@hoox-sh/hoox-shared 1.2.0

package/dist/middleware/index.js

@@ -0,0 +1,635 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/errors.ts
+function toError(err, fallback = "Unknown error") {
+  if (err instanceof Error)
+    return err.message;
+  if (typeof err === "string")
+    return err;
+  if (err && typeof err === "object" && "message" in err && typeof err.message === "string") {
+    return err.message;
+  }
+  if (err === null || err === undefined)
+    return fallback;
+  try {
+    return JSON.stringify(err) || fallback;
+  } catch {
+    return fallback;
+  }
+}
+var SENSITIVE_FIELDS = new Set([
+  "password",
+  "token",
+  "secret",
+  "api_key",
+  "apiKey",
+  "authorization"
+]);
+function hasSensitiveFields(obj) {
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELDS.has(key))
+      return true;
+  }
+  return false;
+}
+function hasErrorValues(obj) {
+  for (const v of Object.values(obj)) {
+    if (v instanceof Error)
+      return true;
+  }
+  return false;
+}
+function sanitizeOutput(data) {
+  if (data === null || data === undefined)
+    return data;
+  const t = typeof data;
+  if (t === "string" || t === "number" || t === "boolean")
+    return data;
+  if (data instanceof Error) {
+    return { name: data.name, message: data.message };
+  }
+  if (Array.isArray(data)) {
+    return data.map(sanitizeOutput);
+  }
+  if (t === "object") {
+    const obj = data;
+    const keys = Object.keys(obj);
+    if (keys.length < 10) {
+      const sanitized2 = {};
+      for (const k of keys) {
+        if (k === "stack" || k === "cause")
+          continue;
+        const v = obj[k];
+        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+      }
+      return sanitized2;
+    }
+    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
+      return obj;
+    }
+    const sanitized = {};
+    for (const k of keys) {
+      if (k === "stack" || k === "cause")
+        continue;
+      const v = obj[k];
+      sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+    }
+    return sanitized;
+  }
+  return data;
+}
+function createJsonResponse(data, status = 200) {
+  return new Response(JSON.stringify(sanitizeOutput(data)), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function createSuccessResponse(result) {
+  return createJsonResponse({ success: true, result }, 200);
+}
+function createErrorResponse(error, status) {
+  const message = typeof error === "string" ? error : error.message;
+  const statusCode = typeof error === "string" ? status ?? 500 : error.status ?? 500;
+  const body = { success: false, error: message };
+  if (typeof error !== "string" && error.code)
+    body.code = error.code;
+  if (typeof error !== "string" && error.details !== undefined)
+    body.details = error.details;
+  return new Response(JSON.stringify(body), {
+    status: statusCode,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+var Errors = {
+  badRequest: (message) => createErrorResponse({ message, status: 400, code: "BAD_REQUEST" }),
+  unauthorized: (message = "Unauthorized") => createErrorResponse({ message, status: 401, code: "UNAUTHORIZED" }),
+  forbidden: (message = "Forbidden") => createErrorResponse({ message, status: 403, code: "FORBIDDEN" }),
+  notFound: (message = "Not found") => createErrorResponse({ message, status: 404, code: "NOT_FOUND" }),
+  methodNotAllowed: (message = "Method not allowed") => createErrorResponse({ message, status: 405, code: "METHOD_NOT_ALLOWED" }),
+  rateLimited: (retryAfter) => {
+    const res = createErrorResponse({
+      message: "Rate limit exceeded",
+      status: 429,
+      code: "RATE_LIMITED"
+    });
+    if (retryAfter)
+      res.headers.set("Retry-After", String(retryAfter));
+    return res;
+  },
+  internal: (err) => {
+    const message = err ? toError(err, "Internal server error") : "Internal server error";
+    return createErrorResponse({
+      message,
+      status: 500,
+      code: "INTERNAL_ERROR"
+    });
+  }
+};
+
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+
+// src/middleware/cors.ts
+var DEFAULT_OPTIONS = {
+  allowOrigin: "",
+  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
+  allowHeaders: "Content-Type, Authorization, X-Request-ID",
+  allowCredentials: false,
+  maxAge: 86400
+};
+function corsHeaders(options) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const headers = {
+    "Access-Control-Allow-Methods": opts.allowMethods,
+    "Access-Control-Allow-Headers": opts.allowHeaders,
+    "Access-Control-Max-Age": String(opts.maxAge)
+  };
+  if (opts.allowOrigin) {
+    headers["Access-Control-Allow-Origin"] = opts.allowOrigin;
+  }
+  if (opts.allowCredentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  return headers;
+}
+function publicCorsHeaders(origin = "*", options) {
+  return corsHeaders({ ...options, allowOrigin: origin });
+}
+function internalCorsHeaders() {
+  return {};
+}
+function resolveCorsOptions(request, env) {
+  const raw = env && typeof env === "object" && "CORS_ALLOW_ORIGIN" in env && typeof env.CORS_ALLOW_ORIGIN === "string" ? env.CORS_ALLOW_ORIGIN : undefined;
+  const configured = raw?.trim();
+  if (!configured) {
+    return {};
+  }
+  const allowed = configured.split(",").map((entry) => entry.trim()).filter(Boolean);
+  const origin = request.headers.get("Origin");
+  if (origin && allowed.includes(origin)) {
+    return { allowOrigin: origin, allowCredentials: true };
+  }
+  if (!origin && allowed.length === 1) {
+    return { allowOrigin: allowed[0] };
+  }
+  return {};
+}
+function handleCorsPreflightRequest(request, options) {
+  if (request.method !== "OPTIONS")
+    return null;
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(options)
+  });
+}
+
+// src/middleware/logger.ts
+function createLogger(ctx) {
+  const base = { service: ctx.service, module: ctx.module };
+  function emit(level, message, context) {
+    const entry = {
+      level,
+      timestamp: new Date().toISOString(),
+      ...base,
+      message,
+      ...context && { context }
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error")
+      console.error(line);
+    else if (level === "warn")
+      console.warn(line);
+    else if (level === "debug")
+      console.debug(line);
+    else
+      console.info(line);
+  }
+  return {
+    debug: (msg, ctx2) => emit("debug", msg, ctx2),
+    info: (msg, ctx2) => emit("info", msg, ctx2),
+    warn: (msg, ctx2) => emit("warn", msg, ctx2),
+    error: (msg, ctx2) => emit("error", msg, ctx2)
+  };
+}
+function withRequestLog(handler, logCtx) {
+  return async (request, env, ctx) => {
+    const start = Date.now();
+    const logger = createLogger(logCtx);
+    try {
+      const response = await handler(request, env, ctx);
+      const duration = Date.now() - start;
+      const url = new URL(request.url);
+      logger.info(`${request.method} ${url.pathname}`, {
+        method: request.method,
+        path: url.pathname,
+        status: response.status,
+        durationMs: duration
+      });
+      return response;
+    } catch (error) {
+      const duration = Date.now() - start;
+      logger.error("Request failed", {
+        method: request.method,
+        path: new URL(request.url).pathname,
+        durationMs: duration,
+        error: toError(error)
+      });
+      throw error;
+    }
+  };
+}
+
+// src/middleware/rate-limit.ts
+function createStorage(kv) {
+  if (!kv) {
+    const memory = new Map;
+    return {
+      async get(key) {
+        const entry = memory.get(key);
+        if (!entry)
+          return null;
+        if (Date.now() > entry.expiresAt) {
+          memory.delete(key);
+          return null;
+        }
+        return entry.value;
+      },
+      async put(key, value, opts) {
+        const ttl = opts?.expirationTtl ?? 0;
+        const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+        memory.set(key, { value, expiresAt });
+      },
+      async incr(key, opts) {
+        let entry = memory.get(key);
+        let newValue;
+        let attempts = 0;
+        const maxAttempts = 100;
+        while (true) {
+          const count = entry ? parseInt(entry.value, 10) : 0;
+          newValue = count + 1;
+          if (!entry) {
+            const ttl = opts?.expirationTtl ?? 0;
+            const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+            if (memory.get(key) === undefined) {
+              memory.set(key, { value: String(newValue), expiresAt });
+              return newValue;
+            }
+            entry = memory.get(key);
+          } else {
+            if (Date.now() > entry.expiresAt) {
+              memory.delete(key);
+              entry = undefined;
+              continue;
+            }
+            const currentEntry = memory.get(key);
+            if (currentEntry === entry) {
+              const ttl = opts?.expirationTtl ?? 0;
+              const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+              memory.set(key, { value: String(newValue), expiresAt });
+              return newValue;
+            }
+            entry = currentEntry;
+          }
+          attempts++;
+          if (attempts >= maxAttempts) {
+            const current = await this.get(key);
+            const count2 = current ? parseInt(current, 10) : 0;
+            newValue = count2 + 1;
+            const ttl = opts?.expirationTtl ?? 0;
+            const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+            memory.set(key, { value: String(newValue), expiresAt });
+            return newValue;
+          }
+        }
+      }
+    };
+  }
+  return {
+    async get(key) {
+      return kv.get(key);
+    },
+    async put(key, value, opts) {
+      await kv.put(key, value, opts);
+    },
+    async incr(key, opts) {
+      const current = await kv.get(key);
+      const count = current ? parseInt(current, 10) : 0;
+      const next = count + 1;
+      await kv.put(key, String(next), opts);
+      return next;
+    }
+  };
+}
+function createRateLimiter(kv, config) {
+  const prefix = config.keyPrefix ?? "rate-limit";
+  const storage = createStorage(kv);
+  function getClientIp(request) {
+    return request.headers.get("CF-Connecting-IP") ?? "unknown";
+  }
+  function getWindowKey(ip) {
+    const windowStart = Math.floor(Date.now() / (config.windowSeconds * 1000));
+    return `${prefix}:${ip}:${windowStart}`;
+  }
+  async function checkWithKey(fullKey) {
+    const current = await storage.get(fullKey);
+    const count = current ? parseInt(current, 10) : 0;
+    if (count >= config.maxRequests) {
+      const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfter
+      };
+    }
+    const newCount = await storage.incr(fullKey, {
+      expirationTtl: config.windowSeconds
+    });
+    if (newCount > config.maxRequests) {
+      const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfter
+      };
+    }
+    return {
+      allowed: true,
+      remaining: config.maxRequests - newCount
+    };
+  }
+  async function check(request) {
+    const ip = getClientIp(request);
+    const key = getWindowKey(ip);
+    return checkWithKey(key);
+  }
+  async function enforce(request) {
+    const result = await check(request);
+    if (!result.allowed) {
+      return new Response(JSON.stringify({
+        error: "Rate limit exceeded",
+        retryAfter: result.retryAfter
+      }), {
+        status: 429,
+        headers: {
+          "Content-Type": "application/json",
+          "Retry-After": String(result.retryAfter ?? config.windowSeconds)
+        }
+      });
+    }
+    return null;
+  }
+  async function checkKey(key) {
+    const fullKey = `${prefix}:${key}`;
+    return checkWithKey(fullKey);
+  }
+  async function enforceKey(key) {
+    const result = await checkKey(key);
+    if (!result.allowed) {
+      return new Response(JSON.stringify({
+        error: "Rate limit exceeded",
+        retryAfter: result.retryAfter
+      }), {
+        status: 429,
+        headers: {
+          "Content-Type": "application/json",
+          "Retry-After": String(result.retryAfter ?? config.windowSeconds)
+        }
+      });
+    }
+    return null;
+  }
+  return { check, enforce, checkKey, enforceKey };
+}
+
+// src/middleware/validate.ts
+function validateJson(schema, data) {
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    return {
+      ok: false,
+      error: result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+    };
+  }
+  return { ok: true, value: result.data };
+}
+async function validateJsonLegacy(request) {
+  try {
+    const body = await request.json();
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+      return { ok: false, error: "Request body must be a JSON object" };
+    }
+    return { ok: true, value: body };
+  } catch {
+    return { ok: false, error: "Invalid JSON in request body" };
+  }
+}
+function requireField(body, field) {
+  if (!(field in body)) {
+    return { ok: false, error: `Missing required field: ${field}` };
+  }
+  return { ok: true, value: body[field] };
+}
+function optionalField(body, field, defaultValue) {
+  if (!(field in body))
+    return defaultValue;
+  return body[field];
+}
+
+// src/middleware/security-headers.ts
+var SECURITY_HEADERS_DEFAULTS = {
+  xContentTypeOptions: "nosniff",
+  xFrameOptions: "DENY",
+  xXssProtection: "1; mode=block",
+  referrerPolicy: "strict-origin-when-cross-origin",
+  permissionsPolicy: "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()",
+  strictTransportSecurity: "max-age=31536000; includeSubDomains",
+  contentSecurityPolicy: "default-src 'self'"
+};
+function secureHeaders(options) {
+  const opts = { ...SECURITY_HEADERS_DEFAULTS, ...options };
+  const headers = {
+    "X-Content-Type-Options": opts.xContentTypeOptions,
+    "X-Frame-Options": opts.xFrameOptions,
+    "X-XSS-Protection": opts.xXssProtection,
+    "Referrer-Policy": opts.referrerPolicy,
+    "Permissions-Policy": opts.permissionsPolicy,
+    "Strict-Transport-Security": opts.strictTransportSecurity
+  };
+  if (opts.contentSecurityPolicy) {
+    headers["Content-Security-Policy"] = opts.contentSecurityPolicy;
+  }
+  return headers;
+}
+function wrapWithSecurityHeaders(response, options) {
+  const headers = new Headers(response.headers);
+  for (const [key, value] of Object.entries(secureHeaders(options))) {
+    headers.set(key, value);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+export {
+  wrapWithSecurityHeaders,
+  withRequestLog,
+  validateJsonLegacy,
+  validateJson,
+  timingSafeEqual,
+  secureHeaders,
+  resolveOperatorApiKey,
+  resolveCorsOptions,
+  requireOperatorAuth,
+  requireInternalAuth,
+  requireField,
+  requireAuth,
+  publicCorsHeaders,
+  optionalField,
+  internalCorsHeaders,
+  handleCorsPreflightRequest,
+  createRateLimiter,
+  createOperatorAuthMiddleware,
+  createLogger,
+  createInternalAuthMiddleware,
+  corsHeaders,
+  collectInternalAuthKeys,
+  checkInternalAuth,
+  SECURITY_HEADERS_DEFAULTS
+};

package/dist/middleware/logger.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Copyright (c) 2026 HOOX · HOOX · jango-blockchained (hoox-sh)
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export interface LogContext {
+    service: string;
+    module?: string;
+}
+export interface Logger {
+    debug(message: string, context?: Record<string, unknown>): void;
+    info(message: string, context?: Record<string, unknown>): void;
+    warn(message: string, context?: Record<string, unknown>): void;
+    error(message: string, context?: Record<string, unknown>): void;
+}
+export declare function createLogger(ctx: LogContext): Logger;
+export declare function withRequestLog<E>(handler: (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>, logCtx: LogContext): (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA4BpD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,QAAQ,CAAC,EACtB,MAAM,EAAE,UAAU,GACjB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2BxE"}