@apifuse/provider-sdk 2.2.0-beta.31 → 2.2.0-beta.33

package/src/runtime/choice.ts

@@ -39,8 +39,6 @@ import type {
 
 export const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV =
 	"APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export const PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV =
-	"APIFUSE__PROVIDER_RUNTIME__CHOICE_WORD_ISSUANCE";
 
 const PRIMARY_CHOICE_TOKEN_KID = "v1";
 const MANAGED_CHOICE_TOKEN_VERSION = 1;
@@ -133,7 +131,6 @@ export function createProviderChoiceContext(
 		const issuedAtMs = issueOptions.nowMs ?? Date.now();
 		const resolvedStorage = resolveIssueStorage(issueOptions.storage, issueOptions.payload);
 		if (resolvedStorage.mode === "server") {
-			const issuance = resolveChoiceWordIssuance(options.env);
 			const keys = hasRequestedChoiceBinding(issueOptions.bind)
 				? deriveManagedChoiceKeys({
 						masterSecret: resolveMasterSecret(),
@@ -159,29 +156,8 @@ export function createProviderChoiceContext(
 				ttl_ms: issueOptions.ttlMs,
 				binding,
 			} satisfies Omit<ManagedChoiceEnvelope, "payload">;
-			if (issuance === "legacy") {
-				const legacyKeys =
-					keys ??
-					deriveManagedChoiceKeys({
-						masterSecret: resolveMasterSecret(),
-						providerId: options.providerId,
-						purpose: issueOptions.purpose,
-						kid,
-					});
-				return issueLegacyServerStoredChoice({
-					baseEnvelope,
-					issueOptions,
-					storage: resolvedStorage.storage,
-					contextState: options.state,
-					kid,
-					keys: legacyKeys,
-					issuedAtMs,
-				});
-			}
 			return issueWordServerStoredChoice({
-				baseEnvelope: {
-					...baseEnvelope,
-				},
+				baseEnvelope,
 				issueOptions,
 				storage: resolvedStorage.storage,
 				contextState: options.state,
@@ -511,22 +487,6 @@ function createLegacyExplicitParseResult(options: {
 	};
 }
 
-function resolveChoiceWordIssuance(env?: EnvContext): "legacy" | "word" {
-	const configured = env?.get(PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV);
-	const value = configured?.trim() ?? "";
-	if (value === "" || value === "legacy") return "legacy";
-	if (value === "word") return "word";
-	throw new ProviderError(
-		`Unsupported provider choice word issuance mode "${value}". Expected "legacy" or "word".`,
-		{
-			code: "CHOICE_WORD_ISSUANCE_INVALID",
-			category: "input_validation",
-			retryable: false,
-			details: { env: PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV },
-		},
-	);
-}
-
 function resolveChoiceMasterSecret(options: CreateProviderChoiceContextOptions): string {
 	const configured =
 		options.masterSecret ?? options.env?.get(PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV);
@@ -657,56 +617,6 @@ async function issueWordServerStoredChoice<TPayload extends ProviderChoiceTokenP
 	});
 }
 
-/**
- * Beta.28-compatible server handle issuance. The state stores the payload and
- * the client receives the existing six-part encrypted envelope whose payload
- * is a server-state handle.
- */
-async function issueLegacyServerStoredChoice<TPayload extends ProviderChoiceTokenPayload>(options: {
-	readonly baseEnvelope: Omit<ManagedChoiceEnvelope, "payload">;
-	readonly issueOptions: ProviderChoiceIssueOptions<TPayload>;
-	readonly storage: ServerProviderChoiceStorageOptions;
-	readonly contextState?: ProviderRuntimeState;
-	readonly kid: string;
-	readonly keys: ManagedChoiceKeys;
-	readonly issuedAtMs: number;
-}): Promise<string> {
-	const serializedPayload = serializeChoicePayload(options.issueOptions.payload);
-	const payloadBytes = Buffer.byteLength(serializedPayload, "utf8");
-	if (payloadBytes > options.storage.maxValueBytes) {
-		throw new ProviderError("Provider choice payload exceeds state storage policy.", {
-			code: "CHOICE_STATE_PAYLOAD_TOO_LARGE",
-			category: "input_validation",
-			retryable: false,
-			details: { maxValueBytes: options.storage.maxValueBytes, payloadBytes },
-		});
-	}
-	const stateId = `choice_${randomBytes(16).toString("base64url")}`;
-	const namespace = resolveChoiceStateNamespace({
-		storage: options.storage,
-		contextState: options.contextState,
-		ttlMs: options.issueOptions.ttlMs,
-	});
-	await namespace.set(optionsStateKey(stateId), options.issueOptions.payload, {
-		ttl: stateTtl(options.storage, options.issueOptions.ttlMs),
-	});
-	const envelope: ManagedChoiceEnvelope = {
-		...options.baseEnvelope,
-		payload: {
-			storage: "server",
-			state_id: stateId,
-			payload_digest: digestChoicePayload(serializedPayload),
-			created_at_ms: options.issuedAtMs,
-		},
-	};
-	return encryptManagedChoiceToken({
-		prefix: options.issueOptions.prefix,
-		kid: options.kid,
-		envelope,
-		keys: options.keys,
-	});
-}
-
 async function parseWordServerStoredChoice(options: {
 	readonly stateKey: string;
 	readonly parseOptions: ProviderChoiceParseOptions;

package/src/runtime/resolver-vendors/browser.ts

@@ -18,6 +18,8 @@ import {
 
 const BROWSER_VENDOR_ID = "browser" as const;
 const DEFAULT_COOKIE_POLL_INTERVAL_MS = 100;
+const AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX = ".awswaf.com";
+const RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY = "connect-src http: https:; worker-src 'none'";
 
 const SUCCESS_COOKIE_NAMES = {
 	aws_waf: "aws-waf-token",
@@ -28,6 +30,22 @@ type SupportedBrowserChallengeKind = keyof typeof SUCCESS_COOKIE_NAMES;
 
 type BrowserClientFactory = (options: BrowserClientOptions) => BrowserClient;
 
+let createResolverBrowserClient: BrowserClientFactory = createBrowserClient;
+
+/** Internal test seam; deliberately not re-exported from the package root. */
+export function swapBrowserResolverClientFactoryForTests(
+	factory: BrowserClientFactory | undefined,
+): () => void {
+	const original = createResolverBrowserClient;
+	createResolverBrowserClient = factory ?? createBrowserClient;
+	let restored = false;
+	return () => {
+		if (restored) return;
+		restored = true;
+		createResolverBrowserClient = original;
+	};
+}
+
 export interface BrowserResolverVendorOptions {
 	readonly cdpUrl?: string;
 	readonly timeoutMs: number;
@@ -200,31 +218,77 @@ function selectSuccessCookie(
 
 async function solveInPage(
 	page: BrowserPage,
+	challengeKind: SupportedBrowserChallengeKind,
 	pageUrl: string,
+	allowedHosts: readonly string[],
 	successCookieName: string,
 	pollIntervalMs: number,
 	signal: AbortSignal,
 ): Promise<Extract<ChallengeSolution, { readonly form: "cookies" }>> {
-	await raceWithAbort(() => page.goto(pageUrl), signal);
-
-	while (true) {
-		const cookies = await raceWithAbort(() => page.cookies(), signal);
-		const successCookie = selectSuccessCookie(cookies, successCookieName, pageUrl);
-		if (successCookie) {
+	return await page.withResourcePolicy(
+		{
+			allowedMethods: ["GET", "HEAD", "POST"],
+			documentContentSecurityPolicy: RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY,
+			routes: [
+				{
+					match: () => true,
+					handle: (request) => ({
+						action: isResolverBrowserRequestAllowed(request.url, challengeKind, allowedHosts)
+							? "continue"
+							: "block",
+					}),
+				},
+			],
+		},
+		async () => {
 			const userAgent = await raceWithAbort(
 				() => page.evaluate<string>("navigator.userAgent"),
 				signal,
 			);
-			return {
-				form: "cookies",
-				cookies: { [successCookieName]: successCookie.value },
-				userAgent,
-				...(successCookie.expires === undefined ? {} : { expires: successCookie.expires }),
-			};
-		}
+			await raceWithAbort(() => page.goto(pageUrl), signal);
+
+			while (true) {
+				const cookies = await raceWithAbort(() => page.cookies(), signal);
+				const successCookie = selectSuccessCookie(cookies, successCookieName, pageUrl);
+				if (successCookie) {
+					return {
+						form: "cookies",
+						cookies: { [successCookieName]: successCookie.value },
+						userAgent,
+						...(successCookie.expires === undefined ? {} : { expires: successCookie.expires }),
+					};
+				}
+
+				await abortableDelay(pollIntervalMs, signal);
+			}
+		},
+	);
+}
 
-		await abortableDelay(pollIntervalMs, signal);
+function isResolverBrowserRequestAllowed(
+	targetUrl: string,
+	challengeKind: SupportedBrowserChallengeKind,
+	allowedHosts: readonly string[],
+): boolean {
+	try {
+		assertResolverHostAllowed(targetUrl, allowedHosts);
+		return true;
+	} catch {
+		if (challengeKind !== "aws_waf") return false;
 	}
+
+	let target: URL;
+	try {
+		target = new URL(targetUrl);
+	} catch {
+		return false;
+	}
+	const hostname = normalizedResolverHostname(target.hostname);
+	return (
+		target.protocol === "https:" &&
+		hostname.length > AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX.length &&
+		hostname.endsWith(AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX)
+	);
 }
 
 const POOL_ALLOCATION_EXHAUSTED_CODES = new Set([
@@ -297,7 +361,7 @@ async function closeBrowserClient(
 export function createBrowserResolverVendorAdapter(
 	options: BrowserResolverVendorOptions,
 ): BrowserResolverVendorAdapter {
-	const createClient = options.createClient ?? createBrowserClient;
+	const createClient = options.createClient ?? createResolverBrowserClient;
 	const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_COOKIE_POLL_INTERVAL_MS;
 
 	return {
@@ -352,12 +416,15 @@ export function createBrowserResolverVendorAdapter(
 					cdpUrl: cdpUrl ?? "",
 					...(proxyUrl === undefined ? {} : { proxy: proxyUrl }),
 					requireCdpPool: cdpUrl !== undefined,
+					serviceWorkers: "block",
 				});
 				const contextOperation = client.withIsolatedContext(async (page) => {
 					handlerEntered = true;
 					return await solveInPage(
 						page,
+						challengeKind,
 						challenge.pageUrl,
+						options.allowedHosts,
 						SUCCESS_COOKIE_NAMES[challengeKind],
 						pollIntervalMs,
 						solveController.signal,