@stacksjs/bun-router 0.0.14 → 0.0.15

package/src/middleware/file_upload.ts

@@ -0,0 +1,275 @@
+import type { EnhancedRequest, NextFunction } from '../types'
+import type { FileSecurityConfig } from './file_security'
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
+import { basename, extname, join } from 'node:path'
+import FileSecurity from './file_security'
+
+export interface UploadedFile {
+  fieldName: string
+  originalName: string
+  filename: string
+  path: string
+  size: number
+  mimetype: string
+  buffer: ArrayBuffer
+}
+
+export interface FileUploadConfig extends FileSecurityConfig {
+  destination?: string
+  maxFileSize?: number // in bytes
+  maxFiles?: number
+  allowedMimeTypes?: string[]
+  allowedExtensions?: string[]
+  preserveOriginalName?: boolean
+  generateUniqueFilename?: boolean
+  createDestination?: boolean
+}
+
+export interface FileUploadOptions extends FileUploadConfig {
+  fieldName?: string | string[]
+}
+
+export default class FileUpload {
+  private config: Required<FileUploadConfig>
+
+  private fileSecurity: FileSecurity
+
+  constructor(config: FileUploadConfig = {}) {
+    this.config = {
+      destination: config.destination || './uploads',
+      maxFileSize: config.maxFileSize || 10 * 1024 * 1024, // 10MB default
+      maxFiles: config.maxFiles || 10,
+      allowedMimeTypes: config.allowedMimeTypes || [],
+      allowedExtensions: config.allowedExtensions || [],
+      preserveOriginalName: config.preserveOriginalName ?? false,
+      generateUniqueFilename: config.generateUniqueFilename ?? true,
+      createDestination: config.createDestination ?? true,
+      scanForMalware: config.scanForMalware ?? false,
+      checkMagicNumbers: config.checkMagicNumbers ?? true,
+      sanitizeFilenames: config.sanitizeFilenames ?? true,
+      preventExecutableUploads: config.preventExecutableUploads ?? true,
+      maxFilenameLength: config.maxFilenameLength ?? 255,
+    }
+
+    this.fileSecurity = new FileSecurity(config)
+
+    // Create destination directory if it doesn't exist
+    if (this.config.createDestination && !existsSync(this.config.destination)) {
+      mkdirSync(this.config.destination, { recursive: true })
+    }
+  }
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    const contentType = req.headers.get('content-type')
+
+    if (!contentType || !contentType.includes('multipart/form-data')) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    try {
+      const formData = await req.formData()
+      const uploadedFiles: UploadedFile[] = []
+      const fields: Record<string, any> = {}
+
+      for (const [key, value] of (formData as any).entries()) {
+        if (value instanceof File) {
+          // Validate file count
+          if (uploadedFiles.length >= this.config.maxFiles) {
+            return this.createErrorResponse(`Maximum ${this.config.maxFiles} files allowed`, 400)
+          }
+
+          // Validate file size
+          if (value.size > this.config.maxFileSize) {
+            return this.createErrorResponse(
+              `File ${value.name} exceeds maximum size of ${this.formatBytes(this.config.maxFileSize)}`,
+              413,
+            )
+          }
+
+          // Validate MIME type
+          if (this.config.allowedMimeTypes.length > 0) {
+            const baseType = value.type.split(';')[0] // Remove charset info
+            if (!this.config.allowedMimeTypes.includes(baseType)) {
+              return this.createErrorResponse(
+                `File type ${baseType} not allowed. Allowed types: ${this.config.allowedMimeTypes.join(', ')}`,
+                415,
+              )
+            }
+          }
+
+          // Validate file extension
+          const fileExtension = extname(value.name).toLowerCase()
+          if (this.config.allowedExtensions.length > 0 && !this.config.allowedExtensions.includes(fileExtension)) {
+            return this.createErrorResponse(
+              `File extension ${fileExtension} not allowed. Allowed extensions: ${this.config.allowedExtensions.join(', ')}`,
+              415,
+            )
+          }
+
+          // Generate filename
+          const filename = this.generateFilename(value.name)
+          const filePath = join(this.config.destination, filename)
+
+          // Convert file to buffer and save
+          const buffer = await value.arrayBuffer()
+
+          const uploadedFile: UploadedFile = {
+            fieldName: key,
+            originalName: value.name,
+            filename,
+            path: filePath,
+            size: value.size,
+            mimetype: value.type,
+            buffer,
+          }
+
+          // Validate file security
+          const securityCheck = this.fileSecurity.validateFile(uploadedFile)
+          if (!securityCheck.isValid) {
+            return this.createErrorResponse(
+              `Security validation failed: ${securityCheck.errors.join(', ')}`,
+              400,
+            )
+          }
+
+          writeFileSync(filePath, new Uint8Array(buffer))
+          uploadedFiles.push(uploadedFile)
+        }
+        else {
+          // Handle regular form fields
+          if (fields[key]) {
+            // Convert to array if multiple values
+            if (Array.isArray(fields[key])) {
+              fields[key].push(value)
+            }
+            else {
+              fields[key] = [fields[key], value]
+            }
+          }
+          else {
+            fields[key] = value
+          }
+        }
+      }
+
+      // Attach files and fields to request
+      Object.defineProperty(req, 'files', {
+        value: uploadedFiles,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+      })
+
+      // Typed lookup by form field name. Mirrors Laravel's
+      // `$request->file('avatar')` ergonomics: returns the matching
+      // UploadedFile or null. See stacksjs/stacks#1856.
+      Object.defineProperty(req, 'file', {
+        value: (fieldName: string): UploadedFile | null =>
+          uploadedFiles.find(f => f.fieldName === fieldName) ?? null,
+        writable: true,
+        enumerable: false,
+        configurable: true,
+      })
+
+      Object.defineProperty(req, 'formBody', {
+        value: fields,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+      })
+
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+    catch (error) {
+      return this.createErrorResponse(
+        `File upload failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+        500,
+      )
+    }
+  }
+
+  private generateFilename(originalName: string): string {
+    // Always sanitize the filename first
+    const sanitizedName = this.fileSecurity.getSafeFilename(originalName)
+
+    if (this.config.preserveOriginalName && !this.config.generateUniqueFilename) {
+      return sanitizedName
+    }
+
+    const extension = extname(sanitizedName)
+    const baseName = basename(sanitizedName, extension)
+
+    if (this.config.generateUniqueFilename) {
+      const uuid = randomUUID()
+      return this.config.preserveOriginalName
+        ? `${baseName}_${uuid}${extension}`
+        : `${uuid}${extension}`
+    }
+
+    return sanitizedName
+  }
+
+  private formatBytes(bytes: number): string {
+    if (bytes === 0)
+      return '0 Bytes'
+    const k = 1024
+    const sizes = ['Bytes', 'KB', 'MB', 'GB']
+    const i = Math.floor(Math.log(bytes) / Math.log(k))
+    return `${Number.parseFloat((bytes / k ** i).toFixed(2))} ${sizes[i]}`
+  }
+
+  private createErrorResponse(message: string, status: number): Response {
+    return new Response(
+      JSON.stringify({ error: message }),
+      {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+      },
+    )
+  }
+}
+
+// Factory function for easier usage
+export function fileUpload(config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload(config)
+}
+
+// Specialized factory functions
+export function singleFileUpload(_fieldName: string, config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload({ ...config, maxFiles: 1 })
+}
+
+export function multipleFileUpload(maxFiles: number = 10, config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload({ ...config, maxFiles })
+}
+
+export function imageUpload(config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload({
+    ...config,
+    allowedMimeTypes: [
+      'image/jpeg',
+      'image/jpg',
+      'image/png',
+      'image/gif',
+      'image/webp',
+      'image/svg+xml',
+    ],
+    allowedExtensions: ['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg'],
+  })
+}
+
+export function documentUpload(config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload({
+    ...config,
+    allowedMimeTypes: [
+      'application/pdf',
+      'application/msword',
+      'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      'text/plain',
+    ],
+    allowedExtensions: ['.pdf', '.doc', '.docx', '.txt'],
+  })
+}

package/src/middleware/helmet.ts

@@ -0,0 +1,268 @@
+import type { EnhancedRequest, NextFunction } from '../types'
+import { config } from '../config'
+
+export interface HelmetOptions {
+  contentSecurityPolicy?: boolean | {
+    directives?: Record<string, string[]>
+    reportOnly?: boolean
+    reportUri?: string
+    upgradeInsecureRequests?: boolean
+    blockAllMixedContent?: boolean
+  }
+  crossOriginEmbedderPolicy?: boolean | {
+    policy?: 'require-corp' | 'credentialless'
+  }
+  crossOriginOpenerPolicy?: boolean | {
+    policy?: 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none'
+  }
+  crossOriginResourcePolicy?: boolean | {
+    policy?: 'same-site' | 'same-origin' | 'cross-origin'
+  }
+  dnsPrefetchControl?: boolean | {
+    allow?: boolean
+  }
+  expectCt?: boolean | {
+    enforce?: boolean
+    maxAge?: number
+    reportUri?: string
+  }
+  frameguard?: boolean | {
+    action?: 'deny' | 'sameorigin'
+    domain?: string
+  }
+  hidePoweredBy?: boolean
+  hsts?: boolean | {
+    maxAge?: number
+    includeSubDomains?: boolean
+    preload?: boolean
+  }
+  ieNoOpen?: boolean
+  noSniff?: boolean
+  originAgentCluster?: boolean
+  permittedCrossDomainPolicies?: boolean | {
+    permittedPolicies?: 'none' | 'master-only' | 'by-content-type' | 'all'
+  }
+  referrerPolicy?: boolean | {
+    policy?: string | string[]
+  }
+  xssFilter?: boolean | {
+    setOnOldIE?: boolean
+  }
+}
+
+export default class Helmet {
+  private options: HelmetOptions
+
+  constructor(options: HelmetOptions = {}) {
+    const helmetConfig = (config.server?.security?.helmet || {}) as any
+
+    this.options = {
+      contentSecurityPolicy: options.contentSecurityPolicy ?? helmetConfig.contentSecurityPolicy ?? {
+        directives: {
+          'default-src': ['\'self\''],
+          'script-src': ['\'self\'', '\'unsafe-inline\''],
+          'style-src': ['\'self\'', '\'unsafe-inline\''],
+          'img-src': ['\'self\'', 'data:', 'https:'],
+          'font-src': ['\'self\''],
+          'connect-src': ['\'self\''],
+          'media-src': ['\'self\''],
+          'object-src': ['\'none\''],
+          'child-src': ['\'self\''],
+          'worker-src': ['\'self\''],
+          'frame-ancestors': ['\'none\''],
+          'form-action': ['\'self\''],
+          'base-uri': ['\'self\''],
+          'manifest-src': ['\'self\''],
+        },
+      },
+      crossOriginEmbedderPolicy: options.crossOriginEmbedderPolicy ?? true,
+      crossOriginOpenerPolicy: options.crossOriginOpenerPolicy ?? true,
+      crossOriginResourcePolicy: options.crossOriginResourcePolicy ?? true,
+      dnsPrefetchControl: options.dnsPrefetchControl ?? true,
+      expectCt: options.expectCt ?? helmetConfig.expectCt ?? false,
+      frameguard: options.frameguard ?? {
+        action: helmetConfig.frameOptions?.toLowerCase() as 'deny' | 'sameorigin' || 'deny',
+      },
+      hidePoweredBy: options.hidePoweredBy ?? helmetConfig.hidePoweredBy ?? true,
+      hsts: options.hsts ?? helmetConfig.hsts ?? {
+        maxAge: 31536000, // 1 year
+        includeSubDomains: true,
+        preload: true,
+      },
+      ieNoOpen: options.ieNoOpen ?? true,
+      noSniff: options.noSniff ?? helmetConfig.noSniff ?? true,
+      originAgentCluster: options.originAgentCluster ?? true,
+      permittedCrossDomainPolicies: options.permittedCrossDomainPolicies ?? {
+        permittedPolicies: 'none',
+      },
+      referrerPolicy: options.referrerPolicy ?? helmetConfig.referrerPolicy ?? {
+        policy: 'strict-origin-when-cross-origin',
+      },
+      xssFilter: options.xssFilter ?? helmetConfig.xssFilter ?? true,
+    }
+  }
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    const helmetConfig = (config.server?.security?.helmet || {}) as any
+
+    // If helmet is disabled, continue to next middleware
+    if (helmetConfig.enabled === false) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    const response = await next()
+    if (!response) {
+      return new Response('Not Found', { status: 404 })
+    }
+
+    const headers = new Headers(response.headers)
+
+    // Content Security Policy
+    if (this.options.contentSecurityPolicy) {
+      const csp = this.options.contentSecurityPolicy
+      if (typeof csp === 'object' && csp.directives) {
+        const directives = Object.entries(csp.directives)
+          .map(([key, values]) => `${key} ${values.join(' ')}`)
+          .join('; ')
+
+        const headerName = csp.reportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy'
+        headers.set(headerName, directives)
+
+        if (csp.reportUri) {
+          headers.set('Report-To', JSON.stringify({
+            group: 'csp-endpoint',
+            max_age: 10886400,
+            endpoints: [{ url: csp.reportUri }],
+          }))
+        }
+      }
+    }
+
+    // Cross-Origin Embedder Policy
+    if (this.options.crossOriginEmbedderPolicy) {
+      const coep = this.options.crossOriginEmbedderPolicy
+      const policy = typeof coep === 'object' ? coep.policy || 'require-corp' : 'require-corp'
+      headers.set('Cross-Origin-Embedder-Policy', policy)
+    }
+
+    // Cross-Origin Opener Policy
+    if (this.options.crossOriginOpenerPolicy) {
+      const coop = this.options.crossOriginOpenerPolicy
+      const policy = typeof coop === 'object' ? coop.policy || 'same-origin' : 'same-origin'
+      headers.set('Cross-Origin-Opener-Policy', policy)
+    }
+
+    // Cross-Origin Resource Policy
+    if (this.options.crossOriginResourcePolicy) {
+      const corp = this.options.crossOriginResourcePolicy
+      const policy = typeof corp === 'object' ? corp.policy || 'same-origin' : 'same-origin'
+      headers.set('Cross-Origin-Resource-Policy', policy)
+    }
+
+    // DNS Prefetch Control
+    if (this.options.dnsPrefetchControl) {
+      const dnsPrefetch = this.options.dnsPrefetchControl
+      const allow = typeof dnsPrefetch === 'object' ? dnsPrefetch.allow : false
+      headers.set('X-DNS-Prefetch-Control', allow ? 'on' : 'off')
+    }
+
+    // Expect-CT
+    if (this.options.expectCt) {
+      const expectCt = this.options.expectCt
+      if (typeof expectCt === 'object') {
+        const parts = []
+        if (expectCt.enforce)
+          parts.push('enforce')
+        if (expectCt.maxAge)
+          parts.push(`max-age=${expectCt.maxAge}`)
+        if (expectCt.reportUri)
+          parts.push(`report-uri="${expectCt.reportUri}"`)
+        headers.set('Expect-CT', parts.join(', '))
+      }
+    }
+
+    // X-Frame-Options
+    if (this.options.frameguard) {
+      const frameguard = this.options.frameguard
+      if (typeof frameguard === 'object') {
+        const action = frameguard.action || 'deny'
+        const value = action === 'sameorigin' && frameguard.domain
+          ? `ALLOW-FROM ${frameguard.domain}`
+          : action.toUpperCase()
+        headers.set('X-Frame-Options', value)
+      }
+    }
+
+    // Hide X-Powered-By
+    if (this.options.hidePoweredBy) {
+      headers.delete('X-Powered-By')
+    }
+
+    // HTTP Strict Transport Security
+    if (this.options.hsts) {
+      const hsts = this.options.hsts
+      if (typeof hsts === 'object') {
+        const parts = [`max-age=${hsts.maxAge || 31536000}`]
+        if (hsts.includeSubDomains)
+          parts.push('includeSubDomains')
+        if (hsts.preload)
+          parts.push('preload')
+        headers.set('Strict-Transport-Security', parts.join('; '))
+      }
+    }
+
+    // X-Download-Options
+    if (this.options.ieNoOpen) {
+      headers.set('X-Download-Options', 'noopen')
+    }
+
+    // X-Content-Type-Options
+    if (this.options.noSniff) {
+      headers.set('X-Content-Type-Options', 'nosniff')
+    }
+
+    // Origin-Agent-Cluster
+    if (this.options.originAgentCluster) {
+      headers.set('Origin-Agent-Cluster', '?1')
+    }
+
+    // X-Permitted-Cross-Domain-Policies
+    if (this.options.permittedCrossDomainPolicies) {
+      const crossDomain = this.options.permittedCrossDomainPolicies
+      const policy = typeof crossDomain === 'object'
+        ? crossDomain.permittedPolicies || 'none'
+        : 'none'
+      headers.set('X-Permitted-Cross-Domain-Policies', policy)
+    }
+
+    // Referrer-Policy
+    if (this.options.referrerPolicy) {
+      const referrer = this.options.referrerPolicy
+      if (typeof referrer === 'object') {
+        const policy = Array.isArray(referrer.policy)
+          ? referrer.policy.join(', ')
+          : referrer.policy || 'strict-origin-when-cross-origin'
+        headers.set('Referrer-Policy', policy)
+      }
+      else {
+        headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
+      }
+    }
+
+    // X-XSS-Protection
+    if (this.options.xssFilter) {
+      const xss = this.options.xssFilter
+      const value = typeof xss === 'object' && xss.setOnOldIE
+        ? '1; mode=block'
+        : '0'
+      headers.set('X-XSS-Protection', value)
+    }
+
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    })
+  }
+}

package/src/middleware/index.ts

@@ -0,0 +1,117 @@
+import Auth, {
+  apiKeyAuth,
+  basicAuth,
+  bearerAuth,
+  extractApiKey,
+  extractBasicAuth,
+  extractBearerToken,
+  jwtAuth,
+  oauth2Auth,
+} from './auth'
+import Cors from './cors'
+import Csrf from './csrf'
+import JsonBody from './json_body'
+import { rateLimit as createRateLimit } from './rate_limit'
+import RequestId from './request_id'
+import RequestSigning from './request_signing'
+import Session from './session'
+
+// Export middleware classes
+export { default as Auth } from './auth'
+export { default as ContentSecurityPolicy } from './content_security_policy'
+export { contentSecurityPolicy } from './content_security_policy'
+export { default as Cors } from './cors'
+export { default as Csrf } from './csrf'
+export { default as DDoSProtection } from './ddos_protection'
+export { ddosProtection } from './ddos_protection'
+export { default as FileSecurity } from './file_security'
+export { default as FileUpload } from './file_upload'
+export { documentUpload, fileUpload, imageUpload, multipleFileUpload, singleFileUpload } from './file_upload'
+export { default as Helmet } from './helmet'
+export { default as InputValidation } from './input_validation'
+export { inputValidation } from './input_validation'
+export { default as JsonBody } from './json_body'
+export { default as PerformanceAlerting, performanceAlerting } from './performance_alerting'
+export { default as PerformanceDashboard, performanceDashboard } from './performance_dashboard'
+export { default as PerformanceMonitor, performanceMonitor } from './performance_monitor'
+export { default as RateLimit } from './rate_limit'
+// Export factory functions for easier usage
+export { rateLimit } from './rate_limit'
+export { default as RequestId } from './request_id'
+export { InMemoryNonceStore, default as RequestSigning, requestSigning, signRequest, verifySignature } from './request_signing'
+export type { NonceStore, RequestSigningOptions, SignatureAlgorithm, SignedPart } from './request_signing'
+export { SignatureError } from './request_signing'
+export { default as RequestTracer, requestTracer } from './request_tracer'
+export { default as Security } from './security'
+export { security } from './security'
+export { default as SecuritySuite } from './security_suite'
+export { securitySuite } from './security_suite'
+
+export { default as Session } from './session'
+
+// Authentication helper exports
+export {
+  apiKeyAuth,
+  basicAuth,
+  bearerAuth,
+  extractApiKey,
+  extractBasicAuth,
+  extractBearerToken,
+  jwtAuth,
+  oauth2Auth,
+}
+
+// Factory functions for easier middleware creation
+export const cors = (): Cors => new Cors()
+export const jsonBody = (): JsonBody => new JsonBody()
+export const requestId = (): RequestId => new RequestId()
+export const session = (): Session => new Session()
+export const csrf = (): Csrf => new Csrf()
+export function auth(): Auth {
+  return new Auth({
+    type: 'bearer',
+    validator: () => true, // Default just passes through - must be configured correctly
+  })
+}
+
+// Named middleware mapping for string-based middleware references (lazy-loaded)
+let _middleware: Record<string, any> | null = null
+
+function getMiddleware(): Record<string, any> {
+  if (!_middleware) {
+    _middleware = {
+      'Middleware/Cors': new Cors(),
+      'Middleware/JsonBody': new JsonBody(),
+      'Middleware/RequestId': new RequestId(),
+      'Middleware/Session': new Session(),
+      'Middleware/Csrf': new Csrf(),
+      'Middleware/Auth': new Auth({
+        type: 'bearer',
+        validator: () => true,
+      }),
+      'Middleware/RateLimit': createRateLimit(),
+      'Middleware/RequestSigning': new RequestSigning({
+        secret: '',
+      }),
+    }
+  }
+  return _middleware
+}
+
+export const middleware: Record<string, any> = new Proxy({} as Record<string, any>, {
+  get(_target, prop) {
+    return getMiddleware()[prop as string]
+  },
+  ownKeys() {
+    return Object.keys(getMiddleware())
+  },
+  getOwnPropertyDescriptor(_target, prop) {
+    const value = getMiddleware()[prop as string]
+    if (value !== undefined) {
+      return { configurable: true, enumerable: true, value }
+    }
+    return undefined
+  },
+})
+
+export default middleware