hi-secure 1.0.12 โ 1.0.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/adapters/ArgonAdapter.js +2 -2
- package/dist/adapters/ArgonAdapter.js.map +1 -1
- package/dist/adapters/BcryptAdapter.js +2 -2
- package/dist/adapters/BcryptAdapter.js.map +1 -1
- package/dist/adapters/ExpressRLAdapter.js +2 -2
- package/dist/adapters/ExpressRLAdapter.js.map +1 -1
- package/dist/adapters/ExpressValidatorAdapter.js +1 -1
- package/dist/adapters/ExpressValidatorAdapter.js.map +1 -1
- package/dist/adapters/GoogleAdapter.js +3 -3
- package/dist/adapters/GoogleAdapter.js.map +1 -1
- package/dist/adapters/JWTAdapter.js +2 -2
- package/dist/adapters/JWTAdapter.js.map +1 -1
- package/dist/adapters/RLFlexibleAdapter.js +2 -2
- package/dist/adapters/RLFlexibleAdapter.js.map +1 -1
- package/dist/adapters/SanitizeHtmlAdapter.js +3 -3
- package/dist/adapters/SanitizeHtmlAdapter.js.map +1 -1
- package/dist/adapters/XSSAdapter.js +3 -3
- package/dist/adapters/XSSAdapter.js.map +1 -1
- package/dist/adapters/ZodAdapter.js +1 -1
- package/dist/adapters/ZodAdapter.js.map +1 -1
- package/dist/core/HiSecure.d.ts.map +1 -1
- package/dist/core/HiSecure.js +9 -8
- package/dist/core/HiSecure.js.map +1 -1
- package/dist/core/config.d.ts.map +1 -1
- package/dist/core/config.js +0 -7
- package/dist/core/config.js.map +1 -1
- package/dist/core/constants.d.ts.map +1 -1
- package/dist/core/constants.js +0 -27
- package/dist/core/constants.js.map +1 -1
- package/dist/core/errors/AdapterError.js +1 -1
- package/dist/core/errors/AdapterError.js.map +1 -1
- package/dist/core/types/HiSecureConfig.d.ts.map +1 -1
- package/dist/core/types/HiSecureConfig.js.map +1 -1
- package/dist/core/types/SecureOptions.d.ts.map +1 -1
- package/dist/core/types/SecureOptions.js +0 -1
- package/dist/core/types/SecureOptions.js.map +1 -1
- package/dist/core/useSecure.d.ts.map +1 -1
- package/dist/core/useSecure.js +1 -1
- package/dist/core/useSecure.js.map +1 -1
- package/dist/managers/AuthManager.js +2 -2
- package/dist/managers/AuthManager.js.map +1 -1
- package/dist/managers/CorsManager.d.ts.map +1 -1
- package/dist/managers/CorsManager.js +2 -2
- package/dist/managers/CorsManager.js.map +1 -1
- package/dist/managers/HashManager.js +7 -7
- package/dist/managers/HashManager.js.map +1 -1
- package/dist/managers/JsonManager.js +4 -4
- package/dist/managers/JsonManager.js.map +1 -1
- package/dist/managers/RateLimitManager.js +5 -5
- package/dist/managers/RateLimitManager.js.map +1 -1
- package/dist/managers/SanitizerManager.js +5 -5
- package/dist/managers/SanitizerManager.js.map +1 -1
- package/dist/managers/ValidatorManager.js +2 -2
- package/dist/managers/ValidatorManager.js.map +1 -1
- package/dist/middlewares/errorHandler.js +3 -3
- package/dist/middlewares/errorHandler.js.map +1 -1
- package/package.json +1 -1
- package/src/adapters/ArgonAdapter.ts +2 -2
- package/src/adapters/BcryptAdapter.ts +2 -2
- package/src/adapters/ExpressRLAdapter.ts +2 -2
- package/src/adapters/ExpressValidatorAdapter.ts +1 -1
- package/src/adapters/GoogleAdapter.ts +3 -3
- package/src/adapters/JWTAdapter.ts +2 -2
- package/src/adapters/RLFlexibleAdapter.ts +2 -2
- package/src/adapters/SanitizeHtmlAdapter.ts +3 -3
- package/src/adapters/XSSAdapter.ts +3 -3
- package/src/adapters/ZodAdapter.ts +1 -1
- package/src/core/HiSecure.ts +10 -8
- package/src/core/config.ts +0 -105
- package/src/core/constants.ts +0 -33
- package/src/core/errors/AdapterError.ts +1 -1
- package/src/core/types/HiSecureConfig.ts +0 -1
- package/src/core/types/SecureOptions.ts +0 -27
- package/src/core/useSecure.ts +1 -3
- package/src/managers/AuthManager.ts +2 -2
- package/src/managers/CorsManager.ts +2 -2
- package/src/managers/HashManager.ts +7 -7
- package/src/managers/JsonManager.ts +4 -4
- package/src/managers/RateLimitManager.ts +5 -5
- package/src/managers/SanitizerManager.ts +5 -5
- package/src/managers/ValidatorManager.ts +2 -2
- package/src/middlewares/errorHandler.ts +3 -3
package/src/core/constants.ts
CHANGED
|
@@ -1,36 +1,3 @@
|
|
|
1
|
-
// export const LIB_NAME = "HiSecure";
|
|
2
|
-
// export const LIB_VERSION = "1.0.0";
|
|
3
|
-
|
|
4
|
-
// // Adapter Names
|
|
5
|
-
// export const ADAPTERS = {
|
|
6
|
-
// HASHING_PRIMARY: "HASHING_PRIMARY",
|
|
7
|
-
// HASHING_FALLBACK: "HASHING_FALLBACK",
|
|
8
|
-
// RATE_LIMITER: "RATE_LIMITER",
|
|
9
|
-
// VALIDATOR: "VALIDATOR",
|
|
10
|
-
// SANITIZER: "SANITIZER"
|
|
11
|
-
// } as const;
|
|
12
|
-
|
|
13
|
-
// // Manager Names
|
|
14
|
-
// export const MANAGERS = {
|
|
15
|
-
// HASH_MANAGER: "HASH_MANAGER",
|
|
16
|
-
// RATE_LIMIT_MANAGER: "RATE_LIMIT_MANAGER",
|
|
17
|
-
// VALIDATION_MANAGER: "VALIDATION_MANAGER",
|
|
18
|
-
// SANITIZER_MANAGER:"SANITIZER_MANAGER"
|
|
19
|
-
// } as const;
|
|
20
|
-
|
|
21
|
-
// // Error Codes
|
|
22
|
-
// export const ERROR_CODES = {
|
|
23
|
-
// ADAPTER_FAILURE: "ADAPTER_FAILURE",
|
|
24
|
-
// VALIDATION_ERROR: "VALIDATION_ERROR",
|
|
25
|
-
// RATE_LIMIT_EXCEEDED: "RATE_LIMIT_EXCEEDED",
|
|
26
|
-
// SANITIZER_ERROR:"SANITIZER_ERROR",
|
|
27
|
-
// CONFIG_ERROR: "CONFIG_ERROR",
|
|
28
|
-
// UNKNOWN: "UNKNOWN"
|
|
29
|
-
// } as const;
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
// src/core/constants.ts
|
|
34
1
|
export const LIB_NAME = "HiSecure";
|
|
35
2
|
export const LIB_VERSION = "1.0.0";
|
|
36
3
|
|
|
@@ -1,30 +1,3 @@
|
|
|
1
|
-
// // src/core/types/SecureOptions.ts
|
|
2
|
-
|
|
3
|
-
// export interface SecureOptions {
|
|
4
|
-
// /** Enable/override CORS for this route */
|
|
5
|
-
// cors?: boolean | object;
|
|
6
|
-
|
|
7
|
-
// /** Per-route rate limit */
|
|
8
|
-
// rateLimit?: boolean | "strict" | "relaxed" | object;
|
|
9
|
-
|
|
10
|
-
// /** Sanitize request body */
|
|
11
|
-
// sanitize?: boolean;
|
|
12
|
-
|
|
13
|
-
// /** Validation schema (Zod or express-validator) */
|
|
14
|
-
// validate?: any;
|
|
15
|
-
|
|
16
|
-
// /** Auto-JSON parsing (express.json) options */
|
|
17
|
-
// json?: boolean | object;
|
|
18
|
-
|
|
19
|
-
// /** NEW: Per-route authentication (JWT protect) */
|
|
20
|
-
// auth?: boolean | { required?: boolean };
|
|
21
|
-
// }
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
// src/core/types/SecureOptions.ts
|
|
28
1
|
import { z, ZodSchema } from 'zod';
|
|
29
2
|
import { ValidationChain } from 'express-validator';
|
|
30
3
|
|
package/src/core/useSecure.ts
CHANGED
|
@@ -6,14 +6,13 @@ import { SecureOptions } from "./types/SecureOptions.js";
|
|
|
6
6
|
*/
|
|
7
7
|
|
|
8
8
|
export function useSecure(options?: SecureOptions | "api" | "strict" | "public") {
|
|
9
|
-
console.warn("
|
|
9
|
+
console.warn("useSecure() is deprecated. Use HiSecure.middleware() or fluent API methods.");
|
|
10
10
|
return HiSecure.middleware(options);
|
|
11
11
|
}
|
|
12
12
|
|
|
13
13
|
|
|
14
14
|
// Legacy support - route-level security
|
|
15
15
|
|
|
16
|
-
|
|
17
16
|
export function secureRoute(options?: SecureOptions) {
|
|
18
17
|
const chain: any[] = [];
|
|
19
18
|
|
|
@@ -45,7 +44,6 @@ export function secureRoute(options?: SecureOptions) {
|
|
|
45
44
|
typeof options.auth === 'object' ? options.auth : undefined
|
|
46
45
|
));
|
|
47
46
|
}
|
|
48
|
-
|
|
49
47
|
return chain;
|
|
50
48
|
}
|
|
51
49
|
|
|
@@ -27,7 +27,7 @@ export class AuthManager {
|
|
|
27
27
|
}
|
|
28
28
|
|
|
29
29
|
if (opts.jwtSecret.length < 32) {
|
|
30
|
-
logger.warn("
|
|
30
|
+
logger.warn(" JWT secret is less than 32 characters - consider using a stronger secret");
|
|
31
31
|
}
|
|
32
32
|
|
|
33
33
|
logger.info("AuthManager initialized");
|
|
@@ -108,7 +108,7 @@ export class AuthManager {
|
|
|
108
108
|
(req as any).auth = decoded;
|
|
109
109
|
(req as any).user = decoded;
|
|
110
110
|
|
|
111
|
-
// Role-based authorization
|
|
111
|
+
// Role-based authorization - role added Middleware
|
|
112
112
|
if (roles && roles.length > 0) {
|
|
113
113
|
const userRole = (decoded as any).role || (decoded as any).roles?.[0];
|
|
114
114
|
if (!userRole || !roles.includes(userRole)) {
|
|
@@ -16,7 +16,7 @@ export class CorsManager {
|
|
|
16
16
|
|
|
17
17
|
const finalOptions = options ? { ...defaultOptions, ...options } : defaultOptions;
|
|
18
18
|
|
|
19
|
-
logger.debug("
|
|
19
|
+
logger.debug("CORS configured", {
|
|
20
20
|
origin: finalOptions.origin,
|
|
21
21
|
methods: finalOptions.methods
|
|
22
22
|
});
|
|
@@ -24,7 +24,7 @@ export class CorsManager {
|
|
|
24
24
|
return cors(finalOptions);
|
|
25
25
|
|
|
26
26
|
} catch (err: any) {
|
|
27
|
-
logger.error("
|
|
27
|
+
logger.error(" CORS Manager: failed to create CORS middleware", {
|
|
28
28
|
error: err?.message || err,
|
|
29
29
|
options
|
|
30
30
|
});
|
|
@@ -37,7 +37,7 @@ export class HashManager {
|
|
|
37
37
|
usedFallback: false
|
|
38
38
|
};
|
|
39
39
|
} catch (err: any) {
|
|
40
|
-
logger.warn("
|
|
40
|
+
logger.warn("Primary hashing failed", {
|
|
41
41
|
error: err.message,
|
|
42
42
|
algorithm: this.config.primary
|
|
43
43
|
});
|
|
@@ -52,7 +52,7 @@ export class HashManager {
|
|
|
52
52
|
const hash = await this.fallbackAdapter.hash(value);
|
|
53
53
|
|
|
54
54
|
// Log security downgrade warning
|
|
55
|
-
logger.warn("
|
|
55
|
+
logger.warn("SECURITY DOWNGRADE: Using fallback hashing", {
|
|
56
56
|
from: this.config.primary,
|
|
57
57
|
to: this.config.fallback
|
|
58
58
|
});
|
|
@@ -63,7 +63,7 @@ export class HashManager {
|
|
|
63
63
|
usedFallback: true
|
|
64
64
|
};
|
|
65
65
|
} catch (fallbackErr: any) {
|
|
66
|
-
logger.error("
|
|
66
|
+
logger.error("Fallback hashing failed", {
|
|
67
67
|
error: fallbackErr?.message,
|
|
68
68
|
});
|
|
69
69
|
throw new AdapterError(
|
|
@@ -74,20 +74,20 @@ export class HashManager {
|
|
|
74
74
|
}
|
|
75
75
|
|
|
76
76
|
async verify(value: string, hashed: string): Promise<boolean> {
|
|
77
|
-
//
|
|
77
|
+
// primary adapter - first
|
|
78
78
|
try {
|
|
79
79
|
return await this.primaryAdapter.verify(value, hashed);
|
|
80
80
|
} catch (primaryErr: any) {
|
|
81
|
-
logger.warn("
|
|
81
|
+
logger.warn("Primary verify failed", {
|
|
82
82
|
error: primaryErr?.message,
|
|
83
83
|
});
|
|
84
84
|
|
|
85
|
-
//
|
|
85
|
+
// fallback exists - try it
|
|
86
86
|
if (this.fallbackAdapter) {
|
|
87
87
|
try {
|
|
88
88
|
return await this.fallbackAdapter.verify(value, hashed);
|
|
89
89
|
} catch (fallbackErr: any) {
|
|
90
|
-
logger.error("
|
|
90
|
+
logger.error(" Fallback verify failed", {
|
|
91
91
|
error: fallbackErr?.message,
|
|
92
92
|
});
|
|
93
93
|
throw new AdapterError(
|
|
@@ -13,7 +13,7 @@ export class JsonManager {
|
|
|
13
13
|
};
|
|
14
14
|
return express.json({ ...defaultOptions, ...(options || {}) });
|
|
15
15
|
} catch (err: any) {
|
|
16
|
-
logger.error("
|
|
16
|
+
logger.error("JSON Manager: failed to create JSON parser");
|
|
17
17
|
throw new AdapterError("JSON parser initialization failed.");
|
|
18
18
|
}
|
|
19
19
|
}
|
|
@@ -28,7 +28,7 @@ export class JsonManager {
|
|
|
28
28
|
const opts = { ...defaultOptions, ...(options || {}) };
|
|
29
29
|
return express.urlencoded(opts);
|
|
30
30
|
} catch (err: any) {
|
|
31
|
-
logger.error("
|
|
31
|
+
logger.error("URL-encoded parser failed");
|
|
32
32
|
throw new AdapterError("URL-encoded parser initialization failed.");
|
|
33
33
|
}
|
|
34
34
|
}
|
|
@@ -45,13 +45,13 @@ export class JsonManager {
|
|
|
45
45
|
});
|
|
46
46
|
|
|
47
47
|
req.parsedQuery = parsed;
|
|
48
|
-
logger.debug("
|
|
48
|
+
logger.debug(" Query parsed", {
|
|
49
49
|
keys: Object.keys(parsed)
|
|
50
50
|
});
|
|
51
51
|
}
|
|
52
52
|
next();
|
|
53
53
|
} catch (err: any) {
|
|
54
|
-
logger.error("
|
|
54
|
+
logger.error("Failed to parse query", { error: err?.message });
|
|
55
55
|
next(new AdapterError("Query parsing failed."));
|
|
56
56
|
}
|
|
57
57
|
};
|
|
@@ -64,7 +64,7 @@ export class RateLimitManager {
|
|
|
64
64
|
k => !allowedOverrides.includes(k) && k !== 'mode'
|
|
65
65
|
);
|
|
66
66
|
if (attemptedOverrides.length > 0) {
|
|
67
|
-
logger.warn("
|
|
67
|
+
logger.warn("Rate limit overrides ignored", {
|
|
68
68
|
preset: opts?.mode || 'default',
|
|
69
69
|
ignoredOptions: attemptedOverrides
|
|
70
70
|
});
|
|
@@ -79,7 +79,7 @@ export class RateLimitManager {
|
|
|
79
79
|
}
|
|
80
80
|
|
|
81
81
|
try {
|
|
82
|
-
logger.info("
|
|
82
|
+
logger.info("Applying rate limiting", {
|
|
83
83
|
mode: opts?.mode || 'default',
|
|
84
84
|
windowMs: finalOptions.windowMs,
|
|
85
85
|
max: finalOptions.max
|
|
@@ -87,7 +87,7 @@ export class RateLimitManager {
|
|
|
87
87
|
|
|
88
88
|
return this.primaryAdapter.getMiddleware(finalOptions);
|
|
89
89
|
} catch (err: any) {
|
|
90
|
-
logger.warn("
|
|
90
|
+
logger.warn("Primary rate limiter failed โ fallback", {
|
|
91
91
|
error: err?.message
|
|
92
92
|
});
|
|
93
93
|
|
|
@@ -96,10 +96,10 @@ export class RateLimitManager {
|
|
|
96
96
|
}
|
|
97
97
|
|
|
98
98
|
try {
|
|
99
|
-
logger.info("
|
|
99
|
+
logger.info("Using fallback rate limiter");
|
|
100
100
|
return this.fallbackAdapter.getMiddleware(finalOptions);
|
|
101
101
|
} catch (fallbackErr: any) {
|
|
102
|
-
logger.error("
|
|
102
|
+
logger.error("Fallback limiter also failed", {
|
|
103
103
|
error: fallbackErr?.message
|
|
104
104
|
});
|
|
105
105
|
throw new AdapterError("Both primary and fallback limiters failed.");
|
|
@@ -23,13 +23,13 @@ export class SanitizerManager {
|
|
|
23
23
|
try {
|
|
24
24
|
return this.primary.sanitize(value, options);
|
|
25
25
|
} catch (err: any) {
|
|
26
|
-
logger.warn("
|
|
26
|
+
logger.warn("Primary sanitizer failed", { error: err?.message });
|
|
27
27
|
|
|
28
28
|
if (!this.fallback) {
|
|
29
29
|
throw new SanitizerError("Primary sanitizer failed and no fallback available.");
|
|
30
30
|
}
|
|
31
31
|
|
|
32
|
-
logger.info("
|
|
32
|
+
logger.info("Using fallback sanitizer");
|
|
33
33
|
return this.fallback.sanitize(value, options);
|
|
34
34
|
}
|
|
35
35
|
}
|
|
@@ -52,7 +52,7 @@ export class SanitizerManager {
|
|
|
52
52
|
}
|
|
53
53
|
|
|
54
54
|
fallbackTriggered = true;
|
|
55
|
-
logger.warn("
|
|
55
|
+
logger.warn("Switching to fallback sanitizer for this request");
|
|
56
56
|
return this.fallback.sanitize(value, options);
|
|
57
57
|
}
|
|
58
58
|
};
|
|
@@ -81,7 +81,7 @@ export class SanitizerManager {
|
|
|
81
81
|
|
|
82
82
|
req.sanitizedBody = sanitizedBody;
|
|
83
83
|
|
|
84
|
-
logger.debug("
|
|
84
|
+
logger.debug("Request body sanitized", {
|
|
85
85
|
originalKeys: Object.keys(originalBody),
|
|
86
86
|
sanitizedKeys: Object.keys(sanitizedBody),
|
|
87
87
|
usedFallback: fallbackTriggered
|
|
@@ -90,7 +90,7 @@ export class SanitizerManager {
|
|
|
90
90
|
|
|
91
91
|
next();
|
|
92
92
|
} catch (err: any) {
|
|
93
|
-
logger.error("
|
|
93
|
+
logger.error("Sanitizer middleware failed", {
|
|
94
94
|
error: err?.message
|
|
95
95
|
});
|
|
96
96
|
next(new SanitizerError("Sanitizer middleware failure"));
|
|
@@ -27,11 +27,11 @@ export class ValidatorManager {
|
|
|
27
27
|
let middleware;
|
|
28
28
|
|
|
29
29
|
if (isZod) {
|
|
30
|
-
logger.debug("
|
|
30
|
+
logger.debug("Using Zod adapter");
|
|
31
31
|
middleware = this.zodAdapter.validate(schema);
|
|
32
32
|
}
|
|
33
33
|
else if (isExpressValidator) {
|
|
34
|
-
logger.debug("
|
|
34
|
+
logger.debug(" Using express-validator adapter");
|
|
35
35
|
middleware = this.expressAdapter.validate(schema);
|
|
36
36
|
}
|
|
37
37
|
else {
|
|
@@ -24,7 +24,7 @@ export function errorHandler(
|
|
|
24
24
|
: undefined;
|
|
25
25
|
|
|
26
26
|
|
|
27
|
-
logger.error("
|
|
27
|
+
logger.error("HiSecure Error", {
|
|
28
28
|
type: err?.name || "UnknownError",
|
|
29
29
|
message,
|
|
30
30
|
status: err?.status,
|
|
@@ -63,7 +63,7 @@ export function errorHandler(
|
|
|
63
63
|
});
|
|
64
64
|
}
|
|
65
65
|
|
|
66
|
-
// 4. Adapter Errors
|
|
66
|
+
// 4. Adapter Errors - hashing, rate-limit, sanitizer, validator
|
|
67
67
|
if (err instanceof AdapterError) {
|
|
68
68
|
return res.status(500).json({
|
|
69
69
|
success: false,
|
|
@@ -81,7 +81,7 @@ export function errorHandler(
|
|
|
81
81
|
});
|
|
82
82
|
}
|
|
83
83
|
|
|
84
|
-
// 6. Fallback
|
|
84
|
+
// 6. Fallback - Unexpected
|
|
85
85
|
return res.status(500).json({
|
|
86
86
|
success: false,
|
|
87
87
|
error: "INTERNAL_SERVER_ERROR",
|