@shohaghinfo/aerojs 0.1.0

package/dist/security/jwt.js

@@ -0,0 +1,308 @@
+/**
+ * @file jwt.ts
+ * @description Zero-dependency JSON Web Token (JWT) signing, verification, and authentication middleware for Aero.
+ * Powered purely by Node.js built-in `node:crypto`.
+ */
+import crypto from 'node:crypto';
+import { UnauthorizedError } from '../core/errors.js';
+export class JsonWebTokenError extends Error {
+    name = 'JsonWebTokenError';
+    constructor(message) {
+        super(message);
+    }
+}
+export class TokenExpiredError extends JsonWebTokenError {
+    name = 'TokenExpiredError';
+    expiredAt;
+    constructor(message, expiredAt) {
+        super(message);
+        this.expiredAt = expiredAt;
+    }
+}
+export class NotBeforeError extends JsonWebTokenError {
+    name = 'NotBeforeError';
+    date;
+    constructor(message, date) {
+        super(message);
+        this.date = date;
+    }
+}
+const ALG_HASH_MAP = {
+    HS256: 'sha256',
+    HS384: 'sha384',
+    HS512: 'sha512',
+};
+/**
+ * Parses timespan string (e.g. '15m', '2h', '7d') or numeric seconds into seconds.
+ */
+export function parseTimespan(val) {
+    if (typeof val === 'number') {
+        if (isNaN(val) || !isFinite(val)) {
+            throw new JsonWebTokenError(`Invalid timespan numeric value: ${val}`);
+        }
+        return Math.floor(val);
+    }
+    const match = /^(\d+)\s*(s|sec|seconds?|m|min|minutes?|h|hrs?|hours?|d|days?|w|weeks?|y|years?)?$/i.exec(val.trim());
+    if (!match) {
+        throw new JsonWebTokenError(`Invalid timespan format: "${val}"`);
+    }
+    const amount = parseInt(match[1], 10);
+    const unit = (match[2] || 's').toLowerCase();
+    if (unit.startsWith('s'))
+        return amount;
+    if (unit.startsWith('m') && !unit.startsWith('mo'))
+        return amount * 60;
+    if (unit.startsWith('h'))
+        return amount * 3600;
+    if (unit.startsWith('d'))
+        return amount * 86400;
+    if (unit.startsWith('w'))
+        return amount * 604800;
+    if (unit.startsWith('y'))
+        return amount * 31536000;
+    return amount;
+}
+function base64UrlEncode(data) {
+    const buf = Buffer.isBuffer(data) ? data : Buffer.from(data, 'utf-8');
+    return buf.toString('base64url');
+}
+function base64UrlDecode(str) {
+    return Buffer.from(str, 'base64url').toString('utf-8');
+}
+function timingSafeEqual(a, b) {
+    const bufA = Buffer.from(a, 'utf-8');
+    const bufB = Buffer.from(b, 'utf-8');
+    if (bufA.length !== bufB.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+function createSignature(input, secret, alg) {
+    const hashAlg = ALG_HASH_MAP[alg];
+    if (!hashAlg) {
+        throw new JsonWebTokenError(`Unsupported algorithm: ${alg}`);
+    }
+    return crypto.createHmac(hashAlg, secret).update(input).digest('base64url');
+}
+/**
+ * Signs a payload and returns a signed JWT token string.
+ */
+export function sign(payload, secret, options = {}) {
+    if (!secret) {
+        throw new JsonWebTokenError('Secret key must be provided');
+    }
+    const alg = options.algorithm || 'HS256';
+    if (!ALG_HASH_MAP[alg]) {
+        throw new JsonWebTokenError(`Unsupported algorithm: ${alg}`);
+    }
+    const header = {
+        alg,
+        typ: 'JWT',
+        ...options.header,
+    };
+    const finalPayload = { ...payload };
+    const nowInSec = Math.floor(Date.now() / 1000);
+    if (!options.noTimestamp && finalPayload.iat === undefined) {
+        finalPayload.iat = nowInSec;
+    }
+    if (options.expiresIn !== undefined) {
+        const diffSec = parseTimespan(options.expiresIn);
+        finalPayload.exp = (finalPayload.iat ?? nowInSec) + diffSec;
+    }
+    if (options.notBefore !== undefined) {
+        const diffSec = parseTimespan(options.notBefore);
+        finalPayload.nbf = (finalPayload.iat ?? nowInSec) + diffSec;
+    }
+    if (options.audience !== undefined) {
+        finalPayload.aud = options.audience;
+    }
+    if (options.issuer !== undefined) {
+        finalPayload.iss = options.issuer;
+    }
+    if (options.subject !== undefined) {
+        finalPayload.sub = options.subject;
+    }
+    if (options.jwtid !== undefined) {
+        finalPayload.jti = options.jwtid;
+    }
+    const encodedHeader = base64UrlEncode(JSON.stringify(header));
+    const encodedPayload = base64UrlEncode(JSON.stringify(finalPayload));
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const signature = createSignature(signingInput, secret, alg);
+    return `${signingInput}.${signature}`;
+}
+/**
+ * Decodes a JWT token without verifying the signature.
+ */
+export function decode(token) {
+    if (typeof token !== 'string') {
+        return null;
+    }
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        return null;
+    }
+    try {
+        const header = JSON.parse(base64UrlDecode(parts[0]));
+        const payload = JSON.parse(base64UrlDecode(parts[1]));
+        const signature = parts[2];
+        return { header, payload, signature };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Cryptographically verifies a JWT token and returns its decoded payload.
+ */
+export function verify(token, secret, options = {}) {
+    if (typeof token !== 'string' || !token) {
+        throw new JsonWebTokenError('jwt must be provided');
+    }
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw new JsonWebTokenError('jwt malformed');
+    }
+    const [encodedHeader, encodedPayload, signature] = parts;
+    if (!encodedHeader || !encodedPayload || !signature) {
+        throw new JsonWebTokenError('jwt malformed');
+    }
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(base64UrlDecode(encodedHeader));
+    }
+    catch {
+        throw new JsonWebTokenError('invalid token header');
+    }
+    try {
+        payload = JSON.parse(base64UrlDecode(encodedPayload));
+    }
+    catch {
+        throw new JsonWebTokenError('invalid token payload');
+    }
+    // Algorithm check
+    const allowedAlgs = options.algorithms || ['HS256', 'HS384', 'HS512'];
+    if (!allowedAlgs.includes(header.alg)) {
+        throw new JsonWebTokenError(`invalid algorithm: ${header.alg}`);
+    }
+    // Signature verification (timing safe)
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const expectedSig = createSignature(signingInput, secret, header.alg);
+    if (!timingSafeEqual(signature, expectedSig)) {
+        throw new JsonWebTokenError('invalid signature');
+    }
+    const clockTolerance = options.clockTolerance ?? 0;
+    const nowSec = Math.floor(Date.now() / 1000);
+    // Expiration check
+    if (!options.ignoreExpiration && payload.exp !== undefined) {
+        if (typeof payload.exp !== 'number') {
+            throw new JsonWebTokenError('invalid exp claim');
+        }
+        if (nowSec >= payload.exp + clockTolerance) {
+            throw new TokenExpiredError('jwt expired', new Date(payload.exp * 1000));
+        }
+    }
+    // Not Before check
+    if (!options.ignoreNotBefore && payload.nbf !== undefined) {
+        if (typeof payload.nbf !== 'number') {
+            throw new JsonWebTokenError('invalid nbf claim');
+        }
+        if (nowSec < payload.nbf - clockTolerance) {
+            throw new NotBeforeError('jwt not active', new Date(payload.nbf * 1000));
+        }
+    }
+    // Audience check
+    if (options.audience !== undefined) {
+        const expectedAudiences = Array.isArray(options.audience) ? options.audience : [options.audience];
+        const payloadAudience = Array.isArray(payload.aud) ? payload.aud : payload.aud ? [payload.aud] : [];
+        const match = expectedAudiences.some((ea) => payloadAudience.includes(ea));
+        if (!match) {
+            throw new JsonWebTokenError(`jwt audience invalid. expected: ${expectedAudiences.join(', ')}`);
+        }
+    }
+    // Issuer check
+    if (options.issuer !== undefined) {
+        const expectedIssuers = Array.isArray(options.issuer) ? options.issuer : [options.issuer];
+        if (!payload.iss || !expectedIssuers.includes(payload.iss)) {
+            throw new JsonWebTokenError(`jwt issuer invalid. expected: ${expectedIssuers.join(', ')}`);
+        }
+    }
+    // Subject check
+    if (options.subject !== undefined) {
+        if (payload.sub !== options.subject) {
+            throw new JsonWebTokenError(`jwt subject invalid. expected: ${options.subject}`);
+        }
+    }
+    return payload;
+}
+export const jwt = {
+    sign,
+    verify,
+    decode,
+    parseTimespan,
+};
+/**
+ * Aero Middleware for zero-dependency JWT authentication.
+ */
+export function jwtAuth(options) {
+    const credentialsRequired = options.credentialsRequired ?? true;
+    const userProperty = options.userProperty || 'user';
+    return async (ctx, next) => {
+        let token = null;
+        // 1. Custom extractor
+        if (options.getToken) {
+            token = await options.getToken(ctx);
+        }
+        // 2. Authorization header: "Bearer <token>"
+        if (!token) {
+            const authHeader = ctx.req.get('authorization');
+            if (authHeader) {
+                const parts = authHeader.split(' ');
+                if (parts.length === 2 && /^Bearer$/i.test(parts[0])) {
+                    token = parts[1];
+                }
+            }
+        }
+        // 3. Cookie extraction
+        if (!token && options.cookie) {
+            token = ctx.cookies[options.cookie];
+        }
+        // If no token was found
+        if (!token) {
+            if (credentialsRequired) {
+                throw new UnauthorizedError('No authorization token was found');
+            }
+            return next();
+        }
+        // Resolve secret
+        let secretKey;
+        if (typeof options.secret === 'function') {
+            const decoded = decode(token);
+            if (!decoded) {
+                throw new UnauthorizedError('Malformed token');
+            }
+            secretKey = await options.secret(decoded.header, decoded.payload);
+        }
+        else {
+            secretKey = options.secret;
+        }
+        try {
+            const verifiedPayload = verify(token, secretKey, {
+                algorithms: options.algorithms,
+            });
+            // Attach to context state and context directly
+            ctx.state[userProperty] = verifiedPayload;
+            ctx[userProperty] = verifiedPayload;
+            await next();
+        }
+        catch (err) {
+            if (credentialsRequired) {
+                const msg = err instanceof Error ? err.message : 'Invalid or expired token';
+                throw new UnauthorizedError(msg);
+            }
+            await next();
+        }
+    };
+}
+//# sourceMappingURL=jwt.js.map

package/dist/security/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/security/jwt.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAoDtD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1B,IAAI,GAAG,mBAAmB,CAAC;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,iBAAiB;IACtC,IAAI,GAAG,mBAAmB,CAAC;IACpC,SAAS,CAAO;IAEvB,YAAY,OAAe,EAAE,SAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnC,IAAI,GAAG,gBAAgB,CAAC;IACjC,IAAI,CAAO;IAElB,YAAY,OAAe,EAAE,IAAU;QACrC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,YAAY,GAAiC;IACjD,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,KAAK,GAAG,qFAAqF,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,GAAG,EAAE,CAAC;IACvE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,GAAG,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,GAAG,KAAK,CAAC;IAChD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,GAAG,MAAM,CAAC;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,GAAG,QAAQ,CAAC;IAEnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAqB;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,MAAuB,EAAE,GAAiB;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI,CAClB,OAAgC,EAChC,MAAuB,EACvB,UAA0B,EAAE;IAE5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAc;QACxB,GAAG;QACH,GAAG,EAAE,KAAK;QACV,GAAG,OAAO,CAAC,MAAM;KAClB,CAAC;IAEF,MAAM,YAAY,GAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE/C,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3D,YAAY,CAAC,GAAG,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,YAAY,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC;IAC9D,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,YAAY,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC;IAC9D,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,YAAY,CAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,YAAY,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACpC,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,YAAY,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,YAAY,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;IACnC,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAE7D,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CACpB,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAc,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAM,CAAC;QAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CACpB,KAAa,EACb,MAAuB,EACvB,UAA4B,EAAE;IAE9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IACzD,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAiB,CAAC;IACtB,IAAI,OAAmB,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAc,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,cAAc,CAAC,CAAe,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAED,kBAAkB;IAClB,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,uCAAuC;IACvC,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEtE,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE7C,mBAAmB;IACnB,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3D,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,GAAG,cAAc,EAAE,CAAC;YAC3C,MAAM,IAAI,iBAAiB,CACzB,aAAa,EACb,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC1D,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,cAAc,EAAE,CAAC;YAC1C,MAAM,IAAI,cAAc,CACtB,gBAAgB,EAChB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClG,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,eAAe;IACf,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,OAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,IAAI;IACJ,MAAM;IACN,MAAM;IACN,aAAa;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,OAAO,CAAiB,OAAuB;IAC7D,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAChE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAgB,EAAE,IAAI,EAAE,EAAE;QACtC,IAAI,KAAK,GAA8B,IAAI,CAAC;QAE5C,sBAAsB;QACtB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAChD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;oBACtD,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC7B,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,iBAAiB;QACjB,IAAI,SAA0B,CAAC;QAC/B,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;YACjD,CAAC;YACD,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,CAAI,KAAK,EAAE,SAAS,EAAE;gBAClD,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAC;YAEH,+CAA+C;YAC/C,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,eAAe,CAAC;YACzC,GAA0C,CAAC,YAAY,CAAC,GAAG,eAAe,CAAC;YAE5E,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;gBAC5E,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/rate-limiter.d.ts

@@ -0,0 +1,80 @@
+/**
+ * @file rate-limiter.ts
+ * @description Zero-dependency, memory-safe sliding/fixed-window Rate Limiter for Aero.
+ */
+import type { Middleware, NextFunction } from '../core/types.js';
+import type { AeroContext, DefaultState } from '../core/context.js';
+import { AeroError } from '../core/errors.js';
+export interface RateLimitInfo {
+    totalHits: number;
+    resetTime: number;
+}
+export interface RateLimitStore {
+    increment(key: string, windowMs: number): Promise<RateLimitInfo> | RateLimitInfo;
+    decrement(key: string): Promise<void> | void;
+    resetKey(key: string): Promise<void> | void;
+    resetAll(): Promise<void> | void;
+    destroy?(): void;
+}
+export interface RateLimitOptions<State = any> {
+    /**
+     * Time window in milliseconds. Default: 60,000 (1 minute).
+     */
+    windowMs?: number;
+    /**
+     * Max number of connections/requests allowed during the windowMs. Default: 100.
+     */
+    max?: number;
+    /**
+     * The response status code to send when limit is reached. Default: 429.
+     */
+    statusCode?: number;
+    /**
+     * The error message or payload to send when rate limit is exceeded.
+     */
+    message?: string | Record<string, unknown>;
+    /**
+     * Whether to send standard rate limit headers (X-RateLimit-* and Retry-After). Default: true.
+     */
+    headers?: boolean;
+    /**
+     * Function used to generate an identifier key for the client. Default: ctx.ip
+     */
+    keyGenerator?: (ctx: AeroContext<State>) => string;
+    /**
+     * Function to skip rate limiting for specific requests (e.g. internal health checks).
+     */
+    skip?: (ctx: AeroContext<State>) => boolean | Promise<boolean>;
+    /**
+     * Custom handler to invoke when rate limit is exceeded.
+     */
+    handler?: (ctx: AeroContext<State>, next: NextFunction) => Promise<void> | void;
+    /**
+     * Custom store instance. Defaults to MemoryRateLimitStore.
+     */
+    store?: RateLimitStore;
+}
+export declare class TooManyRequestsError extends AeroError {
+    name: string;
+    retryAfter: number;
+    constructor(message: string, retryAfter: number, details?: unknown);
+}
+/**
+ * Memory-safe in-memory store for rate limiting with automatic garbage collection of expired buckets.
+ */
+export declare class MemoryRateLimitStore implements RateLimitStore {
+    private hits;
+    private intervalTimer?;
+    constructor(cleanupIntervalMs?: number);
+    increment(key: string, windowMs: number): RateLimitInfo;
+    decrement(key: string): void;
+    resetKey(key: string): void;
+    resetAll(): void;
+    cleanup(): void;
+    destroy(): void;
+}
+/**
+ * Creates a Rate Limiter middleware for Aero applications.
+ */
+export declare function rateLimit<State = DefaultState>(options?: RateLimitOptions<State>): Middleware<State>;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/security/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../src/security/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;IACjF,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG;IAC3C;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/D;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAEhF;;OAEG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,qBAAa,oBAAqB,SAAQ,SAAS;IACjC,IAAI,SAA0B;IACvC,UAAU,EAAE,MAAM,CAAC;gBAEd,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAInE;AAED;;GAEG;AACH,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,IAAI,CAA2D;IACvE,OAAO,CAAC,aAAa,CAAC,CAAiB;gBAE3B,iBAAiB,SAAS;IAY/B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa;IAcvD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAO5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI3B,QAAQ,IAAI,IAAI;IAIhB,OAAO,IAAI,IAAI;IASf,OAAO,IAAI,IAAI;CAOvB;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,GAAG,YAAY,EAAE,OAAO,GAAE,gBAAgB,CAAC,KAAK,CAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CA6DxG"}

package/dist/security/rate-limiter.js

@@ -0,0 +1,127 @@
+/**
+ * @file rate-limiter.ts
+ * @description Zero-dependency, memory-safe sliding/fixed-window Rate Limiter for Aero.
+ */
+import { AeroError } from '../core/errors.js';
+export class TooManyRequestsError extends AeroError {
+    name = 'TooManyRequestsError';
+    retryAfter;
+    constructor(message, retryAfter, details) {
+        super(message, 429, 'TOO_MANY_REQUESTS', details);
+        this.retryAfter = retryAfter;
+    }
+}
+/**
+ * Memory-safe in-memory store for rate limiting with automatic garbage collection of expired buckets.
+ */
+export class MemoryRateLimitStore {
+    hits = new Map();
+    intervalTimer;
+    constructor(cleanupIntervalMs = 60_000) {
+        // Periodic garbage collection to prevent memory leaks from millions of unique IPs
+        this.intervalTimer = setInterval(() => {
+            this.cleanup();
+        }, cleanupIntervalMs);
+        // Unref timer so it does not keep Node.js process alive in tests or CLI scripts
+        if (this.intervalTimer.unref) {
+            this.intervalTimer.unref();
+        }
+    }
+    increment(key, windowMs) {
+        const now = Date.now();
+        const record = this.hits.get(key);
+        if (!record || now >= record.resetTime) {
+            const resetTime = now + windowMs;
+            this.hits.set(key, { count: 1, resetTime });
+            return { totalHits: 1, resetTime };
+        }
+        record.count += 1;
+        return { totalHits: record.count, resetTime: record.resetTime };
+    }
+    decrement(key) {
+        const record = this.hits.get(key);
+        if (record && record.count > 0) {
+            record.count -= 1;
+        }
+    }
+    resetKey(key) {
+        this.hits.delete(key);
+    }
+    resetAll() {
+        this.hits.clear();
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [key, record] of this.hits.entries()) {
+            if (now >= record.resetTime) {
+                this.hits.delete(key);
+            }
+        }
+    }
+    destroy() {
+        if (this.intervalTimer) {
+            clearInterval(this.intervalTimer);
+            this.intervalTimer = undefined;
+        }
+        this.hits.clear();
+    }
+}
+/**
+ * Creates a Rate Limiter middleware for Aero applications.
+ */
+export function rateLimit(options = {}) {
+    const windowMs = options.windowMs ?? 60_000;
+    const max = options.max ?? 100;
+    const statusCode = options.statusCode ?? 429;
+    const sendHeaders = options.headers ?? true;
+    const message = options.message ?? 'Too many requests, please try again later.';
+    const store = options.store ?? new MemoryRateLimitStore(Math.min(windowMs, 60_000));
+    const keyGen = options.keyGenerator ?? ((ctx) => ctx.req.ip || '127.0.0.1');
+    return async (ctx, next) => {
+        // Check skip predicate
+        if (options.skip) {
+            const shouldSkip = await options.skip(ctx);
+            if (shouldSkip) {
+                return next();
+            }
+        }
+        const key = keyGen(ctx);
+        const { totalHits, resetTime } = await store.increment(key, windowMs);
+        const now = Date.now();
+        const remaining = Math.max(0, max - totalHits);
+        const resetTimeSec = Math.ceil(resetTime / 1000);
+        const retryAfterSec = Math.max(1, Math.ceil((resetTime - now) / 1000));
+        // Attach headers
+        if (sendHeaders) {
+            ctx.res.setHeader('X-RateLimit-Limit', String(max));
+            ctx.res.setHeader('X-RateLimit-Remaining', String(remaining));
+            ctx.res.setHeader('X-RateLimit-Reset', String(resetTimeSec));
+        }
+        // Limit exceeded!
+        if (totalHits > max) {
+            if (sendHeaders) {
+                ctx.res.setHeader('Retry-After', String(retryAfterSec));
+            }
+            if (options.handler) {
+                await options.handler(ctx, next);
+                return;
+            }
+            ctx.res.status(statusCode);
+            if (typeof message === 'object') {
+                ctx.res.json(message);
+            }
+            else {
+                ctx.res.json({
+                    error: {
+                        message,
+                        statusCode,
+                        retryAfter: retryAfterSec,
+                    },
+                });
+            }
+            return;
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/security/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/security/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AA8D9C,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACjC,IAAI,GAAG,sBAAsB,CAAC;IACvC,UAAU,CAAS;IAE1B,YAAY,OAAe,EAAE,UAAkB,EAAE,OAAiB;QAChE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAG,IAAI,GAAG,EAAgD,CAAC;IAC/D,aAAa,CAAkB;IAEvC,YAAY,iBAAiB,GAAG,MAAM;QACpC,kFAAkF;QAClF,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEtB,gFAAgF;QAChF,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAEM,SAAS,CAAC,GAAW,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAClE,CAAC;IAEM,SAAS,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAEM,QAAQ,CAAC,GAAW;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAEM,QAAQ;QACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAEM,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAEM,OAAO;QACZ,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAuB,UAAmC,EAAE;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4CAA4C,CAAC;IAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEpF,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,GAAqB,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,WAAW,CAAC,CAAC;IAE9F,OAAO,KAAK,EAAE,GAAuB,EAAE,IAAkB,EAAE,EAAE;QAC3D,uBAAuB;QACvB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAEvE,iBAAiB;QACjB,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,kBAAkB;QAClB,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;YACpB,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE;wBACL,OAAO;wBACP,UAAU;wBACV,UAAU,EAAE,aAAa;qBAC1B;iBACF,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/totp.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @file totp.ts
+ * @description Zero-dependency implementation of RFC 6238 Time-Based One-Time Password (TOTP)
+ * and RFC 4226 HMAC-Based One-Time Password (HOTP) using node:crypto.
+ */
+export declare class Totp {
+    /**
+     * Generates a base32 TOTP secret and a corresponding otpauth:// URI.
+     */
+    static generateSecret(options?: {
+        issuer?: string;
+        label?: string;
+        length?: number;
+    }): {
+        secret: string;
+        uri: string;
+    };
+    /**
+     * Verifies a TOTP token against a secret.
+     * @param token The 6-digit user input token
+     * @param secret The base32 secret
+     * @param options window: number of 30-second steps to allow before/after current time (drift)
+     */
+    static verify(token: string, secret: string, options?: {
+        window?: number;
+        time?: number;
+    }): boolean;
+    /**
+     * Generates recovery/backup codes for 2FA.
+     * Returns plain codes to show to the user, and hashed codes to store in DB.
+     */
+    static generateBackupCodes(count?: number): {
+        plainCodes: string[];
+        hashedCodes: string[];
+    };
+    /**
+     * RFC 4226 HOTP algorithm.
+     */
+    private static hotp;
+    private static base32Encode;
+    private static base32Decode;
+}
+//# sourceMappingURL=totp.d.ts.map

package/dist/security/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/security/totp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,qBAAa,IAAI;IACf;;OAEG;WACW,cAAc,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;;;;IAoB/F;;;;;OAKG;WACW,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO;IAmB9G;;;OAGG;WACW,mBAAmB,CAAC,KAAK,SAAI;;;;IAe3C;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,IAAI;IAmBnB,OAAO,CAAC,MAAM,CAAC,YAAY;IAsB3B,OAAO,CAAC,MAAM,CAAC,YAAY;CAyB5B"}