feat: support cjs and esm both by tshy

.eslintignore

@@ -1,5 +1,2 @@
 test/fixtures
-test/benchmark
 coverage
-node_modules
-lib/plugins/**/app/proxy

.eslintrc

@@ -1,6 +1,6 @@
 {
   "extends": [
-    "eslint-config-egg",
+    "eslint-config-egg/typescript",
     "eslint-config-egg/lib/rules/enforce-node-prefix"
   ]
 }

.github/workflows/nodejs.yml

@@ -11,7 +11,6 @@ jobs:
     name: Node.js
     uses: node-modules/github-actions/.github/workflows/node-test.yml@master
     with:
-      os: 'ubuntu-latest, macos-latest, windows-latest'
-      version: '14.20.0, 14, 16, 18, 20, 22'
+      version: '18.19.0, 20, 22'
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.gitignore

@@ -1,11 +1,11 @@
-node_modules
-coverage
-test/**/logs
-_book
-.DS_Store
+logs/
 npm-debug.log
-run/
-.vscode
+node_modules/
+coverage/
+test/fixtures/**/run
+.DS_Store
+.tshy*
+.eslintcache
+dist
 package-lock.json
-.travis.yml
-.idea
+.package-lock.json

package.json

@@ -1,73 +1,111 @@
 {
-  "name": "egg-security",
+  "name": "@eggjs/security",
   "version": "3.7.0",
-  "engines": {
-    "node": ">=14.20.0"
+  "publishConfig": {
+    "access": "public"
   },
   "description": "security plugin in egg framework",
   "eggPlugin": {
     "name": "security",
     "optionalDependencies": [
       "session"
-    ]
+    ],
+    "exports": {
+      "import": "./dist/esm",
+      "require": "./dist/commonjs",
+      "typescript": "./src"
+    }
   },
   "keywords": [
     "egg",
     "eggPlugin",
     "egg-plugin",
     "security"
   ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eggjs/security.git"
+  },
+  "bugs": {
+    "url": "https://github.com/eggjs/egg/issues"
+  },
+  "homepage": "https://github.com/eggjs/security#readme",
+  "author": "jtyjty99999",
+  "license": "MIT",
+  "engines": {
+    "node": ">= 18.19.0"
+  },
   "dependencies": {
-    "@eggjs/ip": "^2.0.2",
+    "@eggjs/core": "^6.2.13",
+    "@eggjs/ip": "^2.1.0",
     "csrf": "^3.0.6",
-    "delegates": "^1.0.0",
     "egg-path-matching": "^1.0.0",
     "escape-html": "^1.0.3",
     "extend": "^3.0.1",
+    "extend2": "^4.0.0",
     "koa-compose": "^4.1.0",
     "matcher": "^4.0.0",
     "methods": "^1.1.2",
-    "nanoid": "^3.3.6",
-    "platform": "^1.3.4",
+    "nanoid": "^3.3.8",
     "statuses": "^2.0.1",
     "type-is": "^1.6.15",
     "xss": "^1.0.3"
   },
   "devDependencies": {
+    "@arethetypeswrong/cli": "^0.17.1",
+    "@eggjs/bin": "7",
+    "@eggjs/mock": "^6.0.5",
+    "@eggjs/tsconfig": "1",
+    "@types/koa-compose": "^3.2.8",
+    "@types/mocha": "10",
+    "@types/node": "22",
     "beautify-benchmark": "^0.2.4",
     "benchmark": "^2.1.4",
-    "egg": "^3.26.0",
-    "egg-bin": "^6.4.0",
-    "egg-mock": "^5.10.6",
+    "egg": "^4.0.1",
     "egg-view-nunjucks": "^2.3.0",
-    "eslint": "^8.40.0",
-    "eslint-config-egg": "^12.2.1",
+    "eslint": "8",
+    "eslint-config-egg": "14",
+    "rimraf": "6",
     "spy": "^1.0.0",
-    "supertest": "^6.3.3"
+    "supertest": "^6.3.3",
+    "tshy": "3",
+    "tshy-after": "1",
+    "typescript": "5"
   },
   "scripts": {
-    "lint": "eslint .",
-    "test": "npm run lint -- --fix && npm run test-local",
-    "test-local": "egg-bin test",
-    "cov": "egg-bin cov",
-    "ci": "npm run lint && npm run cov"
+    "lint": "eslint --cache src test --ext .ts",
+    "pretest": "npm run clean && npm run lint -- --fix",
+    "test": "egg-bin test",
+    "preci": "npm run clean &&  npm run lint",
+    "ci": "egg-bin cov",
+    "postci": "npm run prepublishOnly && npm run clean",
+    "clean": "rimraf dist",
+    "prepublishOnly": "tshy && tshy-after && attw --pack"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/eggjs/security.git"
+  "type": "module",
+  "tshy": {
+    "exports": {
+      ".": "./src/index.ts",
+      "./package.json": "./package.json"
+    }
+  },
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/commonjs/index.d.ts",
+        "default": "./dist/commonjs/index.js"
+      }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
-    "agent.js",
-    "app",
-    "lib",
-    "config",
-    "app.js",
-    "index.js"
+    "dist",
+    "src"
   ],
-  "bugs": {
-    "url": "https://github.com/eggjs/egg/issues"
-  },
-  "homepage": "https://github.com/eggjs/security#readme",
-  "author": "jtyjty99999",
-  "license": "MIT"
+  "types": "./dist/commonjs/index.d.ts",
+  "main": "./dist/commonjs/index.js"
 }

src/agent.ts

@@ -0,0 +1,14 @@
+import type { ILifecycleBoot, EggCore } from '@eggjs/core';
+import { preprocessConfig } from './lib/utils.js';
+
+export class AgentBoot implements ILifecycleBoot {
+  private readonly agent;
+
+  constructor(agent: EggCore) {
+    this.agent = agent;
+  }
+
+  async configWillLoad() {
+    preprocessConfig(this.agent.config.security);
+  }
+}

src/app.ts

@@ -0,0 +1,29 @@
+import assert from 'node:assert';
+import type { ILifecycleBoot, EggCore } from '@eggjs/core';
+import { preprocessConfig } from './lib/utils.js';
+
+export class AgentBoot implements ILifecycleBoot {
+  private readonly app;
+
+  constructor(app: EggCore) {
+    this.app = app;
+  }
+
+  async configWillLoad() {
+    const app = this.app;
+    app.config.coreMiddleware.push('securities');
+
+    if (app.config.security.csrf && app.config.security.csrf.enable) {
+      const { ignoreJSON, type } = app.config.security.csrf;
+      if (ignoreJSON) {
+        app.deprecate('[@eggjs/security/app] `app.config.security.csrf.ignoreJSON` is not safe now, please disable it.');
+      }
+
+      const legalTypes = [ 'all', 'referer', 'ctoken', 'any' ];
+      assert(legalTypes.includes(type),
+        '[@eggjs/security/ap] `config.security.csrf.type` must be one of ' + legalTypes.join(', '));
+    }
+
+    preprocessConfig(app.config.security);
+  }
+}

src/app/extend/agent.ts

@@ -0,0 +1,6 @@
+import { EggCore } from '@eggjs/core';
+import { safeCurlForApplication } from '../../lib/extend/safe_curl.js';
+
+export default class SecurityAgent extends EggCore {
+  safeCurl = safeCurlForApplication;
+}