@sigitex/route 1.0.0

package/src/middleware/bodyLimit.ts

@@ -0,0 +1,43 @@
+import { HTTP } from "../HTTP"
+import type { RequestContext, RouteMiddleware } from "../router.types"
+
+export type BodyLimitOptions = {
+  readonly maxSize?: number
+  readonly contentTypes?: string[]
+}
+
+export function bodyLimit(options?: BodyLimitOptions): RouteMiddleware {
+  const maxSize = options?.maxSize ?? 1_048_576
+  const contentTypes = options?.contentTypes
+
+  return {
+    before: ({ request }: RequestContext) => {
+      const contentLength = request.headers.get(HTTP.header.ContentLength)
+      if (contentLength && Number.parseInt(contentLength, 10) > maxSize) {
+        return new Response(
+          JSON.stringify({ error: HTTP.statusText.PayloadTooLarge }),
+          {
+            status: HTTP.status.PayloadTooLarge,
+            statusText: HTTP.statusText.PayloadTooLarge,
+          },
+        )
+      }
+
+      if (contentTypes) {
+        const contentType = request.headers.get(HTTP.header.ContentType)
+        if (
+          contentType &&
+          !contentTypes.some((allowed) => contentType.startsWith(allowed))
+        ) {
+          return new Response(
+            JSON.stringify({ error: HTTP.statusText.UnsupportedMediaType }),
+            {
+              status: HTTP.status.UnsupportedMediaType,
+              statusText: HTTP.statusText.UnsupportedMediaType,
+            },
+          )
+        }
+      }
+    },
+  }
+}

package/src/middleware/cache.ts

@@ -0,0 +1,53 @@
+// oxlint-disable no-eq-null -- fix this
+// oxlint-disable curly
+import { HTTP } from "../HTTP"
+import type { ResponseContext, RouteMiddleware } from "../router.types"
+
+export type CacheOptions = {
+  readonly public?: boolean
+  readonly private?: boolean
+  readonly maxAge?: number
+  readonly sMaxAge?: number
+  readonly noCache?: boolean
+  readonly noStore?: boolean
+  readonly mustRevalidate?: boolean
+  readonly proxyRevalidate?: boolean
+  readonly immutable?: boolean
+  readonly staleWhileRevalidate?: number
+  readonly staleIfError?: number
+  readonly vary?: string | string[]
+}
+
+export function cache(options: string | CacheOptions): RouteMiddleware {
+  const directive =
+    typeof options === "string" ? options : buildDirective(options)
+  const vary = typeof options === "object" ? options.vary : undefined
+
+  return {
+    after: ({ response }: ResponseContext) => {
+      response.headers.set(HTTP.header.CacheControl, directive)
+      if (vary) {
+        const value = Array.isArray(vary) ? vary.join(", ") : vary
+        response.headers.set(HTTP.header.Vary, value)
+      }
+    },
+  }
+}
+
+function buildDirective(options: CacheOptions): string {
+  const parts: string[] = []
+  if (options.public) parts.push("public")
+  if (options.private) parts.push("private")
+  if (options.noCache) parts.push("no-cache")
+  if (options.noStore) parts.push("no-store")
+  if (options.mustRevalidate) parts.push("must-revalidate")
+  if (options.proxyRevalidate) parts.push("proxy-revalidate")
+  if (options.immutable) parts.push("immutable")
+  if (options.maxAge != null) parts.push(`max-age=${options.maxAge}`)
+  if (options.sMaxAge != null) parts.push(`s-maxage=${options.sMaxAge}`)
+  if (options.staleWhileRevalidate != null)
+    parts.push(`stale-while-revalidate=${options.staleWhileRevalidate}`)
+  if (options.staleIfError != null)
+    parts.push(`stale-if-error=${options.staleIfError}`)
+  return parts.join(", ")
+}

package/src/middleware/cookies.ts

@@ -0,0 +1,76 @@
+import type {
+  RequestContext,
+  ResponseContext,
+  RouteMiddleware,
+} from "../router.types"
+
+export type CookieOptions = {
+  domain?: string
+  expires?: Date
+  httpOnly?: boolean
+  maxAge?: number
+  path?: string
+  sameSite?: "strict" | "lax" | "none"
+  secure?: boolean
+}
+
+export type Cookies = {
+  get(name: string): string | undefined
+  set(name: string, value: string, options?: CookieOptions): void
+}
+
+export function cookies(): RouteMiddleware {
+  const pending: { name: string; value: string; options?: CookieOptions }[] = []
+  let parsed: Record<string, string> = {}
+
+  return {
+    before: ({ request, bind }: RequestContext) => {
+      parsed = parseCookies(request.headers.get("cookie") ?? "")
+      bind({
+        cookies: {
+          get: (name: string) => parsed[name],
+          set: (name: string, value: string, options?: CookieOptions) =>
+            pending.push({ name, value, options }),
+        } satisfies Cookies,
+      })
+    },
+    after: ({ response }: ResponseContext) => {
+      for (const { name, value, options } of pending) {
+        response.headers.append(
+          "set-cookie",
+          serializeCookie(name, value, options),
+        )
+      }
+    },
+  }
+}
+
+function parseCookies(header: string): Record<string, string> {
+  const result: Record<string, string> = {}
+  for (const pair of header.split(";")) {
+    const index = pair.indexOf("=")
+    if (index === -1) continue
+    const key = pair.slice(0, index).trim()
+    const value = pair.slice(index + 1).trim()
+    if (key) result[key] = decodeURIComponent(value)
+  }
+  return result
+}
+
+function serializeCookie(
+  name: string,
+  value: string,
+  options?: CookieOptions,
+): string {
+  let cookie = `${name}=${encodeURIComponent(value)}`
+  if (!options) return cookie
+  if (options.domain) cookie += `; Domain=${options.domain}`
+  if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`
+  if (options.httpOnly) cookie += "; HttpOnly"
+  // oxlint-disable-next-line no-eq-null
+  if (options.maxAge != null) cookie += `; Max-Age=${options.maxAge}`
+  if (options.path) cookie += `; Path=${options.path}`
+  if (options.sameSite) cookie += `; SameSite=${options.sameSite}`
+  if (options.secure) cookie += "; Secure"
+  return cookie
+}

package/src/middleware/cors.ts

@@ -0,0 +1,113 @@
+import { HTTP } from "../HTTP"
+import type {
+  RequestContext,
+  ResponseContext,
+  RouteMiddleware,
+} from "../router.types"
+
+export type CorsOptions = {
+  readonly origin?: string | string[] | ((origin: string) => boolean)
+  readonly methods?: string[]
+  readonly allowHeaders?: string[]
+  readonly exposeHeaders?: string[]
+  readonly credentials?: boolean
+  readonly maxAge?: number
+}
+
+export function cors(options?: CorsOptions): RouteMiddleware {
+  const originOption = options?.origin ?? "*"
+  const methods = options?.methods ?? [
+    HTTP.method.GET,
+    HTTP.method.HEAD,
+    HTTP.method.PUT,
+    HTTP.method.PATCH,
+    HTTP.method.POST,
+    HTTP.method.DELETE,
+  ]
+  const allowHeaders = options?.allowHeaders
+  const exposeHeaders = options?.exposeHeaders
+  const credentials = options?.credentials ?? false
+  const maxAge = options?.maxAge
+
+  return {
+    before: ({ request }: RequestContext) => {
+      if (request.method !== HTTP.method.OPTIONS) return
+
+      const requestOrigin = request.headers.get(HTTP.header.Origin)
+      if (!requestOrigin) return
+
+      const response = new Response(null, { status: HTTP.status.NoContent })
+      setOriginHeader(response, requestOrigin, originOption)
+      response.headers.set(
+        HTTP.header.AccessControlAllowMethods,
+        methods.join(", "),
+      )
+
+      const requestedHeaders = request.headers.get(
+        HTTP.header.AccessControlRequestHeaders,
+      )
+      if (allowHeaders) {
+        response.headers.set(
+          HTTP.header.AccessControlAllowHeaders,
+          allowHeaders.join(", "),
+        )
+      } else if (requestedHeaders) {
+        response.headers.set(
+          HTTP.header.AccessControlAllowHeaders,
+          requestedHeaders,
+        )
+      }
+
+      if (credentials) {
+        response.headers.set(HTTP.header.AccessControlAllowCredentials, "true")
+      }
+
+      // oxlint-disable-next-line no-eq-null -- fix this
+      if (maxAge != null) {
+        response.headers.set(HTTP.header.AccessControlMaxAge, String(maxAge))
+      }
+
+      return response
+    },
+    after: ({ request, response }: ResponseContext) => {
+      const requestOrigin = request.headers.get(HTTP.header.Origin)
+      if (!requestOrigin) return
+
+      setOriginHeader(response, requestOrigin, originOption)
+
+      if (credentials) {
+        response.headers.set(HTTP.header.AccessControlAllowCredentials, "true")
+      }
+
+      if (exposeHeaders) {
+        response.headers.set(
+          HTTP.header.AccessControlExposeHeaders,
+          exposeHeaders.join(", "),
+        )
+      }
+    },
+  }
+}
+
+function setOriginHeader(
+  response: Response,
+  requestOrigin: string,
+  originOption: string | string[] | ((origin: string) => boolean),
+) {
+  if (originOption === "*") {
+    response.headers.set(HTTP.header.AccessControlAllowOrigin, "*")
+    return
+  }
+
+  const allowed =
+    typeof originOption === "function"
+      ? originOption(requestOrigin)
+      : typeof originOption === "string"
+        ? originOption === requestOrigin
+        : originOption.includes(requestOrigin)
+
+  if (allowed) {
+    response.headers.set(HTTP.header.AccessControlAllowOrigin, requestOrigin)
+    response.headers.append(HTTP.header.Vary, HTTP.header.Origin)
+  }
+}

package/src/middleware/csp.ts

@@ -0,0 +1,109 @@
+import { CSP, type CspSource } from "../CSP"
+import { HTTP } from "../HTTP"
+import type {
+  RequestContext,
+  ResponseContext,
+  RouteMiddleware,
+} from "../router.types"
+
+export type CspOptions = {
+  readonly defaultSrc?: CspSource[]
+  readonly scriptSrc?: CspSource[]
+  readonly styleSrc?: CspSource[]
+  readonly imgSrc?: CspSource[]
+  readonly connectSrc?: CspSource[]
+  readonly fontSrc?: CspSource[]
+  readonly frameSrc?: CspSource[]
+  readonly frameAncestors?: CspSource[]
+  readonly mediaSrc?: CspSource[]
+  readonly objectSrc?: CspSource[]
+  readonly workerSrc?: CspSource[]
+  readonly childSrc?: CspSource[]
+  readonly baseUri?: CspSource[]
+  readonly formAction?: CspSource[]
+  readonly manifestSrc?: CspSource[]
+  readonly upgradeInsecureRequests?: boolean
+  readonly reportOnly?: boolean
+  readonly reportTo?: string
+}
+
+const directiveMap: Record<string, string> = {
+  defaultSrc: "default-src",
+  scriptSrc: "script-src",
+  styleSrc: "style-src",
+  imgSrc: "img-src",
+  connectSrc: "connect-src",
+  fontSrc: "font-src",
+  frameSrc: "frame-src",
+  frameAncestors: "frame-ancestors",
+  mediaSrc: "media-src",
+  objectSrc: "object-src",
+  workerSrc: "worker-src",
+  childSrc: "child-src",
+  baseUri: "base-uri",
+  formAction: "form-action",
+  manifestSrc: "manifest-src",
+}
+
+export function csp(options: CspOptions): RouteMiddleware {
+  const usesNonce = detectsNonce(options)
+  const reportOnly = options.reportOnly ?? false
+
+  return {
+    before: usesNonce
+      ? ({ bind }: RequestContext) => {
+          const nonce = crypto.randomUUID()
+          bind({ cspNonce: nonce })
+        }
+      : undefined,
+    after: ({
+      response,
+      cspNonce,
+    }: ResponseContext & { cspNonce?: string }) => {
+      const value = buildPolicy(options, cspNonce)
+      const header = reportOnly
+        ? HTTP.header.ContentSecurityPolicyReportOnly
+        : HTTP.header.ContentSecurityPolicy
+      response.headers.set(header, value)
+    },
+  }
+}
+
+function detectsNonce(options: CspOptions): boolean {
+  for (const key of Object.keys(directiveMap)) {
+    const sources = options[key as keyof CspOptions]
+    if (
+      Array.isArray(sources) &&
+      sources.includes(CSP.nonce as unknown as CspSource)
+    ) {
+      return true
+    }
+  }
+  return false
+}
+
+function buildPolicy(options: CspOptions, nonce?: string): string {
+  const parts: string[] = []
+
+  for (const [key, directive] of Object.entries(directiveMap)) {
+    const sources = options[key as keyof CspOptions]
+    if (!Array.isArray(sources) || sources.length === 0) continue
+
+    const resolved = sources.map((source) => {
+      if (source === CSP.nonce) return `'nonce-${nonce}'`
+      return source as string
+    })
+
+    parts.push(`${directive} ${resolved.join(" ")}`)
+  }
+
+  if (options.upgradeInsecureRequests) {
+    parts.push("upgrade-insecure-requests")
+  }
+
+  if (options.reportTo) {
+    parts.push(`report-to ${options.reportTo}`)
+  }
+
+  return parts.join("; ")
+}

package/src/middleware/csrf.ts

@@ -0,0 +1,66 @@
+import { HTTP } from "../HTTP"
+import type { RequestContext, RouteMiddleware } from "../router.types"
+import type { Cookies } from "./cookies"
+
+export type CsrfOptions = {
+  readonly cookie?: string
+  readonly header?: string
+  readonly methods?: string[]
+}
+
+export function csrf(options?: CsrfOptions): RouteMiddleware {
+  const cookieName = options?.cookie ?? "csrf-token"
+  const headerName = options?.header ?? HTTP.header.XCsrfToken
+  const methods = options?.methods ?? [
+    HTTP.method.POST,
+    HTTP.method.PUT,
+    HTTP.method.PATCH,
+    HTTP.method.DELETE,
+  ]
+
+  return {
+    before: ({ request, cookies }: RequestContext & { cookies?: Cookies }) => {
+      if (!cookies) {
+        throw new Error(
+          "csrf() requires cookies() middleware to be in the stack",
+        )
+      }
+
+      if (!methods.includes(request.method)) return
+
+      const origin = request.headers.get(HTTP.header.Origin)
+      const url = new URL(request.url)
+      if (origin && origin !== url.origin) {
+        return new Response(
+          JSON.stringify({ error: HTTP.statusText.Forbidden }),
+          {
+            status: HTTP.status.Forbidden,
+            statusText: HTTP.statusText.Forbidden,
+          },
+        )
+      }
+
+      const cookieToken = cookies.get(cookieName)
+      const headerToken = request.headers.get(headerName)
+
+      if (!cookieToken || !headerToken || cookieToken !== headerToken) {
+        return new Response(
+          JSON.stringify({ error: HTTP.statusText.Forbidden }),
+          {
+            status: HTTP.status.Forbidden,
+            statusText: HTTP.statusText.Forbidden,
+          },
+        )
+      }
+    },
+    after: ({ cookies }: { cookies?: Cookies }) => {
+      if (!cookies) return
+      const token = crypto.randomUUID()
+      cookies.set(cookieName, token, {
+        httpOnly: false,
+        sameSite: "strict",
+        path: "/",
+      })
+    },
+  }
+}

package/src/middleware/filter.ts

@@ -0,0 +1,10 @@
+import type { RequestContext, RequestHandler } from "../router.types"
+
+export function filter(
+  predicate: (context: RequestContext) => boolean | Promise<boolean>,
+): (handler: RequestHandler) => RequestHandler {
+  return (handler) => async (context: RequestContext) => {
+    if (!(await predicate(context))) return
+    return context.dispatch(handler, [])
+  }
+}

package/src/middleware/frameGuard.ts

@@ -0,0 +1,15 @@
+import { HTTP } from "../HTTP"
+import type { ResponseContext, RouteMiddleware } from "../router.types"
+
+function make(value: string): RouteMiddleware {
+  return {
+    after: ({ response }: ResponseContext) => {
+      response.headers.set(HTTP.header.XFrameOptions, value)
+    },
+  }
+}
+
+export namespace frameGuard {
+  export const deny = make(HTTP.frameOption.deny)
+  export const sameOrigin = make(HTTP.frameOption.sameOrigin)
+}

package/src/middleware/hardened.ts

@@ -0,0 +1,43 @@
+import type { ResponseContext, RouteMiddleware } from "../router.types"
+import { frameGuard } from "./frameGuard"
+import { hsts, type HstsOptions } from "./hsts"
+import { noSniff } from "./noSniff"
+import { referrerPolicy } from "./referrerPolicy"
+
+export type HardenedOptions = {
+  readonly noSniff?: false
+  readonly frameGuard?: false | "deny" | "sameOrigin"
+  readonly referrerPolicy?: false | keyof typeof referrerPolicy
+  readonly hsts?: false | HstsOptions
+}
+
+export function hardened(options?: HardenedOptions): RouteMiddleware {
+  const parts: RouteMiddleware[] = []
+
+  if (options?.noSniff !== false) {
+    parts.push(noSniff)
+  }
+
+  if (options?.frameGuard !== false) {
+    const value = options?.frameGuard ?? "deny"
+    parts.push(frameGuard[value])
+  }
+
+  if (options?.referrerPolicy !== false) {
+    const value = options?.referrerPolicy ?? "strictOriginWhenCrossOrigin"
+    parts.push(referrerPolicy[value])
+  }
+
+  if (options?.hsts !== false) {
+    const hstsOptions = options?.hsts === undefined ? undefined : options.hsts
+    parts.push(hsts(hstsOptions))
+  }
+
+  return {
+    after: (context: ResponseContext) => {
+      for (const part of parts) {
+        if (part.after) part.after(context)
+      }
+    },
+  }
+}

package/src/middleware/hsts.ts

@@ -0,0 +1,24 @@
+import { HTTP } from "../HTTP"
+import type { ResponseContext, RouteMiddleware } from "../router.types"
+
+export type HstsOptions = {
+  readonly maxAge?: number
+  readonly includeSubDomains?: boolean
+  readonly preload?: boolean
+}
+
+export function hsts(options?: HstsOptions): RouteMiddleware {
+  const maxAge = options?.maxAge ?? 31536000
+  const includeSubDomains = options?.includeSubDomains ?? true
+  const preload = options?.preload ?? false
+
+  let value = `max-age=${maxAge}`
+  if (includeSubDomains) value += "; includeSubDomains"
+  if (preload) value += "; preload"
+
+  return {
+    after: ({ response }: ResponseContext) => {
+      response.headers.set(HTTP.header.StrictTransportSecurity, value)
+    },
+  }
+}

package/src/middleware/https.ts

@@ -0,0 +1,9 @@
+import type { RequestContext, RequestHandler } from "../router.types"
+
+export function https(): RequestHandler {
+  return ({ url }: RequestContext) => {
+    if (url.protocol === "https:") return
+    url.protocol = "https:"
+    return Response.redirect(url, 301)
+  }
+}

package/src/middleware/index.ts

@@ -0,0 +1,17 @@
+export * from "./bodyLimit"
+export * from "./cache"
+export * from "./cookies"
+export * from "./cors"
+export * from "./csp"
+export * from "./csrf"
+export * from "./filter"
+export * from "./frameGuard"
+export * from "./hardened"
+export * from "./hsts"
+export * from "./https"
+export * from "./noSniff"
+export * from "./rateLimit"
+export * from "./referrerPolicy"
+export * from "./requestId"
+export * from "./setHeader"
+export * from "./www"

package/src/middleware/noSniff.ts

@@ -0,0 +1,11 @@
+import { HTTP } from "../HTTP"
+import type { ResponseContext, RouteMiddleware } from "../router.types"
+
+export const noSniff: RouteMiddleware = {
+  after: ({ response }: ResponseContext) => {
+    response.headers.set(
+      HTTP.header.XContentTypeOptions,
+      HTTP.contentTypeOptions.nosniff,
+    )
+  },
+}