@apitap/core 1.4.0 → 1.4.2

package/src/skill/validate.ts

@@ -25,14 +25,26 @@ export function validateSkillFile(raw: unknown, options?: { checkSsrf?: boolean
   if (typeof obj.baseUrl !== 'string') {
     throw new Error('Missing baseUrl');
   }
+  let baseUrlHostname: string;
   try {
     const url = new URL(obj.baseUrl);
     if (url.protocol !== 'http:' && url.protocol !== 'https:') {
       throw new Error('non-HTTP scheme');
     }
+    baseUrlHostname = url.hostname;
   } catch {
     throw new Error(`Invalid baseUrl: must be a valid HTTP(S) URL`);
   }
+
+  // Domain-lock: baseUrl hostname must match or be a subdomain of domain (C1 fix)
+  const domainStr = obj.domain as string;
+  if (baseUrlHostname !== domainStr && !baseUrlHostname.endsWith('.' + domainStr)) {
+    throw new Error(
+      `baseUrl hostname "${baseUrlHostname}" does not match domain "${domainStr}". ` +
+      `Skill files cannot redirect requests to unrelated hosts.`
+    );
+  }
+
   if (options?.checkSsrf) {
     const ssrf = validateUrl(obj.baseUrl);
     if (!ssrf.safe) {
@@ -66,6 +78,42 @@ export function validateSkillFile(raw: unknown, options?: { checkSsrf?: boolean
     if (e.path.length > 2000) {
       throw new Error(`Endpoint ${i}: path exceeds 2000 characters`);
     }
+
+    // M11: Deep type validation on nested structures
+    if ('headers' in e && e.headers !== undefined) {
+      if (typeof e.headers !== 'object' || e.headers === null || Array.isArray(e.headers)) {
+        throw new Error(`Endpoint ${i}: headers must be an object`);
+      }
+      for (const [hk, hv] of Object.entries(e.headers as Record<string, unknown>)) {
+        if (typeof hv !== 'string') {
+          throw new Error(`Endpoint ${i}: header "${hk}" value must be a string`);
+        }
+      }
+    }
+
+    if ('queryParams' in e && e.queryParams !== undefined) {
+      if (typeof e.queryParams !== 'object' || e.queryParams === null || Array.isArray(e.queryParams)) {
+        throw new Error(`Endpoint ${i}: queryParams must be an object`);
+      }
+      for (const [qk, qv] of Object.entries(e.queryParams as Record<string, unknown>)) {
+        if (typeof qv !== 'object' || qv === null || typeof (qv as any).example !== 'string') {
+          throw new Error(`Endpoint ${i}: queryParam "${qk}" must have a string example`);
+        }
+      }
+    }
+
+    if ('requestBody' in e && e.requestBody !== undefined) {
+      const rb = e.requestBody as Record<string, unknown>;
+      if (typeof rb !== 'object' || rb === null) {
+        throw new Error(`Endpoint ${i}: requestBody must be an object`);
+      }
+      if (typeof rb.contentType !== 'string') {
+        throw new Error(`Endpoint ${i}: requestBody.contentType must be a string`);
+      }
+      if (rb.variables !== undefined && !Array.isArray(rb.variables)) {
+        throw new Error(`Endpoint ${i}: requestBody.variables must be an array`);
+      }
+    }
   }
 
   return raw as SkillFile;