@morojs/moro 1.0.0

package/src/core/middleware/built-in/cache.ts

@@ -0,0 +1,228 @@
+// Built-in Cache Middleware
+import { MiddlewareInterface, HookContext } from "../../../types/hooks";
+import {
+  CacheAdapter,
+  CacheOptions,
+  CachedResponse,
+} from "../../../types/cache";
+import { createFrameworkLogger } from "../../logger";
+import { createCacheAdapter } from "./adapters/cache";
+
+const logger = createFrameworkLogger("CacheMiddleware");
+
+export const cache = (options: CacheOptions = {}): MiddlewareInterface => ({
+  name: "cache",
+  version: "1.0.0",
+  metadata: {
+    name: "cache",
+    version: "1.0.0",
+    description: "Built-in cache middleware with pluggable storage adapters",
+    author: "MoroJS Team",
+  },
+
+  install: async (hooks: any, middlewareOptions: any = {}) => {
+    logger.debug("Installing cache middleware", "Installation");
+
+    // Initialize storage adapter
+    let storageAdapter: CacheAdapter;
+
+    if (
+      options.adapter &&
+      typeof options.adapter === "object" &&
+      "get" in options.adapter
+    ) {
+      storageAdapter = options.adapter as CacheAdapter;
+    } else if (typeof options.adapter === "string") {
+      storageAdapter = createCacheAdapter(
+        options.adapter,
+        options.adapterOptions,
+      );
+    } else {
+      // Default to memory cache
+      storageAdapter = createCacheAdapter("memory");
+    }
+
+    // Cache key generation
+    const generateCacheKey = (req: any, strategy?: any): string => {
+      const prefix = options.keyPrefix || "moro:cache:";
+
+      if (strategy?.key) {
+        return `${prefix}${strategy.key(req)}`;
+      }
+
+      // Default key: method + path + query
+      const query = new URLSearchParams(req.query || {}).toString();
+      return `${prefix}${req.method}:${req.path}${query ? `?${query}` : ""}`;
+    };
+
+    // Find matching strategy
+    const findStrategy = (req: any): any | undefined => {
+      if (!options.strategies) return undefined;
+
+      for (const [pattern, strategy] of Object.entries(options.strategies)) {
+        const regex = new RegExp(pattern);
+        if (regex.test(req.path)) {
+          return strategy;
+        }
+      }
+
+      return undefined;
+    };
+
+    hooks.before("request", async (context: HookContext) => {
+      const req = context.request as any;
+      const res = context.response as any;
+
+      // Only cache GET requests by default
+      if (req.method !== "GET") {
+        return;
+      }
+
+      const strategy = findStrategy(req);
+      const cacheKey = generateCacheKey(req, strategy);
+
+      // Check if caching is disabled for this request
+      if (strategy?.condition && !strategy.condition(req, res)) {
+        return;
+      }
+
+      try {
+        // Try to get from cache
+        const cachedResponse = await storageAdapter.get(cacheKey);
+
+        if (cachedResponse) {
+          logger.debug(`Cache hit: ${cacheKey}`, "CacheHit");
+
+          // Set cache headers
+          res.setHeader("X-Cache", "HIT");
+          res.setHeader("X-Cache-Key", cacheKey);
+
+          // Set HTTP cache headers
+          if (options.maxAge) {
+            res.setHeader("Cache-Control", `public, max-age=${options.maxAge}`);
+          }
+
+          if (options.vary && options.vary.length > 0) {
+            res.setHeader("Vary", options.vary.join(", "));
+          }
+
+          // Send cached response
+          res.status(cachedResponse.status || 200);
+
+          // Set cached headers
+          if (cachedResponse.headers) {
+            Object.entries(cachedResponse.headers).forEach(([key, value]) => {
+              res.setHeader(key, value as string);
+            });
+          }
+
+          if (cachedResponse.contentType) {
+            res.setHeader("Content-Type", cachedResponse.contentType);
+          }
+
+          res.send(cachedResponse.body);
+
+          // Mark as handled
+          (context as any).handled = true;
+          return;
+        }
+
+        logger.debug(`Cache miss: ${cacheKey}`, "CacheMiss");
+        res.setHeader("X-Cache", "MISS");
+        res.setHeader("X-Cache-Key", cacheKey);
+      } catch (error) {
+        logger.error("Cache retrieval error", "CacheError", {
+          error,
+          key: cacheKey,
+        });
+      }
+
+      // Store original response methods
+      const originalJson = res.json;
+      const originalSend = res.send;
+      const originalEnd = res.end;
+
+      // Wrap response methods to cache the response
+      const cacheResponse = async (body: any, contentType?: string) => {
+        try {
+          const ttl = strategy?.ttl || options.defaultTtl || 3600;
+
+          const cacheData: CachedResponse = {
+            body,
+            status: res.statusCode,
+            headers: res.getHeaders ? res.getHeaders() : {},
+            contentType: contentType || res.getHeader("Content-Type"),
+            timestamp: Date.now(),
+          };
+
+          await storageAdapter.set(cacheKey, cacheData, ttl);
+          logger.debug(
+            `Response cached: ${cacheKey} (TTL: ${ttl}s)`,
+            "CacheSet",
+          );
+        } catch (error) {
+          logger.error("Cache storage error", "CacheError", {
+            error,
+            key: cacheKey,
+          });
+        }
+      };
+
+      // Override response methods
+      res.json = function (data: any) {
+        cacheResponse(data, "application/json");
+        return originalJson.call(this, data);
+      };
+
+      res.send = function (data: any) {
+        cacheResponse(data);
+        return originalSend.call(this, data);
+      };
+
+      res.end = function (data?: any) {
+        if (data) {
+          cacheResponse(data);
+        }
+        return originalEnd.call(this, data);
+      };
+
+      // Add cache control methods
+      res.cacheControl = (directives: any) => {
+        const parts: string[] = [];
+
+        if (directives.public) parts.push("public");
+        if (directives.private) parts.push("private");
+        if (directives.noCache) parts.push("no-cache");
+        if (directives.noStore) parts.push("no-store");
+        if (directives.mustRevalidate) parts.push("must-revalidate");
+        if (directives.immutable) parts.push("immutable");
+
+        if (typeof directives.maxAge === "number")
+          parts.push(`max-age=${directives.maxAge}`);
+        if (typeof directives.staleWhileRevalidate === "number") {
+          parts.push(
+            `stale-while-revalidate=${directives.staleWhileRevalidate}`,
+          );
+        }
+
+        res.setHeader("Cache-Control", parts.join(", "));
+        return res;
+      };
+
+      // Add ETag generation
+      if (options.etag !== false) {
+        res.generateETag = (content: string | Buffer) => {
+          const crypto = require("crypto");
+          const hash = crypto.createHash("md5").update(content).digest("hex");
+          const prefix = options.etag === "weak" ? "W/" : "";
+          return `${prefix}"${hash}"`;
+        };
+      }
+    });
+
+    logger.info("Cache middleware installed", "Installation", {
+      adapter: typeof options.adapter === "string" ? options.adapter : "custom",
+      strategies: Object.keys(options.strategies || {}).length,
+    });
+  },
+});

package/src/core/middleware/built-in/cdn.ts

@@ -0,0 +1,151 @@
+// Built-in CDN Middleware
+import { MiddlewareInterface, HookContext } from "../../../types/hooks";
+import { CDNAdapter, CDNOptions } from "../../../types/cdn";
+import { createFrameworkLogger } from "../../logger";
+import { createCDNAdapter } from "./adapters/cdn";
+
+const logger = createFrameworkLogger("CDNMiddleware");
+
+export const cdn = (options: CDNOptions = {}): MiddlewareInterface => ({
+  name: "cdn",
+  version: "1.0.0",
+  metadata: {
+    name: "cdn",
+    version: "1.0.0",
+    description: "Built-in CDN middleware with pluggable provider adapters",
+    author: "MoroJS Team",
+  },
+
+  install: async (hooks: any, middlewareOptions: any = {}) => {
+    logger.debug("Installing CDN middleware", "Installation");
+
+    // Initialize CDN adapter
+    let cdnAdapter: CDNAdapter | null = null;
+
+    if (
+      options.adapter &&
+      typeof options.adapter === "object" &&
+      "purge" in options.adapter
+    ) {
+      cdnAdapter = options.adapter as CDNAdapter;
+    } else if (typeof options.adapter === "string") {
+      cdnAdapter = createCDNAdapter(options.adapter, options.adapterOptions);
+    }
+
+    if (!cdnAdapter) {
+      logger.warn(
+        "No CDN adapter configured, CDN features will be disabled",
+        "Installation",
+      );
+      return;
+    }
+
+    hooks.before("request", async (context: HookContext) => {
+      const req = context.request as any;
+      const res = context.response as any;
+
+      // Set CDN headers on all responses
+      if (cdnAdapter) {
+        cdnAdapter.setHeaders(res);
+      }
+
+      // Add CDN methods to response
+      res.purgeCDN = async (urls?: string[]) => {
+        if (!cdnAdapter) {
+          logger.warn(
+            "CDN purge requested but no adapter configured",
+            "CDNPurge",
+          );
+          return;
+        }
+
+        try {
+          const urlsToPurge = urls || [req.path];
+          await cdnAdapter.purge(urlsToPurge);
+          logger.info(
+            `CDN cache purged: ${urlsToPurge.join(", ")}`,
+            "CDNPurge",
+          );
+        } catch (error) {
+          logger.error("CDN purge failed", "CDNError", { error, urls });
+          throw error;
+        }
+      };
+
+      res.prefetchCDN = async (urls: string[]) => {
+        if (!cdnAdapter || !cdnAdapter.prefetch) {
+          logger.warn(
+            "CDN prefetch requested but not supported by adapter",
+            "CDNPrefetch",
+          );
+          return;
+        }
+
+        try {
+          await cdnAdapter.prefetch(urls);
+          logger.info(
+            `CDN prefetch requested: ${urls.join(", ")}`,
+            "CDNPrefetch",
+          );
+        } catch (error) {
+          logger.error("CDN prefetch failed", "CDNError", { error, urls });
+        }
+      };
+
+      res.getCDNStats = async () => {
+        if (!cdnAdapter || !cdnAdapter.getStats) {
+          logger.warn(
+            "CDN stats requested but not supported by adapter",
+            "CDNStats",
+          );
+          return null;
+        }
+
+        try {
+          const stats = await cdnAdapter.getStats();
+          logger.debug("CDN stats retrieved", "CDNStats");
+          return stats;
+        } catch (error) {
+          logger.error("CDN stats retrieval failed", "CDNError", { error });
+          return null;
+        }
+      };
+    });
+
+    // Auto-invalidation on certain patterns
+    if (options.autoInvalidate && options.invalidationPatterns) {
+      hooks.after("response", async (context: HookContext) => {
+        const req = context.request as any;
+        const res = context.response as any;
+
+        // Check if this request matches invalidation patterns
+        const shouldInvalidate = options.invalidationPatterns?.some(
+          (pattern) => {
+            const regex = new RegExp(pattern);
+            return regex.test(req.path);
+          },
+        );
+
+        if (shouldInvalidate && cdnAdapter) {
+          try {
+            await cdnAdapter.purge([req.path]);
+            logger.debug(
+              `Auto-invalidated CDN cache for: ${req.path}`,
+              "CDNAutoInvalidate",
+            );
+          } catch (error) {
+            logger.error("CDN auto-invalidation failed", "CDNError", {
+              error,
+              path: req.path,
+            });
+          }
+        }
+      });
+    }
+
+    logger.info("CDN middleware installed", "Installation", {
+      adapter: typeof options.adapter === "string" ? options.adapter : "custom",
+      autoInvalidate: !!options.autoInvalidate,
+    });
+  },
+});

package/src/core/middleware/built-in/cookie.ts

@@ -0,0 +1,90 @@
+// Cookie Middleware
+import { MiddlewareInterface, HookContext } from "../../../types/hooks";
+import { createFrameworkLogger } from "../../logger";
+
+const logger = createFrameworkLogger("CookieMiddleware");
+
+export interface CookieOptions {
+  maxAge?: number;
+  expires?: Date;
+  httpOnly?: boolean;
+  secure?: boolean;
+  sameSite?: "strict" | "lax" | "none";
+  domain?: string;
+  path?: string;
+}
+
+export const cookie = (
+  options: {
+    secret?: string;
+    signed?: boolean;
+  } = {},
+): MiddlewareInterface => ({
+  name: "cookie",
+  version: "1.0.0",
+  metadata: {
+    name: "cookie",
+    version: "1.0.0",
+    description: "Cookie parsing and setting middleware with security features",
+    author: "MoroJS Team",
+  },
+
+  install: async (hooks: any, options: any = {}) => {
+    logger.debug("Installing cookie middleware", "Installation");
+
+    hooks.before("request", async (context: HookContext) => {
+      const req = context.request as any;
+      const res = context.response as any;
+
+      // Parse cookies from request
+      req.cookies = parseCookies(req.headers.cookie || "");
+
+      // Add cookie methods to response
+      res.cookie = (
+        name: string,
+        value: string,
+        options: CookieOptions = {},
+      ) => {
+        const cookieValue = encodeURIComponent(value);
+        let cookieString = `${name}=${cookieValue}`;
+
+        if (options.maxAge) cookieString += `; Max-Age=${options.maxAge}`;
+        if (options.expires)
+          cookieString += `; Expires=${options.expires.toUTCString()}`;
+        if (options.httpOnly) cookieString += "; HttpOnly";
+        if (options.secure) cookieString += "; Secure";
+        if (options.sameSite) cookieString += `; SameSite=${options.sameSite}`;
+        if (options.domain) cookieString += `; Domain=${options.domain}`;
+        if (options.path) cookieString += `; Path=${options.path}`;
+
+        const existingCookies = res.getHeader("Set-Cookie") || [];
+        const cookies = Array.isArray(existingCookies)
+          ? [...existingCookies]
+          : [existingCookies as string];
+        cookies.push(cookieString);
+        res.setHeader("Set-Cookie", cookies);
+
+        return res;
+      };
+
+      res.clearCookie = (name: string, options: CookieOptions = {}) => {
+        const clearOptions = { ...options, expires: new Date(0), maxAge: 0 };
+        return res.cookie(name, "", clearOptions);
+      };
+    });
+  },
+});
+
+function parseCookies(cookieHeader: string): Record<string, string> {
+  const cookies: Record<string, string> = {};
+  if (!cookieHeader) return cookies;
+
+  cookieHeader.split(";").forEach((cookie) => {
+    const [name, value] = cookie.trim().split("=");
+    if (name && value) {
+      cookies[name] = decodeURIComponent(value);
+    }
+  });
+
+  return cookies;
+}

package/src/core/middleware/built-in/cors.ts

@@ -0,0 +1,38 @@
+// CORS Middleware
+import { MiddlewareInterface, HookContext } from "../../../types/hooks";
+import { createFrameworkLogger } from "../../logger";
+
+const logger = createFrameworkLogger("CorsMiddleware");
+
+export const cors = (options: any = {}): MiddlewareInterface => ({
+  name: "cors",
+  version: "1.0.0",
+  metadata: {
+    name: "cors",
+    version: "1.0.0",
+    description: "Cross-Origin Resource Sharing middleware",
+    author: "MoroJS Team",
+  },
+
+  install: async (hooks: any, options: any = {}) => {
+    logger.debug("Installing CORS middleware", "Installation", { options });
+
+    hooks.before("request", async (context: HookContext) => {
+      const response = context.response as any;
+
+      response.setHeader("Access-Control-Allow-Origin", options.origin || "*");
+      response.setHeader(
+        "Access-Control-Allow-Methods",
+        options.methods || "GET,POST,PUT,DELETE,OPTIONS",
+      );
+      response.setHeader(
+        "Access-Control-Allow-Headers",
+        options.headers || "Content-Type,Authorization",
+      );
+
+      if (options.credentials) {
+        response.setHeader("Access-Control-Allow-Credentials", "true");
+      }
+    });
+  },
+});

package/src/core/middleware/built-in/csp.ts

@@ -0,0 +1,107 @@
+// Content Security Policy Middleware
+import { MiddlewareInterface, HookContext } from "../../../types/hooks";
+import { createFrameworkLogger } from "../../logger";
+
+const logger = createFrameworkLogger("CSPMiddleware");
+
+export const csp = (
+  options: {
+    directives?: {
+      defaultSrc?: string[];
+      scriptSrc?: string[];
+      styleSrc?: string[];
+      imgSrc?: string[];
+      connectSrc?: string[];
+      fontSrc?: string[];
+      objectSrc?: string[];
+      mediaSrc?: string[];
+      frameSrc?: string[];
+      childSrc?: string[];
+      workerSrc?: string[];
+      formAction?: string[];
+      upgradeInsecureRequests?: boolean;
+      blockAllMixedContent?: boolean;
+    };
+    reportOnly?: boolean;
+    reportUri?: string;
+    nonce?: boolean;
+  } = {},
+): MiddlewareInterface => ({
+  name: "csp",
+  version: "1.0.0",
+  metadata: {
+    name: "csp",
+    version: "1.0.0",
+    description:
+      "Content Security Policy middleware with nonce support and violation reporting",
+    author: "MoroJS Team",
+  },
+
+  install: async (hooks: any, middlewareOptions: any = {}) => {
+    logger.debug("Installing CSP middleware", "Installation");
+
+    hooks.before("request", async (context: HookContext) => {
+      const req = context.request as any;
+      const res = context.response as any;
+
+      const directives = options.directives || {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'"],
+        imgSrc: ["'self'", "data:", "https:"],
+        connectSrc: ["'self'"],
+        fontSrc: ["'self'"],
+        objectSrc: ["'none'"],
+        mediaSrc: ["'self'"],
+        frameSrc: ["'none'"],
+      };
+
+      // Generate nonce if requested
+      let nonce: string | undefined;
+      if (options.nonce) {
+        const crypto = require("crypto");
+        nonce = crypto.randomBytes(16).toString("base64");
+        req.cspNonce = nonce;
+      }
+
+      // Build CSP header value
+      const cspParts: string[] = [];
+
+      for (const [directive, sources] of Object.entries(directives)) {
+        if (directive === "upgradeInsecureRequests" && sources === true) {
+          cspParts.push("upgrade-insecure-requests");
+        } else if (directive === "blockAllMixedContent" && sources === true) {
+          cspParts.push("block-all-mixed-content");
+        } else if (Array.isArray(sources)) {
+          let sourceList = sources.join(" ");
+
+          // Add nonce to script-src and style-src if enabled
+          if (
+            nonce &&
+            (directive === "scriptSrc" || directive === "styleSrc")
+          ) {
+            sourceList += ` 'nonce-${nonce}'`;
+          }
+
+          // Convert camelCase to kebab-case
+          const kebabDirective = directive
+            .replace(/([A-Z])/g, "-$1")
+            .toLowerCase();
+          cspParts.push(`${kebabDirective} ${sourceList}`);
+        }
+      }
+
+      // Add report-uri if specified
+      if (options.reportUri) {
+        cspParts.push(`report-uri ${options.reportUri}`);
+      }
+
+      const cspValue = cspParts.join("; ");
+      const headerName = options.reportOnly
+        ? "Content-Security-Policy-Report-Only"
+        : "Content-Security-Policy";
+
+      res.setHeader(headerName, cspValue);
+    });
+  },
+});

package/src/core/middleware/built-in/csrf.ts

@@ -0,0 +1,87 @@
+// CSRF Protection Middleware
+import { MiddlewareInterface, HookContext } from "../../../types/hooks";
+import { createFrameworkLogger } from "../../logger";
+
+const logger = createFrameworkLogger("CSRFMiddleware");
+
+export const csrf = (
+  options: {
+    secret?: string;
+    tokenLength?: number;
+    cookieName?: string;
+    headerName?: string;
+    ignoreMethods?: string[];
+    sameSite?: boolean;
+  } = {},
+): MiddlewareInterface => ({
+  name: "csrf",
+  version: "1.0.0",
+  metadata: {
+    name: "csrf",
+    version: "1.0.0",
+    description:
+      "CSRF protection middleware with token generation and validation",
+    author: "MoroJS Team",
+  },
+
+  install: async (hooks: any, middlewareOptions: any = {}) => {
+    logger.debug("Installing CSRF middleware", "Installation");
+
+    const secret = options.secret || "moro-csrf-secret";
+    const tokenLength = options.tokenLength || 32;
+    const cookieName = options.cookieName || "_csrf";
+    const headerName = options.headerName || "x-csrf-token";
+    const ignoreMethods = options.ignoreMethods || ["GET", "HEAD", "OPTIONS"];
+
+    const generateToken = () => {
+      const crypto = require("crypto");
+      return crypto.randomBytes(tokenLength).toString("hex");
+    };
+
+    const verifyToken = (token: string, sessionToken: string) => {
+      return token && sessionToken && token === sessionToken;
+    };
+
+    hooks.before("request", async (context: HookContext) => {
+      const req = context.request as any;
+      const res = context.response as any;
+
+      // Add CSRF token generation method
+      req.csrfToken = () => {
+        if (!req._csrfToken) {
+          req._csrfToken = generateToken();
+          // Set token in cookie
+          res.cookie(cookieName, req._csrfToken, {
+            httpOnly: true,
+            sameSite: options.sameSite !== false ? "strict" : undefined,
+            secure:
+              req.headers["x-forwarded-proto"] === "https" ||
+              (req.socket as any).encrypted,
+          });
+        }
+        return req._csrfToken;
+      };
+
+      // Skip verification for safe methods
+      if (ignoreMethods.includes(req.method!)) {
+        return;
+      }
+
+      // Get token from header or body
+      const token =
+        req.headers[headerName] ||
+        (req.body && req.body._csrf) ||
+        (req.query && req.query._csrf);
+
+      // Get session token from cookie
+      const sessionToken = req.cookies?.[cookieName];
+
+      if (!verifyToken(token as string, sessionToken || "")) {
+        const error = new Error("Invalid CSRF token");
+        (error as any).status = 403;
+        (error as any).code = "CSRF_TOKEN_MISMATCH";
+        throw error;
+      }
+    });
+  },
+});