@rapidrest/service-core 2.2.0 → 2.3.0

package/dist/types/routes/RouteUtils.d.ts

@@ -14,11 +14,21 @@ export declare class RouteUtils {
     protected rateLimiter?: RateLimiter;
     protected trustedRoles: string[];
     protected trustedProxies: string[];
+    protected csrfConfig: any;
+    protected corsConfig: any;
     /**
      * Creates a middleware function that checks if the user has elevated privileges and if not
      * throws the `AUTH_REQUIRES_ELEVATION` error.
      */
     checkElevation(lastStart?: number): RequestHandler;
+    /**
+     * Creates a middleware function that enforces CSRF protection for a state-changing request whose only
+     * credential came from the `jwt` cookie (`req.auth?.source === "cookie"`.
+     * See `JWTAuthResult`/`JWTStrategy`). A request authenticated via an `Authorization` header, API key,
+     * or query-string token never had that cookie automatically attached by the browser, so it was never
+     * exposed to this class of forgery and is left untouched here.
+     */
+    checkCsrf(): RequestHandler;
     /**
      * Returns a canonical form of a request path for use in rate limit identifiers. The router percent-decodes
      * `:param` values, so `/clients/%61bc` and `/clients/abc` reach the same handler. Keying on the raw path would
@@ -71,6 +81,26 @@ export declare class RouteUtils {
      * @param requiredScopes The list of scopes of which the authenticated user's token must carry at least one.
      */
     checkRequiredScopes(requiredScopes: string[]): RequestHandler;
+    /**
+     * Creates a WebSocket-specific error-sanitizing middleware, appended as the last item in every
+     * `@WebSocket()` route's handler chain (see `registerRoute()`'s WS branch below). Mirrors what
+     * `Server.ts`'s `handleError()`/`serializeError()` already do for ordinary HTTP routes: an
+     * `ApiError`'s own status/code/message pass through unchanged (it's meant to reach the client),
+     * but anything else — a raw DB driver error, an unexpected throw from `RateLimiter`,
+     * `ACLUtils.findACL()`, or any other non-`ApiError` thrown by a middleware in the chain — is
+     * replaced with a generic internal error before `runChain()`'s own end-of-chain fallback can turn
+     * it into a response.
+     *
+     * This matters specifically for WebSocket routes because `runChain()`'s fallback response, for a
+     * WS route, ends up as the literal WebSocket close reason (`ws.close(1002, message)` — see
+     * `Router.ts`/`BunRouter.ts`'s `ws()` `open` handlers), visible to any client via the browser
+     * close event's `event.reason`. An ordinary HTTP route gets the same sanitization for free
+     * because `Server.ts` registers `handleError` as global middleware, which `registerRoute()`
+     * concatenates onto every HTTP route's own handler chain — but `app.ws()` is never given
+     * `globalMiddleware` (only the WS-specific chain built here), so WS routes need their own copy of
+     * the same safety net.
+     */
+    sanitizeWsError(): RequestHandler;
     /**
      * Converts the given array of string or Function objects to functions bound to the given route object.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rapidrest/service-core",
-    "version": "2.2.0",
+    "version": "2.3.0",
     "description": "Provides all core functionality for RapidREST based backend services.",
     "repository": "https://github.com/rapidrest/service-core.git",
     "author": "RapidREST <rapidrests@gmail.com>",