@riocrypto/common-server 1.0.1903 → 1.0.1905

package/build/index.d.ts

@@ -6,7 +6,7 @@ export * from "./middlewares/not-sandbox";
 export * from "./middlewares/set-trace";
 export * from "./middlewares/require-min-role";
 export * from "./middlewares/require-min-admin-role";
-export * from "./middlewares/csrf-protection";
+export * from "./middlewares/verify-csrf-token";
 export * from "./services/apiKey";
 export * from "./services/password";
 export * from "./services/logger";

package/build/index.js

@@ -22,7 +22,7 @@ __exportStar(require("./middlewares/not-sandbox"), exports);
 __exportStar(require("./middlewares/set-trace"), exports);
 __exportStar(require("./middlewares/require-min-role"), exports);
 __exportStar(require("./middlewares/require-min-admin-role"), exports);
-__exportStar(require("./middlewares/csrf-protection"), exports);
+__exportStar(require("./middlewares/verify-csrf-token"), exports);
 __exportStar(require("./services/apiKey"), exports);
 __exportStar(require("./services/password"), exports);
 __exportStar(require("./services/logger"), exports);

package/build/middlewares/verify-csrf-token.d.ts

@@ -0,0 +1,2 @@
+import { Request, Response, NextFunction } from "express";
+export declare const verifyCsrfToken: (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;

package/build/middlewares/verify-csrf-token.js

@@ -0,0 +1,45 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyCsrfToken = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const secret_manager_client_1 = require("../clients/secret-manager-client");
+const common_1 = require("@riocrypto/common");
+const verifyCsrfToken = (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
+    const CSRF_TOKEN_SECRET = yield secret_manager_client_1.secretManagerClient.getSecretValue("CSRF_TOKEN_SECRET");
+    if (!CSRF_TOKEN_SECRET) {
+        throw new common_1.SecretManagerError();
+    }
+    // Check for the presence of accessToken or adminAccessToken cookies
+    const hasAccessToken = req.cookies.accessToken || req.cookies.adminAccessToken;
+    // Only apply CSRF check if accessToken or adminAccessToken cookies are present
+    if (hasAccessToken &&
+        ["POST", "PUT", "PATCH", "DELETE"].includes(req.method.toUpperCase())) {
+        const csrfToken = req.body.csrfToken;
+        if (!csrfToken) {
+            return res.status(403).json({ error: "CSRF token missing" });
+        }
+        try {
+            jsonwebtoken_1.default.verify(csrfToken, CSRF_TOKEN_SECRET);
+            next(); // Token is valid, proceed to the next middleware
+        }
+        catch (err) {
+            return res.status(403).json({ error: "Invalid CSRF token" });
+        }
+    }
+    else {
+        next(); // Skip CSRF check if no relevant cookies are present
+    }
+});
+exports.verifyCsrfToken = verifyCsrfToken;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.1903",
+  "version": "1.0.1905",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",

package/build/middlewares/csrf-protection.d.ts

@@ -1,5 +0,0 @@
-/// <reference types="qs" />
-import { Request, Response, NextFunction } from "express";
-declare const csrfProtection: import("express-serve-static-core").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
-declare const csrfErrorHandler: (err: any, req: Request, res: Response, next: NextFunction) => void;
-export { csrfProtection, csrfErrorHandler };

package/build/middlewares/csrf-protection.js

@@ -1,19 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.csrfErrorHandler = exports.csrfProtection = void 0;
-const csurf_1 = __importDefault(require("csurf"));
-// Initialize CSRF protection middleware
-const csrfProtection = (0, csurf_1.default)();
-exports.csrfProtection = csrfProtection;
-// Error handling middleware for CSRF token errors
-const csrfErrorHandler = (err, req, res, next) => {
-    if (err.code !== "EBADCSRFTOKEN")
-        return next(err);
-    // CSRF token errors
-    res.status(403);
-    res.send("Form tampered with");
-};
-exports.csrfErrorHandler = csrfErrorHandler;