@moontra/moonui-pro 2.37.0 → 2.37.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@moontra/moonui-pro",
-    "version": "2.37.0",
+    "version": "2.37.1",
     "description": "Premium React components for MoonUI - Advanced UI library with 50+ pro components including performance, interactive, and gesture components",
     "type": "module",
     "main": "dist/index.mjs",

package/templates/validate-pro-route.ts

@@ -1,5 +1,5 @@
 /**
- * MoonUI Pro - Server-side License Validation Route
+ * MoonUI Pro - Server-side License Validation Route with Enhanced Security
  *
  * This route handles license validation on the server to prevent browser API calls.
  * Copy this file to: app/api/moonui/validate-pro/route.ts (App Router)
@@ -8,12 +8,22 @@
  * Required environment variables:
  * - MOONUI_LICENSE_KEY: Your MoonUI Pro license key
  * - MOONUI_ENCRYPTION_KEY (optional): Custom encryption key for cookies
+ * - MOONUI_SECURITY_HASH (auto-generated): Security checksum for validation
+ *
+ * SECURITY WARNING: Do not modify the validation logic.
+ * Any tampering will be detected and reported.
  */
 
 import { NextRequest, NextResponse } from 'next/server';
 import { cookies, headers } from 'next/headers';
 import crypto from 'crypto';
 
+// Security checksum - DO NOT MODIFY
+const SECURITY_CHECKSUM = process.env.MOONUI_SECURITY_HASH ||
+  crypto.createHash('sha256')
+    .update(`moonui-pro-${process.env.MOONUI_LICENSE_KEY || 'default'}-validation`)
+    .digest('hex');
+
 // Cache configuration
 const CACHE_DURATION = process.env.NODE_ENV === 'production'
   ? 24 * 60 * 60 * 1000  // 24 hours in production
@@ -150,10 +160,71 @@ async function validateWithMoonUIServer(
 }
 
 /**
- * Main API route handler
+ * Verify request integrity
+ */
+function verifyRequestIntegrity(request: NextRequest): boolean {
+  // Check for suspicious patterns
+  const url = new URL(request.url);
+
+  // Reject if trying to bypass with query params
+  if (url.searchParams.has('bypass') ||
+      url.searchParams.has('force') ||
+      url.searchParams.has('admin')) {
+    console.warn('[MoonUI Security] Suspicious query params detected');
+    return false;
+  }
+
+  // Check request headers for tampering
+  const suspiciousHeaders = [
+    'x-moonui-bypass',
+    'x-force-pro',
+    'x-admin-override'
+  ];
+
+  for (const header of suspiciousHeaders) {
+    if (request.headers.has(header)) {
+      console.warn(`[MoonUI Security] Suspicious header detected: ${header}`);
+      return false;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Generate validation signature for response
+ */
+function generateValidationSignature(data: any): string {
+  const payload = JSON.stringify({
+    ...data,
+    timestamp: Date.now(),
+    checksum: SECURITY_CHECKSUM,
+  });
+
+  return crypto
+    .createHash('sha256')
+    .update(payload)
+    .digest('hex')
+    .substring(0, 16);
+}
+
+/**
+ * Main API route handler with enhanced security
  */
 export async function GET(request: NextRequest) {
   try {
+    // Security check
+    if (!verifyRequestIntegrity(request)) {
+      return NextResponse.json(
+        {
+          error: 'Invalid request',
+          valid: false,
+          hasProAccess: false
+        },
+        { status: 403 }
+      );
+    }
+
     // Generate device fingerprint
     const deviceId = await getDeviceFingerprint(request);
 
@@ -208,7 +279,8 @@ export async function GET(request: NextRequest) {
       maxAge: CACHE_DURATION / 1000, // Convert to seconds
     });
 
-    return NextResponse.json({
+    // Prepare response data
+    const responseData = {
       valid: validation.valid,
       hasProAccess: validation.hasProAccess,
       isAuthenticated: validation.valid,
@@ -217,7 +289,19 @@ export async function GET(request: NextRequest) {
         status: validation.hasProAccess ? 'active' : 'inactive',
         plan: validation.hasProAccess ? 'lifetime' : 'free',
       },
-    });
+      _signature: generateValidationSignature({
+        valid: validation.valid,
+        hasProAccess: validation.hasProAccess,
+        deviceId: deviceId,
+      }),
+    };
+
+    // Log security events
+    if (validation.hasProAccess) {
+      console.log(`[MoonUI Security] Pro access granted for device: ${deviceId.substring(0, 8)}...`);
+    }
+
+    return NextResponse.json(responseData);
 
   } catch (error) {
     console.error('[MoonUI] Validation error:', error);