@rebasepro/server-core 0.0.1-canary.4d4fb3e

package/src/auth/password.ts

@@ -0,0 +1,75 @@
+import { scrypt, randomBytes, timingSafeEqual } from "crypto";
+import { promisify } from "util";
+
+const scryptAsync = promisify(scrypt);
+
+// Scrypt parameters (recommended values for 2024+)
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 64;
+const SCRYPT_PARAMS = { N: 16384, r: 8, p: 1 };
+
+export interface PasswordValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+
+/**
+ * Password requirements:
+ * - Minimum 8 characters
+ * - At least 1 uppercase letter
+ * - At least 1 lowercase letter
+ * - At least 1 number
+ */
+export function validatePasswordStrength(password: string): PasswordValidationResult {
+    const errors: string[] = [];
+
+    if (password.length < 8) {
+        errors.push("Password must be at least 8 characters long");
+    }
+
+    if (!/[A-Z]/.test(password)) {
+        errors.push("Password must contain at least one uppercase letter");
+    }
+
+    if (!/[a-z]/.test(password)) {
+        errors.push("Password must contain at least one lowercase letter");
+    }
+
+    if (!/[0-9]/.test(password)) {
+        errors.push("Password must contain at least one number");
+    }
+
+    return {
+        valid: errors.length === 0,
+        errors
+    };
+}
+
+/**
+ * Hash a password using Node's built-in scrypt
+ * Returns format: salt:hash (both hex encoded)
+ */
+export async function hashPassword(password: string): Promise<string> {
+    const salt = randomBytes(SALT_LENGTH);
+    const derivedKey = await scryptAsync(password, salt, KEY_LENGTH) as Buffer;
+    return `${salt.toString("hex")}:${derivedKey.toString("hex")}`;
+}
+
+/**
+ * Verify a password against a scrypt hash
+ * Expects format: salt:hash (both hex encoded)
+ */
+export async function verifyPassword(password: string, storedHash: string): Promise<boolean> {
+    const [saltHex, hashHex] = storedHash.split(":");
+    if (!saltHex || !hashHex) {
+        return false;
+    }
+
+    const salt = Buffer.from(saltHex, "hex");
+    const storedKey = Buffer.from(hashHex, "hex");
+
+    const derivedKey = await scryptAsync(password, salt, KEY_LENGTH) as Buffer;
+
+    // Use timing-safe comparison to prevent timing attacks
+    return timingSafeEqual(derivedKey, storedKey);
+}

package/src/auth/rate-limiter.ts

@@ -0,0 +1,129 @@
+import { MiddlewareHandler } from "hono";
+import { HonoEnv } from "../api/types";
+
+/**
+ * In-memory sliding-window rate limiter for Hono.
+ *
+ * Suitable for single-instance and moderate-scale deployments.
+ * For multi-instance setups, consider a shared store
+ * (e.g. PostgreSQL-backed counters or an external rate-limit service).
+ */
+
+interface RateLimitEntry {
+    timestamps: number[];
+}
+
+interface RateLimiterOptions {
+    /** Time window in milliseconds (default: 15 minutes) */
+    windowMs?: number;
+    /** Maximum requests per window (default: 100) */
+    limit?: number;
+    /** Key generator function. Defaults to IP-based keying. */
+    keyGenerator?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => string;
+    /** Custom message for rate limit responses */
+    message?: string;
+}
+
+/**
+ * Create a rate-limiting middleware.
+ *
+ * Uses a sliding window algorithm: only timestamps within the last
+ * `windowMs` milliseconds are counted. Old entries are garbage-collected
+ * every `windowMs` to prevent unbounded memory growth.
+ */
+export function createRateLimiter(options: RateLimiterOptions = {}): MiddlewareHandler<HonoEnv> {
+    const {
+        windowMs = 15 * 60 * 1000,
+        limit = 100,
+        keyGenerator = defaultKeyGenerator,
+        message = "Too many requests, please try again later."
+    } = options;
+
+    const store = new Map<string, RateLimitEntry>();
+
+    // Periodic cleanup to prevent memory leak from expired entries
+    const cleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [key, entry] of store.entries()) {
+            entry.timestamps = entry.timestamps.filter(t => now - t < windowMs);
+            if (entry.timestamps.length === 0) {
+                store.delete(key);
+            }
+        }
+    }, windowMs);
+
+    // Allow the Node.js process to exit even if the interval is still running
+    if (cleanupInterval.unref) {
+        cleanupInterval.unref();
+    }
+
+    return async (c, next) => {
+        const key = keyGenerator(c);
+        const now = Date.now();
+
+        let entry = store.get(key);
+        if (!entry) {
+            entry = { timestamps: [] };
+            store.set(key, entry);
+        }
+
+        // Remove timestamps outside the current window
+        entry.timestamps = entry.timestamps.filter(t => now - t < windowMs);
+
+        if (entry.timestamps.length >= limit) {
+            const retryAfterMs = entry.timestamps[0] + windowMs - now;
+            const retryAfterSec = Math.ceil(retryAfterMs / 1000);
+
+            c.header("Retry-After", String(retryAfterSec));
+            c.header("X-RateLimit-Limit", String(limit));
+            c.header("X-RateLimit-Remaining", "0");
+            c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1000)));
+
+            return c.json({
+                error: {
+                    message,
+                    code: "RATE_LIMITED"
+                }
+            }, 429);
+        }
+
+        entry.timestamps.push(now);
+
+        // Set rate limit headers
+        c.header("X-RateLimit-Limit", String(limit));
+        c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
+
+        return next();
+    };
+}
+
+/**
+ * Default key generator: extract client IP from standard headers.
+ */
+function defaultKeyGenerator(c: Parameters<MiddlewareHandler<HonoEnv>>[0]): string {
+    return (
+        c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ||
+        c.req.header("x-real-ip") ||
+        "unknown"
+    );
+}
+
+/**
+ * Pre-configured rate limiter for general auth endpoints (login, register).
+ * 20 requests per 15 minutes per IP.
+ */
+export const defaultAuthLimiter = createRateLimiter({
+    windowMs: 15 * 60 * 1000,
+    limit: 20,
+    message: "Too many authentication attempts, please try again later."
+});
+
+/**
+ * Pre-configured strict rate limiter for sensitive endpoints (password reset, verification).
+ * 5 requests per 15 minutes per IP.
+ */
+export const strictAuthLimiter = createRateLimiter({
+    windowMs: 15 * 60 * 1000,
+    limit: 5,
+    message: "Too many requests to this sensitive endpoint, please try again later."
+});