acrylblends 0.3.0 → 0.4.0

package/plugins/acryl-router/src/core/middleware/csrf/index.ts

@@ -0,0 +1,150 @@
+/**
+ * @module
+ * CSRF Protection Middleware for App.
+ */
+
+import type { Context } from '../../context.ts'
+import { HTTPException } from '../../http-exception.ts'
+import type { MiddlewareHandler } from '../../types.ts'
+
+type IsAllowedOriginHandler = (origin: string, context: Context) => boolean | Promise<boolean>
+
+const secFetchSiteValues = ['same-origin', 'same-site', 'none', 'cross-site'] as const
+type SecFetchSite = (typeof secFetchSiteValues)[number]
+
+const isSecFetchSite = (value: string): value is SecFetchSite =>
+  (secFetchSiteValues as readonly string[]).includes(value)
+
+type IsAllowedSecFetchSiteHandler = (
+  secFetchSite: SecFetchSite,
+  context: Context
+) => boolean | Promise<boolean>
+
+interface CSRFOptions {
+  origin?: string | string[] | IsAllowedOriginHandler
+  secFetchSite?: SecFetchSite | SecFetchSite[] | IsAllowedSecFetchSiteHandler
+}
+
+const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/
+const isRequestedByFormElementRe =
+  /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i
+
+/**
+ * CSRF Protection Middleware for App.
+ *
+ * Protects against Cross-Site Request Forgery attacks by validating request origins
+ * and sec-fetch-site headers. The request is allowed if either validation passes.
+ *
+ *
+ * @param {CSRFOptions} [options] - The options for the CSRF protection middleware.
+ * @param {string|string[]|(origin: string, context: Context) => boolean} [options.origin] -
+ *   Allowed origins for requests.
+ *   - string: Single allowed origin (e.g., 'https://example.com')
+ *   - string[]: Multiple allowed origins
+ *   - function: Custom validation logic
+ *   - Default: Only same origin as the request URL
+ * @param {string|string[]|(secFetchSite: string, context: Context) => boolean} [options.secFetchSite] -
+ *   Sec-Fetch-Site header validation. Standard values include 'same-origin', 'same-site', 'cross-site', 'none'.
+ *   - string: Single allowed value (e.g., 'same-origin')
+ *   - string[]: Multiple allowed values (e.g., ['same-origin', 'same-site'])
+ *   - function: Custom validation with access to context
+ *   - Default: Only allows 'same-origin'
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new App()
+ *
+ * // Default: both origin and sec-fetch-site validation
+ * app.use('*', csrf())
+ *
+ * // Allow specific origins
+ * app.use('*', csrf({ origin: 'https://example.com' }))
+ * app.use('*', csrf({ origin: ['https://app.com', 'https://api.com'] }))
+ *
+ * // Allow specific sec-fetch-site values
+ * app.use('*', csrf({ secFetchSite: 'same-origin' }))
+ * app.use('*', csrf({ secFetchSite: ['same-origin', 'same-site'] }))
+ *
+ * // Dynamic sec-fetch-site validation
+ * app.use('*', csrf({
+ *   secFetchSite: (secFetchSite, c) => {
+ *     // Always allow same-origin
+ *     if (secFetchSite === 'same-origin') return true
+ *     // Allow cross-site for webhook endpoints
+ *     if (secFetchSite === 'cross-site' && c.req.path.startsWith('/webhook/')) {
+ *       return true
+ *     }
+ *     return false
+ *   }
+ * }))
+ *
+ * // Dynamic origin validation
+ * app.use('*', csrf({
+ *   origin: (origin, c) => {
+ *     // Allow same origin
+ *     if (origin === new URL(c.req.url).origin) return true
+ *     // Allow specific trusted domains
+ *     return ['https://app.example.com', 'https://admin.example.com'].includes(origin)
+ *   }
+ * }))
+ * ```
+ */
+export const csrf = (options?: CSRFOptions): MiddlewareHandler => {
+  const originHandler: IsAllowedOriginHandler = ((optsOrigin) => {
+    if (!optsOrigin) {
+      return (origin, c) => origin === new URL(c.req.url).origin
+    } else if (typeof optsOrigin === 'string') {
+      return (origin) => origin === optsOrigin
+    } else if (typeof optsOrigin === 'function') {
+      return optsOrigin
+    } else {
+      return (origin) => optsOrigin.includes(origin)
+    }
+  })(options?.origin)
+  const isAllowedOrigin = async (origin: string | undefined, c: Context) => {
+    if (origin === undefined) {
+      // denied always when origin header is not present
+      return false
+    }
+    return await originHandler(origin, c)
+  }
+
+  const secFetchSiteHandler: IsAllowedSecFetchSiteHandler = ((optsSecFetchSite) => {
+    if (!optsSecFetchSite) {
+      // Default: only allow same-origin
+      return (secFetchSite) => secFetchSite === 'same-origin'
+    } else if (typeof optsSecFetchSite === 'string') {
+      return (secFetchSite) => secFetchSite === optsSecFetchSite
+    } else if (typeof optsSecFetchSite === 'function') {
+      return optsSecFetchSite
+    } else {
+      return (secFetchSite) => optsSecFetchSite.includes(secFetchSite)
+    }
+  })(options?.secFetchSite)
+  const isAllowedSecFetchSite = async (secFetchSite: string | undefined, c: Context) => {
+    if (secFetchSite === undefined) {
+      // denied always when sec-fetch-site header is not present
+      return false
+    }
+    // type guard to check if the value is a valid SecFetchSite
+    if (!isSecFetchSite(secFetchSite)) {
+      return false
+    }
+    return await secFetchSiteHandler(secFetchSite, c)
+  }
+
+  return async function csrf(c, next) {
+    if (
+      !isSafeMethodRe.test(c.req.method) &&
+      isRequestedByFormElementRe.test(c.req.header('content-type') || 'text/plain') &&
+      !(await isAllowedSecFetchSite(c.req.header('sec-fetch-site'), c)) &&
+      !(await isAllowedOrigin(c.req.header('origin'), c))
+    ) {
+      const res = new Response('Forbidden', { status: 403 })
+      throw new HTTPException(403, { res })
+    }
+
+    await next()
+  }
+}

package/plugins/acryl-router/src/core/middleware/etag/digest.test.ts

@@ -0,0 +1,21 @@
+import { generateDigest } from './digest.ts'
+
+describe('generateDigest', () => {
+  it('Should copy pending bytes from a stream that reuses its buffer', async () => {
+    const scratch = new Uint8Array(4)
+    let pullCount = 0
+    const stream = new ReadableStream({
+      pull(controller) {
+        scratch.fill(pullCount === 0 ? 0x41 : 0x42)
+        controller.enqueue(scratch)
+        if (++pullCount === 2) {
+          controller.close()
+        }
+      },
+    })
+
+    const digest = await generateDigest(stream, (body) => crypto.subtle.digest('SHA-1', body))
+
+    expect(digest).toBe('7cd188ef3a9ea7fa0ee9c62c168709695460f5c0')
+  })
+})

package/plugins/acryl-router/src/core/middleware/etag/digest.ts

@@ -0,0 +1,95 @@
+const mergeBuffers = (
+  buffer1: ArrayBuffer | undefined,
+  buffer2: Uint8Array<ArrayBuffer>
+): Uint8Array<ArrayBuffer> => {
+  if (!buffer1) {
+    return buffer2
+  }
+  const merged = new Uint8Array<ArrayBuffer>(
+    new ArrayBuffer(buffer1.byteLength + buffer2.byteLength)
+  )
+  merged.set(new Uint8Array(buffer1), 0)
+  merged.set(buffer2, buffer1.byteLength)
+  return merged
+}
+
+const CHUNK_SIZE = 256 * 1024
+
+export const generateDigest = async (
+  stream: ReadableStream<Uint8Array<ArrayBuffer>> | null,
+  generator: (body: Uint8Array<ArrayBuffer>) => ArrayBuffer | Promise<ArrayBuffer>
+): Promise<string | null> => {
+  if (!stream) {
+    return null
+  }
+
+  let result: ArrayBuffer | undefined = undefined
+  let chunk: Uint8Array<ArrayBuffer> | undefined
+  let chunkLength = 0
+
+  const digest = async (body: Uint8Array<ArrayBuffer>) => {
+    result = await generator(mergeBuffers(result, body))
+  }
+
+  const reader = stream.getReader()
+  for (;;) {
+    const { value, done } = await reader.read()
+    if (done) {
+      break
+    }
+
+    let offset = 0
+    while (offset < value.byteLength) {
+      const remaining = value.byteLength - offset
+
+      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+        await digest(value.subarray(offset, offset + CHUNK_SIZE))
+        offset += CHUNK_SIZE
+        continue
+      }
+
+      const requiredLength = chunkLength + remaining
+      if (requiredLength < CHUNK_SIZE) {
+        if (!chunk) {
+          chunk = value.slice(offset)
+        } else {
+          if (chunk.byteLength < requiredLength) {
+            const nextChunk = new Uint8Array<ArrayBuffer>(
+              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
+            )
+            nextChunk.set(chunk.subarray(0, chunkLength))
+            chunk = nextChunk
+          }
+          chunk.set(value.subarray(offset), chunkLength)
+        }
+        chunkLength = requiredLength
+        break
+      }
+
+      const length = CHUNK_SIZE - chunkLength
+      if (chunk?.byteLength !== CHUNK_SIZE) {
+        const nextChunk = new Uint8Array<ArrayBuffer>(new ArrayBuffer(CHUNK_SIZE))
+        if (chunk) {
+          nextChunk.set(chunk.subarray(0, chunkLength))
+        }
+        chunk = nextChunk
+      }
+      chunk.set(value.subarray(offset, offset + length), chunkLength)
+      await digest(chunk)
+      chunkLength = 0
+      offset += length
+    }
+  }
+
+  if (chunk && chunkLength > 0) {
+    await digest(chunk.subarray(0, chunkLength))
+  }
+
+  if (!result) {
+    return null
+  }
+
+  return Array.prototype.map
+    .call(new Uint8Array(result), (x) => x.toString(16).padStart(2, '0'))
+    .join('')
+}