\r\n

Loading API Documentation...

\r\n

\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n // Security headers handled by middleware\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n }\r\n\r\n /**\r\n * Serves OAuth2 redirect page for Swagger UI authentication\r\n */\r\n static serveOAuth2Redirect(): Response {\r\n const html = `\r\n\r\n\r\n\r\n \r\n OAuth2 Redirect\r\n\r\n\r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=86400\", // Cache for 24 hours\r\n },\r\n });\r\n }\r\n\r\n /**\r\n * Serves Redocly-style documentation with enhanced features\r\n */\r\n static serveRedocDocs(request: Request): Response {\r\n try {\r\n const url = new URL(request.url);\r\n const specUrl = `${url.origin}/api/v1/openapi.json`;\r\n console.log(`Redoc will fetch OpenAPI spec from: ${specUrl}`);\r\n\r\n const title = \"🛡️ ZenPay API Documentation 📚\";\r\n\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n ${title}\r\n \r\n \r\n\r\n\r\n

Loading API Documentation...

\r\n \r\n \r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n // Security headers handled by middleware\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n } catch (error) {\r\n // Return error page\r\n const errorHtml = `\r\n\r\n\r\n\r\n \r\n \r\n API Documentation Error\r\n \r\n\r\n\r\n

\r\n

API Documentation Unavailable

\r\n

The API documentation could not be loaded at this time.

\r\n

\r\n Error: ${error.message}\r\n

\r\n

This usually happens when:

\r\n

The OpenAPI specification file is not accessible
The server is still initializing
There's a configuration error

\r\n \r\n

\r\n\r\n`;\r\n\r\n return new Response(errorHtml, {\r\n status: 500,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n // Security headers handled by middleware\r\n },\r\n });\r\n }\r\n }\r\n\r\n /**\r\n * Serves interactive Fiberplane playground for API testing\r\n */\r\n static async serveFiberplanePlayground(request: Request): Promise {\r\n try {\r\n // Use the loader instance that was set by API Gateway\r\n if (!this.loader) {\r\n throw new Error(\"OpenAPI loader not initialized. DocsHandler.setLoader() must be called first.\");\r\n }\r\n\r\n // Get OpenAPI spec directly from loader (no HTTP request needed)\r\n const openApiSpec = this.loader.getSpec();\r\n\r\n const title = \"🛡️ ZenPay API Playground ⚔️\";\r\n\r\n const html = `\r\n\r\n\r\n\r\n \r\n \r\n ${title}\r\n \r\n\r\n\r\n

\r\n

${title}

\r\n

Interactive API Testing Environment

\r\n

\r\n \r\n

\r\n

API Endpoints

\r\n

Loading API endpoints...

\r\n

\r\n \r\n

\r\n

Request Builder

\r\n

Select an endpoint from the left to start building a request.

\r\n

\r\n \r\n

\r\n

Response

\r\n

Ready to send requests...

\r\n

\r\n\r\n \r\n\r\n`;\r\n\r\n return new Response(html, {\r\n status: 200,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n \"Cache-Control\": \"public, max-age=300, stale-while-revalidate=3600\",\r\n // Security headers handled by middleware\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\",\r\n },\r\n });\r\n } catch (error) {\r\n console.error(\"Error in serveFiberplanePlayground:\", error);\r\n\r\n const errorHtml = `\r\n\r\n\r\n\r\n \r\n \r\n Playground Error\r\n \r\n\r\n\r\n

\r\n

API Playground Unavailable

\r\n

The API playground could not be loaded at this time.

\r\n

\r\n Error: ${error.message}\r\n

\r\n

This usually happens when:

\r\n

The OpenAPI specification file is not accessible
The server is still initializing
There's a configuration error

\r\n \r\n

\r\n\r\n`;\r\n\r\n return new Response(errorHtml, {\r\n status: 500,\r\n headers: {\r\n \"Content-Type\": \"text/html; charset=utf-8\",\r\n // Security headers handled by middleware\r\n },\r\n });\r\n }\r\n }\r\n}\r\n",[],[170,416,432],{"_102":441,"_95":442,"_151":443,"_153":417,"_154":136,"_155":444,"_157":158,"_104":445,"_99":313,"_160":189,"_162":446,"_163":22,"_164":-5,"_165":447,"_98":448},"cf1bfdf4-5ffd-11f0-af86-0224a6c84d84","dynamicHandler.ts","49156b8c-5e6d-11f0-b051-0224a6c84d84",846,["D",1752420415443],"/**\r\n * Dynamic Handler System\r\n *\r\n * This creates a truly dynamic system where:\r\n * 1. OpenAPI handles ALL validation automatically\r\n * 2. Handler routing is automatic based on operationId\r\n * 3. Business logic is separated from HTTP handling\r\n * 4. Adding new endpoints requires NO code changes here\r\n */\r\n\r\n// Note: AppContext type should be Context from Hono\r\ntype AppContext = any;\r\n\r\n// Import using the business logic compatibility layer\r\nimport * as businessLogic from \"./businessLogic.ts\";\r\n\r\ninterface HandlerContext {\r\n request: Request;\r\n context: AppContext;\r\n operationId: string;\r\n validatedData?: any;\r\n}\r\n\r\n/**\r\n * Universal Dynamic Handler\r\n *\r\n * This single handler can process ANY OpenAPI operation:\r\n * - Request validation: ✅ Done by OpenAPI middleware\r\n * - Response validation: ✅ Done by OpenAPI middleware\r\n * - Parameter parsing: ✅ Done by OpenAPI middleware\r\n * - Handler routing: ✅ Done dynamically here\r\n * - Business logic: ✅ Delegated to business logic modules\r\n */\r\nexport async function dynamicHandler({\r\n request,\r\n context,\r\n operationId,\r\n validatedData,\r\n}: HandlerContext): Promise {\r\n try {\r\n // Convert operationId to function name (camelCase)\r\n const handlerName = operationId;\r\n\r\n // Get the business logic function\r\n const businessLogicFunction = (businessLogic as any)[handlerName];\r\n\r\n if (!businessLogicFunction) {\r\n console.warn(`No business logic found for operation: ${operationId}`);\r\n return new Response(\r\n JSON.stringify({ error: `Handler not implemented: ${operationId}` }),\r\n { status: 501, headers: { \"Content-Type\": \"application/json\" } }\r\n );\r\n }\r\n\r\n // Call business logic with extracted data from createRouteHandler\r\n const result = await businessLogicFunction({\r\n // Data extracted by OpenAPI loader\r\n body: validatedData?.body,\r\n params: validatedData?.params,\r\n query: validatedData?.query,\r\n headers: validatedData?.headers,\r\n\r\n // Context\r\n db: context.get(\"db\"),\r\n correlationId: context.get(\"debugCorrelationId\"),\r\n request: request,\r\n\r\n // Raw context for advanced usage\r\n context: context,\r\n });\r\n\r\n // Business logic returns either:\r\n // 1. A Response object (for custom responses)\r\n // 2. { redirect: \"/path\" } object (for redirects)\r\n // 3. { data, status, headers } object\r\n // 4. Data object (for JSON responses)\r\n if (result instanceof Response) {\r\n return result;\r\n }\r\n\r\n if (result && typeof result === \"object\" && \"redirect\" in result) {\r\n return new Response(null, {\r\n status: 302,\r\n headers: { Location: result.redirect },\r\n });\r\n }\r\n\r\n if (result && typeof result === \"object\" && \"data\" in result) {\r\n // Check if CSRF session needs to be set\r\n if (result.csrfSession) {\r\n const { setCSRFCookies } = await import(\"../utils/cookies.ts\");\r\n const response = context.json(result.data, result.status || 200, result.headers);\r\n return setCSRFCookies(response, result.csrfSession);\r\n }\r\n return context.json(result.data, result.status || 200, result.headers);\r\n }\r\n\r\n return context.json(result);\r\n } catch (error) {\r\n console.error(`Error in dynamic handler for ${operationId}:`, error);\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"Internal server error\",\r\n operationId: operationId,\r\n message: error.message,\r\n }),\r\n {\r\n status: 500,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n );\r\n }\r\n}\r\n\r\n/**\r\n * Auto-Generate Handler Map\r\n *\r\n * This function automatically creates a handler map for ANY OpenAPI spec\r\n * by analyzing the operationIds and creating dynamic handlers for each\r\n */\r\nexport function createDynamicHandlerMap(operationIds: string[]) {\r\n const handlerMap: Record = {};\r\n\r\n for (const operationId of operationIds) {\r\n handlerMap[operationId] = ({\r\n request,\r\n context,\r\n params,\r\n query,\r\n body,\r\n headers,\r\n }: any) => {\r\n return dynamicHandler({\r\n request,\r\n context,\r\n operationId,\r\n validatedData: { params, query, body, headers },\r\n });\r\n };\r\n }\r\n\r\n return handlerMap;\r\n}\r\n\r\n/**\r\n * Extract Operation IDs from OpenAPI Spec\r\n */\r\nexport function extractOperationIds(openApiSpec: any): string[] {\r\n const operationIds: string[] = [];\r\n\r\n if (!openApiSpec.paths) return operationIds;\r\n\r\n for (const path in openApiSpec.paths) {\r\n const pathObj = openApiSpec.paths[path];\r\n\r\n for (const method in pathObj) {\r\n if (pathObj[method]?.operationId) {\r\n operationIds.push(pathObj[method].operationId);\r\n }\r\n }\r\n }\r\n\r\n return operationIds;\r\n}",[],[170,416,442],{"_102":450,"_95":451,"_151":452,"_153":417,"_154":136,"_155":453,"_157":158,"_104":454,"_99":208,"_160":189,"_162":455,"_163":22,"_164":-5,"_165":456,"_98":457},"f2ba8c5c-6008-11f0-871b-0224a6c84d84","errorHandler.ts","49189b0e-5e6d-11f0-a473-0224a6c84d84",869,["D",1752425199669],"// F:\\val.town\\ZenServer\\src\\handlers\\errorHandler.ts\r\n// ==================================================\r\n// SECTION: Global Error Handler\r\n// ==================================================\r\n\r\nimport { logger } from \"../utils/logger.ts\";\r\n\r\n/**\r\n * Global error handler for Hono/Deno apps.\r\n * Usage: app.onError(globalErrorHandler)\r\n */\r\nexport function globalErrorHandler(err: unknown, c: any) {\r\n const correlationId = c.get?.(\"debugCorrelationId\");\r\n if (correlationId) {\r\n logger.error(`[ERROR][${correlationId}]`, err);\r\n } else {\r\n logger.error(\"[ERROR]\", err);\r\n }\r\n\r\n const status = 500;\r\n if (err instanceof Response) return err;\r\n\r\n const showStack = Deno.env.get(\"APP_ENV\") === \"dev\";\r\n\r\n let stack: string | undefined = undefined;\r\n let message: string | undefined = undefined;\r\n if (showStack && typeof err === \"object\" && err !== null) {\r\n if (\r\n \"stack\" in err &&\r\n typeof (err as { stack?: unknown }).stack === \"string\"\r\n ) {\r\n stack = (err as { stack: string }).stack;\r\n }\r\n if (\r\n \"message\" in err &&\r\n typeof (err as { message?: unknown }).message === \"string\"\r\n ) {\r\n message = (err as { message: string }).message;\r\n }\r\n }\r\n\r\n return c.json(\r\n {\r\n error: \"Internal server error\",\r\n ...(showStack && { stack, message }),\r\n },\r\n status\r\n );\r\n}\r\n",[],[170,416,451],{"_102":459,"_95":460,"_151":461,"_153":417,"_154":136,"_155":462,"_157":158,"_104":463,"_99":179,"_160":189,"_162":464,"_163":22,"_164":-5,"_165":465,"_98":466},"cf2ff3d6-5ffd-11f0-83db-0224a6c84d84","fallbackHandler.ts","492c3696-5e6d-11f0-afd9-0224a6c84d84",848,["D",1752420415578],"/**\n * Fallback Handler - Provides graceful error handling when the OpenAPI specification fails to load.\n * This handler is registered when the OpenAPILoader encounters a critical error during initialization.\n */\nimport { OpenAPIHono } from \"npm:@hono/zod-openapi\";\nimport { environment } from \"../config/environment.ts\";\nimport { Database } from \"../database/database.ts\";\n\n// Update the AppEnv interface to exactly match the one in apiGateway.ts\ninterface AppEnv {\n Variables: {\n /** Database connection accessible to all route handlers */\n db: Database;\n /** Debug correlation ID for linking logs across the request lifecycle */\n debugCorrelationId: string;\n /** Timestamp when the request started processing */\n requestStartTime: number;\n };\n}\n\n/**\n * Creates and registers a fallback handler on the Hono app instance.\n * This handler catches all requests and returns a user-friendly error page\n * or a JSON error, depending on the request path.\n *\n * @param app The Hono app instance to register the handler on.\n * @param loaderError The error that occurred during OpenAPI loader initialization.\n */\nexport function registerFallbackHandler(\n app: OpenAPIHono<{ Variables: AppEnv[\"Variables\"] }>,\n loaderError: Error\n): void {\n app.all(\"*\", (c) => {\n const path = new URL(c.req.url).pathname;\n\n // For root, /api, or /api/v1, serve a detailed HTML error page\n if (path === \"/\" || path === \"/api\" || path === \"/api/v1\") {\n return c.html(\n `\n \n \n \n API Server - Configuration Error\n \n \n \n

🚨 API Server Configuration Error

\n INITIALIZATION FAILED\n \n

\n Error: ${loaderError?.message || \"Unknown error\"}\n

\n \n

What happened?

The server failed to load the OpenAPI specification during startup. This prevents the API from functioning properly.

\n \n

Common causes:

Environment variables not set correctly - Check OPENAPI_BLOB_KEY and OPENAPI_PUBLIC_URL
OpenAPI spec file not accessible - Verify the URL is correct and publicly accessible
Network connectivity issues - The server couldn't fetch the spec from the URL
Invalid OpenAPI specification - The spec file might have syntax errors

\n \n

Current Configuration:

APP_ENV: ${environment.APP_ENV}\n              OPENAPI_BLOB_KEY: ${environment.OPENAPI_BLOB_KEY || \"(not set)\"}\n              OPENAPI_PUBLIC_URL: ${\n                environment.OPENAPI_PUBLIC_URL || \"(not set)\"\n              }

\n \n

How to fix:

Check your Val Town environment variables
Ensure OPENAPI_BLOB_KEY is set to a valid key (e.g., \"openapi-spec\")
Ensure OPENAPI_PUBLIC_URL points to your OpenAPI JSON file
Verify the OpenAPI file is accessible by opening the URL in a browser
Check the server logs for more detailed error information

\n \n \n `,\n 500\n );\n }\n\n // For all other API paths, return a JSON error\n return c.json(\n {\n error: \"Server initialization failed\",\n message: \"The OpenAPI specification could not be loaded\",\n details: loaderError?.message || \"Unknown error\",\n path: path,\n timestamp: new Date().toISOString(),\n },\n 500\n );\n });\n}",[],[170,416,460],{"_102":468,"_95":469,"_151":470,"_153":417,"_154":136,"_155":471,"_157":158,"_104":472,"_99":32,"_160":189,"_162":473,"_163":22,"_164":-5,"_165":474,"_98":475},"cef10036-5ffd-11f0-bf35-0224a6c84d84","health.ts","cef100f4-5ffd-11f0-bf35-0224a6c84d84",842,["D",1752420415157],"// F:\\val.town\\ZenServer\\src\\handlers\\health.ts\r\nimport { getCurrentDateTimeInSydneyInMilliseconds, getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS } from \"../utils/dateUtils.ts\";\r\nimport { BusinessLogicContext } from \"./businessLogic.ts\";\r\n\r\nconst serverStart = getCurrentDateTimeInSydneyInMilliseconds();\r\n\r\nexport function healthCheck(_ctx: BusinessLogicContext) {\r\n return {\r\n status: \"healthy\",\r\n timestamp: getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS(),\r\n uptimeSeconds: Math.floor((getCurrentDateTimeInSydneyInMilliseconds() - serverStart) / 1000),\r\n version: \"1.0.0\",\r\n };\r\n}\r\n",[],[170,416,469],[170,416],{"_102":478,"_95":479,"_151":480,"_153":171,"_154":136,"_155":199,"_157":158,"_104":481,"_99":32,"_160":161,"_162":-5,"_163":22,"_164":-5,"_165":482,"_98":586},"9e985f7a-58a9-11f0-bc5c-f69ea79377d9","middleware","9e986038-58a9-11f0-bc5c-f69ea79377d9",["D",1751614598193],[483,492,501,511,520,530,540,549,559,568,577],{"_102":484,"_95":485,"_151":486,"_153":480,"_154":136,"_155":487,"_157":158,"_104":488,"_99":208,"_160":189,"_162":489,"_163":22,"_164":-5,"_165":490,"_98":491},"49f0bf66-5e6d-11f0-b4d7-0224a6c84d84","basicAuth.ts","ca99c48a-5c67-11f0-b675-0224a6c84d84",599,["D",1752248393335],"/**\r\n * Basic Authentication Middleware using Hono's built-in basicAuth\r\n * Provides HTTP Basic Authentication for admin and webhook endpoints\r\n */\r\n\r\nimport { basicAuth } from \"npm:hono/basic-auth\";\r\nimport type { Context } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\n\r\n/**\r\n * Creates basic auth middleware for admin endpoints\r\n * Uses environment variables for credentials\r\n */\r\nexport function createBasicAuthMiddleware() {\r\n return basicAuth({\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n realm: \"ZenServer Admin Area\",\r\n invalidUserMessage: {\r\n error: \"Unauthorized\",\r\n message: \"Invalid username or password\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware with custom user verification\r\n * Allows for dynamic user validation against database or external service\r\n */\r\nexport function createDynamicBasicAuthMiddleware(\r\n verifyUser: (\r\n username: string,\r\n password: string,\r\n c: Context\r\n ) => boolean | Promise\r\n) {\r\n return basicAuth({\r\n verifyUser: async (username: string, password: string, c: Context) => {\r\n try {\r\n const isValid = await verifyUser(username, password, c);\r\n\r\n if (!isValid) {\r\n logger.warn(\"Basic auth failed\", {\r\n username,\r\n ip: getClientIP(c),\r\n userAgent: c.req.header(\"user-agent\"),\r\n });\r\n }\r\n\r\n return isValid;\r\n } catch (error) {\r\n logger.error(\"Basic auth verification error\", {\r\n error: error.message,\r\n username,\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer Secure Area\",\r\n invalidUserMessage: {\r\n error: \"Authentication failed\",\r\n message: \"Invalid credentials\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware for webhook endpoints\r\n * Uses webhook-specific credentials\r\n */\r\nexport function createWebhookBasicAuthMiddleware() {\r\n return basicAuth({\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n realm: \"ZenServer Webhook Area\",\r\n invalidUserMessage: {\r\n error: \"Webhook authentication failed\",\r\n message: \"Invalid webhook credentials\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates basic auth middleware supporting multiple users\r\n * Useful for different admin roles or service accounts\r\n */\r\nexport function createMultiUserBasicAuthMiddleware() {\r\n const adminUsers = [\r\n {\r\n username: environment.ZP_USERNAME,\r\n password: environment.ZP_PASSWORD,\r\n },\r\n ];\r\n\r\n return basicAuth(\r\n {\r\n realm: \"ZenServer Admin Area\",\r\n invalidUserMessage: {\r\n error: \"Access denied\",\r\n message: \"Invalid admin credentials\",\r\n },\r\n ...adminUsers[0],\r\n },\r\n ...adminUsers.slice(1)\r\n );\r\n}\r\n\r\n/**\r\n * Default basic auth middleware for general admin access\r\n */\r\nexport const basicAuthMiddleware = createBasicAuthMiddleware();\r\n",[],[170,479,485],{"_102":493,"_95":494,"_151":495,"_153":480,"_154":136,"_155":496,"_157":158,"_104":497,"_99":179,"_160":189,"_162":498,"_163":22,"_164":-5,"_165":499,"_98":500},"49f672e4-5e6d-11f0-b051-0224a6c84d84","bearerAuth.ts","caa96d5e-5c67-11f0-bbdb-0224a6c84d84",600,["D",1752248393365],"/**\r\n * Bearer Authentication Middleware using Hono's built-in bearerAuth\r\n * Provides Bearer token authentication for API endpoints\r\n * Supports both static tokens and dynamic token verification\r\n */\r\n\r\nimport { bearerAuth } from \"npm:hono/bearer-auth\";\r\nimport type { Context } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { AuthService } from \"../services/authService.ts\";\r\nimport { Database } from \"../database/database.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\n\r\n/**\r\n * Creates bearer auth middleware for API endpoints\r\n * Uses static API key from environment\r\n */\r\nexport function createBearerAuthMiddleware() {\r\n const apiKey = environment.MASTER_KEY;\r\n return bearerAuth({\r\n token: apiKey,\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Invalid API key\",\r\n message: \"Bearer token authentication failed\",\r\n },\r\n noAuthenticationHeaderMessage: {\r\n error: \"Missing authentication\",\r\n message: \"Bearer token required in Authorization header\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware with custom token verification\r\n * Integrates with AuthService for dynamic token validation\r\n */\r\nexport function createDynamicBearerAuthMiddleware(\r\n verifyToken: (token: string, c: Context) => boolean | Promise\r\n) {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n try {\r\n const isValid = await verifyToken(token, c);\r\n\r\n if (!isValid) {\r\n logger.warn(\"Bearer auth failed\", {\r\n token: token.substring(0, 8) + \"...\",\r\n ip: getClientIP(c),\r\n userAgent: c.req.header(\"user-agent\"),\r\n });\r\n }\r\n\r\n return isValid;\r\n } catch (error) {\r\n logger.error(\"Bearer auth verification error\", {\r\n error: error.message,\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Token verification failed\",\r\n message: \"Invalid or expired bearer token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware using AuthService validation\r\n * Integrates with existing AuthService.validateApiKey logic\r\n */\r\nexport function createAuthServiceBearerMiddleware() {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n // Create a mock request with the token in Authorization header\r\n const mockRequest = new Request(c.req.url, {\r\n headers: {\r\n Authorization: `Bearer ${token}`,\r\n \"x-forwarded-for\": c.req.header(\"x-forwarded-for\") || \"\",\r\n \"user-agent\": c.req.header(\"user-agent\") || \"\",\r\n },\r\n });\r\n\r\n const validation = AuthService.validateApiKey(mockRequest);\r\n return validation.valid;\r\n },\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"API authentication failed\",\r\n message: \"Invalid API key provided\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware with multiple token support\r\n * Useful for different access levels (read/write permissions)\r\n */\r\nexport function createMultiTokenBearerAuthMiddleware() {\r\n const tokens = [\r\n environment.MASTER_KEY,\r\n environment.WEBHOOK_SECRET,\r\n environment.VALTOWN_TOKEN,\r\n ].filter(Boolean); // Remove undefined values\r\n\r\n return bearerAuth({\r\n token: tokens,\r\n realm: \"ZenServer API\",\r\n invalidTokenMessage: {\r\n error: \"Access denied\",\r\n message: \"Invalid API token provided\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware for webhook endpoints\r\n * Uses webhook-specific token validation\r\n */\r\nexport function createWebhookBearerAuthMiddleware() {\r\n return bearerAuth({\r\n token: environment.WEBHOOK_SECRET,\r\n realm: \"ZenServer Webhook API\",\r\n invalidTokenMessage: {\r\n error: \"Webhook authentication failed\",\r\n message: \"Invalid webhook bearer token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Creates bearer auth middleware for booking token validation\r\n * Integrates with booking token system\r\n */\r\nexport function createBookingTokenBearerAuthMiddleware() {\r\n return bearerAuth({\r\n verifyToken: async (token: string, c: Context) => {\r\n try {\r\n const db = c.get(\"db\") as Database;\r\n if (!db) {\r\n logger.error(\"Database not available in booking token auth\");\r\n return false;\r\n }\r\n\r\n const validation = await AuthService.validateBookingToken(db, token);\r\n\r\n if (validation.valid && validation.bookingId) {\r\n // Store booking ID in context for use in handlers\r\n c.set(\"bookingId\", validation.bookingId);\r\n return true;\r\n }\r\n\r\n return false;\r\n } catch (error) {\r\n logger.error(\"Booking token verification error\", {\r\n error: error.message,\r\n token: token.substring(0, 8) + \"...\",\r\n });\r\n return false;\r\n }\r\n },\r\n realm: \"ZenServer Booking API\",\r\n invalidTokenMessage: {\r\n error: \"Booking token invalid\",\r\n message: \"Invalid or expired booking token\",\r\n },\r\n });\r\n}\r\n\r\n/**\r\n * Default bearer auth middleware for general API access\r\n */\r\nexport const bearerAuthMiddleware = createBearerAuthMiddleware();\r\n\r\n/**\r\n * AuthService-integrated bearer auth middleware\r\n */\r\nexport const authServiceBearerMiddleware = createAuthServiceBearerMiddleware();\r\n",[],[170,479,494],{"_102":502,"_95":503,"_151":504,"_153":480,"_154":136,"_155":505,"_157":158,"_104":506,"_99":507,"_160":189,"_162":508,"_163":22,"_164":-5,"_165":509,"_98":510},"309beb70-604e-11f0-9980-0224a6c84d84","cors.ts","9fe0a658-58a9-11f0-b6a5-f69ea79377d9",874,["D",1752454938763],21,"// F:\\val.town\\ZenServer\\src\\middleware\\cors.ts\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logWarn } from \"../utils/logger.ts\";\r\nimport { logSecurityCheck } from \"./debugger.ts\";\r\nimport type { Context, Next } from \"npm:hono\";\r\n\r\nconst ALLOWED_ORIGINS = environment.ALLOWED_ORIGINS;\r\nconst ALLOWED_METHODS = environment.ALLOWED_METHODS;\r\nconst ALLOWED_HEADERS = environment.ALLOWED_HEADERS;\r\nconst EXPOSED_HEADERS = environment.EXPOSED_HEADERS;\r\nconst CORS_MAX_AGE = environment.CORS_MAX_AGE;\r\nconst CORS_ALLOW_CREDENTIALS = environment.CORS_ALLOW_CREDENTIALS;\r\n\r\n/**\r\n * Comprehensive CORS middleware for Hono that handles both preflight and regular requests\r\n * @param c - Hono context\r\n * @param next - Next middleware function\r\n * @returns Response with CORS headers\r\n */\r\nexport async function corsMiddleware(c: Context, next: Next) {\r\n const origin = c.req.header(\"origin\");\r\n const method = c.req.method;\r\n const correlationId = c.get(\"debugCorrelationId\");\r\n const ip =\r\n c.req.header(\"cf-connecting-ip\") ||\r\n c.req.header(\"x-forwarded-for\") ||\r\n \"unknown\";\r\n\r\n // Debug security checks\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"CORS Origin Check\",\r\n \"Validating request origin against allowed origins\",\r\n true,\r\n {\r\n origin,\r\n allowedOrigins: ALLOWED_ORIGINS,\r\n method,\r\n }\r\n );\r\n }\r\n\r\n // Handle preflight requests\r\n if (method === \"OPTIONS\") {\r\n return handlePreflightRequest(origin, correlationId);\r\n }\r\n\r\n // Validate origin for non-preflight requests\r\n if (origin && !ALLOWED_ORIGINS.includes(origin)) {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"CORS Origin Validation\",\r\n \"Origin not in allowed list - BLOCKED\",\r\n false,\r\n {\r\n origin,\r\n allowedOrigins: ALLOWED_ORIGINS,\r\n ip,\r\n userAgent: c.req.header(\"user-agent\"),\r\n }\r\n );\r\n }\r\n\r\n logWarn(`CORS violation - invalid origin ${origin} - ip: ${ip}`);\r\n return c.json({ error: \"CORS policy violation\" }, 403);\r\n }\r\n\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"CORS Validation Passed\",\r\n \"Request origin is allowed\",\r\n true,\r\n {\r\n origin: origin || \"no-origin\",\r\n ip,\r\n }\r\n );\r\n }\r\n\r\n // Continue to next middleware\r\n await next();\r\n\r\n // Add CORS headers to the response\r\n if (origin && ALLOWED_ORIGINS.includes(origin)) {\r\n // Allowed origin\r\n c.header(\"Access-Control-Allow-Origin\", origin);\r\n if (CORS_ALLOW_CREDENTIALS) {\r\n c.header(\"Access-Control-Allow-Credentials\", \"true\");\r\n }\r\n } else if (origin) {\r\n // For disallowed origins, set empty header to prevent Val Town defaults\r\n c.header(\"Access-Control-Allow-Origin\", \"\");\r\n } else {\r\n // No origin header - likely a non-browser request, allow all\r\n c.header(\"Access-Control-Allow-Origin\", \"*\");\r\n }\r\n\r\n // Always set these headers\r\n c.header(\"Vary\", \"Origin\");\r\n \r\n // Add exposed headers if configured\r\n if (EXPOSED_HEADERS && EXPOSED_HEADERS.length > 0) {\r\n c.header(\"Access-Control-Expose-Headers\", EXPOSED_HEADERS.join(\", \"));\r\n }\r\n}\r\n\r\n/**\r\n * Handle OPTIONS preflight requests\r\n */\r\nfunction handlePreflightRequest(\r\n origin: string | null,\r\n correlationId?: string\r\n): Response {\r\n // Check if origin is allowed\r\n const originAllowed = origin && ALLOWED_ORIGINS.includes(origin);\r\n\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"CORS Preflight Check\",\r\n \"Handling OPTIONS preflight request\",\r\n originAllowed,\r\n {\r\n origin,\r\n originAllowed,\r\n allowedMethods: ALLOWED_METHODS,\r\n allowedHeaders: ALLOWED_HEADERS,\r\n corsMaxAge: CORS_MAX_AGE,\r\n }\r\n );\r\n }\r\n\r\n const headers = new Headers();\r\n\r\n if (originAllowed) {\r\n headers.set(\"Access-Control-Allow-Origin\", origin);\r\n if (CORS_ALLOW_CREDENTIALS) {\r\n headers.set(\"Access-Control-Allow-Credentials\", \"true\");\r\n }\r\n }\r\n // Don't set Access-Control-Allow-Origin for disallowed origins\r\n\r\n headers.set(\"Access-Control-Allow-Methods\", ALLOWED_METHODS.join(\", \"));\r\n headers.set(\"Access-Control-Allow-Headers\", ALLOWED_HEADERS.join(\", \"));\r\n headers.set(\"Access-Control-Max-Age\", CORS_MAX_AGE.toString());\r\n headers.set(\"Vary\", \"Origin\");\r\n\r\n return new Response(null, {\r\n status: 200,\r\n headers,\r\n });\r\n}",[],[170,479,503],{"_102":512,"_95":513,"_151":514,"_153":480,"_154":136,"_155":515,"_157":158,"_104":516,"_99":32,"_160":189,"_162":517,"_163":22,"_164":-5,"_165":518,"_98":519},"4933f19c-5e6d-11f0-b051-0224a6c84d84","csp.ts","4933f26e-5e6d-11f0-b051-0224a6c84d84",583,["D",1752248392102],"/**\r\n * Content Security Policy (CSP) middleware for ZenServer\r\n * Provides centralized CSP configuration and header management\r\n */\r\n\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\n// CSP directive configuration\r\ninterface CSPDirectives {\r\n defaultSrc: string[];\r\n scriptSrc: string[];\r\n styleSrc: string[];\r\n imgSrc: string[];\r\n connectSrc: string[];\r\n fontSrc: string[];\r\n objectSrc: string[];\r\n mediaSrc: string[];\r\n frameSrc: string[];\r\n childSrc: string[];\r\n workerSrc: string[];\r\n manifestSrc: string[];\r\n baseUri: string[];\r\n formAction: string[];\r\n frameAncestors: string[];\r\n upgradeInsecureRequests: boolean;\r\n blockAllMixedContent: boolean;\r\n}\r\n\r\n// Default CSP configuration\r\nconst defaultCSPDirectives: CSPDirectives = {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile\r\n \"https://payuat.travelpay.com.au\" // Zenpay payment gateway\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"https://payuat.travelpay.com.au\", // Zenpay payment gateway styles\r\n \"'unsafe-inline'\" // Allow inline styles (consider removing in production)\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\", // Allow data URLs for images\r\n \"https:\", // Allow HTTPS images\r\n \"https://images.unsplash.com\" // Unsplash for tour images\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile API\r\n \"https://payuat.travelpay.com.au\" // Zenpay payment gateway API\r\n ],\r\n fontSrc: [\r\n \"'self'\",\r\n \"https:\", // Allow HTTPS fonts\r\n \"data:\" // Allow data URL fonts\r\n ],\r\n objectSrc: [\"'none'\"], // Disable object/embed/applet\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\" // Cloudflare Turnstile iframe\r\n ],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"], // Prevent clickjacking\r\n upgradeInsecureRequests: true, // Upgrade HTTP to HTTPS\r\n blockAllMixedContent: true // Block mixed content\r\n};\r\n\r\n// Development CSP configuration (more permissive)\r\nconst developmentCSPDirectives: Partial = {\r\n scriptSrc: [\r\n \"'self'\",\r\n \"'unsafe-eval'\", // Allow eval for dev tools\r\n \"'unsafe-inline'\", // Allow inline scripts for dev\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\"\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"'unsafe-inline'\", // Allow inline styles for dev\r\n \"https://payuat.travelpay.com.au\"\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"ws:\", // Allow WebSocket for dev servers\r\n \"wss:\", // Allow secure WebSocket\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\"\r\n ]\r\n};\r\n\r\n/**\r\n * Get CSP directives based on environment\r\n */\r\nfunction getCSPDirectives(): CSPDirectives {\r\n const baseDirectives = { ...defaultCSPDirectives };\r\n \r\n // Apply development overrides if not in production\r\n if (environment.APP_ENV !== \"prod\") {\r\n return {\r\n ...baseDirectives,\r\n ...developmentCSPDirectives\r\n };\r\n }\r\n \r\n return baseDirectives;\r\n}\r\n\r\n/**\r\n * Convert CSP directives object to CSP header string\r\n */\r\nfunction buildCSPHeader(directives: CSPDirectives): string {\r\n const policies: string[] = [];\r\n \r\n // Add directive-based policies\r\n if (directives.defaultSrc.length > 0) {\r\n policies.push(`default-src ${directives.defaultSrc.join(' ')}`);\r\n }\r\n if (directives.scriptSrc.length > 0) {\r\n policies.push(`script-src ${directives.scriptSrc.join(' ')}`);\r\n }\r\n if (directives.styleSrc.length > 0) {\r\n policies.push(`style-src ${directives.styleSrc.join(' ')}`);\r\n }\r\n if (directives.imgSrc.length > 0) {\r\n policies.push(`img-src ${directives.imgSrc.join(' ')}`);\r\n }\r\n if (directives.connectSrc.length > 0) {\r\n policies.push(`connect-src ${directives.connectSrc.join(' ')}`);\r\n }\r\n if (directives.fontSrc.length > 0) {\r\n policies.push(`font-src ${directives.fontSrc.join(' ')}`);\r\n }\r\n if (directives.objectSrc.length > 0) {\r\n policies.push(`object-src ${directives.objectSrc.join(' ')}`);\r\n }\r\n if (directives.mediaSrc.length > 0) {\r\n policies.push(`media-src ${directives.mediaSrc.join(' ')}`);\r\n }\r\n if (directives.frameSrc.length > 0) {\r\n policies.push(`frame-src ${directives.frameSrc.join(' ')}`);\r\n }\r\n if (directives.childSrc.length > 0) {\r\n policies.push(`child-src ${directives.childSrc.join(' ')}`);\r\n }\r\n if (directives.workerSrc.length > 0) {\r\n policies.push(`worker-src ${directives.workerSrc.join(' ')}`);\r\n }\r\n if (directives.manifestSrc.length > 0) {\r\n policies.push(`manifest-src ${directives.manifestSrc.join(' ')}`);\r\n }\r\n if (directives.baseUri.length > 0) {\r\n policies.push(`base-uri ${directives.baseUri.join(' ')}`);\r\n }\r\n if (directives.formAction.length > 0) {\r\n policies.push(`form-action ${directives.formAction.join(' ')}`);\r\n }\r\n if (directives.frameAncestors.length > 0) {\r\n policies.push(`frame-ancestors ${directives.frameAncestors.join(' ')}`);\r\n }\r\n \r\n // Add boolean directives\r\n if (directives.upgradeInsecureRequests) {\r\n policies.push('upgrade-insecure-requests');\r\n }\r\n if (directives.blockAllMixedContent) {\r\n policies.push('block-all-mixed-content');\r\n }\r\n \r\n return policies.join('; ');\r\n}\r\n\r\n/**\r\n * Get the complete CSP header value\r\n */\r\nexport function getCSPHeader(): string {\r\n const directives = getCSPDirectives();\r\n return buildCSPHeader(directives);\r\n}\r\n\r\n/**\r\n * Get HSTS header value\r\n */\r\nexport function getHSTSHeader(): string {\r\n // More restrictive in production\r\n if (environment.APP_ENV === \"prod\") {\r\n return \"max-age=31536000; includeSubDomains; preload\";\r\n }\r\n // Less restrictive in development\r\n return \"max-age=3600; includeSubDomains\";\r\n}\r\n\r\n/**\r\n * Get all security headers as an object\r\n */\r\nexport function getSecurityHeaders(): Record {\r\n return {\r\n \"Content-Security-Policy\": getCSPHeader(),\r\n \"Strict-Transport-Security\": getHSTSHeader(),\r\n \"X-Content-Type-Options\": \"nosniff\",\r\n \"X-Frame-Options\": \"DENY\",\r\n \"X-XSS-Protection\": \"1; mode=block\",\r\n \"Referrer-Policy\": \"strict-origin-when-cross-origin\"\r\n };\r\n}\r\n\r\n/**\r\n * Apply security headers to a Response object\r\n */\r\nexport function addSecurityHeaders(response: Response): Response {\r\n const headers = getSecurityHeaders();\r\n \r\n // Clone the response to avoid mutating the original\r\n const newResponse = new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers: new Headers(response.headers)\r\n });\r\n \r\n // Add security headers\r\n Object.entries(headers).forEach(([name, value]) => {\r\n newResponse.headers.set(name, value);\r\n });\r\n \r\n return newResponse;\r\n}\r\n\r\n/**\r\n * CSP middleware for Hono\r\n */\r\nexport function cspMiddleware() {\r\n return async (c: any, next: any) => {\r\n await next();\r\n \r\n // Add security headers to the response\r\n const securityHeaders = getSecurityHeaders();\r\n Object.entries(securityHeaders).forEach(([name, value]) => {\r\n c.res.headers.set(name, value);\r\n });\r\n };\r\n}\r\n\r\n// Export directives for testing and customization\r\nexport { getCSPDirectives, buildCSPHeader };\r\nexport type { CSPDirectives };",[],[170,479,513],{"_102":521,"_95":522,"_151":523,"_153":480,"_154":136,"_155":524,"_157":158,"_104":525,"_99":526,"_160":189,"_162":527,"_163":22,"_164":-5,"_165":528,"_98":529},"5f707fae-5fd3-11f0-835d-0224a6c84d84","csrf.ts","8c938ec6-5a93-11f0-a7b1-f69ea79377d9",819,["D",1752402189229],13,"/**\r\n * Comprehensive CSRF Protection Module\r\n *\r\n * This module provides two layers of CSRF protection:\r\n * 1. Origin-based validation (using Hono's built-in CSRF) - for app-wide protection\r\n * 2. Token-based validation (double-submit cookies) - for sensitive endpoints\r\n *\r\n * @module csrf\r\n */\r\n\r\nimport { csrf } from \"npm:hono/csrf\";\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger, logDebug, logWarn, logInfo } from \"../utils/logger.ts\";\r\nimport { getClientIP } from \"../utils/ipUtils.ts\";\r\nimport {\r\n setCSRFCookies,\r\n validateTokenBasedCSRFToken,\r\n type CSRFSession,\r\n type TokenValidationResult,\r\n} from \"../utils/cookies.ts\";\r\nimport { generateSecureToken } from \"../utils/crypto.ts\";\r\n\r\n// ============================================================================\r\n// TYPES AND INTERFACES\r\n// ============================================================================\r\n\r\n/**\r\n * Configuration for origin-based CSRF protection\r\n */\r\nexport interface CSRFOriginConfig {\r\n allowedOrigins: string[];\r\n allowValTownDomains: boolean;\r\n allowLocalhost: boolean;\r\n logValidation: boolean;\r\n}\r\n\r\n// ============================================================================\r\n// TOKEN-BASED CSRF PROTECTION (Double-Submit Cookies)\r\n// ============================================================================\r\n\r\n// Re-export types from cookies utility for backward compatibility\r\nexport type { CSRFSession, TokenValidationResult };\r\n\r\n/**\r\n * Create a new CSRF session with secure tokens\r\n * Now uses centralized crypto utilities with SESSION_SECRET entropy\r\n *\r\n * @returns CSRFSession object with sessionId, xsrfToken, and timestamps\r\n */\r\nexport async function createTokenBasedCSRFSession(): Promise {\r\n // Use SESSION_SECRET if available, otherwise generate without entropy source\r\n const entropy = environment.SESSION_SECRET && environment.SESSION_SECRET.length > 0 \r\n ? environment.SESSION_SECRET \r\n : undefined;\r\n \r\n const sessionId = generateSecureToken(entropy);\r\n const xsrfToken = generateSecureToken(entropy);\r\n const createdAt = new Date();\r\n const expiresAt = new Date(createdAt.getTime() + 30 * 60 * 1000); // 30 minutes\r\n\r\n const session: CSRFSession = {\r\n sessionId,\r\n xsrfToken,\r\n createdAt,\r\n expiresAt,\r\n };\r\n\r\n // Store session in database\r\n try {\r\n const { storeCSRFSession } = await import(\"../services/dbService.ts\");\r\n await storeCSRFSession(session);\r\n } catch (error) {\r\n logger.error(\"Failed to store CSRF session in database\", {\r\n error: error instanceof Error ? error.message : String(error),\r\n sessionId: sessionId.substring(0, 8) + \"...\",\r\n });\r\n // Continue anyway - validation will fall back to format-only check\r\n }\r\n\r\n return session;\r\n}\r\n\r\n// Re-export cookie functions from utils for backward compatibility\r\nexport { setCSRFCookies, validateTokenBasedCSRFToken };\r\n\r\n/**\r\n * Token-based CSRF protection middleware\r\n * Use this for sensitive endpoints (e.g., payment processing)\r\n *\r\n * @param request - The incoming HTTP request\r\n * @returns Error response if validation fails, null if passes\r\n */\r\nexport async function tokenBasedCSRFProtection(request: Request): Promise {\r\n const validation = await validateTokenBasedCSRFToken(request);\r\n\r\n if (!validation.valid) {\r\n logger.warn(\"CSRF validation failed\", {\r\n error: validation.error,\r\n ip: request.headers.get(\"cf-connecting-ip\") || \"unknown\",\r\n userAgent: request.headers.get(\"user-agent\") || \"unknown\",\r\n });\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"CSRF validation failed\",\r\n details: validation.error,\r\n }),\r\n {\r\n status: 403,\r\n headers: { \"Content-Type\": \"application/json\" },\r\n }\r\n );\r\n }\r\n\r\n return null; // Continue processing\r\n}\r\n\r\n// ============================================================================\r\n// ORIGIN-BASED CSRF PROTECTION (Using Hono's Built-in Middleware)\r\n// ============================================================================\r\n\r\n/**\r\n * Get default origin-based CSRF configuration based on environment\r\n *\r\n * @returns Default configuration object\r\n */\r\nexport const getDefaultOriginConfig = (): CSRFOriginConfig => {\r\n const isDevelopment = environment.APP_ENV === \"dev\";\r\n\r\n return {\r\n allowedOrigins: [\r\n // Use all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS,\r\n // Also include BASE_URL if it's not already in the list\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ].filter(Boolean), // Remove any undefined values\r\n allowValTownDomains: isDevelopment, // Allow val.town domains in development\r\n allowLocalhost: isDevelopment, // Allow localhost in development\r\n logValidation: isDevelopment, // Log validation in development\r\n };\r\n};\r\n\r\n// Backward compatibility alias\r\nexport const getDefaultConfig = getDefaultOriginConfig;\r\n\r\n/**\r\n * Create origin validation function for Hono CSRF middleware\r\n *\r\n * @param config - Origin validation configuration\r\n * @returns Function that validates origin strings\r\n */\r\nexport const createOriginValidator = (config: CSRFOriginConfig) => {\r\n return (origin: string): boolean => {\r\n try {\r\n // Check against explicitly allowed origins\r\n for (const allowedOrigin of config.allowedOrigins) {\r\n if (origin === allowedOrigin || origin.startsWith(allowedOrigin)) {\r\n if (config.logValidation) {\r\n logDebug(\"CSRF origin validation passed\", \"csrf_origin\", {\r\n origin,\r\n matchedOrigin: allowedOrigin,\r\n });\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Allow val.town domains for development\r\n if (config.allowValTownDomains) {\r\n const valTownRegex = /^https:\\/\\/[\\w-]+\\.val\\.run$/;\r\n if (valTownRegex.test(origin)) {\r\n if (config.logValidation) {\r\n logDebug(\r\n \"CSRF origin validation passed (val.town)\",\r\n \"csrf_origin\",\r\n {\r\n origin,\r\n reason: \"val.town domain\",\r\n }\r\n );\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Allow localhost for development\r\n if (config.allowLocalhost) {\r\n const localhostRegex = /^https?:\\/\\/localhost(:\\d+)?$/;\r\n if (localhostRegex.test(origin)) {\r\n if (config.logValidation) {\r\n logDebug(\r\n \"CSRF origin validation passed (localhost)\",\r\n \"csrf_origin\",\r\n {\r\n origin,\r\n reason: \"localhost\",\r\n }\r\n );\r\n }\r\n return true;\r\n }\r\n }\r\n\r\n // Log rejected origins\r\n if (config.logValidation) {\r\n logWarn(\"CSRF origin validation failed\", \"csrf_origin\", {\r\n origin,\r\n allowedOrigins: config.allowedOrigins,\r\n allowValTownDomains: config.allowValTownDomains,\r\n allowLocalhost: config.allowLocalhost,\r\n });\r\n }\r\n\r\n return false;\r\n } catch (error) {\r\n logWarn(\"CSRF origin validation error\", \"csrf_origin\", {\r\n origin,\r\n error: error instanceof Error ? error.message : String(error),\r\n });\r\n return false;\r\n }\r\n };\r\n};\r\n\r\n/**\r\n * Create Hono CSRF middleware with custom configuration\r\n *\r\n * @param customConfig - Optional custom configuration to override defaults\r\n * @returns Configured Hono CSRF middleware\r\n */\r\nexport const createHonoCSRFMiddleware = (\r\n customConfig?: Partial\r\n) => {\r\n const config = { ...getDefaultOriginConfig(), ...customConfig };\r\n const originValidator = createOriginValidator(config);\r\n\r\n return csrf({\r\n origin: originValidator,\r\n });\r\n};\r\n\r\n/**\r\n * Enhanced CSRF middleware that combines origin validation with custom logic\r\n *\r\n * @param customConfig - Optional custom configuration\r\n * @returns Enhanced CSRF middleware function\r\n */\r\nexport const createEnhancedCSRFMiddleware = (\r\n customConfig?: Partial\r\n) => {\r\n const honoMiddleware = createHonoCSRFMiddleware(customConfig);\r\n\r\n return async (c: Context, next: Next) => {\r\n // Get client IP for enhanced logging\r\n const clientIP = getClientIP(c);\r\n\r\n try {\r\n // Apply Hono CSRF middleware\r\n await honoMiddleware(c, next);\r\n } catch (error) {\r\n // Enhanced error logging with client information\r\n logWarn(\"CSRF middleware error\", \"csrf_enhanced\", {\r\n clientIP,\r\n origin: c.req.header(\"Origin\"),\r\n referer: c.req.header(\"Referer\"),\r\n userAgent: c.req.header(\"User-Agent\")?.substring(0, 100),\r\n path: c.req.path,\r\n method: c.req.method,\r\n error: error instanceof Error ? error.message : String(error),\r\n });\r\n\r\n // Re-throw the error to maintain the original behavior\r\n throw error;\r\n }\r\n };\r\n};\r\n\r\n// ============================================================================\r\n// PRESET MIDDLEWARE CONFIGURATIONS\r\n// ============================================================================\r\n\r\n/**\r\n * Default CSRF middleware - balanced security for most use cases\r\n */\r\nexport const defaultCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware();\r\n};\r\n\r\n/**\r\n * Strict CSRF middleware - maximum security, minimal allowlists\r\n */\r\nexport const strictOriginCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: false,\r\n allowLocalhost: false,\r\n logValidation: true,\r\n });\r\n};\r\n\r\n/**\r\n * Development CSRF middleware - relaxed settings for local development\r\n */\r\nexport const developmentCSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: true,\r\n allowLocalhost: true,\r\n logValidation: true,\r\n });\r\n};\r\n\r\n/**\r\n * Public API CSRF middleware - for public endpoints that need some protection\r\n */\r\nexport const publicAPICSRFMiddleware = () => {\r\n return createHonoCSRFMiddleware({\r\n allowValTownDomains: true,\r\n allowLocalhost: environment.APP_ENV === \"dev\",\r\n logValidation: false,\r\n });\r\n};\r\n\r\n/**\r\n * Get default CSRF middleware based on environment\r\n */\r\nexport function getOriginBasedCSRFMiddleware(correlationId?: string) {\r\n const config = getDefaultOriginConfig();\r\n\r\n if (correlationId) {\r\n logInfo(`Initializing CSRF middleware`, \"csrf_init\", {\r\n correlationId,\r\n config: {\r\n allowedOrigins: config.allowedOrigins.length,\r\n allowValTownDomains: config.allowValTownDomains,\r\n allowLocalhost: config.allowLocalhost,\r\n environment: environment.APP_ENV,\r\n },\r\n });\r\n }\r\n\r\n return createEnhancedCSRFMiddleware(config);\r\n}\r\n\r\n// ============================================================================\r\n// UTILITY EXPORTS\r\n// ============================================================================\r\n\r\n/**\r\n * Collection of CSRF utilities for testing and advanced configuration\r\n */\r\nexport const CSRFUtils = {\r\n // Origin-based utilities\r\n getDefaultConfig: getDefaultOriginConfig,\r\n createOriginValidator,\r\n createHonoCSRFMiddleware,\r\n createEnhancedCSRFMiddleware,\r\n\r\n // Token-based utilities\r\n generateSecureToken,\r\n createTokenBasedCSRFSession,\r\n setCSRFCookies,\r\n validateTokenBasedCSRFToken,\r\n\r\n // Middleware factories\r\n originBased: {\r\n default: defaultCSRFMiddleware,\r\n strict: strictOriginCSRFMiddleware,\r\n development: developmentCSRFMiddleware,\r\n publicAPI: publicAPICSRFMiddleware,\r\n },\r\n\r\n tokenBased: {\r\n middleware: tokenBasedCSRFProtection,\r\n protection: tokenBasedCSRFProtection,\r\n },\r\n};\r\n\r\n// Default export for easy importing\r\nexport default getOriginBasedCSRFMiddleware;\r\n\r\n// ============================================================================\r\n// USAGE EXAMPLES\r\n// ============================================================================\r\n\r\n/**\r\n * Example 1: Global origin-based protection\r\n * ```typescript\r\n * import { getOriginBasedCSRFMiddleware } from \"./csrf\";\r\n * app.use(getOriginBasedCSRFMiddleware());\r\n * ```\r\n *\r\n * Example 2: Token-based protection for specific routes\r\n * ```typescript\r\n * import { tokenBasedCSRFProtection, createTokenBasedCSRFSession, setCSRFCookies } from \"./csrf\";\r\n *\r\n * // Set cookies on initial visit\r\n * app.get(\"/api/v1/tour/:id\", (c) => {\r\n * const session = createTokenBasedCSRFSession();\r\n * // ... handle request\r\n * return setCSRFCookies(response, session);\r\n * });\r\n *\r\n * // Validate token on sensitive endpoints\r\n * app.post(\"/api/v1/payment\", (c) => {\r\n * const error = tokenBasedCSRFProtection(c.req.raw);\r\n * if (error) return error;\r\n * // ... process payment\r\n * });\r\n * ```\r\n */\r\n",[],[170,479,522],{"_102":531,"_95":532,"_151":533,"_153":480,"_154":136,"_155":534,"_157":158,"_104":535,"_99":536,"_160":189,"_162":537,"_163":22,"_164":-5,"_165":538,"_98":539},"e0d82f90-5f53-11f0-a734-0224a6c84d84","debugger.ts","8c9eeeb0-5a93-11f0-b403-f69ea79377d9",706,["D",1752347430760],11,"import * as log from \"https://deno.land/std@0.203.0/log/mod.ts\";\r\nimport { getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS } from \"../utils/dateUtils.ts\";\r\nimport { OPERATION_EMOJIS } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\nconst DBG_EMOJI = OPERATION_EMOJIS[\"debug_event\"] ?? \"🐞\";\r\n\r\n// ANSI color codes for debug output (maintained from original)\r\nconst DEBUG_COLORS = {\r\n reset: \"\\x1b[0m\",\r\n bright: \"\\x1b[1m\",\r\n dim: \"\\x1b[2m\",\r\n red: \"\\x1b[31m\",\r\n green: \"\\x1b[32m\",\r\n yellow: \"\\x1b[33m\",\r\n blue: \"\\x1b[34m\",\r\n magenta: \"\\x1b[35m\",\r\n cyan: \"\\x1b[36m\",\r\n white: \"\\x1b[37m\",\r\n gray: \"\\x1b[90m\",\r\n brightRed: \"\\x1b[91m\",\r\n brightGreen: \"\\x1b[92m\",\r\n brightYellow: \"\\x1b[93m\",\r\n brightBlue: \"\\x1b[94m\",\r\n brightMagenta: \"\\x1b[95m\",\r\n brightCyan: \"\\x1b[96m\",\r\n brightWhite: \"\\x1b[97m\",\r\n bgRed: \"\\x1b[41m\",\r\n bgGreen: \"\\x1b[42m\",\r\n bgYellow: \"\\x1b[43m\",\r\n bgBlue: \"\\x1b[44m\",\r\n bgMagenta: \"\\x1b[45m\",\r\n bgCyan: \"\\x1b[46m\",\r\n} as const;\r\n\r\n// Custom formatter that maintains color support\r\nfunction coloredJsonFormatter(record: log.LogRecord): string {\r\n const entry = {\r\n timestamp: getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS(),\r\n level: record.levelName,\r\n message: record.msg,\r\n ...(record.args[0] ? { data: record.args[0] } : {}),\r\n };\r\n\r\n // Apply color based on log level (only if colors are enabled)\r\n if (!environment.DEBUG_ENABLE_COLORS) {\r\n return JSON.stringify(entry);\r\n }\r\n\r\n let color: string = DEBUG_COLORS.reset;\r\n switch (record.level) {\r\n case log.LogLevels.DEBUG:\r\n color = DEBUG_COLORS.gray;\r\n break;\r\n case log.LogLevels.INFO:\r\n color = DEBUG_COLORS.cyan;\r\n break;\r\n case log.LogLevels.WARNING:\r\n color = DEBUG_COLORS.yellow;\r\n break;\r\n case log.LogLevels.ERROR:\r\n color = DEBUG_COLORS.red;\r\n break;\r\n case log.LogLevels.CRITICAL:\r\n color = DEBUG_COLORS.brightRed;\r\n break;\r\n }\r\n\r\n return `${color}${JSON.stringify(entry)}${DEBUG_COLORS.reset}`;\r\n}\r\n\r\n// Configure logger with our custom formatter\r\nawait log.setup({\r\n handlers: {\r\n debugConsole: new log.handlers.ConsoleHandler(\r\n environment.DEBUG_LOG_LEVEL as log.LevelName,\r\n {\r\n formatter: coloredJsonFormatter,\r\n }\r\n ),\r\n },\r\n loggers: {\r\n default: {\r\n level: environment.DEBUG_LOG_LEVEL as log.LevelName,\r\n handlers: [\"debugConsole\"],\r\n },\r\n },\r\n});\r\ninterface DebugRequestData {\r\n method: string;\r\n url: string;\r\n headers: Record;\r\n body?: string;\r\n timestamp: string;\r\n ip?: string;\r\n userAgent?: string;\r\n origin?: string;\r\n correlationId?: string;\r\n}\r\n\r\ninterface DebugResponseData {\r\n status: number;\r\n statusText: string;\r\n headers: Record;\r\n body?: string;\r\n timestamp: string;\r\n duration?: number;\r\n}\r\n\r\ninterface DebugRequestResponse {\r\n request: DebugRequestData;\r\n response: DebugResponseData;\r\n correlationId: string;\r\n totalDuration: number;\r\n}\r\n\r\ninterface SecurityCheck {\r\n checkNumber: number;\r\n checkName: string;\r\n description: string;\r\n passed: boolean;\r\n details?: Record;\r\n timestamp: string;\r\n duration?: number;\r\n}\r\n\r\n// Global state remains the same\r\nlet securityCheckCounter = 0;\r\n// ---------- Global state ----------\r\nconst activeRequests = new Map<\r\n string,\r\n {\r\n request: DebugRequestData;\r\n startTime: number;\r\n securityChecks: SecurityCheck[];\r\n }\r\n>();\r\n\r\nconst debugSessions = new Map<\r\n string,\r\n {\r\n correlationId: string;\r\n startTime: number;\r\n request: {\r\n method: string;\r\n url: string;\r\n ip: string;\r\n userAgent: string;\r\n };\r\n }\r\n>();\r\n\r\nexport function isDebugEnabled(): boolean {\r\n // Disable debug for serverless to avoid in-memory state issues\r\n return false;\r\n}\r\n\r\nfunction generateCorrelationId(): string {\r\n return `dbg_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Bulk security-check helper\r\n// -----------------------------------------------------------\r\nexport function logSecurityChecks(\r\n correlationId: string,\r\n checks: Array<{\r\n checkName: string;\r\n description: string;\r\n passed: boolean;\r\n details?: Record;\r\n }>\r\n): void {\r\n if (!isDebugEnabled() || !correlationId) return;\r\n for (const chk of checks) {\r\n logSecurityCheck(\r\n correlationId,\r\n chk.checkName,\r\n chk.description,\r\n chk.passed,\r\n chk.details\r\n );\r\n }\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Debug timer utility\r\n// -----------------------------------------------------------\r\nexport function createDebugTimer(operation: string): {\r\n stop: (details?: Record) => number;\r\n} {\r\n if (!isDebugEnabled()) return { stop: () => 0 };\r\n\r\n const startTime = performance.now();\r\n return {\r\n stop: (details?: Record) => {\r\n const ms = Math.round(performance.now() - startTime);\r\n debugLog(`${DBG_EMOJI} ⏱️ ${operation} took ${ms} ms`, details);\r\n return ms;\r\n },\r\n };\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Correlation-ID passthrough for downstream handlers\r\n// -----------------------------------------------------------\r\nexport function getDebugCorrelationId(ctx: any): string {\r\n return ctx?.get?.(\"debugCorrelationId\") ?? \"\";\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Hono-style middleware (unchanged logic, now w/ std/log)\r\n// -----------------------------------------------------------\r\nexport function createDebugMiddleware() {\r\n return async (c: any, next: any) => {\r\n if (!isDebugEnabled()) return await next();\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}🔧 Debug middleware: ${c.req.method} ${c.req.url}${colorEnd}`\r\n );\r\n log.debug(`${DBG_EMOJI} middleware`, {\r\n method: c.req.method,\r\n url: c.req.url,\r\n });\r\n\r\n const cid = captureRequest(c.req.raw);\r\n c.set(\"debugCorrelationId\", cid);\r\n const started = performance.now();\r\n\r\n try {\r\n await next();\r\n if (c.res) {\r\n await captureResponse(cid, c.res);\r\n } else {\r\n captureResponseFromContext(cid, c, performance.now() - started);\r\n }\r\n } catch (err) {\r\n log.error(`${DBG_EMOJI} middleware error`, { message: err.message });\r\n const fallback = new Response(JSON.stringify({ error: err.message }), {\r\n status: 500,\r\n headers: { \"content-type\": \"application/json\" },\r\n });\r\n await captureResponse(cid, fallback);\r\n throw err;\r\n }\r\n };\r\n}\r\n\r\n// -----------------------------------------------------------\r\n// Session lifecycle helpers (for long-lived flows)\r\n// -----------------------------------------------------------\r\nexport function initializeDebugSession(req: Request): string {\r\n const cid = crypto.randomUUID();\r\n debugSessions.set(cid, {\r\n correlationId: cid,\r\n startTime: Date.now(),\r\n request: {\r\n method: req.method,\r\n url: req.url,\r\n ip:\r\n req.headers.get(\"cf-connecting-ip\") ??\r\n req.headers.get(\"x-forwarded-for\") ??\r\n \"unknown\",\r\n userAgent: req.headers.get(\"user-agent\") ?? \"\",\r\n },\r\n });\r\n\r\n // pre-seed map so security-checks land correctly\r\n if (!activeRequests.has(cid)) {\r\n activeRequests.set(cid, {\r\n request: {\r\n method: req.method,\r\n url: req.url,\r\n headers: Object.fromEntries(req.headers.entries()),\r\n timestamp: getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS(),\r\n ip: debugSessions.get(cid)!.request.ip,\r\n userAgent: debugSessions.get(cid)!.request.userAgent,\r\n origin: req.headers.get(\"origin\") ?? \"\",\r\n correlationId: cid,\r\n },\r\n startTime: Date.now(),\r\n securityChecks: [],\r\n });\r\n }\r\n\r\n if (isDebugEnabled()) {\r\n console.log(`\\n🔍 DEBUG SESSION STARTED — ${cid}`);\r\n log.info(`${DBG_EMOJI} session start`, { cid, url: req.url });\r\n }\r\n return cid;\r\n}\r\n\r\nexport function finalizeDebugSession(\r\n cid: string,\r\n _req: Request,\r\n res: Response\r\n): void {\r\n const session = debugSessions.get(cid);\r\n const reqData = activeRequests.get(cid);\r\n if (!session) return; // nothing to do\r\n\r\n if (isDebugEnabled()) {\r\n const elapsed = Date.now() - session.startTime;\r\n const checks = reqData?.securityChecks ?? [];\r\n const summary = {\r\n total: checks.length,\r\n passed: checks.filter((c) => c.passed).length,\r\n failed: checks.filter((c) => !c.passed).length,\r\n status: res.status,\r\n duration: `${elapsed} ms`,\r\n };\r\n\r\n console.log(\"───────────────────────────────────────\");\r\n console.log(`🔒 SECURITY CHECKS SUMMARY`);\r\n console.table(summary);\r\n console.log(`🔍 DEBUG SESSION ENDED\\n`);\r\n log.info(`${DBG_EMOJI} session end`, { cid, ...summary });\r\n }\r\n\r\n debugSessions.delete(cid);\r\n activeRequests.delete(cid);\r\n}\r\n\r\n// Modified functions to use both std/log and colors\r\nexport function initializeDebugger(): void {\r\n const debug = isDebugEnabled();\r\n const isValTown = Boolean(\r\n globalThis?.location?.hostname?.includes?.(\".val.run\") ||\r\n Deno.cwd().includes(\"val.town\")\r\n );\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n if (debug) {\r\n console.log(`${colorStart}🐛 DEBUG MODE ENABLED${colorEnd}`);\r\n log.info(\"Debug mode initialized\", {\r\n runtime: isValTown ? \"Val.Town\" : \"Local Deno\",\r\n denoVersion: Deno.version.deno,\r\n debugSettings: {\r\n enableColors: environment.DEBUG_ENABLE_COLORS,\r\n enableRequestCapture: environment.DEBUG_ENABLE_REQUEST_CAPTURE,\r\n enableResponseCapture: environment.DEBUG_ENABLE_RESPONSE_CAPTURE,\r\n enableSecurityChecks: environment.DEBUG_ENABLE_SECURITY_CHECKS,\r\n logLevel: environment.DEBUG_LOG_LEVEL,\r\n bodySizeLimit: environment.DEBUG_RESPONSE_BODY_SIZE_LIMIT,\r\n },\r\n });\r\n } else {\r\n console.log(`${grayColor}🐛 Debug mode: OFF${colorEnd}`);\r\n }\r\n}\r\nexport function captureRequest(request: Request): string {\r\n if (!isDebugEnabled() || !environment.DEBUG_ENABLE_REQUEST_CAPTURE) return \"\";\r\n\r\n const correlationId = generateCorrelationId();\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n // Flatten headers\r\n const headers: Record = {};\r\n request.headers.forEach((v, k) => (headers[k.toLowerCase()] = v));\r\n\r\n const requestData: DebugRequestData = {\r\n method: request.method,\r\n url: request.url,\r\n headers,\r\n timestamp,\r\n ip:\r\n headers[\"cf-connecting-ip\"] ||\r\n headers[\"x-forwarded-for\"] ||\r\n headers[\"x-real-ip\"] ||\r\n \"unknown\",\r\n userAgent: headers[\"user-agent\"],\r\n origin: headers[\"origin\"],\r\n correlationId,\r\n };\r\n\r\n activeRequests.set(correlationId, {\r\n request: requestData,\r\n startTime: performance.now(),\r\n securityChecks: [],\r\n });\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightCyan\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(`\\n${colorStart}📥 DEBUG REQUEST [${correlationId}]${colorEnd}`);\r\n log.debug(\"Incoming request\", requestData);\r\n return correlationId;\r\n}\r\n\r\nexport async function captureResponse(\r\n correlationId: string,\r\n response: Response\r\n): Promise {\r\n if (!isDebugEnabled() || !correlationId) return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n const duration = performance.now() - requestData.startTime;\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n // Headers → plain object\r\n const headers: Record = {};\r\n response.headers.forEach((v, k) => (headers[k.toLowerCase()] = v));\r\n\r\n const responseData: DebugResponseData = {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers,\r\n timestamp,\r\n duration: Math.round(duration),\r\n };\r\n\r\n // Non-destructive JSON body capture (configurable size limit)\r\n try {\r\n if (\r\n environment.DEBUG_ENABLE_RESPONSE_CAPTURE &&\r\n response.body &&\r\n headers[\"content-type\"]?.includes(\"application/json\")\r\n ) {\r\n const bodyText = await response.clone().text();\r\n if (bodyText.length < environment.DEBUG_RESPONSE_BODY_SIZE_LIMIT) {\r\n responseData.body = bodyText;\r\n }\r\n }\r\n } catch {\r\n /* ignore */\r\n }\r\n\r\n const debugData: DebugRequestResponse = {\r\n request: requestData.request,\r\n response: responseData,\r\n correlationId,\r\n totalDuration: Math.round(duration),\r\n };\r\n\r\n const statusColor =\r\n response.status >= 400\r\n ? DEBUG_COLORS.brightRed\r\n : response.status >= 300\r\n ? DEBUG_COLORS.brightYellow\r\n : DEBUG_COLORS.brightGreen;\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightMagenta\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}📤 DEBUG RESPONSE [${correlationId}] ${statusColorStart}${response.status}${colorEnd}`\r\n );\r\n\r\n if (response.status >= 400) log.error(\"Request failed\", debugData);\r\n else if (response.status >= 300) log.warning(\"Request redirected\", debugData);\r\n else log.info(\"Request completed\", debugData);\r\n\r\n // Security-check summary\r\n if (\r\n requestData.securityChecks.length &&\r\n environment.DEBUG_ENABLE_SECURITY_CHECKS\r\n ) {\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightYellow\r\n : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `\\n${colorStart}🔒 SECURITY CHECKS SUMMARY [${correlationId}]${colorEnd}`\r\n );\r\n log.debug(\"Security checks summary\", {\r\n total: requestData.securityChecks.length,\r\n passed: requestData.securityChecks.filter((c) => c.passed).length,\r\n });\r\n }\r\n\r\n activeRequests.delete(correlationId);\r\n}\r\n\r\nexport function logSecurityCheck(\r\n correlationId: string,\r\n checkName: string,\r\n description: string,\r\n passed: boolean,\r\n details?: Record\r\n): void {\r\n if (\r\n !isDebugEnabled() ||\r\n !environment.DEBUG_ENABLE_SECURITY_CHECKS ||\r\n !correlationId\r\n )\r\n return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n securityCheckCounter++;\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n\r\n const securityCheck: SecurityCheck = {\r\n checkNumber: securityCheckCounter,\r\n checkName,\r\n description,\r\n passed,\r\n details,\r\n timestamp,\r\n };\r\n\r\n requestData.securityChecks.push(securityCheck);\r\n\r\n const statusColor = passed\r\n ? DEBUG_COLORS.brightGreen\r\n : DEBUG_COLORS.brightRed;\r\n const statusIcon = passed ? \"✅\" : \"❌\";\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightBlue\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}Check${securityCheck.checkNumber}:${colorEnd} ${statusColorStart}${statusIcon} ${checkName}${colorEnd}`\r\n );\r\n console.log(`${grayColor} └─ ${description}${colorEnd}`);\r\n\r\n if (passed) log.debug(`Security check passed: ${checkName}`, securityCheck);\r\n else log.warning(`Security check failed: ${checkName}`, securityCheck);\r\n}\r\nfunction captureResponseFromContext(\r\n correlationId: string,\r\n context: any,\r\n duration: number\r\n): void {\r\n if (\r\n !isDebugEnabled() ||\r\n !environment.DEBUG_ENABLE_RESPONSE_CAPTURE ||\r\n !correlationId\r\n )\r\n return;\r\n\r\n const requestData = activeRequests.get(correlationId);\r\n if (!requestData) return;\r\n\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n const status = context?.status ?? context?._status ?? 200;\r\n const statusText = context?.statusText ?? \"OK\";\r\n\r\n const headers: Record = {};\r\n if (context.headers?.forEach) {\r\n context.headers.forEach(\r\n (v: string, k: string) => (headers[k.toLowerCase()] = v)\r\n );\r\n }\r\n\r\n const responseData: DebugResponseData = {\r\n status,\r\n statusText,\r\n headers,\r\n timestamp,\r\n duration: Math.round(duration),\r\n };\r\n\r\n const debugData: DebugRequestResponse = {\r\n request: requestData.request,\r\n response: responseData,\r\n correlationId,\r\n totalDuration: Math.round(duration),\r\n };\r\n\r\n const statusColor =\r\n status >= 400\r\n ? DEBUG_COLORS.brightRed\r\n : status >= 300\r\n ? DEBUG_COLORS.brightYellow\r\n : DEBUG_COLORS.brightGreen;\r\n\r\n const colorStart = environment.DEBUG_ENABLE_COLORS\r\n ? DEBUG_COLORS.brightMagenta\r\n : \"\";\r\n const statusColorStart = environment.DEBUG_ENABLE_COLORS ? statusColor : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${colorStart}📤 DEBUG RESPONSE [${correlationId}] ${statusColorStart}${status}${colorEnd} (fallback)`\r\n );\r\n log.warning(\"Synthetic response captured\", debugData);\r\n\r\n activeRequests.delete(correlationId);\r\n}\r\n\r\n// Maintain all other original functions with their color support\r\nexport function debugLog(message: string, data?: any): void {\r\n if (!isDebugEnabled()) return;\r\n\r\n const timestamp = getCurrentDateTimeInSydneyInYYYYMMDDTHHMMSS();\r\n const grayColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.gray : \"\";\r\n const cyanColor = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.cyan : \"\";\r\n const colorEnd = environment.DEBUG_ENABLE_COLORS ? DEBUG_COLORS.reset : \"\";\r\n\r\n console.log(\r\n `${grayColor}[${timestamp}]${colorEnd} ${cyanColor}🐛 ${message}${colorEnd}`\r\n );\r\n log.debug(message, data);\r\n}\r\n\r\n// ... (keep all other functions with their original implementations)\r\n\r\nexport default {\r\n initializeDebugger,\r\n isDebugEnabled,\r\n captureRequest,\r\n captureResponse,\r\n logSecurityCheck,\r\n logSecurityChecks, // <- now included\r\n createDebugMiddleware,\r\n getDebugCorrelationId,\r\n debugLog,\r\n createDebugTimer, // <- newly wired\r\n initializeDebugSession, // <- newly wired\r\n finalizeDebugSession, // <- newly wired\r\n};\r\n",[],[170,479,532],{"_102":541,"_95":542,"_151":543,"_153":480,"_154":136,"_155":544,"_157":158,"_104":545,"_99":313,"_160":189,"_162":546,"_163":22,"_164":-5,"_165":547,"_98":548},"4a20d0a2-5e6d-11f0-a4b5-0224a6c84d84","ipRestriction.ts","caa0ce60-5c67-11f0-ac5b-0224a6c84d84",604,["D",1752248393636],"// F:\\val.town\\ZenServer\\src\\middleware\\ipRestriction.ts\r\n/**\r\n * IP Restriction Middleware\r\n * Provides IP-based access control using the IP utilities\r\n */\r\n\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { getClientIP, performIPSecurityCheck } from \"../utils/ipUtils.ts\";\r\nimport { logInfo, logWarn } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\ninterface IPRestrictionOptions {\r\n allowList?: string[];\r\n denyList?: string[];\r\n allowPrivate?: boolean;\r\n allowLoopback?: boolean;\r\n errorMessage?: string;\r\n errorHandler?: (\r\n c: Context,\r\n ip: string,\r\n reason: string\r\n ) => Response | Promise;\r\n}\r\n\r\n/**\r\n * Create IP restriction middleware\r\n */\r\nexport const ipRestrictionMiddleware = (options?: IPRestrictionOptions) => {\r\n return async (c: Context, next: Next) => {\r\n const ip = getClientIP(c);\r\n\r\n // Perform security check\r\n const check = performIPSecurityCheck(ip, {\r\n allowList: options?.allowList,\r\n denyList: options?.denyList,\r\n allowPrivate: options?.allowPrivate ?? environment.ALLOW_PRIVATE_IPS,\r\n allowLoopback: options?.allowLoopback ?? environment.ALLOW_LOOPBACK_IPS,\r\n });\r\n\r\n if (!check.allowed) {\r\n logWarn(`IP access denied`, \"ipRestriction\", {\r\n ip,\r\n reason: check.reason,\r\n path: c.req.path,\r\n method: c.req.method,\r\n });\r\n\r\n // Use custom error handler if provided\r\n if (options?.errorHandler) {\r\n return await options.errorHandler(\r\n c,\r\n ip,\r\n check.reason || \"Access denied\"\r\n );\r\n }\r\n\r\n // Default error response\r\n const message = options?.errorMessage || `Access denied: ${check.reason}`;\r\n return c.text(message, 403);\r\n }\r\n\r\n // Log successful access in development\r\n if (environment.APP_ENV === \"dev\") {\r\n logInfo(`IP access allowed`, \"ipRestriction\", {\r\n ip,\r\n path: c.req.path,\r\n });\r\n }\r\n\r\n // Add IP to context for downstream use\r\n c.set(\"clientIP\", ip);\r\n\r\n await next();\r\n };\r\n};\r\n\r\n/**\r\n * Create admin-only IP restriction middleware\r\n * Uses environment configuration for admin IP allowlist\r\n */\r\nexport const adminIPRestrictionMiddleware = () => {\r\n // Get admin IPs from environment or use defaults\r\n const adminIPs = environment.ADMIN_IPS;\r\n\r\n return ipRestrictionMiddleware({\r\n allowList: adminIPs,\r\n allowPrivate: false,\r\n allowLoopback: environment.ALLOW_LOOPBACK_IPS,\r\n errorMessage: \"Unauthorized: Admin access only\",\r\n errorHandler: async (c, ip, reason) => {\r\n // Custom error response for admin endpoints\r\n return c.json(\r\n {\r\n error: \"Unauthorized\",\r\n message: \"This endpoint requires admin access\",\r\n timestamp: new Date().toISOString(),\r\n },\r\n 403\r\n );\r\n },\r\n });\r\n};\r\n\r\n/**\r\n * Create rate limit bypass middleware\r\n * Allows certain IPs to bypass rate limiting\r\n */\r\nexport const rateLimitBypassMiddleware = () => {\r\n return async (c: Context, next: Next) => {\r\n const ip = getClientIP(c);\r\n\r\n // Check if IP should bypass rate limiting\r\n if (environment.ADMIN_IPS.includes(ip)) {\r\n c.set(\"bypassRateLimit\", true);\r\n logInfo(`Rate limit bypassed for IP`, \"ipRestriction\", { ip });\r\n }\r\n\r\n await next();\r\n };\r\n};\r\n\r\n/**\r\n * Create development-only middleware\r\n * Restricts access to development IPs only\r\n */\r\nexport const developmentOnlyMiddleware = () => {\r\n return ipRestrictionMiddleware({\r\n allowPrivate: environment.ALLOW_PRIVATE_IPS,\r\n allowLoopback: environment.ALLOW_LOOPBACK_IPS,\r\n denyList: [], // Override any global deny list\r\n errorMessage: \"This endpoint is only available in development\",\r\n });\r\n};\r\n\r\nexport default ipRestrictionMiddleware;\r\n",[],[170,479,542],{"_102":550,"_95":551,"_151":552,"_153":480,"_154":136,"_155":553,"_157":158,"_104":554,"_99":555,"_160":189,"_162":556,"_163":22,"_164":-5,"_165":557,"_98":558},"e0db420c-5f53-11f0-bbf6-0224a6c84d84","rateLimit.ts","9fea39ac-58a9-11f0-b67c-f69ea79377d9",707,["D",1752347430777],17,"// ======================\r\n// Configuration Section\r\n// ======================\r\n\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logger } from \"../utils/logger.ts\";\r\nimport { logSecurityCheck } from \"../middleware/debugger.ts\";\r\n\r\ninterface RateLimitConfig {\r\n [endpoint: string]: {\r\n requests: number;\r\n windowMs: number;\r\n };\r\n}\r\n\r\n// Rate limiting per endpoint (using environment configuration)\r\nconst RATE_LIMITS: RateLimitConfig = {\r\n \"/api/v1/payment/create-nonce\": {\r\n requests: environment.RATE_LIMIT_CREATE_NONCE_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_CREATE_NONCE_WINDOW_MS,\r\n },\r\n \"/api/v1/payment/exchange-nonce\": {\r\n requests: environment.RATE_LIMIT_EXCHANGE_NONCE_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_EXCHANGE_NONCE_WINDOW_MS,\r\n },\r\n \"/api/v1/payment/refresh\": {\r\n requests: environment.RATE_LIMIT_PAYMENT_REFRESH_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_PAYMENT_REFRESH_WINDOW_MS,\r\n },\r\n \"/api/v1/turnstile/verify\": {\r\n requests: environment.RATE_LIMIT_TURNSTILE_VERIFY_REQUESTS,\r\n windowMs: environment.RATE_LIMIT_TURNSTILE_VERIFY_WINDOW_MS,\r\n },\r\n};\r\n\r\n// ======================\r\n// Implementation Section\r\n// ======================\r\n\r\nexport async function rateLimitMiddleware(\r\n request: Request,\r\n correlationId?: string,\r\n db?: any\r\n): Promise {\r\n const url = new URL(request.url);\r\n const endpoint = url.pathname;\r\n\r\n // Determine IP address using prioritized header list from environment config\r\n let ip: string | null = null;\r\n for (const headerKey of environment.IP_HEADER_KEYS) {\r\n ip = request.headers.get(headerKey);\r\n if (ip) break;\r\n }\r\n if (!ip) ip = \"unknown\";\r\n\r\n // Check if endpoint has rate limiting configured\r\n const limitConfig = RATE_LIMITS[endpoint];\r\n if (!limitConfig) {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Rate Limit Validation\",\r\n \"No rate limiting configured\",\r\n true,\r\n { endpoint, ip }\r\n );\r\n }\r\n return null; // No rate limiting for this endpoint\r\n }\r\n\r\n if (!db) {\r\n return null; // No database connection, allow request\r\n }\r\n\r\n const now = Date.now();\r\n const windowStart = Math.floor(now / limitConfig.windowMs) * limitConfig.windowMs;\r\n const windowEnd = windowStart + limitConfig.windowMs;\r\n\r\n // Get current count from database using existing Database methods\r\n const existing = await db.queryOne(\r\n `SELECT COUNT(*) as count FROM sys_rate_limits \r\n WHERE ip = ? AND endpoint = ? AND timestamp >= ? AND timestamp < ?`,\r\n [ip, endpoint, windowStart, windowEnd]\r\n );\r\n\r\n const currentCount = existing?.count || 0;\r\n const newCount = currentCount + 1;\r\n \r\n // Insert this request using existing Database methods\r\n await db.execute(\r\n `INSERT INTO sys_rate_limits (ip, endpoint, timestamp) VALUES (?, ?, ?)`,\r\n [ip, endpoint, now]\r\n );\r\n\r\n // Check if limit exceeded\r\n const limitExceeded = newCount > limitConfig.requests;\r\n const remaining = Math.max(0, limitConfig.requests - newCount);\r\n\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Rate Limit Validation\",\r\n limitExceeded ? \"Rate limit exceeded\" : \"Within rate limits\",\r\n !limitExceeded,\r\n {\r\n endpoint,\r\n count: newCount,\r\n limit: limitConfig.requests,\r\n remaining,\r\n ip,\r\n }\r\n );\r\n }\r\n\r\n if (limitExceeded) {\r\n logger.warn(\"Rate limit exceeded\", {\r\n ip,\r\n endpoint,\r\n count: newCount,\r\n limit: limitConfig.requests,\r\n });\r\n\r\n const resetTime = windowStart + limitConfig.windowMs;\r\n const retryAfter = Math.ceil((resetTime - now) / 1000);\r\n\r\n return new Response(\r\n JSON.stringify({\r\n error: \"Too many requests\",\r\n message: \"Rate limit exceeded. Please try again later.\",\r\n retryAfter,\r\n }),\r\n {\r\n status: 429,\r\n headers: {\r\n \"Content-Type\": \"application/json\",\r\n \"Retry-After\": retryAfter.toString(),\r\n \"X-RateLimit-Limit\": limitConfig.requests.toString(),\r\n \"X-RateLimit-Remaining\": remaining.toString(),\r\n \"X-RateLimit-Reset\": resetTime.toString(),\r\n },\r\n }\r\n );\r\n }\r\n\r\n // Clean up old entries periodically\r\n if (Math.random() < environment.RATE_LIMIT_CLEANUP_PROBABILITY) {\r\n const cutoff = now - environment.RATE_LIMIT_CLEANUP_CUTOFF_AGE_MS;\r\n await db.execute(\r\n `DELETE FROM sys_rate_limits WHERE timestamp < ?`,\r\n [cutoff]\r\n );\r\n }\r\n\r\n return null; // Allow request to continue\r\n}\r\n",[],[170,479,551],{"_102":560,"_95":561,"_151":562,"_153":480,"_154":136,"_155":563,"_157":158,"_104":564,"_99":217,"_160":189,"_162":565,"_163":22,"_164":-5,"_165":566,"_98":567},"cf448eb8-5ffd-11f0-bbb2-0224a6c84d84","requestLogger.ts","cabb505a-5c67-11f0-93f2-0224a6c84d84",850,["D",1752420415714],"// F:\\val.town\\ZenServer\\src\\middleware\\requestLogger.ts\r\nimport { requestId } from \"npm:hono/request-id\";\r\nimport type { Context, Next } from \"npm:hono\";\r\nimport { logInfo } from \"../utils/logger.ts\";\r\nimport {\r\n getClientInfo,\r\n anonymizeIP,\r\n parseIPAddress,\r\n createRateLimitKey,\r\n performIPSecurityCheck,\r\n} from \"../utils/ipUtils.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { generateUUID } from \"../utils/crypto.ts\";\r\n\r\ninterface MinimalRequestLog {\r\n method: string;\r\n url: string;\r\n headers: Record;\r\n ip?: string;\r\n ipAnonymized?: string;\r\n ipType?: string;\r\n ipVersion?: string;\r\n userAgent?: string;\r\n referer?: string;\r\n origin?: string;\r\n requestId?: string;\r\n rateLimitKey?: string;\r\n securityWarning?: string;\r\n}\r\n\r\ninterface MinimalResponseLog {\r\n status: number;\r\n statusText: string;\r\n headers: Record;\r\n duration?: number;\r\n}\r\n\r\nfunction extractRequestLog(c: Context): MinimalRequestLog {\r\n const req = c.req.raw;\r\n const headers: Record = {};\r\n req.headers.forEach((value: string, key: string) => {\r\n headers[key.toLowerCase()] = value;\r\n });\r\n\r\n // Sanitize sensitive headers\r\n const sensitiveHeaders = [\r\n \"authorization\",\r\n \"cookie\",\r\n \"x-api-key\",\r\n \"x-auth-token\",\r\n ];\r\n sensitiveHeaders.forEach((header) => {\r\n if (headers[header]) {\r\n headers[header] = \"[REDACTED]\";\r\n }\r\n });\r\n\r\n // Use improved IP detection\r\n const clientInfo = getClientInfo(c);\r\n\r\n // Parse IP for additional info\r\n const ipInfo = parseIPAddress(clientInfo.ip);\r\n\r\n // Get request ID from Hono context\r\n const reqId = c.get(\"requestId\") as string;\r\n\r\n // Create rate limit key\r\n const rateLimitKey = createRateLimitKey(clientInfo.ip);\r\n\r\n // Perform security check\r\n const securityCheck = performIPSecurityCheck(clientInfo.ip);\r\n\r\n return {\r\n method: req.method,\r\n url: req.url,\r\n headers,\r\n ip: clientInfo.ip,\r\n ipAnonymized: anonymizeIP(clientInfo.ip),\r\n ipType: ipInfo ? (ipInfo.isPrivate ? \"private\" : \"public\") : undefined,\r\n ipVersion: ipInfo?.version,\r\n userAgent: clientInfo.userAgent,\r\n referer: clientInfo.referer || undefined,\r\n origin: clientInfo.origin || undefined,\r\n requestId: reqId,\r\n rateLimitKey,\r\n securityWarning: !securityCheck.allowed ? securityCheck.reason : undefined,\r\n };\r\n}\r\n\r\nfunction extractResponseLog(\r\n res: Response,\r\n duration?: number\r\n): MinimalResponseLog {\r\n const headers: Record = {};\r\n res.headers.forEach((value, key) => {\r\n headers[key.toLowerCase()] = value;\r\n });\r\n return {\r\n status: res.status,\r\n statusText: res.statusText,\r\n headers,\r\n duration,\r\n };\r\n}\r\n\r\n/**\r\n * Request ID middleware - generates unique ID for each request\r\n */\r\nexport const requestIdMiddleware = requestId({\r\n limitLength: 255,\r\n headerName: \"X-Request-Id\",\r\n generator: (c: Context) => generateUUID(),\r\n});\r\n\r\n/**\r\n * Request logger middleware - logs request/response with request ID\r\n */\r\nexport async function requestLoggerMiddleware(c: Context, next: Next) {\r\n const startTime = performance.now();\r\n const reqLog = extractRequestLog(c);\r\n const requestId = c.get(\"requestId\") as string;\r\n\r\n // Get client info and set in context for downstream middleware\r\n const clientInfo = getClientInfo(c);\r\n c.set(\"clientIP\", clientInfo.ip);\r\n c.set(\"clientInfo\", clientInfo);\r\n\r\n // Check if this IP should bypass rate limiting (admin IPs)\r\n if (environment.ADMIN_IPS.includes(clientInfo.ip)) {\r\n c.set(\"bypassRateLimit\", true);\r\n }\r\n\r\n await next();\r\n\r\n const duration = Math.round(performance.now() - startTime);\r\n const resLog = extractResponseLog(c.res, duration);\r\n\r\n // Ensure request ID is in response headers\r\n c.res.headers.set(\"X-Request-Id\", requestId);\r\n\r\n // Determine log level based on response status and security warnings\r\n const isError = resLog.status >= 500 || reqLog.securityWarning;\r\n const isWarning = resLog.status >= 400;\r\n\r\n // Build comprehensive log entry\r\n const logEntry = {\r\n request: reqLog,\r\n response: resLog,\r\n requestId,\r\n duration,\r\n timestamp: new Date().toISOString(),\r\n path: new URL(reqLog.url).pathname,\r\n // Additional metadata\r\n metadata: {\r\n ipType: reqLog.ipType,\r\n ipVersion: reqLog.ipVersion,\r\n rateLimitKey: reqLog.rateLimitKey,\r\n securityWarning: reqLog.securityWarning,\r\n bypassRateLimit: c.get(\"bypassRateLimit\") || false,\r\n },\r\n };\r\n\r\n // Log with appropriate level\r\n if (isError) {\r\n logInfo(JSON.stringify(logEntry), \"http_error\", { level: \"ERROR\" });\r\n } else if (isWarning) {\r\n logInfo(JSON.stringify(logEntry), \"http_response\", { level: \"WARN\" });\r\n } else {\r\n logInfo(JSON.stringify(logEntry), \"http_response\");\r\n }\r\n\r\n // Log security warnings separately for monitoring\r\n if (reqLog.securityWarning) {\r\n logInfo(`Security warning for request`, \"security_check\", {\r\n requestId,\r\n ip: reqLog.ipAnonymized,\r\n warning: reqLog.securityWarning,\r\n path: new URL(reqLog.url).pathname,\r\n });\r\n }\r\n}\r\n",[],[170,479,561],{"_102":569,"_95":570,"_151":571,"_153":480,"_154":136,"_155":572,"_157":158,"_104":573,"_99":199,"_160":189,"_162":574,"_163":22,"_164":-5,"_165":575,"_98":576},"4a4a3d20-5e6d-11f0-8719-0224a6c84d84","secureHeaders.ts","cacf7c42-5c67-11f0-b3bd-0224a6c84d84",607,["D",1752248393921],"import { secureHeaders, NONCE } from \"npm:hono/secure-headers\";\r\nimport { environment } from \"../config/environment.ts\";\r\n\r\n/**\r\n * Secure Headers Middleware\r\n *\r\n * Uses the following environment configurations:\r\n * - environment.APP_ENV: Determines production vs development CSP policies\r\n * - environment.ALLOWED_ORIGINS: Used in CSP connectSrc directive for allowed API endpoints\r\n * - environment.BASE_URL: Included in CSP connectSrc if not already in ALLOWED_ORIGINS\r\n *\r\n * CSP Policies:\r\n * - Production: Strict policies with minimal allowances\r\n * - Development: More permissive with unsafe-eval, unsafe-inline, and additional CDNs\r\n */\r\n// Hono secure-headers types (since they're not exported)\r\ntype SecureHeadersOptions = {\r\n contentSecurityPolicy?: ContentSecurityPolicyOptions | false;\r\n strictTransportSecurity?: string | false;\r\n xFrameOptions?: string | false;\r\n xContentTypeOptions?: string | false;\r\n xXssProtection?: string | false;\r\n referrerPolicy?: string | false;\r\n crossOriginResourcePolicy?: string | false;\r\n crossOriginOpenerPolicy?: string | false;\r\n crossOriginEmbedderPolicy?: string | false;\r\n originAgentCluster?: boolean;\r\n xDnsPrefetchControl?: string | false;\r\n xDownloadOptions?: string | false;\r\n xPermittedCrossDomainPolicies?: string | false;\r\n permissionsPolicy?: Record;\r\n removePoweredBy?: boolean;\r\n};\r\ntype ContentSecurityPolicyOptions = Record;\r\n\r\n// CSP directive configuration interface with index signature\r\ninterface CSPDirectives {\r\n defaultSrc?: string[];\r\n scriptSrc?: string[];\r\n styleSrc?: string[];\r\n imgSrc?: string[];\r\n connectSrc?: string[];\r\n fontSrc?: string[];\r\n objectSrc?: string[];\r\n mediaSrc?: string[];\r\n frameSrc?: string[];\r\n childSrc?: string[];\r\n workerSrc?: string[];\r\n manifestSrc?: string[];\r\n baseUri?: string[];\r\n formAction?: string[];\r\n frameAncestors?: string[];\r\n sandbox?: string[];\r\n reportTo?: string;\r\n upgradeInsecureRequests?: string[];\r\n blockAllMixedContent?: boolean;\r\n scriptSrcAttr?: string[];\r\n scriptSrcElem?: string[];\r\n styleSrcAttr?: string[];\r\n styleSrcElem?: string[];\r\n // Add index signature to make it compatible with ContentSecurityPolicyOptions\r\n [key: string]: string | string[] | boolean | undefined;\r\n}\r\n\r\n// Permissions Policy configuration interface with index signature\r\ninterface PermissionsPolicyDirectives {\r\n accelerometer?: string[] | boolean;\r\n ambientLightSensor?: string[] | boolean;\r\n autoplay?: string[] | boolean;\r\n battery?: string[] | boolean;\r\n bluetooth?: string[] | boolean;\r\n browsingTopics?: string[] | boolean;\r\n camera?: string[] | boolean;\r\n displayCapture?: string[] | boolean;\r\n documentDomain?: string[] | boolean;\r\n encryptedMedia?: string[] | boolean;\r\n executionWhileNotRendered?: string[] | boolean;\r\n executionWhileOutOfViewport?: string[] | boolean;\r\n fullscreen?: string[] | boolean;\r\n gamepad?: string[] | boolean;\r\n geolocation?: string[] | boolean;\r\n gyroscope?: string[] | boolean;\r\n hid?: string[] | boolean;\r\n identityCredentialsGet?: string[] | boolean;\r\n idleDetection?: string[] | boolean;\r\n localFonts?: string[] | boolean;\r\n magnetometer?: string[] | boolean;\r\n microphone?: string[] | boolean;\r\n midi?: string[] | boolean;\r\n navigationOverride?: string[] | boolean;\r\n otpCredentials?: string[] | boolean;\r\n payment?: string[] | boolean;\r\n pictureInPicture?: string[] | boolean;\r\n publickeyCredentialsCreate?: string[] | boolean;\r\n publickeyCredentialsGet?: string[] | boolean;\r\n screenWakeLock?: string[] | boolean;\r\n serial?: string[] | boolean;\r\n speakerSelection?: string[] | boolean;\r\n storageAccess?: string[] | boolean;\r\n syncXhr?: string[] | boolean;\r\n usb?: string[] | boolean;\r\n webShare?: string[] | boolean;\r\n windowManagement?: string[] | boolean;\r\n xrSpatialTracking?: string[] | boolean;\r\n // Add index signature to make it compatible with Record\r\n [key: string]: string[] | boolean | undefined;\r\n}\r\n\r\nexport function addSecurityHeaders(response: Response): Response {\r\n const headers = getSecurityHeaders();\r\n\r\n // Clone the response to avoid mutating the original\r\n const newResponse = new Response(response.body, {\r\n status: response.status,\r\n statusText: response.statusText,\r\n headers: new Headers(response.headers),\r\n });\r\n\r\n // Add security headers\r\n Object.entries(headers).forEach(([name, value]) => {\r\n newResponse.headers.set(name, value);\r\n });\r\n\r\n return newResponse;\r\n}\r\n\r\n// Production CSP configuration (strict)\r\nfunction getProductionCSPDirectives(): CSPDirectives {\r\n return {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway styles\r\n \"'unsafe-inline'\", // Required for inline styles - consider using nonces in future\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\", // Allow data URLs for images\r\n \"https:\", // Allow HTTPS images\r\n \"https://images.unsplash.com\", // Unsplash for tour images\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile API\r\n \"https://payuat.travelpay.com.au\", // ZenPay payment gateway API\r\n // Include all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS.filter(\r\n (origin) => origin !== \"'self'\" && origin !== \"*\"\r\n ),\r\n // Include BASE_URL if not already in ALLOWED_ORIGINS\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ],\r\n fontSrc: [\r\n \"'self'\",\r\n \"https:\", // Allow HTTPS fonts\r\n \"data:\", // Allow data URL fonts\r\n ],\r\n objectSrc: [\"'none'\"], // Disable object/embed/applet for security\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\r\n \"'self'\",\r\n \"https://challenges.cloudflare.com\", // Cloudflare Turnstile iframe\r\n ],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"], // Prevent clickjacking\r\n upgradeInsecureRequests: [], // Enable upgrade-insecure-requests\r\n blockAllMixedContent: true, // Block mixed content\r\n };\r\n}\r\n\r\n// Development CSP configuration (more permissive)\r\nfunction getDevelopmentCSPDirectives(): CSPDirectives {\r\n return {\r\n defaultSrc: [\"'self'\"],\r\n scriptSrc: [\r\n \"'self'\",\r\n \"'unsafe-eval'\", // Allow eval for dev tools\r\n \"'unsafe-inline'\", // Allow inline scripts for dev\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\",\r\n \"https://cdn.twind.style\", // Twind CSS\r\n \"https://cdn.jsdelivr.net\", // CDN for dev libraries\r\n \"https://unpkg.com\", // CDN for dev libraries\r\n \"https://esm.sh\", // ES modules CDN\r\n ],\r\n styleSrc: [\r\n \"'self'\",\r\n \"'unsafe-inline'\", // Allow inline styles for dev\r\n \"https://payuat.travelpay.com.au\",\r\n \"https://cdn.jsdelivr.net\",\r\n ],\r\n imgSrc: [\r\n \"'self'\",\r\n \"data:\",\r\n \"https:\",\r\n \"https://placehold.co\", // Placeholder images for dev\r\n \"https://source.unsplash.com\", // Dev image sources\r\n \"https://images.unsplash.com\",\r\n ],\r\n connectSrc: [\r\n \"'self'\",\r\n \"ws:\", // Allow WebSocket for dev servers\r\n \"wss:\", // Allow secure WebSocket\r\n \"https://challenges.cloudflare.com\",\r\n \"https://payuat.travelpay.com.au\",\r\n // Include all allowed origins from environment configuration\r\n ...environment.ALLOWED_ORIGINS.filter(\r\n (origin) => origin !== \"'self'\" && origin !== \"*\"\r\n ),\r\n // Include BASE_URL if not already in ALLOWED_ORIGINS\r\n ...(environment.ALLOWED_ORIGINS.includes(environment.BASE_URL)\r\n ? []\r\n : [environment.BASE_URL]),\r\n ],\r\n fontSrc: [\"'self'\", \"https:\", \"data:\"],\r\n objectSrc: [\"'none'\"],\r\n mediaSrc: [\"'self'\"],\r\n frameSrc: [\"'self'\", \"https://challenges.cloudflare.com\"],\r\n childSrc: [\"'self'\"],\r\n workerSrc: [\"'self'\"],\r\n manifestSrc: [\"'self'\"],\r\n baseUri: [\"'self'\"],\r\n formAction: [\"'self'\"],\r\n frameAncestors: [\"'none'\"],\r\n upgradeInsecureRequests: [],\r\n blockAllMixedContent: false, // Allow mixed content in dev\r\n };\r\n}\r\n\r\n// Permissions Policy configuration\r\nconst permissionsPolicyDirectives: PermissionsPolicyDirectives = {\r\n // Disable dangerous permissions by default\r\n bluetooth: false,\r\n camera: false,\r\n microphone: false,\r\n geolocation: false,\r\n usb: false,\r\n serial: false,\r\n hid: false,\r\n\r\n // Allow safe permissions for self\r\n fullscreen: [\"'self'\"],\r\n payment: [\"'self'\", \"https://payuat.travelpay.com.au\"], // Allow payment for ZenPay\r\n\r\n // Disable synchronous XHR (deprecated)\r\n syncXhr: [],\r\n\r\n // Allow autoplay for self (for better UX)\r\n autoplay: [\"'self'\"],\r\n\r\n // Allow picture-in-picture for self\r\n pictureInPicture: [\"'self'\"],\r\n\r\n // Disable other potentially risky features\r\n ambientLightSensor: false,\r\n accelerometer: false,\r\n gyroscope: false,\r\n magnetometer: false,\r\n battery: false,\r\n displayCapture: false,\r\n documentDomain: false,\r\n encryptedMedia: false,\r\n gamepad: false,\r\n idleDetection: false,\r\n midi: false,\r\n otpCredentials: false,\r\n publickeyCredentialsCreate: [\"'self'\"],\r\n publickeyCredentialsGet: [\"'self'\"],\r\n screenWakeLock: false,\r\n speakerSelection: false,\r\n storageAccess: false,\r\n webShare: [\"'self'\"],\r\n windowManagement: false,\r\n xrSpatialTracking: false,\r\n};\r\n\r\n/**\r\n * Get CSP directives based on environment\r\n */\r\nfunction getCSPDirectives(): ContentSecurityPolicyOptions {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n const directives = isProduction\r\n ? getProductionCSPDirectives()\r\n : getDevelopmentCSPDirectives();\r\n\r\n // Log CSP configuration for debugging\r\n console.log(`🛡️ CSP Configuration (${environment.APP_ENV}):`, {\r\n environment: environment.APP_ENV,\r\n isProduction,\r\n allowedOrigins: environment.ALLOWED_ORIGINS,\r\n baseUrl: environment.BASE_URL,\r\n connectSrcCount: Array.isArray(directives.connectSrc)\r\n ? directives.connectSrc.length\r\n : 0,\r\n scriptSrcCount: Array.isArray(directives.scriptSrc)\r\n ? directives.scriptSrc.length\r\n : 0,\r\n blockAllMixedContent: directives.blockAllMixedContent,\r\n });\r\n\r\n return directives;\r\n}\r\n\r\n/**\r\n * Get comprehensive secure headers configuration\r\n */\r\n/**\r\n * Get comprehensive secure headers configuration\r\n */\r\nexport function getSecureHeadersOptions(): SecureHeadersOptions {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n\r\n const baseOptions: SecureHeadersOptions = {\r\n // Remove X-Powered-By header\r\n removePoweredBy: true,\r\n\r\n // Strict Transport Security - more restrictive in production\r\n strictTransportSecurity: isProduction\r\n ? \"max-age=31536000; includeSubDomains; preload\"\r\n : \"max-age=3600; includeSubDomains\",\r\n\r\n // X-Frame-Options - prevent clickjacking\r\n xFrameOptions: \"DENY\",\r\n\r\n // X-Content-Type-Options - prevent MIME sniffing\r\n xContentTypeOptions: \"nosniff\",\r\n\r\n // X-XSS-Protection - legacy XSS protection\r\n xXssProtection: \"0\", // Recommended to disable as per modern security practices\r\n\r\n // Referrer Policy - control referrer information\r\n referrerPolicy: \"strict-origin-when-cross-origin\",\r\n\r\n // Cross-Origin policies\r\n crossOriginResourcePolicy: \"same-origin\",\r\n crossOriginOpenerPolicy: \"same-origin\",\r\n crossOriginEmbedderPolicy: false, // Disable if not needed\r\n\r\n // Origin Agent Cluster\r\n originAgentCluster: true,\r\n\r\n // DNS Prefetch Control\r\n xDnsPrefetchControl: \"off\",\r\n\r\n // Download Options (IE-specific)\r\n xDownloadOptions: \"noopen\",\r\n\r\n // Permitted Cross-Domain Policies\r\n xPermittedCrossDomainPolicies: \"none\",\r\n\r\n // Permissions Policy\r\n permissionsPolicy: permissionsPolicyDirectives,\r\n };\r\n\r\n // Only add contentSecurityPolicy if it's not disabled\r\n const cspDirectives = getCSPDirectives();\r\n if (Object.keys(cspDirectives).length > 0) {\r\n baseOptions.contentSecurityPolicy = cspDirectives;\r\n }\r\n\r\n return baseOptions;\r\n}\r\n\r\n/**\r\n * Display startup information about security headers configuration\r\n */\r\nfunction logSecurityHeadersStartup(): void {\r\n const isProduction = environment.APP_ENV === \"prod\";\r\n const cspDirectives = getCSPDirectives();\r\n\r\n console.log(`🛡️ Security Headers Configuration:`);\r\n console.log(` Environment: ${environment.APP_ENV}`);\r\n console.log(\r\n ` CSP Policy: ${\r\n isProduction ? \"Production (Strict)\" : \"Development (Permissive)\"\r\n }`\r\n );\r\n console.log(\r\n ` Allowed Origins: ${environment.ALLOWED_ORIGINS.length} configured`\r\n );\r\n console.log(` Base URL: ${environment.BASE_URL}`);\r\n console.log(\r\n ` Connect Sources: ${\r\n Array.isArray(cspDirectives.connectSrc)\r\n ? cspDirectives.connectSrc.length\r\n : 0\r\n } allowed`\r\n );\r\n console.log(\r\n ` Script Sources: ${\r\n Array.isArray(cspDirectives.scriptSrc)\r\n ? cspDirectives.scriptSrc.length\r\n : 0\r\n } allowed`\r\n );\r\n console.log(\r\n ` Mixed Content: ${\r\n cspDirectives.blockAllMixedContent ? \"Blocked\" : \"Allowed\"\r\n }`\r\n );\r\n console.log(\r\n ` Frame Ancestors: ${\r\n Array.isArray(cspDirectives.frameAncestors)\r\n ? cspDirectives.frameAncestors.join(\", \")\r\n : \"None\"\r\n }`\r\n );\r\n}\r\n\r\n/**\r\n * Create Hono secure headers middleware\r\n */\r\nexport function createSecureHeadersMiddleware() {\r\n // Log startup information\r\n logSecurityHeadersStartup();\r\n\r\n const options = getSecureHeadersOptions();\r\n // Only pass to secureHeaders if contentSecurityPolicy is not false\r\n if (options.contentSecurityPolicy === false) {\r\n const {\r\n contentSecurityPolicy: _contentSecurityPolicy,\r\n ...optionsWithoutCSP\r\n } = options;\r\n return secureHeaders(optionsWithoutCSP as any); // Type assertion needed due to Hono's type definitions\r\n }\r\n return secureHeaders(options as any); // Type assertion needed due to Hono's type definitions\r\n}\r\n\r\n/**\r\n * Get security headers as a plain object (for manual header setting)\r\n */\r\nexport function getSecurityHeaders(): Record {\r\n const options = getSecureHeadersOptions();\r\n const headers: Record = {};\r\n\r\n // Build CSP header\r\n if (options.contentSecurityPolicy) {\r\n const csp = options.contentSecurityPolicy;\r\n const policies: string[] = [];\r\n\r\n Object.entries(csp).forEach(([directive, value]) => {\r\n if (Array.isArray(value) && value.length > 0) {\r\n const kebabDirective = directive\r\n .replace(/([A-Z])/g, \"-$1\")\r\n .toLowerCase();\r\n policies.push(`${kebabDirective} ${value.join(\" \")}`);\r\n } else if (\r\n directive === \"upgradeInsecureRequests\" &&\r\n Array.isArray(value)\r\n ) {\r\n policies.push(\"upgrade-insecure-requests\");\r\n } else if (directive === \"blockAllMixedContent\" && value === true) {\r\n policies.push(\"block-all-mixed-content\");\r\n } else if (typeof value === \"string\") {\r\n const kebabDirective = directive\r\n .replace(/([A-Z])/g, \"-$1\")\r\n .toLowerCase();\r\n policies.push(`${kebabDirective} ${value}`);\r\n }\r\n });\r\n\r\n if (policies.length > 0) {\r\n headers[\"Content-Security-Policy\"] = policies.join(\"; \");\r\n }\r\n }\r\n\r\n // Build Permissions Policy header\r\n if (options.permissionsPolicy) {\r\n const policies: string[] = [];\r\n Object.entries(options.permissionsPolicy).forEach(([feature, value]) => {\r\n const kebabFeature = feature.replace(/([A-Z])/g, \"-$1\").toLowerCase();\r\n if (value === false) {\r\n policies.push(`${kebabFeature}=()`);\r\n } else if (value === true) {\r\n policies.push(`${kebabFeature}=*`);\r\n } else if (Array.isArray(value)) {\r\n if (value.length === 0) {\r\n policies.push(`${kebabFeature}=()`);\r\n } else {\r\n const origins = value\r\n .map((origin) =>\r\n origin === \"'self'\" || origin === \"'none'\" || origin === \"*\"\r\n ? origin\r\n : `\"${origin}\"`\r\n )\r\n .join(\" \");\r\n policies.push(`${kebabFeature}=(${origins})`);\r\n }\r\n }\r\n });\r\n\r\n if (policies.length > 0) {\r\n headers[\"Permissions-Policy\"] = policies.join(\", \");\r\n }\r\n }\r\n\r\n // Add other security headers\r\n if (options.strictTransportSecurity) {\r\n headers[\"Strict-Transport-Security\"] = options.strictTransportSecurity;\r\n }\r\n\r\n if (options.xFrameOptions) {\r\n headers[\"X-Frame-Options\"] = options.xFrameOptions;\r\n }\r\n\r\n if (options.xContentTypeOptions) {\r\n headers[\"X-Content-Type-Options\"] = options.xContentTypeOptions;\r\n }\r\n\r\n if (options.xXssProtection) {\r\n headers[\"X-XSS-Protection\"] = options.xXssProtection;\r\n }\r\n\r\n if (options.referrerPolicy) {\r\n headers[\"Referrer-Policy\"] = options.referrerPolicy;\r\n }\r\n\r\n if (options.crossOriginResourcePolicy) {\r\n headers[\"Cross-Origin-Resource-Policy\"] = options.crossOriginResourcePolicy;\r\n }\r\n\r\n if (options.crossOriginOpenerPolicy) {\r\n headers[\"Cross-Origin-Opener-Policy\"] = options.crossOriginOpenerPolicy;\r\n }\r\n\r\n if (options.crossOriginEmbedderPolicy) {\r\n headers[\"Cross-Origin-Embedder-Policy\"] = options.crossOriginEmbedderPolicy;\r\n }\r\n\r\n if (options.originAgentCluster) {\r\n headers[\"Origin-Agent-Cluster\"] = \"?1\";\r\n }\r\n\r\n if (options.xDnsPrefetchControl) {\r\n headers[\"X-DNS-Prefetch-Control\"] = options.xDnsPrefetchControl;\r\n }\r\n\r\n if (options.xDownloadOptions) {\r\n headers[\"X-Download-Options\"] = options.xDownloadOptions;\r\n }\r\n\r\n if (options.xPermittedCrossDomainPolicies) {\r\n headers[\"X-Permitted-Cross-Domain-Policies\"] =\r\n options.xPermittedCrossDomainPolicies;\r\n }\r\n\r\n return headers;\r\n}\r\n\r\n/**\r\n * Middleware function that applies security headers\r\n */\r\nexport function secureHeadersMiddleware() {\r\n return async (c: any, next: any) => {\r\n await next();\r\n\r\n // Add security headers to the response\r\n const securityHeaders = getSecurityHeaders();\r\n Object.entries(securityHeaders).forEach(([name, value]) => {\r\n c.res.headers.set(name, value);\r\n });\r\n\r\n // Remove X-Powered-By if removePoweredBy is enabled\r\n const options = getSecureHeadersOptions();\r\n if (options.removePoweredBy) {\r\n c.res.headers.delete(\"X-Powered-By\");\r\n }\r\n };\r\n}\r\n\r\n/**\r\n * Enhanced secure headers middleware with nonce support\r\n */\r\nexport function createNonceSecureHeadersMiddleware() {\r\n const baseOptions = getSecureHeadersOptions();\r\n const cspDirectives = getCSPDirectives();\r\n\r\n // Safely handle scriptSrc and styleSrc which might not be arrays\r\n const scriptSrc = cspDirectives.scriptSrc;\r\n const styleSrc = cspDirectives.styleSrc;\r\n\r\n const updatedOptions = {\r\n ...baseOptions,\r\n contentSecurityPolicy: {\r\n ...cspDirectives,\r\n scriptSrc: [\r\n NONCE,\r\n ...(Array.isArray(scriptSrc)\r\n ? scriptSrc.filter((src) => src !== \"'unsafe-inline'\")\r\n : []),\r\n ],\r\n styleSrc: [\r\n NONCE,\r\n ...(Array.isArray(styleSrc)\r\n ? styleSrc.filter((src) => src !== \"'unsafe-inline'\")\r\n : []),\r\n ],\r\n },\r\n };\r\n\r\n // Handle the case where contentSecurityPolicy might be false\r\n if (baseOptions.contentSecurityPolicy === false) {\r\n return secureHeaders(baseOptions as any);\r\n }\r\n\r\n return secureHeaders(updatedOptions);\r\n}\r\n\r\n// Export types and constants\r\nexport type {\r\n CSPDirectives,\r\n PermissionsPolicyDirectives,\r\n SecureHeadersOptions,\r\n ContentSecurityPolicyOptions,\r\n};\r\nexport { NONCE };\r\n\r\n// Default export for backwards compatibility\r\nexport default {\r\n createSecureHeadersMiddleware,\r\n getSecureHeadersOptions,\r\n getSecurityHeaders,\r\n secureHeadersMiddleware,\r\n createNonceSecureHeadersMiddleware,\r\n NONCE,\r\n};\r\n",[],[170,479,570],{"_102":578,"_95":579,"_151":580,"_153":480,"_154":136,"_155":581,"_157":158,"_104":582,"_99":172,"_160":189,"_162":583,"_163":22,"_164":-5,"_165":584,"_98":585},"4a56b7bc-5e6d-11f0-8ec4-0224a6c84d84","security.ts","50c82d46-5c70-11f0-9378-0224a6c84d84",608,["D",1752248393999],"import { logger } from \"../utils/logger.ts\";\r\nimport { environment } from \"../config/environment.ts\";\r\nimport { logSecurityCheck } from \"../middleware/debugger.ts\";\r\n\r\nexport function securityMiddleware(\r\n request: Request,\r\n correlationId?: string\r\n): Response | null {\r\n const url = new URL(request.url);\r\n const ip =\r\n request.headers.get(\"cf-connecting-ip\") ||\r\n request.headers.get(\"x-forwarded-for\") ||\r\n \"unknown\";\r\n const userAgent = request.headers.get(\"user-agent\") || \"\";\r\n const referer = request.headers.get(\"referer\") || \"\";\r\n const origin = request.headers.get(\"origin\") || \"\";\r\n\r\n // Basic security headers validation\r\n const securityViolations: string[] = [];\r\n\r\n // Check for suspicious user agents using configuration\r\n const suspiciousPatterns = environment.SECURITY_SUSPICIOUS_USER_AGENTS.map(\r\n (pattern) => new RegExp(pattern, \"i\")\r\n );\r\n\r\n if (suspiciousPatterns.some((pattern) => pattern.test(userAgent))) {\r\n securityViolations.push(\"suspicious_user_agent\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"User Agent Security Scan\",\r\n \"Suspicious pattern detected\",\r\n false,\r\n { userAgent: userAgent.substring(0, 50), ip }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"User Agent Security Scan\",\r\n \"Clean user agent\",\r\n true,\r\n { userAgent: userAgent.substring(0, 50), ip }\r\n );\r\n }\r\n }\r\n\r\n // Validate referer for sensitive endpoints using configuration\r\n const sensitiveEndpoints = environment.SECURITY_SENSITIVE_ENDPOINTS;\r\n\r\n if (sensitiveEndpoints.includes(url.pathname)) {\r\n if (\r\n referer &&\r\n !environment.ALLOWED_ORIGINS.some((allowedOrigin) =>\r\n referer.startsWith(allowedOrigin)\r\n )\r\n ) {\r\n securityViolations.push(\"invalid_referer\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Referer Validation\",\r\n `Invalid referer for ${url.pathname}`,\r\n false,\r\n { referer, endpoint: url.pathname }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Referer Validation\",\r\n `Valid referer for ${url.pathname}`,\r\n true,\r\n { referer: referer || \"none\", endpoint: url.pathname }\r\n );\r\n }\r\n }\r\n\r\n if (origin && !environment.ALLOWED_ORIGINS.includes(origin)) {\r\n securityViolations.push(\"invalid_origin\");\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Origin Validation\",\r\n `Invalid origin for ${url.pathname}`,\r\n false,\r\n { origin, endpoint: url.pathname }\r\n );\r\n }\r\n } else {\r\n if (correlationId) {\r\n logSecurityCheck(\r\n correlationId,\r\n \"Origin Validation\",\r\n `Valid origin for ${url.pathname}`,\r\n true,\r\n { origin: origin || \"none\", endpoint: url.pathname }\r\n );\r\n }\r\n }\r\n }\r\n\r\n // Check for common attack patterns in headers\r\n const dangerousPatterns = [\r\n /\n\n\n

Turnstile Test Page

\n \n

\n \n \n\n`;\n\n // Return as plain text since OpenAPI will handle response formatting\n return html;\n}\n\nexport async function verifyTurnstile(ctx: BusinessLogicContext) {\n const { token } = ctx.body;\n const ip = getClientIP(ctx.request);\n\n // Use ValidationService for required field validation\n const missingFields = checkRequiredFields(ctx.body, [\"token\"]);\n if (missingFields.length > 0) {\n throw new Error(`Missing required fields: ${missingFields.join(\", \")}`);\n }\n\n // Use TurnstileService for complete validation with logging\n const result = await TurnstileService.verifyToken(\n token,\n ip,\n ctx.db,\n ctx.correlationId\n );\n\n return result;\n}\n\n\n\nclass TurnstileService {\n private static readonly TURNSTILE_VERIFY_URL = \"https://challenges.cloudflare.com/turnstile/v0/siteverify\";\n private static readonly CACHE_TTL = 90 * 1000; // 90 seconds as specified in SOLUTION.md\n\n /**\n * Validate Cloudflare Turnstile token with 90-second cache using database\n */\n static async validateToken(cfToken: string, clientIP?: string, db?: Database): Promise {\n if (!cfToken || typeof cfToken !== 'string') {\n return { valid: false, error: \"Missing or invalid Turnstile token\" };\n }\n\n // Check database cache first\n if (db) {\n const cached = await db.queryOne(\n `SELECT result, timestamp FROM turnstile_cache WHERE token = ? AND timestamp > ?`,\n [cfToken, Date.now() - this.CACHE_TTL]\n );\n \n if (cached) {\n const result = JSON.parse(cached.result) as TurnstileValidation;\n logger.info(\"Turnstile validation from database cache\", { \n token: cfToken.substring(0, 10) + \"...\",\n valid: result.valid \n });\n return result;\n }\n }\n\n // Get secret key from environment\n const secretKey = Deno.env.get(\"TURNSTILE_SECRET_KEY\");\n if (!secretKey) {\n logger.error(\"TURNSTILE_SECRET_KEY not configured\");\n return { valid: false, error: \"Turnstile validation not configured\" };\n }\n\n try {\n // Prepare verification payload\n const formData = new FormData();\n formData.append('secret', secretKey);\n formData.append('response', cfToken);\n if (clientIP) {\n formData.append('remoteip', clientIP);\n }\n\n // Call Cloudflare API\n const response = await fetch(this.TURNSTILE_VERIFY_URL, {\n method: 'POST',\n body: formData,\n });\n\n if (!response.ok) {\n logger.error(\"Turnstile API request failed\", { \n status: response.status,\n statusText: response.statusText \n });\n return { valid: false, error: \"Turnstile validation failed\" };\n }\n\n const result = await response.json();\n \n const validation: TurnstileValidation = {\n valid: result.success === true,\n error: result.success ? undefined : \"Turnstile challenge failed\",\n challenge_ts: result.challenge_ts,\n hostname: result.hostname\n };\n\n // Cache the result in database\n if (db) {\n await db.execute(\n `INSERT OR REPLACE INTO turnstile_cache (token, result, timestamp) VALUES (?, ?, ?)`,\n [cfToken, JSON.stringify(validation), Date.now()]\n );\n\n // Clean old cache entries periodically\n if (Math.random() < 0.1) { // 10% chance\n await db.execute(\n `DELETE FROM turnstile_cache WHERE timestamp <= ?`,\n [Date.now() - this.CACHE_TTL]\n );\n }\n }\n\n logger.info(\"Turnstile validation completed\", { \n token: cfToken.substring(0, 10) + \"...\",\n valid: validation.valid,\n hostname: validation.hostname,\n ip: clientIP \n });\n\n return validation;\n\n } catch (error) {\n logger.error(\"Turnstile validation error\", { \n error: error.message,\n token: cfToken.substring(0, 10) + \"...\"\n });\n return { valid: false, error: \"Turnstile validation failed\" };\n }\n }\n\n /**\n * Clean expired cache entries\n */\n\n /**\n * Clear all cached tokens (for testing/admin use)\n */\n static async clearCache(db?: Database): Promise {\n if (db) {\n await db.execute(`DELETE FROM turnstile_cache`);\n }\n logger.info(\"Turnstile cache cleared\");\n }\n\n /**\n * Complete Turnstile validation with security logging and correlation tracking\n */\n static async validateWithSecurityChecks(\n ctx: TurnstileValidationContext\n ): Promise {\n const { cfToken, ip, db, correlationId } = ctx;\n\n // 1. Format validation\n if (!ValidationService.isValidTurnstileTokenFormat(cfToken)) {\n if (correlationId) {\n logSecurityCheck(\n correlationId,\n \"Turnstile Validation\",\n \"Invalid Turnstile token format\",\n false,\n { cfToken: cfToken.substring(0, 20) + \"...\", ip }\n );\n }\n return { valid: false, error: \"Invalid Turnstile token format\" };\n }\n\n // 2. Service validation\n const turnstileValidation = await this.validateToken(cfToken, ip, db);\n\n // 3. Security logging\n if (correlationId) {\n if (!turnstileValidation.valid) {\n logSecurityCheck(\n correlationId,\n \"Turnstile Validation\",\n `Turnstile failed: ${turnstileValidation.error}`,\n false,\n { cfToken: cfToken.substring(0, 20) + \"...\", ip }\n );\n } else {\n logSecurityCheck(\n correlationId,\n \"Turnstile Validation\",\n \"Turnstile validation successful\",\n true,\n { ip, hostname: turnstileValidation.hostname }\n );\n }\n }\n\n return turnstileValidation;\n }\n\n /**\n * Validate Turnstile token for standalone verification endpoint\n */\n static async verifyToken(\n token: string,\n ip: string,\n db: Database,\n correlationId?: string\n ): Promise {\n // Format validation\n const tokenValidation = ValidationService.validateTurnstileToken(token);\n if (!tokenValidation.valid) {\n logger.warn(\"Turnstile token format validation failed\", {\n error: tokenValidation.error,\n token: token.substring(0, 20) + \"...\",\n ip,\n correlationId,\n });\n return { valid: false, error: `Invalid Turnstile token format: ${tokenValidation.error}` };\n }\n\n // Service validation\n const result = await this.validateToken(token, ip, db);\n\n // Audit logging\n logger.info(\"Turnstile verification completed\", {\n valid: result.valid,\n ip,\n token: token.substring(0, 20) + \"...\",\n hostname: result.hostname,\n correlationId,\n });\n\n return result;\n }\n\n /**\n * Check if Turnstile is properly configured\n */\n static isConfigured(): boolean {\n return !!Deno.env.get(\"TURNSTILE_SECRET_KEY\");\n }\n}\n\nexport { TurnstileService };",[],[170,589,642],{"_102":650,"_95":651,"_151":652,"_153":590,"_154":136,"_155":653,"_157":158,"_104":654,"_99":636,"_160":189,"_162":655,"_163":22,"_164":-5,"_165":656,"_98":657},"1cea1360-5fd4-11f0-afbf-0224a6c84d84","validationService.ts","a0236cc2-58a9-11f0-a255-f69ea79377d9",821,["D",1752402507120],"/**\n * Comprehensive validation service for ZenServer.\n * Consolidated validation utilities and security checks.\n */\n\nimport { z } from 'https://esm.sh/zod@3.22.4';\n\n// ========================================\n// Constants and Patterns\n// ========================================\n\nexport const NONCE_PATTERN = /^[a-f0-9]{64}$/;\nexport const BOOKING_ID_PATTERN = /^booking_[a-zA-Z0-9]{6,12}$/;\nexport const TIMESTAMP_PATTERN = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$/;\nexport const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nexport const AMOUNT_PATTERN = /^\\d+(\\.\\d{2})?$/;\n\n// ========================================\n// Zod Schemas\n// ========================================\n\n/**\n * Validates nonce format (64 hex characters).\n */\nexport const NonceSchema = z.string()\n .length(64, 'Nonce must be exactly 64 characters')\n .regex(NONCE_PATTERN, 'Nonce must contain only lowercase hexadecimal characters');\n\n/**\n * Validates booking ID format.\n */\nexport const BookingIdSchema = z.string()\n .min(14, 'Booking ID too short')\n .max(20, 'Booking ID too long')\n .regex(BOOKING_ID_PATTERN, 'Invalid booking ID format');\n\n/**\n * Validates timestamp format for payment requests.\n */\nexport const PaymentTimestampSchema = z.string()\n .regex(TIMESTAMP_PATTERN, 'Timestamp must be in YYYY-MM-DDTHH:MM:SS format');\n\n/**\n * Validates payment amount (must be string with optional .00).\n */\nexport const PaymentAmountSchema = z.string()\n .regex(AMOUNT_PATTERN, 'Invalid amount format')\n .refine((val) => {\n const num = parseFloat(val);\n return num > 0 && num <= 999999.99;\n }, 'Amount must be between 0.01 and 999999.99');\n\n/**\n * Validates UUID format.\n */\nexport const UUIDSchema = z.string()\n .regex(UUID_PATTERN, 'Invalid UUID format');\n\n/**\n * Validates IP address format.\n */\nexport const IPAddressSchema = z.string()\n .ip({ message: 'Invalid IP address format' });\n\n/**\n * Validates payment nonce request.\n */\nexport const PaymentNonceRequestSchema = z.object({\n bookingId: BookingIdSchema,\n email_verify: z.string().optional(), // Honeypot field\n timestamp: PaymentTimestampSchema.optional(),\n});\n\n/**\n * Validates payment hash request.\n */\nexport const PaymentHashRequestSchema = z.object({\n apikey: z.string().min(1),\n mode: z.enum(['0', '1', '2', '3']),\n paymentAmount: PaymentAmountSchema,\n merchantUniquePaymentId: UUIDSchema,\n timestamp: PaymentTimestampSchema,\n});\n\n// ========================================\n// Validation Helper Functions\n// ========================================\n\n/**\n * Formats Zod validation errors into user-friendly messages.\n */\nexport function formatValidationErrors(error: z.ZodError): string[] {\n return error.errors.map((err) => {\n const path = err.path.length > 0 ? `${err.path.join('.')}: ` : '';\n return `${path}${err.message}`;\n });\n}\n\n/**\n * Validates request data and returns formatted errors if validation fails.\n */\nexport function validateRequestData(\n schema: z.ZodSchema,\n data: unknown,\n): { success: true; data: T } | { success: false; errors: string[] } {\n try {\n const validatedData = schema.parse(data);\n return { success: true, data: validatedData };\n } catch (error) {\n if (error instanceof z.ZodError) {\n return { success: false, errors: formatValidationErrors(error) };\n }\n return { success: false, errors: ['Validation failed: Unknown error'] };\n }\n}\n\n/**\n * Validates required fields are present in request.\n */\nexport function checkRequiredFields>(\n data: T,\n requiredFields: string[],\n): string[] {\n const missing: string[] = [];\n\n for (const field of requiredFields) {\n if (data[field] === undefined || data[field] === null || data[field] === '') {\n missing.push(field);\n }\n }\n\n return missing;\n}\n\n// ========================================\n// IP Address Extraction\n// ========================================\n\n/**\n * Extracts and validates IP address from headers.\n * Checks multiple headers in order of preference.\n */\nexport function extractAndValidateIP(headers: Headers): string {\n // Check for Cloudflare headers first\n const cfConnectingIP = headers.get('cf-connecting-ip');\n if (cfConnectingIP) {\n try {\n IPAddressSchema.parse(cfConnectingIP);\n return cfConnectingIP;\n } catch {\n // Fall through to next option\n }\n }\n\n const trueClientIP = headers.get('true-client-ip');\n if (trueClientIP) {\n try {\n IPAddressSchema.parse(trueClientIP);\n return trueClientIP;\n } catch {\n // Fall through to next option\n }\n }\n\n // Check X-Forwarded-For (may contain multiple IPs)\n const xForwardedFor = headers.get('x-forwarded-for');\n if (xForwardedFor) {\n const firstIP = xForwardedFor.split(',')[0].trim();\n try {\n IPAddressSchema.parse(firstIP);\n return firstIP;\n } catch {\n // Fall through to unknown\n }\n }\n\n const xRealIP = headers.get('x-real-ip');\n if (xRealIP) {\n try {\n IPAddressSchema.parse(xRealIP);\n return xRealIP;\n } catch {\n // Fall through to unknown\n }\n }\n\n return 'unknown';\n}\n\n// ========================================\n// Security Validation\n// ========================================\n\n/**\n * Validates email_verify field for honeypot detection.\n * Returns true if honeypot is triggered (field is missing or has wrong value).\n * Correct value should be \"🍯\" (honey emoji) for human users.\n */\nexport function isHoneypotTriggered(emailVerify: string | undefined): boolean {\n // Honeypot is triggered when field is missing OR has wrong value\n // Correct value should be \"🍯\" (honey emoji) \n return !emailVerify || emailVerify.trim() !== \"🍯\";\n}\n\n/**\n * Validates origin header against allowed origins.\n */\nexport function isValidOrigin(origin: string | null, allowedOrigins: string[]): boolean {\n if (!origin) return false;\n return allowedOrigins.includes(origin);\n}\n\n/**\n * Validates referer header against origin.\n */\nexport function isValidReferer(referer: string | null, origin: string | null): boolean {\n if (!referer || !origin) return false;\n try {\n return referer.startsWith(origin);\n } catch {\n return false;\n }\n}\n\n/**\n * Validates host header against expected host.\n */\nexport function isValidHost(host: string | null, expectedHost: string): boolean {\n if (!host) return false;\n return host === expectedHost;\n}\n\n/**\n * Validates timestamp for replay attack prevention.\n */\nexport function isRequestTimestampValid(\n timestamp: string | undefined,\n toleranceMs: number = 5 * 60 * 1000, // 5 minutes\n): boolean {\n if (!timestamp) {\n return false;\n }\n\n try {\n const requestTime = new Date(timestamp).getTime();\n const now = Date.now();\n\n if (isNaN(requestTime)) {\n return false;\n }\n\n // Request must be recent but not from the future\n const age = now - requestTime;\n return age >= 0 && age <= toleranceMs;\n } catch {\n return false;\n }\n}\n\n// ========================================\n// Type Guards\n// ========================================\n\n/**\n * Type guard to check if value is a valid payment mode.\n */\nexport function isValidPaymentMode(mode: any): mode is '0' | '1' | '2' | '3' {\n return ['0', '1', '2', '3'].includes(String(mode));\n}\n\n/**\n * Validates that payment amount string doesn't contain decimals.\n */\nexport function hasNoDecimals(amountString: string): boolean {\n return !/[.,]/.test(amountString);\n}\n\n// ========================================\n// ValidationService Class\n// ========================================\n\nexport class ValidationService {\n /**\n * Validates booking ID using Zod schema.\n */\n static validateBookingId(bookingId: string): { valid: boolean; error?: string } {\n const result = validateRequestData(BookingIdSchema, bookingId);\n\n if (result.success === false) {\n return { valid: false, error: result.errors[0] };\n }\n\n return { valid: true };\n }\n\n /**\n * Validates nonce format using Zod schema.\n */\n static validateNonceFormat(nonce: string): { valid: boolean; error?: string } {\n const result = validateRequestData(NonceSchema, nonce);\n\n if (result.success === false) {\n return { valid: false, error: result.errors[0] };\n }\n\n return { valid: true };\n }\n\n /**\n * Validates IP address using Zod schema.\n */\n static validateIpAddress(ip: string): { valid: boolean; error?: string } {\n if (ip === 'unknown') {\n return { valid: true }; // Allow 'unknown' as fallback\n }\n\n const result = validateRequestData(IPAddressSchema, ip);\n\n if (result.success === false) {\n return { valid: false, error: result.errors[0] };\n }\n\n return { valid: true };\n }\n\n /**\n * Extracts IP address from request headers.\n */\n static extractIpAddress(headers: Headers): string {\n return extractAndValidateIP(headers);\n }\n\n /**\n * Validates request headers for security requirements.\n */\n static validateRequestHeaders(headers: Headers): { valid: boolean; errors: string[] } {\n const errors: string[] = [];\n\n // Check for required security headers\n const userAgent = headers.get(\"user-agent\");\n if (!userAgent || userAgent.trim().length === 0) {\n errors.push(\"User-Agent header is required\");\n }\n\n // Validate Content-Type for POST requests\n const contentType = headers.get(\"content-type\");\n if (contentType && !contentType.includes(\"application/json\")) {\n errors.push(\"Content-Type must be application/json\");\n }\n\n return {\n valid: errors.length === 0,\n errors\n };\n }\n\n /**\n * Validates Turnstile token format.\n */\n static validateTurnstileToken(token: string): { valid: boolean; error?: string } {\n if (!token || typeof token !== 'string') {\n return { valid: false, error: \"Turnstile token is required\" };\n }\n\n // Basic format validation for Cloudflare Turnstile tokens\n if (token.length < 50 || token.length > 2000) {\n return { valid: false, error: \"Invalid Turnstile token format\" };\n }\n\n // Check for basic token structure\n if (!/^[a-zA-Z0-9._-]+$/.test(token)) {\n return { valid: false, error: \"Invalid Turnstile token characters\" };\n }\n\n return { valid: true };\n }\n\n /**\n * Validates Turnstile token format (alias for validateTurnstileToken for compatibility).\n */\n static isValidTurnstileTokenFormat(token: string): boolean {\n return ValidationService.validateTurnstileToken(token).valid;\n }\n\n /**\n * Validates payment callback data format.\n */\n static isValidCallbackFormat(callbackData: any): boolean {\n if (!callbackData || typeof callbackData !== 'object') {\n return false;\n }\n\n const { merchantUniquePaymentId, status, validationCode } = callbackData;\n\n // Check required fields are present and have reasonable formats\n if (typeof merchantUniquePaymentId !== 'string' || merchantUniquePaymentId.length < 10) {\n return false;\n }\n\n if (typeof status !== 'string' || status.length === 0) {\n return false;\n }\n\n if (typeof validationCode !== 'string' || validationCode.length < 10) {\n return false;\n }\n\n // Additional validation can be added here for specific payment gateway formats\n return true;\n }\n\n /**\n * Sanitizes general input to prevent XSS and other attacks.\n */\n static sanitizeInput(input: any, maxLength: number = 1000): string {\n if (typeof input !== 'string') {\n return '';\n }\n\n // Truncate if too long\n let sanitized = input.substring(0, maxLength);\n\n // Remove dangerous characters and patterns\n sanitized = sanitized\n .replace(/)<[^<]*)*<\\/script>/gi, '')\n .replace(/<[^>]*>?/g, '') // Remove all HTML tags\n .replace(/javascript:/gi, '')\n .replace(/vbscript:/gi, '')\n .replace(/on\\w+\\s*=/gi, '') // Remove event handlers\n // deno-lint-ignore no-control-regex\n .replace(/[\\x00-\\x08\\x0B\\x0C\\x0E-\\x1F\\x7F]/g, '') // Remove control characters\n .trim();\n\n return sanitized;\n }\n}\n\n// ========================================\n// Export consolidated validation utilities\n// ========================================\n\nexport default {\n // Patterns\n NONCE_PATTERN,\n BOOKING_ID_PATTERN,\n TIMESTAMP_PATTERN,\n UUID_PATTERN,\n AMOUNT_PATTERN,\n\n // Schemas\n NonceSchema,\n BookingIdSchema,\n PaymentTimestampSchema,\n PaymentAmountSchema,\n UUIDSchema,\n IPAddressSchema,\n PaymentNonceRequestSchema,\n PaymentHashRequestSchema,\n\n // Functions\n extractAndValidateIP,\n isHoneypotTriggered,\n isValidOrigin,\n isValidReferer,\n isValidHost,\n isRequestTimestampValid,\n formatValidationErrors,\n validateRequestData,\n checkRequiredFields,\n isValidPaymentMode,\n hasNoDecimals,\n};\n",[],[170,589,651],{"_102":659,"_95":660,"_151":661,"_153":590,"_154":136,"_155":135,"_157":158,"_104":662,"_99":591,"_160":189,"_162":663,"_163":22,"_164":-5,"_165":664,"_98":665},"2e49a904-6056-11f0-bb4d-0224a6c84d84","zenpayFingerprintService.ts","a0120888-58a9-11f0-9f9f-f69ea79377d9",["D",1752458370843],"import sha3 from \"https://esm.sh/js-sha3@0.9.3\";\nimport { environment } from \"../config/environment.ts\";\nimport { logger } from \"../utils/logger.ts\";\n\nexport interface PaymentHashRequest {\n apikey: string;\n mode: number;\n paymentAmount: number;\n merchantUniquePaymentId: string;\n timestamp: string;\n}\n// export interface PaymentCredentialsResponse {\n// fingerprint: string;\n// paymentParams: {\n// url: string;\n// merchantCode: string;\n// apiKey: string;\n// redirectUrl: string;\n// mode: string;\n// displayMode: number;\n// customerName: string;\n// customerReference: string;\n// customerEmail: string;\n// customerPhone: string;\n// merchantUniquePaymentId: string;\n// paymentAmount: number;\n// timestamp: string;\n// };\n// }\nexport interface PaymentHashResponse {\n fingerprint: string;\n apiKey: string;\n mode: number;\n paymentAmount: number;\n merchantUniquePaymentId: string;\n timestamp: string;\n}\n\nexport class PaymentFingerprintService {\n static generatePaymentHash(request: PaymentHashRequest): PaymentHashResponse {\n // Get server-side credentials from environment\n const username = environment.ZP_USERNAME;\n const password = environment.ZP_PASSWORD;\n\n if (!username || !password) {\n throw new Error(\"Payment gateway credentials not configured\");\n }\n\n // Construct payload string for fingerprint generation\n // Format: apikey|username|password|mode|paymentAmount|merchantUniquePaymentId|timestamp\n const paymentAmountInCents = Math.round(request.paymentAmount * 100);\n const payload = [\n request.apikey,\n username,\n password,\n request.mode,\n paymentAmountInCents,\n request.merchantUniquePaymentId,\n request.timestamp,\n ].join(\"|\");\n\n // Generate SHA3-512 hash\n const fingerprint = sha3.sha3_512(payload);\n\n logger.info(\"Payment hash generated\", {\n apikey: request.apikey,\n username: username.slice(0, 3) + \"...\" + username.slice(-3),\n password: password.slice(0, 3) + \"...\" + password.slice(-3),\n mode: request.mode,\n merchantUniquePaymentId: request.merchantUniquePaymentId,\n paymentAmount: paymentAmountInCents,\n timestamp: request.timestamp,\n });\n\n return {\n fingerprint,\n apiKey: request.apikey,\n mode: request.mode,\n paymentAmount: request.paymentAmount,\n merchantUniquePaymentId: request.merchantUniquePaymentId,\n timestamp: request.timestamp,\n };\n }\n\n static validatePaymentRequest(request: any): {\n valid: boolean;\n errors: string[];\n } {\n const errors: string[] = [];\n\n // Validate apikey\n if (!request.apikey || typeof request.apikey !== \"string\") {\n errors.push(\"apikey is required and must be a string\");\n } else if (!/^[a-zA-Z0-9_-]+$/.test(request.apikey)) {\n errors.push(\"apikey contains invalid characters\");\n }\n\n // Validate mode\n if (!request.mode || typeof request.mode !== \"number\") {\n errors.push(\"mode is required and must be a number\");\n } else if (![0, 1, 2, 3].includes(request.mode)) {\n errors.push(\"mode must be one of: 0, 1, 2, 3\");\n }\n\n // Validate paymentAmount\n if (!request.paymentAmount || typeof request.paymentAmount !== \"number\") {\n errors.push(\"paymentAmount is required and must be a number\");\n } else {\n const amount = parseFloat(request.paymentAmount);\n if (amount <= 0 || amount > 999999.99) {\n errors.push(\"paymentAmount must be between 0.01 and 999999.99\");\n }\n }\n\n // Validate merchantUniquePaymentId (UUID format)\n if (\n !request.merchantUniquePaymentId ||\n typeof request.merchantUniquePaymentId !== \"string\"\n ) {\n errors.push(\"merchantUniquePaymentId is required and must be a string\");\n } else if (\n !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(\n request.merchantUniquePaymentId\n )\n ) {\n errors.push(\"merchantUniquePaymentId must be a valid UUID\");\n }\n\n // Validate timestamp\n if (!request.timestamp || typeof request.timestamp !== \"string\") {\n errors.push(\"timestamp is required and must be a string\");\n } else if (\n !/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$/.test(request.timestamp)\n ) {\n errors.push(\"timestamp must be in format: YYYY-MM-DDTHH:MM:SS\");\n } else {\n const timestampDate = new Date(request.timestamp); // Add Z for UTC\n const now = new Date();\n const diffMs = Math.abs(now.getTime() - timestampDate.getTime());\n const diffMinutes = diffMs / (1000 * 60);\n\n if (diffMinutes > 30) {\n errors.push(\n \"timestamp is too old or too far in the future (max 30 minutes difference)\"\n );\n }\n }\n\n return {\n valid: errors.length === 0,\n errors,\n };\n }\n\n static generateMerchantUniquePaymentId(): string {\n return \"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx\".replace(\n /[xy]/g,\n function (c) {\n const r = (Math.random() * 16) | 0;\n const v = c === \"x\" ? r : (r & 0x3) | 0x8;\n return v.toString(16);\n }\n );\n }\n\n static generateTimestamp(): string {\n const now = new Date();\n return now.toISOString().replace(/\\.\\d{3}Z$/, \"\");\n }\n}\n",[],[170,589,660],[170,589],{"_102":668,"_95":669,"_151":670,"_153":171,"_154":136,"_155":636,"_157":158,"_104":671,"_99":32,"_160":161,"_162":-5,"_163":22,"_164":-5,"_165":672,"_98":691},"9eec4eb4-58a9-11f0-9d42-f69ea79377d9","types","9eec4f86-58a9-11f0-9d42-f69ea79377d9",["D",1751614598742],[673,682],{"_102":674,"_95":675,"_151":676,"_153":670,"_154":136,"_155":677,"_157":158,"_104":678,"_99":32,"_160":189,"_162":679,"_163":22,"_164":-5,"_165":680,"_98":681},"493de274-5e6d-11f0-b4d7-0224a6c84d84","generated-types.ts","493de332-5e6d-11f0-b4d7-0224a6c84d84",584,["D",1752248392167],"/**\n * Auto-generated TypeScript types from OpenAPI specification\n * \n * DO NOT EDIT MANUALLY - This file is generated automatically\n * Run: deno run -A scripts/generate-types.ts\n * \n * Generated at: 2025-07-11T08:05:17.984Z\n */\n\nimport type { Context } from \"npm:hono\";\n\n// ========================================\n// Standard Error Types (only if not in OpenAPI)\n// ========================================\n\nexport interface BadRequestError {\n error: string;\n validation?: string[];\n}\n\nexport interface UnauthorizedError {\n error: string;\n message?: string;\n}\n\n// ========================================\n// Schema Types (from OpenAPI components)\n// ========================================\n\nexport interface Tour {\n /** Unique tour identifier */\n tourId: string;\n /** Tour display name */\n title: string;\n /** Tour name (legacy field for compatibility) */\n name?: string;\n /** Detailed tour description (legacy field) */\n description: string;\n /** Brief tour summary for listings */\n short_description?: string;\n /** Detailed tour description with full details */\n long_description?: string;\n /** Tour duration (e.g., '7 days / 6 nights') */\n duration: string;\n /** Available tour dates (legacy field) */\n datesAvailable: Array;\n /** Structured availability with status per date */\n availability?: Array

Key	Description
ZP_API_KEY
LOG_LEVEL
OPENAPI_LOCAL_PATH
IMAGES_BASE_URL
BASE_URL
API_LOG_FILE
ERROR_LOG_FILE
APP_LOG_FILE
OPENAPI_PUBLIC_URL
OPENAPI_BLOB_KEY
PORT
MASTER_KEY
SESSION_SECRET
ALLOWED_ORIGINS
DEBUG_MODE
TURNSTILE_SECRET_KEY
VALTOWN_TOKEN
WEBHOOK_SECRET
APP_ENV
ZP_PASSWORD
ZP_USERNAME
LOG_DIR

ianmenethil

ZenServer

Environment variables