@mocoto/mahoraga 0.14.0

package/dist/app/github/middleware/rate-limit.js

@@ -0,0 +1,108 @@
+import { reportAttack } from './security-store.js';
+const DEFAULT_WINDOW_MS = 60_000;
+const BURST_WINDOW_MS = 3_000;
+const PUBLIC_LIMIT = 60;
+const PROTECTED_LIMIT = 30;
+const AUTH_LIMIT = 10;
+const BURST_LIMIT = 10;
+const BURST_BLOCK_MS = 900_000;
+const BACKOFF_MULTIPLIER = 2;
+const CLEANUP_INTERVAL_MS = 300_000;
+const windows = new Map();
+const blocks = new Map();
+export function getLimitForPath(path) {
+    if (path.startsWith('/_next/static/'))
+        return Infinity;
+    if (path === '/favicon.ico')
+        return Infinity;
+    if (path.startsWith('/api/github/security/status/stream'))
+        return Infinity;
+    if (path.startsWith('/api/github/webhooks'))
+        return PROTECTED_LIMIT;
+    if (path.startsWith('/api/github'))
+        return PROTECTED_LIMIT;
+    if (path.startsWith('/admin'))
+        return AUTH_LIMIT;
+    return PUBLIC_LIMIT;
+}
+function getClientIp(req) {
+    const forwarded = req.headers['x-forwarded-for'];
+    const ip = typeof forwarded === 'string' ? forwarded.split(',')[0]?.trim() : undefined;
+    return ip || req.ip || req.socket.remoteAddress || 'unknown';
+}
+function cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of windows) {
+        if (now > entry.windowStart + DEFAULT_WINDOW_MS && now > entry.burstWindowStart + BURST_WINDOW_MS) {
+            windows.delete(key);
+        }
+    }
+    for (const [key, entry] of blocks) {
+        if (now > entry.blockedUntil) {
+            blocks.delete(key);
+        }
+    }
+}
+const cleanupTimer = setInterval(cleanup, CLEANUP_INTERVAL_MS);
+cleanupTimer.unref();
+process.on('SIGTERM', () => { clearInterval(cleanupTimer); });
+process.on('SIGINT', () => { clearInterval(cleanupTimer); });
+process.on('beforeExit', () => { clearInterval(cleanupTimer); });
+function getBlockDuration(blockCount) {
+    return Math.min(86_400_000, BURST_BLOCK_MS * Math.pow(BACKOFF_MULTIPLIER, blockCount - 1));
+}
+export function rateLimiter(req, res, next) {
+    const ip = getClientIp(req);
+    const now = Date.now();
+    const limit = getLimitForPath(req.path);
+    if (!Number.isFinite(limit)) {
+        next();
+        return;
+    }
+    const activeBlock = blocks.get(ip);
+    if (activeBlock && now < activeBlock.blockedUntil) {
+        const retryAfter = Math.ceil((activeBlock.blockedUntil - now) / 1000);
+        res.setHeader('Retry-After', String(retryAfter));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(activeBlock.blockedUntil / 1000)));
+        reportAttack('rate_blocked', ip, req.path);
+        res.status(429).json({ erro: 'Muitas requisicoes. Aguarde e tente novamente.' });
+        return;
+    }
+    let entry = windows.get(ip);
+    if (!entry || now > entry.windowStart + DEFAULT_WINDOW_MS) {
+        entry = { count: 0, windowStart: now, burstCount: 0, burstWindowStart: now, blockCount: activeBlock?.blockCount ?? 0 };
+        windows.set(ip, entry);
+    }
+    if (now > entry.burstWindowStart + BURST_WINDOW_MS) {
+        entry.burstCount = 0;
+        entry.burstWindowStart = now;
+    }
+    entry.count++;
+    entry.burstCount++;
+    res.setHeader('X-RateLimit-Limit', String(limit));
+    res.setHeader('X-RateLimit-Remaining', String(Math.max(0, limit - entry.count)));
+    res.setHeader('X-RateLimit-Reset', String(Math.ceil((entry.windowStart + DEFAULT_WINDOW_MS) / 1000)));
+    if (entry.burstCount > BURST_LIMIT) {
+        entry.blockCount++;
+        const blockDuration = getBlockDuration(entry.blockCount);
+        blocks.set(ip, { blockedUntil: now + blockDuration, blockCount: entry.blockCount });
+        windows.delete(ip);
+        res.setHeader('Retry-After', String(Math.ceil(blockDuration / 1000)));
+        reportAttack('rate_burst', ip, req.path);
+        res.status(429).json({ erro: 'Muitas requisicoes. Aguarde e tente novamente.' });
+        return;
+    }
+    if (entry.count > limit) {
+        const retryAfter = Math.ceil(((entry.windowStart + DEFAULT_WINDOW_MS) - now) / 1000);
+        res.setHeader('Retry-After', String(retryAfter));
+        reportAttack('rate_limit', ip, req.path);
+        res.status(429).json({ erro: 'Muitas requisicoes. Aguarde e tente novamente.' });
+        return;
+    }
+    next();
+}
+export function resetRateLimitIp(ip) {
+    windows.delete(ip);
+    blocks.delete(ip);
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/app/github/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAepC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;AAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE7C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,oCAAoC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3E,IAAI,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,eAAe,CAAC;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,eAAe,CAAC;IAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,iBAAiB,IAAI,GAAG,GAAG,KAAK,CAAC,gBAAgB,GAAG,eAAe,EAAE,CAAC;YAClG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC/D,YAAY,CAAC,KAAK,EAAE,CAAC;AAErB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,IAAI,CAAC,GAAG,CACb,UAAU,EACV,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,GAAG,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACzE,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,YAAY,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACtE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvF,YAAY,CAAC,cAAc,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gDAAgD,EAAE,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;QAC1D,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,GAAG,GAAG,KAAK,CAAC,gBAAgB,GAAG,eAAe,EAAE,CAAC;QACnD,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QACrB,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,KAAK,CAAC,UAAU,EAAE,CAAC;IAEnB,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,GAAG,iBAAiB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtG,IAAI,KAAK,CAAC,UAAU,GAAG,WAAW,EAAE,CAAC;QACnC,KAAK,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,GAAG,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,YAAY,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gDAAgD,EAAE,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,GAAG,iBAAiB,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,YAAY,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gDAAgD,EAAE,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { reportAttack } from './security-store.js';\n\nconst DEFAULT_WINDOW_MS = 60_000;\nconst BURST_WINDOW_MS = 3_000;\nconst PUBLIC_LIMIT = 60;\nconst PROTECTED_LIMIT = 30;\nconst AUTH_LIMIT = 10;\nconst BURST_LIMIT = 10;\nconst BURST_BLOCK_MS = 900_000;\nconst BACKOFF_MULTIPLIER = 2;\nconst CLEANUP_INTERVAL_MS = 300_000;\n\ninterface RateEntry {\n  count: number;\n  windowStart: number;\n  burstCount: number;\n  burstWindowStart: number;\n  blockCount: number;\n}\n\ninterface BlockEntry {\n  blockedUntil: number;\n  blockCount: number;\n}\n\nconst windows = new Map<string, RateEntry>();\nconst blocks = new Map<string, BlockEntry>();\n\nexport function getLimitForPath(path: string): number {\n  if (path.startsWith('/_next/static/')) return Infinity;\n  if (path === '/favicon.ico') return Infinity;\n  if (path.startsWith('/api/github/security/status/stream')) return Infinity;\n  if (path.startsWith('/api/github/webhooks')) return PROTECTED_LIMIT;\n  if (path.startsWith('/api/github')) return PROTECTED_LIMIT;\n  if (path.startsWith('/admin')) return AUTH_LIMIT;\n  return PUBLIC_LIMIT;\n}\n\nfunction getClientIp(req: Request): string {\n  const forwarded = req.headers['x-forwarded-for'];\n  const ip = typeof forwarded === 'string' ? forwarded.split(',')[0]?.trim() : undefined;\n  return ip || req.ip || req.socket.remoteAddress || 'unknown';\n}\n\nfunction cleanup(): void {\n  const now = Date.now();\n  for (const [key, entry] of windows) {\n    if (now > entry.windowStart + DEFAULT_WINDOW_MS && now > entry.burstWindowStart + BURST_WINDOW_MS) {\n      windows.delete(key);\n    }\n  }\n  for (const [key, entry] of blocks) {\n    if (now > entry.blockedUntil) {\n      blocks.delete(key);\n    }\n  }\n}\n\nconst cleanupTimer = setInterval(cleanup, CLEANUP_INTERVAL_MS);\ncleanupTimer.unref();\n\nprocess.on('SIGTERM', () => { clearInterval(cleanupTimer); });\nprocess.on('SIGINT', () => { clearInterval(cleanupTimer); });\nprocess.on('beforeExit', () => { clearInterval(cleanupTimer); });\n\nfunction getBlockDuration(blockCount: number): number {\n  return Math.min(\n    86_400_000,\n    BURST_BLOCK_MS * Math.pow(BACKOFF_MULTIPLIER, blockCount - 1)\n  );\n}\n\nexport function rateLimiter(req: Request, res: Response, next: NextFunction): void {\n  const ip = getClientIp(req);\n  const now = Date.now();\n  const limit = getLimitForPath(req.path);\n\n  if (!Number.isFinite(limit)) {\n    next();\n    return;\n  }\n\n  const activeBlock = blocks.get(ip);\n  if (activeBlock && now < activeBlock.blockedUntil) {\n    const retryAfter = Math.ceil((activeBlock.blockedUntil - now) / 1000);\n    res.setHeader('Retry-After', String(retryAfter));\n    res.setHeader('X-RateLimit-Reset', String(Math.ceil(activeBlock.blockedUntil / 1000)));\n    reportAttack('rate_blocked', ip, req.path);\n    res.status(429).json({ erro: 'Muitas requisicoes. Aguarde e tente novamente.' });\n    return;\n  }\n\n  let entry = windows.get(ip);\n  if (!entry || now > entry.windowStart + DEFAULT_WINDOW_MS) {\n    entry = { count: 0, windowStart: now, burstCount: 0, burstWindowStart: now, blockCount: activeBlock?.blockCount ?? 0 };\n    windows.set(ip, entry);\n  }\n\n  if (now > entry.burstWindowStart + BURST_WINDOW_MS) {\n    entry.burstCount = 0;\n    entry.burstWindowStart = now;\n  }\n\n  entry.count++;\n  entry.burstCount++;\n\n  res.setHeader('X-RateLimit-Limit', String(limit));\n  res.setHeader('X-RateLimit-Remaining', String(Math.max(0, limit - entry.count)));\n  res.setHeader('X-RateLimit-Reset', String(Math.ceil((entry.windowStart + DEFAULT_WINDOW_MS) / 1000)));\n\n  if (entry.burstCount > BURST_LIMIT) {\n    entry.blockCount++;\n    const blockDuration = getBlockDuration(entry.blockCount);\n    blocks.set(ip, { blockedUntil: now + blockDuration, blockCount: entry.blockCount });\n    windows.delete(ip);\n    res.setHeader('Retry-After', String(Math.ceil(blockDuration / 1000)));\n    reportAttack('rate_burst', ip, req.path);\n    res.status(429).json({ erro: 'Muitas requisicoes. Aguarde e tente novamente.' });\n    return;\n  }\n\n  if (entry.count > limit) {\n    const retryAfter = Math.ceil(((entry.windowStart + DEFAULT_WINDOW_MS) - now) / 1000);\n    res.setHeader('Retry-After', String(retryAfter));\n    reportAttack('rate_limit', ip, req.path);\n    res.status(429).json({ erro: 'Muitas requisicoes. Aguarde e tente novamente.' });\n    return;\n  }\n\n  next();\n}\n\nexport function resetRateLimitIp(ip: string): void {\n  windows.delete(ip);\n  blocks.delete(ip);\n}\n"]}

package/dist/app/github/middleware/security-store.d.ts

@@ -0,0 +1,11 @@
+import { EventEmitter } from 'events';
+export declare const attackEmitter: EventEmitter<any>;
+export declare function reportAttack(type: string, ip: string, path: string): void;
+export declare function getAttackStatus(): {
+    underAttack: boolean;
+    attacksLast5min: number;
+    attackTypes: Record<string, number>;
+    lastAttack: string | null;
+    blockedIps: number;
+};
+//# sourceMappingURL=security-store.d.ts.map

package/dist/app/github/middleware/security-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-store.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/security-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AActC,eAAO,MAAM,aAAa,mBAAqB,CAAC;AAiBhD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGzE;AAED,wBAAgB,eAAe,IAAI;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,CAeA"}

package/dist/app/github/middleware/security-store.js

@@ -0,0 +1,38 @@
+import { EventEmitter } from 'events';
+const WINDOW_MS = 300_000;
+const CLEANUP_INTERVAL_MS = 30_000;
+const events = [];
+export const attackEmitter = new EventEmitter();
+attackEmitter.setMaxListeners(200);
+function cleanup() {
+    const cutoff = Date.now() - WINDOW_MS;
+    while (events.length > 0 && events[0].timestamp < cutoff) {
+        events.shift();
+    }
+}
+const cleanupTimer = setInterval(cleanup, CLEANUP_INTERVAL_MS);
+cleanupTimer.unref();
+process.on('SIGTERM', () => { clearInterval(cleanupTimer); });
+process.on('SIGINT', () => { clearInterval(cleanupTimer); });
+process.on('beforeExit', () => { clearInterval(cleanupTimer); });
+export function reportAttack(type, ip, path) {
+    events.push({ type, ip, path, timestamp: Date.now() });
+    attackEmitter.emit('attack', getAttackStatus());
+}
+export function getAttackStatus() {
+    cleanup();
+    const types = {};
+    for (const e of events) {
+        types[e.type] = (types[e.type] || 0) + 1;
+    }
+    const total = events.length;
+    const ips = new Set(events.map(e => e.ip));
+    return {
+        underAttack: total > 5,
+        attacksLast5min: total,
+        attackTypes: types,
+        lastAttack: events.length > 0 ? events[events.length - 1].type : null,
+        blockedIps: ips.size,
+    };
+}
+//# sourceMappingURL=security-store.js.map

package/dist/app/github/middleware/security-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-store.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/security-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AASnC,MAAM,MAAM,GAAkB,EAAE,CAAC;AAEjC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,YAAY,EAAE,CAAC;AAChD,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;AAEnC,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC/D,YAAY,CAAC,KAAK,EAAE,CAAC;AAErB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY;IACjE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvD,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,eAAe;IAO7B,OAAO,EAAE,CAAC;IACV,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO;QACL,WAAW,EAAE,KAAK,GAAG,CAAC;QACtB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACrE,UAAU,EAAE,GAAG,CAAC,IAAI;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import { EventEmitter } from 'events';\n\nconst WINDOW_MS = 300_000;\nconst CLEANUP_INTERVAL_MS = 30_000;\n\ninterface AttackEvent {\n  type: string;\n  ip: string;\n  path: string;\n  timestamp: number;\n}\n\nconst events: AttackEvent[] = [];\n\nexport const attackEmitter = new EventEmitter();\nattackEmitter.setMaxListeners(200);\n\nfunction cleanup(): void {\n  const cutoff = Date.now() - WINDOW_MS;\n  while (events.length > 0 && events[0].timestamp < cutoff) {\n    events.shift();\n  }\n}\n\nconst cleanupTimer = setInterval(cleanup, CLEANUP_INTERVAL_MS);\ncleanupTimer.unref();\n\nprocess.on('SIGTERM', () => { clearInterval(cleanupTimer); });\nprocess.on('SIGINT', () => { clearInterval(cleanupTimer); });\nprocess.on('beforeExit', () => { clearInterval(cleanupTimer); });\n\nexport function reportAttack(type: string, ip: string, path: string): void {\n  events.push({ type, ip, path, timestamp: Date.now() });\n  attackEmitter.emit('attack', getAttackStatus());\n}\n\nexport function getAttackStatus(): {\n  underAttack: boolean;\n  attacksLast5min: number;\n  attackTypes: Record<string, number>;\n  lastAttack: string | null;\n  blockedIps: number;\n} {\n  cleanup();\n  const types: Record<string, number> = {};\n  for (const e of events) {\n    types[e.type] = (types[e.type] || 0) + 1;\n  }\n  const total = events.length;\n  const ips = new Set(events.map(e => e.ip));\n  return {\n    underAttack: total > 5,\n    attacksLast5min: total,\n    attackTypes: types,\n    lastAttack: events.length > 0 ? events[events.length - 1].type : null,\n    blockedIps: ips.size,\n  };\n}\n"]}

package/dist/app/github/middleware/seguranca.d.ts

@@ -0,0 +1,6 @@
+import type { NextFunction, Request, Response } from 'express';
+declare function isIpBlocked(ip: string): boolean;
+declare function blockIp(ip: string, durationMs?: number): void;
+export { blockIp, isIpBlocked };
+export declare function createSecurityMiddleware(): Array<(req: Request, res: Response, next: NextFunction) => void>;
+//# sourceMappingURL=seguranca.d.ts.map

package/dist/app/github/middleware/seguranca.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seguranca.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/seguranca.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAO/D,iBAAS,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAQxC;AAED,iBAAS,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,GAAE,MAAgB,GAAG,IAAI,CAE/D;AA2TD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAEhC,wBAAgB,wBAAwB,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC,CAE3G"}

package/dist/app/github/middleware/seguranca.js

@@ -0,0 +1,297 @@
+import crypto from 'node:crypto';
+const IS_PROD = process.env.NODE_ENV === 'production';
+const PUBLIC_URL = process.env.MAHORAGA_PUBLIC_URL || 'http://localhost:3000';
+const blockedIps = new Map();
+function isIpBlocked(ip) {
+    const entry = blockedIps.get(ip);
+    if (!entry)
+        return false;
+    if (Date.now() > entry.blockedUntil) {
+        blockedIps.delete(ip);
+        return false;
+    }
+    return true;
+}
+function blockIp(ip, durationMs = 300_000) {
+    blockedIps.set(ip, { blockedUntil: Date.now() + durationMs });
+}
+function securityHeaders(req, res, next) {
+    const nonce = crypto.randomBytes(32).toString('base64url');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('X-Frame-Options', 'DENY');
+    res.setHeader('X-XSS-Protection', '0');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    res.setHeader('X-DNS-Prefetch-Control', 'off');
+    const isApi = req.path.startsWith('/api/');
+    const isStatic = req.path.startsWith('/_next/static/');
+    if (isApi) {
+        const scriptSrc = `'self' 'nonce-${nonce}'`;
+        const styleSrc = `'self' 'nonce-${nonce}'`;
+        const directives = [
+            `default-src 'self'`,
+            `script-src ${scriptSrc}`,
+            `style-src ${styleSrc}`,
+            `font-src 'self' https://cdnjs.cloudflare.com`,
+            `img-src 'self' data: https:`,
+            `connect-src 'self' https://api.github.com`,
+            `frame-src 'none'`,
+            `frame-ancestors 'none'`,
+            `object-src 'none'`,
+            `base-uri 'self'`,
+            `form-action 'self'`,
+            `manifest-src 'self'`,
+            `worker-src 'self'`,
+            `media-src 'self'`,
+            ...(IS_PROD ? [`upgrade-insecure-requests`] : []),
+        ];
+        res.setHeader('Content-Security-Policy', directives.join('; '));
+        res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+        res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+        res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp');
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0');
+        res.setHeader('Surrogate-Control', 'no-store');
+        res.setHeader('Pragma', 'no-cache');
+        res.setHeader('Expires', '0');
+        res.setHeader('Timing-Allow-Origin', '');
+    }
+    else if (isStatic) {
+        res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+    }
+    else {
+        const scriptSrc = `'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com`;
+        const styleSrc = `'self' 'unsafe-inline' https://cdnjs.cloudflare.com`;
+        const directives = [
+            `default-src 'self'`,
+            `script-src ${scriptSrc}`,
+            `style-src ${styleSrc}`,
+            `font-src 'self' https://cdnjs.cloudflare.com`,
+            `img-src 'self' data: https:`,
+            `connect-src 'self' https://api.github.com`,
+            `frame-src 'none'`,
+            `frame-ancestors 'none'`,
+            `object-src 'none'`,
+            `base-uri 'self'`,
+            `form-action 'self'`,
+            `manifest-src 'self'`,
+            `worker-src 'self'`,
+            `media-src 'self'`,
+            ...(IS_PROD ? [`upgrade-insecure-requests`] : []),
+        ];
+        res.setHeader('Content-Security-Policy', directives.join('; '));
+        res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+        res.setHeader('Timing-Allow-Origin', '');
+    }
+    res.setHeader('Permissions-Policy', 'accelerometer=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=(), geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(), gamepad=(), picture-in-picture=(), screen-wake-lock=(), serial=(), usb=(), xr-spatial-tracking=()');
+    res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');
+    if (IS_PROD && PUBLIC_URL.startsWith('https://')) {
+        res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+    }
+    res.setHeader('X-Request-Id', nonce.slice(0, 12));
+    req.nonce = nonce;
+    next();
+}
+function corsRestrict(req, res, next) {
+    if (req.path.startsWith('/api/github/webhooks')) {
+        next();
+        return;
+    }
+    const origin = req.headers.origin;
+    if (origin) {
+        const normalizedOrigin = origin.replace(/\/$/u, '');
+        const allowed = PUBLIC_URL.replace(/\/$/u, '');
+        const localhost = 'http://localhost:3000';
+        if (normalizedOrigin !== allowed && normalizedOrigin !== localhost) {
+            res.status(403).json({ erro: 'Origin nao permitida.' });
+            return;
+        }
+        res.setHeader('Access-Control-Allow-Origin', normalizedOrigin);
+    }
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token, X-Requested-With');
+    res.setHeader('Access-Control-Expose-Headers', 'X-CSRF-Token, X-Request-Id');
+    res.setHeader('Access-Control-Allow-Credentials', 'true');
+    res.setHeader('Access-Control-Max-Age', '86400');
+    res.setHeader('Vary', 'Origin, Access-Control-Request-Method, Access-Control-Request-Headers');
+    if (req.method === 'OPTIONS') {
+        res.status(204).end();
+        return;
+    }
+    next();
+}
+const csrfTokens = new Map();
+function generateCsrfToken() {
+    const token = crypto.randomBytes(32).toString('hex');
+    csrfTokens.set(token, { token, expiresAt: Date.now() + 3_600_000 });
+    return token;
+}
+function cleanupExpiredTokens() {
+    const now = Date.now();
+    for (const [key, value] of csrfTokens) {
+        if (value.expiresAt < now) {
+            csrfTokens.delete(key);
+        }
+    }
+}
+function csrfProtection(req, res, next) {
+    const safeMethods = new Set(['GET', 'HEAD', 'OPTIONS']);
+    if (safeMethods.has(req.method)) {
+        const token = generateCsrfToken();
+        res.setHeader('X-CSRF-Token', token);
+        next();
+        return;
+    }
+    if (req.path.startsWith('/api/github/webhooks')) {
+        next();
+        return;
+    }
+    const origin = req.headers.origin;
+    const referer = req.headers.referer;
+    if (origin || referer) {
+        const source = (origin || referer || '').replace(/\/$/u, '');
+        const allowed = PUBLIC_URL.replace(/\/$/u, '');
+        if (source !== allowed && source !== 'http://localhost:3000') {
+            res.status(403).json({ erro: 'CSRF origin invalida.' });
+            return;
+        }
+    }
+    const headerToken = req.headers['x-csrf-token'];
+    const stored = headerToken ? csrfTokens.get(headerToken) : undefined;
+    if (!stored || stored.expiresAt < Date.now()) {
+        cleanupExpiredTokens();
+        res.status(403).json({ erro: 'CSRF token invalido ou expirado' });
+        return;
+    }
+    if (headerToken) {
+        csrfTokens.delete(headerToken);
+    }
+    next();
+}
+const INJECTION_PATTERNS = [
+    /\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE|TRUNCATE|EXEC)\b.*\b(FROM|INTO|SET|TABLE|DATABASE|VALUES)\b/is,
+    /\b(OR|AND)\s+\d+\s*=\s*\d+/is,
+    /\b(UNION\s+ALL\s+SELECT|UNION\s+SELECT|SELECT\s+.*\s+FROM)/is,
+    /\b(LOAD_FILE|INTO\s+(OUT|DUMP)FILE|CHAR\s*\()/is,
+    /\b(xp_cmdshell|sp_executesql|sp_prepare)\b/is,
+];
+const XSS_PATTERNS = [
+    /<\s*script\s*[^>]*>/is,
+    /(?:onerror|onload|onclick|onmouseover|onfocus|onblur|onchange|onsubmit|onreset|onselect|onkeydown|onkeypress|onkeyup)\s*=/is,
+    /javascript\s*:/is,
+    /\beval\s*\(/is,
+    /\bdocument\s*\./is,
+    /\b(?:alert|confirm|prompt)\s*\(/is,
+    /data\s*:\s*text\s*\//is,
+    /\b(?:innerHTML|outerHTML|document\.write)\s*=/is,
+];
+const PATH_TRAVERSAL_PATTERNS = [
+    /\.\.\//,
+    /\.\.\\/,
+    /~\//,
+    /%2e%2e\//i,
+    /%2e%2e%2f/i,
+    /%c0%ae%c0%ae\//i,
+    /%252e%252e%255c/i,
+];
+function detectInjection(value) {
+    for (const pattern of INJECTION_PATTERNS) {
+        if (pattern.test(value))
+            return 'sql';
+    }
+    for (const pattern of XSS_PATTERNS) {
+        if (pattern.test(value))
+            return 'xss';
+    }
+    for (const pattern of PATH_TRAVERSAL_PATTERNS) {
+        if (pattern.test(value))
+            return 'path_traversal';
+    }
+    return null;
+}
+const DEEP_SCAN_HEADERS = new Set([
+    'x-forwarded-for',
+    'x-forwarded-host',
+    'x-forwarded-proto',
+    'x-real-ip',
+    'client-ip',
+    'x-originating-ip',
+    'x-remote-ip',
+    'x-remote-addr',
+]);
+function validateInputs(req, res, next) {
+    if (req.path === '/api/github/webhooks' || req.path === '/webhooks') {
+        next();
+        return;
+    }
+    const checkValues = [];
+    if (req.query) {
+        for (const val of Object.values(req.query)) {
+            if (typeof val === 'string')
+                checkValues.push({ source: 'query', value: val });
+            if (Array.isArray(val)) {
+                for (const v of val) {
+                    if (typeof v === 'string')
+                        checkValues.push({ source: 'query', value: v });
+                }
+            }
+        }
+    }
+    if (req.params) {
+        for (const val of Object.values(req.params)) {
+            if (typeof val === 'string')
+                checkValues.push({ source: 'params', value: val });
+        }
+    }
+    if (req.body && typeof req.body === 'object') {
+        const traverseObject = (obj, depth = 0) => {
+            if (depth > 5)
+                return;
+            for (const val of Object.values(obj)) {
+                if (typeof val === 'string')
+                    checkValues.push({ source: 'body', value: val });
+                if (val && typeof val === 'object' && !Array.isArray(val)) {
+                    traverseObject(val, depth + 1);
+                }
+                if (Array.isArray(val)) {
+                    for (const v of val) {
+                        if (typeof v === 'string')
+                            checkValues.push({ source: 'body', value: v });
+                        if (v && typeof v === 'object')
+                            traverseObject(v, depth + 1);
+                    }
+                }
+            }
+        };
+        traverseObject(req.body);
+    }
+    const ip = req.ip || req.socket.remoteAddress || 'unknown';
+    for (const { value } of checkValues) {
+        if (value.length > 2000) {
+            blockIp(ip, 3600_000);
+            res.status(400).json({ erro: 'Parametro muito longo.' });
+            return;
+        }
+        const attackType = detectInjection(value);
+        if (attackType) {
+            blockIp(ip, 3600_000);
+            res.status(400).json({ erro: 'Input invalido detectado.' });
+            return;
+        }
+    }
+    for (const header of DEEP_SCAN_HEADERS) {
+        const val = req.headers[header];
+        if (val) {
+            const attackType = detectInjection(val);
+            if (attackType) {
+                blockIp(ip, 3600_000);
+                res.status(400).json({ erro: 'Header invalido detectado.' });
+                return;
+            }
+        }
+    }
+    next();
+}
+export { blockIp, isIpBlocked };
+export function createSecurityMiddleware() {
+    return [securityHeaders, corsRestrict, csrfProtection, validateInputs];
+}
+//# sourceMappingURL=seguranca.js.map

package/dist/app/github/middleware/seguranca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seguranca.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/seguranca.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAIjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;AAE9E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoC,CAAC;AAE/D,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,EAAU,EAAE,aAAqB,OAAO;IACvD,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE3D,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAEvD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,iBAAiB,KAAK,GAAG,CAAC;QAC5C,MAAM,QAAQ,GAAG,iBAAiB,KAAK,GAAG,CAAC;QAE3C,MAAM,UAAU,GAAG;YACjB,oBAAoB;YACpB,cAAc,SAAS,EAAE;YACzB,aAAa,QAAQ,EAAE;YACvB,8CAA8C;YAC9C,6BAA6B;YAC7B,2CAA2C;YAC3C,kBAAkB;YAClB,wBAAwB;YACxB,mBAAmB;YACnB,iBAAiB;YACjB,oBAAoB;YACpB,qBAAqB;YACrB,mBAAmB;YACnB,kBAAkB;YAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;QAEF,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;QAC7D,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;QAC3D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,kEAAkE,CAAC,CAAC;QACnG,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,wDAAwD,CAAC;QAC3E,MAAM,QAAQ,GAAG,qDAAqD,CAAC;QAEvE,MAAM,UAAU,GAAG;YACjB,oBAAoB;YACpB,cAAc,SAAS,EAAE;YACzB,aAAa,QAAQ,EAAE;YACvB,8CAA8C;YAC9C,6BAA6B;YAC7B,2CAA2C;YAC3C,kBAAkB;YAClB,wBAAwB;YACxB,mBAAmB;YACnB,iBAAiB;YACjB,oBAAoB;YACpB,qBAAqB;YACrB,mBAAmB;YACnB,kBAAkB;YAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;QAEF,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QACtE,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,SAAS,CACX,oBAAoB,EACpB,oUAAoU,CACrU,CAAC;IAEF,GAAG,CAAC,SAAS,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IAE3D,IAAI,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,8CAA8C,CAAC,CAAC;IAC7F,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEjD,GAAmC,CAAC,KAAK,GAAG,KAAK,CAAC;IAEnD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACnE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IAExD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,uBAAuB,CAAC;QAE1C,IAAI,gBAAgB,KAAK,OAAO,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,mCAAmC,CAAC,CAAC;IACnF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6DAA6D,CAAC,CAAC;IAC7G,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,4BAA4B,CAAC,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAC1D,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,uEAAuE,CAAC,CAAC;IAE/F,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAC;AAE3E,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YAC1B,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAExD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAA6B,CAAC;IAE1D,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAuB,CAAC;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7C,oBAAoB,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,kBAAkB,GAAG;IACzB,sHAAsH;IACtH,8BAA8B;IAC9B,8DAA8D;IAC9D,iDAAiD;IACjD,8CAA8C;CAC/C,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,uBAAuB;IACvB,6HAA6H;IAC7H,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,mCAAmC;IACnC,wBAAwB;IACxB,iDAAiD;CAClD,CAAC;AAEF,MAAM,uBAAuB,GAAG;IAC9B,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;CACnB,CAAC;AAEF,SAAS,eAAe,CAAC,KAAa;IACpC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,gBAAgB,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,WAAW;IACX,WAAW;IACX,kBAAkB;IAClB,aAAa;IACb,eAAe;CAChB,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrE,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpE,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAA6C,EAAE,CAAC;IAEjE,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;oBACpB,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,cAAc,GAAG,CAAC,GAA4B,EAAE,KAAK,GAAG,CAAC,EAAQ,EAAE;YACvE,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO;YACtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,IAAI,OAAO,GAAG,KAAK,QAAQ;oBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC9E,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1D,cAAc,CAAC,GAA8B,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;wBACpB,IAAI,OAAO,CAAC,KAAK,QAAQ;4BAAE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;wBAC1E,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;4BAAE,cAAc,CAAC,CAA4B,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,cAAc,CAAC,GAAG,CAAC,IAA+B,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE3D,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAuB,CAAC;QACtD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAEhC,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import crypto from 'node:crypto';\n\nimport type { NextFunction, Request, Response } from 'express';\n\nconst IS_PROD = process.env.NODE_ENV === 'production';\nconst PUBLIC_URL = process.env.MAHORAGA_PUBLIC_URL || 'http://localhost:3000';\n\nconst blockedIps = new Map<string, { blockedUntil: number }>();\n\nfunction isIpBlocked(ip: string): boolean {\n  const entry = blockedIps.get(ip);\n  if (!entry) return false;\n  if (Date.now() > entry.blockedUntil) {\n    blockedIps.delete(ip);\n    return false;\n  }\n  return true;\n}\n\nfunction blockIp(ip: string, durationMs: number = 300_000): void {\n  blockedIps.set(ip, { blockedUntil: Date.now() + durationMs });\n}\n\nfunction securityHeaders(req: Request, res: Response, next: NextFunction): void {\n  const nonce = crypto.randomBytes(32).toString('base64url');\n\n  res.setHeader('X-Content-Type-Options', 'nosniff');\n  res.setHeader('X-Frame-Options', 'DENY');\n  res.setHeader('X-XSS-Protection', '0');\n  res.setHeader('Referrer-Policy', 'no-referrer');\n  res.setHeader('X-DNS-Prefetch-Control', 'off');\n\n  const isApi = req.path.startsWith('/api/');\n  const isStatic = req.path.startsWith('/_next/static/');\n\n  if (isApi) {\n    const scriptSrc = `'self' 'nonce-${nonce}'`;\n    const styleSrc = `'self' 'nonce-${nonce}'`;\n\n    const directives = [\n      `default-src 'self'`,\n      `script-src ${scriptSrc}`,\n      `style-src ${styleSrc}`,\n      `font-src 'self' https://cdnjs.cloudflare.com`,\n      `img-src 'self' data: https:`,\n      `connect-src 'self' https://api.github.com`,\n      `frame-src 'none'`,\n      `frame-ancestors 'none'`,\n      `object-src 'none'`,\n      `base-uri 'self'`,\n      `form-action 'self'`,\n      `manifest-src 'self'`,\n      `worker-src 'self'`,\n      `media-src 'self'`,\n      ...(IS_PROD ? [`upgrade-insecure-requests`] : []),\n    ];\n\n    res.setHeader('Content-Security-Policy', directives.join('; '));\n    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');\n    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');\n    res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp');\n    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0');\n    res.setHeader('Surrogate-Control', 'no-store');\n    res.setHeader('Pragma', 'no-cache');\n    res.setHeader('Expires', '0');\n    res.setHeader('Timing-Allow-Origin', '');\n  } else if (isStatic) {\n    res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');\n  } else {\n    const scriptSrc = `'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com`;\n    const styleSrc = `'self' 'unsafe-inline' https://cdnjs.cloudflare.com`;\n\n    const directives = [\n      `default-src 'self'`,\n      `script-src ${scriptSrc}`,\n      `style-src ${styleSrc}`,\n      `font-src 'self' https://cdnjs.cloudflare.com`,\n      `img-src 'self' data: https:`,\n      `connect-src 'self' https://api.github.com`,\n      `frame-src 'none'`,\n      `frame-ancestors 'none'`,\n      `object-src 'none'`,\n      `base-uri 'self'`,\n      `form-action 'self'`,\n      `manifest-src 'self'`,\n      `worker-src 'self'`,\n      `media-src 'self'`,\n      ...(IS_PROD ? [`upgrade-insecure-requests`] : []),\n    ];\n\n    res.setHeader('Content-Security-Policy', directives.join('; '));\n    res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');\n    res.setHeader('Timing-Allow-Origin', '');\n  }\n\n  res.setHeader(\n    'Permissions-Policy',\n    'accelerometer=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=(), geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(), gamepad=(), picture-in-picture=(), screen-wake-lock=(), serial=(), usb=(), xr-spatial-tracking=()'\n  );\n\n  res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');\n\n  if (IS_PROD && PUBLIC_URL.startsWith('https://')) {\n    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');\n  }\n  res.setHeader('X-Request-Id', nonce.slice(0, 12));\n\n  (req as Request & { nonce: string }).nonce = nonce;\n\n  next();\n}\n\nfunction corsRestrict(req: Request, res: Response, next: NextFunction): void {\n  if (req.path.startsWith('/api/github/webhooks')) {\n    next();\n    return;\n  }\n\n  const origin = req.headers.origin as string | undefined;\n\n  if (origin) {\n    const normalizedOrigin = origin.replace(/\\/$/u, '');\n    const allowed = PUBLIC_URL.replace(/\\/$/u, '');\n    const localhost = 'http://localhost:3000';\n\n    if (normalizedOrigin !== allowed && normalizedOrigin !== localhost) {\n      res.status(403).json({ erro: 'Origin nao permitida.' });\n      return;\n    }\n\n    res.setHeader('Access-Control-Allow-Origin', normalizedOrigin);\n  }\n\n  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS');\n  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token, X-Requested-With');\n  res.setHeader('Access-Control-Expose-Headers', 'X-CSRF-Token, X-Request-Id');\n  res.setHeader('Access-Control-Allow-Credentials', 'true');\n  res.setHeader('Access-Control-Max-Age', '86400');\n  res.setHeader('Vary', 'Origin, Access-Control-Request-Method, Access-Control-Request-Headers');\n\n  if (req.method === 'OPTIONS') {\n    res.status(204).end();\n    return;\n  }\n\n  next();\n}\n\nconst csrfTokens = new Map<string, { token: string; expiresAt: number }>();\n\nfunction generateCsrfToken(): string {\n  const token = crypto.randomBytes(32).toString('hex');\n  csrfTokens.set(token, { token, expiresAt: Date.now() + 3_600_000 });\n  return token;\n}\n\nfunction cleanupExpiredTokens(): void {\n  const now = Date.now();\n  for (const [key, value] of csrfTokens) {\n    if (value.expiresAt < now) {\n      csrfTokens.delete(key);\n    }\n  }\n}\n\nfunction csrfProtection(req: Request, res: Response, next: NextFunction): void {\n  const safeMethods = new Set(['GET', 'HEAD', 'OPTIONS']);\n\n  if (safeMethods.has(req.method)) {\n    const token = generateCsrfToken();\n    res.setHeader('X-CSRF-Token', token);\n    next();\n    return;\n  }\n\n  if (req.path.startsWith('/api/github/webhooks')) {\n    next();\n    return;\n  }\n\n  const origin = req.headers.origin as string | undefined;\n  const referer = req.headers.referer as string | undefined;\n\n  if (origin || referer) {\n    const source = (origin || referer || '').replace(/\\/$/u, '');\n    const allowed = PUBLIC_URL.replace(/\\/$/u, '');\n    if (source !== allowed && source !== 'http://localhost:3000') {\n      res.status(403).json({ erro: 'CSRF origin invalida.' });\n      return;\n    }\n  }\n\n  const headerToken = req.headers['x-csrf-token'] as string | undefined;\n  const stored = headerToken ? csrfTokens.get(headerToken) : undefined;\n\n  if (!stored || stored.expiresAt < Date.now()) {\n    cleanupExpiredTokens();\n    res.status(403).json({ erro: 'CSRF token invalido ou expirado' });\n    return;\n  }\n\n  if (headerToken) {\n    csrfTokens.delete(headerToken);\n  }\n  next();\n}\n\nconst INJECTION_PATTERNS = [\n  /\\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE|TRUNCATE|EXEC)\\b.*\\b(FROM|INTO|SET|TABLE|DATABASE|VALUES)\\b/is,\n  /\\b(OR|AND)\\s+\\d+\\s*=\\s*\\d+/is,\n  /\\b(UNION\\s+ALL\\s+SELECT|UNION\\s+SELECT|SELECT\\s+.*\\s+FROM)/is,\n  /\\b(LOAD_FILE|INTO\\s+(OUT|DUMP)FILE|CHAR\\s*\\()/is,\n  /\\b(xp_cmdshell|sp_executesql|sp_prepare)\\b/is,\n];\n\nconst XSS_PATTERNS = [\n  /<\\s*script\\s*[^>]*>/is,\n  /(?:onerror|onload|onclick|onmouseover|onfocus|onblur|onchange|onsubmit|onreset|onselect|onkeydown|onkeypress|onkeyup)\\s*=/is,\n  /javascript\\s*:/is,\n  /\\beval\\s*\\(/is,\n  /\\bdocument\\s*\\./is,\n  /\\b(?:alert|confirm|prompt)\\s*\\(/is,\n  /data\\s*:\\s*text\\s*\\//is,\n  /\\b(?:innerHTML|outerHTML|document\\.write)\\s*=/is,\n];\n\nconst PATH_TRAVERSAL_PATTERNS = [\n  /\\.\\.\\//,\n  /\\.\\.\\\\/,\n  /~\\//,\n  /%2e%2e\\//i,\n  /%2e%2e%2f/i,\n  /%c0%ae%c0%ae\\//i,\n  /%252e%252e%255c/i,\n];\n\nfunction detectInjection(value: string): string | null {\n  for (const pattern of INJECTION_PATTERNS) {\n    if (pattern.test(value)) return 'sql';\n  }\n  for (const pattern of XSS_PATTERNS) {\n    if (pattern.test(value)) return 'xss';\n  }\n  for (const pattern of PATH_TRAVERSAL_PATTERNS) {\n    if (pattern.test(value)) return 'path_traversal';\n  }\n  return null;\n}\n\nconst DEEP_SCAN_HEADERS = new Set([\n  'x-forwarded-for',\n  'x-forwarded-host',\n  'x-forwarded-proto',\n  'x-real-ip',\n  'client-ip',\n  'x-originating-ip',\n  'x-remote-ip',\n  'x-remote-addr',\n]);\n\nfunction validateInputs(req: Request, res: Response, next: NextFunction): void {\n  if (req.path === '/api/github/webhooks' || req.path === '/webhooks') {\n    next();\n    return;\n  }\n\n  const checkValues: Array<{ source: string; value: string }> = [];\n\n  if (req.query) {\n    for (const val of Object.values(req.query)) {\n      if (typeof val === 'string') checkValues.push({ source: 'query', value: val });\n      if (Array.isArray(val)) {\n        for (const v of val) {\n          if (typeof v === 'string') checkValues.push({ source: 'query', value: v });\n        }\n      }\n    }\n  }\n\n  if (req.params) {\n    for (const val of Object.values(req.params)) {\n      if (typeof val === 'string') checkValues.push({ source: 'params', value: val });\n    }\n  }\n\n  if (req.body && typeof req.body === 'object') {\n    const traverseObject = (obj: Record<string, unknown>, depth = 0): void => {\n      if (depth > 5) return;\n      for (const val of Object.values(obj)) {\n        if (typeof val === 'string') checkValues.push({ source: 'body', value: val });\n        if (val && typeof val === 'object' && !Array.isArray(val)) {\n          traverseObject(val as Record<string, unknown>, depth + 1);\n        }\n        if (Array.isArray(val)) {\n          for (const v of val) {\n            if (typeof v === 'string') checkValues.push({ source: 'body', value: v });\n            if (v && typeof v === 'object') traverseObject(v as Record<string, unknown>, depth + 1);\n          }\n        }\n      }\n    };\n    traverseObject(req.body as Record<string, unknown>);\n  }\n\n  const ip = req.ip || req.socket.remoteAddress || 'unknown';\n\n  for (const { value } of checkValues) {\n    if (value.length > 2000) {\n      blockIp(ip, 3600_000);\n      res.status(400).json({ erro: 'Parametro muito longo.' });\n      return;\n    }\n\n    const attackType = detectInjection(value);\n    if (attackType) {\n      blockIp(ip, 3600_000);\n      res.status(400).json({ erro: 'Input invalido detectado.' });\n      return;\n    }\n  }\n\n  for (const header of DEEP_SCAN_HEADERS) {\n    const val = req.headers[header] as string | undefined;\n    if (val) {\n      const attackType = detectInjection(val);\n      if (attackType) {\n        blockIp(ip, 3600_000);\n        res.status(400).json({ erro: 'Header invalido detectado.' });\n        return;\n      }\n    }\n  }\n\n  next();\n}\n\nexport { blockIp, isIpBlocked };\n\nexport function createSecurityMiddleware(): Array<(req: Request, res: Response, next: NextFunction) => void> {\n  return [securityHeaders, corsRestrict, csrfProtection, validateInputs];\n}\n"]}

package/dist/app/github/push-analysis/analysis-core.d.ts

@@ -0,0 +1,7 @@
+import type { App } from '@octokit/app';
+import type { RodarAnaliseParams, RodarAnaliseResult } from '../../../types/github/app.js';
+import type { OctokitInstance } from '../app/webhook-handler.js';
+export type { RodarAnaliseParams, RodarAnaliseResult };
+export declare function listarArquivosAlterados(octokit: OctokitInstance, owner: string, repo: string, beforeSha: string, afterSha: string): Promise<string[]>;
+export declare function rodarAnaliseCodigo(app: App, params: RodarAnaliseParams): Promise<RodarAnaliseResult>;
+//# sourceMappingURL=analysis-core.d.ts.map

package/dist/app/github/push-analysis/analysis-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-core.d.ts","sourceRoot":"","sources":["../../../../src/app/github/push-analysis/analysis-core.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAGV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAQjE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;AAwBvD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAWD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,kBAAkB,CAAC,CAiE7B"}

package/dist/app/github/push-analysis/analysis-core.js

@@ -0,0 +1,84 @@
+import { carregarConfigDeDiretorio } from '../../../core/config/index.js';
+import { obterConfigInstalacao } from '../app/installation-store.js';
+import { downloadRepo } from '../app/repo-downloader.js';
+import { calcularScoreGeral, executarAnaliseInterna, resumirPorSeveridade, resumirPorTipo } from '../jobs/full-analysis-job.js';
+function simplificarOcorrencias(ocorrencias) {
+    return ocorrencias.map(o => ({
+        mensagem: typeof o.mensagem === 'string' ? o.mensagem : String(o.mensagem ?? ''),
+        relPath: typeof o.relPath === 'string' ? o.relPath : String(o.relPath ?? ''),
+        tipo: typeof o.tipo === 'string' ? o.tipo : undefined,
+        nivel: typeof o.nivel === 'string' ? o.nivel : undefined,
+        linha: typeof o.linha === 'number' ? o.linha : undefined,
+        coluna: typeof o.coluna === 'number' ? o.coluna : undefined,
+        sugestao: typeof o.sugestao === 'string' ? o.sugestao : undefined
+    }));
+}
+export async function listarArquivosAlterados(octokit, owner, repo, beforeSha, afterSha) {
+    if (!beforeSha || beforeSha === '0000000000000000000000000000000000000000') {
+        return [];
+    }
+    try {
+        const { data } = await octokit.request('GET /repos/{owner}/{repo}/compare/{basehead}', {
+            owner,
+            repo,
+            basehead: `${beforeSha}...${afterSha}`
+        });
+        return (data.files ?? [])
+            .filter((f) => f.status !== 'removed' && typeof f.filename === 'string')
+            .map(f => f.filename);
+    }
+    catch {
+        return [];
+    }
+}
+function filtrarOcorrenciasPorArquivos(ocorrencias, arquivos) {
+    if (arquivos.length === 0)
+        return ocorrencias;
+    const set = new Set(arquivos);
+    return ocorrencias.filter(o => set.has(o.relPath));
+}
+export async function rodarAnaliseCodigo(app, params) {
+    const config = obterConfigInstalacao(params.installationId);
+    const octokit = await app.getInstallationOctokit(params.installationId);
+    const inicio = Date.now();
+    const { repoDir, cleanup } = await downloadRepo(app, params.installationId, params.owner, params.repo, params.headSha);
+    try {
+        await carregarConfigDeDiretorio(repoDir);
+        const { totalArquivos, arquivosAnalisados, todasOcorrencias } = await executarAnaliseInterna(repoDir, { fast: params.fast ?? config.fast });
+        let ocorrencias = simplificarOcorrencias(todasOcorrencias);
+        let arquivosAlterados = [];
+        const usarIncremental = params.incremental ?? config.incrementalOnPush;
+        if (usarIncremental && params.baseSha) {
+            arquivosAlterados = await listarArquivosAlterados(octokit, params.owner, params.repo, params.baseSha, params.headSha);
+            if (arquivosAlterados.length > 0) {
+                ocorrencias = filtrarOcorrenciasPorArquivos(ocorrencias, arquivosAlterados);
+            }
+        }
+        const resultado = {
+            totalArquivos,
+            totalOcorrencias: ocorrencias.length,
+            duracaoMs: Date.now() - inicio,
+            arquivosAnalisados,
+            ocorrencias,
+            scoreGeral: calcularScoreGeral(totalArquivos, ocorrencias),
+            resumoPorTipo: resumirPorTipo(ocorrencias),
+            resumoPorSeveridade: resumirPorSeveridade(ocorrencias)
+        };
+        const ctx = {
+            branch: params.branch,
+            headSha: params.headSha,
+            commitMessage: params.commitMessage,
+            owner: params.owner,
+            repo: params.repo,
+            arquivosAlterados: arquivosAlterados.length > 0 ? arquivosAlterados : undefined,
+            escopoIncremental: usarIncremental && arquivosAlterados.length > 0,
+            origem: params.baseSha ? 'pull_request' : 'push'
+        };
+        return { resultado, ctx, cleanup };
+    }
+    catch (err) {
+        cleanup();
+        throw err;
+    }
+}
+//# sourceMappingURL=analysis-core.js.map