@arcjet/node 1.0.0-alpha.31 → 1.0.0-alpha.33

package/index.js

@@ -32,7 +32,7 @@ function createRemoteClient(options) {
     // Transport is the HTTP client that the client uses to make requests.
     const transport = createTransport(url);
     const sdkStack = "NODEJS";
-    const sdkVersion = "1.0.0-alpha.31";
+    const sdkVersion = "1.0.0-alpha.33";
     return createClient({
         transport,
         baseUrl: url,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcjet/node",
-  "version": "1.0.0-alpha.31",
+  "version": "1.0.0-alpha.33",
   "description": "Arcjet SDK for Node.js",
   "license": "Apache-2.0",
   "homepage": "https://arcjet.com",
@@ -29,7 +29,6 @@
     "README.md",
     "*.js",
     "*.d.ts",
-    "*.ts",
     "!*.config.js"
   ],
   "scripts": {
@@ -40,24 +39,24 @@
     "test": "NODE_OPTIONS=--experimental-vm-modules jest --passWithNoTests"
   },
   "dependencies": {
-    "@arcjet/env": "1.0.0-alpha.31",
-    "@arcjet/headers": "1.0.0-alpha.31",
-    "@arcjet/ip": "1.0.0-alpha.31",
-    "@arcjet/logger": "1.0.0-alpha.31",
-    "@arcjet/protocol": "1.0.0-alpha.31",
-    "@arcjet/transport": "1.0.0-alpha.31",
-    "@arcjet/body": "1.0.0-alpha.31",
-    "arcjet": "1.0.0-alpha.31"
+    "@arcjet/env": "1.0.0-alpha.33",
+    "@arcjet/headers": "1.0.0-alpha.33",
+    "@arcjet/ip": "1.0.0-alpha.33",
+    "@arcjet/logger": "1.0.0-alpha.33",
+    "@arcjet/protocol": "1.0.0-alpha.33",
+    "@arcjet/transport": "1.0.0-alpha.33",
+    "@arcjet/body": "1.0.0-alpha.33",
+    "arcjet": "1.0.0-alpha.33"
   },
   "devDependencies": {
-    "@arcjet/eslint-config": "1.0.0-alpha.31",
-    "@arcjet/rollup-config": "1.0.0-alpha.31",
-    "@arcjet/tsconfig": "1.0.0-alpha.31",
+    "@arcjet/eslint-config": "1.0.0-alpha.33",
+    "@arcjet/rollup-config": "1.0.0-alpha.33",
+    "@arcjet/tsconfig": "1.0.0-alpha.33",
     "@jest/globals": "29.7.0",
     "@types/node": "18.18.0",
-    "@rollup/wasm-node": "4.27.3",
+    "@rollup/wasm-node": "4.27.4",
     "jest": "29.7.0",
-    "typescript": "5.6.3"
+    "typescript": "5.7.2"
   },
   "publishConfig": {
     "access": "public",

package/index.ts

@@ -1,349 +0,0 @@
-import core from "arcjet";
-import type {
-  ArcjetDecision,
-  ArcjetOptions,
-  Primitive,
-  Product,
-  ArcjetRequest,
-  ExtraProps,
-  Arcjet,
-  CharacteristicProps,
-} from "arcjet";
-import findIP from "@arcjet/ip";
-import ArcjetHeaders from "@arcjet/headers";
-import { baseUrl, isDevelopment, logLevel, platform } from "@arcjet/env";
-import { Logger } from "@arcjet/logger";
-import { createClient } from "@arcjet/protocol/client.js";
-import { createTransport } from "@arcjet/transport";
-import { readBody } from "@arcjet/body";
-
-// Re-export all named exports from the generic SDK
-export * from "arcjet";
-
-// TODO: Deduplicate with other packages
-function errorMessage(err: unknown): string {
-  if (err) {
-    if (typeof err === "string") {
-      return err;
-    }
-
-    if (
-      typeof err === "object" &&
-      "message" in err &&
-      typeof err.message === "string"
-    ) {
-      return err.message;
-    }
-  }
-
-  return "Unknown problem";
-}
-
-// Type helpers from https://github.com/sindresorhus/type-fest but adjusted for
-// our use.
-//
-// Simplify:
-// https://github.com/sindresorhus/type-fest/blob/964466c9d59c711da57a5297ad954c13132a0001/source/simplify.d.ts
-// EmptyObject:
-// https://github.com/sindresorhus/type-fest/blob/b9723d4785f01f8d2487c09ee5871a1f615781aa/source/empty-object.d.ts
-//
-// Licensed: MIT License Copyright (c) Sindre Sorhus <sindresorhus@gmail.com>
-// (https://sindresorhus.com)
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal
-// in the Software without restriction, including without limitation the rights
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-// copies of the Software, and to permit persons to whom the Software is
-// furnished to do so, subject to the following conditions: The above copyright
-// notice and this permission notice shall be included in all copies or
-// substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-// SOFTWARE.
-type Simplify<T> = { [KeyType in keyof T]: T[KeyType] } & {};
-declare const emptyObjectSymbol: unique symbol;
-type WithoutCustomProps = {
-  [emptyObjectSymbol]?: never;
-};
-
-type PlainObject = {
-  [key: string]: unknown;
-};
-
-export type RemoteClientOptions = {
-  baseUrl?: string;
-  timeout?: number;
-};
-
-export function createRemoteClient(options?: RemoteClientOptions) {
-  // The base URL for the Arcjet API. Will default to the standard production
-  // API unless environment variable `ARCJET_BASE_URL` is set.
-  const url = options?.baseUrl ?? baseUrl(process.env);
-
-  // The timeout for the Arcjet API in milliseconds. This is set to a low value
-  // in production so calls fail open.
-  const timeout = options?.timeout ?? (isDevelopment(process.env) ? 1000 : 500);
-
-  // Transport is the HTTP client that the client uses to make requests.
-  const transport = createTransport(url);
-
-  const sdkStack = "NODEJS";
-  const sdkVersion = "__ARCJET_SDK_VERSION__";
-
-  return createClient({
-    transport,
-    baseUrl: url,
-    timeout,
-    sdkStack,
-    sdkVersion,
-  });
-}
-
-type EventHandlerLike = (
-  event: string,
-  listener: (...args: any[]) => void,
-) => void;
-
-// Interface of fields that the Arcjet Node.js SDK expects on `IncomingMessage`
-// objects.
-export interface ArcjetNodeRequest {
-  headers?: Record<string, string | string[] | undefined>;
-  socket?: Partial<{ remoteAddress: string; encrypted: boolean }>;
-  method?: string;
-  httpVersion?: string;
-  url?: string;
-  // Things needed for getting a body
-  body?: unknown;
-  on?: EventHandlerLike;
-  removeListener?: EventHandlerLike;
-  readable?: boolean;
-}
-
-function cookiesToString(cookies: string | string[] | undefined): string {
-  if (typeof cookies === "undefined") {
-    return "";
-  }
-
-  // This should never be the case with a Node.js cookie header, but we are safe
-  if (Array.isArray(cookies)) {
-    return cookies.join("; ");
-  }
-
-  return cookies;
-}
-
-/**
- * The ArcjetNode client provides a public `protect()` method to
- * make a decision about how a Node.js request should be handled.
- */
-export interface ArcjetNode<Props extends PlainObject> {
-  /**
-   * Runs a request through the configured protections. The request is
-   * analyzed and then a decision made on whether to allow, deny, or challenge
-   * the request.
-   *
-   * @param req - An `IncomingMessage` provided to the request handler.
-   * @param props - Additonal properties required for running rules against a request.
-   * @returns An {@link ArcjetDecision} indicating Arcjet's decision about the request.
-   */
-  protect(
-    request: ArcjetNodeRequest,
-    // We use this neat trick from https://stackoverflow.com/a/52318137 to make a single spread parameter
-    // that is required if the ExtraProps aren't strictly an empty object
-    ...props: Props extends WithoutCustomProps ? [] : [Props]
-  ): Promise<ArcjetDecision>;
-
-  /**
-   * Augments the client with another rule. Useful for varying rules based on
-   * criteria in your handler—e.g. different rate limit for logged in users.
-   *
-   * @param rule The rule to add to this execution.
-   * @returns An augmented {@link ArcjetNode} client.
-   */
-  withRule<Rule extends Primitive | Product>(
-    rule: Rule,
-  ): ArcjetNode<Simplify<Props & ExtraProps<Rule>>>;
-}
-
-/**
- * Create a new {@link ArcjetNode} client. Always build your initial client
- * outside of a request handler so it persists across requests. If you need to
- * augment a client inside a handler, call the `withRule()` function on the base
- * client.
- *
- * @param options - Arcjet configuration options to apply to all requests.
- */
-export default function arcjet<
-  const Rules extends (Primitive | Product)[],
-  const Characteristics extends readonly string[],
->(
-  options: ArcjetOptions<Rules, Characteristics>,
-): ArcjetNode<
-  Simplify<ExtraProps<Rules> & CharacteristicProps<Characteristics>>
-> {
-  const client = options.client ?? createRemoteClient();
-
-  const log = options.log
-    ? options.log
-    : new Logger({
-        level: logLevel(process.env),
-      });
-
-  function toArcjetRequest<Props extends PlainObject>(
-    request: ArcjetNodeRequest,
-    props: Props,
-  ): ArcjetRequest<Props> {
-    // We pull the cookies from the request before wrapping them in ArcjetHeaders
-    const cookies = cookiesToString(request.headers?.cookie);
-
-    // We construct an ArcjetHeaders to normalize over Headers
-    const headers = new ArcjetHeaders(request.headers);
-
-    let ip = findIP(
-      {
-        socket: request.socket,
-        headers,
-      },
-      { platform: platform(process.env) },
-    );
-    if (ip === "") {
-      // If the `ip` is empty but we're in development mode, we default the IP
-      // so the request doesn't fail.
-      if (isDevelopment(process.env)) {
-        log.warn("Using 127.0.0.1 as IP address in development mode");
-        ip = "127.0.0.1";
-      } else {
-        log.warn(
-          `Client IP address is missing. If this is a dev environment set the ARCJET_ENV env var to "development"`,
-        );
-      }
-    }
-    const method = request.method ?? "";
-    const host = headers.get("host") ?? "";
-    let path = "";
-    let query = "";
-    let protocol = "";
-
-    if (typeof request.socket?.encrypted !== "undefined") {
-      protocol = request.socket.encrypted ? "https:" : "http:";
-    } else {
-      protocol = "http:";
-    }
-
-    // Do some very simple validation, but also try/catch around URL parsing
-    if (
-      typeof request.url !== "undefined" &&
-      request.url !== "" &&
-      host !== ""
-    ) {
-      try {
-        const url = new URL(request.url, `${protocol}//${host}`);
-        path = url.pathname;
-        query = url.search;
-        protocol = url.protocol;
-      } catch {
-        // If the parsing above fails, just set the path as whatever url we
-        // received.
-        path = request.url ?? "";
-        log.warn('Unable to parse URL. Using "%s" as `path`.', path);
-      }
-    } else {
-      path = request.url ?? "";
-    }
-
-    return {
-      ...props,
-      ip,
-      method,
-      protocol,
-      host,
-      path,
-      headers,
-      cookies,
-      query,
-    };
-  }
-
-  function withClient<const Rules extends (Primitive | Product)[]>(
-    aj: Arcjet<ExtraProps<Rules>>,
-  ): ArcjetNode<ExtraProps<Rules>> {
-    return Object.freeze({
-      withRule(rule: Primitive | Product) {
-        const client = aj.withRule(rule);
-        return withClient(client);
-      },
-      async protect(
-        request: ArcjetNodeRequest,
-        ...[props]: ExtraProps<Rules> extends WithoutCustomProps
-          ? []
-          : [ExtraProps<Rules>]
-      ): Promise<ArcjetDecision> {
-        // TODO(#220): The generic manipulations get really mad here, so we cast
-        // Further investigation makes it seem like it has something to do with
-        // the definition of `props` in the signature but it's hard to track down
-        const req = toArcjetRequest(request, props ?? {}) as ArcjetRequest<
-          ExtraProps<Rules>
-        >;
-
-        const getBody = async () => {
-          try {
-            // If request.body is present then the body was likely read by a package like express' `body-parser`.
-            // If it's not present then we attempt to read the bytes from the IncomingMessage ourselves.
-            if (typeof request.body === "string") {
-              return request.body;
-            } else if (
-              typeof request.body !== "undefined" &&
-              // BigInt cannot be serialized with JSON.stringify
-              typeof request.body !== "bigint"
-            ) {
-              return JSON.stringify(request.body);
-            }
-
-            if (
-              typeof request.on === "function" &&
-              typeof request.removeListener === "function"
-            ) {
-              let expectedLength: number | undefined;
-              // TODO: This shouldn't need to build headers again but the type
-              // for `req` above is overly relaxed
-              const headers = new ArcjetHeaders(request.headers);
-              const expectedLengthStr = headers.get("content-length");
-              if (typeof expectedLengthStr === "string") {
-                try {
-                  expectedLength = parseInt(expectedLengthStr, 10);
-                } catch {
-                  // If the expected length couldn't be parsed we'll just not set one.
-                }
-              }
-              // Awaited to throw if it rejects and we'll just return undefined
-              const body = await readBody(request, {
-                // We will process 1mb bodies
-                limit: 1048576,
-                expectedLength,
-              });
-              return body;
-            }
-
-            log.warn("no body available");
-            return;
-          } catch (e) {
-            log.error("failed to get request body: %s", errorMessage(e));
-            return;
-          }
-        };
-
-        return aj.protect({ getBody }, req);
-      },
-    });
-  }
-
-  const aj = core({ ...options, client, log });
-
-  return withClient(aj);
-}