@increase21/simplenodejs 1.0.20 → 1.0.22

package/dist/utils/simpleMiddleware.js

@@ -1,41 +1,35 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SetRequestCORS = SetRequestCORS;
+exports.SetCORS = SetCORS;
+exports.SetHSTS = SetHSTS;
+exports.SetCSP = SetCSP;
+exports.SetFrameGuard = SetFrameGuard;
+exports.SetNoSniff = SetNoSniff;
+exports.SetReferrerPolicy = SetReferrerPolicy;
+exports.SetPermissionsPolicy = SetPermissionsPolicy;
+exports.SetCOEP = SetCOEP;
+exports.SetCOOP = SetCOOP;
+exports.SetHelmet = SetHelmet;
 exports.SetRateLimiter = SetRateLimiter;
 exports.SetBodyParser = SetBodyParser;
-const node_querystring_1 = __importDefault(require("node:querystring"));
 const helpers_1 = require("./helpers");
-// core/cors.ts
-function SetRequestCORS(opts) {
+// ─── CORS ────────────────────────────────────────────────────────────────────
+function SetCORS(opts) {
     return async (req, res, next) => {
-        const defaults = {
-            "Access-Control-Allow-Origin": "*",
-            "Access-Control-Allow-Headers": "Origin, X-Requested-With, Content-Type, Accept, Authorization",
-            "Access-Control-Allow-Methods": "GET, POST, DELETE, PUT, PATCH",
-            "X-Content-Type-Options": "nosniff",
-            "X-Frame-Options": "DENY",
-            "Referrer-Policy": "no-referrer",
-            "Content-Security-Policy": "default-src 'none'",
-        };
-        let merged = { ...defaults };
-        for (const { name, value } of opts) {
-            merged[name] = value; // overrides defaults if same key
+        if (opts?.credentials) {
+            const reqOrigin = req.headers.origin;
+            if (!reqOrigin)
+                (0, helpers_1.throwHttpError)(403, "CORS Error: Origin header is required when credentials are enabled");
+            if (opts.origin && reqOrigin !== opts.origin)
+                (0, helpers_1.throwHttpError)(403, "CORS Error: Origin not allowed");
+            res.setHeader("Access-Control-Allow-Origin", reqOrigin);
+            res.setHeader("Access-Control-Allow-Credentials", "true");
         }
-        //allow credentials only when origin specified
-        if (merged["Access-Control-Allow-Credentials"] === "true") {
-            const origin = req.headers.origin;
-            if (!origin) {
-                (0, helpers_1.throwHttpError)(403, "CORS Error: Origin header is required when Access-Control-Allow-Credentials is true");
-                return;
-            }
-            merged["Access-Control-Allow-Origin"] = origin;
-        }
-        for (const [key, value] of Object.entries(merged)) {
-            res.setHeader(key, value);
+        else {
+            res.setHeader("Access-Control-Allow-Origin", opts?.origin || "*");
         }
+        res.setHeader("Access-Control-Allow-Headers", opts?.headers || "Origin, X-Requested-With, Content-Type, Accept, Authorization");
+        res.setHeader("Access-Control-Allow-Methods", opts?.methods || "GET, POST, DELETE, PUT, PATCH");
         if (req.method === "OPTIONS") {
             res.status(204).end();
             return;
@@ -43,20 +37,115 @@ function SetRequestCORS(opts) {
         await next();
     };
 }
-// core/rateLimit.ts
+// ─── HSTS ─────────────────────────────────────────────────────────────────────
+// Only meaningful on HTTPS. Browsers ignore this header over plain HTTP.
+function SetHSTS(opts) {
+    let value = `max-age=${opts?.maxAge ?? 31536000}`;
+    if (opts?.includeSubDomains !== false)
+        value += "; includeSubDomains";
+    if (opts?.preload)
+        value += "; preload";
+    return async (_req, res, next) => {
+        res.setHeader("Strict-Transport-Security", value);
+        await next();
+    };
+}
+// ─── Content Security Policy ──────────────────────────────────────────────────
+function SetCSP(policy = "default-src 'none'") {
+    return async (_req, res, next) => {
+        res.setHeader("Content-Security-Policy", policy);
+        await next();
+    };
+}
+// ─── X-Frame-Options (clickjacking) ──────────────────────────────────────────
+function SetFrameGuard(action = "DENY") {
+    return async (_req, res, next) => {
+        res.setHeader("X-Frame-Options", action);
+        await next();
+    };
+}
+// ─── X-Content-Type-Options (MIME sniffing) ───────────────────────────────────
+function SetNoSniff() {
+    return async (_req, res, next) => {
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        await next();
+    };
+}
+// ─── Referrer-Policy ──────────────────────────────────────────────────────────
+function SetReferrerPolicy(policy = "no-referrer") {
+    return async (_req, res, next) => {
+        res.setHeader("Referrer-Policy", policy);
+        await next();
+    };
+}
+// ─── Permissions-Policy (browser feature control) ────────────────────────────
+function SetPermissionsPolicy(policy = "camera=(), microphone=(), geolocation=(), payment=(), usb=(), display-capture=()") {
+    return async (_req, res, next) => {
+        res.setHeader("Permissions-Policy", policy);
+        await next();
+    };
+}
+// ─── Cross-Origin-Embedder-Policy ────────────────────────────────────────────
+function SetCOEP(value = "require-corp") {
+    return async (_req, res, next) => {
+        res.setHeader("Cross-Origin-Embedder-Policy", value);
+        await next();
+    };
+}
+// ─── Cross-Origin-Opener-Policy ──────────────────────────────────────────────
+function SetCOOP(value = "same-origin") {
+    return async (_req, res, next) => {
+        res.setHeader("Cross-Origin-Opener-Policy", value);
+        await next();
+    };
+}
+// ─── Helmet (security headers bundle, excludes CORS) ─────────────────────────
+function SetHelmet(opts) {
+    return async (_req, res, next) => {
+        if (opts?.noSniff !== false)
+            res.setHeader("X-Content-Type-Options", "nosniff");
+        if (opts?.frameGuard !== false)
+            res.setHeader("X-Frame-Options", typeof opts?.frameGuard === "string" ? opts.frameGuard : "DENY");
+        if (opts?.referrerPolicy !== false)
+            res.setHeader("Referrer-Policy", typeof opts?.referrerPolicy === "string" ? opts.referrerPolicy : "no-referrer");
+        if (opts?.csp !== false)
+            res.setHeader("Content-Security-Policy", typeof opts?.csp === "string" ? opts.csp : "default-src 'none'");
+        if (opts?.hsts !== false) {
+            const hsts = (opts?.hsts && typeof opts.hsts === "object") ? opts.hsts : {};
+            let hstsValue = `max-age=${hsts.maxAge ?? 31536000}`;
+            if (hsts.includeSubDomains !== false)
+                hstsValue += "; includeSubDomains";
+            if (hsts.preload)
+                hstsValue += "; preload";
+            res.setHeader("Strict-Transport-Security", hstsValue);
+        }
+        if (opts?.permissionsPolicy !== false)
+            res.setHeader("Permissions-Policy", typeof opts?.permissionsPolicy === "string" ? opts.permissionsPolicy : "camera=(), microphone=(), geolocation=(), payment=(), usb=(), display-capture=()");
+        if (opts?.coep !== false)
+            res.setHeader("Cross-Origin-Embedder-Policy", typeof opts?.coep === "string" ? opts.coep : "require-corp");
+        if (opts?.coop !== false)
+            res.setHeader("Cross-Origin-Opener-Policy", typeof opts?.coop === "string" ? opts.coop : "same-origin");
+        await next();
+    };
+}
+// ─── Rate Limiter ─────────────────────────────────────────────────────────────
+const RATE_LIMIT_MAX_STORE = 100000;
 function SetRateLimiter(opts) {
     const store = new Map();
     const timer = setInterval(() => {
         const now = Date.now();
         for (const [k, v] of store) {
-            if (now - v.ts > opts.windowMs * 2)
+            if (now - v.ts > opts.windowMs)
                 store.delete(k);
         }
     }, opts.windowMs);
     timer.unref();
     return async (req, res, next) => {
-        const rawIp = req.headers["x-forwarded-for"] || req.socket.remoteAddress || "unknown";
-        const ip = Array.isArray(rawIp) ? rawIp[0] : String(rawIp).split(",")[0].trim();
+        const ip = opts.trustProxy
+            ? (Array.isArray(req.headers["x-forwarded-for"])
+                ? req.headers["x-forwarded-for"][0]
+                : String(req.headers["x-forwarded-for"] || "").split(",")[0].trim()) || req.socket.remoteAddress || "unknown"
+            : req.socket.remoteAddress || "unknown";
         const key = String(opts.keyGenerator?.(req) || ip || "unknown");
         const now = Date.now();
         const entry = store.get(key) || { count: 0, ts: now };
@@ -65,6 +154,9 @@ function SetRateLimiter(opts) {
             entry.ts = now;
         }
         entry.count++;
+        if (!store.has(key) && store.size >= RATE_LIMIT_MAX_STORE) {
+            store.delete(store.keys().next().value); // evict oldest entry
+        }
         store.set(key, entry);
         if (entry.count > opts.max) {
             res.setHeader("Retry-After", Math.ceil(opts.windowMs / 1000));
@@ -75,7 +167,7 @@ function SetRateLimiter(opts) {
         await next();
     };
 }
-// core/body.ts
+// ─── Body Parser ──────────────────────────────────────────────────────────────
 function SetBodyLimit(limit = "1mb") {
     if (typeof limit === "number")
         return limit;
@@ -90,15 +182,11 @@ function SetBodyLimit(limit = "1mb") {
         return n * 1024 * 1024;
     return n;
 }
-//For 
 function SetBodyParser(opts) {
     const maxSize = SetBodyLimit(opts.limit);
     return (req, res, next) => new Promise((resolve, reject) => {
-        //get the content type of the request
         const contentType = req.headers["content-type"] || "";
-        // Skip multipart/form-data (file uploads)
-        if (contentType.includes("multipart/form-data"))
-            return resolve(next());
+        const isMultipart = contentType.includes("multipart/form-data");
         let size = 0;
         let body = "";
         req.on("data", chunk => {
@@ -111,34 +199,31 @@ function SetBodyParser(opts) {
                 req.socket.destroy();
                 return;
             }
-            //add the body
-            body += chunk;
+            if (!isMultipart)
+                body += chunk;
         });
         req.on("end", () => {
             if (res.writableEnded)
                 return resolve();
             try {
-                if (body && contentType.includes("application/json")) {
+                if (!isMultipart && body && contentType.includes("application/json")) {
                     req.body = JSON.parse(body);
                 }
-                else {
+                else if (!isMultipart) {
                     req.body = body;
                 }
-                //parse query
-                if (req.query) {
-                    req.query = JSON.parse(JSON.stringify(node_querystring_1.default.parse(req.query)));
-                }
                 resolve(next());
             }
             catch (e) {
+                reject({ code: 400, error: "Invalid Payload" });
                 if (!res.writableEnded)
-                    reject({ code: 400, error: "Invalid request body" });
+                    res.status(400).end("Invalid Payload");
             }
         });
         req.on("error", () => {
+            reject({ code: 400, error: "Request stream ended" });
             if (!res.writableEnded)
-                reject({ code: 400, error: "Request stream error" });
+                res.status(400).end("Request stream ended");
         });
     });
 }
-;

package/dist/utils/simplePlugins.d.ts

@@ -1,9 +1,72 @@
 import { SimpleJsServer } from "../typings/general";
 import { SimpleJSRateLimitType } from "../typings/simpletypes";
+import { SetCORS, SetHelmet } from "./simpleMiddleware";
 export declare function SimpleJsSecurityPlugin(app: SimpleJsServer, opts: {
-    cors?: {
-        name: string;
-        value: string;
-    }[];
+    cors?: Parameters<typeof SetCORS>[0];
+    helmet?: true | Parameters<typeof SetHelmet>[0];
     rateLimit?: SimpleJSRateLimitType;
 }): void;
+/**
+ * Restricts access based on client IP.
+ * mode "allow" = only listed IPs can access (whitelist).
+ * mode "deny"  = listed IPs are blocked (blacklist).
+ */
+export declare function SimpleJsIPWhitelistPlugin(app: SimpleJsServer, opts: {
+    ips: string[];
+    mode?: "allow" | "deny";
+    trustProxy?: boolean;
+}): void;
+/**
+ * Creates a signed cookie value. Use this when setting a cookie in a response.
+ * The client sends it back as-is; SimpleJsCookiePlugin will verify and strip the signature.
+ */
+export declare function SignCookie(value: string, secret: string): string;
+/**
+ * Parses the Cookie header on every request.
+ * Cookies are available at `this._custom_data[dataKey]` inside controllers.
+ * If a secret is provided, signed cookies (prefixed "s:") are verified and unsigned.
+ * Cookies with invalid signatures are silently dropped.
+ */
+export declare function SimpleJsCookiePlugin(app: SimpleJsServer, opts?: {
+    secret?: string;
+    /** Key used to attach cookies on _custom_data. Default: "cookies" */
+    dataKey?: string;
+}): void;
+/**
+ * Logs every request after it completes, including method, URL, status code, and duration.
+ */
+export declare function SimpleJsRequestLoggerPlugin(app: SimpleJsServer, opts?: {
+    /** Custom log function. Defaults to console.log. */
+    logger?: (message: string) => void;
+    format?: "simple" | "json";
+}): void;
+/**
+ * Automatically closes requests that exceed the configured time limit.
+ */
+export declare function SimpleJsTimeoutPlugin(app: SimpleJsServer, opts: {
+    /** Timeout in milliseconds */
+    ms: number;
+    message?: string;
+}): void;
+/**
+ * Sets Cache-Control response headers on every request.
+ */
+export declare function SimpleJsCachePlugin(app: SimpleJsServer, opts: {
+    /** Max age in seconds for public caching */
+    maxAge?: number;
+    /** Mark response as private (user-specific, not shared caches) */
+    private?: boolean;
+    /** Disable all caching entirely */
+    noStore?: boolean;
+}): void;
+/**
+ * Returns 503 for all requests when maintenance mode is enabled.
+ * Optionally allow specific IPs to bypass (e.g. for internal testing).
+ */
+export declare function SimpleJsMaintenanceModePlugin(app: SimpleJsServer, opts: {
+    enabled: boolean;
+    message?: string;
+    /** IPs that bypass maintenance mode (e.g. your office/server IP) */
+    allowIPs?: string[];
+    trustProxy?: boolean;
+}): void;

package/dist/utils/simplePlugins.js

@@ -1,8 +1,206 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SimpleJsSecurityPlugin = SimpleJsSecurityPlugin;
+exports.SimpleJsIPWhitelistPlugin = SimpleJsIPWhitelistPlugin;
+exports.SignCookie = SignCookie;
+exports.SimpleJsCookiePlugin = SimpleJsCookiePlugin;
+exports.SimpleJsRequestLoggerPlugin = SimpleJsRequestLoggerPlugin;
+exports.SimpleJsTimeoutPlugin = SimpleJsTimeoutPlugin;
+exports.SimpleJsCachePlugin = SimpleJsCachePlugin;
+exports.SimpleJsMaintenanceModePlugin = SimpleJsMaintenanceModePlugin;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_net_1 = __importDefault(require("node:net"));
+const helpers_1 = require("./helpers");
 const simpleMiddleware_1 = require("./simpleMiddleware");
+// ─── IP normalization ─────────────────────────────────────────────────────────
+// Converts IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) to plain IPv4.
+function normalizeIP(raw) {
+    const stripped = raw.replace(/^::ffff:/i, "");
+    return node_net_1.default.isIPv4(stripped) ? stripped : raw;
+}
+// ─── Security Plugin ──────────────────────────────────────────────────────────
 function SimpleJsSecurityPlugin(app, opts) {
-    opts.cors && app.use((0, simpleMiddleware_1.SetRequestCORS)(opts.cors || []));
-    opts.rateLimit && app.use((0, simpleMiddleware_1.SetRateLimiter)(opts.rateLimit || { windowMs: 1000, max: 100 }));
+    if (opts.cors)
+        app.use((0, simpleMiddleware_1.SetCORS)(opts.cors));
+    if (opts.helmet)
+        app.use((0, simpleMiddleware_1.SetHelmet)(opts.helmet === true ? undefined : opts.helmet));
+    if (opts.rateLimit)
+        app.use((0, simpleMiddleware_1.SetRateLimiter)(opts.rateLimit));
+}
+// ─── IP Whitelist / Blacklist Plugin ──────────────────────────────────────────
+/**
+ * Restricts access based on client IP.
+ * mode "allow" = only listed IPs can access (whitelist).
+ * mode "deny"  = listed IPs are blocked (blacklist).
+ */
+function SimpleJsIPWhitelistPlugin(app, opts) {
+    const mode = opts.mode || "allow";
+    const ipSet = new Set(opts.ips);
+    app.use(async (req, _res, next) => {
+        const raw = opts.trustProxy
+            ? (Array.isArray(req.headers["x-forwarded-for"])
+                ? req.headers["x-forwarded-for"][0]
+                : String(req.headers["x-forwarded-for"] || "").split(",")[0].trim()) || req.socket.remoteAddress || ""
+            : req.socket.remoteAddress || "";
+        const ip = normalizeIP(raw);
+        const inList = ipSet.has(ip);
+        if (mode === "allow" && !inList)
+            (0, helpers_1.throwHttpError)(403, "Access denied");
+        if (mode === "deny" && inList)
+            (0, helpers_1.throwHttpError)(403, "Access denied");
+        await next();
+    });
+}
+// ─── Cookie Plugin ────────────────────────────────────────────────────────────
+function parseCookieHeader(header) {
+    const result = {};
+    for (const part of header.split(";")) {
+        const idx = part.indexOf("=");
+        if (idx < 0)
+            continue;
+        const key = part.slice(0, idx).trim();
+        const val = part.slice(idx + 1).trim();
+        try {
+            result[key] = decodeURIComponent(val);
+        }
+        catch {
+            result[key] = val;
+        }
+    }
+    return result;
+}
+/**
+ * Creates a signed cookie value. Use this when setting a cookie in a response.
+ * The client sends it back as-is; SimpleJsCookiePlugin will verify and strip the signature.
+ */
+function SignCookie(value, secret) {
+    const sig = node_crypto_1.default.createHmac("sha256", secret).update(value).digest("base64url");
+    return `s:${value}.${sig}`;
+}
+/**
+ * Parses the Cookie header on every request.
+ * Cookies are available at `this._custom_data[dataKey]` inside controllers.
+ * If a secret is provided, signed cookies (prefixed "s:") are verified and unsigned.
+ * Cookies with invalid signatures are silently dropped.
+ */
+function SimpleJsCookiePlugin(app, opts) {
+    const dataKey = opts?.dataKey || "cookies";
+    app.use(async (req, _res, next) => {
+        const raw = parseCookieHeader(req.headers.cookie || "");
+        if (opts?.secret) {
+            const verified = {};
+            for (const [k, v] of Object.entries(raw)) {
+                if (v.startsWith("s:")) {
+                    const inner = v.slice(2);
+                    const dotIdx = inner.lastIndexOf(".");
+                    if (dotIdx < 0)
+                        continue; // malformed signed cookie — drop
+                    const val = inner.slice(0, dotIdx);
+                    const sig = inner.slice(dotIdx + 1);
+                    const expected = node_crypto_1.default.createHmac("sha256", opts.secret).update(val).digest("base64url");
+                    const sigBuf = Buffer.from(sig, "base64url");
+                    const expectedBuf = Buffer.from(expected, "base64url");
+                    if (sigBuf.length === expectedBuf.length && node_crypto_1.default.timingSafeEqual(sigBuf, expectedBuf)) {
+                        verified[k] = val; // valid — attach unsigned value
+                    }
+                    // invalid signature — silently dropped
+                }
+                else {
+                    verified[k] = v; // unsigned cookie — pass through
+                }
+            }
+            req._custom_data = { ...(req._custom_data || {}), [dataKey]: verified };
+        }
+        else {
+            req._custom_data = { ...(req._custom_data || {}), [dataKey]: raw };
+        }
+        await next();
+    });
+}
+// ─── Request Logger Plugin ────────────────────────────────────────────────────
+/**
+ * Logs every request after it completes, including method, URL, status code, and duration.
+ */
+function SimpleJsRequestLoggerPlugin(app, opts) {
+    const log = opts?.logger || console.log;
+    const format = opts?.format || "simple";
+    app.use(async (req, res, next) => {
+        const start = Date.now();
+        const method = req.method || "?";
+        const url = req.url || "/";
+        const path = url.split("?")[0]; // omit query string to avoid logging sensitive params
+        res.on("finish", () => {
+            const ms = Date.now() - start;
+            const status = res.statusCode;
+            if (format === "json") {
+                log(JSON.stringify({ time: new Date().toISOString(), method, path, status, ms, id: req.id }));
+            }
+            else {
+                log(`[${new Date().toISOString()}] ${method} ${path} ${status} ${ms}ms`);
+            }
+        });
+        await next();
+    });
+}
+// ─── Request Timeout Plugin ───────────────────────────────────────────────────
+/**
+ * Automatically closes requests that exceed the configured time limit.
+ */
+function SimpleJsTimeoutPlugin(app, opts) {
+    app.use(async (req, res, next) => {
+        const timer = setTimeout(() => {
+            if (!res.writableEnded) {
+                res.statusCode = 408;
+                res.end(opts.message || "Request timeout");
+                req.socket.destroy();
+            }
+        }, opts.ms);
+        res.on("finish", () => clearTimeout(timer));
+        res.on("close", () => clearTimeout(timer));
+        await next();
+    });
+}
+// ─── Cache Control Plugin ─────────────────────────────────────────────────────
+/**
+ * Sets Cache-Control response headers on every request.
+ */
+function SimpleJsCachePlugin(app, opts) {
+    let directive;
+    if (opts.noStore) {
+        directive = "no-store";
+    }
+    else if (opts.private) {
+        directive = `private, max-age=${opts.maxAge ?? 0}`;
+    }
+    else {
+        directive = `public, max-age=${opts.maxAge ?? 0}`;
+    }
+    app.use(async (_req, res, next) => {
+        res.setHeader("Cache-Control", directive);
+        await next();
+    });
+}
+// ─── Maintenance Mode Plugin ──────────────────────────────────────────────────
+/**
+ * Returns 503 for all requests when maintenance mode is enabled.
+ * Optionally allow specific IPs to bypass (e.g. for internal testing).
+ */
+function SimpleJsMaintenanceModePlugin(app, opts) {
+    app.use(async (req, res, next) => {
+        if (!opts.enabled)
+            return next();
+        const raw = opts.trustProxy
+            ? (Array.isArray(req.headers["x-forwarded-for"])
+                ? req.headers["x-forwarded-for"][0]
+                : String(req.headers["x-forwarded-for"] || "").split(",")[0].trim()) || req.socket.remoteAddress || ""
+            : req.socket.remoteAddress || "";
+        const ip = normalizeIP(raw);
+        if (opts.allowIPs?.includes(ip))
+            return next();
+        res.setHeader("Retry-After", "3600");
+        (0, helpers_1.throwHttpError)(503, opts.message || "Service is under maintenance. Please try again later.");
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@increase21/simplenodejs",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "description": "Lightweight Node.js HTTP framework with middlewares and plugins",
   "dev": "dist/index.js",
   "bugs": "https://github.com/increase21/simplenodejs/issues",