hi-secure 1.0.0

package/src/adapters/JWTAdapter.ts

@@ -0,0 +1,346 @@
+// // import jwt from "jsonwebtoken";
+// // import { AdapterError } from "../core/errors/AdapterError";
+// // import { logError } from "../logging";
+
+// // export interface JWTAdapterOptions {
+// //     secret: string;
+// //     expiresIn?: string | number | undefined;
+// // }
+
+// // export class JWTAdapter {
+// //     private secret: string;
+// //     private expiresIn?: string | number;
+
+// //     constructor(options: JWTAdapterOptions) {
+// //         if (!options.secret) {
+// //             throw new AdapterError("JWT secret is required");
+// //         }
+
+// //         this.secret = options.secret;
+
+// //         // Normalize expiresIn
+// //         if (options.expiresIn !== undefined) {
+// //             this.expiresIn = options.expiresIn as string | number;
+// //         }
+// //     }
+
+// //     sign(
+// //         payload: object,
+// //         options?: { expiresIn?: string | number }
+// //     ) {
+// //         try {
+// //             const finalExpires =
+// //                 options?.expiresIn ?? this.expiresIn;
+
+// //             const jwtOptions: jwt.SignOptions = {};
+
+// //             if (finalExpires !== undefined) {
+// //                 // Force safe cast → matches SignOptions type
+// //                 jwtOptions.expiresIn = finalExpires as number | any;
+// //             }
+
+// //             return jwt.sign(payload, this.secret, jwtOptions);
+
+// //         } catch (err: any) {
+// //             logError("JWTAdapter.sign failed", { error: err?.message });
+// //             throw new AdapterError(err?.message || "JWT sign failed");
+// //         }
+// //     }
+
+// //     verify(token: string) {
+// //         try {
+// //             return jwt.verify(token, this.secret);
+// //         } catch (err: any) {
+// //             logError("JWTAdapter.verify failed", { error: err?.message });
+// //             throw new AdapterError(err?.message || "JWT verify failed");
+// //         }
+// //     }
+// // }
+
+
+
+// // // src/adapters/JWTAdapter.ts - FIXED (Security hardening)
+// // import jwt from "jsonwebtoken";
+// // import { v4 as uuidv4 } from "uuid";
+// // import { AdapterError } from "../core/errors/AdapterError.js";
+// // import { logError } from "../logging/index.js";
+
+// // export interface JWTAdapterOptions {
+// //     secret: string;
+// //     expiresIn?: string | number;
+// //     algorithm?: jwt.Algorithm;
+// //     issuer?: string;
+// //     audience?: string | string[];
+// // }
+
+// // export interface SignOptions {
+// //     expiresIn?: string | number;
+// //     jti?: string; // JWT ID for token revocation
+// //     subject?: string;
+// //     issuer?: string;
+// //     audience?: string | string[];
+// // }
+
+// // export class JWTAdapter {
+// //     private secret: string;
+// //     private expiresIn?: string | number;
+// //     private algorithm: jwt.Algorithm;
+// //     private issuer?: string;
+// //     private audience?: string | string[];
+
+// //     constructor(options: JWTAdapterOptions) {
+// //         if (!options.secret) {
+// //             throw new AdapterError("JWT secret is required");
+// //         }
+
+// //         if (options.secret.length < 32) {
+// //             logError("⚠ JWT secret is too short (minimum 32 characters recommended)");
+// //         }
+
+// //         this.secret = options.secret;
+// //         this.expiresIn = options.expiresIn;
+// //         this.algorithm = options.algorithm || 'HS256'; // ⚠️ Default algorithm
+// //         this.issuer = options.issuer;
+// //         this.audience = options.audience;
+// //     }
+
+// //     sign(payload: object, options?: SignOptions) {
+// //         try {
+// //             const jwtOptions: jwt.SignOptions = {
+// //                 algorithm: this.algorithm,
+// //                 issuer: options?.issuer || this.issuer,
+// //                 audience: options?.audience || this.audience,
+// //                 jwtid: options?.jti || uuidv4(), // Unique token ID
+// //                 subject: options?.subject
+// //             };
+
+// //             if (options?.expiresIn !== undefined) {
+// //                 jwtOptions.expiresIn = options.expiresIn as number;
+// //             } else if (this.expiresIn !== undefined) {
+// //                 jwtOptions.expiresIn = this.expiresIn as number;
+// //             }
+
+// //             return jwt.sign(payload, this.secret, jwtOptions);
+
+// //         } catch (err: any) {
+// //             logError("JWTAdapter.sign failed", { error: err?.message });
+// //             throw new AdapterError(err?.message || "JWT sign failed");
+// //         }
+// //     }
+
+// //     verify(token: string, options?: { audience?: string | string[] }) {
+// //         try {
+// //             const verifyOptions: jwt.VerifyOptions = {
+// //                 algorithms: [this.algorithm],
+// //                 issuer: this.issuer,
+// //                 audience: options?.audience as string || this.audience as string
+// //             };
+
+// //             return jwt.verify(token, this.secret, verifyOptions);
+// //         } catch (err: any) {
+// //             logError("JWTAdapter.verify failed", { error: err?.message });
+            
+// //             // Provide better error messages
+// //             if (err.name === 'TokenExpiredError') {
+// //                 throw new AdapterError("JWT token has expired");
+// //             }
+// //             if (err.name === 'JsonWebTokenError') {
+// //                 throw new AdapterError("Invalid JWT token");
+// //             }
+            
+// //             throw new AdapterError(err?.message || "JWT verification failed");
+// //         }
+// //     }
+// // }
+
+
+// // src/adapters/JWTAdapter.ts - FIXED (Security hardening)
+// import jwt from "jsonwebtoken";
+// import { nanoid } from "nanoid";  // CHANGED: from uuid to nanoid
+// import { AdapterError } from "../core/errors/AdapterError.js";
+// import { logError } from "../logging/index.js";
+
+// export interface JWTAdapterOptions {
+//     secret: string;
+//     expiresIn?: string | number;
+//     algorithm?: jwt.Algorithm;
+//     issuer?: string;
+//     audience?: string | string[];
+// }
+
+// export interface SignOptions {
+//     expiresIn?: string | number;
+//     jti?: string; // JWT ID for token revocation
+//     subject?: string;
+//     issuer?: string;
+//     audience?: string | string[];
+// }
+
+// export class JWTAdapter {
+//     private secret: string;
+//     private expiresIn?: string | number;
+//     private algorithm: jwt.Algorithm;
+//     private issuer?: string;
+//     private audience?: string | string[];
+
+//     constructor(options: JWTAdapterOptions) {
+//         if (!options.secret) {
+//             throw new AdapterError("JWT secret is required");
+//         }
+
+//         if (options.secret.length < 32) {
+//             logError("⚠ JWT secret is too short (minimum 32 characters recommended)");
+//         }
+
+//         this.secret = options.secret;
+//         this.expiresIn = options.expiresIn;
+//         this.algorithm = options.algorithm || 'HS256'; // ⚠️ Default algorithm
+//         this.issuer = options.issuer;
+//         this.audience = options.audience;
+//     }
+
+//     sign(payload: object, options?: SignOptions) {
+//         try {
+//             const jwtOptions: jwt.SignOptions = {
+//                 algorithm: this.algorithm,
+//                 issuer: options?.issuer || this.issuer,
+//                 audience: options?.audience || this.audience,
+//                 jwtid: options?.jti || nanoid(),  // CHANGED: uuidv4() to nanoid()
+//                 subject: options?.subject
+//             };
+
+//             if (options?.expiresIn !== undefined) {
+//                 jwtOptions.expiresIn = options.expiresIn as number;
+//             } else if (this.expiresIn !== undefined) {
+//                 jwtOptions.expiresIn = this.expiresIn as number;
+//             }
+
+//             return jwt.sign(payload, this.secret, jwtOptions);
+
+//         } catch (err: any) {
+//             logError("JWTAdapter.sign failed", { error: err?.message });
+//             throw new AdapterError(err?.message || "JWT sign failed");
+//         }
+//     }
+
+//     verify(token: string, options?: { audience?: string | string[] }) {
+//         try {
+//             const verifyOptions: jwt.VerifyOptions = {
+//                 algorithms: [this.algorithm],
+//                 issuer: this.issuer,
+//                 audience: options?.audience as string || this.audience as string
+//             };
+
+//             return jwt.verify(token, this.secret, verifyOptions);
+//         } catch (err: any) {
+//             logError("JWTAdapter.verify failed", { error: err?.message });
+            
+//             // Provide better error messages
+//             if (err.name === 'TokenExpiredError') {
+//                 throw new AdapterError("JWT token has expired");
+//             }
+//             if (err.name === 'JsonWebTokenError') {
+//                 throw new AdapterError("Invalid JWT token");
+//             }
+            
+//             throw new AdapterError(err?.message || "JWT verification failed");
+//         }
+//     }
+// }
+
+
+
+
+// src/adapters/JWTAdapter.ts - FIXED (Using crypto.randomUUID())
+import jwt from "jsonwebtoken";
+import { randomUUID } from "crypto";  // Built-in Node.js
+import { AdapterError } from "../core/errors/AdapterError.js";
+import { logError } from "../logging/index.js";
+
+export interface JWTAdapterOptions {
+    secret: string;
+    expiresIn?: string | number;
+    algorithm?: jwt.Algorithm;
+    issuer?: string;
+    audience?: string | string[];
+}
+
+export interface SignOptions {
+    expiresIn?: string | number;
+    jti?: string; // JWT ID for token revocation
+    subject?: string;
+    issuer?: string;
+    audience?: string | string[];
+}
+
+export class JWTAdapter {
+    private secret: string;
+    private expiresIn?: string | number;
+    private algorithm: jwt.Algorithm;
+    private issuer?: string;
+    private audience?: string | string[];
+
+    constructor(options: JWTAdapterOptions) {
+        if (!options.secret) {
+            throw new AdapterError("JWT secret is required");
+        }
+
+        if (options.secret.length < 32) {
+            logError("⚠ JWT secret is too short (minimum 32 characters recommended)");
+        }
+
+        this.secret = options.secret;
+        this.expiresIn = options.expiresIn;
+        this.algorithm = options.algorithm || 'HS256'; // ⚠️ Default algorithm
+        this.issuer = options.issuer;
+        this.audience = options.audience;
+    }
+
+    sign(payload: object, options?: SignOptions) {
+        try {
+            const jwtOptions: jwt.SignOptions = {
+                algorithm: this.algorithm,
+                issuer: options?.issuer || this.issuer,
+                audience: options?.audience || this.audience,
+                jwtid: options?.jti || randomUUID(),  // ✅ Using crypto.randomUUID()
+                subject: options?.subject
+            };
+
+            if (options?.expiresIn !== undefined) {
+                jwtOptions.expiresIn = options.expiresIn as number;
+            } else if (this.expiresIn !== undefined) {
+                jwtOptions.expiresIn = this.expiresIn as number;
+            }
+
+            return jwt.sign(payload, this.secret, jwtOptions);
+
+        } catch (err: any) {
+            logError("JWTAdapter.sign failed", { error: err?.message });
+            throw new AdapterError(err?.message || "JWT sign failed");
+        }
+    }
+
+    verify(token: string, options?: { audience?: string | string[] }) {
+        try {
+            const verifyOptions: jwt.VerifyOptions = {
+                algorithms: [this.algorithm],
+                issuer: this.issuer,
+                audience: options?.audience as string || this.audience as string
+            };
+
+            return jwt.verify(token, this.secret, verifyOptions);
+        } catch (err: any) {
+            logError("JWTAdapter.verify failed", { error: err?.message });
+            
+            // Provide better error messages
+            if (err.name === 'TokenExpiredError') {
+                throw new AdapterError("JWT token has expired");
+            }
+            if (err.name === 'JsonWebTokenError') {
+                throw new AdapterError("Invalid JWT token");
+            }
+            
+            throw new AdapterError(err?.message || "JWT verification failed");
+        }
+    }
+}

package/src/adapters/RLFlexibleAdapter.ts

@@ -0,0 +1,139 @@
+
+// import { RateLimiterMemory, RateLimiterRes } from "rate-limiter-flexible";
+// import { logger } from "../logging";
+// import { AdapterError } from "../core/errors/AdapterError";
+
+// export class RLFlexibleAdapter {
+
+//     /**
+//      * Create middleware dynamically using options.
+//      */
+//     getMiddleware(options: {
+//         points?: number;
+//         duration?: number; // seconds
+//         message?: any;
+//     } = {}) {
+
+//         try {
+//             const limiter = new RateLimiterMemory({
+//                 points: options.points ?? 100,
+//                 duration: options.duration ?? 60,
+//             });
+
+//             return async (req: any, res: any, next: any) => {
+//                 const ip = req.ip ||
+//                            req.headers["x-forwarded-for"] ||
+//                            req.connection?.remoteAddress ||
+//                            "unknown";
+
+//                 try {
+//                     await limiter.consume(ip);
+//                     next();
+//                 } catch (err: any) {
+//                     const rlErr = err as RateLimiterRes;
+
+//                     logger.warn("⚠ RLFlexibleAdapter: rate limit exceeded", {
+//                         ip,
+//                         path: req.path,
+//                         method: req.method,
+//                         retryAfter: rlErr.msBeforeNext
+//                     });
+
+//                     return res.status(429).json({
+//                         success: false,
+//                         error: "RATE_LIMIT_EXCEEDED",
+//                         retryAfter: Math.ceil(rlErr.msBeforeNext / 1000),
+//                         message: options.message ?? "Too many requests, slow down."
+//                     });
+//                 }
+//             };
+
+//         } catch (err: any) {
+//             logger.error("❌ RLFlexibleAdapter: failed to initialize limiter", {
+//                 error: err?.message || err
+//             });
+//             throw new AdapterError("RateLimiterFlexible creation failed.");
+//         }
+//     }
+// }
+
+
+
+// src/adapters/RLFlexibleAdapter.ts - IMPROVED
+import { RateLimiterMemory, RateLimiterRes } from "rate-limiter-flexible";
+import { logger } from "../logging/index.js";
+import { AdapterError } from "../core/errors/AdapterError.js";
+
+export interface RLOptions {
+    points?: number;
+    duration?: number; // seconds
+    message?: any;
+    blockDuration?: number;
+}
+
+export class RLFlexibleAdapter {
+    getMiddleware(options: RLOptions = {}) {
+        try {
+            const defaultOptions = {
+                points: 100,
+                duration: 60,
+                message: "Too many requests, slow down.",
+                blockDuration: 0
+            };
+
+            const finalOptions = { ...defaultOptions, ...options };
+
+            const limiter = new RateLimiterMemory({
+                points: finalOptions.points,
+                duration: finalOptions.duration,
+                blockDuration: finalOptions.blockDuration
+            });
+
+            return async (req: any, res: any, next: any) => {
+                // Better IP extraction
+                const ip = this.extractIP(req);
+
+                try {
+                    await limiter.consume(ip);
+                    next();
+                } catch (err: any) {
+                    const rlErr = err as RateLimiterRes;
+
+                    logger.warn("⚠ RLFlexibleAdapter: rate limit exceeded", {
+                        ip,
+                        path: req.path,
+                        method: req.method,
+                        retryAfter: rlErr.msBeforeNext
+                    });
+
+                    res.setHeader('Retry-After', Math.ceil(rlErr.msBeforeNext / 1000));
+                    
+                    return res.status(429).json({
+                        success: false,
+                        error: "RATE_LIMIT_EXCEEDED",
+                        retryAfter: Math.ceil(rlErr.msBeforeNext / 1000),
+                        message: finalOptions.message
+                    });
+                }
+            };
+
+        } catch (err: any) {
+            logger.error("❌ RLFlexibleAdapter: failed to initialize limiter", {
+                error: err?.message || err
+            });
+            throw new AdapterError("RateLimiterFlexible creation failed.");
+        }
+    }
+
+    private extractIP(req: any): string {
+        // Order of priority for IP extraction
+        return (
+            req.headers['x-real-ip'] ||
+            req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
+            req.ip ||
+            req.connection?.remoteAddress ||
+            req.socket?.remoteAddress ||
+            'unknown'
+        );
+    }
+}

package/src/adapters/SanitizeHtmlAdapter.ts

@@ -0,0 +1,162 @@
+// import sanitizeHtml from "sanitize-html";
+// import { AdapterError } from "../core/errors/AdapterError";
+// import { logger } from "../logging";
+
+// export class SanitizeHtmlAdapter {
+//     private globalOptions: sanitizeHtml.IOptions;
+
+//     constructor(options: sanitizeHtml.IOptions = {}) {
+//         this.globalOptions = options;
+//     }
+
+//     /**
+//      * Sanitize a string with merged global + dynamic options
+//      */
+//     sanitize(input: string, dynamicOptions?: any): string {
+//         try {
+//             const opts = { ...this.globalOptions, ...(dynamicOptions || {}) };
+
+//             const clean = sanitizeHtml(input, opts);
+
+//             return typeof clean === "string" ? clean : String(clean);
+
+//         } catch (err: any) {
+//             logger.error("❌ sanitize-html failed", {
+//                 error: err?.message || err,
+//                 preview: typeof input === "string" ? input.slice(0, 100) : undefined
+//             });
+
+//             throw new AdapterError("sanitize-html adapter failed.");
+//         }
+//     }
+
+//     /**
+//      * Deep sanitize nested objects, arrays, strings
+//      */
+//     private deepSanitize(obj: any, dynamicOptions?: any): any {
+//         if (typeof obj === "string") {
+//             return this.sanitize(obj, dynamicOptions);
+//         }
+
+//         if (Array.isArray(obj)) {
+//             return obj.map((item) => this.deepSanitize(item, dynamicOptions));
+//         }
+
+//         if (obj && typeof obj === "object") {
+//             const result: any = {};
+//             for (const key of Object.keys(obj)) {
+//                 result[key] = this.deepSanitize(obj[key], dynamicOptions);
+//             }
+//             return result;
+//         }
+
+//         return obj;
+//     }
+
+//     /**
+//      * Middleware wrapper with dynamic per-route options
+//      */
+//     middleware(dynamicOptions?: any) {
+//         return (req: any, _res: any, next: any) => {
+//             try {
+//                 if (req.body) {
+//                     req.body = this.deepSanitize(req.body, dynamicOptions);
+
+//                     logger.debug("🧼 sanitize-html applied", {
+//                         keys: Object.keys(req.body)
+//                     });
+//                 }
+//                 next();
+
+//             } catch (err: any) {
+//                 logger.error("❌ sanitize-html middleware failed", {
+//                     error: err?.message || err
+//                 });
+//                 next(err);
+//             }
+//         };
+//     }
+// }
+
+
+// src/adapters/SanitizeHtmlAdapter.ts - FIXED
+import sanitizeHtml from "sanitize-html";
+import { AdapterError } from "../core/errors/AdapterError.js";
+import { logger } from "../logging/index.js";
+
+export class SanitizeHtmlAdapter {
+    private globalOptions: sanitizeHtml.IOptions;
+
+    constructor(options: sanitizeHtml.IOptions = {}) {
+        this.globalOptions = options;
+    }
+
+    sanitize(input: string, dynamicOptions?: any): string {
+        try {
+            const opts = { ...this.globalOptions, ...(dynamicOptions || {}) };
+
+            const clean = sanitizeHtml(input, opts);
+            return typeof clean === "string" ? clean : String(clean);
+
+        } catch (err: any) {
+            logger.error("❌ sanitize-html failed", {
+                error: err?.message || err,
+                preview: typeof input === "string" ? input.slice(0, 100) : undefined
+            });
+
+            throw new AdapterError("sanitize-html adapter failed.");
+        }
+    }
+
+    /**
+     * Deep sanitize with recursion protection
+     */
+    private deepSanitize(obj: any, dynamicOptions?: any, visited = new WeakSet()): any {
+        // Handle circular references
+        if (obj && typeof obj === "object") {
+            if (visited.has(obj)) {
+                return obj; // Circular reference detected
+            }
+            visited.add(obj);
+        }
+
+        if (typeof obj === "string") {
+            return this.sanitize(obj, dynamicOptions);
+        }
+
+        if (Array.isArray(obj)) {
+            return obj.map((item) => this.deepSanitize(item, dynamicOptions, visited));
+        }
+
+        if (obj && typeof obj === "object") {
+            const result: any = {};
+            for (const key of Object.keys(obj)) {
+                result[key] = this.deepSanitize(obj[key], dynamicOptions, visited);
+            }
+            return result;
+        }
+
+        return obj;
+    }
+
+    middleware(dynamicOptions?: any) {
+        return (req: any, _res: any, next: any) => {
+            try {
+                if (req.body) {
+                    req.body = this.deepSanitize(req.body, dynamicOptions);
+
+                    logger.debug("🧼 sanitize-html applied", {
+                        keys: Object.keys(req.body)
+                    });
+                }
+                next();
+
+            } catch (err: any) {
+                logger.error("❌ sanitize-html middleware failed", {
+                    error: err?.message || err
+                });
+                next(err);
+            }
+        };
+    }
+}