@jmruthers/pace-core 0.5.135 → 0.5.137

package/src/utils/validation/validation.ts

@@ -0,0 +1,111 @@
+/**
+ * @file Internal utilities for validation module
+ * @internal This file contains implementation details that should not be used directly
+ */
+
+/**
+ * Utility functions for validating data in the application
+ */
+
+/**
+ * Check if a string is a valid email
+ */
+export function isValidEmail(email: string): boolean {
+  const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  return emailPattern.test(email);
+}
+
+/**
+ * Check if a string is empty (either null, undefined, or just whitespace)
+ */
+export function isEmpty(value: string | null | undefined): boolean {
+  return value === null || value === undefined || value.trim() === '';
+}
+
+/**
+ * Check if a password meets minimum requirements
+ */
+export function isStrongPassword(password: string): boolean {
+  // Minimum 8 characters, at least one uppercase, one lowercase, one number
+  const passwordPattern = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/;
+  return passwordPattern.test(password);
+}
+
+/**
+ * Check if a URL is valid
+ */
+export function isValidUrl(url: string): boolean {
+  try {
+    new URL(url);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check if a date string is valid
+ */
+export function isValidDate(dateStr: string): boolean {
+  const date = new Date(dateStr);
+  return !isNaN(date.getTime());
+}
+
+/**
+ * Check if a value is within a range
+ */
+export function isWithinRange(value: number, min: number, max: number): boolean {
+  return value >= min && value <= max;
+}
+
+/**
+ * Check if a value matches a specific pattern
+ */
+export function matchesPattern(value: string, pattern: RegExp): boolean {
+  return pattern.test(value);
+}
+
+/**
+ * Utility function to deep merge objects for schema combination
+ * @internal
+ */
+export function deepMerge<T extends Record<string, unknown>>(
+  target: T, 
+  source: Record<string, unknown>
+): T {
+  const output = { ...target };
+  
+  if (isObject(target) && isObject(source)) {
+    Object.keys(source).forEach(key => {
+      if (isObject(source[key])) {
+        if (!(key in target)) {
+          Object.assign(output, { [key]: source[key] });
+        } else {
+          // Use a type assertion to safely handle the indexing
+          const targetKey = key as keyof typeof target;
+          const targetValue = target[targetKey];
+          
+          if (isObject(targetValue)) {
+            // Safe cast using type assertion
+            output[targetKey] = deepMerge(
+              targetValue as Record<string, unknown>,
+              source[key] as Record<string, unknown>
+            ) as unknown as T[keyof T];
+          }
+        }
+      } else {
+        Object.assign(output, { [key]: source[key] });
+      }
+    });
+  }
+  
+  return output as T;
+}
+
+/**
+ * Type guard to check if a value is a plain object
+ * @internal
+ */
+export function isObject(item: unknown): item is Record<string, unknown> {
+  return item !== null && typeof item === 'object' && !Array.isArray(item);
+}

package/src/utils/validation/validationUtils.ts

@@ -0,0 +1,123 @@
+
+/**
+ * @file Validation utilities
+ * 
+ * Shared validation utilities with enhanced security
+ */
+
+import { z } from 'zod';
+import { sanitizeUserInput, sanitizeFormData, type SanitizationOptions } from './sanitization';
+import { createLogger } from '../core/logger';
+
+const log = createLogger('ValidationUtils');
+
+/**
+ * Validates user input against a schema with automatic sanitization
+ */
+export function validateUserInput<T>(
+  schema: z.ZodSchema<T>, 
+  data: unknown,
+  sanitizationRules?: Record<string, SanitizationOptions>
+): { success: boolean; data?: T; error?: string } {
+  return sanitizeFormData(data, schema, sanitizationRules);
+}
+
+/**
+ * Sanitizes user input by removing potentially dangerous characters
+ * @deprecated Use sanitizeUserInput from lib/sanitization instead
+ */
+export function sanitizeUserInput_deprecated(input: string): string {
+  // Log deprecation warning
+  log.warn('sanitizeUserInput is deprecated. Use sanitizeUserInput from lib/sanitization instead.');
+  return sanitizeUserInput(input);
+}
+
+/**
+ * Enhanced email validation with sanitization
+ */
+export const emailSchema = z.string()
+  .transform(email => email.toLowerCase().trim())
+  .pipe(z.string().min(1, 'Email is required').email('Invalid email format').max(254, 'Email too long'));
+
+/**
+ * Enhanced password validation
+ */
+export const passwordSchema = z.string()
+  .min(8, 'Password must be at least 8 characters')
+  .max(128, 'Password too long')
+  .regex(/[A-Z]/, 'Password must contain at least one uppercase letter')
+  .regex(/[a-z]/, 'Password must contain at least one lowercase letter')
+  .regex(/[0-9]/, 'Password must contain at least one number')
+  .regex(/[^A-Za-z0-9]/, 'Password must contain at least one special character');
+
+/**
+ * Username validation with sanitization
+ */
+export const usernameSchema = z.string()
+  .transform(username => username.toLowerCase().trim())
+  .pipe(z.string().min(3, 'Username must be at least 3 characters').max(30, 'Username too long').regex(/^[a-zA-Z0-9_-]+$/, 'Username can only contain letters, numbers, hyphens, and underscores'));
+
+/**
+ * Name validation with sanitization
+ */
+export const nameSchema = z.string()
+  .min(1, 'Name is required')
+  .max(100, 'Name too long')
+  .refine(name => {
+    // Check for XSS attempts and other invalid patterns
+    const dangerousPatterns = [
+      /<script/i,
+      /<img/i,
+      /on\w+\s*=/i,
+      /javascript:/i,
+      /data:/i,
+      /vbscript:/i
+    ];
+    
+    return !dangerousPatterns.some(pattern => pattern.test(name));
+  }, 'Name contains invalid characters')
+  .transform(name => sanitizeUserInput(name, { 
+    allowHtml: false, 
+    maxLength: 100, 
+    trim: true 
+  }));
+
+/**
+ * Phone number validation with sanitization
+ */
+export const phoneSchema = z.string()
+  .min(10, 'Phone number must be at least 10 digits')
+  .max(20, 'Phone number too long')
+  .regex(/^[\+]?[0-9\s\-\(\)\.]+$/, 'Invalid phone number format')
+  .refine(phone => {
+    // Remove all non-digit characters and check length
+    const digitsOnly = phone.replace(/\D/g, '');
+    return digitsOnly.length >= 10 && digitsOnly.length <= 15;
+  }, 'Phone number must be between 10 and 15 digits');
+
+/**
+ * URL validation with sanitization
+ */
+export const urlSchema = z.string()
+  .min(1, 'URL is required')
+  .max(2048, 'URL too long')
+  .refine(url => {
+    try {
+      const parsed = new URL(url);
+      return ['http:', 'https:'].includes(parsed.protocol);
+    } catch {
+      return false;
+    }
+  }, 'Invalid URL format')
+  .refine(url => {
+    // Additional security checks
+    const dangerousPatterns = [
+      /javascript:/i,
+      /data:/i,
+      /vbscript:/i,
+      /file:/i,
+      /mailto:/i
+    ];
+    
+    return !dangerousPatterns.some(pattern => pattern.test(url));
+  }, 'URL contains invalid protocol');

package/src/validation/index.ts

@@ -4,40 +4,9 @@
  * @module Validation
  * @since 0.1.0
  * 
- * Validation utilities and schemas for the PACE Core library.
- * For validation types, import from @jmruthers/pace-core/types.
- * 
- * @example
- * // Import validation utilities
- * import { validateInput, sanitizeUserInput } from '@jmruthers/pace-core/validation';
- * 
- * // Import validation types
- * import { LoginFormValues, ValidationResult } from '@jmruthers/pace-core/types';
+ * Re-export validation utilities from utils/validation for convenience.
+ * This provides a top-level validation entry point.
  */
 
-// Core validation utilities
-export * from './common';
-export * from './sanitization';
-export * from './csrf';
-export * from './sqlInjectionProtection';
-export * from './passwordSchema';
+export * from '../utils/validation';
 
-// Re-export schemas from types for convenience
-export {
-  loginSchema,
-  registrationSchema,
-  secureLoginSchema,
-  passwordResetSchema,
-  changePasswordSchema,
-  userProfileSchema,
-  contactFormSchema,
-  emailSchema,
-  nameSchema,
-  phoneSchema,
-  urlSchema,
-  dateSchema,
-  passwordSchema,
-  securePasswordSchema,
-  pickSchema,
-  combineSchemas
-} from '../types/validation';

package/dist/chunk-24MKLB7U.js

@@ -1,81 +0,0 @@
-// src/types/validation.ts
-import { z } from "zod";
-var emailSchema = z.string().email("Please enter a valid email address");
-var nameSchema = z.string().min(1, "Name is required").max(100, "Name must be less than 100 characters");
-var phoneSchema = z.string().regex(/^\+?[\d\s\-\(\)]+$/, "Please enter a valid phone number");
-var urlSchema = z.string().url("Please enter a valid URL");
-var dateSchema = z.string().refine((date) => !isNaN(Date.parse(date)), "Please enter a valid date");
-var passwordSchema = z.string().min(8, "Password must be at least 8 characters").regex(/[A-Z]/, "Password must contain at least one uppercase letter").regex(/[a-z]/, "Password must contain at least one lowercase letter").regex(/[0-9]/, "Password must contain at least one number");
-var securePasswordSchema = passwordSchema.regex(/[!@#$%^&*(),.?":{}|<>]/, "Password must contain at least one special character");
-var loginSchema = z.object({
-  email: emailSchema,
-  password: z.string().min(1, "Password is required")
-});
-var registrationSchema = z.object({
-  email: emailSchema,
-  password: passwordSchema,
-  confirmPassword: z.string()
-}).refine((data) => data.password === data.confirmPassword, {
-  message: "Passwords don't match",
-  path: ["confirmPassword"]
-});
-var secureLoginSchema = z.object({
-  email: emailSchema,
-  password: securePasswordSchema
-});
-var passwordResetSchema = z.object({
-  email: emailSchema
-});
-var changePasswordSchema = z.object({
-  currentPassword: z.string().min(1, "Current password is required"),
-  newPassword: securePasswordSchema,
-  confirmPassword: z.string()
-}).refine((data) => data.newPassword === data.confirmPassword, {
-  message: "Passwords don't match",
-  path: ["confirmPassword"]
-});
-var userProfileSchema = z.object({
-  name: nameSchema,
-  email: emailSchema,
-  phone: phoneSchema.optional(),
-  website: urlSchema.optional(),
-  bio: z.string().max(500).optional()
-});
-var contactFormSchema = z.object({
-  name: nameSchema,
-  email: emailSchema,
-  message: z.string().min(1, "Message is required").max(1e3, "Message must be less than 1000 characters")
-});
-function pickSchema(schema, keys) {
-  const shape = Object.entries(schema.shape).filter(([key]) => keys.includes(key)).reduce((acc, [key, value]) => {
-    acc[key] = value;
-    return acc;
-  }, {});
-  return z.object(shape);
-}
-function combineSchemas(schemas) {
-  return schemas.reduce(
-    (merged, schema) => merged.merge(schema),
-    z.object({})
-  );
-}
-
-export {
-  emailSchema,
-  nameSchema,
-  phoneSchema,
-  urlSchema,
-  dateSchema,
-  passwordSchema,
-  securePasswordSchema,
-  loginSchema,
-  registrationSchema,
-  secureLoginSchema,
-  passwordResetSchema,
-  changePasswordSchema,
-  userProfileSchema,
-  contactFormSchema,
-  pickSchema,
-  combineSchemas
-};
-//# sourceMappingURL=chunk-24MKLB7U.js.map

package/dist/chunk-24MKLB7U.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types/validation.ts"],"sourcesContent":["/**\n * @file Validation Types\n * @package @jmruthers/pace-core\n * @module Types/Validation\n * @since 0.1.0\n * \n * Consolidated validation types and interfaces for the PACE Core library.\n * This file contains all validation-related type definitions.\n */\n\nimport { z } from 'zod';\n\n// ============================================================================\n// Core Validation Interfaces\n// ============================================================================\n\nexport interface ValidationError {\n  field: string;\n  message: string;\n  code: string;\n}\n\nexport interface ValidationResult<T = unknown> {\n  success: boolean;\n  data?: T;\n  errors?: ValidationError[];\n}\n\n// ============================================================================\n// Form Value Types\n// ============================================================================\n\n// Basic form schemas\nexport const emailSchema = z.string().email('Please enter a valid email address');\nexport const nameSchema = z.string().min(1, 'Name is required').max(100, 'Name must be less than 100 characters');\nexport const phoneSchema = z.string().regex(/^\\+?[\\d\\s\\-\\(\\)]+$/, 'Please enter a valid phone number');\nexport const urlSchema = z.string().url('Please enter a valid URL');\nexport const dateSchema = z.string().refine((date) => !isNaN(Date.parse(date)), 'Please enter a valid date');\n\n// Password schemas\nexport const passwordSchema = z.string()\n  .min(8, 'Password must be at least 8 characters')\n  .regex(/[A-Z]/, 'Password must contain at least one uppercase letter')\n  .regex(/[a-z]/, 'Password must contain at least one lowercase letter')\n  .regex(/[0-9]/, 'Password must contain at least one number');\n\nexport const securePasswordSchema = passwordSchema\n  .regex(/[!@#$%^&*(),.?\":{}|<>]/, 'Password must contain at least one special character');\n\n// Auth schemas\nexport const loginSchema = z.object({\n  email: emailSchema,\n  password: z.string().min(1, 'Password is required'),\n});\n\nexport const registrationSchema = z.object({\n  email: emailSchema,\n  password: passwordSchema,\n  confirmPassword: z.string(),\n}).refine((data) => data.password === data.confirmPassword, {\n  message: \"Passwords don't match\",\n  path: [\"confirmPassword\"],\n});\n\nexport const secureLoginSchema = z.object({\n  email: emailSchema,\n  password: securePasswordSchema,\n});\n\nexport const passwordResetSchema = z.object({\n  email: emailSchema,\n});\n\nexport const changePasswordSchema = z.object({\n  currentPassword: z.string().min(1, 'Current password is required'),\n  newPassword: securePasswordSchema,\n  confirmPassword: z.string(),\n}).refine((data) => data.newPassword === data.confirmPassword, {\n  message: \"Passwords don't match\",\n  path: ['confirmPassword'],\n});\n\n// User schemas\nexport const userProfileSchema = z.object({\n  name: nameSchema,\n  email: emailSchema,\n  phone: phoneSchema.optional(),\n  website: urlSchema.optional(),\n  bio: z.string().max(500).optional(),\n});\n\n// Contact form schema\nexport const contactFormSchema = z.object({\n  name: nameSchema,\n  email: emailSchema,\n  message: z.string().min(1, 'Message is required').max(1000, 'Message must be less than 1000 characters'),\n});\n\n// ============================================================================\n// Inferred Types\n// ============================================================================\n\nexport type LoginFormValues = z.infer<typeof loginSchema>;\nexport type RegistrationFormValues = z.infer<typeof registrationSchema>;\nexport type PasswordResetFormValues = z.infer<typeof passwordResetSchema>;\nexport type ChangePasswordFormValues = z.infer<typeof changePasswordSchema>;\nexport type UserProfileFormValues = z.infer<typeof userProfileSchema>;\n\n// Secure form types (with CSRF protection)\nexport type SecureLoginFormValues = {\n  email: string;\n  password: string;\n  csrfToken?: string;\n};\n\nexport type SecureRegistrationFormValues = {\n  email: string;\n  password: string;\n  confirmPassword: string;\n  csrfToken?: string;\n};\n\nexport type SecurePasswordResetFormValues = {\n  email: string;\n  csrfToken?: string;\n};\n\n// ============================================================================\n// Utility Types\n// ============================================================================\n\nexport type FormData = LoginFormData | RegistrationFormData | ProfileFormData | ContactFormData;\n\nexport type LoginFormData = z.infer<typeof loginSchema>;\nexport type RegistrationFormData = z.infer<typeof registrationSchema>;\nexport type ProfileFormData = z.infer<typeof userProfileSchema>;\nexport type ContactFormData = z.infer<typeof contactFormSchema>;\n\n// ============================================================================\n// Schema Utility Functions\n// ============================================================================\n\nexport function pickSchema<T extends z.ZodObject<any, any, any>, K extends keyof z.infer<T>>(\n  schema: T,\n  keys: K[]\n): z.ZodObject<Pick<z.infer<T>, K>> {\n  const shape = Object.entries(schema.shape)\n    .filter(([key]) => keys.includes(key as K))\n    .reduce((acc, [key, value]) => {\n      (acc as Record<string, unknown>)[key] = value as unknown;\n      return acc;\n    }, {} as Record<string, unknown>);\n\n  return z.object(shape as Record<string, z.ZodTypeAny>) as z.ZodObject<Pick<z.infer<T>, K>>;\n}\n\nexport function combineSchemas<T extends z.ZodObject<any, any, any>[]>(\n  schemas: T\n): z.ZodObject<any, any, any> {\n  return schemas.reduce(\n    (merged, schema) => merged.merge(schema),\n    z.object({})\n  );\n}\n"],"mappings":";AAUA,SAAS,SAAS;AAuBX,IAAM,cAAc,EAAE,OAAO,EAAE,MAAM,oCAAoC;AACzE,IAAM,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,kBAAkB,EAAE,IAAI,KAAK,uCAAuC;AACzG,IAAM,cAAc,EAAE,OAAO,EAAE,MAAM,sBAAsB,mCAAmC;AAC9F,IAAM,YAAY,EAAE,OAAO,EAAE,IAAI,0BAA0B;AAC3D,IAAM,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,2BAA2B;AAGpG,IAAM,iBAAiB,EAAE,OAAO,EACpC,IAAI,GAAG,wCAAwC,EAC/C,MAAM,SAAS,qDAAqD,EACpE,MAAM,SAAS,qDAAqD,EACpE,MAAM,SAAS,2CAA2C;AAEtD,IAAM,uBAAuB,eACjC,MAAM,0BAA0B,sDAAsD;AAGlF,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,OAAO;AAAA,EACP,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,sBAAsB;AACpD,CAAC;AAEM,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,OAAO;AAAA,EACP,UAAU;AAAA,EACV,iBAAiB,EAAE,OAAO;AAC5B,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,aAAa,KAAK,iBAAiB;AAAA,EAC1D,SAAS;AAAA,EACT,MAAM,CAAC,iBAAiB;AAC1B,CAAC;AAEM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO;AAAA,EACP,UAAU;AACZ,CAAC;AAEM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,OAAO;AACT,CAAC;AAEM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,iBAAiB,EAAE,OAAO,EAAE,IAAI,GAAG,8BAA8B;AAAA,EACjE,aAAa;AAAA,EACb,iBAAiB,EAAE,OAAO;AAC5B,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,gBAAgB,KAAK,iBAAiB;AAAA,EAC7D,SAAS;AAAA,EACT,MAAM,CAAC,iBAAiB;AAC1B,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,OAAO,YAAY,SAAS;AAAA,EAC5B,SAAS,UAAU,SAAS;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AACpC,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB,EAAE,IAAI,KAAM,2CAA2C;AACzG,CAAC;AA8CM,SAAS,WACd,QACA,MACkC;AAClC,QAAM,QAAQ,OAAO,QAAQ,OAAO,KAAK,EACtC,OAAO,CAAC,CAAC,GAAG,MAAM,KAAK,SAAS,GAAQ,CAAC,EACzC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AAC7B,IAAC,IAAgC,GAAG,IAAI;AACxC,WAAO;AAAA,EACT,GAAG,CAAC,CAA4B;AAElC,SAAO,EAAE,OAAO,KAAqC;AACvD;AAEO,SAAS,eACd,SAC4B;AAC5B,SAAO,QAAQ;AAAA,IACb,CAAC,QAAQ,WAAW,OAAO,MAAM,MAAM;AAAA,IACvC,EAAE,OAAO,CAAC,CAAC;AAAA,EACb;AACF;","names":[]}