@stacksjs/bun-router 0.0.16 → 0.0.18

package/src/middleware/auth.ts

@@ -1,220 +0,0 @@
-import type { EnhancedRequest, Middleware, NextFunction } from '../types'
-
-export interface AuthOptions {
-  /**
-   * Authentication type to use
-   */
-  type: 'basic' | 'bearer' | 'api-key' | 'oauth2' | 'jwt' | 'custom'
-
-  /**
-   * Function to validate credentials
-   */
-  validator: (credentials: any, req: EnhancedRequest) => Promise<boolean> | boolean
-
-  /**
-   * Extract user information after successful authentication
-   */
-  userExtractor?: (credentials: any, req: EnhancedRequest) => Promise<any> | any
-
-  /**
-   * Where to look for auth information
-   */
-  source?: 'header' | 'query' | 'cookie'
-
-  /**
-   * Key name for the source (header name, query param, cookie name)
-   */
-  key?: string
-
-  /**
-   * Realm for Basic authentication
-   */
-  realm?: string
-
-  /**
-   * Custom credentials extractor
-   */
-  credentialsExtractor?: (req: EnhancedRequest) => Promise<any> | any
-
-  /**
-   * Whether to attach user info to request
-   */
-  attachUser?: boolean
-}
-
-/**
- * Extracts and decodes Basic Auth credentials from Authorization header
- */
-export function extractBasicAuth(authHeader: string): { username: string, password: string } | null {
-  if (!authHeader || !authHeader.startsWith('Basic ')) {
-    return null
-  }
-
-  try {
-    const base64Credentials = authHeader.split(' ')[1]
-    const credentials = atob(base64Credentials)
-    const [username, password] = credentials.split(':')
-
-    return { username, password }
-  }
-  catch (error) {
-    void error
-
-    return null
-  }
-}
-
-/**
- * Extracts Bearer token from Authorization header
- */
-export function extractBearerToken(authHeader: string): string | null {
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    return null
-  }
-
-  return authHeader.split(' ')[1]
-}
-
-/**
- * Extracts API key from various sources
- */
-export function extractApiKey(req: EnhancedRequest, source: 'header' | 'query' | 'cookie' = 'header', key: string = 'X-API-Key'): string | null {
-  switch (source) {
-    case 'header':
-      return req.headers.get(key) || null
-    case 'query':
-      return new URL(req.url).searchParams.get(key)
-    case 'cookie':
-      // Handle both Map-like cookies (with .get()) and plain object cookies
-      if (req.cookies) {
-        if (typeof req.cookies.get === 'function') {
-          return req.cookies.get(key) || null
-        }
-        return (req.cookies as unknown as Record<string, string>)[key] || null
-      }
-      return null
-    default:
-      return null
-  }
-}
-
-export default class AuthMiddleware implements Middleware {
-  private options: AuthOptions
-
-  constructor(options: AuthOptions) {
-    this.options = {
-      source: 'header',
-      key: 'Authorization',
-      attachUser: true,
-      ...options,
-    }
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    let credentials: any = null
-
-    // Extract credentials based on auth type
-    if (this.options.credentialsExtractor) {
-      credentials = await this.options.credentialsExtractor(req)
-    }
-    else {
-      switch (this.options.type) {
-        case 'basic': {
-          const authHeader = req.headers.get(this.options.key || 'Authorization')
-          credentials = extractBasicAuth(authHeader || '')
-          break
-        }
-        case 'bearer':
-        case 'jwt': {
-          const authHeader = req.headers.get(this.options.key || 'Authorization')
-          credentials = extractBearerToken(authHeader || '')
-          break
-        }
-        case 'api-key': {
-          credentials = extractApiKey(req, this.options.source, this.options.key)
-          break
-        }
-        case 'oauth2': {
-          // OAuth tokens are typically sent as Bearer tokens
-          const authHeader = req.headers.get(this.options.key || 'Authorization')
-          credentials = extractBearerToken(authHeader || '')
-          break
-        }
-      }
-    }
-
-    // If no credentials were found, return 401
-    if (!credentials) {
-      const headers: Record<string, string> = {}
-
-      // For Basic auth, include WWW-Authenticate header
-      if (this.options.type === 'basic') {
-        const realm = this.options.realm || 'Secure Area'
-        headers['WWW-Authenticate'] = `Basic realm="${realm}"`
-      }
-
-      return new Response('Unauthorized', {
-        status: 401,
-        headers,
-      })
-    }
-
-    // Validate credentials
-    const isValid = await this.options.validator(credentials, req)
-
-    if (!isValid) {
-      return new Response('Unauthorized', { status: 401 })
-    }
-
-    // If user extractor provided and attachUser is true, attach user to request
-    if (this.options.userExtractor && this.options.attachUser) {
-      const user = await this.options.userExtractor(credentials, req)
-      ;(req as any).user = user
-    }
-
-    // Authentication successful, continue to next middleware or route handler
-    const response = await next()
-    return response || new Response('Not Found', { status: 404 })
-  }
-}
-
-// Convenience factory functions for common auth types
-export function basicAuth(validator: (credentials: { username: string, password: string }, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'basic',
-    validator,
-    ...options,
-  })
-}
-
-export function bearerAuth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'bearer',
-    validator,
-    ...options,
-  })
-}
-
-export function jwtAuth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'jwt',
-    validator,
-    ...options,
-  })
-}
-
-export function apiKeyAuth(validator: (apiKey: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'api-key',
-    validator,
-    ...options,
-  })
-}
-
-export function oauth2Auth(validator: (token: string, req: EnhancedRequest) => Promise<boolean> | boolean, options: Partial<AuthOptions> = {}): AuthMiddleware {
-  return new AuthMiddleware({
-    type: 'oauth2',
-    validator,
-    ...options,
-  })
-}

package/src/middleware/content_security_policy.ts

@@ -1,215 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-export interface CSPDirectives {
-  'default-src'?: string[]
-  'script-src'?: string[]
-  'script-src-elem'?: string[]
-  'script-src-attr'?: string[]
-  'style-src'?: string[]
-  'style-src-elem'?: string[]
-  'style-src-attr'?: string[]
-  'img-src'?: string[]
-  'font-src'?: string[]
-  'connect-src'?: string[]
-  'media-src'?: string[]
-  'object-src'?: string[]
-  'child-src'?: string[]
-  'frame-src'?: string[]
-  'worker-src'?: string[]
-  'frame-ancestors'?: string[]
-  'form-action'?: string[]
-  'base-uri'?: string[]
-  'manifest-src'?: string[]
-  'prefetch-src'?: string[]
-  'navigate-to'?: string[]
-  'report-uri'?: string[]
-  'report-to'?: string[]
-  'require-trusted-types-for'?: string[]
-  'trusted-types'?: string[]
-  'upgrade-insecure-requests'?: boolean
-  'block-all-mixed-content'?: boolean
-  'plugin-types'?: string[]
-  'sandbox'?: string[]
-  'disown-opener'?: boolean
-}
-
-export interface CSPOptions {
-  directives?: CSPDirectives
-  reportOnly?: boolean
-  reportUri?: string
-  reportTo?: string
-  useNonces?: boolean
-  nonceLength?: number
-  upgradeInsecureRequests?: boolean
-  blockAllMixedContent?: boolean
-}
-
-export default class ContentSecurityPolicy {
-  private options: CSPOptions
-  private nonces: Map<string, string> = new Map()
-
-  constructor(options: CSPOptions = {}) {
-    const cspConfig = config.server?.security?.helmet?.contentSecurityPolicy
-    const defaultDirectives: CSPDirectives = {
-      'default-src': ['\'self\''],
-      'script-src': ['\'self\''],
-      'style-src': ['\'self\''],
-      'img-src': ['\'self\'', 'data:', 'https:'],
-      'font-src': ['\'self\''],
-      'connect-src': ['\'self\''],
-      'media-src': ['\'self\''],
-      'object-src': ['\'none\''],
-      'child-src': ['\'self\''],
-      'worker-src': ['\'self\''],
-      'frame-ancestors': ['\'none\''],
-      'form-action': ['\'self\''],
-      'base-uri': ['\'self\''],
-      'manifest-src': ['\'self\''],
-    }
-
-    this.options = {
-      directives: options.directives || (typeof cspConfig === 'object' && cspConfig.directives) || defaultDirectives,
-      reportOnly: options.reportOnly ?? (typeof cspConfig === 'object' && cspConfig.reportOnly) ?? false,
-      reportUri: options.reportUri,
-      reportTo: options.reportTo,
-      useNonces: options.useNonces ?? false,
-      nonceLength: options.nonceLength ?? 16,
-      upgradeInsecureRequests: options.upgradeInsecureRequests ?? true,
-      blockAllMixedContent: options.blockAllMixedContent ?? false,
-    }
-  }
-
-  private generateNonce(): string {
-    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
-    let result = ''
-    for (let i = 0; i < (this.options.nonceLength || 16); i++) {
-      result += chars.charAt(Math.floor(Math.random() * chars.length))
-    }
-    return result
-  }
-
-  private buildCSPHeader(): string {
-    const directives: string[] = []
-    const dirs = this.options.directives || {}
-
-    // Handle regular directives
-    for (const [directive, values] of Object.entries(dirs)) {
-      if (directive === 'upgrade-insecure-requests' || directive === 'block-all-mixed-content' || directive === 'disown-opener') {
-        if (values === true) {
-          directives.push(directive.replace(/([A-Z])/g, '-$1').toLowerCase())
-        }
-        continue
-      }
-
-      if (Array.isArray(values) && values.length > 0) {
-        const directiveName = directive.replace(/([A-Z])/g, '-$1').toLowerCase()
-        directives.push(`${directiveName} ${values.join(' ')}`)
-      }
-    }
-
-    // Add upgrade-insecure-requests if enabled
-    if (this.options.upgradeInsecureRequests) {
-      directives.push('upgrade-insecure-requests')
-    }
-
-    // Add block-all-mixed-content if enabled
-    if (this.options.blockAllMixedContent) {
-      directives.push('block-all-mixed-content')
-    }
-
-    // Add report-uri if specified
-    if (this.options.reportUri) {
-      directives.push(`report-uri ${this.options.reportUri}`)
-    }
-
-    // Add report-to if specified
-    if (this.options.reportTo) {
-      directives.push(`report-to ${this.options.reportTo}`)
-    }
-
-    return directives.join('; ')
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const helmetConfig = (config.server?.security?.helmet || {}) as any
-
-    // If CSP is disabled, continue to next middleware
-    if (helmetConfig.contentSecurityPolicy === false) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    // Generate nonce if needed
-    let nonce: string | undefined
-    if (this.options.useNonces) {
-      nonce = this.generateNonce()
-      this.nonces.set(req.url, nonce)
-
-      // Add nonce to script-src and style-src if they exist
-      if (this.options.directives?.['script-src']) {
-        this.options.directives['script-src'] = [
-          ...this.options.directives['script-src'],
-          `'nonce-${nonce}'`,
-        ]
-      }
-      if (this.options.directives?.['style-src']) {
-        this.options.directives['style-src'] = [
-          ...this.options.directives['style-src'],
-          `'nonce-${nonce}'`,
-        ]
-      }
-    }
-
-    // Add nonce to request context for use in templates
-    if (nonce) {
-      req.nonce = nonce
-    }
-
-    const response = await next()
-    if (!response) {
-      return new Response('Not Found', { status: 404 })
-    }
-
-    const headers = new Headers(response.headers)
-    const cspHeader = this.buildCSPHeader()
-
-    if (cspHeader) {
-      const headerName = this.options.reportOnly
-        ? 'Content-Security-Policy-Report-Only'
-        : 'Content-Security-Policy'
-      headers.set(headerName, cspHeader)
-    }
-
-    // Set up reporting endpoint if specified
-    if (this.options.reportTo) {
-      headers.set('Report-To', JSON.stringify({
-        group: this.options.reportTo,
-        max_age: 10886400,
-        endpoints: [{ url: this.options.reportUri || '/csp-report' }],
-      }))
-    }
-
-    // Clean up nonce after use
-    if (nonce) {
-      this.nonces.delete(req.url)
-    }
-
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    })
-  }
-
-  // Helper method to get nonce for templates
-  getNonce(url: string): string | undefined {
-    return this.nonces.get(url)
-  }
-}
-
-// Factory function for easy use
-export function contentSecurityPolicy(options: CSPOptions = {}): (req: EnhancedRequest, next: NextFunction) => Promise<Response> {
-  const instance = new ContentSecurityPolicy(options)
-  return async (req: EnhancedRequest, next: NextFunction) => instance.handle(req, next)
-}

package/src/middleware/cors.ts

@@ -1,74 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-// Default CORS headers
-const DEFAULT_CORS_HEADERS: Record<string, string> = {
-  'Access-Control-Allow-Origin': '*',
-  'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, OPTIONS',
-  'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With, Accept, Origin',
-  'Access-Control-Max-Age': '86400',
-  'Access-Control-Allow-Credentials': 'true',
-}
-
-export default class Cors {
-  private getCorsHeaders(): Record<string, string> {
-    const corsConfig = (config.server as any)?.cors
-    if (corsConfig && corsConfig.enabled) {
-      return {
-        'Access-Control-Allow-Origin': corsConfig.origin || '*',
-        'Access-Control-Allow-Methods': Array.isArray(corsConfig.methods) ? corsConfig.methods.join(', ') : DEFAULT_CORS_HEADERS['Access-Control-Allow-Methods'],
-        'Access-Control-Allow-Headers': Array.isArray(corsConfig.allowedHeaders) ? corsConfig.allowedHeaders.join(', ') : DEFAULT_CORS_HEADERS['Access-Control-Allow-Headers'],
-        'Access-Control-Max-Age': String(corsConfig.maxAge || 86400),
-        'Access-Control-Allow-Credentials': String(corsConfig.credentials || false),
-      }
-    }
-    return { ...DEFAULT_CORS_HEADERS }
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const corsHeaders = this.getCorsHeaders()
-
-    // Handle preflight OPTIONS request
-    if (req.method === 'OPTIONS') {
-      return new Response(null, { status: 204, headers: corsHeaders })
-    }
-
-    // Helper to add CORS headers to any response
-    const addCorsHeaders = (response: Response): Response => {
-      const newHeaders = new Headers(response.headers)
-      Object.entries(corsHeaders).forEach(([key, value]) => {
-        newHeaders.set(key, value)
-      })
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: newHeaders,
-      })
-    }
-
-    try {
-      // For non-OPTIONS requests, add CORS headers to the response
-      const response = await next()
-      if (!response) {
-        return new Response(JSON.stringify({ error: 'Not Found' }), {
-          status: 404,
-          headers: { ...corsHeaders, 'Content-Type': 'application/json' },
-        })
-      }
-
-      // Add CORS headers to the response
-      return addCorsHeaders(response)
-    }
-    catch (error) {
-      // Error occurred - return error response WITH CORS headers
-      console.error('[CORS] Error in middleware chain:', error)
-      return new Response(JSON.stringify({
-        error: 'Internal Server Error',
-        message: error instanceof Error ? error.message : String(error),
-      }), {
-        status: 500,
-        headers: { ...corsHeaders, 'Content-Type': 'application/json' },
-      })
-    }
-  }
-}

package/src/middleware/csrf.ts

@@ -1,118 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { createHash, randomBytes } from 'node:crypto'
-import { config } from '../config'
-
-export default class Csrf {
-  private static tokens = new Map<string, string>()
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const csrfConfig = config.server?.security?.csrf || {} as any
-
-    // Skip CSRF protection for safe methods
-    if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    // Skip for methods that don't modify state
-    const method = req.method.toUpperCase()
-    const ignoredMethods = ['GET', 'HEAD', 'OPTIONS', ...(csrfConfig?.ignoreMethods || [])]
-
-    if (ignoredMethods.includes(method)) {
-      // For safe methods, generate a new token for the response
-      const token = this.generateToken(csrfConfig?.secret || 'csrf-secret')
-
-      // Continue to next middleware
-      const response = await next()
-      if (!response) {
-        return new Response('Not Found', { status: 404 })
-      }
-
-      // Add CSRF token cookie to response
-      const cookieName = csrfConfig?.cookie?.name || 'csrf-token'
-      const cookieOptions = []
-
-      cookieOptions.push(`${cookieName}=${token}`)
-      cookieOptions.push('Path=/')
-
-      if (csrfConfig?.cookie?.options?.httpOnly) {
-        cookieOptions.push('HttpOnly')
-      }
-
-      if (csrfConfig?.cookie?.options?.secure) {
-        cookieOptions.push('Secure')
-      }
-
-      if (csrfConfig?.cookie?.options?.sameSite) {
-        cookieOptions.push(`SameSite=${csrfConfig.cookie.options.sameSite}`)
-      }
-
-      const newHeaders = new Headers(response.headers)
-      newHeaders.append('Set-Cookie', cookieOptions.join('; '))
-
-      // Store token for verification
-      Csrf.tokens.set(token, token)
-
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: newHeaders,
-      })
-    }
-
-    // Bearer-authed requests can't be CSRF'd — the token doesn't
-    // ride on cookies, so a hostile origin can't trick a browser into
-    // sending it. Mirrors Laravel Sanctum / Django REST framework /
-    // express-csurf semantics. Filed against stacksjs/stacks#1922.
-    const authHeader = req.headers.get('authorization') ?? req.headers.get('Authorization')
-    if (authHeader && /^Bearer\s+\S/i.test(authHeader)) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    // For unsafe methods, verify the CSRF token
-    // Check for token in headers or in the request body
-    const token = req.headers.get('X-CSRF-TOKEN')
-      || req.jsonBody?.csrf_token
-      || req.jsonBody?._token
-      || null
-
-    // Get token from cookies for comparison
-    const cookies = this.parseCookies(req)
-    const cookieToken = cookies[csrfConfig?.cookie?.name || 'csrf-token']
-
-    // Verify the token
-    if (!token || !cookieToken || token !== cookieToken || !Csrf.tokens.has(token)) {
-      return new Response(
-        JSON.stringify({ error: 'CSRF token validation failed' }),
-        {
-          status: 403,
-          headers: { 'Content-Type': 'application/json' },
-        },
-      )
-    }
-
-    // Continue to next middleware if token is valid
-    const response = await next()
-    return response || new Response('Not Found', { status: 404 })
-  }
-
-  private generateToken(secret: string): string {
-    const randomString = randomBytes(16).toString('hex')
-    return createHash('sha256')
-      .update(`${randomString}${secret}`)
-      .digest('hex')
-  }
-
-  private parseCookies(req: Request): Record<string, string> {
-    const cookieHeader = req.headers.get('cookie')
-    if (!cookieHeader)
-      return {}
-
-    return cookieHeader.split(';').reduce((cookies, cookie) => {
-      const [name, value] = cookie.trim().split('=')
-      cookies[name] = value
-      return cookies
-    }, {} as Record<string, string>)
-  }
-}