@holo-js/security 0.3.8 → 0.3.11

package/dist/{chunk-NKKBOLDI.mjs → chunk-YIBZOYSR.mjs}

@@ -1119,6 +1119,109 @@ var securityStoreInternals = {
   normalizeStoreConfig
 };
 
+// src/signed-tokens.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var MAX_SIGNED_TOKEN_DEPTH = 32;
+var MAX_SIGNED_TOKEN_BODY_BYTES = 64 * 1024;
+var MAX_SIGNED_TOKEN_CHARACTERS = Math.ceil(MAX_SIGNED_TOKEN_BODY_BYTES * 4 / 3) + 44;
+function signingKey() {
+  const key = getSecurityRuntime().csrfSigningKey?.trim();
+  if (!key) {
+    throw new Error("[@holo-js/security] Signed tokens require an application signing key.");
+  }
+  return key;
+}
+function normalizePurpose(purpose) {
+  const normalized = purpose.trim();
+  if (!normalized) {
+    throw new TypeError("[@holo-js/security] Signed token purpose must be a non-empty string.");
+  }
+  return normalized;
+}
+function isSignedTokenValue(value, ancestors = /* @__PURE__ */ new Set(), depth = 0) {
+  if (value === null || typeof value === "boolean" || typeof value === "string") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (!value || typeof value !== "object") return false;
+  if (depth >= MAX_SIGNED_TOKEN_DEPTH || ancestors.has(value)) return false;
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      const ownKeys = Reflect.ownKeys(value);
+      if (ownKeys.some((key) => key !== "length" && (typeof key !== "string" || !/^(?:0|[1-9]\d*)$/u.test(key)))) return false;
+      for (let index = 0; index < value.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (!descriptor || !("value" in descriptor) || !isSignedTokenValue(descriptor.value, ancestors, depth + 1)) return false;
+      }
+      return true;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) return false;
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== "string") return false;
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor || !("value" in descriptor) || !isSignedTokenValue(descriptor.value, ancestors, depth + 1)) return false;
+    }
+    return true;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function assertPayload(payload) {
+  if (!isSignedTokenValue(payload) || Array.isArray(payload) || payload === null) {
+    throw new TypeError("[@holo-js/security] Signed token payload must contain only JSON-safe values.");
+  }
+}
+function signature(body, purpose) {
+  return createHmac2("sha256", signingKey()).update("holo-signed-token-v1\0").update(purpose).update("\0").update(body).digest();
+}
+function decodeEnvelope(body) {
+  try {
+    const value = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const envelope = value;
+    if (envelope.version !== 1 || !Number.isSafeInteger(envelope.expiresAt)) return null;
+    if (!isSignedTokenValue(envelope.payload) || Array.isArray(envelope.payload) || envelope.payload === null) return null;
+    return envelope;
+  } catch {
+    return null;
+  }
+}
+function createSignedToken(payload, options) {
+  assertPayload(payload);
+  const purpose = normalizePurpose(options.purpose);
+  const expiresAt = options.expiresAt.getTime();
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= Date.now()) {
+    throw new TypeError("[@holo-js/security] Signed token expiry must be a valid future date.");
+  }
+  const encodedEnvelope = JSON.stringify({
+    expiresAt,
+    payload,
+    version: 1
+  });
+  if (Buffer.byteLength(encodedEnvelope, "utf8") > MAX_SIGNED_TOKEN_BODY_BYTES) {
+    throw new TypeError("[@holo-js/security] Signed token payload exceeds 64 KiB.");
+  }
+  const body = Buffer.from(encodedEnvelope).toString("base64url");
+  return `${body}.${signature(body, purpose).toString("base64url")}`;
+}
+function verifySignedToken(token2, options) {
+  if (token2.length > MAX_SIGNED_TOKEN_CHARACTERS) return null;
+  const purpose = normalizePurpose(options.purpose);
+  const separator = token2.lastIndexOf(".");
+  if (separator <= 0 || separator === token2.length - 1) return null;
+  const body = token2.slice(0, separator);
+  const encodedSignature = token2.slice(separator + 1);
+  if (!/^[A-Za-z0-9_-]{43}$/u.test(encodedSignature)) return null;
+  const providedSignature = Buffer.from(encodedSignature, "base64url");
+  if (providedSignature.toString("base64url") !== encodedSignature) return null;
+  const expectedSignature = signature(body, purpose);
+  if (providedSignature.length !== expectedSignature.length || !timingSafeEqual2(providedSignature, expectedSignature)) return null;
+  const envelope = decodeEnvelope(body);
+  const now = options.now?.getTime() ?? Date.now();
+  if (!envelope || !Number.isFinite(now) || envelope.expiresAt <= now) return null;
+  return envelope.payload;
+}
+
 // src/index.ts
 var security = Object.freeze({
   configureSecurityRuntime,
@@ -1132,7 +1235,9 @@ var security = Object.freeze({
   rateLimit,
   clearRateLimit,
   limit,
-  ip
+  ip,
+  createSignedToken,
+  verifySignedToken
 });
 var src_default = security;
 
@@ -1169,5 +1274,7 @@ export {
   redisRateLimitDriverInternals,
   createRateLimitStoreFromConfig,
   securityStoreInternals,
+  createSignedToken,
+  verifySignedToken,
   src_default
 };

package/dist/index.d.ts

@@ -210,6 +210,21 @@ declare const securityRuntimeInternals: {
     getSecurityRuntimeState: typeof getSecurityRuntimeState;
 };
 
+type SecuritySignedTokenPrimitive = boolean | number | string | null;
+type SecuritySignedTokenValue = SecuritySignedTokenPrimitive | readonly SecuritySignedTokenValue[] | {
+    readonly [key: string]: SecuritySignedTokenValue;
+};
+type SecuritySignedTokenPayload = Readonly<Record<string, SecuritySignedTokenValue>>;
+interface SecuritySignedTokenOptions {
+    readonly expiresAt: Date;
+    readonly purpose: string;
+}
+declare function createSignedToken<TPayload extends SecuritySignedTokenPayload>(payload: TPayload, options: SecuritySignedTokenOptions): string;
+declare function verifySignedToken<TPayload extends SecuritySignedTokenPayload>(token: string, options: {
+    readonly now?: Date;
+    readonly purpose: string;
+}): TPayload | null;
+
 declare const security: Readonly<{
     configureSecurityRuntime: typeof configureSecurityRuntime;
     getSecurityRuntime: typeof getSecurityRuntime;
@@ -246,6 +261,8 @@ declare const security: Readonly<{
         };
     }>;
     ip: typeof ip;
+    createSignedToken: typeof createSignedToken;
+    verifySignedToken: typeof verifySignedToken;
 }>;
 
-export { HoloSecurityConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, NormalizedSecurityLimiterConfig, SecurityClearRateLimitOptions, SecurityCsrfField, SecurityCsrfInput, SecurityLimiterConfig, SecurityProtectOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitKeyResolver, SecurityRateLimitRedisDriverAdapter, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRuntimeBindings, SecurityRuntimeFacade, SecurityRuntimeNotConfiguredError, apply as applyCors, clearRateLimit, configureSecurityRuntime, cors, corsInternals, headers as createCorsHeaders, preflight as createCorsPreflightResponse, cookie as createCsrfCookie, field as createCsrfField, input as createCsrfInput, token as createCsrfToken, createFileRateLimitStore, createMemoryRateLimitStore, createRateLimitStoreFromConfig, createRedisRateLimitStore, csrf, csrfInternals, security as default, defaultRateLimitKey, fileRateLimitDriverInternals, getSecurityRuntime, getSecurityRuntimeBindings, ip, isSecureRequest, memoryRateLimitDriverInternals, protect, rateLimit, rateLimitInternals, redisRateLimitDriverInternals, resetSecurityRuntime, securityRuntimeInternals, securityStoreInternals, verify as verifyCsrfRequest };
+export { HoloSecurityConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, NormalizedSecurityLimiterConfig, SecurityClearRateLimitOptions, SecurityCsrfField, SecurityCsrfInput, SecurityLimiterConfig, SecurityProtectOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitKeyResolver, SecurityRateLimitRedisDriverAdapter, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRuntimeBindings, SecurityRuntimeFacade, SecurityRuntimeNotConfiguredError, type SecuritySignedTokenOptions, type SecuritySignedTokenPayload, type SecuritySignedTokenPrimitive, type SecuritySignedTokenValue, apply as applyCors, clearRateLimit, configureSecurityRuntime, cors, corsInternals, headers as createCorsHeaders, preflight as createCorsPreflightResponse, cookie as createCsrfCookie, field as createCsrfField, input as createCsrfInput, token as createCsrfToken, createFileRateLimitStore, createMemoryRateLimitStore, createRateLimitStoreFromConfig, createRedisRateLimitStore, createSignedToken, csrf, csrfInternals, security as default, defaultRateLimitKey, fileRateLimitDriverInternals, getSecurityRuntime, getSecurityRuntimeBindings, ip, isSecureRequest, memoryRateLimitDriverInternals, protect, rateLimit, rateLimitInternals, redisRateLimitDriverInternals, resetSecurityRuntime, securityRuntimeInternals, securityStoreInternals, verify as verifyCsrfRequest, verifySignedToken };

package/dist/index.mjs

@@ -10,6 +10,7 @@ import {
   createMemoryRateLimitStore,
   createRateLimitStoreFromConfig,
   createRedisRateLimitStore,
+  createSignedToken,
   csrf,
   csrfInternals,
   defaultRateLimitKey,
@@ -31,8 +32,9 @@ import {
   securityStoreInternals,
   src_default,
   token,
-  verify
-} from "./chunk-NKKBOLDI.mjs";
+  verify,
+  verifySignedToken
+} from "./chunk-YIBZOYSR.mjs";
 import {
   SecurityCsrfError,
   SecurityRateLimitError,
@@ -75,6 +77,7 @@ export {
   createRateLimitStoreFromConfig,
   createRedisRateLimitStore,
   createRedisRateLimitStoreConfig,
+  createSignedToken,
   csrf,
   csrfInternals,
   src_default as default,
@@ -102,5 +105,6 @@ export {
   securityInternals,
   securityRuntimeInternals,
   securityStoreInternals,
-  verify as verifyCsrfRequest
+  verify as verifyCsrfRequest,
+  verifySignedToken
 };

package/dist/next/server.mjs

@@ -4,7 +4,7 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   protect
-} from "../chunk-NKKBOLDI.mjs";
+} from "../chunk-YIBZOYSR.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,
@@ -47,7 +47,7 @@ async function issueCsrfCookie(request) {
   if (!shouldIssueCsrfToken && !shouldIssueClientConfig) {
     return void 0;
   }
-  const { NextResponse } = await import("next/server");
+  const { NextResponse } = await import("next/server.js");
   const response = NextResponse.next();
   const cookieOptions = {
     httpOnly: false,

package/dist/nuxt/server.mjs

@@ -4,7 +4,7 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   protect
-} from "../chunk-NKKBOLDI.mjs";
+} from "../chunk-YIBZOYSR.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,

package/dist/sveltekit/server.mjs

@@ -3,7 +3,7 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   protect
-} from "../chunk-NKKBOLDI.mjs";
+} from "../chunk-YIBZOYSR.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/security",
-  "version": "0.3.8",
+  "version": "0.3.11",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
@@ -58,8 +58,8 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.3.8",
-    "@holo-js/kernel": "^0.3.8"
+    "@holo-js/config": "^0.3.11",
+    "@holo-js/kernel": "^0.3.11"
   },
   "peerDependencies": {
     "h3": "^1.15.11",