xypriss 9.0.13 → 9.1.1

package/.private/security-example.ts

@@ -0,0 +1,149 @@
+/**
+ * XyPriss Security Configuration Example
+ * Demonstrates how to use the security configuration option
+ */
+
+import { createServer } from "../src/server/ServerFactory";
+
+// Example 1: Basic security configuration
+const basicSecurityServer = createServer({
+    server: {
+        port: 3001,
+        host: "localhost",
+        autoPortSwitch: {
+            enabled: true,
+        },
+    },
+    cluster: {
+        enabled: true,
+    },
+    security: {
+        enabled: true,
+        level: "enhanced",
+        csrf: true,
+        helmet: true,
+        xss: true,
+        bruteForce: true,
+    },
+    logging: {
+        enabled: true,
+        types: {
+            debug: true,
+            portSwitching: true,
+        },
+        components: {},
+    },
+});
+
+// Example 2: Maximum security configuration
+const maxSecurityServer = createServer({
+    server: {
+        port: 3002,
+        host: "localhost",
+    },
+    security: {
+        enabled: true,
+        level: "maximum",
+        csrf: true,
+        helmet: true,
+        xss: true,
+        sqlInjection: true,
+        bruteForce: true,
+        encryption: {
+            algorithm: "AES-256-GCM",
+            keySize: 32,
+        },
+        authentication: {
+            jwt: {
+                secret: "your-super-secret-jwt-key",
+                expiresIn: "24h",
+                algorithm: "HS256",
+            },
+            session: {
+                secret: "your-super-secret-session-key",
+                name: "secure.sid",
+                cookie: {
+                    maxAge: 24 * 60 * 60 * 1000, // 24 hours
+                    secure: true,
+                    httpOnly: true,
+                    sameSite: "strict",
+                },
+            },
+        },
+    },
+    logging: {
+        enabled: true,
+        level: "debug",
+    },
+});
+
+// Example 3: Custom security configuration
+const customSecurityServer = createServer({
+    server: {
+        port: 3003,
+        host: "localhost",
+    },
+    security: {
+        enabled: true,
+        level: "basic",
+        csrf: false, // Disable CSRF for API-only server
+        helmet: true,
+        xss: true,
+        sqlInjection: true,
+        bruteForce: true,
+    },
+    logging: {
+        enabled: true,
+        level: "info",
+    },
+});
+
+// Add some routes to demonstrate security features
+basicSecurityServer.get("/", (req, res) => {
+    res.json({
+        message: "Hello from XyPriss with basic security!",
+        security: "enabled",
+        level: "enhanced",
+    });
+});
+
+basicSecurityServer.post("/api/data", (req, res) => {
+    // This route will be protected by CSRF, XSS filtering, etc.
+    res.json({
+        message: "Data received securely",
+        data: req.body,
+        timestamp: new Date().toISOString(),
+    });
+});
+
+maxSecurityServer.get("/", (req, res) => {
+    res.json({
+        message: "Hello from XyPriss with maximum security!",
+        security: "maximum",
+        features: [
+            "CSRF",
+            "Helmet",
+            "XSS",
+            "SQL Injection",
+            "Brute Force",
+            "Encryption",
+        ],
+    });
+});
+
+customSecurityServer.get("/api/status", (req, res) => {
+    res.json({
+        message: "API server with custom security",
+        security: "basic",
+        csrf: false,
+        timestamp: new Date().toISOString(),
+    });
+});
+
+// Start servers (uncomment to run)
+basicSecurityServer.start();
+maxSecurityServer.start();
+customSecurityServer.start();
+
+export { basicSecurityServer, maxSecurityServer, customSecurityServer };
+

package/.private/serializer.ts

@@ -0,0 +1,13 @@
+import axios from "axios";
+
+(async function () {
+    try {
+        const x = await (await axios.get("http://localhost:8085/.xJson")).data
+
+        console.log(JSON.stringify(x));
+    } catch (error) {
+        console.log("error: ", error);
+    }
+})()
+
+

package/.private/server.ts

@@ -0,0 +1,200 @@
+import NehoID from "nehoid";
+import { createServer } from "../src/index";
+import { xems } from "../src/plugins/modules/xems/XemsPlugin";
+import crypto from "node:crypto";
+import { __strl__ } from "strulink";
+
+const USERS_SANDBOX = "users-db";
+const SESSION_SANDBOX = "auth-automated";
+
+const app = createServer({
+    server: {
+        port: 6578,
+        xems: {
+            // enable: true,
+            sandbox: SESSION_SANDBOX,
+            ttl: "6d", // SEC_POLICY: This will be capped to 5d by Go sidecar
+            autoRotation: true,
+            gracePeriod: 2000,
+            persistence: {
+                enabled: true,
+                secret: "8f2d6c1b9a5e4f0d3c7b2a1e6d9f8c0b",
+                resources: {
+                    cacheSize: 64,
+                },
+            },
+        },
+    },
+    security: {
+        cors: {
+            origin: ["http://localhost:*"],
+            credentials: true,
+            methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+            allowedHeaders: ["Content-Type", "x-xypriss-token"],
+        },
+    },
+}); 
+
+console.log("cors: ", __cfg__.get("security")?.cors);
+const d =
+    "eyJlbWFpbCI6ImRldi5zZXRoQG5laG9uaXguY29tIiwicGFzc3dvcmQiOiIxMjNFbGVhemFyQCJ9";
+
+console.log("data: ", __strl__.autoDetectAndDecode(d).val());
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function hashPassword(password: string): string {
+    return crypto
+        .createHash("sha256")
+        .update(password + "xems-salt-2026")
+        .digest("hex");
+}
+
+function generateId(): string {
+    return crypto.randomBytes(8).toString("hex");
+}
+
+/** Derive a stable XEMS key from an email (so we can look up users by email) */
+function emailKey(email: string): string {
+    return (
+        "user:" +
+        crypto.createHash("sha256").update(email).digest("hex").slice(0, 32)
+    );
+}
+
+// ─── Auth Routes ──────────────────────────────────────────────────────────────
+
+/**
+ * POST /auth/register
+ * Stores user record in XEMS "users-db" sandbox (keyed by email hash).
+ * Creates a session in the "auth-automated" sandbox.
+ */
+app.post("/auth/register", async (req, res) => {
+    try {
+        const { name, email, password } = req.body;
+
+        if (!name || !email || !password) {
+            return res
+                .status(400)
+                .json({ error: "name, email and password are required" });
+        }
+
+        // Check if user already exists (stable key lookup — no token needed)
+        const existing = await xems.from(USERS_SANDBOX).get(emailKey(email));
+        console.log("existing: ", existing);
+        if (existing) {
+            return res.status(409).json({ error: "Email already registered" });
+        }
+
+        const user = {
+            id: generateId(),
+            name,
+            email,
+            role: "user",
+            passwordHash: hashPassword(password),
+            createdAt: new Date().toISOString(),
+        };
+
+        // Persist user record with a stable key (email hash) — no TTL (permanent record)
+        await xems
+            .from(USERS_SANDBOX)
+            .set(emailKey(email), JSON.stringify(user));
+
+        // Create auth session (token-based, with TTL, auto-rotated)
+        const { id, name: userName, role, createdAt } = user;
+        const sessionData = { id, name: userName, email, role, createdAt };
+        const sessionToken = await res.xLink(sessionData, SESSION_SANDBOX);
+
+        return res.json({
+            success: true,
+            message: "Account created successfully",
+            user: sessionData,
+            token: sessionToken,
+        });
+    } catch (e: any) {
+        console.error("[/auth/register]", e);
+        return res.status(500).json({ error: e.message });
+    }
+});
+
+
+/**
+ * POST /auth/login
+ * Looks up user by email in XEMS, validates password, creates a new session.
+ */
+app.post("/auth/login", async (req, res) => {
+    try {
+        const { email, password } = req.body;
+
+        if (!email || !password) {
+            return res
+                .status(400)
+                .json({ error: "email and password are required" });
+        }
+
+        // Look up user record from XEMS by stable email key
+        const raw = await xems.from(USERS_SANDBOX).get(emailKey(email));
+        if (!raw) {
+            return res.status(401).json({ error: "Invalid email or password" });
+        }
+
+        const user = JSON.parse(raw);
+
+        // Verify password
+        if (user.passwordHash !== hashPassword(password)) {
+            return res.status(401).json({ error: "Invalid email or password" });
+        }
+
+        // Create new auth session (token-based, with TTL)
+        const { id, name, role, createdAt } = user;
+        const sessionData = { id, name, email, role, createdAt };
+        const sessionToken = await res.xLink(sessionData, SESSION_SANDBOX);
+
+        return res.json({
+            success: true,
+            message: "Logged in successfully",
+            user: sessionData,
+            token: sessionToken,
+        });
+    } catch (e: any) {
+        console.error("[/auth/login]", e);
+        return res.status(500).json({ error: e.message });
+    }
+});
+
+/**
+ * POST /auth/logout
+ * Clears the session cookie/header.
+ */
+app.post("/auth/logout", async (_req, res) => {
+    await res.xUnlink();
+    return res.json({ success: true, message: "Logged out" });
+});
+
+/**
+ * GET /auth/profile
+ * Returns the current user from the XEMS session (auto-populated by the plugin).
+ */
+app.get("/auth/profile", async (req, res) => {
+    const session = req["session"] as any;
+
+    console.log("session (main): ", session);
+
+    if (!session?.id) {
+        return res.status(401).json({ error: "Not allowed" });
+    }
+
+    return res.json({
+        user: {
+            id: session.id,
+            name: session.name,
+            email: session.email,
+            role: session.role,
+            createdAt: session.createdAt,
+        },
+        tokenRotated: !!(res as any)._xemsNewToken,
+    });
+});
+
+app.start();
+

package/.private/server2.ts

@@ -0,0 +1,12 @@
+import { createServer, XyPrissSys, __sys__ } from "../src";
+import { testSConfigs2 } from "./configs";
+import router from "./router";
+import { logger } from "./testPlugin_Logger";
+
+// Créez d'abord la configuration
+
+// Gelez toute la configuration avant de la passer
+const app = createServer({});
+
+
+app.start();

package/.private/test-mob.ts

@@ -0,0 +1,15 @@
+import axios from "axios";
+
+const url = "http://localhost:3001/api";
+
+async function call() {
+    try {
+        const res = await axios.get(url);
+        console.log("response for testing: ", res.data);
+    } catch (error) {
+        console.log("Error while testing: ", error.response.data);
+    }
+}
+
+call();
+

package/.private/test-pkce.ts

@@ -0,0 +1,43 @@
+import * as crypto from "crypto";
+import { Cipher } from "../mods/security/src/core/crypt";
+// import { Cipher } from "xypriss-security";
+
+// Code verifier du frontend mobile (des logs)
+const codeVerifier =
+  "uCoEh3q6tUR0_eVlsr6b6qjfzeWf_jnfoif8XQvTPeMq~zG6MyiEyhAroiJrmcrCb8JNqd6tSqvYX~1nLcD29.QU~iIxeGZleMeiiC1vfd.hLns0MuQZuTL.NqByFF0K";
+
+// Code challenge stocké dans le backend (des logs)
+const storedChallenge = "eHjZE0STxWg9BRtooH5xl3J5SZ__EUUvjv_UQZXgUII";
+
+// Calculer le challenge comme le backend le fait maintenant
+const computedChallenge = crypto
+  .createHash("sha256")
+  .update(codeVerifier)
+  .digest("base64")
+  .replace(/\+/g, "-") 
+  .replace(/\//g, "_")
+  .replace(/=/g, "");
+
+console.log("PKCE Test Results:");
+console.log("Code Verifier:", codeVerifier);
+console.log("Stored Challenge:", storedChallenge);
+console.log("Computed Challenge:", computedChallenge);
+console.log("Match:", computedChallenge === storedChallenge);
+
+// // Test aussi avec l'ancienne méthode Cipher.hash
+// import { Cipher } from "xypriss-security";
+const oldMethodChallenge = Cipher.hash
+  .create(codeVerifier)
+  .toString("base64url");
+
+// Test the new PKCE method
+const pkceChallenge = Cipher.hash.pkce(codeVerifier);
+
+console.log("New PKCE Method (Cipher.hash.pkce):", pkceChallenge);
+console.log("New PKCE Method Match:", pkceChallenge === storedChallenge);
+
+/**
+ * .replace(/\+/g, '-')
+  .replace(/\//g, '_')
+  .replace(/=/g, '');
+ */

package/.private/test-proxy.cjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+
+/**
+ * Test script to verify trust proxy functionality
+ * This simulates requests that would come through a reverse proxy like Nginx
+ */
+
+const http = require('http');
+
+const SERVER_URL = 'http://localhost:3001';
+
+// Test cases to simulate different proxy scenarios
+const testCases = [
+    {
+        name: "Direct request (no proxy headers)",
+        headers: {},
+        description: "Should show the actual client IP"
+    },
+    {
+        name: "Nginx reverse proxy",
+        headers: {
+            'X-Forwarded-For': '203.0.113.195, 70.41.3.18, 150.172.238.178',
+            'X-Forwarded-Proto': 'https',
+            'X-Forwarded-Host': 'example.com',
+            'X-Real-IP': '203.0.113.195'
+        },
+        description: "Should trust X-Forwarded-For and show 203.0.113.195 as client IP"
+    },
+    {
+        name: "Cloudflare proxy",
+        headers: {
+            'CF-Connecting-IP': '198.51.100.42',
+            'X-Forwarded-For': '198.51.100.42',
+            'X-Forwarded-Proto': 'https',
+            'CF-Ray': '1234567890abcdef-LAX'
+        },
+        description: "Should show Cloudflare's connecting IP"
+    },
+    {
+        name: "Load balancer chain",
+        headers: {
+            'X-Forwarded-For': '192.0.2.60, 198.51.100.178, 203.0.113.15',
+            'X-Forwarded-Proto': 'https',
+            'X-Forwarded-Port': '443'
+        },
+        description: "Should show the first IP in the chain (192.0.2.60)"
+    }
+];
+
+function makeRequest(testCase) {
+    return new Promise((resolve, reject) => {
+        const options = {
+            hostname: 'localhost',
+            port: 3001,
+            path: '/api/proxy-test',
+            method: 'GET',
+            headers: {
+                'User-Agent': 'Trust-Proxy-Test/1.0',
+                ...testCase.headers
+            }
+        };
+
+        const req = http.request(options, (res) => {
+            let data = '';
+            
+            res.on('data', (chunk) => {
+                data += chunk;
+            });
+            
+            res.on('end', () => {
+                try {
+                    const response = JSON.parse(data);
+                    resolve({ testCase, response, statusCode: res.statusCode });
+                } catch (error) {
+                    reject(new Error(`Failed to parse response: ${error.message}`));
+                }
+            });
+        });
+
+        req.on('error', (error) => {
+            reject(error);
+        });
+
+        req.setTimeout(5000, () => {
+            req.destroy();
+            reject(new Error('Request timeout'));
+        });
+
+        req.end();
+    });
+}
+
+async function runTests() {
+    console.log('🧪 Testing Trust Proxy Functionality\n');
+    console.log('=' .repeat(80));
+    
+    for (let i = 0; i < testCases.length; i++) {
+        const testCase = testCases[i];
+        
+        try {
+            console.log(`\n📋 Test ${i + 1}: ${testCase.name}`);
+            console.log(`📝 ${testCase.description}`);
+            console.log('-'.repeat(60));
+            
+            const result = await makeRequest(testCase);
+            
+            if (result.statusCode === 200) {
+                console.log('✅ Status: SUCCESS');
+                console.log(`🌐 Detected IP: ${result.response.clientInfo.ip}`);
+                console.log(`🔒 Protocol: ${result.response.clientInfo.protocol}`);
+                console.log(`🏠 Hostname: ${result.response.clientInfo.hostname}`);
+                console.log(`🔐 Secure: ${result.response.clientInfo.secure}`);
+                
+                if (result.response.clientInfo.ips && result.response.clientInfo.ips.length > 0) {
+                    console.log(`📊 IPs Array: [${result.response.clientInfo.ips.join(', ')}]`);
+                }
+                
+                // Show relevant headers
+                const relevantHeaders = ['x-forwarded-for', 'x-forwarded-proto', 'x-real-ip'];
+                const headers = result.response.headers;
+                
+                console.log('\n📨 Proxy Headers:');
+                relevantHeaders.forEach(header => {
+                    if (headers[header]) {
+                        console.log(`   ${header}: ${headers[header]}`);
+                    }
+                });
+                
+                // Analysis
+                console.log('\n🔍 Analysis:');
+                if (testCase.headers['X-Forwarded-For']) {
+                    const expectedIP = testCase.headers['X-Forwarded-For'].split(',')[0].trim();
+                    if (result.response.clientInfo.ip === expectedIP) {
+                        console.log(`   ✅ Trust proxy working: Expected ${expectedIP}, got ${result.response.clientInfo.ip}`);
+                    } else {
+                        console.log(`   ❌ Trust proxy issue: Expected ${expectedIP}, got ${result.response.clientInfo.ip}`);
+                    }
+                } else {
+                    console.log(`   ℹ️  Direct connection, IP: ${result.response.clientInfo.ip}`);
+                }
+                
+            } else {
+                console.log(`❌ Status: FAILED (HTTP ${result.statusCode})`);
+            }
+            
+        } catch (error) {
+            console.log(`❌ Status: ERROR - ${error.message}`);
+        }
+    }
+    
+    console.log('\n' + '='.repeat(80));
+    console.log('🏁 Test completed!');
+    console.log('\n💡 Tips:');
+    console.log('   - If trust proxy is working, X-Forwarded-For IPs should be detected');
+    console.log('   - req.ip should show the first IP from X-Forwarded-For chain');
+    console.log('   - req.ips should contain the full proxy chain');
+    console.log('   - Protocol should be detected from X-Forwarded-Proto');
+}
+
+// Run the tests
+runTests().catch(console.error);

package/.private/test-query-endpoint.ts

@@ -0,0 +1,28 @@
+import { createServer } from "../src";
+
+const app = createServer({
+    server: {
+        port: 3002,
+        trustProxy: ['loopback', 'uniquelocal']
+    },
+    logging: {
+        enabled: true,
+        level: 'debug'
+    }
+});
+
+// Test endpoint to verify query parameter parsing
+app.get("/test-query", (req: any, res: any) => {
+    res.json({
+        message: "Query parameter parsing test",
+        query: req.query,
+        path: req.path,
+        originalUrl: req.originalUrl,
+        method: req.method,
+        queryKeys: Object.keys(req.query || {}),
+        queryCount: Object.keys(req.query || {}).length
+    });
+});
+
+console.log("Starting query parameter test server on port 3002...");
+app.start();