@stacksjs/bun-router 0.0.17 → 0.0.18

package/src/middleware/csrf.ts

@@ -1,166 +0,0 @@
-import type { EnhancedRequest, NextFunction, SecurityConfig } from '../types'
-import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
-import { config } from '../config'
-
-/** Maximum number of issued tokens kept for verification (oldest evicted first). */
-const MAX_TOKENS = 10_000
-
-/** Token lifetime in milliseconds. */
-const TOKEN_TTL_MS = 2 * 60 * 60 * 1000 // 2 hours
-
-export default class Csrf {
-  // Issued tokens with their issue timestamp. Bounded (LRU by insertion
-  // order) and TTL'd — the previous implementation grew without limit.
-  private static tokens = new Map<string, number>()
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    const csrfConfig: Partial<SecurityConfig['csrf']> = config.server?.security?.csrf ?? {}
-
-    const method = req.method.toUpperCase()
-    const ignoredMethods = ['GET', 'HEAD', 'OPTIONS', ...(csrfConfig?.ignoreMethods || [])]
-
-    if (ignoredMethods.includes(method)) {
-      // Safe methods don't need verification, but the response carries a
-      // fresh token cookie so the client has something to submit later
-      const token = this.generateToken(csrfConfig?.secret || 'csrf-secret')
-
-      // Continue to next middleware
-      const response = await next()
-      if (!response) {
-        return new Response('Not Found', { status: 404 })
-      }
-
-      // Add CSRF token cookie to response
-      const cookieName = csrfConfig?.cookie?.name || 'csrf-token'
-      const cookieOptions = []
-
-      cookieOptions.push(`${cookieName}=${token}`)
-      cookieOptions.push('Path=/')
-
-      if (csrfConfig?.cookie?.options?.httpOnly) {
-        cookieOptions.push('HttpOnly')
-      }
-
-      if (csrfConfig?.cookie?.options?.secure) {
-        cookieOptions.push('Secure')
-      }
-
-      if (csrfConfig?.cookie?.options?.sameSite) {
-        cookieOptions.push(`SameSite=${csrfConfig.cookie.options.sameSite}`)
-      }
-
-      const newHeaders = new Headers(response.headers)
-      newHeaders.append('Set-Cookie', cookieOptions.join('; '))
-
-      // Store token for verification (bounded + TTL)
-      Csrf.storeToken(token)
-
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: newHeaders,
-      })
-    }
-
-    // Bearer-authed requests can't be CSRF'd — the token doesn't
-    // ride on cookies, so a hostile origin can't trick a browser into
-    // sending it. Mirrors Laravel Sanctum / Django REST framework /
-    // express-csurf semantics. Filed against stacksjs/stacks#1922.
-    const authHeader = req.headers.get('authorization') ?? req.headers.get('Authorization')
-    if (authHeader && /^Bearer\s+\S/i.test(authHeader)) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    // For unsafe methods, verify the CSRF token
-    // Check for token in headers or in the request body
-    const rawToken = req.headers.get('X-CSRF-TOKEN')
-      || req.jsonBody?.csrf_token
-      || req.jsonBody?._token
-      || null
-    const token = typeof rawToken === 'string' ? rawToken : null
-
-    // Get token from cookies for comparison
-    const cookies = this.parseCookies(req)
-    const cookieToken = cookies[csrfConfig?.cookie?.name || 'csrf-token']
-
-    // Verify the token: double-submit value must match the cookie
-    // (constant-time comparison) and must have been issued by us
-    if (!token || !cookieToken
-      || !Csrf.safeCompare(token, cookieToken)
-      || !Csrf.isTokenValid(token)) {
-      return new Response(
-        JSON.stringify({ error: 'CSRF token validation failed' }),
-        {
-          status: 403,
-          headers: { 'Content-Type': 'application/json' },
-        },
-      )
-    }
-
-    // Continue to next middleware if token is valid
-    const response = await next()
-    return response || new Response('Not Found', { status: 404 })
-  }
-
-  /**
-   * Constant-time string comparison — a plain `!==` leaks how many leading
-   * characters of the token were correct through response timing.
-   */
-  private static safeCompare(a: string, b: string): boolean {
-    const bufA = Buffer.from(a)
-    const bufB = Buffer.from(b)
-    if (bufA.length !== bufB.length) {
-      return false
-    }
-    return timingSafeEqual(bufA, bufB)
-  }
-
-  private static storeToken(token: string): void {
-    if (Csrf.tokens.size >= MAX_TOKENS) {
-      // Evict the oldest issued token (Map preserves insertion order)
-      const oldest = Csrf.tokens.keys().next().value
-      if (oldest !== undefined) {
-        Csrf.tokens.delete(oldest)
-      }
-    }
-    Csrf.tokens.set(token, Date.now())
-  }
-
-  private static isTokenValid(token: string): boolean {
-    const issuedAt = Csrf.tokens.get(token)
-    if (issuedAt === undefined) {
-      return false
-    }
-    if (Date.now() - issuedAt > TOKEN_TTL_MS) {
-      Csrf.tokens.delete(token)
-      return false
-    }
-    return true
-  }
-
-  private generateToken(secret: string): string {
-    const randomString = randomBytes(16).toString('hex')
-    return createHash('sha256')
-      .update(`${randomString}${secret}`)
-      .digest('hex')
-  }
-
-  private parseCookies(req: Request): Record<string, string> {
-    const cookieHeader = req.headers.get('cookie')
-    if (!cookieHeader)
-      return {}
-
-    const cookies: Record<string, string> = {}
-    for (const cookie of cookieHeader.split(';')) {
-      const eqIndex = cookie.indexOf('=')
-      if (eqIndex === -1)
-        continue
-      const name = cookie.slice(0, eqIndex).trim()
-      if (!name)
-        continue
-      cookies[name] = cookie.slice(eqIndex + 1).trim()
-    }
-    return cookies
-  }
-}

package/src/middleware/ddos_protection.ts

@@ -1,279 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-export interface DDoSProtectionOptions {
-  enabled?: boolean
-  maxRequestsPerSecond?: number
-  maxRequestsPerMinute?: number
-  maxRequestsPerHour?: number
-  burstLimit?: number
-  windowSize?: number
-  blockDuration?: number
-  whitelistedIPs?: string[]
-  blacklistedIPs?: string[]
-  trustProxy?: boolean
-  skipSuccessfulRequests?: boolean
-  skipFailedRequests?: boolean
-  keyGenerator?: (req: EnhancedRequest) => string
-  onLimitReached?: (req: EnhancedRequest, rateLimitInfo: DDoSRateLimitInfo) => Response | Promise<Response>
-  store?: 'memory' | 'redis'
-  redis?: {
-    url: string
-    prefix?: string
-  }
-}
-
-interface RequestInfo {
-  count: number
-  firstRequest: number
-  lastRequest: number
-  blocked: boolean
-  blockExpires?: number
-}
-
-/**
- * Rate-limit details passed to `onLimitReached` when a client is blocked.
- */
-export interface DDoSRateLimitInfo extends RequestInfo {
-  /** Seconds until the block lifts (mirrors the Retry-After header) */
-  retryAfter: number
-}
-
-export default class DDoSProtection {
-  private options: DDoSProtectionOptions
-  private requestStore: Map<string, RequestInfo> = new Map()
-  private cleanupInterval: ReturnType<typeof setInterval> | null = null
-
-  constructor(options: DDoSProtectionOptions = {}) {
-    const ddosConfig = config.server?.security?.ddos || {}
-
-    this.options = {
-      enabled: options.enabled ?? ddosConfig.enabled ?? true,
-      maxRequestsPerSecond: options.maxRequestsPerSecond ?? ddosConfig.maxRequestsPerSecond ?? 10,
-      maxRequestsPerMinute: options.maxRequestsPerMinute ?? ddosConfig.maxRequestsPerMinute ?? 100,
-      maxRequestsPerHour: options.maxRequestsPerHour ?? ddosConfig.maxRequestsPerHour ?? 1000,
-      burstLimit: options.burstLimit ?? ddosConfig.burstLimit ?? 20,
-      windowSize: options.windowSize ?? ddosConfig.windowSize ?? 60000, // 1 minute
-      blockDuration: options.blockDuration ?? ddosConfig.blockDuration ?? 300000, // 5 minutes
-      whitelistedIPs: options.whitelistedIPs ?? ddosConfig.whitelistedIPs ?? [],
-      blacklistedIPs: options.blacklistedIPs ?? ddosConfig.blacklistedIPs ?? [],
-      trustProxy: options.trustProxy ?? ddosConfig.trustProxy ?? true,
-      skipSuccessfulRequests: options.skipSuccessfulRequests ?? ddosConfig.skipSuccessfulRequests ?? false,
-      skipFailedRequests: options.skipFailedRequests ?? ddosConfig.skipFailedRequests ?? false,
-      keyGenerator: options.keyGenerator ?? this.defaultKeyGenerator.bind(this),
-      onLimitReached: options.onLimitReached,
-      store: options.store ?? ddosConfig.store ?? 'memory',
-      redis: options.redis ?? ddosConfig.redis,
-    }
-
-    // Start cleanup interval for memory store
-    if (this.options.store === 'memory') {
-      this.startCleanupInterval()
-    }
-  }
-
-  private defaultKeyGenerator(req: EnhancedRequest): string {
-    const forwarded = req.headers.get('x-forwarded-for')
-    const realIP = req.headers.get('x-real-ip')
-    const cfIP = req.headers.get('cf-connecting-ip')
-
-    if (this.options.trustProxy && forwarded) {
-      return forwarded.split(',')[0].trim()
-    }
-
-    return realIP || cfIP || 'unknown'
-  }
-
-  private startCleanupInterval(): void {
-    this.cleanupInterval = setInterval(() => {
-      const now = Date.now()
-      for (const [key, info] of this.requestStore.entries()) {
-        // Remove expired entries
-        if (now - info.lastRequest > this.options.windowSize! * 2) {
-          this.requestStore.delete(key)
-        }
-        // Remove expired blocks
-        if (info.blocked && info.blockExpires && now > info.blockExpires) {
-          info.blocked = false
-          info.blockExpires = undefined
-        }
-      }
-    }, this.options.windowSize! / 2) // Cleanup every half window
-    // Background housekeeping must not keep the process alive
-    this.cleanupInterval.unref?.()
-  }
-
-  private isWhitelisted(ip: string): boolean {
-    return this.options.whitelistedIPs?.includes(ip) ?? false
-  }
-
-  private isBlacklisted(ip: string): boolean {
-    return this.options.blacklistedIPs?.includes(ip) ?? false
-  }
-
-  private getRateLimitInfo(key: string, now: number): RequestInfo {
-    let info = this.requestStore.get(key)
-
-    if (!info) {
-      // Hard cap on tracked clients: a spoofed-IP flood would otherwise
-      // grow the store faster than the interval cleanup can drain it.
-      // Evicting the oldest entries (Map insertion order) only resets
-      // counters for long-idle clients.
-      if (this.requestStore.size >= 100_000) {
-        let toEvict = Math.ceil(this.requestStore.size / 10)
-        for (const oldestKey of this.requestStore.keys()) {
-          this.requestStore.delete(oldestKey)
-          if (--toEvict <= 0) {
-            break
-          }
-        }
-      }
-
-      info = {
-        count: 0,
-        firstRequest: now,
-        lastRequest: now,
-        blocked: false,
-      }
-      this.requestStore.set(key, info)
-    }
-
-    // Reset count if window has passed
-    if (now - info.firstRequest > this.options.windowSize!) {
-      info.count = 0
-      info.firstRequest = now
-    }
-
-    return info
-  }
-
-  private shouldBlock(info: RequestInfo, now: number): boolean {
-    // Check if already blocked and block hasn't expired
-    if (info.blocked && info.blockExpires && now < info.blockExpires) {
-      return true
-    }
-
-    // Check burst limit (requests per second)
-    const _secondWindow = 1000
-    const recentRequests = info.count // Simplified for this implementation
-    if (recentRequests > this.options.burstLimit!) {
-      return true
-    }
-
-    // Check requests per minute
-    if (info.count > this.options.maxRequestsPerMinute!) {
-      return true
-    }
-
-    return false
-  }
-
-  private blockIP(info: RequestInfo, now: number): void {
-    info.blocked = true
-    info.blockExpires = now + this.options.blockDuration!
-  }
-
-  private createBlockedResponse(req: EnhancedRequest, info: RequestInfo): Response | Promise<Response> {
-    const retryAfter = Math.ceil((info.blockExpires! - Date.now()) / 1000)
-
-    const headers = {
-      'Retry-After': retryAfter.toString(),
-      'X-RateLimit-Limit': this.options.maxRequestsPerMinute!.toString(),
-      'X-RateLimit-Remaining': '0',
-      'X-RateLimit-Reset': Math.ceil(info.blockExpires! / 1000).toString(),
-    }
-
-    if (this.options.onLimitReached) {
-      return this.options.onLimitReached(req, { ...info, retryAfter })
-    }
-
-    return new Response(JSON.stringify({
-      error: 'Too Many Requests',
-      message: 'Rate limit exceeded. Please try again later.',
-      retryAfter,
-    }), {
-      status: 429,
-      headers: {
-        'Content-Type': 'application/json',
-        ...headers,
-      },
-    })
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    // Skip if DDoS protection is disabled
-    if (!this.options.enabled) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    const now = Date.now()
-    const key = this.options.keyGenerator!(req)
-
-    // Check if IP is whitelisted
-    if (this.isWhitelisted(key)) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    // Check if IP is blacklisted
-    if (this.isBlacklisted(key)) {
-      return new Response('Access Denied', { status: 403 })
-    }
-
-    // Get rate limit info
-    const info = this.getRateLimitInfo(key, now)
-
-    // Check if should block
-    if (this.shouldBlock(info, now)) {
-      this.blockIP(info, now)
-      return this.createBlockedResponse(req, info)
-    }
-
-    // Increment request count
-    info.count++
-    info.lastRequest = now
-
-    // Process request
-    const response = await next()
-
-    if (!response) {
-      return new Response('Not Found', { status: 404 })
-    }
-
-    // Skip counting based on response status if configured
-    if (this.options.skipSuccessfulRequests && response.status < 400) {
-      info.count--
-    }
-    if (this.options.skipFailedRequests && response.status >= 400) {
-      info.count--
-    }
-
-    // Add rate limit headers
-    const headers = new Headers(response.headers)
-    headers.set('X-RateLimit-Limit', this.options.maxRequestsPerMinute!.toString())
-    headers.set('X-RateLimit-Remaining', Math.max(0, this.options.maxRequestsPerMinute! - info.count).toString())
-    headers.set('X-RateLimit-Reset', Math.ceil((info.firstRequest + this.options.windowSize!) / 1000).toString())
-
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    })
-  }
-
-  // Cleanup method
-  destroy(): void {
-    if (this.cleanupInterval) {
-      clearInterval(this.cleanupInterval)
-      this.cleanupInterval = null
-    }
-    this.requestStore.clear()
-  }
-}
-
-// Factory function for easy use
-export function ddosProtection(options: DDoSProtectionOptions = {}): (req: EnhancedRequest, next: NextFunction) => Promise<Response> {
-  const instance = new DDoSProtection(options)
-  return async (req: EnhancedRequest, next: NextFunction) => instance.handle(req, next)
-}

package/src/middleware/file_security.ts

@@ -1,191 +0,0 @@
-import type { UploadedFile } from './file_upload'
-
-export interface FileSecurityConfig {
-  scanForMalware?: boolean
-  checkMagicNumbers?: boolean
-  sanitizeFilenames?: boolean
-  preventExecutableUploads?: boolean
-  maxFilenameLength?: number
-}
-
-export default class FileSecurity {
-  private config: Required<FileSecurityConfig>
-
-  // Common file signatures (magic numbers)
-  private readonly FILE_SIGNATURES: Record<string, Uint8Array[]> = {
-    'image/jpeg': [
-      new Uint8Array([0xFF, 0xD8, 0xFF]),
-    ],
-    'image/png': [
-      new Uint8Array([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
-    ],
-    'image/gif': [
-      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x37, 0x61]),
-      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x39, 0x61]),
-    ],
-    'application/pdf': [
-      new Uint8Array([0x25, 0x50, 0x44, 0x46]),
-    ],
-    'application/zip': [
-      new Uint8Array([0x50, 0x4B, 0x03, 0x04]),
-      new Uint8Array([0x50, 0x4B, 0x05, 0x06]),
-      new Uint8Array([0x50, 0x4B, 0x07, 0x08]),
-    ],
-  }
-
-  // Dangerous file extensions
-  private readonly EXECUTABLE_EXTENSIONS = [
-    '.exe',
-    '.bat',
-    '.cmd',
-    '.com',
-    '.pif',
-    '.scr',
-    '.vbs',
-    '.js',
-    '.jar',
-    '.app',
-    '.deb',
-    '.pkg',
-    '.dmg',
-    '.sh',
-    '.ps1',
-    '.msi',
-    '.dll',
-  ]
-
-  constructor(config: FileSecurityConfig = {}) {
-    this.config = {
-      scanForMalware: config.scanForMalware ?? false,
-      checkMagicNumbers: config.checkMagicNumbers ?? true,
-      sanitizeFilenames: config.sanitizeFilenames ?? true,
-      preventExecutableUploads: config.preventExecutableUploads ?? true,
-      maxFilenameLength: config.maxFilenameLength ?? 255,
-    }
-  }
-
-  validateFile(file: UploadedFile): { isValid: boolean, errors: string[] } {
-    const errors: string[] = []
-
-    // Check filename length
-    if (file.originalName.length > this.config.maxFilenameLength) {
-      errors.push(`Filename too long (max ${this.config.maxFilenameLength} characters)`)
-    }
-
-    // Check for dangerous filename patterns (but don't reject if we're sanitizing)
-    if (this.config.sanitizeFilenames) {
-      const sanitizedName = this.sanitizeFilename(file.originalName)
-      // Only error if sanitization results in empty filename
-      if (!sanitizedName || sanitizedName.length === 0) {
-        errors.push('Filename is invalid or empty after sanitization')
-      }
-    }
-
-    // Check for executable files
-    if (this.config.preventExecutableUploads) {
-      const extension = this.getFileExtension(file.originalName).toLowerCase()
-      if (this.EXECUTABLE_EXTENSIONS.includes(extension)) {
-        errors.push('Executable files are not allowed')
-      }
-    }
-
-    // Validate file signature (magic numbers)
-    if (this.config.checkMagicNumbers) {
-      const isValidSignature = this.validateFileSignature(file)
-      if (!isValidSignature) {
-        errors.push('File signature does not match declared MIME type')
-      }
-    }
-
-    // Basic malware scan (simple heuristics)
-    if (this.config.scanForMalware) {
-      const malwareDetected = this.basicMalwareScan(file)
-      if (malwareDetected) {
-        errors.push('Potential malware detected')
-      }
-    }
-
-    return {
-      isValid: errors.length === 0,
-      errors,
-    }
-  }
-
-  private validateFileSignature(file: UploadedFile): boolean {
-    const signatures = this.FILE_SIGNATURES[file.mimetype]
-    if (!signatures) {
-      // If we don't have signatures for this MIME type, allow it
-      return true
-    }
-
-    const fileBuffer = new Uint8Array(file.buffer.slice(0, 16)) // Check first 16 bytes
-
-    return signatures.some((signature) => {
-      if (fileBuffer.length < signature.length)
-        return false
-
-      for (let i = 0; i < signature.length; i++) {
-        if (fileBuffer[i] !== signature[i])
-          return false
-      }
-      return true
-    })
-  }
-
-  private sanitizeFilename(filename: string): string {
-    // Remove or replace dangerous characters
-    return filename
-      // eslint-disable-next-line no-control-regex
-      .replace(/[<>:"/\\|?*\u0000-\u001F]/u, '_') // Replace dangerous chars with underscore
-      .replace(/^\.+/, '') // Remove leading dots
-      .replace(/\.+$/, '') // Remove trailing dots
-      .replace(/\s+/g, '_') // Replace spaces with underscores
-      .substring(0, this.config.maxFilenameLength) // Truncate if too long
-  }
-
-  private getFileExtension(filename: string): string {
-    const lastDotIndex = filename.lastIndexOf('.')
-    return lastDotIndex === -1 ? '' : filename.substring(lastDotIndex)
-  }
-
-  private basicMalwareScan(file: UploadedFile): boolean {
-    // Simple heuristic-based malware detection
-    const buffer = new Uint8Array(file.buffer)
-    const content = new TextDecoder('utf-8', { fatal: false }).decode(buffer)
-
-    // Check for common malware patterns (very basic)
-    const malwarePatterns = [
-      /eval\s*\(/gi,
-      /document\.write/gi,
-      /window\.location/gi,
-      /<script[^>]*>/gi,
-      /javascript:/gi,
-      /vbscript:/gi,
-      /onload\s*=/gi,
-      /onerror\s*=/gi,
-    ]
-
-    return malwarePatterns.some(pattern => pattern.test(content))
-  }
-
-  // Utility method to get safe filename
-  getSafeFilename(originalName: string): string {
-    return this.sanitizeFilename(originalName)
-  }
-
-  // Check if file type is allowed based on whitelist
-  isAllowedFileType(mimetype: string, allowedTypes: string[]): boolean {
-    if (allowedTypes.length === 0)
-      return true
-    return allowedTypes.includes(mimetype)
-  }
-
-  // Check file size limits
-  isWithinSizeLimit(fileSize: number, maxSize: number): boolean {
-    return fileSize <= maxSize
-  }
-}
-
-export function createFileSecurity(config: FileSecurityConfig = {}): FileSecurity {
-  return new FileSecurity(config)
-}