@jango-blockchained/hoox-shared 1.0.8 → 1.1.0

package/dist/middleware/index.js

@@ -32,22 +32,65 @@ function toError(err, fallback = "Unknown error") {
     return fallback;
   }
 }
+var SENSITIVE_FIELDS = new Set([
+  "password",
+  "token",
+  "secret",
+  "api_key",
+  "apiKey",
+  "authorization"
+]);
+function hasSensitiveFields(obj) {
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELDS.has(key))
+      return true;
+  }
+  return false;
+}
+function hasErrorValues(obj) {
+  for (const v of Object.values(obj)) {
+    if (v instanceof Error)
+      return true;
+  }
+  return false;
+}
 function sanitizeOutput(data) {
+  if (data === null || data === undefined)
+    return data;
+  const t = typeof data;
+  if (t === "string" || t === "number" || t === "boolean")
+    return data;
   if (data instanceof Error) {
     return { name: data.name, message: data.message };
   }
-  if (data && typeof data === "object" && !Array.isArray(data)) {
+  if (Array.isArray(data)) {
+    return data.map(sanitizeOutput);
+  }
+  if (t === "object") {
+    const obj = data;
+    const keys = Object.keys(obj);
+    if (keys.length < 10) {
+      const sanitized2 = {};
+      for (const k of keys) {
+        if (k === "stack" || k === "cause")
+          continue;
+        const v = obj[k];
+        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+      }
+      return sanitized2;
+    }
+    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
+      return obj;
+    }
     const sanitized = {};
-    for (const [k, v] of Object.entries(data)) {
+    for (const k of keys) {
       if (k === "stack" || k === "cause")
         continue;
+      const v = obj[k];
       sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
     }
     return sanitized;
   }
-  if (Array.isArray(data)) {
-    return data.map(sanitizeOutput);
-  }
   return data;
 }
 function createJsonResponse(data, status = 200) {
@@ -98,6 +141,184 @@ var Errors = {
   }
 };
 
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+
+// src/middleware/cors.ts
+var DEFAULT_OPTIONS = {
+  allowOrigin: "",
+  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
+  allowHeaders: "Content-Type, Authorization, X-Request-ID",
+  allowCredentials: false,
+  maxAge: 86400
+};
+function corsHeaders(options) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const headers = {
+    "Access-Control-Allow-Methods": opts.allowMethods,
+    "Access-Control-Allow-Headers": opts.allowHeaders,
+    "Access-Control-Max-Age": String(opts.maxAge)
+  };
+  if (opts.allowOrigin) {
+    headers["Access-Control-Allow-Origin"] = opts.allowOrigin;
+  }
+  if (opts.allowCredentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  return headers;
+}
+function publicCorsHeaders(origin = "*", options) {
+  return corsHeaders({ ...options, allowOrigin: origin });
+}
+function internalCorsHeaders() {
+  return {};
+}
+function resolveCorsOptions(request, env) {
+  const raw = env && typeof env === "object" && "CORS_ALLOW_ORIGIN" in env && typeof env.CORS_ALLOW_ORIGIN === "string" ? env.CORS_ALLOW_ORIGIN : undefined;
+  const configured = raw?.trim();
+  if (!configured) {
+    return {};
+  }
+  const allowed = configured.split(",").map((entry) => entry.trim()).filter(Boolean);
+  const origin = request.headers.get("Origin");
+  if (origin && allowed.includes(origin)) {
+    return { allowOrigin: origin, allowCredentials: true };
+  }
+  if (!origin && allowed.length === 1) {
+    return { allowOrigin: allowed[0] };
+  }
+  return {};
+}
+function handleCorsPreflightRequest(request, options) {
+  if (request.method !== "OPTIONS")
+    return null;
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(options)
+  });
+}
+
 // src/middleware/logger.ts
 function createLogger(ctx) {
   const base = { service: ctx.service, module: ctx.module };
@@ -114,10 +335,13 @@ function createLogger(ctx) {
       console.error(line);
     else if (level === "warn")
       console.warn(line);
+    else if (level === "debug")
+      console.debug(line);
     else
       console.info(line);
   }
   return {
+    debug: (msg, ctx2) => emit("debug", msg, ctx2),
     info: (msg, ctx2) => emit("info", msg, ctx2),
     warn: (msg, ctx2) => emit("warn", msg, ctx2),
     error: (msg, ctx2) => emit("error", msg, ctx2)
@@ -150,69 +374,91 @@ function withRequestLog(handler, logCtx) {
     }
   };
 }
-// src/middleware/auth.ts
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length)
-    return false;
-  const encoder = new TextEncoder;
-  const aBuf = encoder.encode(a);
-  const bBuf = encoder.encode(b);
-  let result = 0;
-  for (let i = 0;i < aBuf.length; i++) {
-    result |= aBuf[i] ^ bBuf[i];
-  }
-  return result === 0;
-}
-async function requireAuth(request, env) {
-  const apiKey = env.INTERNAL_API_KEY;
-  if (!apiKey) {
-    return new Response(JSON.stringify({ error: "Internal API key not configured" }), { status: 401, headers: { "Content-Type": "application/json" } });
-  }
-  const authHeader = request.headers.get("Authorization");
-  const expectedHeader = `Bearer ${apiKey}`;
-  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
-    return new Response(JSON.stringify({ error: "Unauthorized" }), {
-      status: 401,
-      headers: { "Content-Type": "application/json" }
-    });
-  }
-  return null;
-}
-function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
-  const expectedKey = env[keyName];
-  if (!expectedKey) {
-    return new Response(JSON.stringify({
-      success: false,
-      error: `Internal auth key ${keyName} not configured`
-    }), { status: 401, headers: { "Content-Type": "application/json" } });
-  }
-  const providedKey = request.headers.get("X-Internal-Auth-Key");
-  if (!providedKey || !timingSafeEqual(providedKey, expectedKey)) {
-    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+
+// src/middleware/rate-limit.ts
+function createStorage(kv) {
+  if (!kv) {
+    const memory = new Map;
+    return {
+      async get(key) {
+        const entry = memory.get(key);
+        if (!entry)
+          return null;
+        if (Date.now() > entry.expiresAt) {
+          memory.delete(key);
+          return null;
+        }
+        return entry.value;
+      },
+      async put(key, value, opts) {
+        const ttl = opts?.expirationTtl ?? 0;
+        const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+        memory.set(key, { value, expiresAt });
+      },
+      async incr(key, opts) {
+        let entry = memory.get(key);
+        let newValue;
+        let attempts = 0;
+        const maxAttempts = 100;
+        while (true) {
+          const count = entry ? parseInt(entry.value, 10) : 0;
+          newValue = count + 1;
+          if (!entry) {
+            const ttl = opts?.expirationTtl ?? 0;
+            const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+            if (memory.get(key) === undefined) {
+              memory.set(key, { value: String(newValue), expiresAt });
+              return newValue;
+            }
+            entry = memory.get(key);
+          } else {
+            if (Date.now() > entry.expiresAt) {
+              memory.delete(key);
+              entry = undefined;
+              continue;
+            }
+            const currentEntry = memory.get(key);
+            if (currentEntry === entry) {
+              const ttl = opts?.expirationTtl ?? 0;
+              const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+              memory.set(key, { value: String(newValue), expiresAt });
+              return newValue;
+            }
+            entry = currentEntry;
+          }
+          attempts++;
+          if (attempts >= maxAttempts) {
+            const current = await this.get(key);
+            const count2 = current ? parseInt(current, 10) : 0;
+            newValue = count2 + 1;
+            const ttl = opts?.expirationTtl ?? 0;
+            const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+            memory.set(key, { value: String(newValue), expiresAt });
+            return newValue;
+          }
+        }
+      }
+    };
   }
-  return null;
-}
-function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
-  return (request, env) => {
-    const result = requireInternalAuth(request, env, keyName);
-    if (result)
-      return result;
+  return {
+    async get(key) {
+      return kv.get(key);
+    },
+    async put(key, value, opts) {
+      await kv.put(key, value, opts);
+    },
+    async incr(key, opts) {
+      const current = await kv.get(key);
+      const count = current ? parseInt(current, 10) : 0;
+      const next = count + 1;
+      await kv.put(key, String(next), opts);
+      return next;
+    }
   };
 }
-function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
-  const expectedKey = env[keyName];
-  if (!expectedKey) {
-    return { authorized: false, error: `${keyName} not configured` };
-  }
-  const providedKey = request.headers.get("X-Internal-Auth-Key");
-  if (!providedKey || !timingSafeEqual(providedKey, expectedKey)) {
-    return { authorized: false, error: "Unauthorized" };
-  }
-  return { authorized: true };
-}
-// src/middleware/rate-limit.ts
 function createRateLimiter(kv, config) {
   const prefix = config.keyPrefix ?? "rate-limit";
+  const storage = createStorage(kv);
   function getClientIp(request) {
     return request.headers.get("CF-Connecting-IP") ?? "unknown";
   }
@@ -220,23 +466,37 @@ function createRateLimiter(kv, config) {
     const windowStart = Math.floor(Date.now() / (config.windowSeconds * 1000));
     return `${prefix}:${ip}:${windowStart}`;
   }
-  async function check(request) {
-    const ip = getClientIp(request);
-    const key = getWindowKey(ip);
-    const current = await kv.get(key);
+  async function checkWithKey(fullKey) {
+    const current = await storage.get(fullKey);
     const count = current ? parseInt(current, 10) : 0;
     if (count >= config.maxRequests) {
-      const retryAfter = config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000;
+      const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
       return {
         allowed: false,
         remaining: 0,
-        retryAfter: Math.ceil(retryAfter)
+        retryAfter
       };
     }
-    await kv.put(key, String(count + 1), {
+    const newCount = await storage.incr(fullKey, {
       expirationTtl: config.windowSeconds
     });
-    return { allowed: true, remaining: config.maxRequests - count - 1 };
+    if (newCount > config.maxRequests) {
+      const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfter
+      };
+    }
+    return {
+      allowed: true,
+      remaining: config.maxRequests - newCount
+    };
+  }
+  async function check(request) {
+    const ip = getClientIp(request);
+    const key = getWindowKey(ip);
+    return checkWithKey(key);
   }
   async function enforce(request) {
     const result = await check(request);
@@ -254,8 +514,29 @@ function createRateLimiter(kv, config) {
     }
     return null;
   }
-  return { check, enforce };
+  async function checkKey(key) {
+    const fullKey = `${prefix}:${key}`;
+    return checkWithKey(fullKey);
+  }
+  async function enforceKey(key) {
+    const result = await checkKey(key);
+    if (!result.allowed) {
+      return new Response(JSON.stringify({
+        error: "Rate limit exceeded",
+        retryAfter: result.retryAfter
+      }), {
+        status: 429,
+        headers: {
+          "Content-Type": "application/json",
+          "Retry-After": String(result.retryAfter ?? config.windowSeconds)
+        }
+      });
+    }
+    return null;
+  }
+  return { check, enforce, checkKey, enforceKey };
 }
+
 // src/middleware/validate.ts
 function validateJson(schema, data) {
   const result = schema.safeParse(data);
@@ -289,35 +570,7 @@ function optionalField(body, field, defaultValue) {
     return defaultValue;
   return body[field];
 }
-// src/middleware/cors.ts
-var DEFAULT_OPTIONS = {
-  allowOrigin: "*",
-  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
-  allowHeaders: "Content-Type, Authorization, X-Request-ID, X-Internal-Auth-Key",
-  allowCredentials: false,
-  maxAge: 86400
-};
-function corsHeaders(options) {
-  const opts = { ...DEFAULT_OPTIONS, ...options };
-  const headers = {
-    "Access-Control-Allow-Origin": opts.allowOrigin,
-    "Access-Control-Allow-Methods": opts.allowMethods,
-    "Access-Control-Allow-Headers": opts.allowHeaders,
-    "Access-Control-Max-Age": String(opts.maxAge)
-  };
-  if (opts.allowCredentials) {
-    headers["Access-Control-Allow-Credentials"] = "true";
-  }
-  return headers;
-}
-function handleCorsPreflightRequest(request, options) {
-  if (request.method !== "OPTIONS")
-    return null;
-  return new Response(null, {
-    status: 204,
-    headers: corsHeaders(options)
-  });
-}
+
 // src/middleware/security-headers.ts
 var SECURITY_HEADERS_DEFAULTS = {
   xContentTypeOptions: "nosniff",
@@ -361,15 +614,22 @@ export {
   validateJson,
   timingSafeEqual,
   secureHeaders,
+  resolveOperatorApiKey,
+  resolveCorsOptions,
+  requireOperatorAuth,
   requireInternalAuth,
   requireField,
   requireAuth,
+  publicCorsHeaders,
   optionalField,
+  internalCorsHeaders,
   handleCorsPreflightRequest,
   createRateLimiter,
+  createOperatorAuthMiddleware,
   createLogger,
   createInternalAuthMiddleware,
   corsHeaders,
+  collectInternalAuthKeys,
   checkInternalAuth,
   SECURITY_HEADERS_DEFAULTS
 };

package/dist/middleware/logger.d.ts

@@ -7,10 +7,11 @@ export interface LogContext {
     module?: string;
 }
 export interface Logger {
+    debug(message: string, context?: Record<string, unknown>): void;
     info(message: string, context?: Record<string, unknown>): void;
     warn(message: string, context?: Record<string, unknown>): void;
     error(message: string, context?: Record<string, unknown>): void;
 }
 export declare function createLogger(ctx: LogContext): Logger;
-export declare function withRequestLog<E extends Record<string, unknown>>(handler: (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>, logCtx: LogContext): (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>;
+export declare function withRequestLog<E>(handler: (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>, logCtx: LogContext): (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>;
 //# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA0BpD;AAED,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9D,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,QAAQ,CAAC,EACtB,MAAM,EAAE,UAAU,GACjB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2BxE"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA4BpD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,QAAQ,CAAC,EACtB,MAAM,EAAE,UAAU,GACjB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2BxE"}