nuxt-security-module 4.3.1 → 4.4.0

package/dist/runtime/nitro/plugins/ssgHashes.d.ts

@@ -1,5 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-//#region src/runtime/nitro/plugins/ssgHashes.d.ts
-declare const ssgHashes: NitroAppPlugin;
-//#endregion
-export { ssgHashes as default };

package/dist/runtime/nitro/plugins/ssgHashes.js

@@ -1,27 +0,0 @@
-import { collectSsgHashes } from "../../services/collectSsgHashes.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { getSecurityState } from "../../services/getSecurityState.js";
-import { insertContentSecurityPolicyMeta } from "../../services/insertContentSecurityPolicyMeta.js";
-import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
-import { definePlugin } from "nitro";
-//#region src/runtime/nitro/plugins/ssgHashes.ts
-const HTML_SECTIONS = [
-	"head",
-	"bodyPrepend",
-	"body",
-	"bodyAppend"
-];
-const ssgHashes = definePlugin((nitroApp) => {
-	if (!import.meta.prerender) return;
-	nitroApp.hooks.hook("render:html", async (html, { event }) => {
-		const rules = getSecurityRules(event);
-		if (!rules?.enabled || !rules.ssg || !rules.headers || !rules.headers.contentSecurityPolicy) return;
-		const state = getSecurityState(event);
-		state.hashes = await collectSsgHashes(HTML_SECTIONS.map((section) => html[section].join("")).join(""), rules.ssg);
-		if (!rules.ssg.meta) return;
-		const policy = updateContentSecurityPolicy(rules.headers.contentSecurityPolicy, state);
-		html.head = [insertContentSecurityPolicyMeta(html.head.join(""), policy)];
-	});
-});
-//#endregion
-export { ssgHashes as default };

package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts

@@ -1,4 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-//#region src/runtime/nitro/plugins/subresourceIntegrity.d.ts
-export declare const createSubresourceIntegrityPlugin: (sriHashes: Record<string, string>) => NitroAppPlugin;
-//#endregion

package/dist/runtime/nitro/plugins/subresourceIntegrity.js

@@ -1,19 +0,0 @@
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { injectSubresourceIntegrity } from "../../services/injectSubresourceIntegrity.js";
-import { definePlugin } from "nitro";
-//#region src/runtime/nitro/plugins/subresourceIntegrity.ts
-const HTML_SECTIONS = [
-	"body",
-	"bodyAppend",
-	"bodyPrepend",
-	"head"
-];
-const createSubresourceIntegrityPlugin = (sriHashes) => definePlugin((nitroApp) => {
-	nitroApp.hooks.hook("render:html", (html, { event }) => {
-		const rules = getSecurityRules(event);
-		if (!rules?.enabled || !rules.sri) return;
-		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectSubresourceIntegrity(element, sriHashes));
-	});
-});
-//#endregion
-export { createSubresourceIntegrityPlugin };

package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts

@@ -1,5 +0,0 @@
-import { Middleware } from "nitro/h3";
-//#region src/runtime/server/middleware/allowedMethodsRestricter.d.ts
-declare const allowedMethodsRestricter: Middleware;
-//#endregion
-export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/allowedMethodsRestricter.js

@@ -1,15 +0,0 @@
-import { checkIsMethodAllowed } from "../../services/checkIsMethodAllowed.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError } from "nitro/h3";
-//#region src/runtime/server/middleware/allowedMethodsRestricter.ts
-const allowedMethodsRestricter = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.allowedMethodsRestricter) return;
-	if (!checkIsMethodAllowed(event.req.method, rules.allowedMethodsRestricter.methods)) throw new HTTPError({
-		status: 405,
-		statusText: "Method not allowed"
-	});
-});
-//#endregion
-export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/basicAuth.d.ts

@@ -1,5 +0,0 @@
-import { Middleware } from "nitro/h3";
-//#region src/runtime/server/middleware/basicAuth.d.ts
-declare const basicAuthMiddleware: Middleware;
-//#endregion
-export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/basicAuth.js

@@ -1,23 +0,0 @@
-import "../../constants.js";
-import { checkIsBasicAuthorized } from "../../services/checkIsBasicAuthorized.js";
-import { checkIsChallenged } from "../../services/checkIsChallenged.js";
-import { getBasicAuthOptions } from "../../services/getBasicAuthOptions.js";
-import { serializeBasicAuthChallenge } from "../../services/serializeBasicAuthChallenge.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError } from "nitro/h3";
-import { useRuntimeConfig } from "nuxt/server";
-//#region src/runtime/server/middleware/basicAuth.ts
-const basicAuthMiddleware = defineMiddleware((event) => {
-	const basicAuth = getBasicAuthOptions(useRuntimeConfig().private);
-	if (!basicAuth) return;
-	const { pathname } = event.url;
-	if (!checkIsChallenged(pathname, basicAuth)) return;
-	if (checkIsBasicAuthorized(event.req.headers.get("authorization"), basicAuth)) return;
-	event.res.headers.set("WWW-Authenticate", serializeBasicAuthChallenge(basicAuth.message || "Please enter username and password"));
-	throw new HTTPError({
-		status: 401,
-		statusText: "Access denied"
-	});
-});
-//#endregion
-export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/corsHandler.d.ts

@@ -1,5 +0,0 @@
-import { Middleware } from "nitro/h3";
-//#region src/runtime/server/middleware/corsHandler.d.ts
-declare const corsHandler: Middleware;
-//#endregion
-export { corsHandler as default };

package/dist/runtime/server/middleware/corsHandler.js

@@ -1,20 +0,0 @@
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { handleCors } from "nitro/h3";
-//#region src/runtime/server/middleware/corsHandler.ts
-const corsHandler = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.corsHandler) return;
-	const { allowHeaders, credentials, exposeHeaders, maxAge, methods, origin, preflight } = rules.corsHandler;
-	handleCors(event, {
-		allowHeaders,
-		credentials,
-		exposeHeaders,
-		maxAge,
-		methods,
-		origin: [origin].flat(),
-		preflight
-	});
-});
-//#endregion
-export { corsHandler as default };

package/dist/runtime/server/middleware/csrf.d.ts

@@ -1,5 +0,0 @@
-import { Middleware } from "nitro/h3";
-//#region src/runtime/server/middleware/csrf.d.ts
-declare const csrf: Middleware;
-//#endregion
-export { csrf as default };

package/dist/runtime/server/middleware/csrf.js

@@ -1,28 +0,0 @@
-import { CSRF_UNSAFE_METHODS } from "../../constants.js";
-import { checkIsCsrfTokenValid } from "../../services/checkIsCsrfTokenValid.js";
-import { generateRandomToken } from "../../services/generateRandomToken.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError, getCookie, setCookie } from "nitro/h3";
-//#region src/runtime/server/middleware/csrf.ts
-const csrf = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.csrf) return;
-	const { cookieName, headerName } = rules.csrf;
-	const cookieToken = getCookie(event, cookieName);
-	if (!CSRF_UNSAFE_METHODS.includes(event.req.method)) {
-		if (cookieToken === void 0) setCookie(event, cookieName, generateRandomToken(32), {
-			httpOnly: false,
-			path: "/",
-			sameSite: "strict",
-			secure: event.url.protocol === "https:"
-		});
-		return;
-	}
-	if (!checkIsCsrfTokenValid(cookieToken, event.req.headers.get(headerName))) throw new HTTPError({
-		status: 403,
-		statusText: "Forbidden"
-	});
-});
-//#endregion
-export { csrf as default };

package/dist/runtime/server/middleware/rateLimiter.d.ts

@@ -1,5 +0,0 @@
-import { Middleware } from "nitro/h3";
-//#region src/runtime/server/middleware/rateLimiter.d.ts
-declare const rateLimiter: Middleware;
-//#endregion
-export { rateLimiter as default };

package/dist/runtime/server/middleware/rateLimiter.js

@@ -1,22 +0,0 @@
-import { MAX_RATE_LIMIT_ENTRIES } from "../../constants.js";
-import { createInMemoryRateLimiterStore } from "../../services/createInMemoryRateLimiterStore.js";
-import { getRetryAfterSeconds } from "../../services/getRetryAfterSeconds.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError, getRequestIP } from "nitro/h3";
-//#region src/runtime/server/middleware/rateLimiter.ts
-const rateLimiterStore = createInMemoryRateLimiterStore(MAX_RATE_LIMIT_ENTRIES);
-const rateLimiter = defineMiddleware(async (event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.rateLimiter) return;
-	const key = getRequestIP(event, { xForwardedFor: false }) ?? "unknown";
-	const retryAfterSeconds = await getRetryAfterSeconds(rateLimiterStore, key, rules.rateLimiter);
-	if (retryAfterSeconds === void 0) return;
-	event.res.headers.set("Retry-After", String(retryAfterSeconds));
-	throw new HTTPError({
-		status: 429,
-		statusText: "Too Many Requests"
-	});
-});
-//#endregion
-export { rateLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.d.ts

@@ -1,5 +0,0 @@
-import { Middleware } from "nitro/h3";
-//#region src/runtime/server/middleware/requestSizeLimiter.d.ts
-declare const requestSizeLimiter: Middleware;
-//#endregion
-export { requestSizeLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.js

@@ -1,17 +0,0 @@
-import { checkIsRequestTooLarge } from "../../services/checkIsRequestTooLarge.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError } from "nitro/h3";
-//#region src/runtime/server/middleware/requestSizeLimiter.ts
-const requestSizeLimiter = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.requestSizeLimiter) return;
-	const contentLength = event.req.headers.get("content-length");
-	const contentType = event.req.headers.get("content-type");
-	if (checkIsRequestTooLarge(event.req.method, contentLength, contentType, rules.requestSizeLimiter)) throw new HTTPError({
-		status: 413,
-		statusText: "Payload Too Large"
-	});
-});
-//#endregion
-export { requestSizeLimiter as default };

package/dist/runtime/services/checkIsBasicAuthorized.d.ts

@@ -1,4 +0,0 @@
-import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
-//#region src/runtime/services/checkIsBasicAuthorized.d.ts
-export declare const checkIsBasicAuthorized: (authorization: null | string, { name, pass }: BasicAuthOptions) => boolean;
-//#endregion

package/dist/runtime/services/checkIsBasicAuthorized.js

@@ -1,12 +0,0 @@
-import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
-import { getBasicAuthCredentials } from "./getBasicAuthCredentials.js";
-//#region src/runtime/services/checkIsBasicAuthorized.ts
-const checkIsBasicAuthorized = (authorization, { name, pass }) => {
-	const credentials = getBasicAuthCredentials(authorization);
-	if (!credentials) return false;
-	const isNameEqual = checkIsEqualInConstantTime(credentials.name, name);
-	const isPassEqual = checkIsEqualInConstantTime(credentials.pass, pass);
-	return isNameEqual && isPassEqual;
-};
-//#endregion
-export { checkIsBasicAuthorized };

package/dist/runtime/services/checkIsChallenged.d.ts

@@ -1,4 +0,0 @@
-import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
-//#region src/runtime/services/checkIsChallenged.d.ts
-export declare const checkIsChallenged: (path: string, { exclude, include }: BasicAuthOptions) => boolean;
-//#endregion

package/dist/runtime/services/checkIsChallenged.js

@@ -1,8 +0,0 @@
-//#region src/runtime/services/checkIsChallenged.ts
-const checkIsChallenged = (path, { exclude = [], include = [] }) => {
-	const isIncluded = include.some((prefix) => path.startsWith(prefix));
-	const isExcluded = exclude.some((prefix) => path.startsWith(prefix));
-	return isIncluded || !isExcluded;
-};
-//#endregion
-export { checkIsChallenged };

package/dist/runtime/services/checkIsCsrfTokenValid.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/checkIsCsrfTokenValid.d.ts
-export declare const checkIsCsrfTokenValid: (cookieToken: string | undefined, headerToken: null | string) => boolean;
-//#endregion

package/dist/runtime/services/checkIsCsrfTokenValid.js

@@ -1,8 +0,0 @@
-import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
-//#region src/runtime/services/checkIsCsrfTokenValid.ts
-const checkIsCsrfTokenValid = (cookieToken, headerToken) => {
-	if (!cookieToken || !headerToken) return false;
-	return checkIsEqualInConstantTime(cookieToken, headerToken);
-};
-//#endregion
-export { checkIsCsrfTokenValid };

package/dist/runtime/services/checkIsEqualInConstantTime.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/checkIsEqualInConstantTime.d.ts
-export declare const checkIsEqualInConstantTime: (first: string, second: string) => boolean;
-//#endregion

package/dist/runtime/services/checkIsEqualInConstantTime.js

@@ -1,11 +0,0 @@
-//#region src/runtime/services/checkIsEqualInConstantTime.ts
-const checkIsEqualInConstantTime = (first, second) => {
-	const firstBytes = new TextEncoder().encode(first);
-	const secondBytes = new TextEncoder().encode(second);
-	if (firstBytes.length !== secondBytes.length) return false;
-	let difference = 0;
-	for (const [index, byte] of firstBytes.entries()) difference |= byte ^ (secondBytes[index] ?? 0);
-	return difference === 0;
-};
-//#endregion
-export { checkIsEqualInConstantTime };

package/dist/runtime/services/checkIsMethodAllowed.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/checkIsMethodAllowed.d.ts
-export declare const checkIsMethodAllowed: (method: string, methods: string[]) => boolean;
-//#endregion

package/dist/runtime/services/checkIsMethodAllowed.js

@@ -1,4 +0,0 @@
-//#region src/runtime/services/checkIsMethodAllowed.ts
-const checkIsMethodAllowed = (method, methods) => methods.includes(method);
-//#endregion
-export { checkIsMethodAllowed };

package/dist/runtime/services/checkIsRecord.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/checkIsRecord.d.ts
-export declare const checkIsRecord: (value: unknown) => value is Record<string, unknown>;
-//#endregion

package/dist/runtime/services/checkIsRecord.js

@@ -1,4 +0,0 @@
-//#region src/runtime/services/checkIsRecord.ts
-const checkIsRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-//#endregion
-export { checkIsRecord };

package/dist/runtime/services/checkIsRequestTooLarge.d.ts

@@ -1,4 +0,0 @@
-import { RequestSizeLimiterOptions } from "../../models/RequestSizeLimiterOptions.js";
-//#region src/runtime/services/checkIsRequestTooLarge.d.ts
-export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, contentType: null | string, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }: RequestSizeLimiterOptions) => boolean;
-//#endregion

package/dist/runtime/services/checkIsRequestTooLarge.js

@@ -1,9 +0,0 @@
-import { SIZE_LIMITED_METHODS } from "../constants.js";
-//#region src/runtime/services/checkIsRequestTooLarge.ts
-const checkIsRequestTooLarge = (method, contentLength, contentType, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }) => {
-	if (!SIZE_LIMITED_METHODS.includes(method) || contentLength === null) return false;
-	const limit = contentType?.includes("multipart/form-data") ?? false ? maxUploadFileRequestInBytes : maxRequestSizeInBytes;
-	return Math.trunc(Number(contentLength)) >= limit;
-};
-//#endregion
-export { checkIsRequestTooLarge };

package/dist/runtime/services/collectSsgHashes.d.ts

@@ -1,5 +0,0 @@
-import { SsgOptions } from "../../models/SsgOptions.js";
-import { SecurityState } from "./getSecurityState.js";
-//#region src/runtime/services/collectSsgHashes.d.ts
-export declare const collectSsgHashes: (html: string, options: SsgOptions) => Promise<SecurityState["hashes"]>;
-//#endregion

package/dist/runtime/services/collectSsgHashes.js

@@ -1,41 +0,0 @@
-import { CSP_HASH_ALGORITHM, HTML_TAG_REGEX } from "../constants.js";
-import { generateHash } from "./generateHash.js";
-import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
-//#region src/runtime/services/collectSsgHashes.ts
-const SCRIPT_PRELOAD_TYPES = /* @__PURE__ */ new Set([
-	"audioworklet",
-	"paintworklet",
-	"script",
-	"xslt"
-]);
-const getSsgHashSource = async ([name, attributes, body], { hashScripts, hashStyles }) => {
-	const integrity = readHtmlTagAttribute(attributes, "integrity");
-	if (name === "script" && hashScripts) {
-		const source = readHtmlTagAttribute(attributes, "src");
-		if (source !== void 0 && integrity !== void 0) return ["script", `'${integrity}'`];
-		if (source === void 0 && body) return ["script", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
-		return;
-	}
-	if (name === "style" && hashStyles && body) return ["style", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
-	if (name !== "link" || integrity === void 0) return void 0;
-	const rel = readHtmlTagAttribute(attributes, "rel");
-	const as = readHtmlTagAttribute(attributes, "as") ?? "";
-	if (rel === "stylesheet" && hashStyles) return ["style", `'${integrity}'`];
-	if (hashScripts && (rel === "modulepreload" || rel === "preload" && SCRIPT_PRELOAD_TYPES.has(as))) return ["script", `'${integrity}'`];
-};
-const collectSsgHashes = async (html, options) => {
-	const elements = Array.from(html.matchAll(HTML_TAG_REGEX), ([, elementName, elementAttributes, , body, tagName, tagAttributes]) => [
-		(elementName ?? tagName ?? "").toLowerCase(),
-		elementAttributes ?? tagAttributes ?? "",
-		body
-	]);
-	const hashSources = await Promise.all(elements.map((element) => getSsgHashSource(element, options)));
-	const hashes = {
-		script: [],
-		style: []
-	};
-	for (const hashSource of hashSources) if (hashSource) hashes[hashSource[0]].push(hashSource[1]);
-	return hashes;
-};
-//#endregion
-export { collectSsgHashes };

package/dist/runtime/services/createInMemoryRateLimiterStore.d.ts

@@ -1,4 +0,0 @@
-import { RateLimiterStore } from "../../models/RateLimiterStore.js";
-//#region src/runtime/services/createInMemoryRateLimiterStore.d.ts
-export declare const createInMemoryRateLimiterStore: (maxEntries: number) => RateLimiterStore;
-//#endregion

package/dist/runtime/services/createInMemoryRateLimiterStore.js

@@ -1,22 +0,0 @@
-//#region src/runtime/services/createInMemoryRateLimiterStore.ts
-const createInMemoryRateLimiterStore = (maxEntries) => {
-	const windows = /* @__PURE__ */ new Map();
-	return { increment: (key, intervalInMilliseconds) => {
-		const now = Date.now();
-		const current = windows.get(key);
-		const window = current && current.resetAt > now ? {
-			count: current.count + 1,
-			resetAt: current.resetAt
-		} : {
-			count: 1,
-			resetAt: now + intervalInMilliseconds
-		};
-		windows.delete(key);
-		windows.set(key, window);
-		const [oldestKey] = windows.keys();
-		if (windows.size > maxEntries && oldestKey !== void 0) windows.delete(oldestKey);
-		return Promise.resolve(window);
-	} };
-};
-//#endregion
-export { createInMemoryRateLimiterStore };

package/dist/runtime/services/generateHash.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/generateHash.d.ts
-export declare const generateHash: (content: string | Uint8Array, hashAlgorithm: string) => Promise<string>;
-//#endregion

package/dist/runtime/services/generateHash.js

@@ -1,9 +0,0 @@
-//#region src/runtime/services/generateHash.ts
-const generateHash = async (content, hashAlgorithm) => {
-	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : new Uint8Array(content);
-	const hashBuffer = await globalThis.crypto.subtle.digest(hashAlgorithm, bytes);
-	const base64 = btoa(String.fromCodePoint(...new Uint8Array(hashBuffer)));
-	return `${hashAlgorithm.replace("-", "").toLowerCase()}-${base64}`;
-};
-//#endregion
-export { generateHash };

package/dist/runtime/services/generateNonce.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/generateNonce.d.ts
-export declare const generateNonce: () => string;
-//#endregion

package/dist/runtime/services/generateNonce.js

@@ -1,6 +0,0 @@
-import "../constants.js";
-import { generateRandomToken } from "./generateRandomToken.js";
-//#region src/runtime/services/generateNonce.ts
-const generateNonce = () => generateRandomToken(18);
-//#endregion
-export { generateNonce };

package/dist/runtime/services/generateRandomToken.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/generateRandomToken.d.ts
-export declare const generateRandomToken: (byteLength: number) => string;
-//#endregion

package/dist/runtime/services/generateRandomToken.js

@@ -1,8 +0,0 @@
-//#region src/runtime/services/generateRandomToken.ts
-const generateRandomToken = (byteLength) => {
-	const bytes = new Uint8Array(byteLength);
-	globalThis.crypto.getRandomValues(bytes);
-	return btoa(String.fromCodePoint(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
-};
-//#endregion
-export { generateRandomToken };

package/dist/runtime/services/getBasicAuthCredentials.d.ts

@@ -1,6 +0,0 @@
-//#region src/runtime/services/getBasicAuthCredentials.d.ts
-export declare const getBasicAuthCredentials: (authorization: null | string) => undefined | {
-  name: string;
-  pass: string;
-};
-//#endregion

package/dist/runtime/services/getBasicAuthCredentials.js

@@ -1,19 +0,0 @@
-import { BASIC_AUTHORIZATION_SCHEME } from "../constants.js";
-//#region src/runtime/services/getBasicAuthCredentials.ts
-const BASE64_REGEX = /^[\d+/A-Za-z]*={0,2}$/u;
-const BASE64_QUANTUM_LENGTH = 4;
-const checkIsBase64 = (value) => BASE64_REGEX.test(value) && (value.endsWith("=") ? value.length % BASE64_QUANTUM_LENGTH === 0 : value.length % BASE64_QUANTUM_LENGTH !== 1);
-const getBasicAuthCredentials = (authorization) => {
-	if (!authorization?.startsWith(`Basic `)) return void 0;
-	const encoded = authorization.slice(BASIC_AUTHORIZATION_SCHEME.length + 1).trim();
-	if (!checkIsBase64(encoded)) return void 0;
-	const decoded = new TextDecoder().decode(Uint8Array.fromBase64(encoded));
-	const separatorIndex = decoded.indexOf(":");
-	if (separatorIndex === -1) return void 0;
-	return {
-		name: decoded.slice(0, separatorIndex),
-		pass: decoded.slice(separatorIndex + 1)
-	};
-};
-//#endregion
-export { getBasicAuthCredentials };

package/dist/runtime/services/getBasicAuthOptions.d.ts

@@ -1,4 +0,0 @@
-import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
-//#region src/runtime/services/getBasicAuthOptions.d.ts
-export declare const getBasicAuthOptions: (privateRuntimeConfig: unknown) => BasicAuthOptions | undefined;
-//#endregion

package/dist/runtime/services/getBasicAuthOptions.js

@@ -1,17 +0,0 @@
-import { checkIsRecord } from "./checkIsRecord.js";
-//#region src/runtime/services/getBasicAuthOptions.ts
-const checkIsStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
-const getBasicAuthOptions = (privateRuntimeConfig) => {
-	if (!checkIsRecord(privateRuntimeConfig) || !checkIsRecord(privateRuntimeConfig.basicAuth)) return void 0;
-	const { exclude, include, message, name, pass } = privateRuntimeConfig.basicAuth;
-	if (typeof name !== "string" || typeof pass !== "string") return void 0;
-	return {
-		...checkIsStringList(exclude) && { exclude },
-		...checkIsStringList(include) && { include },
-		...typeof message === "string" && { message },
-		name,
-		pass
-	};
-};
-//#endregion
-export { getBasicAuthOptions };

package/dist/runtime/services/getRetryAfterSeconds.d.ts

@@ -1,5 +0,0 @@
-import { RateLimiterOptions } from "../../models/RateLimiterOptions.js";
-import { RateLimiterStore } from "../../models/RateLimiterStore.js";
-//#region src/runtime/services/getRetryAfterSeconds.d.ts
-export declare const getRetryAfterSeconds: (store: RateLimiterStore, key: string, { intervalInMilliseconds, tokensPerInterval }: RateLimiterOptions) => Promise<number | undefined>;
-//#endregion

package/dist/runtime/services/getRetryAfterSeconds.js

@@ -1,9 +0,0 @@
-//#region src/runtime/services/getRetryAfterSeconds.ts
-const MILLISECONDS_PER_SECOND = 1e3;
-const getRetryAfterSeconds = async (store, key, { intervalInMilliseconds, tokensPerInterval }) => {
-	const { count, resetAt } = await store.increment(key, intervalInMilliseconds);
-	if (count <= tokensPerInterval) return void 0;
-	return Math.max(1, Math.ceil((resetAt - Date.now()) / MILLISECONDS_PER_SECOND));
-};
-//#endregion
-export { getRetryAfterSeconds };

package/dist/runtime/services/getSecurityRules.d.ts

@@ -1,5 +0,0 @@
-import { SecurityRules } from "../../models/SecurityRules.js";
-import { H3Event } from "nitro/h3";
-//#region src/runtime/services/getSecurityRules.d.ts
-export declare const getSecurityRules: (event: H3Event) => SecurityRules | undefined;
-//#endregion

package/dist/runtime/services/getSecurityRules.js

@@ -1,15 +0,0 @@
-import { mergeSecurityRules } from "./mergeSecurityRules.js";
-import { findSecurityRules } from "./securityRouteMatcher.js";
-//#region src/runtime/services/getSecurityRules.ts
-const securityRulesByEvent = /* @__PURE__ */ new WeakMap();
-const getSecurityRules = (event) => {
-	const cachedRules = securityRulesByEvent.get(event);
-	if (cachedRules) return cachedRules;
-	const matchedRules = findSecurityRules(event.url.pathname);
-	if (!matchedRules) return void 0;
-	const rules = mergeSecurityRules(...matchedRules.toReversed());
-	securityRulesByEvent.set(event, rules);
-	return rules;
-};
-//#endregion
-export { getSecurityRules };

package/dist/runtime/services/getSecurityState.d.ts

@@ -1,11 +0,0 @@
-import { H3Event } from "nitro/h3";
-//#region src/runtime/services/getSecurityState.d.ts
-export interface SecurityState {
-  hashes: {
-    script: string[];
-    style: string[];
-  };
-  nonce?: string;
-}
-export declare const getSecurityState: (event: H3Event) => SecurityState;
-//#endregion

package/dist/runtime/services/getSecurityState.js

@@ -1,14 +0,0 @@
-//#region src/runtime/services/getSecurityState.ts
-const securityStateByEvent = /* @__PURE__ */ new WeakMap();
-const getSecurityState = (event) => {
-	const cachedState = securityStateByEvent.get(event);
-	if (cachedState) return cachedState;
-	const state = { hashes: {
-		script: [],
-		style: []
-	} };
-	securityStateByEvent.set(event, state);
-	return state;
-};
-//#endregion
-export { getSecurityState };

package/dist/runtime/services/injectNonce.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/injectNonce.d.ts
-export declare const injectNonce: (html: string, nonce: string) => string;
-//#endregion

package/dist/runtime/services/injectNonce.js

@@ -1,7 +0,0 @@
-import { NONCE_TAG_NAMES } from "../constants.js";
-import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
-import { stripHtmlTagAttribute } from "./stripHtmlTagAttribute.js";
-//#region src/runtime/services/injectNonce.ts
-const injectNonce = (html, nonce) => rewriteHtmlTags(html, (tagName, attributes) => NONCE_TAG_NAMES.includes(tagName.toLowerCase()) ? ` nonce="${nonce}"${stripHtmlTagAttribute(attributes, "nonce")}` : void 0);
-//#endregion
-export { injectNonce };

package/dist/runtime/services/injectSubresourceIntegrity.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/injectSubresourceIntegrity.d.ts
-export declare const injectSubresourceIntegrity: (html: string, hashes: Record<string, string>) => string;
-//#endregion