addSubnet(range.address, range.prefix, family);
+  }
+  return (address) => ranges.check(address, isIP(address) === 4 ? "ipv4" : "ipv6");
+}
+var secureProtocols = /* @__PURE__ */ new Set(["https", "on", "ssl", "1"]);
+function firstListValue(value) {
+  return value?.split(",")[0]?.trim() || void 0;
+}
+function forwardedProtocol(value) {
+  if (value === void 0) return void 0;
+  return secureProtocols.has(value.toLowerCase()) ? "https" : "http";
+}
+function clientAddress(forwardedFor, connectionAddress, isTrusted) {
+  let client;
+  let firstTrusted;
+  for (const entry of [...forwardedFor?.split(",") ?? [], ...connectionAddress === void 0 ? [] : [connectionAddress]]) {
+    const address = bareAddress(entry);
+    if (!address) continue;
+    if (isTrusted(address)) firstTrusted ??= address;
+    else client = address;
+  }
+  return client ?? firstTrusted;
+}
+function resolveForwarding(readHeader, rawConnectionAddress, trustedProxies) {
+  const connectionAddress = rawConnectionAddress === void 0 ? void 0 : bareAddress(rawConnectionAddress) ?? rawConnectionAddress;
+  const isTrusted = createTrustedAddressMatcher(trustedProxies, connectionAddress);
+  const fromTrustedProxy = connectionAddress === void 0 ? trustedProxies === "*" : isTrusted(connectionAddress);
+  if (!fromTrustedProxy) return { address: connectionAddress };
+  return {
+    address: clientAddress(readHeader("x-forwarded-for"), connectionAddress, isTrusted),
+    protocol: forwardedProtocol(firstListValue(readHeader("x-forwarded-proto"))),
+    host: firstListValue(readHeader("x-forwarded-host")),
+    port: firstListValue(readHeader("x-forwarded-port")),
+    prefix: firstListValue(readHeader("x-forwarded-prefix"))
+  };
+}
+function createForwardedRequestResolver(trustedProxies) {
+  return (readHeader, connectionAddress) => resolveForwarding(readHeader, connectionAddress, trustedProxies);
+}
+
+// src/config.ts
 var DEFAULT_CORS_PATHS = Object.freeze(["/api/*"]);
 var DEFAULT_CORS_METHODS = Object.freeze(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]);
-var DEFAULT_CORS_HEADERS = Object.freeze(["Content-Type", "Authorization", "X-CSRF-TOKEN", "X-Requested-With"]);
+var DEFAULT_CORS_HEADERS = Object.freeze(["Content-Type", "Authorization", "X-CSRF-TOKEN", "X-XSRF-TOKEN", "X-Requested-With"]);
 var DEFAULT_CORS_MAX_AGE = 7200;
 var holoCorsDefaults = Object.freeze({
   paths: DEFAULT_CORS_PATHS,
@@ -28,7 +116,7 @@ var DEFAULT_SECURITY_RATE_LIMIT_FILE_PATH = "./storage/framework/rate-limits";
 var DEFAULT_SECURITY_RATE_LIMIT_REDIS_CONNECTION = "default";
 var DEFAULT_SECURITY_RATE_LIMIT_REDIS_PREFIX = "holo:rate-limit:";
 var DEFAULT_SECURITY_CSRF_CONFIG = Object.freeze({
-  enabled: false,
+  enabled: true,
   field: DEFAULT_SECURITY_CSRF_FIELD,
   header: DEFAULT_SECURITY_CSRF_HEADER,
   cookie: DEFAULT_SECURITY_CSRF_COOKIE,
@@ -55,7 +143,10 @@ var DEFAULT_SECURITY_RATE_LIMIT_CONFIG = Object.freeze({
 });
 var holoSecurityDefaults = Object.freeze({
   csrf: DEFAULT_SECURITY_CSRF_CONFIG,
-  rateLimit: DEFAULT_SECURITY_RATE_LIMIT_CONFIG
+  rateLimit: DEFAULT_SECURITY_RATE_LIMIT_CONFIG,
+  trustedProxies: normalizeTrustedProxies(void 0),
+  maxBodyBytes: DEFAULT_MAX_REQUEST_BODY_BYTES,
+  maxUploadBodyBytes: DEFAULT_MAX_UPLOAD_BODY_BYTES
 });
 function parseScopedInteger(value, fallback, namespace, label, options = {}) {
   const normalized = typeof value === "undefined" ? fallback : typeof value === "number" ? value : value.trim() ? Number(value.trim()) : Number.NaN;
@@ -99,12 +190,17 @@ function normalizeCorsMaxAge(value) {
   });
 }
 function normalizeCorsConfig(config = {}) {
+  const origins = normalizeCorsStringList(config.origins, holoCorsDefaults.origins, "origins");
+  const credentials = config.credentials ?? holoCorsDefaults.credentials;
+  if (credentials && origins.includes("*")) {
+    throw new Error("[Holo CORS] Wildcard origins cannot be combined with credentials.");
+  }
   return Object.freeze({
     paths: normalizeCorsStringList(config.paths, DEFAULT_CORS_PATHS, "paths"),
-    origins: normalizeCorsStringList(config.origins, holoCorsDefaults.origins, "origins"),
+    origins,
     methods: normalizeCorsMethods(config.methods),
     headers: normalizeCorsStringList(config.headers, DEFAULT_CORS_HEADERS, "headers"),
-    credentials: config.credentials ?? holoCorsDefaults.credentials,
+    credentials,
     maxAge: normalizeCorsMaxAge(config.maxAge),
     statefulDomains: normalizeCorsStringList(config.statefulDomains, holoCorsDefaults.statefulDomains, "statefulDomains")
   });
@@ -197,7 +293,14 @@ function normalizeSecurityConfig(config = {}, redisConfig) {
       cookie: normalizeSecurityOptionalString(csrf.cookie) || DEFAULT_SECURITY_CSRF_COOKIE,
       except
     }),
-    rateLimit: normalizeSecurityRateLimitConfig(config.rateLimit, redisConfig)
+    rateLimit: normalizeSecurityRateLimitConfig(config.rateLimit, redisConfig),
+    trustedProxies: normalizeTrustedProxies(config.trustedProxies),
+    maxBodyBytes: parseSecurityInteger(config.maxBodyBytes, DEFAULT_MAX_REQUEST_BODY_BYTES, "maxBodyBytes", {
+      minimum: 1
+    }),
+    maxUploadBodyBytes: parseSecurityInteger(config.maxUploadBodyBytes, DEFAULT_MAX_UPLOAD_BODY_BYTES, "maxUploadBodyBytes", {
+      minimum: 1
+    })
   });
 }
 function defineSecurityConfig(config) {
@@ -219,6 +322,9 @@ registerConfigNormalizer({
 });
 
 export {
+  normalizeTrustedProxies,
+  resolveForwarding,
+  createForwardedRequestResolver,
   DEFAULT_CORS_PATHS,
   DEFAULT_CORS_METHODS,
   DEFAULT_CORS_HEADERS,

package/dist/{chunk-PC2YCWDH.mjs → chunk-EINZXLC2.mjs}

@@ -1,8 +1,10 @@
 // src/client-config.ts
 var SECURITY_CLIENT_CONFIG_COOKIE = "HOLO-CSRF-CONFIG";
+var SECURITY_XSRF_HEADER = "X-XSRF-TOKEN";
 var DEFAULT_SECURITY_CLIENT_CONFIG = Object.freeze({
   csrf: Object.freeze({
     field: "_token",
+    header: "X-CSRF-TOKEN",
     cookie: "XSRF-TOKEN"
   })
 });
@@ -29,7 +31,7 @@ function parseCookieHeader(header) {
   return Object.freeze(Object.fromEntries(entries));
 }
 function isSecurityClientConfig(value) {
-  return !!value && typeof value === "object" && !!value.csrf && typeof value.csrf.field === "string" && typeof value.csrf.cookie === "string";
+  return !!value && typeof value === "object" && !!value.csrf && typeof value.csrf.field === "string" && ["string", "undefined"].includes(typeof value.csrf.header) && typeof value.csrf.cookie === "string";
 }
 function getDefaultSecurityClientConfig() {
   return DEFAULT_SECURITY_CLIENT_CONFIG;
@@ -65,8 +67,8 @@ function readSecurityClientConfigFromCookies(cookieHeader) {
   return parsed ? Object.freeze({
     csrf: Object.freeze({
       field: parsed.csrf.field,
-      cookie: parsed.csrf.cookie,
-      ..."header" in parsed.csrf && typeof parsed.csrf.header === "string" ? { header: parsed.csrf.header } : {}
+      header: parsed.csrf.header ?? DEFAULT_SECURITY_CLIENT_CONFIG.csrf.header,
+      cookie: parsed.csrf.cookie
     })
   }) : void 0;
 }
@@ -74,8 +76,7 @@ function getCsrfRequestHeaders(cookieHeader) {
   const cookies = parseCookieHeader(cookieHeader);
   const config = parseSecurityClientConfig(cookies[SECURITY_CLIENT_CONFIG_COOKIE]) ?? DEFAULT_SECURITY_CLIENT_CONFIG;
   const token = cookies[config.csrf.cookie];
-  const header = "header" in config.csrf && typeof config.csrf.header === "string" ? config.csrf.header : "X-CSRF-TOKEN";
-  return token ? { [header]: token } : {};
+  return token ? { [SECURITY_XSRF_HEADER]: token } : {};
 }
 var securityClientConfigInternals = {
   parseCookieHeader,
@@ -84,6 +85,7 @@ var securityClientConfigInternals = {
 
 export {
   SECURITY_CLIENT_CONFIG_COOKIE,
+  SECURITY_XSRF_HEADER,
   getDefaultSecurityClientConfig,
   createSecurityClientConfig,
   serializeSecurityClientConfig,

package/dist/chunk-Q3PK4AGL.mjs

@@ -0,0 +1,84 @@
+import {
+  csrfInternals,
+  encryptedToken,
+  getSecurityRuntime,
+  isSecureRequest
+} from "./chunk-RYQLS2OO.mjs";
+import {
+  SECURITY_CLIENT_CONFIG_COOKIE,
+  createSecurityClientConfig,
+  serializeSecurityClientConfig
+} from "./chunk-EINZXLC2.mjs";
+import {
+  SecurityCsrfError
+} from "./chunk-U25HSHLJ.mjs";
+
+// src/cookie-issuance.ts
+var NO_CSRF_COOKIES = Object.freeze({ cookies: Object.freeze([]), sessionCookies: Object.freeze([]) });
+async function prepareCsrfCookies(request, getCookie) {
+  const { config } = getSecurityRuntime();
+  const method = request.method.trim().toUpperCase();
+  if (!config.csrf.enabled || method !== "GET" && method !== "HEAD") {
+    return NO_CSRF_COOKIES;
+  }
+  const { token, sessionCookies } = await csrfInternals.ensureSessionToken(request);
+  const existingCookie = getCookie(config.csrf.cookie);
+  const clientConfig = serializeSecurityClientConfig(createSecurityClientConfig(config));
+  const shouldIssueToken = !existingCookie || csrfInternals.decryptCsrfToken(existingCookie) !== token;
+  const shouldIssueClientConfig = getCookie(SECURITY_CLIENT_CONFIG_COOKIE) !== clientConfig;
+  const options = {
+    httpOnly: false,
+    path: "/",
+    sameSite: "lax",
+    secure: isSecureRequest(request)
+  };
+  const cookies = [];
+  if (shouldIssueToken) {
+    cookies.push({ name: config.csrf.cookie, value: await encryptedToken(request, token), options });
+  }
+  if (shouldIssueClientConfig) {
+    cookies.push({ name: SECURITY_CLIENT_CONFIG_COOKIE, value: clientConfig, options });
+  }
+  return { token, cookies, sessionCookies };
+}
+function appendSetCookies(response, setCookies) {
+  if (setCookies.length === 0) {
+    return response;
+  }
+  const headers = new Headers();
+  for (const setCookie of setCookies) {
+    headers.append("Set-Cookie", setCookie);
+  }
+  response.headers.forEach((value, name) => {
+    if (name !== "set-cookie") headers.append(name, value);
+  });
+  for (const setCookie of response.headers.getSetCookie()) {
+    headers.append("Set-Cookie", setCookie);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// src/rejection-response.ts
+import { HoloRequestBodyTooLargeError, HoloRequestUrlError } from "@holo-js/kernel";
+function isSecurityRejection(error) {
+  return error instanceof SecurityCsrfError || error instanceof HoloRequestUrlError || error instanceof HoloRequestBodyTooLargeError;
+}
+function createSecurityRejectionResponse(error) {
+  return new Response(error.message, {
+    status: error.status,
+    headers: {
+      "content-type": "text/plain; charset=utf-8"
+    }
+  });
+}
+
+export {
+  prepareCsrfCookies,
+  appendSetCookies,
+  isSecurityRejection,
+  createSecurityRejectionResponse
+};