@withwiz/toolkit 0.3.1 → 0.3.2

package/dist/auth/core/jwt/index.js

@@ -1,7 +1,7 @@
 import {
   JWTManager,
   JWTService
-} from "../../../chunk-2ATBAIRL.js";
+} from "../../../chunk-R6YVUU6I.js";
 import "../../../chunk-AIH3F7JV.js";
 import "../../../chunk-ORMEWXMH.js";
 export {

package/dist/auth/index.js

@@ -1,9 +1,6 @@
 import {
   TokenGenerator
 } from "../chunk-GDWEDUHO.js";
-import {
-  OAuthManager
-} from "../chunk-V5K5FYU7.js";
 import {
   JWTClientManager,
   clearStoredTokens,
@@ -20,6 +17,9 @@ import {
   isTokenExpiringSoon,
   storeTokens
 } from "../chunk-XRRPEBKB.js";
+import {
+  OAuthManager
+} from "../chunk-V5K5FYU7.js";
 import {
   DEFAULT_PASSWORD_CONFIG,
   createPasswordHasher,
@@ -44,7 +44,7 @@ import {
 import {
   JWTManager,
   JWTService
-} from "../chunk-2ATBAIRL.js";
+} from "../chunk-R6YVUU6I.js";
 import {
   AUTH_ERROR_CODES,
   AuthError,

package/dist/{chunk-BDY3AOX5.js → chunk-A6V6XVPZ.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-OZE5KUS3.js";
 import {
   JWTManager
-} from "./chunk-2ATBAIRL.js";
+} from "./chunk-R6YVUU6I.js";
 import {
   logger
 } from "./chunk-GQVBWZLH.js";

package/dist/{chunk-JR7GVCQX.js → chunk-BKJPYZYO.js}

@@ -1,12 +1,12 @@
 import {
   AUTH_ERROR_CODE_MAP
 } from "./chunk-2KDLKHTO.js";
-import {
-  getErrorMessage
-} from "./chunk-Y2JYA2AR.js";
 import {
   AppError
 } from "./chunk-KXXROUA5.js";
+import {
+  getErrorMessage
+} from "./chunk-Y2JYA2AR.js";
 import {
   ERROR_CODES,
   classifyError
@@ -28,7 +28,7 @@ import {
 import { NextResponse } from "next/server";
 import { z } from "zod";
 var errorHandlerMiddleware = async (context, next) => {
-  var _a, _b;
+  var _a;
   try {
     return await next();
   } catch (error) {
@@ -75,7 +75,11 @@ var errorHandlerMiddleware = async (context, next) => {
       );
     }
     const classified = error instanceof Error ? classifyError(error) : ERROR_CODES.INTERNAL_SERVER_ERROR;
-    logger.error("[ErrorHandler] Unexpected error:", error);
+    logger.error("[ErrorHandler] Unexpected error:", {
+      error,
+      requestId: context.requestId,
+      stack: error instanceof Error ? error.stack : void 0
+    });
     let isProduction = false;
     try {
       isProduction = getCommonConfig().nodeEnv === "production";
@@ -87,8 +91,7 @@ var errorHandlerMiddleware = async (context, next) => {
       classified.code,
       safeMessage,
       context.locale,
-      context.requestId,
-      !isProduction && error instanceof Error ? { stack: (_b = error.stack) == null ? void 0 : _b.split("\n").slice(0, 5) } : void 0
+      context.requestId
     );
   }
 };

package/dist/{chunk-SR65BF6X.js → chunk-N54KGJPU.js}

@@ -7,7 +7,15 @@ function sanitizeHtml(input) {
   if (!input || typeof input !== "string") {
     return "";
   }
-  return input.replace(/<[^>]*>/g, "").replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/<[^>]*>/g, "").replace(/&amp;/gi, "&").replace(/&quot;/gi, '"').replace(/&#x27;/gi, "'").replace(/&#x2F;/gi, "/").trim();
+  let result = input;
+  result = result.replace(/<[^>]*>/g, "");
+  result = result.replace(/&lt;/gi, "<").replace(/&gt;/gi, ">");
+  result = result.replace(/<[^>]*>/g, "");
+  result = result.replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(Number(dec))).replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+  result = result.replace(/<[^>]*>/g, "");
+  result = result.replace(/<[^>]*$/g, "");
+  result = result.replace(/&amp;/gi, "&").replace(/&quot;/gi, '"').replace(/&#x27;/gi, "'").replace(/&#x2F;/gi, "/");
+  return result.trim();
 }
 function removeEventHandlers(input) {
   if (!input || typeof input !== "string") {

package/dist/{chunk-LD7POV6B.js → chunk-NQS7UT6X.js}

@@ -17,13 +17,13 @@ import {
   adminMiddleware,
   authMiddleware,
   optionalAuthMiddleware
-} from "./chunk-BDY3AOX5.js";
+} from "./chunk-A6V6XVPZ.js";
 import {
   corsMiddleware
 } from "./chunk-KGHWGLED.js";
 import {
   errorHandlerMiddleware
-} from "./chunk-JR7GVCQX.js";
+} from "./chunk-BKJPYZYO.js";
 
 // src/middleware/wrappers.ts
 function withPublicApi(handler) {

package/dist/{chunk-2ATBAIRL.js → chunk-R6YVUU6I.js}

@@ -25,7 +25,7 @@ var JWTManager = class {
       });
       return jwt;
     } catch (error) {
-      this.logger.error("Failed to create access token", { error, payload });
+      this.logger.error("Failed to create access token", { error, userId: payload.userId });
       throw new JWTError(
         "Access token creation failed",
         "TOKEN_CREATION_FAILED"

package/dist/constants/index.js

@@ -1,14 +1,3 @@
-import {
-  API_KEY,
-  CSRF,
-  EMAIL_VERIFICATION,
-  JWT_DEFAULTS,
-  MAGIC_LINK,
-  OAUTH,
-  PASSWORD_RESET,
-  SECURITY_HEADERS,
-  SESSION
-} from "../chunk-JLLMTTQ4.js";
 import {
   DATE,
   FILE_UPLOAD,
@@ -18,19 +7,6 @@ import {
   URL,
   USER_INPUT
 } from "../chunk-LNV2E4I6.js";
-import {
-  GENERIC_CONFIRM_MESSAGES,
-  GENERIC_ERROR_MESSAGES,
-  GENERIC_INFO_MESSAGES,
-  GENERIC_SUCCESS_MESSAGES
-} from "../chunk-2TO7WUKK.js";
-import {
-  DATE_RANGE,
-  FILTER_OPTIONS,
-  PAGE_SIZES,
-  PAGINATION,
-  SORT_OPTIONS
-} from "../chunk-VDXB5DCY.js";
 import {
   ERROR_CODES,
   HTTP_STATUS,
@@ -45,6 +21,30 @@ import {
   getHttpStatus,
   getLogLevel
 } from "../chunk-SNVGJPPX.js";
+import {
+  GENERIC_CONFIRM_MESSAGES,
+  GENERIC_ERROR_MESSAGES,
+  GENERIC_INFO_MESSAGES,
+  GENERIC_SUCCESS_MESSAGES
+} from "../chunk-2TO7WUKK.js";
+import {
+  DATE_RANGE,
+  FILTER_OPTIONS,
+  PAGE_SIZES,
+  PAGINATION,
+  SORT_OPTIONS
+} from "../chunk-VDXB5DCY.js";
+import {
+  API_KEY,
+  CSRF,
+  EMAIL_VERIFICATION,
+  JWT_DEFAULTS,
+  MAGIC_LINK,
+  OAUTH,
+  PASSWORD_RESET,
+  SECURITY_HEADERS,
+  SESSION
+} from "../chunk-JLLMTTQ4.js";
 import "../chunk-ORMEWXMH.js";
 export {
   API_KEY,

package/dist/error/error-display.js

@@ -5,7 +5,8 @@ import {
   getErrorIcon,
   handleApiResponse,
   showFriendlyError
-} from "../chunk-IJCVFLEY.js";
+} from "../chunk-TQJDNWBL.js";
+import "../chunk-KXXROUA5.js";
 import {
   getErrorDisplayInfo,
   getFriendlyMessage
@@ -13,7 +14,6 @@ import {
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-ORMEWXMH.js";
 export {

package/dist/error/index.js

@@ -1,6 +1,14 @@
 import {
   LocaleDetector
 } from "../chunk-XHZ5L4FO.js";
+import {
+  extractErrorInfo,
+  formatInlineError,
+  getDefaultErrorCode,
+  getErrorIcon,
+  handleApiResponse,
+  showFriendlyError
+} from "../chunk-TQJDNWBL.js";
 import {
   AUTH_ERROR_CODE_MAP,
   ErrorResponse,
@@ -9,13 +17,8 @@ import {
   withErrorHandler
 } from "../chunk-2KDLKHTO.js";
 import {
-  extractErrorInfo,
-  formatInlineError,
-  getDefaultErrorCode,
-  getErrorIcon,
-  handleApiResponse,
-  showFriendlyError
-} from "../chunk-IJCVFLEY.js";
+  AppError
+} from "../chunk-KXXROUA5.js";
 import {
   formatFriendlyError,
   getErrorDisplayInfo,
@@ -30,9 +33,6 @@ import {
 } from "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import {
-  AppError
-} from "../chunk-KXXROUA5.js";
 import {
   ERROR_CODES,
   HTTP_STATUS,

package/dist/middleware/auth.js

@@ -4,11 +4,11 @@ import {
   initializeAuthMiddleware,
   optionalAuthMiddleware,
   setAccessTokenBlacklistChecker
-} from "../chunk-BDY3AOX5.js";
+} from "../chunk-A6V6XVPZ.js";
 import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-2ATBAIRL.js";
+import "../chunk-R6YVUU6I.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";

package/dist/middleware/error-handler.js

@@ -1,11 +1,11 @@
 import {
   errorHandlerMiddleware
-} from "../chunk-JR7GVCQX.js";
+} from "../chunk-BKJPYZYO.js";
 import "../chunk-2KDLKHTO.js";
+import "../chunk-KXXROUA5.js";
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";

package/dist/middleware/index.js

@@ -4,7 +4,7 @@ import {
   withCustomApi,
   withOptionalAuthApi,
   withPublicApi
-} from "../chunk-LD7POV6B.js";
+} from "../chunk-NQS7UT6X.js";
 import {
   initRequestMiddleware
 } from "../chunk-62Q7DN5G.js";
@@ -29,24 +29,24 @@ import {
   initializeAuthMiddleware,
   optionalAuthMiddleware,
   setAccessTokenBlacklistChecker
-} from "../chunk-BDY3AOX5.js";
+} from "../chunk-A6V6XVPZ.js";
 import {
   corsMiddleware,
   validateCorsConfiguration
 } from "../chunk-KGHWGLED.js";
 import {
   errorHandlerMiddleware
-} from "../chunk-JR7GVCQX.js";
+} from "../chunk-BKJPYZYO.js";
 import "../chunk-XHZ5L4FO.js";
 import "../chunk-2KDLKHTO.js";
+import "../chunk-KXXROUA5.js";
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-GFWGLWTS.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-2ATBAIRL.js";
+import "../chunk-R6YVUU6I.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";

package/dist/middleware/wrappers.js

@@ -4,25 +4,25 @@ import {
   withCustomApi,
   withOptionalAuthApi,
   withPublicApi
-} from "../chunk-LD7POV6B.js";
+} from "../chunk-NQS7UT6X.js";
 import "../chunk-62Q7DN5G.js";
 import "../chunk-FPESPW6P.js";
 import "../chunk-6MI4XLWC.js";
 import "../chunk-OIRAH57Y.js";
 import "../chunk-QVWDWROP.js";
-import "../chunk-BDY3AOX5.js";
+import "../chunk-A6V6XVPZ.js";
 import "../chunk-KGHWGLED.js";
-import "../chunk-JR7GVCQX.js";
+import "../chunk-BKJPYZYO.js";
 import "../chunk-XHZ5L4FO.js";
 import "../chunk-2KDLKHTO.js";
+import "../chunk-KXXROUA5.js";
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-GFWGLWTS.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-2ATBAIRL.js";
+import "../chunk-R6YVUU6I.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";

package/dist/utils/index.js

@@ -5,7 +5,7 @@ import {
   sanitizeInput,
   sanitizeObjectFields,
   sanitizeUrl
-} from "../chunk-SR65BF6X.js";
+} from "../chunk-N54KGJPU.js";
 import {
   isApiErrorResponse,
   isApiSuccessResponse,

package/dist/utils/ip-utils.d.ts

@@ -4,12 +4,15 @@ export declare function normalizeIP(ip: string): string;
 /**
  * 클라이언트 IP 주소 추출 (서버에서만 사용)
  *
- * Cloudflare 환경 최적화:
- * 1. CF-Connecting-IP: Cloudflare가 설정하는 실제 클라이언트 IP (가장 신뢰)
- * 2. True-Client-IP: Cloudflare Enterprise에서 사용
- * 3. X-Real-IP: Nginx 등 신뢰할 수 있는 리버스 프록시
- * 4. X-Forwarded-For: 첫 번째 IP가 실제 클라이언트 (Cloudflare가 추가)
- * 5. X-Client-IP: 일부 프록시에서 사용
+ * 신뢰 가능한 프록시 헤더만 사용:
+ * 1. CF-Connecting-IP: Cloudflare Proxy가 강제 설정 (스푸핑 불가)
+ * 2. True-Client-IP: Cloudflare Enterprise에서 설정
+ * 3. X-Forwarded-For: 마지막 IP = 직전 프록시가 추가한 실제 클라이언트 IP
+ *
+ * 보안 참고:
+ * - X-Real-IP, X-Client-IP 등 클라이언트가 임의 설정 가능한 헤더는 사용하지 않음
+ * - X-Forwarded-For의 첫 번째 IP는 클라이언트가 조작 가능하므로 마지막 IP를 사용
+ * - Cloudflare Proxy 환경에서는 CF-Connecting-IP가 항상 설정되므로 폴백에 도달하지 않음
  */
 export declare function extractClientIp(headers: Headers): string | null;
 export declare function isValidIP(ip: string): boolean;

package/dist/utils/ip-utils.js

@@ -54,17 +54,14 @@ function extractClientIp(headers) {
   if (cf && isValidIP(cf.trim())) return cf.trim();
   const trueClientIp = headers.get("true-client-ip");
   if (trueClientIp && isValidIP(trueClientIp.trim())) return trueClientIp.trim();
-  const xri = headers.get("x-real-ip");
-  if (xri && isValidIP(xri.trim())) return xri.trim();
   const xff = headers.get("x-forwarded-for");
   if (xff) {
     const ips = xff.split(",").map((ip) => ip.trim()).filter(Boolean);
-    if (ips.length > 0 && isValidIP(ips[0])) {
-      return ips[0];
+    const lastIp = ips[ips.length - 1];
+    if (lastIp && isValidIP(lastIp)) {
+      return lastIp;
     }
   }
-  const xc = headers.get("x-client-ip");
-  if (xc && isValidIP(xc.trim())) return xc.trim();
   return null;
 }
 function isValidIP(ip) {

package/dist/utils/sanitizer.d.ts

@@ -8,15 +8,16 @@
  */
 /**
  * XSS 방지를 위한 HTML 태그 제거
- * - 모든 HTML 태그 제거
- * - 이스케이프된 HTML 엔티티 처리
+ * - 모든 HTML 태그 제거 (named + numeric 엔티티로 인코딩된 태그 포함)
+ * - 닫는 >가 없는 불완전 태그 제거 (HTML5 파서 우회 방지)
+ * - HTML 엔티티를 디코딩하여 원본 텍스트 반환
  * - 공백 정리
  *
  * @param input - 정제할 문자열
- * @returns 정제된 문자열
+ * @returns 태그가 제거된 순수 텍스트 (React 등 텍스트 컨텍스트에서 사용)
  *
  * @example
- * sanitizeHtml('<script>alert("xss")</script>Hello') // 'Hello'
+ * sanitizeHtml('<script>alert("xss")</script>Hello') // 'alert("xss")Hello'
  * sanitizeHtml('Hello <b>World</b>') // 'Hello World'
  */
 export declare function sanitizeHtml(input: string): string;

package/dist/utils/sanitizer.js

@@ -6,7 +6,7 @@ import {
   sanitizeObjectFields,
   sanitizeUrl,
   sanitizer_default
-} from "../chunk-SR65BF6X.js";
+} from "../chunk-N54KGJPU.js";
 import "../chunk-ORMEWXMH.js";
 export {
   sanitizer_default as default,

package/dist/utils/short-code-generator.d.ts

@@ -1,9 +1,10 @@
 /**
  * 단축 코드 생성 전용 유틸리티
- * 순수 함수로 구현하여 외부 의존성 없음
+ * 암호학적으로 안전한 난수 생성기(CSPRNG) 사용
  */
 /**
  * 기본 단축 코드 생성 함수
+ * crypto.randomBytes를 사용하여 예측 불가능한 코드 생성
  * @param length - 생성할 코드 길이 (기본값: 8)
  * @returns 생성된 단축 코드
  */

package/dist/utils/short-code-generator.js

@@ -1,14 +1,16 @@
 import "../chunk-ORMEWXMH.js";
 
 // src/utils/short-code-generator.ts
+import { randomBytes } from "crypto";
 function generateShortCode(length = 8) {
   if (!Number.isInteger(length) || length <= 0) {
     throw new Error("length must be a positive integer");
   }
   const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  const bytes = randomBytes(length);
   let result = "";
   for (let i = 0; i < length; i++) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
+    result += chars.charAt(bytes[i] % chars.length);
   }
   return result;
 }

package/dist/utils/url-normalizer.js

@@ -39,11 +39,21 @@ var SUPPORTED_SCHEMES = [
   "maps:",
   "geo:"
 ];
+var DANGEROUS_SCHEMES = [
+  "javascript:",
+  "vbscript:",
+  "data:",
+  "file:",
+  "blob:"
+];
 var CUSTOM_SCHEME_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
 function hasValidScheme(url) {
   try {
     const urlObj = new URL(url);
-    const protocol = urlObj.protocol;
+    const protocol = urlObj.protocol.toLowerCase();
+    if (DANGEROUS_SCHEMES.includes(protocol)) {
+      return false;
+    }
     if (SUPPORTED_SCHEMES.includes(protocol)) {
       return true;
     }
@@ -69,6 +79,9 @@ function normalizeUrl(url) {
   }
   const scheme = extractScheme(normalized);
   if (scheme) {
+    if (DANGEROUS_SCHEMES.includes(scheme.toLowerCase() + ":")) {
+      return "";
+    }
     return normalized;
   }
   if (normalized.startsWith("//")) {
@@ -88,6 +101,14 @@ function validateUrl(url, options) {
   try {
     const urlObj = new URL(normalized);
     const protocol = urlObj.protocol;
+    if (DANGEROUS_SCHEMES.includes(protocol.toLowerCase())) {
+      return {
+        isValid: false,
+        message: `\uBCF4\uC548\uC0C1 \uD5C8\uC6A9\uB418\uC9C0 \uC54A\uB294 \uD504\uB85C\uD1A0\uCF5C\uC785\uB2C8\uB2E4: ${protocol}`,
+        messageKey: "unsupportedProtocol",
+        messageParams: { protocol }
+      };
+    }
     const isSupported = SUPPORTED_SCHEMES.includes(protocol);
     const isCustom = CUSTOM_SCHEME_PATTERN.test(normalized);
     if (!isSupported && !isCustom) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withwiz/toolkit",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Shared utility library for withwiz projects",
   "license": "MIT",
   "private": false,

package/dist/{chunk-IJCVFLEY.js → chunk-TQJDNWBL.js}

@@ -1,10 +1,10 @@
+import {
+  AppError
+} from "./chunk-KXXROUA5.js";
 import {
   getErrorDisplayInfo,
   getFriendlyMessage
 } from "./chunk-S54PFAEU.js";
-import {
-  AppError
-} from "./chunk-KXXROUA5.js";
 import {
   getErrorCategory
 } from "./chunk-SNVGJPPX.js";