@withwiz/toolkit 0.3.1 → 0.3.3

package/dist/auth/core/jwt/cookie.d.ts

@@ -0,0 +1,21 @@
+/**
+ * JWT 토큰을 HttpOnly 쿠키로 설정/삭제하는 유틸리티
+ *
+ * NextResponse 타입을 제네릭으로 처리하여
+ * symlink 환경에서의 next 패키지 경로 충돌을 방지합니다.
+ */
+import type { TokenPair } from '@withwiz/auth/types';
+/** cookies.set()을 지원하는 Response 타입 */
+interface CookieSettableResponse {
+    cookies: {
+        set(name: string, value: string, options?: Record<string, unknown>): void;
+    };
+}
+export interface CookieOptions {
+    secure?: boolean;
+    sameSite?: 'lax' | 'strict' | 'none';
+    domain?: string;
+}
+export declare function setTokenCookies<T extends CookieSettableResponse>(response: T, tokenPair: TokenPair, options?: CookieOptions): T;
+export declare function clearTokenCookies<T extends CookieSettableResponse>(response: T, options?: CookieOptions): T;
+export {};

package/dist/auth/core/jwt/cookie.js

@@ -0,0 +1,9 @@
+import {
+  clearTokenCookies,
+  setTokenCookies
+} from "../../../chunk-AJLUPYCQ.js";
+import "../../../chunk-ORMEWXMH.js";
+export {
+  clearTokenCookies,
+  setTokenCookies
+};

package/dist/auth/core/jwt/index.d.ts

@@ -107,4 +107,6 @@ export declare class JWTService {
      */
     extractTokenFromHeader(authHeader: string | undefined): string | null;
 }
+export { setTokenCookies, clearTokenCookies } from './cookie';
+export type { CookieOptions } from './cookie';
 export type { JWTConfig, JWTPayload, TokenPair };

package/dist/auth/core/jwt/index.js

@@ -1,10 +1,16 @@
 import {
   JWTManager,
   JWTService
-} from "../../../chunk-2ATBAIRL.js";
+} from "../../../chunk-3GAY2T2A.js";
+import {
+  clearTokenCookies,
+  setTokenCookies
+} from "../../../chunk-AJLUPYCQ.js";
 import "../../../chunk-AIH3F7JV.js";
 import "../../../chunk-ORMEWXMH.js";
 export {
   JWTManager,
-  JWTService
+  JWTService,
+  clearTokenCookies,
+  setTokenCookies
 };

package/dist/auth/index.js

@@ -1,9 +1,21 @@
+import {
+  DEFAULT_PASSWORD_CONFIG,
+  createPasswordHasher,
+  createPasswordSchema,
+  createPasswordValidator,
+  getPasswordStrength,
+  passwordValidator,
+  validatePassword
+} from "../chunk-G26T2PRQ.js";
+import {
+  PasswordHasher,
+  PasswordValidator,
+  defaultPasswordSchema,
+  strongPasswordSchema
+} from "../chunk-IHXRF3BH.js";
 import {
   TokenGenerator
 } from "../chunk-GDWEDUHO.js";
-import {
-  OAuthManager
-} from "../chunk-V5K5FYU7.js";
 import {
   JWTClientManager,
   clearStoredTokens,
@@ -21,20 +33,8 @@ import {
   storeTokens
 } from "../chunk-XRRPEBKB.js";
 import {
-  DEFAULT_PASSWORD_CONFIG,
-  createPasswordHasher,
-  createPasswordSchema,
-  createPasswordValidator,
-  getPasswordStrength,
-  passwordValidator,
-  validatePassword
-} from "../chunk-G26T2PRQ.js";
-import {
-  PasswordHasher,
-  PasswordValidator,
-  defaultPasswordSchema,
-  strongPasswordSchema
-} from "../chunk-IHXRF3BH.js";
+  OAuthManager
+} from "../chunk-V5K5FYU7.js";
 import {
   OAuthProvider,
   PasswordStrength,
@@ -44,7 +44,8 @@ import {
 import {
   JWTManager,
   JWTService
-} from "../chunk-2ATBAIRL.js";
+} from "../chunk-3GAY2T2A.js";
+import "../chunk-AJLUPYCQ.js";
 import {
   AUTH_ERROR_CODES,
   AuthError,

package/dist/{chunk-2ATBAIRL.js → chunk-3GAY2T2A.js}

@@ -25,7 +25,7 @@ var JWTManager = class {
       });
       return jwt;
     } catch (error) {
-      this.logger.error("Failed to create access token", { error, payload });
+      this.logger.error("Failed to create access token", { error, userId: payload.userId });
       throw new JWTError(
         "Access token creation failed",
         "TOKEN_CREATION_FAILED"

package/dist/chunk-AJLUPYCQ.js

@@ -0,0 +1,50 @@
+import {
+  __spreadValues
+} from "./chunk-ORMEWXMH.js";
+
+// src/auth/core/jwt/cookie.ts
+var DEFAULT_OPTIONS = {
+  secure: process.env.NODE_ENV === "production",
+  sameSite: "lax"
+};
+function setTokenCookies(response, tokenPair, options = {}) {
+  const opts = __spreadValues(__spreadValues({}, DEFAULT_OPTIONS), options);
+  response.cookies.set("access_token", tokenPair.accessToken, {
+    httpOnly: true,
+    secure: opts.secure,
+    sameSite: opts.sameSite,
+    path: "/",
+    maxAge: 15 * 60
+  });
+  response.cookies.set("refresh_token", tokenPair.refreshToken, {
+    httpOnly: true,
+    secure: opts.secure,
+    sameSite: opts.sameSite,
+    path: "/api/auth",
+    maxAge: 7 * 24 * 60 * 60
+  });
+  return response;
+}
+function clearTokenCookies(response, options = {}) {
+  const opts = __spreadValues(__spreadValues({}, DEFAULT_OPTIONS), options);
+  response.cookies.set("access_token", "", {
+    httpOnly: true,
+    secure: opts.secure,
+    sameSite: opts.sameSite,
+    path: "/",
+    maxAge: 0
+  });
+  response.cookies.set("refresh_token", "", {
+    httpOnly: true,
+    secure: opts.secure,
+    sameSite: opts.sameSite,
+    path: "/api/auth",
+    maxAge: 0
+  });
+  return response;
+}
+
+export {
+  setTokenCookies,
+  clearTokenCookies
+};

package/dist/{chunk-JR7GVCQX.js → chunk-BKJPYZYO.js}

@@ -1,12 +1,12 @@
 import {
   AUTH_ERROR_CODE_MAP
 } from "./chunk-2KDLKHTO.js";
-import {
-  getErrorMessage
-} from "./chunk-Y2JYA2AR.js";
 import {
   AppError
 } from "./chunk-KXXROUA5.js";
+import {
+  getErrorMessage
+} from "./chunk-Y2JYA2AR.js";
 import {
   ERROR_CODES,
   classifyError
@@ -28,7 +28,7 @@ import {
 import { NextResponse } from "next/server";
 import { z } from "zod";
 var errorHandlerMiddleware = async (context, next) => {
-  var _a, _b;
+  var _a;
   try {
     return await next();
   } catch (error) {
@@ -75,7 +75,11 @@ var errorHandlerMiddleware = async (context, next) => {
       );
     }
     const classified = error instanceof Error ? classifyError(error) : ERROR_CODES.INTERNAL_SERVER_ERROR;
-    logger.error("[ErrorHandler] Unexpected error:", error);
+    logger.error("[ErrorHandler] Unexpected error:", {
+      error,
+      requestId: context.requestId,
+      stack: error instanceof Error ? error.stack : void 0
+    });
     let isProduction = false;
     try {
       isProduction = getCommonConfig().nodeEnv === "production";
@@ -87,8 +91,7 @@ var errorHandlerMiddleware = async (context, next) => {
       classified.code,
       safeMessage,
       context.locale,
-      context.requestId,
-      !isProduction && error instanceof Error ? { stack: (_b = error.stack) == null ? void 0 : _b.split("\n").slice(0, 5) } : void 0
+      context.requestId
     );
   }
 };

package/dist/{chunk-BDY3AOX5.js → chunk-HUDWNKGY.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-OZE5KUS3.js";
 import {
   JWTManager
-} from "./chunk-2ATBAIRL.js";
+} from "./chunk-3GAY2T2A.js";
 import {
   logger
 } from "./chunk-GQVBWZLH.js";
@@ -72,7 +72,7 @@ function initializeAuthMiddleware() {
   return jwtManager !== null;
 }
 var authMiddleware = async (context, next) => {
-  var _a, _b;
+  var _a, _b, _c, _d;
   try {
     const jwtManager = getJWTManager();
     if (!jwtManager) {
@@ -84,8 +84,11 @@ var authMiddleware = async (context, next) => {
         "Authentication not configured. Contact administrator."
       );
     }
-    const authHeader = context.request.headers.get("authorization");
-    const token = jwtManager.extractTokenFromHeader(authHeader);
+    let token = (_b = (_a = context.request.cookies.get("access_token")) == null ? void 0 : _a.value) != null ? _b : null;
+    if (!token) {
+      const authHeader = context.request.headers.get("authorization");
+      token = jwtManager.extractTokenFromHeader(authHeader);
+    }
     if (!token) {
       throw new AppError(ERROR_CODES.UNAUTHORIZED.code);
     }
@@ -105,7 +108,7 @@ var authMiddleware = async (context, next) => {
     const payload = await jwtManager.verifyAccessToken(token);
     context.user = {
       id: payload.userId,
-      email: (_a = payload.email) != null ? _a : "",
+      email: (_c = payload.email) != null ? _c : "",
       name: void 0,
       // 필요시 DB에서 조회
       role: payload.role === "ADMIN" ? "ADMIN" : "USER"
@@ -114,7 +117,7 @@ var authMiddleware = async (context, next) => {
     if (error instanceof AppError) {
       throw error;
     }
-    if (error.code === "TOKEN_EXPIRED" || ((_b = error.message) == null ? void 0 : _b.includes("expired"))) {
+    if (error.code === "TOKEN_EXPIRED" || ((_d = error.message) == null ? void 0 : _d.includes("expired"))) {
       throw new AppError(ERROR_CODES.TOKEN_EXPIRED.code, error.message);
     }
     throw new AppError(
@@ -125,12 +128,15 @@ var authMiddleware = async (context, next) => {
   return await next();
 };
 var optionalAuthMiddleware = async (context, next) => {
-  var _a;
+  var _a, _b, _c;
   try {
     const jwtManager = getJWTManager();
     if (jwtManager) {
-      const authHeader = context.request.headers.get("authorization");
-      const token = jwtManager.extractTokenFromHeader(authHeader);
+      let token = (_b = (_a = context.request.cookies.get("access_token")) == null ? void 0 : _a.value) != null ? _b : null;
+      if (!token) {
+        const authHeader = context.request.headers.get("authorization");
+        token = jwtManager.extractTokenFromHeader(authHeader);
+      }
       if (token) {
         const tokenChecker = getAccessTokenChecker();
         let isRevoked = false;
@@ -141,7 +147,7 @@ var optionalAuthMiddleware = async (context, next) => {
           const payload = await jwtManager.verifyAccessToken(token);
           context.user = {
             id: payload.userId,
-            email: (_a = payload.email) != null ? _a : "",
+            email: (_c = payload.email) != null ? _c : "",
             name: void 0,
             role: payload.role === "ADMIN" ? "ADMIN" : "USER"
           };

package/dist/{chunk-LD7POV6B.js → chunk-JJ3I57N2.js}

@@ -12,18 +12,18 @@ import {
 } from "./chunk-OIRAH57Y.js";
 import {
   securityMiddleware
-} from "./chunk-QVWDWROP.js";
+} from "./chunk-WMQE2YK7.js";
 import {
   adminMiddleware,
   authMiddleware,
   optionalAuthMiddleware
-} from "./chunk-BDY3AOX5.js";
+} from "./chunk-HUDWNKGY.js";
 import {
   corsMiddleware
 } from "./chunk-KGHWGLED.js";
 import {
   errorHandlerMiddleware
-} from "./chunk-JR7GVCQX.js";
+} from "./chunk-BKJPYZYO.js";
 
 // src/middleware/wrappers.ts
 function withPublicApi(handler) {

package/dist/{chunk-SR65BF6X.js → chunk-N54KGJPU.js}

@@ -7,7 +7,15 @@ function sanitizeHtml(input) {
   if (!input || typeof input !== "string") {
     return "";
   }
-  return input.replace(/<[^>]*>/g, "").replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/<[^>]*>/g, "").replace(/&amp;/gi, "&").replace(/&quot;/gi, '"').replace(/&#x27;/gi, "'").replace(/&#x2F;/gi, "/").trim();
+  let result = input;
+  result = result.replace(/<[^>]*>/g, "");
+  result = result.replace(/&lt;/gi, "<").replace(/&gt;/gi, ">");
+  result = result.replace(/<[^>]*>/g, "");
+  result = result.replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(Number(dec))).replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+  result = result.replace(/<[^>]*>/g, "");
+  result = result.replace(/<[^>]*$/g, "");
+  result = result.replace(/&amp;/gi, "&").replace(/&quot;/gi, '"').replace(/&#x27;/gi, "'").replace(/&#x2F;/gi, "/");
+  return result.trim();
 }
 function removeEventHandlers(input) {
   if (!input || typeof input !== "string") {

package/dist/{chunk-QVWDWROP.js → chunk-WMQE2YK7.js}

@@ -4,6 +4,35 @@ import {
 
 // src/middleware/security.ts
 import { NextResponse } from "next/server";
+function setAllowedOrigins(origins) {
+  globalThis.__withwiz_allowed_origins = origins;
+  logger.info(`[Security Middleware] Allowed origins configured: ${origins.join(", ")}`);
+}
+var STATE_CHANGING_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+function verifyOrigin(request) {
+  const allowedOrigins = globalThis.__withwiz_allowed_origins;
+  if (!allowedOrigins || allowedOrigins.length === 0) {
+    return true;
+  }
+  const method = request.method.toUpperCase();
+  if (!STATE_CHANGING_METHODS.includes(method)) {
+    return true;
+  }
+  const origin = request.headers.get("origin");
+  if (origin) {
+    return allowedOrigins.some((allowed) => origin === allowed);
+  }
+  const referer = request.headers.get("referer");
+  if (referer) {
+    try {
+      const refererOrigin = new URL(referer).origin;
+      return allowedOrigins.some((allowed) => refererOrigin === allowed);
+    } catch (e) {
+      return false;
+    }
+  }
+  return false;
+}
 var BLOCKED_METHODS = ["TRACE", "TRACK"];
 var ALLOWED_CONTENT_TYPES = [
   "application/json",
@@ -97,6 +126,32 @@ var securityMiddleware = async (context, next) => {
       }
     }
   }
+  if (!verifyOrigin(request)) {
+    logger.warn("[Security] Origin verification failed", {
+      method,
+      origin: request.headers.get("origin"),
+      referer: request.headers.get("referer"),
+      url: request.url
+    });
+    return new NextResponse(
+      JSON.stringify({
+        success: false,
+        error: {
+          code: 40300,
+          message: "Origin verification failed",
+          userMessage: {
+            title: "\uC694\uCCAD \uAC70\uBD80",
+            description: "\uD5C8\uC6A9\uB418\uC9C0 \uC54A\uC740 \uCD9C\uCC98\uC5D0\uC11C\uC758 \uC694\uCCAD\uC785\uB2C8\uB2E4.",
+            action: "\uC62C\uBC14\uB978 \uD398\uC774\uC9C0\uC5D0\uC11C \uB2E4\uC2DC \uC2DC\uB3C4\uD574 \uC8FC\uC138\uC694."
+          }
+        }
+      }),
+      {
+        status: 403,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
   const response = await next();
   if (!response.headers.has("X-Content-Type-Options")) {
     response.headers.set("X-Content-Type-Options", "nosniff");
@@ -118,9 +173,12 @@ var securityMiddleware = async (context, next) => {
 function validateSecurityConfiguration() {
   logger.info("[Security Middleware] Blocked methods: " + BLOCKED_METHODS.join(", "));
   logger.info("[Security Middleware] Allowed Content-Types: " + ALLOWED_CONTENT_TYPES.join(", "));
+  const origins = globalThis.__withwiz_allowed_origins;
+  logger.info("[Security Middleware] Allowed Origins: " + ((origins == null ? void 0 : origins.join(", ")) || "NOT CONFIGURED (origin check disabled)"));
 }
 
 export {
+  setAllowedOrigins,
   securityMiddleware,
   validateSecurityConfiguration
 };

package/dist/components/ui/DataTable.js

@@ -1,12 +1,12 @@
 import {
   DataTable
-} from "../../chunk-LX2EYD74.js";
-import "../../chunk-7IY3RQQL.js";
+} from "../../chunk-HB5GFTFD.js";
 import "../../chunk-MAATEX2R.js";
 import "../../chunk-SEZJN4TC.js";
 import "../../chunk-IPXPCBDO.js";
 import "../../chunk-KHYY4KCV.js";
 import "../../chunk-NY5QXT33.js";
+import "../../chunk-7IY3RQQL.js";
 import "../../chunk-34WAGUT5.js";
 import "../../chunk-RJUVBBZG.js";
 import "../../chunk-IJEZ7G7S.js";

package/dist/components/ui/data-table/DataTable.js

@@ -1,13 +1,13 @@
 "use client";
 import {
   DataTable
-} from "../../../chunk-LX2EYD74.js";
-import "../../../chunk-7IY3RQQL.js";
+} from "../../../chunk-HB5GFTFD.js";
 import "../../../chunk-MAATEX2R.js";
 import "../../../chunk-SEZJN4TC.js";
 import "../../../chunk-IPXPCBDO.js";
 import "../../../chunk-KHYY4KCV.js";
 import "../../../chunk-NY5QXT33.js";
+import "../../../chunk-7IY3RQQL.js";
 import "../../../chunk-34WAGUT5.js";
 import "../../../chunk-RJUVBBZG.js";
 import "../../../chunk-IJEZ7G7S.js";

package/dist/constants/index.js

@@ -1,3 +1,16 @@
+import {
+  GENERIC_CONFIRM_MESSAGES,
+  GENERIC_ERROR_MESSAGES,
+  GENERIC_INFO_MESSAGES,
+  GENERIC_SUCCESS_MESSAGES
+} from "../chunk-2TO7WUKK.js";
+import {
+  DATE_RANGE,
+  FILTER_OPTIONS,
+  PAGE_SIZES,
+  PAGINATION,
+  SORT_OPTIONS
+} from "../chunk-VDXB5DCY.js";
 import {
   API_KEY,
   CSRF,
@@ -18,19 +31,6 @@ import {
   URL,
   USER_INPUT
 } from "../chunk-LNV2E4I6.js";
-import {
-  GENERIC_CONFIRM_MESSAGES,
-  GENERIC_ERROR_MESSAGES,
-  GENERIC_INFO_MESSAGES,
-  GENERIC_SUCCESS_MESSAGES
-} from "../chunk-2TO7WUKK.js";
-import {
-  DATE_RANGE,
-  FILTER_OPTIONS,
-  PAGE_SIZES,
-  PAGINATION,
-  SORT_OPTIONS
-} from "../chunk-VDXB5DCY.js";
 import {
   ERROR_CODES,
   HTTP_STATUS,

package/dist/error/error-display.js

@@ -5,7 +5,8 @@ import {
   getErrorIcon,
   handleApiResponse,
   showFriendlyError
-} from "../chunk-IJCVFLEY.js";
+} from "../chunk-TQJDNWBL.js";
+import "../chunk-KXXROUA5.js";
 import {
   getErrorDisplayInfo,
   getFriendlyMessage
@@ -13,7 +14,6 @@ import {
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-ORMEWXMH.js";
 export {

package/dist/error/index.js

@@ -1,6 +1,14 @@
 import {
   LocaleDetector
 } from "../chunk-XHZ5L4FO.js";
+import {
+  extractErrorInfo,
+  formatInlineError,
+  getDefaultErrorCode,
+  getErrorIcon,
+  handleApiResponse,
+  showFriendlyError
+} from "../chunk-TQJDNWBL.js";
 import {
   AUTH_ERROR_CODE_MAP,
   ErrorResponse,
@@ -9,13 +17,8 @@ import {
   withErrorHandler
 } from "../chunk-2KDLKHTO.js";
 import {
-  extractErrorInfo,
-  formatInlineError,
-  getDefaultErrorCode,
-  getErrorIcon,
-  handleApiResponse,
-  showFriendlyError
-} from "../chunk-IJCVFLEY.js";
+  AppError
+} from "../chunk-KXXROUA5.js";
 import {
   formatFriendlyError,
   getErrorDisplayInfo,
@@ -30,9 +33,6 @@ import {
 } from "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import {
-  AppError
-} from "../chunk-KXXROUA5.js";
 import {
   ERROR_CODES,
   HTTP_STATUS,

package/dist/middleware/auth.d.ts

@@ -46,7 +46,8 @@ export declare function initializeAuthMiddleware(): boolean;
 /**
  * 인증 미들웨어
  *
- * Authorization 헤더에서 JWT 토큰을 추출하고 검증합니다.
+ * 쿠키(access_token) 또는 Authorization 헤더에서 JWT 토큰을 추출하고 검증합니다.
+ * 쿠키를 우선 확인하며, 없을 경우 Authorization 헤더로 폴백합니다 (OAPI 호환).
  * 검증된 사용자 정보를 context.user에 추가합니다.
  *
  * @example
@@ -59,7 +60,9 @@ export declare const authMiddleware: TApiMiddleware;
 /**
  * 선택적 인증 미들웨어
  *
- * Authorization 헤더가 있으면 JWT 토큰을 검증하고 context.user를 설정합니다.
+ * 쿠키(access_token) 또는 Authorization 헤더가 있으면 JWT 토큰을 검증하고
+ * context.user를 설정합니다. 쿠키를 우선 확인하며, 없을 경우 Authorization
+ * 헤더로 폴백합니다 (OAPI 호환).
  * 토큰이 없거나 유효하지 않아도 에러를 발생시키지 않고 계속 진행합니다.
  * 공개 API이지만 로그인 사용자를 선택적으로 인식해야 하는 경우에 사용합니다.
  *

package/dist/middleware/auth.js

@@ -4,11 +4,12 @@ import {
   initializeAuthMiddleware,
   optionalAuthMiddleware,
   setAccessTokenBlacklistChecker
-} from "../chunk-BDY3AOX5.js";
+} from "../chunk-HUDWNKGY.js";
 import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-2ATBAIRL.js";
+import "../chunk-3GAY2T2A.js";
+import "../chunk-AJLUPYCQ.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";

package/dist/middleware/error-handler.js

@@ -1,11 +1,11 @@
 import {
   errorHandlerMiddleware
-} from "../chunk-JR7GVCQX.js";
+} from "../chunk-BKJPYZYO.js";
 import "../chunk-2KDLKHTO.js";
+import "../chunk-KXXROUA5.js";
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";

package/dist/middleware/index.d.ts

@@ -12,5 +12,5 @@ export { rateLimitMiddleware, createRateLimitMiddleware, setRateLimitAdapter } f
 export { errorHandlerMiddleware } from './error-handler';
 export { responseLoggerMiddleware } from './response-logger';
 export { corsMiddleware, validateCorsConfiguration } from './cors';
-export { securityMiddleware, validateSecurityConfiguration } from './security';
+export { securityMiddleware, validateSecurityConfiguration, setAllowedOrigins } from './security';
 export { withPublicApi, withAuthApi, withAdminApi, withOptionalAuthApi, withCustomApi, } from './wrappers';

package/dist/middleware/index.js

@@ -4,7 +4,7 @@ import {
   withCustomApi,
   withOptionalAuthApi,
   withPublicApi
-} from "../chunk-LD7POV6B.js";
+} from "../chunk-JJ3I57N2.js";
 import {
   initRequestMiddleware
 } from "../chunk-62Q7DN5G.js";
@@ -21,32 +21,34 @@ import {
 } from "../chunk-OIRAH57Y.js";
 import {
   securityMiddleware,
+  setAllowedOrigins,
   validateSecurityConfiguration
-} from "../chunk-QVWDWROP.js";
+} from "../chunk-WMQE2YK7.js";
 import {
   adminMiddleware,
   authMiddleware,
   initializeAuthMiddleware,
   optionalAuthMiddleware,
   setAccessTokenBlacklistChecker
-} from "../chunk-BDY3AOX5.js";
+} from "../chunk-HUDWNKGY.js";
 import {
   corsMiddleware,
   validateCorsConfiguration
 } from "../chunk-KGHWGLED.js";
 import {
   errorHandlerMiddleware
-} from "../chunk-JR7GVCQX.js";
+} from "../chunk-BKJPYZYO.js";
 import "../chunk-XHZ5L4FO.js";
 import "../chunk-2KDLKHTO.js";
+import "../chunk-KXXROUA5.js";
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-GFWGLWTS.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-2ATBAIRL.js";
+import "../chunk-3GAY2T2A.js";
+import "../chunk-AJLUPYCQ.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";
@@ -68,6 +70,7 @@ export {
   responseLoggerMiddleware,
   securityMiddleware,
   setAccessTokenBlacklistChecker,
+  setAllowedOrigins,
   setRateLimitAdapter,
   validateCorsConfiguration,
   validateSecurityConfiguration,

package/dist/middleware/security.d.ts

@@ -6,6 +6,10 @@
  * - 보안 헤더 강화
  */
 import type { TApiMiddleware } from './types';
+declare global {
+    var __withwiz_allowed_origins: string[] | undefined;
+}
+export declare function setAllowedOrigins(origins: string[]): void;
 /**
  * 보안 미들웨어
  *

package/dist/middleware/security.js

@@ -1,7 +1,8 @@
 import {
   securityMiddleware,
+  setAllowedOrigins,
   validateSecurityConfiguration
-} from "../chunk-QVWDWROP.js";
+} from "../chunk-WMQE2YK7.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";
 import "../chunk-SFPMFVSD.js";
@@ -10,5 +11,6 @@ import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";
 export {
   securityMiddleware,
+  setAllowedOrigins,
   validateSecurityConfiguration
 };

package/dist/middleware/wrappers.js

@@ -4,25 +4,26 @@ import {
   withCustomApi,
   withOptionalAuthApi,
   withPublicApi
-} from "../chunk-LD7POV6B.js";
+} from "../chunk-JJ3I57N2.js";
 import "../chunk-62Q7DN5G.js";
 import "../chunk-FPESPW6P.js";
 import "../chunk-6MI4XLWC.js";
 import "../chunk-OIRAH57Y.js";
-import "../chunk-QVWDWROP.js";
-import "../chunk-BDY3AOX5.js";
+import "../chunk-WMQE2YK7.js";
+import "../chunk-HUDWNKGY.js";
 import "../chunk-KGHWGLED.js";
-import "../chunk-JR7GVCQX.js";
+import "../chunk-BKJPYZYO.js";
 import "../chunk-XHZ5L4FO.js";
 import "../chunk-2KDLKHTO.js";
+import "../chunk-KXXROUA5.js";
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-GFWGLWTS.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-2ATBAIRL.js";
+import "../chunk-3GAY2T2A.js";
+import "../chunk-AJLUPYCQ.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";

package/dist/utils/index.js

@@ -5,7 +5,7 @@ import {
   sanitizeInput,
   sanitizeObjectFields,
   sanitizeUrl
-} from "../chunk-SR65BF6X.js";
+} from "../chunk-N54KGJPU.js";
 import {
   isApiErrorResponse,
   isApiSuccessResponse,

package/dist/utils/ip-utils.d.ts

@@ -4,12 +4,15 @@ export declare function normalizeIP(ip: string): string;
 /**
  * 클라이언트 IP 주소 추출 (서버에서만 사용)
  *
- * Cloudflare 환경 최적화:
- * 1. CF-Connecting-IP: Cloudflare가 설정하는 실제 클라이언트 IP (가장 신뢰)
- * 2. True-Client-IP: Cloudflare Enterprise에서 사용
- * 3. X-Real-IP: Nginx 등 신뢰할 수 있는 리버스 프록시
- * 4. X-Forwarded-For: 첫 번째 IP가 실제 클라이언트 (Cloudflare가 추가)
- * 5. X-Client-IP: 일부 프록시에서 사용
+ * 신뢰 가능한 프록시 헤더만 사용:
+ * 1. CF-Connecting-IP: Cloudflare Proxy가 강제 설정 (스푸핑 불가)
+ * 2. True-Client-IP: Cloudflare Enterprise에서 설정
+ * 3. X-Forwarded-For: 마지막 IP = 직전 프록시가 추가한 실제 클라이언트 IP
+ *
+ * 보안 참고:
+ * - X-Real-IP, X-Client-IP 등 클라이언트가 임의 설정 가능한 헤더는 사용하지 않음
+ * - X-Forwarded-For의 첫 번째 IP는 클라이언트가 조작 가능하므로 마지막 IP를 사용
+ * - Cloudflare Proxy 환경에서는 CF-Connecting-IP가 항상 설정되므로 폴백에 도달하지 않음
  */
 export declare function extractClientIp(headers: Headers): string | null;
 export declare function isValidIP(ip: string): boolean;

package/dist/utils/ip-utils.js

@@ -54,17 +54,14 @@ function extractClientIp(headers) {
   if (cf && isValidIP(cf.trim())) return cf.trim();
   const trueClientIp = headers.get("true-client-ip");
   if (trueClientIp && isValidIP(trueClientIp.trim())) return trueClientIp.trim();
-  const xri = headers.get("x-real-ip");
-  if (xri && isValidIP(xri.trim())) return xri.trim();
   const xff = headers.get("x-forwarded-for");
   if (xff) {
     const ips = xff.split(",").map((ip) => ip.trim()).filter(Boolean);
-    if (ips.length > 0 && isValidIP(ips[0])) {
-      return ips[0];
+    const lastIp = ips[ips.length - 1];
+    if (lastIp && isValidIP(lastIp)) {
+      return lastIp;
     }
   }
-  const xc = headers.get("x-client-ip");
-  if (xc && isValidIP(xc.trim())) return xc.trim();
   return null;
 }
 function isValidIP(ip) {

package/dist/utils/sanitizer.d.ts

@@ -8,15 +8,16 @@
  */
 /**
  * XSS 방지를 위한 HTML 태그 제거
- * - 모든 HTML 태그 제거
- * - 이스케이프된 HTML 엔티티 처리
+ * - 모든 HTML 태그 제거 (named + numeric 엔티티로 인코딩된 태그 포함)
+ * - 닫는 >가 없는 불완전 태그 제거 (HTML5 파서 우회 방지)
+ * - HTML 엔티티를 디코딩하여 원본 텍스트 반환
  * - 공백 정리
  *
  * @param input - 정제할 문자열
- * @returns 정제된 문자열
+ * @returns 태그가 제거된 순수 텍스트 (React 등 텍스트 컨텍스트에서 사용)
  *
  * @example
- * sanitizeHtml('<script>alert("xss")</script>Hello') // 'Hello'
+ * sanitizeHtml('<script>alert("xss")</script>Hello') // 'alert("xss")Hello'
  * sanitizeHtml('Hello <b>World</b>') // 'Hello World'
  */
 export declare function sanitizeHtml(input: string): string;

package/dist/utils/sanitizer.js

@@ -6,7 +6,7 @@ import {
   sanitizeObjectFields,
   sanitizeUrl,
   sanitizer_default
-} from "../chunk-SR65BF6X.js";
+} from "../chunk-N54KGJPU.js";
 import "../chunk-ORMEWXMH.js";
 export {
   sanitizer_default as default,

package/dist/utils/short-code-generator.d.ts

@@ -1,9 +1,10 @@
 /**
  * 단축 코드 생성 전용 유틸리티
- * 순수 함수로 구현하여 외부 의존성 없음
+ * 암호학적으로 안전한 난수 생성기(CSPRNG) 사용
  */
 /**
  * 기본 단축 코드 생성 함수
+ * crypto.randomBytes를 사용하여 예측 불가능한 코드 생성
  * @param length - 생성할 코드 길이 (기본값: 8)
  * @returns 생성된 단축 코드
  */

package/dist/utils/short-code-generator.js

@@ -1,14 +1,16 @@
 import "../chunk-ORMEWXMH.js";
 
 // src/utils/short-code-generator.ts
+import { randomBytes } from "crypto";
 function generateShortCode(length = 8) {
   if (!Number.isInteger(length) || length <= 0) {
     throw new Error("length must be a positive integer");
   }
   const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  const bytes = randomBytes(length);
   let result = "";
   for (let i = 0; i < length; i++) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
+    result += chars.charAt(bytes[i] % chars.length);
   }
   return result;
 }

package/dist/utils/url-normalizer.js

@@ -39,11 +39,21 @@ var SUPPORTED_SCHEMES = [
   "maps:",
   "geo:"
 ];
+var DANGEROUS_SCHEMES = [
+  "javascript:",
+  "vbscript:",
+  "data:",
+  "file:",
+  "blob:"
+];
 var CUSTOM_SCHEME_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
 function hasValidScheme(url) {
   try {
     const urlObj = new URL(url);
-    const protocol = urlObj.protocol;
+    const protocol = urlObj.protocol.toLowerCase();
+    if (DANGEROUS_SCHEMES.includes(protocol)) {
+      return false;
+    }
     if (SUPPORTED_SCHEMES.includes(protocol)) {
       return true;
     }
@@ -69,6 +79,9 @@ function normalizeUrl(url) {
   }
   const scheme = extractScheme(normalized);
   if (scheme) {
+    if (DANGEROUS_SCHEMES.includes(scheme.toLowerCase() + ":")) {
+      return "";
+    }
     return normalized;
   }
   if (normalized.startsWith("//")) {
@@ -88,6 +101,14 @@ function validateUrl(url, options) {
   try {
     const urlObj = new URL(normalized);
     const protocol = urlObj.protocol;
+    if (DANGEROUS_SCHEMES.includes(protocol.toLowerCase())) {
+      return {
+        isValid: false,
+        message: `\uBCF4\uC548\uC0C1 \uD5C8\uC6A9\uB418\uC9C0 \uC54A\uB294 \uD504\uB85C\uD1A0\uCF5C\uC785\uB2C8\uB2E4: ${protocol}`,
+        messageKey: "unsupportedProtocol",
+        messageParams: { protocol }
+      };
+    }
     const isSupported = SUPPORTED_SCHEMES.includes(protocol);
     const isCustom = CUSTOM_SCHEME_PATTERN.test(normalized);
     if (!isSupported && !isCustom) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withwiz/toolkit",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Shared utility library for withwiz projects",
   "license": "MIT",
   "private": false,

package/dist/{chunk-LX2EYD74.js → chunk-HB5GFTFD.js}

@@ -1,6 +1,3 @@
-import {
-  DataTableBody
-} from "./chunk-7IY3RQQL.js";
 import {
   DataTableBulkActions
 } from "./chunk-MAATEX2R.js";
@@ -16,6 +13,9 @@ import {
 import {
   DEFAULT_LABELS
 } from "./chunk-NY5QXT33.js";
+import {
+  DataTableBody
+} from "./chunk-7IY3RQQL.js";
 import {
   Alert,
   AlertDescription

package/dist/{chunk-IJCVFLEY.js → chunk-TQJDNWBL.js}

@@ -1,10 +1,10 @@
+import {
+  AppError
+} from "./chunk-KXXROUA5.js";
 import {
   getErrorDisplayInfo,
   getFriendlyMessage
 } from "./chunk-S54PFAEU.js";
-import {
-  AppError
-} from "./chunk-KXXROUA5.js";
 import {
   getErrorCategory
 } from "./chunk-SNVGJPPX.js";