@mocoto/mahoraga 0.14.0 → 0.14.1

package/dist/app/github/middleware/crypto.js

@@ -1,104 +0,0 @@
-import crypto from 'node:crypto';
-const ALGORITHM = 'aes-256-gcm';
-const IV_LENGTH = 16;
-const KEY_LENGTH = 32;
-function deriveKey() {
-    const secret = process.env.MAHORAGA_ENCRYPTION_KEY;
-    if (secret && secret.length >= 16) {
-        return crypto.scryptSync(secret, 'mahoraga-salt', KEY_LENGTH);
-    }
-    const fallbackParts = [
-        process.env.MAHORAGA_ADMIN_TOKEN,
-        process.env.GITHUB_WEBHOOK_SECRET,
-        process.env.GITHUB_PRIVATE_KEY?.slice(0, 64),
-        'mahoraga-fallback-key',
-    ].filter(Boolean);
-    const combined = fallbackParts.join(':');
-    return crypto.scryptSync(combined, 'mahoraga-salt', KEY_LENGTH);
-}
-let cachedKey = null;
-function getKey() {
-    if (!cachedKey) {
-        cachedKey = deriveKey();
-    }
-    return cachedKey;
-}
-export function encrypt(text) {
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, getKey(), iv);
-    let encrypted = cipher.update(text, 'utf8', 'base64');
-    encrypted += cipher.final('base64');
-    const authTag = cipher.getAuthTag();
-    return `${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;
-}
-export function decrypt(encrypted) {
-    const parts = encrypted.split(':');
-    if (parts.length !== 3) {
-        throw new Error('Formato de dado criptografado invalido');
-    }
-    const iv = Buffer.from(parts[0], 'base64');
-    const authTag = Buffer.from(parts[1], 'base64');
-    const data = parts[2];
-    const decipher = crypto.createDecipheriv(ALGORITHM, getKey(), iv);
-    decipher.setAuthTag(authTag);
-    let decrypted = decipher.update(data, 'base64', 'utf8');
-    decrypted += decipher.final('utf8');
-    return decrypted;
-}
-export function encryptJson(data) {
-    return encrypt(JSON.stringify(data));
-}
-export function decryptJson(encrypted) {
-    return JSON.parse(decrypt(encrypted));
-}
-export function encryptObject(obj, sensitiveFields) {
-    const result = { ...obj };
-    for (const field of sensitiveFields) {
-        if (result[field] !== undefined && result[field] !== null) {
-            const val = result[field];
-            if (typeof val === 'string') {
-                result[field] = encrypt(val);
-            }
-            else {
-                result[field] = encryptJson(val);
-            }
-        }
-    }
-    return result;
-}
-export function decryptObject(obj, sensitiveFields) {
-    const result = { ...obj };
-    for (const field of sensitiveFields) {
-        const val = result[field];
-        if (typeof val === 'string' && val.includes(':')) {
-            try {
-                result[field] = decrypt(val);
-            }
-            catch {
-                try {
-                    const decrypted = decryptJson(val);
-                    result[field] = decrypted;
-                }
-                catch {
-                }
-            }
-        }
-    }
-    return result;
-}
-export function hashToken(token) {
-    return crypto.createHash('sha256').update(token).digest('hex');
-}
-export function signRequest(payload, secret) {
-    return crypto.createHmac('sha256', secret).update(payload).digest('hex');
-}
-export function verifyRequestSignature(payload, signature, secret) {
-    try {
-        const expected = signRequest(payload, secret);
-        return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
-    }
-    catch {
-        return false;
-    }
-}
-//# sourceMappingURL=crypto.js.map

package/dist/app/github/middleware/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACnD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,aAAa,GAAG;QACpB,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5C,uBAAuB;KACxB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED,IAAI,SAAS,GAAkB,IAAI,CAAC;AAEpC,SAAS,MAAM;IACb,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,SAAS,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAClE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxD,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW,CAAI,IAAO;IACpC,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,WAAW,CAAI,SAAiB;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAM,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAM,EACN,eAA4B;IAE5B,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAe,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,GAAG,CAAe,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAM,EACN,eAA4B;IAE5B,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAK,GAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,GAAa,CAAe,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,WAAW,CAAa,GAAa,CAAC,CAAC;oBACzD,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;gBAET,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import crypto from 'node:crypto';\n\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 16;\nconst KEY_LENGTH = 32;\n\nfunction deriveKey(): Buffer {\n  const secret = process.env.MAHORAGA_ENCRYPTION_KEY;\n  if (secret && secret.length >= 16) {\n    return crypto.scryptSync(secret, 'mahoraga-salt', KEY_LENGTH);\n  }\n  const fallbackParts = [\n    process.env.MAHORAGA_ADMIN_TOKEN,\n    process.env.GITHUB_WEBHOOK_SECRET,\n    process.env.GITHUB_PRIVATE_KEY?.slice(0, 64),\n    'mahoraga-fallback-key',\n  ].filter(Boolean);\n  const combined = fallbackParts.join(':');\n  return crypto.scryptSync(combined, 'mahoraga-salt', KEY_LENGTH);\n}\n\nlet cachedKey: Buffer | null = null;\n\nfunction getKey(): Buffer {\n  if (!cachedKey) {\n    cachedKey = deriveKey();\n  }\n  return cachedKey;\n}\n\nexport function encrypt(text: string): string {\n  const iv = crypto.randomBytes(IV_LENGTH);\n  const cipher = crypto.createCipheriv(ALGORITHM, getKey(), iv);\n  let encrypted = cipher.update(text, 'utf8', 'base64');\n  encrypted += cipher.final('base64');\n  const authTag = cipher.getAuthTag();\n  return `${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;\n}\n\nexport function decrypt(encrypted: string): string {\n  const parts = encrypted.split(':');\n  if (parts.length !== 3) {\n    throw new Error('Formato de dado criptografado invalido');\n  }\n  const iv = Buffer.from(parts[0], 'base64');\n  const authTag = Buffer.from(parts[1], 'base64');\n  const data = parts[2];\n  const decipher = crypto.createDecipheriv(ALGORITHM, getKey(), iv);\n  decipher.setAuthTag(authTag);\n  let decrypted = decipher.update(data, 'base64', 'utf8');\n  decrypted += decipher.final('utf8');\n  return decrypted;\n}\n\nexport function encryptJson<T>(data: T): string {\n  return encrypt(JSON.stringify(data));\n}\n\nexport function decryptJson<T>(encrypted: string): T {\n  return JSON.parse(decrypt(encrypted)) as T;\n}\n\nexport function encryptObject<T extends Record<string, unknown>>(\n  obj: T,\n  sensitiveFields: (keyof T)[]\n): T {\n  const result = { ...obj };\n  for (const field of sensitiveFields) {\n    if (result[field] !== undefined && result[field] !== null) {\n      const val = result[field];\n      if (typeof val === 'string') {\n        result[field] = encrypt(val) as T[keyof T];\n      } else {\n        result[field] = encryptJson(val) as T[keyof T];\n      }\n    }\n  }\n  return result;\n}\n\nexport function decryptObject<T extends Record<string, unknown>>(\n  obj: T,\n  sensitiveFields: (keyof T)[]\n): T {\n  const result = { ...obj };\n  for (const field of sensitiveFields) {\n    const val = result[field];\n    if (typeof val === 'string' && (val as string).includes(':')) {\n      try {\n        result[field] = decrypt(val as string) as T[keyof T];\n      } catch {\n        try {\n          const decrypted = decryptJson<T[keyof T]>(val as string);\n          result[field] = decrypted;\n        } catch {\n          /* assume not encrypted */\n        }\n      }\n    }\n  }\n  return result;\n}\n\nexport function hashToken(token: string): string {\n  return crypto.createHash('sha256').update(token).digest('hex');\n}\n\nexport function signRequest(payload: string, secret: string): string {\n  return crypto.createHmac('sha256', secret).update(payload).digest('hex');\n}\n\nexport function verifyRequestSignature(\n  payload: string,\n  signature: string,\n  secret: string\n): boolean {\n  try {\n    const expected = signRequest(payload, secret);\n    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/app/github/middleware/ddos-protection.d.ts

@@ -1,5 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-declare function getClientIp(req: Request): string;
-export declare function createDdosProtection(): Array<(req: Request, res: Response, next: NextFunction) => void>;
-export { getClientIp };
-//# sourceMappingURL=ddos-protection.d.ts.map

package/dist/app/github/middleware/ddos-protection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ddos-protection.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/ddos-protection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAgB/D,iBAAS,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAKzC;AAsKD,wBAAgB,oBAAoB,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC,CAOvG;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/app/github/middleware/ddos-protection.js

@@ -1,167 +0,0 @@
-import { reportAttack } from './security-store.js';
-const MAX_CONCURRENT_PER_IP = 20;
-const SLOW_BODY_TIMEOUT_MS = 10_000;
-const MAX_HEADER_SIZE = 16_384;
-const MAX_URI_SIZE = 8_192;
-const CLEANUP_INTERVAL_MS = 60_000;
-const DUPLICATE_PATH_WINDOW_MS = 2_000;
-const activeConnections = new Map();
-const duplicatePathTrack = new Map();
-const activeTimers = new Map();
-function getClientIp(req) {
-    return req.headers['x-forwarded-for']?.split(',')[0]?.trim()
-        || req.ip
-        || req.socket.remoteAddress
-        || 'unknown';
-}
-function generateConnectionId() {
-    return Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
-}
-function trackSlowBody(req, res, next) {
-    const ip = getClientIp(req);
-    const timer = setTimeout(() => {
-        if (!res.headersSent) {
-            reportAttack('ddos_slow_body', ip, req.path);
-            res.status(408).json({ erro: 'Request timeout.' });
-        }
-        try {
-            res.end();
-        }
-        catch { }
-    }, SLOW_BODY_TIMEOUT_MS);
-    activeTimers.set(ip, timer);
-    res.on('finish', () => {
-        const existingTimer = activeTimers.get(ip);
-        if (existingTimer) {
-            clearTimeout(existingTimer);
-            activeTimers.delete(ip);
-        }
-        desconectarHandler(req);
-    });
-    res.on('close', () => {
-        const existingTimer = activeTimers.get(ip);
-        if (existingTimer) {
-            clearTimeout(existingTimer);
-            activeTimers.delete(ip);
-        }
-        desconectarHandler(req);
-    });
-    next();
-}
-function connectHandler(req, res, next) {
-    const ip = getClientIp(req);
-    let conns = activeConnections.get(ip);
-    if (!conns) {
-        conns = new Set();
-        activeConnections.set(ip, conns);
-    }
-    if (conns.size >= MAX_CONCURRENT_PER_IP) {
-        reportAttack('ddos_concurrent', ip, req.path);
-        res.status(429).json({ erro: 'Muitas conexoes simultaneas.' });
-        return;
-    }
-    const connId = generateConnectionId();
-    conns.add(connId);
-    res.on('finish', () => { removeConnection(ip, connId); });
-    res.on('close', () => { removeConnection(ip, connId); });
-    next();
-}
-function removeConnection(ip, connId) {
-    const conns = activeConnections.get(ip);
-    if (conns) {
-        conns.delete(connId);
-        if (conns.size === 0) {
-            activeConnections.delete(ip);
-        }
-    }
-}
-function desconectarHandler(req) {
-    const ip = getClientIp(req);
-    const timer = activeTimers.get(ip);
-    if (timer) {
-        clearTimeout(timer);
-        activeTimers.delete(ip);
-    }
-}
-function validateRequestSize(req, res, next) {
-    const uriLength = (req.originalUrl || req.url || '').length;
-    if (uriLength > MAX_URI_SIZE) {
-        reportAttack('ddos_long_uri', getClientIp(req), req.path);
-        res.status(414).json({ erro: 'URI muito longa.' });
-        return;
-    }
-    let totalHeadersSize = 0;
-    if (req.headers) {
-        for (const [key, value] of Object.entries(req.headers)) {
-            const headerStr = `${key}: ${Array.isArray(value) ? value.join(', ') : value}`;
-            totalHeadersSize += Buffer.byteLength(headerStr, 'utf8');
-            if (totalHeadersSize > MAX_HEADER_SIZE) {
-                reportAttack('ddos_large_headers', getClientIp(req), req.path);
-                res.status(431).json({ erro: 'Cabecalhos muito grandes.' });
-                return;
-            }
-        }
-    }
-    next();
-}
-function shouldSkipDdosProtection(path) {
-    return path.startsWith('/_next/static/') || path === '/favicon.ico';
-}
-function detectDuplicatePathFlood(req, res, next) {
-    const ip = getClientIp(req);
-    const path = req.path;
-    const now = Date.now();
-    if (shouldSkipDdosProtection(path)) {
-        next();
-        return;
-    }
-    let entry = duplicatePathTrack.get(ip);
-    if (!entry || now > entry.windowStart + DUPLICATE_PATH_WINDOW_MS) {
-        entry = { path, count: 1, windowStart: now };
-        duplicatePathTrack.set(ip, entry);
-        next();
-        return;
-    }
-    if (entry.path === path) {
-        entry.count++;
-        if (entry.count > 10) {
-            reportAttack('ddos_path_flood', ip, path);
-            res.status(429).json({ erro: 'Muitas requisicoes.' });
-            return;
-        }
-    }
-    else {
-        entry.path = path;
-        entry.count = 1;
-        entry.windowStart = now;
-    }
-    next();
-}
-function cleanupConnections() {
-    const now = Date.now();
-    for (const [ip, conns] of activeConnections) {
-        if (conns.size === 0) {
-            activeConnections.delete(ip);
-        }
-    }
-    for (const [ip, entry] of duplicatePathTrack) {
-        if (now > entry.windowStart + DUPLICATE_PATH_WINDOW_MS + 10_000) {
-            duplicatePathTrack.delete(ip);
-        }
-    }
-}
-const cleanupTimer = setInterval(cleanupConnections, CLEANUP_INTERVAL_MS);
-cleanupTimer.unref();
-process.on('SIGTERM', () => { clearInterval(cleanupTimer); });
-process.on('SIGINT', () => { clearInterval(cleanupTimer); });
-process.on('beforeExit', () => { clearInterval(cleanupTimer); });
-export function createDdosProtection() {
-    return [
-        connectHandler,
-        validateRequestSize,
-        detectDuplicatePathFlood,
-        trackSlowBody,
-    ];
-}
-export { getClientIp };
-//# sourceMappingURL=ddos-protection.js.map

package/dist/app/github/middleware/ddos-protection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ddos-protection.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/ddos-protection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuB,CAAC;AACzD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAgE,CAAC;AAEnG,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyC,CAAC;AAEtE,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAQ,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;WACnE,GAAG,CAAC,EAAE;WACN,GAAG,CAAC,MAAM,CAAC,aAAa;WACxB,SAAS,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACpE,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,YAAY,CAAC,gBAAgB,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAc,CAAC;IAC3C,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAE5B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACpB,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrE,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACxC,YAAY,CAAC,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAElB,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU,EAAE,MAAc;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC1E,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;QAC7B,YAAY,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IAED,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAC/E,gBAAgB,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACzD,IAAI,gBAAgB,GAAG,eAAe,EAAE,CAAC;gBACvC,YAAY,CAAC,oBAAoB,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,IAAI,KAAK,cAAc,CAAC;AACtE,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC/E,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,wBAAwB,EAAE,CAAC;QACjE,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,EAAE,CAAC;YACrB,YAAY,CAAC,iBAAiB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QAChB,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC;IAC1B,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC7C,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,wBAAwB,GAAG,MAAM,EAAE,CAAC;YAChE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,WAAW,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAC1E,YAAY,CAAC,KAAK,EAAE,CAAC;AAErB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,cAAc;QACd,mBAAmB;QACnB,wBAAwB;QACxB,aAAa;KACd,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { reportAttack } from './security-store.js';\n\nconst MAX_CONCURRENT_PER_IP = 20;\nconst SLOW_BODY_TIMEOUT_MS = 10_000;\nconst MAX_HEADER_SIZE = 16_384;\nconst MAX_URI_SIZE = 8_192;\nconst CLEANUP_INTERVAL_MS = 60_000;\nconst DUPLICATE_PATH_WINDOW_MS = 2_000;\n\nconst activeConnections = new Map<string, Set<string>>();\nconst duplicatePathTrack = new Map<string, { path: string; count: number; windowStart: number }>();\n\nconst activeTimers = new Map<string, ReturnType<typeof setTimeout>>();\n\nfunction getClientIp(req: Request): string {\n  return (req.headers['x-forwarded-for'] as string)?.split(',')[0]?.trim()\n    || req.ip\n    || req.socket.remoteAddress\n    || 'unknown';\n}\n\nfunction generateConnectionId(): string {\n  return Date.now().toString(36) + Math.random().toString(36).slice(2, 8);\n}\n\nfunction trackSlowBody(req: Request, res: Response, next: NextFunction): void {\n  const ip = getClientIp(req);\n\n  const timer = setTimeout(() => {\n    if (!res.headersSent) {\n      reportAttack('ddos_slow_body', ip, req.path);\n      res.status(408).json({ erro: 'Request timeout.' });\n    }\n    try { res.end(); } catch { /* ignore */ }\n  }, SLOW_BODY_TIMEOUT_MS);\n\n  activeTimers.set(ip, timer);\n\n  res.on('finish', () => {\n    const existingTimer = activeTimers.get(ip);\n    if (existingTimer) {\n      clearTimeout(existingTimer);\n      activeTimers.delete(ip);\n    }\n    desconectarHandler(req);\n  });\n\n  res.on('close', () => {\n    const existingTimer = activeTimers.get(ip);\n    if (existingTimer) {\n      clearTimeout(existingTimer);\n      activeTimers.delete(ip);\n    }\n    desconectarHandler(req);\n  });\n\n  next();\n}\n\nfunction connectHandler(req: Request, res: Response, next: NextFunction): void {\n  const ip = getClientIp(req);\n\n  let conns = activeConnections.get(ip);\n  if (!conns) {\n    conns = new Set();\n    activeConnections.set(ip, conns);\n  }\n\n  if (conns.size >= MAX_CONCURRENT_PER_IP) {\n    reportAttack('ddos_concurrent', ip, req.path);\n    res.status(429).json({ erro: 'Muitas conexoes simultaneas.' });\n    return;\n  }\n\n  const connId = generateConnectionId();\n  conns.add(connId);\n\n  res.on('finish', () => { removeConnection(ip, connId); });\n  res.on('close', () => { removeConnection(ip, connId); });\n\n  next();\n}\n\nfunction removeConnection(ip: string, connId: string): void {\n  const conns = activeConnections.get(ip);\n  if (conns) {\n    conns.delete(connId);\n    if (conns.size === 0) {\n      activeConnections.delete(ip);\n    }\n  }\n}\n\nfunction desconectarHandler(req: Request): void {\n  const ip = getClientIp(req);\n  const timer = activeTimers.get(ip);\n  if (timer) {\n    clearTimeout(timer);\n    activeTimers.delete(ip);\n  }\n}\n\nfunction validateRequestSize(req: Request, res: Response, next: NextFunction): void {\n  const uriLength = (req.originalUrl || req.url || '').length;\n  if (uriLength > MAX_URI_SIZE) {\n    reportAttack('ddos_long_uri', getClientIp(req), req.path);\n    res.status(414).json({ erro: 'URI muito longa.' });\n    return;\n  }\n\n  let totalHeadersSize = 0;\n  if (req.headers) {\n    for (const [key, value] of Object.entries(req.headers)) {\n      const headerStr = `${key}: ${Array.isArray(value) ? value.join(', ') : value}`;\n      totalHeadersSize += Buffer.byteLength(headerStr, 'utf8');\n      if (totalHeadersSize > MAX_HEADER_SIZE) {\n        reportAttack('ddos_large_headers', getClientIp(req), req.path);\n        res.status(431).json({ erro: 'Cabecalhos muito grandes.' });\n        return;\n      }\n    }\n  }\n\n  next();\n}\n\nfunction shouldSkipDdosProtection(path: string): boolean {\n  return path.startsWith('/_next/static/') || path === '/favicon.ico';\n}\n\nfunction detectDuplicatePathFlood(req: Request, res: Response, next: NextFunction): void {\n  const ip = getClientIp(req);\n  const path = req.path;\n  const now = Date.now();\n\n  if (shouldSkipDdosProtection(path)) {\n    next();\n    return;\n  }\n\n  let entry = duplicatePathTrack.get(ip);\n  if (!entry || now > entry.windowStart + DUPLICATE_PATH_WINDOW_MS) {\n    entry = { path, count: 1, windowStart: now };\n    duplicatePathTrack.set(ip, entry);\n    next();\n    return;\n  }\n\n  if (entry.path === path) {\n    entry.count++;\n    if (entry.count > 10) {\n      reportAttack('ddos_path_flood', ip, path);\n      res.status(429).json({ erro: 'Muitas requisicoes.' });\n      return;\n    }\n  } else {\n    entry.path = path;\n    entry.count = 1;\n    entry.windowStart = now;\n  }\n\n  next();\n}\n\nfunction cleanupConnections(): void {\n  const now = Date.now();\n  for (const [ip, conns] of activeConnections) {\n    if (conns.size === 0) {\n      activeConnections.delete(ip);\n    }\n  }\n  for (const [ip, entry] of duplicatePathTrack) {\n    if (now > entry.windowStart + DUPLICATE_PATH_WINDOW_MS + 10_000) {\n      duplicatePathTrack.delete(ip);\n    }\n  }\n}\n\nconst cleanupTimer = setInterval(cleanupConnections, CLEANUP_INTERVAL_MS);\ncleanupTimer.unref();\n\nprocess.on('SIGTERM', () => { clearInterval(cleanupTimer); });\nprocess.on('SIGINT', () => { clearInterval(cleanupTimer); });\nprocess.on('beforeExit', () => { clearInterval(cleanupTimer); });\n\nexport function createDdosProtection(): Array<(req: Request, res: Response, next: NextFunction) => void> {\n  return [\n    connectHandler,\n    validateRequestSize,\n    detectDuplicatePathFlood,\n    trackSlowBody,\n  ];\n}\n\nexport { getClientIp };\n"]}

package/dist/app/github/middleware/isolamento.d.ts

@@ -1,11 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-export declare function bloquearAcessoDireto(req: Request, res: Response, next: NextFunction): void;
-export declare function verificarOrigem(req: Request, res: Response, next: NextFunction): void;
-export declare function verificarAssinaturaApi(req: Request, res: Response, next: NextFunction): Promise<void>;
-export declare function mascararRotasApi(req: Request, res: Response, next: NextFunction): void;
-export declare function createIsolationMiddleware(): Array<(req: Request, res: Response, next: NextFunction) => void | Promise<void>>;
-export declare function gerarAssinaturaApi(method: string, path: string, body: Record<string, unknown> | string): {
-    signature: string;
-    timestamp: string;
-};
-//# sourceMappingURL=isolamento.d.ts.map

package/dist/app/github/middleware/isolamento.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"isolamento.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/isolamento.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AA4F/D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAwC1F;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAuBrF;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C3G;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA0BtF;AAED,wBAAgB,yBAAyB,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAO5H;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GACrC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAM1C"}

package/dist/app/github/middleware/isolamento.js

@@ -1,220 +0,0 @@
-import crypto from 'node:crypto';
-const PUBLIC_URL = process.env.MAHORAGA_PUBLIC_URL || 'http://localhost:3000';
-const API_SECRET = process.env.MAHORAGA_API_SECRET || '';
-const IS_PROD = process.env.NODE_ENV === 'production';
-const BLOQUEIO_AVISO = 'Nao encontrado.';
-const ROTAS_PUBLICAS = new Set([
-    '/app-info',
-    '/health',
-    '/webhooks',
-    '/ping',
-]);
-const ORIGENS_PERMITIDAS = new Set([
-    PUBLIC_URL.replace(/\/$/u, ''),
-    'http://localhost:3000',
-    'http://localhost:5173',
-]);
-function isRotaPublica(path) {
-    if (ROTAS_PUBLICAS.has(path))
-        return true;
-    if (path.startsWith('/setup'))
-        return true;
-    return false;
-}
-function originPermitida(origin) {
-    if (!origin)
-        return false;
-    const normalizada = origin.replace(/\/$/u, '');
-    for (const permitida of ORIGENS_PERMITIDAS) {
-        if (normalizada === permitida || normalizada.startsWith(`${permitida}/`)) {
-            return true;
-        }
-    }
-    return false;
-}
-const USER_AGENT_BLOCKLIST = [
-    /burpsuite/i,
-    /owasp/i,
-    /zap/i,
-    /nikto/i,
-    /nmap/i,
-    /sqlmap/i,
-    /wpscan/i,
-    /acunetix/i,
-    /netsparker/i,
-    /nessus/i,
-    /openvas/i,
-    /appscan/i,
-    /webinspect/i,
-    /golismero/i,
-    /w3af/i,
-    /arachni/i,
-    /masscan/i,
-    /hydra/i,
-    /medusa/i,
-    /aircrack/i,
-    /metasploit/i,
-    /fiddler/i,
-    /postmanruntime/i,
-    /python-requests/i,
-    /python-urllib/i,
-    /go-http-client/i,
-    /scrapy/i,
-    /curl/i,
-    /wget/i,
-    /perl\/.*libwww/i,
-    /ruby/i,
-    /java\/\d+\.\d+/i,
-];
-const REQUISICAO_SUSPEITA_TEMPO = 300_000;
-const reputacaoIp = new Map();
-function incrementarReputacao(ip) {
-    const now = Date.now();
-    let entry = reputacaoIp.get(ip);
-    if (!entry || now > entry.resetAt) {
-        entry = { score: 1, resetAt: now + REQUISICAO_SUSPEITA_TEMPO };
-    }
-    else {
-        entry.score++;
-    }
-    reputacaoIp.set(ip, entry);
-    if (entry.score > 20) {
-        entry.score = 0;
-        entry.resetAt = now + 3600_000;
-    }
-}
-export function bloquearAcessoDireto(req, res, next) {
-    if (isRotaPublica(req.path)) {
-        next();
-        return;
-    }
-    const userAgent = req.headers['user-agent'] || '';
-    for (const pattern of USER_AGENT_BLOCKLIST) {
-        if (pattern.test(userAgent)) {
-            const ip = req.ip || req.socket.remoteAddress || 'unknown';
-            incrementarReputacao(ip);
-            res.status(404).json({ erro: BLOQUEIO_AVISO });
-            return;
-        }
-    }
-    const xRequestedWith = req.headers['x-requested-with'];
-    const secFetchSite = req.headers['sec-fetch-site'];
-    const accept = req.headers.accept;
-    const secFetchMode = req.headers['sec-fetch-mode'];
-    const secFetchDest = req.headers['sec-fetch-dest'];
-    const isXHR = xRequestedWith === 'XMLHttpRequest';
-    const isFetch = accept?.includes('application/json');
-    const isSameOrigin = secFetchSite === 'same-origin' || secFetchSite === 'same-site';
-    const isNavigation = secFetchMode === 'navigate' || secFetchDest === 'document';
-    if (isNavigation && req.method === 'GET') {
-        next();
-        return;
-    }
-    if (!isXHR && !isFetch && !isSameOrigin) {
-        const ip = req.ip || req.socket.remoteAddress || 'unknown';
-        incrementarReputacao(ip);
-        res.status(404).json({ erro: BLOQUEIO_AVISO });
-        return;
-    }
-    next();
-}
-export function verificarOrigem(req, res, next) {
-    if (isRotaPublica(req.path)) {
-        next();
-        return;
-    }
-    const origin = req.headers.origin;
-    const referer = req.headers.referer;
-    if (!origin && !referer) {
-        next();
-        return;
-    }
-    const source = origin || referer;
-    if (source && !originPermitida(source)) {
-        const ip = req.ip || req.socket.remoteAddress || 'unknown';
-        incrementarReputacao(ip);
-        res.status(403).json({ erro: BLOQUEIO_AVISO });
-        return;
-    }
-    next();
-}
-export async function verificarAssinaturaApi(req, res, next) {
-    if (isRotaPublica(req.path)) {
-        next();
-        return;
-    }
-    if (!API_SECRET) {
-        if (IS_PROD) {
-            res.status(401).json({ erro: BLOQUEIO_AVISO });
-            return;
-        }
-        next();
-        return;
-    }
-    const signature = req.headers['x-api-signature'];
-    if (!signature || signature.length !== 64) {
-        res.status(401).json({ erro: BLOQUEIO_AVISO });
-        return;
-    }
-    const timestamp = req.headers['x-api-timestamp'];
-    if (!timestamp || !/^\d{13}$/u.test(timestamp)) {
-        res.status(401).json({ erro: BLOQUEIO_AVISO });
-        return;
-    }
-    const now = Date.now();
-    const ts = parseInt(timestamp, 10);
-    if (Number.isNaN(ts) || Math.abs(now - ts) > 15000) {
-        res.status(401).json({ erro: BLOQUEIO_AVISO });
-        return;
-    }
-    const method = req.method;
-    const path = req.path;
-    const body = typeof req.body === 'object' ? JSON.stringify(req.body) : '';
-    const payload = `${method}:${path}:${timestamp}:${body}`;
-    const { verifyRequestSignature: verificarAssinatura } = await import('./crypto.js');
-    const valido = verificarAssinatura(payload, signature, API_SECRET);
-    if (!valido) {
-        res.status(401).json({ erro: BLOQUEIO_AVISO });
-        return;
-    }
-    next();
-}
-export function mascararRotasApi(req, res, next) {
-    if (isRotaPublica(req.path)) {
-        next();
-        return;
-    }
-    if (!req.path.startsWith('/api/github')) {
-        next();
-        return;
-    }
-    const xRequestedWith = req.headers['x-requested-with'];
-    const accept = req.headers.accept;
-    const isXHR = xRequestedWith === 'XMLHttpRequest';
-    const isFetch = accept?.includes('application/json');
-    if (!isXHR && !isFetch) {
-        if (req.method === 'GET') {
-            res.redirect('/');
-            return;
-        }
-        res.status(404).json({ erro: 'Nao encontrado.' });
-        return;
-    }
-    next();
-}
-export function createIsolationMiddleware() {
-    return [
-        bloquearAcessoDireto,
-        verificarOrigem,
-        verificarAssinaturaApi,
-        mascararRotasApi,
-    ];
-}
-export function gerarAssinaturaApi(method, path, body) {
-    const timestamp = String(Date.now());
-    const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
-    const payload = `${method}:${path}:${timestamp}:${bodyStr}`;
-    const signature = crypto.createHmac('sha256', API_SECRET).update(payload).digest('hex');
-    return { signature, timestamp };
-}
-//# sourceMappingURL=isolamento.js.map

package/dist/app/github/middleware/isolamento.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"isolamento.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/isolamento.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAIjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;AAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;AACzD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAEtD,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,WAAW;IACX,SAAS;IACT,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9B,uBAAuB;IACvB,uBAAuB;CACxB,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,oBAAoB,GAAG;IAC3B,YAAY;IACZ,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,SAAS;IACT,UAAU;IACV,UAAU;IACV,aAAa;IACb,YAAY;IACZ,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,SAAS;IACT,OAAO;IACP,OAAO;IACP,iBAAiB;IACjB,OAAO;IACP,iBAAiB;CAClB,CAAC;AAEF,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;AAE1E,SAAS,oBAAoB,CAAC,EAAU;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAE3B,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,EAAE,CAAC;QACrB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QAChB,KAAK,CAAC,OAAO,GAAG,GAAG,GAAG,QAAQ,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAClF,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAY,IAAI,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;YAC3D,oBAAoB,CAAC,EAAE,CAAC,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAuB,CAAC;IAC7E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IACxD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;IACzE,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;IAEzE,MAAM,KAAK,GAAG,cAAc,KAAK,gBAAgB,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,YAAY,KAAK,aAAa,IAAI,YAAY,KAAK,WAAW,CAAC;IACpF,MAAM,YAAY,GAAG,YAAY,KAAK,UAAU,IAAI,YAAY,KAAK,UAAU,CAAC;IAEhF,IAAI,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAC3D,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC7E,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAA6B,CAAC;IAE1D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC;IACjC,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAC3D,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC1F,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAuB,CAAC;IACvE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAuB,CAAC;IACvE,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;IACzD,MAAM,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAEnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC9E,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAuB,CAAC;IAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IACxD,MAAM,KAAK,GAAG,cAAc,KAAK,gBAAgB,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAErD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,oBAAoB;QACpB,eAAe;QACf,sBAAsB;QACtB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,IAAY,EACZ,IAAsC;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import crypto from 'node:crypto';\n\nimport type { NextFunction, Request, Response } from 'express';\n\nconst PUBLIC_URL = process.env.MAHORAGA_PUBLIC_URL || 'http://localhost:3000';\nconst API_SECRET = process.env.MAHORAGA_API_SECRET || '';\nconst IS_PROD = process.env.NODE_ENV === 'production';\n\nconst BLOQUEIO_AVISO = 'Nao encontrado.';\n\nconst ROTAS_PUBLICAS = new Set([\n  '/app-info',\n  '/health',\n  '/webhooks',\n  '/ping',\n]);\n\nconst ORIGENS_PERMITIDAS = new Set([\n  PUBLIC_URL.replace(/\\/$/u, ''),\n  'http://localhost:3000',\n  'http://localhost:5173',\n]);\n\nfunction isRotaPublica(path: string): boolean {\n  if (ROTAS_PUBLICAS.has(path)) return true;\n  if (path.startsWith('/setup')) return true;\n  return false;\n}\n\nfunction originPermitida(origin: string | undefined): boolean {\n  if (!origin) return false;\n  const normalizada = origin.replace(/\\/$/u, '');\n  for (const permitida of ORIGENS_PERMITIDAS) {\n    if (normalizada === permitida || normalizada.startsWith(`${permitida}/`)) {\n      return true;\n    }\n  }\n  return false;\n}\n\nconst USER_AGENT_BLOCKLIST = [\n  /burpsuite/i,\n  /owasp/i,\n  /zap/i,\n  /nikto/i,\n  /nmap/i,\n  /sqlmap/i,\n  /wpscan/i,\n  /acunetix/i,\n  /netsparker/i,\n  /nessus/i,\n  /openvas/i,\n  /appscan/i,\n  /webinspect/i,\n  /golismero/i,\n  /w3af/i,\n  /arachni/i,\n  /masscan/i,\n  /hydra/i,\n  /medusa/i,\n  /aircrack/i,\n  /metasploit/i,\n  /fiddler/i,\n  /postmanruntime/i,\n  /python-requests/i,\n  /python-urllib/i,\n  /go-http-client/i,\n  /scrapy/i,\n  /curl/i,\n  /wget/i,\n  /perl\\/.*libwww/i,\n  /ruby/i,\n  /java\\/\\d+\\.\\d+/i,\n];\n\nconst REQUISICAO_SUSPEITA_TEMPO = 300_000;\nconst reputacaoIp = new Map<string, { score: number; resetAt: number }>();\n\nfunction incrementarReputacao(ip: string): void {\n  const now = Date.now();\n  let entry = reputacaoIp.get(ip);\n  if (!entry || now > entry.resetAt) {\n    entry = { score: 1, resetAt: now + REQUISICAO_SUSPEITA_TEMPO };\n  } else {\n    entry.score++;\n  }\n  reputacaoIp.set(ip, entry);\n\n  if (entry.score > 20) {\n    entry.score = 0;\n    entry.resetAt = now + 3600_000;\n  }\n}\n\nexport function bloquearAcessoDireto(req: Request, res: Response, next: NextFunction): void {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  const userAgent = (req.headers['user-agent'] as string) || '';\n  for (const pattern of USER_AGENT_BLOCKLIST) {\n    if (pattern.test(userAgent)) {\n      const ip = req.ip || req.socket.remoteAddress || 'unknown';\n      incrementarReputacao(ip);\n      res.status(404).json({ erro: BLOQUEIO_AVISO });\n      return;\n    }\n  }\n\n  const xRequestedWith = req.headers['x-requested-with'] as string | undefined;\n  const secFetchSite = req.headers['sec-fetch-site'] as string | undefined;\n  const accept = req.headers.accept as string | undefined;\n  const secFetchMode = req.headers['sec-fetch-mode'] as string | undefined;\n  const secFetchDest = req.headers['sec-fetch-dest'] as string | undefined;\n\n  const isXHR = xRequestedWith === 'XMLHttpRequest';\n  const isFetch = accept?.includes('application/json');\n  const isSameOrigin = secFetchSite === 'same-origin' || secFetchSite === 'same-site';\n  const isNavigation = secFetchMode === 'navigate' || secFetchDest === 'document';\n\n  if (isNavigation && req.method === 'GET') {\n    next();\n    return;\n  }\n\n  if (!isXHR && !isFetch && !isSameOrigin) {\n    const ip = req.ip || req.socket.remoteAddress || 'unknown';\n    incrementarReputacao(ip);\n    res.status(404).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  next();\n}\n\nexport function verificarOrigem(req: Request, res: Response, next: NextFunction): void {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  const origin = req.headers.origin as string | undefined;\n  const referer = req.headers.referer as string | undefined;\n\n  if (!origin && !referer) {\n    next();\n    return;\n  }\n\n  const source = origin || referer;\n  if (source && !originPermitida(source)) {\n    const ip = req.ip || req.socket.remoteAddress || 'unknown';\n    incrementarReputacao(ip);\n    res.status(403).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  next();\n}\n\nexport async function verificarAssinaturaApi(req: Request, res: Response, next: NextFunction): Promise<void> {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  if (!API_SECRET) {\n    if (IS_PROD) {\n      res.status(401).json({ erro: BLOQUEIO_AVISO });\n      return;\n    }\n    next();\n    return;\n  }\n\n  const signature = req.headers['x-api-signature'] as string | undefined;\n  if (!signature || signature.length !== 64) {\n    res.status(401).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  const timestamp = req.headers['x-api-timestamp'] as string | undefined;\n  if (!timestamp || !/^\\d{13}$/u.test(timestamp)) {\n    res.status(401).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  const now = Date.now();\n  const ts = parseInt(timestamp, 10);\n  if (Number.isNaN(ts) || Math.abs(now - ts) > 15000) {\n    res.status(401).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  const method = req.method;\n  const path = req.path;\n  const body = typeof req.body === 'object' ? JSON.stringify(req.body) : '';\n  const payload = `${method}:${path}:${timestamp}:${body}`;\n  const { verifyRequestSignature: verificarAssinatura } = await import('./crypto.js');\n  const valido = verificarAssinatura(payload, signature, API_SECRET);\n\n  if (!valido) {\n    res.status(401).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  next();\n}\n\nexport function mascararRotasApi(req: Request, res: Response, next: NextFunction): void {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  if (!req.path.startsWith('/api/github')) {\n    next();\n    return;\n  }\n\n  const xRequestedWith = req.headers['x-requested-with'] as string | undefined;\n  const accept = req.headers.accept as string | undefined;\n  const isXHR = xRequestedWith === 'XMLHttpRequest';\n  const isFetch = accept?.includes('application/json');\n\n  if (!isXHR && !isFetch) {\n    if (req.method === 'GET') {\n      res.redirect('/');\n      return;\n    }\n    res.status(404).json({ erro: 'Nao encontrado.' });\n    return;\n  }\n\n  next();\n}\n\nexport function createIsolationMiddleware(): Array<(req: Request, res: Response, next: NextFunction) => void | Promise<void>> {\n  return [\n    bloquearAcessoDireto,\n    verificarOrigem,\n    verificarAssinaturaApi,\n    mascararRotasApi,\n  ];\n}\n\nexport function gerarAssinaturaApi(\n  method: string,\n  path: string,\n  body: Record<string, unknown> | string\n): { signature: string; timestamp: string } {\n  const timestamp = String(Date.now());\n  const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);\n  const payload = `${method}:${path}:${timestamp}:${bodyStr}`;\n  const signature = crypto.createHmac('sha256', API_SECRET).update(payload).digest('hex');\n  return { signature, timestamp };\n}\n"]}

package/dist/app/github/middleware/rate-limit.d.ts

@@ -1,5 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-export declare function getLimitForPath(path: string): number;
-export declare function rateLimiter(req: Request, res: Response, next: NextFunction): void;
-export declare function resetRateLimitIp(ip: string): void;
-//# sourceMappingURL=rate-limit.d.ts.map

package/dist/app/github/middleware/rate-limit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AA8B/D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AAoCD,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA0DjF;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAGjD"}