@authhero/proxy 0.10.4 → 0.10.6

package/dist/types/data-plane/cloudflare-ips.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Parse a textual IP address into its bytes: 4 for IPv4, 16 for IPv6.
+ * IPv4-mapped IPv6 (`::ffff:1.2.3.4`) collapses to the 4-byte form so it is
+ * matched against the IPv4 ranges. Returns null for anything unparseable.
+ */
+export declare function parseIpAddress(input: string): number[] | null;
+/**
+ * True when `ip` falls inside a Cloudflare-published range. Unparseable input
+ * returns false — callers treat "not recognizably Cloudflare" as a client IP.
+ */
+export declare function isCloudflareIp(ip: string): boolean;

package/dist/types/data-plane/compile.d.ts

@@ -3,6 +3,33 @@ import type { MiddlewareHandler } from "hono";
 import type { ProxyRoute } from "../types";
 import { HandlerRegistry } from "./registry";
 import { type ProxyHostContext } from "./handlers/util";
+export declare const FORWARDED_HEADERS_HANDLER_TYPE = "forwarded_headers";
+/**
+ * Minimal shape shared by stored route handlers (`HandlerConfig`) and the
+ * catch-all specs passed to the data plane (`ProxyRouteHandlerSpec`).
+ */
+export interface HandlerSpecLike {
+    type: string;
+    options?: unknown;
+}
+/**
+ * Guarantee a `forwarded_headers` handler at the head of a chain. Stored route
+ * tables (KV / control plane) predate the handler and routinely omit it, which
+ * silently drops the visitor IP: nothing else in the chain stamps
+ * X-Forwarded-For / X-Real-IP, so upstreams see only the proxy hop's own
+ * source address. Chains that already declare it — anywhere in the list — are
+ * returned untouched so their configured options win and nothing is stamped
+ * twice. Prefer `withForwardedHeadersFor`, which also checks that the registry
+ * knows the handler.
+ */
+export declare function withForwardedHeaders(handlers: readonly HandlerSpecLike[]): HandlerSpecLike[];
+/**
+ * `withForwardedHeaders`, but a no-op unless `registry` knows the handler — a
+ * consumer with a bespoke registry that never registered it would otherwise
+ * get a build-time throw on every route. Every chain the data plane compiles
+ * (per-host routes and the `defaultHandlers` catch-all) goes through here.
+ */
+export declare function withForwardedHeadersFor(registry: HandlerRegistry, handlers: readonly HandlerSpecLike[]): HandlerSpecLike[];
 /**
  * Build a Hono app whose route table mirrors the configured proxy routes for
  * a single host. Compiled once per host (and cached alongside the resolved
@@ -12,8 +39,13 @@ import { type ProxyHostContext } from "./handlers/util";
  * `handlers/util.ts`). Handlers that template against those values
  * (`dispatch_namespace`) depend on this wiring.
  *
+ * Every route's handler chain is normalized through
+ * `withForwardedHeadersFor`, so a stored route table that omits
+ * `forwarded_headers` still forwards the visitor IP.
+ *
  * `defaultHandlers` is a prebuilt middleware chain installed as the catch-all
  * when no per-host route matches. Pass `undefined` to keep the legacy 404
- * "No matching route" behavior.
+ * "No matching route" behavior. It is built by the caller (`router.ts`), which
+ * applies `withForwardedHeadersFor` to it as well.
  */
 export declare function compileHostApp(routes: ProxyRoute[], registry: HandlerRegistry, hostContext?: ProxyHostContext, defaultHandlers?: MiddlewareHandler[]): Hono;

package/dist/types/data-plane/handlers/forwarded-headers.d.ts

@@ -2,4 +2,5 @@ export declare const forwardedHeadersHandler: import("../registry").HandlerDefin
     client_ip_header: string;
     set_x_real_ip: boolean;
     set_x_original_url: boolean;
+    skip_cloudflare_client_ip: boolean;
 }>;

package/dist/types/index.d.ts

@@ -13,7 +13,9 @@ export type { CacheAdapterHostCacheOptions } from "./data-plane/cache-adapter-ca
 export { HandlerRegistry, defineHandler } from "./data-plane/registry";
 export type { HandlerDefinition, HandlerBuildContext, } from "./data-plane/registry";
 export { registerBuiltinHandlers, corsHandler, basicAuthHandler, headersHandler, cacheHandler, forwardedHeadersHandler, rewriteCookiesHandler, rewriteLocationHandler, httpHandler, serviceBindingHandler, dispatchNamespaceHandler, redirectHandler, staticHandler, } from "./data-plane/handlers";
-export { compileHostApp } from "./data-plane/compile";
+export { compileHostApp, withForwardedHeaders, withForwardedHeadersFor, FORWARDED_HEADERS_HANDLER_TYPE, } from "./data-plane/compile";
+export type { HandlerSpecLike } from "./data-plane/compile";
+export { isCloudflareIp } from "./data-plane/cloudflare-ips";
 export { sortRoutes, matchesHost, matchesAnyHost, buildMatchFilter, } from "./data-plane/matcher";
 export { createStaticProxyAdapter, httpRoute } from "./static";
 export type { StaticProxyAdapterOptions, StaticHostConfig, StaticRouteInput, } from "./static";

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "0.10.4",
+  "version": "0.10.6",
   "files": [
     "dist"
   ],
@@ -40,7 +40,7 @@
     "hono": "^4.6.8"
   },
   "dependencies": {
-    "@authhero/adapter-interfaces": "4.7.0"
+    "@authhero/adapter-interfaces": "4.8.0"
   },
   "license": "AGPL-3.0-only",
   "scripts": {