(Feat): Initial Commit

backend-deno/middleware/security.ts

@@ -0,0 +1,152 @@
+import { Context, Next } from "@oak/oak";
+import { config } from "../config/env.ts";
+
+// Rate limiting store (in-memory, use Redis in production)
+const rateLimitStore = new Map<string, { count: number; resetTime: number }>();
+
+// Rate limiting middleware
+export async function rateLimit(ctx: Context, next: Next): Promise<void> {
+  const ip = ctx.request.ip || "unknown";
+  const now = Date.now();
+  const windowMs = config.RATE_LIMIT_WINDOW_MS;
+  const maxRequests = config.RATE_LIMIT_MAX_REQUESTS;
+  
+  const record = rateLimitStore.get(ip);
+  
+  if (!record || now > record.resetTime) {
+    rateLimitStore.set(ip, { count: 1, resetTime: now + windowMs });
+  } else {
+    record.count++;
+    
+    if (record.count > maxRequests) {
+      ctx.response.status = 429;
+      ctx.response.body = { 
+        error: "Too many requests",
+        retryAfter: Math.ceil((record.resetTime - now) / 1000)
+      };
+      return;
+    }
+  }
+  
+  await next();
+}
+
+// Security headers middleware
+export async function securityHeaders(ctx: Context, next: Next): Promise<void> {
+  await next();
+  
+  // Prevent clickjacking
+  ctx.response.headers.set("X-Frame-Options", "DENY");
+  
+  // Prevent MIME type sniffing
+  ctx.response.headers.set("X-Content-Type-Options", "nosniff");
+  
+  // XSS protection
+  ctx.response.headers.set("X-XSS-Protection", "1; mode=block");
+  
+  // Referrer policy
+  ctx.response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+  
+  // Content Security Policy
+  ctx.response.headers.set(
+    "Content-Security-Policy",
+    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
+  );
+  
+  // Strict Transport Security (only in production with HTTPS)
+  if (config.isProduction()) {
+    ctx.response.headers.set(
+      "Strict-Transport-Security",
+      "max-age=31536000; includeSubDomains"
+    );
+  }
+}
+
+// CORS middleware
+export async function cors(ctx: Context, next: Next): Promise<void> {
+  const origin = ctx.request.headers.get("Origin");
+  const allowedOrigins = config.CORS_ORIGIN.split(",").map(o => o.trim());
+  
+  // Check if origin is allowed
+  if (origin && (allowedOrigins.includes(origin) || allowedOrigins.includes("*"))) {
+    ctx.response.headers.set("Access-Control-Allow-Origin", origin);
+  } else if (config.isDevelopment()) {
+    // Allow all origins in development
+    ctx.response.headers.set("Access-Control-Allow-Origin", origin || "*");
+  }
+  
+  ctx.response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+  ctx.response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization");
+  ctx.response.headers.set("Access-Control-Allow-Credentials", "true");
+  ctx.response.headers.set("Access-Control-Max-Age", "86400");
+  
+  // Handle preflight requests
+  if (ctx.request.method === "OPTIONS") {
+    ctx.response.status = 204;
+    return;
+  }
+  
+  await next();
+}
+
+// Request logging middleware
+export async function requestLogger(ctx: Context, next: Next): Promise<void> {
+  const start = Date.now();
+  const { method, url } = ctx.request;
+  
+  await next();
+  
+  const ms = Date.now() - start;
+  const status = ctx.response.status;
+  
+  // Color code based on status
+  let statusColor = "\x1b[32m"; // Green for 2xx
+  if (status >= 400 && status < 500) statusColor = "\x1b[33m"; // Yellow for 4xx
+  if (status >= 500) statusColor = "\x1b[31m"; // Red for 5xx
+  
+  console.log(
+    `${new Date().toISOString()} - ${method} ${url.pathname} ${statusColor}${status}\x1b[0m ${ms}ms`
+  );
+}
+
+// Input sanitization helper
+export function sanitizeInput(input: string): string {
+  return input
+    .replace(/[<>]/g, "") // Remove angle brackets
+    .replace(/javascript:/gi, "") // Remove javascript: protocol
+    .replace(/on\w+=/gi, "") // Remove event handlers
+    .trim();
+}
+
+// Validate email format
+export function isValidEmail(email: string): boolean {
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  return emailRegex.test(email);
+}
+
+// Validate password strength
+export function isStrongPassword(password: string): { valid: boolean; message?: string } {
+  if (password.length < 8) {
+    return { valid: false, message: "Password must be at least 8 characters long" };
+  }
+  if (!/[A-Z]/.test(password)) {
+    return { valid: false, message: "Password must contain at least one uppercase letter" };
+  }
+  if (!/[a-z]/.test(password)) {
+    return { valid: false, message: "Password must contain at least one lowercase letter" };
+  }
+  if (!/[0-9]/.test(password)) {
+    return { valid: false, message: "Password must contain at least one number" };
+  }
+  return { valid: true };
+}
+
+// Clean up old rate limit entries periodically
+setInterval(() => {
+  const now = Date.now();
+  for (const [ip, record] of rateLimitStore.entries()) {
+    if (now > record.resetTime) {
+      rateLimitStore.delete(ip);
+    }
+  }
+}, 60000); // Clean up every minute