@apifuse/provider-sdk 2.2.0-beta.24 → 2.2.0-beta.26

package/src/runtime/cache.ts

@@ -1,6 +1,7 @@
-import { createHash } from "node:crypto";
+import { createHash, createHmac } from "node:crypto";
 
 import { providerCacheRedisUrlFromEnv } from "../config/loader.js";
+import { ProviderError } from "../errors.js";
 import type {
 	ProviderCache,
 	ProviderCacheGetOrSetOptions,
@@ -43,9 +44,12 @@ export type ProviderCacheOptions = {
 	now?: () => number;
 };
 
+export const APIFUSE__CACHE__KEY_PEPPER_ENV = "APIFUSE__CACHE__KEY_PEPPER";
+
 const DEFAULT_PREFIX = "apifuse:provider-cache:v1";
 const DEFAULT_MEMORY_MAX_ENTRIES = 1_000;
 const DEFAULT_REDIS_TIMEOUT_MS = 150;
+const SECRET_SCOPED_KEY_MARKER = "[secret-scoped";
 const SECRET_FIELD_NAMES = new Set([
 	"authorization",
 	"cookie",
@@ -61,6 +65,7 @@ const SECRET_FIELD_NAMES = new Set([
 ]);
 
 const sharedBackends = new Map<string, SharedCacheBackend>();
+let warnedAboutUnpepperedSecretKeys = false;
 
 function backendKey(redisUrl: string | undefined): string {
 	return redisUrl ?? "memory";
@@ -107,19 +112,178 @@ function shouldRedactField(name: string, extra: Set<string>): boolean {
 	);
 }
 
-function normalizeKeyPart(value: unknown, extra: Set<string>): unknown {
+type NormalizedKeyPart = {
+	value: unknown;
+	secretScoped: boolean;
+};
+
+function unsupportedSecretValue(path: string, reason: string): never {
+	throw new ProviderError(`Secret cache-key values must be JSON-safe; ${reason} at ${path}.`, {
+		code: "CACHE_KEY_SECRET_VALUE_UNSUPPORTED",
+		fix: "Convert the secret cache-key selector to JSON-safe primitives, arrays, or plain objects.",
+	});
+}
+
+function assertJsonSafeSecretValue(
+	value: unknown,
+	reportedPath: string,
+	ancestors = new Set<object>(),
+): void {
+	if (value === undefined) return;
+	if (value === null || typeof value === "string" || typeof value === "boolean") return;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value))
+			unsupportedSecretValue(reportedPath, "non-finite numbers are unsupported");
+		if (Object.is(value, -0))
+			unsupportedSecretValue(reportedPath, "negative zero is unsupported");
+		return;
+	}
+	if (typeof value !== "object") {
+		unsupportedSecretValue(reportedPath, `${typeof value} values are unsupported`);
+	}
+	if (ancestors.has(value))
+		unsupportedSecretValue(reportedPath, "cyclic values are unsupported");
+
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) {
+			if (Object.getOwnPropertySymbols(value).length > 0) {
+				unsupportedSecretValue(reportedPath, "symbol-keyed array properties are unsupported");
+			}
+			const expectedNames = new Set(["length"]);
+			for (let index = 0; index < value.length; index += 1) {
+				const key = String(index);
+				expectedNames.add(key);
+				const descriptor = Object.getOwnPropertyDescriptor(value, key);
+				if (!descriptor)
+					unsupportedSecretValue(reportedPath, "sparse arrays are unsupported");
+				if (!descriptor.enumerable || !("value" in descriptor)) {
+					unsupportedSecretValue(reportedPath, "array accessors are unsupported");
+				}
+				assertJsonSafeSecretValue(descriptor.value, reportedPath, ancestors);
+			}
+			if (Object.getOwnPropertyNames(value).some((name) => !expectedNames.has(name))) {
+				unsupportedSecretValue(reportedPath, "custom array properties are unsupported");
+			}
+			return;
+		}
+
+		const prototype = Object.getPrototypeOf(value);
+		if (prototype !== Object.prototype && prototype !== null) {
+			unsupportedSecretValue(reportedPath, "non-plain objects are unsupported");
+		}
+		if (Object.getOwnPropertySymbols(value).length > 0) {
+			unsupportedSecretValue(reportedPath, "symbol-keyed properties are unsupported");
+		}
+		for (const key of Object.getOwnPropertyNames(value)) {
+			const descriptor = Object.getOwnPropertyDescriptor(value, key);
+			if (!descriptor?.enumerable || !("value" in descriptor)) {
+				unsupportedSecretValue(
+					reportedPath,
+					"non-enumerable properties and accessors are unsupported",
+				);
+			}
+			assertJsonSafeSecretValue(descriptor.value, reportedPath, ancestors);
+		}
+	} finally {
+		ancestors.delete(value);
+	}
+}
+
+function containsUndefined(value: unknown): boolean {
+	if (value === undefined) return true;
+	if (Array.isArray(value)) return value.some(containsUndefined);
+	if (isRecord(value)) return Object.values(value).some(containsUndefined);
+	return false;
+}
+
+function tagSecretValue(value: unknown): unknown {
+	if (value === undefined) return ["undefined"];
+	if (value === null) return ["null"];
+	if (typeof value === "string") return ["string", value];
+	if (typeof value === "number") return ["number", value];
+	if (typeof value === "boolean") return ["boolean", value];
+	if (Array.isArray(value)) return ["array", value.map(tagSecretValue)];
+	return [
+		"object",
+		Object.entries(value as Record<string, unknown>).map(([key, entry]) => [
+			key,
+			tagSecretValue(entry),
+		]),
+	];
+}
+
+function serializeSecretValue(value: unknown): string {
+	if (!containsUndefined(value)) return JSON.stringify([value]);
+	return `undefined-v1:${JSON.stringify(tagSecretValue(value))}`;
+}
+
+function warnAboutUnpepperedSecretKey(): void {
+	if (warnedAboutUnpepperedSecretKeys) return;
+	warnedAboutUnpepperedSecretKeys = true;
+	console.warn(
+		JSON.stringify({
+			level: "warn",
+			event: "provider_cache_secret_key_unpeppered",
+			message: `Secret-bearing cache keys are using unkeyed SHA-256 because ${APIFUSE__CACHE__KEY_PEPPER_ENV} is not configured.`,
+		}),
+	);
+}
+
+function normalizeKeyPart(
+	value: unknown,
+	extra: Set<string>,
+	pepper: string | undefined,
+): NormalizedKeyPart {
 	if (Array.isArray(value)) {
-		return value.map((entry) => normalizeKeyPart(entry, extra));
+		const entries = value.map((entry) => normalizeKeyPart(entry, extra, pepper));
+		return {
+			value: entries.map((entry) => entry.value),
+			secretScoped: entries.some((entry) => entry.secretScoped),
+		};
 	}
 	if (isRecord(value)) {
-		const normalized: Record<string, unknown> = {};
+		const normalized: Record<string, unknown> = Object.create(null);
+		let secretScoped = false;
 		for (const key of Object.keys(value).sort()) {
-			if (shouldRedactField(key, extra)) continue;
-			normalized[key] = normalizeKeyPart(value[key], extra);
+			const part = shouldRedactField(key, extra)
+				? hashSecretValue(value[key], key, extra, pepper)
+				: normalizeKeyPart(value[key], extra, pepper);
+			normalized[key] = part.value;
+			secretScoped ||= part.secretScoped;
 		}
-		return normalized;
+		return { value: normalized, secretScoped };
+	}
+	return { value, secretScoped: false };
+}
+
+function hashSecretValue(
+	value: unknown,
+	fieldName: string,
+	extra: Set<string>,
+	pepper: string | undefined,
+): NormalizedKeyPart {
+	assertJsonSafeSecretValue(value, `${fieldName} (inside secret value)`);
+	const canonical = serializeSecretValue(normalizeKeyPart(value, extra, pepper).value);
+	if (pepper === undefined) {
+		warnAboutUnpepperedSecretKey();
+		const digest = createHash("sha256").update(canonical).digest("hex");
+		return { value: `sha256:${digest}`, secretScoped: true };
 	}
-	return value;
+	const digest = createHmac("sha256", pepper).update(canonical).digest("hex");
+	return { value: `hmac-sha256:${digest}`, secretScoped: true };
+}
+
+function metadataKeys(
+	events: ProviderCacheLookupMeta[],
+	secretScopedKeys: Set<string>,
+): string[] {
+	let secretScopedIndex = 0;
+	return Array.from(new Set(events.map((event) => event.key))).map((key) => {
+		if (!secretScopedKeys.has(key)) return key;
+		secretScopedIndex += 1;
+		return `${SECRET_SCOPED_KEY_MARKER}#${secretScopedIndex}]`;
+	});
 }
 
 function stableHash(value: unknown): string {
@@ -198,10 +362,13 @@ async function withRedisFallback<T>(operation: () => Promise<T>): Promise<T | un
 
 export function createProviderCache(options: ProviderCacheOptions): ProviderCache {
 	const redisUrl = options.redisUrl ?? providerCacheRedisUrlFromEnv();
+	const configuredPepper = process.env[APIFUSE__CACHE__KEY_PEPPER_ENV];
+	const pepper = configuredPepper && configuredPepper.length > 0 ? configuredPepper : undefined;
 	const backend = getSharedBackend(redisUrl);
 	const memoryMaxEntries = Math.max(1, options.memoryMaxEntries ?? DEFAULT_MEMORY_MAX_ENTRIES);
 	const now = options.now ?? Date.now;
 	const events: ProviderCacheLookupMeta[] = [];
+	const secretScopedKeys = new Set<string>();
 
 	function record(meta: ProviderCacheLookupMeta): void {
 		events.push(meta);
@@ -353,8 +520,10 @@ export function createProviderCache(options: ProviderCacheOptions): ProviderCach
 	return {
 		key(namespace, parts, keyOptions?: ProviderCacheKeyOptions) {
 			const extra = new Set((keyOptions?.redactFields ?? []).map((field) => field.toLowerCase()));
-			const normalized = normalizeKeyPart(parts, extra);
-			return `${DEFAULT_PREFIX}:${options.providerId}:${namespace}:${stableHash(normalized)}`;
+			const normalized = normalizeKeyPart(parts, extra, pepper);
+			const key = `${DEFAULT_PREFIX}:${options.providerId}:${namespace}:${stableHash(normalized.value)}`;
+			if (normalized.secretScoped) secretScopedKeys.add(key);
+			return key;
 		},
 
 		async get<T = unknown>(key: string): Promise<ProviderCacheResult<T> | null> {
@@ -413,7 +582,7 @@ export function createProviderCache(options: ProviderCacheOptions): ProviderCach
 			return {
 				hit: events.some((event) => event.hit),
 				stale: events.some((event) => event.stale),
-				keys: Array.from(new Set(events.map((event) => event.key))),
+				keys: metadataKeys(events, secretScopedKeys),
 				source: sourceSummary(events),
 			};
 		},
@@ -423,13 +592,18 @@ export function createProviderCache(options: ProviderCacheOptions): ProviderCach
 export function createBypassProviderCache(
 	options: Pick<ProviderCacheOptions, "providerId">,
 ): ProviderCache {
+	const configuredPepper = process.env[APIFUSE__CACHE__KEY_PEPPER_ENV];
+	const pepper = configuredPepper && configuredPepper.length > 0 ? configuredPepper : undefined;
 	const events: ProviderCacheLookupMeta[] = [];
+	const secretScopedKeys = new Set<string>();
 
 	return {
 		key(namespace, parts, keyOptions?: ProviderCacheKeyOptions) {
 			const extra = new Set((keyOptions?.redactFields ?? []).map((field) => field.toLowerCase()));
-			const normalized = normalizeKeyPart(parts, extra);
-			return `${DEFAULT_PREFIX}:${options.providerId}:${namespace}:${stableHash(normalized)}`;
+			const normalized = normalizeKeyPart(parts, extra, pepper);
+			const key = `${DEFAULT_PREFIX}:${options.providerId}:${namespace}:${stableHash(normalized.value)}`;
+			if (normalized.secretScoped) secretScopedKeys.add(key);
+			return key;
 		},
 
 		async get<T = unknown>(_key: string): Promise<ProviderCacheResult<T> | null> {
@@ -464,7 +638,7 @@ export function createBypassProviderCache(
 			return {
 				hit: false,
 				stale: false,
-				keys: Array.from(new Set(events.map((event) => event.key))),
+				keys: metadataKeys(events, secretScopedKeys),
 				source: sourceSummary(events),
 			};
 		},
@@ -478,4 +652,5 @@ export function resetProviderCacheForTests(): void {
 		backend.redis?.disconnect();
 	}
 	sharedBackends.clear();
+	warnedAboutUnpepperedSecretKeys = false;
 }

package/src/runtime/resolver-vendors/bindings.ts

@@ -1,30 +1,55 @@
 import type { ProviderChallenge, ProviderChallengeKind } from "../../types.js";
 import type { ResolverIssuingIdentity } from "./types.js";
 
+type ResolverChallengeBinding = {
+	readonly cacheable: boolean;
+	readonly identityBinding: "none" | "identity_scoped" | "portable";
+	readonly directCacheable: boolean;
+};
+
+// An IP-bound artifact minted without any recorded egress identity is unsafe to
+// share. The Akamai kinds therefore reject direct caching, while Cloudflare
+// keeps its pre-existing direct-cache behavior pending measurement.
 export const RESOLVER_CHALLENGE_BINDINGS = {
-	aws_waf: "portable",
-	cloudflare_interstitial: "identity_scoped",
-} as const satisfies Partial<
-	Readonly<Record<ProviderChallengeKind, "identity_scoped" | "portable">>
->;
+	turnstile: { cacheable: false, identityBinding: "none", directCacheable: false },
+	recaptcha_v2: { cacheable: false, identityBinding: "none", directCacheable: false },
+	recaptcha_v3: { cacheable: false, identityBinding: "none", directCacheable: false },
+	hcaptcha: { cacheable: false, identityBinding: "none", directCacheable: false },
+	cloudflare_interstitial: {
+		cacheable: true,
+		identityBinding: "identity_scoped",
+		directCacheable: true,
+	},
+	aws_waf: { cacheable: true, identityBinding: "portable", directCacheable: true },
+	akamai_sec_cpt: {
+		cacheable: true,
+		identityBinding: "identity_scoped",
+		directCacheable: false,
+	},
+	akamai_sensor: {
+		cacheable: true,
+		identityBinding: "identity_scoped",
+		directCacheable: false,
+	},
+} as const satisfies Readonly<Record<ProviderChallengeKind, ResolverChallengeBinding>>;
+
+export function resolverChallengeIsCacheable(challenge: ProviderChallenge): boolean {
+	return RESOLVER_CHALLENGE_BINDINGS[challenge.kind].cacheable;
+}
+
+export function resolverChallengeAllowsDirectCache(challenge: ProviderChallenge): boolean {
+	return RESOLVER_CHALLENGE_BINDINGS[challenge.kind].directCacheable;
+}
 
 export function resolverChallengeIsIdentityScoped(challenge: ProviderChallenge): boolean {
-	return (
-		RESOLVER_CHALLENGE_BINDINGS[challenge.kind as keyof typeof RESOLVER_CHALLENGE_BINDINGS] ===
-		"identity_scoped"
-	);
+	return RESOLVER_CHALLENGE_BINDINGS[challenge.kind].identityBinding === "identity_scoped";
 }
 
 export function resolverChallengeIssuingIdentity(
 	challenge: ProviderChallenge,
 	identity: ResolverIssuingIdentity,
 ): ResolverIssuingIdentity {
-	const binding = (
-		RESOLVER_CHALLENGE_BINDINGS as Partial<
-			Readonly<Record<ProviderChallengeKind, "identity_scoped" | "portable">>
-		>
-	)[challenge.kind];
-	if (binding === "portable") {
+	if (RESOLVER_CHALLENGE_BINDINGS[challenge.kind].identityBinding === "portable") {
 		return { userAgent: identity.userAgent };
 	}
 	return identity;

package/src/runtime/resolver-vendors/browser.ts

@@ -1,4 +1,4 @@
-import { isProviderError, ProviderError } from "../../errors.js";
+import { isProviderError } from "../../errors.js";
 import type {
 	BrowserClient,
 	BrowserCookie,
@@ -9,6 +9,7 @@ import type {
 import { type BrowserClientOptions, createBrowserClient } from "../browser.js";
 import type { TraceRecorder } from "../trace.js";
 import { resolverChallengeIssuingIdentity } from "./bindings.js";
+import { assertResolverHostAllowed, normalizedResolverHostname } from "./hosts.js";
 import {
 	type ResolverIdentity,
 	type ResolverVendorAdapter,
@@ -35,11 +36,6 @@ export interface BrowserResolverVendorOptions {
 	readonly createClient?: BrowserClientFactory;
 }
 
-export type BrowserResolverSolution = Extract<ChallengeSolution, { readonly form: "cookies" }> & {
-	/** Unix seconds from the cookie that proved the challenge cleared. */
-	readonly expires?: number;
-};
-
 export interface BrowserResolverVendorAdapter extends ResolverVendorAdapter {
 	readonly id: "browser";
 	solve(
@@ -47,7 +43,7 @@ export interface BrowserResolverVendorAdapter extends ResolverVendorAdapter {
 		identity: ResolverIdentity | undefined,
 		signal: AbortSignal,
 		traceRecorder?: TraceRecorder,
-	): Promise<BrowserResolverSolution>;
+	): Promise<Extract<ChallengeSolution, { readonly form: "cookies" }>>;
 }
 
 class BrowserSolveTimeoutError extends Error {
@@ -155,38 +151,20 @@ function isSupportedKind(kind: string): kind is SupportedBrowserChallengeKind {
 	return Object.hasOwn(SUCCESS_COOKIE_NAMES, kind);
 }
 
-function normalizedHostname(hostname: string): string {
-	return hostname.trim().toLowerCase().replace(/\.$/, "");
-}
-
-function assertChallengeHostAllowed(pageUrl: string, allowedHosts: readonly string[]): void {
-	const challengeHost = normalizedHostname(new URL(pageUrl).hostname);
-	const isAllowed = allowedHosts.some((host) => {
-		const declaredHost = normalizedHostname(host);
-		return declaredHost.length > 0 && !declaredHost.includes("*") && declaredHost === challengeHost;
-	});
-	if (isAllowed) return;
-
-	throw new ProviderError(`Resolver challenge host "${challengeHost}" is not declared`, {
-		code: "RESOLVER_HOST_NOT_ALLOWED",
-		fix: "Add the exact challenge hostname to the provider's allowedHosts declaration.",
-	});
-}
-
 function cookieDomainSpecificity(cookie: BrowserCookie): number {
-	return normalizedHostname(cookie.domain.replace(/^\./, "")).length;
+	return normalizedResolverHostname(cookie.domain.replace(/^\./, "")).length;
 }
 
 function isHostOnlyCookieFor(cookie: BrowserCookie, hostname: string): boolean {
 	return (
 		!cookie.domain.startsWith(".") &&
-		normalizedHostname(cookie.domain) === normalizedHostname(hostname)
+		normalizedResolverHostname(cookie.domain) === normalizedResolverHostname(hostname)
 	);
 }
 
 function cookieAppliesToUrl(cookie: BrowserCookie, url: URL): boolean {
-	const cookieDomain = normalizedHostname(cookie.domain.replace(/^\./, ""));
-	const requestHostname = normalizedHostname(url.hostname);
+	const cookieDomain = normalizedResolverHostname(cookie.domain.replace(/^\./, ""));
+	const requestHostname = normalizedResolverHostname(url.hostname);
 	const domainMatches =
 		cookieDomain.length > 0 &&
 		(requestHostname === cookieDomain ||
@@ -226,7 +204,7 @@ async function solveInPage(
 	successCookieName: string,
 	pollIntervalMs: number,
 	signal: AbortSignal,
-): Promise<BrowserResolverSolution> {
+): Promise<Extract<ChallengeSolution, { readonly form: "cookies" }>> {
 	await raceWithAbort(() => page.goto(pageUrl), signal);
 
 	while (true) {
@@ -345,7 +323,7 @@ export function createBrowserResolverVendorAdapter(
 			if (!isSupportedKind(challenge.kind)) {
 				throw new TypeError(`Browser resolver does not support ${challenge.kind}`);
 			}
-			assertChallengeHostAllowed(challenge.pageUrl, options.allowedHosts);
+			assertResolverHostAllowed(challenge.pageUrl, options.allowedHosts);
 			const challengeKind = challenge.kind;
 			callerSignal.throwIfAborted();
 

package/src/runtime/resolver-vendors/hosts.ts

@@ -0,0 +1,38 @@
+import { ProviderError } from "../../errors.js";
+
+export function normalizedResolverHostname(hostname: string): string {
+	return hostname.trim().toLowerCase().replace(/\.$/, "");
+}
+
+export function assertResolverHostAllowed(
+	targetUrl: string,
+	allowedHosts: readonly string[],
+): void {
+	let targetUrlObject: URL;
+	try {
+		targetUrlObject = new URL(targetUrl);
+	} catch {
+		throw new ProviderError("Resolver target URL is invalid", {
+			code: "RESOLVER_HOST_NOT_ALLOWED",
+			fix: "Use a valid URL whose exact hostname appears in the provider's allowedHosts declaration.",
+		});
+	}
+	if (targetUrlObject.protocol !== "http:" && targetUrlObject.protocol !== "https:") {
+		throw new ProviderError(`Resolver target URL scheme "${targetUrlObject.protocol}" is not allowed`, {
+			code: "RESOLVER_HOST_NOT_ALLOWED",
+			fix: "Use an http or https URL whose exact hostname appears in the provider's allowedHosts declaration.",
+		});
+	}
+	const targetHost = normalizedResolverHostname(targetUrlObject.hostname);
+
+	const isAllowed = allowedHosts.some((host) => {
+		const declaredHost = normalizedResolverHostname(host);
+		return declaredHost.length > 0 && !declaredHost.includes("*") && declaredHost === targetHost;
+	});
+	if (isAllowed) return;
+
+	throw new ProviderError(`Resolver target host "${targetHost}" is not declared`, {
+		code: "RESOLVER_HOST_NOT_ALLOWED",
+		fix: "Add the exact target hostname to the provider's allowedHosts declaration.",
+	});
+}