@apifuse/provider-sdk 2.2.0-beta.7 → 2.2.0-beta.70

package/dist/runtime/redirect-hop-headers.d.ts

@@ -0,0 +1,19 @@
+/** One redirect hop: the URL the headers were sent to, and the next request. */
+export interface RedirectHop {
+    readonly from: string;
+    readonly to: string;
+    readonly methodChanged: boolean;
+}
+/**
+ * The caller headers the next redirect hop carries, derived from the headers
+ * the previous hop sent. Both stealth redirect walkers compute every hop's
+ * headers here, so the rules hold on every path:
+ *
+ * - a method change drops the request-body headers;
+ * - a cross-origin hop drops `Authorization` and `Proxy-Authorization`;
+ * - a cross-site hop drops an explicit `Cookie`, after which the session
+ *   cookie jar supplies cookies by its own domain rules, as a browser does.
+ *
+ * A header dropped on one hop stays dropped for the rest of the chain.
+ */
+export declare function redirectHopHeaders<T>(hop: RedirectHop, headers: Readonly<Record<string, T>>): Record<string, T>;

package/dist/runtime/redirect-hop-headers.js

@@ -0,0 +1,58 @@
+import { getPublicSuffix } from "tough-cookie";
+/**
+ * Request-body header names a redirect drops when it changes the method
+ * (Fetch "request-body-header name").
+ */
+const REDIRECT_BODY_HEADERS = new Set([
+    "content-encoding",
+    "content-language",
+    "content-location",
+    "content-type",
+]);
+/**
+ * Credentials a redirect never carries to another origin. Fetch removes
+ * `Authorization` on a cross-origin redirect; `Proxy-Authorization` is a
+ * credential of the same kind.
+ */
+const CROSS_ORIGIN_CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "proxy-authorization",
+]);
+/**
+ * Schemeful site (HTML "same site"): scheme plus registrable domain from the
+ * public suffix list, or the bare host when there is none (an IP address or
+ * a single-label host).
+ */
+function schemefulSite(url) {
+    const host = url.hostname;
+    const registrable = getPublicSuffix(host, { allowSpecialUseDomain: true, ignoreError: true });
+    return `${url.protocol}//${registrable ?? host}`;
+}
+/**
+ * The caller headers the next redirect hop carries, derived from the headers
+ * the previous hop sent. Both stealth redirect walkers compute every hop's
+ * headers here, so the rules hold on every path:
+ *
+ * - a method change drops the request-body headers;
+ * - a cross-origin hop drops `Authorization` and `Proxy-Authorization`;
+ * - a cross-site hop drops an explicit `Cookie`, after which the session
+ *   cookie jar supplies cookies by its own domain rules, as a browser does.
+ *
+ * A header dropped on one hop stays dropped for the rest of the chain.
+ */
+export function redirectHopHeaders(hop, headers) {
+    const from = new URL(hop.from);
+    const to = new URL(hop.to);
+    const crossOrigin = from.origin !== to.origin;
+    const crossSite = schemefulSite(from) !== schemefulSite(to);
+    return Object.fromEntries(Object.entries(headers).filter(([name]) => {
+        const lower = name.toLowerCase();
+        if (hop.methodChanged && REDIRECT_BODY_HEADERS.has(lower))
+            return false;
+        if (crossOrigin && CROSS_ORIGIN_CREDENTIAL_HEADERS.has(lower))
+            return false;
+        if (crossSite && lower === "cookie")
+            return false;
+        return true;
+    }));
+}

package/dist/runtime/redirects.d.ts

@@ -0,0 +1,61 @@
+import { TransportError } from "../errors.js";
+import type { HttpRedirectFailureReason, HttpRedirectPolicy } from "../types.js";
+export type RedirectHopDecision<TMethod extends string> = {
+    kind: "follow";
+    nextMethod: TMethod | "GET";
+    nextUrl: string;
+} | {
+    kind: "stop";
+    reason: HttpRedirectFailureReason;
+    nextUrl?: string;
+};
+export declare function isRedirectStatus(status: number): boolean;
+/** Shared fetch-compatible redirect method rewriting for stealth and ctx.http. */
+export declare function nextRedirectMethod<TMethod extends string>(status: number, method: TMethod): TMethod | "GET";
+/** Resolves a Location value against the response URL without issuing a request. */
+export declare function resolveRedirectUrl(location: string | undefined, responseUrl: string): string | undefined;
+/**
+ * Shared post-response decision ordering for both redirect walkers. The
+ * caller-owned stop hook is checked first, matching stealth's pre-follow
+ * contract, then structural termination and loop checks run before follow.
+ */
+export declare function evaluateRedirectHop<TMethod extends string>(input: {
+    status: number;
+    method: TMethod;
+    nextUrl: string | undefined;
+    shouldStop: boolean;
+    redirectCount: number;
+    maxHops: number;
+    visitedRequests: ReadonlySet<string>;
+}): RedirectHopDecision<TMethod>;
+export declare const MALFORMED_REDIRECT_TARGET = "[malformed redirect target]";
+/** The transport a redirectPolicy belongs to: its name in diagnostics and its own hop limit. */
+export interface RedirectPolicyTransport {
+    readonly label: string;
+    readonly maxHops: number;
+}
+export declare function invalidRedirectPolicy(transport: RedirectPolicyTransport, message: string, cause?: Error): TransportError;
+/** Snapshot untrusted caller input synchronously, before proxy resolution or fetch. */
+export declare function normalizeRedirectPolicy(value: unknown, transport: RedirectPolicyTransport): HttpRedirectPolicy | undefined;
+export declare function redirectDiagnosticTarget(value: string): string;
+/**
+ * One hop of a same-origin `redirectPolicy` walk, shared by ctx.http and
+ * ctx.stealth so both follow and refuse identically: returns the next request
+ * inside the initial origin, or throws the `HttpRedirectError` naming why the
+ * walk stopped (cross-origin target, maxHops, loop, missing or malformed
+ * Location) before any request leaves for that target.
+ */
+export declare function nextSameOriginRedirectHop<TMethod extends string>(input: {
+    policy: HttpRedirectPolicy;
+    initialOrigin: string;
+    currentUrl: string;
+    responseUrl: string;
+    status: number;
+    method: TMethod;
+    location: string | undefined;
+    followedHops: number;
+    visitedRequests: ReadonlySet<string>;
+}): {
+    nextMethod: TMethod | "GET";
+    nextUrl: string;
+};

package/dist/runtime/redirects.js

@@ -0,0 +1,149 @@
+import { HttpRedirectError, TransportError } from "../errors.js";
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+export function isRedirectStatus(status) {
+    return REDIRECT_STATUSES.has(status);
+}
+/** Shared fetch-compatible redirect method rewriting for stealth and ctx.http. */
+export function nextRedirectMethod(status, method) {
+    if (status === 303 && method !== "HEAD")
+        return "GET";
+    if ((status === 301 || status === 302) && method === "POST")
+        return "GET";
+    return method;
+}
+/** Resolves a Location value against the response URL without issuing a request. */
+export function resolveRedirectUrl(location, responseUrl) {
+    return location ? new URL(location, responseUrl).toString() : undefined;
+}
+/**
+ * Shared post-response decision ordering for both redirect walkers. The
+ * caller-owned stop hook is checked first, matching stealth's pre-follow
+ * contract, then structural termination and loop checks run before follow.
+ */
+export function evaluateRedirectHop(input) {
+    if (input.shouldStop) {
+        return { kind: "stop", reason: "stopped", ...(input.nextUrl ? { nextUrl: input.nextUrl } : {}) };
+    }
+    if (!input.nextUrl)
+        return { kind: "stop", reason: "missing_location" };
+    if (input.redirectCount > input.maxHops) {
+        return { kind: "stop", reason: "max_hops", nextUrl: input.nextUrl };
+    }
+    const nextMethod = nextRedirectMethod(input.status, input.method);
+    if (input.visitedRequests.has(`${nextMethod} ${input.nextUrl}`)) {
+        return { kind: "stop", reason: "loop", nextUrl: input.nextUrl };
+    }
+    return { kind: "follow", nextMethod, nextUrl: input.nextUrl };
+}
+const REDIRECT_POLICY_FIELDS = new Set(["mode", "maxHops"]);
+export const MALFORMED_REDIRECT_TARGET = "[malformed redirect target]";
+export function invalidRedirectPolicy(transport, message, cause) {
+    return new TransportError(`Invalid ${transport.label} redirectPolicy: ${message}`, {
+        code: "http_redirect_policy_invalid",
+        ...(cause ? { cause } : {}),
+    });
+}
+/** Snapshot untrusted caller input synchronously, before proxy resolution or fetch. */
+export function normalizeRedirectPolicy(value, transport) {
+    if (value === undefined)
+        return undefined;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw invalidRedirectPolicy(transport, "expected an object");
+    }
+    try {
+        const keys = Reflect.ownKeys(value);
+        for (const key of keys) {
+            if (typeof key !== "string" || !REDIRECT_POLICY_FIELDS.has(key)) {
+                throw invalidRedirectPolicy(transport, `unknown field ${String(key)}`);
+            }
+        }
+        for (const field of REDIRECT_POLICY_FIELDS) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, field);
+            if (!descriptor || !("value" in descriptor)) {
+                throw invalidRedirectPolicy(transport, `${field} must be an own data property`);
+            }
+        }
+        const record = value;
+        if (record.mode !== "same-origin") {
+            throw invalidRedirectPolicy(transport, 'mode must be "same-origin"');
+        }
+        if (typeof record.maxHops !== "number" ||
+            !Number.isInteger(record.maxHops) ||
+            record.maxHops < 0 ||
+            record.maxHops > transport.maxHops) {
+            throw invalidRedirectPolicy(transport, `maxHops must be an integer from 0 to ${transport.maxHops}`);
+        }
+        return { mode: "same-origin", maxHops: record.maxHops };
+    }
+    catch (error) {
+        if (error instanceof TransportError)
+            throw error;
+        throw invalidRedirectPolicy(transport, "could not be inspected safely", error instanceof Error ? error : undefined);
+    }
+}
+export function redirectDiagnosticTarget(value) {
+    try {
+        const parsed = new URL(value);
+        // Origin omits URL userinfo. Keeping only origin + path makes diagnostics
+        // useful while structurally excluding every query value and fragment,
+        // including attacker-chosen keys the provider did not declare sensitive.
+        const redactedQuery = parsed.search ? "?[REDACTED]" : "";
+        return parsed.origin === "null"
+            ? `${parsed.protocol}<opaque-target>`
+            : `${parsed.origin}${parsed.pathname}${redactedQuery}`;
+    }
+    catch {
+        return MALFORMED_REDIRECT_TARGET;
+    }
+}
+/**
+ * One hop of a same-origin `redirectPolicy` walk, shared by ctx.http and
+ * ctx.stealth so both follow and refuse identically: returns the next request
+ * inside the initial origin, or throws the `HttpRedirectError` naming why the
+ * walk stopped (cross-origin target, maxHops, loop, missing or malformed
+ * Location) before any request leaves for that target.
+ */
+export function nextSameOriginRedirectHop(input) {
+    let nextUrl;
+    try {
+        nextUrl = resolveRedirectUrl(input.location || undefined, input.responseUrl);
+    }
+    catch {
+        const target = MALFORMED_REDIRECT_TARGET;
+        throw new HttpRedirectError(`Redirect response has malformed Location target ${target}`, {
+            reason: "missing_location",
+            target,
+            status: input.status,
+        });
+    }
+    const decision = evaluateRedirectHop({
+        status: input.status,
+        method: input.method,
+        nextUrl,
+        shouldStop: nextUrl ? new URL(nextUrl).origin !== input.initialOrigin : false,
+        redirectCount: input.followedHops + 1,
+        maxHops: input.policy.maxHops,
+        visitedRequests: input.visitedRequests,
+    });
+    if (decision.kind === "follow") {
+        return { nextMethod: decision.nextMethod, nextUrl: decision.nextUrl };
+    }
+    const target = decision.nextUrl ? redirectDiagnosticTarget(decision.nextUrl) : undefined;
+    const message = (() => {
+        switch (decision.reason) {
+            case "stopped":
+                return `Redirect policy refused cross-origin target ${target}`;
+            case "max_hops":
+                return `Redirect policy reached maxHops before target ${target}`;
+            case "loop":
+                return `Redirect loop refused target ${target}`;
+            case "missing_location":
+                return `Redirect response from ${redirectDiagnosticTarget(input.currentUrl)} is missing Location`;
+        }
+    })();
+    throw new HttpRedirectError(message, {
+        reason: decision.reason,
+        ...(target ? { target } : {}),
+        status: input.status,
+    });
+}

package/dist/runtime/redis.d.ts

@@ -1,4 +1,4 @@
-import { Redis } from "ioredis";
+import type { Redis } from "ioredis";
 export type ProviderRedisClient = Redis;
 export type ProviderRedisClientOptions = {
     readonly redisUrl: string;

package/dist/runtime/redis.js

@@ -1,6 +1,8 @@
-import { Redis } from "ioredis";
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
 export function createProviderRedisClient(options) {
-    const redis = new Redis(options.redisUrl, {
+    const { Redis: RedisClient } = require("ioredis");
+    const redis = new RedisClient(options.redisUrl, {
         connectTimeout: options.timeoutMs,
         enableOfflineQueue: false,
         lazyConnect: true,

package/dist/runtime/request-options.d.ts

@@ -1,3 +1,77 @@
-import type { RequestParams } from "../types.js";
+import type { HttpClient, RequestOptions, RequestParams } from "../types.js";
+export declare const REDACTED_QUERY_VALUE = "[REDACTED]";
+/** Internal heuristic shared by diagnostic and fixture structural redaction. */
+export declare function isSensitiveKey(key: string): boolean;
+declare const HTTP_REQUEST_METHOD_CONFIG: {
+    readonly request: {
+        readonly optionsIndex: 1;
+    };
+    readonly get: {
+        readonly optionsIndex: 1;
+    };
+    readonly post: {
+        readonly optionsIndex: 2;
+    };
+    readonly put: {
+        readonly optionsIndex: 2;
+    };
+    readonly delete: {
+        readonly optionsIndex: 1;
+    };
+    readonly stream: {
+        readonly optionsIndex: 1;
+    };
+    readonly sse: {
+        readonly optionsIndex: 1;
+    };
+};
+export type HttpRequestMethod = keyof typeof HTTP_REQUEST_METHOD_CONFIG;
+export type HttpRequestInvocation = {
+    [M in HttpRequestMethod]: {
+        method: M;
+        args: Parameters<HttpClient[M]>;
+    };
+}[HttpRequestMethod];
+export declare const HTTP_REQUEST_METHOD_NAMES: HttpRequestMethod[];
+export declare function isHttpRequestMethod(method: PropertyKey): method is HttpRequestMethod;
+export type SerializedRequestUrl = {
+    requestUrl: string;
+    redactedUrl: string;
+    sensitiveValues: readonly string[];
+};
+export declare function normalizeSensitiveParams(sensitiveParams?: Record<string, string>): Record<string, string> | undefined;
 export declare function appendQueryParams(url: string, params?: RequestParams): string;
+/** Redacts matching query keys without reserializing any other URL bytes. */
+export declare function redactUrlQueryParams(url: string, sensitiveParamNames: readonly string[]): {
+    redactedUrl: string;
+    sensitiveValues: readonly string[];
+};
+/**
+ * Serializes public and secret query parameters together while constructing a
+ * separate, structurally redacted URL for diagnostics and observability.
+ */
+export declare function serializeRequestUrl(url: string, params?: RequestParams, sensitiveParams?: Record<string, string>): SerializedRequestUrl;
+export declare function normalizePercentEscapes(value: string): string;
+export type SensitiveValueVariant = {
+    value: string;
+    requiresTokenBoundary: boolean;
+    caseInsensitive: boolean;
+};
+export declare function allSensitiveValueVariants(sensitiveValues: readonly string[]): SensitiveValueVariant[];
+/** Scrubs raw and URL-encoded secret values from diagnostic text. */
+export declare function redactSensitiveText(text: string, sensitiveValues: readonly string[], requestUrl?: string, redactedUrl?: string): string;
+/**
+ * Redacts error text and recursively serializable diagnostic metadata.
+ * Mutable errors retain identity; readonly/frozen errors may be replaced, so
+ * callers must use the returned value.
+ */
+export declare function redactSensitiveError<T>(error: T, sensitiveValues: readonly string[], requestUrl?: string, redactedUrl?: string): T;
+/** Redacts failures that occur before a request URL can be fully serialized. */
+export declare function redactSensitiveRequestError<T>(error: T, url: string, sensitiveParams?: Record<string, string>): T;
+/** Validates an untyped proxy invocation before narrowing it to the HttpClient contract. */
+export declare function parseHttpRequestInvocation(method: PropertyKey, args: unknown[]): HttpRequestInvocation | undefined;
+/** Internal typed registry for the request-options position of HttpClient calls. */
+export declare function requestOptionsFromHttpInvocation(invocation: HttpRequestInvocation): RequestOptions | undefined;
+export declare function replaceRequestOptionsInHttpInvocation(invocation: HttpRequestInvocation, options: RequestOptions): void;
 export declare function normalizeHttpRequestBody(body: unknown): string | Buffer | undefined;
+export {};