@remix-run/cop-middleware 0.1.1 → 0.1.3

package/README.md

@@ -18,8 +18,8 @@ npm i remix
 ## Usage
 
 ```ts
-import { createRouter } from 'remix/fetch-router'
-import { cop } from 'remix/cop-middleware'
+import { createRouter } from 'remix/router'
+import { cop } from 'remix/middleware/cop'
 
 let router = createRouter({
   middleware: [cop()],
@@ -51,11 +51,11 @@ You can also layer `cop()` in front of `csrf()` when you want both browser prove
 
 ```ts
 import { createCookie } from 'remix/cookie'
-import { createRouter } from 'remix/fetch-router'
-import { createCookieSessionStorage } from 'remix/session/cookie-storage'
-import { session } from 'remix/session-middleware'
-import { cop } from 'remix/cop-middleware'
-import { csrf } from 'remix/csrf-middleware'
+import { createRouter } from 'remix/router'
+import { createCookieSessionStorage } from 'remix/session-storage/cookie'
+import { session } from 'remix/middleware/session'
+import { cop } from 'remix/middleware/cop'
+import { csrf } from 'remix/middleware/csrf'
 
 let sessionCookie = createCookie('__session', { secrets: ['secret1'] })
 let sessionStorage = createCookieSessionStorage()
@@ -70,8 +70,8 @@ In this setup, `cop()` runs first and rejects unsafe cross-origin browser reques
 ## Trusted Origins
 
 ```ts
-import { createRouter } from 'remix/fetch-router'
-import { cop } from 'remix/cop-middleware'
+import { createRouter } from 'remix/router'
+import { cop } from 'remix/middleware/cop'
 
 let router = createRouter({
   middleware: [
@@ -95,8 +95,8 @@ Bypass patterns intentionally weaken protection for specific endpoints. They sup
 - Tail wildcards with `{name...}`
 
 ```ts
-import { createRouter } from 'remix/fetch-router'
-import { cop } from 'remix/cop-middleware'
+import { createRouter } from 'remix/router'
+import { cop } from 'remix/middleware/cop'
 
 let router = createRouter({
   middleware: [

package/dist/lib/cop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cop.d.ts","sourceRoot":"","sources":["../../src/lib/cop.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAiB,MAAM,yBAAyB,CAAA;AAaxF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,GAAG,uCAAuC,CAAA;AAE/F;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAElC;;OAEG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE1C;;OAEG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAqFD;;;;;GAKG;AACH,wBAAgB,GAAG,CAAC,OAAO,GAAE,UAAe,GAAG,UAAU,CAWxD"}
+{"version":3,"file":"cop.d.ts","sourceRoot":"","sources":["../../src/lib/cop.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAiB,MAAM,yBAAyB,CAAA;AAaxF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,GAAG,uCAAuC,CAAA;AAE/F;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAElC;;OAEG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE1C;;OAEG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAyFD;;;;;GAKG;AACH,wBAAgB,GAAG,CAAC,OAAO,GAAE,UAAe,GAAG,UAAU,CAWxD"}

package/dist/lib/cop.js

@@ -1,4 +1,4 @@
-import { RequestMethods } from '@remix-run/fetch-router';
+import { isRequestMethod } from '@remix-run/fetch-router';
 const safeMethods = ['GET', 'HEAD', 'OPTIONS'];
 class CrossOriginProtection {
     #trustedOrigins = new Set();
@@ -23,7 +23,7 @@ class CrossOriginProtection {
         this.#onDeny = onDeny;
     }
     check(context) {
-        if (safeMethods.includes(context.method)) {
+        if (isSafeMethod(context.method)) {
             return null;
         }
         let secFetchSite = getHeaderValue(context.headers, 'Sec-Fetch-Site')?.toLowerCase() ?? '';
@@ -66,6 +66,9 @@ class CrossOriginProtection {
         return normalizedOrigin != null && this.#trustedOrigins.has(normalizedOrigin);
     }
 }
+function isSafeMethod(method) {
+    return isRequestMethod(method) && safeMethods.includes(method);
+}
 /**
  * Creates middleware that rejects unsafe cross-origin requests.
  *
@@ -145,7 +148,7 @@ function parseBypassPattern(pattern) {
     let methodPattern = /^([A-Z]+)\s+(.+)$/.exec(trimmedPattern);
     if (methodPattern != null && methodPattern[2].startsWith('/')) {
         let maybeMethod = methodPattern[1];
-        if (!RequestMethods.includes(maybeMethod)) {
+        if (!isRequestMethod(maybeMethod)) {
             throw new Error(`invalid request method in bypass pattern ${JSON.stringify(pattern)}`);
         }
         method = maybeMethod;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remix-run/cop-middleware",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Middleware for tokenless cross-origin protection in Fetch API servers",
   "author": "Michael Jackson <mjijackson@gmail.com>",
   "license": "MIT",
@@ -28,12 +28,12 @@
   "devDependencies": {
     "@types/node": "^24.6.0",
     "@typescript/native-preview": "7.0.0-dev.20251125.1",
-    "@remix-run/fetch-router": "0.18.1",
-    "@remix-run/assert": "0.1.0",
-    "@remix-run/test": "0.1.0"
+    "@remix-run/fetch-router": "0.19.0",
+    "@remix-run/assert": "0.2.0",
+    "@remix-run/test": "0.4.0"
   },
   "dependencies": {
-    "@remix-run/fetch-router": "^0.18.1"
+    "@remix-run/fetch-router": "^0.19.0"
   },
   "keywords": [
     "fetch",
@@ -47,6 +47,7 @@
     "build": "tsgo -p tsconfig.build.json",
     "clean": "git clean -fdX",
     "test": "remix-test",
+    "test:bun": "bun x --bun remix-test",
     "typecheck": "tsgo --noEmit"
   }
 }

package/src/lib/cop.ts

@@ -1,4 +1,4 @@
-import { RequestMethods } from '@remix-run/fetch-router'
+import { isRequestMethod } from '@remix-run/fetch-router'
 import type { Middleware, RequestContext, RequestMethod } from '@remix-run/fetch-router'
 
 const safeMethods: RequestMethod[] = ['GET', 'HEAD', 'OPTIONS']
@@ -77,7 +77,7 @@ class CrossOriginProtection {
   }
 
   check(context: RequestContext): CopFailureReason | null {
-    if (safeMethods.includes(context.method)) {
+    if (isSafeMethod(context.method)) {
       return null
     }
 
@@ -130,6 +130,10 @@ class CrossOriginProtection {
   }
 }
 
+function isSafeMethod(method: string): boolean {
+  return isRequestMethod(method) && safeMethods.includes(method)
+}
+
 /**
  * Creates middleware that rejects unsafe cross-origin requests.
  *
@@ -228,8 +232,8 @@ function parseBypassPattern(pattern: string): BypassPattern {
   let methodPattern = /^([A-Z]+)\s+(.+)$/.exec(trimmedPattern)
 
   if (methodPattern != null && methodPattern[2].startsWith('/')) {
-    let maybeMethod = methodPattern[1] as RequestMethod
-    if (!RequestMethods.includes(maybeMethod)) {
+    let maybeMethod = methodPattern[1]
+    if (!isRequestMethod(maybeMethod)) {
       throw new Error(`invalid request method in bypass pattern ${JSON.stringify(pattern)}`)
     }