@agent-profile/web 0.2.0 → 0.3.0

package/build/server/chunks/{hooks.server-BKavEpqC.js → hooks.server-Dva4z7fv.js}

@@ -13,6 +13,7 @@ var STATE_CHANGING_METHODS = new Set([
 	"PATCH",
 	"DELETE"
 ]);
+var SESSION_COOKIE_NAME = "agent_profile_session";
 var handle = async ({ event, resolve }) => {
 	if (isMarketingBuild()) return resolve(event);
 	const host = event.request.headers.get("host");
@@ -23,11 +24,44 @@ var handle = async ({ event, resolve }) => {
 	if (STATE_CHANGING_METHODS.has(method)) {
 		if (!isLocalSameOrigin(host, source, false)) error(403, "Agent Profile UI only accepts localhost requests.");
 	} else if (!isLocalSameOrigin(host, source, true)) error(403, "Agent Profile UI only accepts localhost requests.");
+	const expectedToken = getExpectedSessionToken();
+	if (expectedToken !== void 0) {
+		if (!hasValidSessionToken(event, expectedToken)) error(403, "Agent Profile UI session token missing or invalid. Re-open the URL printed by the CLI.");
+		if (method === "GET") {
+			const fromQuery = event.url.searchParams.get("session");
+			if (fromQuery && constantTimeEqual(fromQuery, expectedToken)) event.cookies.set(SESSION_COOKIE_NAME, expectedToken, {
+				path: "/",
+				httpOnly: true,
+				sameSite: "strict",
+				secure: false
+			});
+		}
+	}
 	return resolve(event);
 };
 function isMarketingBuild() {
 	return process.env.AGENT_PROFILE_MARKETING_BUILD === "1";
 }
+function getExpectedSessionToken() {
+	const value = process.env.AGENT_PROFILE_SESSION_TOKEN;
+	if (!value || value.trim().length === 0) return void 0;
+	return value;
+}
+function hasValidSessionToken(event, expected) {
+	const fromCookie = event.cookies.get(SESSION_COOKIE_NAME);
+	if (fromCookie && constantTimeEqual(fromCookie, expected)) return true;
+	const fromQuery = event.url.searchParams.get("session");
+	if (fromQuery && constantTimeEqual(fromQuery, expected)) return true;
+	const fromHeader = event.request.headers.get("x-agent-profile-session");
+	if (fromHeader && constantTimeEqual(fromHeader, expected)) return true;
+	return false;
+}
+function constantTimeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let i = 0; i < a.length; i += 1) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return mismatch === 0;
+}
 function isLocalSameOrigin(hostHeader, sourceHeader, allowMissingSource) {
 	const host = parseHostHeader(hostHeader);
 	if (host === null) return false;
@@ -78,4 +112,4 @@ function normalizePort(port, protocol) {
 }
 
 export { handle };
-//# sourceMappingURL=hooks.server-BKavEpqC.js.map
+//# sourceMappingURL=hooks.server-Dva4z7fv.js.map

package/build/server/chunks/hooks.server-Dva4z7fv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.server-Dva4z7fv.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { error } from \"@sveltejs/kit\";\n//#region src/hooks.server.ts\nvar LOOPBACK_HOSTS = new Set([\n\t\"127.0.0.1\",\n\t\"localhost\",\n\t\"::1\"\n]);\nvar STATE_CHANGING_METHODS = new Set([\n\t\"POST\",\n\t\"PUT\",\n\t\"PATCH\",\n\t\"DELETE\"\n]);\nvar SESSION_COOKIE_NAME = \"agent_profile_session\";\nvar handle = async ({ event, resolve }) => {\n\tif (isMarketingBuild()) return resolve(event);\n\tconst host = event.request.headers.get(\"host\");\n\tconst origin = event.request.headers.get(\"origin\");\n\tconst referer = event.request.headers.get(\"referer\");\n\tconst source = origin ?? referer;\n\tconst method = event.request.method.toUpperCase();\n\tif (STATE_CHANGING_METHODS.has(method)) {\n\t\tif (!isLocalSameOrigin(host, source, false)) error(403, \"Agent Profile UI only accepts localhost requests.\");\n\t} else if (!isLocalSameOrigin(host, source, true)) error(403, \"Agent Profile UI only accepts localhost requests.\");\n\tconst expectedToken = getExpectedSessionToken();\n\tif (expectedToken !== void 0) {\n\t\tif (!hasValidSessionToken(event, expectedToken)) error(403, \"Agent Profile UI session token missing or invalid. Re-open the URL printed by the CLI.\");\n\t\tif (method === \"GET\") {\n\t\t\tconst fromQuery = event.url.searchParams.get(\"session\");\n\t\t\tif (fromQuery && constantTimeEqual(fromQuery, expectedToken)) event.cookies.set(SESSION_COOKIE_NAME, expectedToken, {\n\t\t\t\tpath: \"/\",\n\t\t\t\thttpOnly: true,\n\t\t\t\tsameSite: \"strict\",\n\t\t\t\tsecure: false\n\t\t\t});\n\t\t}\n\t}\n\treturn resolve(event);\n};\nfunction isMarketingBuild() {\n\treturn process.env.AGENT_PROFILE_MARKETING_BUILD === \"1\";\n}\nfunction getExpectedSessionToken() {\n\tconst value = process.env.AGENT_PROFILE_SESSION_TOKEN;\n\tif (!value || value.trim().length === 0) return void 0;\n\treturn value;\n}\nfunction hasValidSessionToken(event, expected) {\n\tconst fromCookie = event.cookies.get(SESSION_COOKIE_NAME);\n\tif (fromCookie && constantTimeEqual(fromCookie, expected)) return true;\n\tconst fromQuery = event.url.searchParams.get(\"session\");\n\tif (fromQuery && constantTimeEqual(fromQuery, expected)) return true;\n\tconst fromHeader = event.request.headers.get(\"x-agent-profile-session\");\n\tif (fromHeader && constantTimeEqual(fromHeader, expected)) return true;\n\treturn false;\n}\nfunction constantTimeEqual(a, b) {\n\tif (a.length !== b.length) return false;\n\tlet mismatch = 0;\n\tfor (let i = 0; i < a.length; i += 1) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n\treturn mismatch === 0;\n}\nfunction isLocalSameOrigin(hostHeader, sourceHeader, allowMissingSource) {\n\tconst host = parseHostHeader(hostHeader);\n\tif (host === null) return false;\n\tif (!sourceHeader) return allowMissingSource;\n\ttry {\n\t\tconst source = new URL(sourceHeader);\n\t\tconst sourceHost = normalizeHostname(source.hostname);\n\t\treturn source.protocol === \"http:\" && sourceHost === host.hostname && normalizePort(source.port, source.protocol) === host.port;\n\t} catch {\n\t\treturn false;\n\t}\n}\nfunction parseHostHeader(value) {\n\tif (!value) return null;\n\tlet hostname;\n\tlet port = \"\";\n\tif (value.startsWith(\"[\")) {\n\t\tconst end = value.indexOf(\"]\");\n\t\tif (end === -1) return null;\n\t\thostname = value.slice(1, end);\n\t\tconst rest = value.slice(end + 1);\n\t\tif (rest.length > 0) {\n\t\t\tif (!rest.startsWith(\":\")) return null;\n\t\t\tport = rest.slice(1);\n\t\t}\n\t} else {\n\t\tconst parts = value.split(\":\");\n\t\tif (parts.length > 2) return null;\n\t\thostname = parts[0];\n\t\tport = parts[1] ?? \"\";\n\t}\n\thostname = normalizeHostname(hostname);\n\tif (!LOOPBACK_HOSTS.has(hostname)) return null;\n\tif (port !== \"\" && !/^\\d+$/u.test(port)) return null;\n\treturn {\n\t\thostname,\n\t\tport\n\t};\n}\nfunction normalizeHostname(hostname) {\n\treturn hostname.toLowerCase();\n}\nfunction normalizePort(port, protocol) {\n\tif (port !== \"\") return port;\n\tif (protocol === \"http:\") return \"80\";\n\tif (protocol === \"https:\") return \"443\";\n\treturn \"\";\n}\n//#endregion\nexport { handle };\n"],"names":[],"mappings":";;;AACA;AACA,IAAI,cAAc,GAAG,IAAI,GAAG,CAAC;AAC7B,CAAC,WAAW;AACZ,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF,IAAI,sBAAsB,GAAG,IAAI,GAAG,CAAC;AACrC,CAAC,MAAM;AACP,CAAC,KAAK;AACN,CAAC,OAAO;AACR,CAAC;AACD,CAAC,CAAC;AACF,IAAI,mBAAmB,GAAG,uBAAuB;AAC9C,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,IAAI,gBAAgB,EAAE,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AAC/C,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AACnD,CAAC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;AACrD,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO;AACjC,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;AAClD,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;AACzC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,mDAAmD,CAAC;AAC9G,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,mDAAmD,CAAC;AACnH,CAAC,MAAM,aAAa,GAAG,uBAAuB,EAAE;AAChD,CAAC,IAAI,aAAa,KAAK,MAAM,EAAE;AAC/B,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,wFAAwF,CAAC;AACvJ,EAAE,IAAI,MAAM,KAAK,KAAK,EAAE;AACxB,GAAG,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;AAC1D,GAAG,IAAI,SAAS,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,aAAa,EAAE;AACvH,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,QAAQ,EAAE,QAAQ;AACtB,IAAI,MAAM,EAAE;AACZ,IAAI,CAAC;AACL,EAAE;AACF,CAAC;AACD,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG;AACzD;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B;AACtD,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,MAAM;AACvD,CAAC,OAAO,KAAK;AACb;AACA,SAAS,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE;AAC/C,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC1D,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,IAAI;AACvE,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;AACxD,CAAC,IAAI,SAAS,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,IAAI;AACrE,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxE,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,IAAI;AACvE,CAAC,OAAO,KAAK;AACb;AACA,SAAS,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE;AACjC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK;AACxC,CAAC,IAAI,QAAQ,GAAG,CAAC;AACjB,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AACpF,CAAC,OAAO,QAAQ,KAAK,CAAC;AACtB;AACA,SAAS,iBAAiB,CAAC,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE;AACzE,CAAC,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC;AACzC,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,OAAO,KAAK;AAChC,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,kBAAkB;AAC7C,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC;AACtC,EAAE,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;AACvD,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,KAAK,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,IAAI;AACjI,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA,SAAS,eAAe,CAAC,KAAK,EAAE;AAChC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI;AACxB,CAAC,IAAI,QAAQ;AACb,CAAC,IAAI,IAAI,GAAG,EAAE;AACd,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC5B,EAAE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;AAChC,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE,OAAO,IAAI;AAC7B,EAAE,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;AAChC,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AACnC,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;AACvB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI;AACzC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACvB,EAAE;AACF,CAAC,CAAC,MAAM;AACR,EAAE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AAChC,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;AACnC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC;AACrB,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;AACvB,CAAC;AACD,CAAC,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC;AACvC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC/C,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACrD,CAAC,OAAO;AACR,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF;AACA,SAAS,iBAAiB,CAAC,QAAQ,EAAE;AACrC,CAAC,OAAO,QAAQ,CAAC,WAAW,EAAE;AAC9B;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE;AACvC,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,OAAO,IAAI;AAC7B,CAAC,IAAI,QAAQ,KAAK,OAAO,EAAE,OAAO,IAAI;AACtC,CAAC,IAAI,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;AACxC,CAAC,OAAO,EAAE;AACV;;;;"}

package/build/server/chunks/{internal-Dz8-ksla.js → internal-DyPeC3rk.js}

@@ -1972,7 +1972,7 @@ var options = {
 		app: ({ head, body, assets, nonce, env }) => "<!DOCTYPE html>\n<html lang=\"en\" data-theme=\"dark\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <meta name=\"referrer\" content=\"no-referrer\" />\n    <meta name=\"color-scheme\" content=\"dark\" />\n    <link rel=\"icon\" href=\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='6' fill='%234b8bf5'/%3E%3Crect x='9' y='9' width='14' height='14' fill='none' stroke='%23111' stroke-width='2'/%3E%3C/svg%3E\" />\n    <title>agent-profile</title>\n    " + head + "\n  </head>\n  <body>\n    <div id=\"app\">" + body + "</div>\n  </body>\n</html>\n",
 		error: ({ status, message }) => "<!doctype html>\n<html lang=\"en\">\n	<head>\n		<meta charset=\"utf-8\" />\n		<title>" + message + "</title>\n\n		<style>\n			body {\n				--bg: white;\n				--fg: #222;\n				--divider: #ccc;\n				background: var(--bg);\n				color: var(--fg);\n				font-family:\n					system-ui,\n					-apple-system,\n					BlinkMacSystemFont,\n					'Segoe UI',\n					Roboto,\n					Oxygen,\n					Ubuntu,\n					Cantarell,\n					'Open Sans',\n					'Helvetica Neue',\n					sans-serif;\n				display: flex;\n				align-items: center;\n				justify-content: center;\n				height: 100vh;\n				margin: 0;\n			}\n\n			.error {\n				display: flex;\n				align-items: center;\n				max-width: 32rem;\n				margin: 0 1rem;\n			}\n\n			.status {\n				font-weight: 200;\n				font-size: 3rem;\n				line-height: 1;\n				position: relative;\n				top: -0.05rem;\n			}\n\n			.message {\n				border-left: 1px solid var(--divider);\n				padding: 0 0 0 1rem;\n				margin: 0 0 0 1rem;\n				min-height: 2.5rem;\n				display: flex;\n				align-items: center;\n			}\n\n			.message h1 {\n				font-weight: 400;\n				font-size: 1em;\n				margin: 0;\n			}\n\n			@media (prefers-color-scheme: dark) {\n				body {\n					--bg: #222;\n					--fg: #ddd;\n					--divider: #666;\n				}\n			}\n		</style>\n	</head>\n	<body>\n		<div class=\"error\">\n			<span class=\"status\">" + status + "</span>\n			<div class=\"message\">\n				<h1>" + message + "</h1>\n			</div>\n		</div>\n	</body>\n</html>\n"
 	},
-	version_hash: "vo4ovz"
+	version_hash: "7p2d6d"
 };
 async function get_hooks() {
 	let handle;
@@ -1980,7 +1980,7 @@ async function get_hooks() {
 	let handleError;
 	let handleValidationError;
 	let init;
-	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-BKavEpqC.js'));
+	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-Dva4z7fv.js'));
 	let reroute;
 	let transport;
 	return {
@@ -1995,4 +1995,4 @@ async function get_hooks() {
 }
 
 export { validate_page_exports as A, noop_span as B, assets as C, app_dir as D, create_remote_key as E, hash as F, text_encoder as G, compact as H, INVALIDATED_PARAM as I, once as J, normalize_error as K, resolve as L, parse_remote_arg as M, stringify as N, make_trackable as O, stringify$1 as P, read_implementation as Q, split_remote_key as R, get_relative_path as S, TRAILING_SLASH_PARAM as T, base64_encode as U, override as V, reset as W, set_read_implementation as X, get_message as a, set_public_env as b, coalesce_to_error as c, get_hooks as d, has_data_suffix as e, base as f, get_status as g, has_resolution_suffix as h, index_server_exports as i, strip_resolution_suffix as j, strip_data_suffix as k, decode_pathname as l, add_data_suffix as m, noop as n, options as o, parse as p, add_resolution_suffix as q, find_route as r, set_private_env as s, normalize_path as t, disable_search as u, public_env as v, with_request_store as w, validate_layout_server_exports as x, validate_layout_exports as y, validate_page_server_exports as z };
-//# sourceMappingURL=internal-Dz8-ksla.js.map
+//# sourceMappingURL=internal-DyPeC3rk.js.map