@unireq/cookies 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Olivier Orabona
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,41 @@
+import { Policy } from '@unireq/core';
+
+/**
+ * @unireq/cookies - Cookie jar integration with tough-cookie and http-cookie-agent/undici
+ * @see https://www.npmjs.com/package/tough-cookie
+ * @see https://www.npmjs.com/package/http-cookie-agent
+ */
+
+/** Cookie jar interface (compatible with tough-cookie) */
+interface CookieJar {
+    getCookieString: (url: string) => Promise<string> | string;
+    setCookie: (cookie: string, url: string) => Promise<void> | void;
+}
+/**
+ * Creates a cookie jar policy
+ * Integrates with tough-cookie CookieJar
+ *
+ * @param jar - Cookie jar instance (tough-cookie CookieJar)
+ * @returns Policy that manages cookies
+ *
+ * @example
+ * ```ts
+ * import { CookieJar } from 'tough-cookie';
+ *
+ * const jar = new CookieJar();
+ * const cookiePolicy = cookieJar(jar);
+ * ```
+ *
+ * Note: For proxy support, use http-cookie-agent with undici:
+ * ```ts
+ * import { CookieJar } from 'tough-cookie';
+ * import { CookieAgent } from 'http-cookie-agent/undici';
+ *
+ * const jar = new CookieJar();
+ * const agent = new CookieAgent({ cookies: { jar } });
+ * // Use agent with fetchTransport or undici
+ * ```
+ */
+declare function cookieJar(jar: CookieJar): Policy;
+
+export { type CookieJar, cookieJar };

package/dist/index.js

@@ -0,0 +1,2 @@
+import {SECURITY_CONFIG}from'@unireq/config';function s(o){return !SECURITY_CONFIG.CRLF_VALIDATION.PATTERN.test(o)}function u(o){return async(e,a)=>{let i=await Promise.resolve(o.getCookieString(e.url));if(i&&!s(i))throw new Error("Invalid cookie value: contains CRLF characters (potential injection attack)");let c=i?{...e,headers:{...e.headers,cookie:i}}:e,r=await a(c),t=r.headers["set-cookie"]||r.headers["Set-Cookie"];if(t){let k=Array.isArray(t)?t:[t];for(let n of k){if(!s(n)){console.warn("Skipping invalid Set-Cookie header: contains CRLF characters (potential injection attack)");continue}await Promise.resolve(o.setCookie(n,e.url));}}return r}}export{u as cookieJar};//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["isValidCookieValue","value","SECURITY_CONFIG","cookieJar","jar","ctx","next","cookies","updatedCtx","response","setCookieHeaders","cookieArray","cookie"],"mappings":"6CAqBA,SAASA,CAAAA,CAAmBC,CAAAA,CAAwB,CAElD,OAAO,CAACC,eAAAA,CAAgB,eAAA,CAAgB,OAAA,CAAQ,IAAA,CAAKD,CAAK,CAC5D,CA2BO,SAASE,CAAAA,CAAUC,CAAAA,CAAwB,CAChD,OAAO,MAAOC,CAAAA,CAAqBC,CAAAA,GAAqD,CAEtF,IAAMC,CAAAA,CAAU,MAAM,OAAA,CAAQ,QAAQH,CAAAA,CAAI,eAAA,CAAgBC,CAAAA,CAAI,GAAG,CAAC,CAAA,CAGlE,GAAIE,CAAAA,EAAW,CAACP,CAAAA,CAAmBO,CAAO,CAAA,CACxC,MAAM,IAAI,KAAA,CAAM,6EAA6E,CAAA,CAI/F,IAAMC,CAAAA,CAAaD,CAAAA,CACf,CACE,GAAGF,CAAAA,CACH,OAAA,CAAS,CACP,GAAGA,CAAAA,CAAI,OAAA,CACP,MAAA,CAAQE,CACV,CACF,CAAA,CACAF,CAAAA,CAGEI,CAAAA,CAAW,MAAMH,CAAAA,CAAKE,CAAU,CAAA,CAGhCE,CAAAA,CAAmBD,CAAAA,CAAS,OAAA,CAAQ,YAAY,CAAA,EAAKA,CAAAA,CAAS,OAAA,CAAQ,YAAY,CAAA,CAExF,GAAIC,CAAAA,CAAkB,CACpB,IAAMC,CAAAA,CAAc,KAAA,CAAM,OAAA,CAAQD,CAAgB,CAAA,CAAIA,CAAAA,CAAmB,CAACA,CAAgB,CAAA,CAE1F,IAAA,IAAWE,KAAUD,CAAAA,CAAa,CAEhC,GAAI,CAACX,CAAAA,CAAmBY,CAAM,CAAA,CAAG,CAC/B,OAAA,CAAQ,IAAA,CAAK,2FAA2F,CAAA,CACxG,QACF,CAEA,MAAM,OAAA,CAAQ,OAAA,CAAQR,CAAAA,CAAI,SAAA,CAAUQ,CAAAA,CAAQP,CAAAA,CAAI,GAAG,CAAC,EACtD,CACF,CAEA,OAAOI,CACT,CACF","file":"index.js","sourcesContent":["/**\n * @unireq/cookies - Cookie jar integration with tough-cookie and http-cookie-agent/undici\n * @see https://www.npmjs.com/package/tough-cookie\n * @see https://www.npmjs.com/package/http-cookie-agent\n */\n\nimport { SECURITY_CONFIG } from '@unireq/config';\nimport type { Policy, RequestContext, Response } from '@unireq/core';\n\n/** Cookie jar interface (compatible with tough-cookie) */\nexport interface CookieJar {\n  getCookieString: (url: string) => Promise<string> | string;\n  setCookie: (cookie: string, url: string) => Promise<void> | void;\n}\n\n/**\n * Validates cookie value for CRLF injection (OWASP A03:2021)\n * @param value - Cookie value to validate\n * @returns True if valid, false if contains CRLF characters\n * @see https://owasp.org/www-community/vulnerabilities/CRLF_Injection\n */\nfunction isValidCookieValue(value: string): boolean {\n  // Reject any cookie value containing CR (\\r) or LF (\\n)\n  return !SECURITY_CONFIG.CRLF_VALIDATION.PATTERN.test(value);\n}\n\n/**\n * Creates a cookie jar policy\n * Integrates with tough-cookie CookieJar\n *\n * @param jar - Cookie jar instance (tough-cookie CookieJar)\n * @returns Policy that manages cookies\n *\n * @example\n * ```ts\n * import { CookieJar } from 'tough-cookie';\n *\n * const jar = new CookieJar();\n * const cookiePolicy = cookieJar(jar);\n * ```\n *\n * Note: For proxy support, use http-cookie-agent with undici:\n * ```ts\n * import { CookieJar } from 'tough-cookie';\n * import { CookieAgent } from 'http-cookie-agent/undici';\n *\n * const jar = new CookieJar();\n * const agent = new CookieAgent({ cookies: { jar } });\n * // Use agent with fetchTransport or undici\n * ```\n */\nexport function cookieJar(jar: CookieJar): Policy {\n  return async (ctx: RequestContext, next: (ctx: RequestContext) => Promise<Response>) => {\n    // Get cookies for this URL\n    const cookies = await Promise.resolve(jar.getCookieString(ctx.url));\n\n    // Validate cookies for CRLF injection\n    if (cookies && !isValidCookieValue(cookies)) {\n      throw new Error('Invalid cookie value: contains CRLF characters (potential injection attack)');\n    }\n\n    // Add cookies to request if present\n    const updatedCtx = cookies\n      ? {\n          ...ctx,\n          headers: {\n            ...ctx.headers,\n            cookie: cookies,\n          },\n        }\n      : ctx;\n\n    // Execute request\n    const response = await next(updatedCtx);\n\n    // Store Set-Cookie headers from response\n    const setCookieHeaders = response.headers['set-cookie'] || response.headers['Set-Cookie'];\n\n    if (setCookieHeaders) {\n      const cookieArray = Array.isArray(setCookieHeaders) ? setCookieHeaders : [setCookieHeaders];\n\n      for (const cookie of cookieArray) {\n        // Validate Set-Cookie header for CRLF injection\n        if (!isValidCookieValue(cookie)) {\n          console.warn('Skipping invalid Set-Cookie header: contains CRLF characters (potential injection attack)');\n          continue;\n        }\n\n        await Promise.resolve(jar.setCookie(cookie, ctx.url));\n      }\n    }\n\n    return response;\n  };\n}\n"]}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@unireq/cookies",
+  "version": "0.0.1",
+  "description": "Cookie jar integration for unireq with tough-cookie and http-cookie-agent",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "author": "Olivier Orabona",
+  "license": "MIT",
+  "dependencies": {
+    "@unireq/core": "0.0.1",
+    "@unireq/config": "0.0.1"
+  },
+  "peerDependencies": {
+    "tough-cookie": "^5.0.0",
+    "http-cookie-agent": "^6.0.6"
+  },
+  "peerDependenciesMeta": {
+    "tough-cookie": {
+      "optional": true
+    },
+    "http-cookie-agent": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "tsup": "^8.5.1"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/oorabona/unireq",
+    "directory": "packages/cookies"
+  },
+  "bugs": {
+    "url": "https://github.com/oorabona/unireq/issues"
+  },
+  "homepage": "https://github.com/oorabona/unireq/tree/main/packages/cookies",
+  "scripts": {
+    "build": "tsup",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  }
+}