@jango-blockchained/hoox-shared 1.0.9 → 1.1.0

package/dist/middleware/index.js

@@ -141,6 +141,184 @@ var Errors = {
   }
 };
 
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+
+// src/middleware/cors.ts
+var DEFAULT_OPTIONS = {
+  allowOrigin: "",
+  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
+  allowHeaders: "Content-Type, Authorization, X-Request-ID",
+  allowCredentials: false,
+  maxAge: 86400
+};
+function corsHeaders(options) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const headers = {
+    "Access-Control-Allow-Methods": opts.allowMethods,
+    "Access-Control-Allow-Headers": opts.allowHeaders,
+    "Access-Control-Max-Age": String(opts.maxAge)
+  };
+  if (opts.allowOrigin) {
+    headers["Access-Control-Allow-Origin"] = opts.allowOrigin;
+  }
+  if (opts.allowCredentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  return headers;
+}
+function publicCorsHeaders(origin = "*", options) {
+  return corsHeaders({ ...options, allowOrigin: origin });
+}
+function internalCorsHeaders() {
+  return {};
+}
+function resolveCorsOptions(request, env) {
+  const raw = env && typeof env === "object" && "CORS_ALLOW_ORIGIN" in env && typeof env.CORS_ALLOW_ORIGIN === "string" ? env.CORS_ALLOW_ORIGIN : undefined;
+  const configured = raw?.trim();
+  if (!configured) {
+    return {};
+  }
+  const allowed = configured.split(",").map((entry) => entry.trim()).filter(Boolean);
+  const origin = request.headers.get("Origin");
+  if (origin && allowed.includes(origin)) {
+    return { allowOrigin: origin, allowCredentials: true };
+  }
+  if (!origin && allowed.length === 1) {
+    return { allowOrigin: allowed[0] };
+  }
+  return {};
+}
+function handleCorsPreflightRequest(request, options) {
+  if (request.method !== "OPTIONS")
+    return null;
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(options)
+  });
+}
+
 // src/middleware/logger.ts
 function createLogger(ctx) {
   const base = { service: ctx.service, module: ctx.module };
@@ -196,75 +374,7 @@ function withRequestLog(handler, logCtx) {
     }
   };
 }
-// src/middleware/auth.ts
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length)
-    return false;
-  const encoder = new TextEncoder;
-  const aBuf = encoder.encode(a);
-  const bBuf = encoder.encode(b);
-  let result = 0;
-  for (let i = 0;i < aBuf.length; i++) {
-    result |= aBuf[i] ^ bBuf[i];
-  }
-  return result === 0;
-}
-async function requireAuth(request, env) {
-  const apiKey = env.INTERNAL_API_KEY;
-  if (!apiKey) {
-    return new Response(JSON.stringify({ error: "Internal API key not configured" }), { status: 401, headers: { "Content-Type": "application/json" } });
-  }
-  const authHeader = request.headers.get("Authorization");
-  const expectedHeader = `Bearer ${apiKey}`;
-  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
-    return new Response(JSON.stringify({ error: "Unauthorized" }), {
-      status: 401,
-      headers: { "Content-Type": "application/json" }
-    });
-  }
-  return null;
-}
-function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
-  const expectedKey = env[keyName];
-  if (!expectedKey) {
-    return new Response(JSON.stringify({
-      success: false,
-      error: `Internal auth key ${keyName} not configured`
-    }), { status: 401, headers: { "Content-Type": "application/json" } });
-  }
-  const providedKey = request.headers.get("X-Internal-Auth-Key");
-  if (!providedKey || !timingSafeEqual(providedKey, expectedKey)) {
-    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
-  }
-  return null;
-}
-function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
-  return async (request, env, _ctx) => {
-    const expectedKey = env[keyName];
-    if (!expectedKey) {
-      return new Response(JSON.stringify({
-        success: false,
-        error: `Internal auth key ${keyName} not configured`
-      }), { status: 401, headers: { "Content-Type": "application/json" } });
-    }
-    const providedKey = request.headers.get("X-Internal-Auth-Key");
-    if (!providedKey || !timingSafeEqual(providedKey, expectedKey)) {
-      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
-    }
-    return;
-  };
-}
-function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
-  const expectedKey = env[keyName];
-  if (!expectedKey) {
-    return { authorized: false, error: `${keyName} not configured` };
-  }
-  const providedKey = request.headers.get("X-Internal-Auth-Key");
-  if (!providedKey || !timingSafeEqual(providedKey, expectedKey)) {
-    return { authorized: false, error: "Unauthorized" };
-  }
-  return { authorized: true };
-}
+
 // src/middleware/rate-limit.ts
 function createStorage(kv) {
   if (!kv) {
@@ -338,16 +448,11 @@ function createStorage(kv) {
       await kv.put(key, value, opts);
     },
     async incr(key, opts) {
-      const maxRetries = 3;
-      for (let attempt = 0;attempt < maxRetries; attempt++) {
-        const current2 = await kv.get(key);
-        const count = current2 ? parseInt(current2, 10) : 0;
-        const next = count + 1;
-        await kv.put(key, String(next), opts);
-        return next;
-      }
       const current = await kv.get(key);
-      return current ? parseInt(current, 10) + 1 : 1;
+      const count = current ? parseInt(current, 10) : 0;
+      const next = count + 1;
+      await kv.put(key, String(next), opts);
+      return next;
     }
   };
 }
@@ -431,6 +536,7 @@ function createRateLimiter(kv, config) {
   }
   return { check, enforce, checkKey, enforceKey };
 }
+
 // src/middleware/validate.ts
 function validateJson(schema, data) {
   const result = schema.safeParse(data);
@@ -464,35 +570,7 @@ function optionalField(body, field, defaultValue) {
     return defaultValue;
   return body[field];
 }
-// src/middleware/cors.ts
-var DEFAULT_OPTIONS = {
-  allowOrigin: "*",
-  allowMethods: "GET, POST, OPTIONS, PUT, DELETE",
-  allowHeaders: "Content-Type, Authorization, X-Request-ID, X-Internal-Auth-Key",
-  allowCredentials: false,
-  maxAge: 86400
-};
-function corsHeaders(options) {
-  const opts = { ...DEFAULT_OPTIONS, ...options };
-  const headers = {
-    "Access-Control-Allow-Origin": opts.allowOrigin,
-    "Access-Control-Allow-Methods": opts.allowMethods,
-    "Access-Control-Allow-Headers": opts.allowHeaders,
-    "Access-Control-Max-Age": String(opts.maxAge)
-  };
-  if (opts.allowCredentials) {
-    headers["Access-Control-Allow-Credentials"] = "true";
-  }
-  return headers;
-}
-function handleCorsPreflightRequest(request, options) {
-  if (request.method !== "OPTIONS")
-    return null;
-  return new Response(null, {
-    status: 204,
-    headers: corsHeaders(options)
-  });
-}
+
 // src/middleware/security-headers.ts
 var SECURITY_HEADERS_DEFAULTS = {
   xContentTypeOptions: "nosniff",
@@ -536,15 +614,22 @@ export {
   validateJson,
   timingSafeEqual,
   secureHeaders,
+  resolveOperatorApiKey,
+  resolveCorsOptions,
+  requireOperatorAuth,
   requireInternalAuth,
   requireField,
   requireAuth,
+  publicCorsHeaders,
   optionalField,
+  internalCorsHeaders,
   handleCorsPreflightRequest,
   createRateLimiter,
+  createOperatorAuthMiddleware,
   createLogger,
   createInternalAuthMiddleware,
   corsHeaders,
+  collectInternalAuthKeys,
   checkInternalAuth,
   SECURITY_HEADERS_DEFAULTS
 };

package/dist/middleware/logger.js

@@ -0,0 +1,202 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/errors.ts
+function toError(err, fallback = "Unknown error") {
+  if (err instanceof Error)
+    return err.message;
+  if (typeof err === "string")
+    return err;
+  if (err && typeof err === "object" && "message" in err && typeof err.message === "string") {
+    return err.message;
+  }
+  if (err === null || err === undefined)
+    return fallback;
+  try {
+    return JSON.stringify(err) || fallback;
+  } catch {
+    return fallback;
+  }
+}
+var SENSITIVE_FIELDS = new Set([
+  "password",
+  "token",
+  "secret",
+  "api_key",
+  "apiKey",
+  "authorization"
+]);
+function hasSensitiveFields(obj) {
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELDS.has(key))
+      return true;
+  }
+  return false;
+}
+function hasErrorValues(obj) {
+  for (const v of Object.values(obj)) {
+    if (v instanceof Error)
+      return true;
+  }
+  return false;
+}
+function sanitizeOutput(data) {
+  if (data === null || data === undefined)
+    return data;
+  const t = typeof data;
+  if (t === "string" || t === "number" || t === "boolean")
+    return data;
+  if (data instanceof Error) {
+    return { name: data.name, message: data.message };
+  }
+  if (Array.isArray(data)) {
+    return data.map(sanitizeOutput);
+  }
+  if (t === "object") {
+    const obj = data;
+    const keys = Object.keys(obj);
+    if (keys.length < 10) {
+      const sanitized2 = {};
+      for (const k of keys) {
+        if (k === "stack" || k === "cause")
+          continue;
+        const v = obj[k];
+        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+      }
+      return sanitized2;
+    }
+    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
+      return obj;
+    }
+    const sanitized = {};
+    for (const k of keys) {
+      if (k === "stack" || k === "cause")
+        continue;
+      const v = obj[k];
+      sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+    }
+    return sanitized;
+  }
+  return data;
+}
+function createJsonResponse(data, status = 200) {
+  return new Response(JSON.stringify(sanitizeOutput(data)), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function createSuccessResponse(result) {
+  return createJsonResponse({ success: true, result }, 200);
+}
+function createErrorResponse(error, status) {
+  const message = typeof error === "string" ? error : error.message;
+  const statusCode = typeof error === "string" ? status ?? 500 : error.status ?? 500;
+  const body = { success: false, error: message };
+  if (typeof error !== "string" && error.code)
+    body.code = error.code;
+  if (typeof error !== "string" && error.details !== undefined)
+    body.details = error.details;
+  return new Response(JSON.stringify(body), {
+    status: statusCode,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+var Errors = {
+  badRequest: (message) => createErrorResponse({ message, status: 400, code: "BAD_REQUEST" }),
+  unauthorized: (message = "Unauthorized") => createErrorResponse({ message, status: 401, code: "UNAUTHORIZED" }),
+  forbidden: (message = "Forbidden") => createErrorResponse({ message, status: 403, code: "FORBIDDEN" }),
+  notFound: (message = "Not found") => createErrorResponse({ message, status: 404, code: "NOT_FOUND" }),
+  methodNotAllowed: (message = "Method not allowed") => createErrorResponse({ message, status: 405, code: "METHOD_NOT_ALLOWED" }),
+  rateLimited: (retryAfter) => {
+    const res = createErrorResponse({
+      message: "Rate limit exceeded",
+      status: 429,
+      code: "RATE_LIMITED"
+    });
+    if (retryAfter)
+      res.headers.set("Retry-After", String(retryAfter));
+    return res;
+  },
+  internal: (err) => {
+    const message = err ? toError(err, "Internal server error") : "Internal server error";
+    return createErrorResponse({
+      message,
+      status: 500,
+      code: "INTERNAL_ERROR"
+    });
+  }
+};
+
+// src/middleware/logger.ts
+function createLogger(ctx) {
+  const base = { service: ctx.service, module: ctx.module };
+  function emit(level, message, context) {
+    const entry = {
+      level,
+      timestamp: new Date().toISOString(),
+      ...base,
+      message,
+      ...context && { context }
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error")
+      console.error(line);
+    else if (level === "warn")
+      console.warn(line);
+    else if (level === "debug")
+      console.debug(line);
+    else
+      console.info(line);
+  }
+  return {
+    debug: (msg, ctx2) => emit("debug", msg, ctx2),
+    info: (msg, ctx2) => emit("info", msg, ctx2),
+    warn: (msg, ctx2) => emit("warn", msg, ctx2),
+    error: (msg, ctx2) => emit("error", msg, ctx2)
+  };
+}
+function withRequestLog(handler, logCtx) {
+  return async (request, env, ctx) => {
+    const start = Date.now();
+    const logger = createLogger(logCtx);
+    try {
+      const response = await handler(request, env, ctx);
+      const duration = Date.now() - start;
+      const url = new URL(request.url);
+      logger.info(`${request.method} ${url.pathname}`, {
+        method: request.method,
+        path: url.pathname,
+        status: response.status,
+        durationMs: duration
+      });
+      return response;
+    } catch (error) {
+      const duration = Date.now() - start;
+      logger.error("Request failed", {
+        method: request.method,
+        path: new URL(request.url).pathname,
+        durationMs: duration,
+        error: toError(error)
+      });
+      throw error;
+    }
+  };
+}
+export {
+  withRequestLog,
+  createLogger
+};

package/dist/middleware/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACnD;AA6HD,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,SAAS,EAChC,MAAM,EAAE,eAAe,GACtB,WAAW,CAiHb"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACnD;AAuHD,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,SAAS,EAChC,MAAM,EAAE,eAAe,GACtB,WAAW,CAiHb"}