@harsh23-field-validation/core

Fast, security-first field validators with ES Modules. Includes authorization gating via access key and a 5-stage validation pipeline: type/presence → normalize → length/range → pattern/charset → threat checks.

Install (local workspace)

If used locally alongside your app:

# package.json of your app
"dependencies": {
  "@harsh23-field-validation/core": "file:../harsh23-field-validation"
}

Then:

npm install

When publishing to npm, use public access if you don’t want a paid plan.

Authorization

All validators require a key call before use:

import { setAccessKey } from '@harsh23-field-validation/core';
setAccessKey('YOUR_SECRET_KEY');

This compares a SHA-256 of your key with the embedded hash.

Quick start

import {
  setAccessKey,
  validateRequiredThen,
  validateNotEmpty,
  validateText,
  validateNumber,
  validateEmail,
  validatePassword,
  validateURL,
  validateIP,
  validateUUID,
  validateSlug,
} from '@harsh23-field-validation/core';

setAccessKey('YOUR_SECRET_KEY');

// Required first, then specific kind
await validateRequiredThen('email', '[email protected]', { checkMx: true });

// Text
validateText('Alpha_123', { pattern: /^[A-Za-z0-9_]+$/, minLength: 2, maxLength: 32 });

// Number (numeric)
validateNumber('42', { mode: 'numeric', min: 1, max: 100, integer: true });

// Number (phone) with country rule
validateNumber('9876543210', { mode: 'phone', country: 'IN' });

// Email (domain allowlist + MX)
await validateEmail('[email protected]', {
  allowedDomains: ['company.com'],
  checkMx: true,
});

// Password (strong defaults)
validatePassword('Str0ng!Pass', { minLength: 8, requireSymbol: true });

// URL (https only by default)
validateURL('https://example.com/path?q=1', { allowedSchemes: ['https'] });

// IP (v4 or v6)
validateIP('192.168.0.1', { version: 'v4' });

// UUID
validateUUID('550e8400-e29b-41d4-a716-446655440000', { version: 'v4' });

// Slug
validateSlug('my-blog-post-1');

API

Each validator returns an object: { ok: boolean, message: string|null, value?: any }.

validateRequiredThen(kind, value, opts)

• Runs validateNotEmpty first, then one of: number | email | text.

validateNotEmpty(value, { trim=true })

• Ensures presence after trim and basic sanitization.

validateText(value, options)

• Options: { trim=true, minLength=1, maxLength=2048, allowed=/[\p{L}\p{N}\s\p{P}\p{S}]/u, pattern? }
• Threat detection and regex safety checks included.

validateNumber(value, options)

• Numeric mode: { mode:'numeric', min, max, integer }
• Phone mode: { mode:'phone', country?, allowSeparators=true }
  • Country rules available: IN, US, GB. Generic E.164 check if not provided.

validateEmail(value, options)

• Options: { trim=true, maxLength=320, pattern=/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9\-]+(\.[a-zA-Z0-9\-]+)+$/, allowedDomains?, blockedDomains?, allowDisposable=false, checkMx=false }
• Performs regex safety check, domain allow/block, disposable block, optional MX query.

validatePassword(value, options)

• Options: { trim=true, minLength=8, maxLength=128, requireUpper=true, requireLower=true, requireDigit=true, requireSymbol=true, allowSpaces=false, blockCommon=true, pattern? }

validateURL(value, options)

• Options: { trim=true, maxLength=2048, allowedSchemes=['https'], requireHostname=true, allowPrivateIP=false }
• Uses new URL() parsing; basic host sanitization.

validateIP(value, options)

• Options: { version:'both'|'v4'|'v6' }.

validateUUID(value, options)

• Options: { version:'any'|'v1'|'v4'|'v7' }.

validateSlug(value, options)

• Options: { trim=true, minLength=1, maxLength=100 }, pattern ^[a-z0-9]+(?:-[a-z0-9]+)*$.

Security notes

• All inputs are sanitized (control/zero-width stripping) and length-capped.
• Regex safety guard prevents common ReDoS patterns.
• Threat signatures catch common XSS/SQLi payloads.
• Always perform server-side validation even if you also validate on client.

License

MIT