@riocrypto/common-server 1.0.1902 → 1.0.1904

package/build/index.d.ts

@@ -6,6 +6,7 @@ export * from "./middlewares/not-sandbox";
 export * from "./middlewares/set-trace";
 export * from "./middlewares/require-min-role";
 export * from "./middlewares/require-min-admin-role";
+export * from "./middlewares/verify-csrf-token";
 export * from "./services/apiKey";
 export * from "./services/password";
 export * from "./services/logger";

package/build/index.js

@@ -22,6 +22,7 @@ __exportStar(require("./middlewares/not-sandbox"), exports);
 __exportStar(require("./middlewares/set-trace"), exports);
 __exportStar(require("./middlewares/require-min-role"), exports);
 __exportStar(require("./middlewares/require-min-admin-role"), exports);
+__exportStar(require("./middlewares/verify-csrf-token"), exports);
 __exportStar(require("./services/apiKey"), exports);
 __exportStar(require("./services/password"), exports);
 __exportStar(require("./services/logger"), exports);

package/build/middlewares/verify-csrf-token.d.ts

@@ -0,0 +1,2 @@
+import { Request, Response, NextFunction } from "express";
+export declare const verifyCsrfToken: (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;

package/build/middlewares/verify-csrf-token.js

@@ -0,0 +1,42 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyCsrfToken = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const secret_manager_client_1 = require("../clients/secret-manager-client");
+const common_1 = require("@riocrypto/common");
+const verifyCsrfToken = (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
+    const CSRF_TOKEN_SECRET = yield secret_manager_client_1.secretManagerClient.getSecretValue("CSRF_TOKEN_SECRET");
+    if (!CSRF_TOKEN_SECRET) {
+        throw new common_1.SecretManagerError();
+    }
+    // Only apply CSRF check to state-changing methods
+    if (["POST", "PUT", "PATCH", "DELETE"].includes(req.method.toUpperCase())) {
+        const csrfToken = req.body.csrfToken;
+        if (!csrfToken) {
+            return res.status(403).json({ error: "CSRF token missing" });
+        }
+        try {
+            jsonwebtoken_1.default.verify(csrfToken, CSRF_TOKEN_SECRET);
+            next(); // Token is valid, proceed to the next middleware
+        }
+        catch (err) {
+            return res.status(403).json({ error: "Invalid CSRF token" });
+        }
+    }
+    else {
+        next(); // Skip CSRF check for non-state-changing methods
+    }
+});
+exports.verifyCsrfToken = verifyCsrfToken;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.1902",
+  "version": "1.0.1904",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -16,6 +16,7 @@
   "license": "ISC",
   "devDependencies": {
     "@types/crypto-js": "^4.1.1",
+    "@types/csurf": "^1.11.5",
     "@types/he": "^1.2.0",
     "@types/jsonwebtoken": "^8.5.8",
     "@types/uuid": "^9.0.1",
@@ -30,6 +31,7 @@
     "@types/express": "^4.17.13",
     "axios": "^1.7.4",
     "crypto-js": "^4.2.0",
+    "csurf": "^1.11.0",
     "express": "^4.21.1",
     "express-validator": "^6.14.2",
     "fireblocks-sdk": "^5.13.0",