@titanshield/core 0.1.0

package/src/validate.ts

@@ -0,0 +1,72 @@
+import { z, ZodSchema } from 'zod';
+import type { ValidationResult } from './types.js';
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Input Validation Module — Zod-powered with XSS / SQLi sanitization
+// ─────────────────────────────────────────────────────────────────────────────
+
+// Common XSS / injection patterns
+const XSS_PATTERN = /<script[\s\S]*?>[\s\S]*?<\/script>|javascript:|on\w+\s*=|<iframe|<object|<embed/gi;
+const SQLI_PATTERN = /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|EXEC|EXECUTE|DECLARE|CAST|CONVERT|ALTER|CREATE)\b)|(-{2}|\/\*|\*\/|;)/gi;
+
+function sanitizeString(value: string): string {
+    return value
+        .replace(XSS_PATTERN, '')
+        .replace(SQLI_PATTERN, '')
+        .trim();
+}
+
+function sanitizeDeep(input: unknown): unknown {
+    if (typeof input === 'string') return sanitizeString(input);
+    if (Array.isArray(input)) return input.map(sanitizeDeep);
+    if (input !== null && typeof input === 'object') {
+        return Object.fromEntries(
+            Object.entries(input as Record<string, unknown>).map(([k, v]) => [k, sanitizeDeep(v)])
+        );
+    }
+    return input;
+}
+
+export function validate<T>(schema: ZodSchema<T>, input: unknown): ValidationResult {
+    const sanitized = sanitizeDeep(input);
+    const result = schema.safeParse(sanitized);
+
+    if (result.success) {
+        return { valid: true, errors: [], sanitized: result.data };
+    }
+
+    return {
+        valid: false,
+        errors: result.error.errors.map(e => ({
+            field: e.path.join('.'),
+            message: e.message,
+            code: e.code,
+        })),
+    };
+}
+
+// ── Pre-built schemas for common inputs ──────────────────────────────────────
+
+export const Schemas = {
+    email: z.object({ email: z.string().email().max(320) }),
+
+    login: z.object({
+        email: z.string().email().max(320),
+        password: z.string().min(8).max(128),
+    }),
+
+    userRegistration: z.object({
+        email: z.string().email().max(320),
+        password: z.string().min(8).max(128).regex(
+            /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&#])/,
+            'Password must contain uppercase, lowercase, digit, and special character'
+        ),
+        displayName: z.string().min(2).max(64).regex(/^[a-zA-Z0-9 _-]+$/),
+    }),
+
+    text: (maxLen = 500) => z.object({ text: z.string().max(maxLen) }),
+
+    id: z.object({ id: z.string().uuid() }),
+};
+
+export { z };

package/tsconfig.json

@@ -0,0 +1,26 @@
+{
+    "compilerOptions": {
+        "target": "ES2020",
+        "module": "commonjs",
+        "lib": [
+            "ES2020"
+        ],
+        "outDir": "dist",
+        "rootDir": "src",
+        "declaration": true,
+        "declarationMap": true,
+        "sourceMap": true,
+        "strict": true,
+        "esModuleInterop": true,
+        "skipLibCheck": true,
+        "forceConsistentCasingInFileNames": true,
+        "resolveJsonModule": true
+    },
+    "include": [
+        "src/**/*"
+    ],
+    "exclude": [
+        "node_modules",
+        "dist"
+    ]
+}