@ubean/server 0.1.13 → 0.2.0

package/dist/sessions-BsBsyFAG.js

@@ -0,0 +1,450 @@
+import { o as useStorage } from "./storage-BZLMaqHr.js";
+//#region src/csrf.ts
+const SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS",
+	"TRACE"
+]);
+/**
+* 生成密码学安全的随机 token
+*/
+function defaultGenerateToken(length = 32) {
+	const bytes = new Uint8Array(length);
+	if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.getRandomValues) globalThis.crypto.getRandomValues(bytes);
+	else for (let i = 0; i < length; i++) bytes[i] = Math.floor(Math.random() * 256);
+	return Buffer.from(bytes).toString("base64url");
+}
+/**
+* 从 cookie header 中解析指定 cookie 值
+*/
+function parseCookie$1(cookieHeader, name) {
+	if (!cookieHeader) return void 0;
+	const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]+)`));
+	return match ? match[1] : void 0;
+}
+/**
+* 校验 Origin/Referer 是否与目标 host 匹配
+*/
+function isOriginAllowed(c) {
+	const origin = c.req.header("origin");
+	const referer = c.req.header("referer");
+	const host = c.req.header("host");
+	if (!host) return false;
+	if (origin) try {
+		return new URL(origin).host === host;
+	} catch {
+		return false;
+	}
+	if (referer) try {
+		return new URL(referer).host === host;
+	} catch {
+		return false;
+	}
+	return true;
+}
+function isExcluded$1(path, exclude) {
+	if (!exclude || exclude.length === 0) return false;
+	return exclude.some((pattern) => {
+		if (pattern.endsWith("/**")) return path.startsWith(pattern.slice(0, -3));
+		if (pattern.endsWith("/*")) {
+			const prefix = pattern.slice(0, -2);
+			return path.startsWith(prefix) && !path.slice(prefix.length).includes("/");
+		}
+		return path === pattern;
+	});
+}
+function defaultErrorHandler(c) {
+	return c.json({
+		error: "CSRF Token Invalid",
+		message: "The CSRF token is missing or invalid."
+	}, 403);
+}
+/**
+* 创建 CSRF 保护中间件
+*
+* @example
+* ```typescript
+* // 使用默认配置(double-submit cookie 模式)
+* app.use('*', createCsrfMiddleware());
+*
+* // 仅校验 Origin
+* app.use('*', createCsrfMiddleware({ mode: 'origin' }));
+*
+* // 排除 API 路径
+* app.use('*', createCsrfMiddleware({ exclude: ['/api/webhook/**'] }));
+* ```
+*/
+function createCsrfMiddleware(options = {}) {
+	const { mode = "token", cookieName = "ubean_csrf", headerName = "x-csrf-token", fieldName = "csrfToken", tokenLength = 32, cookie: cookieOpts = {}, generateToken = () => defaultGenerateToken(tokenLength), exclude = [], handler = defaultErrorHandler } = options;
+	const cookiePath = cookieOpts.path || "/";
+	const cookieSecure = cookieOpts.secure ?? false;
+	const cookieSameSite = cookieOpts.sameSite || "lax";
+	const cookieDomain = cookieOpts.domain;
+	return async function csrfMiddleware(c, next) {
+		if (isExcluded$1(c.req.path, exclude)) {
+			await next();
+			return;
+		}
+		const method = c.req.method.toUpperCase();
+		if (SAFE_METHODS.has(method)) {
+			if (!parseCookie$1(c.req.header("cookie"), cookieName)) {
+				const token = generateToken();
+				const parts = [`${cookieName}=${token}`, `Path=${cookiePath}`];
+				if (cookieSecure) parts.push("Secure");
+				parts.push(`SameSite=${cookieSameSite}`);
+				if (cookieDomain) parts.push(`Domain=${cookieDomain}`);
+				c.header("Set-Cookie", parts.join("; "));
+			}
+			await next();
+			return;
+		}
+		const cookieToken = parseCookie$1(c.req.header("cookie"), cookieName);
+		let originValid = true;
+		if (mode === "origin" || mode === "both") originValid = isOriginAllowed(c);
+		let tokenValid = true;
+		if (mode === "token" || mode === "both") {
+			const headerToken = c.req.header(headerName);
+			let bodyToken;
+			if (!headerToken) try {
+				const contentType = c.req.header("content-type") || "";
+				if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) bodyToken = (await c.req.formData()).get(fieldName);
+			} catch {}
+			const requestToken = headerToken || bodyToken;
+			if (!cookieToken || !requestToken) tokenValid = false;
+			else if (cookieToken !== requestToken) tokenValid = false;
+		}
+		if (!originValid || !tokenValid) return handler(c);
+		await next();
+	};
+}
+/**
+* 生成 CSRF token(供前端使用)
+*/
+function generateCsrfToken(length = 32) {
+	return defaultGenerateToken(length);
+}
+function defineCsrf(options) {
+	return createCsrfMiddleware(options);
+}
+//#endregion
+//#region src/security-headers.ts
+/**
+* 将 CSP 指令对象序列化为 header 值
+*/
+function serializeCsp(directives) {
+	const parts = [];
+	for (const [key, value] of Object.entries(directives)) {
+		if (value === void 0 || value === null) continue;
+		if (value === true) parts.push(key);
+		else if (Array.isArray(value)) {
+			if (value.length > 0) parts.push(`${key} ${value.join(" ")}`);
+		}
+	}
+	return parts.join("; ");
+}
+/**
+* 将 Permissions-Policy 对象序列化为 header 值
+*/
+function serializePermissionsPolicy(policy) {
+	return Object.entries(policy).map(([feature, values]) => {
+		if (values.length === 0) return `${feature}=()`;
+		return `${feature}=(${values.join(" ")})`;
+	}).join(", ");
+}
+const DEFAULT_CSP = {
+	"default-src": ["'self'"],
+	"script-src": [
+		"'self'",
+		"'unsafe-inline'",
+		"'unsafe-eval'"
+	],
+	"style-src": ["'self'", "'unsafe-inline'"],
+	"img-src": [
+		"'self'",
+		"data:",
+		"blob:"
+	],
+	"font-src": ["'self'", "data:"],
+	"connect-src": ["'self'"],
+	"object-src": ["'none'"],
+	"base-uri": ["'self'"],
+	"form-action": ["'self'"],
+	"frame-ancestors": ["'self'"],
+	"upgrade-insecure-requests": true
+};
+/**
+* 创建安全头中间件
+*
+* @example
+* ```typescript
+* // 使用默认安全头
+* app.use('*', createSecurityHeadersMiddleware());
+*
+* // 自定义 CSP
+* app.use('*', createSecurityHeadersMiddleware({
+*   contentSecurityPolicy: {
+*     'default-src': ["'self'"],
+*     'script-src': ["'self'", 'https://cdn.example.com'],
+*     'style-src': ["'self'", "'unsafe-inline'"],
+*     'img-src': ["'self'", 'data:', 'https:']
+*   }
+* }));
+*
+* // 禁用某些头
+* app.use('*', createSecurityHeadersMiddleware({
+*   xFrameOptions: false,
+*   contentSecurityPolicy: false
+* }));
+* ```
+*/
+function createSecurityHeadersMiddleware(options = {}) {
+	const { contentSecurityPolicy = DEFAULT_CSP, contentSecurityPolicyReportOnly = false, strictTransportSecurity = {
+		maxAge: 15552e3,
+		includeSubDomains: true
+	}, xFrameOptions = "SAMEORIGIN", xContentTypeOptions = "nosniff", referrerPolicy = "strict-origin-when-cross-origin", permissionsPolicy = false, crossOriginOpenerPolicy = "same-origin", crossOriginEmbedderPolicy = false, crossOriginResourcePolicy = "same-origin", exclude = [], extraHeaders = {} } = options;
+	const headers = {};
+	if (contentSecurityPolicy !== false) {
+		const cspValue = serializeCsp(contentSecurityPolicy);
+		if (cspValue) {
+			const headerName = contentSecurityPolicyReportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy";
+			headers[headerName] = cspValue;
+		}
+	}
+	if (strictTransportSecurity !== false) {
+		const sts = strictTransportSecurity;
+		let stsValue = `max-age=${sts.maxAge ?? 15552e3}`;
+		if (sts.includeSubDomains) stsValue += "; includeSubDomains";
+		if (sts.preload) stsValue += "; preload";
+		headers["Strict-Transport-Security"] = stsValue;
+	}
+	if (xFrameOptions !== false) headers["X-Frame-Options"] = xFrameOptions;
+	if (xContentTypeOptions !== false) headers["X-Content-Type-Options"] = xContentTypeOptions;
+	if (referrerPolicy !== false) headers["Referrer-Policy"] = referrerPolicy;
+	if (permissionsPolicy !== false) {
+		const ppValue = serializePermissionsPolicy(permissionsPolicy);
+		if (ppValue) headers["Permissions-Policy"] = ppValue;
+	}
+	if (crossOriginOpenerPolicy !== false) headers["Cross-Origin-Opener-Policy"] = crossOriginOpenerPolicy;
+	if (crossOriginEmbedderPolicy !== false) headers["Cross-Origin-Embedder-Policy"] = crossOriginEmbedderPolicy;
+	if (crossOriginResourcePolicy !== false) headers["Cross-Origin-Resource-Policy"] = crossOriginResourcePolicy;
+	Object.assign(headers, extraHeaders);
+	return async function securityHeadersMiddleware(c, next) {
+		if (exclude.length > 0) {
+			const path = c.req.path;
+			if (exclude.some((pattern) => path.startsWith(pattern))) {
+				await next();
+				return;
+			}
+		}
+		for (const [name, value] of Object.entries(headers)) c.header(name, value);
+		await next();
+	};
+}
+function defineSecurityHeaders(options) {
+	return createSecurityHeadersMiddleware(options);
+}
+//#endregion
+//#region src/sessions.ts
+var SessionImpl = class {
+	id;
+	_store;
+	_ttl;
+	_onSave;
+	_onDestroy;
+	_data;
+	_dirty = false;
+	_destroyed = false;
+	constructor(id, initialData, _store, _ttl, _onSave, _onDestroy) {
+		this.id = id;
+		this._store = _store;
+		this._ttl = _ttl;
+		this._onSave = _onSave;
+		this._onDestroy = _onDestroy;
+		this._data = { ...initialData };
+	}
+	get(key) {
+		if (this._destroyed) return void 0;
+		return this._data[key];
+	}
+	set(key, value) {
+		if (this._destroyed) return;
+		this._data[key] = value;
+		this._dirty = true;
+	}
+	delete(key) {
+		if (this._destroyed) return;
+		if (key in this._data) {
+			delete this._data[key];
+			this._dirty = true;
+		}
+	}
+	has(key) {
+		if (this._destroyed) return false;
+		return key in this._data;
+	}
+	all() {
+		return { ...this._data };
+	}
+	get isDirty() {
+		return this._dirty;
+	}
+	get isDestroyed() {
+		return this._destroyed;
+	}
+	async save() {
+		if (this._destroyed) return;
+		if (this._onSave) await this._onSave(this.id, this._data);
+		else if (this._store) await this._store.set(this.id, this._data, this._ttl);
+		this._dirty = false;
+	}
+	async destroy() {
+		if (this._destroyed) return;
+		if (this._onDestroy) await this._onDestroy(this.id);
+		else if (this._store) await this._store.delete(this.id);
+		this._data = {};
+		this._destroyed = true;
+		this._dirty = false;
+	}
+};
+function defaultGenerateId() {
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.getRandomValues) globalThis.crypto.getRandomValues(bytes);
+	else for (let i = 0; i < 32; i++) bytes[i] = Math.floor(Math.random() * 256);
+	return Buffer.from(bytes).toString("hex");
+}
+function parseCookie(cookieHeader, name) {
+	if (!cookieHeader) return void 0;
+	const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]+)`));
+	return match ? match[1] : void 0;
+}
+function serializeCookie(name, value, opts) {
+	const parts = [`${name}=${value}`];
+	if (opts.path) parts.push(`Path=${opts.path}`);
+	if (opts.domain) parts.push(`Domain=${opts.domain}`);
+	if (opts.secure) parts.push("Secure");
+	if (opts.httpOnly) parts.push("HttpOnly");
+	if (opts.sameSite) parts.push(`SameSite=${opts.sameSite}`);
+	return parts.join("; ");
+}
+/**
+* 简单签名/验证(cookie 模式用,非加密级别安全)
+* 生产环境建议使用 storage 模式或提供更强的 secret
+*/
+function sign(value, secret) {
+	let hash = 0;
+	const str = secret + value;
+	for (let i = 0; i < str.length; i++) {
+		const char = str.charCodeAt(i);
+		hash = (hash << 5) - hash + char;
+		hash |= 0;
+	}
+	return `${value}.${Math.abs(hash).toString(36)}`;
+}
+function verify(signed, secret) {
+	const idx = signed.lastIndexOf(".");
+	if (idx === -1) return null;
+	const value = signed.slice(0, idx);
+	return signed === sign(value, secret) ? value : null;
+}
+function isExcluded(path, exclude) {
+	if (!exclude || exclude.length === 0) return false;
+	return exclude.some((p) => path.startsWith(p));
+}
+function createStorageSessionStore(storage, prefix = "session:") {
+	const store = storage || useStorage();
+	return {
+		async get(id) {
+			return await store.get(`${prefix}${id}`);
+		},
+		async set(id, data, ttl) {
+			await store.set(`${prefix}${id}`, data, ttl);
+		},
+		async delete(id) {
+			await store.remove(`${prefix}${id}`);
+		}
+	};
+}
+const SESSION_CONTEXT_KEY = "__ubean_session__";
+/**
+* 创建 session 中间件
+*
+* @example
+* ```typescript
+* // cookie 模式(默认,数据存 signed cookie)
+* app.use('*', createSessionMiddleware({ secret: 'my-secret' }));
+*
+* // storage 模式(数据存服务端 KV/storage)
+* app.use('*', createSessionMiddleware({
+*   store: createStorageSessionStore()
+* }));
+* ```
+*/
+function createSessionMiddleware(options = {}) {
+	const { cookieName = "ubean_session", ttl = 604800, cookie: cookieOpts = {}, store = null, generateId = defaultGenerateId, secret, exclude = [] } = options;
+	const cookieDefaults = {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: false,
+		...cookieOpts
+	};
+	return async function sessionMiddleware(c, next) {
+		if (isExcluded(c.req.path, exclude)) {
+			await next();
+			return;
+		}
+		let sessionId = parseCookie(c.req.header("cookie"), cookieName);
+		let cookieData = {};
+		if (sessionId && !store && secret) {
+			const verified = verify(sessionId, secret);
+			if (verified) try {
+				cookieData = JSON.parse(Buffer.from(verified, "base64").toString("utf-8"));
+				sessionId = void 0;
+			} catch {
+				sessionId = void 0;
+			}
+			else sessionId = void 0;
+		}
+		let session;
+		if (store) {
+			if (!sessionId) {
+				sessionId = generateId();
+				session = new SessionImpl(sessionId, {}, store, ttl);
+			} else {
+				const data = await store.get(sessionId);
+				session = new SessionImpl(sessionId, data || {}, store, ttl);
+			}
+		} else session = new SessionImpl(sessionId || generateId(), cookieData, null, ttl);
+		c[SESSION_CONTEXT_KEY] = session;
+		await next();
+		if (session.isDestroyed) c.header("Set-Cookie", `${serializeCookie(cookieName, "", {
+			...cookieDefaults,
+			path: cookieDefaults.path
+		})}; Max-Age=0`);
+		else if (session.isDirty) {
+			if (store) {
+				await session.save();
+				c.header("Set-Cookie", serializeCookie(cookieName, session.id, cookieDefaults));
+			} else if (secret) {
+				const json = JSON.stringify(session.all());
+				const signed = sign(Buffer.from(json, "utf-8").toString("base64"), secret);
+				c.header("Set-Cookie", serializeCookie(cookieName, signed, cookieDefaults));
+			}
+		}
+	};
+}
+/**
+* 从 Hono Context 获取 session
+*/
+function useSession(c) {
+	return c[SESSION_CONTEXT_KEY] || null;
+}
+/**
+* 定义 session store 别名
+*/
+function defineSessionStore(store) {
+	return store;
+}
+//#endregion
+export { createSecurityHeadersMiddleware as a, createCsrfMiddleware as c, useSession as i, defineCsrf as l, createStorageSessionStore as n, defineSecurityHeaders as o, defineSessionStore as r, serializeCsp as s, createSessionMiddleware as t, generateCsrfToken as u };