json-rest-api 1.0.22 → 1.0.24

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__connectors__lib__busboy-detector.js.txt

@@ -1,175 +0,0 @@
-     1	/**
-     2	 * Busboy File Detector for HTTP Multipart Uploads
-     3	 *
-     4	 * This detector handles multipart/form-data uploads using the busboy library.
-     5	 * It's suitable for both HTTP and Express connectors.
-     6	 *
-     7	 * Features:
-     8	 * - Streaming parser (memory efficient)
-     9	 * - Configurable file size limits
-    10	 * - Automatic field parsing
-    11	 * - No temporary files by default (keeps in memory)
-    12	 *
-    13	 * Usage:
-    14	 * ```javascript
-    15	 * import { createBusboyDetector } from 'jsonrestapi/plugins/core/lib/busboy-detector.js';
-    16	 *
-    17	 * api.use(HttpPlugin, {
-    18	 *   fileParser: 'busboy',
-    19	 *   fileParserOptions: {
-    20	 *     limits: { fileSize: 10 * 1024 * 1024 } // 10MB
-    21	 *   }
-    22	 * });
-    23	 * ```
-    24	 */
-    25	
-    26	import { requirePackage } from 'hooked-api'
-    27	import { Readable } from 'stream'
-    28	
-    29	let Busboy
-    30	try {
-    31	  Busboy = (await import('busboy')).default
-    32	} catch (e) {
-    33	  requirePackage('busboy', 'express/http-connector',
-    34	    'Busboy is required for multipart/form-data file uploads. This is a peer dependency.')
-    35	}
-    36	
-    37	/**
-    38	 * Creates a busboy-based file detector
-    39	 *
-    40	 * @param {Object} options - Busboy configuration options
-    41	 * @param {Object} options.limits - Size limits
-    42	 * @param {number} options.limits.fileSize - Max file size in bytes
-    43	 * @param {number} options.limits.files - Max number of files
-    44	 * @param {number} options.limits.fields - Max number of fields
-    45	 * @returns {Object} Detector object with detect() and parse() methods
-    46	 */
-    47	export function createBusboyDetector (options = {}) {
-    48	  return {
-    49	    name: 'busboy-multipart',
-    50	
-    51	    /**
-    52	     * Check if this detector can handle the request
-    53	     * @param {Object} params - Request parameters
-    54	     * @returns {boolean} True if this is a multipart request
-    55	     */
-    56	    detect: (params) => {
-    57	      const req = params._httpReq || params._expressReq
-    58	      if (!req || !req.headers) return false
-    59	
-    60	      const contentType = req.headers['content-type'] || ''
-    61	      return contentType.includes('multipart/form-data')
-    62	    },
-    63	
-    64	    /**
-    65	     * Parse multipart data from the request
-    66	     * @param {Object} params - Request parameters
-    67	     * @returns {Promise<{fields: Object, files: Object}>} Parsed data
-    68	     */
-    69	    parse: async (params) => {
-    70	      const req = params._httpReq || params._expressReq
-    71	
-    72	      return new Promise((resolve, reject) => {
-    73	        const busboy = new Busboy({
-    74	          headers: req.headers,
-    75	          ...options
-    76	        })
-    77	
-    78	        const fields = {}
-    79	        const files = {}
-    80	        const filePromises = []
-    81	
-    82	        // Handle fields
-    83	        busboy.on('field', (fieldname, val) => {
-    84	          // Handle array notation (field[] or field[0])
-    85	          const arrayMatch = fieldname.match(/^(.+)\[\d*\]$/)
-    86	          if (arrayMatch) {
-    87	            const baseName = arrayMatch[1]
-    88	            if (!fields[baseName]) {
-    89	              fields[baseName] = []
-    90	            }
-    91	            if (Array.isArray(fields[baseName])) {
-    92	              fields[baseName].push(val)
-    93	            }
-    94	          } else {
-    95	            fields[fieldname] = val
-    96	          }
-    97	        })
-    98	
-    99	        // Handle files
-   100	        busboy.on('file', (fieldname, file, filename, encoding, mimetype) => {
-   101	          const chunks = []
-   102	          let size = 0
-   103	
-   104	          const filePromise = new Promise((fileResolve, fileReject) => {
-   105	            file.on('data', (chunk) => {
-   106	              chunks.push(chunk)
-   107	              size += chunk.length
-   108	            })
-   109	
-   110	            file.on('limit', () => {
-   111	              fileReject(new Error(`File size limit exceeded for field '${fieldname}'`))
-   112	            })
-   113	
-   114	            file.on('end', () => {
-   115	              files[fieldname] = {
-   116	                filename,
-   117	                mimetype,
-   118	                encoding,
-   119	                size,
-   120	                data: Buffer.concat(chunks)
-   121	              }
-   122	              fileResolve()
-   123	            })
-   124	
-   125	            file.on('error', fileReject)
-   126	          })
-   127	
-   128	          filePromises.push(filePromise)
-   129	        })
-   130	
-   131	        // Handle completion
-   132	        busboy.on('finish', async () => {
-   133	          try {
-   134	            // Wait for all files to be fully read
-   135	            await Promise.all(filePromises)
-   136	            resolve({ fields, files })
-   137	          } catch (error) {
-   138	            reject(error)
-   139	          }
-   140	        })
-   141	
-   142	        // Handle errors
-   143	        busboy.on('error', (error) => {
-   144	          reject(error)
-   145	        })
-   146	
-   147	        // Handle limit errors
-   148	        busboy.on('partsLimit', () => {
-   149	          reject(new Error('Parts limit exceeded'))
-   150	        })
-   151	
-   152	        busboy.on('filesLimit', () => {
-   153	          reject(new Error('Files limit exceeded'))
-   154	        })
-   155	
-   156	        busboy.on('fieldsLimit', () => {
-   157	          reject(new Error('Fields limit exceeded'))
-   158	        })
-   159	
-   160	        // Pipe request to busboy
-   161	        if (req.pipe) {
-   162	          req.pipe(busboy)
-   163	        } else if (req.on) {
-   164	          // For already buffered requests
-   165	          const stream = new Readable()
-   166	          stream.push(req.body || req)
-   167	          stream.push(null)
-   168	          stream.pipe(busboy)
-   169	        } else {
-   170	          reject(new Error('Request object is not a stream'))
-   171	        }
-   172	      })
-   173	    }
-   174	  }
-   175	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__connectors__lib__formidable-detector.js.txt

@@ -1,138 +0,0 @@
-     1	/**
-     2	 * Formidable File Detector for HTTP Multipart Uploads
-     3	 *
-     4	 * This detector handles multipart/form-data uploads using the formidable library.
-     5	 * Unlike busboy, formidable saves files to disk temporarily, which is better
-     6	 * for large files.
-     7	 *
-     8	 * Features:
-     9	 * - Disk-based storage (better for large files)
-    10	 * - Automatic temp file cleanup
-    11	 * - Progress tracking support
-    12	 * - Built-in file type detection
-    13	 *
-    14	 * Usage:
-    15	 * ```javascript
-    16	 * import { createFormidableDetector } from 'jsonrestapi/plugins/core/lib/formidable-detector.js';
-    17	 *
-    18	 * api.use(ExpressPlugin, {
-    19	 *   fileParser: 'formidable',
-    20	 *   fileParserOptions: {
-    21	 *     uploadDir: './uploads/temp',
-    22	 *     keepExtensions: true,
-    23	 *     maxFileSize: 200 * 1024 * 1024 // 200MB
-    24	 *   }
-    25	 * });
-    26	 * ```
-    27	 */
-    28	
-    29	import { requirePackage } from 'hooked-api'
-    30	import { promises as fs } from 'fs'
-    31	import path from 'path'
-    32	
-    33	let formidable
-    34	try {
-    35	  formidable = (await import('formidable')).default
-    36	} catch (e) {
-    37	  requirePackage('formidable', 'express/http-connector',
-    38	    'Formidable is required for multipart/form-data file uploads with disk storage. This is a peer dependency.')
-    39	}
-    40	
-    41	/**
-    42	 * Creates a formidable-based file detector
-    43	 *
-    44	 * @param {Object} options - Formidable configuration options
-    45	 * @param {string} options.uploadDir - Directory for temporary files
-    46	 * @param {boolean} options.keepExtensions - Keep file extensions
-    47	 * @param {number} options.maxFileSize - Max file size in bytes
-    48	 * @param {boolean} options.multiples - Allow multiple files per field
-    49	 * @returns {Object} Detector object with detect() and parse() methods
-    50	 */
-    51	export function createFormidableDetector (options = {}) {
-    52	  // Set default upload directory
-    53	  const uploadDir = options.uploadDir || path.join(process.cwd(), 'uploads', 'temp')
-    54	
-    55	  return {
-    56	    name: 'formidable-multipart',
-    57	
-    58	    /**
-    59	     * Check if this detector can handle the request
-    60	     * @param {Object} params - Request parameters
-    61	     * @returns {boolean} True if this is a multipart request
-    62	     */
-    63	    detect: (params) => {
-    64	      const req = params._httpReq || params._expressReq
-    65	      if (!req || !req.headers) return false
-    66	
-    67	      const contentType = req.headers['content-type'] || ''
-    68	      return contentType.includes('multipart/form-data')
-    69	    },
-    70	
-    71	    /**
-    72	     * Parse multipart data from the request
-    73	     * @param {Object} params - Request parameters
-    74	     * @returns {Promise<{fields: Object, files: Object}>} Parsed data
-    75	     */
-    76	    parse: async (params) => {
-    77	      const req = params._httpReq || params._expressReq
-    78	
-    79	      // Ensure upload directory exists
-    80	      await fs.mkdir(uploadDir, { recursive: true })
-    81	
-    82	      // Create form parser
-    83	      const form = formidable({
-    84	        uploadDir,
-    85	        keepExtensions: true,
-    86	        ...options
-    87	      })
-    88	
-    89	      // Parse the request
-    90	      const [fields, fileUploads] = await form.parse(req)
-    91	
-    92	      // Normalize formidable's file format to our standard format
-    93	      const files = {}
-    94	
-    95	      for (const [fieldname, uploadedFiles] of Object.entries(fileUploads)) {
-    96	        // Formidable returns arrays for multiple files
-    97	        const fileArray = Array.isArray(uploadedFiles) ? uploadedFiles : [uploadedFiles]
-    98	
-    99	        // For now, just take the first file (TODO: handle multiple files per field)
-   100	        const file = fileArray[0]
-   101	
-   102	        if (file) {
-   103	          // Read file data into memory (for small files)
-   104	          // For large files, you might want to keep them on disk
-   105	          const data = await fs.readFile(file.filepath)
-   106	
-   107	          files[fieldname] = {
-   108	            filename: file.originalFilename || 'unknown',
-   109	            mimetype: file.mimetype || 'application/octet-stream',
-   110	            size: file.size,
-   111	            data,
-   112	            filepath: file.filepath, // Keep for reference
-   113	
-   114	            // Cleanup function to remove temp file
-   115	            cleanup: async () => {
-   116	              try {
-   117	                await fs.unlink(file.filepath)
-   118	              } catch (error) {
-   119	                // File might already be deleted, ignore
-   120	                if (error.code !== 'ENOENT') {
-   121	                  throw error
-   122	                }
-   123	              }
-   124	            }
-   125	          }
-   126	        }
-   127	      }
-   128	
-   129	      // Normalize fields (formidable returns arrays for repeated fields)
-   130	      const normalizedFields = {}
-   131	      for (const [key, value] of Object.entries(fields)) {
-   132	        normalizedFields[key] = Array.isArray(value) && value.length === 1 ? value[0] : value
-   133	      }
-   134	
-   135	      return { fields: normalizedFields, files }
-   136	    }
-   137	  }
-   138	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__connectors__lib__request-helpers.js.txt

@@ -1,222 +0,0 @@
-     1	/**
-     2	 * Helper functions for HTTP request context creation
-     3	 * Used by both HTTP and Express plugins
-     4	 */
-     5	
-     6	/**
-     7	 * Extract the real client IP address, handling proxies
-     8	 * @param {Object} req - The request object (Node.js http.IncomingMessage or Express Request)
-     9	 * @returns {string} The client IP address
-    10	 */
-    11	export function getClientIP (req) {
-    12	  // Check X-Forwarded-For header (comma-separated list, first is original client)
-    13	  const xForwardedFor = req.headers['x-forwarded-for']
-    14	  if (xForwardedFor) {
-    15	    return xForwardedFor.split(',')[0].trim()
-    16	  }
-    17	
-    18	  // Check X-Real-IP header (single IP)
-    19	  const xRealIP = req.headers['x-real-ip']
-    20	  if (xRealIP) {
-    21	    return xRealIP
-    22	  }
-    23	
-    24	  // Check Cloudflare's CF-Connecting-IP
-    25	  const cfConnectingIP = req.headers['cf-connecting-ip']
-    26	  if (cfConnectingIP) {
-    27	    return cfConnectingIP
-    28	  }
-    29	
-    30	  // Fall back to direct connection
-    31	  return req.connection?.remoteAddress ||
-    32	         req.socket?.remoteAddress ||
-    33	         req.ip || // Express specific
-    34	         'unknown'
-    35	}
-    36	
-    37	/**
-    38	 * Check if the request is using HTTPS
-    39	 * @param {Object} req - The request object
-    40	 * @returns {boolean} True if the request is secure
-    41	 */
-    42	export function isSecure (req) {
-    43	  // Express-specific property
-    44	  if (req.secure !== undefined) {
-    45	    return req.secure
-    46	  }
-    47	
-    48	  // Check X-Forwarded-Proto header (used by proxies)
-    49	  const xForwardedProto = req.headers['x-forwarded-proto']
-    50	  if (xForwardedProto) {
-    51	    return xForwardedProto === 'https'
-    52	  }
-    53	
-    54	  // Check if connection is encrypted (Node.js)
-    55	  if (req.connection?.encrypted) {
-    56	    return true
-    57	  }
-    58	
-    59	  // Check protocol directly
-    60	  if (req.protocol === 'https') {
-    61	    return true
-    62	  }
-    63	
-    64	  // Default to false
-    65	  return false
-    66	}
-    67	
-    68	/**
-    69	 * Get the hostname from the request
-    70	 * @param {Object} req - The request object
-    71	 * @returns {string} The hostname
-    72	 */
-    73	export function getHostname (req) {
-    74	  // Express-specific property
-    75	  if (req.hostname) {
-    76	    return req.hostname
-    77	  }
-    78	
-    79	  // Check Host header
-    80	  const hostHeader = req.headers.host
-    81	  if (hostHeader) {
-    82	    // Remove port if present
-    83	    const colonIndex = hostHeader.indexOf(':')
-    84	    return colonIndex === -1 ? hostHeader : hostHeader.substring(0, colonIndex)
-    85	  }
-    86	
-    87	  // Fall back
-    88	  return 'localhost'
-    89	}
-    90	
-    91	/**
-    92	 * Get the port from the request
-    93	 * @param {Object} req - The request object
-    94	 * @returns {number|null} The port number or null
-    95	 */
-    96	export function getPort (req) {
-    97	  // Check Host header for port
-    98	  const hostHeader = req.headers.host
-    99	  if (hostHeader) {
-   100	    const colonIndex = hostHeader.indexOf(':')
-   101	    if (colonIndex !== -1) {
-   102	      const port = parseInt(hostHeader.substring(colonIndex + 1), 10)
-   103	      if (!isNaN(port)) {
-   104	        return port
-   105	      }
-   106	    }
-   107	  }
-   108	
-   109	  // Check connection local port
-   110	  if (req.connection?.localPort) {
-   111	    return req.connection.localPort
-   112	  }
-   113	
-   114	  if (req.socket?.localPort) {
-   115	    return req.socket.localPort
-   116	  }
-   117	
-   118	  // Default ports based on protocol
-   119	  return isSecure(req) ? 443 : 80
-   120	}
-   121	
-   122	/**
-   123	 * Parse cookies from cookie header string
-   124	 * @param {string} cookieString - The cookie header value
-   125	 * @returns {Object} Parsed cookies as key-value pairs
-   126	 */
-   127	export function parseCookies (cookieString) {
-   128	  const cookies = {}
-   129	
-   130	  if (!cookieString || typeof cookieString !== 'string') {
-   131	    return cookies
-   132	  }
-   133	
-   134	  // Split by semicolons and parse each cookie
-   135	  cookieString.split(';').forEach(cookie => {
-   136	    const trimmedCookie = cookie.trim()
-   137	    if (trimmedCookie) {
-   138	      const eqIndex = trimmedCookie.indexOf('=')
-   139	      if (eqIndex !== -1) {
-   140	        const name = trimmedCookie.substring(0, eqIndex).trim()
-   141	        const value = trimmedCookie.substring(eqIndex + 1).trim()
-   142	        if (name) {
-   143	          // Remove quotes if present
-   144	          cookies[name] = value.replace(/^"(.*)"$/, '$1')
-   145	        }
-   146	      }
-   147	    }
-   148	  })
-   149	
-   150	  return cookies
-   151	}
-   152	
-   153	/**
-   154	 * Extract token from request based on common patterns
-   155	 * @param {Object} req - The request object
-   156	 * @returns {string|null} The extracted token or null
-   157	 */
-   158	export function extractToken (req) {
-   159	  // Check Authorization header for Bearer token
-   160	  const authHeader = req.headers.authorization || req.headers.Authorization
-   161	  if (authHeader && typeof authHeader === 'string') {
-   162	    const bearerMatch = authHeader.match(/^Bearer\s+(.+)$/i)
-   163	    if (bearerMatch) {
-   164	      return bearerMatch[1]
-   165	    }
-   166	  }
-   167	
-   168	  // Check cookies for session token (Auth.js pattern)
-   169	  const cookies = parseCookies(req.headers.cookie || '')
-   170	  if (cookies['__Secure-authjs.session-token']) {
-   171	    return cookies['__Secure-authjs.session-token']
-   172	  }
-   173	  if (cookies['authjs.session-token']) {
-   174	    return cookies['authjs.session-token']
-   175	  }
-   176	
-   177	  return null
-   178	}
-   179	
-   180	/**
-   181	 * Create a context object for the request
-   182	 * @param {Object} req - The request object
-   183	 * @param {Object} res - The response object
-   184	 * @param {string} source - The source plugin ('http' or 'express')
-   185	 * @returns {Object} The context object
-   186	 */
-   187	export function createContext (req, res, source) {
-   188	  const context = {
-   189	    source,
-   190	    auth: {
-   191	      userId: null,
-   192	      claims: null
-   193	    },
-   194	    request: {
-   195	      ip: getClientIP(req),
-   196	      userAgent: req.headers['user-agent'] || null,
-   197	      protocol: isSecure(req) ? 'https' : 'http',
-   198	      hostname: getHostname(req),
-   199	      port: getPort(req),
-   200	      method: req.method,
-   201	      path: req.url || req.path,
-   202	      headers: req.headers,
-   203	      cookies: parseCookies(req.headers.cookie || ''),
-   204	      token: extractToken(req)
-   205	    },
-   206	    raw: { req, res },
-   207	    handled: false,
-   208	    rejection: null
-   209	  }
-   210	
-   211	  // Add reject function
-   212	  context.reject = (status, message, details = {}) => {
-   213	    context.handled = true
-   214	    context.rejection = {
-   215	      status,
-   216	      message,
-   217	      ...details
-   218	    }
-   219	  }
-   220	
-   221	  return context
-   222	}