xypriss 3.1.0 → 3.2.1

package/dist/index.d.ts

@@ -1664,6 +1664,51 @@ interface CacheStrategy {
     tags?: string[];
 }
 
+/**
+ * Mobile-Only Access Protector
+ * Blocks browser requests and allows only mobile app access.
+ * Multi-layered detection with strict validation to avoid false positives.
+ *
+ * @example Enable with defaults:
+ * ```typescript
+ * mobileOnly: true
+ * ```
+ *
+ * @example Custom configuration:
+ * ```typescript
+ * mobileOnly: {
+ *   blockBrowserIndicators: true,
+ *   allowedPlatforms: ['ios', 'android'],
+ *   requireMobileHeaders: true,
+ *   customUserAgentPatterns: [/MyApp/i],
+ *   errorMessage: "Mobile app access required"
+ * }
+ * ```
+ */
+
+interface MobileOnlyConfig {
+    /** Enable/disable mobile-only protection */
+    enable?: boolean;
+    /** Block requests with browser indicators */
+    blockBrowserIndicators?: boolean;
+    /** Allowed mobile platforms */
+    allowedPlatforms?: ("ios" | "android" | "react-native" | "expo" | "flutter")[];
+    /** Require mobile-specific headers */
+    requireMobileHeaders?: boolean;
+    /** Custom User-Agent patterns to allow */
+    customUserAgentPatterns?: RegExp[];
+    /** Debug logging */
+    debug?: boolean;
+    /** Custom error message */
+    errorMessage?: string;
+    /** HTTP status code for blocked requests */
+    statusCode?: number;
+    /** Case-sensitive User-Agent matching */
+    caseSensitive?: boolean;
+    /** Trim whitespace from User-Agent */
+    trimUserAgent?: boolean;
+}
+
 /**
  * Browser-Only Protection Configuration
  *
@@ -1841,6 +1886,22 @@ interface RequestSignatureConfig {
     caseSensitive?: boolean;
     /** Trim whitespace from header value */
     trimValue?: boolean;
+    /** Maximum allowed header length to prevent DoS (default: 512) */
+    maxHeaderLength?: number;
+    /** Rate limiting: max failed attempts before temporary block (default: 5) */
+    maxFailedAttempts?: number;
+    /** Rate limiting: block duration in milliseconds (default: 15 minutes) */
+    blockDuration?: number;
+    /** Disable rate limiting entirely (default: false) */
+    disableRateLimiting?: boolean;
+    /** Scale factor for rate limiting thresholds (default: 1.0) */
+    rateLimitScaleFactor?: number;
+    /** Minimum secret length requirement (default: 32) */
+    minSecretLength?: number;
+    /** Enable timing attack protection (default: true) */
+    timingSafeComparison?: boolean;
+    /** Reject requests with suspicious patterns (default: true) */
+    rejectSuspiciousPatterns?: boolean;
 }
 /**
  * Helmet Security Headers Configuration
@@ -2752,6 +2813,67 @@ interface SecurityConfig {
      * ```
      */
     terminalOnly?: boolean | TerminalOnlyConfig;
+    /**
+     * Mobile-Only Protection Configuration
+     *
+     * Blocks browser requests while allowing mobile app access.
+     * Perfect for APIs that should only be accessed through mobile applications.
+     *
+     * @example Enable with defaults:
+     * ```typescript
+     * mobileOnly: true
+     * ```
+     *
+     * @example Custom configuration:
+     * ```typescript
+     * mobileOnly: {
+     *   blockBrowserIndicators: true,
+     *   allowedPlatforms: ['ios', 'android'],
+     *   requireMobileHeaders: true,
+     *   customUserAgentPatterns: [/MyApp/i],
+     *   errorMessage: "Mobile app access required"
+     * }
+     * ```
+     */
+    mobileOnly?: boolean | MobileOnlyConfig;
+    /**
+     * Device Access Control Configuration
+     *
+     * Comprehensive device-based access control allowing multiple device types.
+     * Enables fine-grained control over which devices can access your API.
+     *
+     * @example Allow only mobile apps:
+     * ```typescript
+     * deviceAccess: {
+     *   mobileOnly: true
+     * }
+     * ```
+     *
+     * @example Allow mobile apps and browsers:
+     * ```typescript
+     * deviceAccess: {
+     *   mobileOnly: true,
+     *   browserOnly: true
+     * }
+     * ```
+     *
+     * @example Allow all except browsers:
+     * ```typescript
+     * deviceAccess: {
+     *   mobileOnly: true,
+     *   terminalOnly: true,
+     *   browserOnly: false
+     * }
+     * ```
+     */
+    deviceAccess?: {
+        /** Allow only browser requests */
+        browserOnly?: boolean | BrowserOnlyConfig;
+        /** Allow only terminal/API tool requests */
+        terminalOnly?: boolean | TerminalOnlyConfig;
+        /** Allow only mobile app requests */
+        mobileOnly?: boolean | MobileOnlyConfig;
+    };
     /**
      * XyRS - XyPriss Request Signature Configuration
      *
@@ -2993,6 +3115,7 @@ interface CORSConfig {
  *
  * @example
  * ```typescript
+ * // String message
  * const rateLimitConfig: RateLimitConfig = {
  *   windowMs: 900000, // 15 minutes
  *   max: 100, // 100 requests per window
@@ -3000,6 +3123,19 @@ interface CORSConfig {
  *   standardHeaders: true,
  *   legacyHeaders: false
  * };
+ *
+ * // Object message (more flexible)
+ * const rateLimitConfig: RateLimitConfig = {
+ *   windowMs: 900000,
+ *   max: 100,
+ *   message: {
+ *     error: 'Rate limit exceeded',
+ *     message: 'Too many requests, please try again later',
+ *     retryAfter: 900
+ *   },
+ *   standardHeaders: true,
+ *   legacyHeaders: false
+ * };
  * ```
  */
 interface RateLimitConfig$1 {
@@ -3007,8 +3143,13 @@ interface RateLimitConfig$1 {
     windowMs?: number;
     /** Maximum requests per window */
     max?: number;
-    /** Message to send when limit is exceeded */
-    message?: string;
+    /** Message to send when limit is exceeded (string or object) */
+    message?: string | {
+        error?: string;
+        message?: string;
+        retryAfter?: number;
+        [key: string]: any;
+    };
     /** Include standard rate limit headers */
     standardHeaders?: boolean;
     /** Include legacy rate limit headers */
@@ -4628,6 +4769,12 @@ declare class SecurityMiddleware {
     slowDown: boolean | SlowDownConfig;
     browserOnly: boolean | BrowserOnlyConfig;
     terminalOnly: boolean | TerminalOnlyConfig;
+    mobileOnly: boolean | MobileOnlyConfig;
+    deviceAccess?: {
+        browserOnly?: boolean | BrowserOnlyConfig;
+        terminalOnly?: boolean | TerminalOnlyConfig;
+        mobileOnly?: boolean | MobileOnlyConfig;
+    };
     requestSignature: boolean | RequestSignatureConfig;
     encryption: Required<SecurityConfig>["encryption"];
     authentication: Required<SecurityConfig>["authentication"];
@@ -4639,6 +4786,7 @@ declare class SecurityMiddleware {
     private csrfMiddleware;
     private browserOnlyMiddleware;
     private terminalOnlyMiddleware;
+    private mobileOnlyMiddleware;
     private requestSignatureMiddleware;
     private mongoSanitizeMiddleware;
     private hppMiddleware;
@@ -4652,6 +4800,7 @@ declare class SecurityMiddleware {
     private ldapInjectionDetector;
     private browserOnlyProtector?;
     private terminalOnlyProtector?;
+    private mobileOnlyProtector?;
     private logger;
     constructor(config?: SecurityConfig, logger?: Logger);
     /**
@@ -4696,6 +4845,22 @@ declare class SecurityMiddleware {
      * Check if terminal-only protection is enabled
      */
     private isTerminalOnlyEnabled;
+    /**
+     * Check if mobile-only protection is enabled
+     */
+    private isMobileOnlyEnabled;
+    /**
+     * Validate device access configuration
+     */
+    private validateDeviceAccessConfig;
+    /**
+     * Create combined middleware for browser and mobile access control
+     */
+    private createCombinedDeviceMiddleware;
+    /**
+     * Check if request is from a mobile device (using MobileOnlyProtector logic)
+     */
+    private isMobileRequest;
     /**
      * Get security configuration
      */
@@ -5291,7 +5456,7 @@ interface SecurityMiddlewareConfig {
         xssFilter?: boolean;
     };
     cors?: boolean | {
-        origin?: string | string[] | boolean;
+        origin?: string | RegExp | (string | RegExp)[] | boolean;
         methods?: string | string[];
         allowedHeaders?: string | string[];
         exposedHeaders?: string | string[];
@@ -5303,7 +5468,12 @@ interface SecurityMiddlewareConfig {
     rateLimit?: boolean | {
         windowMs?: number;
         max?: number;
-        message?: string;
+        message?: string | {
+            error?: string;
+            message?: string;
+            retryAfter?: number;
+            [key: string]: any;
+        };
         standardHeaders?: boolean;
         legacyHeaders?: boolean;
         store?: any;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "xypriss",
-    "version": "3.1.0",
+    "version": "3.2.1",
     "description": "XyPriss is a lightweight, TypeScript-first, open-source Node.js web framework crafted for developers seeking a familiar Express-like API without Express dependencies. It features built-in security middleware, a robust routing system, and performance optimizations to build scalable, secure web applications effortlessly. Join our community and contribute on GitHub!",
     "main": "dist/cjs/index.js",
     "module": "dist/esm/index.js",