restifyx.js/dist/cjs/utils/security.js

Advanced API endpoint handler system with automatic documentation

"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.generateSecureToken = generateSecureToken;
exports.hashString = hashString;
exports.generateCsrfToken = generateCsrfToken;
exports.csrfProtection = csrfProtection;
exports.securityHeaders = securityHeaders;
exports.encryptData = encryptData;
exports.decryptData = decryptData;
exports.generateJwtSecret = generateJwtSecret;
exports.sanitizeInput = sanitizeInput;
const crypto_1 = __importDefault(require("crypto"));
const logger_1 = require("./logger");
function generateSecureToken(length = 32) {
    return crypto_1.default.randomBytes(length).toString("hex");
}
function hashString(data, algorithm = "sha256") {
    return crypto_1.default.createHash(algorithm).update(data).digest("hex");
}
function generateCsrfToken() {
    return generateSecureToken();
}
function csrfProtection(options = {}) {
    const cookieName = options.cookieName || "csrf-token";
    const headerName = options.headerName || "x-csrf-token";
    const ignoreMethods = options.ignoreMethods || ["GET", "HEAD", "OPTIONS"];
    const logger = (0, logger_1.getLogger)();
    return (req, res, next) => {
        if (ignoreMethods.includes(req.method)) {
            return next();
        }
        const token = req.cookies?.[cookieName];
        const headerToken = req.headers[headerName.toLowerCase()];
        if (!token || !headerToken || token !== headerToken) {
            logger.warn(`CSRF token validation failed for ${req.method} ${req.originalUrl}`);
            if (options.errorHandler) {
                return options.errorHandler(req, res);
            }
            return res.status(403).json({
                status: "error",
                statusCode: 403,
                message: "CSRF token validation failed",
                errorCode: "CSRF_VALIDATION_FAILED",
                timestamp: Date.now(),
            });
        }
        next();
    };
}
function securityHeaders() {
    return (req, res, next) => {
        res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
        res.setHeader("X-Content-Type-Options", "nosniff");
        res.setHeader("X-Frame-Options", "DENY");
        res.setHeader("X-XSS-Protection", "1; mode=block");
        res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self'; object-src 'none'; img-src 'self' data:; style-src 'self' 'unsafe-inline'");
        res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
        res.setHeader("Permissions-Policy", "geolocation=(), camera=(), microphone=()");
        next();
    };
}
function encryptData(data, key, iv) {
    const ivBuffer = iv || crypto_1.default.randomBytes(16);
    const cipher = crypto_1.default.createCipheriv("aes-256-cbc", Buffer.from(key), ivBuffer);
    let encrypted = cipher.update(data, "utf8", "hex");
    encrypted += cipher.final("hex");
    return {
        encrypted,
        iv: ivBuffer.toString("hex"),
    };
}
function decryptData(encryptedData, key, iv) {
    const ivBuffer = Buffer.from(iv, "hex");
    const decipher = crypto_1.default.createDecipheriv("aes-256-cbc", Buffer.from(key), ivBuffer);
    let decrypted = decipher.update(encryptedData, "hex", "utf8");
    decrypted += decipher.final("utf8");
    return decrypted;
}
function generateJwtSecret() {
    return crypto_1.default.randomBytes(64).toString("hex");
}
function sanitizeInput(input) {
    return input
        .replace(/</g, "&lt;")
        .replace(/>/g, "&gt;")
        .replace(/"/g, "&quot;")
        .replace(/'/g, "&#x27;")
        .replace(/\//g, "&#x2F;");
}
//# sourceMappingURL=security.js.map