@jmruthers/pace-core 0.5.181 → 0.5.183

package/dist/utils.d.ts

@@ -1,13 +1,12 @@
 export { S as SecureDataAccess, a as cn, l as formatCompactNumber, i as formatCurrency, f as formatDate, h as formatDateTime, m as formatFileSize, j as formatNumber, k as formatPercent, e as formatTime, g as getAppConfig, d as getCurrentAppId, s as setAppConfig, u as useSessionTracking } from './formatting-5wETwiGF.js';
 import { SupabaseClient } from '@supabase/supabase-js';
-import { D as Database } from './database-C6jy7EOu.js';
-export { deepMerge, isEmpty, isObject, isStrongPassword, isValidDate, isValidEmail, isValidUrl, isWithinRange, matchesPattern } from './validation.js';
+import { D as Database } from './database.generated-CBmg2950.js';
+export { g as changePasswordSchema, t as combineSchemas, i as contactFormSchema, l as loginSchema, f as passwordResetSchema, q as pickSchema, r as registrationSchema, c as secureLoginSchema, s as securePasswordSchema, h as userProfileSchema } from './validation-643vUDZW.js';
 import { z } from 'zod';
-export { c as combineSchemas, p as pickSchema } from './schema-DTDZQe2u.js';
 export { u as useComponentPerformance } from './useComponentPerformance-DE9l5RkL.js';
 import * as date_fns from 'date-fns';
-import { D as DataTable } from './DataTable-CWAZZcXC.js';
-import './types-Dfz9dmVH.js';
+import { D as DataTable } from './DataTable-Bz8ffqyA.js';
+import './types-_x1f4QBF.js';
 import React__default, { ComponentType } from 'react';
 import 'clsx';
 import 'react/jsx-runtime';
@@ -239,6 +238,119 @@ declare class CachedAppIdResolver {
 }
 declare const cachedAppIdResolver: CachedAppIdResolver;
 
+/**
+ * @file Internal utilities for validation module
+ * @internal This file contains implementation details that should not be used directly
+ */
+/**
+ * Utility functions for validating data in the application
+ */
+/**
+ * Check if a string is a valid email
+ */
+declare function isValidEmail(email: string): boolean;
+/**
+ * Check if a string is empty (either null, undefined, or just whitespace)
+ */
+declare function isEmpty(value: string | null | undefined): boolean;
+/**
+ * Check if a password meets minimum requirements
+ */
+declare function isStrongPassword(password: string): boolean;
+/**
+ * Check if a URL is valid
+ */
+declare function isValidUrl(url: string): boolean;
+/**
+ * Check if a date string is valid
+ */
+declare function isValidDate(dateStr: string): boolean;
+/**
+ * Check if a value is within a range
+ */
+declare function isWithinRange(value: number, min: number, max: number): boolean;
+/**
+ * Check if a value matches a specific pattern
+ */
+declare function matchesPattern(value: string, pattern: RegExp): boolean;
+/**
+ * Utility function to deep merge objects for schema combination
+ * @internal
+ */
+declare function deepMerge<T extends Record<string, unknown>>(target: T, source: Record<string, unknown>): T;
+/**
+ * Type guard to check if a value is a plain object
+ * @internal
+ */
+declare function isObject(item: unknown): item is Record<string, unknown>;
+
+/**
+ * @file HTML Sanitization Utilities
+ * @package @jmruthers/pace-core
+ * @module Utils/Validation/HTMLSanitization
+ * @since 0.4.36
+ *
+ * Utilities for safely rendering HTML content.
+ * Provides sanitization and validation for basic HTML elements.
+ */
+/**
+ * Basic HTML sanitization function using regex-based approach
+ * Removes potentially dangerous elements and attributes while preserving basic formatting
+ * This approach is more reliable in SSR environments and doesn't require DOM manipulation
+ *
+ * @param html - The HTML string to sanitize
+ * @returns Sanitized HTML string safe for rendering
+ *
+ * @example
+ * ```tsx
+ * const safeHtml = sanitizeHtml('<p>Hello <strong>world</strong>!</p>');
+ * // Returns: '<p>Hello <strong>world</strong>!</p>'
+ *
+ * const dangerousHtml = sanitizeHtml('<script>alert("xss")</script><p>Safe content</p>');
+ * // Returns: '<p>Safe content</p>'
+ * ```
+ */
+declare function sanitizeHtml(html: string): string;
+/**
+ * Validates if HTML content is safe for rendering
+ *
+ * @param html - The HTML string to validate
+ * @returns Object with validation result and any warnings
+ *
+ * @example
+ * ```tsx
+ * const validation = validateHtml('<p>Safe content</p>');
+ * console.log(validation.isValid); // true
+ * console.log(validation.warnings); // []
+ * ```
+ */
+declare function validateHtml(html: string): {
+    isValid: boolean;
+    warnings: string[];
+};
+/**
+ * Safely renders HTML content with sanitization
+ *
+ * @param html - The HTML string to render
+ * @param options - Rendering options
+ * @returns Object with sanitized HTML and validation info
+ *
+ * @example
+ * ```tsx
+ * const result = renderSafeHtml('<p>Hello <strong>world</strong>!</p>');
+ * console.log(result.html); // Sanitized HTML
+ * console.log(result.isValid); // true
+ * ```
+ */
+declare function renderSafeHtml(html: string, options?: {
+    strict?: boolean;
+    logWarnings?: boolean;
+}): {
+    html: string;
+    isValid: boolean;
+    warnings: string[];
+};
+
 /**
  * @file Input Sanitization Layer
  * @package @jmruthers/pace-core
@@ -313,6 +425,112 @@ declare const phoneSchema: z.ZodString;
  * URL validation schema
  */
 declare const urlSchema: z.ZodString;
+/**
+ * Date validation schema
+ */
+declare const dateSchema: z.ZodEffects<z.ZodString, string, string>;
+
+/**
+ * @file CSRF Protection Implementation
+ * @description Session-based CSRF token management with security enhancements
+ */
+interface CSRFTokenData {
+    token: string;
+    sessionId: string;
+    timestamp: number;
+    used: boolean;
+}
+declare class CSRFManager {
+    private tokenCache;
+    private readonly TOKEN_EXPIRY;
+    private readonly MAX_TOKENS_PER_SESSION;
+    /**
+     * Generate a new CSRF token for the current session
+     */
+    generateToken(sessionId: string): Promise<string>;
+    /**
+     * Validate and consume a CSRF token
+     */
+    validateToken(token: string, sessionId: string): Promise<boolean>;
+    /**
+     * Get current valid token for session
+     */
+    getCurrentToken(sessionId: string): Promise<string | null>;
+    /**
+     * Clean up expired and used tokens
+     */
+    private cleanupExpiredTokens;
+    /**
+     * Persist tokens to secure storage
+     */
+    private persistTokens;
+    /**
+     * Load tokens from secure storage
+     */
+    private loadTokens;
+    /**
+     * Clear all tokens for session
+     */
+    clearSession(sessionId: string): Promise<void>;
+}
+declare const csrfManager: CSRFManager;
+declare function generateCSRFToken(sessionId: string): Promise<string>;
+declare function validateCSRFToken(token: string, sessionId: string): Promise<boolean>;
+declare function getCSRFToken(sessionId: string): Promise<string | null>;
+
+/**
+ * @file SQL Injection Protection
+ * @description Utilities to prevent SQL injection attacks in dynamic queries
+ */
+
+/**
+ * Schema for validating and sanitizing search queries
+ */
+declare const searchQuerySchema: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+/**
+ * Schema for validating table/column names
+ */
+declare const sqlIdentifierSchema: z.ZodEffects<z.ZodString, string, string>;
+/**
+ * Schema for validating order by clauses
+ */
+declare const orderBySchema: z.ZodString;
+/**
+ * Schema for validating limit/offset values
+ */
+declare const limitOffsetSchema: z.ZodNumber;
+/**
+ * Sanitize search query by removing dangerous characters
+ */
+declare function sanitizeSearchQuery(query: string): string;
+/**
+ * Escape special characters for LIKE queries
+ */
+declare function escapeLikeQuery(query: string): string;
+/**
+ * Validate and sanitize a dynamic filter object
+ */
+declare function sanitizeFilters(filters: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Build safe query parameters for Supabase
+ */
+interface SafeQueryParams {
+    select?: string;
+    filters?: Record<string, unknown>;
+    orderBy?: string;
+    limit?: number;
+    offset?: number;
+    search?: string;
+}
+declare function buildSafeQueryParams(params: SafeQueryParams): SafeQueryParams;
+/**
+ * Detect potential SQL injection attempts
+ */
+declare function detectSQLInjection(input: string): {
+    isSuspicious: boolean;
+    patterns: string[];
+    riskLevel: 'low' | 'medium' | 'high' | 'critical';
+};
 
 /**
  * @file Enhanced Password Schema with Security Validations
@@ -323,6 +541,62 @@ declare const urlSchema: z.ZodString;
  * Basic password schema for less strict requirements
  */
 declare const passwordSchema: z.ZodString;
+/**
+ * Password strength calculator
+ */
+declare function calculatePasswordStrength(password: string): {
+    score: number;
+    feedback: string[];
+    level: 'very-weak' | 'weak' | 'fair' | 'good' | 'strong';
+};
+
+/**
+ * Schema for user settings
+ */
+declare const userSettingsSchema: z.ZodObject<{
+    notifications: z.ZodObject<{
+        email: z.ZodBoolean;
+        push: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        push: boolean;
+        email: boolean;
+    }, {
+        push: boolean;
+        email: boolean;
+    }>;
+    language: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    language: string;
+    notifications: {
+        push: boolean;
+        email: boolean;
+    };
+}, {
+    language: string;
+    notifications: {
+        push: boolean;
+        email: boolean;
+    };
+}>;
+/**
+ * Schema for user preferences
+ */
+declare const userPreferencesSchema: z.ZodObject<{
+    displayName: z.ZodString;
+    timezone: z.ZodString;
+    dateFormat: z.ZodString;
+    currency: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    currency: string;
+    timezone: string;
+    displayName: string;
+    dateFormat: string;
+}, {
+    currency: string;
+    timezone: string;
+    displayName: string;
+    dateFormat: string;
+}>;
 
 interface SecurityEvent$1 {
     type: string;
@@ -355,15 +629,27 @@ declare class SecurityMonitor {
 declare const securityMonitor: SecurityMonitor;
 
 /**
- * Performance thresholds and constants
+ * @file Performance Constants
+ * @package @jmruthers/pace-core
+ * @module Constants/Performance
+ * @since 0.1.0
+ *
+ * Performance thresholds and constants used across the application.
+ */
+/**
+ * Performance thresholds for various operations.
+ * These thresholds are used for smoke tests to detect significant regressions.
+ * They are intentionally generous to avoid flakiness in CI/coverage environments.
  */
 declare const PERFORMANCE_THRESHOLDS: {
-    readonly RENDER_TIME: 16;
-    readonly INTERACTION_TIME: 100;
-    readonly ANIMATION_TIME: 300;
-    readonly LOAD_TIME: 1000;
-    readonly MEMORY_USAGE: number;
-    readonly BUNDLE_SIZE: number;
+    /** Render time threshold in milliseconds */
+    readonly RENDER_TIME: 200;
+    /** Permission check time threshold in milliseconds */
+    readonly PERMISSION_CHECK_TIME: 110;
+    /** Memory usage increase threshold in bytes */
+    readonly MEMORY_USAGE_INCREASE: number;
+    /** Maximum acceptable re-render count */
+    readonly RE_RENDER_COUNT: 3;
 };
 
 /**
@@ -645,4 +931,4 @@ declare function getOrganisationContext(supabase: SupabaseClient): Promise<strin
  */
 declare function isOrganisationContextAvailable(supabase: SupabaseClient): Promise<boolean>;
 
-export { CachedAppIdResolver, DebugLogger, LazyDataTable, LogLevel, Logger, type LoggerConfig, PERFORMANCE_BUDGETS, PERFORMANCE_THRESHOLDS, type PerformanceMetrics$1 as PerformanceMetrics, PermissionType, type SecurityEvent$1 as SecurityEvent, auditLog, auditLogger, bundleAnalyzer, cachedAppIdResolver, clearOrganisationContext, createLazyComponent, createLazyUtility, createLogger, createPerformanceBenchmark, emailSchema, generateDeviceFingerprint, getAppId, getAppIds, getAppNameFromBuildTime, getAppNameFromEnvironment, getAppNameFromGlobal, getAppNameFromPackageJson, getCurrentAppName, getCurrentAppNameWithFallback, getOrganisationContext, getSecurityHeaders, hasAllPermissions, hasAnyPermission, hasPermission, isOrganisationContextAvailable, lazyCSVUtils, lazyChartUtils, lazyDateUtils, lazyFormUtils, lazyLodash, loadCSVUtils, loadChartUtils, loadDateUtils, loadFormUtils, loadLodash, logAuditEvent, logAuthEvent, logPermissionEvent, logSecurityEvent, logger, measureRenderPerformance, nameSchema, parsePermission, passwordSchema, performanceBudgetMonitor, phoneSchema, sanitizeFormData, sanitizeUserInput, securityMonitor, setOrganisationContext, setRBACAppName, trackDynamicImport, transformPermissionMapToBoolean, urlSchema, usernameSchema, validateDeviceFingerprint, validateImportPattern, validateSecurityHeaders, validateUserInput };
+export { type CSRFTokenData, CachedAppIdResolver, DebugLogger, LazyDataTable, LogLevel, Logger, type LoggerConfig, PERFORMANCE_BUDGETS, PERFORMANCE_THRESHOLDS, type PerformanceMetrics$1 as PerformanceMetrics, PermissionType, type SafeQueryParams, type SanitizationOptions, type SecurityEvent$1 as SecurityEvent, auditLog, auditLogger, buildSafeQueryParams, bundleAnalyzer, cachedAppIdResolver, calculatePasswordStrength, clearOrganisationContext, createLazyComponent, createLazyUtility, createLogger, createPerformanceBenchmark, csrfManager, dateSchema, deepMerge, detectSQLInjection, emailSchema, escapeLikeQuery, generateCSRFToken, generateDeviceFingerprint, getAppId, getAppIds, getAppNameFromBuildTime, getAppNameFromEnvironment, getAppNameFromGlobal, getAppNameFromPackageJson, getCSRFToken, getCurrentAppName, getCurrentAppNameWithFallback, getOrganisationContext, getSecurityHeaders, hasAllPermissions, hasAnyPermission, hasPermission, isEmpty, isObject, isOrganisationContextAvailable, isStrongPassword, isValidDate, isValidEmail, isValidUrl, isWithinRange, lazyCSVUtils, lazyChartUtils, lazyDateUtils, lazyFormUtils, lazyLodash, limitOffsetSchema, loadCSVUtils, loadChartUtils, loadDateUtils, loadFormUtils, loadLodash, logAuditEvent, logAuthEvent, logPermissionEvent, logSecurityEvent, logger, matchesPattern, measureRenderPerformance, nameSchema, orderBySchema, parsePermission, passwordSchema, performanceBudgetMonitor, phoneSchema, renderSafeHtml, sanitizeFilters, sanitizeFormData, sanitizeHtml, sanitizeSearchQuery, sanitizeUserInput, searchQuerySchema, securityMonitor, setOrganisationContext, setRBACAppName, sqlIdentifierSchema, trackDynamicImport, transformPermissionMapToBoolean, urlSchema, userPreferencesSchema, userSettingsSchema, usernameSchema, validateCSRFToken, validateDeviceFingerprint, validateHtml, validateImportPattern, validateSecurityHeaders, validateUserInput };