@xexr/blog-platform 1.0.7 → 1.0.8

package/dist/lib/ratelimit.ts

@@ -0,0 +1,224 @@
+/**
+ * Rate limiting for blog platform API endpoints
+ * 
+ * This implements rate limiting using Upstash Redis to prevent abuse
+ * and ensure fair usage across all API consumers.
+ */
+
+import { Ratelimit } from "@upstash/ratelimit";
+import { Redis } from "@upstash/redis";
+import type { PublishResult } from "@/types/contracts";
+
+/**
+ * Rate limit configuration interface
+ * Allows customers to customize rate limiting behavior
+ */
+export interface RateLimitConfig {
+  /** Upstash Redis REST URL */
+  redisUrl: string;
+  
+  /** Upstash Redis REST token */
+  redisToken: string;
+  
+  /** Requests per minute limit (default: 5) */
+  requestsPerMinute?: number;
+  
+  /** Redis key prefix for rate limiting (default: "blog-platform-ratelimit") */
+  keyPrefix?: string;
+  
+  /** Enable analytics (default: true) */
+  analytics?: boolean;
+}
+
+/**
+ * Rate limit result
+ */
+export interface RateLimitResult {
+  /** Whether the request is allowed */
+  success: boolean;
+  
+  /** Number of requests remaining in current window */
+  remaining: number;
+  
+  /** When the rate limit window resets (Unix timestamp) */
+  reset: number;
+  
+  /** Total requests allowed per window */
+  limit: number;
+  
+  /** Current request count in window */
+  count: number;
+}
+
+/**
+ * Rate limiter instance
+ */
+type GlobalWithRateLimiter = typeof globalThis & {
+  __BLOG_PLATFORM_RATE_LIMITER__?: Ratelimit | null;
+};
+
+function getRateLimiter(): Ratelimit | null {
+  const globalRef = globalThis as GlobalWithRateLimiter;
+  return globalRef.__BLOG_PLATFORM_RATE_LIMITER__ ?? null;
+}
+
+function setRateLimiter(instance: Ratelimit | null): void {
+  const globalRef = globalThis as GlobalWithRateLimiter;
+  globalRef.__BLOG_PLATFORM_RATE_LIMITER__ = instance;
+}
+
+/**
+ * Configure the rate limiter
+ * This must be called during app initialization
+ */
+export function configureRateLimit(config: RateLimitConfig): void {
+  const {
+    redisUrl,
+    redisToken,
+    requestsPerMinute = 5,
+    keyPrefix = "blog-platform-ratelimit",
+    analytics = true,
+  } = config;
+
+  const redis = new Redis({
+    url: redisUrl,
+    token: redisToken,
+  });
+
+  const limiter = new Ratelimit({
+    redis,
+    analytics,
+    prefix: keyPrefix,
+    // 5 requests per minute sliding window
+    limiter: Ratelimit.slidingWindow(requestsPerMinute, "1m"),
+  });
+
+  setRateLimiter(limiter);
+}
+
+/**
+ * Auto-configure rate limiting from environment variables
+ * Uses UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN
+ */
+export function autoConfigureRateLimit(): void {
+  const redisUrl = process.env.UPSTASH_REDIS_REST_URL;
+  const redisToken = process.env.UPSTASH_REDIS_REST_TOKEN;
+  
+  if (!redisUrl || !redisToken) {
+    console.warn("Blog platform: No Upstash Redis configuration found. Rate limiting disabled.");
+    return;
+  }
+  
+  configureRateLimit({
+    redisUrl,
+    redisToken,
+  });
+  
+  console.log("Blog platform: Rate limiting configured (5 requests per minute per token)");
+}
+
+/**
+ * Check rate limit for a given identifier (typically an auth token)
+ * @param identifier - Unique identifier (usually the authentication token)
+ * @returns Rate limit result
+ */
+export async function checkRateLimit(identifier: string): Promise<RateLimitResult> {
+  const limiter = getRateLimiter();
+  if (!limiter) {
+    // Rate limiting not configured - allow all requests
+    console.warn("Blog platform: Rate limiter not configured. All requests allowed.");
+    return {
+      success: true,
+      remaining: 999,
+      reset: Date.now() + 60000,
+      limit: 5,
+      count: 0,
+    };
+  }
+
+  try {
+    const result = await limiter.limit(identifier);
+    
+    return {
+      success: result.success,
+      remaining: result.remaining,
+      reset: result.reset,
+      limit: result.limit,
+      count: result.limit - result.remaining,
+    };
+  } catch (error) {
+    console.error("Blog platform: Rate limit check failed:", error);
+    // On error, allow the request but log the issue
+    return {
+      success: true,
+      remaining: 0,
+      reset: Date.now() + 60000,
+      limit: 5,
+      count: 0,
+    };
+  }
+}
+
+/**
+ * Create a rate limit error response
+ * @param rateLimitResult - The rate limit result that failed
+ * @param idempotencyKey - Optional idempotency key from request
+ * @returns PublishResult with rate limit error
+ */
+export function createRateLimitErrorResponse(
+  rateLimitResult: RateLimitResult,
+  idempotencyKey = ""
+): PublishResult {
+  const resetMinutes = Math.ceil((rateLimitResult.reset - Date.now()) / 60000);
+  
+  return {
+    success: false,
+    error: {
+      code: "PUB011",
+      message: `Rate limit exceeded. You can make ${rateLimitResult.limit} requests per minute. Try again in ${resetMinutes} minute(s).`,
+      details: {
+        rateLimit: rateLimitResult,
+      },
+    },
+    idempotencyKey,
+  };
+}
+
+/**
+ * Rate limiting middleware for API routes
+ * @param identifier - Unique identifier for rate limiting (typically auth token)
+ * @param idempotencyKey - Optional idempotency key from request
+ * @returns Rate limit result or error response
+ */
+export async function enforceRateLimit(
+  identifier: string,
+  idempotencyKey = ""
+): Promise<{ allowed: true; rateLimitResult: RateLimitResult } | { allowed: false; errorResponse: PublishResult }> {
+  const rateLimitResult = await checkRateLimit(identifier);
+  
+  if (!rateLimitResult.success) {
+    return {
+      allowed: false,
+      errorResponse: createRateLimitErrorResponse(rateLimitResult, idempotencyKey),
+    };
+  }
+  
+  return {
+    allowed: true,
+    rateLimitResult,
+  };
+}
+
+/**
+ * Get rate limit headers for HTTP responses
+ * @param rateLimitResult - Rate limit result
+ * @returns Headers object for HTTP response
+ */
+export function getRateLimitHeaders(rateLimitResult: RateLimitResult): Record<string, string> {
+  return {
+    "X-RateLimit-Limit": rateLimitResult.limit.toString(),
+    "X-RateLimit-Remaining": rateLimitResult.remaining.toString(),
+    "X-RateLimit-Reset": rateLimitResult.reset.toString(),
+    "Retry-After": Math.ceil((rateLimitResult.reset - Date.now()) / 1000).toString(),
+  };
+}

package/dist/lib/security-headers.ts

@@ -0,0 +1,322 @@
+/**
+ * Security headers for blog platform API endpoints
+ *
+ * This provides comprehensive security headers to protect against common
+ * web vulnerabilities including XSS, clickjacking, and content injection.
+ */
+
+import type { NextRequest } from "next/server";
+
+/**
+ * Security headers configuration interface
+ */
+export interface SecurityConfig {
+  /** Enable Content Security Policy (default: true) */
+  enableCSP?: boolean;
+
+  /** Custom CSP directives (merges with defaults) */
+  cspDirectives?: Record<string, string>;
+
+  /** Enable X-Frame-Options (default: true) */
+  enableFrameOptions?: boolean;
+
+  /** X-Frame-Options value (default: "DENY") */
+  frameOptions?: string;
+
+  /** Enable X-Content-Type-Options (default: true) */
+  enableContentTypeOptions?: boolean;
+
+  /** Enable X-XSS-Protection (default: true) */
+  enableXSSProtection?: boolean;
+
+  /** Enable Referrer-Policy (default: true) */
+  enableReferrerPolicy?: boolean;
+
+  /** Referrer policy value (default: "strict-origin-when-cross-origin") */
+  referrerPolicy?: string;
+
+  /** Enable Strict-Transport-Security for HTTPS (default: true) */
+  enableHSTS?: boolean;
+
+  /** HSTS max-age in seconds (default: 31536000 = 1 year) */
+  hstsMaxAge?: number;
+
+  /** Include HSTS subdomains (default: true) */
+  hstsIncludeSubdomains?: boolean;
+
+  /** Enable Permissions-Policy (default: true) */
+  enablePermissionsPolicy?: boolean;
+
+  /** Custom permissions policy directives */
+  permissionsPolicyDirectives?: Record<string, string>;
+}
+
+/**
+ * Default security configuration for blog platform APIs
+ */
+const DEFAULT_SECURITY_CONFIG: Required<SecurityConfig> = {
+  enableCSP: true,
+  cspDirectives: {
+    "default-src": "'self'",
+    "script-src": "'self' 'unsafe-inline'", // Allow inline scripts for API responses
+    "style-src": "'self' 'unsafe-inline'",  // Allow inline styles for blog rendering
+    "img-src": "'self' data: https:",       // Allow images from self, data URIs, and HTTPS
+    "font-src": "'self' https:",            // Allow fonts from self and HTTPS
+    "connect-src": "'self'",                // API connections to same origin
+    "media-src": "'self'",                  // Media from same origin only
+    "object-src": "'none'",                 // Disable object/embed elements
+    "base-uri": "'self'",                   // Restrict base URIs to same origin
+    "form-action": "'self'",                // Forms can only submit to same origin
+    "frame-ancestors": "'none'",            // Prevent embedding in frames
+    "upgrade-insecure-requests": "",        // Upgrade HTTP to HTTPS
+  },
+  enableFrameOptions: true,
+  frameOptions: "DENY",
+  enableContentTypeOptions: true,
+  enableXSSProtection: true,
+  enableReferrerPolicy: true,
+  referrerPolicy: "strict-origin-when-cross-origin",
+  enableHSTS: true,
+  hstsMaxAge: 31536000, // 1 year
+  hstsIncludeSubdomains: true,
+  enablePermissionsPolicy: true,
+  permissionsPolicyDirectives: {
+    "camera": "()",           // Disable camera access
+    "microphone": "()",       // Disable microphone access
+    "geolocation": "()",      // Disable geolocation
+    "payment": "()",          // Disable payment API
+    "usb": "()",              // Disable USB access
+    "accelerometer": "()",    // Disable accelerometer
+    "gyroscope": "()",        // Disable gyroscope
+    "magnetometer": "()",     // Disable magnetometer
+  },
+};
+
+/**
+ * Get security configuration from environment or defaults
+ */
+function getSecurityConfig(): Required<SecurityConfig> {
+  const envCSPDisabled = process.env.BLOG_PLATFORM_DISABLE_CSP === "true";
+  const envFrameOptions = process.env.BLOG_PLATFORM_FRAME_OPTIONS;
+  const envHSTSDisabled = process.env.BLOG_PLATFORM_DISABLE_HSTS === "true";
+
+  return {
+    ...DEFAULT_SECURITY_CONFIG,
+    enableCSP: !envCSPDisabled,
+    frameOptions: envFrameOptions ?? DEFAULT_SECURITY_CONFIG.frameOptions,
+    enableHSTS: !envHSTSDisabled,
+  };
+}
+
+/**
+ * Build Content Security Policy header value
+ */
+function buildCSPHeader(directives: Record<string, string>): string {
+  return Object.entries(directives)
+    .map(([directive, value]) =>
+      value ? `${directive} ${value}` : directive
+    )
+    .join("; ");
+}
+
+/**
+ * Build Permissions Policy header value
+ */
+function buildPermissionsPolicyHeader(directives: Record<string, string>): string {
+  return Object.entries(directives)
+    .map(([feature, allowlist]) => `${feature}=${allowlist}`)
+    .join(", ");
+}
+
+/**
+ * Get security headers for HTTP responses
+ */
+export function getSecurityHeaders(
+  request: NextRequest,
+  config: SecurityConfig = {}
+): Record<string, string> {
+  const securityConfig = { ...getSecurityConfig(), ...config };
+  const headers: Record<string, string> = {};
+
+  // Content Security Policy
+  if (securityConfig.enableCSP) {
+    const cspDirectives = {
+      ...securityConfig.cspDirectives,
+      ...(config.cspDirectives ?? {}),
+    };
+    headers["Content-Security-Policy"] = buildCSPHeader(cspDirectives);
+  }
+
+  // X-Frame-Options (prevent clickjacking)
+  if (securityConfig.enableFrameOptions) {
+    headers["X-Frame-Options"] = securityConfig.frameOptions;
+  }
+
+  // X-Content-Type-Options (prevent MIME sniffing)
+  if (securityConfig.enableContentTypeOptions) {
+    headers["X-Content-Type-Options"] = "nosniff";
+  }
+
+  // X-XSS-Protection (legacy XSS protection)
+  if (securityConfig.enableXSSProtection) {
+    headers["X-XSS-Protection"] = "1; mode=block";
+  }
+
+  // Referrer-Policy (control referrer information)
+  if (securityConfig.enableReferrerPolicy) {
+    headers["Referrer-Policy"] = securityConfig.referrerPolicy;
+  }
+
+  // Strict-Transport-Security (HTTPS enforcement)
+  if (securityConfig.enableHSTS && isHTTPS(request)) {
+    const hstsValue = [
+      `max-age=${securityConfig.hstsMaxAge}`,
+      securityConfig.hstsIncludeSubdomains ? "includeSubDomains" : "",
+    ].filter(Boolean).join("; ");
+
+    headers["Strict-Transport-Security"] = hstsValue;
+  }
+
+  // Permissions-Policy (feature control)
+  if (securityConfig.enablePermissionsPolicy) {
+    const permissionsDirectives = {
+      ...securityConfig.permissionsPolicyDirectives,
+      ...(config.permissionsPolicyDirectives ?? {}),
+    };
+    headers["Permissions-Policy"] = buildPermissionsPolicyHeader(permissionsDirectives);
+  }
+
+  return headers;
+}
+
+/**
+ * Check if request is over HTTPS
+ */
+function isHTTPS(request: NextRequest): boolean {
+  // Check protocol from URL
+  if (request.url.startsWith("https://")) {
+    return true;
+  }
+
+  // Check forwarded protocol headers (for proxies/load balancers)
+  const forwardedProto = request.headers.get("x-forwarded-proto");
+  if (forwardedProto === "https") {
+    return true;
+  }
+
+  // Check if we're in a secure context (Cloudflare, Vercel, etc.)
+  const cfVisitor = request.headers.get("cf-visitor");
+  if (cfVisitor?.includes('"scheme":"https"')) {
+    return true;
+  }
+
+  return false;
+}
+
+/**
+ * Create security headers optimized for API endpoints
+ */
+export function getAPISecurityHeaders(
+  request: NextRequest,
+  config: SecurityConfig = {}
+): Record<string, string> {
+  // API-specific CSP that's less restrictive for JSON responses
+  const apiCSPDirectives = {
+    "default-src": "'none'",     // APIs don't need default sources
+    "frame-ancestors": "'none'", // Prevent embedding
+    "base-uri": "'none'",        // No base URI needed for APIs
+  };
+
+  return getSecurityHeaders(request, {
+    ...config,
+    cspDirectives: {
+      ...apiCSPDirectives,
+      ...(config.cspDirectives ?? {}),
+    },
+  });
+}
+
+/**
+ * Create security headers optimized for blog pages
+ */
+export function getBlogSecurityHeaders(
+  request: NextRequest,
+  config: SecurityConfig = {}
+): Record<string, string> {
+  // Blog-specific CSP that allows images, fonts, and styles
+  const blogCSPDirectives = {
+    "default-src": "'self'",
+    "script-src": "'self' 'unsafe-inline'",
+    "style-src": "'self' 'unsafe-inline' https:",
+    "img-src": "'self' data: https:",
+    "font-src": "'self' https:",
+    "connect-src": "'self'",
+    "frame-src": "'none'",       // No iframes in blog posts
+    "object-src": "'none'",      // No plugins/objects
+  };
+
+  return getSecurityHeaders(request, {
+    ...config,
+    frameOptions: "SAMEORIGIN", // Allow embedding from same origin
+    cspDirectives: {
+      ...blogCSPDirectives,
+      ...(config.cspDirectives ?? {}),
+    },
+  });
+}
+
+/**
+ * Security header presets for different use cases
+ */
+export const SECURITY_PRESETS = {
+  /** Strict security for API endpoints */
+  API: {
+    enableCSP: true,
+    frameOptions: "DENY",
+    cspDirectives: {
+      "default-src": "'none'",
+      "frame-ancestors": "'none'",
+      "base-uri": "'none'",
+    },
+  },
+
+  /** Balanced security for blog pages */
+  BLOG: {
+    enableCSP: true,
+    frameOptions: "SAMEORIGIN",
+    cspDirectives: {
+      "default-src": "'self'",
+      "script-src": "'self' 'unsafe-inline'",
+      "style-src": "'self' 'unsafe-inline' https:",
+      "img-src": "'self' data: https:",
+      "font-src": "'self' https:",
+    },
+  },
+
+  /** Development-friendly settings */
+  DEVELOPMENT: {
+    enableCSP: false,
+    enableHSTS: false,
+    frameOptions: "SAMEORIGIN",
+  },
+} as const;
+
+/**
+ * Validate and sanitize CSP directive values
+ */
+export function sanitizeCSPDirective(directive: string, value: string): string {
+  // Remove potentially dangerous values
+  const sanitized = value
+    .replace(/javascript:/gi, "")     // Remove javascript: URIs
+    .replace(/data:/gi, "data:")      // Normalize data: URIs
+    .replace(/\s+/g, " ")             // Normalize whitespace
+    .trim();
+
+  // Validate that value doesn't contain injection attempts
+  if (sanitized.includes(";") || sanitized.includes("\n") || sanitized.includes("\r")) {
+    console.warn(`Potentially dangerous CSP value for ${directive}: ${value}`);
+    return "'none'"; // Safe fallback
+  }
+
+  return sanitized;
+}