{"_id":"@bonhomie/api-shield","_rev":"4-9f908f49e9e87925c734894575690237","name":"@bonhomie/api-shield","dist-tags":{"latest":"2.1.1"},"versions":{"1.0.0":{"name":"@bonhomie/api-shield","version":"1.0.0","keywords":["security","api-security","node-security","backend-security","express-security","api-hardening","csrf-protection","jwt-auth","xss-protection","sqli-detection","api-protection","rate-limiter","anti-replay","hmac","nonce","argon2","password-hashing","input-sanitization","sanitize-html","attack-detection","bot-detection","device-fingerprint","ddos-protection","ip-blocking","express-middleware","node-middleware","api-middleware","request-logger","http-logger","rbac","permissions","role-based-access","node-toolkit","api-toolkit","backend-toolkit","redis-cache","cache-wrapper","rate-limiting","cron-jobs","cron-helper","microservice-tools","api-helpers","node-utils","request-validation","session-security","payload-inspection","escape-html"],"author":{"name":"Bonhomie"},"license":"MIT","_id":"@bonhomie/api-shield@1.0.0","maintainers":[{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"}],"dist":{"shasum":"65034515845661b3b5e78fab4452e854cbe147a7","tarball":"https://registry.npmjs.org/@bonhomie/api-shield/-/api-shield-1.0.0.tgz","fileCount":3,"integrity":"sha512-XNZJWBuSk+KWhLSYkRpOJFuQPyqNnAX9SB3LWQ3+kjZT7HLUkAG2yMQRsQvte9WBE861JSRZPCDZ2Oeu4vT2kg==","signatures":[{"sig":"MEUCIA+dHBQVlpx5eZomG/ieL6d9yOxXnhR8SP/7QbC1gpdwAiEAxMuWGM3RHM275MRwrqYgVRZFwYWWB3IHtKPwSHh0oHc=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":38813},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"153b8d786c274903d2f3de65bcbf95d2405b78cf","scripts":{"dev":"tsup --watch","build":"tsup"},"_npmUser":{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"},"_npmVersion":"10.8.0","description":"A modern Node.js API utility toolkit: rate limiter, fingerprinting, validators, caching, logger, error handler, and cron helpers.","directories":{},"_nodeVersion":"22.20.0","dependencies":{"xss":"^1.0.15","cron":"^3.1.0","argon2":"^0.44.0","crypto":"^1.0.1","express":"^5.1.0","ioredis":"^5.3.2","typescript":"^5.9.3","jsonwebtoken":"^9.0.2","ua-parser-js":"^1.0.37","cookie-parser":"^1.4.7"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.1","@types/node":"^20.11.0"},"_npmOperationalInternal":{"tmp":"tmp/api-shield_1.0.0_1764473952637_0.15563765513063066","host":"s3://npm-registry-packages-npm-production"}},"1.1.0":{"name":"@bonhomie/api-shield","version":"1.1.0","keywords":["security","api-security","node-security","backend-security","express-security","api-hardening","csrf-protection","jwt-auth","xss-protection","sqli-detection","api-protection","rate-limiter","anti-replay","hmac","nonce","argon2","password-hashing","input-sanitization","sanitize-html","attack-detection","bot-detection","device-fingerprint","ddos-protection","ip-blocking","express-middleware","node-middleware","api-middleware","request-logger","http-logger","rbac","permissions","role-based-access","node-toolkit","api-toolkit","backend-toolkit","redis-cache","cache-wrapper","rate-limiting","cron-jobs","cron-helper","microservice-tools","api-helpers","node-utils","request-validation","session-security","payload-inspection","escape-html"],"author":{"name":"Bonhomie"},"license":"MIT","_id":"@bonhomie/api-shield@1.1.0","maintainers":[{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"}],"dist":{"shasum":"41fba3268f825eeb02749fca6c0a1a5f86e67f08","tarball":"https://registry.npmjs.org/@bonhomie/api-shield/-/api-shield-1.1.0.tgz","fileCount":3,"integrity":"sha512-NhK/T2v3iVTlkyadtexiRZnNuXCChhRjFBFT2I1FtrRZ68qp7YCZH/JG6D/+Vo1iHYxqz4Uq1xVX44Fe22H90Q==","signatures":[{"sig":"MEUCIQDC3/Zw90ucF3UysZkjW02awHsIsPDWs9LNOhldEn8yOAIgMPpZNuDYMlURIaeOHWuMA6ihy22ouchEulzl5vemeL8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":39355},"main":"dist/index.js","types":"dist/index.d.ts","gitHead":"042ee435be34ba171a4c73b832f7bbce4183f1f2","scripts":{"dev":"tsup --watch","build":"tsup"},"_npmUser":{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"},"_npmVersion":"10.8.0","description":"A modern Node.js API utility toolkit: rate limiter, fingerprinting, validators, caching, logger, error handler, and cron helpers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"xss":"^1.0.15","cron":"^3.1.0","argon2":"^0.44.0","express":"^5.1.0","ioredis":"^5.3.2","typescript":"^5.9.3","jsonwebtoken":"^9.0.2","ua-parser-js":"^1.0.37","cookie-parser":"^1.4.7"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.1","@types/node":"^20.11.0"},"_npmOperationalInternal":{"tmp":"tmp/api-shield_1.1.0_1773823019349_0.767783168174019","host":"s3://npm-registry-packages-npm-production"}},"2.1.0":{"name":"@bonhomie/api-shield","version":"2.1.0","keywords":["security","api-security","node-security","backend-security","express-security","csrf-protection","jwt-auth","xss-protection","sqli-detection","rate-limiter","anti-replay","hmac","argon2","password-hashing","input-sanitization","attack-detection","bot-detection","device-fingerprint","ddos-protection","ip-blocking","express-middleware","request-logger","rbac","permissions","role-based-access","redis-cache","cron-jobs","api-toolkit","backend-toolkit","node-utils","request-validation","session-security"],"author":{"name":"Bonhomie"},"license":"MIT","_id":"@bonhomie/api-shield@2.1.0","maintainers":[{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"}],"dist":{"shasum":"019e4ca66020064ee5472d6d57609ec4fa583f4c","tarball":"https://registry.npmjs.org/@bonhomie/api-shield/-/api-shield-2.1.0.tgz","fileCount":6,"integrity":"sha512-9cwQ8Z/djJyQ0VWpsrcYl4DTmMqBbHLsybAXQ8fuHN283cnyXkXyOR79035Q0/aWgxEJM9eR9st4hcPfRB5VaA==","signatures":[{"sig":"MEQCIB6uUrY6vPLDHe41S8dCNpq9gfmROkyk9qfHHB07BDBeAiBgjnsYH3dtxRbPWd3yJhcmSPV13w9UpVDwGHrkyQAvxA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":163812},"main":"dist/index.cjs","types":"dist/index.d.ts","module":"dist/index.js","exports":{".":{"import":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"dev":"tsup --watch","build":"tsup src/index.js --format esm,cjs --dts"},"_npmUser":{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"},"_npmVersion":"11.12.1","description":"A modern Node.js API utility toolkit: rate limiter, fingerprinting, validators, caching, logger, error handler, and cron helpers.","directories":{},"_nodeVersion":"24.15.0","dependencies":{"xss":"^1.0.15","cron":"^3.1.0","argon2":"^0.44.0","ioredis":"^5.3.2","jsonwebtoken":"^9.0.2","ua-parser-js":"^1.0.37","cookie-parser":"^1.4.7"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.1","express":"^5.1.0","typescript":"^5.9.3","@types/node":"^20.11.0"},"peerDependencies":{"express":">=4.0.0"},"peerDependenciesMeta":{"express":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/api-shield_2.1.0_1777495287087_0.010239781757453992","host":"s3://npm-registry-packages-npm-production"}},"2.1.1":{"name":"@bonhomie/api-shield","version":"2.1.1","description":"A modern Node.js API utility toolkit: rate limiter, fingerprinting, validators, caching, logger, error handler, and cron helpers.","main":"dist/index.cjs","module":"dist/index.js","types":"dist/index.d.ts","exports":{".":{"import":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"dev":"tsup --watch","build":"tsup src/index.js --format esm,cjs --dts"},"keywords":["security","api-security","node-security","backend-security","express-security","csrf-protection","jwt-auth","xss-protection","sqli-detection","rate-limiter","anti-replay","hmac","argon2","password-hashing","input-sanitization","attack-detection","bot-detection","device-fingerprint","ddos-protection","ip-blocking","express-middleware","request-logger","rbac","permissions","role-based-access","redis-cache","cron-jobs","api-toolkit","backend-toolkit","node-utils","request-validation","session-security"],"author":{"name":"Bonhomie"},"license":"MIT","peerDependencies":{"express":">=4.0.0"},"peerDependenciesMeta":{"express":{"optional":true}},"dependencies":{"argon2":"^0.44.0","cookie-parser":"^1.4.7","cron":"^3.1.0","ioredis":"^5.3.2","jsonwebtoken":"^9.0.2","ua-parser-js":"^1.0.37","xss":"^1.0.15"},"devDependencies":{"@types/node":"^20.11.0","express":"^5.1.0","tsup":"^8.0.1","typescript":"^5.9.3"},"gitHead":"365c56c38bbb317da0f10875972d0771afd5dfa2","_id":"@bonhomie/api-shield@2.1.1","_nodeVersion":"24.15.0","_npmVersion":"11.12.1","dist":{"integrity":"sha512-E2gOTfygWoFLwdy61MgeoFucTYVlt9ANRwESqHsHVVEb53zBbTFRcXM4jwNxF9DFhyYoCdgfM8ZBS9Nq97WXTg==","shasum":"b31a707ac4573fa784d360e4960d7e92bcbe7d6d","tarball":"https://registry.npmjs.org/@bonhomie/api-shield/-/api-shield-2.1.1.tgz","fileCount":6,"unpackedSize":166110,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQD3bSJW8u/K3cWnntZH2t0IjIL1WABe2By1FCJB9vJQYwIgKD1aj0vMpeaBL8NFQoO0pmJZs21Vw8wAiH1zD51ZXb0="}]},"_npmUser":{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"},"directories":{},"maintainers":[{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/api-shield_2.1.1_1777498352032_0.39212519603602547"},"_hasShrinkwrap":false}},"time":{"created":"2025-11-30T03:39:12.553Z","modified":"2026-04-29T21:32:32.299Z","1.0.0":"2025-11-30T03:39:12.835Z","1.1.0":"2026-03-18T08:36:59.474Z","2.1.0":"2026-04-29T20:41:27.233Z","2.1.1":"2026-04-29T21:32:32.176Z"},"author":{"name":"Bonhomie"},"license":"MIT","keywords":["security","api-security","node-security","backend-security","express-security","csrf-protection","jwt-auth","xss-protection","sqli-detection","rate-limiter","anti-replay","hmac","argon2","password-hashing","input-sanitization","attack-detection","bot-detection","device-fingerprint","ddos-protection","ip-blocking","express-middleware","request-logger","rbac","permissions","role-based-access","redis-cache","cron-jobs","api-toolkit","backend-toolkit","node-utils","request-validation","session-security"],"description":"A modern Node.js API utility toolkit: rate limiter, fingerprinting, validators, caching, logger, error handler, and cron helpers.","maintainers":[{"name":"bonhomie95","email":"adeyemibabatundejoseph@gmail.com"}],"readme":"# 🛡️ @bonhomie/api-shield\r\n\r\n### **The Ultimate Security & Utility Toolkit for Node.js APIs**\r\n\r\n**Rate limiting, fingerprinting, CSRF, JWT, bot detection, RBAC, sanitization, attack detection, caching, cron helpers & more.**\r\n\r\n[![npm version](https://img.shields.io/npm/v/@bonhomie/api-shield.svg?color=blue)](https://www.npmjs.com/package/@bonhomie/api-shield)\r\n[![npm downloads](https://img.shields.io/npm/dm/@bonhomie/api-shield.svg?color=brightgreen)](https://www.npmjs.com/package/@bonhomie/api-shield)\r\n![node-current](https://img.shields.io/node/v/@bonhomie/api-shield)\r\n![license](https://img.shields.io/badge/license-MIT-green)\r\n![security](https://img.shields.io/badge/security-hardened-critical)\r\n\r\n---\r\n\r\n## 🚀 Why API Shield?\r\n\r\n`@bonhomie/api-shield` is an **all-in-one backend security and utility layer** designed for **Express, Fastify, or any Node.js API**.\r\n\r\nIt provides:\r\n\r\n* 🔐 **JWT auth** (sign, verify, attach user, roles)\r\n* 🛡 **CSRF protection** (double-submit cookie)\r\n* 🧪 **Input validation + sanitization**\r\n* ⚔️ **SQLi/XSS/path-traversal detection**\r\n* 🕵️ **Bot detection + device fingerprinting**\r\n* 🚦 **Rate limiting (memory & Redis)**\r\n* 🔄 **Cache wrapper (Redis + in-memory)**\r\n* 🧰 **Password hashing (argon2)**\r\n* 🕹 **RBAC (roles + permissions)**\r\n* 📅 **Cron helpers**\r\n* 📦 **Response formatters (success, fail, paginate)**\r\n* 🌐 **HMAC, nonce, and anti-replay tokens**\r\n\r\nEverything packaged cleanly and production-ready.\r\n\r\n---\r\n\r\n# 📦 Installation\r\n\r\n```bash\r\nnpm install @bonhomie/api-shield\r\n```\r\n\r\nRequires Node 18+.\r\n\r\n---\r\n\r\n# ⚡ Quick Start (Express)\r\n\r\n```js\r\nimport express from \"express\";\r\nimport cookieParser from \"cookie-parser\";\r\nimport {\r\n  requestLogger,\r\n  attackGuard,\r\n  sanitizeRequest,\r\n  csrfCookie,\r\n  csrfProtect,\r\n  createRateLimiter,\r\n  requireAuth,\r\n} from \"@bonhomie/api-shield\";\r\n\r\nconst app = express();\r\napp.use(express.json());\r\napp.use(cookieParser());\r\n\r\n// Global protections\r\napp.use(requestLogger());\r\napp.use(attackGuard({ block: true }));\r\napp.use(sanitizeRequest());\r\napp.use(csrfCookie());\r\n\r\n// Rate limiter\r\nconst limiter = createRateLimiter({ limit: 100, windowMs: 60000 });\r\napp.use(limiter);\r\n\r\n// Protected route\r\napp.post(\"/update-profile\",\r\n  csrfProtect(),\r\n  requireAuth({ secret: process.env.JWT_SECRET }),\r\n  (req, res) => {\r\n    res.success({ message: \"Profile updated\" });\r\n  }\r\n);\r\n\r\napp.listen(3000);\r\n```\r\n\r\n---\r\n\r\n# 🔐 JWT Utilities\r\n\r\n```js\r\nimport { signJwt, requireAuth } from \"@bonhomie/api-shield\";\r\n\r\nconst token = signJwt(\r\n  { id: user._id, role: \"admin\" },\r\n  { secret: process.env.JWT_SECRET, expiresIn: \"15m\" }\r\n);\r\n\r\napp.get(\"/admin\",\r\n  requireAuth({\r\n    secret: process.env.JWT_SECRET,\r\n    roles: [\"admin\"]\r\n  }),\r\n  (req, res) => res.success(\"Welcome Admin\")\r\n);\r\n```\r\n\r\n---\r\n\r\n# 🛡 CSRF Protection (double-submit cookie)\r\n\r\n```js\r\nimport { csrfCookie, csrfProtect } from \"@bonhomie/api-shield\";\r\n\r\napp.use(csrfCookie());\r\n\r\napp.post(\"/form\",\r\n  csrfProtect(),\r\n  (req, res) => res.success(\"Submitted\")\r\n);\r\n```\r\n\r\nFrontend must include the CSRF token:\r\n\r\n```\r\nHeader: x-csrf-token: <token_from_cookie>\r\n```\r\n\r\n---\r\n\r\n# 🔐 Password Hashing (argon2)\r\n\r\n```js\r\nimport { hashPassword, verifyPassword } from \"@bonhomie/api-shield\";\r\n\r\nconst hash = await hashPassword(\"password123\");\r\nconst ok = await verifyPassword(\"password123\", hash);\r\n```\r\n\r\n---\r\n\r\n# ⚙ Input Sanitization\r\n\r\n```js\r\nimport { sanitizeRequest } from \"@bonhomie/api-shield\";\r\n\r\napp.use(sanitizeRequest());\r\n```\r\n\r\nCleans `req.body`, `req.query`, and `req.params` from XSS.\r\n\r\n---\r\n\r\n# ⚔ SQLi / XSS Attack Detection\r\n\r\n```js\r\nimport { attackGuard } from \"@bonhomie/api-shield\";\r\n\r\napp.use(attackGuard({ block: true }));\r\n```\r\n\r\nAutomatically blocks dangerous payloads.\r\n\r\n---\r\n\r\n# 🕵️ Bot Detection + Device Fingerprinting\r\n\r\n```js\r\nimport { botGuard, fingerprintV2 } from \"@bonhomie/api-shield\";\r\n\r\napp.use(botGuard({ block: false }));\r\n```\r\n\r\nDetects:\r\n\r\n* Bad user-agent patterns\r\n* Scripted bots\r\n* Headless browsers\r\n\r\nFingerprint v2 uses:\r\n\r\n* IP\r\n* User-Agent\r\n* Accept-Language\r\n* Screen/device hints\r\n\r\n---\r\n\r\n# 🚦 Rate Limiting (Memory or Redis)\r\n\r\n```js\r\nimport { createRateLimiter } from \"@bonhomie/api-shield\";\r\n\r\nconst limiter = createRateLimiter({\r\n  limit: 100,\r\n  windowMs: 60000\r\n});\r\n\r\napp.use(limiter);\r\n```\r\n\r\nRedis version:\r\n\r\n```js\r\ncreateRateLimiter({ redis, limit: 100, windowMs: 60000 });\r\n```\r\n\r\n---\r\n\r\n# 🧰 Response Formatters\r\n\r\n```js\r\nimport { success, fail, paginate } from \"@bonhomie/api-shield\";\r\n\r\nres.json(success({ name: \"Bonhomie\" }));\r\nres.json(fail(\"Unauthorized\", 401));\r\nres.json(paginate(items, { page: 1, perPage: 10, total: 200 }));\r\n```\r\n\r\nOr attach directly:\r\n\r\n```js\r\nimport { responseFormatter } from \"@bonhomie/api-shield\";\r\n\r\napp.use(responseFormatter());\r\n\r\nres.success({ msg: \"OK\" });\r\nres.fail(\"Oops\");\r\n```\r\n\r\n---\r\n\r\n# 🔄 Cache Wrapper (Redis or Memory)\r\n\r\n```js\r\nimport { cache } from \"@bonhomie/api-shield\";\r\n\r\nawait cache.set(\"profile:123\", { name: \"Bonhomie\" }, 60000);\r\nconst data = await cache.get(\"profile:123\");\r\n```\r\n\r\nWorks with Redis or in-memory fallback.\r\n\r\n---\r\n\r\n# 🔧 Cron Helpers\r\n\r\n```js\r\nimport { cronEvery, cronAt } from \"@bonhomie/api-shield\";\r\n\r\ncronEvery(\"5m\", () => console.log(\"runs every 5 minutes\"));\r\ncronAt(\"0 0 * * *\", () => console.log(\"midnight job\"));\r\n```\r\n\r\n---\r\n\r\n# 🛂 RBAC (Roles & Permissions)\r\n\r\n```js\r\nimport { requireRole, requirePermission } from \"@bonhomie/api-shield\";\r\n\r\napp.get(\"/admin\",\r\n  requireRole([\"admin\"]),\r\n  (req, res) => res.success(\"Admin Panel\")\r\n);\r\n\r\napp.post(\"/edit\",\r\n  requirePermission(\"edit:content\"),\r\n  (req, res) => res.success(\"Updated\")\r\n);\r\n```\r\n\r\n---\r\n\r\n# 🧬 Replay Protection + HMAC + Nonce\r\n\r\n```js\r\nimport {\r\n  createReplayToken,\r\n  createHmac,\r\n  verifyHmac,\r\n  generateNonce\r\n} from \"@bonhomie/api-shield\";\r\n\r\nconst token = createReplayToken();\r\nconst nonce = generateNonce();\r\nconst signature = createHmac(secret, payload);\r\n```\r\n\r\n---\r\n\r\n# 🛠 Developer-Friendly Features\r\n\r\n* Zero configuration needed\r\n* ESM-first\r\n* Works in Express, Fastify, NestJS, or raw Node\r\n* Lightweight single-file build\r\n* Safe defaults\r\n* Production security baked in\r\n\r\n---\r\n\r\n# 🔍 SEO Keywords\r\n\r\n> (This helps your npm ranking)\r\n\r\n```\r\nnode api security, csrf token express, node jwt middleware, express rate limiter,\r\nnode sanitizer, api shield, bot detection node, argon2 password hashing,\r\nnodejs validation, node hmac, express anti replay, security middleware node,\r\nxss sqli detection node, rbac nodejs, redis caching node\r\n```\r\n\r\n---\r\n# 📄 License\r\n\r\nMIT © Bonhomie\r\n---\r\n\r\n# ❤️ Contribute\r\nPull requests welcome.\r\nSecurity suggestions extra welcome.","readmeFilename":"README.md"}