@revealui/core 0.2.1 → 0.5.0

package/dist/security/headers.js

@@ -1,402 +0,0 @@
-/**
- * Security Headers and CORS Configuration
- *
- * HTTP security headers and CORS policy management
- */
-/**
- * Security headers manager
- */
-export class SecurityHeaders {
-    config;
-    constructor(config = {}) {
-        this.config = config;
-    }
-    /**
-     * Get all security headers
-     */
-    getHeaders() {
-        const headers = {};
-        // Content Security Policy
-        if (this.config.contentSecurityPolicy) {
-            headers['Content-Security-Policy'] = this.buildCSP(this.config.contentSecurityPolicy);
-        }
-        // Strict Transport Security
-        if (this.config.strictTransportSecurity) {
-            headers['Strict-Transport-Security'] = this.buildHSTS(this.config.strictTransportSecurity);
-        }
-        // X-Frame-Options
-        if (this.config.xFrameOptions) {
-            headers['X-Frame-Options'] = this.config.xFrameOptions;
-        }
-        // X-Content-Type-Options
-        if (this.config.xContentTypeOptions !== false) {
-            headers['X-Content-Type-Options'] = 'nosniff';
-        }
-        // Referrer-Policy
-        if (this.config.referrerPolicy) {
-            headers['Referrer-Policy'] = this.config.referrerPolicy;
-        }
-        // Permissions-Policy
-        if (this.config.permissionsPolicy) {
-            headers['Permissions-Policy'] = this.buildPermissionsPolicy(this.config.permissionsPolicy);
-        }
-        // Cross-Origin headers
-        if (this.config.crossOriginEmbedderPolicy) {
-            headers['Cross-Origin-Embedder-Policy'] = this.config.crossOriginEmbedderPolicy;
-        }
-        if (this.config.crossOriginOpenerPolicy) {
-            headers['Cross-Origin-Opener-Policy'] = this.config.crossOriginOpenerPolicy;
-        }
-        if (this.config.crossOriginResourcePolicy) {
-            headers['Cross-Origin-Resource-Policy'] = this.config.crossOriginResourcePolicy;
-        }
-        return headers;
-    }
-    /**
-     * Build Content Security Policy header
-     */
-    buildCSP(config) {
-        if (typeof config === 'string') {
-            return config;
-        }
-        const directives = [];
-        const addDirective = (name, values) => {
-            if (values && values.length > 0) {
-                directives.push(`${name} ${values.join(' ')}`);
-            }
-        };
-        addDirective('default-src', config.defaultSrc);
-        addDirective('script-src', config.scriptSrc);
-        addDirective('style-src', config.styleSrc);
-        addDirective('img-src', config.imgSrc);
-        addDirective('font-src', config.fontSrc);
-        addDirective('connect-src', config.connectSrc);
-        addDirective('frame-src', config.frameSrc);
-        addDirective('object-src', config.objectSrc);
-        addDirective('media-src', config.mediaSrc);
-        addDirective('worker-src', config.workerSrc);
-        addDirective('child-src', config.childSrc);
-        addDirective('form-action', config.formAction);
-        addDirective('frame-ancestors', config.frameAncestors);
-        addDirective('base-uri', config.baseUri);
-        addDirective('manifest-src', config.manifestSrc);
-        if (config.upgradeInsecureRequests) {
-            directives.push('upgrade-insecure-requests');
-        }
-        if (config.blockAllMixedContent) {
-            directives.push('block-all-mixed-content');
-        }
-        if (config.reportUri) {
-            directives.push(`report-uri ${config.reportUri}`);
-        }
-        if (config.reportTo) {
-            directives.push(`report-to ${config.reportTo}`);
-        }
-        return directives.join('; ');
-    }
-    /**
-     * Build HSTS header
-     */
-    buildHSTS(config) {
-        if (config === true) {
-            return 'max-age=31536000; includeSubDomains';
-        }
-        if (config === false) {
-            return '';
-        }
-        // config is now HSTSConfig
-        const parts = [`max-age=${config.maxAge}`];
-        if (config.includeSubDomains) {
-            parts.push('includeSubDomains');
-        }
-        if (config.preload) {
-            parts.push('preload');
-        }
-        return parts.join('; ');
-    }
-    /**
-     * Build Permissions-Policy header
-     */
-    buildPermissionsPolicy(config) {
-        if (typeof config === 'string') {
-            return config;
-        }
-        const policies = [];
-        Object.entries(config).forEach(([feature, origins]) => {
-            if (!origins || origins.length === 0) {
-                policies.push(`${feature}=()`);
-            }
-            else if (origins.includes('*')) {
-                policies.push(`${feature}=*`);
-            }
-            else {
-                const originsList = origins.map((o) => `"${o}"`).join(' ');
-                policies.push(`${feature}=(${originsList})`);
-            }
-        });
-        return policies.join(', ');
-    }
-    /**
-     * Apply headers to response
-     */
-    applyHeaders(response) {
-        const headers = this.getHeaders();
-        Object.entries(headers).forEach(([name, value]) => {
-            response.headers.set(name, value);
-        });
-        return response;
-    }
-}
-/**
- * CORS manager
- */
-export class CORSManager {
-    config;
-    constructor(config = {}) {
-        this.config = {
-            origin: config.origin ?? [],
-            methods: config.methods || ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
-            allowedHeaders: config.allowedHeaders || ['Content-Type', 'Authorization'],
-            exposedHeaders: config.exposedHeaders || [],
-            credentials: config.credentials ?? false,
-            maxAge: config.maxAge || 86400,
-            preflightContinue: config.preflightContinue ?? false,
-            optionsSuccessStatus: config.optionsSuccessStatus || 204,
-        };
-    }
-    /**
-     * Check if origin is allowed
-     */
-    isOriginAllowed(origin) {
-        const { origin: allowedOrigin } = this.config;
-        if (allowedOrigin === '*') {
-            return true;
-        }
-        if (typeof allowedOrigin === 'function') {
-            return allowedOrigin(origin);
-        }
-        if (typeof allowedOrigin === 'string') {
-            return origin === allowedOrigin;
-        }
-        if (Array.isArray(allowedOrigin)) {
-            return allowedOrigin.includes(origin);
-        }
-        return false;
-    }
-    /**
-     * Get CORS headers
-     */
-    getCORSHeaders(origin) {
-        const headers = {};
-        // Access-Control-Allow-Origin
-        if (this.isOriginAllowed(origin)) {
-            headers['Access-Control-Allow-Origin'] = this.config.origin === '*' ? '*' : origin;
-        }
-        // Access-Control-Allow-Credentials — incompatible with origin: '*' per Fetch spec
-        if (this.config.credentials && this.config.origin !== '*') {
-            headers['Access-Control-Allow-Credentials'] = 'true';
-        }
-        // Access-Control-Expose-Headers
-        if (this.config.exposedHeaders.length > 0) {
-            headers['Access-Control-Expose-Headers'] = this.config.exposedHeaders.join(', ');
-        }
-        return headers;
-    }
-    /**
-     * Get preflight headers
-     */
-    getPreflightHeaders(origin) {
-        const headers = this.getCORSHeaders(origin);
-        // Access-Control-Allow-Methods
-        headers['Access-Control-Allow-Methods'] = this.config.methods.join(', ');
-        // Access-Control-Allow-Headers
-        headers['Access-Control-Allow-Headers'] = this.config.allowedHeaders.join(', ');
-        // Access-Control-Max-Age
-        headers['Access-Control-Max-Age'] = this.config.maxAge.toString();
-        return headers;
-    }
-    /**
-     * Handle CORS request
-     */
-    handleRequest(request) {
-        const origin = request.headers.get('Origin');
-        if (!origin) {
-            return null;
-        }
-        // Handle preflight
-        if (request.method === 'OPTIONS') {
-            return this.handlePreflight(request, origin);
-        }
-        return null;
-    }
-    /**
-     * Handle preflight request
-     */
-    handlePreflight(_request, origin) {
-        if (!this.isOriginAllowed(origin)) {
-            return new Response(null, { status: 403 });
-        }
-        const headers = this.getPreflightHeaders(origin);
-        return new Response(null, {
-            status: this.config.optionsSuccessStatus,
-            headers,
-        });
-    }
-    /**
-     * Apply CORS headers to response
-     */
-    applyHeaders(response, origin) {
-        if (!this.isOriginAllowed(origin)) {
-            return response;
-        }
-        const headers = this.getCORSHeaders(origin);
-        Object.entries(headers).forEach(([name, value]) => {
-            response.headers.set(name, value);
-        });
-        return response;
-    }
-}
-/**
- * Common security header presets
- */
-export const SecurityPresets = {
-    /**
-     * Strict security (recommended for production)
-     */
-    strict: () => ({
-        contentSecurityPolicy: {
-            defaultSrc: ["'self'"],
-            scriptSrc: ["'self'"],
-            styleSrc: ["'self'", "'unsafe-inline'"],
-            imgSrc: ["'self'", 'data:', 'https:'],
-            fontSrc: ["'self'", 'data:'],
-            connectSrc: ["'self'"],
-            frameSrc: ["'none'"],
-            objectSrc: ["'none'"],
-            baseUri: ["'self'"],
-            formAction: ["'self'"],
-            frameAncestors: ["'none'"],
-            upgradeInsecureRequests: true,
-        },
-        strictTransportSecurity: {
-            maxAge: 31536000,
-            includeSubDomains: true,
-            preload: true,
-        },
-        xFrameOptions: 'DENY',
-        xContentTypeOptions: true,
-        referrerPolicy: 'strict-origin-when-cross-origin',
-        crossOriginEmbedderPolicy: 'require-corp',
-        crossOriginOpenerPolicy: 'same-origin',
-        crossOriginResourcePolicy: 'same-origin',
-    }),
-    /**
-     * Moderate security (balanced)
-     */
-    moderate: () => ({
-        contentSecurityPolicy: {
-            defaultSrc: ["'self'"],
-            scriptSrc: ["'self'", "'unsafe-inline'"],
-            styleSrc: ["'self'", "'unsafe-inline'"],
-            imgSrc: ["'self'", 'data:', 'https:'],
-            fontSrc: ["'self'", 'data:', 'https:'],
-            connectSrc: ["'self'", 'https:'],
-            frameAncestors: ["'self'"],
-        },
-        strictTransportSecurity: {
-            maxAge: 31536000,
-            includeSubDomains: true,
-        },
-        xFrameOptions: 'SAMEORIGIN',
-        xContentTypeOptions: true,
-        referrerPolicy: 'origin-when-cross-origin',
-    }),
-    /**
-     * Development (permissive)
-     */
-    development: () => ({
-        xContentTypeOptions: true,
-        referrerPolicy: 'no-referrer-when-downgrade',
-    }),
-};
-/**
- * Common CORS presets
- */
-export const CORSPresets = {
-    /**
-     * Strict CORS (same origin only)
-     */
-    strict: () => ({
-        origin: [],
-        methods: ['GET', 'POST', 'PUT', 'DELETE'],
-        allowedHeaders: ['Content-Type', 'Authorization'],
-        credentials: true,
-        maxAge: 86400,
-    }),
-    /**
-     * Moderate CORS (specific origins)
-     */
-    moderate: (allowedOrigins) => ({
-        origin: allowedOrigins,
-        methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
-        allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],
-        exposedHeaders: ['X-Total-Count'],
-        credentials: true,
-        maxAge: 86400,
-    }),
-    /**
-     * Permissive CORS (all origins)
-     */
-    permissive: () => ({
-        origin: '*',
-        methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
-        allowedHeaders: ['*'],
-        credentials: false,
-        maxAge: 86400,
-    }),
-    /**
-     * API CORS (for public APIs)
-     */
-    api: () => ({
-        origin: '*',
-        methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
-        allowedHeaders: ['Content-Type', 'Authorization', 'X-API-Key'],
-        exposedHeaders: ['X-RateLimit-Limit', 'X-RateLimit-Remaining', 'X-RateLimit-Reset'],
-        credentials: false,
-        maxAge: 86400,
-    }),
-};
-/**
- * Security middleware creator
- */
-export function createSecurityMiddleware(securityConfig, corsConfig) {
-    const security = new SecurityHeaders(securityConfig);
-    const cors = new CORSManager(corsConfig);
-    return async (request, next) => {
-        const origin = request.headers.get('Origin');
-        // Handle CORS preflight
-        if (origin && request.method === 'OPTIONS') {
-            const preflightResponse = cors.handleRequest(request);
-            if (preflightResponse) {
-                return preflightResponse;
-            }
-        }
-        // Process request
-        const response = await next();
-        // Apply security headers
-        security.applyHeaders(response);
-        // Apply CORS headers
-        if (origin) {
-            cors.applyHeaders(response, origin);
-        }
-        return response;
-    };
-}
-/**
- * Rate limiting headers
- */
-export function setRateLimitHeaders(response, limit, remaining, reset) {
-    response.headers.set('X-RateLimit-Limit', limit.toString());
-    response.headers.set('X-RateLimit-Remaining', remaining.toString());
-    response.headers.set('X-RateLimit-Reset', reset.toString());
-}

package/dist/utils/jwt-validation.d.ts

@@ -1,14 +0,0 @@
-/**
- * JWT Validation Utilities
- *
- * Utilities for validating JWT tokens from RevealRequest objects.
- */
-import type { RevealRequest } from '../types/index.js';
-/**
- * Validate JWT token from request authorization header
- *
- * @param req - RevealRequest object
- * @throws Error if token is invalid or expired
- */
-export declare function validateJWTFromRequest(req?: RevealRequest): Promise<void>;
-//# sourceMappingURL=jwt-validation.d.ts.map

package/dist/utils/jwt-validation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-validation.d.ts","sourceRoot":"","sources":["../../src/utils/jwt-validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGtD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B/E"}

package/dist/utils/jwt-validation.js

@@ -1,36 +0,0 @@
-/**
- * JWT Validation Utilities
- *
- * Utilities for validating JWT tokens from RevealRequest objects.
- */
-import { jwtVerify } from 'jose';
-import { extractAuthHeader } from './request-headers.js';
-/**
- * Validate JWT token from request authorization header
- *
- * @param req - RevealRequest object
- * @throws Error if token is invalid or expired
- */
-export async function validateJWTFromRequest(req) {
-    const authHeader = extractAuthHeader(req);
-    if (!authHeader || typeof authHeader !== 'string') {
-        return; // No auth header, skip validation
-    }
-    // Extract token from "JWT <token>" format
-    if (!authHeader.startsWith('JWT ')) {
-        return; // Not a JWT token, skip validation
-    }
-    const token = authHeader.substring(4);
-    const secret = process.env.REVEALUI_SECRET;
-    if (!secret || secret.length < 32) {
-        throw new Error('REVEALUI_SECRET must be set to a secure random value (minimum 32 characters). ' +
-            'Generate one with: openssl rand -base64 32');
-    }
-    try {
-        await jwtVerify(token, new TextEncoder().encode(secret));
-    }
-    catch (_error) {
-        // Token is invalid, expired, or tampered
-        throw new Error('Invalid or expired token');
-    }
-}

package/dist/utils/request-headers.d.ts

@@ -1,15 +0,0 @@
-/**
- * Request Header Utilities
- *
- * Utilities for extracting headers from RevealRequest objects.
- * Handles various header types (Headers, Map, plain object).
- */
-import type { RevealRequest } from '../types/index.js';
-/**
- * Extract authorization header from request
- *
- * @param req - RevealRequest object
- * @returns Authorization header value or null if not found
- */
-export declare function extractAuthHeader(req?: RevealRequest): string | null;
-//# sourceMappingURL=request-headers.d.ts.map

package/dist/utils/request-headers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-headers.d.ts","sourceRoot":"","sources":["../../src/utils/request-headers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAqBpE"}

package/dist/utils/request-headers.js

@@ -1,31 +0,0 @@
-/**
- * Request Header Utilities
- *
- * Utilities for extracting headers from RevealRequest objects.
- * Handles various header types (Headers, Map, plain object).
- */
-/**
- * Extract authorization header from request
- *
- * @param req - RevealRequest object
- * @returns Authorization header value or null if not found
- */
-export function extractAuthHeader(req) {
-    if (!req?.headers) {
-        return null;
-    }
-    let authHeader;
-    // Handle Headers object
-    if (req.headers instanceof Headers) {
-        authHeader = req.headers.get('authorization') || undefined;
-    }
-    // Handle Map object (used in tests) - type cast to avoid TS error
-    else if (req.headers instanceof Map) {
-        authHeader = req.headers.get('authorization') || undefined;
-    }
-    // Handle plain object with authorization property
-    else if (typeof req.headers === 'object' && 'authorization' in req.headers) {
-        authHeader = req.headers.authorization;
-    }
-    return authHeader || null;
-}