hi-secure 1.0.16 → 1.0.18

package/src/adapters/XSSAdapter.ts

@@ -1,152 +1,3 @@
-// import { FilterXSS, getDefaultWhiteList, whiteList } from 'xss';
-// import { AdapterError } from "../core/errors/AdapterError.js";
-// import { logger } from "../logging/index.js";
-
-// export interface XSSOptions {
-//     whiteList?: typeof whiteList;
-//     stripIgnoreTag?: boolean;
-//     stripIgnoreTagBody?: string[];
-//     allowCommentTag?: boolean;
-//     css?: boolean | { [key: string]: boolean };
-//     onTag?: (tag: string, html: string, options: any) => string;
-//     onTagAttr?: (tag: string, name: string, value: string, isWhiteAttr: boolean) => string;
-//     onIgnoreTag?: (tag: string, html: string, options: any) => string;
-//     [key: string]: any;
-// }
-
-// export class XSSAdapter {
-//     private globalOptions: XSSOptions;
-//     private defaultFilter: FilterXSS;
-
-//     constructor(options: XSSOptions = {}) {
-//         this.globalOptions = options;
-        
-//         // Default safe configuration
-//         const defaultOptions: XSSOptions = {
-//             whiteList: getDefaultWhiteList(),
-//             stripIgnoreTag: true, 
-//             stripIgnoreTagBody: ['script', 'style', 'iframe', 'object', 'embed'],
-//             allowCommentTag: false,
-//             css: false, 
-//             onTag: (tag, html, options) => {
-               
-//                 if (tag === 'a') {
-//                     return html.replace(/<a /i, '<a target="_blank" rel="noopener noreferrer" ');
-//                 }
-//                 return html;
-//             }
-//         };
-
-//         const finalOptions = { ...defaultOptions, ...options };
-//         this.defaultFilter = new FilterXSS(finalOptions);
-//     }
-
-   
-//     sanitize(input: string, dynamicOptions?: XSSOptions): string {
-//         try {
-//             if (typeof input !== "string") {
-//                 return input as any;
-//             }
-
-           
-//             if (!dynamicOptions || Object.keys(dynamicOptions).length === 0) {
-//                 return this.defaultFilter.process(input);
-//             }
-
-            
-//             const mergedOptions = { ...this.globalOptions, ...dynamicOptions };
-//             const customFilter = new FilterXSS(mergedOptions);
-            
-//             return customFilter.process(input);
-
-//         } catch (err: any) {
-//             logger.error("XSS sanitizer failed", {
-//                 error: err?.message,
-//                 preview: input?.slice?.(0, 80)
-//             });
-//             throw new AdapterError("XSS sanitizer failed.");
-//         }
-//     }
-
-   
-//     middleware(dynamicOptions?: XSSOptions) {
-//         return (req: any, _res: any, next: any) => {
-//             try {
-//                 if (req.body && typeof req.body === "object") {
-//                     const originalBody = req.body;
-//                     const sanitizedBody: any = Array.isArray(originalBody) ? [] : {};
-                    
-//                     for (const key of Object.keys(originalBody)) {
-//                         const val = originalBody[key];
-
-//                         if (typeof val === "string") {
-//                             sanitizedBody[key] = this.sanitize(val, dynamicOptions);
-//                         } else if (Array.isArray(val)) {
-//                             sanitizedBody[key] = val.map((v) =>
-//                                 typeof v === "string"
-//                                     ? this.sanitize(v, dynamicOptions)
-//                                     : v
-//                             );
-//                         } else if (val && typeof val === "object") {
-                            
-//                             sanitizedBody[key] = this.deepSanitize(val, dynamicOptions);
-//                         } else {
-//                             sanitizedBody[key] = val;
-//                         }
-//                     }
-                    
-                   
-//                     req.sanitizedBody = sanitizedBody;
-                    
-//                     logger.debug("XSS sanitizer applied", {
-//                         originalKeys: Object.keys(originalBody),
-//                         sanitizedKeys: Object.keys(sanitizedBody)
-//                     });
-//                 }
-
-//                 next();
-//             } catch (err: any) {
-//                 logger.error("XSS middleware failed", {
-//                     error: err?.message || err
-//                 });
-//                 next(err);
-//             }
-//         };
-//     }
-
-   
-//     private deepSanitize(obj: any, options?: XSSOptions, visited = new WeakSet()): any {
-       
-//         if (obj && typeof obj === "object") {
-//             if (visited.has(obj)) {
-//                 return obj;
-//             }
-//             visited.add(obj);
-//         }
-
-//         if (typeof obj === "string") {
-//             return this.sanitize(obj, options);
-//         }
-
-//         if (Array.isArray(obj)) {
-//             return obj.map(item => this.deepSanitize(item, options, visited));
-//         }
-
-//         if (obj && typeof obj === "object") {
-//             const result: any = {};
-//             for (const key of Object.keys(obj)) {
-//                 result[key] = this.deepSanitize(obj[key], options, visited);
-//             }
-//             return result;
-//         }
-
-//         return obj;
-//     }
-// }
-
-
-
-
 import { FilterXSS, getDefaultWhiteList, whiteList } from "xss";
 import { AdapterError } from "../core/errors/AdapterError";
 import { logger } from "../logging";
@@ -242,7 +93,7 @@ export class XSSAdapter {
 
                     req.sanitizedBody = sanitizedBody;
 
-                    // ✅ visible + safe info log
+                    
                     logger.info("XSS sanitization applied", {
                         adapter: "xss",
                         operation: "middleware",

package/src/adapters/ZodAdapter.ts

@@ -1,49 +1,3 @@
-// import { ZodSchema, ZodError } from "zod";
-// import { ValidationError } from "../core/errors/ValidationError.js"; 
-// import { logger } from "../logging/index.js";
-
-// export class ZodAdapter {
-//     private globalSchema?: ZodSchema;
-
-//     constructor(globalSchema?: ZodSchema) {
-//         this.globalSchema = globalSchema;
-//     }
-
-//     validate(dynamicSchema?: ZodSchema) {
-//         return (req: any, res: any, next: any) => {
-//             const schema = dynamicSchema || this.globalSchema;
-
-//             if (!schema) return next();
-
-//             const result = schema.safeParse(req.body);
-
-//             if (result.success) return next();
-
-//             const zodErr: ZodError = result.error;
-
-//             const issues = zodErr.issues.map(issue => ({
-//                 message: issue.message,
-//                 path: issue.path.join("."),
-//                 code: issue.code
-//             }));
-
-//             logger.warn("Zod validation failed", {
-//                 path: req.path,
-//                 method: req.method,
-//                 issues,
-//                 preview: JSON.stringify(req.body).slice(0, 200)
-//             });
-
-//             return next(
-//                 new ValidationError("Validation failed.", issues as any) 
-//             );
-//         };
-//     }
-// }
-
-
-
-
 import { ZodSchema, ZodError } from "zod";
 import { ValidationError } from "../core/errors/ValidationError";
 import { logger } from "../logging";

package/src/core/HiSecure.ts

@@ -1,362 +1,3 @@
-// import { HiSecureConfig } from "./types/HiSecureConfig.js";
-// import { defaultConfig } from "./config.js";
-// import { LIB_NAME, LIB_VERSION } from "./constants.js";
-// import { deepMerge } from "../utils/deepMerge.js";
-// import { deepFreeze } from "../utils/deepFreeze.js";
-// import { logger } from "../logging/index.js";
-
-// // Adapters
-// import { ArgonAdapter } from "../adapters/ArgonAdapter.js";
-// import { BcryptAdapter } from "../adapters/BcryptAdapter.js";
-// import { RLFlexibleAdapter } from "../adapters/RLFlexibleAdapter.js";
-// import { ExpressRLAdapter } from "../adapters/ExpressRLAdapter.js";
-// import { ZodAdapter } from "../adapters/ZodAdapter.js";
-// import { ExpressValidatorAdapter } from "../adapters/ExpressValidatorAdapter.js";
-// import { SanitizeHtmlAdapter } from "../adapters/SanitizeHtmlAdapter.js";
-// import { XSSAdapter } from "../adapters/XSSAdapter.js";
-
-// // Managers
-// import { HashManager } from "../managers/HashManager.js";
-// import { RateLimitManager } from "../managers/RateLimitManager.js";
-// import { ValidatorManager } from "../managers/ValidatorManager.js";
-// import { SanitizerManager } from "../managers/SanitizerManager.js";
-// import { JsonManager } from "../managers/JsonManager.js";
-// import { CorsManager } from "../managers/CorsManager.js";
-// import { AuthManager } from "../managers/AuthManager.js";
-
-// // Middlewares
-// import helmet from "helmet";
-// import hpp from "hpp";
-// import compression from "compression";
-// import { errorHandler } from "../middlewares/errorHandler.js";
-
-// // Types
-// import { SecureOptions, ValidationSchema} from "./types/SecureOptions.js";
-
-// export class HiSecure {
-//     private static instance: HiSecure | null = null;
-//     private config: HiSecureConfig;
-//     private initialized = false;
-
-//     // Managers
-//     public hashManager!: HashManager;
-//     public rateLimitManager!: RateLimitManager;
-//     public validatorManager!: ValidatorManager;
-//     public sanitizerManager!: SanitizerManager;
-//     public jsonManager!: JsonManager;
-//     public corsManager!: CorsManager;
-//     public authManager?: AuthManager;
-
-//     // Internal adapters
-//     private hashingPrimary: any;
-//     private hashingFallback: any;
-//     private rateLimiterPrimary: any;
-//     private rateLimiterFallback: any;
-//     private sanitizerPrimary: any;
-//     private sanitizerFallback: any;
-
-//     // Private constructor for singleton
-//     private constructor(userConfig: Partial<HiSecureConfig> = {}) {
-//         this.config = deepMerge(defaultConfig, userConfig);
-//     }
-
-//     // SINGLETON & INITIALIZATION
-    
-//     static getInstance(config?: Partial<HiSecureConfig>): HiSecure {
-//         if (!HiSecure.instance) {
-//             HiSecure.instance = new HiSecure(config);
-//             HiSecure.instance.init();
-//         }
-//         return HiSecure.instance;
-//     }
-
-//     static resetInstance(): void {
-//         HiSecure.instance = null;
-//     }
-
-//     init(): void {
-//         if (this.initialized) {
-//             logger.warn(" HiSecure already initialized");
-//             return;
-//         }
-
-//         logger.info(` ${LIB_NAME} v${LIB_VERSION} initializing...`);
-
-//         this.setupAdapters();
-//         this.setupManagers();
-//         this.setupDynamicManagers();
-
-//         deepFreeze(this.config);
-//         // deep Freeze - for now we remove from manager it needs to manage the adapters
-//         // deepFreeze(this.hashManager);
-//         // deepFreeze(this.rateLimitManager);
-//         // deepFreeze(this.validatorManager);
-//         // deepFreeze(this.sanitizerManager);
-//         // deepFreeze(this.jsonManager);
-//         // deepFreeze(this.corsManager);
-//         // if (this.authManager) deepFreeze(this.authManager);
-
-//         this.initialized = true;
-//         logger.info("HiSecure initialized successfully");
-//     }
-
-//     isInitialized(): boolean {
-//         return this.initialized;
-//     }
-
-//     // FLUENT API METHODS (Route-level security)
-    
-//     static auth(options?: { required?: boolean; roles?: string[] }) {
-//         const instance = this.getInstance();
-//         if (!instance.authManager) {
-//             throw new Error("Auth not enabled. Set auth.enabled=true in config.");
-//         }
-//         return instance.authManager.protect(options);
-//     }
-
-//     static validate(schema: ValidationSchema) {
-//         return this.getInstance().validatorManager.validate(schema);
-//     }
-
-//     static sanitize(options?: any) {
-//         return this.getInstance().sanitizerManager.middleware(options);
-//     }
-
-//     static rateLimit(preset: "strict" | "relaxed" | "api" | object) {
-//         const instance = this.getInstance();
-        
-//         if (typeof preset === "string") {
-//             const presets: Record<string, { mode?: "strict" | "relaxed" | "api"; options?: any }> = {
-//                 strict: { mode: "strict" },
-//                 relaxed: { mode: "relaxed" },
-//                 api: { mode: "api", options: { max: 100, windowMs: 60000 } }
-//             };
-//             return instance.rateLimitManager.middleware(presets[preset] || {});
-//         }
-        
-//         return instance.rateLimitManager.middleware({ options: preset });
-//     }
-
-//     static cors(options?: any) {
-//         return this.getInstance().corsManager.middleware(options);
-//     }
-
-//     static json(options?: any) {
-//         const instance = this.getInstance();
-//         const chain = [];
-//         chain.push(instance.jsonManager.middleware(options));
-//         chain.push(instance.jsonManager.urlencoded());
-//         return chain;
-//     }
-
-//     // UTILITY METHODS - For direct use
-    
-//     static async hash(password: string): Promise<string> {
-//         const instance = this.getInstance();
-//         const result = await instance.hashManager.hash(password, { allowFallback: true });
-//         return result.hash;
-//     }
-
-//     static async verify(password: string, hash: string): Promise<boolean> {
-//         return this.getInstance().hashManager.verify(password, hash);
-//     }
-
-//     static jwt = {
-//         sign: (payload: object, options?: any) => {
-//             const instance = HiSecure.getInstance();
-//             if (!instance.authManager) {
-//                 throw new Error("Auth not enabled");
-//             }
-//             return instance.authManager.sign(payload, options);
-//         },
-        
-//         verify: (token: string) => {
-//             const instance = HiSecure.getInstance();
-//             if (!instance.authManager) {
-//                 throw new Error("Auth not enabled");
-//             }
-//             return instance.authManager.verify(token);
-//         },
-        
-//         google: {
-//             verifyIdToken: (idToken: string) => {
-//                 const instance = HiSecure.getInstance();
-//                 if (!instance.authManager) {
-//                     throw new Error("Auth not enabled");
-//                 }
-//                 return instance.authManager.verifyGoogleIdToken(idToken);
-//             }
-//         }
-//     };
-
-//     // GLOBAL MIDDLEWARE (app.use())
-    
-//     static middleware(options?: SecureOptions | "api" | "strict" | "public") {
-//         const instance = this.getInstance();
-        
-//         // Handle preset strings
-//         if (typeof options === "string") {
-//             const presets: Record<string, SecureOptions> = {
-//                 api: { cors: true, rateLimit: "relaxed" as any, sanitize: true },
-//                 strict: { cors: true, rateLimit: "strict" as any, sanitize: true, auth: true },
-//                 public: { cors: true, rateLimit: true as any, sanitize: false }
-//             };
-//             const presetOptions = presets[options];
-//             if (presetOptions) {
-//                 return instance.createMiddlewareChain(presetOptions);
-//             }
-//             return instance.createMiddlewareChain({});
-//         }
-        
-//         return instance.createMiddlewareChain(options || {});
-//     }
-
-   
-//     // Internal Methods
-    
-//     private setupAdapters(): void {
-//         logger.info(" Setting up adapters...");
-
-//         // Hashing
-//         this.hashingPrimary = this.config.hashing.primary === "argon2"
-//             ? new ArgonAdapter()
-//             : new BcryptAdapter(this.config.hashing.saltRounds);
-
-//         this.hashingFallback = this.config.hashing.fallback === "bcrypt"
-//             ? new BcryptAdapter(this.config.hashing.saltRounds)
-//             : null;
-
-//         // Rate limiting
-//         this.rateLimiterPrimary = this.config.rateLimiter.useAdaptiveMode
-//             ? new RLFlexibleAdapter()
-//             : new ExpressRLAdapter();
-//         this.rateLimiterFallback = new ExpressRLAdapter();
-
-
-
-
-//         // // Validation - we handle this in d/f way for now 
-//         // this.validatorPrimary = this.config.validation.mode === "zod"
-//         //     ? new ZodAdapter()
-//         //     : new ExpressValidatorAdapter();
-//         // this.validatorFallback = this.config.validation.fallback === "express-validator"
-//         //     ? new ExpressValidatorAdapter()
-//         //     : null;
-
-
-//         // Sanitization
-//         this.sanitizerPrimary = new SanitizeHtmlAdapter(this.config.sanitizer);
-//         this.sanitizerFallback = new XSSAdapter(this.config.sanitizer);
-
-//         logger.info("Adapters ready");
-//     }
-
-//     private setupManagers(): void {
-//         this.hashManager = new HashManager(
-//             this.config.hashing,
-//             this.hashingPrimary,
-//             this.hashingFallback
-//         );
-
-//         this.rateLimitManager = new RateLimitManager(
-//             this.config.rateLimiter,
-//             this.rateLimiterPrimary,
-//             this.rateLimiterFallback
-//         );
-
-//         this.validatorManager = new ValidatorManager(
-//             // this.config.validation,
-//             // this.validatorPrimary,
-//             // this.validatorFallback
-//             new ZodAdapter(),
-//             new ExpressValidatorAdapter()
-//         );
-
-//         this.sanitizerManager = new SanitizerManager(
-//             this.sanitizerPrimary,
-//             this.sanitizerFallback
-//         );
-//     }
-
-//     private setupDynamicManagers(): void {
-//         this.jsonManager = new JsonManager();
-//         this.corsManager = new CorsManager();
-
-//         // Auth manager (only if enabled)
-//         if (this.config.auth.enabled) {
-//             const jwtSecret = process.env.JWT_SECRET || this.config.auth.jwtSecret;
-//             if (!jwtSecret) {
-//                 throw new Error("JWT_SECRET environment variable or jwtSecret in config is required when auth.enabled=true");
-//             }
-
-//             this.authManager = new AuthManager({
-//                 jwtSecret,
-//                 jwtExpiresIn: this.config.auth.jwtExpiresIn,
-//                 googleClientId: process.env.GOOGLE_CLIENT_ID || this.config.auth.googleClientId
-//             });
-//         }
-//     }
-
-//     private createMiddlewareChain(options: SecureOptions): any[] {
-//         const chain: any[] = [];
-        
-//         // JSON parsing
-//         chain.push(this.jsonManager.middleware(this.config.json));
-//         chain.push(this.jsonManager.urlencoded(this.config.urlencoded));
-        
-//         // Security headers
-//         if (this.config.enableHelmet) chain.push(helmet());
-//         if (this.config.enableHPP) chain.push(hpp());
-        
-//         // Compression (check if compression config exists)
-//         if (this.config.enableCompression && this.config.compression) {
-//             chain.push(compression(this.config.compression));
-//         } else if (this.config.enableCompression) {
-//             chain.push(compression()); // Use defaults
-//         }
-        
-//         // CORS
-//         if (this.config.enableCORS || options.cors) {
-//             const corsOptions = options.cors === true ? this.config.cors : 
-//                               (typeof options.cors === 'object' ? options.cors : this.config.cors);
-//             chain.push(this.corsManager.middleware(corsOptions));
-//         }
-        
-//         // Sanitization
-//         if (this.config.enableSanitizer || options.sanitize) {
-//             const sanitizeOptions = options.sanitize === true ? undefined : 
-//                                   (typeof options.sanitize === 'object' ? options.sanitize : undefined);
-//             chain.push(this.sanitizerManager.middleware(sanitizeOptions));
-//         }
-        
-//         // Rate limiting
-//         if (this.config.enableRateLimiter || options.rateLimit) {
-//             const rateLimitOpts = typeof options.rateLimit === 'object' ? 
-//                                 { options: options.rateLimit } : {};
-//             chain.push(this.rateLimitManager.middleware(rateLimitOpts));
-//         }
-        
-//         // Authentication
-//         if (options.auth && this.authManager) {
-//             const authOpts = options.auth === true ? undefined : 
-//                            (typeof options.auth === 'object' ? options.auth : undefined);
-//             chain.push(this.authManager.protect(authOpts));
-//         }
-        
-//         // Error handler - at last usage
-//         chain.push(errorHandler);
-        
-//         return chain;
-//     }
-// }
-
-
-
-
-
-
-
-
 import { HiSecureConfig } from "./types/HiSecureConfig.js";
 import { defaultConfig } from "./config.js";
 import { LIB_NAME, LIB_VERSION } from "./constants.js";
@@ -418,9 +59,7 @@ export class HiSecure {
         this.config = deepMerge(defaultConfig, userConfig);
     }
 
-    // =========================
     // Singleton & Init
-    // =========================
 
     static getInstance(config?: Partial<HiSecureConfig>): HiSecure {
         if (!HiSecure.instance) {
@@ -463,9 +102,8 @@ export class HiSecure {
         });
     }
 
-    // =========================
     // Public Fluent APIs
-    // =========================
+    
 
     static auth(options?: { required?: boolean; roles?: string[] }) {
         const instance = this.getInstance();
@@ -515,9 +153,7 @@ export class HiSecure {
         ];
     }
 
-    // =========================
     // Utilities
-    // =========================
 
     static async hash(value: string): Promise<string> {
         const instance = this.getInstance();
@@ -542,9 +178,7 @@ export class HiSecure {
         }
     };
 
-    // =========================
     // Global Middleware
-    // =========================
 
     static middleware(options?: SecureOptions | "api" | "strict" | "public") {
         const instance = this.getInstance();
@@ -567,9 +201,7 @@ export class HiSecure {
         return instance.createMiddlewareChain(options || {});
     }
 
-    // =========================
     // Internal Setup
-    // =========================
 
     private setupAdapters() {
         logger.info("Adapters setup started", {

package/src/logging/index.ts

@@ -1,8 +1,2 @@
-// export * from "./winstonSetup.js";
-// export * from "./morganSetup.js";
-
-
-
-
 export * from "./winstonSetup.js";
 export * from "./morganSetup.js";

package/src/logging/morganSetup.ts

@@ -1,28 +1,3 @@
-// // import morgan from "morgan";
-
-// // export const requestLogger = morgan("combined");
-
-
-
-
-// import morgan from "morgan";
-// import { logger } from "./winstonSetup";
-
-// export const requestLogger = morgan(
-//     ":method :url :status :response-time ms",
-//     {
-//         stream: {
-//             write: (message) => {
-//                 logger.http(message.trim());
-//             }
-//         }
-//     }
-// );
-
-
-
-
-
 import morgan from "morgan";
 import { logger } from "./winstonSetup";