@stacksjs/bun-router 0.0.13 → 0.0.14

package/src/middleware/helmet.ts

@@ -1,268 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-export interface HelmetOptions {
-  contentSecurityPolicy?: boolean | {
-    directives?: Record<string, string[]>
-    reportOnly?: boolean
-    reportUri?: string
-    upgradeInsecureRequests?: boolean
-    blockAllMixedContent?: boolean
-  }
-  crossOriginEmbedderPolicy?: boolean | {
-    policy?: 'require-corp' | 'credentialless'
-  }
-  crossOriginOpenerPolicy?: boolean | {
-    policy?: 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none'
-  }
-  crossOriginResourcePolicy?: boolean | {
-    policy?: 'same-site' | 'same-origin' | 'cross-origin'
-  }
-  dnsPrefetchControl?: boolean | {
-    allow?: boolean
-  }
-  expectCt?: boolean | {
-    enforce?: boolean
-    maxAge?: number
-    reportUri?: string
-  }
-  frameguard?: boolean | {
-    action?: 'deny' | 'sameorigin'
-    domain?: string
-  }
-  hidePoweredBy?: boolean
-  hsts?: boolean | {
-    maxAge?: number
-    includeSubDomains?: boolean
-    preload?: boolean
-  }
-  ieNoOpen?: boolean
-  noSniff?: boolean
-  originAgentCluster?: boolean
-  permittedCrossDomainPolicies?: boolean | {
-    permittedPolicies?: 'none' | 'master-only' | 'by-content-type' | 'all'
-  }
-  referrerPolicy?: boolean | {
-    policy?: string | string[]
-  }
-  xssFilter?: boolean | {
-    setOnOldIE?: boolean
-  }
-}
-
-export default class Helmet {
-  private options: HelmetOptions
-
-  constructor(options: HelmetOptions = {}) {
-    const helmetConfig = (config.server?.security?.helmet || {}) as any
-
-    this.options = {
-      contentSecurityPolicy: options.contentSecurityPolicy ?? helmetConfig.contentSecurityPolicy ?? {
-        directives: {
-          'default-src': ['\'self\''],
-          'script-src': ['\'self\'', '\'unsafe-inline\''],
-          'style-src': ['\'self\'', '\'unsafe-inline\''],
-          'img-src': ['\'self\'', 'data:', 'https:'],
-          'font-src': ['\'self\''],
-          'connect-src': ['\'self\''],
-          'media-src': ['\'self\''],
-          'object-src': ['\'none\''],
-          'child-src': ['\'self\''],
-          'worker-src': ['\'self\''],
-          'frame-ancestors': ['\'none\''],
-          'form-action': ['\'self\''],
-          'base-uri': ['\'self\''],
-          'manifest-src': ['\'self\''],
-        },
-      },
-      crossOriginEmbedderPolicy: options.crossOriginEmbedderPolicy ?? true,
-      crossOriginOpenerPolicy: options.crossOriginOpenerPolicy ?? true,
-      crossOriginResourcePolicy: options.crossOriginResourcePolicy ?? true,
-      dnsPrefetchControl: options.dnsPrefetchControl ?? true,
-      expectCt: options.expectCt ?? helmetConfig.expectCt ?? false,
-      frameguard: options.frameguard ?? {
-        action: helmetConfig.frameOptions?.toLowerCase() as 'deny' | 'sameorigin' || 'deny',
-      },
-      hidePoweredBy: options.hidePoweredBy ?? helmetConfig.hidePoweredBy ?? true,
-      hsts: options.hsts ?? helmetConfig.hsts ?? {
-        maxAge: 31536000, // 1 year
-        includeSubDomains: true,
-        preload: true,
-      },
-      ieNoOpen: options.ieNoOpen ?? true,
-      noSniff: options.noSniff ?? helmetConfig.noSniff ?? true,
-      originAgentCluster: options.originAgentCluster ?? true,
-      permittedCrossDomainPolicies: options.permittedCrossDomainPolicies ?? {
-        permittedPolicies: 'none',
-      },
-      referrerPolicy: options.referrerPolicy ?? helmetConfig.referrerPolicy ?? {
-        policy: 'strict-origin-when-cross-origin',
-      },
-      xssFilter: options.xssFilter ?? helmetConfig.xssFilter ?? true,
-    }
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const helmetConfig = (config.server?.security?.helmet || {}) as any
-
-    // If helmet is disabled, continue to next middleware
-    if (helmetConfig.enabled === false) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    const response = await next()
-    if (!response) {
-      return new Response('Not Found', { status: 404 })
-    }
-
-    const headers = new Headers(response.headers)
-
-    // Content Security Policy
-    if (this.options.contentSecurityPolicy) {
-      const csp = this.options.contentSecurityPolicy
-      if (typeof csp === 'object' && csp.directives) {
-        const directives = Object.entries(csp.directives)
-          .map(([key, values]) => `${key} ${values.join(' ')}`)
-          .join('; ')
-
-        const headerName = csp.reportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy'
-        headers.set(headerName, directives)
-
-        if (csp.reportUri) {
-          headers.set('Report-To', JSON.stringify({
-            group: 'csp-endpoint',
-            max_age: 10886400,
-            endpoints: [{ url: csp.reportUri }],
-          }))
-        }
-      }
-    }
-
-    // Cross-Origin Embedder Policy
-    if (this.options.crossOriginEmbedderPolicy) {
-      const coep = this.options.crossOriginEmbedderPolicy
-      const policy = typeof coep === 'object' ? coep.policy || 'require-corp' : 'require-corp'
-      headers.set('Cross-Origin-Embedder-Policy', policy)
-    }
-
-    // Cross-Origin Opener Policy
-    if (this.options.crossOriginOpenerPolicy) {
-      const coop = this.options.crossOriginOpenerPolicy
-      const policy = typeof coop === 'object' ? coop.policy || 'same-origin' : 'same-origin'
-      headers.set('Cross-Origin-Opener-Policy', policy)
-    }
-
-    // Cross-Origin Resource Policy
-    if (this.options.crossOriginResourcePolicy) {
-      const corp = this.options.crossOriginResourcePolicy
-      const policy = typeof corp === 'object' ? corp.policy || 'same-origin' : 'same-origin'
-      headers.set('Cross-Origin-Resource-Policy', policy)
-    }
-
-    // DNS Prefetch Control
-    if (this.options.dnsPrefetchControl) {
-      const dnsPrefetch = this.options.dnsPrefetchControl
-      const allow = typeof dnsPrefetch === 'object' ? dnsPrefetch.allow : false
-      headers.set('X-DNS-Prefetch-Control', allow ? 'on' : 'off')
-    }
-
-    // Expect-CT
-    if (this.options.expectCt) {
-      const expectCt = this.options.expectCt
-      if (typeof expectCt === 'object') {
-        const parts = []
-        if (expectCt.enforce)
-          parts.push('enforce')
-        if (expectCt.maxAge)
-          parts.push(`max-age=${expectCt.maxAge}`)
-        if (expectCt.reportUri)
-          parts.push(`report-uri="${expectCt.reportUri}"`)
-        headers.set('Expect-CT', parts.join(', '))
-      }
-    }
-
-    // X-Frame-Options
-    if (this.options.frameguard) {
-      const frameguard = this.options.frameguard
-      if (typeof frameguard === 'object') {
-        const action = frameguard.action || 'deny'
-        const value = action === 'sameorigin' && frameguard.domain
-          ? `ALLOW-FROM ${frameguard.domain}`
-          : action.toUpperCase()
-        headers.set('X-Frame-Options', value)
-      }
-    }
-
-    // Hide X-Powered-By
-    if (this.options.hidePoweredBy) {
-      headers.delete('X-Powered-By')
-    }
-
-    // HTTP Strict Transport Security
-    if (this.options.hsts) {
-      const hsts = this.options.hsts
-      if (typeof hsts === 'object') {
-        const parts = [`max-age=${hsts.maxAge || 31536000}`]
-        if (hsts.includeSubDomains)
-          parts.push('includeSubDomains')
-        if (hsts.preload)
-          parts.push('preload')
-        headers.set('Strict-Transport-Security', parts.join('; '))
-      }
-    }
-
-    // X-Download-Options
-    if (this.options.ieNoOpen) {
-      headers.set('X-Download-Options', 'noopen')
-    }
-
-    // X-Content-Type-Options
-    if (this.options.noSniff) {
-      headers.set('X-Content-Type-Options', 'nosniff')
-    }
-
-    // Origin-Agent-Cluster
-    if (this.options.originAgentCluster) {
-      headers.set('Origin-Agent-Cluster', '?1')
-    }
-
-    // X-Permitted-Cross-Domain-Policies
-    if (this.options.permittedCrossDomainPolicies) {
-      const crossDomain = this.options.permittedCrossDomainPolicies
-      const policy = typeof crossDomain === 'object'
-        ? crossDomain.permittedPolicies || 'none'
-        : 'none'
-      headers.set('X-Permitted-Cross-Domain-Policies', policy)
-    }
-
-    // Referrer-Policy
-    if (this.options.referrerPolicy) {
-      const referrer = this.options.referrerPolicy
-      if (typeof referrer === 'object') {
-        const policy = Array.isArray(referrer.policy)
-          ? referrer.policy.join(', ')
-          : referrer.policy || 'strict-origin-when-cross-origin'
-        headers.set('Referrer-Policy', policy)
-      }
-      else {
-        headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
-      }
-    }
-
-    // X-XSS-Protection
-    if (this.options.xssFilter) {
-      const xss = this.options.xssFilter
-      const value = typeof xss === 'object' && xss.setOnOldIE
-        ? '1; mode=block'
-        : '0'
-      headers.set('X-XSS-Protection', value)
-    }
-
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    })
-  }
-}

package/src/middleware/index.ts

@@ -1,117 +0,0 @@
-import Auth, {
-  apiKeyAuth,
-  basicAuth,
-  bearerAuth,
-  extractApiKey,
-  extractBasicAuth,
-  extractBearerToken,
-  jwtAuth,
-  oauth2Auth,
-} from './auth'
-import Cors from './cors'
-import Csrf from './csrf'
-import JsonBody from './json_body'
-import { rateLimit as createRateLimit } from './rate_limit'
-import RequestId from './request_id'
-import RequestSigning from './request_signing'
-import Session from './session'
-
-// Export middleware classes
-export { default as Auth } from './auth'
-export { default as ContentSecurityPolicy } from './content_security_policy'
-export { contentSecurityPolicy } from './content_security_policy'
-export { default as Cors } from './cors'
-export { default as Csrf } from './csrf'
-export { default as DDoSProtection } from './ddos_protection'
-export { ddosProtection } from './ddos_protection'
-export { default as FileSecurity } from './file_security'
-export { default as FileUpload } from './file_upload'
-export { documentUpload, fileUpload, imageUpload, multipleFileUpload, singleFileUpload } from './file_upload'
-export { default as Helmet } from './helmet'
-export { default as InputValidation } from './input_validation'
-export { inputValidation } from './input_validation'
-export { default as JsonBody } from './json_body'
-export { default as PerformanceAlerting, performanceAlerting } from './performance_alerting'
-export { default as PerformanceDashboard, performanceDashboard } from './performance_dashboard'
-export { default as PerformanceMonitor, performanceMonitor } from './performance_monitor'
-export { default as RateLimit } from './rate_limit'
-// Export factory functions for easier usage
-export { rateLimit } from './rate_limit'
-export { default as RequestId } from './request_id'
-export { InMemoryNonceStore, default as RequestSigning, requestSigning, signRequest, verifySignature } from './request_signing'
-export type { NonceStore, RequestSigningOptions, SignatureAlgorithm, SignedPart } from './request_signing'
-export { SignatureError } from './request_signing'
-export { default as RequestTracer, requestTracer } from './request_tracer'
-export { default as Security } from './security'
-export { security } from './security'
-export { default as SecuritySuite } from './security_suite'
-export { securitySuite } from './security_suite'
-
-export { default as Session } from './session'
-
-// Authentication helper exports
-export {
-  apiKeyAuth,
-  basicAuth,
-  bearerAuth,
-  extractApiKey,
-  extractBasicAuth,
-  extractBearerToken,
-  jwtAuth,
-  oauth2Auth,
-}
-
-// Factory functions for easier middleware creation
-export const cors = (): Cors => new Cors()
-export const jsonBody = (): JsonBody => new JsonBody()
-export const requestId = (): RequestId => new RequestId()
-export const session = (): Session => new Session()
-export const csrf = (): Csrf => new Csrf()
-export function auth(): Auth {
-  return new Auth({
-    type: 'bearer',
-    validator: () => true, // Default just passes through - must be configured correctly
-  })
-}
-
-// Named middleware mapping for string-based middleware references (lazy-loaded)
-let _middleware: Record<string, any> | null = null
-
-function getMiddleware(): Record<string, any> {
-  if (!_middleware) {
-    _middleware = {
-      'Middleware/Cors': new Cors(),
-      'Middleware/JsonBody': new JsonBody(),
-      'Middleware/RequestId': new RequestId(),
-      'Middleware/Session': new Session(),
-      'Middleware/Csrf': new Csrf(),
-      'Middleware/Auth': new Auth({
-        type: 'bearer',
-        validator: () => true,
-      }),
-      'Middleware/RateLimit': createRateLimit(),
-      'Middleware/RequestSigning': new RequestSigning({
-        secret: '',
-      }),
-    }
-  }
-  return _middleware
-}
-
-export const middleware: Record<string, any> = new Proxy({} as Record<string, any>, {
-  get(_target, prop) {
-    return getMiddleware()[prop as string]
-  },
-  ownKeys() {
-    return Object.keys(getMiddleware())
-  },
-  getOwnPropertyDescriptor(_target, prop) {
-    const value = getMiddleware()[prop as string]
-    if (value !== undefined) {
-      return { configurable: true, enumerable: true, value }
-    }
-    return undefined
-  },
-})
-
-export default middleware