thatcher 1.0.4

package/src/lib/validation/format-validators.js

@@ -0,0 +1,106 @@
+export function validateURL(url) {
+  if (!url || typeof url !== 'string') return { valid: false, reason: 'URL required' };
+  
+  try {
+    const parsed = new URL(url);
+    const ALLOWED_PROTOCOLS = ['http:', 'https:'];
+    if (!ALLOWED_PROTOCOLS.includes(parsed.protocol)) {
+      return { valid: false, reason: `Protocol ${parsed.protocol} not allowed` };
+    }
+    if (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1') {
+      return { valid: false, reason: 'localhost URLs not allowed' };
+    }
+    return { valid: true, url: url };
+  } catch (err) {
+    return { valid: false, reason: 'Invalid URL format' };
+  }
+}
+
+export function validatePhoneNumber(phone) {
+  if (!phone || typeof phone !== 'string') return { valid: false, reason: 'Phone number required' };
+  const cleaned = phone.replace(/[^0-9+]/g, '');
+  if (cleaned.length < 10 || cleaned.length > 15) {
+    return { valid: false, reason: 'Invalid phone number length' };
+  }
+  return { valid: true, phone: cleaned };
+}
+
+export function validatePostalCode(postal, country = 'US') {
+  if (!postal || typeof postal !== 'string') return { valid: false, reason: 'Postal code required' };
+  const patterns = {
+    US: /^\d{5}(-\d{4})?$/,
+    CA: /^[A-Z]\d[A-Z]\s?\d[A-Z]\d$/i,
+    UK: /^[A-Z]{1,2}\d{1,2}[A-Z]?\s?\d[A-Z]{2}$/i
+  };
+  const pattern = patterns[country] || patterns.US;
+  if (!pattern.test(postal)) {
+    return { valid: false, reason: `Invalid ${country} postal code format` };
+  }
+  return { valid: true, postal };
+}
+
+export function validateCreditCard(number) {
+  if (!number || typeof number !== 'string') return { valid: false, reason: 'Card number required' };
+  const cleaned = number.replace(/\D/g, '');
+  if (cleaned.length < 13 || cleaned.length > 19) {
+    return { valid: false, reason: 'Invalid card number length' };
+  }
+  let sum = 0;
+  let isEven = false;
+  for (let i = cleaned.length - 1; i >= 0; i--) {
+    let digit = parseInt(cleaned[i]);
+    if (isEven) {
+      digit *= 2;
+      if (digit > 9) digit -= 9;
+    }
+    sum += digit;
+    isEven = !isEven;
+  }
+  if (sum % 10 !== 0) {
+    return { valid: false, reason: 'Invalid card number (failed Luhn check)' };
+  }
+  return { valid: true, card: cleaned };
+}
+
+export function validatePassword(password, options = {}) {
+  const { minLength = 8, requireUppercase = true, requireLowercase = true, requireNumber = true, requireSpecial = true } = options;
+  const errors = [];
+  
+  if (!password || typeof password !== 'string') {
+    return { valid: false, errors: ['Password required'] };
+  }
+  
+  if (password.length < minLength) {
+    errors.push(`Password must be at least ${minLength} characters`);
+  }
+  
+  if (requireUppercase && !/[A-Z]/.test(password)) {
+    errors.push('Password must contain uppercase letter');
+  }
+  
+  if (requireLowercase && !/[a-z]/.test(password)) {
+    errors.push('Password must contain lowercase letter');
+  }
+  
+  if (requireNumber && !/\d/.test(password)) {
+    errors.push('Password must contain number');
+  }
+  
+  if (requireSpecial && !/[!@#$%^&*(),.?":{}|<>]/.test(password)) {
+    errors.push('Password must contain special character');
+  }
+  
+  return { valid: errors.length === 0, errors };
+}
+
+export function validateIPAddress(ip) {
+  if (!ip || typeof ip !== 'string') return { valid: false, reason: 'IP address required' };
+  const ipv4Pattern = /^(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)$/;
+  const ipv6Pattern = /^([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$/i;
+  
+  if (!ipv4Pattern.test(ip) && !ipv6Pattern.test(ip)) {
+    return { valid: false, reason: 'Invalid IP address format' };
+  }
+  
+  return { valid: true, ip };
+}

package/src/lib/validation/index.js

@@ -0,0 +1,19 @@
+export * from '@/lib/validation/security-validators';
+export * from '@/lib/validation/format-validators';
+export * from '@/lib/validation/file-validators';
+export * from '@/lib/validation/business-validators';
+export * from '@/lib/validation/rate-limit';
+export * from '@/lib/validation/csrf';
+
+export {
+  isValidEmail,
+  validateField,
+  validateEntity,
+  validateUpdate,
+  hasErrors,
+  validateStatusTransition,
+  validateDateRange,
+  validateDeadline,
+  sanitizeData,
+  sanitizeHtml
+} from '@/lib/validate';

package/src/lib/validation/rate-limit.js

@@ -0,0 +1,31 @@
+export function rateLimitCheck(identifier, maxRequests = 100, windowMs = 60000) {
+  if (!global.rateLimitStore) global.rateLimitStore = {};
+  
+  const now = Date.now();
+  const key = `rate:${identifier}`;
+  const record = global.rateLimitStore[key] || { count: 0, resetAt: now + windowMs };
+  
+  if (now > record.resetAt) {
+    record.count = 0;
+    record.resetAt = now + windowMs;
+  }
+  
+  record.count++;
+  global.rateLimitStore[key] = record;
+  
+  if (record.count > maxRequests) {
+    return { allowed: false, reason: 'Rate limit exceeded', resetAt: record.resetAt };
+  }
+  
+  return { allowed: true, remaining: maxRequests - record.count, resetAt: record.resetAt };
+}
+
+setInterval(() => {
+  if (!global.rateLimitStore) return;
+  const now = Date.now();
+  for (const key of Object.keys(global.rateLimitStore)) {
+    if (global.rateLimitStore[key].resetAt < now) {
+      delete global.rateLimitStore[key];
+    }
+  }
+}, 60000);

package/src/lib/validation/security-validators.js

@@ -0,0 +1,78 @@
+import { sanitizeHtml } from '@/lib/validate';
+
+const XSS_PATTERNS = [
+  /<script[^>]*>.*?<\/script>/gi,
+  /javascript:/gi,
+  /on\w+\s*=/gi,
+  /<iframe[^>]*>/gi,
+  /<object[^>]*>/gi,
+  /<embed[^>]*>/gi,
+  /eval\(/gi,
+  /expression\(/gi
+];
+
+const SQL_INJECTION_PATTERNS = [
+  /('|(\-\-)|(;)|(\|\|)|(\/\*)|(\*\/)|xp_)/gi,
+  /(union|select|insert|update|delete|drop|create|alter|exec|execute)\s/gi,
+  /0x[0-9a-f]+/gi,
+  /char\(/gi,
+  /concat\(/gi
+];
+
+const PATH_TRAVERSAL_PATTERNS = [
+  /\.\.[\\\/]/g,
+  /\.\.%/g,
+  /%2e%2e/gi,
+  /\.\.\./g
+];
+
+export function detectXSS(input) {
+  if (typeof input !== 'string') return { safe: true };
+  for (const pattern of XSS_PATTERNS) {
+    if (pattern.test(input)) {
+      return { safe: false, reason: 'Potential XSS attack detected', pattern: pattern.toString() };
+    }
+  }
+  return { safe: true };
+}
+
+export function detectSQLInjection(input) {
+  if (typeof input !== 'string') return { safe: true };
+  for (const pattern of SQL_INJECTION_PATTERNS) {
+    if (pattern.test(input)) {
+      return { safe: false, reason: 'Potential SQL injection detected', pattern: pattern.toString() };
+    }
+  }
+  return { safe: true };
+}
+
+export function detectPathTraversal(input) {
+  if (typeof input !== 'string') return { safe: true };
+  for (const pattern of PATH_TRAVERSAL_PATTERNS) {
+    if (pattern.test(input)) {
+      return { safe: false, reason: 'Path traversal attempt detected', pattern: pattern.toString() };
+    }
+  }
+  return { safe: true };
+}
+
+export function sanitizeDeep(data) {
+  if (typeof data === 'string') {
+    const xssCheck = detectXSS(data);
+    if (!xssCheck.safe) return '';
+    const sqlCheck = detectSQLInjection(data);
+    if (!sqlCheck.safe) return '';
+    return sanitizeHtml(data);
+  }
+  if (Array.isArray(data)) {
+    return data.map(sanitizeDeep);
+  }
+  if (data && typeof data === 'object') {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(data)) {
+      sanitized[key] = sanitizeDeep(value);
+    }
+    return sanitized;
+  }
+  return data;
+}

package/src/lib/validation-middleware.js

@@ -0,0 +1,133 @@
+import { NextResponse } from '@/lib/next-polyfills';
+import {
+  detectXSS,
+  detectSQLInjection,
+  sanitizeDeep,
+  validateBusinessRules,
+  rateLimitCheck,
+  validateCSRFToken
+} from '@/lib/validation';
+import { validateEntity, validateUpdate, hasErrors } from '@/lib/validate';
+
+export async function validateRequest(request, options = {}) {
+  const { requireCSRF = true, rateLimit = { max: 100, window: 60000 }, entityName = null } = options;
+  
+  const ip = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip') || 'unknown';
+  const sessionId = request.headers.get('cookie')?.match(/session=([^;]+)/)?.[1] || ip;
+  
+  if (rateLimit) {
+    const rateLimitResult = rateLimitCheck(ip, rateLimit.max, rateLimit.window);
+    if (!rateLimitResult.allowed) {
+      return NextResponse.json(
+        { success: false, error: 'Rate limit exceeded', resetAt: rateLimitResult.resetAt },
+        { status: 429, headers: { 'Retry-After': Math.ceil((rateLimitResult.resetAt - Date.now()) / 1000).toString() } }
+      );
+    }
+  }
+  
+  if (requireCSRF && ['POST', 'PUT', 'DELETE', 'PATCH'].includes(request.method)) {
+    const csrfToken = request.headers.get('x-csrf-token');
+    const csrfCheck = validateCSRFToken(csrfToken, sessionId);
+    if (!csrfCheck.valid) {
+      return NextResponse.json(
+        { success: false, error: csrfCheck.reason },
+        { status: 403 }
+      );
+    }
+  }
+  
+  return null;
+}
+
+export async function validateRequestBody(request, entityName, isUpdate = false, recordId = null) {
+  let body;
+  try {
+    body = await request.json();
+  } catch (err) {
+    return {
+      valid: false,
+      response: NextResponse.json(
+        { success: false, error: 'Invalid JSON in request body' },
+        { status: 400 }
+      )
+    };
+  }
+  
+  for (const [key, value] of Object.entries(body)) {
+    if (typeof value === 'string') {
+      const xssCheck = detectXSS(value);
+      if (!xssCheck.safe) {
+        return {
+          valid: false,
+          response: NextResponse.json(
+            { success: false, error: `XSS attempt detected in field '${key}'`, reason: xssCheck.reason },
+            { status: 400 }
+          )
+        };
+      }
+      
+      const sqlCheck = detectSQLInjection(value);
+      if (!sqlCheck.safe) {
+        return {
+          valid: false,
+          response: NextResponse.json(
+            { success: false, error: `SQL injection attempt detected in field '${key}'`, reason: sqlCheck.reason },
+            { status: 400 }
+          )
+        };
+      }
+    }
+  }
+  
+  const sanitizedBody = sanitizeDeep(body);
+  
+  const validationErrors = isUpdate
+    ? await validateUpdate(entityName, recordId, sanitizedBody)
+    : await validateEntity(entityName, sanitizedBody);
+  
+  if (hasErrors(validationErrors)) {
+    return {
+      valid: false,
+      response: NextResponse.json(
+        { success: false, error: 'Validation failed', errors: validationErrors },
+        { status: 400 }
+      )
+    };
+  }
+  
+  const businessErrors = validateBusinessRules(entityName, sanitizedBody, isUpdate ? { id: recordId } : null);
+  if (Object.keys(businessErrors).length > 0) {
+    return {
+      valid: false,
+      response: NextResponse.json(
+        { success: false, error: 'Business rule validation failed', errors: businessErrors },
+        { status: 400 }
+      )
+    };
+  }
+  
+  return { valid: true, body: sanitizedBody };
+}
+
+export function withValidation(handler, options = {}) {
+  return async (request, context) => {
+    const validationError = await validateRequest(request, options);
+    if (validationError) return validationError;
+    
+    return handler(request, context);
+  };
+}
+
+export function withBodyValidation(handler, entityName, isUpdate = false) {
+  return async (request, context) => {
+    const validationError = await validateRequest(request);
+    if (validationError) return validationError;
+    
+    const recordId = isUpdate ? context?.params?.id : null;
+    const bodyValidation = await validateRequestBody(request, entityName, isUpdate, recordId);
+    
+    if (!bodyValidation.valid) return bodyValidation.response;
+    
+    return handler(request, { ...context, validatedBody: bodyValidation.body });
+  };
+}

package/src/lib/validators.js

@@ -0,0 +1,105 @@
+/**
+ * Validation Utilities - Reusable validation functions
+ */
+
+/**
+ * Validate email address
+ * @param {string} email
+ * @returns {{valid: boolean, email?: string, domain?: string, reason?: string}}
+ */
+export function isValidEmail(email) {
+  if (!email || typeof email !== 'string') {
+    return { valid: false, reason: 'Email is required' };
+  }
+
+  const trimmed = email.trim().toLowerCase();
+  const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+  if (!EMAIL_REGEX.test(trimmed)) {
+    return { valid: false, reason: 'Invalid email format' };
+  }
+
+  const domain = trimmed.split('@')[1];
+  if (!domain || domain.length < 3 || !domain.includes('.')) {
+    return { valid: false, reason: 'Invalid email domain' };
+  }
+
+  // Disposable email domains
+  const DISPOSABLE_DOMAINS = new Set([
+    'mailinator.com', 'guerrillamail.com', 'tempmail.com',
+    'throwaway.email', 'yopmail.com', '10minutemail.com',
+  ]);
+
+  if (DISPOSABLE_DOMAINS.has(domain)) {
+    return { valid: false, reason: 'Disposable email addresses are not allowed' };
+  }
+
+  return { valid: true, email: trimmed, domain };
+}
+
+/**
+ * Validate URL
+ * @param {string} url
+ * @returns {boolean}
+ */
+export function isValidUrl(url) {
+  try {
+    new URL(url);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Validate date is within range
+ * @param {number} timestamp - Unix timestamp (seconds)
+ * @param {number} minYearsAgo
+ * @param {number} maxYearsAhead
+ * @returns {boolean}
+ */
+export function isWithinYears(timestamp, minYearsAgo = 10, maxYearsAhead = 5) {
+  const now = Date.now() / 1000;
+  const secondsInYear = 365.25 * 24 * 60 * 60;
+  return (
+    timestamp > now - (minYearsAgo * secondsInYear) &&
+    timestamp < now + (maxYearsAhead * secondsInYear)
+  );
+}
+
+/**
+ * Check if date1 is before date2
+ * @param {number} date1 - Unix timestamp
+ * @param {number} date2 - Unix timestamp
+ * @returns {boolean}
+ */
+export function isBeforeDate(date1, date2) {
+  return date1 < date2;
+}
+
+/**
+ * Slugify string
+ * @param {string} str
+ * @returns {string}
+ */
+export function slugify(str) {
+  return str
+    .toLowerCase()
+    .trim()
+    .replace(/[^\w\s-]/g, '')
+    .replace(/[\s_-]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+/**
+ * Validate required fields object
+ * @param {object} data
+ * @param {Array<string>} requiredFields
+ * @returns {Array<string>} Missing field names
+ */
+export function getMissingFields(data, requiredFields) {
+  return requiredFields.filter(field => {
+    const val = data[field];
+    return val === undefined || val === null || val === '';
+  });
+}

package/src/lib/with-audit-logging.js

@@ -0,0 +1,63 @@
+import { logCreate, logUpdate, logDelete, logAuthzFailure, logPerformance, logError } from '@/lib/audit-logger-enhanced';
+
+const extractEntityInfo = (request, params = {}) => {
+  const url = new URL(request.url);
+  const parts = url.pathname.split('/').filter(Boolean);
+  const entityType = parts[parts.length - 2] || 'unknown';
+  const entityId = params.id || params.engagementId || params.reviewId || params.highlightId || params.permissionId || parts[parts.length - 1];
+  return { entityType, entityId };
+};
+
+export const withAuditLogging = (handler, options = {}) => {
+  return async (request, context = {}) => {
+    const startTime = Date.now();
+    const method = request.method;
+    const { entityType: defaultEntityType, entityId: defaultEntityId } = extractEntityInfo(request, context.params || {});
+    const entityType = options.entityType || defaultEntityType;
+    let response;
+    let userId = null;
+    let entityId = defaultEntityId;
+
+    try {
+      response = await handler(request, context);
+      const endTime = Date.now();
+      const durationMs = endTime - startTime;
+
+      if (response.userId) userId = response.userId;
+      if (response.user && response.user.id) userId = response.user.id;
+
+      const body = response instanceof Response ? await response.clone().json().catch(() => ({})) : response;
+      if (body.user && body.user.id) userId = body.user.id;
+
+      if (method === 'POST' && response.status >= 200 && response.status < 300) {
+        const createdId = body.id || body.data?.id || entityId;
+        logCreate(entityType, createdId, userId, body.data || body);
+      }
+
+      if (method === 'PATCH' && response.status >= 200 && response.status < 300) {
+        logUpdate(entityType, entityId, userId, null, body.data || body);
+      }
+
+      if (method === 'DELETE' && response.status >= 200 && response.status < 300) {
+        logDelete(entityType, entityId, userId, null);
+      }
+
+      if (durationMs > 500) {
+        logPerformance(`${method} ${entityType}`, entityType, durationMs, userId);
+      }
+
+      if (response.status === 403) {
+        logAuthzFailure(userId, entityType, entityId, 'unknown', { method, path: request.url });
+      }
+
+      return response;
+    } catch (error) {
+      logError(error, { entityType, entityId, userId, method, path: request.url });
+      throw error;
+    }
+  };
+};
+
+export const auditCreate = (entityType, entityId, userId, afterState) => logCreate(entityType, entityId, userId, afterState);
+export const auditUpdate = (entityType, entityId, userId, beforeState, afterState) => logUpdate(entityType, entityId, userId, beforeState, afterState);
+export const auditDelete = (entityType, entityId, userId, beforeState) => logDelete(entityType, entityId, userId, beforeState);

package/src/lib/with-error-handler.js

@@ -0,0 +1,31 @@
+import { AppError, normalizeError, createErrorLogger } from '@/lib/error-handler';
+import { apiError } from '@/lib/response-formatter';
+import { HTTP } from '@/config/constants';
+
+export const withErrorHandler = (handler, operation = 'Operation') => {
+  const logger = createErrorLogger(operation);
+
+  return async (...args) => {
+    try {
+      return await handler(...args);
+    } catch (e) {
+      const error = normalizeError(e);
+      logger.error(error.code, error.context);
+      return apiError(error);
+    }
+  };
+};
+
+export const withAsyncErrorHandler = (handler, context = '') => {
+  const logger = createErrorLogger(context);
+
+  return async (...args) => {
+    try {
+      return await handler(...args);
+    } catch (e) {
+      const error = e instanceof AppError ? e : new AppError(e.message, 'INTERNAL_ERROR', HTTP.INTERNAL_ERROR, { originalMessage: e.message });
+      logger.error(error.code || 'ERROR', error.context || {});
+      throw error;
+    }
+  };
+};