@stacksjs/bun-router 0.0.16 → 0.0.18

package/src/middleware/file_upload.ts

@@ -1,275 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import type { FileSecurityConfig } from './file_security'
-import { randomUUID } from 'node:crypto'
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
-import { basename, extname, join } from 'node:path'
-import FileSecurity from './file_security'
-
-export interface UploadedFile {
-  fieldName: string
-  originalName: string
-  filename: string
-  path: string
-  size: number
-  mimetype: string
-  buffer: ArrayBuffer
-}
-
-export interface FileUploadConfig extends FileSecurityConfig {
-  destination?: string
-  maxFileSize?: number // in bytes
-  maxFiles?: number
-  allowedMimeTypes?: string[]
-  allowedExtensions?: string[]
-  preserveOriginalName?: boolean
-  generateUniqueFilename?: boolean
-  createDestination?: boolean
-}
-
-export interface FileUploadOptions extends FileUploadConfig {
-  fieldName?: string | string[]
-}
-
-export default class FileUpload {
-  private config: Required<FileUploadConfig>
-
-  private fileSecurity: FileSecurity
-
-  constructor(config: FileUploadConfig = {}) {
-    this.config = {
-      destination: config.destination || './uploads',
-      maxFileSize: config.maxFileSize || 10 * 1024 * 1024, // 10MB default
-      maxFiles: config.maxFiles || 10,
-      allowedMimeTypes: config.allowedMimeTypes || [],
-      allowedExtensions: config.allowedExtensions || [],
-      preserveOriginalName: config.preserveOriginalName ?? false,
-      generateUniqueFilename: config.generateUniqueFilename ?? true,
-      createDestination: config.createDestination ?? true,
-      scanForMalware: config.scanForMalware ?? false,
-      checkMagicNumbers: config.checkMagicNumbers ?? true,
-      sanitizeFilenames: config.sanitizeFilenames ?? true,
-      preventExecutableUploads: config.preventExecutableUploads ?? true,
-      maxFilenameLength: config.maxFilenameLength ?? 255,
-    }
-
-    this.fileSecurity = new FileSecurity(config)
-
-    // Create destination directory if it doesn't exist
-    if (this.config.createDestination && !existsSync(this.config.destination)) {
-      mkdirSync(this.config.destination, { recursive: true })
-    }
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const contentType = req.headers.get('content-type')
-
-    if (!contentType || !contentType.includes('multipart/form-data')) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    try {
-      const formData = await req.formData()
-      const uploadedFiles: UploadedFile[] = []
-      const fields: Record<string, any> = {}
-
-      for (const [key, value] of (formData as any).entries()) {
-        if (value instanceof File) {
-          // Validate file count
-          if (uploadedFiles.length >= this.config.maxFiles) {
-            return this.createErrorResponse(`Maximum ${this.config.maxFiles} files allowed`, 400)
-          }
-
-          // Validate file size
-          if (value.size > this.config.maxFileSize) {
-            return this.createErrorResponse(
-              `File ${value.name} exceeds maximum size of ${this.formatBytes(this.config.maxFileSize)}`,
-              413,
-            )
-          }
-
-          // Validate MIME type
-          if (this.config.allowedMimeTypes.length > 0) {
-            const baseType = value.type.split(';')[0] // Remove charset info
-            if (!this.config.allowedMimeTypes.includes(baseType)) {
-              return this.createErrorResponse(
-                `File type ${baseType} not allowed. Allowed types: ${this.config.allowedMimeTypes.join(', ')}`,
-                415,
-              )
-            }
-          }
-
-          // Validate file extension
-          const fileExtension = extname(value.name).toLowerCase()
-          if (this.config.allowedExtensions.length > 0 && !this.config.allowedExtensions.includes(fileExtension)) {
-            return this.createErrorResponse(
-              `File extension ${fileExtension} not allowed. Allowed extensions: ${this.config.allowedExtensions.join(', ')}`,
-              415,
-            )
-          }
-
-          // Generate filename
-          const filename = this.generateFilename(value.name)
-          const filePath = join(this.config.destination, filename)
-
-          // Convert file to buffer and save
-          const buffer = await value.arrayBuffer()
-
-          const uploadedFile: UploadedFile = {
-            fieldName: key,
-            originalName: value.name,
-            filename,
-            path: filePath,
-            size: value.size,
-            mimetype: value.type,
-            buffer,
-          }
-
-          // Validate file security
-          const securityCheck = this.fileSecurity.validateFile(uploadedFile)
-          if (!securityCheck.isValid) {
-            return this.createErrorResponse(
-              `Security validation failed: ${securityCheck.errors.join(', ')}`,
-              400,
-            )
-          }
-
-          writeFileSync(filePath, new Uint8Array(buffer))
-          uploadedFiles.push(uploadedFile)
-        }
-        else {
-          // Handle regular form fields
-          if (fields[key]) {
-            // Convert to array if multiple values
-            if (Array.isArray(fields[key])) {
-              fields[key].push(value)
-            }
-            else {
-              fields[key] = [fields[key], value]
-            }
-          }
-          else {
-            fields[key] = value
-          }
-        }
-      }
-
-      // Attach files and fields to request
-      Object.defineProperty(req, 'files', {
-        value: uploadedFiles,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
-
-      // Typed lookup by form field name. Mirrors Laravel's
-      // `$request->file('avatar')` ergonomics: returns the matching
-      // UploadedFile or null. See stacksjs/stacks#1856.
-      Object.defineProperty(req, 'file', {
-        value: (fieldName: string): UploadedFile | null =>
-          uploadedFiles.find(f => f.fieldName === fieldName) ?? null,
-        writable: true,
-        enumerable: false,
-        configurable: true,
-      })
-
-      Object.defineProperty(req, 'formBody', {
-        value: fields,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
-
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-    catch (error) {
-      return this.createErrorResponse(
-        `File upload failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
-        500,
-      )
-    }
-  }
-
-  private generateFilename(originalName: string): string {
-    // Always sanitize the filename first
-    const sanitizedName = this.fileSecurity.getSafeFilename(originalName)
-
-    if (this.config.preserveOriginalName && !this.config.generateUniqueFilename) {
-      return sanitizedName
-    }
-
-    const extension = extname(sanitizedName)
-    const baseName = basename(sanitizedName, extension)
-
-    if (this.config.generateUniqueFilename) {
-      const uuid = randomUUID()
-      return this.config.preserveOriginalName
-        ? `${baseName}_${uuid}${extension}`
-        : `${uuid}${extension}`
-    }
-
-    return sanitizedName
-  }
-
-  private formatBytes(bytes: number): string {
-    if (bytes === 0)
-      return '0 Bytes'
-    const k = 1024
-    const sizes = ['Bytes', 'KB', 'MB', 'GB']
-    const i = Math.floor(Math.log(bytes) / Math.log(k))
-    return `${Number.parseFloat((bytes / k ** i).toFixed(2))} ${sizes[i]}`
-  }
-
-  private createErrorResponse(message: string, status: number): Response {
-    return new Response(
-      JSON.stringify({ error: message }),
-      {
-        status,
-        headers: { 'Content-Type': 'application/json' },
-      },
-    )
-  }
-}
-
-// Factory function for easier usage
-export function fileUpload(config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload(config)
-}
-
-// Specialized factory functions
-export function singleFileUpload(_fieldName: string, config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload({ ...config, maxFiles: 1 })
-}
-
-export function multipleFileUpload(maxFiles: number = 10, config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload({ ...config, maxFiles })
-}
-
-export function imageUpload(config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload({
-    ...config,
-    allowedMimeTypes: [
-      'image/jpeg',
-      'image/jpg',
-      'image/png',
-      'image/gif',
-      'image/webp',
-      'image/svg+xml',
-    ],
-    allowedExtensions: ['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg'],
-  })
-}
-
-export function documentUpload(config: FileUploadConfig = {}): FileUpload {
-  return new FileUpload({
-    ...config,
-    allowedMimeTypes: [
-      'application/pdf',
-      'application/msword',
-      'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-      'text/plain',
-    ],
-    allowedExtensions: ['.pdf', '.doc', '.docx', '.txt'],
-  })
-}

package/src/middleware/helmet.ts

@@ -1,268 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-export interface HelmetOptions {
-  contentSecurityPolicy?: boolean | {
-    directives?: Record<string, string[]>
-    reportOnly?: boolean
-    reportUri?: string
-    upgradeInsecureRequests?: boolean
-    blockAllMixedContent?: boolean
-  }
-  crossOriginEmbedderPolicy?: boolean | {
-    policy?: 'require-corp' | 'credentialless'
-  }
-  crossOriginOpenerPolicy?: boolean | {
-    policy?: 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none'
-  }
-  crossOriginResourcePolicy?: boolean | {
-    policy?: 'same-site' | 'same-origin' | 'cross-origin'
-  }
-  dnsPrefetchControl?: boolean | {
-    allow?: boolean
-  }
-  expectCt?: boolean | {
-    enforce?: boolean
-    maxAge?: number
-    reportUri?: string
-  }
-  frameguard?: boolean | {
-    action?: 'deny' | 'sameorigin'
-    domain?: string
-  }
-  hidePoweredBy?: boolean
-  hsts?: boolean | {
-    maxAge?: number
-    includeSubDomains?: boolean
-    preload?: boolean
-  }
-  ieNoOpen?: boolean
-  noSniff?: boolean
-  originAgentCluster?: boolean
-  permittedCrossDomainPolicies?: boolean | {
-    permittedPolicies?: 'none' | 'master-only' | 'by-content-type' | 'all'
-  }
-  referrerPolicy?: boolean | {
-    policy?: string | string[]
-  }
-  xssFilter?: boolean | {
-    setOnOldIE?: boolean
-  }
-}
-
-export default class Helmet {
-  private options: HelmetOptions
-
-  constructor(options: HelmetOptions = {}) {
-    const helmetConfig = (config.server?.security?.helmet || {}) as any
-
-    this.options = {
-      contentSecurityPolicy: options.contentSecurityPolicy ?? helmetConfig.contentSecurityPolicy ?? {
-        directives: {
-          'default-src': ['\'self\''],
-          'script-src': ['\'self\'', '\'unsafe-inline\''],
-          'style-src': ['\'self\'', '\'unsafe-inline\''],
-          'img-src': ['\'self\'', 'data:', 'https:'],
-          'font-src': ['\'self\''],
-          'connect-src': ['\'self\''],
-          'media-src': ['\'self\''],
-          'object-src': ['\'none\''],
-          'child-src': ['\'self\''],
-          'worker-src': ['\'self\''],
-          'frame-ancestors': ['\'none\''],
-          'form-action': ['\'self\''],
-          'base-uri': ['\'self\''],
-          'manifest-src': ['\'self\''],
-        },
-      },
-      crossOriginEmbedderPolicy: options.crossOriginEmbedderPolicy ?? true,
-      crossOriginOpenerPolicy: options.crossOriginOpenerPolicy ?? true,
-      crossOriginResourcePolicy: options.crossOriginResourcePolicy ?? true,
-      dnsPrefetchControl: options.dnsPrefetchControl ?? true,
-      expectCt: options.expectCt ?? helmetConfig.expectCt ?? false,
-      frameguard: options.frameguard ?? {
-        action: helmetConfig.frameOptions?.toLowerCase() as 'deny' | 'sameorigin' || 'deny',
-      },
-      hidePoweredBy: options.hidePoweredBy ?? helmetConfig.hidePoweredBy ?? true,
-      hsts: options.hsts ?? helmetConfig.hsts ?? {
-        maxAge: 31536000, // 1 year
-        includeSubDomains: true,
-        preload: true,
-      },
-      ieNoOpen: options.ieNoOpen ?? true,
-      noSniff: options.noSniff ?? helmetConfig.noSniff ?? true,
-      originAgentCluster: options.originAgentCluster ?? true,
-      permittedCrossDomainPolicies: options.permittedCrossDomainPolicies ?? {
-        permittedPolicies: 'none',
-      },
-      referrerPolicy: options.referrerPolicy ?? helmetConfig.referrerPolicy ?? {
-        policy: 'strict-origin-when-cross-origin',
-      },
-      xssFilter: options.xssFilter ?? helmetConfig.xssFilter ?? true,
-    }
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const helmetConfig = (config.server?.security?.helmet || {}) as any
-
-    // If helmet is disabled, continue to next middleware
-    if (helmetConfig.enabled === false) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    const response = await next()
-    if (!response) {
-      return new Response('Not Found', { status: 404 })
-    }
-
-    const headers = new Headers(response.headers)
-
-    // Content Security Policy
-    if (this.options.contentSecurityPolicy) {
-      const csp = this.options.contentSecurityPolicy
-      if (typeof csp === 'object' && csp.directives) {
-        const directives = Object.entries(csp.directives)
-          .map(([key, values]) => `${key} ${values.join(' ')}`)
-          .join('; ')
-
-        const headerName = csp.reportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy'
-        headers.set(headerName, directives)
-
-        if (csp.reportUri) {
-          headers.set('Report-To', JSON.stringify({
-            group: 'csp-endpoint',
-            max_age: 10886400,
-            endpoints: [{ url: csp.reportUri }],
-          }))
-        }
-      }
-    }
-
-    // Cross-Origin Embedder Policy
-    if (this.options.crossOriginEmbedderPolicy) {
-      const coep = this.options.crossOriginEmbedderPolicy
-      const policy = typeof coep === 'object' ? coep.policy || 'require-corp' : 'require-corp'
-      headers.set('Cross-Origin-Embedder-Policy', policy)
-    }
-
-    // Cross-Origin Opener Policy
-    if (this.options.crossOriginOpenerPolicy) {
-      const coop = this.options.crossOriginOpenerPolicy
-      const policy = typeof coop === 'object' ? coop.policy || 'same-origin' : 'same-origin'
-      headers.set('Cross-Origin-Opener-Policy', policy)
-    }
-
-    // Cross-Origin Resource Policy
-    if (this.options.crossOriginResourcePolicy) {
-      const corp = this.options.crossOriginResourcePolicy
-      const policy = typeof corp === 'object' ? corp.policy || 'same-origin' : 'same-origin'
-      headers.set('Cross-Origin-Resource-Policy', policy)
-    }
-
-    // DNS Prefetch Control
-    if (this.options.dnsPrefetchControl) {
-      const dnsPrefetch = this.options.dnsPrefetchControl
-      const allow = typeof dnsPrefetch === 'object' ? dnsPrefetch.allow : false
-      headers.set('X-DNS-Prefetch-Control', allow ? 'on' : 'off')
-    }
-
-    // Expect-CT
-    if (this.options.expectCt) {
-      const expectCt = this.options.expectCt
-      if (typeof expectCt === 'object') {
-        const parts = []
-        if (expectCt.enforce)
-          parts.push('enforce')
-        if (expectCt.maxAge)
-          parts.push(`max-age=${expectCt.maxAge}`)
-        if (expectCt.reportUri)
-          parts.push(`report-uri="${expectCt.reportUri}"`)
-        headers.set('Expect-CT', parts.join(', '))
-      }
-    }
-
-    // X-Frame-Options
-    if (this.options.frameguard) {
-      const frameguard = this.options.frameguard
-      if (typeof frameguard === 'object') {
-        const action = frameguard.action || 'deny'
-        const value = action === 'sameorigin' && frameguard.domain
-          ? `ALLOW-FROM ${frameguard.domain}`
-          : action.toUpperCase()
-        headers.set('X-Frame-Options', value)
-      }
-    }
-
-    // Hide X-Powered-By
-    if (this.options.hidePoweredBy) {
-      headers.delete('X-Powered-By')
-    }
-
-    // HTTP Strict Transport Security
-    if (this.options.hsts) {
-      const hsts = this.options.hsts
-      if (typeof hsts === 'object') {
-        const parts = [`max-age=${hsts.maxAge || 31536000}`]
-        if (hsts.includeSubDomains)
-          parts.push('includeSubDomains')
-        if (hsts.preload)
-          parts.push('preload')
-        headers.set('Strict-Transport-Security', parts.join('; '))
-      }
-    }
-
-    // X-Download-Options
-    if (this.options.ieNoOpen) {
-      headers.set('X-Download-Options', 'noopen')
-    }
-
-    // X-Content-Type-Options
-    if (this.options.noSniff) {
-      headers.set('X-Content-Type-Options', 'nosniff')
-    }
-
-    // Origin-Agent-Cluster
-    if (this.options.originAgentCluster) {
-      headers.set('Origin-Agent-Cluster', '?1')
-    }
-
-    // X-Permitted-Cross-Domain-Policies
-    if (this.options.permittedCrossDomainPolicies) {
-      const crossDomain = this.options.permittedCrossDomainPolicies
-      const policy = typeof crossDomain === 'object'
-        ? crossDomain.permittedPolicies || 'none'
-        : 'none'
-      headers.set('X-Permitted-Cross-Domain-Policies', policy)
-    }
-
-    // Referrer-Policy
-    if (this.options.referrerPolicy) {
-      const referrer = this.options.referrerPolicy
-      if (typeof referrer === 'object') {
-        const policy = Array.isArray(referrer.policy)
-          ? referrer.policy.join(', ')
-          : referrer.policy || 'strict-origin-when-cross-origin'
-        headers.set('Referrer-Policy', policy)
-      }
-      else {
-        headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
-      }
-    }
-
-    // X-XSS-Protection
-    if (this.options.xssFilter) {
-      const xss = this.options.xssFilter
-      const value = typeof xss === 'object' && xss.setOnOldIE
-        ? '1; mode=block'
-        : '0'
-      headers.set('X-XSS-Protection', value)
-    }
-
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    })
-  }
-}

package/src/middleware/index.ts

@@ -1,117 +0,0 @@
-import Auth, {
-  apiKeyAuth,
-  basicAuth,
-  bearerAuth,
-  extractApiKey,
-  extractBasicAuth,
-  extractBearerToken,
-  jwtAuth,
-  oauth2Auth,
-} from './auth'
-import Cors from './cors'
-import Csrf from './csrf'
-import JsonBody from './json_body'
-import { rateLimit as createRateLimit } from './rate_limit'
-import RequestId from './request_id'
-import RequestSigning from './request_signing'
-import Session from './session'
-
-// Export middleware classes
-export { default as Auth } from './auth'
-export { default as ContentSecurityPolicy } from './content_security_policy'
-export { contentSecurityPolicy } from './content_security_policy'
-export { default as Cors } from './cors'
-export { default as Csrf } from './csrf'
-export { default as DDoSProtection } from './ddos_protection'
-export { ddosProtection } from './ddos_protection'
-export { default as FileSecurity } from './file_security'
-export { default as FileUpload } from './file_upload'
-export { documentUpload, fileUpload, imageUpload, multipleFileUpload, singleFileUpload } from './file_upload'
-export { default as Helmet } from './helmet'
-export { default as InputValidation } from './input_validation'
-export { inputValidation } from './input_validation'
-export { default as JsonBody } from './json_body'
-export { default as PerformanceAlerting, performanceAlerting } from './performance_alerting'
-export { default as PerformanceDashboard, performanceDashboard } from './performance_dashboard'
-export { default as PerformanceMonitor, performanceMonitor } from './performance_monitor'
-export { default as RateLimit } from './rate_limit'
-// Export factory functions for easier usage
-export { rateLimit } from './rate_limit'
-export { default as RequestId } from './request_id'
-export { InMemoryNonceStore, default as RequestSigning, requestSigning, signRequest, verifySignature } from './request_signing'
-export type { NonceStore, RequestSigningOptions, SignatureAlgorithm, SignedPart } from './request_signing'
-export { SignatureError } from './request_signing'
-export { default as RequestTracer, requestTracer } from './request_tracer'
-export { default as Security } from './security'
-export { security } from './security'
-export { default as SecuritySuite } from './security_suite'
-export { securitySuite } from './security_suite'
-
-export { default as Session } from './session'
-
-// Authentication helper exports
-export {
-  apiKeyAuth,
-  basicAuth,
-  bearerAuth,
-  extractApiKey,
-  extractBasicAuth,
-  extractBearerToken,
-  jwtAuth,
-  oauth2Auth,
-}
-
-// Factory functions for easier middleware creation
-export const cors = (): Cors => new Cors()
-export const jsonBody = (): JsonBody => new JsonBody()
-export const requestId = (): RequestId => new RequestId()
-export const session = (): Session => new Session()
-export const csrf = (): Csrf => new Csrf()
-export function auth(): Auth {
-  return new Auth({
-    type: 'bearer',
-    validator: () => true, // Default just passes through - must be configured correctly
-  })
-}
-
-// Named middleware mapping for string-based middleware references (lazy-loaded)
-let _middleware: Record<string, any> | null = null
-
-function getMiddleware(): Record<string, any> {
-  if (!_middleware) {
-    _middleware = {
-      'Middleware/Cors': new Cors(),
-      'Middleware/JsonBody': new JsonBody(),
-      'Middleware/RequestId': new RequestId(),
-      'Middleware/Session': new Session(),
-      'Middleware/Csrf': new Csrf(),
-      'Middleware/Auth': new Auth({
-        type: 'bearer',
-        validator: () => true,
-      }),
-      'Middleware/RateLimit': createRateLimit(),
-      'Middleware/RequestSigning': new RequestSigning({
-        secret: '',
-      }),
-    }
-  }
-  return _middleware
-}
-
-export const middleware: Record<string, any> = new Proxy({} as Record<string, any>, {
-  get(_target, prop) {
-    return getMiddleware()[prop as string]
-  },
-  ownKeys() {
-    return Object.keys(getMiddleware())
-  },
-  getOwnPropertyDescriptor(_target, prop) {
-    const value = getMiddleware()[prop as string]
-    if (value !== undefined) {
-      return { configurable: true, enumerable: true, value }
-    }
-    return undefined
-  },
-})
-
-export default middleware