@vistagenic/vista 0.3.0 → 0.3.3

package/dist/server/middleware-security.d.ts

@@ -1,36 +1,36 @@
-/**
- * Middleware security primitives.
- *
- * These are Next-inspired helpers that apps can compose in `middleware.ts`.
- * The runner also uses the redirect/header sanitizers internally.
- */
-export declare const FORBIDDEN_REQUEST_HEADERS: Set<string>;
-export declare function isForbiddenRequestHeader(name: string): boolean;
-export declare function sanitizeRequestHeaderMap(headers: Map<string, string> | Headers | Record<string, string>): Map<string, string>;
-export declare function isSafeRedirectLocation(location: string, requestUrl: string, allowedHosts?: string[]): boolean;
-export declare function isSafeRewriteLocation(location: string): boolean;
-export declare function securityHeaders(init?: ResponseInit): Headers;
-export declare function cors(options?: {
-    origin?: string | string[] | '*';
-    methods?: string[];
-    headers?: string[];
-    credentials?: boolean;
-    maxAge?: number;
-}): (request: Request) => Headers;
-export declare function rateLimit(options?: {
-    key?: string;
-    limit?: number;
-    windowMs?: number;
-    identifier?: (request: {
-        headers: Headers;
-        ip?: string;
-    }) => string;
-}): (request: {
-    headers: Headers;
-    ip?: string;
-}) => {
-    ok: boolean;
-    remaining: number;
-};
-export type MiddlewareLike = (context: any) => Promise<Response | void> | Response | void;
-export declare function chain(middlewares: MiddlewareLike[]): MiddlewareLike;
+/**
+ * Middleware security primitives.
+ *
+ * These are Next-inspired helpers that apps can compose in `middleware.ts`.
+ * The runner also uses the redirect/header sanitizers internally.
+ */
+export declare const FORBIDDEN_REQUEST_HEADERS: Set<string>;
+export declare function isForbiddenRequestHeader(name: string): boolean;
+export declare function sanitizeRequestHeaderMap(headers: Map<string, string> | Headers | Record<string, string>): Map<string, string>;
+export declare function isSafeRedirectLocation(location: string, requestUrl: string, allowedHosts?: string[]): boolean;
+export declare function isSafeRewriteLocation(location: string): boolean;
+export declare function securityHeaders(init?: ResponseInit): Headers;
+export declare function cors(options?: {
+    origin?: string | string[] | '*';
+    methods?: string[];
+    headers?: string[];
+    credentials?: boolean;
+    maxAge?: number;
+}): (request: Request) => Headers;
+export declare function rateLimit(options?: {
+    key?: string;
+    limit?: number;
+    windowMs?: number;
+    identifier?: (request: {
+        headers: Headers;
+        ip?: string;
+    }) => string;
+}): (request: {
+    headers: Headers;
+    ip?: string;
+}) => {
+    ok: boolean;
+    remaining: number;
+};
+export type MiddlewareLike = (context: any) => Promise<Response | void> | Response | void;
+export declare function chain(middlewares: MiddlewareLike[]): MiddlewareLike;

package/dist/server/middleware-security.js

@@ -1,183 +1,183 @@
-"use strict";
-/**
- * Middleware security primitives.
- *
- * These are Next-inspired helpers that apps can compose in `middleware.ts`.
- * The runner also uses the redirect/header sanitizers internally.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FORBIDDEN_REQUEST_HEADERS = void 0;
-exports.isForbiddenRequestHeader = isForbiddenRequestHeader;
-exports.sanitizeRequestHeaderMap = sanitizeRequestHeaderMap;
-exports.isSafeRedirectLocation = isSafeRedirectLocation;
-exports.isSafeRewriteLocation = isSafeRewriteLocation;
-exports.securityHeaders = securityHeaders;
-exports.cors = cors;
-exports.rateLimit = rateLimit;
-exports.chain = chain;
-exports.FORBIDDEN_REQUEST_HEADERS = new Set([
-    'host',
-    'cookie',
-    'content-length',
-    'content-type',
-    'transfer-encoding',
-    'x-forwarded-for',
-    'x-forwarded-host',
-    'x-forwarded-proto',
-    'x-forwarded-port',
-    'x-real-ip',
-    'x-middleware-next',
-    'x-middleware-rewrite',
-]);
-function isForbiddenRequestHeader(name) {
-    return exports.FORBIDDEN_REQUEST_HEADERS.has(name.toLowerCase());
-}
-function sanitizeRequestHeaderMap(headers) {
-    const sanitized = new Map();
-    const append = (key, value) => {
-        if (!isForbiddenRequestHeader(key)) {
-            sanitized.set(key.toLowerCase(), value);
-        }
-    };
-    if (headers instanceof Map) {
-        headers.forEach((value, key) => append(key, value));
-    }
-    else if (typeof headers.forEach === 'function' && !Array.isArray(headers)) {
-        headers.forEach((value, key) => append(key, value));
-    }
-    else {
-        for (const [key, value] of Object.entries(headers)) {
-            append(key, value);
-        }
-    }
-    return sanitized;
-}
-function isSafeRedirectLocation(location, requestUrl, allowedHosts = []) {
-    const trimmed = String(location || '').trim();
-    if (!trimmed)
-        return false;
-    if (trimmed.startsWith('/') && !trimmed.startsWith('//') && !trimmed.startsWith('/\\')) {
-        return !trimmed.includes('://');
-    }
-    try {
-        const base = new URL(requestUrl);
-        const target = new URL(trimmed, base);
-        if (target.origin === base.origin) {
-            return true;
-        }
-        const allowed = new Set(allowedHosts.map((host) => host.toLowerCase()));
-        return allowed.has(target.host.toLowerCase());
-    }
-    catch {
-        return false;
-    }
-}
-function isSafeRewriteLocation(location) {
-    const trimmed = String(location || '').trim();
-    if (!trimmed)
-        return false;
-    if (trimmed.startsWith('/') && !trimmed.startsWith('//') && !trimmed.startsWith('/\\')) {
-        return !trimmed.includes('://');
-    }
-    return false;
-}
-function securityHeaders(init = {}) {
-    const headers = new Headers(init.headers);
-    if (!headers.has('X-Content-Type-Options'))
-        headers.set('X-Content-Type-Options', 'nosniff');
-    if (!headers.has('X-Frame-Options'))
-        headers.set('X-Frame-Options', 'DENY');
-    if (!headers.has('Referrer-Policy'))
-        headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-    if (!headers.has('X-DNS-Prefetch-Control'))
-        headers.set('X-DNS-Prefetch-Control', 'off');
-    if (!headers.has('Permissions-Policy')) {
-        headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
-    }
-    if (process.env.NODE_ENV === 'production' && !headers.has('Strict-Transport-Security')) {
-        headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-    }
-    return headers;
-}
-function cors(options = {}) {
-    const origin = options.origin ?? '*';
-    const methods = (options.methods ?? ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']).join(', ');
-    const allowHeaders = (options.headers ?? ['Content-Type', 'Authorization']).join(', ');
-    return (request) => {
-        const headers = new Headers();
-        const requestOrigin = request.headers.get('origin');
-        if (origin === '*') {
-            headers.set('Access-Control-Allow-Origin', '*');
-        }
-        else if (Array.isArray(origin)) {
-            if (requestOrigin && origin.includes(requestOrigin)) {
-                headers.set('Access-Control-Allow-Origin', requestOrigin);
-                headers.set('Vary', 'Origin');
-            }
-        }
-        else if (origin) {
-            headers.set('Access-Control-Allow-Origin', origin);
-        }
-        headers.set('Access-Control-Allow-Methods', methods);
-        headers.set('Access-Control-Allow-Headers', allowHeaders);
-        if (options.credentials) {
-            headers.set('Access-Control-Allow-Credentials', 'true');
-        }
-        if (options.maxAge != null) {
-            headers.set('Access-Control-Max-Age', String(options.maxAge));
-        }
-        return headers;
-    };
-}
-const rateLimitStores = new Map();
-function rateLimit(options = {}) {
-    const limit = options.limit ?? 60;
-    const windowMs = options.windowMs ?? 60_000;
-    const storeKey = options.key ?? 'default';
-    if (!rateLimitStores.has(storeKey)) {
-        rateLimitStores.set(storeKey, new Map());
-    }
-    const store = rateLimitStores.get(storeKey);
-    return (request) => {
-        const identifier = options.identifier?.(request) ||
-            request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ||
-            request.ip ||
-            'anonymous';
-        const now = Date.now();
-        const bucket = store.get(identifier) || { tokens: limit, updatedAt: now };
-        const elapsed = now - bucket.updatedAt;
-        const refill = (elapsed / windowMs) * limit;
-        bucket.tokens = Math.min(limit, bucket.tokens + refill);
-        bucket.updatedAt = now;
-        if (bucket.tokens < 1) {
-            store.set(identifier, bucket);
-            return { ok: false, remaining: 0 };
-        }
-        bucket.tokens -= 1;
-        store.set(identifier, bucket);
-        return { ok: true, remaining: Math.floor(bucket.tokens) };
-    };
-}
-function chain(middlewares) {
-    return async (context) => {
-        const originalNext = context.next;
-        let index = -1;
-        const dispatch = async (current) => {
-            if (current <= index) {
-                throw new Error('next() called multiple times');
-            }
-            index = current;
-            const fn = middlewares[current];
-            if (!fn) {
-                return originalNext();
-            }
-            const next = async () => dispatch(current + 1);
-            const result = await fn({ ...context, next });
-            if (result instanceof Response) {
-                return result;
-            }
-            return next();
-        };
-        return dispatch(0);
-    };
-}
+"use strict";
+/**
+ * Middleware security primitives.
+ *
+ * These are Next-inspired helpers that apps can compose in `middleware.ts`.
+ * The runner also uses the redirect/header sanitizers internally.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FORBIDDEN_REQUEST_HEADERS = void 0;
+exports.isForbiddenRequestHeader = isForbiddenRequestHeader;
+exports.sanitizeRequestHeaderMap = sanitizeRequestHeaderMap;
+exports.isSafeRedirectLocation = isSafeRedirectLocation;
+exports.isSafeRewriteLocation = isSafeRewriteLocation;
+exports.securityHeaders = securityHeaders;
+exports.cors = cors;
+exports.rateLimit = rateLimit;
+exports.chain = chain;
+exports.FORBIDDEN_REQUEST_HEADERS = new Set([
+    'host',
+    'cookie',
+    'content-length',
+    'content-type',
+    'transfer-encoding',
+    'x-forwarded-for',
+    'x-forwarded-host',
+    'x-forwarded-proto',
+    'x-forwarded-port',
+    'x-real-ip',
+    'x-middleware-next',
+    'x-middleware-rewrite',
+]);
+function isForbiddenRequestHeader(name) {
+    return exports.FORBIDDEN_REQUEST_HEADERS.has(name.toLowerCase());
+}
+function sanitizeRequestHeaderMap(headers) {
+    const sanitized = new Map();
+    const append = (key, value) => {
+        if (!isForbiddenRequestHeader(key)) {
+            sanitized.set(key.toLowerCase(), value);
+        }
+    };
+    if (headers instanceof Map) {
+        headers.forEach((value, key) => append(key, value));
+    }
+    else if (typeof headers.forEach === 'function' && !Array.isArray(headers)) {
+        headers.forEach((value, key) => append(key, value));
+    }
+    else {
+        for (const [key, value] of Object.entries(headers)) {
+            append(key, value);
+        }
+    }
+    return sanitized;
+}
+function isSafeRedirectLocation(location, requestUrl, allowedHosts = []) {
+    const trimmed = String(location || '').trim();
+    if (!trimmed)
+        return false;
+    if (trimmed.startsWith('/') && !trimmed.startsWith('//') && !trimmed.startsWith('/\\')) {
+        return !trimmed.includes('://');
+    }
+    try {
+        const base = new URL(requestUrl);
+        const target = new URL(trimmed, base);
+        if (target.origin === base.origin) {
+            return true;
+        }
+        const allowed = new Set(allowedHosts.map((host) => host.toLowerCase()));
+        return allowed.has(target.host.toLowerCase());
+    }
+    catch {
+        return false;
+    }
+}
+function isSafeRewriteLocation(location) {
+    const trimmed = String(location || '').trim();
+    if (!trimmed)
+        return false;
+    if (trimmed.startsWith('/') && !trimmed.startsWith('//') && !trimmed.startsWith('/\\')) {
+        return !trimmed.includes('://');
+    }
+    return false;
+}
+function securityHeaders(init = {}) {
+    const headers = new Headers(init.headers);
+    if (!headers.has('X-Content-Type-Options'))
+        headers.set('X-Content-Type-Options', 'nosniff');
+    if (!headers.has('X-Frame-Options'))
+        headers.set('X-Frame-Options', 'DENY');
+    if (!headers.has('Referrer-Policy'))
+        headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+    if (!headers.has('X-DNS-Prefetch-Control'))
+        headers.set('X-DNS-Prefetch-Control', 'off');
+    if (!headers.has('Permissions-Policy')) {
+        headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+    }
+    if (process.env.NODE_ENV === 'production' && !headers.has('Strict-Transport-Security')) {
+        headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+    }
+    return headers;
+}
+function cors(options = {}) {
+    const origin = options.origin ?? '*';
+    const methods = (options.methods ?? ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']).join(', ');
+    const allowHeaders = (options.headers ?? ['Content-Type', 'Authorization']).join(', ');
+    return (request) => {
+        const headers = new Headers();
+        const requestOrigin = request.headers.get('origin');
+        if (origin === '*') {
+            headers.set('Access-Control-Allow-Origin', '*');
+        }
+        else if (Array.isArray(origin)) {
+            if (requestOrigin && origin.includes(requestOrigin)) {
+                headers.set('Access-Control-Allow-Origin', requestOrigin);
+                headers.set('Vary', 'Origin');
+            }
+        }
+        else if (origin) {
+            headers.set('Access-Control-Allow-Origin', origin);
+        }
+        headers.set('Access-Control-Allow-Methods', methods);
+        headers.set('Access-Control-Allow-Headers', allowHeaders);
+        if (options.credentials) {
+            headers.set('Access-Control-Allow-Credentials', 'true');
+        }
+        if (options.maxAge != null) {
+            headers.set('Access-Control-Max-Age', String(options.maxAge));
+        }
+        return headers;
+    };
+}
+const rateLimitStores = new Map();
+function rateLimit(options = {}) {
+    const limit = options.limit ?? 60;
+    const windowMs = options.windowMs ?? 60_000;
+    const storeKey = options.key ?? 'default';
+    if (!rateLimitStores.has(storeKey)) {
+        rateLimitStores.set(storeKey, new Map());
+    }
+    const store = rateLimitStores.get(storeKey);
+    return (request) => {
+        const identifier = options.identifier?.(request) ||
+            request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ||
+            request.ip ||
+            'anonymous';
+        const now = Date.now();
+        const bucket = store.get(identifier) || { tokens: limit, updatedAt: now };
+        const elapsed = now - bucket.updatedAt;
+        const refill = (elapsed / windowMs) * limit;
+        bucket.tokens = Math.min(limit, bucket.tokens + refill);
+        bucket.updatedAt = now;
+        if (bucket.tokens < 1) {
+            store.set(identifier, bucket);
+            return { ok: false, remaining: 0 };
+        }
+        bucket.tokens -= 1;
+        store.set(identifier, bucket);
+        return { ok: true, remaining: Math.floor(bucket.tokens) };
+    };
+}
+function chain(middlewares) {
+    return async (context) => {
+        const originalNext = context.next;
+        let index = -1;
+        const dispatch = async (current) => {
+            if (current <= index) {
+                throw new Error('next() called multiple times');
+            }
+            index = current;
+            const fn = middlewares[current];
+            if (!fn) {
+                return originalNext();
+            }
+            const next = async () => dispatch(current + 1);
+            const result = await fn({ ...context, next });
+            if (result instanceof Response) {
+                return result;
+            }
+            return next();
+        };
+        return dispatch(0);
+    };
+}