discordjs-security 1.4.0 → 1.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "discordjs-security",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "Security utilities for discord.js v14+ (Pure CommonJS JavaScript).",
   "keywords": [
     "discord",
@@ -11,6 +11,9 @@
     "redaction",
     "anti-spam"
   ],
+  "repository": {
+    "url": "https://github.com/WRLD-ENT/discordjs-security.git"
+  },
   "license": "MIT",
   "main": "index.js",
   "engines": {

package/src/cooldown.js

@@ -0,0 +1,50 @@
+function createCooldownManager() {
+  const buckets = new Map();
+
+  function makeKey(ctx, key) {
+    const u = ctx.userId || "0";
+    const g = ctx.guildId || "0";
+    const c = ctx.channelId || "0";
+
+    switch (key) {
+      case "guild": return `g:${g}`;
+      case "channel": return `c:${c}`;
+      case "user:guild": return `u:${u}:g:${g}`;
+      case "user:channel": return `u:${u}:c:${c}`;
+      default: return `u:${u}`;
+    }
+  }
+
+  function hit(ctx, opts) {
+    const now = Date.now();
+    const limit = opts.limit || 1;
+    const key = opts.key || "user";
+    const id = makeKey(ctx, key);
+
+    const existing = buckets.get(id);
+    if (!existing || existing.resetAt <= now) {
+      const resetAt = now + opts.durationMs;
+      buckets.set(id, { count: 1, resetAt });
+      return { ok: true, remaining: limit - 1, resetAt };
+    }
+
+    if (existing.count >= limit) {
+      return { ok: false, retryAfterMs: existing.resetAt - now, resetAt: existing.resetAt };
+    }
+
+    existing.count++;
+    return { ok: true, remaining: limit - existing.count, resetAt: existing.resetAt };
+  }
+
+  function reset(ctx, key = "user") {
+    buckets.delete(makeKey(ctx, key));
+  }
+
+  function clearAll() {
+    buckets.clear();
+  }
+
+  return { hit, reset, clearAll };
+}
+
+module.exports = { createCooldownManager };

package/src/filters.js

@@ -0,0 +1,14 @@
+const INVITE_RE = /(discord\.gg|discord\.com\/invite)/i;
+const EVERYONE_RE = /@everyone|@here/;
+
+function filterContent(content, opts = {}) {
+  if (opts.blockInvites && INVITE_RE.test(content))
+    return { ok: false, reason: "Invites not allowed." };
+
+  if (opts.blockEveryoneMentions && EVERYONE_RE.test(content))
+    return { ok: false, reason: "Mass mentions not allowed." };
+
+  return { ok: true };
+}
+
+module.exports = { filterContent };

package/src/guards.js

@@ -0,0 +1,40 @@
+function guardGuildOnly(interaction) {
+  if (!interaction.inGuild()) return { ok: false, reason: "Guild only." };
+  return { ok: true };
+}
+
+function guardOwner(interaction, opts) {
+  if (!opts.ownerIds.includes(interaction.user.id))
+    return { ok: false, reason: "Not authorized." };
+  return { ok: true };
+}
+
+function guardPermissions(interaction, opts) {
+  if (!interaction.inGuild()) return { ok: true };
+  const member = interaction.member;
+  const perms = member && member.permissions;
+
+  if (!perms) return { ok: false, reason: "Missing permission context." };
+
+  const required = opts.permissions || [];
+  const ok = required.every(p => perms.has(p));
+  if (!ok) return { ok: false, reason: "Missing permissions." };
+
+  return { ok: true };
+}
+
+function guardRoles(interaction, opts) {
+  if (!interaction.inGuild()) return { ok: true };
+  const roles = interaction.member && interaction.member.roles && interaction.member.roles.cache;
+  if (!roles) return { ok: false, reason: "Missing role context." };
+
+  const requireAll = opts.requireAll === true;
+  const ok = requireAll
+    ? opts.roleIds.every(id => roles.has(id))
+    : opts.roleIds.some(id => roles.has(id));
+
+  if (!ok) return { ok: false, reason: "Missing role." };
+  return { ok: true };
+}
+
+module.exports = { guardGuildOnly, guardOwner, guardPermissions, guardRoles };

package/src/logger.js

@@ -0,0 +1,23 @@
+const util = require("node:util");
+const { redact } = require("./redact");
+
+function createSecureLogger(opts = {}) {
+  const name = opts.name || "discordjs-security";
+
+  function log(level, fmt, ...args) {
+    const msg = redact(util.format(fmt, ...args), opts);
+    const out = `[${new Date().toISOString()}] [${name}] [${level}] ${msg}`;
+    if (level === "ERROR") console.error(out);
+    else if (level === "WARN") console.warn(out);
+    else console.log(out);
+  }
+
+  return {
+    info: (f, ...a) => log("INFO", f, ...a),
+    warn: (f, ...a) => log("WARN", f, ...a),
+    error: (f, ...a) => log("ERROR", f, ...a),
+    debug: (f, ...a) => log("DEBUG", f, ...a)
+  };
+}
+
+module.exports = { createSecureLogger };

package/src/redact.js

@@ -0,0 +1,47 @@
+const DEFAULT_MASK = "[REDACTED]";
+
+const TOKEN_PATTERNS = [
+  /\b(mfa\.[\w-]{80,})\b/g,
+  /\b([\w-]{24}\.[\w-]{6}\.[\w-]{27})\b/g,
+  /\b(sk-[A-Za-z0-9]{20,})\b/g
+];
+
+const JWT_LIKE = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function redact(input, options = {}) {
+  const mask = options.mask || DEFAULT_MASK;
+  const heuristic = options.heuristic !== false;
+  let out = input;
+
+  if (options.extraSecrets && Array.isArray(options.extraSecrets)) {
+    for (const secret of options.extraSecrets) {
+      if (!secret) continue;
+      const re = new RegExp(escapeRegExp(secret), "g");
+      out = out.replace(re, mask);
+    }
+  }
+
+  if (heuristic) {
+    for (const re of TOKEN_PATTERNS) out = out.replace(re, mask);
+    out = out.replace(JWT_LIKE, mask);
+  }
+
+  return out;
+}
+
+function redactAny(value, options = {}) {
+  if (typeof value === "string") return redact(value, options);
+  if (Array.isArray(value)) return value.map(v => redactAny(v, options));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const k in value) out[k] = redactAny(value[k], options);
+    return out;
+  }
+  return value;
+}
+
+module.exports = { redact, redactAny };

package/src/safeReply.js

@@ -0,0 +1,26 @@
+function normalizeAllowedMentions(am) {
+  return {
+    parse: (am && am.parse) || [],
+    users: am && am.users,
+    roles: am && am.roles,
+    repliedUser: am && am.repliedUser === true
+  };
+}
+
+async function safeReply(interaction, options) {
+  const allowedMentions = normalizeAllowedMentions(options.allowedMentions);
+  const payload = { ...options, allowedMentions };
+
+  if (interaction.deferred || interaction.replied) {
+    return interaction.followUp(payload);
+  }
+  return interaction.reply(payload);
+}
+
+async function safeSend(target, options) {
+  const allowedMentions = normalizeAllowedMentions(options.allowedMentions);
+  const payload = { ...options, allowedMentions };
+  return target.send(payload);
+}
+
+module.exports = { safeReply, safeSend };