@unchainedshop/api 3.1.12 → 3.1.15

package/lib/middleware/accountLockout.js

@@ -1,84 +0,0 @@
-import { GraphQLError } from 'graphql';
-// Store login attempts by user identifier (username/email)
-const loginAttempts = new Map();
-// Configuration
-const MAX_ATTEMPTS = 5;
-const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes
-const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes
-// Clean up old entries periodically
-setInterval(() => {
-    const now = Date.now();
-    for (const [key, attempt] of loginAttempts.entries()) {
-        // Remove entries older than 24 hours
-        if (now - attempt.lastAttempt > 24 * 60 * 60 * 1000) {
-            loginAttempts.delete(key);
-        }
-    }
-}, 60 * 60 * 1000); // Clean every hour
-async function createIdentifierHash(identifier) {
-    const encoder = new TextEncoder();
-    const dataBuffer = encoder.encode(identifier.toLowerCase());
-    const hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
-}
-export async function checkAccountLockout(identifier) {
-    const hashedIdentifier = await createIdentifierHash(identifier);
-    const attempt = loginAttempts.get(hashedIdentifier);
-    if (!attempt)
-        return;
-    const now = Date.now();
-    // Check if account is locked
-    if (attempt.lockedUntil && attempt.lockedUntil > now) {
-        const remainingMinutes = Math.ceil((attempt.lockedUntil - now) / 60000);
-        throw new GraphQLError(`Account is locked. Please try again in ${remainingMinutes} minutes.`, {
-            extensions: {
-                code: 'ACCOUNT_LOCKED',
-                lockedUntil: attempt.lockedUntil,
-                remainingMinutes,
-            },
-        });
-    }
-    // Reset attempts if outside the window
-    if (now - attempt.firstAttempt > ATTEMPT_WINDOW) {
-        loginAttempts.delete(hashedIdentifier);
-    }
-}
-export async function recordFailedLoginAttempt(identifier) {
-    const hashedIdentifier = await createIdentifierHash(identifier);
-    const now = Date.now();
-    let attempt = loginAttempts.get(hashedIdentifier);
-    if (!attempt || now - attempt.firstAttempt > ATTEMPT_WINDOW) {
-        // Create new attempt record or reset if outside window
-        attempt = {
-            count: 1,
-            firstAttempt: now,
-            lastAttempt: now,
-        };
-    }
-    else {
-        // Increment existing attempt
-        attempt.count++;
-        attempt.lastAttempt = now;
-        // Lock account if max attempts exceeded
-        if (attempt.count >= MAX_ATTEMPTS) {
-            attempt.lockedUntil = now + LOCKOUT_DURATION;
-        }
-    }
-    loginAttempts.set(hashedIdentifier, attempt);
-    // Provide warning about remaining attempts
-    if (attempt.count >= 3 && attempt.count < MAX_ATTEMPTS) {
-        const remainingAttempts = MAX_ATTEMPTS - attempt.count;
-        throw new GraphQLError(`Invalid credentials. ${remainingAttempts} attempts remaining before account lockout.`, {
-            extensions: {
-                code: 'INVALID_CREDENTIALS',
-                remainingAttempts,
-            },
-        });
-    }
-}
-export async function clearLoginAttempts(identifier) {
-    const hashedIdentifier = await createIdentifierHash(identifier);
-    loginAttempts.delete(hashedIdentifier);
-}
-//# sourceMappingURL=accountLockout.js.map

package/lib/middleware/accountLockout.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"accountLockout.js","sourceRoot":"","sources":["../../src/middleware/accountLockout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AASvC,2DAA2D;AAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEtD,gBAAgB;AAChB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AACtD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAEpD,oCAAoC;AACpC,WAAW,CACT,GAAG,EAAE;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,qCAAqC;QACrC,IAAI,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACpD,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC,EACD,EAAE,GAAG,EAAE,GAAG,IAAI,CACf,CAAC,CAAC,mBAAmB;AAEtB,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACpD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAEpD,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,6BAA6B;IAC7B,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QACxE,MAAM,IAAI,YAAY,CAAC,0CAA0C,gBAAgB,WAAW,EAAE;YAC5F,UAAU,EAAE;gBACV,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,gBAAgB;aACjB;SACF,CAAC,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,IAAI,GAAG,GAAG,OAAO,CAAC,YAAY,GAAG,cAAc,EAAE,CAAC;QAChD,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IAC/D,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,CAAC,YAAY,GAAG,cAAc,EAAE,CAAC;QAC5D,uDAAuD;QACvD,OAAO,GAAG;YACR,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,GAAG;YACjB,WAAW,EAAE,GAAG;SACjB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC;QAE1B,wCAAwC;QACxC,IAAI,OAAO,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;YAClC,OAAO,CAAC,WAAW,GAAG,GAAG,GAAG,gBAAgB,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,aAAa,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,YAAY,EAAE,CAAC;QACvD,MAAM,iBAAiB,GAAG,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;QACvD,MAAM,IAAI,YAAY,CACpB,wBAAwB,iBAAiB,6CAA6C,EACtF;YACE,UAAU,EAAE;gBACV,IAAI,EAAE,qBAAqB;gBAC3B,iBAAiB;aAClB;SACF,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAChE,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACzC,CAAC"}

package/lib/middleware/rateLimiter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rateLimiter.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimiter.ts"],"names":[],"mappings":"AAEA,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAkCD,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,EAAE,UAAS,gBAAqB,MAmBnE,SAAS,GAAG,qBA8B3B,CAAC;AAGF,eAAO,MAAM,eAAe,YAjCH,GAAG,qBAqC1B,CAAC;AAEH,eAAO,MAAM,wBAAwB,YAvCZ,GAAG,qBAiD1B,CAAC;AAEH,eAAO,MAAM,uBAAuB,YAnDX,GAAG,qBA4D1B,CAAC"}

package/lib/middleware/rateLimiter.js

@@ -1,91 +0,0 @@
-import { GraphQLError } from 'graphql';
-const stores = {};
-// Clean up expired entries periodically
-setInterval(() => {
-    const now = Date.now();
-    Object.keys(stores).forEach((storeName) => {
-        const store = stores[storeName];
-        Object.keys(store).forEach((key) => {
-            if (store[key].resetTime < now) {
-                delete store[key];
-            }
-        });
-    });
-}, 60000); // Clean every minute
-// Helper to create hash using WebCrypto
-async function createHash(data) {
-    const encoder = new TextEncoder();
-    const dataBuffer = encoder.encode(data);
-    const hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
-}
-export const createRateLimiter = (storeName, options = {}) => {
-    const { windowMs = 15 * 60 * 1000, // 15 minutes default
-    max = 5, // 5 requests per window default
-    message = 'Too many requests, please try again later.', keyGenerator = async (context) => {
-        // Default key generator uses IP + userId
-        const ip = context.req?.ip || context.req?.connection?.remoteAddress || 'unknown';
-        const userId = context.userId || 'anonymous';
-        return createHash(`${ip}-${userId}`);
-    }, } = options;
-    // Initialize store for this limiter
-    if (!stores[storeName]) {
-        stores[storeName] = {};
-    }
-    const store = stores[storeName];
-    return async (context) => {
-        const key = await keyGenerator(context);
-        const now = Date.now();
-        // Get or create rate limit entry
-        let entry = store[key];
-        if (!entry || entry.resetTime < now) {
-            entry = {
-                count: 0,
-                resetTime: now + windowMs,
-            };
-            store[key] = entry;
-        }
-        // Increment counter
-        entry.count++;
-        // Check if limit exceeded
-        if (entry.count > max) {
-            const retryAfter = Math.ceil((entry.resetTime - now) / 1000);
-            throw new GraphQLError(message, {
-                extensions: {
-                    code: 'RATE_LIMIT_EXCEEDED',
-                    retryAfter,
-                },
-            });
-        }
-        return true;
-    };
-};
-// Pre-configured rate limiters for common use cases
-export const authRateLimiter = createRateLimiter('auth', {
-    windowMs: 15 * 60 * 1000, // 15 minutes
-    max: 5, // 5 attempts per 15 minutes
-    message: 'Too many authentication attempts. Please try again later.',
-});
-export const passwordResetRateLimiter = createRateLimiter('passwordReset', {
-    windowMs: 60 * 60 * 1000, // 1 hour
-    max: 3, // 3 attempts per hour
-    message: 'Too many password reset requests. Please try again later.',
-    keyGenerator: async (context) => {
-        // Rate limit by email/username instead of IP for password reset
-        const { email, username } = context.args || {};
-        const identifier = email || username || 'unknown';
-        return createHash(identifier.toLowerCase());
-    },
-});
-export const registrationRateLimiter = createRateLimiter('registration', {
-    windowMs: 60 * 60 * 1000, // 1 hour
-    max: 10, // 10 registrations per hour per IP
-    message: 'Too many registration attempts. Please try again later.',
-    keyGenerator: async (context) => {
-        // Rate limit by IP only for registrations
-        const ip = context.req?.ip || context.req?.connection?.remoteAddress || 'unknown';
-        return createHash(ip);
-    },
-});
-//# sourceMappingURL=rateLimiter.js.map

package/lib/middleware/rateLimiter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rateLimiter.js","sourceRoot":"","sources":["../../src/middleware/rateLimiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAiBvC,MAAM,MAAM,GAAmC,EAAE,CAAC;AAElD,wCAAwC;AACxC,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,qBAAqB;AAEhC,wCAAwC;AACxC,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,UAA4B,EAAE,EAAE,EAAE;IACrF,MAAM,EACJ,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,qBAAqB;IAChD,GAAG,GAAG,CAAC,EAAE,gCAAgC;IACzC,OAAO,GAAG,4CAA4C,EACtD,YAAY,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,yCAAyC;QACzC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,IAAI,SAAS,CAAC;QAClF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC;QAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC,GACF,GAAG,OAAO,CAAC;IAEZ,oCAAoC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,KAAK,EAAE,OAAY,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,iCAAiC;QACjC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACpC,KAAK,GAAG;gBACN,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,GAAG,GAAG,QAAQ;aAC1B,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,oBAAoB;QACpB,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,0BAA0B;QAC1B,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE;gBAC9B,UAAU,EAAE;oBACV,IAAI,EAAE,qBAAqB;oBAC3B,UAAU;iBACX;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,GAAG,EAAE,CAAC,EAAE,4BAA4B;IACpC,OAAO,EAAE,2DAA2D;CACrE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,eAAe,EAAE;IACzE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;IACnC,GAAG,EAAE,CAAC,EAAE,sBAAsB;IAC9B,OAAO,EAAE,2DAA2D;IACpE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,gEAAgE;QAChE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,KAAK,IAAI,QAAQ,IAAI,SAAS,CAAC;QAClD,OAAO,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,cAAc,EAAE;IACvE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;IACnC,GAAG,EAAE,EAAE,EAAE,mCAAmC;IAC5C,OAAO,EAAE,yDAAyD;IAClE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,0CAA0C;QAC1C,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,IAAI,SAAS,CAAC;QAClF,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;CACF,CAAC,CAAC"}

package/lib/plugins/inputValidation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inputValidation.d.ts","sourceRoot":"","sources":["../../src/plugins/inputValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA6DtC,MAAM,WAAW,sBAAsB;IAErC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAErD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CA6C/E"}

package/lib/plugins/inputValidation.js

@@ -1,95 +0,0 @@
-import { GraphQLError } from 'graphql';
-// Dangerous patterns to check for
-const DANGEROUS_PATTERNS = [
-    /<script/i, // Script tags
-    /<iframe/i, // Iframes
-    /<object/i, // Object embeds
-    /<embed/i, // Embed tags
-    /<link/i, // Link tags (can load CSS)
-    /javascript:/i, // JavaScript protocol
-    /vbscript:/i, // VBScript protocol
-    /on\w+\s*=/i, // Event handlers (onclick, onload, etc)
-    /<meta/i, // Meta tags
-    /data:text\/html/i, // Data URLs with HTML
-    /<svg.*onload/i, // SVG with event handlers
-    /&#x?[0-9a-f]+;/i, // HTML entities (could be obfuscation)
-    /\\u[0-9a-f]{4}/i, // Unicode escapes
-    /expression\s*\(/i, // CSS expressions
-    /@import/i, // CSS imports
-    /<!--|-->/, // HTML comments
-];
-function checkForDangerousContent(value, path) {
-    for (const dangerous of DANGEROUS_PATTERNS) {
-        if (dangerous.test(value)) {
-            throw new GraphQLError(`Potentially dangerous content detected in ${path}`, {
-                extensions: {
-                    code: 'DANGEROUS_INPUT',
-                    path,
-                },
-            });
-        }
-    }
-}
-function validateValue(value, path = '') {
-    if (value === null || value === undefined) {
-        return value;
-    }
-    if (typeof value === 'string') {
-        checkForDangerousContent(value, path);
-        return value;
-    }
-    if (Array.isArray(value)) {
-        return value.map((item, index) => validateValue(item, `${path}[${index}]`));
-    }
-    if (typeof value === 'object') {
-        const validated = {};
-        for (const [key, val] of Object.entries(value)) {
-            validated[key] = validateValue(val, path ? `${path}.${key}` : key);
-        }
-        return validated;
-    }
-    return value;
-}
-export function useInputValidation(options = {}) {
-    const { skipOperations = [], skipFields = [], customValidator, logErrors = false } = options;
-    return {
-        onParams({ params, setParams }) {
-            // Get operation name from the request
-            const operationName = params.operationName || '';
-            // Skip if operation is in skip list
-            if (operationName && skipOperations.includes(operationName)) {
-                return;
-            }
-            try {
-                // Validate variables
-                if (params.variables) {
-                    const validatedVariables = {};
-                    for (const [key, value] of Object.entries(params.variables)) {
-                        if (!skipFields.includes(key)) {
-                            validatedVariables[key] = validateValue(value, `variables.${key}`);
-                            // Run custom validator if provided
-                            if (customValidator) {
-                                customValidator(value, `variables.${key}`);
-                            }
-                        }
-                        else {
-                            validatedVariables[key] = value;
-                        }
-                    }
-                    // Update params with validated variables
-                    setParams({
-                        ...params,
-                        variables: validatedVariables,
-                    });
-                }
-            }
-            catch (error) {
-                if (logErrors) {
-                    console.error('Input validation error:', error);
-                }
-                throw error;
-            }
-        },
-    };
-}
-//# sourceMappingURL=inputValidation.js.map

package/lib/plugins/inputValidation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"inputValidation.js","sourceRoot":"","sources":["../../src/plugins/inputValidation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,kCAAkC;AAClC,MAAM,kBAAkB,GAAG;IACzB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,gBAAgB;IAC5B,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,2BAA2B;IACrC,cAAc,EAAE,sBAAsB;IACtC,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,wCAAwC;IACtD,QAAQ,EAAE,YAAY;IACtB,kBAAkB,EAAE,sBAAsB;IAC1C,eAAe,EAAE,0BAA0B;IAC3C,iBAAiB,EAAE,uCAAuC;IAC1D,iBAAiB,EAAE,kBAAkB;IACrC,kBAAkB,EAAE,kBAAkB;IACtC,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,gBAAgB;CAC7B,CAAC;AAEF,SAAS,wBAAwB,CAAC,KAAa,EAAE,IAAY;IAC3D,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CAAC,6CAA6C,IAAI,EAAE,EAAE;gBAC1E,UAAU,EAAE;oBACV,IAAI,EAAE,iBAAiB;oBACvB,IAAI;iBACL;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAU,EAAE,IAAI,GAAG,EAAE;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAaD,MAAM,UAAU,kBAAkB,CAAC,UAAkC,EAAE;IACrE,MAAM,EAAE,cAAc,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,eAAe,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE7F,OAAO;QACL,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE;YAC5B,sCAAsC;YACtC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;YAEjD,oCAAoC;YACpC,IAAI,aAAa,IAAI,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,qBAAqB;gBACrB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,kBAAkB,GAAQ,EAAE,CAAC;oBAEnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC9B,kBAAkB,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;4BAEnE,mCAAmC;4BACnC,IAAI,eAAe,EAAE,CAAC;gCACpB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;4BAC7C,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,kBAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBAClC,CAAC;oBACH,CAAC;oBAED,yCAAyC;oBACzC,SAAS,CAAC;wBACR,GAAG,MAAM;wBACT,SAAS,EAAE,kBAAkB;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAClD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/utils/inputValidation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inputValidation.d.ts","sourceRoot":"","sources":["../../src/utils/inputValidation.ts"],"names":[],"mappings":"AAuBA,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAU5D;AAGD,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,SAAK,GAAG,GAAG,CAmBvD"}

package/lib/utils/inputValidation.js

@@ -1,51 +0,0 @@
-import { GraphQLError } from 'graphql';
-// Dangerous patterns to check for
-const DANGEROUS_PATTERNS = [
-    /<script/i, // Script tags
-    /<iframe/i, // Iframes
-    /<object/i, // Object embeds
-    /<embed/i, // Embed tags
-    /<link/i, // Link tags (can load CSS)
-    /javascript:/i, // JavaScript protocol
-    /vbscript:/i, // VBScript protocol
-    /on\w+\s*=/i, // Event handlers (onclick, onload, etc)
-    /<meta/i, // Meta tags
-    /data:text\/html/i, // Data URLs with HTML
-    /<svg.*onload/i, // SVG with event handlers
-    /&#x?[0-9a-f]+;/i, // HTML entities (could be obfuscation)
-    /\\u[0-9a-f]{4}/i, // Unicode escapes
-    /expression\s*\(/i, // CSS expressions
-    /@import/i, // CSS imports
-    /<!--|-->/, // HTML comments
-];
-// Check for dangerous patterns in any string
-export function checkForDangerousContent(value) {
-    if (!value)
-        return;
-    for (const dangerous of DANGEROUS_PATTERNS) {
-        if (dangerous.test(value)) {
-            throw new GraphQLError('Input contains potentially dangerous content', {
-                extensions: { code: 'SECURITY_VALIDATION_ERROR' },
-            });
-        }
-    }
-}
-// Validate an entire object recursively
-export function validateObject(obj, path = '') {
-    if (typeof obj === 'string') {
-        checkForDangerousContent(obj);
-        return obj;
-    }
-    if (Array.isArray(obj)) {
-        return obj.map((item, index) => validateObject(item, `${path}[${index}]`));
-    }
-    if (obj && typeof obj === 'object') {
-        const validated = {};
-        for (const [key, value] of Object.entries(obj)) {
-            validated[key] = validateObject(value, path ? `${path}.${key}` : key);
-        }
-        return validated;
-    }
-    return obj;
-}
-//# sourceMappingURL=inputValidation.js.map

package/lib/utils/inputValidation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"inputValidation.js","sourceRoot":"","sources":["../../src/utils/inputValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,kCAAkC;AAClC,MAAM,kBAAkB,GAAG;IACzB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,gBAAgB;IAC5B,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,2BAA2B;IACrC,cAAc,EAAE,sBAAsB;IACtC,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,wCAAwC;IACtD,QAAQ,EAAE,YAAY;IACtB,kBAAkB,EAAE,sBAAsB;IAC1C,eAAe,EAAE,0BAA0B;IAC3C,iBAAiB,EAAE,uCAAuC;IAC1D,iBAAiB,EAAE,kBAAkB;IACrC,kBAAkB,EAAE,kBAAkB;IACtC,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,gBAAgB;CAC7B,CAAC;AAEF,6CAA6C;AAC7C,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CAAC,8CAA8C,EAAE;gBACrE,UAAU,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,cAAc,CAAC,GAAQ,EAAE,IAAI,GAAG,EAAE;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}