@shware/http 2.11.2 → 2.11.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/hono/csrf.cjs +2 -2
- package/dist/hono/csrf.cjs.map +1 -1
- package/dist/hono/csrf.mjs.map +1 -1
- package/dist/utils/timing.cjs +1 -1
- package/dist/utils/timing.cjs.map +1 -1
- package/dist/utils/timing.mjs +1 -1
- package/dist/utils/timing.mjs.map +1 -1
- package/dist/webhook/index.cjs +3 -3
- package/dist/webhook/index.cjs.map +1 -1
- package/dist/webhook/index.mjs.map +1 -1
- package/package.json +11 -8
package/dist/hono/csrf.cjs
CHANGED
|
@@ -23,7 +23,7 @@ __export(csrf_exports, {
|
|
|
23
23
|
csrf: () => csrf
|
|
24
24
|
});
|
|
25
25
|
module.exports = __toCommonJS(csrf_exports);
|
|
26
|
-
var
|
|
26
|
+
var import_node_crypto = require("crypto");
|
|
27
27
|
var import_cookie = require("hono/cookie");
|
|
28
28
|
var import_router = require("hono/router");
|
|
29
29
|
var import_reg_exp_router = require("hono/router/reg-exp-router");
|
|
@@ -36,7 +36,7 @@ function safeCompare(a, b) {
|
|
|
36
36
|
const bufferA = Buffer.from(a, "utf-8");
|
|
37
37
|
const bufferB = Buffer.from(b, "utf-8");
|
|
38
38
|
if (bufferA.length !== bufferB.length) return false;
|
|
39
|
-
return (0,
|
|
39
|
+
return (0, import_node_crypto.timingSafeEqual)(bufferA, bufferB);
|
|
40
40
|
}
|
|
41
41
|
function csrf(config = {}) {
|
|
42
42
|
const cookieName = config.cookieName ?? "XSRF-TOKEN";
|
package/dist/hono/csrf.cjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../src/hono/csrf.ts"],"sourcesContent":["import { timingSafeEqual } from 'crypto';\nimport type { MiddlewareHandler } from 'hono';\nimport { getCookie } from 'hono/cookie';\nimport { METHOD_NAME_ALL } from 'hono/router';\nimport { RegExpRouter } from 'hono/router/reg-exp-router';\nimport { SmartRouter } from 'hono/router/smart-router';\nimport { TrieRouter } from 'hono/router/trie-router';\nimport { Status } from '../error/status';\n\ntype HTTPMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n\nexport type CSRFIgnoreRule = string | { path: string; methods?: [HTTPMethod, ...HTTPMethod[]] };\n\nexport interface CSRFConfig {\n /**\n * Cookie name for CSRF token\n * @default 'XSRF-TOKEN'\n */\n cookieName?: string;\n\n /**\n * Header name for CSRF token\n * @default 'X-XSRF-TOKEN'\n */\n headerName?: string;\n\n /**\n * Ignore rules for specific paths and methods\n * @example\n * [\n * { path: '/api/webhook/*', methods: ['POST'] },\n * { path: '/auth/apple/callback' }, // ignores all methods\n * ]\n */\n ignores?: CSRFIgnoreRule[];\n\n /**\n * Skip CSRF check for these methods\n * @default ['GET', 'HEAD', 'OPTIONS']\n */\n safeMethods?: HTTPMethod[];\n\n /**\n * Origin allowed to bypass CSRF check\n * @default undefined\n */\n origin?: string[];\n\n /**\n * Sec-Fetch-Site allowed to bypass CSRF check\n * @default undefined\n */\n secFetchSite?: Array<'same-origin' | 'same-site' | 'none' | 'cross-origin'>;\n\n /**\n * Custom error message\n * @default 'CSRF token validation failed'\n */\n errorMessage?: string;\n}\n\n/** use timing safe compare to prevent timing attack */\nfunction safeCompare(a: string, b: string): boolean {\n if (typeof a !== 'string' || typeof b !== 'string') return false;\n if (a.length === 0 || b.length === 0) return false;\n\n const bufferA = Buffer.from(a, 'utf-8');\n const bufferB = Buffer.from(b, 'utf-8');\n if (bufferA.length !== bufferB.length) return false;\n return timingSafeEqual(bufferA, bufferB);\n}\n\n/**\n * Create CSRF protection middleware\n *\n * @example\n * ```ts\n * import { Hono } from 'hono';\n * import { csrf } from '@shware/http/hono';\n *\n * const app = new Hono();\n *\n * // basic usage\n * app.use(csrf());\n *\n * // with configuration\n * app.use(csrf({\n * cookieName: 'csrf-token',\n * headerName: 'X-CSRF-Token',\n * ignores: [\n * { path: '/api/webhook/*', methods: ['POST'] },\n * { path: '/auth/apple/callback' },\n * ]\n * }));\n * ```\n */\nexport function csrf(config: CSRFConfig = {}): MiddlewareHandler {\n const cookieName = config.cookieName ?? 'XSRF-TOKEN';\n const headerName = config.headerName ?? 'X-XSRF-TOKEN';\n const safeMethods = new Set(config.safeMethods ?? ['GET', 'HEAD', 'OPTIONS']);\n const errorMessage = config.errorMessage ?? 'CSRF token validation failed';\n\n // initialize router for matching ignore rules\n const router = new SmartRouter<boolean>({\n routers: [new RegExpRouter(), new TrieRouter()],\n });\n\n // register ignore rules\n if (config.ignores) {\n for (const rule of config.ignores) {\n if (typeof rule === 'string') {\n router.add(METHOD_NAME_ALL, rule, true);\n } else if (rule.methods && rule.methods.length > 0) {\n for (const method of rule.methods) {\n router.add(method, rule.path, true);\n }\n } else {\n // if no methods are specified, ignore all methods\n router.add(METHOD_NAME_ALL, rule.path, true);\n }\n }\n }\n\n // return middleware\n return async (c, next) => {\n const method = c.req.method;\n const path = c.req.path;\n\n // check if the request should be ignored\n // 1. ignore safe methods\n if (safeMethods.has(method)) {\n await next();\n return;\n }\n\n // 2. ignore configured origin\n if (config.origin && config.origin.includes(c.req.header('origin') ?? '')) {\n await next();\n return;\n }\n\n // 3. ignore configured secFetchSite\n if (\n config.secFetchSite &&\n config.secFetchSite.includes((c.req.header('sec-fetch-site') ?? '') as never)\n ) {\n await next();\n return;\n }\n\n // 4. ignore configured ignore rules\n const [matched] = router.match(method, path);\n if (matched.length > 0) {\n await next();\n return;\n }\n\n const cookieToken = getCookie(c, cookieName);\n const headerToken = c.req.header(headerName);\n\n if (!cookieToken || !headerToken) {\n throw Status.permissionDenied(errorMessage).error();\n }\n\n if (!safeCompare(cookieToken, headerToken)) {\n throw Status.permissionDenied(errorMessage).error();\n }\n\n await next();\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,
|
|
1
|
+
{"version":3,"sources":["../../src/hono/csrf.ts"],"sourcesContent":["import { timingSafeEqual } from 'node:crypto';\nimport type { MiddlewareHandler } from 'hono';\nimport { getCookie } from 'hono/cookie';\nimport { METHOD_NAME_ALL } from 'hono/router';\nimport { RegExpRouter } from 'hono/router/reg-exp-router';\nimport { SmartRouter } from 'hono/router/smart-router';\nimport { TrieRouter } from 'hono/router/trie-router';\nimport { Status } from '../error/status';\n\ntype HTTPMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n\nexport type CSRFIgnoreRule = string | { path: string; methods?: [HTTPMethod, ...HTTPMethod[]] };\n\nexport interface CSRFConfig {\n /**\n * Cookie name for CSRF token\n * @default 'XSRF-TOKEN'\n */\n cookieName?: string;\n\n /**\n * Header name for CSRF token\n * @default 'X-XSRF-TOKEN'\n */\n headerName?: string;\n\n /**\n * Ignore rules for specific paths and methods\n * @example\n * [\n * { path: '/api/webhook/*', methods: ['POST'] },\n * { path: '/auth/apple/callback' }, // ignores all methods\n * ]\n */\n ignores?: CSRFIgnoreRule[];\n\n /**\n * Skip CSRF check for these methods\n * @default ['GET', 'HEAD', 'OPTIONS']\n */\n safeMethods?: HTTPMethod[];\n\n /**\n * Origin allowed to bypass CSRF check\n * @default undefined\n */\n origin?: string[];\n\n /**\n * Sec-Fetch-Site allowed to bypass CSRF check\n * @default undefined\n */\n secFetchSite?: Array<'same-origin' | 'same-site' | 'none' | 'cross-origin'>;\n\n /**\n * Custom error message\n * @default 'CSRF token validation failed'\n */\n errorMessage?: string;\n}\n\n/** use timing safe compare to prevent timing attack */\nfunction safeCompare(a: string, b: string): boolean {\n if (typeof a !== 'string' || typeof b !== 'string') return false;\n if (a.length === 0 || b.length === 0) return false;\n\n const bufferA = Buffer.from(a, 'utf-8');\n const bufferB = Buffer.from(b, 'utf-8');\n if (bufferA.length !== bufferB.length) return false;\n return timingSafeEqual(bufferA, bufferB);\n}\n\n/**\n * Create CSRF protection middleware\n *\n * @example\n * ```ts\n * import { Hono } from 'hono';\n * import { csrf } from '@shware/http/hono';\n *\n * const app = new Hono();\n *\n * // basic usage\n * app.use(csrf());\n *\n * // with configuration\n * app.use(csrf({\n * cookieName: 'csrf-token',\n * headerName: 'X-CSRF-Token',\n * ignores: [\n * { path: '/api/webhook/*', methods: ['POST'] },\n * { path: '/auth/apple/callback' },\n * ]\n * }));\n * ```\n */\nexport function csrf(config: CSRFConfig = {}): MiddlewareHandler {\n const cookieName = config.cookieName ?? 'XSRF-TOKEN';\n const headerName = config.headerName ?? 'X-XSRF-TOKEN';\n const safeMethods = new Set(config.safeMethods ?? ['GET', 'HEAD', 'OPTIONS']);\n const errorMessage = config.errorMessage ?? 'CSRF token validation failed';\n\n // initialize router for matching ignore rules\n const router = new SmartRouter<boolean>({\n routers: [new RegExpRouter(), new TrieRouter()],\n });\n\n // register ignore rules\n if (config.ignores) {\n for (const rule of config.ignores) {\n if (typeof rule === 'string') {\n router.add(METHOD_NAME_ALL, rule, true);\n } else if (rule.methods && rule.methods.length > 0) {\n for (const method of rule.methods) {\n router.add(method, rule.path, true);\n }\n } else {\n // if no methods are specified, ignore all methods\n router.add(METHOD_NAME_ALL, rule.path, true);\n }\n }\n }\n\n // return middleware\n return async (c, next) => {\n const method = c.req.method;\n const path = c.req.path;\n\n // check if the request should be ignored\n // 1. ignore safe methods\n if (safeMethods.has(method)) {\n await next();\n return;\n }\n\n // 2. ignore configured origin\n if (config.origin && config.origin.includes(c.req.header('origin') ?? '')) {\n await next();\n return;\n }\n\n // 3. ignore configured secFetchSite\n if (\n config.secFetchSite &&\n config.secFetchSite.includes((c.req.header('sec-fetch-site') ?? '') as never)\n ) {\n await next();\n return;\n }\n\n // 4. ignore configured ignore rules\n const [matched] = router.match(method, path);\n if (matched.length > 0) {\n await next();\n return;\n }\n\n const cookieToken = getCookie(c, cookieName);\n const headerToken = c.req.header(headerName);\n\n if (!cookieToken || !headerToken) {\n throw Status.permissionDenied(errorMessage).error();\n }\n\n if (!safeCompare(cookieToken, headerToken)) {\n throw Status.permissionDenied(errorMessage).error();\n }\n\n await next();\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAgC;AAEhC,oBAA0B;AAC1B,oBAAgC;AAChC,4BAA6B;AAC7B,0BAA4B;AAC5B,yBAA2B;AAC3B,oBAAuB;AAuDvB,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,MAAI,QAAQ,WAAW,QAAQ,OAAQ,QAAO;AAC9C,aAAO,oCAAgB,SAAS,OAAO;AACzC;AA0BO,SAAS,KAAK,SAAqB,CAAC,GAAsB;AAC/D,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc,IAAI,IAAI,OAAO,eAAe,CAAC,OAAO,QAAQ,SAAS,CAAC;AAC5E,QAAM,eAAe,OAAO,gBAAgB;AAG5C,QAAM,SAAS,IAAI,gCAAqB;AAAA,IACtC,SAAS,CAAC,IAAI,mCAAa,GAAG,IAAI,8BAAW,CAAC;AAAA,EAChD,CAAC;AAGD,MAAI,OAAO,SAAS;AAClB,eAAW,QAAQ,OAAO,SAAS;AACjC,UAAI,OAAO,SAAS,UAAU;AAC5B,eAAO,IAAI,+BAAiB,MAAM,IAAI;AAAA,MACxC,WAAW,KAAK,WAAW,KAAK,QAAQ,SAAS,GAAG;AAClD,mBAAW,UAAU,KAAK,SAAS;AACjC,iBAAO,IAAI,QAAQ,KAAK,MAAM,IAAI;AAAA,QACpC;AAAA,MACF,OAAO;AAEL,eAAO,IAAI,+BAAiB,KAAK,MAAM,IAAI;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAGA,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,SAAS,EAAE,IAAI;AACrB,UAAM,OAAO,EAAE,IAAI;AAInB,QAAI,YAAY,IAAI,MAAM,GAAG;AAC3B,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK,EAAE,GAAG;AACzE,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QACE,OAAO,gBACP,OAAO,aAAa,SAAU,EAAE,IAAI,OAAO,gBAAgB,KAAK,EAAY,GAC5E;AACA,YAAM,KAAK;AACX;AAAA,IACF;AAGA,UAAM,CAAC,OAAO,IAAI,OAAO,MAAM,QAAQ,IAAI;AAC3C,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,kBAAc,yBAAU,GAAG,UAAU;AAC3C,UAAM,cAAc,EAAE,IAAI,OAAO,UAAU;AAE3C,QAAI,CAAC,eAAe,CAAC,aAAa;AAChC,YAAM,qBAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,QAAI,CAAC,YAAY,aAAa,WAAW,GAAG;AAC1C,YAAM,qBAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}
|
package/dist/hono/csrf.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../src/hono/csrf.ts"],"sourcesContent":["import { timingSafeEqual } from 'crypto';\nimport type { MiddlewareHandler } from 'hono';\nimport { getCookie } from 'hono/cookie';\nimport { METHOD_NAME_ALL } from 'hono/router';\nimport { RegExpRouter } from 'hono/router/reg-exp-router';\nimport { SmartRouter } from 'hono/router/smart-router';\nimport { TrieRouter } from 'hono/router/trie-router';\nimport { Status } from '../error/status';\n\ntype HTTPMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n\nexport type CSRFIgnoreRule = string | { path: string; methods?: [HTTPMethod, ...HTTPMethod[]] };\n\nexport interface CSRFConfig {\n /**\n * Cookie name for CSRF token\n * @default 'XSRF-TOKEN'\n */\n cookieName?: string;\n\n /**\n * Header name for CSRF token\n * @default 'X-XSRF-TOKEN'\n */\n headerName?: string;\n\n /**\n * Ignore rules for specific paths and methods\n * @example\n * [\n * { path: '/api/webhook/*', methods: ['POST'] },\n * { path: '/auth/apple/callback' }, // ignores all methods\n * ]\n */\n ignores?: CSRFIgnoreRule[];\n\n /**\n * Skip CSRF check for these methods\n * @default ['GET', 'HEAD', 'OPTIONS']\n */\n safeMethods?: HTTPMethod[];\n\n /**\n * Origin allowed to bypass CSRF check\n * @default undefined\n */\n origin?: string[];\n\n /**\n * Sec-Fetch-Site allowed to bypass CSRF check\n * @default undefined\n */\n secFetchSite?: Array<'same-origin' | 'same-site' | 'none' | 'cross-origin'>;\n\n /**\n * Custom error message\n * @default 'CSRF token validation failed'\n */\n errorMessage?: string;\n}\n\n/** use timing safe compare to prevent timing attack */\nfunction safeCompare(a: string, b: string): boolean {\n if (typeof a !== 'string' || typeof b !== 'string') return false;\n if (a.length === 0 || b.length === 0) return false;\n\n const bufferA = Buffer.from(a, 'utf-8');\n const bufferB = Buffer.from(b, 'utf-8');\n if (bufferA.length !== bufferB.length) return false;\n return timingSafeEqual(bufferA, bufferB);\n}\n\n/**\n * Create CSRF protection middleware\n *\n * @example\n * ```ts\n * import { Hono } from 'hono';\n * import { csrf } from '@shware/http/hono';\n *\n * const app = new Hono();\n *\n * // basic usage\n * app.use(csrf());\n *\n * // with configuration\n * app.use(csrf({\n * cookieName: 'csrf-token',\n * headerName: 'X-CSRF-Token',\n * ignores: [\n * { path: '/api/webhook/*', methods: ['POST'] },\n * { path: '/auth/apple/callback' },\n * ]\n * }));\n * ```\n */\nexport function csrf(config: CSRFConfig = {}): MiddlewareHandler {\n const cookieName = config.cookieName ?? 'XSRF-TOKEN';\n const headerName = config.headerName ?? 'X-XSRF-TOKEN';\n const safeMethods = new Set(config.safeMethods ?? ['GET', 'HEAD', 'OPTIONS']);\n const errorMessage = config.errorMessage ?? 'CSRF token validation failed';\n\n // initialize router for matching ignore rules\n const router = new SmartRouter<boolean>({\n routers: [new RegExpRouter(), new TrieRouter()],\n });\n\n // register ignore rules\n if (config.ignores) {\n for (const rule of config.ignores) {\n if (typeof rule === 'string') {\n router.add(METHOD_NAME_ALL, rule, true);\n } else if (rule.methods && rule.methods.length > 0) {\n for (const method of rule.methods) {\n router.add(method, rule.path, true);\n }\n } else {\n // if no methods are specified, ignore all methods\n router.add(METHOD_NAME_ALL, rule.path, true);\n }\n }\n }\n\n // return middleware\n return async (c, next) => {\n const method = c.req.method;\n const path = c.req.path;\n\n // check if the request should be ignored\n // 1. ignore safe methods\n if (safeMethods.has(method)) {\n await next();\n return;\n }\n\n // 2. ignore configured origin\n if (config.origin && config.origin.includes(c.req.header('origin') ?? '')) {\n await next();\n return;\n }\n\n // 3. ignore configured secFetchSite\n if (\n config.secFetchSite &&\n config.secFetchSite.includes((c.req.header('sec-fetch-site') ?? '') as never)\n ) {\n await next();\n return;\n }\n\n // 4. ignore configured ignore rules\n const [matched] = router.match(method, path);\n if (matched.length > 0) {\n await next();\n return;\n }\n\n const cookieToken = getCookie(c, cookieName);\n const headerToken = c.req.header(headerName);\n\n if (!cookieToken || !headerToken) {\n throw Status.permissionDenied(errorMessage).error();\n }\n\n if (!safeCompare(cookieToken, headerToken)) {\n throw Status.permissionDenied(errorMessage).error();\n }\n\n await next();\n };\n}\n"],"mappings":";AAAA,SAAS,uBAAuB;AAEhC,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AAuDvB,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,MAAI,QAAQ,WAAW,QAAQ,OAAQ,QAAO;AAC9C,SAAO,gBAAgB,SAAS,OAAO;AACzC;AA0BO,SAAS,KAAK,SAAqB,CAAC,GAAsB;AAC/D,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc,IAAI,IAAI,OAAO,eAAe,CAAC,OAAO,QAAQ,SAAS,CAAC;AAC5E,QAAM,eAAe,OAAO,gBAAgB;AAG5C,QAAM,SAAS,IAAI,YAAqB;AAAA,IACtC,SAAS,CAAC,IAAI,aAAa,GAAG,IAAI,WAAW,CAAC;AAAA,EAChD,CAAC;AAGD,MAAI,OAAO,SAAS;AAClB,eAAW,QAAQ,OAAO,SAAS;AACjC,UAAI,OAAO,SAAS,UAAU;AAC5B,eAAO,IAAI,iBAAiB,MAAM,IAAI;AAAA,MACxC,WAAW,KAAK,WAAW,KAAK,QAAQ,SAAS,GAAG;AAClD,mBAAW,UAAU,KAAK,SAAS;AACjC,iBAAO,IAAI,QAAQ,KAAK,MAAM,IAAI;AAAA,QACpC;AAAA,MACF,OAAO;AAEL,eAAO,IAAI,iBAAiB,KAAK,MAAM,IAAI;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAGA,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,SAAS,EAAE,IAAI;AACrB,UAAM,OAAO,EAAE,IAAI;AAInB,QAAI,YAAY,IAAI,MAAM,GAAG;AAC3B,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK,EAAE,GAAG;AACzE,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QACE,OAAO,gBACP,OAAO,aAAa,SAAU,EAAE,IAAI,OAAO,gBAAgB,KAAK,EAAY,GAC5E;AACA,YAAM,KAAK;AACX;AAAA,IACF;AAGA,UAAM,CAAC,OAAO,IAAI,OAAO,MAAM,QAAQ,IAAI;AAC3C,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,cAAc,UAAU,GAAG,UAAU;AAC3C,UAAM,cAAc,EAAE,IAAI,OAAO,UAAU;AAE3C,QAAI,CAAC,eAAe,CAAC,aAAa;AAChC,YAAM,OAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,QAAI,CAAC,YAAY,aAAa,WAAW,GAAG;AAC1C,YAAM,OAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}
|
|
1
|
+
{"version":3,"sources":["../../src/hono/csrf.ts"],"sourcesContent":["import { timingSafeEqual } from 'node:crypto';\nimport type { MiddlewareHandler } from 'hono';\nimport { getCookie } from 'hono/cookie';\nimport { METHOD_NAME_ALL } from 'hono/router';\nimport { RegExpRouter } from 'hono/router/reg-exp-router';\nimport { SmartRouter } from 'hono/router/smart-router';\nimport { TrieRouter } from 'hono/router/trie-router';\nimport { Status } from '../error/status';\n\ntype HTTPMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n\nexport type CSRFIgnoreRule = string | { path: string; methods?: [HTTPMethod, ...HTTPMethod[]] };\n\nexport interface CSRFConfig {\n /**\n * Cookie name for CSRF token\n * @default 'XSRF-TOKEN'\n */\n cookieName?: string;\n\n /**\n * Header name for CSRF token\n * @default 'X-XSRF-TOKEN'\n */\n headerName?: string;\n\n /**\n * Ignore rules for specific paths and methods\n * @example\n * [\n * { path: '/api/webhook/*', methods: ['POST'] },\n * { path: '/auth/apple/callback' }, // ignores all methods\n * ]\n */\n ignores?: CSRFIgnoreRule[];\n\n /**\n * Skip CSRF check for these methods\n * @default ['GET', 'HEAD', 'OPTIONS']\n */\n safeMethods?: HTTPMethod[];\n\n /**\n * Origin allowed to bypass CSRF check\n * @default undefined\n */\n origin?: string[];\n\n /**\n * Sec-Fetch-Site allowed to bypass CSRF check\n * @default undefined\n */\n secFetchSite?: Array<'same-origin' | 'same-site' | 'none' | 'cross-origin'>;\n\n /**\n * Custom error message\n * @default 'CSRF token validation failed'\n */\n errorMessage?: string;\n}\n\n/** use timing safe compare to prevent timing attack */\nfunction safeCompare(a: string, b: string): boolean {\n if (typeof a !== 'string' || typeof b !== 'string') return false;\n if (a.length === 0 || b.length === 0) return false;\n\n const bufferA = Buffer.from(a, 'utf-8');\n const bufferB = Buffer.from(b, 'utf-8');\n if (bufferA.length !== bufferB.length) return false;\n return timingSafeEqual(bufferA, bufferB);\n}\n\n/**\n * Create CSRF protection middleware\n *\n * @example\n * ```ts\n * import { Hono } from 'hono';\n * import { csrf } from '@shware/http/hono';\n *\n * const app = new Hono();\n *\n * // basic usage\n * app.use(csrf());\n *\n * // with configuration\n * app.use(csrf({\n * cookieName: 'csrf-token',\n * headerName: 'X-CSRF-Token',\n * ignores: [\n * { path: '/api/webhook/*', methods: ['POST'] },\n * { path: '/auth/apple/callback' },\n * ]\n * }));\n * ```\n */\nexport function csrf(config: CSRFConfig = {}): MiddlewareHandler {\n const cookieName = config.cookieName ?? 'XSRF-TOKEN';\n const headerName = config.headerName ?? 'X-XSRF-TOKEN';\n const safeMethods = new Set(config.safeMethods ?? ['GET', 'HEAD', 'OPTIONS']);\n const errorMessage = config.errorMessage ?? 'CSRF token validation failed';\n\n // initialize router for matching ignore rules\n const router = new SmartRouter<boolean>({\n routers: [new RegExpRouter(), new TrieRouter()],\n });\n\n // register ignore rules\n if (config.ignores) {\n for (const rule of config.ignores) {\n if (typeof rule === 'string') {\n router.add(METHOD_NAME_ALL, rule, true);\n } else if (rule.methods && rule.methods.length > 0) {\n for (const method of rule.methods) {\n router.add(method, rule.path, true);\n }\n } else {\n // if no methods are specified, ignore all methods\n router.add(METHOD_NAME_ALL, rule.path, true);\n }\n }\n }\n\n // return middleware\n return async (c, next) => {\n const method = c.req.method;\n const path = c.req.path;\n\n // check if the request should be ignored\n // 1. ignore safe methods\n if (safeMethods.has(method)) {\n await next();\n return;\n }\n\n // 2. ignore configured origin\n if (config.origin && config.origin.includes(c.req.header('origin') ?? '')) {\n await next();\n return;\n }\n\n // 3. ignore configured secFetchSite\n if (\n config.secFetchSite &&\n config.secFetchSite.includes((c.req.header('sec-fetch-site') ?? '') as never)\n ) {\n await next();\n return;\n }\n\n // 4. ignore configured ignore rules\n const [matched] = router.match(method, path);\n if (matched.length > 0) {\n await next();\n return;\n }\n\n const cookieToken = getCookie(c, cookieName);\n const headerToken = c.req.header(headerName);\n\n if (!cookieToken || !headerToken) {\n throw Status.permissionDenied(errorMessage).error();\n }\n\n if (!safeCompare(cookieToken, headerToken)) {\n throw Status.permissionDenied(errorMessage).error();\n }\n\n await next();\n };\n}\n"],"mappings":";AAAA,SAAS,uBAAuB;AAEhC,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AAuDvB,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,MAAI,QAAQ,WAAW,QAAQ,OAAQ,QAAO;AAC9C,SAAO,gBAAgB,SAAS,OAAO;AACzC;AA0BO,SAAS,KAAK,SAAqB,CAAC,GAAsB;AAC/D,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc,IAAI,IAAI,OAAO,eAAe,CAAC,OAAO,QAAQ,SAAS,CAAC;AAC5E,QAAM,eAAe,OAAO,gBAAgB;AAG5C,QAAM,SAAS,IAAI,YAAqB;AAAA,IACtC,SAAS,CAAC,IAAI,aAAa,GAAG,IAAI,WAAW,CAAC;AAAA,EAChD,CAAC;AAGD,MAAI,OAAO,SAAS;AAClB,eAAW,QAAQ,OAAO,SAAS;AACjC,UAAI,OAAO,SAAS,UAAU;AAC5B,eAAO,IAAI,iBAAiB,MAAM,IAAI;AAAA,MACxC,WAAW,KAAK,WAAW,KAAK,QAAQ,SAAS,GAAG;AAClD,mBAAW,UAAU,KAAK,SAAS;AACjC,iBAAO,IAAI,QAAQ,KAAK,MAAM,IAAI;AAAA,QACpC;AAAA,MACF,OAAO;AAEL,eAAO,IAAI,iBAAiB,KAAK,MAAM,IAAI;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAGA,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,SAAS,EAAE,IAAI;AACrB,UAAM,OAAO,EAAE,IAAI;AAInB,QAAI,YAAY,IAAI,MAAM,GAAG;AAC3B,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK,EAAE,GAAG;AACzE,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QACE,OAAO,gBACP,OAAO,aAAa,SAAU,EAAE,IAAI,OAAO,gBAAgB,KAAK,EAAY,GAC5E;AACA,YAAM,KAAK;AACX;AAAA,IACF;AAGA,UAAM,CAAC,OAAO,IAAI,OAAO,MAAM,QAAQ,IAAI;AAC3C,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,cAAc,UAAU,GAAG,UAAU;AAC3C,UAAM,cAAc,EAAE,IAAI,OAAO,UAAU;AAE3C,QAAI,CAAC,eAAe,CAAC,aAAa;AAChC,YAAM,OAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,QAAI,CAAC,YAAY,aAAa,WAAW,GAAG;AAC1C,YAAM,OAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}
|
package/dist/utils/timing.cjs
CHANGED
|
@@ -24,7 +24,7 @@ __export(timing_exports, {
|
|
|
24
24
|
});
|
|
25
25
|
module.exports = __toCommonJS(timing_exports);
|
|
26
26
|
function timing(options = { enabled: true }) {
|
|
27
|
-
const { enabled
|
|
27
|
+
const { enabled, crossOrigin } = options;
|
|
28
28
|
let start = performance.now();
|
|
29
29
|
const headers = [];
|
|
30
30
|
const timers = /* @__PURE__ */ new Map();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../src/utils/timing.ts"],"sourcesContent":["interface Timer {\n description?: string;\n start: number;\n}\n\nexport interface Options {\n enabled: boolean;\n crossOrigin?: string;\n}\n\nexport function timing(options: Options = { enabled: true }) {\n const { enabled
|
|
1
|
+
{"version":3,"sources":["../../src/utils/timing.ts"],"sourcesContent":["interface Timer {\n description?: string;\n start: number;\n}\n\nexport interface Options {\n enabled: boolean;\n crossOrigin?: string;\n}\n\nexport function timing(options: Options = { enabled: true }) {\n const { enabled, crossOrigin } = options;\n let start = performance.now();\n const headers: string[] = [];\n const timers = new Map<string, Timer>();\n\n return {\n startTime: (name: Lowercase<string>, description?: string) => {\n timers.set(name, { description, start: performance.now() });\n },\n endTime: (name: Lowercase<string>, precision?: number) => {\n const timer = timers.get(name);\n if (!timer) {\n console.warn(`timing: ${name} not found`);\n return;\n }\n const { start, description } = timer;\n const dur = (performance.now() - start).toFixed(precision ?? 1);\n timers.delete(name);\n const metric = description\n ? `${name};dur=${dur};desc=\"${description}\"`\n : `${name};dur=${dur}`;\n headers.push(metric);\n },\n mark: (name: Lowercase<string>, description?: string, precision?: number) => {\n const dur = (performance.now() - start).toFixed(precision ?? 1);\n const metric = description\n ? `${name};dur=${dur};desc=\"${description}\"`\n : `${name};dur=${dur}`;\n headers.push(metric);\n start = performance.now();\n },\n setMetric: (\n name: Lowercase<string>,\n value: number | string | undefined,\n description?: string,\n precision?: number\n ) => {\n if (typeof value === 'number') {\n const dur = value.toFixed(precision ?? 1);\n const metric = description\n ? `${name};dur=${dur};desc=\"${description}\"`\n : `${name};dur=${dur}`;\n headers.push(metric);\n } else {\n const metric = value ? `${name};desc=\"${value}\"` : `${name}`;\n headers.push(metric);\n }\n },\n setTiming: (response: Response) => {\n if (!enabled) return;\n response.headers.append('Server-Timing', headers.join(','));\n response.headers.append('Timing-Allow-Origin', crossOrigin ?? '*');\n },\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUO,SAAS,OAAO,UAAmB,EAAE,SAAS,KAAK,GAAG;AAC3D,QAAM,EAAE,SAAS,YAAY,IAAI;AACjC,MAAI,QAAQ,YAAY,IAAI;AAC5B,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAAS,oBAAI,IAAmB;AAEtC,SAAO;AAAA,IACL,WAAW,CAAC,MAAyB,gBAAyB;AAC5D,aAAO,IAAI,MAAM,EAAE,aAAa,OAAO,YAAY,IAAI,EAAE,CAAC;AAAA,IAC5D;AAAA,IACA,SAAS,CAAC,MAAyB,cAAuB;AACxD,YAAM,QAAQ,OAAO,IAAI,IAAI;AAC7B,UAAI,CAAC,OAAO;AACV,gBAAQ,KAAK,WAAW,IAAI,YAAY;AACxC;AAAA,MACF;AACA,YAAM,EAAE,OAAAA,QAAO,YAAY,IAAI;AAC/B,YAAM,OAAO,YAAY,IAAI,IAAIA,QAAO,QAAQ,aAAa,CAAC;AAC9D,aAAO,OAAO,IAAI;AAClB,YAAM,SAAS,cACX,GAAG,IAAI,QAAQ,GAAG,UAAU,WAAW,MACvC,GAAG,IAAI,QAAQ,GAAG;AACtB,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,IACA,MAAM,CAAC,MAAyB,aAAsB,cAAuB;AAC3E,YAAM,OAAO,YAAY,IAAI,IAAI,OAAO,QAAQ,aAAa,CAAC;AAC9D,YAAM,SAAS,cACX,GAAG,IAAI,QAAQ,GAAG,UAAU,WAAW,MACvC,GAAG,IAAI,QAAQ,GAAG;AACtB,cAAQ,KAAK,MAAM;AACnB,cAAQ,YAAY,IAAI;AAAA,IAC1B;AAAA,IACA,WAAW,CACT,MACA,OACA,aACA,cACG;AACH,UAAI,OAAO,UAAU,UAAU;AAC7B,cAAM,MAAM,MAAM,QAAQ,aAAa,CAAC;AACxC,cAAM,SAAS,cACX,GAAG,IAAI,QAAQ,GAAG,UAAU,WAAW,MACvC,GAAG,IAAI,QAAQ,GAAG;AACtB,gBAAQ,KAAK,MAAM;AAAA,MACrB,OAAO;AACL,cAAM,SAAS,QAAQ,GAAG,IAAI,UAAU,KAAK,MAAM,GAAG,IAAI;AAC1D,gBAAQ,KAAK,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,IACA,WAAW,CAAC,aAAuB;AACjC,UAAI,CAAC,QAAS;AACd,eAAS,QAAQ,OAAO,iBAAiB,QAAQ,KAAK,GAAG,CAAC;AAC1D,eAAS,QAAQ,OAAO,uBAAuB,eAAe,GAAG;AAAA,IACnE;AAAA,EACF;AACF;","names":["start"]}
|
package/dist/utils/timing.mjs
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../src/utils/timing.ts"],"sourcesContent":["interface Timer {\n description?: string;\n start: number;\n}\n\nexport interface Options {\n enabled: boolean;\n crossOrigin?: string;\n}\n\nexport function timing(options: Options = { enabled: true }) {\n const { enabled
|
|
1
|
+
{"version":3,"sources":["../../src/utils/timing.ts"],"sourcesContent":["interface Timer {\n description?: string;\n start: number;\n}\n\nexport interface Options {\n enabled: boolean;\n crossOrigin?: string;\n}\n\nexport function timing(options: Options = { enabled: true }) {\n const { enabled, crossOrigin } = options;\n let start = performance.now();\n const headers: string[] = [];\n const timers = new Map<string, Timer>();\n\n return {\n startTime: (name: Lowercase<string>, description?: string) => {\n timers.set(name, { description, start: performance.now() });\n },\n endTime: (name: Lowercase<string>, precision?: number) => {\n const timer = timers.get(name);\n if (!timer) {\n console.warn(`timing: ${name} not found`);\n return;\n }\n const { start, description } = timer;\n const dur = (performance.now() - start).toFixed(precision ?? 1);\n timers.delete(name);\n const metric = description\n ? `${name};dur=${dur};desc=\"${description}\"`\n : `${name};dur=${dur}`;\n headers.push(metric);\n },\n mark: (name: Lowercase<string>, description?: string, precision?: number) => {\n const dur = (performance.now() - start).toFixed(precision ?? 1);\n const metric = description\n ? `${name};dur=${dur};desc=\"${description}\"`\n : `${name};dur=${dur}`;\n headers.push(metric);\n start = performance.now();\n },\n setMetric: (\n name: Lowercase<string>,\n value: number | string | undefined,\n description?: string,\n precision?: number\n ) => {\n if (typeof value === 'number') {\n const dur = value.toFixed(precision ?? 1);\n const metric = description\n ? `${name};dur=${dur};desc=\"${description}\"`\n : `${name};dur=${dur}`;\n headers.push(metric);\n } else {\n const metric = value ? `${name};desc=\"${value}\"` : `${name}`;\n headers.push(metric);\n }\n },\n setTiming: (response: Response) => {\n if (!enabled) return;\n response.headers.append('Server-Timing', headers.join(','));\n response.headers.append('Timing-Allow-Origin', crossOrigin ?? '*');\n },\n };\n}\n"],"mappings":";AAUO,SAAS,OAAO,UAAmB,EAAE,SAAS,KAAK,GAAG;AAC3D,QAAM,EAAE,SAAS,YAAY,IAAI;AACjC,MAAI,QAAQ,YAAY,IAAI;AAC5B,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAAS,oBAAI,IAAmB;AAEtC,SAAO;AAAA,IACL,WAAW,CAAC,MAAyB,gBAAyB;AAC5D,aAAO,IAAI,MAAM,EAAE,aAAa,OAAO,YAAY,IAAI,EAAE,CAAC;AAAA,IAC5D;AAAA,IACA,SAAS,CAAC,MAAyB,cAAuB;AACxD,YAAM,QAAQ,OAAO,IAAI,IAAI;AAC7B,UAAI,CAAC,OAAO;AACV,gBAAQ,KAAK,WAAW,IAAI,YAAY;AACxC;AAAA,MACF;AACA,YAAM,EAAE,OAAAA,QAAO,YAAY,IAAI;AAC/B,YAAM,OAAO,YAAY,IAAI,IAAIA,QAAO,QAAQ,aAAa,CAAC;AAC9D,aAAO,OAAO,IAAI;AAClB,YAAM,SAAS,cACX,GAAG,IAAI,QAAQ,GAAG,UAAU,WAAW,MACvC,GAAG,IAAI,QAAQ,GAAG;AACtB,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,IACA,MAAM,CAAC,MAAyB,aAAsB,cAAuB;AAC3E,YAAM,OAAO,YAAY,IAAI,IAAI,OAAO,QAAQ,aAAa,CAAC;AAC9D,YAAM,SAAS,cACX,GAAG,IAAI,QAAQ,GAAG,UAAU,WAAW,MACvC,GAAG,IAAI,QAAQ,GAAG;AACtB,cAAQ,KAAK,MAAM;AACnB,cAAQ,YAAY,IAAI;AAAA,IAC1B;AAAA,IACA,WAAW,CACT,MACA,OACA,aACA,cACG;AACH,UAAI,OAAO,UAAU,UAAU;AAC7B,cAAM,MAAM,MAAM,QAAQ,aAAa,CAAC;AACxC,cAAM,SAAS,cACX,GAAG,IAAI,QAAQ,GAAG,UAAU,WAAW,MACvC,GAAG,IAAI,QAAQ,GAAG;AACtB,gBAAQ,KAAK,MAAM;AAAA,MACrB,OAAO;AACL,cAAM,SAAS,QAAQ,GAAG,IAAI,UAAU,KAAK,MAAM,GAAG,IAAI;AAC1D,gBAAQ,KAAK,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,IACA,WAAW,CAAC,aAAuB;AACjC,UAAI,CAAC,QAAS;AACd,eAAS,QAAQ,OAAO,iBAAiB,QAAQ,KAAK,GAAG,CAAC;AAC1D,eAAS,QAAQ,OAAO,uBAAuB,eAAe,GAAG;AAAA,IACnE;AAAA,EACF;AACF;","names":["start"]}
|
package/dist/webhook/index.cjs
CHANGED
|
@@ -23,7 +23,7 @@ __export(webhook_exports, {
|
|
|
23
23
|
verifyStandardWebhook: () => verifyStandardWebhook
|
|
24
24
|
});
|
|
25
25
|
module.exports = __toCommonJS(webhook_exports);
|
|
26
|
-
var
|
|
26
|
+
var import_node_crypto = require("crypto");
|
|
27
27
|
var import_status = require("../error/status.cjs");
|
|
28
28
|
var WEBHOOK_TOLERANCE_IN_SECONDS = 5 * 60;
|
|
29
29
|
function verifyTimestamp(webhookTimestamp) {
|
|
@@ -50,7 +50,7 @@ function verifyStandardWebhook(headers, payload, secret) {
|
|
|
50
50
|
const timestamp = verifyTimestamp(webhookTimestamp);
|
|
51
51
|
const encoder = new TextEncoder();
|
|
52
52
|
const toSign = encoder.encode(`${webhookId}.${timestamp}.${payload}`);
|
|
53
|
-
const hmac = (0,
|
|
53
|
+
const hmac = (0, import_node_crypto.createHmac)("sha256", Buffer.from(secret, "base64"));
|
|
54
54
|
const digest = hmac.update(toSign).digest();
|
|
55
55
|
const computedSignature = `v1,${Buffer.from(digest).toString("base64")}`;
|
|
56
56
|
const expectedSignature = computedSignature.split(",")[1];
|
|
@@ -58,7 +58,7 @@ function verifyStandardWebhook(headers, payload, secret) {
|
|
|
58
58
|
for (const versionedSignature of passedSignatures) {
|
|
59
59
|
const [version, signature] = versionedSignature.split(",");
|
|
60
60
|
if (version !== "v1") continue;
|
|
61
|
-
if ((0,
|
|
61
|
+
if ((0, import_node_crypto.timingSafeEqual)(encoder.encode(signature), encoder.encode(expectedSignature))) {
|
|
62
62
|
try {
|
|
63
63
|
return JSON.parse(payload);
|
|
64
64
|
} catch (_) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../src/webhook/index.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'crypto';\nimport { Status } from '../error/status';\n\nconst WEBHOOK_TOLERANCE_IN_SECONDS = 5 * 60; // 5 minutes\n\nfunction verifyTimestamp(webhookTimestamp: string) {\n const now = Math.floor(Date.now() / 1000);\n const timestamp = parseInt(webhookTimestamp, 10);\n if (isNaN(timestamp)) {\n throw Status.invalidArgument('invalid webhook timestamp').error();\n }\n if (timestamp < now - WEBHOOK_TOLERANCE_IN_SECONDS) {\n throw Status.invalidArgument('webhook timestamp is too old').error();\n }\n if (timestamp > now + WEBHOOK_TOLERANCE_IN_SECONDS) {\n throw Status.invalidArgument('webhook timestamp is too new').error();\n }\n return timestamp;\n}\n\n/**\n * reference: https://github.com/standard-webhooks/standard-webhooks/tree/main/libraries/javascript\n * hono usage:\n * ```ts\n * const webhook = verifyStandardWebhook(c.req.header(), await c.req.text(), 'secret');\n * ```\n */\nexport function verifyStandardWebhook<T = unknown>(\n headers: Record<string, string>,\n payload: string,\n secret: string\n): T {\n const webhookId = headers['webhook-id'];\n const webhookTimestamp = headers['webhook-timestamp'];\n const webhookSignature = headers['webhook-signature'];\n if (!webhookId || !webhookTimestamp || !webhookSignature) {\n throw Status.invalidArgument('invalid webhook').error();\n }\n const timestamp = verifyTimestamp(webhookTimestamp);\n\n const encoder = new TextEncoder();\n const toSign = encoder.encode(`${webhookId}.${timestamp}.${payload}`);\n const hmac = createHmac('sha256', Buffer.from(secret, 'base64'));\n const digest = hmac.update(toSign).digest();\n\n const computedSignature = `v1,${Buffer.from(digest).toString('base64')}`;\n const expectedSignature = computedSignature.split(',')[1];\n const passedSignatures = webhookSignature.split(' ');\n\n for (const versionedSignature of passedSignatures) {\n const [version, signature] = versionedSignature.split(',');\n if (version !== 'v1') continue;\n if (timingSafeEqual(encoder.encode(signature), encoder.encode(expectedSignature))) {\n try {\n return JSON.parse(payload) as T;\n } catch (_) {\n console.error('invalid payload', payload);\n throw Status.invalidArgument('invalid webhook payload').error();\n }\n }\n }\n console.error('webhook verification failed');\n throw Status.invalidArgument('invalid webhook signature').error();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,
|
|
1
|
+
{"version":3,"sources":["../../src/webhook/index.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\nimport { Status } from '../error/status';\n\nconst WEBHOOK_TOLERANCE_IN_SECONDS = 5 * 60; // 5 minutes\n\nfunction verifyTimestamp(webhookTimestamp: string) {\n const now = Math.floor(Date.now() / 1000);\n const timestamp = parseInt(webhookTimestamp, 10);\n if (isNaN(timestamp)) {\n throw Status.invalidArgument('invalid webhook timestamp').error();\n }\n if (timestamp < now - WEBHOOK_TOLERANCE_IN_SECONDS) {\n throw Status.invalidArgument('webhook timestamp is too old').error();\n }\n if (timestamp > now + WEBHOOK_TOLERANCE_IN_SECONDS) {\n throw Status.invalidArgument('webhook timestamp is too new').error();\n }\n return timestamp;\n}\n\n/**\n * reference: https://github.com/standard-webhooks/standard-webhooks/tree/main/libraries/javascript\n * hono usage:\n * ```ts\n * const webhook = verifyStandardWebhook(c.req.header(), await c.req.text(), 'secret');\n * ```\n */\nexport function verifyStandardWebhook<T = unknown>(\n headers: Record<string, string>,\n payload: string,\n secret: string\n): T {\n const webhookId = headers['webhook-id'];\n const webhookTimestamp = headers['webhook-timestamp'];\n const webhookSignature = headers['webhook-signature'];\n if (!webhookId || !webhookTimestamp || !webhookSignature) {\n throw Status.invalidArgument('invalid webhook').error();\n }\n const timestamp = verifyTimestamp(webhookTimestamp);\n\n const encoder = new TextEncoder();\n const toSign = encoder.encode(`${webhookId}.${timestamp}.${payload}`);\n const hmac = createHmac('sha256', Buffer.from(secret, 'base64'));\n const digest = hmac.update(toSign).digest();\n\n const computedSignature = `v1,${Buffer.from(digest).toString('base64')}`;\n const expectedSignature = computedSignature.split(',')[1];\n const passedSignatures = webhookSignature.split(' ');\n\n for (const versionedSignature of passedSignatures) {\n const [version, signature] = versionedSignature.split(',');\n if (version !== 'v1') continue;\n if (timingSafeEqual(encoder.encode(signature), encoder.encode(expectedSignature))) {\n try {\n return JSON.parse(payload) as T;\n } catch (_) {\n console.error('invalid payload', payload);\n throw Status.invalidArgument('invalid webhook payload').error();\n }\n }\n }\n console.error('webhook verification failed');\n throw Status.invalidArgument('invalid webhook signature').error();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA4C;AAC5C,oBAAuB;AAEvB,IAAM,+BAA+B,IAAI;AAEzC,SAAS,gBAAgB,kBAA0B;AACjD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,YAAY,SAAS,kBAAkB,EAAE;AAC/C,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,qBAAO,gBAAgB,2BAA2B,EAAE,MAAM;AAAA,EAClE;AACA,MAAI,YAAY,MAAM,8BAA8B;AAClD,UAAM,qBAAO,gBAAgB,8BAA8B,EAAE,MAAM;AAAA,EACrE;AACA,MAAI,YAAY,MAAM,8BAA8B;AAClD,UAAM,qBAAO,gBAAgB,8BAA8B,EAAE,MAAM;AAAA,EACrE;AACA,SAAO;AACT;AASO,SAAS,sBACd,SACA,SACA,QACG;AACH,QAAM,YAAY,QAAQ,YAAY;AACtC,QAAM,mBAAmB,QAAQ,mBAAmB;AACpD,QAAM,mBAAmB,QAAQ,mBAAmB;AACpD,MAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,kBAAkB;AACxD,UAAM,qBAAO,gBAAgB,iBAAiB,EAAE,MAAM;AAAA,EACxD;AACA,QAAM,YAAY,gBAAgB,gBAAgB;AAElD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,QAAQ,OAAO,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE;AACpE,QAAM,WAAO,+BAAW,UAAU,OAAO,KAAK,QAAQ,QAAQ,CAAC;AAC/D,QAAM,SAAS,KAAK,OAAO,MAAM,EAAE,OAAO;AAE1C,QAAM,oBAAoB,MAAM,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,CAAC;AACtE,QAAM,oBAAoB,kBAAkB,MAAM,GAAG,EAAE,CAAC;AACxD,QAAM,mBAAmB,iBAAiB,MAAM,GAAG;AAEnD,aAAW,sBAAsB,kBAAkB;AACjD,UAAM,CAAC,SAAS,SAAS,IAAI,mBAAmB,MAAM,GAAG;AACzD,QAAI,YAAY,KAAM;AACtB,YAAI,oCAAgB,QAAQ,OAAO,SAAS,GAAG,QAAQ,OAAO,iBAAiB,CAAC,GAAG;AACjF,UAAI;AACF,eAAO,KAAK,MAAM,OAAO;AAAA,MAC3B,SAAS,GAAG;AACV,gBAAQ,MAAM,mBAAmB,OAAO;AACxC,cAAM,qBAAO,gBAAgB,yBAAyB,EAAE,MAAM;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACA,UAAQ,MAAM,6BAA6B;AAC3C,QAAM,qBAAO,gBAAgB,2BAA2B,EAAE,MAAM;AAClE;","names":[]}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../src/webhook/index.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'crypto';\nimport { Status } from '../error/status';\n\nconst WEBHOOK_TOLERANCE_IN_SECONDS = 5 * 60; // 5 minutes\n\nfunction verifyTimestamp(webhookTimestamp: string) {\n const now = Math.floor(Date.now() / 1000);\n const timestamp = parseInt(webhookTimestamp, 10);\n if (isNaN(timestamp)) {\n throw Status.invalidArgument('invalid webhook timestamp').error();\n }\n if (timestamp < now - WEBHOOK_TOLERANCE_IN_SECONDS) {\n throw Status.invalidArgument('webhook timestamp is too old').error();\n }\n if (timestamp > now + WEBHOOK_TOLERANCE_IN_SECONDS) {\n throw Status.invalidArgument('webhook timestamp is too new').error();\n }\n return timestamp;\n}\n\n/**\n * reference: https://github.com/standard-webhooks/standard-webhooks/tree/main/libraries/javascript\n * hono usage:\n * ```ts\n * const webhook = verifyStandardWebhook(c.req.header(), await c.req.text(), 'secret');\n * ```\n */\nexport function verifyStandardWebhook<T = unknown>(\n headers: Record<string, string>,\n payload: string,\n secret: string\n): T {\n const webhookId = headers['webhook-id'];\n const webhookTimestamp = headers['webhook-timestamp'];\n const webhookSignature = headers['webhook-signature'];\n if (!webhookId || !webhookTimestamp || !webhookSignature) {\n throw Status.invalidArgument('invalid webhook').error();\n }\n const timestamp = verifyTimestamp(webhookTimestamp);\n\n const encoder = new TextEncoder();\n const toSign = encoder.encode(`${webhookId}.${timestamp}.${payload}`);\n const hmac = createHmac('sha256', Buffer.from(secret, 'base64'));\n const digest = hmac.update(toSign).digest();\n\n const computedSignature = `v1,${Buffer.from(digest).toString('base64')}`;\n const expectedSignature = computedSignature.split(',')[1];\n const passedSignatures = webhookSignature.split(' ');\n\n for (const versionedSignature of passedSignatures) {\n const [version, signature] = versionedSignature.split(',');\n if (version !== 'v1') continue;\n if (timingSafeEqual(encoder.encode(signature), encoder.encode(expectedSignature))) {\n try {\n return JSON.parse(payload) as T;\n } catch (_) {\n console.error('invalid payload', payload);\n throw Status.invalidArgument('invalid webhook payload').error();\n }\n }\n }\n console.error('webhook verification failed');\n throw Status.invalidArgument('invalid webhook signature').error();\n}\n"],"mappings":";AAAA,SAAS,YAAY,uBAAuB;AAC5C,SAAS,cAAc;AAEvB,IAAM,+BAA+B,IAAI;AAEzC,SAAS,gBAAgB,kBAA0B;AACjD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,YAAY,SAAS,kBAAkB,EAAE;AAC/C,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,OAAO,gBAAgB,2BAA2B,EAAE,MAAM;AAAA,EAClE;AACA,MAAI,YAAY,MAAM,8BAA8B;AAClD,UAAM,OAAO,gBAAgB,8BAA8B,EAAE,MAAM;AAAA,EACrE;AACA,MAAI,YAAY,MAAM,8BAA8B;AAClD,UAAM,OAAO,gBAAgB,8BAA8B,EAAE,MAAM;AAAA,EACrE;AACA,SAAO;AACT;AASO,SAAS,sBACd,SACA,SACA,QACG;AACH,QAAM,YAAY,QAAQ,YAAY;AACtC,QAAM,mBAAmB,QAAQ,mBAAmB;AACpD,QAAM,mBAAmB,QAAQ,mBAAmB;AACpD,MAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,kBAAkB;AACxD,UAAM,OAAO,gBAAgB,iBAAiB,EAAE,MAAM;AAAA,EACxD;AACA,QAAM,YAAY,gBAAgB,gBAAgB;AAElD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,QAAQ,OAAO,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE;AACpE,QAAM,OAAO,WAAW,UAAU,OAAO,KAAK,QAAQ,QAAQ,CAAC;AAC/D,QAAM,SAAS,KAAK,OAAO,MAAM,EAAE,OAAO;AAE1C,QAAM,oBAAoB,MAAM,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,CAAC;AACtE,QAAM,oBAAoB,kBAAkB,MAAM,GAAG,EAAE,CAAC;AACxD,QAAM,mBAAmB,iBAAiB,MAAM,GAAG;AAEnD,aAAW,sBAAsB,kBAAkB;AACjD,UAAM,CAAC,SAAS,SAAS,IAAI,mBAAmB,MAAM,GAAG;AACzD,QAAI,YAAY,KAAM;AACtB,QAAI,gBAAgB,QAAQ,OAAO,SAAS,GAAG,QAAQ,OAAO,iBAAiB,CAAC,GAAG;AACjF,UAAI;AACF,eAAO,KAAK,MAAM,OAAO;AAAA,MAC3B,SAAS,GAAG;AACV,gBAAQ,MAAM,mBAAmB,OAAO;AACxC,cAAM,OAAO,gBAAgB,yBAAyB,EAAE,MAAM;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACA,UAAQ,MAAM,6BAA6B;AAC3C,QAAM,OAAO,gBAAgB,2BAA2B,EAAE,MAAM;AAClE;","names":[]}
|
|
1
|
+
{"version":3,"sources":["../../src/webhook/index.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\nimport { Status } from '../error/status';\n\nconst WEBHOOK_TOLERANCE_IN_SECONDS = 5 * 60; // 5 minutes\n\nfunction verifyTimestamp(webhookTimestamp: string) {\n const now = Math.floor(Date.now() / 1000);\n const timestamp = parseInt(webhookTimestamp, 10);\n if (isNaN(timestamp)) {\n throw Status.invalidArgument('invalid webhook timestamp').error();\n }\n if (timestamp < now - WEBHOOK_TOLERANCE_IN_SECONDS) {\n throw Status.invalidArgument('webhook timestamp is too old').error();\n }\n if (timestamp > now + WEBHOOK_TOLERANCE_IN_SECONDS) {\n throw Status.invalidArgument('webhook timestamp is too new').error();\n }\n return timestamp;\n}\n\n/**\n * reference: https://github.com/standard-webhooks/standard-webhooks/tree/main/libraries/javascript\n * hono usage:\n * ```ts\n * const webhook = verifyStandardWebhook(c.req.header(), await c.req.text(), 'secret');\n * ```\n */\nexport function verifyStandardWebhook<T = unknown>(\n headers: Record<string, string>,\n payload: string,\n secret: string\n): T {\n const webhookId = headers['webhook-id'];\n const webhookTimestamp = headers['webhook-timestamp'];\n const webhookSignature = headers['webhook-signature'];\n if (!webhookId || !webhookTimestamp || !webhookSignature) {\n throw Status.invalidArgument('invalid webhook').error();\n }\n const timestamp = verifyTimestamp(webhookTimestamp);\n\n const encoder = new TextEncoder();\n const toSign = encoder.encode(`${webhookId}.${timestamp}.${payload}`);\n const hmac = createHmac('sha256', Buffer.from(secret, 'base64'));\n const digest = hmac.update(toSign).digest();\n\n const computedSignature = `v1,${Buffer.from(digest).toString('base64')}`;\n const expectedSignature = computedSignature.split(',')[1];\n const passedSignatures = webhookSignature.split(' ');\n\n for (const versionedSignature of passedSignatures) {\n const [version, signature] = versionedSignature.split(',');\n if (version !== 'v1') continue;\n if (timingSafeEqual(encoder.encode(signature), encoder.encode(expectedSignature))) {\n try {\n return JSON.parse(payload) as T;\n } catch (_) {\n console.error('invalid payload', payload);\n throw Status.invalidArgument('invalid webhook payload').error();\n }\n }\n }\n console.error('webhook verification failed');\n throw Status.invalidArgument('invalid webhook signature').error();\n}\n"],"mappings":";AAAA,SAAS,YAAY,uBAAuB;AAC5C,SAAS,cAAc;AAEvB,IAAM,+BAA+B,IAAI;AAEzC,SAAS,gBAAgB,kBAA0B;AACjD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,YAAY,SAAS,kBAAkB,EAAE;AAC/C,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,OAAO,gBAAgB,2BAA2B,EAAE,MAAM;AAAA,EAClE;AACA,MAAI,YAAY,MAAM,8BAA8B;AAClD,UAAM,OAAO,gBAAgB,8BAA8B,EAAE,MAAM;AAAA,EACrE;AACA,MAAI,YAAY,MAAM,8BAA8B;AAClD,UAAM,OAAO,gBAAgB,8BAA8B,EAAE,MAAM;AAAA,EACrE;AACA,SAAO;AACT;AASO,SAAS,sBACd,SACA,SACA,QACG;AACH,QAAM,YAAY,QAAQ,YAAY;AACtC,QAAM,mBAAmB,QAAQ,mBAAmB;AACpD,QAAM,mBAAmB,QAAQ,mBAAmB;AACpD,MAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,kBAAkB;AACxD,UAAM,OAAO,gBAAgB,iBAAiB,EAAE,MAAM;AAAA,EACxD;AACA,QAAM,YAAY,gBAAgB,gBAAgB;AAElD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,QAAQ,OAAO,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE;AACpE,QAAM,OAAO,WAAW,UAAU,OAAO,KAAK,QAAQ,QAAQ,CAAC;AAC/D,QAAM,SAAS,KAAK,OAAO,MAAM,EAAE,OAAO;AAE1C,QAAM,oBAAoB,MAAM,OAAO,KAAK,MAAM,EAAE,SAAS,QAAQ,CAAC;AACtE,QAAM,oBAAoB,kBAAkB,MAAM,GAAG,EAAE,CAAC;AACxD,QAAM,mBAAmB,iBAAiB,MAAM,GAAG;AAEnD,aAAW,sBAAsB,kBAAkB;AACjD,UAAM,CAAC,SAAS,SAAS,IAAI,mBAAmB,MAAM,GAAG;AACzD,QAAI,YAAY,KAAM;AACtB,QAAI,gBAAgB,QAAQ,OAAO,SAAS,GAAG,QAAQ,OAAO,iBAAiB,CAAC,GAAG;AACjF,UAAI;AACF,eAAO,KAAK,MAAM,OAAO;AAAA,MAC3B,SAAS,GAAG;AACV,gBAAQ,MAAM,mBAAmB,OAAO;AACxC,cAAM,OAAO,gBAAgB,yBAAyB,EAAE,MAAM;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACA,UAAQ,MAAM,6BAA6B;AAC3C,QAAM,OAAO,gBAAgB,2BAA2B,EAAE,MAAM;AAClE;","names":[]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@shware/http",
|
|
3
|
-
"version": "2.11.
|
|
3
|
+
"version": "2.11.4",
|
|
4
4
|
"private": false,
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -37,20 +37,23 @@
|
|
|
37
37
|
"require": "./dist/google-one-tap/index.cjs"
|
|
38
38
|
}
|
|
39
39
|
},
|
|
40
|
+
"publishConfig": {
|
|
41
|
+
"access": "public"
|
|
42
|
+
},
|
|
40
43
|
"dependencies": {
|
|
41
|
-
"vitest": "^4.1.
|
|
44
|
+
"vitest": "^4.1.9",
|
|
42
45
|
"zod": "^4.4.3",
|
|
43
|
-
"@shware/utils": "^1.4.
|
|
46
|
+
"@shware/utils": "^1.4.5"
|
|
44
47
|
},
|
|
45
48
|
"devDependencies": {
|
|
46
|
-
"@types/node": "^
|
|
47
|
-
"@types/react": "^19.2.
|
|
49
|
+
"@types/node": "^26.1.0",
|
|
50
|
+
"@types/react": "^19.2.17",
|
|
48
51
|
"typescript": "^6.0.3",
|
|
49
52
|
"@repo/typescript-config": "0.0.0"
|
|
50
53
|
},
|
|
51
54
|
"peerDependencies": {
|
|
52
|
-
"hono": "^4.12.
|
|
53
|
-
"i18next": "^26.3.
|
|
55
|
+
"hono": "^4.12.28",
|
|
56
|
+
"i18next": "^26.3.4",
|
|
54
57
|
"react": "^19"
|
|
55
58
|
},
|
|
56
59
|
"peerDependenciesMeta": {
|
|
@@ -69,6 +72,6 @@
|
|
|
69
72
|
"build": "tsup",
|
|
70
73
|
"test": "vitest run",
|
|
71
74
|
"check-types": "tsc --noEmit",
|
|
72
|
-
"lint": "oxlint . --fix"
|
|
75
|
+
"lint": "oxlint --type-aware . --fix"
|
|
73
76
|
}
|
|
74
77
|
}
|