@withwiz/toolkit 0.3.2 → 0.3.3

package/dist/auth/core/jwt/cookie.d.ts

@@ -0,0 +1,21 @@
+/**
+ * JWT 토큰을 HttpOnly 쿠키로 설정/삭제하는 유틸리티
+ *
+ * NextResponse 타입을 제네릭으로 처리하여
+ * symlink 환경에서의 next 패키지 경로 충돌을 방지합니다.
+ */
+import type { TokenPair } from '@withwiz/auth/types';
+/** cookies.set()을 지원하는 Response 타입 */
+interface CookieSettableResponse {
+    cookies: {
+        set(name: string, value: string, options?: Record<string, unknown>): void;
+    };
+}
+export interface CookieOptions {
+    secure?: boolean;
+    sameSite?: 'lax' | 'strict' | 'none';
+    domain?: string;
+}
+export declare function setTokenCookies<T extends CookieSettableResponse>(response: T, tokenPair: TokenPair, options?: CookieOptions): T;
+export declare function clearTokenCookies<T extends CookieSettableResponse>(response: T, options?: CookieOptions): T;
+export {};

package/dist/auth/core/jwt/cookie.js

@@ -0,0 +1,9 @@
+import {
+  clearTokenCookies,
+  setTokenCookies
+} from "../../../chunk-AJLUPYCQ.js";
+import "../../../chunk-ORMEWXMH.js";
+export {
+  clearTokenCookies,
+  setTokenCookies
+};

package/dist/auth/core/jwt/index.d.ts

@@ -107,4 +107,6 @@ export declare class JWTService {
      */
     extractTokenFromHeader(authHeader: string | undefined): string | null;
 }
+export { setTokenCookies, clearTokenCookies } from './cookie';
+export type { CookieOptions } from './cookie';
 export type { JWTConfig, JWTPayload, TokenPair };

package/dist/auth/core/jwt/index.js

@@ -1,10 +1,16 @@
 import {
   JWTManager,
   JWTService
-} from "../../../chunk-R6YVUU6I.js";
+} from "../../../chunk-3GAY2T2A.js";
+import {
+  clearTokenCookies,
+  setTokenCookies
+} from "../../../chunk-AJLUPYCQ.js";
 import "../../../chunk-AIH3F7JV.js";
 import "../../../chunk-ORMEWXMH.js";
 export {
   JWTManager,
-  JWTService
+  JWTService,
+  clearTokenCookies,
+  setTokenCookies
 };

package/dist/auth/index.js

@@ -1,3 +1,18 @@
+import {
+  DEFAULT_PASSWORD_CONFIG,
+  createPasswordHasher,
+  createPasswordSchema,
+  createPasswordValidator,
+  getPasswordStrength,
+  passwordValidator,
+  validatePassword
+} from "../chunk-G26T2PRQ.js";
+import {
+  PasswordHasher,
+  PasswordValidator,
+  defaultPasswordSchema,
+  strongPasswordSchema
+} from "../chunk-IHXRF3BH.js";
 import {
   TokenGenerator
 } from "../chunk-GDWEDUHO.js";
@@ -20,21 +35,6 @@ import {
 import {
   OAuthManager
 } from "../chunk-V5K5FYU7.js";
-import {
-  DEFAULT_PASSWORD_CONFIG,
-  createPasswordHasher,
-  createPasswordSchema,
-  createPasswordValidator,
-  getPasswordStrength,
-  passwordValidator,
-  validatePassword
-} from "../chunk-G26T2PRQ.js";
-import {
-  PasswordHasher,
-  PasswordValidator,
-  defaultPasswordSchema,
-  strongPasswordSchema
-} from "../chunk-IHXRF3BH.js";
 import {
   OAuthProvider,
   PasswordStrength,
@@ -44,7 +44,8 @@ import {
 import {
   JWTManager,
   JWTService
-} from "../chunk-R6YVUU6I.js";
+} from "../chunk-3GAY2T2A.js";
+import "../chunk-AJLUPYCQ.js";
 import {
   AUTH_ERROR_CODES,
   AuthError,

package/dist/chunk-AJLUPYCQ.js

@@ -0,0 +1,50 @@
+import {
+  __spreadValues
+} from "./chunk-ORMEWXMH.js";
+
+// src/auth/core/jwt/cookie.ts
+var DEFAULT_OPTIONS = {
+  secure: process.env.NODE_ENV === "production",
+  sameSite: "lax"
+};
+function setTokenCookies(response, tokenPair, options = {}) {
+  const opts = __spreadValues(__spreadValues({}, DEFAULT_OPTIONS), options);
+  response.cookies.set("access_token", tokenPair.accessToken, {
+    httpOnly: true,
+    secure: opts.secure,
+    sameSite: opts.sameSite,
+    path: "/",
+    maxAge: 15 * 60
+  });
+  response.cookies.set("refresh_token", tokenPair.refreshToken, {
+    httpOnly: true,
+    secure: opts.secure,
+    sameSite: opts.sameSite,
+    path: "/api/auth",
+    maxAge: 7 * 24 * 60 * 60
+  });
+  return response;
+}
+function clearTokenCookies(response, options = {}) {
+  const opts = __spreadValues(__spreadValues({}, DEFAULT_OPTIONS), options);
+  response.cookies.set("access_token", "", {
+    httpOnly: true,
+    secure: opts.secure,
+    sameSite: opts.sameSite,
+    path: "/",
+    maxAge: 0
+  });
+  response.cookies.set("refresh_token", "", {
+    httpOnly: true,
+    secure: opts.secure,
+    sameSite: opts.sameSite,
+    path: "/api/auth",
+    maxAge: 0
+  });
+  return response;
+}
+
+export {
+  setTokenCookies,
+  clearTokenCookies
+};

package/dist/{chunk-A6V6XVPZ.js → chunk-HUDWNKGY.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-OZE5KUS3.js";
 import {
   JWTManager
-} from "./chunk-R6YVUU6I.js";
+} from "./chunk-3GAY2T2A.js";
 import {
   logger
 } from "./chunk-GQVBWZLH.js";
@@ -72,7 +72,7 @@ function initializeAuthMiddleware() {
   return jwtManager !== null;
 }
 var authMiddleware = async (context, next) => {
-  var _a, _b;
+  var _a, _b, _c, _d;
   try {
     const jwtManager = getJWTManager();
     if (!jwtManager) {
@@ -84,8 +84,11 @@ var authMiddleware = async (context, next) => {
         "Authentication not configured. Contact administrator."
       );
     }
-    const authHeader = context.request.headers.get("authorization");
-    const token = jwtManager.extractTokenFromHeader(authHeader);
+    let token = (_b = (_a = context.request.cookies.get("access_token")) == null ? void 0 : _a.value) != null ? _b : null;
+    if (!token) {
+      const authHeader = context.request.headers.get("authorization");
+      token = jwtManager.extractTokenFromHeader(authHeader);
+    }
     if (!token) {
       throw new AppError(ERROR_CODES.UNAUTHORIZED.code);
     }
@@ -105,7 +108,7 @@ var authMiddleware = async (context, next) => {
     const payload = await jwtManager.verifyAccessToken(token);
     context.user = {
       id: payload.userId,
-      email: (_a = payload.email) != null ? _a : "",
+      email: (_c = payload.email) != null ? _c : "",
       name: void 0,
       // 필요시 DB에서 조회
       role: payload.role === "ADMIN" ? "ADMIN" : "USER"
@@ -114,7 +117,7 @@ var authMiddleware = async (context, next) => {
     if (error instanceof AppError) {
       throw error;
     }
-    if (error.code === "TOKEN_EXPIRED" || ((_b = error.message) == null ? void 0 : _b.includes("expired"))) {
+    if (error.code === "TOKEN_EXPIRED" || ((_d = error.message) == null ? void 0 : _d.includes("expired"))) {
       throw new AppError(ERROR_CODES.TOKEN_EXPIRED.code, error.message);
     }
     throw new AppError(
@@ -125,12 +128,15 @@ var authMiddleware = async (context, next) => {
   return await next();
 };
 var optionalAuthMiddleware = async (context, next) => {
-  var _a;
+  var _a, _b, _c;
   try {
     const jwtManager = getJWTManager();
     if (jwtManager) {
-      const authHeader = context.request.headers.get("authorization");
-      const token = jwtManager.extractTokenFromHeader(authHeader);
+      let token = (_b = (_a = context.request.cookies.get("access_token")) == null ? void 0 : _a.value) != null ? _b : null;
+      if (!token) {
+        const authHeader = context.request.headers.get("authorization");
+        token = jwtManager.extractTokenFromHeader(authHeader);
+      }
       if (token) {
         const tokenChecker = getAccessTokenChecker();
         let isRevoked = false;
@@ -141,7 +147,7 @@ var optionalAuthMiddleware = async (context, next) => {
           const payload = await jwtManager.verifyAccessToken(token);
           context.user = {
             id: payload.userId,
-            email: (_a = payload.email) != null ? _a : "",
+            email: (_c = payload.email) != null ? _c : "",
             name: void 0,
             role: payload.role === "ADMIN" ? "ADMIN" : "USER"
           };

package/dist/{chunk-NQS7UT6X.js → chunk-JJ3I57N2.js}

@@ -12,12 +12,12 @@ import {
 } from "./chunk-OIRAH57Y.js";
 import {
   securityMiddleware
-} from "./chunk-QVWDWROP.js";
+} from "./chunk-WMQE2YK7.js";
 import {
   adminMiddleware,
   authMiddleware,
   optionalAuthMiddleware
-} from "./chunk-A6V6XVPZ.js";
+} from "./chunk-HUDWNKGY.js";
 import {
   corsMiddleware
 } from "./chunk-KGHWGLED.js";

package/dist/{chunk-QVWDWROP.js → chunk-WMQE2YK7.js}

@@ -4,6 +4,35 @@ import {
 
 // src/middleware/security.ts
 import { NextResponse } from "next/server";
+function setAllowedOrigins(origins) {
+  globalThis.__withwiz_allowed_origins = origins;
+  logger.info(`[Security Middleware] Allowed origins configured: ${origins.join(", ")}`);
+}
+var STATE_CHANGING_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+function verifyOrigin(request) {
+  const allowedOrigins = globalThis.__withwiz_allowed_origins;
+  if (!allowedOrigins || allowedOrigins.length === 0) {
+    return true;
+  }
+  const method = request.method.toUpperCase();
+  if (!STATE_CHANGING_METHODS.includes(method)) {
+    return true;
+  }
+  const origin = request.headers.get("origin");
+  if (origin) {
+    return allowedOrigins.some((allowed) => origin === allowed);
+  }
+  const referer = request.headers.get("referer");
+  if (referer) {
+    try {
+      const refererOrigin = new URL(referer).origin;
+      return allowedOrigins.some((allowed) => refererOrigin === allowed);
+    } catch (e) {
+      return false;
+    }
+  }
+  return false;
+}
 var BLOCKED_METHODS = ["TRACE", "TRACK"];
 var ALLOWED_CONTENT_TYPES = [
   "application/json",
@@ -97,6 +126,32 @@ var securityMiddleware = async (context, next) => {
       }
     }
   }
+  if (!verifyOrigin(request)) {
+    logger.warn("[Security] Origin verification failed", {
+      method,
+      origin: request.headers.get("origin"),
+      referer: request.headers.get("referer"),
+      url: request.url
+    });
+    return new NextResponse(
+      JSON.stringify({
+        success: false,
+        error: {
+          code: 40300,
+          message: "Origin verification failed",
+          userMessage: {
+            title: "\uC694\uCCAD \uAC70\uBD80",
+            description: "\uD5C8\uC6A9\uB418\uC9C0 \uC54A\uC740 \uCD9C\uCC98\uC5D0\uC11C\uC758 \uC694\uCCAD\uC785\uB2C8\uB2E4.",
+            action: "\uC62C\uBC14\uB978 \uD398\uC774\uC9C0\uC5D0\uC11C \uB2E4\uC2DC \uC2DC\uB3C4\uD574 \uC8FC\uC138\uC694."
+          }
+        }
+      }),
+      {
+        status: 403,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
   const response = await next();
   if (!response.headers.has("X-Content-Type-Options")) {
     response.headers.set("X-Content-Type-Options", "nosniff");
@@ -118,9 +173,12 @@ var securityMiddleware = async (context, next) => {
 function validateSecurityConfiguration() {
   logger.info("[Security Middleware] Blocked methods: " + BLOCKED_METHODS.join(", "));
   logger.info("[Security Middleware] Allowed Content-Types: " + ALLOWED_CONTENT_TYPES.join(", "));
+  const origins = globalThis.__withwiz_allowed_origins;
+  logger.info("[Security Middleware] Allowed Origins: " + ((origins == null ? void 0 : origins.join(", ")) || "NOT CONFIGURED (origin check disabled)"));
 }
 
 export {
+  setAllowedOrigins,
   securityMiddleware,
   validateSecurityConfiguration
 };

package/dist/components/ui/DataTable.js

@@ -1,12 +1,12 @@
 import {
   DataTable
-} from "../../chunk-LX2EYD74.js";
-import "../../chunk-7IY3RQQL.js";
+} from "../../chunk-HB5GFTFD.js";
 import "../../chunk-MAATEX2R.js";
 import "../../chunk-SEZJN4TC.js";
 import "../../chunk-IPXPCBDO.js";
 import "../../chunk-KHYY4KCV.js";
 import "../../chunk-NY5QXT33.js";
+import "../../chunk-7IY3RQQL.js";
 import "../../chunk-34WAGUT5.js";
 import "../../chunk-RJUVBBZG.js";
 import "../../chunk-IJEZ7G7S.js";

package/dist/components/ui/data-table/DataTable.js

@@ -1,13 +1,13 @@
 "use client";
 import {
   DataTable
-} from "../../../chunk-LX2EYD74.js";
-import "../../../chunk-7IY3RQQL.js";
+} from "../../../chunk-HB5GFTFD.js";
 import "../../../chunk-MAATEX2R.js";
 import "../../../chunk-SEZJN4TC.js";
 import "../../../chunk-IPXPCBDO.js";
 import "../../../chunk-KHYY4KCV.js";
 import "../../../chunk-NY5QXT33.js";
+import "../../../chunk-7IY3RQQL.js";
 import "../../../chunk-34WAGUT5.js";
 import "../../../chunk-RJUVBBZG.js";
 import "../../../chunk-IJEZ7G7S.js";

package/dist/constants/index.js

@@ -1,26 +1,3 @@
-import {
-  DATE,
-  FILE_UPLOAD,
-  NUMERIC,
-  PASSWORD,
-  TEXT,
-  URL,
-  USER_INPUT
-} from "../chunk-LNV2E4I6.js";
-import {
-  ERROR_CODES,
-  HTTP_STATUS,
-  classifyError,
-  formatErrorMessage,
-  getAllErrorCodes,
-  getDefaultErrorMessage,
-  getErrorByCode,
-  getErrorCategory,
-  getErrorCodesByCategory,
-  getErrorInfo,
-  getHttpStatus,
-  getLogLevel
-} from "../chunk-SNVGJPPX.js";
 import {
   GENERIC_CONFIRM_MESSAGES,
   GENERIC_ERROR_MESSAGES,
@@ -45,6 +22,29 @@ import {
   SECURITY_HEADERS,
   SESSION
 } from "../chunk-JLLMTTQ4.js";
+import {
+  DATE,
+  FILE_UPLOAD,
+  NUMERIC,
+  PASSWORD,
+  TEXT,
+  URL,
+  USER_INPUT
+} from "../chunk-LNV2E4I6.js";
+import {
+  ERROR_CODES,
+  HTTP_STATUS,
+  classifyError,
+  formatErrorMessage,
+  getAllErrorCodes,
+  getDefaultErrorMessage,
+  getErrorByCode,
+  getErrorCategory,
+  getErrorCodesByCategory,
+  getErrorInfo,
+  getHttpStatus,
+  getLogLevel
+} from "../chunk-SNVGJPPX.js";
 import "../chunk-ORMEWXMH.js";
 export {
   API_KEY,

package/dist/middleware/auth.d.ts

@@ -46,7 +46,8 @@ export declare function initializeAuthMiddleware(): boolean;
 /**
  * 인증 미들웨어
  *
- * Authorization 헤더에서 JWT 토큰을 추출하고 검증합니다.
+ * 쿠키(access_token) 또는 Authorization 헤더에서 JWT 토큰을 추출하고 검증합니다.
+ * 쿠키를 우선 확인하며, 없을 경우 Authorization 헤더로 폴백합니다 (OAPI 호환).
  * 검증된 사용자 정보를 context.user에 추가합니다.
  *
  * @example
@@ -59,7 +60,9 @@ export declare const authMiddleware: TApiMiddleware;
 /**
  * 선택적 인증 미들웨어
  *
- * Authorization 헤더가 있으면 JWT 토큰을 검증하고 context.user를 설정합니다.
+ * 쿠키(access_token) 또는 Authorization 헤더가 있으면 JWT 토큰을 검증하고
+ * context.user를 설정합니다. 쿠키를 우선 확인하며, 없을 경우 Authorization
+ * 헤더로 폴백합니다 (OAPI 호환).
  * 토큰이 없거나 유효하지 않아도 에러를 발생시키지 않고 계속 진행합니다.
  * 공개 API이지만 로그인 사용자를 선택적으로 인식해야 하는 경우에 사용합니다.
  *

package/dist/middleware/auth.js

@@ -4,11 +4,12 @@ import {
   initializeAuthMiddleware,
   optionalAuthMiddleware,
   setAccessTokenBlacklistChecker
-} from "../chunk-A6V6XVPZ.js";
+} from "../chunk-HUDWNKGY.js";
 import "../chunk-KXXROUA5.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-R6YVUU6I.js";
+import "../chunk-3GAY2T2A.js";
+import "../chunk-AJLUPYCQ.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";

package/dist/middleware/index.d.ts

@@ -12,5 +12,5 @@ export { rateLimitMiddleware, createRateLimitMiddleware, setRateLimitAdapter } f
 export { errorHandlerMiddleware } from './error-handler';
 export { responseLoggerMiddleware } from './response-logger';
 export { corsMiddleware, validateCorsConfiguration } from './cors';
-export { securityMiddleware, validateSecurityConfiguration } from './security';
+export { securityMiddleware, validateSecurityConfiguration, setAllowedOrigins } from './security';
 export { withPublicApi, withAuthApi, withAdminApi, withOptionalAuthApi, withCustomApi, } from './wrappers';

package/dist/middleware/index.js

@@ -4,7 +4,7 @@ import {
   withCustomApi,
   withOptionalAuthApi,
   withPublicApi
-} from "../chunk-NQS7UT6X.js";
+} from "../chunk-JJ3I57N2.js";
 import {
   initRequestMiddleware
 } from "../chunk-62Q7DN5G.js";
@@ -21,15 +21,16 @@ import {
 } from "../chunk-OIRAH57Y.js";
 import {
   securityMiddleware,
+  setAllowedOrigins,
   validateSecurityConfiguration
-} from "../chunk-QVWDWROP.js";
+} from "../chunk-WMQE2YK7.js";
 import {
   adminMiddleware,
   authMiddleware,
   initializeAuthMiddleware,
   optionalAuthMiddleware,
   setAccessTokenBlacklistChecker
-} from "../chunk-A6V6XVPZ.js";
+} from "../chunk-HUDWNKGY.js";
 import {
   corsMiddleware,
   validateCorsConfiguration
@@ -46,7 +47,8 @@ import "../chunk-IYXMGIEP.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-GFWGLWTS.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-R6YVUU6I.js";
+import "../chunk-3GAY2T2A.js";
+import "../chunk-AJLUPYCQ.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";
@@ -68,6 +70,7 @@ export {
   responseLoggerMiddleware,
   securityMiddleware,
   setAccessTokenBlacklistChecker,
+  setAllowedOrigins,
   setRateLimitAdapter,
   validateCorsConfiguration,
   validateSecurityConfiguration,

package/dist/middleware/security.d.ts

@@ -6,6 +6,10 @@
  * - 보안 헤더 강화
  */
 import type { TApiMiddleware } from './types';
+declare global {
+    var __withwiz_allowed_origins: string[] | undefined;
+}
+export declare function setAllowedOrigins(origins: string[]): void;
 /**
  * 보안 미들웨어
  *

package/dist/middleware/security.js

@@ -1,7 +1,8 @@
 import {
   securityMiddleware,
+  setAllowedOrigins,
   validateSecurityConfiguration
-} from "../chunk-QVWDWROP.js";
+} from "../chunk-WMQE2YK7.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";
 import "../chunk-SFPMFVSD.js";
@@ -10,5 +11,6 @@ import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";
 export {
   securityMiddleware,
+  setAllowedOrigins,
   validateSecurityConfiguration
 };

package/dist/middleware/wrappers.js

@@ -4,13 +4,13 @@ import {
   withCustomApi,
   withOptionalAuthApi,
   withPublicApi
-} from "../chunk-NQS7UT6X.js";
+} from "../chunk-JJ3I57N2.js";
 import "../chunk-62Q7DN5G.js";
 import "../chunk-FPESPW6P.js";
 import "../chunk-6MI4XLWC.js";
 import "../chunk-OIRAH57Y.js";
-import "../chunk-QVWDWROP.js";
-import "../chunk-A6V6XVPZ.js";
+import "../chunk-WMQE2YK7.js";
+import "../chunk-HUDWNKGY.js";
 import "../chunk-KGHWGLED.js";
 import "../chunk-BKJPYZYO.js";
 import "../chunk-XHZ5L4FO.js";
@@ -22,7 +22,8 @@ import "../chunk-IYXMGIEP.js";
 import "../chunk-SNVGJPPX.js";
 import "../chunk-GFWGLWTS.js";
 import "../chunk-OZE5KUS3.js";
-import "../chunk-R6YVUU6I.js";
+import "../chunk-3GAY2T2A.js";
+import "../chunk-AJLUPYCQ.js";
 import "../chunk-AIH3F7JV.js";
 import "../chunk-GQVBWZLH.js";
 import "../chunk-OHBAELPZ.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withwiz/toolkit",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Shared utility library for withwiz projects",
   "license": "MIT",
   "private": false,

package/dist/{chunk-LX2EYD74.js → chunk-HB5GFTFD.js}

@@ -1,6 +1,3 @@
-import {
-  DataTableBody
-} from "./chunk-7IY3RQQL.js";
 import {
   DataTableBulkActions
 } from "./chunk-MAATEX2R.js";
@@ -16,6 +13,9 @@ import {
 import {
   DEFAULT_LABELS
 } from "./chunk-NY5QXT33.js";
+import {
+  DataTableBody
+} from "./chunk-7IY3RQQL.js";
 import {
   Alert,
   AlertDescription