@nathapp/nestjs-csrf 3.3.0

package/.turbo/turbo-build.log

@@ -0,0 +1,4 @@
+
+> @nathapp/nestjs-csrf@3.3.0 build
+> rimraf dist && tsc -p tsconfig.json
+

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# @nathapp/nestjs-csrf
+
+## 3.3.0
+
+### Minor Changes
+
+- a27440f: 3.3.0 milestone release. The `@nathapp/nestjs-*` packages now version and publish in lockstep at a unified version.
+
+  - **nestjs-csrf**: first public release — stateless double-submit-cookie CSRF guard (zero-dep HMAC, Express + Fastify, Bearer coexist skip, `@SkipCsrf()`, auto-binds `APP_GUARD`).
+  - **nestjs-health**: first public release — terminus aggregator over cache/prisma/queue with k8s liveness/readiness probes via a dynamic controller factory.
+  - **nestjs-idempotency**: first public release — `@Idempotent()` interceptor (zero-dep sha256 fingerprint, Express + Fastify, 409-in-flight, 2xx replay, fingerprint mismatch 422, fail-closed on store error).
+  - **nestjs-observability**: first public release — Prometheus RED metrics + OpenTelemetry tracing joined to the logging ALS; `initTracing()` pre-bootstrap hook.
+  - **nestjs-outbox**: first public release — transactional outbox relay (at-least-once via `ITransactionManager`, lease-claim + backoff, dead-letter).
+  - **nestjs-storage**: migrated from aws-sdk v2 to v3 (zero runtime dep via `import type` + lazy `loadPackage`); NFSStorage stub replaced with an S3-style HTTP file-service client.
+  - **nestjs-cache**: `delByPattern` now routes through Redis SCAN instead of an O(n) key sweep, with glob-detection and multi-tier iterator support.

package/README.md

@@ -0,0 +1,29 @@
+# @nathapp/nestjs-csrf
+
+Stateless double-submit-cookie CSRF protection for NestJS, working on both the
+Express and Fastify adapters, with **zero runtime dependencies** (Node `crypto` only).
+
+## Design
+
+- **Double-submit cookie (stateless)** — no server-side session store. The guard
+  auto-issues an HMAC-signed token as a cookie on safe (GET/HEAD/OPTIONS) responses;
+  the client echoes it in the `x-csrf-token` header on mutating requests, and the
+  guard verifies the two match.
+- **Guard-only** — `DefaultCsrfGuard` performs both auto-issue and verification;
+  `CsrfTokenService` is the pure stdlib-HMAC mint/verify core.
+- **Coexists with bearer auth** — routes carrying `Authorization: Bearer …` are
+  skipped by default (a browser cannot silently attach that header cross-site).
+- **Disable-able** — globally via the module `enabled` flag, and per-route via the
+  `@SkipCsrf()` decorator.
+
+## Assumed peer setup
+
+The host app **must enable cookie parsing** so `req.cookies` is populated:
+
+- Express: `app.use(cookieParser())` (`cookie-parser`)
+- Fastify: `app.register(require('@fastify/cookie'))` (`@fastify/cookie`)
+
+These are not auto-wired. If cookie parsing is not enabled, mutating requests fail
+closed (403).
+
+See `docs/superpowers/specs/2026-07-08-nestjs-csrf-design.md`.

package/dist/constant/csrf.constants.d.ts

@@ -0,0 +1,2 @@
+export declare const CSRF_MODULE_OPTIONS: unique symbol;
+export declare const SKIP_CSRF_METADATA_KEY: unique symbol;

package/dist/constant/csrf.constants.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SKIP_CSRF_METADATA_KEY = exports.CSRF_MODULE_OPTIONS = void 0;
+exports.CSRF_MODULE_OPTIONS = Symbol.for('@nathapp/nestjs-csrf/options');
+exports.SKIP_CSRF_METADATA_KEY = Symbol.for('@nathapp/nestjs-csrf/skip');
+//# sourceMappingURL=csrf.constants.js.map

package/dist/constant/csrf.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.constants.js","sourceRoot":"","sources":["../../lib/constant/csrf.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;AAEjE,QAAA,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC"}

package/dist/constant/index.d.ts

@@ -0,0 +1 @@
+export { CSRF_MODULE_OPTIONS, SKIP_CSRF_METADATA_KEY } from './csrf.constants';

package/dist/constant/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SKIP_CSRF_METADATA_KEY = exports.CSRF_MODULE_OPTIONS = void 0;
+var csrf_constants_1 = require("./csrf.constants");
+Object.defineProperty(exports, "CSRF_MODULE_OPTIONS", { enumerable: true, get: function () { return csrf_constants_1.CSRF_MODULE_OPTIONS; } });
+Object.defineProperty(exports, "SKIP_CSRF_METADATA_KEY", { enumerable: true, get: function () { return csrf_constants_1.SKIP_CSRF_METADATA_KEY; } });
+//# sourceMappingURL=index.js.map

package/dist/constant/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/constant/index.ts"],"names":[],"mappings":";;;AAAA,mDAA+E;AAAtE,qHAAA,mBAAmB,OAAA;AAAE,wHAAA,sBAAsB,OAAA"}

package/dist/decorator/index.d.ts

@@ -0,0 +1 @@
+export { SkipCsrf } from './skip-csrf.decorator';

package/dist/decorator/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkipCsrf = void 0;
+var skip_csrf_decorator_1 = require("./skip-csrf.decorator");
+Object.defineProperty(exports, "SkipCsrf", { enumerable: true, get: function () { return skip_csrf_decorator_1.SkipCsrf; } });
+//# sourceMappingURL=index.js.map

package/dist/decorator/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/decorator/index.ts"],"names":[],"mappings":";;;AAAA,6DAAiD;AAAxC,+GAAA,QAAQ,OAAA"}

package/dist/decorator/skip-csrf.decorator.d.ts

@@ -0,0 +1 @@
+export declare function SkipCsrf(): MethodDecorator & ClassDecorator;

package/dist/decorator/skip-csrf.decorator.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkipCsrf = SkipCsrf;
+const common_1 = require("@nestjs/common");
+const csrf_constants_1 = require("../constant/csrf.constants");
+function SkipCsrf() {
+    return (0, common_1.SetMetadata)(csrf_constants_1.SKIP_CSRF_METADATA_KEY, true);
+}
+//# sourceMappingURL=skip-csrf.decorator.js.map

package/dist/decorator/skip-csrf.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skip-csrf.decorator.js","sourceRoot":"","sources":["../../lib/decorator/skip-csrf.decorator.ts"],"names":[],"mappings":";;AAGA,4BAEC;AALD,2CAA6C;AAC7C,+DAAoE;AAEpE,SAAgB,QAAQ;IACtB,OAAO,IAAA,oBAAW,EAAC,uCAAsB,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC"}

package/dist/guard/csrf.guard.d.ts

@@ -0,0 +1,13 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { CsrfOptions } from '../interface/csrf-options.interface';
+import { CsrfTokenService } from '../service/csrf-token.service';
+export declare class DefaultCsrfGuard implements CanActivate {
+    private readonly tokens;
+    private readonly reflector;
+    private readonly logger;
+    private readonly options;
+    constructor(rawOptions: CsrfOptions, tokens: CsrfTokenService, reflector: Reflector);
+    canActivate(context: ExecutionContext): boolean;
+    private issue;
+}

package/dist/guard/csrf.guard.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var DefaultCsrfGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultCsrfGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const nestjs_common_1 = require("@nathapp/nestjs-common");
+const csrf_constants_1 = require("../constant/csrf.constants");
+const csrf_token_service_1 = require("../service/csrf-token.service");
+const resolve_options_1 = require("../service/resolve-options");
+let DefaultCsrfGuard = DefaultCsrfGuard_1 = class DefaultCsrfGuard {
+    constructor(rawOptions, tokens, reflector) {
+        this.tokens = tokens;
+        this.reflector = reflector;
+        this.logger = new common_1.Logger(DefaultCsrfGuard_1.name);
+        this.options = (0, resolve_options_1.resolveCsrfOptions)(rawOptions);
+    }
+    canActivate(context) {
+        var _a, _b, _c, _d, _e;
+        if (this.options.enabled === false)
+            return true;
+        const http = context.switchToHttp();
+        const req = http.getRequest();
+        const res = http.getResponse();
+        if (this.options.ignoreMethods.includes(((_a = req.method) !== null && _a !== void 0 ? _a : '').toUpperCase())) {
+            const existingCookie = (_b = req.cookies) === null || _b === void 0 ? void 0 : _b[this.options.cookie.name];
+            if (!existingCookie) {
+                this.issue(res);
+            }
+            return true;
+        }
+        const reflectionTargets = [context.getHandler(), context.getClass()];
+        const validTargets = reflectionTargets.filter((t) => t != null);
+        if (validTargets.length > 0 &&
+            this.reflector.getAllAndOverride(csrf_constants_1.SKIP_CSRF_METADATA_KEY, validTargets)) {
+            return true;
+        }
+        if (this.options.skipWhenBearer &&
+            typeof ((_c = req.headers) === null || _c === void 0 ? void 0 : _c['authorization']) === 'string' &&
+            /^Bearer\s/i.test(req.headers['authorization'])) {
+            return true;
+        }
+        const cookie = (_d = req.cookies) === null || _d === void 0 ? void 0 : _d[this.options.cookie.name];
+        const headerValue = (_e = req.headers) === null || _e === void 0 ? void 0 : _e[this.options.headerName];
+        const header = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+        if (!this.tokens.verify(this.options.secret, cookie, header)) {
+            throw new nestjs_common_1.ForbiddenAppException({ reason: 'csrf_token_invalid' });
+        }
+        return true;
+    }
+    issue(res) {
+        const token = this.tokens.mint(this.options.secret);
+        const { name, ...opts } = this.options.cookie;
+        if (typeof res.setCookie === 'function') {
+            res.setCookie(name, token, opts);
+        }
+        else if (typeof res.cookie === 'function') {
+            res.cookie(name, token, opts);
+        }
+        else {
+            this.logger.warn('Unable to issue CSRF cookie: response object exposes neither setCookie nor cookie. ' +
+                'Ensure cookie-parser (Express) or @fastify/cookie (Fastify) is registered.');
+        }
+    }
+};
+exports.DefaultCsrfGuard = DefaultCsrfGuard;
+exports.DefaultCsrfGuard = DefaultCsrfGuard = DefaultCsrfGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(csrf_constants_1.CSRF_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object, csrf_token_service_1.CsrfTokenService,
+        core_1.Reflector])
+], DefaultCsrfGuard);
+//# sourceMappingURL=csrf.guard.js.map

package/dist/guard/csrf.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.guard.js","sourceRoot":"","sources":["../../lib/guard/csrf.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAyC;AACzC,0DAA+D;AAC/D,+DAAyF;AAEzF,sEAAiE;AACjE,gEAAgE;AAGzD,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAI3B,YAC+B,UAAuB,EACnC,MAAwB,EACxB,SAAoB;QADpB,WAAM,GAAN,MAAM,CAAkB;QACxB,cAAS,GAAT,SAAS,CAAW;QANtB,WAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;QAQ1D,IAAI,CAAC,OAAO,GAAG,IAAA,oCAAkB,EAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,OAAyB;;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAEhD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAKvB,CAAC;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAGxB,CAAC;QAEL,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,cAAc,GAAG,MAAA,GAAG,CAAC,OAAO,0CAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,iBAAiB,GAAe,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjF,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,IAAI,IAAI,CAChC,CAAC;QACF,IACE,YAAY,CAAC,MAAM,GAAG,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,uCAAsB,EAAE,YAAY,CAAC,EACtE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,IAAI,CAAC,OAAO,CAAC,cAAc;YAC3B,OAAO,CAAA,MAAA,GAAG,CAAC,OAAO,0CAAG,eAAe,CAAC,CAAA,KAAK,QAAQ;YAClD,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAW,CAAC,EACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAA,GAAG,CAAC,OAAO,0CAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAA,GAAG,CAAC,OAAO,0CAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAEzE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,qCAAqB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,GAGb;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9C,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACxC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qFAAqF;gBACnF,4EAA4E,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAlFY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,oCAAmB,CAAC,CAAA;6CACH,qCAAgB;QACb,gBAAS;GAP5B,gBAAgB,CAkF5B"}

package/dist/guard/index.d.ts

@@ -0,0 +1 @@
+export { DefaultCsrfGuard } from './csrf.guard';

package/dist/guard/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultCsrfGuard = void 0;
+var csrf_guard_1 = require("./csrf.guard");
+Object.defineProperty(exports, "DefaultCsrfGuard", { enumerable: true, get: function () { return csrf_guard_1.DefaultCsrfGuard; } });
+//# sourceMappingURL=index.js.map

package/dist/guard/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/guard/index.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { CSRF_MODULE_OPTIONS, SKIP_CSRF_METADATA_KEY } from './constant';
+export { CsrfAsyncModuleOptions, CsrfModule } from './module';
+export { CsrfTokenService, resolveCsrfOptions } from './service';
+export { DefaultCsrfGuard } from './guard';
+export { SkipCsrf } from './decorator';
+export { CsrfCookieOptions, CsrfModuleOptionsFactory, CsrfOptions, CsrfSameSite, ResolvedCsrfOptions, } from './interface';

package/dist/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkipCsrf = exports.DefaultCsrfGuard = exports.resolveCsrfOptions = exports.CsrfTokenService = exports.CsrfModule = exports.SKIP_CSRF_METADATA_KEY = exports.CSRF_MODULE_OPTIONS = void 0;
+var constant_1 = require("./constant");
+Object.defineProperty(exports, "CSRF_MODULE_OPTIONS", { enumerable: true, get: function () { return constant_1.CSRF_MODULE_OPTIONS; } });
+Object.defineProperty(exports, "SKIP_CSRF_METADATA_KEY", { enumerable: true, get: function () { return constant_1.SKIP_CSRF_METADATA_KEY; } });
+var module_1 = require("./module");
+Object.defineProperty(exports, "CsrfModule", { enumerable: true, get: function () { return module_1.CsrfModule; } });
+var service_1 = require("./service");
+Object.defineProperty(exports, "CsrfTokenService", { enumerable: true, get: function () { return service_1.CsrfTokenService; } });
+Object.defineProperty(exports, "resolveCsrfOptions", { enumerable: true, get: function () { return service_1.resolveCsrfOptions; } });
+var guard_1 = require("./guard");
+Object.defineProperty(exports, "DefaultCsrfGuard", { enumerable: true, get: function () { return guard_1.DefaultCsrfGuard; } });
+var decorator_1 = require("./decorator");
+Object.defineProperty(exports, "SkipCsrf", { enumerable: true, get: function () { return decorator_1.SkipCsrf; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":";;;AAAA,uCAAyE;AAAhE,+GAAA,mBAAmB,OAAA;AAAE,kHAAA,sBAAsB,OAAA;AACpD,mCAA8D;AAA7B,oGAAA,UAAU,OAAA;AAC3C,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAC7C,iCAA2C;AAAlC,yGAAA,gBAAgB,OAAA;AACzB,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA"}

package/dist/interface/csrf-options.interface.d.ts

@@ -0,0 +1,27 @@
+export type CsrfSameSite = 'lax' | 'strict' | 'none';
+export interface CsrfCookieOptions {
+    name: string;
+    path: string;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: CsrfSameSite;
+}
+export interface CsrfOptions {
+    secret: string;
+    enabled?: boolean;
+    headerName?: string;
+    ignoreMethods?: string[];
+    skipWhenBearer?: boolean;
+    cookie?: Partial<CsrfCookieOptions>;
+}
+export interface ResolvedCsrfOptions {
+    secret: string;
+    enabled: boolean;
+    headerName: string;
+    ignoreMethods: string[];
+    skipWhenBearer: boolean;
+    cookie: CsrfCookieOptions;
+}
+export interface CsrfModuleOptionsFactory {
+    createOptions(): Promise<CsrfOptions> | CsrfOptions;
+}

package/dist/interface/csrf-options.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=csrf-options.interface.js.map

package/dist/interface/csrf-options.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-options.interface.js","sourceRoot":"","sources":["../../lib/interface/csrf-options.interface.ts"],"names":[],"mappings":""}

package/dist/interface/index.d.ts

@@ -0,0 +1 @@
+export { CsrfCookieOptions, CsrfModuleOptionsFactory, CsrfOptions, CsrfSameSite, ResolvedCsrfOptions, } from './csrf-options.interface';

package/dist/interface/index.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=index.js.map

package/dist/interface/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/interface/index.ts"],"names":[],"mappings":""}

package/dist/module/csrf.module.d.ts

@@ -0,0 +1,15 @@
+import { DynamicModule, ModuleMetadata, Type } from '@nestjs/common';
+import { CsrfModuleOptionsFactory, CsrfOptions } from '../interface/csrf-options.interface';
+export type CsrfAsyncModuleOptions = Pick<ModuleMetadata, 'imports'> & {
+    useExisting?: Type<CsrfModuleOptionsFactory>;
+    useClass?: Type<CsrfModuleOptionsFactory>;
+    useFactory?: (...args: any[]) => Promise<CsrfOptions> | CsrfOptions;
+    inject?: any[];
+};
+declare const CsrfModule_base: import("@nathapp/nestjs-common").ConfigurableModuleCls<CsrfOptions, "register", "createOptions", {}>;
+export declare class CsrfModule extends CsrfModule_base {
+    static register(options: CsrfOptions): DynamicModule;
+    static registerAsync(options: CsrfAsyncModuleOptions): DynamicModule;
+    private static withCsrfProviders;
+}
+export {};

package/dist/module/csrf.module.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var CsrfModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CsrfModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const nestjs_common_1 = require("@nathapp/nestjs-common");
+const csrf_constants_1 = require("../constant/csrf.constants");
+const csrf_token_service_1 = require("../service/csrf-token.service");
+const resolve_options_1 = require("../service/resolve-options");
+const csrf_guard_1 = require("../guard/csrf.guard");
+let CsrfModule = CsrfModule_1 = class CsrfModule extends (0, nestjs_common_1.ConfigurableModuleClass)(csrf_constants_1.CSRF_MODULE_OPTIONS) {
+    static register(options) {
+        (0, resolve_options_1.resolveCsrfOptions)(options);
+        const base = super.register(options);
+        return CsrfModule_1.withCsrfProviders(base);
+    }
+    static registerAsync(options) {
+        var _a, _b;
+        const wrappedAsyncOptions = typeof options.useFactory === 'function'
+            ? {
+                ...options,
+                useFactory: async (...args) => {
+                    const resolved = await options.useFactory(...args);
+                    (0, resolve_options_1.resolveCsrfOptions)(resolved);
+                    return resolved;
+                },
+            }
+            : options;
+        const base = super.registerAsync(wrappedAsyncOptions);
+        return CsrfModule_1.withCsrfProviders(base, {
+            imports: (_a = options.imports) !== null && _a !== void 0 ? _a : ((_b = base.imports) !== null && _b !== void 0 ? _b : []),
+        });
+    }
+    static withCsrfProviders(base, overrides = {}) {
+        var _a;
+        const baseProviders = ((_a = base.providers) !== null && _a !== void 0 ? _a : []);
+        return {
+            ...base,
+            module: CsrfModule_1,
+            global: true,
+            ...overrides,
+            providers: [
+                ...baseProviders,
+                csrf_token_service_1.CsrfTokenService,
+                core_1.Reflector,
+                csrf_guard_1.DefaultCsrfGuard,
+                { provide: core_1.APP_GUARD, useExisting: csrf_guard_1.DefaultCsrfGuard },
+            ],
+            exports: [csrf_token_service_1.CsrfTokenService],
+        };
+    }
+};
+exports.CsrfModule = CsrfModule;
+exports.CsrfModule = CsrfModule = CsrfModule_1 = __decorate([
+    (0, common_1.Module)({})
+], CsrfModule);
+//# sourceMappingURL=csrf.module.js.map

package/dist/module/csrf.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.module.js","sourceRoot":"","sources":["../../lib/module/csrf.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAoD;AACpD,0DAAiE;AACjE,+DAAiE;AAEjE,sEAAiE;AACjE,gEAAgE;AAChE,oDAAuD;AAUhD,IAAM,UAAU,kBAAhB,MAAM,UAAW,SAAQ,IAAA,uCAAuB,EACrD,oCAAmB,CACpB;IACC,MAAM,CAAC,QAAQ,CAAC,OAAoB;QAClC,IAAA,oCAAkB,EAAC,OAAO,CAAC,CAAC;QAE5B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,YAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAA+B;;QAClD,MAAM,mBAAmB,GACvB,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU;YACtC,CAAC,CAAC;gBACE,GAAG,OAAO;gBACV,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;oBACnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAW,CAAC,GAAG,IAAI,CAAC,CAAC;oBACpD,IAAA,oCAAkB,EAAC,QAAQ,CAAC,CAAC;oBAC7B,OAAO,QAAQ,CAAC;gBAClB,CAAC;aACF;YACH,CAAC,CAAC,OAAO,CAAC;QAEd,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;QACtD,OAAO,YAAU,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACxC,OAAO,EAAE,MAAA,OAAO,CAAC,OAAO,mCAAI,CAAC,MAAA,IAAI,CAAC,OAAO,mCAAI,EAAE,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAC9B,IAAmB,EACnB,YAAoC,EAAE;;QAEtC,MAAM,aAAa,GAAG,CAAC,MAAA,IAAI,CAAC,SAAS,mCAAI,EAAE,CAAe,CAAC;QAE3D,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,GAAG,SAAS;YACZ,SAAS,EAAE;gBACT,GAAG,aAAa;gBAChB,qCAAgB;gBAChB,gBAAS;gBACT,6BAAgB;gBAChB,EAAE,OAAO,EAAE,gBAAS,EAAE,WAAW,EAAE,6BAAgB,EAAE;aACtD;YACD,OAAO,EAAE,CAAC,qCAAgB,CAAC;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AAlDY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAkDtB"}

package/dist/module/index.d.ts

@@ -0,0 +1 @@
+export { CsrfAsyncModuleOptions, CsrfModule } from './csrf.module';

package/dist/module/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CsrfModule = void 0;
+var csrf_module_1 = require("./csrf.module");
+Object.defineProperty(exports, "CsrfModule", { enumerable: true, get: function () { return csrf_module_1.CsrfModule; } });
+//# sourceMappingURL=index.js.map

package/dist/module/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/module/index.ts"],"names":[],"mappings":";;;AAAA,6CAAmE;AAAlC,yGAAA,UAAU,OAAA"}

package/dist/service/csrf-token.service.d.ts

@@ -0,0 +1,4 @@
+export declare class CsrfTokenService {
+    mint(secret: string): string;
+    verify(secret: string, cookieValue?: string, headerValue?: string): boolean;
+}

package/dist/service/csrf-token.service.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CsrfTokenService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+function timingSafeStrEqual(a, b) {
+    if (typeof a !== 'string' || typeof b !== 'string')
+        return false;
+    const aBuf = Buffer.from(a, 'utf8');
+    const bBuf = Buffer.from(b, 'utf8');
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return (0, crypto_1.timingSafeEqual)(aBuf, bBuf);
+}
+let CsrfTokenService = class CsrfTokenService {
+    mint(secret) {
+        const value = (0, crypto_1.randomBytes)(32).toString('hex');
+        const sig = (0, crypto_1.createHmac)('sha256', secret).update(value).digest('hex');
+        return `${value}.${sig}`;
+    }
+    verify(secret, cookieValue, headerValue) {
+        if (!cookieValue || !headerValue)
+            return false;
+        if (!timingSafeStrEqual(cookieValue, headerValue))
+            return false;
+        const dotIndex = cookieValue.indexOf('.');
+        if (dotIndex < 0)
+            return false;
+        const value = cookieValue.slice(0, dotIndex);
+        const sig = cookieValue.slice(dotIndex + 1);
+        if (!value || !sig)
+            return false;
+        const expected = (0, crypto_1.createHmac)('sha256', secret).update(value).digest('hex');
+        return timingSafeStrEqual(sig, expected);
+    }
+};
+exports.CsrfTokenService = CsrfTokenService;
+exports.CsrfTokenService = CsrfTokenService = __decorate([
+    (0, common_1.Injectable)()
+], CsrfTokenService);
+//# sourceMappingURL=csrf-token.service.js.map

package/dist/service/csrf-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-token.service.js","sourceRoot":"","sources":["../../lib/service/csrf-token.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAC5C,mCAAkE;AAElE,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,IAAI,CAAC,MAAc;QACjB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,WAAoB,EAAE,WAAoB;QAC/D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAEhE,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAE/B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,OAAO,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF,CAAA;AArBY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAqB5B"}

package/dist/service/index.d.ts

@@ -0,0 +1,2 @@
+export { CsrfTokenService } from './csrf-token.service';
+export { resolveCsrfOptions } from './resolve-options';

package/dist/service/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCsrfOptions = exports.CsrfTokenService = void 0;
+var csrf_token_service_1 = require("./csrf-token.service");
+Object.defineProperty(exports, "CsrfTokenService", { enumerable: true, get: function () { return csrf_token_service_1.CsrfTokenService; } });
+var resolve_options_1 = require("./resolve-options");
+Object.defineProperty(exports, "resolveCsrfOptions", { enumerable: true, get: function () { return resolve_options_1.resolveCsrfOptions; } });
+//# sourceMappingURL=index.js.map

package/dist/service/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/service/index.ts"],"names":[],"mappings":";;;AAAA,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,qDAAuD;AAA9C,qHAAA,kBAAkB,OAAA"}

package/dist/service/resolve-options.d.ts

@@ -0,0 +1,2 @@
+import { CsrfOptions, ResolvedCsrfOptions } from '../interface/csrf-options.interface';
+export declare function resolveCsrfOptions(options: CsrfOptions): ResolvedCsrfOptions;

package/dist/service/resolve-options.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCsrfOptions = resolveCsrfOptions;
+const DEFAULT_COOKIE_NAME = 'csrf-token';
+const DEFAULT_HEADER_NAME = 'x-csrf-token';
+const DEFAULT_IGNORE_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+const DEFAULT_COOKIE_PATH = '/';
+const DEFAULT_COOKIE_HTTP_ONLY = false;
+const DEFAULT_COOKIE_SECURE = true;
+const DEFAULT_COOKIE_SAME_SITE = 'lax';
+function resolveCsrfOptions(options) {
+    var _a, _b, _c, _d, _e;
+    const { secret, enabled = true, headerName: headerNameOverride = DEFAULT_HEADER_NAME, ignoreMethods: ignoreMethodsOverride, skipWhenBearer = true, cookie: cookieOverrides, } = options;
+    if (typeof secret !== 'string' || secret.length === 0) {
+        throw new Error('CsrfOptions.secret must be a non-empty string');
+    }
+    const headerName = headerNameOverride.toLowerCase();
+    const ignoreMethods = ignoreMethodsOverride
+        ? [...ignoreMethodsOverride]
+        : [...DEFAULT_IGNORE_METHODS];
+    const cookie = {
+        name: (_a = cookieOverrides === null || cookieOverrides === void 0 ? void 0 : cookieOverrides.name) !== null && _a !== void 0 ? _a : DEFAULT_COOKIE_NAME,
+        path: (_b = cookieOverrides === null || cookieOverrides === void 0 ? void 0 : cookieOverrides.path) !== null && _b !== void 0 ? _b : DEFAULT_COOKIE_PATH,
+        httpOnly: (_c = cookieOverrides === null || cookieOverrides === void 0 ? void 0 : cookieOverrides.httpOnly) !== null && _c !== void 0 ? _c : DEFAULT_COOKIE_HTTP_ONLY,
+        secure: (_d = cookieOverrides === null || cookieOverrides === void 0 ? void 0 : cookieOverrides.secure) !== null && _d !== void 0 ? _d : DEFAULT_COOKIE_SECURE,
+        sameSite: (_e = cookieOverrides === null || cookieOverrides === void 0 ? void 0 : cookieOverrides.sameSite) !== null && _e !== void 0 ? _e : DEFAULT_COOKIE_SAME_SITE,
+    };
+    return {
+        secret,
+        enabled,
+        headerName,
+        ignoreMethods,
+        skipWhenBearer,
+        cookie,
+    };
+}
+//# sourceMappingURL=resolve-options.js.map

package/dist/service/resolve-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-options.js","sourceRoot":"","sources":["../../lib/service/resolve-options.ts"],"names":[],"mappings":";;AAUA,gDAoCC;AA5CD,MAAM,mBAAmB,GAAG,YAAY,CAAC;AACzC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAC3C,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,wBAAwB,GAAkC,KAAK,CAAC;AAEtE,SAAgB,kBAAkB,CAAC,OAAoB;;IACrD,MAAM,EACJ,MAAM,EACN,OAAO,GAAG,IAAI,EACd,UAAU,EAAE,kBAAkB,GAAG,mBAAmB,EACpD,aAAa,EAAE,qBAAqB,EACpC,cAAc,GAAG,IAAI,EACrB,MAAM,EAAE,eAAe,GACxB,GAAG,OAAO,CAAC;IAEZ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;IAEpD,MAAM,aAAa,GAAG,qBAAqB;QACzC,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC;QAC5B,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAsB;QAChC,IAAI,EAAE,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,IAAI,mCAAI,mBAAmB;QAClD,IAAI,EAAE,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,IAAI,mCAAI,mBAAmB;QAClD,QAAQ,EAAE,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,QAAQ,mCAAI,wBAAwB;QAC/D,MAAM,EAAE,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,MAAM,mCAAI,qBAAqB;QACxD,QAAQ,EAAE,MAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,QAAQ,mCAAI,wBAAwB;KAChE,CAAC;IAEF,OAAO;QACL,MAAM;QACN,OAAO;QACP,UAAU;QACV,aAAa;QACb,cAAc;QACd,MAAM;KACP,CAAC;AACJ,CAAC"}

package/lib/constant/csrf.constants.ts

@@ -0,0 +1,3 @@
+export const CSRF_MODULE_OPTIONS = Symbol.for('@nathapp/nestjs-csrf/options');
+
+export const SKIP_CSRF_METADATA_KEY = Symbol.for('@nathapp/nestjs-csrf/skip');

package/lib/constant/index.ts

@@ -0,0 +1 @@
+export { CSRF_MODULE_OPTIONS, SKIP_CSRF_METADATA_KEY } from './csrf.constants';

package/lib/decorator/index.ts

@@ -0,0 +1 @@
+export { SkipCsrf } from './skip-csrf.decorator';

package/lib/decorator/skip-csrf.decorator.ts

@@ -0,0 +1,6 @@
+import { SetMetadata } from '@nestjs/common';
+import { SKIP_CSRF_METADATA_KEY } from '../constant/csrf.constants';
+
+export function SkipCsrf(): MethodDecorator & ClassDecorator {
+  return SetMetadata(SKIP_CSRF_METADATA_KEY, true);
+}