@rimelight/security 0.0.18 → 0.0.20

package/src/middleware/construction.ts

@@ -0,0 +1,315 @@
+import { getCookie, setCookie } from "hono/cookie"
+import type { ConstructionOptions } from "../types"
+
+export const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest"
+
+const DEFAULT_WHITELISTED_PATTERNS = [
+  "/construction",
+  "/api/auth",
+  "/api/construction-guest",
+  "/_astro/",
+  "/_image",
+  "/favicon.",
+  "/robots.txt",
+  "/sitemap",
+  "/.well-known/"
+]
+
+const getPassphrase = (c: any, options?: ConstructionOptions): string | undefined => {
+  if (options?.passphrase) return options.passphrase
+  const envKey = options?.passphraseEnvKey ?? "CONSTRUCTION_PASSPHRASE"
+  return (
+    c?.env?.[envKey] ??
+    (typeof process !== "undefined" ? process.env?.[envKey] : undefined) ??
+    (import.meta as any)?.env?.[envKey]
+  )
+}
+
+const isModeEnabled = (c: any, options?: ConstructionOptions): boolean => {
+  const envKey = options?.modeEnvKey ?? "CONSTRUCTION_MODE"
+  const val =
+    c?.env?.[envKey] ??
+    (typeof process !== "undefined" ? process.env?.[envKey] : undefined) ??
+    (import.meta as any)?.env?.[envKey]
+  return val === "true" || val === true
+}
+
+const encodeBase64Url = (value: Uint8Array): string =>
+  btoa(String.fromCharCode(...value))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "")
+
+const decodeBase64Url = (value: string): Uint8Array => {
+  const padded = value
+    .replace(/-/g, "+")
+    .replace(/_/g, "/")
+    .padEnd(Math.ceil(value.length / 4) * 4, "=")
+  return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0))
+}
+
+const signHmac = async (payload: string, secret: string) => {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  )
+  return {
+    key,
+    signature: await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload))
+  }
+}
+
+const getContextHelpers = (c: any) => {
+  const req = c.req?.raw || c.request || c.req
+  const urlObj =
+    c.url instanceof URL ? c.url : req?.url ? new URL(req.url) : new URL("http://localhost/")
+  const path: string = c.req?.path || urlObj.pathname || "/"
+  const method: string = (c.req?.method || req?.method || "GET").toUpperCase()
+  const search: string = c.req?.url ? new URL(c.req.url).search : urlObj.search || ""
+
+  const redirect = (target: string) => {
+    if (typeof c.redirect === "function") {
+      return c.redirect(target)
+    }
+    const fullTarget = target.startsWith("http")
+      ? target
+      : new URL(target, urlObj.origin).toString()
+    return Response.redirect(fullTarget, 302)
+  }
+
+  const json = (data: any, status = 200) => {
+    if (typeof c.json === "function") {
+      return c.json(data, status)
+    }
+    return new Response(JSON.stringify(data), {
+      status,
+      headers: { "Content-Type": "application/json" }
+    })
+  }
+
+  const getCookieValue = (name: string): string | undefined => {
+    try {
+      const fromHono = getCookie(c, name)
+      if (fromHono) return fromHono
+    } catch {}
+
+    if (c.cookies?.get) {
+      const val = c.cookies.get(name)
+      return typeof val === "string" ? val : val?.value
+    }
+
+    const cookieHeader = req?.headers?.get?.("cookie") || ""
+    const match = cookieHeader.match(new RegExp(`(?:^|; )${name}=([^;]*)`))
+    return match ? decodeURIComponent(match[1]) : undefined
+  }
+
+  return { path, method, search, redirect, json, getCookieValue }
+}
+
+/**
+ * Validates whether the incoming request carries a valid, signed construction guest cookie.
+ */
+export const isConstructionGuest = async (
+  c: any,
+  options?: ConstructionOptions
+): Promise<boolean> => {
+  const cookieName = options?.cookieName ?? CONSTRUCTION_GUEST_COOKIE
+  const helpers = getContextHelpers(c)
+  const token = helpers.getCookieValue(cookieName)
+  const passphrase = getPassphrase(c, options)
+  if (!token || !passphrase) return false
+
+  try {
+    const [encodedPayload, encodedSignature] = token.split(".")
+    if (!encodedPayload || !encodedSignature) return false
+
+    const payload = new TextDecoder().decode(decodeBase64Url(encodedPayload))
+    const { key } = await signHmac(payload, passphrase)
+    const signatureBuffer = decodeBase64Url(encodedSignature)
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      signatureBuffer as unknown as BufferSource,
+      new TextEncoder().encode(payload)
+    )
+    return valid && JSON.parse(payload).expiresAt > Date.now()
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Signs and sets the construction guest cookie on the Hono or Astro context.
+ */
+export const signInConstructionGuest = async (
+  c: any,
+  passphrase: string,
+  rememberMe = true,
+  options?: ConstructionOptions
+): Promise<boolean> => {
+  const expectedPassphrase = getPassphrase(c, options)
+  if (!expectedPassphrase || !passphrase || passphrase !== expectedPassphrase) {
+    return false
+  }
+
+  const cookieName = options?.cookieName ?? CONSTRUCTION_GUEST_COOKIE
+  const maxAge = options?.cookieMaxAge ?? 60 * 60 * 24 * 7 // 7 days
+
+  const payload = JSON.stringify({
+    expiresAt: Date.now() + maxAge * 1000
+  })
+
+  const { signature } = await signHmac(payload, expectedPassphrase)
+  const cookieValue =
+    encodeBase64Url(new TextEncoder().encode(payload)) +
+    "." +
+    encodeBase64Url(new Uint8Array(signature))
+
+  try {
+    setCookie(c, cookieName, cookieValue, {
+      httpOnly: true,
+      secure: true,
+      sameSite: "Lax",
+      path: "/",
+      ...(rememberMe ? { maxAge } : {})
+    })
+  } catch {
+    if (c.cookies?.set) {
+      c.cookies.set(cookieName, cookieValue, {
+        httpOnly: true,
+        secure: true,
+        sameSite: "lax",
+        path: "/",
+        ...(rememberMe ? { maxAge } : {})
+      })
+    }
+  }
+
+  return true
+}
+
+const resolveLocale = (path: string, options?: ConstructionOptions): string => {
+  if (options?.getLocale) {
+    return options.getLocale(path)
+  }
+  if (options?.locales && options.locales.length > 0) {
+    const matched = options.locales.find((loc) => path === `/${loc}` || path.startsWith(`/${loc}/`))
+    if (matched) return matched
+  }
+  // Auto-detection using RFC-5646 language tag pattern at path start (e.g. /en, /en-US, /pt)
+  const match = path.match(/^\/([a-zA-Z]{2}(?:-[a-zA-Z]{2})?)(\/|$)/)
+  return match?.[1]?.toLowerCase() ?? "en"
+}
+
+/**
+ * Universal Construction Mode Middleware for Hono and Astro.
+ *
+ * Intercepts unauthenticated traffic when CONSTRUCTION_MODE is active, handles POST requests to the
+ * guest auth endpoint automatically, and passes authenticated requests or whitelisted assets
+ * cleanly.
+ */
+export function construction(options: ConstructionOptions = {}) {
+  const apiPath = options.apiPath !== undefined ? options.apiPath : "/api/construction-guest"
+  const constructionPath = options.constructionPath ?? "/construction"
+
+  return async (c: any, next: any) => {
+    const { path, method, search, redirect, json } = getContextHelpers(c)
+
+    // 1. Auto-handle API guest authentication endpoint
+    if (apiPath && path === apiPath && method === "POST") {
+      try {
+        let body: any = {}
+        if (typeof c.req?.json === "function") {
+          body = await c.req.json().catch(() => ({}))
+        } else if (c.request) {
+          body = await c.request.json().catch(() => ({}))
+        }
+
+        const signedIn = await signInConstructionGuest(
+          c,
+          body?.passphrase ?? "",
+          body?.rememberMe ?? true,
+          options
+        )
+
+        if (!signedIn) {
+          return json({ error: "Invalid credentials" }, 401)
+        }
+        return json({ success: true })
+      } catch (err: any) {
+        return json({ error: err?.message || "Authentication failed" }, 400)
+      }
+    }
+
+    const enabled = isModeEnabled(c, options)
+    const locale = resolveLocale(path, options)
+
+    const isConstructionPage =
+      path === constructionPath ||
+      path === `/${locale}${constructionPath}` ||
+      path.endsWith(constructionPath)
+
+    // Helper to check user authorization
+    const isAuthorized = async (): Promise<boolean> => {
+      if (options.isAuthorized) {
+        const customAuth = await options.isAuthorized(c)
+        if (customAuth) return true
+      }
+      const session = c.get?.("session") || c.get?.("user") || c.locals?.session || c.locals?.user
+      if (session) return true
+      return await isConstructionGuest(c, options)
+    }
+
+    // 2. If user visits the construction page directly:
+    if (isConstructionPage) {
+      if (!enabled || (await isAuthorized())) {
+        return redirect(`/${locale}`)
+      }
+      return next()
+    }
+
+    // 3. If construction mode is off, proceed normally
+    if (!enabled) {
+      return next()
+    }
+
+    // 4. Built-in and custom whitelist verification
+    const isWhitelisted = DEFAULT_WHITELISTED_PATTERNS.some((pattern) => path.includes(pattern))
+    if (isWhitelisted) {
+      return next()
+    }
+
+    if (options.whitelist) {
+      if (typeof options.whitelist === "function") {
+        if (options.whitelist(path)) return next()
+      } else if (Array.isArray(options.whitelist)) {
+        const match = options.whitelist.some((pattern) =>
+          typeof pattern === "string" ? path.includes(pattern) : pattern.test(path)
+        )
+        if (match) return next()
+      }
+    }
+
+    // 5. Authorized users proceed
+    if (await isAuthorized()) {
+      return next()
+    }
+
+    // 6. Redirect unauthorized users to construction page
+    const redirectTo = encodeURIComponent(path + search)
+    const targetUrl = `/${locale}${constructionPath}?redirect=${redirectTo}`
+
+    if (options.onUnauthorized) {
+      return options.onUnauthorized(c, {
+        locale,
+        path,
+        redirectUrl: targetUrl
+      })
+    }
+
+    return redirect(targetUrl)
+  }
+}

package/src/middleware/dev-only.ts

@@ -0,0 +1,16 @@
+/**
+ * Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
+ * this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
+ * routes and `/api/dev/` API routes in a single place.
+ *
+ * @example
+ *   // fetch.ts
+ *   import { devOnly } from "@rimelight/security/middleware"
+ *   app.use(devOnly)
+ */
+export const devOnly = async (c: any, next: any): Promise<Response> => {
+  if (!import.meta.env.DEV && c.req.path.includes("/dev/")) {
+    return c.notFound()
+  }
+  return next()
+}

package/src/middleware/index.ts

@@ -0,0 +1,4 @@
+export * from "./security"
+export * from "./dev-only"
+export * from "./construction"
+export * from "./ratelimit"

package/src/middleware/ratelimit.ts

@@ -0,0 +1,120 @@
+import type { RateLimitOptions, RateLimiterBinding } from "../types"
+
+const DEFAULT_SENSITIVE_ROUTES = ["/auth/sign-in", "/auth/sign-up", "/api/upload", "/api/chat"]
+
+/**
+ * Middleware to enforce rate limits on sensitive endpoints using Cloudflare Rate Limiting bindings.
+ *
+ * @example
+ *   // fetch.ts
+ *   import { ratelimit } from "@rimelight/security/middleware"
+ *   app.use(ratelimit())
+ *
+ * @example
+ *   // Custom configuration
+ *   app.use(
+ *     ratelimit({
+ *       routes: ["/api/checkout", "/auth/login"],
+ *       retryAfter: 30,
+ *       bindingName: "MY_RATE_LIMITER"
+ *     })
+ *   )
+ */
+export const ratelimit = (options: RateLimitOptions = {}) => {
+  const {
+    bindingName = "MY_RATE_LIMITER",
+    routes = DEFAULT_SENSITIVE_ROUTES,
+    retryAfter = 60,
+    fallback = "pass",
+    keyGenerator = (c: any) =>
+      c.req.header("CF-Connecting-IP") || c.req.header("x-forwarded-for") || "unknown",
+    onRateLimited = (c: any, retry: number) => {
+      if (typeof c.json === "function") {
+        return c.json(
+          {
+            error: "Too Many Requests",
+            message: "Rate limit exceeded. Please try again later."
+          },
+          429,
+          {
+            "Retry-After": String(retry)
+          }
+        )
+      }
+
+      return new Response(
+        JSON.stringify({
+          error: "Too Many Requests",
+          message: "Rate limit exceeded. Please try again later."
+        }),
+        {
+          status: 429,
+          headers: {
+            "Content-Type": "application/json",
+            "Retry-After": String(retry)
+          }
+        }
+      )
+    }
+  } = options
+
+  return async (c: any, next: () => Promise<any> | any): Promise<Response | any> => {
+    const path = c?.req?.path || ""
+
+    // 1. Check if the current request matches the rate-limited routes
+    const matchesRoute =
+      typeof routes === "function"
+        ? routes(c)
+        : routes.some((route) =>
+            typeof route === "string" ? path.includes(route) : route.test(path)
+          )
+
+    if (!matchesRoute) {
+      return next()
+    }
+
+    // 2. Resolve the rate limiter binding
+    const bindings = c?.env
+    const limiter: RateLimiterBinding | undefined = options.limiter
+      ? options.limiter(c)
+      : bindings?.[bindingName]
+
+    if (!limiter || typeof limiter.limit !== "function") {
+      // Falls back (fails open/closed according to fallback option)
+      if (fallback === "pass") {
+        return next()
+      }
+
+      if (typeof c.json === "function") {
+        return c.json({ error: "Rate limiter not configured" }, 500)
+      }
+      return new Response(JSON.stringify({ error: "Rate limiter not configured" }), {
+        status: 500,
+        headers: { "Content-Type": "application/json" }
+      })
+    }
+
+    // 3. Extract key and perform rate limit check
+    try {
+      const clientKey = await keyGenerator(c)
+      const { success } = await limiter.limit({ key: clientKey })
+
+      if (!success) {
+        return onRateLimited(c, retryAfter)
+      }
+    } catch (error) {
+      console.error("[Rate Limit Error]", error)
+      if (fallback !== "pass") {
+        if (typeof c.json === "function") {
+          return c.json({ error: "Rate limit check failed" }, 500)
+        }
+        return new Response(JSON.stringify({ error: "Rate limit check failed" }), {
+          status: 500,
+          headers: { "Content-Type": "application/json" }
+        })
+      }
+    }
+
+    return next()
+  }
+}