secure-vibe-runtime 0.0.0-stage → 7.3.0

package/dist/withCsrf.js

@@ -0,0 +1,104 @@
+import { NextResponse } from "next/server";
+import { validateCsrfToken } from "./csrf";
+import { ConvexHttpClient } from 'convex/browser';
+import { makeFunctionReference } from 'convex/server';
+/**
+ * The app's public security-log mutation. Named rather than imported from the
+ * app's generated api so this file can live in a package; the app registers
+ * `logSecurityViolation` in convex/security.ts with exactly these args.
+ */
+const logSecurityViolation = makeFunctionReference('security:logSecurityViolation');
+// Lazy-initialized Convex client for security logging
+let convexClient = null;
+function getConvexClient() {
+    if (!process.env.NEXT_PUBLIC_CONVEX_URL) {
+        return null;
+    }
+    if (!convexClient) {
+        convexClient = new ConvexHttpClient(process.env.NEXT_PUBLIC_CONVEX_URL);
+    }
+    return convexClient;
+}
+/**
+ * Log a CSRF violation to the security dashboard (non-blocking)
+ */
+function logCsrfViolation(request, reason) {
+    const ip = request.headers.get('x-forwarded-for')?.split(',')[0].trim() ||
+        request.headers.get('x-real-ip') ||
+        'unknown';
+    const endpoint = request.nextUrl.pathname;
+    const origin = request.headers.get('origin') || undefined;
+    // The mutation requires the shared SECURITY_LOG_KEY so that only this server,
+    // not anyone holding the public deployment URL, can write to the security log.
+    const client = getConvexClient();
+    const key = process.env.SECURITY_LOG_KEY;
+    if (client && !key) {
+        console.error('SECURITY_LOG_KEY is not set; CSRF violation not logged to Convex');
+    }
+    if (client && key) {
+        client.mutation(logSecurityViolation, {
+            key,
+            eventType: 'csrf_validation_failed',
+            severity: 'critical',
+            metadata: {
+                endpoint,
+                ipAddress: ip,
+                origin,
+                errorMessage: reason,
+            },
+        }).catch((logErr) => {
+            console.error('Failed to log CSRF violation:', logErr);
+        });
+    }
+}
+/**
+ * Higher-order function that wraps API route handlers with CSRF protection
+ * Validates the CSRF token from the request header against the stored cookie
+ * Tokens are single-use and cleared after validation
+ *
+ * @param handler - The API route handler to wrap
+ * @returns A wrapped handler with CSRF protection
+ *
+ * @example
+ * ```typescript
+ * import { withCsrf } from '@/lib/withCsrf';
+ *
+ * async function loginHandler(request: NextRequest) {
+ *   // Your login logic here
+ *   return NextResponse.json({ success: true });
+ * }
+ *
+ * export const POST = withCsrf(loginHandler);
+ * ```
+ */
+export function withCsrf(handler) {
+    return async (request) => {
+        try {
+            const csrfToken = request.headers.get("x-csrf-token");
+            const storedToken = request.cookies.get("XSRF-TOKEN")?.value;
+            if (!csrfToken || !storedToken) {
+                const reason = !csrfToken ? "Missing CSRF token in header" : "Missing CSRF cookie";
+                console.error("CSRF check failed: Missing token", {
+                    sent: csrfToken ? "[present]" : "[missing]",
+                    stored: storedToken ? "[present]" : "[missing]",
+                });
+                logCsrfViolation(request, reason);
+                return NextResponse.json({ error: "Invalid CSRF token" }, { status: 403 });
+            }
+            if (!validateCsrfToken(csrfToken, storedToken)) {
+                console.error("CSRF check failed: Token mismatch");
+                logCsrfViolation(request, "CSRF token mismatch");
+                return NextResponse.json({ error: "Invalid CSRF token" }, { status: 403 });
+            }
+            // Call the original handler
+            const response = await handler(request);
+            // Clear the CSRF token after use (single-use tokens)
+            response.cookies.set("XSRF-TOKEN", "", { maxAge: 0, path: "/" });
+            return response;
+        }
+        catch (err) {
+            console.error("CSRF middleware error:", err.message);
+            return NextResponse.json({ error: "Server error" }, { status: 500 });
+        }
+    };
+}

package/dist/withRateLimit.d.ts

@@ -0,0 +1,23 @@
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * Higher-order function that wraps API route handlers with rate limiting
+ * Tracks requests by IP address and returns 429 when limit is exceeded
+ *
+ * @param handler - The API route handler to wrap
+ * @returns A wrapped handler with rate limiting protection
+ *
+ * @example
+ * ```typescript
+ * import { withRateLimit } from '@/lib/withRateLimit';
+ * import { withCsrf } from '@/lib/withCsrf';
+ *
+ * async function sensitiveHandler(request: NextRequest) {
+ *   // Your API logic here
+ *   return NextResponse.json({ success: true });
+ * }
+ *
+ * // Apply both rate limiting and CSRF protection
+ * export const POST = withRateLimit(withCsrf(sensitiveHandler));
+ * ```
+ */
+export declare function withRateLimit(handler: (request: NextRequest) => Promise<NextResponse>): (request: NextRequest) => Promise<NextResponse<unknown>>;

package/dist/withRateLimit.js

@@ -0,0 +1,168 @@
+import { NextResponse } from 'next/server';
+import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible';
+import { ConvexHttpClient } from 'convex/browser';
+import { makeFunctionReference } from 'convex/server';
+/**
+ * The app's public security-log mutation. Named rather than imported from the
+ * app's generated api so this file can live in a package; the app registers
+ * `logSecurityViolation` in convex/security.ts with exactly these args.
+ */
+const logSecurityViolation = makeFunctionReference('security:logSecurityViolation');
+/**
+ * Rate limiter instance - 5 requests per minute per IP address
+ *
+ * SCOPE LIMITATION — READ BEFORE RELYING ON THIS FOR ABUSE PREVENTION.
+ *
+ * RateLimiterMemory keeps its counters in the memory of ONE process. Vercel runs
+ * this app across many function instances and recycles them freely, so:
+ *
+ *   - a caller spread across N warm instances gets up to N x 5 requests/minute
+ *   - counters reset whenever an instance is recycled
+ *
+ * That makes this a speed bump against naive scripted abuse, NOT a guarantee.
+ * It is honest defence in depth; it is not a quota.
+ *
+ * For a real limit you need shared durable state (Redis / Upstash) keyed the
+ * same way, or enforcement at a layer that already sees every request — Vercel's
+ * WAF rate limiting is the least-effort option and requires no code.
+ *
+ * For Convex mutations specifically this wrapper does nothing at all: Convex RPC
+ * goes browser -> Convex and never passes through a Next.js route handler. Limit
+ * those inside the mutation.
+ */
+const rateLimiter = new RateLimiterMemory({
+    points: 5, // 5 requests
+    duration: 60, // per 60 seconds (1 minute)
+});
+/**
+ * Resolves the caller's IP from platform-trusted headers.
+ *
+ * Why not the leftmost X-Forwarded-For entry: XFF is an append-only list, and
+ * the LEFTMOST entry is whatever the client sent. A caller can simply set
+ * `X-Forwarded-For: <random>` on each request and receive a fresh bucket every
+ * time, defeating the limit entirely. The previous implementation did exactly
+ * this, so the limiter could be bypassed by anyone who knew to rotate a header.
+ *
+ * Order of preference:
+ *   1. `x-vercel-forwarded-for` — set by Vercel's edge, overwritten on every
+ *      request, so a client cannot forge it.
+ *   2. The RIGHTMOST `x-forwarded-for` entry — appended by the closest trusted
+ *      proxy, rather than the leftmost value the client supplied.
+ *   3. `x-real-ip` — set by the proxy, not the client, on common setups.
+ *
+ * If none are present we return null and the caller fails CLOSED (see below),
+ * because a single shared "unknown" bucket would let one abuser exhaust the
+ * limit for every anonymous visitor at once.
+ */
+function clientIp(request) {
+    const vercel = request.headers.get('x-vercel-forwarded-for')?.trim();
+    if (vercel)
+        return vercel;
+    const xff = request.headers.get('x-forwarded-for');
+    if (xff) {
+        const parts = xff.split(',').map((p) => p.trim()).filter(Boolean);
+        if (parts.length > 0)
+            return parts[parts.length - 1];
+    }
+    const real = request.headers.get('x-real-ip')?.trim();
+    if (real)
+        return real;
+    return null;
+}
+// Lazy-initialized Convex client for security logging
+let convexClient = null;
+function getConvexClient() {
+    if (!process.env.NEXT_PUBLIC_CONVEX_URL) {
+        return null;
+    }
+    if (!convexClient) {
+        convexClient = new ConvexHttpClient(process.env.NEXT_PUBLIC_CONVEX_URL);
+    }
+    return convexClient;
+}
+/**
+ * Higher-order function that wraps API route handlers with rate limiting
+ * Tracks requests by IP address and returns 429 when limit is exceeded
+ *
+ * @param handler - The API route handler to wrap
+ * @returns A wrapped handler with rate limiting protection
+ *
+ * @example
+ * ```typescript
+ * import { withRateLimit } from '@/lib/withRateLimit';
+ * import { withCsrf } from '@/lib/withCsrf';
+ *
+ * async function sensitiveHandler(request: NextRequest) {
+ *   // Your API logic here
+ *   return NextResponse.json({ success: true });
+ * }
+ *
+ * // Apply both rate limiting and CSRF protection
+ * export const POST = withRateLimit(withCsrf(sensitiveHandler));
+ * ```
+ */
+export function withRateLimit(handler) {
+    return async (request) => {
+        // Resolve once, outside the try, so the catch block reports the same key
+        // that was actually consumed rather than recomputing it.
+        const ip = clientIp(request);
+        if (!ip) {
+            // Fail closed. Previously an unresolvable IP collapsed to the literal
+            // string 'unknown', putting every such caller in ONE shared bucket — so a
+            // single abuser could exhaust the limit for all of them. Refusing is the
+            // safer failure, and on Vercel this branch should be unreachable.
+            console.warn('Rate limit: could not resolve a trusted client IP; refusing request');
+            return NextResponse.json({ error: 'Too many requests, please try again later' }, { status: 429 });
+        }
+        try {
+            // Consume a point for this IP address
+            await rateLimiter.consume(ip);
+            // Rate limit not exceeded, proceed with the original handler
+            return await handler(request);
+        }
+        catch (err) {
+            // Check if this is a rate limit error.
+            //
+            // instanceof, NOT `err.constructor.name === 'RateLimiterRes'`. The
+            // production server bundle is minified and class names are mangled, so
+            // the name check matched in `next dev` and silently failed in `next
+            // build` + `next start`: every over-limit request fell through to the
+            // rethrow below and surfaced as a 500, and the violation was never
+            // logged. Caught by the release smoke test, not by review.
+            if (err instanceof RateLimiterRes) {
+                const endpoint = request.nextUrl.pathname;
+                console.warn(`Rate limit exceeded for IP: ${ip} on ${endpoint}`);
+                // Log security violation to Convex. The mutation requires the shared
+                // SECURITY_LOG_KEY so that only this server, not anyone holding the
+                // public deployment URL, can write to the security log.
+                const client = getConvexClient();
+                const key = process.env.SECURITY_LOG_KEY;
+                if (client && !key) {
+                    console.error('SECURITY_LOG_KEY is not set; rate limit violation not logged to Convex');
+                }
+                if (client && key) {
+                    try {
+                        await client.mutation(logSecurityViolation, {
+                            key,
+                            eventType: 'rate_limit_exceeded',
+                            severity: 'medium',
+                            metadata: {
+                                endpoint,
+                                ipAddress: ip,
+                                errorMessage: 'Rate limit exceeded: 5 requests per minute',
+                            },
+                        });
+                    }
+                    catch (logErr) {
+                        console.error('Failed to log rate limit violation:', logErr);
+                    }
+                }
+                return NextResponse.json({ error: 'Too many requests, please try again later' }, { status: 429 });
+            }
+            // Re-throw any other errors
+            const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+            console.error('Rate limiting error:', errorMessage);
+            throw err;
+        }
+    };
+}

package/package.json

@@ -1,6 +1,74 @@
 {
   "name": "secure-vibe-runtime",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "7.3.0",
+  "description": "The runtime security pieces of Secure Vibe Coding OS (secrets loading, CSRF, rate limiting, security log) as one package, so every app built from the template gets fixes by updating it.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Allen Harper",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/harperaa/secure-vibe-coding-OS.git",
+    "directory": "packages/secure-vibe-runtime"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./csrf": {
+      "types": "./dist/csrf.d.ts",
+      "default": "./dist/csrf.js"
+    },
+    "./secrets": {
+      "types": "./dist/secrets.d.ts",
+      "default": "./dist/secrets.js"
+    },
+    "./withCsrf": {
+      "types": "./dist/withCsrf.d.ts",
+      "default": "./dist/withCsrf.js"
+    },
+    "./withRateLimit": {
+      "types": "./dist/withRateLimit.d.ts",
+      "default": "./dist/withRateLimit.js"
+    },
+    "./convex": {
+      "types": "./dist/convex/index.d.ts",
+      "default": "./dist/convex/index.js"
+    }
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "convex": ">=1.31.0",
+    "next": ">=15.0.0"
+  },
+  "dependencies": {
+    "crypto-js": "^4.2.0",
+    "rate-limiter-flexible": "^8.1.0",
+    "uuid": "^14.0.0"
+  },
+  "devDependencies": {
+    "@types/crypto-js": "^4.2.2",
+    "@types/node": "^20",
+    "convex": "^1.31.3",
+    "next": "^16.4.2",
+    "typescript": "^5"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "security",
+    "nextjs",
+    "convex",
+    "csrf",
+    "rate-limit",
+    "secure-vibe-coding"
+  ]
+}