velocious 1.0.571 → 1.0.573

package/src/utils/bearer-token.js

@@ -0,0 +1,34 @@
+// @ts-check
+
+import crypto from "node:crypto"
+
+/**
+ * Constant-time comparison so token checks don't leak length/contents through
+ * timing. Returns false for differing lengths before the timing-safe compare.
+ * @param {string} a - First value.
+ * @param {string} b - Second value.
+ * @returns {boolean} - Whether the values are equal.
+ */
+export function constantTimeEqual(a, b) {
+  const bufferA = Buffer.from(String(a))
+  const bufferB = Buffer.from(String(b))
+
+  if (bufferA.length !== bufferB.length) return false
+
+  return crypto.timingSafeEqual(bufferA, bufferB)
+}
+
+/**
+ * Extracts the bearer token from the Authorization header of a request.
+ * @param {import("../http-server/client/request.js").default | import("../http-server/client/websocket-request.js").default} request - Request object.
+ * @returns {string | null} - Bearer token from the Authorization header, if any.
+ */
+export function bearerToken(request) {
+  const header = request.header("authorization")
+
+  if (typeof header !== "string") return null
+
+  const match = header.match(/^Bearer\s+(.+)$/i)
+
+  return match ? match[1].trim() : null
+}

package/src/utils/mount-prefix.js

@@ -0,0 +1,36 @@
+// @ts-check
+
+/**
+ * Normalizes a mount prefix: ensures a leading slash and strips any trailing
+ * slash so `/velocious/jobs/` and `/velocious/jobs` behave identically.
+ * @param {string} at - Raw mount prefix.
+ * @returns {string} - Normalized prefix.
+ */
+export function normalizeMountPrefix(at) {
+  if (typeof at !== "string" || !at.startsWith("/")) {
+    throw new Error(`mount requires an 'at' path starting with '/', got: ${String(at)}`)
+  }
+
+  if (at.length > 1 && at.endsWith("/")) {
+    return at.slice(0, -1)
+  }
+
+  return at
+}
+
+/**
+ * Extracts the request sub-path under a normalized mount prefix, or null when
+ * the path is outside the mount. A root mount (`/`) treats the whole path as
+ * the sub-path.
+ * @param {object} args - Options.
+ * @param {string} args.prefix - Normalized mount prefix.
+ * @param {string} args.path - Request path without query string.
+ * @returns {string | null} - Sub-path ("/" for the bare prefix) or null.
+ */
+export function mountSubPath({prefix, path}) {
+  if (prefix === "/") return path
+  if (path === prefix) return "/"
+  if (path.startsWith(`${prefix}/`)) return path.slice(prefix.length)
+
+  return null
+}