@hoox-sh/hoox-shared 1.2.0

package/dist/middleware/auth.js

@@ -0,0 +1,151 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+export {
+  timingSafeEqual,
+  resolveOperatorApiKey,
+  requireOperatorAuth,
+  requireInternalAuth,
+  requireAuth,
+  createOperatorAuthMiddleware,
+  createInternalAuthMiddleware,
+  collectInternalAuthKeys,
+  checkInternalAuth
+};

package/dist/middleware/cors.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Copyright (c) 2026 HOOX · HOOX · jango-blockchained (hoox-sh)
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * CORS middleware for Cloudflare Workers
+ * Provides standardized CORS headers and preflight handling
+ *
+ * Security default: NO open origin (*). Internal service-binding workers
+ * should not advertise browser CORS at all. Public endpoints must pass
+ * an explicit allowOrigin (or use publicCorsHeaders()).
+ *
+ * @available — Available for consumer use. Import from "@hoox-sh/hoox-shared/middleware".
+ */
+export interface CorsEnv {
+    CORS_ALLOW_ORIGIN?: string;
+}
+export interface CorsOptions {
+    /**
+     * Allowed origins. Empty / omitted = no Access-Control-Allow-Origin header
+     * (fail-closed). Never defaults to "*".
+     */
+    allowOrigin?: string;
+    /** Allowed methods (default: "GET, POST, OPTIONS, PUT, DELETE") */
+    allowMethods?: string;
+    /** Allowed headers (default: "Content-Type, Authorization, X-Request-ID") */
+    allowHeaders?: string;
+    /** Whether to include credentials (default: false) */
+    allowCredentials?: boolean;
+    /** Max age for preflight cache (default: 86400 = 24h) */
+    maxAge?: number;
+}
+/**
+ * Create CORS headers object for use in responses.
+ * Omits Access-Control-Allow-Origin when allowOrigin is empty.
+ */
+export declare function corsHeaders(options?: CorsOptions): Record<string, string>;
+/**
+ * CORS headers for truly public browser-facing APIs.
+ * Prefer a concrete origin over "*" whenever possible.
+ */
+export declare function publicCorsHeaders(origin?: string, options?: Omit<CorsOptions, "allowOrigin">): Record<string, string>;
+/**
+ * CORS headers for internal workers (service bindings only).
+ * Returns an empty object — no browser CORS surface.
+ */
+export declare function internalCorsHeaders(): Record<string, string>;
+/**
+ * Resolve CORS from env + request for dashboard-facing workers.
+ * Set CORS_ALLOW_ORIGIN to a comma-separated browser origin allowlist.
+ */
+export declare function resolveCorsOptions(request: Request, env?: unknown): CorsOptions;
+/**
+ * Handle CORS preflight (OPTIONS) requests.
+ * Returns a Response for OPTIONS, or null for non-OPTIONS requests.
+ */
+export declare function handleCorsPreflightRequest(request: Request, options?: CorsOptions): Response | null;
+//# sourceMappingURL=cors.d.ts.map

package/dist/middleware/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AAEH,MAAM,WAAW,OAAO;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAcD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAczE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,EAGhB,GAAG,CAAC,EAAE,OAAO,GACZ,WAAW,CA4Bb;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,WAAW,GACpB,QAAQ,GAAG,IAAI,CAOjB"}

package/dist/middleware/cors.js

@@ -0,0 +1,77 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/middleware/cors.ts
+var DEFAULT_OPTIONS = {
+  allowOrigin: "",
+  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
+  allowHeaders: "Content-Type, Authorization, X-Request-ID",
+  allowCredentials: false,
+  maxAge: 86400
+};
+function corsHeaders(options) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const headers = {
+    "Access-Control-Allow-Methods": opts.allowMethods,
+    "Access-Control-Allow-Headers": opts.allowHeaders,
+    "Access-Control-Max-Age": String(opts.maxAge)
+  };
+  if (opts.allowOrigin) {
+    headers["Access-Control-Allow-Origin"] = opts.allowOrigin;
+  }
+  if (opts.allowCredentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  return headers;
+}
+function publicCorsHeaders(origin = "*", options) {
+  return corsHeaders({ ...options, allowOrigin: origin });
+}
+function internalCorsHeaders() {
+  return {};
+}
+function resolveCorsOptions(request, env) {
+  const raw = env && typeof env === "object" && "CORS_ALLOW_ORIGIN" in env && typeof env.CORS_ALLOW_ORIGIN === "string" ? env.CORS_ALLOW_ORIGIN : undefined;
+  const configured = raw?.trim();
+  if (!configured) {
+    return {};
+  }
+  const allowed = configured.split(",").map((entry) => entry.trim()).filter(Boolean);
+  const origin = request.headers.get("Origin");
+  if (origin && allowed.includes(origin)) {
+    return { allowOrigin: origin, allowCredentials: true };
+  }
+  if (!origin && allowed.length === 1) {
+    return { allowOrigin: allowed[0] };
+  }
+  return {};
+}
+function handleCorsPreflightRequest(request, options) {
+  if (request.method !== "OPTIONS")
+    return null;
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(options)
+  });
+}
+export {
+  resolveCorsOptions,
+  publicCorsHeaders,
+  internalCorsHeaders,
+  handleCorsPreflightRequest,
+  corsHeaders
+};

package/dist/middleware/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Copyright (c) 2026 HOOX · HOOX · jango-blockchained (hoox-sh)
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Barrel exports for shared middleware
+ */
+export { createLogger, withRequestLog, type Logger, type LogContext, } from "./logger";
+export { requireAuth, requireOperatorAuth, createOperatorAuthMiddleware, resolveOperatorApiKey, requireInternalAuth, createInternalAuthMiddleware, checkInternalAuth, timingSafeEqual, collectInternalAuthKeys, type InternalAuthEnv, type InternalAuthKeyName, type OperatorAuthEnv, } from "./auth";
+export { createRateLimiter, type RateLimiter, type RateLimitConfig, } from "./rate-limit";
+export { validateJson, validateJsonLegacy, requireField, optionalField, } from "./validate";
+export { corsHeaders, resolveCorsOptions, type CorsEnv, publicCorsHeaders, internalCorsHeaders, handleCorsPreflightRequest, type CorsOptions, } from "./cors";
+export { secureHeaders, wrapWithSecurityHeaders, type SecurityHeadersOptions, SECURITY_HEADERS_DEFAULTS, } from "./security-headers";
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,MAAM,EACX,KAAK,UAAU,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,KAAK,OAAO,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,WAAW,GACjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC"}