specmem-hardwicksoftware 3.5.99

package/dist/middleware/csrf.d.ts

@@ -0,0 +1,118 @@
+/**
+ * csrf.ts - CSRF Protection Middleware for SpecMem Dashboard
+ *
+ * yo this prevents cross-site request forgery attacks
+ * tokens for state-changing operations fr fr
+ * keeps the dashboard SECURE
+ *
+ * Issue #37 fix - CSRF protection
+ */
+import { IncomingMessage, ServerResponse } from 'http';
+/**
+ * CSRF configuration
+ */
+export interface CsrfConfig {
+    /** Token length in bytes */
+    tokenLength: number;
+    /** Cookie name for the secret */
+    cookieName: string;
+    /** Header name for the token */
+    headerName: string;
+    /** Form field name for the token */
+    fieldName: string;
+    /** Token validity in ms */
+    tokenValidityMs: number;
+    /** Secure cookie (HTTPS only) */
+    secureCookie: boolean;
+    /** SameSite cookie attribute */
+    sameSite: 'strict' | 'lax' | 'none';
+    /** Methods that require CSRF validation */
+    protectedMethods: string[];
+    /** Paths to skip CSRF validation */
+    ignorePaths: RegExp[];
+}
+/**
+ * CsrfProtection - prevents cross-site request forgery
+ *
+ * Features that KEEP US SAFE:
+ * - Double submit cookie pattern
+ * - Token validation
+ * - Configurable protected methods
+ * - Path exclusions
+ */
+export declare class CsrfProtection {
+    private config;
+    private tokens;
+    private cleanupInterval;
+    constructor(config?: Partial<CsrfConfig>);
+    /**
+     * Generate a new CSRF token
+     */
+    generateToken(): {
+        token: string;
+        secret: string;
+    };
+    /**
+     * Create token from secret
+     */
+    private createToken;
+    /**
+     * Validate a CSRF token
+     */
+    validateToken(token: string, secret: string): boolean;
+    /**
+     * Verify token signature
+     */
+    private verifyTokenSignature;
+    /**
+     * Check if path should be protected
+     */
+    shouldProtect(method: string, path: string): boolean;
+    /**
+     * Express-style middleware
+     */
+    middleware(): (req: IncomingMessage & {
+        body?: Record<string, unknown>;
+    }, res: ServerResponse, next: () => void) => void;
+    /**
+     * Set token cookie on response
+     */
+    setTokenCookie(res: ServerResponse, secret: string): void;
+    /**
+     * Get secret from cookie
+     */
+    getSecretFromCookie(req: IncomingMessage): string | null;
+    /**
+     * Clean up expired tokens
+     */
+    private cleanupExpiredTokens;
+    /**
+     * Get token count
+     */
+    getTokenCount(): number;
+    /**
+     * Shutdown
+     */
+    shutdown(): void;
+}
+/**
+ * Get the global CSRF protection instance
+ */
+export declare function getCsrfProtection(config?: Partial<CsrfConfig>): CsrfProtection;
+/**
+ * Reset the global CSRF instance
+ */
+export declare function resetCsrfProtection(): void;
+/**
+ * Generate HTML meta tag with CSRF token for templates
+ */
+export declare function getCsrfMetaTag(token: string): string;
+/**
+ * Generate hidden input field with CSRF token for forms
+ */
+export declare function getCsrfInputField(token: string, fieldName?: string): string;
+/**
+ * JavaScript snippet to include CSRF token in fetch requests
+ */
+export declare const CSRF_FETCH_SCRIPT = "\n// CSRF token handling\nconst csrfToken = document.querySelector('meta[name=\"csrf-token\"]')?.content;\n\n// Override fetch to include CSRF token\nconst originalFetch = window.fetch;\nwindow.fetch = function(url, options = {}) {\n  const method = (options.method || 'GET').toUpperCase();\n  if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {\n    options.headers = options.headers || {};\n    options.headers['X-CSRF-Token'] = csrfToken;\n  }\n  return originalFetch(url, options);\n};\n";
+//# sourceMappingURL=csrf.d.ts.map

package/dist/middleware/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAGvD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,gCAAgC;IAChC,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA2BD;;;;;;;;GAQG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,eAAe,CAA+B;gBAE1C,MAAM,GAAE,OAAO,CAAC,UAAU,CAAM;IAU5C;;OAEG;IACH,aAAa,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAYlD;;OAEG;IACH,OAAO,CAAC,WAAW;IAWnB;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAoBrD;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAgBpD;;OAEG;IACH,UAAU,KAEN,KAAK,eAAe,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EACzD,KAAK,cAAc,EACnB,MAAM,MAAM,IAAI;IAqDpB;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAuBzD;;OAEG;IACH,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI;IAcxD;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,QAAQ,IAAI,IAAI;CAOjB;AAKD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,cAAc,CAK9E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,MAAgB,GAAG,MAAM,CAEpF;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,ufAc7B,CAAC"}

package/dist/middleware/csrf.js

@@ -0,0 +1,300 @@
+/**
+ * csrf.ts - CSRF Protection Middleware for SpecMem Dashboard
+ *
+ * yo this prevents cross-site request forgery attacks
+ * tokens for state-changing operations fr fr
+ * keeps the dashboard SECURE
+ *
+ * Issue #37 fix - CSRF protection
+ */
+import crypto from 'crypto';
+import { logger } from '../utils/logger.js';
+const DEFAULT_CONFIG = {
+    tokenLength: 32,
+    cookieName: '_specmem_csrf',
+    headerName: 'x-csrf-token',
+    fieldName: '_csrf',
+    tokenValidityMs: 24 * 60 * 60 * 1000, // 24 hours
+    secureCookie: false, // Set to true in production with HTTPS
+    sameSite: 'lax',
+    protectedMethods: ['POST', 'PUT', 'PATCH', 'DELETE'],
+    ignorePaths: [
+        /^\/api\/v\d+\/health$/,
+        /^\/api\/health$/,
+        /^\/metrics$/,
+        /^\/api\/v\d+\/metrics$/
+    ]
+};
+/**
+ * CsrfProtection - prevents cross-site request forgery
+ *
+ * Features that KEEP US SAFE:
+ * - Double submit cookie pattern
+ * - Token validation
+ * - Configurable protected methods
+ * - Path exclusions
+ */
+export class CsrfProtection {
+    config;
+    tokens = new Map();
+    cleanupInterval = null;
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        // Start cleanup interval
+        this.cleanupInterval = setInterval(() => {
+            this.cleanupExpiredTokens();
+        }, 60000); // Every minute
+        this.cleanupInterval.unref?.();
+    }
+    /**
+     * Generate a new CSRF token
+     */
+    generateToken() {
+        const secret = crypto.randomBytes(this.config.tokenLength).toString('hex');
+        const token = this.createToken(secret);
+        this.tokens.set(token, {
+            secret,
+            createdAt: Date.now()
+        });
+        return { token, secret };
+    }
+    /**
+     * Create token from secret
+     */
+    createToken(secret) {
+        const timestamp = Date.now().toString(36);
+        const hash = crypto
+            .createHmac('sha256', secret)
+            .update(timestamp)
+            .digest('hex')
+            .slice(0, 32);
+        return `${timestamp}.${hash}`;
+    }
+    /**
+     * Validate a CSRF token
+     */
+    validateToken(token, secret) {
+        if (!token || !secret)
+            return false;
+        // Check if token exists
+        const tokenData = this.tokens.get(token);
+        if (!tokenData) {
+            // Try to validate against provided secret
+            return this.verifyTokenSignature(token, secret);
+        }
+        // Check expiration
+        if (Date.now() - tokenData.createdAt > this.config.tokenValidityMs) {
+            this.tokens.delete(token);
+            return false;
+        }
+        // Verify secret matches
+        return tokenData.secret === secret;
+    }
+    /**
+     * Verify token signature
+     */
+    verifyTokenSignature(token, secret) {
+        const parts = token.split('.');
+        if (parts.length !== 2)
+            return false;
+        const [timestamp, hash] = parts;
+        if (!timestamp || !hash)
+            return false;
+        // Check token age
+        const tokenTime = parseInt(timestamp, 36);
+        if (isNaN(tokenTime) || Date.now() - tokenTime > this.config.tokenValidityMs) {
+            return false;
+        }
+        // Verify hash
+        const expectedHash = crypto
+            .createHmac('sha256', secret)
+            .update(timestamp)
+            .digest('hex')
+            .slice(0, 32);
+        return crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(expectedHash));
+    }
+    /**
+     * Check if path should be protected
+     */
+    shouldProtect(method, path) {
+        // Check method
+        if (!this.config.protectedMethods.includes(method.toUpperCase())) {
+            return false;
+        }
+        // Check ignore paths
+        for (const pattern of this.config.ignorePaths) {
+            if (pattern.test(path)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Express-style middleware
+     */
+    middleware() {
+        return (req, res, next) => {
+            const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+            const path = url.pathname;
+            const method = req.method || 'GET';
+            // Add CSRF token to response for GET requests
+            if (method === 'GET') {
+                const { token, secret } = this.generateToken();
+                this.setTokenCookie(res, secret);
+                // Attach token to response for templates
+                res.csrfToken = token;
+            }
+            // Skip validation for non-protected methods/paths
+            if (!this.shouldProtect(method, path)) {
+                return next();
+            }
+            // Get token from header or body
+            const tokenFromHeader = req.headers[this.config.headerName];
+            const tokenFromBody = req.body?.[this.config.fieldName];
+            const token = tokenFromHeader || tokenFromBody;
+            // Get secret from cookie
+            const secret = this.getSecretFromCookie(req);
+            if (!token || !secret) {
+                logger.warn({ method, path }, 'CSRF token missing');
+                res.statusCode = 403;
+                res.setHeader('Content-Type', 'application/json');
+                res.end(JSON.stringify({
+                    error: 'CSRF token missing',
+                    code: 'CSRF_MISSING'
+                }));
+                return;
+            }
+            if (!this.validateToken(token, secret)) {
+                logger.warn({ method, path }, 'CSRF token invalid');
+                res.statusCode = 403;
+                res.setHeader('Content-Type', 'application/json');
+                res.end(JSON.stringify({
+                    error: 'CSRF token invalid',
+                    code: 'CSRF_INVALID'
+                }));
+                return;
+            }
+            next();
+        };
+    }
+    /**
+     * Set token cookie on response
+     */
+    setTokenCookie(res, secret) {
+        const parts = [
+            `${this.config.cookieName}=${secret}`,
+            'Path=/',
+            'HttpOnly',
+            `SameSite=${this.config.sameSite}`
+        ];
+        if (this.config.secureCookie) {
+            parts.push('Secure');
+        }
+        const existing = res.getHeader('Set-Cookie');
+        const cookies = existing
+            ? Array.isArray(existing)
+                ? existing
+                : [existing.toString()]
+            : [];
+        cookies.push(parts.join('; '));
+        res.setHeader('Set-Cookie', cookies);
+    }
+    /**
+     * Get secret from cookie
+     */
+    getSecretFromCookie(req) {
+        const cookies = req.headers.cookie;
+        if (!cookies)
+            return null;
+        const prefix = `${this.config.cookieName}=`;
+        const cookie = cookies.split(';')
+            .map(c => c.trim())
+            .find(c => c.startsWith(prefix));
+        if (!cookie)
+            return null;
+        return cookie.slice(prefix.length);
+    }
+    /**
+     * Clean up expired tokens
+     */
+    cleanupExpiredTokens() {
+        const now = Date.now();
+        let removed = 0;
+        for (const [token, data] of this.tokens) {
+            if (now - data.createdAt > this.config.tokenValidityMs) {
+                this.tokens.delete(token);
+                removed++;
+            }
+        }
+        if (removed > 0) {
+            logger.debug({ removed }, 'cleaned up expired CSRF tokens');
+        }
+    }
+    /**
+     * Get token count
+     */
+    getTokenCount() {
+        return this.tokens.size;
+    }
+    /**
+     * Shutdown
+     */
+    shutdown() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+        this.tokens.clear();
+    }
+}
+// Singleton instance
+let csrfInstance = null;
+/**
+ * Get the global CSRF protection instance
+ */
+export function getCsrfProtection(config) {
+    if (!csrfInstance) {
+        csrfInstance = new CsrfProtection(config);
+    }
+    return csrfInstance;
+}
+/**
+ * Reset the global CSRF instance
+ */
+export function resetCsrfProtection() {
+    if (csrfInstance) {
+        csrfInstance.shutdown();
+    }
+    csrfInstance = null;
+}
+/**
+ * Generate HTML meta tag with CSRF token for templates
+ */
+export function getCsrfMetaTag(token) {
+    return `<meta name="csrf-token" content="${token}">`;
+}
+/**
+ * Generate hidden input field with CSRF token for forms
+ */
+export function getCsrfInputField(token, fieldName = '_csrf') {
+    return `<input type="hidden" name="${fieldName}" value="${token}">`;
+}
+/**
+ * JavaScript snippet to include CSRF token in fetch requests
+ */
+export const CSRF_FETCH_SCRIPT = `
+// CSRF token handling
+const csrfToken = document.querySelector('meta[name="csrf-token"]')?.content;
+
+// Override fetch to include CSRF token
+const originalFetch = window.fetch;
+window.fetch = function(url, options = {}) {
+  const method = (options.method || 'GET').toUpperCase();
+  if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
+    options.headers = options.headers || {};
+    options.headers['X-CSRF-Token'] = csrfToken;
+  }
+  return originalFetch(url, options);
+};
+`;
+//# sourceMappingURL=csrf.js.map

package/dist/middleware/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AA0B5C,MAAM,cAAc,GAAe;IACjC,WAAW,EAAE,EAAE;IACf,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,OAAO;IAClB,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW;IACjD,YAAY,EAAE,KAAK,EAAE,uCAAuC;IAC5D,QAAQ,EAAE,KAAK;IACf,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;IACpD,WAAW,EAAE;QACX,uBAAuB;QACvB,iBAAiB;QACjB,aAAa;QACb,wBAAwB;KACzB;CACF,CAAC;AAUF;;;;;;;;GAQG;AACH,MAAM,OAAO,cAAc;IACjB,MAAM,CAAa;IACnB,MAAM,GAA2B,IAAI,GAAG,EAAE,CAAC;IAC3C,eAAe,GAA0B,IAAI,CAAC;IAEtD,YAAY,SAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAE/C,yBAAyB;QACzB,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,eAAe;QAC1B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE;YACrB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,MAAc;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM;aAChB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC5B,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhB,OAAO,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa,EAAE,MAAc;QACzC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAEpC,wBAAwB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,0CAA0C;YAC1C,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wBAAwB;QACxB,OAAO,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,KAAa,EAAE,MAAc;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAErC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;QAChC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAEtC,kBAAkB;QAClB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,cAAc;QACd,MAAM,YAAY,GAAG,MAAM;aACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC5B,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhB,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc,EAAE,IAAY;QACxC,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACjE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qBAAqB;QACrB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,CACL,GAAyD,EACzD,GAAmB,EACnB,IAAgB,EAChB,EAAE;YACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;YACjF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;YAEnC,8CAA8C;YAC9C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACjC,yCAAyC;gBACxC,GAA8B,CAAC,SAAS,GAAG,KAAK,CAAC;YACpD,CAAC;YAED,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,gCAAgC;YAChC,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAuB,CAAC;YAClF,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAuB,CAAC;YAC9E,MAAM,KAAK,GAAG,eAAe,IAAI,aAAa,CAAC;YAE/C,yBAAyB;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAE7C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBACpD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,KAAK,EAAE,oBAAoB;oBAC3B,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBACpD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,KAAK,EAAE,oBAAoB;oBAC3B,IAAI,EAAE,cAAc;iBACrB,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,GAAmB,EAAE,MAAc;QAChD,MAAM,KAAK,GAAG;YACZ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,EAAE;YACrC,QAAQ;YACR,UAAU;YACV,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;SACnC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,QAAQ;YACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,GAAoB;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAClB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,oBAAoB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,qBAAqB;AACrB,IAAI,YAAY,GAA0B,IAAI,CAAC;AAE/C;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA4B;IAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IACD,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,oCAAoC,KAAK,IAAI,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,YAAoB,OAAO;IAC1E,OAAO,8BAA8B,SAAS,YAAY,KAAK,IAAI,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;CAchC,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * middleware/index.ts - Middleware Module Exports
+ *
+ * yo this exports ALL the fire middleware
+ * rate limiting, CSRF, compression, API versioning fr fr
+ *
+ * Production readiness middleware for SpecMem Dashboard
+ */
+export { WsRateLimiter, WsRateLimiterConfig, RateLimitResult, getWsRateLimiter, resetWsRateLimiter, extractClientIp } from './wsRateLimiter.js';
+export { CsrfProtection, CsrfConfig, getCsrfProtection, resetCsrfProtection, getCsrfMetaTag, getCsrfInputField, CSRF_FETCH_SCRIPT } from './csrf.js';
+export { compressionMiddleware, CompressionConfig, minifyHtml, minifyCss, minifyJs, processHtml, preCompress } from './compression.js';
+export { createApiVersionMiddleware, createVersionedRouter, createHealthHandler, createApiInfoHandler, deprecatedEndpoint, versionedPath, ApiVersionConfig, VersionedHealthResponse, ApiInfoResponse } from './apiVersioning.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,QAAQ,EACR,WAAW,EACX,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EAChB,MAAM,oBAAoB,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,17 @@
+/**
+ * middleware/index.ts - Middleware Module Exports
+ *
+ * yo this exports ALL the fire middleware
+ * rate limiting, CSRF, compression, API versioning fr fr
+ *
+ * Production readiness middleware for SpecMem Dashboard
+ */
+// WebSocket Rate Limiter - Issue #25
+export { WsRateLimiter, getWsRateLimiter, resetWsRateLimiter, extractClientIp } from './wsRateLimiter.js';
+// CSRF Protection - Issue #37
+export { CsrfProtection, getCsrfProtection, resetCsrfProtection, getCsrfMetaTag, getCsrfInputField, CSRF_FETCH_SCRIPT } from './csrf.js';
+// Response Compression - Issue #24
+export { compressionMiddleware, minifyHtml, minifyCss, minifyJs, processHtml, preCompress } from './compression.js';
+// API Versioning - Issue #23
+export { createApiVersionMiddleware, createVersionedRouter, createHealthHandler, createApiInfoHandler, deprecatedEndpoint, versionedPath } from './apiVersioning.js';
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qCAAqC;AACrC,OAAO,EACL,aAAa,EAGb,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAE5B,8BAA8B;AAC9B,OAAO,EACL,cAAc,EAEd,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAEnB,mCAAmC;AACnC,OAAO,EACL,qBAAqB,EAErB,UAAU,EACV,SAAS,EACT,QAAQ,EACR,WAAW,EACX,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAE1B,6BAA6B;AAC7B,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EAId,MAAM,oBAAoB,CAAC"}

package/dist/middleware/wsRateLimiter.d.ts

@@ -0,0 +1,129 @@
+/**
+ * wsRateLimiter.ts - WebSocket Rate Limiting for SpecMem
+ *
+ * yo this protects our WebSocket from abuse
+ * 100 messages per minute per connection, 1MB max message size
+ * track connection counts per IP fr fr
+ *
+ * Issue #25 fix - rate limiting on WebSocket
+ */
+import WebSocket from 'ws';
+/**
+ * Rate limiter configuration
+ */
+export interface WsRateLimiterConfig {
+    /** Max messages per window */
+    maxMessagesPerWindow: number;
+    /** Window size in ms */
+    windowMs: number;
+    /** Max message size in bytes */
+    maxMessageSize: number;
+    /** Max connections per IP */
+    maxConnectionsPerIp: number;
+    /** Whether to disconnect on abuse */
+    disconnectOnAbuse: boolean;
+    /** Abuse threshold (percentage over limit to trigger disconnect) */
+    abuseThreshold: number;
+}
+/**
+ * Connection tracking data
+ */
+interface ConnectionData {
+    messages: number[];
+    ip: string;
+    connectedAt: number;
+    warnings: number;
+    totalMessages: number;
+    totalBytes: number;
+}
+/**
+ * Rate limit result
+ */
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    resetAt: number;
+    reason?: string;
+}
+/**
+ * WsRateLimiter - WebSocket rate limiting
+ *
+ * Features that PROTECT US:
+ * - Per-connection message rate limiting
+ * - Message size limiting
+ * - Per-IP connection limits
+ * - Abuse detection and disconnect
+ * - Statistics tracking
+ */
+export declare class WsRateLimiter {
+    private config;
+    private connections;
+    private ipConnections;
+    private abusiveIps;
+    constructor(config?: Partial<WsRateLimiterConfig>);
+    /**
+     * Register a new WebSocket connection
+     */
+    registerConnection(ws: WebSocket, ip: string): boolean;
+    /**
+     * Unregister a WebSocket connection
+     */
+    unregisterConnection(ws: WebSocket): void;
+    /**
+     * Check if a message is allowed
+     */
+    checkMessage(ws: WebSocket, messageSize: number): RateLimitResult;
+    /**
+     * Check if connection should be disconnected
+     */
+    private shouldDisconnect;
+    /**
+     * Block an IP temporarily
+     */
+    private blockIp;
+    /**
+     * Get connection stats
+     */
+    getConnectionStats(ws: WebSocket): ConnectionData | undefined;
+    /**
+     * Get overall stats
+     */
+    getStats(): {
+        totalConnections: number;
+        uniqueIps: number;
+        blockedIps: number;
+        totalMessages: number;
+        totalBytes: number;
+    };
+    /**
+     * Check if an IP is blocked
+     */
+    isIpBlocked(ip: string): boolean;
+    /**
+     * Manually unblock an IP
+     */
+    unblockIp(ip: string): boolean;
+    /**
+     * Reset the rate limiter
+     */
+    reset(): void;
+}
+/**
+ * Get the global WebSocket rate limiter
+ */
+export declare function getWsRateLimiter(config?: Partial<WsRateLimiterConfig>): WsRateLimiter;
+/**
+ * Reset the global rate limiter
+ */
+export declare function resetWsRateLimiter(): void;
+/**
+ * Extract client IP from WebSocket or HTTP request
+ */
+export declare function extractClientIp(req: {
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    };
+}): string;
+export {};
+//# sourceMappingURL=wsRateLimiter.d.ts.map

package/dist/middleware/wsRateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wsRateLimiter.d.ts","sourceRoot":"","sources":["../../src/middleware/wsRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,SAAS,MAAM,IAAI,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,8BAA8B;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qCAAqC;IACrC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;CACxB;AAWD;;GAEG;AACH,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,WAAW,CAA6C;IAChE,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,UAAU,CAA6D;gBAEnE,MAAM,GAAE,OAAO,CAAC,mBAAmB,CAAM;IAIrD;;OAEG;IACH,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAgCtD;;OAEG;IACH,oBAAoB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI;IAiBzC;;OAEG;IACH,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe;IAqFjE;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;OAEG;IACH,OAAO,CAAC,OAAO;IAUf;;OAEG;IACH,kBAAkB,CAAC,EAAE,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS;IAI7D;;OAEG;IACH,QAAQ,IAAI;QACV,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;KACpB;IA0BD;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAUhC;;OAEG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI9B;;OAEG;IACH,KAAK,IAAI,IAAI;CAKd;AAKD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAKrF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,MAAM,CAc5I"}