hono 4.13.8 → 4.13.10

package/dist/cjs/middleware/csrf/index.js

@@ -1,77 +1,106 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var csrf_exports = {};
-__export(csrf_exports, {
-  csrf: () => csrf
-});
-module.exports = __toCommonJS(csrf_exports);
-var import_http_exception = require("../../http-exception");
-const secFetchSiteValues = ["same-origin", "same-site", "none", "cross-site"];
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_http_exception = require("../../http-exception.js");
+//#region src/middleware/csrf/index.ts
+const secFetchSiteValues = [
+	"same-origin",
+	"same-site",
+	"none",
+	"cross-site"
+];
 const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
 const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
 const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
+/**
+* CSRF Protection Middleware for Hono.
+*
+* Protects against Cross-Site Request Forgery attacks by validating request origins
+* and sec-fetch-site headers. The request is allowed if either validation passes.
+*
+* @see {@link https://hono.dev/docs/middleware/builtin/csrf}
+*
+* @param {CSRFOptions} [options] - The options for the CSRF protection middleware.
+* @param {string|string[]|(origin: string, context: Context) => boolean} [options.origin] -
+*   Allowed origins for requests.
+*   - string: Single allowed origin (e.g., 'https://example.com')
+*   - string[]: Multiple allowed origins
+*   - function: Custom validation logic
+*   - Default: Only same origin as the request URL
+* @param {string|string[]|(secFetchSite: string, context: Context) => boolean} [options.secFetchSite] -
+*   Sec-Fetch-Site header validation. Standard values include 'same-origin', 'same-site', 'cross-site', 'none'.
+*   - string: Single allowed value (e.g., 'same-origin')
+*   - string[]: Multiple allowed values (e.g., ['same-origin', 'same-site'])
+*   - function: Custom validation with access to context
+*   - Default: Only allows 'same-origin'
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Hono()
+*
+* // Default: both origin and sec-fetch-site validation
+* app.use('*', csrf())
+*
+* // Allow specific origins
+* app.use('*', csrf({ origin: 'https://example.com' }))
+* app.use('*', csrf({ origin: ['https://app.com', 'https://api.com'] }))
+*
+* // Allow specific sec-fetch-site values
+* app.use('*', csrf({ secFetchSite: 'same-origin' }))
+* app.use('*', csrf({ secFetchSite: ['same-origin', 'same-site'] }))
+*
+* // Dynamic sec-fetch-site validation
+* app.use('*', csrf({
+*   secFetchSite: (secFetchSite, c) => {
+*     // Always allow same-origin
+*     if (secFetchSite === 'same-origin') return true
+*     // Allow cross-site for webhook endpoints
+*     if (secFetchSite === 'cross-site' && c.req.path.startsWith('/webhook/')) {
+*       return true
+*     }
+*     return false
+*   }
+* }))
+*
+* // Dynamic origin validation
+* app.use('*', csrf({
+*   origin: (origin, c) => {
+*     // Allow same origin
+*     if (origin === new URL(c.req.url).origin) return true
+*     // Allow specific trusted domains
+*     return ['https://app.example.com', 'https://admin.example.com'].includes(origin)
+*   }
+* }))
+* ```
+*/
 const csrf = (options) => {
-  const originHandler = ((optsOrigin) => {
-    if (!optsOrigin) {
-      return (origin, c) => origin === new URL(c.req.url).origin;
-    } else if (typeof optsOrigin === "string") {
-      return (origin) => origin === optsOrigin;
-    } else if (typeof optsOrigin === "function") {
-      return optsOrigin;
-    } else {
-      return (origin) => optsOrigin.includes(origin);
-    }
-  })(options?.origin);
-  const isAllowedOrigin = async (origin, c) => {
-    if (origin === void 0) {
-      return false;
-    }
-    return await originHandler(origin, c);
-  };
-  const secFetchSiteHandler = ((optsSecFetchSite) => {
-    if (!optsSecFetchSite) {
-      return (secFetchSite) => secFetchSite === "same-origin";
-    } else if (typeof optsSecFetchSite === "string") {
-      return (secFetchSite) => secFetchSite === optsSecFetchSite;
-    } else if (typeof optsSecFetchSite === "function") {
-      return optsSecFetchSite;
-    } else {
-      return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
-    }
-  })(options?.secFetchSite);
-  const isAllowedSecFetchSite = async (secFetchSite, c) => {
-    if (secFetchSite === void 0) {
-      return false;
-    }
-    if (!isSecFetchSite(secFetchSite)) {
-      return false;
-    }
-    return await secFetchSiteHandler(secFetchSite, c);
-  };
-  return async function csrf2(c, next) {
-    if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
-      const res = new Response("Forbidden", { status: 403 });
-      throw new import_http_exception.HTTPException(403, { res });
-    }
-    await next();
-  };
+	const originHandler = ((optsOrigin) => {
+		if (!optsOrigin) return (origin, c) => origin === new URL(c.req.url).origin;
+		else if (typeof optsOrigin === "string") return (origin) => origin === optsOrigin;
+		else if (typeof optsOrigin === "function") return optsOrigin;
+		else return (origin) => optsOrigin.includes(origin);
+	})(options?.origin);
+	const isAllowedOrigin = async (origin, c) => {
+		if (origin === void 0) return false;
+		return await originHandler(origin, c);
+	};
+	const secFetchSiteHandler = ((optsSecFetchSite) => {
+		if (!optsSecFetchSite) return (secFetchSite) => secFetchSite === "same-origin";
+		else if (typeof optsSecFetchSite === "string") return (secFetchSite) => secFetchSite === optsSecFetchSite;
+		else if (typeof optsSecFetchSite === "function") return optsSecFetchSite;
+		else return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
+	})(options?.secFetchSite);
+	const isAllowedSecFetchSite = async (secFetchSite, c) => {
+		if (secFetchSite === void 0) return false;
+		if (!isSecFetchSite(secFetchSite)) return false;
+		return await secFetchSiteHandler(secFetchSite, c);
+	};
+	return async function csrf(c, next) {
+		if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
+			const res = new Response("Forbidden", { status: 403 });
+			throw new require_http_exception.HTTPException(403, { res });
+		}
+		await next();
+	};
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  csrf
-});
+//#endregion
+exports.csrf = csrf;

package/dist/cjs/middleware/etag/digest.js

@@ -1,101 +1,62 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var digest_exports = {};
-__export(digest_exports, {
-  generateDigest: () => generateDigest
-});
-module.exports = __toCommonJS(digest_exports);
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/middleware/etag/digest.ts
 const mergeBuffers = (buffer1, buffer2) => {
-  if (!buffer1) {
-    return buffer2;
-  }
-  const merged = new Uint8Array(
-    new ArrayBuffer(buffer1.byteLength + buffer2.byteLength)
-  );
-  merged.set(new Uint8Array(buffer1), 0);
-  merged.set(buffer2, buffer1.byteLength);
-  return merged;
+	if (!buffer1) return buffer2;
+	const merged = new Uint8Array(new ArrayBuffer(buffer1.byteLength + buffer2.byteLength));
+	merged.set(new Uint8Array(buffer1), 0);
+	merged.set(buffer2, buffer1.byteLength);
+	return merged;
 };
-const CHUNK_SIZE = 256 * 1024;
+const CHUNK_SIZE = 262144;
 const generateDigest = async (stream, generator) => {
-  if (!stream) {
-    return null;
-  }
-  let result = void 0;
-  let chunk;
-  let chunkLength = 0;
-  const digest = async (body) => {
-    result = await generator(mergeBuffers(result, body));
-  };
-  const reader = stream.getReader();
-  for (; ; ) {
-    const { value, done } = await reader.read();
-    if (done) {
-      break;
-    }
-    let offset = 0;
-    while (offset < value.byteLength) {
-      const remaining = value.byteLength - offset;
-      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
-        await digest(value.subarray(offset, offset + CHUNK_SIZE));
-        offset += CHUNK_SIZE;
-        continue;
-      }
-      const requiredLength = chunkLength + remaining;
-      if (requiredLength < CHUNK_SIZE) {
-        if (!chunk) {
-          chunk = value.slice(offset);
-        } else {
-          if (chunk.byteLength < requiredLength) {
-            const nextChunk = new Uint8Array(
-              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
-            );
-            nextChunk.set(chunk.subarray(0, chunkLength));
-            chunk = nextChunk;
-          }
-          chunk.set(value.subarray(offset), chunkLength);
-        }
-        chunkLength = requiredLength;
-        break;
-      }
-      const length = CHUNK_SIZE - chunkLength;
-      if (chunk?.byteLength !== CHUNK_SIZE) {
-        const nextChunk = new Uint8Array(new ArrayBuffer(CHUNK_SIZE));
-        if (chunk) {
-          nextChunk.set(chunk.subarray(0, chunkLength));
-        }
-        chunk = nextChunk;
-      }
-      chunk.set(value.subarray(offset, offset + length), chunkLength);
-      await digest(chunk);
-      chunkLength = 0;
-      offset += length;
-    }
-  }
-  if (chunk && chunkLength > 0) {
-    await digest(chunk.subarray(0, chunkLength));
-  }
-  if (!result) {
-    return null;
-  }
-  return Array.prototype.map.call(new Uint8Array(result), (x) => x.toString(16).padStart(2, "0")).join("");
+	if (!stream) return null;
+	let result = void 0;
+	let chunk;
+	let chunkLength = 0;
+	const digest = async (body) => {
+		result = await generator(mergeBuffers(result, body));
+	};
+	const reader = stream.getReader();
+	for (;;) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		let offset = 0;
+		while (offset < value.byteLength) {
+			const remaining = value.byteLength - offset;
+			if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+				await digest(value.subarray(offset, offset + CHUNK_SIZE));
+				offset += CHUNK_SIZE;
+				continue;
+			}
+			const requiredLength = chunkLength + remaining;
+			if (requiredLength < CHUNK_SIZE) {
+				if (!chunk) chunk = value.slice(offset);
+				else {
+					if (chunk.byteLength < requiredLength) {
+						const nextChunk = new Uint8Array(new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2))));
+						nextChunk.set(chunk.subarray(0, chunkLength));
+						chunk = nextChunk;
+					}
+					chunk.set(value.subarray(offset), chunkLength);
+				}
+				chunkLength = requiredLength;
+				break;
+			}
+			const length = CHUNK_SIZE - chunkLength;
+			if (chunk?.byteLength !== CHUNK_SIZE) {
+				const nextChunk = new Uint8Array(/* @__PURE__ */ new ArrayBuffer(CHUNK_SIZE));
+				if (chunk) nextChunk.set(chunk.subarray(0, chunkLength));
+				chunk = nextChunk;
+			}
+			chunk.set(value.subarray(offset, offset + length), chunkLength);
+			await digest(chunk);
+			chunkLength = 0;
+			offset += length;
+		}
+	}
+	if (chunk && chunkLength > 0) await digest(chunk.subarray(0, chunkLength));
+	if (!result) return null;
+	return Array.prototype.map.call(new Uint8Array(result), (x) => x.toString(16).padStart(2, "0")).join("");
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  generateDigest
-});
+//#endregion
+exports.generateDigest = generateDigest;

package/dist/cjs/middleware/etag/index.js

@@ -1,99 +1,79 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var etag_exports = {};
-__export(etag_exports, {
-  RETAINED_304_HEADERS: () => RETAINED_304_HEADERS,
-  etag: () => etag
-});
-module.exports = __toCommonJS(etag_exports);
-var import_digest = require("./digest");
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_middleware_etag_digest = require("./digest.js");
+//#region src/middleware/etag/index.ts
+/**
+* Default headers to pass through on 304 responses. From the spec:
+* > The response must not contain a body and must include the headers that
+* > would have been sent in an equivalent 200 OK response: Cache-Control,
+* > Content-Location, Date, ETag, Expires, and Vary.
+*/
 const RETAINED_304_HEADERS = [
-  "cache-control",
-  "content-location",
-  "date",
-  "etag",
-  "expires",
-  "vary"
+	"cache-control",
+	"content-location",
+	"date",
+	"etag",
+	"expires",
+	"vary"
 ];
 const stripWeak = (tag) => tag.replace(/^W\//, "");
-function etagMatches(etag2, ifNoneMatch) {
-  return ifNoneMatch != null && ifNoneMatch.split(",").some((t) => stripWeak(t.trim()) === stripWeak(etag2));
+function etagMatches(etag, ifNoneMatch) {
+	return ifNoneMatch != null && ifNoneMatch.split(",").some((t) => stripWeak(t.trim()) === stripWeak(etag));
 }
 function initializeGenerator(generator) {
-  if (!generator) {
-    if (crypto && crypto.subtle) {
-      generator = (body) => crypto.subtle.digest(
-        {
-          name: "SHA-1"
-        },
-        body
-      );
-    }
-  }
-  return generator;
+	if (!generator) {
+		if (crypto && crypto.subtle) generator = (body) => crypto.subtle.digest({ name: "SHA-1" }, body);
+	}
+	return generator;
 }
+/**
+* ETag Middleware for Hono.
+*
+* @see {@link https://hono.dev/docs/middleware/builtin/etag}
+*
+* @param {ETagOptions} [options] - The options for the ETag middleware.
+* @param {boolean} [options.weak=false] - Define using or not using a weak validation. If true is set, then `W/` is added to the prefix of the value.
+* @param {string[]} [options.retainedHeaders=RETAINED_304_HEADERS] - The headers that you want to retain in the 304 Response.
+* @param {function(Uint8Array): ArrayBuffer | Promise<ArrayBuffer>} [options.generateDigest] -
+* A custom digest generation function. By default, it uses 'SHA-1'
+* This function is called with the response body as a `Uint8Array` and should return a hash as an `ArrayBuffer` or a Promise of one.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Hono()
+*
+* app.use('/etag/*', etag())
+* app.get('/etag/abc', (c) => {
+*   return c.text('Hono is hot')
+* })
+* ```
+*/
 const etag = (options) => {
-  const retainedHeaders = options?.retainedHeaders ?? RETAINED_304_HEADERS;
-  const weak = options?.weak ?? false;
-  const generator = initializeGenerator(options?.generateDigest);
-  return async function etag2(c, next) {
-    const ifNoneMatch = c.req.header("If-None-Match") ?? null;
-    await next();
-    if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) {
-      return;
-    }
-    const res = c.res;
-    let etag3 = res.headers.get("ETag");
-    if (!etag3) {
-      if (!generator) {
-        return;
-      }
-      const hash = await (0, import_digest.generateDigest)(
-        // This type casing avoids the type error for `deno publish`
-        res.clone().body,
-        generator
-      );
-      if (hash === null) {
-        return;
-      }
-      etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
-    }
-    const matched = ifNoneMatch === "*" || etagMatches(etag3, ifNoneMatch);
-    if (matched) {
-      c.res = new Response(null, {
-        status: 304,
-        statusText: "Not Modified",
-        headers: {
-          ETag: etag3
-        }
-      });
-      for (const key of Array.from(c.res.headers.keys())) {
-        if (retainedHeaders.indexOf(key.toLowerCase()) === -1) {
-          c.res.headers.delete(key);
-        }
-      }
-    } else {
-      c.res.headers.set("ETag", etag3);
-    }
-  };
+	const retainedHeaders = options?.retainedHeaders ?? RETAINED_304_HEADERS;
+	const weak = options?.weak ?? false;
+	const generator = initializeGenerator(options?.generateDigest);
+	return async function etag(c, next) {
+		const ifNoneMatch = c.req.header("If-None-Match") ?? null;
+		await next();
+		if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) return;
+		const res = c.res;
+		let etag = res.headers.get("ETag");
+		if (!etag) {
+			if (!generator) return;
+			const hash = await require_middleware_etag_digest.generateDigest(res.clone().body, generator);
+			if (hash === null) return;
+			etag = weak ? `W/"${hash}"` : `"${hash}"`;
+		}
+		if (ifNoneMatch === "*" || etagMatches(etag, ifNoneMatch)) {
+			c.res = new Response(null, {
+				status: 304,
+				statusText: "Not Modified",
+				headers: { ETag: etag }
+			});
+			for (const key of Array.from(c.res.headers.keys())) if (retainedHeaders.indexOf(key.toLowerCase()) === -1) c.res.headers.delete(key);
+		} else c.res.headers.set("ETag", etag);
+	};
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  RETAINED_304_HEADERS,
-  etag
-});
+//#endregion
+exports.RETAINED_304_HEADERS = RETAINED_304_HEADERS;
+exports.etag = etag;