@rapidrest/service-core 2.2.1 → 2.4.0

package/dist/lib/http/csrf/csrf.js

@@ -0,0 +1,212 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import * as crypto from "crypto";
+import { ApiError } from "@rapidrest/core";
+import { ApiErrorMessages, ApiErrors } from "../../ApiErrors.js";
+/**
+ * Double-submit CSRF protection for the `jwt` cookie that `@rapidrest/auth`'s `TokenUtils` issues (see
+ * that library's `CsrfUtils`, which rotates this same cookie at login/elevation/logout). This module is
+ * the shared, framework-agnostic core: `RouteUtils.checkCsrf()` wires it into every route's middleware
+ * chain automatically, and `createCsrfMiddleware()` below offers the same check as a standalone global
+ * middleware for a service that doesn't go through `RouteUtils` (or wants it registered once instead of
+ * per-route). `auth`'s route handlers that read `req.session` directly instead of going through the
+ * `jwt`-cookie auth path (e.g. the OAuth `/authorize/consent` route) call `verifyCsrfRequest()` by hand —
+ * see that route's own doc comment for why it can't rely on the automatic, `req.auth`-keyed gate.
+ *
+ * ## Why this is a host-only cookie, not a naive double-submit
+ *
+ * The `jwt`/`refresh` cookies `TokenUtils` issues are commonly configured with a wildcard `Domain`
+ * (e.g. `.example.com`) so a single sign-in is shared across sibling subdomains (`mail.example.com`,
+ * `auth.example.com`, ...) — that's the whole point of a shared SSO cookie. A *naive* double-submit CSRF
+ * cookie sharing that same wildcard `Domain` would defeat itself: `document.cookie` on *any* sibling
+ * subdomain can read a wildcard-domain cookie, so a same-site page that isn't the app itself (a
+ * compromised or merely less-trusted subdomain, a multi-tenant customer subdomain, ...) could read the
+ * "secret" double-submit value and echo it right back — exactly the value this scheme exists to keep
+ * out of an attacker's hands. `SameSite=Lax` doesn't help here either: it blocks genuine cross-*site*
+ * forgery, but `auth.example.com` and `mail.example.com` are cross-*origin*, same-*site* — Lax cookies
+ * are still attached.
+ *
+ * `buildCsrfCookie()` below therefore never emits a `Domain` attribute: the cookie this module issues is
+ * always host-only, readable only by script running on the exact host that set it. That closes the
+ * sibling-subdomain-reads-the-cookie hole, but it also means a *legitimately* cross-origin caller (e.g.
+ * `react-shared`'s `authApiFetch()`, used by an admin console on `mail.example.com` to drive
+ * impersonation on `auth.example.com`) can never read this cookie either — there is no way for it to
+ * supply a matching header. `verifyCsrfRequest()` handles that case by falling back to an Origin/Referer
+ * allow-list check for any request whose Origin doesn't match the host it arrived on: the browser only
+ * ever sends such a request in the first place because the target's CORS policy already named that exact
+ * origin as trusted (see `Server.ts`'s CORS middleware, which reflects `Access-Control-Allow-Origin` only
+ * for an exact, explicitly configured match — never a wildcard-with-credentials), so re-checking the same
+ * allow-list server-side is a legitimate, independent proof for a cross-origin request in a way that
+ * would not exist for a same-origin one.
+ */
+/** Default name of the double-submit CSRF cookie. */
+export const DEFAULT_CSRF_COOKIE_NAME = "csrf";
+/** Default name of the request header a caller echoes the CSRF cookie's value back on. */
+export const DEFAULT_CSRF_HEADER_NAME = "x-csrf-token";
+/** HTTP methods exempt from CSRF checks — by definition never supposed to mutate state. */
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/** Generates a new, cryptographically random CSRF token, matching `OIDCStrategy`'s own `state`-token style. */
+export function generateCsrfToken() {
+    return crypto.randomBytes(32).toString("base64url");
+}
+/**
+ * Builds the `Set-Cookie` header value for the CSRF cookie. Pass an empty string for `token` to build a
+ * header that immediately clears the cookie instead (mirrors `TokenUtils.buildCookie()`'s own clearing
+ * convention in `@rapidrest/auth`).
+ *
+ * Deliberately never emits a `Domain` attribute, even though the sibling `jwt`/`refresh` cookies often do
+ * — see this module's doc comment for why a wide-open `Domain` here would defeat the whole scheme.
+ * Deliberately never emits `HttpOnly` either: browser JavaScript reading this cookie and echoing it back
+ * as a header is the entire mechanism.
+ */
+export function buildCsrfCookie(token, options = {}) {
+    const clearing = token === "";
+    const parts = [`${options.name ?? DEFAULT_CSRF_COOKIE_NAME}=${token}`, `Path=${options.path ?? "/"}`];
+    parts.push(`SameSite=${options.sameSite ?? "Lax"}`);
+    if (clearing) {
+        parts.push("Max-Age=0");
+    }
+    else if (options.maxAge !== undefined) {
+        parts.push(`Max-Age=${options.maxAge}`);
+    }
+    if (options.secure !== false) {
+        parts.push("Secure");
+    }
+    return parts.join("; ");
+}
+/** Constant-time string comparison. Rejects a length mismatch up front — `crypto.timingSafeEqual()` throws on one
+ * rather than returning `false`, and comparing lengths first is itself safe (a token's length isn't a secret). */
+function timingSafeEqualStr(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    return bufA.length > 0 && bufA.length === bufB.length && crypto.timingSafeEqual(bufA, bufB);
+}
+function firstHeaderValue(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+/** Extracts `scheme://host` from a full URL string (e.g. a `Referer` header), or `undefined` if unparseable. */
+function originOf(url) {
+    if (!url) {
+        return undefined;
+    }
+    try {
+        const parsed = new URL(url);
+        return `${parsed.protocol}//${parsed.host}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Extracts just the `host` (hostname[:port], no scheme) portion of an origin string, or `undefined` if unparseable. */
+function hostOf(origin) {
+    if (!origin) {
+        return undefined;
+    }
+    try {
+        return new URL(origin).host;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Ensures the caller holds a CSRF cookie, issuing one via `Set-Cookie` if it doesn't already have a valid
+ * one — the standard "set on first visit" double-submit pattern (matches Django/Rails), and what lets a
+ * service that never itself issues auth cookies (e.g. `server`/`restapi`, which only ever verify a `jwt`
+ * cookie someone else set) still adopt this mechanism on its own. Returns the (possibly freshly-generated)
+ * token value.
+ */
+export function ensureCsrfCookie(req, res, options = {}) {
+    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
+    const existing = req.cookies?.[cookieName];
+    if (existing) {
+        return existing;
+    }
+    const token = generateCsrfToken();
+    res.appendHeader("Set-Cookie", buildCsrfCookie(token, { name: cookieName, maxAge: options.maxAge, secure: options.secure }));
+    return token;
+}
+/**
+ * Verifies `req` against the double-submit CSRF cookie plus Origin/Referer allow-list, per the scheme
+ * documented at the top of this module. Throws an `ApiError` (`AUTH_CSRF_FAILURE`, 403) on failure. A safe
+ * method (`GET`/`HEAD`/`OPTIONS`) or `options.enabled === false` always passes without throwing.
+ *
+ * This does *not* check `req.auth?.source` — that gate belongs to the caller (see `RouteUtils.checkCsrf()`,
+ * which only calls this when `req.auth?.source === "cookie"`). A caller like `BaseOAuthAuthorizeRoute`'s
+ * `decideConsent()`, which authenticates via `req.session` instead of a JWT, calls this unconditionally
+ * for exactly that reason.
+ */
+export function verifyCsrfRequest(req, options = {}) {
+    if (options.enabled === false) {
+        return;
+    }
+    const method = (req.method || "GET").toUpperCase();
+    if (SAFE_METHODS.has(method)) {
+        return;
+    }
+    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;
+    const headerName = (options.headerName ?? DEFAULT_CSRF_HEADER_NAME).toLowerCase();
+    const allowedOrigins = options.allowedOrigins ?? [];
+    const originHeader = firstHeaderValue(req.headers["origin"]);
+    const refererHeader = firstHeaderValue(req.headers["referer"] ?? req.headers["referrer"]);
+    const effectiveOrigin = originHeader ?? originOf(refererHeader);
+    const hostHeader = firstHeaderValue(req.headers["host"]);
+    const originHost = hostOf(effectiveOrigin);
+    // Scheme is deliberately not part of this comparison: a TLS-terminating proxy commonly forwards a
+    // plain-HTTP request to this process for an origin the browser saw as `https://`, and that mismatch
+    // alone must never be treated as cross-origin.
+    const crossOrigin = !!originHost && !!hostHeader && originHost !== hostHeader;
+    // Defense in depth, checked regardless of same/cross-origin whenever an Origin (or Referer fallback)
+    // is present and an allow-list is configured: a same-origin request forging its own Origin header is
+    // not something a browser lets a page do, so this mainly guards against a misconfigured proxy or a
+    // non-browser replay of a stolen cookie pair.
+    if (effectiveOrigin && allowedOrigins.length > 0 && !allowedOrigins.includes(effectiveOrigin)) {
+        options.logger?.warn?.(`[CSRF] Rejected ${method} ${req.path} — origin '${effectiveOrigin}' is not allow-listed.`);
+        throw new ApiError(ApiErrors.AUTH_CSRF_FAILURE, 403, ApiErrorMessages.AUTH_CSRF_FAILURE);
+    }
+    if (crossOrigin) {
+        // A cross-origin caller's own JavaScript cannot read this host's host-only CSRF cookie (see this
+        // module's doc comment), so the double-submit check below is structurally unsatisfiable for it —
+        // the Origin allow-list check above is this request's only available CSRF defense. Fail closed if
+        // there's no allow-list configured at all: nothing here proved the request legitimate.
+        if (allowedOrigins.length === 0) {
+            options.logger?.warn?.(`[CSRF] Rejected cross-origin ${method} ${req.path} — no CSRF allow-list configured.`);
+            throw new ApiError(ApiErrors.AUTH_CSRF_FAILURE, 403, ApiErrorMessages.AUTH_CSRF_FAILURE);
+        }
+        return;
+    }
+    const cookieToken = req.cookies?.[cookieName];
+    const headerToken = firstHeaderValue(req.headers[headerName]);
+    if (!cookieToken || !headerToken || !timingSafeEqualStr(cookieToken, headerToken)) {
+        options.logger?.warn?.(`[CSRF] Rejected ${method} ${req.path} — missing or mismatched '${headerName}' header.`);
+        throw new ApiError(ApiErrors.AUTH_CSRF_FAILURE, 403, ApiErrorMessages.AUTH_CSRF_FAILURE);
+    }
+}
+/**
+ * Standalone global-middleware form of the same check `RouteUtils.checkCsrf()` installs automatically on
+ * every route. Useful for a service that registers its own middleware chain directly instead of going
+ * through `RouteUtils` (or that wants a single global registration instead of a per-route one). Always
+ * lazily issues the cookie first (see `ensureCsrfCookie()`), then enforces the check only when
+ * `req.auth?.source === "cookie"` — the same gate `RouteUtils.checkCsrf()` uses.
+ */
+export function createCsrfMiddleware(options = {}) {
+    return (req, res, next) => {
+        if (options.enabled !== false) {
+            ensureCsrfCookie(req, res, options);
+        }
+        if (req.auth?.source !== "cookie") {
+            next();
+            return;
+        }
+        try {
+            verifyCsrfRequest(req, options);
+            next();
+        }
+        catch (err) {
+            next(err);
+        }
+    };
+}
+//# sourceMappingURL=csrf.js.map

package/dist/lib/http/csrf/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../../../src/http/csrf/csrf.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,2FAA2F;AAC3F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAgBzD,+GAA+G;AAC/G,MAAM,UAAU,iBAAiB;IAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,UAA6B,EAAE;IAC1E,MAAM,QAAQ,GAAG,KAAK,KAAK,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAa,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,wBAAwB,IAAI,KAAK,EAAE,EAAE,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAChH,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;kHACkH;AAClH,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC1D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED,gHAAgH;AAChH,SAAS,QAAQ,CAAC,GAAuB;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC;AAED,wHAAwH;AACxH,SAAS,MAAM,CAAC,MAA0B;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,GAAiB,EAAE,UAA4B,EAAE;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,wBAAwB,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,GAAG,CAAC,YAAY,CACZ,YAAY,EACZ,eAAe,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAC/F,CAAC;IACF,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAgB,EAAE,UAA4B,EAAE;IAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO;IACX,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;IACX,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,wBAAwB,CAAC;IAClE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,wBAAwB,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IAEpD,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1F,MAAM,eAAe,GAAG,YAAY,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,kGAAkG;IAClG,oGAAoG;IACpG,+CAA+C;IAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,UAAU,KAAK,UAAU,CAAC;IAE9E,qGAAqG;IACrG,qGAAqG;IACrG,mGAAmG;IACnG,8CAA8C;IAC9C,IAAI,eAAe,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5F,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,mBAAmB,MAAM,IAAI,GAAG,CAAC,IAAI,cAAc,eAAe,wBAAwB,CAAC,CAAC;QACnH,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACd,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,uFAAuF;QACvF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,gCAAgC,MAAM,IAAI,GAAG,CAAC,IAAI,mCAAmC,CAAC,CAAC;YAC9G,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO;IACX,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAChF,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,mBAAmB,MAAM,IAAI,GAAG,CAAC,IAAI,6BAA6B,UAAU,WAAW,CAAC,CAAC;QAChH,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC7F,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA4B,EAAE;IAC/D,OAAO,CAAC,GAAgB,EAAE,GAAiB,EAAE,IAAI,EAAE,EAAE;QACjD,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACL,CAAC,CAAC;AACN,CAAC"}

package/dist/lib/http/index.js

@@ -4,6 +4,12 @@ export { extractParamNames, makeWsStubResponse, runChain, splitRouteArgs } from
 export { RedisSessionStore } from "./session/RedisSessionStore.js";
 export { SessionManager } from "./session/SessionManager.js";
 export { createSessionMiddleware } from "./session/sessionMiddleware.js";
+// CSRF support — double-submit cookie protection for the `jwt` cookie `@rapidrest/auth`'s `TokenUtils`
+// issues. `RouteUtils.checkCsrf()` wires the check into every registered route automatically; the pieces
+// below are exported for a route that must check by hand (session-only auth, not the `jwt` cookie — see
+// `BaseOAuthAuthorizeRoute.decideConsent()` in `@rapidrest/auth`) or a service that registers its own
+// middleware chain outside of `RouteUtils`.
+export { DEFAULT_CSRF_COOKIE_NAME, DEFAULT_CSRF_HEADER_NAME, buildCsrfCookie, createCsrfMiddleware, ensureCsrfCookie, generateCsrfToken, verifyCsrfRequest, } from "./csrf/csrf.js";
 // uWS-backed adapter. `HttpRouter` is exported as a type only — the class itself value-imports
 // `uWebSockets.js` at module load, which does not work under Bun. Consumers that only annotate with
 // the type stay safe on every runtime; constructing one is done internally by Server.ts via a

package/dist/lib/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAMvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,+FAA+F;AAC/F,oGAAoG;AACpG,8FAA8F;AAC9F,4CAA4C;AAC5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGtF,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,kGAAkG;AAClG,sEAAsE;AACtE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAMvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,uGAAuG;AACvG,yGAAyG;AACzG,wGAAwG;AACxG,sGAAsG;AACtG,4CAA4C;AAC5C,OAAO,EACH,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,+FAA+F;AAC/F,oGAAoG;AACpG,8FAA8F;AAC9F,4CAA4C;AAC5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGtF,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,kGAAkG;AAClG,sEAAsE;AACtE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/lib/http/uWS/Router.js

@@ -26,6 +26,28 @@ function remoteAddressOf(uwsRes) {
     const raw = Buffer.from(uwsRes.getRemoteAddressAsText()).toString();
     return NetUtils.normalizeIP(raw) ?? raw;
 }
+/**
+ * Copies a route's `:param` values from the uWS request onto `req.params`, keyed by `paramNames` (see
+ * `extractParamNames()`). Shared by the HTTP handlers and the WebSocket `upgrade` callback. Must be called
+ * synchronously (`uwsReq` is stack-allocated and only valid before the first `await`).
+ *
+ * uWS never decodes route segments itself (unlike the query-string parsing in Adapters.ts), so a
+ * caller-encoded value (e.g. `encodeURIComponent()`-ing an email-address-derived uid before
+ * building the URL, this library's own established convention) would otherwise arrive here still
+ * percent-encoded and fail every downstream uid lookup. Falls back to the raw value on malformed
+ * percent-encoding (e.g. a bare "%"), matching Adapters.ts's identical query-string fallback.
+ */
+function capturePathParams(uwsReq, paramNames, req) {
+    for (let i = 0; i < paramNames.length; i++) {
+        const raw = uwsReq.getParameter(i) || "";
+        try {
+            req.params[paramNames[i]] = decodeURIComponent(raw);
+        }
+        catch {
+            req.params[paramNames[i]] = raw;
+        }
+    }
+}
 /**
  * Wraps a uWS route handler to convert uWS request/response objects into `HttpRequest`/`HttpResponse`
  * adapters, reads the body, and runs the full middleware chain (pre-route global + route-specific + post-route global).
@@ -57,20 +79,7 @@ function makeUWSHandler(globalMiddleware, routeHandlers, options) {
         const res = new UWSResponse(uwsRes);
         res.isHead = isHead;
         // Capture path params synchronously (uwsReq is stack-allocated, only valid before first await).
-        // uWS never decodes route segments itself (unlike the query-string parsing in Adapters.ts), so a
-        // caller-encoded value (e.g. `encodeURIComponent()`-ing an email-address-derived uid before
-        // building the URL, this library's own established convention) would otherwise arrive here still
-        // percent-encoded and fail every downstream uid lookup. Falls back to the raw value on malformed
-        // percent-encoding (e.g. a bare "%"), matching Adapters.ts's identical query-string fallback.
-        for (let i = 0; i < paramNames.length; i++) {
-            const raw = uwsReq.getParameter(i) || "";
-            try {
-                req.params[paramNames[i]] = decodeURIComponent(raw);
-            }
-            catch {
-                req.params[paramNames[i]] = raw;
-            }
-        }
+        capturePathParams(uwsReq, paramNames, req);
         if (streamingBody) {
             // Opted out of buffering (see HttpRouteOptions.streamingBody / @StreamingBody()) — expose
             // the raw body as a stream instead. This must happen synchronously, in the same tick as
@@ -274,14 +283,26 @@ export class HttpRouter {
      * Both `path` and `path + "/"` are registered to avoid trailing-slash mismatch.
      */
     ws(routePath, handlers, wsOptions, upgradeAuth) {
+        // An option a route leaves `undefined` keeps its default: a plain object spread would let an explicit
+        // `undefined` overwrite the default and hand uWS `undefined` instead. Any other uWS behavior option in
+        // `wsOptions` is passed through untouched.
+        const options = { ...wsOptions };
+        for (const key of Object.keys(DEFAULT_WS_OPTIONS)) {
+            options[key] = wsOptions?.[key] ?? DEFAULT_WS_OPTIONS[key];
+        }
+        const paramNames = extractParamNames(routePath);
+        // One behavior object, shared by the plain and the trailing-slash registration below, so both get the same
+        // options.
         const behavior = {
             // Explicit defaults, identical to the ones BunRouter applies, so a route behaves the same on both runtimes.
-            ...DEFAULT_WS_OPTIONS,
-            ...wsOptions,
+            ...options,
             upgrade: (uwsRes, uwsReq, context) => {
                 // Capture all request data synchronously — uWS HttpRequest is stack-allocated
                 const req = new UWSRequest(uwsReq, remoteAddressOf(uwsRes));
                 req.routePattern = routePath;
+                // `:param` segments must be read here: `open` runs after the request object is gone, and the HTTP
+                // handlers' capture (see makeUWSHandler) never runs for an upgrade.
+                capturePathParams(uwsReq, paramNames, req);
                 const secWebSocketKey = uwsReq.getHeader("sec-websocket-key");
                 const secWebSocketProtocol = uwsReq.getHeader("sec-websocket-protocol");
                 const secWebSocketExtensions = uwsReq.getHeader("sec-websocket-extensions");

package/dist/lib/http/uWS/Router.js.map

@@ -1 +1 @@
-{"version":3,"file":"Router.js","sourceRoot":"","sources":["../../../../src/http/uWS/Router.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wEAAwE;AACxE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,GAAG,MAAM,gBAAgB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EACH,kBAAkB,GAQrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAkB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAsB,MAAM,uBAAuB,CAAC;AAC5H,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAGpE;;uGAEuG;AACvG,SAAS,aAAa,CAAC,QAAgB;IACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;+FAC+F;AAC/F,SAAS,eAAe,CAAC,MAAwB;IAC7C,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5E,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC5C,CAAC;AAsBD;;;;;;;GAOG;AACH,SAAS,cAAc,CACnB,gBAAkC,EAClC,aAA+B,EAC/B,OAA0B;IAE1B,MAAM,EACF,SAAS,EACT,UAAU,EACV,YAAY,EACZ,MAAM,GAAG,KAAK,EACd,WAAW,GAAG,qBAAqB,EACnC,QAAQ,EACR,aAAa,GAAG,KAAK,GACxB,GAAG,OAAO,CAAC;IACZ,wFAAwF;IACxF,gFAAgF;IAChF,IAAI,WAAW,GAA4B,IAAI,CAAC;IAEhD,OAAO,KAAK,EAAE,MAAwB,EAAE,MAAuB,EAAE,EAAE;QAC/D,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACP,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CAAC,MAAwB,EAAE,MAAuB;QACnE,+CAA+C;QAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE9C,uEAAuE;QACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QAEpB,gGAAgG;QAChG,iGAAiG;QACjG,4FAA4F;QAC5F,iGAAiG;QACjG,iGAAiG;QACjG,8FAA8F;QAC9F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACL,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACpC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAChB,0FAA0F;YAC1F,wFAAwF;YACxF,0FAA0F;YAC1F,0FAA0F;YAC1F,2FAA2F;YAC3F,oFAAoF;YACpF,oCAAoC;YACpC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC7C,kFAAkF;YAClF,sFAAsF;YACtF,oFAAoF;YACpF,sFAAsF;YACtF,uBAAuB;YACvB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACJ,0FAA0F;YAC1F,0FAA0F;YAC1F,6DAA6D;YAC7D,IAAI,MAAM,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBACD,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACL,qDAAqD;YACzD,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACvB,WAAW,GAAG;gBACV,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBACvC,GAAG,aAAa;gBAChB,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC;aACvC,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAEtC,8CAA8C;QAC9C,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1B,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,UAAU;IA6BnB,YAAY,MAAwB,EAAE,cAAsB,qBAAqB;QA3BhE,qBAAgB,GAAqB,EAAE,CAAC;QACjD,iBAAY,GAAgC,IAAI,CAAC;QACzD;;;WAGG;QACK,kBAAa,GAAW,CAAC,CAAC,CAAC;QACnC,8FAA8F;QACvF,eAAU,GAAW,CAAC,CAAC;QAC9B;;;;WAIG;QACc,sBAAiB,GAAgB,IAAI,GAAG,EAAE,CAAC;QAC5D;;;;;WAKG;QACc,yBAAoB,GAAgB,IAAI,GAAG,EAAE,CAAC;QAG/D,iDAAiD;QAChC,aAAQ,GAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAGtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IAED,2DAA2D;IAC3D,IAAW,WAAW;QAClB,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,uEAAuE;IAChE,GAAG,CAAC,GAAG,QAA0B;QACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,oBAAoB;QACxB,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,oHAAoH;IAC5G,WAAW,CACf,QAA0B,EAC1B,SAAiB,EACjB,YAAgC,EAChC,SAAkB,KAAK,EACvB,eAAiC,EAAE;QAEnC,OAAO,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE;YACnD,SAAS;YACT,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;YAC/D,YAAY;YACZ,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,YAAY,CAAC,aAAa;SAC5C,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAC5E,iDAAiD;IACjD,4EAA4E;IAErE,GAAG,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,IAAI,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,GAAG,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,MAAM,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,IAAI,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,2FAA2F;QAC3F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,OAAO,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5C,8FAA8F;QAC9F,gGAAgG;QAChG,IAAI,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;yDAKqD;IAC9C,uBAAuB,CAAC,IAAY;QACvC,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;OAWG;IACI,EAAE,CACL,SAAiB,EACjB,QAA0B,EAC1B,SAAkE,EAClE,WAA2B;QAE3B,MAAM,QAAQ,GAA+B;YACzC,4GAA4G;YAC5G,GAAG,kBAAkB;YACrB,GAAI,SAAiD;YAErD,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;gBACjC,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,YAAY,GAAG,SAAS,CAAC;gBAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;gBAC9D,MAAM,oBAAoB,GAAG,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;gBACxE,MAAM,sBAAsB,GAAG,MAAM,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;gBAE5E,IAAI,WAAW,EAAE,CAAC;oBACd,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;wBACpB,sDAAsD;wBACtD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;4BACb,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;4BACvC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;4BACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;wBACzE,CAAC,CAAC,CAAC;wBACH,OAAO;oBACX,CAAC;oBACD,uEAAuE;oBACvE,iFAAiF;oBACjF,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;wBAClB,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;wBAC3B,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC;wBACtB,GAAG,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;wBACzC,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;oBACzC,CAAC;gBACL,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;YACpG,CAAC;YAED,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBACf,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAiD,CAAC;gBACjF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBACtC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;gBAErB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAgB,CAAC;gBACtC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;gBACrB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;gBAEtB,qFAAqF;gBACrF,yFAAyF;gBACzF,oFAAoF;gBACpF,wFAAwF;gBACxF,MAAM,OAAO,GAAiB,kBAAkB,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;oBACjE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;oBACrB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC;gBACnF,CAAC,CAAC,CAAC;gBAEH,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAEvC,wDAAwD;gBACxD,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,iEAAiE;gBACjE,0CAA0C;gBAC1C,EAAE;gBACF,sFAAsF;gBACtF,wFAAwF;gBACxF,2FAA2F;gBAC3F,0FAA0F;gBAC1F,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC;wBACD,EAAE,CAAC,GAAG,EAAE,CAAC;oBACb,CAAC;oBAAC,MAAM,CAAC;wBACL,8CAA8C;oBAClD,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;gBAC/B,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAiC,CAAC;gBACjE,uGAAuG;gBACvG,qGAAqG;gBACrG,gGAAgG;gBAChG,6DAA6D;gBAC7D,QAAQ,CAAC,IAAI,EAAE,IAAI,CACf,SAAS,EACT,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAC1E,QAAQ,CACX,CAAC;YACN,CAAC;YAED,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBACzB,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAiC,CAAC;gBACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACpF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxE,CAAC;SACJ,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpC,8DAA8D;QAC9D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,IAAY,EAAE,IAAY;QACpC,kGAAkG;QAClG,6FAA6F;QAC7F,4FAA4F;QAC5F,+FAA+F;QAC/F,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAE9D,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,+FAA+F;QAC/F,oFAAoF;QACpF,uBAAuB;QACvB,MAAM,eAAe,GAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAkB,EAAE,EAAE;YACvE,IAAI,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAW,CAAC;QAChH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAU,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,+FAA+F;gBAC/F,oGAAoG;gBACpG,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC;YAC5G,CAAC;QACL,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;gBACtC,IAAI,MAAM,EAAE,CAAC;oBACT,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;oBAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;oBACvB,OAAO,EAAE,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACJ,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED,oFAAoF;IAC7E,KAAK;QACR,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,IAAW,gBAAgB;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,QAAQ,CAAC,YAAoB,KAAK;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,QAAQ,GAAW,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACL,iBAAiB;QACrB,CAAC;IACL,CAAC;CAKJ"}
+{"version":3,"file":"Router.js","sourceRoot":"","sources":["../../../../src/http/uWS/Router.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wEAAwE;AACxE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,GAAG,MAAM,gBAAgB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EACH,kBAAkB,GAQrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAkB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAsB,MAAM,uBAAuB,CAAC;AAC5H,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAGpE;;uGAEuG;AACvG,SAAS,aAAa,CAAC,QAAgB;IACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;+FAC+F;AAC/F,SAAS,eAAe,CAAC,MAAwB;IAC7C,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5E,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC5C,CAAC;AAOD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,MAAuB,EAAE,UAAoB,EAAE,GAAe;IACrF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACL,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QACpC,CAAC;IACL,CAAC;AACL,CAAC;AAiBD;;;;;;;GAOG;AACH,SAAS,cAAc,CACnB,gBAAkC,EAClC,aAA+B,EAC/B,OAA0B;IAE1B,MAAM,EACF,SAAS,EACT,UAAU,EACV,YAAY,EACZ,MAAM,GAAG,KAAK,EACd,WAAW,GAAG,qBAAqB,EACnC,QAAQ,EACR,aAAa,GAAG,KAAK,GACxB,GAAG,OAAO,CAAC;IACZ,wFAAwF;IACxF,gFAAgF;IAChF,IAAI,WAAW,GAA4B,IAAI,CAAC;IAEhD,OAAO,KAAK,EAAE,MAAwB,EAAE,MAAuB,EAAE,EAAE;QAC/D,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACP,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CAAC,MAAwB,EAAE,MAAuB;QACnE,+CAA+C;QAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE9C,uEAAuE;QACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QAEpB,gGAAgG;QAChG,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAE3C,IAAI,aAAa,EAAE,CAAC;YAChB,0FAA0F;YAC1F,wFAAwF;YACxF,0FAA0F;YAC1F,0FAA0F;YAC1F,2FAA2F;YAC3F,oFAAoF;YACpF,oCAAoC;YACpC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC7C,kFAAkF;YAClF,sFAAsF;YACtF,oFAAoF;YACpF,sFAAsF;YACtF,uBAAuB;YACvB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACJ,0FAA0F;YAC1F,0FAA0F;YAC1F,6DAA6D;YAC7D,IAAI,MAAM,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBACD,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACL,qDAAqD;YACzD,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACvB,WAAW,GAAG;gBACV,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBACvC,GAAG,aAAa;gBAChB,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC;aACvC,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAEtC,8CAA8C;QAC9C,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1B,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,UAAU;IA6BnB,YAAY,MAAwB,EAAE,cAAsB,qBAAqB;QA3BhE,qBAAgB,GAAqB,EAAE,CAAC;QACjD,iBAAY,GAAgC,IAAI,CAAC;QACzD;;;WAGG;QACK,kBAAa,GAAW,CAAC,CAAC,CAAC;QACnC,8FAA8F;QACvF,eAAU,GAAW,CAAC,CAAC;QAC9B;;;;WAIG;QACc,sBAAiB,GAAgB,IAAI,GAAG,EAAE,CAAC;QAC5D;;;;;WAKG;QACc,yBAAoB,GAAgB,IAAI,GAAG,EAAE,CAAC;QAG/D,iDAAiD;QAChC,aAAQ,GAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAGtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IAED,2DAA2D;IAC3D,IAAW,WAAW;QAClB,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,uEAAuE;IAChE,GAAG,CAAC,GAAG,QAA0B;QACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,oBAAoB;QACxB,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,oHAAoH;IAC5G,WAAW,CACf,QAA0B,EAC1B,SAAiB,EACjB,YAAgC,EAChC,SAAkB,KAAK,EACvB,eAAiC,EAAE;QAEnC,OAAO,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE;YACnD,SAAS;YACT,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;YAC/D,YAAY;YACZ,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,YAAY,CAAC,aAAa;SAC5C,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAC5E,iDAAiD;IACjD,4EAA4E;IAErE,GAAG,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,IAAI,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,GAAG,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,MAAM,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,IAAI,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,IAAI,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,2FAA2F;QAC3F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,OAAO,CAAC,SAAiB,EAAE,GAAG,iBAA2D;QAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5C,8FAA8F;QAC9F,gGAAgG;QAChG,IAAI,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;yDAKqD;IAC9C,uBAAuB,CAAC,IAAY;QACvC,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;OAWG;IACI,EAAE,CACL,SAAiB,EACjB,QAA0B,EAC1B,SAAkE,EAClE,WAA2B;QAE3B,sGAAsG;QACtG,uGAAuG;QACvG,2CAA2C;QAC3C,MAAM,OAAO,GAAwC,EAAE,GAAI,SAAiD,EAAE,CAAC;QAC/G,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAA2C,EAAE,CAAC;YAC1F,OAAO,CAAC,GAAG,CAAC,GAAI,SAA0C,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,UAAU,GAAa,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,2GAA2G;QAC3G,WAAW;QACX,MAAM,QAAQ,GAA+B;YACzC,4GAA4G;YAC5G,GAAG,OAAO;YAEV,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;gBACjC,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,YAAY,GAAG,SAAS,CAAC;gBAC7B,kGAAkG;gBAClG,oEAAoE;gBACpE,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC3C,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;gBAC9D,MAAM,oBAAoB,GAAG,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;gBACxE,MAAM,sBAAsB,GAAG,MAAM,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;gBAE5E,IAAI,WAAW,EAAE,CAAC;oBACd,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;wBACpB,sDAAsD;wBACtD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;4BACb,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;4BACvC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;4BACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;wBACzE,CAAC,CAAC,CAAC;wBACH,OAAO;oBACX,CAAC;oBACD,uEAAuE;oBACvE,iFAAiF;oBACjF,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;wBAClB,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;wBAC3B,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC;wBACtB,GAAG,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;wBACzC,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;oBACzC,CAAC;gBACL,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;YACpG,CAAC;YAED,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBACf,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAiD,CAAC;gBACjF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBACtC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;gBAErB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAgB,CAAC;gBACtC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;gBACrB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;gBAEtB,qFAAqF;gBACrF,yFAAyF;gBACzF,oFAAoF;gBACpF,wFAAwF;gBACxF,MAAM,OAAO,GAAiB,kBAAkB,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;oBACjE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;oBACrB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC;gBACnF,CAAC,CAAC,CAAC;gBAEH,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAEvC,wDAAwD;gBACxD,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,iEAAiE;gBACjE,0CAA0C;gBAC1C,EAAE;gBACF,sFAAsF;gBACtF,wFAAwF;gBACxF,2FAA2F;gBAC3F,0FAA0F;gBAC1F,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC;wBACD,EAAE,CAAC,GAAG,EAAE,CAAC;oBACb,CAAC;oBAAC,MAAM,CAAC;wBACL,8CAA8C;oBAClD,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;gBAC/B,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAiC,CAAC;gBACjE,uGAAuG;gBACvG,qGAAqG;gBACrG,gGAAgG;gBAChG,6DAA6D;gBAC7D,QAAQ,CAAC,IAAI,EAAE,IAAI,CACf,SAAS,EACT,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAC1E,QAAQ,CACX,CAAC;YACN,CAAC;YAED,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBACzB,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAiC,CAAC;gBACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACpF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxE,CAAC;SACJ,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpC,8DAA8D;QAC9D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,IAAY,EAAE,IAAY;QACpC,kGAAkG;QAClG,6FAA6F;QAC7F,4FAA4F;QAC5F,+FAA+F;QAC/F,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAE9D,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,+FAA+F;QAC/F,oFAAoF;QACpF,uBAAuB;QACvB,MAAM,eAAe,GAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAkB,EAAE,EAAE;YACvE,IAAI,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAW,CAAC;QAChH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAU,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,+FAA+F;gBAC/F,oGAAoG;gBACpG,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC;YAC5G,CAAC;QACL,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;gBACtC,IAAI,MAAM,EAAE,CAAC;oBACT,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;oBAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;oBACvB,OAAO,EAAE,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACJ,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED,oFAAoF;IAC7E,KAAK;QACR,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,IAAW,gBAAgB;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,QAAQ,CAAC,YAAoB,KAAK;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,QAAQ,GAAW,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACL,iBAAiB;QACrB,CAAC;IACL,CAAC;CAKJ"}

package/dist/lib/routes/RouteUtils.js

@@ -19,7 +19,9 @@ import { ACLAction, ACLUtils } from "../security/index.js";
 import _ from "lodash-es";
 import { AuthMiddleware } from "../auth/AuthMiddleware.js";
 import { RateLimiter } from "../RateLimiter.js";
+import { MAX_WEBSOCKET_BACKPRESSURE, MAX_WEBSOCKET_IDLE_TIMEOUT, MAX_WEBSOCKET_PAYLOAD_LENGTH, } from "../decorators/RouteDecorators.js";
 import { NetUtils } from "../NetUtils.js";
+import { verifyCsrfRequest, ensureCsrfCookie } from "../http/csrf/csrf.js";
 const { Config, Inject, Logger } = ObjectDecorators;
 /**
  * Provides a set of utilities for converting Route classes to HTTP middleware.
@@ -31,6 +33,8 @@ export class RouteUtils {
         this.apiSpec = new OpenApiSpec();
         this.trustedRoles = ["admin"];
         this.trustedProxies = [];
+        this.csrfConfig = { enabled: true };
+        this.corsConfig = {};
     }
     /**
      * Creates a middleware function that checks if the user has elevated privileges and if not
@@ -53,6 +57,96 @@ export class RouteUtils {
             return next(err);
         };
     }
+    /**
+     * Creates a middleware function that enforces CSRF protection for a state-changing request whose only
+     * credential came from the `jwt` cookie (`req.auth?.source === "cookie"`.
+     * See `JWTAuthResult`/`JWTStrategy`). A request authenticated via an `Authorization` header, API key,
+     * or query-string token never had that cookie automatically attached by the browser, so it was never
+     * exposed to this class of forgery and is left untouched here.
+     */
+    checkCsrf() {
+        return (req, res, next) => {
+            const options = {
+                enabled: this.csrfConfig?.enabled !== false,
+                cookieName: this.csrfConfig?.cookieName,
+                headerName: this.csrfConfig?.headerName,
+                maxAge: this.csrfConfig?.maxAge,
+                secure: this.csrfConfig?.secure,
+                allowedOrigins: Array.isArray(this.csrfConfig?.allowedOrigins)
+                    ? this.csrfConfig.allowedOrigins
+                    : Array.isArray(this.corsConfig?.origins)
+                        ? this.corsConfig.origins
+                        : [],
+                logger: this.logger,
+            };
+            // Always ensure the caller holds a cookie to echo back later, regardless of whether this
+            // particular request needs to be verified — unless the whole mechanism is switched off, in
+            // which case an operator who disabled this deliberately shouldn't see an unexplained cookie.
+            if (options.enabled !== false) {
+                ensureCsrfCookie(req, res, options);
+            }
+            if (req.auth?.source !== "cookie") {
+                return next();
+            }
+            try {
+                verifyCsrfRequest(req, options);
+                return next();
+            }
+            catch (err) {
+                return next(err);
+            }
+        };
+    }
+    /**
+     * Validates the options of a `@WebSocket()` route and returns the object to pass to `app.ws()` as its
+     * `wsOptions`, or `undefined` when the route has no options (so it gets the router's defaults, exactly as a route
+     * that never had this feature). A field that is `undefined` is left out and keeps its default.
+     *
+     * Every value must be a finite integer: `maxPayloadLength` from 1 to 16 MiB, `maxBackpressure` from 1 to 64 MiB,
+     * and `idleTimeout` `0` (disabled) or from 8 to 960 seconds (uWebSockets.js refuses `1` to `7` and anything over
+     * 960 by aborting while the route is being registered, so those are rejected here with a readable error instead).
+     * An option name that is not one of the three is rejected too, since it would otherwise be silently ignored.
+     *
+     * @param options The options declared on the route, if any.
+     * @param routeName A description of the route (e.g. `WS /relay/:id`), used in the error message.
+     * @throws Error naming the route when an option is invalid.
+     */
+    static resolveWebSocketOptions(options, routeName) {
+        if (options === undefined || options === null) {
+            return undefined;
+        }
+        if (typeof options !== "object" || Array.isArray(options)) {
+            throw new Error(`Invalid WebSocket options for ${routeName}: expected an object.`);
+        }
+        const limits = {
+            maxPayloadLength: { min: 1, max: MAX_WEBSOCKET_PAYLOAD_LENGTH },
+            maxBackpressure: { min: 1, max: MAX_WEBSOCKET_BACKPRESSURE },
+            idleTimeout: { min: 8, max: MAX_WEBSOCKET_IDLE_TIMEOUT, zero: true },
+        };
+        const resolved = {};
+        for (const key of Object.keys(options)) {
+            if (!Object.prototype.hasOwnProperty.call(limits, key)) {
+                throw new Error(`Invalid WebSocket options for ${routeName}: unknown option "${key}" (expected ` +
+                    `${Object.keys(limits).join(", ")}).`);
+            }
+        }
+        for (const key of Object.keys(limits)) {
+            const value = options[key];
+            if (value === undefined) {
+                continue;
+            }
+            const { min, max, zero } = limits[key];
+            const range = zero ? `0 (disabled) or an integer from ${min} to ${max}` : `an integer from ${min} to ${max}`;
+            if (typeof value !== "number" || !Number.isInteger(value)) {
+                throw new Error(`Invalid WebSocket option ${key} for ${routeName}: ${String(value)} is not ${range}.`);
+            }
+            if (!(zero && value === 0) && (value < min || value > max)) {
+                throw new Error(`Invalid WebSocket option ${key} for ${routeName}: ${value} is not ${range}.`);
+            }
+            resolved[key] = value;
+        }
+        return resolved;
+    }
     /**
      * Returns a canonical form of a request path for use in rate limit identifiers. The router percent-decodes
      * `:param` values, so `/clients/%61bc` and `/clients/abc` reach the same handler. Keying on the raw path would
@@ -370,6 +464,7 @@ export class RouteUtils {
                 // 1. Rate Limiter
                 // 2. Requires Elevation
                 // 3. Auth Strategies
+                // 3a. CSRF Check
                 // 4. Required Roles
                 // 5. Required Scopes
                 // 6. Required Permissions (Path Matching)
@@ -384,6 +479,7 @@ export class RouteUtils {
                 if (requiresElevation !== undefined) {
                     middleware.push(this.checkElevation(requiresElevation));
                 }
+                middleware.push(this.checkCsrf());
                 if (requiresTrustedRole) {
                     middleware.push(this.checkTrusedRoles());
                 }
@@ -456,8 +552,12 @@ export class RouteUtils {
                                     this.sanitizeWsError(),
                                 ]
                                 : [...middleware, this.sanitizeWsError()];
+                            // The route's own `@WebSocket(path, options)` limits, validated here so a bad value fails
+                            // registration with an error naming the route. `undefined` (no options declared) leaves
+                            // the router's defaults exactly as they always were.
+                            const wsOptions = RouteUtils.resolveWebSocketOptions(metadata.wsOptions, `WS ${path} (${route.constructor.name}.${key})`);
                             // Register with the HttpRouter's ws() method; trailing slash handled internally
-                            app.ws(path, wsMiddleware, undefined, upgradeAuth);
+                            app.ws(path, wsMiddleware, wsOptions, upgradeAuth);
                             // Update our OpenAPI spec — WebSocket upgrade is a GET request
                             this.apiSpec.addRoute(key, path, "get", metadata, docs, route, true);
                             this.logger.info("Registered Route: WS " + path);
@@ -704,4 +804,12 @@ __decorate([
     Config("trusted_proxies", []),
     __metadata("design:type", Array)
 ], RouteUtils.prototype, "trustedProxies", void 0);
+__decorate([
+    Config("csrf", { enabled: true }),
+    __metadata("design:type", Object)
+], RouteUtils.prototype, "csrfConfig", void 0);
+__decorate([
+    Config("cors", {}),
+    __metadata("design:type", Object)
+], RouteUtils.prototype, "corsConfig", void 0);
 //# sourceMappingURL=RouteUtils.js.map