Turnstile Test Page

\r\n

\r\n \r\n

\r\n \r\n \r\n\r\n`;\r\n\r\n // Return as plain text since OpenAPI will handle response formatting\r\n return html;\r\n}\r\n\r\nimport { getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS } from \"../utils/dateUtils.ts\";\r\n\r\nexport async function healthCheck(ctx: BusinessLogicContext) {\r\n return {\r\n status: \"healthy\",\r\n timestamp: getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS(),\r\n version: \"1.0.0\",\r\n };\r\n}\r\n",[],[175,299,305],{"_105":314,"_96":315,"_157":316,"_159":300,"_160":142,"_161":317,"_163":22,"_107":318,"_101":319,"_165":194,"_167":320,"_168":22,"_169":-5,"_170":321,"_99":322},"650ba26c-5fcf-11f0-a74b-0224a6c84d84","docsHandler.ts","b8afbbb4-5abc-11f0-abfd-f69ea79377d9",814,["D",1752400480647],11,"/**\r\n * Documentation Handler - Serves dynamic API documentation\r\n * Uses OpenAPI loader system to generate documentation pages with advanced Swagger UI features\r\n */\r\nimport { OpenAPILoader } from \"../utils/openApiLoader.ts\";\r\n\r\nexport class DocsHandler {\r\n private static loader: OpenAPILoader | null = null;\r\n \r\n /**\r\n * Set the OpenAPI loader instance (called by API Gateway)\r\n */\r\n static setLoader(loader: OpenAPILoader): void {\r\n this.loader = loader;\r\n }\r\n /**\r\n * Serves enhanced API documentation using latest Swagger UI\r\n * Features: Request snippets, OAuth2, custom theming, error handling, deep linking\r\n */\r\n static serveSwaggerDocs(request: Request): Response {\r\n // Check if loader is available\r\n if (!this.loader) {\r\n throw new Error(\"OpenAPI loader not initialized. DocsHandler.setLoader() must be called first.\");\r\n }\r\n\r\n const url = new URL(request.url);\r\n // Use the direct API Gateway endpoint that serves the spec directly\r\n const specUrl = `${url.origin}/api/v1/openapi.json`;\r\n\r\n console.log(`Swagger UI will fetch OpenAPI spec from: ${specUrl}`);\r\n const oauthRedirectUrl = `${url.origin}/docs/oauth2-redirect.html`;\r\n\r\n // Get the title from OpenAPI spec or use default\r\n const apiTitle = \"🛡️ ZenPay API Documentation 📚\";\r\n const apiTitleEscaped = JSON.stringify(apiTitle).slice(1, -1); // Remove the quotes that JSON.stringify adds\r\n\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n ${apiTitle}\r\n \r\n \r\n \r\n \r\n\r\n\r\n

\r\n

Loading API Documentation...

\r\n

\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n // Security headers handled by middleware\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n }\r\n\r\n /**\r\n * Serves OAuth2 redirect page for Swagger UI authentication\r\n */\r\n static serveOAuth2Redirect(): Response {\r\n const html = `\r\n\r\n\r\n\r\n \r\n OAuth2 Redirect\r\n\r\n\r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=86400\", // Cache for 24 hours\r\n },\r\n });\r\n }\r\n\r\n /**\r\n * Serves Redocly-style documentation with enhanced features\r\n */\r\n static serveRedocDocs(request: Request): Response {\r\n try {\r\n const url = new URL(request.url);\r\n const specUrl = `${url.origin}/api/v1/openapi.json`;\r\n console.log(`Redoc will fetch OpenAPI spec from: ${specUrl}`);\r\n\r\n const title = \"🛡️ ZenPay API Documentation 📚\";\r\n\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n ${title}\r\n \r\n \r\n\r\n\r\n

Loading API Documentation...

\r\n \r\n \r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n // Security headers handled by middleware\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n } catch (error) {\r\n // Return error page\r\n const errorHtml = `\r\n\r\n\r\n\r\n \r\n \r\n API Documentation Error\r\n \r\n\r\n\r\n

\r\n

API Documentation Unavailable

\r\n

The API documentation could not be loaded at this time.

\r\n

\r\n Error: ${error.message}\r\n

\r\n

This usually happens when:

\r\n

The OpenAPI specification file is not accessible
The server is still initializing
There's a configuration error

\r\n \r\n

\r\n\r\n`;\r\n\r\n return new Response(errorHtml, {\r\n status: 500,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n // Security headers handled by middleware\r\n },\r\n });\r\n }\r\n }\r\n\r\n /**\r\n * Serves interactive Fiberplane playground for API testing\r\n */\r\n static async serveFiberplanePlayground(request: Request): Promise {\r\n try {\r\n // Use the loader instance that was set by API Gateway\r\n if (!this.loader) {\r\n throw new Error(\"OpenAPI loader not initialized. DocsHandler.setLoader() must be called first.\");\r\n }\r\n\r\n // Get OpenAPI spec directly from loader (no HTTP request needed)\r\n const openApiSpec = this.loader.getSpec();\r\n\r\n const title = \"🛡️ ZenPay API Playground ⚔️\";\r\n\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n ${title}\r\n \r\n\r\n\r\n

\r\n

${title}

\r\n

Interactive API Testing Environment

\r\n

\r\n \r\n

\r\n

API Endpoints

\r\n

Loading API endpoints...

\r\n

\r\n \r\n

\r\n

Request Builder

\r\n

Select an endpoint from the left to start building a request.

\r\n

\r\n \r\n

\r\n

Response

\r\n

Ready to send requests...

\r\n

\r\n\r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n // Security headers handled by middleware\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n } catch (error) {\r\n console.error(\"Error in serveFiberplanePlayground:\", error);\r\n\r\n const errorHtml = `\r\n\r\n\r\n\r\n \r\n \r\n Playground Error\r\n \r\n\r\n\r\n

\r\n

API Playground Unavailable

\r\n

The API playground could not be loaded at this time.

\r\n

\r\n Error: ${error.message}\r\n

\r\n

This usually happens when:

\r\n

The OpenAPI specification file is not accessible
The server is still initializing
There's a configuration error

\r\n \r\n

\r\n\r\n`;\r\n\r\n return new Response(errorHtml, {\r\n status: 500,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n // Security headers handled by middleware\r\n },\r\n });\r\n }\r\n }\r\n}\r\n",[],[175,299,315],{"_105":324,"_96":325,"_157":326,"_159":300,"_160":142,"_161":327,"_163":22,"_107":328,"_101":230,"_165":194,"_167":329,"_168":22,"_169":-5,"_170":330,"_99":331},"72e0280c-5f59-11f0-88f0-0224a6c84d84","dynamicHandler.ts","49156b8c-5e6d-11f0-b051-0224a6c84d84",720,["D",1752349823227],"/**\r\n * Dynamic Handler System\r\n *\r\n * This creates a truly dynamic system where:\r\n * 1. OpenAPI handles ALL validation automatically\r\n * 2. Handler routing is automatic based on operationId\r\n * 3. Business logic is separated from HTTP handling\r\n * 4. Adding new endpoints requires NO code changes here\r\n */\r\n\r\n// Note: AppContext type should be Context from Hono\r\ntype AppContext = any;\r\nimport * as businessLogic from \"./businessLogic.ts\";\r\n\r\ninterface HandlerContext {\r\n request: Request;\r\n context: AppContext;\r\n operationId: string;\r\n validatedData?: any;\r\n}\r\n\r\n/**\r\n * Universal Dynamic Handler\r\n *\r\n * This single handler can process ANY OpenAPI operation:\r\n * - Request validation: ✅ Done by OpenAPI middleware\r\n * - Response validation: ✅ Done by OpenAPI middleware\r\n * - Parameter parsing: ✅ Done by OpenAPI middleware\r\n * - Handler routing: ✅ Done dynamically here\r\n * - Business logic: ✅ Delegated to business logic modules\r\n */\r\nexport async function dynamicHandler({\r\n request,\r\n context,\r\n operationId,\r\n validatedData,\r\n}: HandlerContext): Promise {\r\n try {\r\n // Convert operationId to function name (camelCase)\r\n const handlerName = operationId;\r\n\r\n // Get the business logic function\r\n const businessLogicFunction = (businessLogic as any)[handlerName];\r\n\r\n if (!businessLogicFunction) {\r\n console.warn(`No business logic found for operation: ${operationId}`);\r\n return new Response(\r\n JSON.stringify({ error: `Handler not implemented: ${operationId}` }),\r\n { status: 501, headers: { \"Content-Type\": \"application/json\" } }\r\n );\r\n }\r\n\r\n // Call business logic with extracted data from createRouteHandler\r\n const result = await businessLogicFunction({\r\n // Data extracted by OpenAPI loader\r\n body: validatedData?.body,\r\n params: validatedData?.params,\r\n query: validatedData?.query,\r\n headers: validatedData?.headers,\r\n\r\n // Context\r\n db: context.get(\"db\"),\r\n correlationId: context.get(\"debugCorrelationId\"),\r\n request: request,\r\n\r\n // Raw context for advanced usage\r\n context: context,\r\n });\r\n\r\n // Business logic returns either:\r\n // 1. A Response object (for custom responses)\r\n // 2. { redirect: \"/path\" } object (for redirects)\r\n // 3. { data, status, headers } object\r\n // 4. Data object (for JSON responses)\r\n if (result instanceof Response) {\r\n return result;\r\n }\r\n\r\n if (result && typeof result === \"object\" && \"redirect\" in result) {\r\n return new Response(null, {\r\n status: 302,\r\n headers: { Location: result.redirect },\r\n });\r\n }\r\n\r\n if (result && typeof result === \"object\" && \"data\" in result) {\r\n // Check if CSRF session needs to be set\r\n if (result.csrfSession) {\r\n const { setCSRFCookies } = await import(\"../utils/cookies.ts\");\r\n const response = context.json(result.data, result.status || 200, result.headers);\r\n return setCSRFCookies(response, result.csrfSession);\r\n }\r\n return context.json(result.data, result.status || 200, result.headers);\r\n }\r\n\r\n return context.json(result);\r\n } catch (error) {\r\n console.error(`Error in dynamic handler for ${operationId}:`, error);\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"Internal server error\",\r\n operationId: operationId,\r\n message: error.message,\r\n }),\r\n {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n );\r\n }\r\n}\r\n\r\n/**\r\n * Auto-Generate Handler Map\r\n *\r\n * This function automatically creates a handler map for ANY OpenAPI spec\r\n * by analyzing the operationIds and creating dynamic handlers for each\r\n */\r\nexport function createDynamicHandlerMap(operationIds: string[]) {\r\n const handlerMap: Record = {};\r\n\r\n for (const operationId of operationIds) {\r\n handlerMap[operationId] = ({\r\n request,\r\n context,\r\n params,\r\n query,\r\n body,\r\n headers,\r\n }: any) => {\r\n return dynamicHandler({\r\n request,\r\n context,\r\n operationId,\r\n validatedData: { params, query, body, headers },\r\n });\r\n };\r\n }\r\n\r\n return handlerMap;\r\n}\r\n\r\n/**\r\n * Extract Operation IDs from OpenAPI Spec\r\n */\r\nexport function extractOperationIds(openApiSpec: any): string[] {\r\n const operationIds: string[] = [];\r\n\r\n if (!openApiSpec.paths) return operationIds;\r\n\r\n for (const path in openApiSpec.paths) {\r\n const pathObj = openApiSpec.paths[path];\r\n\r\n for (const method in pathObj) {\r\n if (pathObj[method]?.operationId) {\r\n operationIds.push(pathObj[method].operationId);\r\n }\r\n }\r\n }\r\n\r\n return operationIds;\r\n}\r\n",[],[175,299,325],{"_105":333,"_96":334,"_157":335,"_159":300,"_160":142,"_161":336,"_163":22,"_107":337,"_101":177,"_165":194,"_167":338,"_168":22,"_169":-5,"_170":339,"_99":340},"17d40b7c-5fcc-11f0-a36e-0224a6c84d84","errorHandler.ts","49189b0e-5e6d-11f0-a473-0224a6c84d84",805,["D",1752399062539],"// ==================================================\r\n// SECTION: Global Error Handler\r\n// ==================================================\r\n\r\nimport { logger } from \"../utils/logger.ts\";\r\n\r\n/**\r\n * Global error handler for Hono/Deno apps.\r\n * Usage: app.onError(globalErrorHandler)\r\n */\r\nexport function globalErrorHandler(err: unknown, c: any) {\r\n const correlationId = c.get?.(\"debugCorrelationId\");\r\n if (correlationId) {\r\n logger.error(`[ERROR][${correlationId}]`, err);\r\n } else {\r\n logger.error(\"[ERROR]\", err);\r\n }\r\n\r\n const status = 500;\r\n if (err instanceof Response) return err;\r\n\r\n const showStack = Deno.env.get(\"ENV\") === \"dev\";\r\n\r\n let stack: string | undefined = undefined;\r\n let message: string | undefined = undefined;\r\n if (showStack && typeof err === \"object\" && err !== null) {\r\n if (\"stack\" in err && typeof (err as { stack?: unknown }).stack === \"string\") {\r\n stack = (err as { stack: string }).stack;\r\n }\r\n if (\"message\" in err && typeof (err as { message?: unknown }).message === \"string\") {\r\n message = (err as { message: string }).message;\r\n }\r\n }\r\n\r\n return c.json(\r\n {\r\n error: \"Internal server error\",\r\n ...(showStack && { stack, message }),\r\n },\r\n status\r\n );\r\n}\r\n",[],[175,299,334],{"_105":342,"_96":343,"_157":344,"_159":300,"_160":142,"_161":345,"_163":22,"_107":346,"_101":177,"_165":194,"_167":347,"_168":22,"_169":-5,"_170":348,"_99":349},"8f8e46fa-5fb3-11f0-805f-0224a6c84d84","fallbackHandler.ts","492c3696-5e6d-11f0-afd9-0224a6c84d84",782,["D",1752388526052],"/**\n * Fallback Handler - Provides graceful error handling when the OpenAPI specification fails to load.\n * This handler is registered when the OpenAPILoader encounters a critical error during initialization.\n */\nimport { OpenAPIHono } from \"npm:@hono/zod-openapi\";\nimport { environment } from \"../config/environment.ts\";\nimport { Database } from \"../database/database.ts\";\n\ninterface AppEnv {\n Variables: {\n db: Database;\n debugCorrelationId: string;\n };\n}\n\n/**\n * Creates and registers a fallback handler on the Hono app instance.\n * This handler catches all requests and returns a user-friendly error page\n * or a JSON error, depending on the request path.\n *\n * @param app The Hono app instance to register the handler on.\n * @param loaderError The error that occurred during OpenAPI loader initialization.\n */\nexport function registerFallbackHandler(\n app: OpenAPIHono<{ Variables: AppEnv[\"Variables\"] }>,\n loaderError: Error\n) {\n app.all(\"*\", (c) => {\n const path = new URL(c.req.url).pathname;\n\n // For root, /api, or /api/v1, serve a detailed HTML error page\n if (path === \"/\" || path === \"/api\" || path === \"/api/v1\") {\n return c.html(\n `\n \n \n \n API Server - Configuration Error\n \n \n \n

🚨 API Server Configuration Error

\n INITIALIZATION FAILED\n \n

\n Error: ${loaderError?.message || \"Unknown error\"}\n

\n \n

What happened?

The server failed to load the OpenAPI specification during startup. This prevents the API from functioning properly.

\n \n

Common causes:

Environment variables not set correctly - Check OPENAPI_BLOB_KEY and OPENAPI_PUBLIC_URL
OpenAPI spec file not accessible - Verify the URL is correct and publicly accessible
Network connectivity issues - The server couldn't fetch the spec from the URL
Invalid OpenAPI specification - The spec file might have syntax errors

\n \n

Current Configuration:

APP_ENV: ${environment.APP_ENV}\n              OPENAPI_BLOB_KEY: ${environment.OPENAPI_BLOB_KEY || \"(not set)\"}\n              OPENAPI_PUBLIC_URL: ${environment.OPENAPI_PUBLIC_URL || \"(not set)\"}

\n \n

How to fix:

Check your Val Town environment variables
Ensure OPENAPI_BLOB_KEY is set to a valid key (e.g., \"openapi-spec\")
Ensure OPENAPI_PUBLIC_URL points to your OpenAPI JSON file
Verify the OpenAPI file is accessible by opening the URL in a browser
Check the server logs for more detailed error information

\n \n \n `,\n 500\n );\n }\n\n // For all other API paths, return a JSON error\n return c.json(\n {\n error: \"Server initialization failed\",\n message: \"The OpenAPI specification could not be loaded\",\n details: loaderError?.message || \"Unknown error\",\n path: path,\n timestamp: new Date().toISOString(),\n },\n 500\n );\n });\n}\n",[],[175,299,343],[175,299],{"_105":352,"_96":353,"_157":354,"_159":176,"_160":142,"_161":355,"_163":119,"_107":356,"_101":32,"_165":166,"_167":-5,"_168":22,"_169":-5,"_170":357,"_99":459},"9e985f7a-58a9-11f0-bc5c-f69ea79377d9","middleware","9e986038-58a9-11f0-bc5c-f69ea79377d9",6,["D",1751614598193],[358,367,376,386,395,405,414,423,432,441,450],{"_105":359,"_96":360,"_157":361,"_159":354,"_160":142,"_161":362,"_163":119,"_107":363,"_101":230,"_165":194,"_167":364,"_168":22,"_169":-5,"_170":365,"_99":366},"49f0bf66-5e6d-11f0-b4d7-0224a6c84d84","basicAuth.ts","ca99c48a-5c67-11f0-b675-0224a6c84d84",599,["D",1752248393335],"/**\r\n * Basic Authentication Middleware using Hono's built-in basicAuth\r\n * Provides HTTP Basic Authentication for admin and webhook endpoints\r\n */\r\n\r\nimport { basicAuth } from \"npm:hono/basic-auth\";\r\nimport type { Context } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\n\r\n/**\r\n * Creates basic auth middleware for admin endpoints\r\n * Uses environment variables for credentials\r\n */\r\nexport function createBasicAuthMiddleware() {\r\n return basicAuth({\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n realm: \"ZenServer Admin Area\",\r\n invalidUserMessage: {\r\n error: \"Unauthorized\",\r\n message: \"Invalid username or password\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware with custom user verification\r\n * Allows for dynamic user validation against database or external service\r\n */\r\nexport function createDynamicBasicAuthMiddleware(\r\n verifyUser: (\r\n username: string,\r\n password: string,\r\n c: Context\r\n ) => boolean | Promise\r\n) {\r\n return basicAuth({\r\n verifyUser: async (username: string, password: string, c: Context) => {\r\n try {\r\n const isValid = await verifyUser(username, password, c);\r\n\r\n if (!isValid) {\r\n logger.warn(\"Basic auth failed\", {\r\n username,\r\n ip: getClientIP(c),\r\n userAgent: c.req.header(\"user-agent\"),\r\n });\r\n }\r\n\r\n return isValid;\r\n } catch (error) {\r\n logger.error(\"Basic auth verification error\", {\r\n error: error.message,\r\n username,\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer Secure Area\",\r\n invalidUserMessage: {\r\n error: \"Authentication failed\",\r\n message: \"Invalid credentials\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware for webhook endpoints\r\n * Uses webhook-specific credentials\r\n */\r\nexport function createWebhookBasicAuthMiddleware() {\r\n return basicAuth({\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n realm: \"ZenServer Webhook Area\",\r\n invalidUserMessage: {\r\n error: \"Webhook authentication failed\",\r\n message: \"Invalid webhook credentials\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware supporting multiple users\r\n * Useful for different admin roles or service accounts\r\n */\r\nexport function createMultiUserBasicAuthMiddleware() {\r\n const adminUsers = [\r\n {\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n },\r\n ];\r\n\r\n return basicAuth(\r\n {\r\n realm: \"ZenServer Admin Area\",\r\n invalidUserMessage: {\r\n error: \"Access denied\",\r\n message: \"Invalid admin credentials\",\r\n },\r\n ...adminUsers[0],\r\n },\r\n ...adminUsers.slice(1)\r\n );\r\n}\r\n\r\n/**\r\n * Default basic auth middleware for general admin access\r\n */\r\nexport const basicAuthMiddleware = createBasicAuthMiddleware();\r\n",[],[175,353,360],{"_105":368,"_96":369,"_157":370,"_159":354,"_160":142,"_161":371,"_163":119,"_107":372,"_101":184,"_165":194,"_167":373,"_168":22,"_169":-5,"_170":374,"_99":375},"49f672e4-5e6d-11f0-b051-0224a6c84d84","bearerAuth.ts","caa96d5e-5c67-11f0-bbdb-0224a6c84d84",600,["D",1752248393365],"/**\r\n * Bearer Authentication Middleware using Hono's built-in bearerAuth\r\n * Provides Bearer token authentication for API endpoints\r\n * Supports both static tokens and dynamic token verification\r\n */\r\n\r\nimport { bearerAuth } from \"npm:hono/bearer-auth\";\r\nimport type { Context } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { AuthService } from \"../services/authService.ts\";\r\nimport { Database } from \"../database/database.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\n\r\n/**\r\n * Creates bearer auth middleware for API endpoints\r\n * Uses static API key from environment\r\n */\r\nexport function createBearerAuthMiddleware() {\r\n const apiKey = environment.MASTER_KEY;\r\n return bearerAuth({\r\n token: apiKey,\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Invalid API key\",\r\n message: \"Bearer token authentication failed\",\r\n },\r\n noAuthenticationHeaderMessage: {\r\n error: \"Missing authentication\",\r\n message: \"Bearer token required in Authorization header\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware with custom token verification\r\n * Integrates with AuthService for dynamic token validation\r\n */\r\nexport function createDynamicBearerAuthMiddleware(\r\n verifyToken: (token: string, c: Context) => boolean | Promise\r\n) {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n try {\r\n const isValid = await verifyToken(token, c);\r\n\r\n if (!isValid) {\r\n logger.warn(\"Bearer auth failed\", {\r\n token: token.substring(0, 8) + \"...\",\r\n ip: getClientIP(c),\r\n userAgent: c.req.header(\"user-agent\"),\r\n });\r\n }\r\n\r\n return isValid;\r\n } catch (error) {\r\n logger.error(\"Bearer auth verification error\", {\r\n error: error.message,\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Token verification failed\",\r\n message: \"Invalid or expired bearer token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware using AuthService validation\r\n * Integrates with existing AuthService.validateApiKey logic\r\n */\r\nexport function createAuthServiceBearerMiddleware() {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n // Create a mock request with the token in Authorization header\r\n const mockRequest = new Request(c.req.url, {\r\n headers: {\r\n Authorization: `Bearer ${token}`,\r\n \"x-forwarded-for\": c.req.header(\"x-forwarded-for\") || \"\",\r\n \"user-agent\": c.req.header(\"user-agent\") || \"\",\r\n },\r\n });\r\n\r\n const validation = AuthService.validateApiKey(mockRequest);\r\n return validation.valid;\r\n },\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"API authentication failed\",\r\n message: \"Invalid API key provided\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware with multiple token support\r\n * Useful for different access levels (read/write permissions)\r\n */\r\nexport function createMultiTokenBearerAuthMiddleware() {\r\n const tokens = [\r\n environment.MASTER_KEY,\r\n environment.WEBHOOK_SECRET,\r\n environment.VALTOWN_TOKEN,\r\n ].filter(Boolean); // Remove undefined values\r\n\r\n return bearerAuth({\r\n token: tokens,\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Access denied\",\r\n message: \"Invalid API token provided\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware for webhook endpoints\r\n * Uses webhook-specific token validation\r\n */\r\nexport function createWebhookBearerAuthMiddleware() {\r\n return bearerAuth({\r\n token: environment.WEBHOOK_SECRET,\r\n realm: \"ZenServer Webhook API\",\r\n invalidTokenMessage: {\r\n error: \"Webhook authentication failed\",\r\n message: \"Invalid webhook bearer token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware for booking token validation\r\n * Integrates with booking token system\r\n */\r\nexport function createBookingTokenBearerAuthMiddleware() {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n try {\r\n const db = c.get(\"db\") as Database;\r\n if (!db) {\r\n logger.error(\"Database not available in booking token auth\");\r\n return false;\r\n }\r\n\r\n const validation = await AuthService.validateBookingToken(db, token);\r\n\r\n if (validation.valid && validation.bookingId) {\r\n // Store booking ID in context for use in handlers\r\n c.set(\"bookingId\", validation.bookingId);\r\n return true;\r\n }\r\n\r\n return false;\r\n } catch (error) {\r\n logger.error(\"Booking token verification error\", {\r\n error: error.message,\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer Booking API\",\r\n invalidTokenMessage: {\r\n error: \"Booking token invalid\",\r\n message: \"Invalid or expired booking token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Default bearer auth middleware for general API access\r\n */\r\nexport const bearerAuthMiddleware = createBearerAuthMiddleware();\r\n\r\n/**\r\n * AuthService-integrated bearer auth middleware\r\n */\r\nexport const authServiceBearerMiddleware = createAuthServiceBearerMiddleware();\r\n",[],[175,353,369],{"_105":377,"_96":378,"_157":379,"_159":354,"_160":142,"_161":380,"_163":22,"_107":381,"_101":382,"_165":194,"_167":383,"_168":22,"_169":-5,"_170":384,"_99":385},"2fd29502-5f5b-11f0-8d6d-0224a6c84d84","cors.ts","9fe0a658-58a9-11f0-b6a5-f69ea79377d9",727,["D",1752350569738],17,"import { environment } from \"../config/environment.ts\";\r\nimport { logWarn } from \"../utils/logger.ts\";\r\nimport { logSecurityCheck } from \"./debugger.ts\";\r\n\r\nconst ALLOWED_ORIGINS = environment.ALLOWED_ORIGINS;\r\nconst ALLOWED_METHODS = [\"GET\", \"POST\", \"OPTIONS\"];\r\nconst ALLOWED_HEADERS = environment.ALLOWED_HEADERS;\r\n\r\nexport function corsMiddleware(\r\n request: Request,\r\n correlationId?: string\r\n): Response | null {\r\n const origin = request.headers.get(\"origin\");\r\n const method = request.method;\r\n const ip =\r\n request.headers.get(\"cf-connecting-ip\") ||\r\n request.headers.get(\"x-forwarded-for\") ||\r\n \"unknown\";\r\n\r\n // Debug security checks\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"CORS Origin Check\",\r\n \"Validating request origin against allowed origins\",\r\n true,\r\n {\r\n origin,\r\n allowedOrigins: ALLOWED_ORIGINS,\r\n method,\r\n }\r\n );\r\n }\r\n\r\n // Handle preflight requests\r\n if (method === \"OPTIONS\") {\r\n // Check if origin is allowed\r\n const originAllowed = origin && ALLOWED_ORIGINS.includes(origin);\r\n\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"CORS Preflight Check\",\r\n \"Handling OPTIONS preflight request\",\r\n originAllowed,\r\n {\r\n origin,\r\n originAllowed,\r\n allowedMethods: ALLOWED_METHODS,\r\n allowedHeaders: ALLOWED_HEADERS,\r\n }\r\n );\r\n }\r\n\r\n const headers = new Headers();\r\n\r\n if (originAllowed) {\r\n headers.set(\"Access-Control-Allow-Origin\", origin);\r\n headers.set(\"Access-Control-Allow-Credentials\", \"true\");\r\n }\r\n // Don't set Access-Control-Allow-Origin for disallowed origins\r\n\r\n headers.set(\"Access-Control-Allow-Methods\", ALLOWED_METHODS.join(\", \"));\r\n headers.set(\"Access-Control-Allow-Headers\", ALLOWED_HEADERS.join(\", \"));\r\n headers.set(\"Access-Control-Max-Age\", \"86400\"); // 24 hours\r\n headers.set(\"Vary\", \"Origin\");\r\n\r\n return new Response(null, {\r\n status: 200,\r\n headers,\r\n });\r\n }\r\n\r\n // Validate origin for non-preflight requests\r\n if (origin && !ALLOWED_ORIGINS.includes(origin)) {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"CORS Origin Validation\",\r\n \"Origin not in allowed list - BLOCKED\",\r\n false,\r\n {\r\n origin,\r\n allowedOrigins: ALLOWED_ORIGINS,\r\n ip,\r\n userAgent: request.headers.get(\"user-agent\"),\r\n }\r\n );\r\n }\r\n\r\n logWarn(`CORS violation - invalid origin ${origin} - ip: ${ip}`);\r\n return new Response(JSON.stringify({ error: \"CORS policy violation\" }), {\r\n status: 403,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n });\r\n }\r\n\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"CORS Validation Passed\",\r\n \"Request origin is allowed\",\r\n true,\r\n {\r\n origin: origin || \"no-origin\",\r\n ip,\r\n }\r\n );\r\n }\r\n\r\n // Allow the request to continue\r\n return null;\r\n}\r\n\r\n// export function addCorsHeaders(response: Response, origin?: string): Response {\r\n// const headers = new Headers(response.headers);\r\n\r\n// if (origin && ALLOWED_ORIGINS.includes(origin)) {\r\n// headers.set(\"Access-Control-Allow-Origin\", origin);\r\n// } else if (origin) {\r\n// // Don't set CORS headers for disallowed origins\r\n// // This is more secure than defaulting to first allowed origin\r\n// return response;\r\n// } else {\r\n// // No origin header - likely a non-browser request\r\n// headers.set(\"Access-Control-Allow-Origin\", \"*\");\r\n// }\r\n\r\n// headers.set(\"Access-Control-Allow-Credentials\", \"true\");\r\n// headers.set(\"Vary\", \"Origin\");\r\n\r\n// return new Response(response.body, {\r\n// status: response.status,\r\n// statusText: response.statusText,\r\n// headers\r\n// });\r\n// }\r\n",[],[175,353,378],{"_105":387,"_96":388,"_157":389,"_159":354,"_160":142,"_161":390,"_163":119,"_107":391,"_101":32,"_165":194,"_167":392,"_168":22,"_169":-5,"_170":393,"_99":394},"4933f19c-5e6d-11f0-b051-0224a6c84d84","csp.ts","4933f26e-5e6d-11f0-b051-0224a6c84d84",583,["D",1752248392102],"/**\r\n * Content Security Policy (CSP) middleware for ZenServer\r\n * Provides centralized CSP configuration and header management\r\n */\r\n\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\n// CSP directive configuration\r\ninterface CSPDirectives {\r\n defaultSrc: string[];\r\n scriptSrc: string[];\r\n styleSrc: string[];\r\n imgSrc: string[];\r\n connectSrc: string[];\r\n fontSrc: string[];\r\n objectSrc: string[];\r\n mediaSrc: string[];\r\n frameSrc: string[];\r\n childSrc: string[];\r\n workerSrc: string[];\r\n manifestSrc: string[];\r\n baseUri: string[];\r\n formAction: string[];\r\n frameAncestors: string[];\r\n upgradeInsecureRequests: boolean;\r\n blockAllMixedContent: boolean;\r\n}\r\n\r\n// Default CSP configuration\r\nconst defaultCSPDirectives: CSPDirectives = {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile\r\n \"https://payuat.travelpay.com.au\" // Zenpay payment gateway\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"https://payuat.travelpay.com.au\", // Zenpay payment gateway styles\r\n \"'unsafe-inline'\" // Allow inline styles (consider removing in production)\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\", // Allow data URLs for images\r\n \"https:\", // Allow HTTPS images\r\n \"https://images.unsplash.com\" // Unsplash for tour images\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile API\r\n \"https://payuat.travelpay.com.au\" // Zenpay payment gateway API\r\n ],\r\n fontSrc: [\r\n \"'self'\",\r\n \"https:\", // Allow HTTPS fonts\r\n \"data:\" // Allow data URL fonts\r\n ],\r\n objectSrc: [\"'none'\"], // Disable object/embed/applet\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\" // Cloudflare Turnstile iframe\r\n ],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"], // Prevent clickjacking\r\n upgradeInsecureRequests: true, // Upgrade HTTP to HTTPS\r\n blockAllMixedContent: true // Block mixed content\r\n};\r\n\r\n// Development CSP configuration (more permissive)\r\nconst developmentCSPDirectives: Partial = {\r\n scriptSrc: [\r\n \"'self'\",\r\n \"'unsafe-eval'\", // Allow eval for dev tools\r\n \"'unsafe-inline'\", // Allow inline scripts for dev\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\"\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"'unsafe-inline'\", // Allow inline styles for dev\r\n \"https://payuat.travelpay.com.au\"\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"ws:\", // Allow WebSocket for dev servers\r\n \"wss:\", // Allow secure WebSocket\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\"\r\n ]\r\n};\r\n\r\n/**\r\n * Get CSP directives based on environment\r\n */\r\nfunction getCSPDirectives(): CSPDirectives {\r\n const baseDirectives = { ...defaultCSPDirectives };\r\n \r\n // Apply development overrides if not in production\r\n if (environment.APP_ENV !== \"prod\") {\r\n return {\r\n ...baseDirectives,\r\n ...developmentCSPDirectives\r\n };\r\n }\r\n \r\n return baseDirectives;\r\n}\r\n\r\n/**\r\n * Convert CSP directives object to CSP header string\r\n */\r\nfunction buildCSPHeader(directives: CSPDirectives): string {\r\n const policies: string[] = [];\r\n \r\n // Add directive-based policies\r\n if (directives.defaultSrc.length > 0) {\r\n policies.push(`default-src ${directives.defaultSrc.join(' ')}`);\r\n }\r\n if (directives.scriptSrc.length > 0) {\r\n policies.push(`script-src ${directives.scriptSrc.join(' ')}`);\r\n }\r\n if (directives.styleSrc.length > 0) {\r\n policies.push(`style-src ${directives.styleSrc.join(' ')}`);\r\n }\r\n if (directives.imgSrc.length > 0) {\r\n policies.push(`img-src ${directives.imgSrc.join(' ')}`);\r\n }\r\n if (directives.connectSrc.length > 0) {\r\n policies.push(`connect-src ${directives.connectSrc.join(' ')}`);\r\n }\r\n if (directives.fontSrc.length > 0) {\r\n policies.push(`font-src ${directives.fontSrc.join(' ')}`);\r\n }\r\n if (directives.objectSrc.length > 0) {\r\n policies.push(`object-src ${directives.objectSrc.join(' ')}`);\r\n }\r\n if (directives.mediaSrc.length > 0) {\r\n policies.push(`media-src ${directives.mediaSrc.join(' ')}`);\r\n }\r\n if (directives.frameSrc.length > 0) {\r\n policies.push(`frame-src ${directives.frameSrc.join(' ')}`);\r\n }\r\n if (directives.childSrc.length > 0) {\r\n policies.push(`child-src ${directives.childSrc.join(' ')}`);\r\n }\r\n if (directives.workerSrc.length > 0) {\r\n policies.push(`worker-src ${directives.workerSrc.join(' ')}`);\r\n }\r\n if (directives.manifestSrc.length > 0) {\r\n policies.push(`manifest-src ${directives.manifestSrc.join(' ')}`);\r\n }\r\n if (directives.baseUri.length > 0) {\r\n policies.push(`base-uri ${directives.baseUri.join(' ')}`);\r\n }\r\n if (directives.formAction.length > 0) {\r\n policies.push(`form-action ${directives.formAction.join(' ')}`);\r\n }\r\n if (directives.frameAncestors.length > 0) {\r\n policies.push(`frame-ancestors ${directives.frameAncestors.join(' ')}`);\r\n }\r\n \r\n // Add boolean directives\r\n if (directives.upgradeInsecureRequests) {\r\n policies.push('upgrade-insecure-requests');\r\n }\r\n if (directives.blockAllMixedContent) {\r\n policies.push('block-all-mixed-content');\r\n }\r\n \r\n return policies.join('; ');\r\n}\r\n\r\n/**\r\n * Get the complete CSP header value\r\n */\r\nexport function getCSPHeader(): string {\r\n const directives = getCSPDirectives();\r\n return buildCSPHeader(directives);\r\n}\r\n\r\n/**\r\n * Get HSTS header value\r\n */\r\nexport function getHSTSHeader(): string {\r\n // More restrictive in production\r\n if (environment.APP_ENV === \"prod\") {\r\n return \"max-age=31536000; includeSubDomains; preload\";\r\n }\r\n // Less restrictive in development\r\n return \"max-age=3600; includeSubDomains\";\r\n}\r\n\r\n/**\r\n * Get all security headers as an object\r\n */\r\nexport function getSecurityHeaders(): Record {\r\n return {\r\n \"Content-Security-Policy\": getCSPHeader(),\r\n \"Strict-Transport-Security\": getHSTSHeader(),\r\n \"X-Content-Type-Options\": \"nosniff\",\r\n \"X-Frame-Options\": \"DENY\",\r\n \"X-XSS-Protection\": \"1; mode=block\",\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\"\r\n };\r\n}\r\n\r\n/**\r\n * Apply security headers to a Response object\r\n */\r\nexport function addSecurityHeaders(response: Response): Response {\r\n const headers = getSecurityHeaders();\r\n \r\n // Clone the response to avoid mutating the original\r\n const newResponse = new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers: new Headers(response.headers)\r\n });\r\n \r\n // Add security headers\r\n Object.entries(headers).forEach(([name, value]) => {\r\n newResponse.headers.set(name, value);\r\n });\r\n \r\n return newResponse;\r\n}\r\n\r\n/**\r\n * CSP middleware for Hono\r\n */\r\nexport function cspMiddleware() {\r\n return async (c: any, next: any) => {\r\n await next();\r\n \r\n // Add security headers to the response\r\n const securityHeaders = getSecurityHeaders();\r\n Object.entries(securityHeaders).forEach(([name, value]) => {\r\n c.res.headers.set(name, value);\r\n });\r\n };\r\n}\r\n\r\n// Export directives for testing and customization\r\nexport { getCSPDirectives, buildCSPHeader };\r\nexport type { CSPDirectives };",[],[175,353,388],{"_105":396,"_96":397,"_157":398,"_159":354,"_160":142,"_161":399,"_163":119,"_107":400,"_101":401,"_165":194,"_167":402,"_168":22,"_169":-5,"_170":403,"_99":404},"5f707fae-5fd3-11f0-835d-0224a6c84d84","csrf.ts","8c938ec6-5a93-11f0-a7b1-f69ea79377d9",819,["D",1752402189229],13,"/**\r\n * Comprehensive CSRF Protection Module\r\n *\r\n * This module provides two layers of CSRF protection:\r\n * 1. Origin-based validation (using Hono's built-in CSRF) - for app-wide protection\r\n * 2. Token-based validation (double-submit cookies) - for sensitive endpoints\r\n *\r\n * @module csrf\r\n */\r\n\r\nimport { csrf } from \"npm:hono/csrf\";\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger, logDebug, logWarn, logInfo } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\nimport {\r\n setCSRFCookies,\r\n validateTokenBasedCSRFToken,\r\n type CSRFSession,\r\n type TokenValidationResult,\r\n} from \"../utils/cookies.ts\";\r\nimport { generateSecureToken } from \"../utils/crypto.ts\";\r\n\r\n// ============================================================================\r\n// TYPES AND INTERFACES\r\n// ============================================================================\r\n\r\n/**\r\n * Configuration for origin-based CSRF protection\r\n */\r\nexport interface CSRFOriginConfig {\r\n allowedOrigins: string[];\r\n allowValTownDomains: boolean;\r\n allowLocalhost: boolean;\r\n logValidation: boolean;\r\n}\r\n\r\n// ============================================================================\r\n// TOKEN-BASED CSRF PROTECTION (Double-Submit Cookies)\r\n// ============================================================================\r\n\r\n// Re-export types from cookies utility for backward compatibility\r\nexport type { CSRFSession, TokenValidationResult };\r\n\r\n/**\r\n * Create a new CSRF session with secure tokens\r\n * Now uses centralized crypto utilities with SESSION_SECRET entropy\r\n *\r\n * @returns CSRFSession object with sessionId, xsrfToken, and timestamps\r\n */\r\nexport async function createTokenBasedCSRFSession(): Promise {\r\n // Use SESSION_SECRET if available, otherwise generate without entropy source\r\n const entropy = environment.SESSION_SECRET && environment.SESSION_SECRET.length > 0 \r\n ? environment.SESSION_SECRET \r\n : undefined;\r\n \r\n const sessionId = generateSecureToken(entropy);\r\n const xsrfToken = generateSecureToken(entropy);\r\n const createdAt = new Date();\r\n const expiresAt = new Date(createdAt.getTime() + 30 * 60 * 1000); // 30 minutes\r\n\r\n const session: CSRFSession = {\r\n sessionId,\r\n xsrfToken,\r\n createdAt,\r\n expiresAt,\r\n };\r\n\r\n // Store session in database\r\n try {\r\n const { storeCSRFSession } = await import(\"../services/dbService.ts\");\r\n await storeCSRFSession(session);\r\n } catch (error) {\r\n logger.error(\"Failed to store CSRF session in database\", {\r\n error: error instanceof Error ? error.message : String(error),\r\n sessionId: sessionId.substring(0, 8) + \"...\",\r\n });\r\n // Continue anyway - validation will fall back to format-only check\r\n }\r\n\r\n return session;\r\n}\r\n\r\n// Re-export cookie functions from utils for backward compatibility\r\nexport { setCSRFCookies, validateTokenBasedCSRFToken };\r\n\r\n/**\r\n * Token-based CSRF protection middleware\r\n * Use this for sensitive endpoints (e.g., payment processing)\r\n *\r\n * @param request - The incoming HTTP request\r\n * @returns Error response if validation fails, null if passes\r\n */\r\nexport async function tokenBasedCSRFProtection(request: Request): Promise {\r\n const validation = await validateTokenBasedCSRFToken(request);\r\n\r\n if (!validation.valid) {\r\n logger.warn(\"CSRF validation failed\", {\r\n error: validation.error,\r\n ip: request.headers.get(\"cf-connecting-ip\") || \"unknown\",\r\n userAgent: request.headers.get(\"user-agent\") || \"unknown\",\r\n });\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"CSRF validation failed\",\r\n details: validation.error,\r\n }),\r\n {\r\n status: 403,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n );\r\n }\r\n\r\n return null; // Continue processing\r\n}\r\n\r\n// ============================================================================\r\n// ORIGIN-BASED CSRF PROTECTION (Using Hono's Built-in Middleware)\r\n// ============================================================================\r\n\r\n/**\r\n * Get default origin-based CSRF configuration based on environment\r\n *\r\n * @returns Default configuration object\r\n */\r\nexport const getDefaultOriginConfig = (): CSRFOriginConfig => {\r\n const isDevelopment = environment.APP_ENV === \"dev\";\r\n\r\n return {\r\n allowedOrigins: [\r\n // Use all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS,\r\n // Also include BASE_URL if it's not already in the list\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ].filter(Boolean), // Remove any undefined values\r\n allowValTownDomains: isDevelopment, // Allow val.town domains in development\r\n allowLocalhost: isDevelopment, // Allow localhost in development\r\n logValidation: isDevelopment, // Log validation in development\r\n };\r\n};\r\n\r\n// Backward compatibility alias\r\nexport const getDefaultConfig = getDefaultOriginConfig;\r\n\r\n/**\r\n * Create origin validation function for Hono CSRF middleware\r\n *\r\n * @param config - Origin validation configuration\r\n * @returns Function that validates origin strings\r\n */\r\nexport const createOriginValidator = (config: CSRFOriginConfig) => {\r\n return (origin: string): boolean => {\r\n try {\r\n // Check against explicitly allowed origins\r\n for (const allowedOrigin of config.allowedOrigins) {\r\n if (origin === allowedOrigin || origin.startsWith(allowedOrigin)) {\r\n if (config.logValidation) {\r\n logDebug(\"CSRF origin validation passed\", \"csrf_origin\", {\r\n origin,\r\n matchedOrigin: allowedOrigin,\r\n });\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Allow val.town domains for development\r\n if (config.allowValTownDomains) {\r\n const valTownRegex = /^https:\\/\\/[\\w-]+\\.val\\.run$/;\r\n if (valTownRegex.test(origin)) {\r\n if (config.logValidation) {\r\n logDebug(\r\n \"CSRF origin validation passed (val.town)\",\r\n \"csrf_origin\",\r\n {\r\n origin,\r\n reason: \"val.town domain\",\r\n }\r\n );\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Allow localhost for development\r\n if (config.allowLocalhost) {\r\n const localhostRegex = /^https?:\\/\\/localhost(:\\d+)?$/;\r\n if (localhostRegex.test(origin)) {\r\n if (config.logValidation) {\r\n logDebug(\r\n \"CSRF origin validation passed (localhost)\",\r\n \"csrf_origin\",\r\n {\r\n origin,\r\n reason: \"localhost\",\r\n }\r\n );\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Log rejected origins\r\n if (config.logValidation) {\r\n logWarn(\"CSRF origin validation failed\", \"csrf_origin\", {\r\n origin,\r\n allowedOrigins: config.allowedOrigins,\r\n allowValTownDomains: config.allowValTownDomains,\r\n allowLocalhost: config.allowLocalhost,\r\n });\r\n }\r\n\r\n return false;\r\n } catch (error) {\r\n logWarn(\"CSRF origin validation error\", \"csrf_origin\", {\r\n origin,\r\n error: error instanceof Error ? error.message : String(error),\r\n });\r\n return false;\r\n }\r\n };\r\n};\r\n\r\n/**\r\n * Create Hono CSRF middleware with custom configuration\r\n *\r\n * @param customConfig - Optional custom configuration to override defaults\r\n * @returns Configured Hono CSRF middleware\r\n */\r\nexport const createHonoCSRFMiddleware = (\r\n customConfig?: Partial\r\n) => {\r\n const config = { ...getDefaultOriginConfig(), ...customConfig };\r\n const originValidator = createOriginValidator(config);\r\n\r\n return csrf({\r\n origin: originValidator,\r\n });\r\n};\r\n\r\n/**\r\n * Enhanced CSRF middleware that combines origin validation with custom logic\r\n *\r\n * @param customConfig - Optional custom configuration\r\n * @returns Enhanced CSRF middleware function\r\n */\r\nexport const createEnhancedCSRFMiddleware = (\r\n customConfig?: Partial\r\n) => {\r\n const honoMiddleware = createHonoCSRFMiddleware(customConfig);\r\n\r\n return async (c: Context, next: Next) => {\r\n // Get client IP for enhanced logging\r\n const clientIP = getClientIP(c);\r\n\r\n try {\r\n // Apply Hono CSRF middleware\r\n await honoMiddleware(c, next);\r\n } catch (error) {\r\n // Enhanced error logging with client information\r\n logWarn(\"CSRF middleware error\", \"csrf_enhanced\", {\r\n clientIP,\r\n origin: c.req.header(\"Origin\"),\r\n referer: c.req.header(\"Referer\"),\r\n userAgent: c.req.header(\"User-Agent\")?.substring(0, 100),\r\n path: c.req.path,\r\n method: c.req.method,\r\n error: error instanceof Error ? error.message : String(error),\r\n });\r\n\r\n // Re-throw the error to maintain the original behavior\r\n throw error;\r\n }\r\n };\r\n};\r\n\r\n// ============================================================================\r\n// PRESET MIDDLEWARE CONFIGURATIONS\r\n// ============================================================================\r\n\r\n/**\r\n * Default CSRF middleware - balanced security for most use cases\r\n */\r\nexport const defaultCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware();\r\n};\r\n\r\n/**\r\n * Strict CSRF middleware - maximum security, minimal allowlists\r\n */\r\nexport const strictOriginCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: false,\r\n allowLocalhost: false,\r\n logValidation: true,\r\n });\r\n};\r\n\r\n/**\r\n * Development CSRF middleware - relaxed settings for local development\r\n */\r\nexport const developmentCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: true,\r\n allowLocalhost: true,\r\n logValidation: true,\r\n });\r\n};\r\n\r\n/**\r\n * Public API CSRF middleware - for public endpoints that need some protection\r\n */\r\nexport const publicAPICSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: true,\r\n allowLocalhost: environment.APP_ENV === \"dev\",\r\n logValidation: false,\r\n });\r\n};\r\n\r\n/**\r\n * Get default CSRF middleware based on environment\r\n */\r\nexport function getOriginBasedCSRFMiddleware(correlationId?: string) {\r\n const config = getDefaultOriginConfig();\r\n\r\n if (correlationId) {\r\n logInfo(`Initializing CSRF middleware`, \"csrf_init\", {\r\n correlationId,\r\n config: {\r\n allowedOrigins: config.allowedOrigins.length,\r\n allowValTownDomains: config.allowValTownDomains,\r\n allowLocalhost: config.allowLocalhost,\r\n environment: environment.APP_ENV,\r\n },\r\n });\r\n }\r\n\r\n return createEnhancedCSRFMiddleware(config);\r\n}\r\n\r\n// ============================================================================\r\n// UTILITY EXPORTS\r\n// ============================================================================\r\n\r\n/**\r\n * Collection of CSRF utilities for testing and advanced configuration\r\n */\r\nexport const CSRFUtils = {\r\n // Origin-based utilities\r\n getDefaultConfig: getDefaultOriginConfig,\r\n createOriginValidator,\r\n createHonoCSRFMiddleware,\r\n createEnhancedCSRFMiddleware,\r\n\r\n // Token-based utilities\r\n generateSecureToken,\r\n createTokenBasedCSRFSession,\r\n setCSRFCookies,\r\n validateTokenBasedCSRFToken,\r\n\r\n // Middleware factories\r\n originBased: {\r\n default: defaultCSRFMiddleware,\r\n strict: strictOriginCSRFMiddleware,\r\n development: developmentCSRFMiddleware,\r\n publicAPI: publicAPICSRFMiddleware,\r\n },\r\n\r\n tokenBased: {\r\n middleware: tokenBasedCSRFProtection,\r\n protection: tokenBasedCSRFProtection,\r\n },\r\n};\r\n\r\n// Default export for easy importing\r\nexport default getOriginBasedCSRFMiddleware;\r\n\r\n// ============================================================================\r\n// USAGE EXAMPLES\r\n// ============================================================================\r\n\r\n/**\r\n * Example 1: Global origin-based protection\r\n * ```typescript\r\n * import { getOriginBasedCSRFMiddleware } from \"./csrf\";\r\n * app.use(getOriginBasedCSRFMiddleware());\r\n * ```\r\n *\r\n * Example 2: Token-based protection for specific routes\r\n * ```typescript\r\n * import { tokenBasedCSRFProtection, createTokenBasedCSRFSession, setCSRFCookies } from \"./csrf\";\r\n *\r\n * // Set cookies on initial visit\r\n * app.get(\"/api/v1/tour/:id\", (c) => {\r\n * const session = createTokenBasedCSRFSession();\r\n * // ... handle request\r\n * return setCSRFCookies(response, session);\r\n * });\r\n *\r\n * // Validate token on sensitive endpoints\r\n * app.post(\"/api/v1/payment\", (c) => {\r\n * const error = tokenBasedCSRFProtection(c.req.raw);\r\n * if (error) return error;\r\n * // ... process payment\r\n * });\r\n * ```\r\n */\r\n",[],[175,353,397],{"_105":406,"_96":407,"_157":408,"_159":354,"_160":142,"_161":409,"_163":119,"_107":410,"_101":319,"_165":194,"_167":411,"_168":22,"_169":-5,"_170":412,"_99":413},"e0d82f90-5f53-11f0-a734-0224a6c84d84","debugger.ts","8c9eeeb0-5a93-11f0-b403-f69ea79377d9",706,["D",1752347430760],"import * as log from \"https://deno.land/std@0.203.0/log/mod.ts\";\r\nimport { getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS } from \"../utils/dateUtils.ts\";\r\nimport { OPERATION_EMOJIS } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\nconst DBG_EMOJI = OPERATION_EMOJIS[\"debug_event\"] ?? \"🐞\";\r\n\r\n// ANSI color codes for debug output (maintained from original)\r\nconst DEBUG_COLORS = {\r\n reset: \"\\x1b[0m\",\r\n bright: \"\\x1b[1m\",\r\n dim: \"\\x1b[2m\",\r\n red: \"\\x1b[31m\",\r\n green: \"\\x1b[32m\",\r\n yellow: \"\\x1b[33m\",\r\n blue: \"\\x1b[34m\",\r\n magenta: \"\\x1b[35m\",\r\n cyan: \"\\x1b[36m\",\r\n white: \"\\x1b[37m\",\r\n gray: \"\\x1b[90m\",\r\n brightRed: \"\\x1b[91m\",\r\n brightGreen: \"\\x1b[92m\",\r\n brightYellow: \"\\x1b[93m\",\r\n brightBlue: \"\\x1b[94m\",\r\n brightMagenta: \"\\x1b[95m\",\r\n brightCyan: \"\\x1b[96m\",\r\n brightWhite: \"\\x1b[97m\",\r\n bgRed: \"\\x1b[41m\",\r\n bgGreen: \"\\x1b[42m\",\r\n bgYellow: \"\\x1b[43m\",\r\n bgBlue: \"\\x1b[44m\",\r\n bgMagenta: \"\\x1b[45m\",\r\n bgCyan: \"\\x1b[46m\",\r\n} as const;\r\n\r\n// Custom formatter that maintains color support\r\nfunction coloredJsonFormatter(record: log.LogRecord): string {\r\n const entry = {\r\n timestamp: getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS(),\r\n level: record.levelName,\r\n message: record.msg,\r\n ...(record.args[0] ? { data: record.args[0] } : {}),\r\n };\r\n\r\n // Apply color based on log level (only if colors are enabled)\r\n if (!environment.DEBUG_ENABLE_COLORS) {\r\n return JSON.stringify(entry);\r\n }\r\n\r\n let color: string = DEBUG_COLORS.reset;\r\n switch (record.level) {\r\n case log.LogLevels.DEBUG:\r\n color = DEBUG_COLORS.gray;\r\n break;\r\n case log.LogLevels.INFO:\r\n color = DEBUG_COLORS.cyan;\r\n break;\r\n case log.LogLevels.WARNING:\r\n color = DEBUG_COLORS.yellow;\r\n break;\r\n case log.LogLevels.ERROR:\r\n color = DEBUG_COLORS.red;\r\n break;\r\n case log.LogLevels.CRITICAL:\r\n color = DEBUG_COLORS.brightRed;\r\n break;\r\n }\r\n\r\n return `${color}${JSON.stringify(entry)}${DEBUG_COLORS.reset}`;\r\n}\r\n\r\n// Configure logger with our custom formatter\r\nawait log.setup({\r\n handlers: {\r\n debugConsole: new log.handlers.ConsoleHandler(\r\n environment.DEBUG_LOG_LEVEL as log.LevelName,\r\n {\r\n formatter: coloredJsonFormatter,\r\n }\r\n ),\r\n },\r\n loggers: {\r\n default: {\r\n level: environment.DEBUG_LOG_LEVEL as log.LevelName,\r\n handlers: [\"debugConsole\"],\r\n },\r\n },\r\n});\r\ninterface DebugRequestData {\r\n method: string;\r\n url: string;\r\n headers: Record;\r\n body?: string;\r\n timestamp: string;\r\n ip?: string;\r\n userAgent?: string;\r\n origin?: string;\r\n correlationId?: string;\r\n}\r\n\r\ninterface DebugResponseData {\r\n status: number;\r\n statusText: string;\r\n headers: Record;\r\n body?: string;\r\n timestamp: string;\r\n duration?: number;\r\n}\r\n\r\ninterface DebugRequestResponse {\r\n request: DebugRequestData;\r\n response: DebugResponseData;\r\n correlationId: string;\r\n totalDuration: number;\r\n}\r\n\r\ninterface SecurityCheck {\r\n checkNumber: number;\r\n checkName: string;\r\n description: string;\r\n passed: boolean;\r\n details?: Record;\r\n timestamp: string;\r\n duration?: number;\r\n}\r\n\r\n// Global state remains the same\r\nlet securityCheckCounter = 0;\r\n// ---------- Global state ----------\r\nconst activeRequests = new Map<\r\n string,\r\n {\r\n request: DebugRequestData;\r\n startTime: number;\r\n securityChecks: SecurityCheck[];\r\n }\r\n>();\r\n\r\nconst debugSessions = new Map<\r\n string,\r\n {\r\n correlationId: string;\r\n startTime: number;\r\n request: {\r\n method: string;\r\n url: string;\r\n ip: string;\r\n userAgent: string;\r\n };\r\n }\r\n>();\r\n\r\nexport function isDebugEnabled(): boolean {\r\n // Disable debug for serverless to avoid in-memory state issues\r\n return false;\r\n}\r\n\r\nfunction generateCorrelationId(): string {\r\n return `dbg_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Bulk security-check helper\r\n// -----------------------------------------------------------\r\nexport function logSecurityChecks(\r\n correlationId: string,\r\n checks: Array<{\r\n checkName: string;\r\n description: string;\r\n passed: boolean;\r\n details?: Record;\r\n }>\r\n): void {\r\n if (!isDebugEnabled() || !correlationId) return;\r\n for (const chk of checks) {\r\n logSecurityCheck(\r\n correlationId,\r\n chk.checkName,\r\n chk.description,\r\n chk.passed,\r\n chk.details\r\n );\r\n }\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Debug timer utility\r\n// -----------------------------------------------------------\r\nexport function createDebugTimer(operation: string): {\r\n stop: (details?: Record) => number;\r\n} {\r\n if (!isDebugEnabled()) return { stop: () => 0 };\r\n\r\n const startTime = performance.now();\r\n return {\r\n stop: (details?: Record) => {\r\n const ms = Math.round(performance.now() - startTime);\r\n debugLog(`${DBG_EMOJI} ⏱️ ${operation} took ${ms} ms`, details);\r\n return ms;\r\n },\r\n };\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Correlation-ID passthrough for downstream handlers\r\n// -----------------------------------------------------------\r\nexport function getDebugCorrelationId(ctx: any): string {\r\n return ctx?.get?.(\"debugCorrelationId\") ?? \"\";\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Hono-style middleware (unchanged logic, now w/ std/log)\r\n// -----------------------------------------------------------\r\nexport function createDebugMiddleware() {\r\n return async (c: any, next: any) => {\r\n if (!isDebugEnabled()) return await next();\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}🔧 Debug middleware: ${c.req.method} ${c.req.url}${colorEnd}`\r\n );\r\n log.debug(`${DBG_EMOJI} middleware`, {\r\n method: c.req.method,\r\n url: c.req.url,\r\n });\r\n\r\n const cid = captureRequest(c.req.raw);\r\n c.set(\"debugCorrelationId\", cid);\r\n const started = performance.now();\r\n\r\n try {\r\n await next();\r\n if (c.res) {\r\n await captureResponse(cid, c.res);\r\n } else {\r\n captureResponseFromContext(cid, c, performance.now() - started);\r\n }\r\n } catch (err) {\r\n log.error(`${DBG_EMOJI} middleware error`, { message: err.message });\r\n const fallback = new Response(JSON.stringify({ error: err.message }), {\r\n status: 500,\r\n headers: { \"content-type\": \"application/json\" },\r\n });\r\n await captureResponse(cid, fallback);\r\n throw err;\r\n }\r\n };\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Session lifecycle helpers (for long-lived flows)\r\n// -----------------------------------------------------------\r\nexport function initializeDebugSession(req: Request): string {\r\n const cid = crypto.randomUUID();\r\n debugSessions.set(cid, {\r\n correlationId: cid,\r\n startTime: Date.now(),\r\n request: {\r\n method: req.method,\r\n url: req.url,\r\n ip:\r\n req.headers.get(\"cf-connecting-ip\") ??\r\n req.headers.get(\"x-forwarded-for\") ??\r\n \"unknown\",\r\n userAgent: req.headers.get(\"user-agent\") ?? \"\",\r\n },\r\n });\r\n\r\n // pre-seed map so security-checks land correctly\r\n if (!activeRequests.has(cid)) {\r\n activeRequests.set(cid, {\r\n request: {\r\n method: req.method,\r\n url: req.url,\r\n headers: Object.fromEntries(req.headers.entries()),\r\n timestamp: getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS(),\r\n ip: debugSessions.get(cid)!.request.ip,\r\n userAgent: debugSessions.get(cid)!.request.userAgent,\r\n origin: req.headers.get(\"origin\") ?? \"\",\r\n correlationId: cid,\r\n },\r\n startTime: Date.now(),\r\n securityChecks: [],\r\n });\r\n }\r\n\r\n if (isDebugEnabled()) {\r\n console.log(`\\n🔍 DEBUG SESSION STARTED — ${cid}`);\r\n log.info(`${DBG_EMOJI} session start`, { cid, url: req.url });\r\n }\r\n return cid;\r\n}\r\n\r\nexport function finalizeDebugSession(\r\n cid: string,\r\n _req: Request,\r\n res: Response\r\n): void {\r\n const session = debugSessions.get(cid);\r\n const reqData = activeRequests.get(cid);\r\n if (!session) return; // nothing to do\r\n\r\n if (isDebugEnabled()) {\r\n const elapsed = Date.now() - session.startTime;\r\n const checks = reqData?.securityChecks ?? [];\r\n const summary = {\r\n total: checks.length,\r\n passed: checks.filter((c) => c.passed).length,\r\n failed: checks.filter((c) => !c.passed).length,\r\n status: res.status,\r\n duration: `${elapsed} ms`,\r\n };\r\n\r\n console.log(\"───────────────────────────────────────\");\r\n console.log(`🔒 SECURITY CHECKS SUMMARY`);\r\n console.table(summary);\r\n console.log(`🔍 DEBUG SESSION ENDED\\n`);\r\n log.info(`${DBG_EMOJI} session end`, { cid, ...summary });\r\n }\r\n\r\n debugSessions.delete(cid);\r\n activeRequests.delete(cid);\r\n}\r\n\r\n// Modified functions to use both std/log and colors\r\nexport function initializeDebugger(): void {\r\n const debug = isDebugEnabled();\r\n const isValTown = Boolean(\r\n globalThis?.location?.hostname?.includes?.(\".val.run\") ||\r\n Deno.cwd().includes(\"val.town\")\r\n );\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n if (debug) {\r\n console.log(`${colorStart}🐛 DEBUG MODE ENABLED${colorEnd}`);\r\n log.info(\"Debug mode initialized\", {\r\n runtime: isValTown ? \"Val.Town\" : \"Local Deno\",\r\n denoVersion: Deno.version.deno,\r\n debugSettings: {\r\n enableColors: environment.DEBUG_ENABLE_COLORS,\r\n enableRequestCapture: environment.DEBUG_ENABLE_REQUEST_CAPTURE,\r\n enableResponseCapture: environment.DEBUG_ENABLE_RESPONSE_CAPTURE,\r\n enableSecurityChecks: environment.DEBUG_ENABLE_SECURITY_CHECKS,\r\n logLevel: environment.DEBUG_LOG_LEVEL,\r\n bodySizeLimit: environment.DEBUG_RESPONSE_BODY_SIZE_LIMIT,\r\n },\r\n });\r\n } else {\r\n console.log(`${grayColor}🐛 Debug mode: OFF${colorEnd}`);\r\n }\r\n}\r\nexport function captureRequest(request: Request): string {\r\n if (!isDebugEnabled() || !environment.DEBUG_ENABLE_REQUEST_CAPTURE) return \"\";\r\n\r\n const correlationId = generateCorrelationId();\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n // Flatten headers\r\n const headers: Record = {};\r\n request.headers.forEach((v, k) => (headers[k.toLowerCase()] = v));\r\n\r\n const requestData: DebugRequestData = {\r\n method: request.method,\r\n url: request.url,\r\n headers,\r\n timestamp,\r\n ip:\r\n headers[\"cf-connecting-ip\"] ||\r\n headers[\"x-forwarded-for\"] ||\r\n headers[\"x-real-ip\"] ||\r\n \"unknown\",\r\n userAgent: headers[\"user-agent\"],\r\n origin: headers[\"origin\"],\r\n correlationId,\r\n };\r\n\r\n activeRequests.set(correlationId, {\r\n request: requestData,\r\n startTime: performance.now(),\r\n securityChecks: [],\r\n });\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightCyan\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(`\\n${colorStart}📥 DEBUG REQUEST [${correlationId}]${colorEnd}`);\r\n log.debug(\"Incoming request\", requestData);\r\n return correlationId;\r\n}\r\n\r\nexport async function captureResponse(\r\n correlationId: string,\r\n response: Response\r\n): Promise {\r\n if (!isDebugEnabled() || !correlationId) return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n const duration = performance.now() - requestData.startTime;\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n // Headers → plain object\r\n const headers: Record = {};\r\n response.headers.forEach((v, k) => (headers[k.toLowerCase()] = v));\r\n\r\n const responseData: DebugResponseData = {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers,\r\n timestamp,\r\n duration: Math.round(duration),\r\n };\r\n\r\n // Non-destructive JSON body capture (configurable size limit)\r\n try {\r\n if (\r\n environment.DEBUG_ENABLE_RESPONSE_CAPTURE &&\r\n response.body &&\r\n headers[\"content-type\"]?.includes(\"application/json\")\r\n ) {\r\n const bodyText = await response.clone().text();\r\n if (bodyText.length < environment.DEBUG_RESPONSE_BODY_SIZE_LIMIT) {\r\n responseData.body = bodyText;\r\n }\r\n }\r\n } catch {\r\n /* ignore */\r\n }\r\n\r\n const debugData: DebugRequestResponse = {\r\n request: requestData.request,\r\n response: responseData,\r\n correlationId,\r\n totalDuration: Math.round(duration),\r\n };\r\n\r\n const statusColor =\r\n response.status >= 400\r\n ? DEBUG_COLORS.brightRed\r\n : response.status >= 300\r\n ? DEBUG_COLORS.brightYellow\r\n : DEBUG_COLORS.brightGreen;\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightMagenta\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}📤 DEBUG RESPONSE [${correlationId}] ${statusColorStart}${response.status}${colorEnd}`\r\n );\r\n\r\n if (response.status >= 400) log.error(\"Request failed\", debugData);\r\n else if (response.status >= 300) log.warning(\"Request redirected\", debugData);\r\n else log.info(\"Request completed\", debugData);\r\n\r\n // Security-check summary\r\n if (\r\n requestData.securityChecks.length &&\r\n environment.DEBUG_ENABLE_SECURITY_CHECKS\r\n ) {\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `\\n${colorStart}🔒 SECURITY CHECKS SUMMARY [${correlationId}]${colorEnd}`\r\n );\r\n log.debug(\"Security checks summary\", {\r\n total: requestData.securityChecks.length,\r\n passed: requestData.securityChecks.filter((c) => c.passed).length,\r\n });\r\n }\r\n\r\n activeRequests.delete(correlationId);\r\n}\r\n\r\nexport function logSecurityCheck(\r\n correlationId: string,\r\n checkName: string,\r\n description: string,\r\n passed: boolean,\r\n details?: Record\r\n): void {\r\n if (\r\n !isDebugEnabled() ||\r\n !environment.DEBUG_ENABLE_SECURITY_CHECKS ||\r\n !correlationId\r\n )\r\n return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n securityCheckCounter++;\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n const securityCheck: SecurityCheck = {\r\n checkNumber: securityCheckCounter,\r\n checkName,\r\n description,\r\n passed,\r\n details,\r\n timestamp,\r\n };\r\n\r\n requestData.securityChecks.push(securityCheck);\r\n\r\n const statusColor = passed\r\n ? DEBUG_COLORS.brightGreen\r\n : DEBUG_COLORS.brightRed;\r\n const statusIcon = passed ? \"✅\" : \"❌\";\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightBlue\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}Check${securityCheck.checkNumber}:${colorEnd} ${statusColorStart}${statusIcon} ${checkName}${colorEnd}`\r\n );\r\n console.log(`${grayColor} └─ ${description}${colorEnd}`);\r\n\r\n if (passed) log.debug(`Security check passed: ${checkName}`, securityCheck);\r\n else log.warning(`Security check failed: ${checkName}`, securityCheck);\r\n}\r\nfunction captureResponseFromContext(\r\n correlationId: string,\r\n context: any,\r\n duration: number\r\n): void {\r\n if (\r\n !isDebugEnabled() ||\r\n !environment.DEBUG_ENABLE_RESPONSE_CAPTURE ||\r\n !correlationId\r\n )\r\n return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n const status = context?.status ?? context?._status ?? 200;\r\n const statusText = context?.statusText ?? \"OK\";\r\n\r\n const headers: Record = {};\r\n if (context.headers?.forEach) {\r\n context.headers.forEach(\r\n (v: string, k: string) => (headers[k.toLowerCase()] = v)\r\n );\r\n }\r\n\r\n const responseData: DebugResponseData = {\r\n status,\r\n statusText,\r\n headers,\r\n timestamp,\r\n duration: Math.round(duration),\r\n };\r\n\r\n const debugData: DebugRequestResponse = {\r\n request: requestData.request,\r\n response: responseData,\r\n correlationId,\r\n totalDuration: Math.round(duration),\r\n };\r\n\r\n const statusColor =\r\n status >= 400\r\n ? DEBUG_COLORS.brightRed\r\n : status >= 300\r\n ? DEBUG_COLORS.brightYellow\r\n : DEBUG_COLORS.brightGreen;\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightMagenta\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}📤 DEBUG RESPONSE [${correlationId}] ${statusColorStart}${status}${colorEnd} (fallback)`\r\n );\r\n log.warning(\"Synthetic response captured\", debugData);\r\n\r\n activeRequests.delete(correlationId);\r\n}\r\n\r\n// Maintain all other original functions with their color support\r\nexport function debugLog(message: string, data?: any): void {\r\n if (!isDebugEnabled()) return;\r\n\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const cyanColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.cyan : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${grayColor}[${timestamp}]${colorEnd} ${cyanColor}🐛 ${message}${colorEnd}`\r\n );\r\n log.debug(message, data);\r\n}\r\n\r\n// ... (keep all other functions with their original implementations)\r\n\r\nexport default {\r\n initializeDebugger,\r\n isDebugEnabled,\r\n captureRequest,\r\n captureResponse,\r\n logSecurityCheck,\r\n logSecurityChecks, // <- now included\r\n createDebugMiddleware,\r\n getDebugCorrelationId,\r\n debugLog,\r\n createDebugTimer, // <- newly wired\r\n initializeDebugSession, // <- newly wired\r\n finalizeDebugSession, // <- newly wired\r\n};\r\n",[],[175,353,407],{"_105":415,"_96":416,"_157":417,"_159":354,"_160":142,"_161":418,"_163":119,"_107":419,"_101":283,"_165":194,"_167":420,"_168":22,"_169":-5,"_170":421,"_99":422},"4a20d0a2-5e6d-11f0-a4b5-0224a6c84d84","ipRestriction.ts","caa0ce60-5c67-11f0-ac5b-0224a6c84d84",604,["D",1752248393636],"// F:\\val.town\\ZenServer\\src\\middleware\\ipRestriction.ts\r\n/**\r\n * IP Restriction Middleware\r\n * Provides IP-based access control using the IP utilities\r\n */\r\n\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { getClientIP, performIPSecurityCheck } from \"../utils/ipUtils.ts\";\r\nimport { logInfo, logWarn } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\ninterface IPRestrictionOptions {\r\n allowList?: string[];\r\n denyList?: string[];\r\n allowPrivate?: boolean;\r\n allowLoopback?: boolean;\r\n errorMessage?: string;\r\n errorHandler?: (\r\n c: Context,\r\n ip: string,\r\n reason: string\r\n ) => Response | Promise;\r\n}\r\n\r\n/**\r\n * Create IP restriction middleware\r\n */\r\nexport const ipRestrictionMiddleware = (options?: IPRestrictionOptions) => {\r\n return async (c: Context, next: Next) => {\r\n const ip = getClientIP(c);\r\n\r\n // Perform security check\r\n const check = performIPSecurityCheck(ip, {\r\n allowList: options?.allowList,\r\n denyList: options?.denyList,\r\n allowPrivate: options?.allowPrivate ?? environment.ALLOW_PRIVATE_IPS,\r\n allowLoopback: options?.allowLoopback ?? environment.ALLOW_LOOPBACK_IPS,\r\n });\r\n\r\n if (!check.allowed) {\r\n logWarn(`IP access denied`, \"ipRestriction\", {\r\n ip,\r\n reason: check.reason,\r\n path: c.req.path,\r\n method: c.req.method,\r\n });\r\n\r\n // Use custom error handler if provided\r\n if (options?.errorHandler) {\r\n return await options.errorHandler(\r\n c,\r\n ip,\r\n check.reason || \"Access denied\"\r\n );\r\n }\r\n\r\n // Default error response\r\n const message = options?.errorMessage || `Access denied: ${check.reason}`;\r\n return c.text(message, 403);\r\n }\r\n\r\n // Log successful access in development\r\n if (environment.APP_ENV === \"dev\") {\r\n logInfo(`IP access allowed`, \"ipRestriction\", {\r\n ip,\r\n path: c.req.path,\r\n });\r\n }\r\n\r\n // Add IP to context for downstream use\r\n c.set(\"clientIP\", ip);\r\n\r\n await next();\r\n };\r\n};\r\n\r\n/**\r\n * Create admin-only IP restriction middleware\r\n * Uses environment configuration for admin IP allowlist\r\n */\r\nexport const adminIPRestrictionMiddleware = () => {\r\n // Get admin IPs from environment or use defaults\r\n const adminIPs = environment.ADMIN_IPS;\r\n\r\n return ipRestrictionMiddleware({\r\n allowList: adminIPs,\r\n allowPrivate: false,\r\n allowLoopback: environment.ALLOW_LOOPBACK_IPS,\r\n errorMessage: \"Unauthorized: Admin access only\",\r\n errorHandler: async (c, ip, reason) => {\r\n // Custom error response for admin endpoints\r\n return c.json(\r\n {\r\n error: \"Unauthorized\",\r\n message: \"This endpoint requires admin access\",\r\n timestamp: new Date().toISOString(),\r\n },\r\n 403\r\n );\r\n },\r\n });\r\n};\r\n\r\n/**\r\n * Create rate limit bypass middleware\r\n * Allows certain IPs to bypass rate limiting\r\n */\r\nexport const rateLimitBypassMiddleware = () => {\r\n return async (c: Context, next: Next) => {\r\n const ip = getClientIP(c);\r\n\r\n // Check if IP should bypass rate limiting\r\n if (environment.ADMIN_IPS.includes(ip)) {\r\n c.set(\"bypassRateLimit\", true);\r\n logInfo(`Rate limit bypassed for IP`, \"ipRestriction\", { ip });\r\n }\r\n\r\n await next();\r\n };\r\n};\r\n\r\n/**\r\n * Create development-only middleware\r\n * Restricts access to development IPs only\r\n */\r\nexport const developmentOnlyMiddleware = () => {\r\n return ipRestrictionMiddleware({\r\n allowPrivate: environment.ALLOW_PRIVATE_IPS,\r\n allowLoopback: environment.ALLOW_LOOPBACK_IPS,\r\n denyList: [], // Override any global deny list\r\n errorMessage: \"This endpoint is only available in development\",\r\n });\r\n};\r\n\r\nexport default ipRestrictionMiddleware;\r\n",[],[175,353,416],{"_105":424,"_96":425,"_157":426,"_159":354,"_160":142,"_161":427,"_163":119,"_107":428,"_101":382,"_165":194,"_167":429,"_168":22,"_169":-5,"_170":430,"_99":431},"e0db420c-5f53-11f0-bbf6-0224a6c84d84","rateLimit.ts","9fea39ac-58a9-11f0-b67c-f69ea79377d9",707,["D",1752347430777],"// ======================\r\n// Configuration Section\r\n// ======================\r\n\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { logSecurityCheck } from \"../middleware/debugger.ts\";\r\n\r\ninterface RateLimitConfig {\r\n [endpoint: string]: {\r\n requests: number;\r\n windowMs: number;\r\n };\r\n}\r\n\r\n// Rate limiting per endpoint (using environment configuration)\r\nconst RATE_LIMITS: RateLimitConfig = {\r\n \"/api/v1/payment/create-nonce\": {\r\n requests: environment.RATE_LIMIT_CREATE_NONCE_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_CREATE_NONCE_WINDOW_MS,\r\n },\r\n \"/api/v1/payment/exchange-nonce\": {\r\n requests: environment.RATE_LIMIT_EXCHANGE_NONCE_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_EXCHANGE_NONCE_WINDOW_MS,\r\n },\r\n \"/api/v1/payment/refresh\": {\r\n requests: environment.RATE_LIMIT_PAYMENT_REFRESH_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_PAYMENT_REFRESH_WINDOW_MS,\r\n },\r\n \"/api/v1/turnstile/verify\": {\r\n requests: environment.RATE_LIMIT_TURNSTILE_VERIFY_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_TURNSTILE_VERIFY_WINDOW_MS,\r\n },\r\n};\r\n\r\n// ======================\r\n// Implementation Section\r\n// ======================\r\n\r\nexport async function rateLimitMiddleware(\r\n request: Request,\r\n correlationId?: string,\r\n db?: any\r\n): Promise {\r\n const url = new URL(request.url);\r\n const endpoint = url.pathname;\r\n\r\n // Determine IP address using prioritized header list from environment config\r\n let ip: string | null = null;\r\n for (const headerKey of environment.IP_HEADER_KEYS) {\r\n ip = request.headers.get(headerKey);\r\n if (ip) break;\r\n }\r\n if (!ip) ip = \"unknown\";\r\n\r\n // Check if endpoint has rate limiting configured\r\n const limitConfig = RATE_LIMITS[endpoint];\r\n if (!limitConfig) {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Rate Limit Validation\",\r\n \"No rate limiting configured\",\r\n true,\r\n { endpoint, ip }\r\n );\r\n }\r\n return null; // No rate limiting for this endpoint\r\n }\r\n\r\n if (!db) {\r\n return null; // No database connection, allow request\r\n }\r\n\r\n const now = Date.now();\r\n const windowStart = Math.floor(now / limitConfig.windowMs) * limitConfig.windowMs;\r\n const windowEnd = windowStart + limitConfig.windowMs;\r\n\r\n // Get current count from database using existing Database methods\r\n const existing = await db.queryOne(\r\n `SELECT COUNT(*) as count FROM sys_rate_limits \r\n WHERE ip = ? AND endpoint = ? AND timestamp >= ? AND timestamp < ?`,\r\n [ip, endpoint, windowStart, windowEnd]\r\n );\r\n\r\n const currentCount = existing?.count || 0;\r\n const newCount = currentCount + 1;\r\n \r\n // Insert this request using existing Database methods\r\n await db.execute(\r\n `INSERT INTO sys_rate_limits (ip, endpoint, timestamp) VALUES (?, ?, ?)`,\r\n [ip, endpoint, now]\r\n );\r\n\r\n // Check if limit exceeded\r\n const limitExceeded = newCount > limitConfig.requests;\r\n const remaining = Math.max(0, limitConfig.requests - newCount);\r\n\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Rate Limit Validation\",\r\n limitExceeded ? \"Rate limit exceeded\" : \"Within rate limits\",\r\n !limitExceeded,\r\n {\r\n endpoint,\r\n count: newCount,\r\n limit: limitConfig.requests,\r\n remaining,\r\n ip,\r\n }\r\n );\r\n }\r\n\r\n if (limitExceeded) {\r\n logger.warn(\"Rate limit exceeded\", {\r\n ip,\r\n endpoint,\r\n count: newCount,\r\n limit: limitConfig.requests,\r\n });\r\n\r\n const resetTime = windowStart + limitConfig.windowMs;\r\n const retryAfter = Math.ceil((resetTime - now) / 1000);\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"Too many requests\",\r\n message: \"Rate limit exceeded. Please try again later.\",\r\n retryAfter,\r\n }),\r\n {\r\n status: 429,\r\n headers: {\r\n \"Content-Type\": \"application/json\",\r\n \"Retry-After\": retryAfter.toString(),\r\n \"X-RateLimit-Limit\": limitConfig.requests.toString(),\r\n \"X-RateLimit-Remaining\": remaining.toString(),\r\n \"X-RateLimit-Reset\": resetTime.toString(),\r\n },\r\n }\r\n );\r\n }\r\n\r\n // Clean up old entries periodically\r\n if (Math.random() < environment.RATE_LIMIT_CLEANUP_PROBABILITY) {\r\n const cutoff = now - environment.RATE_LIMIT_CLEANUP_CUTOFF_AGE_MS;\r\n await db.execute(\r\n `DELETE FROM sys_rate_limits WHERE timestamp < ?`,\r\n [cutoff]\r\n );\r\n }\r\n\r\n return null; // Allow request to continue\r\n}\r\n",[],[175,353,425],{"_105":433,"_96":434,"_157":435,"_159":354,"_160":142,"_161":436,"_163":22,"_107":437,"_101":283,"_165":194,"_167":438,"_168":22,"_169":-5,"_170":439,"_99":440},"4a411150-5e6d-11f0-a4b5-0224a6c84d84","requestLogger.ts","cabb505a-5c67-11f0-93f2-0224a6c84d84",606,["D",1752248393860],"import { requestId } from \"npm:hono/request-id\";\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { logInfo } from \"../utils/logger.ts\";\r\nimport {\r\n getClientInfo,\r\n anonymizeIP,\r\n parseIPAddress,\r\n createRateLimitKey,\r\n performIPSecurityCheck,\r\n} from \"../utils/ipUtils.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { generateUUID } from \"../utils/crypto.ts\";\r\n\r\ninterface MinimalRequestLog {\r\n method: string;\r\n url: string;\r\n headers: Record;\r\n ip?: string;\r\n ipAnonymized?: string;\r\n ipType?: string;\r\n ipVersion?: string;\r\n userAgent?: string;\r\n referer?: string;\r\n origin?: string;\r\n requestId?: string;\r\n rateLimitKey?: string;\r\n securityWarning?: string;\r\n}\r\n\r\ninterface MinimalResponseLog {\r\n status: number;\r\n statusText: string;\r\n headers: Record;\r\n duration?: number;\r\n}\r\n\r\nfunction extractRequestLog(c: Context): MinimalRequestLog {\r\n const req = c.req.raw;\r\n const headers: Record = {};\r\n req.headers.forEach((value: string, key: string) => {\r\n headers[key.toLowerCase()] = value;\r\n });\r\n\r\n // Sanitize sensitive headers\r\n const sensitiveHeaders = [\r\n \"authorization\",\r\n \"cookie\",\r\n \"x-api-key\",\r\n \"x-auth-token\",\r\n ];\r\n sensitiveHeaders.forEach((header) => {\r\n if (headers[header]) {\r\n headers[header] = \"[REDACTED]\";\r\n }\r\n });\r\n\r\n // Use improved IP detection\r\n const clientInfo = getClientInfo(c);\r\n\r\n // Parse IP for additional info\r\n const ipInfo = parseIPAddress(clientInfo.ip);\r\n\r\n // Get request ID from Hono context\r\n const reqId = c.get(\"requestId\") as string;\r\n\r\n // Create rate limit key\r\n const rateLimitKey = createRateLimitKey(clientInfo.ip);\r\n\r\n // Perform security check\r\n const securityCheck = performIPSecurityCheck(clientInfo.ip);\r\n\r\n return {\r\n method: req.method,\r\n url: req.url,\r\n headers,\r\n ip: clientInfo.ip,\r\n ipAnonymized: anonymizeIP(clientInfo.ip),\r\n ipType: ipInfo ? (ipInfo.isPrivate ? \"private\" : \"public\") : undefined,\r\n ipVersion: ipInfo?.version,\r\n userAgent: clientInfo.userAgent,\r\n referer: clientInfo.referer || undefined,\r\n origin: clientInfo.origin || undefined,\r\n requestId: reqId,\r\n rateLimitKey,\r\n securityWarning: !securityCheck.allowed ? securityCheck.reason : undefined,\r\n };\r\n}\r\n\r\nfunction extractResponseLog(\r\n res: Response,\r\n duration?: number\r\n): MinimalResponseLog {\r\n const headers: Record = {};\r\n res.headers.forEach((value, key) => {\r\n headers[key.toLowerCase()] = value;\r\n });\r\n return {\r\n status: res.status,\r\n statusText: res.statusText,\r\n headers,\r\n duration,\r\n };\r\n}\r\n\r\n/**\r\n * Request ID middleware - generates unique ID for each request\r\n */\r\nexport const requestIdMiddleware = requestId({\r\n limitLength: 255,\r\n headerName: \"X-Request-Id\",\r\n generator: (c: Context) => generateUUID(),\r\n});\r\n\r\n/**\r\n * Request logger middleware - logs request/response with request ID\r\n */\r\nexport async function requestLoggerMiddleware(c: Context, next: Next) {\r\n const startTime = performance.now();\r\n const reqLog = extractRequestLog(c);\r\n const requestId = c.get(\"requestId\") as string;\r\n\r\n // Get client info and set in context for downstream middleware\r\n const clientInfo = getClientInfo(c);\r\n c.set(\"clientIP\", clientInfo.ip);\r\n c.set(\"clientInfo\", clientInfo);\r\n\r\n // Check if this IP should bypass rate limiting (admin IPs)\r\n if (environment.ADMIN_IPS.includes(clientInfo.ip)) {\r\n c.set(\"bypassRateLimit\", true);\r\n }\r\n\r\n await next();\r\n\r\n const duration = Math.round(performance.now() - startTime);\r\n const resLog = extractResponseLog(c.res, duration);\r\n\r\n // Ensure request ID is in response headers\r\n c.res.headers.set(\"X-Request-Id\", requestId);\r\n\r\n // Determine log level based on response status and security warnings\r\n const isError = resLog.status >= 500 || reqLog.securityWarning;\r\n const isWarning = resLog.status >= 400;\r\n\r\n // Build comprehensive log entry\r\n const logEntry = {\r\n request: reqLog,\r\n response: resLog,\r\n requestId,\r\n duration,\r\n timestamp: new Date().toISOString(),\r\n path: new URL(reqLog.url).pathname,\r\n // Additional metadata\r\n metadata: {\r\n ipType: reqLog.ipType,\r\n ipVersion: reqLog.ipVersion,\r\n rateLimitKey: reqLog.rateLimitKey,\r\n securityWarning: reqLog.securityWarning,\r\n bypassRateLimit: c.get(\"bypassRateLimit\") || false,\r\n },\r\n };\r\n\r\n // Log with appropriate level\r\n if (isError) {\r\n logInfo(JSON.stringify(logEntry), \"http_error\", { level: \"ERROR\" });\r\n } else if (isWarning) {\r\n logInfo(JSON.stringify(logEntry), \"http_response\", { level: \"WARN\" });\r\n } else {\r\n logInfo(JSON.stringify(logEntry), \"http_response\");\r\n }\r\n\r\n // Log security warnings separately for monitoring\r\n if (reqLog.securityWarning) {\r\n logInfo(`Security warning for request`, \"security_check\", {\r\n requestId,\r\n ip: reqLog.ipAnonymized,\r\n warning: reqLog.securityWarning,\r\n path: new URL(reqLog.url).pathname,\r\n });\r\n }\r\n}\r\n",[],[175,353,434],{"_105":442,"_96":443,"_157":444,"_159":354,"_160":142,"_161":445,"_163":119,"_107":446,"_101":355,"_165":194,"_167":447,"_168":22,"_169":-5,"_170":448,"_99":449},"4a4a3d20-5e6d-11f0-8719-0224a6c84d84","secureHeaders.ts","cacf7c42-5c67-11f0-b3bd-0224a6c84d84",607,["D",1752248393921],"import { secureHeaders, NONCE } from \"npm:hono/secure-headers\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\n/**\r\n * Secure Headers Middleware\r\n *\r\n * Uses the following environment configurations:\r\n * - environment.APP_ENV: Determines production vs development CSP policies\r\n * - environment.ALLOWED_ORIGINS: Used in CSP connectSrc directive for allowed API endpoints\r\n * - environment.BASE_URL: Included in CSP connectSrc if not already in ALLOWED_ORIGINS\r\n *\r\n * CSP Policies:\r\n * - Production: Strict policies with minimal allowances\r\n * - Development: More permissive with unsafe-eval, unsafe-inline, and additional CDNs\r\n */\r\n// Hono secure-headers types (since they're not exported)\r\ntype SecureHeadersOptions = {\r\n contentSecurityPolicy?: ContentSecurityPolicyOptions | false;\r\n strictTransportSecurity?: string | false;\r\n xFrameOptions?: string | false;\r\n xContentTypeOptions?: string | false;\r\n xXssProtection?: string | false;\r\n referrerPolicy?: string | false;\r\n crossOriginResourcePolicy?: string | false;\r\n crossOriginOpenerPolicy?: string | false;\r\n crossOriginEmbedderPolicy?: string | false;\r\n originAgentCluster?: boolean;\r\n xDnsPrefetchControl?: string | false;\r\n xDownloadOptions?: string | false;\r\n xPermittedCrossDomainPolicies?: string | false;\r\n permissionsPolicy?: Record;\r\n removePoweredBy?: boolean;\r\n};\r\ntype ContentSecurityPolicyOptions = Record;\r\n\r\n// CSP directive configuration interface with index signature\r\ninterface CSPDirectives {\r\n defaultSrc?: string[];\r\n scriptSrc?: string[];\r\n styleSrc?: string[];\r\n imgSrc?: string[];\r\n connectSrc?: string[];\r\n fontSrc?: string[];\r\n objectSrc?: string[];\r\n mediaSrc?: string[];\r\n frameSrc?: string[];\r\n childSrc?: string[];\r\n workerSrc?: string[];\r\n manifestSrc?: string[];\r\n baseUri?: string[];\r\n formAction?: string[];\r\n frameAncestors?: string[];\r\n sandbox?: string[];\r\n reportTo?: string;\r\n upgradeInsecureRequests?: string[];\r\n blockAllMixedContent?: boolean;\r\n scriptSrcAttr?: string[];\r\n scriptSrcElem?: string[];\r\n styleSrcAttr?: string[];\r\n styleSrcElem?: string[];\r\n // Add index signature to make it compatible with ContentSecurityPolicyOptions\r\n [key: string]: string | string[] | boolean | undefined;\r\n}\r\n\r\n// Permissions Policy configuration interface with index signature\r\ninterface PermissionsPolicyDirectives {\r\n accelerometer?: string[] | boolean;\r\n ambientLightSensor?: string[] | boolean;\r\n autoplay?: string[] | boolean;\r\n battery?: string[] | boolean;\r\n bluetooth?: string[] | boolean;\r\n browsingTopics?: string[] | boolean;\r\n camera?: string[] | boolean;\r\n displayCapture?: string[] | boolean;\r\n documentDomain?: string[] | boolean;\r\n encryptedMedia?: string[] | boolean;\r\n executionWhileNotRendered?: string[] | boolean;\r\n executionWhileOutOfViewport?: string[] | boolean;\r\n fullscreen?: string[] | boolean;\r\n gamepad?: string[] | boolean;\r\n geolocation?: string[] | boolean;\r\n gyroscope?: string[] | boolean;\r\n hid?: string[] | boolean;\r\n identityCredentialsGet?: string[] | boolean;\r\n idleDetection?: string[] | boolean;\r\n localFonts?: string[] | boolean;\r\n magnetometer?: string[] | boolean;\r\n microphone?: string[] | boolean;\r\n midi?: string[] | boolean;\r\n navigationOverride?: string[] | boolean;\r\n otpCredentials?: string[] | boolean;\r\n payment?: string[] | boolean;\r\n pictureInPicture?: string[] | boolean;\r\n publickeyCredentialsCreate?: string[] | boolean;\r\n publickeyCredentialsGet?: string[] | boolean;\r\n screenWakeLock?: string[] | boolean;\r\n serial?: string[] | boolean;\r\n speakerSelection?: string[] | boolean;\r\n storageAccess?: string[] | boolean;\r\n syncXhr?: string[] | boolean;\r\n usb?: string[] | boolean;\r\n webShare?: string[] | boolean;\r\n windowManagement?: string[] | boolean;\r\n xrSpatialTracking?: string[] | boolean;\r\n // Add index signature to make it compatible with Record\r\n [key: string]: string[] | boolean | undefined;\r\n}\r\n\r\nexport function addSecurityHeaders(response: Response): Response {\r\n const headers = getSecurityHeaders();\r\n\r\n // Clone the response to avoid mutating the original\r\n const newResponse = new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers: new Headers(response.headers),\r\n });\r\n\r\n // Add security headers\r\n Object.entries(headers).forEach(([name, value]) => {\r\n newResponse.headers.set(name, value);\r\n });\r\n\r\n return newResponse;\r\n}\r\n\r\n// Production CSP configuration (strict)\r\nfunction getProductionCSPDirectives(): CSPDirectives {\r\n return {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway styles\r\n \"'unsafe-inline'\", // Required for inline styles - consider using nonces in future\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\", // Allow data URLs for images\r\n \"https:\", // Allow HTTPS images\r\n \"https://images.unsplash.com\", // Unsplash for tour images\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile API\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway API\r\n // Include all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS.filter(\r\n (origin) => origin !== \"'self'\" && origin !== \"*\"\r\n ),\r\n // Include BASE_URL if not already in ALLOWED_ORIGINS\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ],\r\n fontSrc: [\r\n \"'self'\",\r\n \"https:\", // Allow HTTPS fonts\r\n \"data:\", // Allow data URL fonts\r\n ],\r\n objectSrc: [\"'none'\"], // Disable object/embed/applet for security\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile iframe\r\n ],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"], // Prevent clickjacking\r\n upgradeInsecureRequests: [], // Enable upgrade-insecure-requests\r\n blockAllMixedContent: true, // Block mixed content\r\n };\r\n}\r\n\r\n// Development CSP configuration (more permissive)\r\nfunction getDevelopmentCSPDirectives(): CSPDirectives {\r\n return {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"'unsafe-eval'\", // Allow eval for dev tools\r\n \"'unsafe-inline'\", // Allow inline scripts for dev\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\",\r\n \"https://cdn.twind.style\", // Twind CSS\r\n \"https://cdn.jsdelivr.net\", // CDN for dev libraries\r\n \"https://unpkg.com\", // CDN for dev libraries\r\n \"https://esm.sh\", // ES modules CDN\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"'unsafe-inline'\", // Allow inline styles for dev\r\n \"https://payuat.travelpay.com.au\",\r\n \"https://cdn.jsdelivr.net\",\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\",\r\n \"https:\",\r\n \"https://placehold.co\", // Placeholder images for dev\r\n \"https://source.unsplash.com\", // Dev image sources\r\n \"https://images.unsplash.com\",\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"ws:\", // Allow WebSocket for dev servers\r\n \"wss:\", // Allow secure WebSocket\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\",\r\n // Include all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS.filter(\r\n (origin) => origin !== \"'self'\" && origin !== \"*\"\r\n ),\r\n // Include BASE_URL if not already in ALLOWED_ORIGINS\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ],\r\n fontSrc: [\"'self'\", \"https:\", \"data:\"],\r\n objectSrc: [\"'none'\"],\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\"'self'\", \"https://challenges.cloudflare.com\"],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"],\r\n upgradeInsecureRequests: [],\r\n blockAllMixedContent: false, // Allow mixed content in dev\r\n };\r\n}\r\n\r\n// Permissions Policy configuration\r\nconst permissionsPolicyDirectives: PermissionsPolicyDirectives = {\r\n // Disable dangerous permissions by default\r\n bluetooth: false,\r\n camera: false,\r\n microphone: false,\r\n geolocation: false,\r\n usb: false,\r\n serial: false,\r\n hid: false,\r\n\r\n // Allow safe permissions for self\r\n fullscreen: [\"'self'\"],\r\n payment: [\"'self'\", \"https://payuat.travelpay.com.au\"], // Allow payment for ZenPay\r\n\r\n // Disable synchronous XHR (deprecated)\r\n syncXhr: [],\r\n\r\n // Allow autoplay for self (for better UX)\r\n autoplay: [\"'self'\"],\r\n\r\n // Allow picture-in-picture for self\r\n pictureInPicture: [\"'self'\"],\r\n\r\n // Disable other potentially risky features\r\n ambientLightSensor: false,\r\n accelerometer: false,\r\n gyroscope: false,\r\n magnetometer: false,\r\n battery: false,\r\n displayCapture: false,\r\n documentDomain: false,\r\n encryptedMedia: false,\r\n gamepad: false,\r\n idleDetection: false,\r\n midi: false,\r\n otpCredentials: false,\r\n publickeyCredentialsCreate: [\"'self'\"],\r\n publickeyCredentialsGet: [\"'self'\"],\r\n screenWakeLock: false,\r\n speakerSelection: false,\r\n storageAccess: false,\r\n webShare: [\"'self'\"],\r\n windowManagement: false,\r\n xrSpatialTracking: false,\r\n};\r\n\r\n/**\r\n * Get CSP directives based on environment\r\n */\r\nfunction getCSPDirectives(): ContentSecurityPolicyOptions {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n const directives = isProduction\r\n ? getProductionCSPDirectives()\r\n : getDevelopmentCSPDirectives();\r\n\r\n // Log CSP configuration for debugging\r\n console.log(`🛡️ CSP Configuration (${environment.APP_ENV}):`, {\r\n environment: environment.APP_ENV,\r\n isProduction,\r\n allowedOrigins: environment.ALLOWED_ORIGINS,\r\n baseUrl: environment.BASE_URL,\r\n connectSrcCount: Array.isArray(directives.connectSrc)\r\n ? directives.connectSrc.length\r\n : 0,\r\n scriptSrcCount: Array.isArray(directives.scriptSrc)\r\n ? directives.scriptSrc.length\r\n : 0,\r\n blockAllMixedContent: directives.blockAllMixedContent,\r\n });\r\n\r\n return directives;\r\n}\r\n\r\n/**\r\n * Get comprehensive secure headers configuration\r\n */\r\n/**\r\n * Get comprehensive secure headers configuration\r\n */\r\nexport function getSecureHeadersOptions(): SecureHeadersOptions {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n\r\n const baseOptions: SecureHeadersOptions = {\r\n // Remove X-Powered-By header\r\n removePoweredBy: true,\r\n\r\n // Strict Transport Security - more restrictive in production\r\n strictTransportSecurity: isProduction\r\n ? \"max-age=31536000; includeSubDomains; preload\"\r\n : \"max-age=3600; includeSubDomains\",\r\n\r\n // X-Frame-Options - prevent clickjacking\r\n xFrameOptions: \"DENY\",\r\n\r\n // X-Content-Type-Options - prevent MIME sniffing\r\n xContentTypeOptions: \"nosniff\",\r\n\r\n // X-XSS-Protection - legacy XSS protection\r\n xXssProtection: \"0\", // Recommended to disable as per modern security practices\r\n\r\n // Referrer Policy - control referrer information\r\n referrerPolicy: \"strict-origin-when-cross-origin\",\r\n\r\n // Cross-Origin policies\r\n crossOriginResourcePolicy: \"same-origin\",\r\n crossOriginOpenerPolicy: \"same-origin\",\r\n crossOriginEmbedderPolicy: false, // Disable if not needed\r\n\r\n // Origin Agent Cluster\r\n originAgentCluster: true,\r\n\r\n // DNS Prefetch Control\r\n xDnsPrefetchControl: \"off\",\r\n\r\n // Download Options (IE-specific)\r\n xDownloadOptions: \"noopen\",\r\n\r\n // Permitted Cross-Domain Policies\r\n xPermittedCrossDomainPolicies: \"none\",\r\n\r\n // Permissions Policy\r\n permissionsPolicy: permissionsPolicyDirectives,\r\n };\r\n\r\n // Only add contentSecurityPolicy if it's not disabled\r\n const cspDirectives = getCSPDirectives();\r\n if (Object.keys(cspDirectives).length > 0) {\r\n baseOptions.contentSecurityPolicy = cspDirectives;\r\n }\r\n\r\n return baseOptions;\r\n}\r\n\r\n/**\r\n * Display startup information about security headers configuration\r\n */\r\nfunction logSecurityHeadersStartup(): void {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n const cspDirectives = getCSPDirectives();\r\n\r\n console.log(`🛡️ Security Headers Configuration:`);\r\n console.log(` Environment: ${environment.APP_ENV}`);\r\n console.log(\r\n ` CSP Policy: ${\r\n isProduction ? \"Production (Strict)\" : \"Development (Permissive)\"\r\n }`\r\n );\r\n console.log(\r\n ` Allowed Origins: ${environment.ALLOWED_ORIGINS.length} configured`\r\n );\r\n console.log(` Base URL: ${environment.BASE_URL}`);\r\n console.log(\r\n ` Connect Sources: ${\r\n Array.isArray(cspDirectives.connectSrc)\r\n ? cspDirectives.connectSrc.length\r\n : 0\r\n } allowed`\r\n );\r\n console.log(\r\n ` Script Sources: ${\r\n Array.isArray(cspDirectives.scriptSrc)\r\n ? cspDirectives.scriptSrc.length\r\n : 0\r\n } allowed`\r\n );\r\n console.log(\r\n ` Mixed Content: ${\r\n cspDirectives.blockAllMixedContent ? \"Blocked\" : \"Allowed\"\r\n }`\r\n );\r\n console.log(\r\n ` Frame Ancestors: ${\r\n Array.isArray(cspDirectives.frameAncestors)\r\n ? cspDirectives.frameAncestors.join(\", \")\r\n : \"None\"\r\n }`\r\n );\r\n}\r\n\r\n/**\r\n * Create Hono secure headers middleware\r\n */\r\nexport function createSecureHeadersMiddleware() {\r\n // Log startup information\r\n logSecurityHeadersStartup();\r\n\r\n const options = getSecureHeadersOptions();\r\n // Only pass to secureHeaders if contentSecurityPolicy is not false\r\n if (options.contentSecurityPolicy === false) {\r\n const {\r\n contentSecurityPolicy: _contentSecurityPolicy,\r\n ...optionsWithoutCSP\r\n } = options;\r\n return secureHeaders(optionsWithoutCSP as any); // Type assertion needed due to Hono's type definitions\r\n }\r\n return secureHeaders(options as any); // Type assertion needed due to Hono's type definitions\r\n}\r\n\r\n/**\r\n * Get security headers as a plain object (for manual header setting)\r\n */\r\nexport function getSecurityHeaders(): Record {\r\n const options = getSecureHeadersOptions();\r\n const headers: Record = {};\r\n\r\n // Build CSP header\r\n if (options.contentSecurityPolicy) {\r\n const csp = options.contentSecurityPolicy;\r\n const policies: string[] = [];\r\n\r\n Object.entries(csp).forEach(([directive, value]) => {\r\n if (Array.isArray(value) && value.length > 0) {\r\n const kebabDirective = directive\r\n .replace(/([A-Z])/g, \"-$1\")\r\n .toLowerCase();\r\n policies.push(`${kebabDirective} ${value.join(\" \")}`);\r\n } else if (\r\n directive === \"upgradeInsecureRequests\" &&\r\n Array.isArray(value)\r\n ) {\r\n policies.push(\"upgrade-insecure-requests\");\r\n } else if (directive === \"blockAllMixedContent\" && value === true) {\r\n policies.push(\"block-all-mixed-content\");\r\n } else if (typeof value === \"string\") {\r\n const kebabDirective = directive\r\n .replace(/([A-Z])/g, \"-$1\")\r\n .toLowerCase();\r\n policies.push(`${kebabDirective} ${value}`);\r\n }\r\n });\r\n\r\n if (policies.length > 0) {\r\n headers[\"Content-Security-Policy\"] = policies.join(\"; \");\r\n }\r\n }\r\n\r\n // Build Permissions Policy header\r\n if (options.permissionsPolicy) {\r\n const policies: string[] = [];\r\n Object.entries(options.permissionsPolicy).forEach(([feature, value]) => {\r\n const kebabFeature = feature.replace(/([A-Z])/g, \"-$1\").toLowerCase();\r\n if (value === false) {\r\n policies.push(`${kebabFeature}=()`);\r\n } else if (value === true) {\r\n policies.push(`${kebabFeature}=*`);\r\n } else if (Array.isArray(value)) {\r\n if (value.length === 0) {\r\n policies.push(`${kebabFeature}=()`);\r\n } else {\r\n const origins = value\r\n .map((origin) =>\r\n origin === \"'self'\" || origin === \"'none'\" || origin === \"*\"\r\n ? origin\r\n : `\"${origin}\"`\r\n )\r\n .join(\" \");\r\n policies.push(`${kebabFeature}=(${origins})`);\r\n }\r\n }\r\n });\r\n\r\n if (policies.length > 0) {\r\n headers[\"Permissions-Policy\"] = policies.join(\", \");\r\n }\r\n }\r\n\r\n // Add other security headers\r\n if (options.strictTransportSecurity) {\r\n headers[\"Strict-Transport-Security\"] = options.strictTransportSecurity;\r\n }\r\n\r\n if (options.xFrameOptions) {\r\n headers[\"X-Frame-Options\"] = options.xFrameOptions;\r\n }\r\n\r\n if (options.xContentTypeOptions) {\r\n headers[\"X-Content-Type-Options\"] = options.xContentTypeOptions;\r\n }\r\n\r\n if (options.xXssProtection) {\r\n headers[\"X-XSS-Protection\"] = options.xXssProtection;\r\n }\r\n\r\n if (options.referrerPolicy) {\r\n headers[\"Referrer-Policy\"] = options.referrerPolicy;\r\n }\r\n\r\n if (options.crossOriginResourcePolicy) {\r\n headers[\"Cross-Origin-Resource-Policy\"] = options.crossOriginResourcePolicy;\r\n }\r\n\r\n if (options.crossOriginOpenerPolicy) {\r\n headers[\"Cross-Origin-Opener-Policy\"] = options.crossOriginOpenerPolicy;\r\n }\r\n\r\n if (options.crossOriginEmbedderPolicy) {\r\n headers[\"Cross-Origin-Embedder-Policy\"] = options.crossOriginEmbedderPolicy;\r\n }\r\n\r\n if (options.originAgentCluster) {\r\n headers[\"Origin-Agent-Cluster\"] = \"?1\";\r\n }\r\n\r\n if (options.xDnsPrefetchControl) {\r\n headers[\"X-DNS-Prefetch-Control\"] = options.xDnsPrefetchControl;\r\n }\r\n\r\n if (options.xDownloadOptions) {\r\n headers[\"X-Download-Options\"] = options.xDownloadOptions;\r\n }\r\n\r\n if (options.xPermittedCrossDomainPolicies) {\r\n headers[\"X-Permitted-Cross-Domain-Policies\"] =\r\n options.xPermittedCrossDomainPolicies;\r\n }\r\n\r\n return headers;\r\n}\r\n\r\n/**\r\n * Middleware function that applies security headers\r\n */\r\nexport function secureHeadersMiddleware() {\r\n return async (c: any, next: any) => {\r\n await next();\r\n\r\n // Add security headers to the response\r\n const securityHeaders = getSecurityHeaders();\r\n Object.entries(securityHeaders).forEach(([name, value]) => {\r\n c.res.headers.set(name, value);\r\n });\r\n\r\n // Remove X-Powered-By if removePoweredBy is enabled\r\n const options = getSecureHeadersOptions();\r\n if (options.removePoweredBy) {\r\n c.res.headers.delete(\"X-Powered-By\");\r\n }\r\n };\r\n}\r\n\r\n/**\r\n * Enhanced secure headers middleware with nonce support\r\n */\r\nexport function createNonceSecureHeadersMiddleware() {\r\n const baseOptions = getSecureHeadersOptions();\r\n const cspDirectives = getCSPDirectives();\r\n\r\n // Safely handle scriptSrc and styleSrc which might not be arrays\r\n const scriptSrc = cspDirectives.scriptSrc;\r\n const styleSrc = cspDirectives.styleSrc;\r\n\r\n const updatedOptions = {\r\n ...baseOptions,\r\n contentSecurityPolicy: {\r\n ...cspDirectives,\r\n scriptSrc: [\r\n NONCE,\r\n ...(Array.isArray(scriptSrc)\r\n ? scriptSrc.filter((src) => src !== \"'unsafe-inline'\")\r\n : []),\r\n ],\r\n styleSrc: [\r\n NONCE,\r\n ...(Array.isArray(styleSrc)\r\n ? styleSrc.filter((src) => src !== \"'unsafe-inline'\")\r\n : []),\r\n ],\r\n },\r\n };\r\n\r\n // Handle the case where contentSecurityPolicy might be false\r\n if (baseOptions.contentSecurityPolicy === false) {\r\n return secureHeaders(baseOptions as any);\r\n }\r\n\r\n return secureHeaders(updatedOptions);\r\n}\r\n\r\n// Export types and constants\r\nexport type {\r\n CSPDirectives,\r\n PermissionsPolicyDirectives,\r\n SecureHeadersOptions,\r\n ContentSecurityPolicyOptions,\r\n};\r\nexport { NONCE };\r\n\r\n// Default export for backwards compatibility\r\nexport default {\r\n createSecureHeadersMiddleware,\r\n getSecureHeadersOptions,\r\n getSecurityHeaders,\r\n secureHeadersMiddleware,\r\n createNonceSecureHeadersMiddleware,\r\n NONCE,\r\n};\r\n",[],[175,353,443],{"_105":451,"_96":452,"_157":453,"_159":354,"_160":142,"_161":454,"_163":119,"_107":455,"_101":177,"_165":194,"_167":456,"_168":22,"_169":-5,"_170":457,"_99":458},"4a56b7bc-5e6d-11f0-8ec4-0224a6c84d84","security.ts","50c82d46-5c70-11f0-9378-0224a6c84d84",608,["D",1752248393999],"import { logger } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logSecurityCheck } from \"../middleware/debugger.ts\";\r\n\r\nexport function securityMiddleware(\r\n request: Request,\r\n correlationId?: string\r\n): Response | null {\r\n const url = new URL(request.url);\r\n const ip =\r\n request.headers.get(\"cf-connecting-ip\") ||\r\n request.headers.get(\"x-forwarded-for\") ||\r\n \"unknown\";\r\n const userAgent = request.headers.get(\"user-agent\") || \"\";\r\n const referer = request.headers.get(\"referer\") || \"\";\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n\r\n // Basic security headers validation\r\n const securityViolations: string[] = [];\r\n\r\n // Check for suspicious user agents using configuration\r\n const suspiciousPatterns = environment.SECURITY_SUSPICIOUS_USER_AGENTS.map(\r\n (pattern) => new RegExp(pattern, \"i\")\r\n );\r\n\r\n if (suspiciousPatterns.some((pattern) => pattern.test(userAgent))) {\r\n securityViolations.push(\"suspicious_user_agent\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"User Agent Security Scan\",\r\n \"Suspicious pattern detected\",\r\n false,\r\n { userAgent: userAgent.substring(0, 50), ip }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"User Agent Security Scan\",\r\n \"Clean user agent\",\r\n true,\r\n { userAgent: userAgent.substring(0, 50), ip }\r\n );\r\n }\r\n }\r\n\r\n // Validate referer for sensitive endpoints using configuration\r\n const sensitiveEndpoints = environment.SECURITY_SENSITIVE_ENDPOINTS;\r\n\r\n if (sensitiveEndpoints.includes(url.pathname)) {\r\n if (\r\n referer &&\r\n !environment.ALLOWED_ORIGINS.some((allowedOrigin) =>\r\n referer.startsWith(allowedOrigin)\r\n )\r\n ) {\r\n securityViolations.push(\"invalid_referer\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Referer Validation\",\r\n `Invalid referer for ${url.pathname}`,\r\n false,\r\n { referer, endpoint: url.pathname }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Referer Validation\",\r\n `Valid referer for ${url.pathname}`,\r\n true,\r\n { referer: referer || \"none\", endpoint: url.pathname }\r\n );\r\n }\r\n }\r\n\r\n if (origin && !environment.ALLOWED_ORIGINS.includes(origin)) {\r\n securityViolations.push(\"invalid_origin\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Origin Validation\",\r\n `Invalid origin for ${url.pathname}`,\r\n false,\r\n { origin, endpoint: url.pathname }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Origin Validation\",\r\n `Valid origin for ${url.pathname}`,\r\n true,\r\n { origin: origin || \"none\", endpoint: url.pathname }\r\n );\r\n }\r\n }\r\n }\r\n\r\n // Check for common attack patterns in headers\r\n const dangerousPatterns = [\r\n /

ianmenethil

ZenServer