@authhero/proxy 0.10.4 → 0.10.6

package/dist/proxy.d.ts

@@ -183,6 +183,7 @@ declare const forwardedHeadersHandler: HandlerDefinition<{
     client_ip_header: string;
     set_x_real_ip: boolean;
     set_x_original_url: boolean;
+    skip_cloudflare_client_ip: boolean;
 }>;
 
 declare const rewriteCookiesHandler: HandlerDefinition<{
@@ -236,6 +237,33 @@ interface ProxyHostContext {
     domain: string;
 }
 
+declare const FORWARDED_HEADERS_HANDLER_TYPE = "forwarded_headers";
+/**
+ * Minimal shape shared by stored route handlers (`HandlerConfig`) and the
+ * catch-all specs passed to the data plane (`ProxyRouteHandlerSpec`).
+ */
+interface HandlerSpecLike {
+    type: string;
+    options?: unknown;
+}
+/**
+ * Guarantee a `forwarded_headers` handler at the head of a chain. Stored route
+ * tables (KV / control plane) predate the handler and routinely omit it, which
+ * silently drops the visitor IP: nothing else in the chain stamps
+ * X-Forwarded-For / X-Real-IP, so upstreams see only the proxy hop's own
+ * source address. Chains that already declare it — anywhere in the list — are
+ * returned untouched so their configured options win and nothing is stamped
+ * twice. Prefer `withForwardedHeadersFor`, which also checks that the registry
+ * knows the handler.
+ */
+declare function withForwardedHeaders(handlers: readonly HandlerSpecLike[]): HandlerSpecLike[];
+/**
+ * `withForwardedHeaders`, but a no-op unless `registry` knows the handler — a
+ * consumer with a bespoke registry that never registered it would otherwise
+ * get a build-time throw on every route. Every chain the data plane compiles
+ * (per-host routes and the `defaultHandlers` catch-all) goes through here.
+ */
+declare function withForwardedHeadersFor(registry: HandlerRegistry, handlers: readonly HandlerSpecLike[]): HandlerSpecLike[];
 /**
  * Build a Hono app whose route table mirrors the configured proxy routes for
  * a single host. Compiled once per host (and cached alongside the resolved
@@ -245,12 +273,23 @@ interface ProxyHostContext {
  * `handlers/util.ts`). Handlers that template against those values
  * (`dispatch_namespace`) depend on this wiring.
  *
+ * Every route's handler chain is normalized through
+ * `withForwardedHeadersFor`, so a stored route table that omits
+ * `forwarded_headers` still forwards the visitor IP.
+ *
  * `defaultHandlers` is a prebuilt middleware chain installed as the catch-all
  * when no per-host route matches. Pass `undefined` to keep the legacy 404
- * "No matching route" behavior.
+ * "No matching route" behavior. It is built by the caller (`router.ts`), which
+ * applies `withForwardedHeadersFor` to it as well.
  */
 declare function compileHostApp(routes: ProxyRoute[], registry: HandlerRegistry, hostContext?: ProxyHostContext, defaultHandlers?: MiddlewareHandler[]): Hono;
 
+/**
+ * True when `ip` falls inside a Cloudflare-published range. Unparseable input
+ * returns false — callers treat "not recognizably Cloudflare" as a client IP.
+ */
+declare function isCloudflareIp(ip: string): boolean;
+
 declare function sortRoutes(routes: ProxyRoute[]): ProxyRoute[];
 /**
  * Match a configured host pattern against a request's `Host`. Supports
@@ -394,5 +433,5 @@ declare function createKvProxyAdapter(options: KvProxyAdapterOptions): ProxyData
  */
 declare const PROXY_RESOLVE_HOST_SCOPE = "proxy:resolve_host";
 
-export { DEFAULT_KV_HOST_KEY_PREFIX, HandlerRegistry, PROXY_RESOLVE_HOST_SCOPE, basicAuthHandler, buildCacheAdapterKey, buildCacheApiKey, buildKvHostKey, buildMatchFilter, cacheHandler, compileHostApp, corsHandler, createCacheAdapterHostCache, createCacheApiHostCache, createHttpProxyAdapter, createInMemoryHostCache, createKvProxyAdapter, createProxyApp, createProxyDataPlaneHandler, createProxyDataPlaneRouter, createServiceBindingFetch, createStaticProxyAdapter, defineHandler, dispatchNamespaceHandler, forwardedHeadersHandler, headersHandler, httpHandler, httpRoute, matchesAnyHost, matchesHost, redirectHandler, registerBuiltinHandlers, rewriteCookiesHandler, rewriteLocationHandler, serviceBindingHandler, sortRoutes, staticHandler };
-export type { CacheAdapterHostCacheOptions, CacheApiHostCacheOptions, HandlerBuildContext, HandlerDefinition, HostCacheOptions, HostResolverCache, HttpProxyAdapterOptions, KvNamespaceReader, KvNamespaceWriter, KvProxyAdapterOptions, ProxyAppOptions, ProxyDataAdapter, ProxyDataPlaneOptions, ProxyRouteHandlerSpec, ResolvedHost, ServiceBindingFetcher, StaticHostConfig, StaticProxyAdapterOptions, StaticRouteInput };
+export { DEFAULT_KV_HOST_KEY_PREFIX, FORWARDED_HEADERS_HANDLER_TYPE, HandlerRegistry, PROXY_RESOLVE_HOST_SCOPE, basicAuthHandler, buildCacheAdapterKey, buildCacheApiKey, buildKvHostKey, buildMatchFilter, cacheHandler, compileHostApp, corsHandler, createCacheAdapterHostCache, createCacheApiHostCache, createHttpProxyAdapter, createInMemoryHostCache, createKvProxyAdapter, createProxyApp, createProxyDataPlaneHandler, createProxyDataPlaneRouter, createServiceBindingFetch, createStaticProxyAdapter, defineHandler, dispatchNamespaceHandler, forwardedHeadersHandler, headersHandler, httpHandler, httpRoute, isCloudflareIp, matchesAnyHost, matchesHost, redirectHandler, registerBuiltinHandlers, rewriteCookiesHandler, rewriteLocationHandler, serviceBindingHandler, sortRoutes, staticHandler, withForwardedHeaders, withForwardedHeadersFor };
+export type { CacheAdapterHostCacheOptions, CacheApiHostCacheOptions, HandlerBuildContext, HandlerDefinition, HandlerSpecLike, HostCacheOptions, HostResolverCache, HttpProxyAdapterOptions, KvNamespaceReader, KvNamespaceWriter, KvProxyAdapterOptions, ProxyAppOptions, ProxyDataAdapter, ProxyDataPlaneOptions, ProxyRouteHandlerSpec, ResolvedHost, ServiceBindingFetcher, StaticHostConfig, StaticProxyAdapterOptions, StaticRouteInput };