hazo_secure 0.5.0 → 1.1.0

package/dist/csrf/index.d.ts

@@ -1,3 +1,5 @@
+import { HazoError } from 'hazo_core';
+
 interface CsrfPolicy {
     cookieName?: string;
     headerName?: string;
@@ -14,7 +16,14 @@ interface CsrfPolicy {
     };
 }
 type CsrfErrorCode = "csrf_cookie_missing" | "csrf_header_missing" | "csrf_mismatch" | "csrf_malformed";
-declare class CsrfError extends Error {
+/**
+ * Typed error raised by `/csrf`. Extends `HazoError` so it participates in
+ * the workspace's correlation-ID auto-attach + envelope shape, while
+ * preserving the legacy `(code, message)` constructor + `err.code` short
+ * discriminator that 1.0.x consumers already check. All CSRF rejections
+ * map to HTTP 403.
+ */
+declare class CsrfError extends HazoError {
     readonly code: CsrfErrorCode;
     constructor(code: CsrfErrorCode, message: string);
 }

package/dist/csrf/index.js

@@ -1,15 +1,20 @@
 // src/csrf/index.ts
+import { HazoError } from "hazo_core";
 var DEFAULT_COOKIE_NAME = "hs_csrf";
 var DEFAULT_HEADER_NAME = "x-csrf-token";
 var DEFAULT_TOKEN_LENGTH = 32;
 var DEFAULT_PROTECTED = ["POST", "PUT", "PATCH", "DELETE"];
-var CsrfError = class extends Error {
+var CsrfError = class extends HazoError {
   constructor(code, message) {
-    super(message);
-    this.code = code;
+    super({
+      code,
+      pkg: "hazo_secure",
+      message,
+      httpStatus: 403,
+      retryable: false
+    });
     this.name = "CsrfError";
   }
-  code;
 };
 function resolved(policy) {
   return {

package/dist/fetch/index.d.ts

@@ -1,3 +1,24 @@
+import { HazoError } from 'hazo_core';
+import { Agent } from 'undici';
+
+/**
+ * Validates a resolved IP at connect time. Throws `SafeFetchError("private_ip_blocked")`
+ * if private/reserved. Exported so it can be unit-tested directly.
+ *
+ * Carries the legacy `SSRF_PRIVATE_IP` ErrnoException-style code on the error
+ * for older consumers that grepped for it. New code should branch on the
+ * SafeFetchError discriminator instead.
+ */
+declare function validateConnectIp(ip: string): void;
+/**
+ * Creates an undici Agent whose DNS lookup validates the resolved IP before
+ * the TCP socket is opened. This prevents DNS rebinding: even if the DNS
+ * record flips after the pre-flight check, the IP is re-validated here.
+ *
+ * Node 18+ ships undici as a built-in; we pin an explicit dep for stability.
+ */
+declare function createSecureDispatcher(): Agent;
+
 interface SafeFetchPolicy {
     allowedHosts?: readonly string[];
     allowedHostPatterns?: readonly RegExp[];
@@ -15,10 +36,16 @@ interface SafeFetchOptions extends Omit<RequestInit, "redirect"> {
     deps?: SafeFetchDeps;
 }
 type SafeFetchErrorCode = "invalid_url" | "protocol_not_allowed" | "host_not_allowed" | "dns_failed" | "private_ip_blocked" | "redirect_limit" | "redirect_loop" | "timeout";
-declare class SafeFetchError extends Error {
+/**
+ * Typed error raised by `safeFetch`. Extends `HazoError` so it participates
+ * in the workspace's correlation-ID auto-attach + envelope JSON shape, while
+ * preserving the legacy `(code, message)` constructor + `err.code` short
+ * discriminator that 1.0.x consumers already check.
+ */
+declare class SafeFetchError extends HazoError {
     readonly code: SafeFetchErrorCode;
     constructor(code: SafeFetchErrorCode, message: string);
 }
 declare function safeFetch(input: string | URL, options: SafeFetchOptions): Promise<Response>;
 
-export { type SafeFetchDeps, SafeFetchError, type SafeFetchErrorCode, type SafeFetchOptions, type SafeFetchPolicy, safeFetch };
+export { type SafeFetchDeps, SafeFetchError, type SafeFetchErrorCode, type SafeFetchOptions, type SafeFetchPolicy, createSecureDispatcher, safeFetch, validateConnectIp };

package/dist/fetch/index.js

@@ -1,5 +1,7 @@
 // src/fetch/index.ts
-import { lookup } from "dns/promises";
+import { lookup as lookup2 } from "dns/promises";
+import { fetch as undiciFetch } from "undici";
+import { HazoError, REQUEST_ID_HEADER, getCorrelationId } from "hazo_core";
 
 // src/fetch/cidr.ts
 import { isIP } from "net";
@@ -70,20 +72,68 @@ function isPrivateIp(ip) {
   return false;
 }
 
+// src/fetch/dispatcher.ts
+import { Agent } from "undici";
+import * as dns from "dns";
+function validateConnectIp(ip) {
+  if (isPrivateIp(ip)) {
+    const err = new SafeFetchError(
+      "private_ip_blocked",
+      `SSRF: resolved IP ${ip} is a private/reserved address \u2014 blocked at connect time`
+    );
+    err.code = "private_ip_blocked";
+    err.ssrfCode = "SSRF_PRIVATE_IP";
+    throw err;
+  }
+}
+function createSecureDispatcher() {
+  return new Agent({
+    connect: {
+      lookup(hostname, _options, callback) {
+        dns.lookup(hostname, (err, address, family) => {
+          if (err) return callback(err, "", 4);
+          try {
+            validateConnectIp(address);
+          } catch (ssrfErr) {
+            return callback(ssrfErr, "", 4);
+          }
+          callback(null, address, family);
+        });
+      }
+    }
+  });
+}
+
 // src/fetch/index.ts
-var SafeFetchError = class extends Error {
+var secureDispatcher = createSecureDispatcher();
+var SAFE_FETCH_STATUS_MAP = {
+  invalid_url: { httpStatus: 400, retryable: false },
+  protocol_not_allowed: { httpStatus: 400, retryable: false },
+  host_not_allowed: { httpStatus: 403, retryable: false },
+  dns_failed: { httpStatus: 502, retryable: true },
+  private_ip_blocked: { httpStatus: 403, retryable: false },
+  redirect_limit: { httpStatus: 502, retryable: false },
+  redirect_loop: { httpStatus: 502, retryable: false },
+  timeout: { httpStatus: 504, retryable: true }
+};
+var SafeFetchError = class extends HazoError {
   constructor(code, message) {
-    super(message);
-    this.code = code;
+    const { httpStatus, retryable } = SAFE_FETCH_STATUS_MAP[code];
+    super({
+      code,
+      pkg: "hazo_secure",
+      message,
+      httpStatus,
+      retryable
+    });
     this.name = "SafeFetchError";
   }
-  code;
 };
 var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_MAX_REDIRECTS = 3;
 var DEFAULT_PROTOCOLS = ["https:", "http:"];
 async function defaultDnsLookup(host) {
-  const records = await lookup(host, { all: true, verbatim: true });
+  const records = await lookup2(host, { all: true, verbatim: true });
   return records.map((r) => r.address);
 }
 function hostAllowed(host, policy) {
@@ -129,7 +179,8 @@ async function validateUrl(url, policy, deps) {
 }
 async function safeFetch(input, options) {
   const { policy, deps = {}, ...init } = options;
-  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fetchImpl = deps.fetchImpl ?? // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ((url, init2) => undiciFetch(url, { ...init2, dispatcher: secureDispatcher }));
   const maxRedirects = policy.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
   const timeoutMs = policy.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   let currentUrl;
@@ -138,6 +189,14 @@ async function safeFetch(input, options) {
   } catch {
     throw new SafeFetchError("invalid_url", `Could not parse URL: ${String(input)}`);
   }
+  const correlationId = getCorrelationId();
+  if (correlationId) {
+    const existingHeaders = new Headers(init.headers);
+    if (!existingHeaders.has(REQUEST_ID_HEADER)) {
+      existingHeaders.set(REQUEST_ID_HEADER, correlationId);
+      init.headers = existingHeaders;
+    }
+  }
   const visited = /* @__PURE__ */ new Set();
   let hopsRemaining = maxRedirects;
   while (true) {
@@ -185,5 +244,7 @@ async function safeFetch(input, options) {
 }
 export {
   SafeFetchError,
-  safeFetch
+  createSecureDispatcher,
+  safeFetch,
+  validateConnectIp
 };

package/dist/gdpr/index.d.ts

@@ -1,3 +1,5 @@
+import { HazoError } from 'hazo_core';
+
 interface ExporterContext {
     userId: string;
     locale?: string;
@@ -13,12 +15,57 @@ interface DomainAnonymiser {
     domain: string;
     anonymise(ctx: ExporterContext): Promise<void>;
 }
+type UserExportResult = Array<{
+    domain: string;
+    files: Array<{
+        filename: string;
+        content: Uint8Array | string;
+    }>;
+}>;
+type DryRunExportResult = Array<{
+    domain: string;
+    files: string[];
+}>;
+interface ValidateRegistryOptions {
+    /** Domain names that MUST each have both an exporter and an anonymiser registered. */
+    requiredDomains: string[];
+}
+/** Matches hazo_audit's auditIntent after partial application with an adapter. */
+type AuditIntentFn = (name: string, callback: () => Promise<void>, opts?: {
+    subject_kind?: string;
+    subject_id?: string;
+    metadata?: Record<string, unknown>;
+}) => Promise<void>;
+interface GdprRegistryOptions {
+    /**
+     * Optional audit trail. Pass hazo_audit's auditIntent partially applied:
+     *   createGdprRegistry({
+     *     auditIntent: (name, cb, opts) => auditIntent(adapter, name, cb, opts),
+     *   })
+     */
+    auditIntent?: AuditIntentFn;
+}
+type GdprRegistryErrorCode = 'incomplete_registry';
+/**
+ * Typed error raised by `/gdpr`. Extends `HazoError` so registry-incomplete
+ * gaps surface through the workspace's correlation-ID + envelope shape, while
+ * preserving the legacy `(message, code)` constructor + `err.code` short
+ * discriminator that 1.0.x consumers already check.
+ */
+declare class GdprRegistryError extends HazoError {
+    readonly code: GdprRegistryErrorCode;
+    constructor(message: string, code: GdprRegistryErrorCode);
+}
 interface GdprRegistry {
     registerExporter(exporter: DomainExporter): void;
     registerAnonymiser(anonymiser: DomainAnonymiser): void;
     listExporters(): readonly DomainExporter[];
     listAnonymisers(): readonly DomainAnonymiser[];
+    exportUser(ctx: ExporterContext): Promise<UserExportResult>;
+    anonymiseUser(ctx: ExporterContext): Promise<void>;
+    validateRegistry(opts: ValidateRegistryOptions): void;
+    dryRunExport(ctx: ExporterContext): Promise<DryRunExportResult>;
 }
-declare function createGdprRegistry(): GdprRegistry;
+declare function createGdprRegistry(opts?: GdprRegistryOptions): GdprRegistry;
 
-export { type DomainAnonymiser, type DomainExporter, type ExporterContext, type GdprRegistry, createGdprRegistry };
+export { type AuditIntentFn, type DomainAnonymiser, type DomainExporter, type DryRunExportResult, type ExporterContext, type GdprRegistry, GdprRegistryError, type GdprRegistryErrorCode, type GdprRegistryOptions, type UserExportResult, type ValidateRegistryOptions, createGdprRegistry };

package/dist/gdpr/index.js

@@ -1,22 +1,107 @@
 // src/gdpr/index.ts
-function createGdprRegistry() {
+import { HazoError } from "hazo_core";
+var GdprRegistryError = class extends HazoError {
+  constructor(message, code) {
+    super({
+      code,
+      pkg: "hazo_secure",
+      message,
+      httpStatus: 500,
+      retryable: false
+    });
+    this.name = "GdprRegistryError";
+  }
+};
+function createGdprRegistry(opts = {}) {
   const exporters = [];
   const anonymisers = [];
+  const { auditIntent } = opts;
+  async function exportUser(ctx) {
+    const run = async () => {
+      const result = [];
+      for (const exporter of exporters) {
+        const files = [];
+        for await (const item of exporter.export(ctx)) {
+          files.push(item);
+        }
+        result.push({ domain: exporter.domain, files });
+      }
+      return result;
+    };
+    if (auditIntent) {
+      let result;
+      await auditIntent(
+        "gdpr.export",
+        async () => {
+          result = await run();
+        },
+        { subject_kind: "user", subject_id: ctx.userId }
+      );
+      return result;
+    }
+    return run();
+  }
+  async function anonymiseUser(ctx) {
+    const run = async () => {
+      for (const anonymiser of anonymisers) {
+        await anonymiser.anonymise(ctx);
+      }
+    };
+    if (auditIntent) {
+      await auditIntent(
+        "gdpr.anonymise",
+        run,
+        { subject_kind: "user", subject_id: ctx.userId, metadata: { domainCount: anonymisers.length } }
+      );
+    } else {
+      await run();
+    }
+  }
+  function validateRegistry(options) {
+    const exporterDomains = new Set(exporters.map((e) => e.domain));
+    const anonymiserDomains = new Set(anonymisers.map((a) => a.domain));
+    const gaps = [];
+    for (const domain of options.requiredDomains) {
+      const missing = [];
+      if (!exporterDomains.has(domain)) missing.push("exporter");
+      if (!anonymiserDomains.has(domain)) missing.push("anonymiser");
+      if (missing.length > 0) gaps.push(`  ${domain}: missing ${missing.join(", ")}`);
+    }
+    if (gaps.length > 0) {
+      throw new GdprRegistryError(
+        `GDPR registry incomplete:
+${gaps.join("\n")}`,
+        "incomplete_registry"
+      );
+    }
+  }
+  async function dryRunExport(ctx) {
+    const result = [];
+    for (const exporter of exporters) {
+      const files = [];
+      for await (const item of exporter.export(ctx)) {
+        files.push(item.filename);
+      }
+      result.push({ domain: exporter.domain, files });
+    }
+    return result;
+  }
   return {
-    registerExporter(e) {
+    registerExporter: (e) => {
       exporters.push(e);
     },
-    registerAnonymiser(a) {
+    registerAnonymiser: (a) => {
       anonymisers.push(a);
     },
-    listExporters() {
-      return exporters;
-    },
-    listAnonymisers() {
-      return anonymisers;
-    }
+    listExporters: () => exporters,
+    listAnonymisers: () => anonymisers,
+    exportUser,
+    anonymiseUser,
+    validateRegistry,
+    dryRunExport
   };
 }
 export {
+  GdprRegistryError,
   createGdprRegistry
 };

package/dist/index.d.ts

@@ -1,10 +1,43 @@
+/**
+ * Logger utility for hazo_secure.
+ *
+ * Default: delegates to hazo_core's createLogger('hazo_secure'), which
+ * auto-injects correlationId, env, and writes structured JSON via hazo_logs.
+ * Consumers can still override with set_logger() — useful for tests, or for
+ * apps that want to route hazo_secure logs through their own sink.
+ */
 interface Logger {
-    debug(msg: string, meta?: Record<string, unknown>): void;
-    info(msg: string, meta?: Record<string, unknown>): void;
-    warn(msg: string, meta?: Record<string, unknown>): void;
-    error(msg: string, meta?: Record<string, unknown>): void;
+    info: (message: string, data?: Record<string, unknown>) => void;
+    debug: (message: string, data?: Record<string, unknown>) => void;
+    warn: (message: string, data?: Record<string, unknown>) => void;
+    error: (message: string, data?: Record<string, unknown>) => void;
 }
-declare const NoopLogger: Logger;
-declare const PACKAGE_VERSION = "0.1.0";
+/**
+ * Set the logger instance used throughout hazo_secure.
+ * Pass `undefined` to reset to the hazo_core default.
+ */
+declare function set_logger(logger: Logger | undefined): void;
+/**
+ * Get the current logger instance — defaults to hazo_core's createLogger
+ * on first access if no consumer override has been set.
+ */
+declare function get_logger(): Logger;
+/**
+ * Re-exported for backwards compatibility with hazo_secure < 1.1.0, which
+ * shipped a `NoopLogger` constant for consumers that wanted to silence
+ * package logs. Prefer `set_logger(noop_logger)` going forward.
+ */
+declare const noop_logger: Logger;
 
-export { type Logger, NoopLogger, PACKAGE_VERSION };
+/**
+ * Root entry — shared types only. Functional surface lives in the subpath
+ * modules (`hazo_secure/fetch`, `/ratelimit`, `/crypto`, `/gdpr`, `/csrf`).
+ *
+ * Logger helpers re-exported here so consumers can override the in-package
+ * logger without reaching into a subpath: `import { set_logger } from
+ * 'hazo_secure'`.
+ */
+
+declare const PACKAGE_VERSION = "1.1.0";
+
+export { type Logger, noop_logger as NoopLogger, PACKAGE_VERSION, get_logger, noop_logger, set_logger };

package/dist/index.js

@@ -1,16 +1,45 @@
-// src/index.ts
-var NoopLogger = {
-  debug() {
+// src/utils/logger.ts
+import { createLogger } from "hazo_core";
+var console_logger = {
+  info: (m, d) => d ? console.log(`[hazo_secure] ${m}`, d) : console.log(`[hazo_secure] ${m}`),
+  debug: (m, d) => d ? console.debug(`[hazo_secure] ${m}`, d) : console.debug(`[hazo_secure] ${m}`),
+  warn: (m, d) => d ? console.warn(`[hazo_secure] ${m}`, d) : console.warn(`[hazo_secure] ${m}`),
+  error: (m, d) => d ? console.error(`[hazo_secure] ${m}`, d) : console.error(`[hazo_secure] ${m}`)
+};
+function build_default_logger() {
+  try {
+    return createLogger("hazo_secure");
+  } catch {
+    return console_logger;
+  }
+}
+var current_logger = null;
+function set_logger(logger) {
+  current_logger = logger ?? null;
+}
+function get_logger() {
+  if (!current_logger) {
+    current_logger = build_default_logger();
+  }
+  return current_logger;
+}
+var noop_logger = {
+  debug: () => {
   },
-  info() {
+  info: () => {
   },
-  warn() {
+  warn: () => {
   },
-  error() {
+  error: () => {
   }
 };
-var PACKAGE_VERSION = "0.1.0";
+
+// src/index.ts
+var PACKAGE_VERSION = "1.1.0";
 export {
-  NoopLogger,
-  PACKAGE_VERSION
+  noop_logger as NoopLogger,
+  PACKAGE_VERSION,
+  get_logger,
+  noop_logger,
+  set_logger
 };

package/dist/ratelimit/index.d.ts

@@ -1,3 +1,10 @@
+/**
+ * @deprecated MemoryRateLimitStore has moved to `hazo_api/rate_limit` per D-014.
+ * This implementation remains in hazo_secure for one major version for backwards
+ * compatibility and will be removed in hazo_secure@2.0.0.
+ * Update your imports: `import { MemoryRateLimitStore } from 'hazo_api/rate_limit'`
+ */
+
 interface MemoryStoreOptions {
     now?: () => number;
     sweepIntervalMs?: number;
@@ -8,7 +15,7 @@ declare class MemoryRateLimitStore implements RateLimitStore {
     private sweepTimer;
     constructor(opts?: MemoryStoreOptions);
     get(key: string): Promise<RateLimitState | null>;
-    increment(key: string, windowMs: number): Promise<RateLimitState>;
+    increment(key: string, windowMs: number, _max?: number): Promise<RateLimitState>;
     reset(key: string): Promise<void>;
     size(): number;
     sweep(): void;
@@ -16,6 +23,50 @@ declare class MemoryRateLimitStore implements RateLimitStore {
 }
 declare function getDefaultMemoryStore(): MemoryRateLimitStore;
 
+type BucketRow = {
+    id: string;
+    tokens: number;
+    last_refill_at: string;
+    max_tokens: number;
+    refill_rate_per_ms: number;
+};
+type SvcLike = {
+    findOneBy(criteria: Record<string, unknown>): Promise<BucketRow | null>;
+    insert(data: Partial<BucketRow> | Partial<BucketRow>[]): Promise<BucketRow[]>;
+    updateById(id: unknown, patch: Partial<BucketRow>): Promise<BucketRow[]>;
+    deleteById(id: unknown): Promise<void>;
+};
+interface ConnectRateLimitStoreOptions {
+    /**
+     * Factory that resolves to a hazo_connect HazoConnectAdapter. Used in production.
+     * Call createCrudService from hazo_connect/server before passing.
+     */
+    getAdapter?: () => unknown | Promise<unknown>;
+    /** For testing: inject a CrudService stub directly. */
+    _svc?: () => SvcLike | Promise<SvcLike>;
+    /** Injectable clock. Defaults to Date.now. */
+    now?: () => number;
+}
+/**
+ * Rate-limit store backed by hazo_connect (PostgreSQL or SQLite).
+ * Uses a token bucket algorithm — no boundary burst, continuous token refill.
+ *
+ * Requires the hazo_rl_buckets table from migrations/001_hazo_rl_buckets.sql.
+ *
+ * Token bucket → RateLimitState mapping:
+ *   count = max - tokensAfterConsumption
+ *   count <= max  → allowed (tokensAfter >= 0)
+ *   count >  max  → denied  (tokensAfter < 0)
+ */
+declare class ConnectRateLimitStore implements RateLimitStore {
+    #private;
+    constructor(opts: ConnectRateLimitStoreOptions);
+    private svc;
+    get(key: string): Promise<RateLimitState | null>;
+    increment(key: string, windowMs: number, max?: number): Promise<RateLimitState>;
+    reset(key: string): Promise<void>;
+}
+
 interface RateLimitState {
     count: number;
     resetAt: number;
@@ -28,7 +79,8 @@ interface RateLimitDecision {
 }
 interface RateLimitStore {
     get(key: string): Promise<RateLimitState | null>;
-    increment(key: string, windowMs: number): Promise<RateLimitState>;
+    /** max is optional for backward compat; ConnectRateLimitStore requires it. */
+    increment(key: string, windowMs: number, max?: number): Promise<RateLimitState>;
     reset(key: string): Promise<void>;
 }
 interface RateLimiterOptions {
@@ -51,4 +103,4 @@ interface WithRateLimitOptions extends RateLimiterOptions {
 type AnyRouteHandler = (...args: any[]) => Promise<Response>;
 declare function withRateLimit<H extends AnyRouteHandler>(handler: H, opts: WithRateLimitOptions): H;
 
-export { MemoryRateLimitStore, type RateLimitDecision, type RateLimitState, type RateLimitStore, type RateLimiter, type RateLimiterOptions, type WithRateLimitOptions, checkRateLimit, createRateLimiter, defaultKeyResolver, getDefaultMemoryStore, withRateLimit };
+export { ConnectRateLimitStore, type ConnectRateLimitStoreOptions, MemoryRateLimitStore, type RateLimitDecision, type RateLimitState, type RateLimitStore, type RateLimiter, type RateLimiterOptions, type WithRateLimitOptions, checkRateLimit, createRateLimiter, defaultKeyResolver, getDefaultMemoryStore, withRateLimit };