EmployeeManagementSystem/backend-deno/middleware/security.ts

import { Context, Next } from "@oak/oak";
import { config } from "../config/env.ts";

// Rate limiting store (in-memory, use Redis in production)
const rateLimitStore = new Map<string, { count: number; resetTime: number }>();

// Rate limiting middleware
export async function rateLimit(ctx: Context, next: Next): Promise<void> {
  const ip = ctx.request.ip || "unknown";
  const now = Date.now();
  const windowMs = config.RATE_LIMIT_WINDOW_MS;
  const maxRequests = config.RATE_LIMIT_MAX_REQUESTS;

  const record = rateLimitStore.get(ip);

  if (!record || now > record.resetTime) {
    rateLimitStore.set(ip, { count: 1, resetTime: now + windowMs });
  } else {
    record.count++;

    if (record.count > maxRequests) {
      ctx.response.status = 429;
      ctx.response.body = {
        error: "Too many requests",
        retryAfter: Math.ceil((record.resetTime - now) / 1000),
      };
      return;
    }
  }

  await next();
}

// Security headers middleware
export async function securityHeaders(ctx: Context, next: Next): Promise<void> {
  await next();

  // Prevent clickjacking
  ctx.response.headers.set("X-Frame-Options", "DENY");

  // Prevent MIME type sniffing
  ctx.response.headers.set("X-Content-Type-Options", "nosniff");

  // XSS protection
  ctx.response.headers.set("X-XSS-Protection", "1; mode=block");

  // Referrer policy
  ctx.response.headers.set(
    "Referrer-Policy",
    "strict-origin-when-cross-origin",
  );

  // Content Security Policy
  ctx.response.headers.set(
    "Content-Security-Policy",
    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';",
  );

  // Strict Transport Security (only in production with HTTPS)
  if (config.isProduction()) {
    ctx.response.headers.set(
      "Strict-Transport-Security",
      "max-age=31536000; includeSubDomains",
    );
  }
}

// CORS middleware
export async function cors(ctx: Context, next: Next): Promise<void> {
  const origin = ctx.request.headers.get("Origin");
  const allowedOrigins = config.CORS_ORIGIN.split(",").map((o) => o.trim());

  // Check if origin is allowed
  if (
    origin && (allowedOrigins.includes(origin) || allowedOrigins.includes("*"))
  ) {
    ctx.response.headers.set("Access-Control-Allow-Origin", origin);
  } else if (config.isDevelopment()) {
    // Allow all origins in development
    ctx.response.headers.set("Access-Control-Allow-Origin", origin || "*");
  }

  ctx.response.headers.set(
    "Access-Control-Allow-Methods",
    "GET, POST, PUT, DELETE, OPTIONS",
  );
  ctx.response.headers.set(
    "Access-Control-Allow-Headers",
    "Content-Type, Authorization",
  );
  ctx.response.headers.set("Access-Control-Allow-Credentials", "true");
  ctx.response.headers.set("Access-Control-Max-Age", "86400");

  // Handle preflight requests
  if (ctx.request.method === "OPTIONS") {
    ctx.response.status = 204;
    return;
  }

  await next();
}

// Request logging middleware
export async function requestLogger(ctx: Context, next: Next): Promise<void> {
  const start = Date.now();
  const { method, url } = ctx.request;

  await next();

  const ms = Date.now() - start;
  const status = ctx.response.status;

  // Color code based on status
  let statusColor = "\x1b[32m"; // Green for 2xx
  if (status >= 400 && status < 500) statusColor = "\x1b[33m"; // Yellow for 4xx
  if (status >= 500) statusColor = "\x1b[31m"; // Red for 5xx

  console.log(
    `${
      new Date().toISOString()
    } - ${method} ${url.pathname} ${statusColor}${status}\x1b[0m ${ms}ms`,
  );
}

// Input sanitization helper
export function sanitizeInput(input: string): string {
  return input
    .replace(/[<>]/g, "") // Remove angle brackets
    .replace(/javascript:/gi, "") // Remove javascript: protocol
    .replace(/on\w+=/gi, "") // Remove event handlers
    .trim();
}

// Validate email format
export function isValidEmail(email: string): boolean {
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return emailRegex.test(email);
}

// Validate password strength
export function isStrongPassword(
  password: string,
): { valid: boolean; message?: string } {
  if (password.length < 8) {
    return {
      valid: false,
      message: "Password must be at least 8 characters long",
    };
  }
  if (!/[A-Z]/.test(password)) {
    return {
      valid: false,
      message: "Password must contain at least one uppercase letter",
    };
  }
  if (!/[a-z]/.test(password)) {
    return {
      valid: false,
      message: "Password must contain at least one lowercase letter",
    };
  }
  if (!/[0-9]/.test(password)) {
    return {
      valid: false,
      message: "Password must contain at least one number",
    };
  }
  return { valid: true };
}

// Clean up old rate limit entries periodically
setInterval(() => {
  const now = Date.now();
  for (const [ip, record] of rateLimitStore.entries()) {
    if (now > record.resetTime) {
      rateLimitStore.delete(ip);
    }
  }
}, 60000); // Clean up every minute