@stacksjs/bun-router 0.0.13 → 0.0.14

package/src/middleware/ddos_protection.ts

@@ -1,255 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-export interface DDoSProtectionOptions {
-  enabled?: boolean
-  maxRequestsPerSecond?: number
-  maxRequestsPerMinute?: number
-  maxRequestsPerHour?: number
-  burstLimit?: number
-  windowSize?: number
-  blockDuration?: number
-  whitelistedIPs?: string[]
-  blacklistedIPs?: string[]
-  trustProxy?: boolean
-  skipSuccessfulRequests?: boolean
-  skipFailedRequests?: boolean
-  keyGenerator?: (req: EnhancedRequest) => string
-  onLimitReached?: (req: EnhancedRequest, rateLimitInfo: any) => Response | Promise<Response>
-  store?: 'memory' | 'redis'
-  redis?: {
-    url: string
-    prefix?: string
-  }
-}
-
-interface RequestInfo {
-  count: number
-  firstRequest: number
-  lastRequest: number
-  blocked: boolean
-  blockExpires?: number
-}
-
-export default class DDoSProtection {
-  private options: DDoSProtectionOptions
-  private requestStore: Map<string, RequestInfo> = new Map()
-  private cleanupInterval: ReturnType<typeof setInterval> | null = null
-
-  constructor(options: DDoSProtectionOptions = {}) {
-    const ddosConfig = config.server?.security?.ddos || {}
-
-    this.options = {
-      enabled: options.enabled ?? ddosConfig.enabled ?? true,
-      maxRequestsPerSecond: options.maxRequestsPerSecond ?? ddosConfig.maxRequestsPerSecond ?? 10,
-      maxRequestsPerMinute: options.maxRequestsPerMinute ?? ddosConfig.maxRequestsPerMinute ?? 100,
-      maxRequestsPerHour: options.maxRequestsPerHour ?? ddosConfig.maxRequestsPerHour ?? 1000,
-      burstLimit: options.burstLimit ?? ddosConfig.burstLimit ?? 20,
-      windowSize: options.windowSize ?? ddosConfig.windowSize ?? 60000, // 1 minute
-      blockDuration: options.blockDuration ?? ddosConfig.blockDuration ?? 300000, // 5 minutes
-      whitelistedIPs: options.whitelistedIPs ?? ddosConfig.whitelistedIPs ?? [],
-      blacklistedIPs: options.blacklistedIPs ?? ddosConfig.blacklistedIPs ?? [],
-      trustProxy: options.trustProxy ?? ddosConfig.trustProxy ?? true,
-      skipSuccessfulRequests: options.skipSuccessfulRequests ?? ddosConfig.skipSuccessfulRequests ?? false,
-      skipFailedRequests: options.skipFailedRequests ?? ddosConfig.skipFailedRequests ?? false,
-      keyGenerator: options.keyGenerator ?? this.defaultKeyGenerator.bind(this),
-      onLimitReached: options.onLimitReached,
-      store: options.store ?? ddosConfig.store ?? 'memory',
-      redis: options.redis ?? ddosConfig.redis,
-    }
-
-    // Start cleanup interval for memory store
-    if (this.options.store === 'memory') {
-      this.startCleanupInterval()
-    }
-  }
-
-  private defaultKeyGenerator(req: EnhancedRequest): string {
-    const forwarded = req.headers.get('x-forwarded-for')
-    const realIP = req.headers.get('x-real-ip')
-    const cfIP = req.headers.get('cf-connecting-ip')
-
-    if (this.options.trustProxy && forwarded) {
-      return forwarded.split(',')[0].trim()
-    }
-
-    return realIP || cfIP || 'unknown'
-  }
-
-  private startCleanupInterval(): void {
-    this.cleanupInterval = setInterval(() => {
-      const now = Date.now()
-      for (const [key, info] of this.requestStore.entries()) {
-        // Remove expired entries
-        if (now - info.lastRequest > this.options.windowSize! * 2) {
-          this.requestStore.delete(key)
-        }
-        // Remove expired blocks
-        if (info.blocked && info.blockExpires && now > info.blockExpires) {
-          info.blocked = false
-          info.blockExpires = undefined
-        }
-      }
-    }, this.options.windowSize! / 2) // Cleanup every half window
-  }
-
-  private isWhitelisted(ip: string): boolean {
-    return this.options.whitelistedIPs?.includes(ip) ?? false
-  }
-
-  private isBlacklisted(ip: string): boolean {
-    return this.options.blacklistedIPs?.includes(ip) ?? false
-  }
-
-  private getRateLimitInfo(key: string, now: number): RequestInfo {
-    let info = this.requestStore.get(key)
-
-    if (!info) {
-      info = {
-        count: 0,
-        firstRequest: now,
-        lastRequest: now,
-        blocked: false,
-      }
-      this.requestStore.set(key, info)
-    }
-
-    // Reset count if window has passed
-    if (now - info.firstRequest > this.options.windowSize!) {
-      info.count = 0
-      info.firstRequest = now
-    }
-
-    return info
-  }
-
-  private shouldBlock(info: RequestInfo, now: number): boolean {
-    // Check if already blocked and block hasn't expired
-    if (info.blocked && info.blockExpires && now < info.blockExpires) {
-      return true
-    }
-
-    // Check burst limit (requests per second)
-    const _secondWindow = 1000
-    const recentRequests = info.count // Simplified for this implementation
-    if (recentRequests > this.options.burstLimit!) {
-      return true
-    }
-
-    // Check requests per minute
-    if (info.count > this.options.maxRequestsPerMinute!) {
-      return true
-    }
-
-    return false
-  }
-
-  private blockIP(info: RequestInfo, now: number): void {
-    info.blocked = true
-    info.blockExpires = now + this.options.blockDuration!
-  }
-
-  private createBlockedResponse(req: EnhancedRequest, info: RequestInfo): Response {
-    const retryAfter = Math.ceil((info.blockExpires! - Date.now()) / 1000)
-
-    const headers = {
-      'Retry-After': retryAfter.toString(),
-      'X-RateLimit-Limit': this.options.maxRequestsPerMinute!.toString(),
-      'X-RateLimit-Remaining': '0',
-      'X-RateLimit-Reset': Math.ceil(info.blockExpires! / 1000).toString(),
-    }
-
-    if (this.options.onLimitReached) {
-      return this.options.onLimitReached(req, { ...info, retryAfter }) as Response
-    }
-
-    return new Response(JSON.stringify({
-      error: 'Too Many Requests',
-      message: 'Rate limit exceeded. Please try again later.',
-      retryAfter,
-    }), {
-      status: 429,
-      headers: {
-        'Content-Type': 'application/json',
-        ...headers,
-      },
-    })
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    // Skip if DDoS protection is disabled
-    if (!this.options.enabled) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    const now = Date.now()
-    const key = this.options.keyGenerator!(req)
-
-    // Check if IP is whitelisted
-    if (this.isWhitelisted(key)) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    // Check if IP is blacklisted
-    if (this.isBlacklisted(key)) {
-      return new Response('Access Denied', { status: 403 })
-    }
-
-    // Get rate limit info
-    const info = this.getRateLimitInfo(key, now)
-
-    // Check if should block
-    if (this.shouldBlock(info, now)) {
-      this.blockIP(info, now)
-      return this.createBlockedResponse(req, info)
-    }
-
-    // Increment request count
-    info.count++
-    info.lastRequest = now
-
-    // Process request
-    const response = await next()
-
-    if (!response) {
-      return new Response('Not Found', { status: 404 })
-    }
-
-    // Skip counting based on response status if configured
-    if (this.options.skipSuccessfulRequests && response.status < 400) {
-      info.count--
-    }
-    if (this.options.skipFailedRequests && response.status >= 400) {
-      info.count--
-    }
-
-    // Add rate limit headers
-    const headers = new Headers(response.headers)
-    headers.set('X-RateLimit-Limit', this.options.maxRequestsPerMinute!.toString())
-    headers.set('X-RateLimit-Remaining', Math.max(0, this.options.maxRequestsPerMinute! - info.count).toString())
-    headers.set('X-RateLimit-Reset', Math.ceil((info.firstRequest + this.options.windowSize!) / 1000).toString())
-
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    })
-  }
-
-  // Cleanup method
-  destroy(): void {
-    if (this.cleanupInterval) {
-      clearInterval(this.cleanupInterval)
-      this.cleanupInterval = null
-    }
-    this.requestStore.clear()
-  }
-}
-
-// Factory function for easy use
-export function ddosProtection(options: DDoSProtectionOptions = {}): (req: EnhancedRequest, next: NextFunction) => Promise<Response> {
-  const instance = new DDoSProtection(options)
-  return async (req: EnhancedRequest, next: NextFunction) => instance.handle(req, next)
-}

package/src/middleware/file_security.ts

@@ -1,191 +0,0 @@
-import type { UploadedFile } from './file_upload'
-
-export interface FileSecurityConfig {
-  scanForMalware?: boolean
-  checkMagicNumbers?: boolean
-  sanitizeFilenames?: boolean
-  preventExecutableUploads?: boolean
-  maxFilenameLength?: number
-}
-
-export default class FileSecurity {
-  private config: Required<FileSecurityConfig>
-
-  // Common file signatures (magic numbers)
-  private readonly FILE_SIGNATURES: Record<string, Uint8Array[]> = {
-    'image/jpeg': [
-      new Uint8Array([0xFF, 0xD8, 0xFF]),
-    ],
-    'image/png': [
-      new Uint8Array([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
-    ],
-    'image/gif': [
-      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x37, 0x61]),
-      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x39, 0x61]),
-    ],
-    'application/pdf': [
-      new Uint8Array([0x25, 0x50, 0x44, 0x46]),
-    ],
-    'application/zip': [
-      new Uint8Array([0x50, 0x4B, 0x03, 0x04]),
-      new Uint8Array([0x50, 0x4B, 0x05, 0x06]),
-      new Uint8Array([0x50, 0x4B, 0x07, 0x08]),
-    ],
-  }
-
-  // Dangerous file extensions
-  private readonly EXECUTABLE_EXTENSIONS = [
-    '.exe',
-    '.bat',
-    '.cmd',
-    '.com',
-    '.pif',
-    '.scr',
-    '.vbs',
-    '.js',
-    '.jar',
-    '.app',
-    '.deb',
-    '.pkg',
-    '.dmg',
-    '.sh',
-    '.ps1',
-    '.msi',
-    '.dll',
-  ]
-
-  constructor(config: FileSecurityConfig = {}) {
-    this.config = {
-      scanForMalware: config.scanForMalware ?? false,
-      checkMagicNumbers: config.checkMagicNumbers ?? true,
-      sanitizeFilenames: config.sanitizeFilenames ?? true,
-      preventExecutableUploads: config.preventExecutableUploads ?? true,
-      maxFilenameLength: config.maxFilenameLength ?? 255,
-    }
-  }
-
-  validateFile(file: UploadedFile): { isValid: boolean, errors: string[] } {
-    const errors: string[] = []
-
-    // Check filename length
-    if (file.originalName.length > this.config.maxFilenameLength) {
-      errors.push(`Filename too long (max ${this.config.maxFilenameLength} characters)`)
-    }
-
-    // Check for dangerous filename patterns (but don't reject if we're sanitizing)
-    if (this.config.sanitizeFilenames) {
-      const sanitizedName = this.sanitizeFilename(file.originalName)
-      // Only error if sanitization results in empty filename
-      if (!sanitizedName || sanitizedName.length === 0) {
-        errors.push('Filename is invalid or empty after sanitization')
-      }
-    }
-
-    // Check for executable files
-    if (this.config.preventExecutableUploads) {
-      const extension = this.getFileExtension(file.originalName).toLowerCase()
-      if (this.EXECUTABLE_EXTENSIONS.includes(extension)) {
-        errors.push('Executable files are not allowed')
-      }
-    }
-
-    // Validate file signature (magic numbers)
-    if (this.config.checkMagicNumbers) {
-      const isValidSignature = this.validateFileSignature(file)
-      if (!isValidSignature) {
-        errors.push('File signature does not match declared MIME type')
-      }
-    }
-
-    // Basic malware scan (simple heuristics)
-    if (this.config.scanForMalware) {
-      const malwareDetected = this.basicMalwareScan(file)
-      if (malwareDetected) {
-        errors.push('Potential malware detected')
-      }
-    }
-
-    return {
-      isValid: errors.length === 0,
-      errors,
-    }
-  }
-
-  private validateFileSignature(file: UploadedFile): boolean {
-    const signatures = this.FILE_SIGNATURES[file.mimetype]
-    if (!signatures) {
-      // If we don't have signatures for this MIME type, allow it
-      return true
-    }
-
-    const fileBuffer = new Uint8Array(file.buffer.slice(0, 16)) // Check first 16 bytes
-
-    return signatures.some((signature) => {
-      if (fileBuffer.length < signature.length)
-        return false
-
-      for (let i = 0; i < signature.length; i++) {
-        if (fileBuffer[i] !== signature[i])
-          return false
-      }
-      return true
-    })
-  }
-
-  private sanitizeFilename(filename: string): string {
-    // Remove or replace dangerous characters
-    return filename
-      // eslint-disable-next-line no-control-regex
-      .replace(/[<>:"/\\|?*\u0000-\u001F]/u, '_') // Replace dangerous chars with underscore
-      .replace(/^\.+/, '') // Remove leading dots
-      .replace(/\.+$/, '') // Remove trailing dots
-      .replace(/\s+/g, '_') // Replace spaces with underscores
-      .substring(0, this.config.maxFilenameLength) // Truncate if too long
-  }
-
-  private getFileExtension(filename: string): string {
-    const lastDotIndex = filename.lastIndexOf('.')
-    return lastDotIndex === -1 ? '' : filename.substring(lastDotIndex)
-  }
-
-  private basicMalwareScan(file: UploadedFile): boolean {
-    // Simple heuristic-based malware detection
-    const buffer = new Uint8Array(file.buffer)
-    const content = new TextDecoder('utf-8', { fatal: false }).decode(buffer)
-
-    // Check for common malware patterns (very basic)
-    const malwarePatterns = [
-      /eval\s*\(/gi,
-      /document\.write/gi,
-      /window\.location/gi,
-      /<script[^>]*>/gi,
-      /javascript:/gi,
-      /vbscript:/gi,
-      /onload\s*=/gi,
-      /onerror\s*=/gi,
-    ]
-
-    return malwarePatterns.some(pattern => pattern.test(content))
-  }
-
-  // Utility method to get safe filename
-  getSafeFilename(originalName: string): string {
-    return this.sanitizeFilename(originalName)
-  }
-
-  // Check if file type is allowed based on whitelist
-  isAllowedFileType(mimetype: string, allowedTypes: string[]): boolean {
-    if (allowedTypes.length === 0)
-      return true
-    return allowedTypes.includes(mimetype)
-  }
-
-  // Check file size limits
-  isWithinSizeLimit(fileSize: number, maxSize: number): boolean {
-    return fileSize <= maxSize
-  }
-}
-
-export function createFileSecurity(config: FileSecurityConfig = {}): FileSecurity {
-  return new FileSecurity(config)
-}

package/src/middleware/file_upload.ts

@@ -1,264 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import type { FileSecurityConfig } from './file_security'
-import { randomUUID } from 'node:crypto'
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
-import { basename, extname, join } from 'node:path'
-import FileSecurity from './file_security'
-
-export interface UploadedFile {
-  fieldName: string
-  originalName: string
-  filename: string
-  path: string
-  size: number
-  mimetype: string
-  buffer: ArrayBuffer
-}
-
-export interface FileUploadConfig extends FileSecurityConfig {
-  destination?: string
-  maxFileSize?: number // in bytes
-  maxFiles?: number
-  allowedMimeTypes?: string[]
-  allowedExtensions?: string[]
-  preserveOriginalName?: boolean
-  generateUniqueFilename?: boolean
-  createDestination?: boolean
-}
-
-export interface FileUploadOptions extends FileUploadConfig {
-  fieldName?: string | string[]
-}
-
-export default class FileUpload {
-  private config: Required<FileUploadConfig>
-
-  private fileSecurity: FileSecurity
-
-  constructor(config: FileUploadConfig = {}) {
-    this.config = {
-      destination: config.destination || './uploads',
-      maxFileSize: config.maxFileSize || 10 * 1024 * 1024, // 10MB default
-      maxFiles: config.maxFiles || 10,
-      allowedMimeTypes: config.allowedMimeTypes || [],
-      allowedExtensions: config.allowedExtensions || [],
-      preserveOriginalName: config.preserveOriginalName ?? false,
-      generateUniqueFilename: config.generateUniqueFilename ?? true,
-      createDestination: config.createDestination ?? true,
-      scanForMalware: config.scanForMalware ?? false,
-      checkMagicNumbers: config.checkMagicNumbers ?? true,
-      sanitizeFilenames: config.sanitizeFilenames ?? true,
-      preventExecutableUploads: config.preventExecutableUploads ?? true,
-      maxFilenameLength: config.maxFilenameLength ?? 255,
-    }
-
-    this.fileSecurity = new FileSecurity(config)
-
-    // Create destination directory if it doesn't exist
-    if (this.config.createDestination && !existsSync(this.config.destination)) {
-      mkdirSync(this.config.destination, { recursive: true })
-    }
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const contentType = req.headers.get('content-type')
-
-    if (!contentType || !contentType.includes('multipart/form-data')) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    try {
-      const formData = await req.formData()
-      const uploadedFiles: UploadedFile[] = []
-      const fields: Record<string, any> = {}
-
-      for (const [key, value] of (formData as any).entries()) {
-        if (value instanceof File) {
-          // Validate file count
-          if (uploadedFiles.length >= this.config.maxFiles) {
-            return this.createErrorResponse(`Maximum ${this.config.maxFiles} files allowed`, 400)
-          }
-
-          // Validate file size
-          if (value.size > this.config.maxFileSize) {
-            return this.createErrorResponse(
-              `File ${value.name} exceeds maximum size of ${this.formatBytes(this.config.maxFileSize)}`,
-              413,
-            )
-          }
-
-          // Validate MIME type
-          if (this.config.allowedMimeTypes.length > 0) {
-            const baseType = value.type.split(';')[0] // Remove charset info
-            if (!this.config.allowedMimeTypes.includes(baseType)) {
-              return this.createErrorResponse(
-                `File type ${baseType} not allowed. Allowed types: ${this.config.allowedMimeTypes.join(', ')}`,
-                415,
-              )
-            }
-          }
-
-          // Validate file extension
-          const fileExtension = extname(value.name).toLowerCase()
-          if (this.config.allowedExtensions.length > 0 && !this.config.allowedExtensions.includes(fileExtension)) {
-            return this.createErrorResponse(
-              `File extension ${fileExtension} not allowed. Allowed extensions: ${this.config.allowedExtensions.join(', ')}`,
-              415,
-            )
-          }
-
-          // Generate filename
-          const filename = this.generateFilename(value.name)
-          const filePath = join(this.config.destination, filename)
-
-          // Convert file to buffer and save
-          const buffer = await value.arrayBuffer()
-
-          const uploadedFile: UploadedFile = {
-            fieldName: key,
-            originalName: value.name,
-            filename,
-            path: filePath,
-            size: value.size,
-            mimetype: value.type,
-            buffer,
-          }
-
-          // Validate file security
-          const securityCheck = this.fileSecurity.validateFile(uploadedFile)
-          if (!securityCheck.isValid) {
-            return this.createErrorResponse(
-              `Security validation failed: ${securityCheck.errors.join(', ')}`,
-              400,
-            )
-          }
-
-          writeFileSync(filePath, new Uint8Array(buffer))
-          uploadedFiles.push(uploadedFile)
-        }
-        else {
-          // Handle regular form fields
-          if (fields[key]) {
-            // Convert to array if multiple values
-            if (Array.isArray(fields[key])) {
-              fields[key].push(value)
-            }
-            else {
-              fields[key] = [fields[key], value]
-            }
-          }
-          else {
-            fields[key] = value
-          }
-        }
-      }
-
-      // Attach files and fields to request
-      Object.defineProperty(req, 'files', {
-        value: uploadedFiles,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
-
-      Object.defineProperty(req, 'formBody', {
-        value: fields,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
-
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-    catch (error) {
-      return this.createErrorResponse(
-        `File upload failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
-        500,
-      )
-    }
-  }
-
-  private generateFilename(originalName: string): string {
-    // Always sanitize the filename first
-    const sanitizedName = this.fileSecurity.getSafeFilename(originalName)
-
-    if (this.config.preserveOriginalName && !this.config.generateUniqueFilename) {
-      return sanitizedName
-    }
-
-    const extension = extname(sanitizedName)
-    const baseName = basename(sanitizedName, extension)
-
-    if (this.config.generateUniqueFilename) {
-      const uuid = randomUUID()
-      return this.config.preserveOriginalName
-        ? `${baseName}_${uuid}${extension}`
-        : `${uuid}${extension}`
-    }
-
-    return sanitizedName
-  }
-
-  private formatBytes(bytes: number): string {
-    if (bytes === 0)
-      return '0 Bytes'
-    const k = 1024
-    const sizes = ['Bytes', 'KB', 'MB', 'GB']
-    const i = Math.floor(Math.log(bytes) / Math.log(k))
-    return `${Number.parseFloat((bytes / k ** i).toFixed(2))} ${sizes[i]}`
-  }
-
-  private createErrorResponse(message: string, status: number): Response {
-    return new Response(
-      JSON.stringify({ error: message }),
-      {
-        status,
-        headers: { 'Content-Type': 'application/json' },
-      },
-    )
-  }
-}
-
-// Factory function for easier usage
-export function fileUpload(config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload(config)
-}
-
-// Specialized factory functions
-export function singleFileUpload(_fieldName: string, config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload({ ...config, maxFiles: 1 })
-}
-
-export function multipleFileUpload(maxFiles: number = 10, config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload({ ...config, maxFiles })
-}
-
-export function imageUpload(config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload({
-    ...config,
-    allowedMimeTypes: [
-      'image/jpeg',
-      'image/jpg',
-      'image/png',
-      'image/gif',
-      'image/webp',
-      'image/svg+xml',
-    ],
-    allowedExtensions: ['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg'],
-  })
-}
-
-export function documentUpload(config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload({
-    ...config,
-    allowedMimeTypes: [
-      'application/pdf',
-      'application/msword',
-      'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-      'text/plain',
-    ],
-    allowedExtensions: ['.pdf', '.doc', '.docx', '.txt'],
-  })
-}