@sebastienrousseau/crypto-middleware 0.0.7

package/LICENSE

@@ -0,0 +1,8 @@
+This project is dual-licensed under either of:
+
+  * Apache License, Version 2.0 — see LICENSE-APACHE
+  * MIT license — see LICENSE-MIT
+
+at your option.
+
+SPDX-License-Identifier: Apache-2.0 OR MIT

package/README.md

@@ -0,0 +1,277 @@
+<!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/sebastienrousseau/crypto-service/main/assets/crypto-middleware-logo.svg" alt="crypto-middleware logo" width="360" />
+</p>
+
+<h1 align="center">@sebastienrousseau/crypto-middleware</h1>
+
+<p align="center">
+  Framework-agnostic cryptographic middleware for Express, Fastify, and Koa applications.
+</p>
+
+<p align="center">
+  <a href="https://github.com/sebastienrousseau/crypto-service/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/crypto-service/ci.yml?branch=main&style=for-the-badge&logo=github" alt="Build" /></a>
+  <a href="https://coveralls.io/github/sebastienrousseau/crypto-service?branch=main"><img src="https://img.shields.io/coveralls/github/sebastienrousseau/crypto-service?branch=main&style=for-the-badge" alt="Coverage" /></a>
+  <a href="https://www.npmjs.com/package/@sebastienrousseau/crypto-middleware"><img src="https://img.shields.io/npm/v/@sebastienrousseau/crypto-middleware.svg?style=for-the-badge&color=f14041&logo=npm" alt="Registry" /></a>
+  <a href="https://sebastienrousseau.github.io/crypto-service/"><img src="https://img.shields.io/badge/docs-TypeDoc-blue.svg?style=for-the-badge&labelColor=555555&logo=typescript" alt="Docs" /></a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/crypto-service" title="ossf-scorecard"><img src="https://img.shields.io/badge/OpenSSF-Scorecard-blue?style=for-the-badge&logo=openssf" alt="OpenSSF Scorecard" /></a>
+  <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0%20OR%20MIT-blue.svg?style=for-the-badge" alt="License: Apache-2.0 OR MIT" /></a>
+  <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/docs/POLICIES.md"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-93450a.svg?style=for-the-badge&logo=node.js" alt="Node.js 22 or newer" /></a>
+</p>
+
+---
+
+## Contents
+
+**Getting started**
+
+- [Install](#install) — installation via pnpm, npm, or yarn
+- [Requirements](#requirements) — runtime floor and environment prerequisites
+- [Quick Start](#quick-start) — minimal working usage sample
+
+**The Crypto Service ecosystem**
+
+- [The Crypto Service ecosystem](#the-crypto-service-ecosystem) — full 14-package suite overview
+
+**Package reference**
+
+- [Reference & Usage](#overview) — features, configuration, and capabilities
+- [Examples](#examples) — runnable sample code
+
+**Operational**
+
+- [Development](#development) — build, lint, format, and test targets
+- [Security](#security) — vulnerability disclosure and cryptographic invariants
+- [Documentation](#documentation) — TypeDoc API docs and ecosystem guides
+- [Stability guarantees](#stability-guarantees) — SemVer axis and release policy
+- [License](#license)
+
+---
+
+## Install
+
+```bash
+pnpm add @sebastienrousseau/crypto-middleware
+# or
+npm install @sebastienrousseau/crypto-middleware
+# or
+yarn add @sebastienrousseau/crypto-middleware
+```
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Requirements
+
+- **Node.js**: `^22.0.0` or `>=24.0.0` (active and maintenance LTS releases)
+- **Package Manager**: `pnpm >=9` (recommended) or `npm >=10`
+- **TypeScript**: `>=5.0` (when compiling with TypeScript)
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Quick Start
+
+```ts
+import express from "express";
+import { createCryptoMiddleware } from "@sebastienrousseau/crypto-middleware";
+
+const app = express();
+app.use(express.json());
+
+app.use(
+  createCryptoMiddleware({
+    key: process.env.CRYPTO_KEY, // 256-bit hex key
+    operations: ["decrypt-request", "encrypt-response"],
+  }),
+);
+
+app.post("/api/data", (req, res) => {
+  // req.body is already decrypted
+  res.json({ received: req.body });
+  // response is automatically encrypted
+});
+
+app.listen(3000);
+```
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## The Crypto Service ecosystem
+
+Crypto Service provides a complete cryptography stack across 14 specialized packages:
+
+| Package                                                                             | Role            | Description                                                                                                                            |
+| :---------------------------------------------------------------------------------- | :-------------- | :------------------------------------------------------------------------------------------------------------------------------------- |
+| [`@sebastienrousseau/crypto-api`](../crypto-api)                                    | API Schemas     | Shared TypeScript types and utilities for the Crypto Service Suite, defining the canonical API surface.                                |
+| [`@sebastienrousseau/crypto-cli`](../crypto-cli)                                    | Terminal CLI    | An interactive command-line interface for cryptographic operations, supporting both legacy OpenPGP and modern post-quantum algorithms. |
+| [`@sebastienrousseau/crypto-edge`](../crypto-edge)                                  | Edge Runtime    | Edge-runtime cryptographic operations using the Web Crypto API, optimized for Cloudflare Workers, Vercel Edge, and Deno.               |
+| [`@sebastienrousseau/crypto-kms`](../crypto-kms)                                    | Cloud KMS       | Unified Key Management Service interface for AWS KMS, GCP Cloud KMS, Azure Key Vault, and HashiCorp Vault.                             |
+| [`@sebastienrousseau/crypto-lib`](../crypto-lib)                                    | Core Library    | A modern cryptographic library for TypeScript, with post-quantum support, zero unsafe dependencies, and 100% test coverage.            |
+| **[`@sebastienrousseau/crypto-middleware`](../crypto-middleware)** _(this package)_ | **Middleware**  | **Framework-agnostic cryptographic middleware for Express, Fastify, and Koa applications.**                                            |
+| [`@sebastienrousseau/crypto-prisma`](../crypto-prisma)                              | ORM Adapter     | Transparent field-level encryption extension for Prisma Client, using XChaCha20-Poly1305.                                              |
+| [`@sebastienrousseau/crypto-react`](../crypto-react)                                | React Hooks     | React hooks and context provider for client-side cryptographic operations with zero boilerplate.                                       |
+| [`@sebastienrousseau/crypto-sdk`](../crypto-sdk)                                    | Client SDK      | A zero-dependency, typed HTTP client for the Crypto Service REST API, with full post-quantum support.                                  |
+| [`@sebastienrousseau/crypto-server`](../crypto-server)                              | HTTP API        | A hardened Fastify REST API for cryptographic operations, with rate limiting, OpenAPI schemas, and post-quantum endpoints.             |
+| [`@sebastienrousseau/crypto-testing`](../crypto-testing)                            | Test Support    | Deterministic keys, fast mocks, and test fixtures for crypto-lib                                                                       |
+| [`@sebastienrousseau/crypto-typeorm`](../crypto-typeorm)                            | ORM Adapter     | TypeORM column-level encryption with a single decorator, powered by crypto-lib.                                                        |
+| [`@sebastienrousseau/crypto-vue`](../crypto-vue)                                    | Vue Composables | Vue 3 composables for client-side cryptography                                                                                         |
+| [`@sebastienrousseau/crypto-wasm`](../crypto-wasm)                                  | Acceleration    | WebAssembly performance accelerator for crypto-lib                                                                                     |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Overview
+
+crypto-middleware provides transparent cryptographic operations for
+Express and Fastify applications. It can auto-decrypt incoming
+request bodies, encrypt outgoing responses, verify HMAC signatures
+on webhooks, and validate HS256 JWT bearer tokens -- all via a
+single middleware registration. Route matching via glob patterns
+lets you scope protection to specific endpoints.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Express
+
+### Configuration
+
+| Option       | Type       | Required | Description                                       |
+| :----------- | :--------- | :------- | :------------------------------------------------ |
+| `key`        | `string`   | \*       | Hex-encoded 256-bit key for encryption/decryption |
+| `routes`     | `string[]` | No       | Glob patterns for routes to apply middleware to   |
+| `operations` | `string[]` | No       | Operations to perform (see below)                 |
+| `hmacKey`    | `string`   | \*       | Hex-encoded HMAC key for signature verification   |
+| `jwtSecret`  | `string`   | \*       | Secret for HS256 JWT verification                 |
+
+\* Required when the corresponding operation is enabled.
+
+### Operations
+
+| Operation          | Description                                            |
+| :----------------- | :----------------------------------------------------- |
+| `decrypt-request`  | Decrypts incoming JSON bodies                          |
+| `encrypt-response` | Encrypts outgoing JSON responses                       |
+| `verify-signature` | Verifies HMAC-SHA256 from `x-signature` header         |
+| `verify-jwt`       | Verifies HS256 JWT from `Authorization: Bearer` header |
+
+### Route Matching
+
+| Pattern     | Matches                                  |
+| :---------- | :--------------------------------------- |
+| `/api/data` | Exact match only                         |
+| `/api/*`    | One path segment: `/api/users`, `/api/1` |
+| `/api/**`   | Any depth: `/api/users/1/profile`        |
+
+When `routes` is omitted or empty, middleware applies to all routes.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Fastify
+
+```ts
+import Fastify from "fastify";
+import { cryptoPlugin } from "@sebastienrousseau/crypto-middleware";
+
+const app = Fastify();
+
+app.register(cryptoPlugin, {
+  key: process.env.CRYPTO_KEY,
+  operations: ["decrypt-request", "encrypt-response"],
+});
+
+app.post("/api/data", async (request) => {
+  return { received: request.body };
+});
+
+app.listen({ port: 3000 });
+```
+
+The `cryptoPlugin` accepts the same configuration options as
+`createCryptoMiddleware`.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Examples
+
+All examples are self-contained TypeScript files in the `examples/`
+directory. Run any example with:
+
+```bash
+npx ts-node examples/<name>.ts
+```
+
+| Category  | Example                               | Purpose                                  |
+| :-------- | :------------------------------------ | :--------------------------------------- |
+| Express   | [express.ts](examples/express.ts)     | Full Express setup with encrypt/decrypt  |
+| Fastify   | [fastify.ts](examples/fastify.ts)     | Fastify plugin registration              |
+| Webhook   | [webhook.ts](examples/webhook.ts)     | HMAC signature verification for webhooks |
+| JWT       | [jwt.ts](examples/jwt.ts)             | JWT Bearer token verification            |
+| Encrypted | [encrypted.ts](examples/encrypted.ts) | Full encrypted request/response pipeline |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Development
+
+```bash
+pnpm --filter @sebastienrousseau/crypto-middleware run build
+pnpm --filter @sebastienrousseau/crypto-middleware run test
+pnpm --filter @sebastienrousseau/crypto-middleware run lint
+pnpm --filter @sebastienrousseau/crypto-middleware run format
+```
+
+All 18 packages in the Crypto Service workspace maintain a **100% coverage floor** across statements, branches, functions, and lines.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Security
+
+Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/sebastienrousseau/crypto-service/security/advisories) or according to [`SECURITY.md`](../../SECURITY.md). Never report security issues publicly.
+
+Cryptographic operations use the `@noble/*` libraries, Node.js `crypto` and OpenPGP.js. `@noble/post-quantum` has not been independently audited and does not guarantee constant-time execution, and no module in this suite is FIPS 140-3 validated. Key zeroization is limited: JavaScript strings and garbage-collected buffers cannot be reliably wiped. See [`SECURITY.md`](../../SECURITY.md).
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Documentation
+
+- [Full Suite Documentation](https://sebastienrousseau.github.io/crypto-service/)
+- [API Reference (TypeDoc)](https://sebastienrousseau.github.io/crypto-service/)
+- [Developer Guide](../../DEVELOPMENT.md)
+- [Security Policy](../../SECURITY.md)
+- [Architecture & Design](../../ARCHITECTURE.md)
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Stability guarantees
+
+Versions advance strictly one step at a time on the `0.0.x` line (`v0.0.1` → `v0.0.2` → `v0.0.3` ... → `v0.0.999` → `v0.1.0`). Work for every release iteration begins on a dedicated `feat/v<version>` branch.
+
+All 18 packages in the workspace move in lockstep. Public API signatures, cipher output formats, and serialization schemas are strictly versioned. Breaking changes to serialized formats or algorithm defaults are considered major breaking changes. Minimum toolchain upgrades (e.g. Node.js LTS floor) are governed by [POLICIES.md](../../docs/POLICIES.md).
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## License
+
+Dual-licensed under [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) or [MIT](https://opensource.org/licenses/MIT), at your option.
+
+Copyright (c) 2022-2026 Sebastien Rousseau and The Crypto Service Suite contributors.
+
+<p align="right"><a href="#contents">Back to Top</a></p>

package/dist/common.d.ts

@@ -0,0 +1,7 @@
+import { JwtPayload } from "./types";
+export declare function encryptPayload(key: string, data: unknown): string;
+export declare function decryptPayload(key: string, sealed: string): unknown;
+export declare function verifyHmacSignature(hmacKey: string, body: string, signature: string): boolean;
+export declare function verifyJwt(jwtSecret: string, token: string): JwtPayload;
+export declare function matchRoute(path: string, routes: string[]): boolean;
+//# sourceMappingURL=common.d.ts.map

package/dist/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAyB,UAAU,EAAE,MAAM,SAAS,CAAC;AAgB5D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAIjE;AAgBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAYnE;AAsBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CA4BT;AA6BD,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAqGtE;AAoBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAYlE"}

package/dist/common.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptPayload = encryptPayload;
+exports.decryptPayload = decryptPayload;
+exports.verifyHmacSignature = verifyHmacSignature;
+exports.verifyJwt = verifyJwt;
+exports.matchRoute = matchRoute;
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const types_1 = require("./types");
+function encryptPayload(key, data) {
+    const plaintext = typeof data === "string" ? data : JSON.stringify(data);
+    const result = crypto_lib_1.secretbox.seal(key, plaintext);
+    return result.sealed;
+}
+function decryptPayload(key, sealed) {
+    try {
+        const plainBytes = crypto_lib_1.secretbox.open(key, sealed);
+        const plaintext = Buffer.from(plainBytes).toString("utf8");
+        return JSON.parse(plaintext);
+    }
+    catch (err) {
+        throw new types_1.CryptoMiddlewareError(`Decryption failed: ${err.message}`, 400, "DECRYPTION_FAILED");
+    }
+}
+function verifyHmacSignature(hmacKey, body, signature) {
+    if (!signature) {
+        throw new types_1.CryptoMiddlewareError("Missing signature header", 401, "MISSING_SIGNATURE");
+    }
+    const sig = signature.startsWith("sha256=") ? signature.slice(7) : signature;
+    const result = (0, crypto_lib_1.verifyHmac)({
+        algorithm: "sha256",
+        key: hmacKey,
+        data: body,
+        mac: sig,
+    });
+    if (!result.valid) {
+        throw new types_1.CryptoMiddlewareError("Invalid HMAC signature", 401, "INVALID_SIGNATURE");
+    }
+    return true;
+}
+function base64urlDecode(input) {
+    const padded = input + "=".repeat((4 - (input.length % 4)) % 4);
+    return Buffer.from(padded, "base64").toString("utf8");
+}
+function verifyJwt(jwtSecret, token) {
+    if (!token) {
+        throw new types_1.CryptoMiddlewareError("Missing JWT token", 401, "MISSING_TOKEN");
+    }
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+        throw new types_1.CryptoMiddlewareError("Malformed JWT: expected 3 parts", 401, "MALFORMED_TOKEN");
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    let header;
+    try {
+        header = JSON.parse(base64urlDecode(headerB64));
+    }
+    catch {
+        throw new types_1.CryptoMiddlewareError("Malformed JWT header", 401, "MALFORMED_TOKEN");
+    }
+    if (header.alg !== "HS256") {
+        throw new types_1.CryptoMiddlewareError(`Unsupported JWT algorithm: ${header.alg}. Only HS256 is supported.`, 401, "UNSUPPORTED_ALGORITHM");
+    }
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const keyHex = Buffer.from(jwtSecret, "utf8").toString("hex");
+    const computed = (0, crypto_lib_1.computeHmac)({
+        algorithm: "sha256",
+        key: keyHex,
+        data: signingInput,
+    });
+    const sigPadded = signatureB64 + "=".repeat((4 - (signatureB64.length % 4)) % 4);
+    const sigHex = Buffer.from(sigPadded, "base64").toString("hex");
+    const computedBytes = Buffer.from(computed.mac, "hex");
+    const signatureBytes = Buffer.from(sigHex, "hex");
+    if (!(0, crypto_lib_1.timingSafeEqual)(computedBytes, signatureBytes)) {
+        throw new types_1.CryptoMiddlewareError("Invalid JWT signature", 401, "INVALID_TOKEN");
+    }
+    let payload;
+    try {
+        payload = JSON.parse(base64urlDecode(payloadB64));
+    }
+    catch {
+        throw new types_1.CryptoMiddlewareError("Malformed JWT payload", 401, "MALFORMED_TOKEN");
+    }
+    if (payload.exp !== undefined) {
+        const now = Math.floor(Date.now() / 1000);
+        if (now >= payload.exp) {
+            throw new types_1.CryptoMiddlewareError("JWT has expired", 401, "TOKEN_EXPIRED");
+        }
+    }
+    if (payload.nbf !== undefined) {
+        const now = Math.floor(Date.now() / 1000);
+        if (now < payload.nbf) {
+            throw new types_1.CryptoMiddlewareError("JWT is not yet valid", 401, "TOKEN_NOT_YET_VALID");
+        }
+    }
+    return payload;
+}
+function matchRoute(path, routes) {
+    if (routes.length === 0)
+        return true;
+    for (const pattern of routes) {
+        if (pattern === path)
+            return true;
+        const regexStr = pattern
+            .replace(/\*\*/g, "___GLOBSTAR___")
+            .replace(/\*/g, "[^/]+")
+            .replace(/___GLOBSTAR___/g, ".*");
+        const regex = new RegExp(`^${regexStr}$`);
+        if (regex.test(path))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=common.js.map

package/dist/express.d.ts

@@ -0,0 +1,4 @@
+import type { Request, Response, NextFunction } from "express";
+import { MiddlewareConfig } from "./types";
+export declare function createCryptoMiddleware(config: MiddlewareConfig): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=express.d.ts.map

package/dist/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,SAAS,CAAC;AA6BlE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,IAK3D,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,MAAM,YAAY,KACjB,IAAI,CA0FR"}

package/dist/express.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCryptoMiddleware = createCryptoMiddleware;
+const types_1 = require("./types");
+const common_1 = require("./common");
+function createCryptoMiddleware(config) {
+    const operations = config.operations ?? [];
+    const routes = config.routes ?? [];
+    return function cryptoMiddleware(req, res, next) {
+        if (!(0, common_1.matchRoute)(req.path, routes)) {
+            next();
+            return;
+        }
+        try {
+            if (operations.includes("verify-jwt")) {
+                if (!config.jwtSecret) {
+                    throw new types_1.CryptoMiddlewareError("jwtSecret is required for verify-jwt operation", 500, "MISSING_CONFIG");
+                }
+                const authHeader = req.headers.authorization ?? "";
+                const token = authHeader.startsWith("Bearer ")
+                    ? authHeader.slice(7)
+                    : "";
+                const payload = (0, common_1.verifyJwt)(config.jwtSecret, token);
+                req.jwtPayload = payload;
+            }
+            if (operations.includes("verify-signature")) {
+                if (!config.hmacKey) {
+                    throw new types_1.CryptoMiddlewareError("hmacKey is required for verify-signature operation", 500, "MISSING_CONFIG");
+                }
+                const signature = req.headers["x-signature"] ??
+                    req.headers["x-hub-signature-256"] ??
+                    "";
+                const rawBody = typeof req.body === "string" ? req.body : JSON.stringify(req.body);
+                (0, common_1.verifyHmacSignature)(config.hmacKey, rawBody, signature);
+            }
+            if (operations.includes("decrypt-request")) {
+                if (!config.key) {
+                    throw new types_1.CryptoMiddlewareError("key is required for decrypt-request operation", 500, "MISSING_CONFIG");
+                }
+                if (req.body &&
+                    typeof req.body === "object" &&
+                    "encrypted" in req.body) {
+                    req.body = (0, common_1.decryptPayload)(config.key, req.body.encrypted);
+                }
+            }
+            if (operations.includes("encrypt-response")) {
+                if (!config.key) {
+                    throw new types_1.CryptoMiddlewareError("key is required for encrypt-response operation", 500, "MISSING_CONFIG");
+                }
+                const originalJson = res.json.bind(res);
+                res.json = function encryptedJson(body) {
+                    const sealed = (0, common_1.encryptPayload)(config.key, body);
+                    return originalJson({ encrypted: sealed });
+                };
+            }
+            next();
+        }
+        catch (err) {
+            if (err instanceof types_1.CryptoMiddlewareError) {
+                res.status(err.statusCode).json({
+                    error: err.message,
+                    code: err.code,
+                });
+                return;
+            }
+            next(err);
+        }
+    };
+}
+//# sourceMappingURL=express.js.map

package/dist/fastify.d.ts

@@ -0,0 +1,6 @@
+import type { FastifyInstance } from "fastify";
+import { MiddlewareConfig } from "./types";
+declare function cryptoPluginImpl(fastify: FastifyInstance, opts: MiddlewareConfig): Promise<void>;
+export declare const cryptoPlugin: typeof cryptoPluginImpl;
+export {};
+//# sourceMappingURL=fastify.d.ts.map

package/dist/fastify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,SAAS,CAAC;AAyBlE,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAiHf;AAGD,eAAO,MAAM,YAAY,yBAGvB,CAAC"}

package/dist/fastify.js

@@ -0,0 +1,100 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cryptoPlugin = void 0;
+const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
+const types_1 = require("./types");
+const common_1 = require("./common");
+async function cryptoPluginImpl(fastify, opts) {
+    const operations = opts.operations ?? [];
+    const routes = opts.routes ?? [];
+    fastify.addHook("onRequest", async (request, reply) => {
+        if (!(0, common_1.matchRoute)(request.url, routes))
+            return;
+        try {
+            if (operations.includes("verify-jwt")) {
+                if (!opts.jwtSecret) {
+                    throw new types_1.CryptoMiddlewareError("jwtSecret is required for verify-jwt operation", 500, "MISSING_CONFIG");
+                }
+                const authHeader = request.headers.authorization ?? "";
+                const token = authHeader.startsWith("Bearer ")
+                    ? authHeader.slice(7)
+                    : "";
+                const payload = (0, common_1.verifyJwt)(opts.jwtSecret, token);
+                request.jwtPayload = payload;
+            }
+            if (operations.includes("verify-signature")) {
+                if (!opts.hmacKey) {
+                    throw new types_1.CryptoMiddlewareError("hmacKey is required for verify-signature operation", 500, "MISSING_CONFIG");
+                }
+                const signature = request.headers["x-signature"] ??
+                    request.headers["x-hub-signature-256"] ??
+                    "";
+                const rawBody = typeof request.body === "string"
+                    ? request.body
+                    : JSON.stringify(request.body);
+                (0, common_1.verifyHmacSignature)(opts.hmacKey, rawBody, signature);
+            }
+        }
+        catch (err) {
+            if (err instanceof types_1.CryptoMiddlewareError) {
+                reply.code(err.statusCode).send({
+                    error: err.message,
+                    code: err.code,
+                });
+                return;
+            }
+            throw err;
+        }
+    });
+    if (operations.includes("decrypt-request")) {
+        fastify.addHook("preHandler", async (request, reply) => {
+            if (!(0, common_1.matchRoute)(request.url, routes))
+                return;
+            if (!opts.key) {
+                reply.code(500).send({
+                    error: "key is required for decrypt-request operation",
+                    code: "MISSING_CONFIG",
+                });
+                return;
+            }
+            try {
+                const body = request.body;
+                if (body && typeof body === "object" && "encrypted" in body) {
+                    request.body =
+                        (0, common_1.decryptPayload)(opts.key, body.encrypted);
+                }
+            }
+            catch (err) {
+                if (err instanceof types_1.CryptoMiddlewareError) {
+                    reply.code(err.statusCode).send({
+                        error: err.message,
+                        code: err.code,
+                    });
+                    return;
+                }
+                throw err;
+            }
+        });
+    }
+    if (operations.includes("encrypt-response")) {
+        fastify.addHook("preSerialization", async (request, _reply, payload) => {
+            if (!(0, common_1.matchRoute)(request.url, routes))
+                return payload;
+            if (!opts.key)
+                return payload;
+            if (payload !== null && typeof payload === "object") {
+                const sealed = (0, common_1.encryptPayload)(opts.key, payload);
+                return { encrypted: sealed };
+            }
+            return payload;
+        });
+    }
+}
+exports.cryptoPlugin = (0, fastify_plugin_1.default)(cryptoPluginImpl, {
+    name: "crypto-middleware",
+    fastify: "4.x",
+});
+//# sourceMappingURL=fastify.js.map

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export type { MiddlewareConfig, JwtPayload } from "./types";
+export { CryptoMiddlewareError } from "./types";
+export { encryptPayload, decryptPayload, verifyHmacSignature, verifyJwt, matchRoute, } from "./common";
+export { createCryptoMiddleware } from "./express";
+export { cryptoPlugin } from "./fastify";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAGhD,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,UAAU,GACX,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cryptoPlugin = exports.createCryptoMiddleware = exports.matchRoute = exports.verifyJwt = exports.verifyHmacSignature = exports.decryptPayload = exports.encryptPayload = exports.CryptoMiddlewareError = void 0;
+var types_1 = require("./types");
+Object.defineProperty(exports, "CryptoMiddlewareError", { enumerable: true, get: function () { return types_1.CryptoMiddlewareError; } });
+var common_1 = require("./common");
+Object.defineProperty(exports, "encryptPayload", { enumerable: true, get: function () { return common_1.encryptPayload; } });
+Object.defineProperty(exports, "decryptPayload", { enumerable: true, get: function () { return common_1.decryptPayload; } });
+Object.defineProperty(exports, "verifyHmacSignature", { enumerable: true, get: function () { return common_1.verifyHmacSignature; } });
+Object.defineProperty(exports, "verifyJwt", { enumerable: true, get: function () { return common_1.verifyJwt; } });
+Object.defineProperty(exports, "matchRoute", { enumerable: true, get: function () { return common_1.matchRoute; } });
+var express_1 = require("./express");
+Object.defineProperty(exports, "createCryptoMiddleware", { enumerable: true, get: function () { return express_1.createCryptoMiddleware; } });
+var fastify_1 = require("./fastify");
+Object.defineProperty(exports, "cryptoPlugin", { enumerable: true, get: function () { return fastify_1.cryptoPlugin; } });
+//# sourceMappingURL=index.js.map

package/dist/types.d.ts

@@ -0,0 +1,23 @@
+export interface MiddlewareConfig {
+    key?: string;
+    routes?: string[];
+    operations?: Array<"decrypt-request" | "encrypt-response" | "verify-signature" | "verify-jwt">;
+    hmacKey?: string;
+    jwtSecret?: string;
+}
+export interface JwtPayload {
+    sub?: string;
+    iss?: string;
+    aud?: string | string[];
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+    [key: string]: unknown;
+}
+export declare class CryptoMiddlewareError extends Error {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(message: string, statusCode: number, code: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,gBAAgB;IAE/B,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,UAAU,CAAC,EAAE,KAAK,CAChB,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,YAAY,CAC3E,CAAC;IAEF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAcD,MAAM,WAAW,UAAU;IAEzB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAUD,qBAAa,qBAAsB,SAAQ,KAAK;IAE9C,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAGjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM9D"}

package/dist/types.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoMiddlewareError = void 0;
+class CryptoMiddlewareError extends Error {
+    statusCode;
+    code;
+    constructor(message, statusCode, code) {
+        super(message);
+        this.name = "CryptoMiddlewareError";
+        this.statusCode = statusCode;
+        this.code = code;
+    }
+}
+exports.CryptoMiddlewareError = CryptoMiddlewareError;
+//# sourceMappingURL=types.js.map

package/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "@sebastienrousseau/crypto-middleware",
+  "version": "0.0.7",
+  "description": "Plug-and-play cryptographic middleware for Express and Fastify -- auto-decrypt requests, verify signatures, and encrypt responses.",
+  "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
+  "license": "MIT OR Apache-2.0",
+  "homepage": "https://crypto-service.co",
+  "repository": {
+    "directory": "packages/crypto-middleware",
+    "type": "git",
+    "url": "git@github.com:sebastienrousseau/crypto-service.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sebastienrousseau/crypto-service/issues"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map"
+  ],
+  "dependencies": {
+    "@sebastienrousseau/crypto-lib": "0.0.7"
+  },
+  "peerDependencies": {
+    "express": "^4.0.0",
+    "fastify": "^4.0.0",
+    "fastify-plugin": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "express": {
+      "optional": true
+    },
+    "fastify": {
+      "optional": true
+    },
+    "fastify-plugin": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@sebastienrousseau/mocha-config": "^0.0.5",
+    "@types/chai": "^4.3.7",
+    "@types/chai-as-promised": "^8.0.2",
+    "@types/express": "^4.17.21",
+    "@types/mocha": "^10.0.2",
+    "@types/node": "^26.4.1",
+    "c8": "^12.0.0",
+    "chai": "^4.5.0",
+    "chai-as-promised": "^7.1.2",
+    "express": "^4.21.0",
+    "fastify": "^5.12.5",
+    "fastify-plugin": "^6.0.0",
+    "mocha": "^10.8.2",
+    "rimraf": "^6.1.3",
+    "ts-node": "^10.9.2",
+    "typedoc": "^0.28.20",
+    "typescript": "~5.9.3"
+  },
+  "keywords": [
+    "crypto-middleware",
+    "cryptography",
+    "express",
+    "fastify",
+    "encryption",
+    "hmac",
+    "jwt",
+    "middleware"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "private": false,
+  "scripts": {
+    "build": "tsc --build tsconfig.json",
+    "clean": "rimraf ./coverage ./dist ./docs",
+    "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
+    "docs": "typedoc",
+    "lint": "eslint --ext .ts src __tests__",
+    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "format": "prettier --write src/**/*.ts",
+    "format:check": "prettier --check \"src/**/*.ts\""
+  }
+}