@rimelight/security 0.0.11 → 0.0.13

package/dist/config/index.d.mts

@@ -1,3 +1,3 @@
-import { t as SecurityOptions } from "../types-t69O3m_O.mjs";
+import { n as SecurityOptions, t as ConstructionOptions } from "../types-BdTXMZBc.mjs";
 import { buildCspHeader } from "../csp.mjs";
-export { SecurityOptions, buildCspHeader };
+export { ConstructionOptions, SecurityOptions, buildCspHeader };

package/dist/csp.d.mts

@@ -1,4 +1,4 @@
-import { t as SecurityOptions } from "./types-t69O3m_O.mjs";
+import { n as SecurityOptions } from "./types-BdTXMZBc.mjs";
 //#region src/csp.d.ts
 /**
  * Builds the Content-Security-Policy header string dynamically for a given request nonce.

package/dist/index.d.mts

@@ -1,4 +1,5 @@
-import { t as SecurityOptions } from "./types-t69O3m_O.mjs";
+import { n as SecurityOptions, t as ConstructionOptions } from "./types-BdTXMZBc.mjs";
 import { buildCspHeader } from "./csp.mjs";
 import { RimelightSecurityPlugin, SecurityPluginOptions, security } from "./vite.mjs";
-export { RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, security, security as sri };
+import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./middleware/construction.mjs";
+export { CONSTRUCTION_GUEST_COOKIE, ConstructionOptions, RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, construction, isConstructionGuest, security, security as sri, signInConstructionGuest };

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import "./types.mjs";
 import { buildCspHeader } from "./csp.mjs";
 import { security } from "./vite.mjs";
-export { buildCspHeader, security, security as sri };
+import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./middleware/construction.mjs";
+export { CONSTRUCTION_GUEST_COOKIE, buildCspHeader, construction, isConstructionGuest, security, security as sri, signInConstructionGuest };

package/dist/middleware/construction.d.mts

@@ -0,0 +1,20 @@
+import { t as ConstructionOptions } from "../types-BdTXMZBc.mjs";
+//#region src/middleware/construction.d.ts
+export declare const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
+/**
+ * Validates whether the incoming request carries a valid, signed construction guest cookie.
+ */
+export declare const isConstructionGuest: (c: any, options?: ConstructionOptions) => Promise<boolean>;
+/**
+ * Signs and sets the construction guest cookie on the Hono or Astro context.
+ */
+export declare const signInConstructionGuest: (c: any, passphrase: string, rememberMe?: boolean, options?: ConstructionOptions) => Promise<boolean>;
+/**
+ * Universal Construction Mode Middleware for Hono and Astro.
+ *
+ * Intercepts unauthenticated traffic when CONSTRUCTION_MODE is active, handles POST requests to the
+ * guest auth endpoint automatically, and passes authenticated requests or whitelisted assets
+ * cleanly.
+ */
+export declare function construction(options?: ConstructionOptions): (c: any, next: any) => Promise<any>;
+//#endregion

package/dist/middleware/construction.mjs

@@ -0,0 +1,192 @@
+import { getCookie, setCookie } from "hono/cookie";
+//#region src/middleware/construction.ts
+const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
+const DEFAULT_WHITELISTED_PATTERNS = [
+	"/construction",
+	"/api/auth",
+	"/api/construction-guest",
+	"/_astro/",
+	"/_image",
+	"/favicon.",
+	"/robots.txt",
+	"/sitemap",
+	"/.well-known/"
+];
+const getPassphrase = (c, options) => {
+	if (options?.passphrase) return options.passphrase;
+	const envKey = options?.passphraseEnvKey ?? "CONSTRUCTION_PASSPHRASE";
+	return c?.env?.[envKey] ?? (typeof process !== "undefined" ? process.env?.[envKey] : void 0) ?? import.meta.env?.[envKey];
+};
+const isModeEnabled = (c, options) => {
+	const envKey = options?.modeEnvKey ?? "CONSTRUCTION_MODE";
+	const val = c?.env?.[envKey] ?? (typeof process !== "undefined" ? process.env?.[envKey] : void 0) ?? import.meta.env?.[envKey];
+	return val === "true" || val === true;
+};
+const encodeBase64Url = (value) => btoa(String.fromCharCode(...value)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const decodeBase64Url = (value) => {
+	const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+	return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0));
+};
+const signHmac = async (payload, secret) => {
+	const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign", "verify"]);
+	return {
+		key,
+		signature: await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload))
+	};
+};
+const getContextHelpers = (c) => {
+	const req = c.req?.raw || c.request || c.req;
+	const urlObj = c.url instanceof URL ? c.url : req?.url ? new URL(req.url) : new URL("http://localhost/");
+	const path = c.req?.path || urlObj.pathname || "/";
+	const method = (c.req?.method || req?.method || "GET").toUpperCase();
+	const search = c.req?.url ? new URL(c.req.url).search : urlObj.search || "";
+	const redirect = (target) => {
+		if (typeof c.redirect === "function") return c.redirect(target);
+		const fullTarget = target.startsWith("http") ? target : new URL(target, urlObj.origin).toString();
+		return Response.redirect(fullTarget, 302);
+	};
+	const json = (data, status = 200) => {
+		if (typeof c.json === "function") return c.json(data, status);
+		return new Response(JSON.stringify(data), {
+			status,
+			headers: { "Content-Type": "application/json" }
+		});
+	};
+	const getCookieValue = (name) => {
+		try {
+			const fromHono = getCookie(c, name);
+			if (fromHono) return fromHono;
+		} catch {}
+		if (c.cookies?.get) {
+			const val = c.cookies.get(name);
+			return typeof val === "string" ? val : val?.value;
+		}
+		const match = (req?.headers?.get?.("cookie") || "").match(new RegExp(`(?:^|; )${name}=([^;]*)`));
+		return match ? decodeURIComponent(match[1]) : void 0;
+	};
+	return {
+		path,
+		method,
+		search,
+		redirect,
+		json,
+		getCookieValue
+	};
+};
+/**
+* Validates whether the incoming request carries a valid, signed construction guest cookie.
+*/
+const isConstructionGuest = async (c, options) => {
+	const cookieName = options?.cookieName ?? "rimelight-construction-guest";
+	const token = getContextHelpers(c).getCookieValue(cookieName);
+	const passphrase = getPassphrase(c, options);
+	if (!token || !passphrase) return false;
+	try {
+		const [encodedPayload, encodedSignature] = token.split(".");
+		if (!encodedPayload || !encodedSignature) return false;
+		const payload = new TextDecoder().decode(decodeBase64Url(encodedPayload));
+		const { key } = await signHmac(payload, passphrase);
+		const signatureBuffer = decodeBase64Url(encodedSignature);
+		return await crypto.subtle.verify("HMAC", key, signatureBuffer, new TextEncoder().encode(payload)) && JSON.parse(payload).expiresAt > Date.now();
+	} catch {
+		return false;
+	}
+};
+/**
+* Signs and sets the construction guest cookie on the Hono or Astro context.
+*/
+const signInConstructionGuest = async (c, passphrase, rememberMe = true, options) => {
+	const expectedPassphrase = getPassphrase(c, options);
+	if (!expectedPassphrase || !passphrase || passphrase !== expectedPassphrase) return false;
+	const cookieName = options?.cookieName ?? "rimelight-construction-guest";
+	const maxAge = options?.cookieMaxAge ?? 604800;
+	const payload = JSON.stringify({ expiresAt: Date.now() + maxAge * 1e3 });
+	const { signature } = await signHmac(payload, expectedPassphrase);
+	const cookieValue = encodeBase64Url(new TextEncoder().encode(payload)) + "." + encodeBase64Url(new Uint8Array(signature));
+	try {
+		setCookie(c, cookieName, cookieValue, {
+			httpOnly: true,
+			secure: true,
+			sameSite: "Lax",
+			path: "/",
+			...rememberMe ? { maxAge } : {}
+		});
+	} catch {
+		if (c.cookies?.set) c.cookies.set(cookieName, cookieValue, {
+			httpOnly: true,
+			secure: true,
+			sameSite: "lax",
+			path: "/",
+			...rememberMe ? { maxAge } : {}
+		});
+	}
+	return true;
+};
+const resolveLocale = (path, options) => {
+	if (options?.getLocale) return options.getLocale(path);
+	if (options?.locales && options.locales.length > 0) {
+		const matched = options.locales.find((loc) => path === `/${loc}` || path.startsWith(`/${loc}/`));
+		if (matched) return matched;
+	}
+	return path.match(/^\/([a-zA-Z]{2}(?:-[a-zA-Z]{2})?)(\/|$)/)?.[1]?.toLowerCase() ?? "en";
+};
+/**
+* Universal Construction Mode Middleware for Hono and Astro.
+*
+* Intercepts unauthenticated traffic when CONSTRUCTION_MODE is active, handles POST requests to the
+* guest auth endpoint automatically, and passes authenticated requests or whitelisted assets
+* cleanly.
+*/
+function construction(options = {}) {
+	const apiPath = options.apiPath !== void 0 ? options.apiPath : "/api/construction-guest";
+	const constructionPath = options.constructionPath ?? "/construction";
+	return async (c, next) => {
+		const { path, method, search, redirect, json } = getContextHelpers(c);
+		if (apiPath && path === apiPath && method === "POST") try {
+			let body = {};
+			if (typeof c.req?.json === "function") body = await c.req.json().catch(() => ({}));
+			else if (c.request) body = await c.request.json().catch(() => ({}));
+			if (!await signInConstructionGuest(c, body?.passphrase ?? "", body?.rememberMe ?? true, options)) return json({ error: "Invalid credentials" }, 401);
+			return json({ success: true });
+		} catch (err) {
+			return json({ error: err?.message || "Authentication failed" }, 400);
+		}
+		const enabled = isModeEnabled(c, options);
+		const locale = resolveLocale(path, options);
+		const isConstructionPage = path === constructionPath || path === `/${locale}${constructionPath}` || path.endsWith(constructionPath);
+		const isAuthorized = async () => {
+			if (options.isAuthorized) {
+				if (await options.isAuthorized(c)) return true;
+			}
+			if (c.get?.("session") || c.get?.("user") || c.locals?.session || c.locals?.user) return true;
+			return await isConstructionGuest(c, options);
+		};
+		if (isConstructionPage) {
+			if (!enabled || await isAuthorized()) return redirect(`/${locale}`);
+			return next();
+		}
+		if (!enabled) return next();
+		if (DEFAULT_WHITELISTED_PATTERNS.some((pattern) => path.includes(pattern))) return next();
+		if (options.whitelist) {
+			if (typeof options.whitelist === "function") {
+				if (options.whitelist(path)) return next();
+			} else if (Array.isArray(options.whitelist)) {
+				if (options.whitelist.some((pattern) => typeof pattern === "string" ? path.includes(pattern) : pattern.test(path))) return next();
+			}
+		}
+		if (await isAuthorized()) return next();
+		const redirectTo = encodeURIComponent(path + search);
+		const targetUrl = `/${locale}${constructionPath}?redirect=${redirectTo}`;
+		if (options.onUnauthorized) return options.onUnauthorized(c, {
+			locale,
+			path,
+			redirectUrl: targetUrl
+		});
+		return redirect(targetUrl);
+	};
+}
+//#endregion
+export { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest };

package/dist/middleware/index.d.mts

@@ -1,3 +1,4 @@
+import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./construction.mjs";
 import { devOnly } from "./dev-only.mjs";
 import { security } from "./security.mjs";
-export { devOnly, security };
+export { CONSTRUCTION_GUEST_COOKIE, construction, devOnly, isConstructionGuest, security, signInConstructionGuest };

package/dist/middleware/index.mjs

@@ -1,3 +1,4 @@
+import { CONSTRUCTION_GUEST_COOKIE, construction, isConstructionGuest, signInConstructionGuest } from "./construction.mjs";
 import { devOnly } from "./dev-only.mjs";
 import { security } from "./security.mjs";
-export { devOnly, security };
+export { CONSTRUCTION_GUEST_COOKIE, construction, devOnly, isConstructionGuest, security, signInConstructionGuest };

package/dist/middleware/security.d.mts

@@ -1,4 +1,4 @@
-import { t as SecurityOptions } from "../types-t69O3m_O.mjs";
+import { n as SecurityOptions } from "../types-BdTXMZBc.mjs";
 //#region src/middleware/security.d.ts
 /**
  * Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,

package/dist/{types-t69O3m_O.d.mts → types-BdTXMZBc.d.mts}

@@ -59,5 +59,63 @@ interface SecurityOptions {
    */
   headers?: Record<string, string>;
 }
+interface ConstructionOptions {
+  /**
+   * Environment variable key for construction mode flag ("true" | "false"). Defaults to
+   * "CONSTRUCTION_MODE".
+   */
+  modeEnvKey?: string;
+  /**
+   * Environment variable key for the passphrase secret. Defaults to "CONSTRUCTION_PASSPHRASE".
+   */
+  passphraseEnvKey?: string;
+  /**
+   * Explicit passphrase override (if not reading from env).
+   */
+  passphrase?: string;
+  /**
+   * Cookie name used for guest authorization token. Defaults to "rimelight-construction-guest".
+   */
+  cookieName?: string;
+  /**
+   * Cookie max age in seconds when "remember me" is enabled. Defaults to 7 days (604,800 seconds).
+   */
+  cookieMaxAge?: number;
+  /**
+   * List of supported locales or custom resolver.
+   */
+  locales?: string[];
+  /**
+   * Custom locale extractor from request path.
+   */
+  getLocale?: (path: string) => string;
+  /**
+   * Custom path for the construction page. Defaults to "/construction".
+   */
+  constructionPath?: string;
+  /**
+   * API endpoint to automatically handle guest sign-in. Set to `false` to disable automatic API
+   * interception. Defaults to "/api/construction-guest".
+   */
+  apiPath?: string | false;
+  /**
+   * Additional routes / prefixes to whitelist and skip gating.
+   */
+  whitelist?: (string | RegExp)[] | ((path: string) => boolean);
+  /**
+   * Custom authorization predicate. If returns true, request is allowed through. Defaults to
+   * checking `c.get("session") || await isConstructionGuest(c, options)`.
+   */
+  isAuthorized?: (c: any) => boolean | Promise<boolean>;
+  /**
+   * Custom handler when unauthorized. Defaults to redirecting to
+   * `/${locale}/construction?redirect=${encodeURIComponent(path)}`.
+   */
+  onUnauthorized?: (c: any, meta: {
+    locale: string;
+    path: string;
+    redirectUrl: string;
+  }) => Response | Promise<Response>;
+}
 //#endregion
-export { SecurityOptions as t };
+export { SecurityOptions as n, ConstructionOptions as t };

package/dist/types.d.mts

@@ -1,2 +1,2 @@
-import { t as SecurityOptions } from "./types-t69O3m_O.mjs";
-export { SecurityOptions };
+import { n as SecurityOptions, t as ConstructionOptions } from "./types-BdTXMZBc.mjs";
+export { ConstructionOptions, SecurityOptions };

package/dist/vite.d.mts

@@ -1,4 +1,4 @@
-import { t as SecurityOptions } from "./types-t69O3m_O.mjs";
+import { n as SecurityOptions } from "./types-BdTXMZBc.mjs";
 //#region src/vite.d.ts
 export interface RimelightSecurityPlugin {
   name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -38,14 +38,24 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "@rimelight/ui": "0.0.51"
+  },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.8",
+    "@rimelight/config": "0.0.9",
     "astro": "7.3.2",
+    "hono": "4.12.3",
     "typescript": "6.0.3"
   },
   "peerDependencies": {
-    "astro": ">=7.0.0"
+    "astro": ">=7.0.0",
+    "hono": ">=4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "hono": {
+      "optional": true
+    }
   },
   "engines": {
     "node": ">=26.8.2"

package/src/components/ConstructionSignIn.astro

@@ -0,0 +1,148 @@
+---
+import RLACard from "@rimelight/ui/components/card/RLACard.astro"
+import RLAFormField from "@rimelight/ui/components/form-field/RLAFormField.astro"
+import RLAInput from "@rimelight/ui/components/input/RLAInput.astro"
+import RLAButton from "@rimelight/ui/components/button/RLAButton.astro"
+import RLACheckbox from "@rimelight/ui/components/checkbox/RLACheckbox.astro"
+
+interface Props {
+  allowAuth?: boolean
+  endpoint?: string
+  passphraseLabel?: string
+  passphrasePlaceholder?: string
+  rememberMeLabel?: string
+  signInButtonLabel?: string
+  loadingButtonLabel?: string
+  returnLaterText?: string
+  class?: string
+}
+
+const {
+  allowAuth = true,
+  endpoint = "/api/construction-guest",
+  passphraseLabel = "Passphrase",
+  passphrasePlaceholder = "Enter passphrase...",
+  rememberMeLabel = "Remember me",
+  signInButtonLabel = "Sign In",
+  loadingButtonLabel = "Signing In...",
+  returnLaterText = "Please return at a later stage.",
+  class: className = ""
+} = Astro.props
+---
+
+{
+  allowAuth ? (
+    <RLACard class={`bg-black text-left w-full max-w-md ${className}`}>
+      <slot name="header" />
+      <form id="construction-sign-in-form" data-endpoint={endpoint} class="flex flex-col gap-4">
+        <p id="construction-error-message" class="text-red-500 text-sm hidden" role="alert" />
+
+        <div class="flex flex-col gap-4">
+          <RLAFormField
+            label={passphraseLabel}
+            required
+            ui={{
+              label: "text-white",
+              description: "text-neutral-500"
+            }}
+          >
+            <RLAInput
+              id="construction-passphrase-input"
+              type="password"
+              name="passphrase"
+              placeholder={passphrasePlaceholder}
+              class="w-full text-white"
+              required
+              autocomplete="current-password"
+            />
+          </RLAFormField>
+
+          <RLACheckbox
+            id="construction-remember-me-checkbox"
+            name="rememberMe"
+            label={rememberMeLabel}
+            checked
+            ui={{
+              label: "text-white",
+              indicator: "data-[state=checked]:bg-primary-500 data-[state=checked]:text-white"
+            }}
+          />
+
+          <RLAButton
+            id="construction-submit-button"
+            type="submit"
+            color="primary"
+            variant="solid"
+            block
+            class="text-white bg-primary-500 hover:bg-primary-600 w-full"
+            data-label={signInButtonLabel}
+            data-loading-label={loadingButtonLabel}
+          >
+            {signInButtonLabel}
+          </RLAButton>
+        </div>
+      </form>
+      <slot name="footer" />
+    </RLACard>
+  ) : (
+    <p class="text-neutral-400">{returnLaterText}</p>
+  )
+}
+
+<script>
+  function getRedirectParam() {
+    const params = new URLSearchParams(window.location.search)
+    return params.get("redirect") || "/"
+  }
+
+  const form = document.getElementById("construction-sign-in-form") as HTMLFormElement | null
+  const passphraseInput = document.getElementById("construction-passphrase-input") as HTMLInputElement | null
+  const rememberCheckbox = document.getElementById("construction-remember-me-checkbox") as HTMLInputElement | null
+  const errorMessage = document.getElementById("construction-error-message")
+  const submitButton = document.getElementById("construction-submit-button")
+
+  if (form) {
+    form.addEventListener("submit", async (event) => {
+      event.preventDefault()
+      if (!passphraseInput || !submitButton || !errorMessage) return
+
+      const endpoint = form.getAttribute("data-endpoint") || "/api/construction-guest"
+      const defaultLabel = submitButton.getAttribute("data-label") || "Sign In"
+      const loadingLabel = submitButton.getAttribute("data-loading-label") || "Signing In..."
+
+      // Set loading state
+      submitButton.setAttribute("disabled", "true")
+      submitButton.textContent = loadingLabel
+      errorMessage.classList.add("hidden")
+      errorMessage.textContent = ""
+
+      try {
+        const response = await fetch(endpoint, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            passphrase: passphraseInput.value,
+            rememberMe: rememberCheckbox ? rememberCheckbox.checked : true
+          })
+        })
+
+        const data = (await response.json().catch(() => ({}))) as { error?: string; success?: boolean }
+
+        if (!response.ok || !data.success) {
+          errorMessage.textContent = data?.error || "Invalid credentials"
+          errorMessage.classList.remove("hidden")
+          submitButton.removeAttribute("disabled")
+          submitButton.textContent = defaultLabel
+          return
+        }
+
+        window.location.href = getRedirectParam()
+      } catch (err: any) {
+        errorMessage.textContent = err?.message || "An unexpected error occurred."
+        errorMessage.classList.remove("hidden")
+        submitButton.removeAttribute("disabled")
+        submitButton.textContent = defaultLabel
+      }
+    })
+  }
+</script>