@stacksjs/bun-router 0.0.14 → 0.0.15

package/src/middleware/auth.ts

@@ -0,0 +1,220 @@
+import type { EnhancedRequest, Middleware, NextFunction } from '../types'
+
+export interface AuthOptions {
+  /**
+   * Authentication type to use
+   */
+  type: 'basic' | 'bearer' | 'api-key' | 'oauth2' | 'jwt' | 'custom'
+
+  /**
+   * Function to validate credentials
+   */
+  validator: (credentials: any, req: EnhancedRequest) => Promise<boolean> | boolean
+
+  /**
+   * Extract user information after successful authentication
+   */
+  userExtractor?: (credentials: any, req: EnhancedRequest) => Promise<any> | any
+
+  /**
+   * Where to look for auth information
+   */
+  source?: 'header' | 'query' | 'cookie'
+
+  /**
+   * Key name for the source (header name, query param, cookie name)
+   */
+  key?: string
+
+  /**
+   * Realm for Basic authentication
+   */
+  realm?: string
+
+  /**
+   * Custom credentials extractor
+   */
+  credentialsExtractor?: (req: EnhancedRequest) => Promise<any> | any
+
+  /**
+   * Whether to attach user info to request
+   */
+  attachUser?: boolean
+}
+
+/**
+ * Extracts and decodes Basic Auth credentials from Authorization header
+ */
+export function extractBasicAuth(authHeader: string): { username: string, password: string } | null {
+  if (!authHeader || !authHeader.startsWith('Basic ')) {
+    return null
+  }
+
+  try {
+    const base64Credentials = authHeader.split(' ')[1]
+    const credentials = atob(base64Credentials)
+    const [username, password] = credentials.split(':')
+
+    return { username, password }
+  }
+  catch (error) {
+    void error
+
+    return null
+  }
+}
+
+/**
+ * Extracts Bearer token from Authorization header
+ */
+export function extractBearerToken(authHeader: string): string | null {
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return null
+  }
+
+  return authHeader.split(' ')[1]
+}
+
+/**
+ * Extracts API key from various sources
+ */
+export function extractApiKey(req: EnhancedRequest, source: 'header' | 'query' | 'cookie' = 'header', key: string = 'X-API-Key'): string | null {
+  switch (source) {
+    case 'header':
+      return req.headers.get(key) || null
+    case 'query':
+      return new URL(req.url).searchParams.get(key)
+    case 'cookie':
+      // Handle both Map-like cookies (with .get()) and plain object cookies
+      if (req.cookies) {
+        if (typeof req.cookies.get === 'function') {
+          return req.cookies.get(key) || null
+        }
+        return (req.cookies as unknown as Record<string, string>)[key] || null
+      }
+      return null
+    default:
+      return null
+  }
+}
+
+export default class AuthMiddleware implements Middleware {
+  private options: AuthOptions
+
+  constructor(options: AuthOptions) {
+    this.options = {
+      source: 'header',
+      key: 'Authorization',
+      attachUser: true,
+      ...options,
+    }
+  }
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    let credentials: any = null
+
+    // Extract credentials based on auth type
+    if (this.options.credentialsExtractor) {
+      credentials = await this.options.credentialsExtractor(req)
+    }
+    else {
+      switch (this.options.type) {
+        case 'basic': {
+          const authHeader = req.headers.get(this.options.key || 'Authorization')
+          credentials = extractBasicAuth(authHeader || '')
+          break
+        }
+        case 'bearer':
+        case 'jwt': {
+          const authHeader = req.headers.get(this.options.key || 'Authorization')
+          credentials = extractBearerToken(authHeader || '')
+          break
+        }
+        case 'api-key': {
+          credentials = extractApiKey(req, this.options.source, this.options.key)
+          break
+        }
+        case 'oauth2': {
+          // OAuth tokens are typically sent as Bearer tokens
+          const authHeader = req.headers.get(this.options.key || 'Authorization')
+          credentials = extractBearerToken(authHeader || '')
+          break
+        }
+      }
+    }
+
+    // If no credentials were found, return 401
+    if (!credentials) {
+      const headers: Record<string, string> = {}
+
+      // For Basic auth, include WWW-Authenticate header
+      if (this.options.type === 'basic') {
+        const realm = this.options.realm || 'Secure Area'
+        headers['WWW-Authenticate'] = `Basic realm="${realm}"`
+      }
+
+      return new Response('Unauthorized', {
+        status: 401,
+        headers,
+      })
+    }
+
+    // Validate credentials
+    const isValid = await this.options.validator(credentials, req)
+
+    if (!isValid) {
+      return new Response('Unauthorized', { status: 401 })
+    }
+
+    // If user extractor provided and attachUser is true, attach user to request
+    if (this.options.userExtractor && this.options.attachUser) {
+      const user = await this.options.userExtractor(credentials, req)
+      ;(req as any).user = user
+    }
+
+    // Authentication successful, continue to next middleware or route handler
+    const response = await next()
+    return response || new Response('Not Found', { status: 404 })
+  }
+}
+
+// Convenience factory functions for common auth types
+export function basicAuth(validator: (credentials: { username: string, password: string }, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
+  return new AuthMiddleware({
+    type: 'basic',
+    validator,
+    ...options,
+  })
+}
+
+export function bearerAuth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
+  return new AuthMiddleware({
+    type: 'bearer',
+    validator,
+    ...options,
+  })
+}
+
+export function jwtAuth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
+  return new AuthMiddleware({
+    type: 'jwt',
+    validator,
+    ...options,
+  })
+}
+
+export function apiKeyAuth(validator: (apiKey: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
+  return new AuthMiddleware({
+    type: 'api-key',
+    validator,
+    ...options,
+  })
+}
+
+export function oauth2Auth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
+  return new AuthMiddleware({
+    type: 'oauth2',
+    validator,
+    ...options,
+  })
+}

package/src/middleware/content_security_policy.ts

@@ -0,0 +1,215 @@
+import type { EnhancedRequest, NextFunction } from '../types'
+import { config } from '../config'
+
+export interface CSPDirectives {
+  'default-src'?: string[]
+  'script-src'?: string[]
+  'script-src-elem'?: string[]
+  'script-src-attr'?: string[]
+  'style-src'?: string[]
+  'style-src-elem'?: string[]
+  'style-src-attr'?: string[]
+  'img-src'?: string[]
+  'font-src'?: string[]
+  'connect-src'?: string[]
+  'media-src'?: string[]
+  'object-src'?: string[]
+  'child-src'?: string[]
+  'frame-src'?: string[]
+  'worker-src'?: string[]
+  'frame-ancestors'?: string[]
+  'form-action'?: string[]
+  'base-uri'?: string[]
+  'manifest-src'?: string[]
+  'prefetch-src'?: string[]
+  'navigate-to'?: string[]
+  'report-uri'?: string[]
+  'report-to'?: string[]
+  'require-trusted-types-for'?: string[]
+  'trusted-types'?: string[]
+  'upgrade-insecure-requests'?: boolean
+  'block-all-mixed-content'?: boolean
+  'plugin-types'?: string[]
+  'sandbox'?: string[]
+  'disown-opener'?: boolean
+}
+
+export interface CSPOptions {
+  directives?: CSPDirectives
+  reportOnly?: boolean
+  reportUri?: string
+  reportTo?: string
+  useNonces?: boolean
+  nonceLength?: number
+  upgradeInsecureRequests?: boolean
+  blockAllMixedContent?: boolean
+}
+
+export default class ContentSecurityPolicy {
+  private options: CSPOptions
+  private nonces: Map<string, string> = new Map()
+
+  constructor(options: CSPOptions = {}) {
+    const cspConfig = config.server?.security?.helmet?.contentSecurityPolicy
+    const defaultDirectives: CSPDirectives = {
+      'default-src': ['\'self\''],
+      'script-src': ['\'self\''],
+      'style-src': ['\'self\''],
+      'img-src': ['\'self\'', 'data:', 'https:'],
+      'font-src': ['\'self\''],
+      'connect-src': ['\'self\''],
+      'media-src': ['\'self\''],
+      'object-src': ['\'none\''],
+      'child-src': ['\'self\''],
+      'worker-src': ['\'self\''],
+      'frame-ancestors': ['\'none\''],
+      'form-action': ['\'self\''],
+      'base-uri': ['\'self\''],
+      'manifest-src': ['\'self\''],
+    }
+
+    this.options = {
+      directives: options.directives || (typeof cspConfig === 'object' && cspConfig.directives) || defaultDirectives,
+      reportOnly: options.reportOnly ?? (typeof cspConfig === 'object' && cspConfig.reportOnly) ?? false,
+      reportUri: options.reportUri,
+      reportTo: options.reportTo,
+      useNonces: options.useNonces ?? false,
+      nonceLength: options.nonceLength ?? 16,
+      upgradeInsecureRequests: options.upgradeInsecureRequests ?? true,
+      blockAllMixedContent: options.blockAllMixedContent ?? false,
+    }
+  }
+
+  private generateNonce(): string {
+    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+    let result = ''
+    for (let i = 0; i < (this.options.nonceLength || 16); i++) {
+      result += chars.charAt(Math.floor(Math.random() * chars.length))
+    }
+    return result
+  }
+
+  private buildCSPHeader(): string {
+    const directives: string[] = []
+    const dirs = this.options.directives || {}
+
+    // Handle regular directives
+    for (const [directive, values] of Object.entries(dirs)) {
+      if (directive === 'upgrade-insecure-requests' || directive === 'block-all-mixed-content' || directive === 'disown-opener') {
+        if (values === true) {
+          directives.push(directive.replace(/([A-Z])/g, '-$1').toLowerCase())
+        }
+        continue
+      }
+
+      if (Array.isArray(values) && values.length > 0) {
+        const directiveName = directive.replace(/([A-Z])/g, '-$1').toLowerCase()
+        directives.push(`${directiveName} ${values.join(' ')}`)
+      }
+    }
+
+    // Add upgrade-insecure-requests if enabled
+    if (this.options.upgradeInsecureRequests) {
+      directives.push('upgrade-insecure-requests')
+    }
+
+    // Add block-all-mixed-content if enabled
+    if (this.options.blockAllMixedContent) {
+      directives.push('block-all-mixed-content')
+    }
+
+    // Add report-uri if specified
+    if (this.options.reportUri) {
+      directives.push(`report-uri ${this.options.reportUri}`)
+    }
+
+    // Add report-to if specified
+    if (this.options.reportTo) {
+      directives.push(`report-to ${this.options.reportTo}`)
+    }
+
+    return directives.join('; ')
+  }
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    const helmetConfig = (config.server?.security?.helmet || {}) as any
+
+    // If CSP is disabled, continue to next middleware
+    if (helmetConfig.contentSecurityPolicy === false) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    // Generate nonce if needed
+    let nonce: string | undefined
+    if (this.options.useNonces) {
+      nonce = this.generateNonce()
+      this.nonces.set(req.url, nonce)
+
+      // Add nonce to script-src and style-src if they exist
+      if (this.options.directives?.['script-src']) {
+        this.options.directives['script-src'] = [
+          ...this.options.directives['script-src'],
+          `'nonce-${nonce}'`,
+        ]
+      }
+      if (this.options.directives?.['style-src']) {
+        this.options.directives['style-src'] = [
+          ...this.options.directives['style-src'],
+          `'nonce-${nonce}'`,
+        ]
+      }
+    }
+
+    // Add nonce to request context for use in templates
+    if (nonce) {
+      req.nonce = nonce
+    }
+
+    const response = await next()
+    if (!response) {
+      return new Response('Not Found', { status: 404 })
+    }
+
+    const headers = new Headers(response.headers)
+    const cspHeader = this.buildCSPHeader()
+
+    if (cspHeader) {
+      const headerName = this.options.reportOnly
+        ? 'Content-Security-Policy-Report-Only'
+        : 'Content-Security-Policy'
+      headers.set(headerName, cspHeader)
+    }
+
+    // Set up reporting endpoint if specified
+    if (this.options.reportTo) {
+      headers.set('Report-To', JSON.stringify({
+        group: this.options.reportTo,
+        max_age: 10886400,
+        endpoints: [{ url: this.options.reportUri || '/csp-report' }],
+      }))
+    }
+
+    // Clean up nonce after use
+    if (nonce) {
+      this.nonces.delete(req.url)
+    }
+
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    })
+  }
+
+  // Helper method to get nonce for templates
+  getNonce(url: string): string | undefined {
+    return this.nonces.get(url)
+  }
+}
+
+// Factory function for easy use
+export function contentSecurityPolicy(options: CSPOptions = {}): (req: EnhancedRequest, next: NextFunction) => Promise<Response> {
+  const instance = new ContentSecurityPolicy(options)
+  return async (req: EnhancedRequest, next: NextFunction) => instance.handle(req, next)
+}

package/src/middleware/cors.ts

@@ -0,0 +1,74 @@
+import type { EnhancedRequest, NextFunction } from '../types'
+import { config } from '../config'
+
+// Default CORS headers
+const DEFAULT_CORS_HEADERS: Record<string, string> = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, OPTIONS',
+  'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With, Accept, Origin',
+  'Access-Control-Max-Age': '86400',
+  'Access-Control-Allow-Credentials': 'true',
+}
+
+export default class Cors {
+  private getCorsHeaders(): Record<string, string> {
+    const corsConfig = (config.server as any)?.cors
+    if (corsConfig && corsConfig.enabled) {
+      return {
+        'Access-Control-Allow-Origin': corsConfig.origin || '*',
+        'Access-Control-Allow-Methods': Array.isArray(corsConfig.methods) ? corsConfig.methods.join(', ') : DEFAULT_CORS_HEADERS['Access-Control-Allow-Methods'],
+        'Access-Control-Allow-Headers': Array.isArray(corsConfig.allowedHeaders) ? corsConfig.allowedHeaders.join(', ') : DEFAULT_CORS_HEADERS['Access-Control-Allow-Headers'],
+        'Access-Control-Max-Age': String(corsConfig.maxAge || 86400),
+        'Access-Control-Allow-Credentials': String(corsConfig.credentials || false),
+      }
+    }
+    return { ...DEFAULT_CORS_HEADERS }
+  }
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    const corsHeaders = this.getCorsHeaders()
+
+    // Handle preflight OPTIONS request
+    if (req.method === 'OPTIONS') {
+      return new Response(null, { status: 204, headers: corsHeaders })
+    }
+
+    // Helper to add CORS headers to any response
+    const addCorsHeaders = (response: Response): Response => {
+      const newHeaders = new Headers(response.headers)
+      Object.entries(corsHeaders).forEach(([key, value]) => {
+        newHeaders.set(key, value)
+      })
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: newHeaders,
+      })
+    }
+
+    try {
+      // For non-OPTIONS requests, add CORS headers to the response
+      const response = await next()
+      if (!response) {
+        return new Response(JSON.stringify({ error: 'Not Found' }), {
+          status: 404,
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' },
+        })
+      }
+
+      // Add CORS headers to the response
+      return addCorsHeaders(response)
+    }
+    catch (error) {
+      // Error occurred - return error response WITH CORS headers
+      console.error('[CORS] Error in middleware chain:', error)
+      return new Response(JSON.stringify({
+        error: 'Internal Server Error',
+        message: error instanceof Error ? error.message : String(error),
+      }), {
+        status: 500,
+        headers: { ...corsHeaders, 'Content-Type': 'application/json' },
+      })
+    }
+  }
+}

package/src/middleware/csrf.ts

@@ -0,0 +1,108 @@
+import type { EnhancedRequest, NextFunction } from '../types'
+import { createHash, randomBytes } from 'node:crypto'
+import { config } from '../config'
+
+export default class Csrf {
+  private static tokens = new Map<string, string>()
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    const csrfConfig = config.server?.security?.csrf || {} as any
+
+    // Skip CSRF protection for safe methods
+    if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    // Skip for methods that don't modify state
+    const method = req.method.toUpperCase()
+    const ignoredMethods = ['GET', 'HEAD', 'OPTIONS', ...(csrfConfig?.ignoreMethods || [])]
+
+    if (ignoredMethods.includes(method)) {
+      // For safe methods, generate a new token for the response
+      const token = this.generateToken(csrfConfig?.secret || 'csrf-secret')
+
+      // Continue to next middleware
+      const response = await next()
+      if (!response) {
+        return new Response('Not Found', { status: 404 })
+      }
+
+      // Add CSRF token cookie to response
+      const cookieName = csrfConfig?.cookie?.name || 'csrf-token'
+      const cookieOptions = []
+
+      cookieOptions.push(`${cookieName}=${token}`)
+      cookieOptions.push('Path=/')
+
+      if (csrfConfig?.cookie?.options?.httpOnly) {
+        cookieOptions.push('HttpOnly')
+      }
+
+      if (csrfConfig?.cookie?.options?.secure) {
+        cookieOptions.push('Secure')
+      }
+
+      if (csrfConfig?.cookie?.options?.sameSite) {
+        cookieOptions.push(`SameSite=${csrfConfig.cookie.options.sameSite}`)
+      }
+
+      const newHeaders = new Headers(response.headers)
+      newHeaders.append('Set-Cookie', cookieOptions.join('; '))
+
+      // Store token for verification
+      Csrf.tokens.set(token, token)
+
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: newHeaders,
+      })
+    }
+
+    // For unsafe methods, verify the CSRF token
+    // Check for token in headers or in the request body
+    const token = req.headers.get('X-CSRF-TOKEN')
+      || req.jsonBody?.csrf_token
+      || req.jsonBody?._token
+      || null
+
+    // Get token from cookies for comparison
+    const cookies = this.parseCookies(req)
+    const cookieToken = cookies[csrfConfig?.cookie?.name || 'csrf-token']
+
+    // Verify the token
+    if (!token || !cookieToken || token !== cookieToken || !Csrf.tokens.has(token)) {
+      return new Response(
+        JSON.stringify({ error: 'CSRF token validation failed' }),
+        {
+          status: 403,
+          headers: { 'Content-Type': 'application/json' },
+        },
+      )
+    }
+
+    // Continue to next middleware if token is valid
+    const response = await next()
+    return response || new Response('Not Found', { status: 404 })
+  }
+
+  private generateToken(secret: string): string {
+    const randomString = randomBytes(16).toString('hex')
+    return createHash('sha256')
+      .update(`${randomString}${secret}`)
+      .digest('hex')
+  }
+
+  private parseCookies(req: Request): Record<string, string> {
+    const cookieHeader = req.headers.get('cookie')
+    if (!cookieHeader)
+      return {}
+
+    return cookieHeader.split(';').reduce((cookies, cookie) => {
+      const [name, value] = cookie.trim().split('=')
+      cookies[name] = value
+      return cookies
+    }, {} as Record<string, string>)
+  }
+}