@3wks/gae-node-nestjs/dist/auth/csrf.interceptor.js

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const uuidv4 = require("uuid/v4");
const generateToken = () => (process.env.APP_ENGINE_ENVIRONMENT ? uuidv4() : 'development');
const defaultValidatorOptions = {
    sameSite: true,
};
exports.CsrfValidator = (req, res, next, options) => {
    options = Object.assign({}, defaultValidatorOptions, options);
    if (req.session && !req.session.csrf) {
        req.session.csrf = generateToken();
        res.cookie('csrf-token', req.session.csrf, {
            sameSite: options.sameSite,
            maxAge: 9999999999,
        });
    }
    if (req.method === 'GET' || req.method === 'OPTIONS' || req.method === 'HEAD') {
        return next();
    }
    if (req.headers && req.session) {
        const token = req.headers['x-csrf-token'];
        if (token && token === req.session.csrf) {
            return next();
        }
    }
    res.status(403).send({
        message: 'Invalid CSRF token',
    });
};
exports.CsrfValidatorWithOptions = (options) => {
    return (req, res, next) => {
        return exports.CsrfValidator(req, res, next, options);
    };
};
//# sourceMappingURL=csrf.interceptor.js.map