@plasius/api - npm Package Compare versions

Comparing version 1.0.10 to 1.0.11

dist/utils/cookie-security.d.ts

+import type { HttpRequest } from "@azure/functions";
+export type CookieSameSite = "None" | "Lax";
+export declare function resolvePublicBaseUrl(request: HttpRequest): string;
+export declare function getCookieSecurity(request: HttpRequest): {
+    secure: boolean;
+    sameSite: CookieSameSite;
+};
+//# sourceMappingURL=cookie-security.d.ts.map

dist/utils/cookie-security.d.ts.map

+{"version":3,"file":"cookie-security.d.ts","sourceRoot":"","sources":["../../src/utils/cookie-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,CAAC;AA4E5C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAkBjE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAQA"}

dist/utils/cookie-security.js

+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePublicBaseUrl = resolvePublicBaseUrl;
+exports.getCookieSecurity = getCookieSecurity;
+function normalizeBaseUrl(value) {
+    if (!value) {
+        return null;
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return null;
+    }
+    try {
+        const url = new URL(trimmed);
+        return `${url.protocol}//${url.host}`;
+    }
+    catch {
+        return null;
+    }
+}
+function firstHeaderValue(value) {
+    if (!value) {
+        return null;
+    }
+    const first = value.split(",")[0]?.trim();
+    return first && first.length > 0 ? first : null;
+}
+function getForwardedBaseUrl(request) {
+    const forwardedProto = firstHeaderValue(request.headers.get("x-forwarded-proto"));
+    const forwardedHost = firstHeaderValue(request.headers.get("x-forwarded-host"));
+    if (forwardedProto && forwardedHost) {
+        return normalizeBaseUrl(`${forwardedProto}://${forwardedHost}`);
+    }
+    const forwarded = request.headers.get("forwarded");
+    if (!forwarded) {
+        return null;
+    }
+    const firstForwardedValue = forwarded.split(",")[0] ?? "";
+    const parts = firstForwardedValue
+        .split(";")
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+    const kvPairs = Object.fromEntries(parts.map((part) => {
+        const separatorIndex = part.indexOf("=");
+        if (separatorIndex < 0) {
+            return [part.toLowerCase(), ""];
+        }
+        const key = part.slice(0, separatorIndex).trim().toLowerCase();
+        const nextValue = part.slice(separatorIndex + 1).trim().replace(/^"|"$/g, "");
+        return [key, nextValue];
+    }));
+    const proto = typeof kvPairs.proto === "string" && kvPairs.proto.length > 0
+        ? kvPairs.proto
+        : null;
+    const host = typeof kvPairs.host === "string" && kvPairs.host.length > 0
+        ? kvPairs.host
+        : null;
+    if (!proto || !host) {
+        return null;
+    }
+    return normalizeBaseUrl(`${proto}://${host}`);
+}
+function resolvePublicBaseUrl(request) {
+    const headerOrigin = normalizeBaseUrl(request.headers.get("origin"));
+    const headerReferer = normalizeBaseUrl(request.headers.get("referer"));
+    const configuredPublicBase = normalizeBaseUrl(process.env.PUBLIC_BASE_URL);
+    const frontendDomain = normalizeBaseUrl(process.env.FRONTEND_DOMAIN);
+    const configuredDomain = normalizeBaseUrl(process.env.DOMAIN);
+    const requestBaseUrl = normalizeBaseUrl(request.url);
+    const resolved = getForwardedBaseUrl(request) ??
+        headerOrigin ??
+        headerReferer ??
+        configuredPublicBase ??
+        frontendDomain ??
+        configuredDomain ??
+        requestBaseUrl;
+    return resolved ?? "http://localhost:5173";
+}
+function getCookieSecurity(request) {
+    const baseUrl = resolvePublicBaseUrl(request);
+    const secure = baseUrl.startsWith("https://");
+    return {
+        secure,
+        sameSite: secure ? "None" : "Lax",
+    };
+}
+//# sourceMappingURL=cookie-security.js.map

dist/utils/cookie-security.js.map

+{"version":3,"file":"cookie-security.js","sourceRoot":"","sources":["../../src/utils/cookie-security.ts"],"names":[],"mappings":";;AA8EA,oDAkBC;AAED,8CAWC;AAzGD,SAAS,gBAAgB,CAAC,KAAgC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoB;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoB;IAC/C,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAChF,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;QACpC,OAAO,gBAAgB,CAAC,GAAG,cAAc,MAAM,aAAa,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,mBAAmB;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1B,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GACT,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAC3D,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,IAAI,GACR,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,OAAO,CAAC,IAAI;QACd,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,gBAAgB,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAoB;IACvD,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErD,MAAM,QAAQ,GACZ,mBAAmB,CAAC,OAAO,CAAC;QAC5B,YAAY;QACZ,aAAa;QACb,oBAAoB;QACpB,cAAc;QACd,gBAAgB;QAChB,cAAc,CAAC;IAEjB,OAAO,QAAQ,IAAI,uBAAuB,CAAC;AAC7C,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAoB;IAIpD,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAE9C,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;KAClC,CAAC;AACJ,CAAC"}

CHANGELOG.md

@@ -21,2 +21,17 @@ # Changelog
 
+## [1.0.11] - 2026-03-09
+
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - Exempted OAuth callback, Apple notification, and `/oauth/refresh-token` routes from CSRF validation in the shared middleware package, matching the live backend expectations.
+  - Made shared CSRF and session middleware derive cookie security from the incoming request so localhost and forwarded deployments use the correct `secure`/`SameSite` settings without backend-local overrides.
+
+- **Security**
+  - (placeholder)
+
 ## [1.0.10] - 2026-03-04
@@ -166,3 +181,3 @@
 
-[Unreleased]: https://github.com/Plasius-LTD/api/compare/v1.0.10...HEAD
+[Unreleased]: https://github.com/Plasius-LTD/api/compare/v1.0.11...HEAD
 [1.0.0]: https://github.com/Plasius-LTD/api/releases/tag/v1.0.0
@@ -177,1 +192,2 @@ [1.0.1]: https://github.com/Plasius-LTD/api/releases/tag/v1.0.1
 [1.0.10]: https://github.com/Plasius-LTD/api/releases/tag/v1.0.10
+[1.0.11]: https://github.com/Plasius-LTD/api/releases/tag/v1.0.11

dist/index.d.ts

@@ -6,2 +6,3 @@ export { applyBaselineSecurityHeaders, isHttpsRequest, isInsecureLocalRequest, shouldEnforceHttps, } from "./middleware/transportSecurity.js";
 export { DEFAULT_SESSION_COOKIE_NAME, createSessionCookie, ensureSession, getSessionIdFromRequest, } from "./utils/session.js";
+export { getCookieSecurity, resolvePublicBaseUrl, } from "./utils/cookie-security.js";
 //# sourceMappingURL=index.d.ts.map

dist/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AAEtC,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AAEtC,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}

dist/index.js

@@ -17,3 +17,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSessionIdFromRequest = exports.ensureSession = exports.createSessionCookie = exports.DEFAULT_SESSION_COOKIE_NAME = exports.isValidPkceCookieId = exports.isValidPkceCodeVerifier = exports.getPkceCookieName = exports.generatePkceCookieId = exports.generatePkceCodeVerifier = exports.generatePkceCodeChallenge = exports.verifyState = exports.parseEncodedState = exports.decodeOAuthReturnToState = exports.shouldEnforceHttps = exports.isInsecureLocalRequest = exports.isHttpsRequest = exports.applyBaselineSecurityHeaders = void 0;
+exports.resolvePublicBaseUrl = exports.getCookieSecurity = exports.getSessionIdFromRequest = exports.ensureSession = exports.createSessionCookie = exports.DEFAULT_SESSION_COOKIE_NAME = exports.isValidPkceCookieId = exports.isValidPkceCodeVerifier = exports.getPkceCookieName = exports.generatePkceCookieId = exports.generatePkceCodeVerifier = exports.generatePkceCodeChallenge = exports.verifyState = exports.parseEncodedState = exports.decodeOAuthReturnToState = exports.shouldEnforceHttps = exports.isInsecureLocalRequest = exports.isHttpsRequest = exports.applyBaselineSecurityHeaders = void 0;
 var transportSecurity_js_1 = require("./middleware/transportSecurity.js");
@@ -41,2 +41,5 @@ Object.defineProperty(exports, "applyBaselineSecurityHeaders", { enumerable: true, get: function () { return transportSecurity_js_1.applyBaselineSecurityHeaders; } });
 Object.defineProperty(exports, "getSessionIdFromRequest", { enumerable: true, get: function () { return session_js_1.getSessionIdFromRequest; } });
+var cookie_security_js_1 = require("./utils/cookie-security.js");
+Object.defineProperty(exports, "getCookieSecurity", { enumerable: true, get: function () { return cookie_security_js_1.getCookieSecurity; } });
+Object.defineProperty(exports, "resolvePublicBaseUrl", { enumerable: true, get: function () { return cookie_security_js_1.resolvePublicBaseUrl; } });
 //# sourceMappingURL=index.js.map

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0EAK2C;AAJzC,oIAAA,4BAA4B,OAAA;AAC5B,sHAAA,cAAc,OAAA;AACd,8HAAA,sBAAsB,OAAA;AACtB,0HAAA,kBAAkB,OAAA;AAEpB,wDAAsC;AAEtC,6CAI0B;AAHxB,oHAAA,wBAAwB,OAAA;AACxB,6GAAA,iBAAiB,OAAA;AACjB,uGAAA,WAAW,OAAA;AAGb,uDAO+B;AAN7B,0HAAA,yBAAyB,OAAA;AACzB,yHAAA,wBAAwB,OAAA;AACxB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AACjB,wHAAA,uBAAuB,OAAA;AACvB,oHAAA,mBAAmB,OAAA;AAGrB,iDAK4B;AAJ1B,yHAAA,2BAA2B,OAAA;AAC3B,iHAAA,mBAAmB,OAAA;AACnB,2GAAA,aAAa,OAAA;AACb,qHAAA,uBAAuB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0EAK2C;AAJzC,oIAAA,4BAA4B,OAAA;AAC5B,sHAAA,cAAc,OAAA;AACd,8HAAA,sBAAsB,OAAA;AACtB,0HAAA,kBAAkB,OAAA;AAEpB,wDAAsC;AAEtC,6CAI0B;AAHxB,oHAAA,wBAAwB,OAAA;AACxB,6GAAA,iBAAiB,OAAA;AACjB,uGAAA,WAAW,OAAA;AAGb,uDAO+B;AAN7B,0HAAA,yBAAyB,OAAA;AACzB,yHAAA,wBAAwB,OAAA;AACxB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AACjB,wHAAA,uBAAuB,OAAA;AACvB,oHAAA,mBAAmB,OAAA;AAGrB,iDAK4B;AAJ1B,yHAAA,2BAA2B,OAAA;AAC3B,iHAAA,mBAAmB,OAAA;AACnB,2GAAA,aAAa,OAAA;AACb,qHAAA,uBAAuB,OAAA;AAGzB,iEAGoC;AAFlC,uHAAA,iBAAiB,OAAA;AACjB,0HAAA,oBAAoB,OAAA"}

dist/middleware/withCSRF.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"withCSRF.d.ts","sourceRoot":"","sources":["../../src/middleware/withCSRF.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,eAAO,MAAM,QAAQ,QAAO,UAoD3B,CAAC"}
+{"version":3,"file":"withCSRF.d.ts","sourceRoot":"","sources":["../../src/middleware/withCSRF.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAqCnD,eAAO,MAAM,QAAQ,QAAO,UAyD3B,CAAC"}

dist/middleware/withCSRF.js

@@ -9,2 +9,25 @@ "use strict";
 const CSRF_COOKIE_NAME = "csrf-token";
+function normalizePathname(pathname) {
+    const normalized = pathname.trim().replace(/\/+$/, "");
+    return normalized.length > 0 ? normalized : "/";
+}
+function shouldSkipCsrfValidation(request) {
+    const method = request.method?.toUpperCase();
+    if (!method || method === "GET" || method === "HEAD" || method === "OPTIONS") {
+        return false;
+    }
+    let pathname = "";
+    try {
+        pathname = normalizePathname(new URL(request.url).pathname);
+    }
+    catch {
+        return false;
+    }
+    const oauthCallbackPattern = /(^|\/)(?:api\/)?oauth\/[^/]+\/callback$/i;
+    const appleNotificationPattern = /(^|\/)(?:api\/)?oauth\/apple\/notification$/i;
+    const oauthRefreshPattern = /(^|\/)(?:api\/)?oauth\/refresh-token$/i;
+    return (oauthCallbackPattern.test(pathname) ||
+        appleNotificationPattern.test(pathname) ||
+        oauthRefreshPattern.test(pathname));
+}
 const withCSRF = () => {
@@ -16,2 +39,6 @@ return async (request, context) => {
         const isReadOnly = method === "GET" || method === "HEAD" || method === "OPTIONS";
+        if (shouldSkipCsrfValidation(request)) {
+            logger.log("CSRF validation skipped for OAuth callback/notification route");
+            return true;
+        }
         // Read token from header and cookie
@@ -23,2 +50,3 @@ const headerToken = request.headers?.get(CSRF_HEADER_NAME);
             const newToken = (0, crypto_1.randomUUID)();
+            const cookieSecurity = (0, utils_1.getCookieSecurity)(request);
             const newCookies = [
@@ -29,4 +57,3 @@ ...cookies,
                     value: newToken,
-                    secure: true,
-                    sameSite: "None",
+                    ...cookieSecurity,
                     path: "/",
@@ -33,0 +60,0 @@ maxAge: 10 * 60, // 10 minutes

dist/middleware/withCSRF.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"withCSRF.js","sourceRoot":"","sources":["../../src/middleware/withCSRF.ts"],"names":[],"mappings":";;;AAEA,oCAAqC;AACrC,mCAAoC;AACpC,gDAAoD;AAEpD,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE/B,MAAM,QAAQ,GAAG,GAAe,EAAE;IACvC,OAAO,KAAK,EAAE,OAAoB,EAAE,OAA0B,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAI9C,CAAC;QAEF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;QAC7C,MAAM,UAAU,GACd,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC;QAEhE,oCAAoC;QACpC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,IAAA,iBAAS,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAEzD,gDAAgD;QAChD,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,IAAA,mBAAU,GAAE,CAAC;YAC9B,MAAM,UAAU,GAAG;gBACjB,GAAG,OAAO;gBACV;oBACE,IAAI,EAAE,gBAAgB;oBACtB,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,aAAa;iBAC/B;aACF,CAAC;YAEF,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC9C,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;gBAC7C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE;oBAC/B,MAAM,EAAE,GAAG;oBACX,OAAO;oBACP,OAAO;oBACP,IAAI,EAAE,qBAAqB;iBAC5B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC,CAAC;AApDW,QAAA,QAAQ,YAoDnB"}
+{"version":3,"file":"withCSRF.js","sourceRoot":"","sources":["../../src/middleware/withCSRF.ts"],"names":[],"mappings":";;;AAEA,oCAAwD;AACxD,mCAAoC;AACpC,gDAAoD;AAEpD,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAoB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;IACxE,MAAM,wBAAwB,GAAG,8CAA8C,CAAC;IAChF,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;IAErE,OAAO,CACL,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACnC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACnC,CAAC;AACJ,CAAC;AAEM,MAAM,QAAQ,GAAG,GAAe,EAAE;IACvC,OAAO,KAAK,EAAE,OAAoB,EAAE,OAA0B,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAI9C,CAAC;QAEF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;QAC7C,MAAM,UAAU,GACd,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC;QAEhE,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oCAAoC;QACpC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,IAAA,iBAAS,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAEzD,gDAAgD;QAChD,IAAI,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,IAAA,mBAAU,GAAE,CAAC;YAC9B,MAAM,cAAc,GAAG,IAAA,yBAAiB,EAAC,OAAO,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG;gBACjB,GAAG,OAAO;gBACV;oBACE,IAAI,EAAE,gBAAgB;oBACtB,KAAK,EAAE,QAAQ;oBACf,GAAG,cAAc;oBACjB,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,aAAa;iBAC/B;aACF,CAAC;YAEF,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC9C,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;gBAC7C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE;oBAC/B,MAAM,EAAE,GAAG;oBACX,OAAO;oBACP,OAAO;oBACP,IAAI,EAAE,qBAAqB;iBAC5B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC,CAAC;AAzDW,QAAA,QAAQ,YAyDnB"}

dist/middleware/withSession.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"withSession.d.ts","sourceRoot":"","sources":["../../src/middleware/withSession.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIjD,eAAO,MAAM,WAAW,EAAE,UAezB,CAAC"}
+{"version":3,"file":"withSession.d.ts","sourceRoot":"","sources":["../../src/middleware/withSession.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIjD,eAAO,MAAM,WAAW,EAAE,UAiBzB,CAAC"}

dist/middleware/withSession.js

@@ -7,3 +7,5 @@ "use strict";
     const { cookies } = (0, index_js_1.getExtraOutputs)(context);
-    const session = (0, index_js_1.ensureSession)(req);
+    const session = (0, index_js_1.ensureSession)(req, {
+        cookieOptions: (0, index_js_1.getCookieSecurity)(req),
+    });
     if (session.isNew && session.cookie) {
@@ -10,0 +12,0 @@ const newCookies = [...cookies, session.cookie];

dist/middleware/withSession.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"withSession.js","sourceRoot":"","sources":["../../src/middleware/withSession.ts"],"names":[],"mappings":";;;AAGA,gDAAmE;AAE5D,MAAM,WAAW,GAAe,KAAK,EAC1C,GAAgB,EAChB,OAA0B,EAC1B,EAAE;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAA,wBAAa,EAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAExD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAfW,QAAA,WAAW,eAetB"}
+{"version":3,"file":"withSession.js","sourceRoot":"","sources":["../../src/middleware/withSession.ts"],"names":[],"mappings":";;;AAGA,gDAAsF;AAE/E,MAAM,WAAW,GAAe,KAAK,EAC1C,GAAgB,EAChB,OAA0B,EAC1B,EAAE;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAA,wBAAa,EAAC,GAAG,EAAE;QACjC,aAAa,EAAE,IAAA,4BAAiB,EAAC,GAAG,CAAC;KACtC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAExD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAjBW,QAAA,WAAW,eAiBtB"}

dist/utils/index.d.ts

@@ -10,2 +10,3 @@ export * from "./cookies.js";
 export * from "./session.js";
+export * from "./cookie-security.js";
 //# sourceMappingURL=index.d.ts.map

dist/utils/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC"}

dist/utils/index.js

@@ -26,2 +26,3 @@ "use strict";
 __exportStar(require("./session.js"), exports);
+__exportStar(require("./cookie-security.js"), exports);
 //# sourceMappingURL=index.js.map

dist/utils/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,6CAA2B;AAC3B,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,+CAA6B;AAC7B,0DAAwC;AACxC,kDAAgC;AAChC,+CAA6B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,6CAA2B;AAC3B,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,+CAA6B;AAC7B,0DAAwC;AACxC,kDAAgC;AAChC,+CAA6B;AAC7B,uDAAqC"}

package.json

 {
   "name": "@plasius/api",
-  "version": "1.0.10",
+  "version": "1.0.11",
   "description": "Generic public API security and middleware helpers.",
@@ -49,2 +49,3 @@ "private": false,
     "audit:test": "vitest run --coverage",
+    "audit:all": "npm run typecheck && npm run audit:eslint && npm run audit:deps && npm run audit:npm && npm run audit:test",
     "lint": "eslint . --max-warnings=0",
@@ -51,0 +52,0 @@ "pack:check": "node scripts/verify-public-package.cjs",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Improved metrics

Total package byte prevSize

141249

8.28%

Number of package files

111

3.74%

Lines of code

1141

12.75%

Worsened metrics

Number of low supply chain risk alerts

12

33.33%

No dependency changes