xypriss 2.3.7 → 3.1.0

package/dist/esm/src/middleware/security-middleware.js

@@ -32,19 +32,53 @@ class SecurityMiddleware {
         this.csrf = config.csrf !== false ? config.csrf || true : false;
         this.helmet = config.helmet !== false ? config.helmet || true : false;
         this.xss = config.xss !== false ? config.xss || true : false;
-        this.sqlInjection = config.sqlInjection !== false ? config.sqlInjection || true : false;
-        this.pathTraversal = config.pathTraversal !== false ? config.pathTraversal || false : false;
-        this.commandInjection = config.commandInjection !== false ? config.commandInjection || false : false;
+        this.sqlInjection =
+            config.sqlInjection !== false ? config.sqlInjection || true : false;
+        this.pathTraversal =
+            config.pathTraversal !== false
+                ? config.pathTraversal || false
+                : false;
+        this.commandInjection =
+            config.commandInjection !== false
+                ? config.commandInjection || false
+                : false;
         this.xxe = config.xxe !== false ? config.xxe || false : false;
-        this.ldapInjection = config.ldapInjection !== false ? config.ldapInjection || false : false;
-        this.bruteForce = config.bruteForce !== false ? config.bruteForce || true : false;
-        this.rateLimit = config.rateLimit !== false ? config.rateLimit || true : false;
+        this.ldapInjection =
+            config.ldapInjection !== false
+                ? config.ldapInjection || false
+                : false;
+        this.bruteForce =
+            config.bruteForce !== false ? config.bruteForce || true : false;
+        this.rateLimit =
+            config.rateLimit !== false ? config.rateLimit || true : false;
         this.cors = config.cors !== false ? config.cors || true : false;
-        this.compression = config.compression !== false ? config.compression || true : false;
+        this.compression =
+            config.compression !== false ? config.compression || true : false;
         this.hpp = config.hpp !== false ? config.hpp || true : false;
-        this.mongoSanitize = config.mongoSanitize !== false ? config.mongoSanitize || true : false;
+        this.mongoSanitize =
+            config.mongoSanitize !== false
+                ? config.mongoSanitize || true
+                : false;
         this.morgan = config.morgan !== false ? config.morgan || true : false;
-        this.slowDown = config.slowDown !== false ? config.slowDown || true : false;
+        this.slowDown =
+            config.slowDown !== false ? config.slowDown || true : false;
+        this.browserOnly =
+            config.browserOnly !== false ? config.browserOnly || false : false;
+        this.terminalOnly =
+            config.terminalOnly !== false
+                ? config.terminalOnly || false
+                : false;
+        this.requestSignature =
+            config.requestSignature !== false
+                ? config.requestSignature || false
+                : false;
+        // Validate that both browserOnly and terminalOnly are not enabled simultaneously
+        const browserOnlyEnabled = this.isBrowserOnlyEnabled();
+        const terminalOnlyEnabled = this.isTerminalOnlyEnabled();
+        if (browserOnlyEnabled && terminalOnlyEnabled) {
+            throw new Error("Security configuration error: browserOnly and terminalOnly cannot be enabled simultaneously. " +
+                "Choose one access control method or disable both.");
+        }
         this.encryption = {
             algorithm: "AES-256-GCM",
             keySize: 32,
@@ -67,7 +101,7 @@ class SecurityMiddleware {
                         entropy: "high",
                     }),
                 name: config.authentication?.session?.name ||
-                    "nehonix.XyPriss.sid",
+                    "xypriss.nehonix.sid",
                 cookie: {
                     maxAge: 24 * 60 * 60 * 1000, // 24 hours
                     secure: true,
@@ -82,45 +116,89 @@ class SecurityMiddleware {
         this.routeConfig = config.routeConfig;
         // Initialize security detectors
         this.sqlInjectionDetector = new SQLInjectionDetector({
-            strictMode: typeof this.sqlInjection === 'object' ? this.sqlInjection.strictMode : false,
-            contextualAnalysis: typeof this.sqlInjection === 'object' ? this.sqlInjection.contextualAnalysis : true,
-            logAttempts: typeof this.sqlInjection === 'object' ? this.sqlInjection.logAttempts : true,
-            falsePositiveThreshold: typeof this.sqlInjection === 'object' ? this.sqlInjection.falsePositiveThreshold : 0.6,
+            strictMode: typeof this.sqlInjection === "object"
+                ? this.sqlInjection.strictMode
+                : false,
+            contextualAnalysis: typeof this.sqlInjection === "object"
+                ? this.sqlInjection.contextualAnalysis
+                : true,
+            logAttempts: typeof this.sqlInjection === "object"
+                ? this.sqlInjection.logAttempts
+                : true,
+            falsePositiveThreshold: typeof this.sqlInjection === "object"
+                ? this.sqlInjection.falsePositiveThreshold
+                : 0.6,
         });
         this.pathTraversalDetector = new PathTraversalDetector({
             enabled: !!this.pathTraversal,
-            strictMode: typeof this.pathTraversal === 'object' ? this.pathTraversal.strictMode : false,
-            logAttempts: typeof this.pathTraversal === 'object' ? this.pathTraversal.logAttempts : true,
-            blockOnDetection: typeof this.pathTraversal === 'object' ? this.pathTraversal.blockOnDetection : true,
-            allowedPaths: typeof this.pathTraversal === 'object' ? this.pathTraversal.allowedPaths : [],
-            allowedExtensions: typeof this.pathTraversal === 'object' ? this.pathTraversal.allowedExtensions : ['.jpg', '.png', '.pdf', '.txt'],
-            maxDepth: typeof this.pathTraversal === 'object' ? this.pathTraversal.maxDepth : 3,
-            falsePositiveThreshold: typeof this.pathTraversal === 'object' ? this.pathTraversal.falsePositiveThreshold : 0.6,
+            strictMode: typeof this.pathTraversal === "object"
+                ? this.pathTraversal.strictMode
+                : false,
+            logAttempts: typeof this.pathTraversal === "object"
+                ? this.pathTraversal.logAttempts
+                : true,
+            blockOnDetection: typeof this.pathTraversal === "object"
+                ? this.pathTraversal.blockOnDetection
+                : true,
+            allowedPaths: typeof this.pathTraversal === "object"
+                ? this.pathTraversal.allowedPaths
+                : [],
+            allowedExtensions: typeof this.pathTraversal === "object"
+                ? this.pathTraversal.allowedExtensions
+                : [".jpg", ".png", ".pdf", ".txt"],
+            maxDepth: typeof this.pathTraversal === "object"
+                ? this.pathTraversal.maxDepth
+                : 3,
+            falsePositiveThreshold: typeof this.pathTraversal === "object"
+                ? this.pathTraversal.falsePositiveThreshold
+                : 0.6,
         });
         this.commandInjectionDetector = new CommandInjectionDetector({
             enabled: !!this.commandInjection,
-            strictMode: typeof this.commandInjection === 'object' ? this.commandInjection.strictMode : false,
-            logAttempts: typeof this.commandInjection === 'object' ? this.commandInjection.logAttempts : true,
-            blockOnDetection: typeof this.commandInjection === 'object' ? this.commandInjection.blockOnDetection : true,
-            contextualAnalysis: typeof this.commandInjection === 'object' ? this.commandInjection.contextualAnalysis : true,
-            allowedCommands: typeof this.commandInjection === 'object' ? this.commandInjection.allowedCommands : [],
-            falsePositiveThreshold: typeof this.commandInjection === 'object' ? this.commandInjection.falsePositiveThreshold : 0.7,
+            strictMode: typeof this.commandInjection === "object"
+                ? this.commandInjection.strictMode
+                : false,
+            logAttempts: typeof this.commandInjection === "object"
+                ? this.commandInjection.logAttempts
+                : true,
+            blockOnDetection: typeof this.commandInjection === "object"
+                ? this.commandInjection.blockOnDetection
+                : true,
+            contextualAnalysis: typeof this.commandInjection === "object"
+                ? this.commandInjection.contextualAnalysis
+                : true,
+            allowedCommands: typeof this.commandInjection === "object"
+                ? this.commandInjection.allowedCommands
+                : [],
+            falsePositiveThreshold: typeof this.commandInjection === "object"
+                ? this.commandInjection.falsePositiveThreshold
+                : 0.7,
         });
         this.xxeProtector = new XXEProtector({
             enabled: !!this.xxe,
-            strictMode: typeof this.xxe === 'object' ? this.xxe.strictMode : true,
-            logAttempts: typeof this.xxe === 'object' ? this.xxe.logAttempts : true,
-            blockOnDetection: typeof this.xxe === 'object' ? this.xxe.blockOnDetection : true,
-            allowDTD: typeof this.xxe === 'object' ? this.xxe.allowDTD : false,
-            allowExternalEntities: typeof this.xxe === 'object' ? this.xxe.allowExternalEntities : false,
-            maxEntityExpansions: typeof this.xxe === 'object' ? this.xxe.maxEntityExpansions : 0,
+            strictMode: typeof this.xxe === "object" ? this.xxe.strictMode : true,
+            logAttempts: typeof this.xxe === "object" ? this.xxe.logAttempts : true,
+            blockOnDetection: typeof this.xxe === "object" ? this.xxe.blockOnDetection : true,
+            allowDTD: typeof this.xxe === "object" ? this.xxe.allowDTD : false,
+            allowExternalEntities: typeof this.xxe === "object"
+                ? this.xxe.allowExternalEntities
+                : false,
+            maxEntityExpansions: typeof this.xxe === "object" ? this.xxe.maxEntityExpansions : 0,
         });
         this.ldapInjectionDetector = new LDAPInjectionDetector({
             enabled: !!this.ldapInjection,
-            strictMode: typeof this.ldapInjection === 'object' ? this.ldapInjection.strictMode : false,
-            logAttempts: typeof this.ldapInjection === 'object' ? this.ldapInjection.logAttempts : true,
-            blockOnDetection: typeof this.ldapInjection === 'object' ? this.ldapInjection.blockOnDetection : true,
-            falsePositiveThreshold: typeof this.ldapInjection === 'object' ? this.ldapInjection.falsePositiveThreshold : 0.6,
+            strictMode: typeof this.ldapInjection === "object"
+                ? this.ldapInjection.strictMode
+                : false,
+            logAttempts: typeof this.ldapInjection === "object"
+                ? this.ldapInjection.logAttempts
+                : true,
+            blockOnDetection: typeof this.ldapInjection === "object"
+                ? this.ldapInjection.blockOnDetection
+                : true,
+            falsePositiveThreshold: typeof this.ldapInjection === "object"
+                ? this.ldapInjection.falsePositiveThreshold
+                : 0.6,
         });
         // Initialize all middleware instances
         this.initializeMiddleware();
@@ -133,20 +211,28 @@ class SecurityMiddleware {
         // Helmet for security headers
         if (this.helmet) {
             const helmetConfig = typeof this.helmet === "object" ? this.helmet : {};
+            // Prepare CSP configuration with proper merging
+            let cspConfig = false;
+            if (this.level === "maximum") {
+                cspConfig = {
+                    directives: {
+                        defaultSrc: ["'self'"],
+                        styleSrc: ["'self'", "'unsafe-inline'"],
+                        scriptSrc: ["'self'"],
+                        imgSrc: ["'self'", "data:", "https:"],
+                    },
+                };
+            }
+            else if (helmetConfig.contentSecurityPolicy) {
+                // Merge user CSP config with defaults from BuiltInMiddleware
+                cspConfig = helmetConfig.contentSecurityPolicy; // BuiltInMiddleware will handle merging
+            }
+            this.logger.debug("security", "Final cspConfig:", cspConfig);
             this.helmetMiddleware = BuiltInMiddleware.helmet({
-                contentSecurityPolicy: this.level === "maximum"
-                    ? {
-                        directives: {
-                            defaultSrc: ["'self'"],
-                            styleSrc: ["'self'", "'unsafe-inline'"],
-                            scriptSrc: ["'self'"],
-                            imgSrc: ["'self'", "data:", "https:"],
-                        },
-                    }
-                    : helmetConfig.contentSecurityPolicy
-                        ? helmetConfig.contentSecurityPolicy
-                        : false,
-                hsts: this.level !== "basic" || helmetConfig.hsts ? helmetConfig.hsts : undefined,
+                contentSecurityPolicy: cspConfig,
+                hsts: this.level !== "basic" || helmetConfig.hsts
+                    ? helmetConfig.hsts
+                    : undefined,
                 crossOriginEmbedderPolicy: this.level === "maximum",
             });
         }
@@ -188,8 +274,10 @@ class SecurityMiddleware {
                 legacyHeaders: false,
                 skip: (req) => {
                     // Skip rate limiting for health checks and static assets
-                    return req.path === "/health" || req.path === "/ping" ||
-                        req.path.startsWith("/static/") || req.path.startsWith("/assets/");
+                    return (req.path === "/health" ||
+                        req.path === "/ping" ||
+                        req.path.startsWith("/static/") ||
+                        req.path.startsWith("/assets/"));
                 },
             });
             this.logger.debug("security", `General rate limiting initialized with max: ${maxRequests} requests`);
@@ -211,6 +299,27 @@ class SecurityMiddleware {
                 },
             });
         }
+        // Browser-only protection
+        if (this.isBrowserOnlyEnabled()) {
+            const browserOnlyConfig = typeof this.browserOnly === "object" ? this.browserOnly : {};
+            this.browserOnlyMiddleware =
+                BuiltInMiddleware.browserOnly(browserOnlyConfig);
+        }
+        // Terminal-only protection
+        if (this.isTerminalOnlyEnabled()) {
+            const terminalOnlyConfig = typeof this.terminalOnly === "object" ? this.terminalOnly : {};
+            this.terminalOnlyMiddleware =
+                BuiltInMiddleware.terminalOnly(terminalOnlyConfig);
+        }
+        // Request signature protection (API authentication)
+        if (this.requestSignature) {
+            const requestSignatureConfig = typeof this.requestSignature === "object" &&
+                this.requestSignature !== null
+                ? this.requestSignature
+                : { secret: "default-secret" }; // This will be overridden by user config
+            this.requestSignatureMiddleware =
+                BuiltInMiddleware.requestSignature(requestSignatureConfig);
+        }
         // Compression middleware
         if (this.compression) {
             const compressionConfig = typeof this.compression === "object" ? this.compression : {};
@@ -231,19 +340,23 @@ class SecurityMiddleware {
         }
         // MongoDB injection protection
         if (this.mongoSanitize) {
-            const mongoConfig = typeof this.mongoSanitize === "object" ? this.mongoSanitize : {};
+            const mongoConfig = typeof this.mongoSanitize === "object"
+                ? this.mongoSanitize
+                : {};
             this.mongoSanitizeMiddleware = BuiltInMiddleware.mongoSanitize({
                 replaceWith: mongoConfig.replaceWith || "_",
-                onSanitize: mongoConfig.onSanitize || (({ req, key }) => {
-                    console.warn(`Sanitized key ${key} in request from ${req.ip}`);
-                }),
+                onSanitize: mongoConfig.onSanitize ||
+                    (({ req, key }) => {
+                        this.logger.warn("security", `Sanitized key ${key} in request from ${req.ip}`);
+                    }),
             });
         }
         // Morgan logging middleware
         if (this.morgan) {
             const morganConfig = typeof this.morgan === "object" ? this.morgan : {};
             this.morganMiddleware = BuiltInMiddleware.morgan({
-                skip: morganConfig.skip || ((req, res) => res.statusCode < 400),
+                skip: morganConfig.skip ||
+                    ((req, res) => res.statusCode < 400),
                 stream: morganConfig.stream,
             });
         }
@@ -253,10 +366,11 @@ class SecurityMiddleware {
             this.slowDownMiddleware = BuiltInMiddleware.slowDown({
                 windowMs: slowDownConfig.windowMs || 15 * 60 * 1000, // 15 minutes
                 delayAfter: slowDownConfig.delayAfter || 100,
-                delayMs: slowDownConfig.delayMs || ((used, req) => {
-                    const delayAfter = req.slowDown?.limit || 100;
-                    return (used - delayAfter) * 500;
-                }),
+                delayMs: slowDownConfig.delayMs ||
+                    ((used, req) => {
+                        const delayAfter = req.slowDown?.limit || 100;
+                        return (used - delayAfter) * 500;
+                    }),
             });
         }
     }
@@ -275,57 +389,74 @@ class SecurityMiddleware {
     applySecurityStack(req, res, next) {
         this.logger.debug("security", "Starting security middleware stack");
         const middlewareStack = [];
-        // 1. Compression (should be first)
+        // 🚨 CRITICAL: Access control middlewares FIRST (before any other processing)
+        // These must run before route resolution to block unwanted requests
+        // 1. Browser-only protection (blocks cURL and automation tools)
+        if (this.isBrowserOnlyEnabled() && this.browserOnlyMiddleware) {
+            this.logger.debug("security", "Adding browser-only middleware (FIRST)");
+            middlewareStack.push(this.browserOnlyMiddleware);
+        }
+        // 2. Terminal-only protection (blocks browser requests)
+        if (this.isTerminalOnlyEnabled() && this.terminalOnlyMiddleware) {
+            this.logger.debug("security", "Adding terminal-only middleware (FIRST)");
+            middlewareStack.push(this.terminalOnlyMiddleware);
+        }
+        // 3. Request signature protection (API authentication)
+        if (this.requestSignature && this.requestSignatureMiddleware) {
+            this.logger.debug("security", "Adding request signature middleware (FIRST)");
+            middlewareStack.push(this.requestSignatureMiddleware);
+        }
+        // 4. Compression (should be early but after access control)
         if (this.compression && this.compressionMiddleware) {
             this.logger.debug("security", "Adding compression middleware");
             middlewareStack.push(this.compressionMiddleware);
         }
-        // 2. Security headers (Helmet)
+        // 5. Security headers (Helmet)
         if (this.helmet && this.helmetMiddleware) {
             this.logger.debug("security", "Adding helmet middleware");
             middlewareStack.push(this.helmetMiddleware);
         }
-        // 3. CORS
+        // 6. CORS
         if (this.cors !== false && this.corsMiddleware) {
             this.logger.debug("security", "Adding CORS middleware");
             middlewareStack.push(this.corsMiddleware);
         }
-        // 4. Rate limiting (brute force protection - stricter)
+        // 7. Rate limiting (brute force protection - stricter)
         if (this.bruteForce && this.bruteForceMiddleware) {
             this.logger.debug("security", "Adding brute force protection middleware");
             middlewareStack.push(this.bruteForceMiddleware);
         }
-        // 5. General rate limiting (less strict)
+        // 8. General rate limiting (less strict)
         if (this.rateLimit && this.rateLimitMiddleware) {
             this.logger.debug("security", "Adding general rate limiting middleware");
             middlewareStack.push(this.rateLimitMiddleware);
         }
-        // 6. HTTP Parameter Pollution protection
+        // 9. HTTP Parameter Pollution protection
         if (this.hpp && this.hppMiddleware) {
             this.logger.debug("security", "Adding HPP middleware");
             middlewareStack.push(this.hppMiddleware);
         }
-        // 7. MongoDB sanitization
+        // 10. MongoDB sanitization
         if (this.mongoSanitize && this.mongoSanitizeMiddleware) {
             this.logger.debug("security", "Adding mongo sanitize middleware");
             middlewareStack.push(this.mongoSanitizeMiddleware);
         }
-        // 8. Morgan logging
+        // 11. Morgan logging
         if (this.morgan && this.morganMiddleware) {
             this.logger.debug("security", "Adding morgan middleware");
             middlewareStack.push(this.morganMiddleware);
         }
-        // 9. Slow down middleware
+        // 12. Slow down middleware
         if (this.slowDown && this.slowDownMiddleware) {
             this.logger.debug("security", "Adding slow down middleware");
             middlewareStack.push(this.slowDownMiddleware);
         }
-        // 10. XSS protection (custom implementation)
+        // 13. XSS protection (custom implementation)
         if (this.xss) {
             this.logger.debug("security", "Adding XSS protection middleware");
             middlewareStack.push(this.xssProtection.bind(this));
         }
-        // 11. CSRF protection (should be after body parsing)
+        // 14. CSRF protection (should be after body parsing)
         if (this.csrf && this.csrfMiddleware) {
             this.logger.debug("security", "Adding CSRF middleware");
             middlewareStack.push(this.csrfMiddleware);
@@ -505,7 +636,8 @@ class SecurityMiddleware {
                     detectedPatterns.push("XSS");
                 }
                 // SQL Injection Detection
-                if (this.sqlInjection && this.shouldApplySecurityModule(req, this.routeConfig?.sqlInjection)) {
+                if (this.sqlInjection &&
+                    this.shouldApplySecurityModule(req, this.routeConfig?.sqlInjection)) {
                     const sqlResult = this.sqlInjectionDetector.detect(original, currentPath);
                     if (sqlResult.isMalicious) {
                         threatDetected = true;
@@ -517,7 +649,8 @@ class SecurityMiddleware {
                     }
                 }
                 // Path Traversal Detection
-                if (this.pathTraversal && this.shouldApplySecurityModule(req, this.routeConfig?.pathTraversal)) {
+                if (this.pathTraversal &&
+                    this.shouldApplySecurityModule(req, this.routeConfig?.pathTraversal)) {
                     const pathResult = this.pathTraversalDetector.detect(original);
                     if (pathResult.isMalicious) {
                         threatDetected = true;
@@ -528,7 +661,8 @@ class SecurityMiddleware {
                     }
                 }
                 // Command Injection Detection
-                if (this.commandInjection && this.shouldApplySecurityModule(req, this.routeConfig?.commandInjection)) {
+                if (this.commandInjection &&
+                    this.shouldApplySecurityModule(req, this.routeConfig?.commandInjection)) {
                     const cmdResult = this.commandInjectionDetector.detect(original);
                     if (cmdResult.isMalicious) {
                         threatDetected = true;
@@ -539,7 +673,10 @@ class SecurityMiddleware {
                     }
                 }
                 // XXE Detection (for XML content)
-                if (this.xxe && this.shouldApplySecurityModule(req, this.routeConfig?.xxe) && (original.includes('<?xml') || original.includes('<!DOCTYPE'))) {
+                if (this.xxe &&
+                    this.shouldApplySecurityModule(req, this.routeConfig?.xxe) &&
+                    (original.includes("<?xml") ||
+                        original.includes("<!DOCTYPE"))) {
                     const xxeResult = this.xxeProtector.detect(original);
                     if (xxeResult.isMalicious) {
                         threatDetected = true;
@@ -550,7 +687,8 @@ class SecurityMiddleware {
                     }
                 }
                 // LDAP Injection Detection
-                if (this.ldapInjection && this.shouldApplySecurityModule(req, this.routeConfig?.ldapInjection)) {
+                if (this.ldapInjection &&
+                    this.shouldApplySecurityModule(req, this.routeConfig?.ldapInjection)) {
                     const ldapResult = this.ldapInjectionDetector.detect(original);
                     if (ldapResult.isMalicious) {
                         threatDetected = true;
@@ -615,6 +753,29 @@ class SecurityMiddleware {
         }
         return null;
     }
+    /**
+     * Check if browser-only protection is enabled
+     */
+    isBrowserOnlyEnabled() {
+        if (this.browserOnly === true)
+            return true;
+        if (typeof this.browserOnly === "object" && this.browserOnly !== null) {
+            return this.browserOnly.enable !== false; // Default to true when config provided
+        }
+        return false;
+    }
+    /**
+     * Check if terminal-only protection is enabled
+     */
+    isTerminalOnlyEnabled() {
+        if (this.terminalOnly === true)
+            return true;
+        if (typeof this.terminalOnly === "object" &&
+            this.terminalOnly !== null) {
+            return this.terminalOnly.enable !== false; // Default to true when config provided
+        }
+        return false;
+    }
     /**
      * Get security configuration
      */
@@ -623,6 +784,9 @@ class SecurityMiddleware {
             level: this.level,
             csrf: this.csrf,
             helmet: this.helmet,
+            browserOnly: this.browserOnly,
+            terminalOnly: this.terminalOnly,
+            requestSignature: this.requestSignature,
             xss: this.xss,
             sqlInjection: this.sqlInjection,
             pathTraversal: this.pathTraversal,
@@ -647,7 +811,7 @@ class SecurityMiddleware {
      */
     matchesRoute(requestPath, requestMethod, pattern) {
         // Handle RoutePattern object
-        if (typeof pattern === 'object' && 'path' in pattern) {
+        if (typeof pattern === "object" && "path" in pattern) {
             const routePattern = pattern;
             // Check method if specified
             if (routePattern.methods && routePattern.methods.length > 0) {
@@ -664,25 +828,25 @@ class SecurityMiddleware {
         // Handle string patterns with wildcards
         const patternStr = pattern;
         // Normalize paths by removing trailing slashes for comparison
-        const normalizedRequestPath = requestPath.replace(/\/$/, '');
-        const normalizedPattern = patternStr.replace(/\/$/, '');
+        const normalizedRequestPath = requestPath.replace(/\/$/, "");
+        const normalizedPattern = patternStr.replace(/\/$/, "");
         // Exact match (after normalization)
         if (normalizedPattern === normalizedRequestPath) {
             return true;
         }
         // Wildcard matching (e.g., /api/* matches /api/anything)
-        if (patternStr.includes('*')) {
+        if (patternStr.includes("*")) {
             // Handle trailing /* specially to match with or without trailing slash
-            if (patternStr.endsWith('/*')) {
+            if (patternStr.endsWith("/*")) {
                 const prefix = patternStr.slice(0, -2); // Remove /*
                 // Match if requestPath starts with prefix, optionally followed by /
-                const regex = new RegExp(`^${prefix.replace(/[.+?^${}()|[\]\\]/g, '\\$&')}(?:/.*)?$`);
+                const regex = new RegExp(`^${prefix.replace(/[.+?^${}()|[\]\\]/g, "\\$&")}(?:/.*)?$`);
                 return regex.test(requestPath);
             }
             else {
                 const regexPattern = patternStr
-                    .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // Escape special regex chars except *
-                    .replace(/\*/g, '.*'); // Convert * to .*
+                    .replace(/[.+?^${}()|[\]\\]/g, "\\$&") // Escape special regex chars except *
+                    .replace(/\*/g, ".*"); // Convert * to .*
                 const regex = new RegExp(`^${regexPattern}$`);
                 return regex.test(requestPath);
             }
@@ -700,17 +864,19 @@ class SecurityMiddleware {
         if (!moduleConfig) {
             return true; // Apply by default if no route config
         }
-        const requestPath = req.path || req.url || '';
-        const requestMethod = req.method || 'GET';
+        const requestPath = req.path || req.url || "";
+        const requestMethod = req.method || "GET";
         // Check includeRoutes first (whitelist approach)
-        if (moduleConfig.includeRoutes && moduleConfig.includeRoutes.length > 0) {
+        if (moduleConfig.includeRoutes &&
+            moduleConfig.includeRoutes.length > 0) {
             // Only apply if route is in the include list
-            return moduleConfig.includeRoutes.some(pattern => this.matchesRoute(requestPath, requestMethod, pattern));
+            return moduleConfig.includeRoutes.some((pattern) => this.matchesRoute(requestPath, requestMethod, pattern));
         }
         // Check excludeRoutes (blacklist approach)
-        if (moduleConfig.excludeRoutes && moduleConfig.excludeRoutes.length > 0) {
+        if (moduleConfig.excludeRoutes &&
+            moduleConfig.excludeRoutes.length > 0) {
             // Don't apply if route is in the exclude list
-            const isExcluded = moduleConfig.excludeRoutes.some(pattern => this.matchesRoute(requestPath, requestMethod, pattern));
+            const isExcluded = moduleConfig.excludeRoutes.some((pattern) => this.matchesRoute(requestPath, requestMethod, pattern));
             return !isExcluded;
         }
         return true; // Apply by default