@appwarden/middleware 1.0.18 → 1.1.0

package/chunk-BHCQJZWE.js

@@ -0,0 +1,358 @@
+import {
+  APPWARDEN_CACHE_KEY,
+  APPWARDEN_TEST_ROUTE,
+  LockValue,
+  MemoryCache,
+  UseCSPInputSchema,
+  debug,
+  getErrors,
+  printMessage,
+  removedHeaders,
+  renderLockPage
+} from "./chunk-WVVSYKJM.js";
+
+// src/utils/cloudflare/cloudflare-cache.ts
+var store = {
+  json: (context, cacheKey, options) => {
+    const cacheKeyUrl = new URL(cacheKey, context.serviceOrigin);
+    return {
+      getValue: () => getCacheValue(context, cacheKeyUrl),
+      updateValue: (json) => updateCacheValue(
+        context,
+        cacheKeyUrl,
+        json,
+        options?.cacheExpirationSeconds
+      ),
+      deleteValue: () => clearCache(context, cacheKeyUrl)
+    };
+  }
+};
+var getCacheValue = async (context, cacheKey) => {
+  const match = await context.cache.match(cacheKey);
+  if (!match) {
+    debug(`[${cacheKey.pathname}] Cache MISS!`);
+    return void 0;
+  }
+  debug(`[${cacheKey.pathname}] Cache MATCH!`);
+  return match;
+};
+var updateCacheValue = async (context, cacheKey, value, cacheExpirationSeconds) => {
+  debug(
+    "updating cache...",
+    cacheKey.pathname,
+    value,
+    cacheExpirationSeconds ? `expires in ${cacheExpirationSeconds}s` : ""
+  );
+  await context.cache.put(
+    cacheKey,
+    new Response(JSON.stringify(value), {
+      headers: {
+        "content-type": "application/json",
+        ...cacheExpirationSeconds && {
+          "cache-control": `max-age=${cacheExpirationSeconds}`
+        }
+      }
+    })
+  );
+};
+var clearCache = (context, cacheKey) => context.cache.delete(cacheKey);
+
+// src/utils/cloudflare/delete-edge-value.ts
+var deleteEdgeValue = async (context) => {
+  try {
+    switch (context.provider) {
+      case "cloudflare-cache": {
+        const success = await context.edgeCache.deleteValue();
+        if (!success) {
+          throw new Error();
+        }
+        break;
+      }
+      default:
+        throw new Error(`Unsupported provider: ${context.provider}`);
+    }
+  } catch (e) {
+    const message = "Failed to delete edge value";
+    console.error(
+      printMessage(e instanceof Error ? `${message} - ${e.message}` : message)
+    );
+  }
+};
+
+// src/utils/cloudflare/get-lock-value.ts
+var getLockValue = async (context) => {
+  try {
+    let shouldDeleteEdgeValue = false;
+    let cacheResponse, lockValue = {
+      isLockedTest: 0,
+      isLocked: 0,
+      lastCheck: Date.now(),
+      code: ""
+    };
+    switch (context.provider) {
+      case "cloudflare-cache": {
+        cacheResponse = await context.edgeCache.getValue();
+        break;
+      }
+      default:
+        throw new Error(`Unsupported provider: ${context.provider}`);
+    }
+    if (!cacheResponse) {
+      return { lockValue: void 0 };
+    }
+    try {
+      const clonedResponse = cacheResponse?.clone();
+      lockValue = LockValue.parse(
+        clonedResponse ? await clonedResponse.json() : void 0
+      );
+    } catch (error) {
+      console.error(
+        printMessage(
+          `Failed to parse ${context.keyName} from edge cache - ${error}`
+        )
+      );
+      shouldDeleteEdgeValue = true;
+    }
+    return { lockValue, shouldDeleteEdgeValue };
+  } catch (e) {
+    const message = "Failed to retrieve edge value";
+    console.error(
+      printMessage(e instanceof Error ? `${message} - ${e.message}` : message)
+    );
+    return { lockValue: void 0 };
+  }
+};
+
+// src/utils/cloudflare/insert-errors-logs.ts
+var insertErrorLogs = async (context, error) => new HTMLRewriter().on("body", {
+  element: (elem) => {
+    elem.append(
+      `<script>
+            ${getErrors(error).map((err) => `console.error(\`${printMessage(err)}\`)`).join("\n")}
+          </script>`,
+      { html: true }
+    );
+  }
+}).transform(await fetch(context.request));
+
+// src/utils/cloudflare/make-csp-header.ts
+var addNonce = (value, cspNonce) => value.replace("{{nonce}}", `'nonce-${cspNonce}'`);
+var makeCSPHeader = (cspNonce, directives, mode) => {
+  const namesSeen = /* @__PURE__ */ new Set(), result = [];
+  Object.entries(directives ?? {}).forEach(([originalName, value]) => {
+    const name = originalName.replace(/([a-z])([A-Z])/g, "$1-$2").toLowerCase();
+    if (namesSeen.has(name)) {
+      throw new Error(`${originalName} is specified more than once`);
+    }
+    namesSeen.add(name);
+    if (Array.isArray(value)) {
+      value = addNonce(value.join(" "), cspNonce);
+    } else if (value === true) {
+      value = "";
+    }
+    if (value) {
+      result.push(`${name} ${addNonce(value, cspNonce)}`);
+    } else if (value !== false) {
+      result.push(name);
+    }
+  });
+  return [
+    mode === "enforced" ? "Content-Security-Policy" : "Content-Security-Policy-Report-Only",
+    result.join("; ")
+  ];
+};
+
+// src/utils/cloudflare/sync-edge-value.ts
+var APIError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "APIError";
+  }
+};
+var syncEdgeValue = async (context) => {
+  debug(`syncing with api`);
+  try {
+    const response = await fetch(new URL("/v1/status/check", "https://bot-gateway.appwarden.io"), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        service: "cloudflare",
+        provider: context.provider,
+        fqdn: context.requestUrl.hostname,
+        appwardenApiToken: context.appwardenApiToken
+      })
+    });
+    if (response.status !== 200) {
+      throw new Error(`${response.status} ${response.statusText}`);
+    }
+    if (response.headers.get("content-type")?.includes("application/json")) {
+      const result = await response.json();
+      if (result.error) {
+        throw new APIError(result.error.message);
+      }
+      if (result.content) {
+        try {
+          const parsedValue = LockValue.omit({ lastCheck: true }).parse(
+            result.content
+          );
+          debug(
+            `syncing with api...DONE ${JSON.stringify(parsedValue, null, 2)}`
+          );
+          await context.edgeCache.updateValue({
+            ...parsedValue,
+            lastCheck: Date.now()
+          });
+        } catch (error) {
+          throw new APIError(`Failed to parse check endpoint result - ${error}`);
+        }
+      }
+    }
+  } catch (e) {
+    const message = "Failed to fetch from check endpoint";
+    console.error(
+      printMessage(
+        e instanceof APIError ? e.message : e instanceof Error ? `${message} - ${e.message}` : message
+      )
+    );
+  }
+};
+
+// src/middlewares/use-content-security-policy.ts
+var AppendAttribute = (attribute, nonce) => ({
+  element: function(element) {
+    element.setAttribute(attribute, nonce);
+  }
+});
+var useContentSecurityPolicy = (input) => {
+  const parsedInput = UseCSPInputSchema.safeParse(input);
+  if (!parsedInput.success) {
+    throw parsedInput.error;
+  }
+  const config = parsedInput.data;
+  return async (context, next) => {
+    await next();
+    const { response } = context;
+    if (
+      // if the csp is disabled
+      !["enforced", "report-only"].includes(config.mode)
+    ) {
+      debug(printMessage("csp is disabled"));
+      return;
+    }
+    if (response.headers.has("Content-Type") && !response.headers.get("Content-Type")?.includes("text/html")) {
+      return;
+    }
+    const cspNonce = btoa(crypto.getRandomValues(new Uint32Array(2)).toString());
+    const [cspHeaderName, cspHeaderValue] = makeCSPHeader(
+      cspNonce,
+      config.directives,
+      config.mode
+    );
+    const nextResponse = new Response(response.body, response);
+    nextResponse.headers.set(cspHeaderName, cspHeaderValue);
+    nextResponse.headers.set("content-type", "text/html; charset=utf-8");
+    removedHeaders.forEach((name) => {
+      nextResponse.headers.delete(name);
+    });
+    context.response = new HTMLRewriter().on("style", AppendAttribute("nonce", cspNonce)).on("script", AppendAttribute("nonce", cspNonce)).transform(nextResponse);
+  };
+};
+
+// src/handlers/maybe-quarantine.ts
+var resolveLockValue = async (context, options) => {
+  const { lockValue, shouldDeleteEdgeValue } = await getLockValue(context);
+  if (shouldDeleteEdgeValue) {
+    await deleteEdgeValue(context);
+  }
+  if (lockValue?.isLocked || context.requestUrl.pathname === APPWARDEN_TEST_ROUTE && !MemoryCache.isTestExpired(lockValue)) {
+    await options.onLocked();
+  }
+  return lockValue;
+};
+var maybeQuarantine = async (context, options) => {
+  const cachedLockValue = await resolveLockValue(context, {
+    onLocked: options.onLocked
+  });
+  const shouldRecheck = MemoryCache.isExpired(cachedLockValue);
+  if (shouldRecheck) {
+    if (!cachedLockValue || cachedLockValue.isLocked) {
+      await syncEdgeValue(context);
+      await resolveLockValue(context, {
+        onLocked: options.onLocked
+      });
+    } else {
+      context.waitUntil(syncEdgeValue(context));
+    }
+  }
+};
+
+// src/handlers/reset-cache.ts
+var isResetCacheRequest = (request) => request.method === "POST" && new URL(request.url).pathname === "/__appwarden/reset-cache" && request.headers.get("content-type") === "application/json";
+var handleResetCache = async (keyName, provider, edgeCache, request) => {
+  const { lockValue } = await getLockValue({
+    keyName,
+    provider,
+    edgeCache
+  });
+  try {
+    const body = await request.clone().json();
+    if (body.code === lockValue?.code) {
+      await edgeCache.deleteValue();
+    }
+  } catch (error) {
+  }
+};
+
+// src/middlewares/use-appwarden.ts
+var useAppwarden = (input) => async (context, next) => {
+  await next();
+  const { request, response } = context;
+  try {
+    const requestUrl = new URL(request.url);
+    const provider = "cloudflare-cache";
+    const keyName = APPWARDEN_CACHE_KEY;
+    const edgeCache = store.json(
+      {
+        serviceOrigin: requestUrl.origin,
+        cache: await caches.open("appwarden:lock")
+      },
+      keyName
+    );
+    if (isResetCacheRequest(request)) {
+      await handleResetCache(keyName, provider, edgeCache, request);
+      return;
+    }
+    const isHTMLRequest = response.headers.get("Content-Type")?.includes("text/html");
+    if (isHTMLRequest) {
+      const innerContext = {
+        keyName,
+        request,
+        edgeCache,
+        requestUrl,
+        provider,
+        debug: input.debug,
+        lockPageSlug: input.lockPageSlug,
+        appwardenApiToken: input.appwardenApiToken,
+        waitUntil: (fn) => context.waitUntil(fn)
+      };
+      await maybeQuarantine(innerContext, {
+        onLocked: async () => {
+          context.response = await renderLockPage(innerContext);
+        }
+      });
+    }
+  } catch (e) {
+    const message = "Appwarden encountered an unknown error. Please contact Appwarden support at https://appwarden.io/join-community.";
+    console.error(
+      printMessage(
+        e instanceof Error ? `${message} - ${e.message}` : message
+      )
+    );
+  }
+};
+
+export {
+  insertErrorLogs,
+  useAppwarden,
+  useContentSecurityPolicy
+};