@mohasinac/appkit 2.1.1 → 2.2.0

package/dist/chunk-EEMSMWIZ.js

@@ -1,566 +0,0 @@
-import { AuthenticationError, AuthorizationError } from './chunk-IE5L2QHV.js';
-import { __spreadValues } from './chunk-2NMEKWO5.js';
-import { randomBytes, createCipheriv, createDecipheriv, createHmac } from 'crypto';
-import { useMemo } from 'react';
-import { jsx, Fragment } from 'react/jsx-runtime';
-
-// src/security/csp.ts
-function generateNonce() {
-  const bytes = new Uint8Array(16);
-  crypto.getRandomValues(bytes);
-  return btoa(String.fromCharCode(...bytes));
-}
-function buildCSP(nonce) {
-  const isDev = process.env.NODE_ENV === "development";
-  return [
-    "default-src 'self'",
-    isDev ? "script-src 'self' 'unsafe-eval' 'unsafe-inline'" : `script-src 'self' 'nonce-${nonce}'`,
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data: https: blob:",
-    "font-src 'self' data:",
-    [
-      "connect-src 'self'",
-      "https://*.googleapis.com",
-      "https://*.google.com",
-      "https://*.firebase.com",
-      "https://*.firebaseio.com",
-      "https://*.cloudfunctions.net"
-    ].join(" "),
-    "frame-src 'self' https://accounts.google.com",
-    "media-src 'self' https: blob:",
-    "worker-src 'self' blob:"
-  ].join("; ");
-}
-
-// src/security/rate-limit.ts
-function getClientIP(request) {
-  const forwarded = request.headers.get("x-forwarded-for");
-  if (forwarded) return forwarded.split(",")[0].trim();
-  const realIP = request.headers.get("x-real-ip");
-  if (realIP) return realIP;
-  return "unknown";
-}
-var upstashLimiter = null;
-async function getUpstashLimiter() {
-  if (upstashLimiter) return upstashLimiter;
-  const url = process.env.UPSTASH_REDIS_REST_URL;
-  const token = process.env.UPSTASH_REDIS_REST_TOKEN;
-  if (!url || !token) return null;
-  const { Redis } = await import('@upstash/redis');
-  const { Ratelimit } = await import('@upstash/ratelimit');
-  const redis = new Redis({ url, token });
-  const cache = /* @__PURE__ */ new Map();
-  upstashLimiter = async (ip, limit, window) => {
-    const key = `${limit}:${window}`;
-    if (!cache.has(key)) {
-      cache.set(
-        key,
-        new Ratelimit({
-          redis,
-          limiter: Ratelimit.slidingWindow(limit, `${window} s`),
-          prefix: "mohasinac:rl"
-        })
-      );
-    }
-    const result = await cache.get(key).limit(ip);
-    const reset = Math.ceil(result.reset / 1e3);
-    return {
-      success: result.success,
-      limit: result.limit,
-      remaining: result.remaining,
-      reset,
-      error: result.success ? void 0 : `Rate limit exceeded. Try again at ${new Date(reset * 1e3).toISOString()}`
-    };
-  };
-  return upstashLimiter;
-}
-var memStore = /* @__PURE__ */ new Map();
-function inMemoryLimit(identifier, limit, window) {
-  const now = Date.now();
-  const windowMs = window * 1e3;
-  let entry = memStore.get(identifier);
-  if (!entry || now > entry.resetAt) {
-    entry = { count: 0, resetAt: now + windowMs };
-    memStore.set(identifier, entry);
-  }
-  entry.count++;
-  const remaining = Math.max(0, limit - entry.count);
-  const reset = Math.ceil(entry.resetAt / 1e3);
-  if (entry.count > limit) {
-    return {
-      success: false,
-      limit,
-      remaining: 0,
-      reset,
-      error: `Rate limit exceeded. Try again in ${Math.ceil((entry.resetAt - now) / 1e3)} seconds`
-    };
-  }
-  return { success: true, limit, remaining, reset };
-}
-async function rateLimit(request, config = { limit: 10, window: 60 }) {
-  const identifier = config.identifier || getClientIP(request);
-  const limiter = await getUpstashLimiter();
-  if (limiter) return limiter(identifier, config.limit, config.window);
-  return inMemoryLimit(identifier, config.limit, config.window);
-}
-var applyRateLimit = rateLimit;
-async function rateLimitByIdentifier(identifier, config = { limit: 60, window: 60 }) {
-  const limiter = await getUpstashLimiter();
-  if (limiter) return limiter(identifier, config.limit, config.window);
-  return inMemoryLimit(identifier, config.limit, config.window);
-}
-var RateLimitPresets = {
-  STRICT: { limit: 5, window: 60 },
-  AUTH: { limit: 10, window: 60 },
-  API: { limit: 60, window: 60 },
-  GENEROUS: { limit: 100, window: 60 },
-  PASSWORD_RESET: { limit: 3, window: 3600 },
-  EMAIL_VERIFICATION: { limit: 5, window: 3600 }
-};
-function clearRateLimitStore() {
-  memStore.clear();
-}
-
-// src/security/authorization.ts
-var ROLE_HIERARCHY = {
-  admin: 4,
-  moderator: 3,
-  seller: 2,
-  user: 1
-};
-var MSG = {
-  NOT_AUTHENTICATED: "Please log in to continue",
-  FORBIDDEN: "You do not have permission to perform this action",
-  EMAIL_NOT_VERIFIED: "Please verify your email address before logging in",
-  ACCOUNT_DISABLED: "Your account has been disabled. Please contact support"
-};
-function requireAuth(user) {
-  if (!user) {
-    throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
-  }
-}
-function requireRole(user, roles) {
-  if (!user) throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
-  const requiredRoles = Array.isArray(roles) ? roles : [roles];
-  const userRole = user.role || "user";
-  if (!requiredRoles.includes(userRole)) {
-    throw new AuthorizationError(MSG.FORBIDDEN);
-  }
-}
-function requireOwnership(user, resourceOwnerId) {
-  if (!user) throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
-  if (user.uid !== resourceOwnerId) {
-    throw new AuthorizationError(MSG.FORBIDDEN);
-  }
-}
-function requireEmailVerified(user) {
-  if (!user) throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
-  if (!user.emailVerified) throw new AuthorizationError(MSG.EMAIL_NOT_VERIFIED);
-}
-function requireActiveAccount(user) {
-  if (!user) throw new AuthenticationError(MSG.NOT_AUTHENTICATED);
-  if (user.disabled) throw new AuthorizationError(MSG.ACCOUNT_DISABLED);
-}
-function canChangeRole(currentUserRole, targetCurrentRole, targetNewRole) {
-  if (currentUserRole === "admin") return true;
-  if (currentUserRole === "moderator") {
-    return targetCurrentRole === "user" && targetNewRole === "seller";
-  }
-  return false;
-}
-function getRoleLevel(role) {
-  var _a;
-  return (_a = ROLE_HIERARCHY[role]) != null ? _a : 0;
-}
-
-// src/security/pii-redact.ts
-var MAX_DEPTH = 10;
-var REDACT_KEYS = /* @__PURE__ */ new Set([
-  "password",
-  "secret",
-  "apiKey",
-  "apiSecret",
-  "token",
-  "refreshToken",
-  "accessToken",
-  "authorization",
-  "cookie",
-  "sessionToken",
-  "accountNumber",
-  "ifscCode",
-  "upiId",
-  "bankAccount",
-  "pan",
-  "panNumber",
-  "aadhar",
-  "aadhaar",
-  "ssn",
-  "gstin",
-  "gstNumber",
-  "addressLine1",
-  "addressLine2",
-  "address",
-  "shippingAddress",
-  "postalCode",
-  "pincode",
-  "zipCode"
-]);
-var EMAIL_KEYS = /* @__PURE__ */ new Set([
-  "email",
-  "userEmail",
-  "sellerEmail",
-  "shiprocketEmail"
-]);
-var PHONE_KEYS = /* @__PURE__ */ new Set(["phone", "phoneNumber", "mobileNumber"]);
-var NAME_KEYS = /* @__PURE__ */ new Set([
-  "displayName",
-  "fullName",
-  "firstName",
-  "lastName",
-  "userName"
-]);
-var IP_KEYS = /* @__PURE__ */ new Set(["ip", "ipAddress"]);
-function maskEmail(value) {
-  const atIndex = value.indexOf("@");
-  if (atIndex <= 0) return "[REDACTED]";
-  const local = value.slice(0, atIndex);
-  const domain = value.slice(atIndex);
-  if (local.length <= 2) return `${local[0]}***${domain}`;
-  return `${local.slice(0, 2)}***${domain}`;
-}
-function maskPhone(value) {
-  const digits = value.replace(/\D/g, "");
-  if (digits.length < 4) return "[REDACTED]";
-  return `***${digits.slice(-4)}`;
-}
-function maskName(value) {
-  if (!value || value.length < 2) return "[REDACTED]";
-  return `${value[0]}${"*".repeat(Math.min(value.length - 1, 8))}`;
-}
-function maskIp(value) {
-  const parts = value.split(".");
-  if (parts.length === 4) return `${parts[0]}.***.***.***`;
-  return "[REDACTED]";
-}
-function redactStringValue(key, value) {
-  if (REDACT_KEYS.has(key)) return "[REDACTED]";
-  if (EMAIL_KEYS.has(key)) return maskEmail(value);
-  if (PHONE_KEYS.has(key)) return maskPhone(value);
-  if (NAME_KEYS.has(key)) return maskName(value);
-  if (IP_KEYS.has(key)) return maskIp(value);
-  return value;
-}
-function redactPii(data, depth = 0) {
-  if (depth > MAX_DEPTH) return "[MAX_DEPTH]";
-  if (data === null || data === void 0) return data;
-  if (typeof data !== "object") return data;
-  if (Array.isArray(data)) {
-    return data.map((item) => redactPii(item, depth + 1));
-  }
-  const result = {};
-  for (const [key, value] of Object.entries(data)) {
-    if (typeof value === "string") {
-      result[key] = redactStringValue(key, value);
-    } else if (typeof value === "object" && value !== null) {
-      result[key] = redactPii(value, depth + 1);
-    } else {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-var ALGO = "aes-256-gcm";
-var ENC_PREFIX = "enc:v1:";
-var HMAC_PREFIX = "hmac-sha256:";
-function getEncKey() {
-  var _a;
-  const raw = (_a = process.env["PII_ENCRYPTION_KEY"]) != null ? _a : "";
-  if (!raw)
-    throw new Error(
-      "PII_ENCRYPTION_KEY env var is not set \u2014 cannot encrypt PII fields"
-    );
-  return Buffer.from(raw, "hex");
-}
-function getHmacKey() {
-  var _a, _b;
-  const raw = (_b = (_a = process.env["PII_HMAC_KEY"]) != null ? _a : process.env["PII_ENCRYPTION_KEY"]) != null ? _b : "";
-  if (!raw)
-    throw new Error(
-      "PII_HMAC_KEY env var is not set \u2014 cannot generate blind PII index"
-    );
-  return Buffer.from(raw, "hex");
-}
-function encryptValue(plaintext) {
-  const key = getEncKey();
-  const iv = randomBytes(12);
-  const cipher = createCipheriv(ALGO, key, iv);
-  const enc = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${ENC_PREFIX}${iv.toString("base64")}:${enc.toString("base64")}:${tag.toString("base64")}`;
-}
-function decryptValue(ciphertext) {
-  if (!ciphertext.startsWith(ENC_PREFIX)) return ciphertext;
-  const inner = ciphertext.slice(ENC_PREFIX.length);
-  const parts = inner.split(":");
-  if (parts.length !== 3) throw new Error(`Invalid PII ciphertext: ${ciphertext}`);
-  const [ivB64, encB64, tagB64] = parts;
-  const key = getEncKey();
-  const iv = Buffer.from(ivB64, "base64");
-  const encrypted = Buffer.from(encB64, "base64");
-  const tag = Buffer.from(tagB64, "base64");
-  const decipher = createDecipheriv(ALGO, key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString(
-    "utf8"
-  );
-}
-function hmacBlindIndex(value) {
-  const key = getHmacKey();
-  const hash = createHmac("sha256", key).update(value).digest("hex");
-  return `${HMAC_PREFIX}${hash}`;
-}
-function encryptPiiFields(doc, piiFields) {
-  const result = __spreadValues({}, doc);
-  for (const field of piiFields) {
-    const value = doc[field];
-    if (typeof value !== "string" || !value) continue;
-    if (value.startsWith(ENC_PREFIX)) continue;
-    result[field] = encryptValue(value);
-    result[`${field}Index`] = hmacBlindIndex(value);
-  }
-  return result;
-}
-function decryptPiiFields(doc, piiFields) {
-  const result = __spreadValues({}, doc);
-  for (const field of piiFields) {
-    const value = doc[field];
-    if (typeof value === "string" && value.startsWith(ENC_PREFIX)) {
-      result[field] = decryptValue(value);
-    }
-  }
-  return result;
-}
-
-// src/security/rbac/default-roles.ts
-var DEFAULT_ROLES = {
-  super_admin: {
-    label: "Super Admin",
-    permissions: ["*"],
-    inherits: []
-  },
-  admin: {
-    label: "Admin",
-    permissions: [
-      "admin:access",
-      "admin:settings",
-      "admin:users",
-      "admin:orders",
-      "admin:orders:refund",
-      "admin:products",
-      "admin:reviews",
-      "admin:analytics",
-      "admin:activity",
-      "admin:sessions",
-      "admin:newsletter",
-      "admin:search",
-      "admin:feature-flags",
-      "admin:cms",
-      "admin:payouts",
-      "admin:kyc"
-    ],
-    inherits: ["moderator"]
-  },
-  moderator: {
-    label: "Moderator",
-    permissions: [
-      "admin:access",
-      "admin:reviews",
-      "admin:products",
-      "content:reviews:moderate",
-      "content:products:moderate",
-      "content:orders:support"
-    ],
-    inherits: []
-  },
-  seller: {
-    label: "Seller",
-    permissions: [
-      "seller:access",
-      "seller:products:read",
-      "seller:products:write",
-      "seller:products:delete",
-      "seller:orders:read",
-      "seller:orders:fulfill",
-      "seller:analytics",
-      "seller:coupons",
-      "seller:store",
-      "seller:payouts:read",
-      "seller:shipping"
-    ],
-    inherits: ["user"]
-  },
-  user: {
-    label: "User",
-    permissions: [
-      "user:profile",
-      "user:orders",
-      "user:orders:cancel",
-      "user:reviews",
-      "user:wishlist",
-      "user:addresses",
-      "user:chat",
-      "user:offers",
-      "user:auctions"
-    ],
-    inherits: []
-  },
-  support_agent: {
-    label: "Support Agent",
-    permissions: [
-      "admin:access",
-      "admin:orders",
-      "content:orders:support",
-      "admin:users"
-    ],
-    inherits: []
-  }
-};
-
-// src/security/rbac/resolver.ts
-function resolvePermissions(userRoles, config) {
-  const { roles, multiRoleStrategy = "union" } = config;
-  function getPermissionsForRole(roleKey, visited = /* @__PURE__ */ new Set()) {
-    var _a;
-    if (visited.has(roleKey)) return /* @__PURE__ */ new Set();
-    visited.add(roleKey);
-    const def = roles[roleKey];
-    if (!def) return /* @__PURE__ */ new Set();
-    const own = new Set(def.permissions);
-    if (own.has("*")) return /* @__PURE__ */ new Set(["*"]);
-    for (const inherited of (_a = def.inherits) != null ? _a : []) {
-      for (const p of getPermissionsForRole(inherited, visited)) {
-        own.add(p);
-      }
-    }
-    return own;
-  }
-  if (userRoles.length === 0) return /* @__PURE__ */ new Set();
-  const sets = userRoles.map((r) => getPermissionsForRole(r));
-  if (multiRoleStrategy === "intersection") {
-    return sets.reduce(
-      (acc, set) => new Set([...acc].filter((p) => set.has(p)))
-    );
-  }
-  return sets.reduce(
-    (acc, set) => /* @__PURE__ */ new Set([...acc, ...set]),
-    /* @__PURE__ */ new Set()
-  );
-}
-function hasPermission(permissions, required) {
-  return permissions.has("*") || permissions.has(required);
-}
-function hasAllPermissions(permissions, required) {
-  return required.every((p) => hasPermission(permissions, p));
-}
-function hasAnyPermission(permissions, required) {
-  return required.some((p) => hasPermission(permissions, p));
-}
-function createRbacHook(config, getUserRoles) {
-  return function useRBAC() {
-    var _a;
-    const userRoles = (_a = getUserRoles()) != null ? _a : [];
-    const permissions = useMemo(
-      () => resolvePermissions(userRoles, config),
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      [userRoles.join(",")]
-    );
-    return {
-      can: (permission) => hasPermission(permissions, permission),
-      canAll: (perms) => hasAllPermissions(permissions, perms),
-      canAny: (perms) => hasAnyPermission(permissions, perms),
-      roles: userRoles,
-      permissions,
-      isAdmin: hasPermission(permissions, "admin:access"),
-      isSeller: hasPermission(permissions, "seller:access")
-    };
-  };
-}
-function Can({
-  permission,
-  permissions,
-  mode = "all",
-  fallback = null,
-  children,
-  rbac
-}) {
-  const allowed = permission ? rbac.can(permission) : mode === "all" ? rbac.canAll(permissions != null ? permissions : []) : rbac.canAny(permissions != null ? permissions : []);
-  return allowed ? /* @__PURE__ */ jsx(Fragment, { children }) : /* @__PURE__ */ jsx(Fragment, { children: fallback });
-}
-
-// src/security/rbac/server.ts
-function createRequirePermission(config) {
-  return async function requirePermission(user, permission) {
-    if (!user) {
-      const { AuthenticationError: AuthenticationError2 } = await import('./errors/index.js');
-      throw new AuthenticationError2("Not authenticated");
-    }
-    const perms = resolvePermissions(user.roles, config);
-    if (!hasPermission(perms, permission)) {
-      const { AuthorizationError: AuthorizationError2 } = await import('./errors/index.js');
-      throw new AuthorizationError2(`Missing permission: ${permission}`);
-    }
-  };
-}
-function createRequirePermissionSync(config) {
-  return function requirePermission(user, permission) {
-    if (!user) {
-      throw Object.assign(new Error("Not authenticated"), { status: 401 });
-    }
-    const perms = resolvePermissions(user.roles, config);
-    if (!hasPermission(perms, permission)) {
-      throw Object.assign(new Error(`Missing permission: ${permission}`), {
-        status: 403
-      });
-    }
-  };
-}
-
-// src/security/rbac/middleware.ts
-function matchesRoute(pathname, pattern) {
-  const escaped = pattern.replace(/\[.*?\]/g, "[^/]+").replace(/:\w+\*/g, ".*").replace(/:\w+/g, "[^/]+");
-  return new RegExp(`^${escaped}(/|$)`).test(pathname);
-}
-function createRbacMiddleware(config, pageMap, getSessionUser, options = {}) {
-  var _a, _b;
-  const loginPath = (_a = options.loginPath) != null ? _a : "/auth/login";
-  const unauthorizedPath = (_b = options.unauthorizedPath) != null ? _b : "/unauthorized";
-  return async function rbacMiddleware(request, NextResponseLib) {
-    const { pathname } = request.nextUrl;
-    const entry = Object.entries(pageMap).filter(([route]) => matchesRoute(pathname, route)).sort((a, b) => b[0].length - a[0].length)[0];
-    if (!entry) return NextResponseLib.next();
-    const [, requiredPermission] = entry;
-    const user = await getSessionUser(request);
-    if (!user) {
-      return NextResponseLib.redirect(
-        new URL(
-          loginPath + `?from=${encodeURIComponent(pathname)}`,
-          request.url
-        )
-      );
-    }
-    const perms = resolvePermissions(user.roles, config);
-    if (!hasPermission(perms, requiredPermission)) {
-      return NextResponseLib.redirect(
-        new URL(
-          unauthorizedPath + `?required=${encodeURIComponent(requiredPermission)}`,
-          request.url
-        )
-      );
-    }
-    return NextResponseLib.next();
-  };
-}
-
-export { Can, DEFAULT_ROLES, ENC_PREFIX, HMAC_PREFIX, RateLimitPresets, applyRateLimit, buildCSP, canChangeRole, clearRateLimitStore, createRbacHook, createRbacMiddleware, createRequirePermission, createRequirePermissionSync, decryptPiiFields, decryptValue, encryptPiiFields, encryptValue, generateNonce, getRoleLevel, hasAllPermissions, hasAnyPermission, hasPermission, hmacBlindIndex, rateLimit, rateLimitByIdentifier, redactPii, requireActiveAccount, requireAuth, requireEmailVerified, requireOwnership, requireRole, resolvePermissions };
-//# sourceMappingURL=chunk-EEMSMWIZ.js.map
-//# sourceMappingURL=chunk-EEMSMWIZ.js.map