hi-secure 1.0.7 → 1.0.11

package/src/adapters/JWTAdapter.ts

@@ -1,259 +1,5 @@
-// // import jwt from "jsonwebtoken";
-// // import { AdapterError } from "../core/errors/AdapterError";
-// // import { logError } from "../logging";
-
-// // export interface JWTAdapterOptions {
-// //     secret: string;
-// //     expiresIn?: string | number | undefined;
-// // }
-
-// // export class JWTAdapter {
-// //     private secret: string;
-// //     private expiresIn?: string | number;
-
-// //     constructor(options: JWTAdapterOptions) {
-// //         if (!options.secret) {
-// //             throw new AdapterError("JWT secret is required");
-// //         }
-
-// //         this.secret = options.secret;
-
-// //         // Normalize expiresIn
-// //         if (options.expiresIn !== undefined) {
-// //             this.expiresIn = options.expiresIn as string | number;
-// //         }
-// //     }
-
-// //     sign(
-// //         payload: object,
-// //         options?: { expiresIn?: string | number }
-// //     ) {
-// //         try {
-// //             const finalExpires =
-// //                 options?.expiresIn ?? this.expiresIn;
-
-// //             const jwtOptions: jwt.SignOptions = {};
-
-// //             if (finalExpires !== undefined) {
-// //                 // Force safe cast → matches SignOptions type
-// //                 jwtOptions.expiresIn = finalExpires as number | any;
-// //             }
-
-// //             return jwt.sign(payload, this.secret, jwtOptions);
-
-// //         } catch (err: any) {
-// //             logError("JWTAdapter.sign failed", { error: err?.message });
-// //             throw new AdapterError(err?.message || "JWT sign failed");
-// //         }
-// //     }
-
-// //     verify(token: string) {
-// //         try {
-// //             return jwt.verify(token, this.secret);
-// //         } catch (err: any) {
-// //             logError("JWTAdapter.verify failed", { error: err?.message });
-// //             throw new AdapterError(err?.message || "JWT verify failed");
-// //         }
-// //     }
-// // }
-
-
-
-// // // src/adapters/JWTAdapter.ts - FIXED (Security hardening)
-// // import jwt from "jsonwebtoken";
-// // import { v4 as uuidv4 } from "uuid";
-// // import { AdapterError } from "../core/errors/AdapterError.js";
-// // import { logError } from "../logging/index.js";
-
-// // export interface JWTAdapterOptions {
-// //     secret: string;
-// //     expiresIn?: string | number;
-// //     algorithm?: jwt.Algorithm;
-// //     issuer?: string;
-// //     audience?: string | string[];
-// // }
-
-// // export interface SignOptions {
-// //     expiresIn?: string | number;
-// //     jti?: string; // JWT ID for token revocation
-// //     subject?: string;
-// //     issuer?: string;
-// //     audience?: string | string[];
-// // }
-
-// // export class JWTAdapter {
-// //     private secret: string;
-// //     private expiresIn?: string | number;
-// //     private algorithm: jwt.Algorithm;
-// //     private issuer?: string;
-// //     private audience?: string | string[];
-
-// //     constructor(options: JWTAdapterOptions) {
-// //         if (!options.secret) {
-// //             throw new AdapterError("JWT secret is required");
-// //         }
-
-// //         if (options.secret.length < 32) {
-// //             logError("⚠ JWT secret is too short (minimum 32 characters recommended)");
-// //         }
-
-// //         this.secret = options.secret;
-// //         this.expiresIn = options.expiresIn;
-// //         this.algorithm = options.algorithm || 'HS256'; // ⚠️ Default algorithm
-// //         this.issuer = options.issuer;
-// //         this.audience = options.audience;
-// //     }
-
-// //     sign(payload: object, options?: SignOptions) {
-// //         try {
-// //             const jwtOptions: jwt.SignOptions = {
-// //                 algorithm: this.algorithm,
-// //                 issuer: options?.issuer || this.issuer,
-// //                 audience: options?.audience || this.audience,
-// //                 jwtid: options?.jti || uuidv4(), // Unique token ID
-// //                 subject: options?.subject
-// //             };
-
-// //             if (options?.expiresIn !== undefined) {
-// //                 jwtOptions.expiresIn = options.expiresIn as number;
-// //             } else if (this.expiresIn !== undefined) {
-// //                 jwtOptions.expiresIn = this.expiresIn as number;
-// //             }
-
-// //             return jwt.sign(payload, this.secret, jwtOptions);
-
-// //         } catch (err: any) {
-// //             logError("JWTAdapter.sign failed", { error: err?.message });
-// //             throw new AdapterError(err?.message || "JWT sign failed");
-// //         }
-// //     }
-
-// //     verify(token: string, options?: { audience?: string | string[] }) {
-// //         try {
-// //             const verifyOptions: jwt.VerifyOptions = {
-// //                 algorithms: [this.algorithm],
-// //                 issuer: this.issuer,
-// //                 audience: options?.audience as string || this.audience as string
-// //             };
-
-// //             return jwt.verify(token, this.secret, verifyOptions);
-// //         } catch (err: any) {
-// //             logError("JWTAdapter.verify failed", { error: err?.message });
-            
-// //             // Provide better error messages
-// //             if (err.name === 'TokenExpiredError') {
-// //                 throw new AdapterError("JWT token has expired");
-// //             }
-// //             if (err.name === 'JsonWebTokenError') {
-// //                 throw new AdapterError("Invalid JWT token");
-// //             }
-            
-// //             throw new AdapterError(err?.message || "JWT verification failed");
-// //         }
-// //     }
-// // }
-
-
-// // src/adapters/JWTAdapter.ts - FIXED (Security hardening)
-// import jwt from "jsonwebtoken";
-// import { nanoid } from "nanoid";  // CHANGED: from uuid to nanoid
-// import { AdapterError } from "../core/errors/AdapterError.js";
-// import { logError } from "../logging/index.js";
-
-// export interface JWTAdapterOptions {
-//     secret: string;
-//     expiresIn?: string | number;
-//     algorithm?: jwt.Algorithm;
-//     issuer?: string;
-//     audience?: string | string[];
-// }
-
-// export interface SignOptions {
-//     expiresIn?: string | number;
-//     jti?: string; // JWT ID for token revocation
-//     subject?: string;
-//     issuer?: string;
-//     audience?: string | string[];
-// }
-
-// export class JWTAdapter {
-//     private secret: string;
-//     private expiresIn?: string | number;
-//     private algorithm: jwt.Algorithm;
-//     private issuer?: string;
-//     private audience?: string | string[];
-
-//     constructor(options: JWTAdapterOptions) {
-//         if (!options.secret) {
-//             throw new AdapterError("JWT secret is required");
-//         }
-
-//         if (options.secret.length < 32) {
-//             logError("⚠ JWT secret is too short (minimum 32 characters recommended)");
-//         }
-
-//         this.secret = options.secret;
-//         this.expiresIn = options.expiresIn;
-//         this.algorithm = options.algorithm || 'HS256'; // ⚠️ Default algorithm
-//         this.issuer = options.issuer;
-//         this.audience = options.audience;
-//     }
-
-//     sign(payload: object, options?: SignOptions) {
-//         try {
-//             const jwtOptions: jwt.SignOptions = {
-//                 algorithm: this.algorithm,
-//                 issuer: options?.issuer || this.issuer,
-//                 audience: options?.audience || this.audience,
-//                 jwtid: options?.jti || nanoid(),  // CHANGED: uuidv4() to nanoid()
-//                 subject: options?.subject
-//             };
-
-//             if (options?.expiresIn !== undefined) {
-//                 jwtOptions.expiresIn = options.expiresIn as number;
-//             } else if (this.expiresIn !== undefined) {
-//                 jwtOptions.expiresIn = this.expiresIn as number;
-//             }
-
-//             return jwt.sign(payload, this.secret, jwtOptions);
-
-//         } catch (err: any) {
-//             logError("JWTAdapter.sign failed", { error: err?.message });
-//             throw new AdapterError(err?.message || "JWT sign failed");
-//         }
-//     }
-
-//     verify(token: string, options?: { audience?: string | string[] }) {
-//         try {
-//             const verifyOptions: jwt.VerifyOptions = {
-//                 algorithms: [this.algorithm],
-//                 issuer: this.issuer,
-//                 audience: options?.audience as string || this.audience as string
-//             };
-
-//             return jwt.verify(token, this.secret, verifyOptions);
-//         } catch (err: any) {
-//             logError("JWTAdapter.verify failed", { error: err?.message });
-            
-//             // Provide better error messages
-//             if (err.name === 'TokenExpiredError') {
-//                 throw new AdapterError("JWT token has expired");
-//             }
-//             if (err.name === 'JsonWebTokenError') {
-//                 throw new AdapterError("Invalid JWT token");
-//             }
-            
-//             throw new AdapterError(err?.message || "JWT verification failed");
-//         }
-//     }
-// }
-
-
-
-
-// src/adapters/JWTAdapter.ts - FIXED (Using crypto.randomUUID())
 import jwt from "jsonwebtoken";
-import { randomUUID } from "crypto";  // Built-in Node.js
+import { randomUUID } from "crypto"; 
 import { AdapterError } from "../core/errors/AdapterError.js";
 import { logError } from "../logging/index.js";
 import { logger } from "../logging";
@@ -268,7 +14,7 @@ export interface JWTAdapterOptions {
 
 export interface SignOptions {
     expiresIn?: string | number;
-    jti?: string; // JWT ID for token revocation
+    jti?: string; 
     subject?: string;
     issuer?: string;
     audience?: string | string[];
@@ -293,7 +39,7 @@ export class JWTAdapter {
 
         this.secret = options.secret;
         this.expiresIn = options.expiresIn;
-        this.algorithm = options.algorithm || 'HS256'; // ⚠️ Default algorithm
+        this.algorithm = options.algorithm || 'HS256'; // Default algorithm 
         this.issuer = options.issuer;
         this.audience = options.audience;
     }
@@ -304,7 +50,7 @@ export class JWTAdapter {
                 algorithm: this.algorithm,
                 issuer: options?.issuer || this.issuer,
                 audience: options?.audience || this.audience,
-                jwtid: options?.jti || randomUUID(),  // ✅ Using crypto.randomUUID()
+                jwtid: options?.jti || randomUUID(), 
                 subject: options?.subject
             };
 
@@ -334,7 +80,7 @@ export class JWTAdapter {
         } catch (err: any) {
             logError("JWTAdapter.verify failed", { error: err?.message });
             
-            // Provide better error messages
+           
             if (err.name === 'TokenExpiredError') {
                 throw new AdapterError("JWT token has expired");
             }

package/src/adapters/RLFlexibleAdapter.ts

@@ -1,72 +1,10 @@
-
-// import { RateLimiterMemory, RateLimiterRes } from "rate-limiter-flexible";
-// import { logger } from "../logging";
-// import { AdapterError } from "../core/errors/AdapterError";
-
-// export class RLFlexibleAdapter {
-
-//     /**
-//      * Create middleware dynamically using options.
-//      */
-//     getMiddleware(options: {
-//         points?: number;
-//         duration?: number; // seconds
-//         message?: any;
-//     } = {}) {
-
-//         try {
-//             const limiter = new RateLimiterMemory({
-//                 points: options.points ?? 100,
-//                 duration: options.duration ?? 60,
-//             });
-
-//             return async (req: any, res: any, next: any) => {
-//                 const ip = req.ip ||
-//                            req.headers["x-forwarded-for"] ||
-//                            req.connection?.remoteAddress ||
-//                            "unknown";
-
-//                 try {
-//                     await limiter.consume(ip);
-//                     next();
-//                 } catch (err: any) {
-//                     const rlErr = err as RateLimiterRes;
-
-//                     logger.warn("⚠ RLFlexibleAdapter: rate limit exceeded", {
-//                         ip,
-//                         path: req.path,
-//                         method: req.method,
-//                         retryAfter: rlErr.msBeforeNext
-//                     });
-
-//                     return res.status(429).json({
-//                         success: false,
-//                         error: "RATE_LIMIT_EXCEEDED",
-//                         retryAfter: Math.ceil(rlErr.msBeforeNext / 1000),
-//                         message: options.message ?? "Too many requests, slow down."
-//                     });
-//                 }
-//             };
-
-//         } catch (err: any) {
-//             logger.error("❌ RLFlexibleAdapter: failed to initialize limiter", {
-//                 error: err?.message || err
-//             });
-//             throw new AdapterError("RateLimiterFlexible creation failed.");
-//         }
-//     }
-// }
-
-
-
-// src/adapters/RLFlexibleAdapter.ts - IMPROVED
 import { RateLimiterMemory, RateLimiterRes } from "rate-limiter-flexible";
 import { logger } from "../logging/index.js";
 import { AdapterError } from "../core/errors/AdapterError.js";
 
 export interface RLOptions {
     points?: number;
-    duration?: number; // seconds
+    duration?: number; 
     message?: any;
     blockDuration?: number;
 }
@@ -90,7 +28,7 @@ export class RLFlexibleAdapter {
             });
 
             return async (req: any, res: any, next: any) => {
-                // Better IP extraction
+               
                 const ip = this.extractIP(req);
 
                 try {
@@ -126,7 +64,6 @@ export class RLFlexibleAdapter {
     }
 
     private extractIP(req: any): string {
-        // Order of priority for IP extraction
         return (
             req.headers['x-real-ip'] ||
             req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||

package/src/adapters/SanitizeHtmlAdapter.ts

@@ -1,85 +1,3 @@
-// import sanitizeHtml from "sanitize-html";
-// import { AdapterError } from "../core/errors/AdapterError";
-// import { logger } from "../logging";
-
-// export class SanitizeHtmlAdapter {
-//     private globalOptions: sanitizeHtml.IOptions;
-
-//     constructor(options: sanitizeHtml.IOptions = {}) {
-//         this.globalOptions = options;
-//     }
-
-//     /**
-//      * Sanitize a string with merged global + dynamic options
-//      */
-//     sanitize(input: string, dynamicOptions?: any): string {
-//         try {
-//             const opts = { ...this.globalOptions, ...(dynamicOptions || {}) };
-
-//             const clean = sanitizeHtml(input, opts);
-
-//             return typeof clean === "string" ? clean : String(clean);
-
-//         } catch (err: any) {
-//             logger.error("❌ sanitize-html failed", {
-//                 error: err?.message || err,
-//                 preview: typeof input === "string" ? input.slice(0, 100) : undefined
-//             });
-
-//             throw new AdapterError("sanitize-html adapter failed.");
-//         }
-//     }
-
-//     /**
-//      * Deep sanitize nested objects, arrays, strings
-//      */
-//     private deepSanitize(obj: any, dynamicOptions?: any): any {
-//         if (typeof obj === "string") {
-//             return this.sanitize(obj, dynamicOptions);
-//         }
-
-//         if (Array.isArray(obj)) {
-//             return obj.map((item) => this.deepSanitize(item, dynamicOptions));
-//         }
-
-//         if (obj && typeof obj === "object") {
-//             const result: any = {};
-//             for (const key of Object.keys(obj)) {
-//                 result[key] = this.deepSanitize(obj[key], dynamicOptions);
-//             }
-//             return result;
-//         }
-
-//         return obj;
-//     }
-
-//     /**
-//      * Middleware wrapper with dynamic per-route options
-//      */
-//     middleware(dynamicOptions?: any) {
-//         return (req: any, _res: any, next: any) => {
-//             try {
-//                 if (req.body) {
-//                     req.body = this.deepSanitize(req.body, dynamicOptions);
-
-//                     logger.debug("🧼 sanitize-html applied", {
-//                         keys: Object.keys(req.body)
-//                     });
-//                 }
-//                 next();
-
-//             } catch (err: any) {
-//                 logger.error("❌ sanitize-html middleware failed", {
-//                     error: err?.message || err
-//                 });
-//                 next(err);
-//             }
-//         };
-//     }
-// }
-
-
-// src/adapters/SanitizeHtmlAdapter.ts - FIXED
 import sanitizeHtml from "sanitize-html";
 import { AdapterError } from "../core/errors/AdapterError.js";
 import { logger } from "../logging/index.js";
@@ -108,14 +26,12 @@ export class SanitizeHtmlAdapter {
         }
     }
 
-    /**
-     * Deep sanitize with recursion protection
-     */
+    // Deep Sanitization - Recursively 
     private deepSanitize(obj: any, dynamicOptions?: any, visited = new WeakSet()): any {
-        // Handle circular references
+        
         if (obj && typeof obj === "object") {
             if (visited.has(obj)) {
-                return obj; // Circular reference detected
+                return obj; 
             }
             visited.add(obj);
         }

package/src/adapters/XSSAdapter.ts

@@ -1,4 +1,3 @@
-// src/adapters/XSSAdapter.ts - NEW FILE
 import { FilterXSS, getDefaultWhiteList, whiteList } from 'xss';
 import { AdapterError } from "../core/errors/AdapterError.js";
 import { logger } from "../logging/index.js";
@@ -25,12 +24,12 @@ export class XSSAdapter {
         // Default safe configuration
         const defaultOptions: XSSOptions = {
             whiteList: getDefaultWhiteList(),
-            stripIgnoreTag: true, // Remove non-whitelisted tags completely
+            stripIgnoreTag: true, 
             stripIgnoreTagBody: ['script', 'style', 'iframe', 'object', 'embed'],
             allowCommentTag: false,
-            css: false, // Disable CSS by default
+            css: false, 
             onTag: (tag, html, options) => {
-                // Add noopener/noreferrer to links for security
+               
                 if (tag === 'a') {
                     return html.replace(/<a /i, '<a target="_blank" rel="noopener noreferrer" ');
                 }
@@ -42,21 +41,19 @@ export class XSSAdapter {
         this.defaultFilter = new FilterXSS(finalOptions);
     }
 
-    /**
-     * Sanitize a string with global + dynamic merged options
-     */
+   
     sanitize(input: string, dynamicOptions?: XSSOptions): string {
         try {
             if (typeof input !== "string") {
                 return input as any;
             }
 
-            // If no dynamic options, use default filter
+           
             if (!dynamicOptions || Object.keys(dynamicOptions).length === 0) {
                 return this.defaultFilter.process(input);
             }
 
-            // Merge options for this specific call
+            
             const mergedOptions = { ...this.globalOptions, ...dynamicOptions };
             const customFilter = new FilterXSS(mergedOptions);
             
@@ -71,10 +68,7 @@ export class XSSAdapter {
         }
     }
 
-    /**
-     * Middleware wrapper WITH dynamic options
-     * Doesn't mutate original request - creates sanitized copy
-     */
+   
     middleware(dynamicOptions?: XSSOptions) {
         return (req: any, _res: any, next: any) => {
             try {
@@ -94,14 +88,14 @@ export class XSSAdapter {
                                     : v
                             );
                         } else if (val && typeof val === "object") {
-                            // Handle nested objects (simple recursion)
+                            
                             sanitizedBody[key] = this.deepSanitize(val, dynamicOptions);
                         } else {
                             sanitizedBody[key] = val;
                         }
                     }
                     
-                    // Store sanitized version separately
+                   
                     req.sanitizedBody = sanitizedBody;
                     
                     logger.debug("🛡️ XSS sanitizer applied", {
@@ -120,11 +114,9 @@ export class XSSAdapter {
         };
     }
 
-    /**
-     * Deep sanitize nested objects/arrays
-     */
+   
     private deepSanitize(obj: any, options?: XSSOptions, visited = new WeakSet()): any {
-        // Handle circular references
+       
         if (obj && typeof obj === "object") {
             if (visited.has(obj)) {
                 return obj;

package/src/adapters/ZodAdapter.ts

@@ -1,54 +1,5 @@
-// import { ZodSchema, ZodError } from "zod";
-// import { ValidationError } from "../core/errors/ValidationError";
-// import { logger } from "../logging";
-
-// export class ZodAdapter {
-//     private globalSchema?: ZodSchema;
-
-//     constructor(globalSchema?: ZodSchema) {
-//         this.globalSchema = globalSchema as any;
-//     }
-
-//     /**
-//      * Validate with global + dynamic schema (dynamic overrides global)
-//      */
-//     validate(dynamicSchema?: ZodSchema) {
-//         return (req: any, res: any, next: any) => {
-//             const schema = dynamicSchema || this.globalSchema;
-
-//             if (!schema) return next(); // no validation for this route
-
-//             const result = schema.safeParse(req.body);
-
-//             if (result.success) return next();
-
-//             const zodErr: ZodError = result.error;
-
-//             const issues = zodErr.issues.map(issue => ({
-//                 message: issue.message,
-//                 path: issue.path.join("."),
-//                 code: issue.code
-//             }));
-
-//             logger.warn("⚠ Zod validation failed", {
-//                 path: req.path,
-//                 method: req.method,
-//                 issues,
-//                 preview: JSON.stringify(req.body).slice(0, 200)
-//             });
-
-//             return next(
-//                 new ValidationError(issues[0]?.message || "Validation failed.")
-//             );
-//         };
-//     }
-// }
-
-
-
-// src/adapters/ZodAdapter.ts - FIXED
 import { ZodSchema, ZodError } from "zod";
-import { ValidationError } from "../core/errors/ValidationError.js"; // ✅ Add .js
+import { ValidationError } from "../core/errors/ValidationError.js"; 
 import { logger } from "../logging/index.js";
 
 export class ZodAdapter {
@@ -84,7 +35,7 @@ export class ZodAdapter {
             });
 
             return next(
-                new ValidationError("Validation failed.", issues as any) // ✅ Pass issues
+                new ValidationError("Validation failed.", issues as any) 
             );
         };
     }