@lastshotlabs/bunshot 0.0.25 → 0.0.27

package/dist/lib/saml.js

@@ -0,0 +1,64 @@
+let _sp = null;
+let _idp = null;
+export async function initSaml(config) {
+    const samlify = await import("samlify");
+    _sp = samlify.ServiceProvider({
+        entityID: config.entityId,
+        assertionConsumerService: [{
+                Binding: samlify.Constants.BindingNamespace.Post,
+                Location: config.acsUrl,
+            }],
+        signingCert: config.signingCert,
+        privateKey: config.signingKey,
+        allowCreate: true,
+    });
+    // Load IdP metadata
+    if (config.idpMetadata.startsWith("http")) {
+        // URL — fetch it
+        const res = await fetch(config.idpMetadata);
+        const xml = await res.text();
+        _idp = samlify.IdentityProvider({ metadata: xml });
+    }
+    else {
+        // XML string
+        _idp = samlify.IdentityProvider({ metadata: config.idpMetadata });
+    }
+}
+export function createAuthnRequest() {
+    if (!_sp || !_idp)
+        throw new Error("SAML not initialized");
+    const { context, entityEndpoint } = _sp.createLoginRequest(_idp, "redirect");
+    return { redirectUrl: entityEndpoint + "?" + context, id: context };
+}
+export async function validateSamlResponse(body, config) {
+    if (!_sp || !_idp)
+        throw new Error("SAML not initialized");
+    const { extract } = await _sp.parseLoginResponse(_idp, "post", { body: { SAMLResponse: body } });
+    const mapping = config.attributeMapping ?? {};
+    const attrs = extract.attributes ?? {};
+    const emailKey = mapping.email ?? "email";
+    const firstNameKey = mapping.firstName ?? "firstName";
+    const lastNameKey = mapping.lastName ?? "lastName";
+    const groupsKey = mapping.groups ?? "groups";
+    const nameId = extract.nameID;
+    const email = attrs[emailKey] ?? nameId;
+    const firstName = attrs[firstNameKey];
+    const lastName = attrs[lastNameKey];
+    const displayName = firstName && lastName ? `${firstName} ${lastName}` : undefined;
+    const rawGroups = attrs[groupsKey];
+    const groups = rawGroups ? (Array.isArray(rawGroups) ? rawGroups : [rawGroups]) : undefined;
+    return { nameId, email, firstName, lastName, displayName, groups, attributes: attrs };
+}
+export function samlProfileToIdentityProfile(profile) {
+    return {
+        email: profile.email,
+        displayName: profile.displayName,
+        firstName: profile.firstName,
+        lastName: profile.lastName,
+    };
+}
+export function getSamlSpMetadata() {
+    if (!_sp)
+        throw new Error("SAML not initialized");
+    return _sp.getMetadata();
+}

package/dist/lib/scim.d.ts

@@ -0,0 +1,44 @@
+import type { UserRecord } from "./authAdapter";
+export interface ScimUser {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"];
+    id: string;
+    externalId?: string;
+    userName: string;
+    displayName?: string;
+    name?: {
+        givenName?: string;
+        familyName?: string;
+        formatted?: string;
+    };
+    emails?: Array<{
+        value: string;
+        primary: boolean;
+    }>;
+    active: boolean;
+    meta: {
+        resourceType: "User";
+        created?: string;
+        lastModified?: string;
+    };
+}
+export interface ScimListResponse {
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"];
+    totalResults: number;
+    startIndex: number;
+    itemsPerPage: number;
+    Resources: ScimUser[];
+}
+export interface ScimError {
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"];
+    status: string;
+    detail: string;
+}
+export declare function userRecordToScim(user: UserRecord, config?: {
+    userName?: "email" | "username";
+}): ScimUser;
+/**
+ * Parse a simple SCIM filter string into a UserQuery object.
+ * Supports: userName eq "val", email eq "val", externalId eq "val", active eq true/false
+ */
+export declare function parseScimFilter(filter?: string): import("./authAdapter").UserQuery;
+export declare function scimError(status: number, detail: string): Response;

package/dist/lib/scim.js

@@ -0,0 +1,54 @@
+export function userRecordToScim(user, config) {
+    const userName = user.email ?? user.id;
+    return {
+        schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
+        id: user.id,
+        externalId: user.externalId,
+        userName,
+        displayName: user.displayName,
+        name: (user.firstName || user.lastName) ? {
+            givenName: user.firstName,
+            familyName: user.lastName,
+            formatted: [user.firstName, user.lastName].filter(Boolean).join(" ") || undefined,
+        } : undefined,
+        emails: user.email ? [{ value: user.email, primary: true }] : undefined,
+        active: !user.suspended,
+        meta: { resourceType: "User" },
+    };
+}
+/**
+ * Parse a simple SCIM filter string into a UserQuery object.
+ * Supports: userName eq "val", email eq "val", externalId eq "val", active eq true/false
+ */
+export function parseScimFilter(filter) {
+    if (!filter)
+        return {};
+    const query = {};
+    // Simple single-clause filter: `attr op "value"`
+    const match = filter.trim().match(/^(\w+)\s+eq\s+"?([^"]*)"?$/i);
+    if (!match)
+        return {};
+    const [, attr, value] = match;
+    const attrLower = attr.toLowerCase();
+    if (attrLower === "username" || attrLower === "email") {
+        query.email = value;
+    }
+    else if (attrLower === "externalid") {
+        query.externalId = value;
+    }
+    else if (attrLower === "active") {
+        query.suspended = value.toLowerCase() !== "true"; // active=true means suspended=false
+    }
+    return query;
+}
+export function scimError(status, detail) {
+    const body = {
+        schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+        status: String(status),
+        detail,
+    };
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "Content-Type": "application/scim+json" },
+    });
+}

package/dist/lib/securityEvents.d.ts

@@ -0,0 +1,28 @@
+export type SecurityEventType = "auth.login.success" | "auth.login.failure" | "auth.login.blocked" | "auth.register.success" | "auth.register.failure" | "auth.logout" | "auth.password.reset" | "auth.password.change" | "auth.mfa.setup" | "auth.mfa.verify.success" | "auth.mfa.verify.failure" | "auth.step_up.success" | "auth.step_up.failure" | "auth.session.created" | "auth.session.revoked" | "auth.account.suspended" | "auth.account.deleted" | "auth.oauth.link" | "auth.oauth.unlink" | "security.rate_limit.exceeded" | "security.credential_stuffing.detected" | "security.captcha.failed" | "security.csrf.failed" | "security.breached_password.detected" | "admin.role.changed" | "admin.user.modified";
+export interface SecurityEvent {
+    eventType: SecurityEventType;
+    severity: "info" | "warn" | "critical";
+    timestamp: string;
+    requestId?: string;
+    userId?: string;
+    sessionId?: string;
+    tenantId?: string;
+    ip?: string;
+    userAgent?: string;
+    meta?: Record<string, unknown>;
+}
+export interface SecurityEventConfig {
+    /** Called for each security event. Non-blocking — errors are swallowed. */
+    onEvent: (event: SecurityEvent) => void | Promise<void>;
+    /** Only emit events of these types. If omitted, all events are emitted. */
+    include?: SecurityEventType[];
+    /** Skip events of these types. Applied after include. */
+    exclude?: SecurityEventType[];
+}
+export declare function setSecurityEventConfig(config: SecurityEventConfig | null): void;
+export declare function getSecurityEventConfig(): SecurityEventConfig | null;
+/**
+ * Emit a security event. Non-blocking — the call returns immediately.
+ * If onEvent throws, the error is silently swallowed (never propagates to the caller).
+ */
+export declare function emitSecurityEvent(event: SecurityEvent): void;

package/dist/lib/securityEvents.js

@@ -0,0 +1,26 @@
+let _config = null;
+export function setSecurityEventConfig(config) {
+    _config = config;
+}
+export function getSecurityEventConfig() {
+    return _config;
+}
+/**
+ * Emit a security event. Non-blocking — the call returns immediately.
+ * If onEvent throws, the error is silently swallowed (never propagates to the caller).
+ */
+export function emitSecurityEvent(event) {
+    if (!_config)
+        return;
+    const { onEvent, include, exclude } = _config;
+    if (include && include.length > 0 && !include.includes(event.eventType))
+        return;
+    if (exclude && exclude.includes(event.eventType))
+        return;
+    // Fire and forget — never block the request
+    Promise.resolve()
+        .then(() => onEvent({ ...event, timestamp: event.timestamp ?? new Date().toISOString() }))
+        .catch(() => {
+        // Swallow errors — security event emission must never crash the app
+    });
+}

package/dist/lib/session.d.ts

@@ -36,4 +36,14 @@ export declare const rotateRefreshToken: (sessionId: string, newRefreshToken: st
 export declare const getSessionFingerprint: (sessionId: string) => Promise<string | null>;
 /** Store a fingerprint on an existing session. No-op if the session does not exist. */
 export declare const setSessionFingerprint: (sessionId: string, fingerprint: string) => Promise<void>;
+/**
+ * Store the timestamp when MFA was last verified in the session metadata.
+ * Used by requireStepUp middleware.
+ */
+export declare const setMfaVerifiedAt: (sessionId: string) => Promise<void>;
+/**
+ * Get the Unix timestamp (seconds) when MFA was last verified for this session.
+ * Returns null if MFA has never been verified or session not found.
+ */
+export declare const getMfaVerifiedAt: (sessionId: string) => Promise<number | null>;
 export {};

package/dist/lib/session.js

@@ -1,8 +1,9 @@
 import { getRedis } from "./redis";
 import { appConnection, mongoose } from "./mongo";
 import { getAppName, getPersistSessionMetadata, getIncludeInactiveSessions, getRotationGraceSeconds, getRefreshTokenExpiry } from "./appConfig";
-import { sqliteCreateSession, sqliteGetSession, sqliteDeleteSession, sqliteGetUserSessions, sqliteGetActiveSessionCount, sqliteEvictOldestSession, sqliteUpdateSessionLastActive, sqliteSetRefreshToken, sqliteGetSessionByRefreshToken, sqliteRotateRefreshToken, sqliteGetSessionFingerprint, sqliteSetSessionFingerprint, } from "../adapters/sqliteAuth";
-import { memoryCreateSession, memoryGetSession, memoryDeleteSession, memoryGetUserSessions, memoryGetActiveSessionCount, memoryEvictOldestSession, memoryUpdateSessionLastActive, memorySetRefreshToken, memoryGetSessionByRefreshToken, memoryRotateRefreshToken, memoryGetSessionFingerprint, memorySetSessionFingerprint, } from "../adapters/memoryAuth";
+import { timingSafeEqual } from "./crypto";
+import { sqliteCreateSession, sqliteGetSession, sqliteDeleteSession, sqliteGetUserSessions, sqliteGetActiveSessionCount, sqliteEvictOldestSession, sqliteUpdateSessionLastActive, sqliteSetRefreshToken, sqliteGetSessionByRefreshToken, sqliteRotateRefreshToken, sqliteGetSessionFingerprint, sqliteSetSessionFingerprint, sqliteGetMfaVerifiedAt, sqliteSetMfaVerifiedAt, } from "../adapters/sqliteAuth";
+import { memoryCreateSession, memoryGetSession, memoryDeleteSession, memoryGetUserSessions, memoryGetActiveSessionCount, memoryEvictOldestSession, memoryUpdateSessionLastActive, memorySetRefreshToken, memoryGetSessionByRefreshToken, memoryRotateRefreshToken, memoryGetSessionFingerprint, memorySetSessionFingerprint, memoryGetMfaVerifiedAt, memorySetMfaVerifiedAt, } from "../adapters/memoryAuth";
 function getSessionModel() {
     if (appConnection.models["Session"])
         return appConnection.models["Session"];
@@ -20,6 +21,7 @@ function getSessionModel() {
         prevRefreshToken: { type: String, default: null },
         prevTokenExpiresAt: { type: Date, default: null },
         fingerprint: { type: String, default: null },
+        mfaVerifiedAt: { type: Number, default: null },
     }, { collection: "sessions", timestamps: false });
     sessionSchema.index({ refreshToken: 1 }, { unique: true, partialFilterExpression: { refreshToken: { $type: "string" } } });
     // Add TTL index only when metadata is not persisted — docs auto-delete at expiresAt.
@@ -203,16 +205,16 @@ async function redisGetSessionByRefreshToken(refreshToken) {
         return null;
     const rec = JSON.parse(raw);
     // Current refresh token matches
-    if (rec.refreshToken === refreshToken) {
+    if (timingSafeEqual(rec.refreshToken ?? "", refreshToken)) {
         return { sessionId: rec.sessionId, userId: rec.userId, newRefreshToken: refreshToken };
     }
     // Check grace window: old token used within grace period
-    if (rec.prevRefreshToken === refreshToken && rec.prevTokenExpiresAt && rec.prevTokenExpiresAt > Date.now()) {
+    if (timingSafeEqual(rec.prevRefreshToken ?? "", refreshToken) && rec.prevTokenExpiresAt && rec.prevTokenExpiresAt > Date.now()) {
         // Return current refresh token — client missed the rotation response
         return { sessionId: rec.sessionId, userId: rec.userId, newRefreshToken: rec.refreshToken };
     }
     // Old token used after grace window — token family theft detected, invalidate session
-    if (rec.prevRefreshToken === refreshToken) {
+    if (timingSafeEqual(rec.prevRefreshToken ?? "", refreshToken)) {
         await redisDeleteSession(sessionId);
         return null;
     }
@@ -533,3 +535,63 @@ export const setSessionFingerprint = async (sessionId, fingerprint) => {
     // mongo
     await getSessionModel().updateOne({ sessionId }, { $set: { fingerprint } });
 };
+// ---------------------------------------------------------------------------
+// Step-up MFA API (mfaVerifiedAt)
+// ---------------------------------------------------------------------------
+/**
+ * Store the timestamp when MFA was last verified in the session metadata.
+ * Used by requireStepUp middleware.
+ */
+export const setMfaVerifiedAt = async (sessionId) => {
+    const now = Math.floor(Date.now() / 1000);
+    if (_store === "memory") {
+        memorySetMfaVerifiedAt(sessionId, now);
+        return;
+    }
+    if (_store === "sqlite") {
+        sqliteSetMfaVerifiedAt(sessionId, now);
+        return;
+    }
+    if (_store === "redis") {
+        const redis = getRedis();
+        const raw = await redis.get(redisSessionKey(sessionId));
+        if (!raw)
+            return;
+        const rec = JSON.parse(raw);
+        rec.mfaVerifiedAt = now;
+        if (getPersistSessionMetadata()) {
+            await redis.set(redisSessionKey(sessionId), JSON.stringify(rec));
+        }
+        else {
+            const nowMs = Date.now();
+            if (rec.expiresAt <= nowMs)
+                return;
+            const ttlRemaining = Math.max(1, Math.ceil((rec.expiresAt - nowMs) / 1000));
+            await redis.set(redisSessionKey(sessionId), JSON.stringify(rec), "EX", ttlRemaining);
+        }
+        return;
+    }
+    // mongo
+    await getSessionModel().updateOne({ sessionId }, { $set: { mfaVerifiedAt: now } });
+};
+/**
+ * Get the Unix timestamp (seconds) when MFA was last verified for this session.
+ * Returns null if MFA has never been verified or session not found.
+ */
+export const getMfaVerifiedAt = async (sessionId) => {
+    if (_store === "memory")
+        return memoryGetMfaVerifiedAt(sessionId);
+    if (_store === "sqlite")
+        return sqliteGetMfaVerifiedAt(sessionId);
+    if (_store === "redis") {
+        const redis = getRedis();
+        const raw = await redis.get(redisSessionKey(sessionId));
+        if (!raw)
+            return null;
+        const rec = JSON.parse(raw);
+        return rec.mfaVerifiedAt ?? null;
+    }
+    // mongo
+    const doc = await getSessionModel().findOne({ sessionId }, "mfaVerifiedAt").lean();
+    return doc?.mfaVerifiedAt ?? null;
+};

package/dist/lib/signing.js

@@ -33,7 +33,10 @@ export function hmacVerify(data, sig, secret) {
                 return true;
         }
         catch {
-            // timingSafeEqual can throw on length mismatch with multi-byte chars
+            // timingSafeEqual (src/lib/crypto.ts) handles length mismatches itself:
+            // it returns false rather than throwing, so this catch block is never
+            // reached under normal conditions. It is kept as a defensive no-op in
+            // case the underlying implementation changes in the future.
         }
     }
     return false;
@@ -163,7 +166,7 @@ export function verifyPresignedUrl(url, method, secret) {
         return null;
     // Expiry check
     const expNum = parseInt(exp, 10);
-    if (isNaN(expNum) || expNum < Math.floor(Date.now() / 1000))
+    if (!isFinite(expNum) || expNum < Math.floor(Date.now() / 1000))
         return null;
     // Signature check
     const data = `${urlMethod}\n${key}\n${exp}`;

package/dist/lib/suspension.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Suspend or unsuspend a user.
+ * No-op when the adapter does not implement setSuspended.
+ */
+export declare function setSuspended(userId: string, suspended: boolean, reason?: string): Promise<void>;
+/**
+ * Get the suspension status of a user.
+ * Returns { suspended: false } when the adapter does not implement getSuspended.
+ */
+export declare function getSuspended(userId: string): Promise<{
+    suspended: boolean;
+    suspendedReason?: string;
+}>;

package/dist/lib/suspension.js

@@ -0,0 +1,23 @@
+import { getAuthAdapter } from "./authAdapter";
+/**
+ * Suspend or unsuspend a user.
+ * No-op when the adapter does not implement setSuspended.
+ */
+export async function setSuspended(userId, suspended, reason) {
+    const adapter = getAuthAdapter();
+    if (adapter.setSuspended) {
+        await adapter.setSuspended(userId, suspended, reason);
+    }
+}
+/**
+ * Get the suspension status of a user.
+ * Returns { suspended: false } when the adapter does not implement getSuspended.
+ */
+export async function getSuspended(userId) {
+    const adapter = getAuthAdapter();
+    if (adapter.getSuspended) {
+        const result = await adapter.getSuspended(userId);
+        return result ?? { suspended: false };
+    }
+    return { suspended: false };
+}

package/dist/lib/upload.d.ts

@@ -21,6 +21,10 @@ export declare const generateUploadKey: (file: File, ctx: {
     userId?: string;
     tenantId?: string;
 }, opts?: UploadOpts) => string;
+export declare const generateUploadKeyFromFilename: (filename: string | undefined, ctx: {
+    userId?: string;
+    tenantId?: string;
+}, opts?: UploadOpts) => string;
 export declare const validateFile: (file: File, opts: {
     maxFileSize?: number;
     allowedMimeTypes?: string[];

package/dist/lib/upload.js

@@ -10,7 +10,22 @@ export const generateUploadKey = (file, ctx, opts) => {
     const merged = { ..._config, ...opts };
     if (merged.generateKey)
         return merged.generateKey(file, ctx);
-    const ext = extname(file.name);
+    const rawExt = extname(file.name);
+    const ext = /^\.[a-zA-Z0-9]{1,10}$/.test(rawExt) ? rawExt : "";
+    const uuid = crypto.randomUUID();
+    const prefix = merged.keyPrefix ?? "uploads/";
+    const tenantPrefix = merged.tenantScopedKeys && ctx.tenantId ? `${ctx.tenantId}/` : "";
+    return `${prefix}${tenantPrefix}${uuid}${ext}`;
+};
+export const generateUploadKeyFromFilename = (filename, ctx, opts) => {
+    const merged = { ..._config, ...opts };
+    if (merged.generateKey) {
+        // Create minimal File-like for custom generators that expect a File object
+        const stub = new File([], filename ?? "upload");
+        return merged.generateKey(stub, ctx);
+    }
+    const rawExt = filename ? extname(filename) : "";
+    const ext = /^\.[a-zA-Z0-9]{1,10}$/.test(rawExt) ? rawExt : "";
     const uuid = crypto.randomUUID();
     const prefix = merged.keyPrefix ?? "uploads/";
     const tenantPrefix = merged.tenantScopedKeys && ctx.tenantId ? `${ctx.tenantId}/` : "";
@@ -49,6 +64,16 @@ export const processUpload = async (file, opts) => {
         size: file.size,
         bucket: opts.bucket,
     });
+    // Register the upload for ownership tracking
+    const { registerUpload } = await import("./uploadRegistry");
+    await registerUpload({
+        key,
+        ownerUserId: opts.ctx?.userId,
+        tenantId: opts.ctx?.tenantId,
+        mimeType: file.type,
+        bucket: opts.bucket,
+        createdAt: Date.now(),
+    });
     return {
         key,
         originalName: file.name,

package/dist/lib/uploadRegistry.d.ts

@@ -0,0 +1,18 @@
+export interface UploadRecord {
+    key: string;
+    ownerUserId?: string;
+    tenantId?: string;
+    mimeType?: string;
+    bucket?: string;
+    createdAt: number;
+}
+type UploadRegistryStore = "redis" | "mongo" | "sqlite" | "memory";
+export declare const setUploadRegistryStore: (store: UploadRegistryStore) => void;
+export declare const clearUploadRegistry: () => void;
+/** Store a new upload record. Keyed by the storage key. */
+export declare const registerUpload: (record: UploadRecord) => Promise<void>;
+/** Retrieve an upload record by key. Returns null if not found. */
+export declare const getUploadRecord: (key: string) => Promise<UploadRecord | null>;
+/** Delete an upload record by key. Returns true if it existed. */
+export declare const deleteUploadRecord: (key: string) => Promise<boolean>;
+export {};

package/dist/lib/uploadRegistry.js

@@ -0,0 +1,83 @@
+import { getRedis } from "./redis";
+import { appConnection, mongoose } from "./mongo";
+import { getAppName } from "./appConfig";
+let _store = "memory";
+export const setUploadRegistryStore = (store) => { _store = store; };
+// ---------------------------------------------------------------------------
+// Memory backend
+// ---------------------------------------------------------------------------
+const _memoryRegistry = new Map();
+export const clearUploadRegistry = () => { _memoryRegistry.clear(); };
+function getUploadRegistryModel() {
+    if (appConnection.models["UploadRegistry"])
+        return appConnection.models["UploadRegistry"];
+    const { Schema } = mongoose;
+    const schema = new Schema({
+        key: { type: String, required: true, unique: true },
+        ownerUserId: { type: String },
+        tenantId: { type: String },
+        mimeType: { type: String },
+        bucket: { type: String },
+        createdAt: { type: Number, required: true },
+    }, { collection: "upload_registry" });
+    return appConnection.model("UploadRegistry", schema);
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/** Store a new upload record. Keyed by the storage key. */
+export const registerUpload = async (record) => {
+    if (_store === "memory") {
+        _memoryRegistry.set(record.key, record);
+        return;
+    }
+    if (_store === "sqlite") {
+        const { sqliteRegisterUpload } = await import("../adapters/sqliteAuth");
+        sqliteRegisterUpload(record);
+        return;
+    }
+    if (_store === "mongo") {
+        await getUploadRegistryModel().updateOne({ key: record.key }, { $set: record }, { upsert: true });
+        return;
+    }
+    // Redis — no TTL (upload records are permanent until deleted)
+    await getRedis().set(`ur:${getAppName()}:${record.key}`, JSON.stringify(record));
+};
+/** Retrieve an upload record by key. Returns null if not found. */
+export const getUploadRecord = async (key) => {
+    if (_store === "memory") {
+        return _memoryRegistry.get(key) ?? null;
+    }
+    if (_store === "sqlite") {
+        const { sqliteGetUploadRecord } = await import("../adapters/sqliteAuth");
+        return sqliteGetUploadRecord(key);
+    }
+    if (_store === "mongo") {
+        const doc = await getUploadRegistryModel().findOne({ key }).lean();
+        if (!doc)
+            return null;
+        return { key: doc.key, ownerUserId: doc.ownerUserId, tenantId: doc.tenantId, mimeType: doc.mimeType, bucket: doc.bucket, createdAt: doc.createdAt };
+    }
+    // Redis
+    const raw = await getRedis().get(`ur:${getAppName()}:${key}`);
+    if (!raw)
+        return null;
+    return JSON.parse(raw);
+};
+/** Delete an upload record by key. Returns true if it existed. */
+export const deleteUploadRecord = async (key) => {
+    if (_store === "memory") {
+        return _memoryRegistry.delete(key);
+    }
+    if (_store === "sqlite") {
+        const { sqliteDeleteUploadRecord } = await import("../adapters/sqliteAuth");
+        return sqliteDeleteUploadRecord(key);
+    }
+    if (_store === "mongo") {
+        const result = await getUploadRegistryModel().deleteOne({ key });
+        return result.deletedCount > 0;
+    }
+    // Redis
+    const deleted = await getRedis().del(`ur:${getAppName()}:${key}`);
+    return deleted > 0;
+};

package/dist/lib/ws.js

@@ -15,6 +15,9 @@ export const getRooms = () => [..._roomRegistry.keys()];
 /** Socket IDs subscribed to a given room */
 export const getRoomSubscribers = (room) => [...(_roomRegistry.get(room) ?? [])];
 const MAX_ROOM_ACTION_SIZE = 4096; // 4 KB — room actions are small JSON payloads
+function isValidRoomName(room) {
+    return typeof room === "string" && /^[a-zA-Z0-9_:./\-]{1,128}$/.test(room);
+}
 export const handleRoomActions = async (ws, message, onSubscribe) => {
     try {
         const raw = typeof message === "string" ? message : Buffer.from(message).toString();
@@ -22,6 +25,8 @@ export const handleRoomActions = async (ws, message, onSubscribe) => {
             return false; // not a room action
         const data = JSON.parse(raw);
         if (data.action === "subscribe" && typeof data.room === "string") {
+            if (!isValidRoomName(data.room))
+                return true; // silently drop invalid room names
             if (onSubscribe && !(await onSubscribe(ws, data.room))) {
                 ws.send(JSON.stringify({ event: "subscribe_denied", room: data.room }));
             }
@@ -32,6 +37,8 @@ export const handleRoomActions = async (ws, message, onSubscribe) => {
             return true;
         }
         if (data.action === "unsubscribe" && typeof data.room === "string") {
+            if (!isValidRoomName(data.room))
+                return true; // silently drop invalid room names
             unsubscribe(ws, data.room);
             ws.send(JSON.stringify({ event: "unsubscribed", room: data.room }));
             return true;

package/dist/middleware/bearerAuth.js

@@ -1,7 +1,7 @@
 import { timingSafeEqual } from "../lib/crypto";
 export const bearerAuth = async (c, next) => {
     const isProd = process.env.NODE_ENV === "production";
-    const validToken = isProd ? process.env.BEARER_TOKEN_PROD : process.env.BEARER_TOKEN_DEV;
+    const validToken = (isProd ? process.env.BEARER_TOKEN_PROD : process.env.BEARER_TOKEN_DEV) ?? undefined;
     const header = c.req.header("Authorization");
     const token = header?.startsWith("Bearer ") ? header.slice(7) : null;
     if (!token || !validToken || !timingSafeEqual(token, validToken)) {

package/dist/middleware/captcha.d.ts

@@ -0,0 +1,10 @@
+import type { MiddlewareHandler } from "hono";
+import type { AppEnv } from "../lib/context";
+import { type CaptchaConfig } from "../lib/captcha";
+/**
+ * Middleware factory that verifies a CAPTCHA token from the request body.
+ *
+ * @example
+ * router.post("/contact", requireCaptcha({ provider: "turnstile", secretKey: "..." }), handler);
+ */
+export declare const requireCaptcha: (config?: CaptchaConfig) => MiddlewareHandler<AppEnv>;

package/dist/middleware/captcha.js

@@ -0,0 +1,36 @@
+import { verifyCaptcha } from "../lib/captcha";
+import { HttpError } from "../lib/HttpError";
+import { getClientIp } from "../lib/clientIp";
+/**
+ * Middleware factory that verifies a CAPTCHA token from the request body.
+ *
+ * @example
+ * router.post("/contact", requireCaptcha({ provider: "turnstile", secretKey: "..." }), handler);
+ */
+export const requireCaptcha = (config) => async (c, next) => {
+    // Get effective config: param takes precedence, then global config
+    const { getCaptchaConfig } = await import("../lib/appConfig");
+    const effectiveConfig = config ?? getCaptchaConfig();
+    if (!effectiveConfig) {
+        await next();
+        return;
+    }
+    const tokenField = effectiveConfig.tokenField ?? "captcha-token";
+    let body;
+    try {
+        body = await c.req.json();
+    }
+    catch {
+        body = {};
+    }
+    const token = body[tokenField];
+    if (!token) {
+        throw new HttpError(400, "CAPTCHA token is required", "CAPTCHA_MISSING");
+    }
+    const ip = getClientIp(c) ?? undefined;
+    const result = await verifyCaptcha(token, effectiveConfig, ip);
+    if (!result.success) {
+        throw new HttpError(400, "CAPTCHA verification failed", "CAPTCHA_FAILED");
+    }
+    await next();
+};