@authhero/proxy 0.8.5 → 0.9.0

package/dist/types/http-adapter/service-binding-fetch.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Minimal shape of a Cloudflare service binding (a `Fetcher`). Declared
+ * locally so `@authhero/proxy` does not depend on `@cloudflare/workers-types`.
+ */
+export interface ServiceBindingFetcher {
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Wrap a Cloudflare service binding as a `fetch`-compatible function, suitable
+ * for the `fetch` override on {@link HttpProxyAdapterOptions}.
+ *
+ * When the proxy's control plane lives on a hostname that the proxy itself
+ * serves (e.g. the proxy owns `*.token.example.com/*` and the control plane
+ * resolves at `https://controlplane.token.example.com`), resolving it over the
+ * public edge loops the proxy's `resolveHost`/`/oauth/token` calls straight
+ * back into itself — a self-DoS. Routing those calls through a service binding
+ * to the control-plane worker keeps them off the public edge entirely, so the
+ * loop cannot form regardless of the configured `baseUrl`.
+ *
+ * ```ts
+ * const data = createHttpProxyAdapter({
+ *   baseUrl: env.CONTROL_PLANE_URL,
+ *   clientId: env.CONTROL_PLANE_CLIENT_ID,
+ *   clientSecret: env.CONTROL_PLANE_CLIENT_SECRET,
+ *   fetch: createServiceBindingFetch(env.AUTH2),
+ * });
+ * ```
+ */
+export declare function createServiceBindingFetch(fetcher: ServiceBindingFetcher): typeof fetch;

package/dist/types/http-adapter/service-binding-fetch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/index.d.ts

@@ -19,6 +19,8 @@ export { createStaticProxyAdapter, httpRoute } from "./static";
 export type { StaticProxyAdapterOptions, StaticHostConfig, StaticRouteInput, } from "./static";
 export { createHttpProxyAdapter } from "./http-adapter";
 export type { HttpProxyAdapterOptions } from "./http-adapter";
+export { createServiceBindingFetch } from "./http-adapter/service-binding-fetch";
+export type { ServiceBindingFetcher } from "./http-adapter/service-binding-fetch";
 export { createKvProxyAdapter, buildKvHostKey, DEFAULT_KV_HOST_KEY_PREFIX, } from "./kv-adapter";
 export type { KvProxyAdapterOptions, KvNamespaceReader, KvNamespaceWriter, } from "./kv-adapter";
 export { PROXY_RESOLVE_HOST_SCOPE } from "./constants";

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "0.8.5",
+  "version": "0.9.0",
   "files": [
     "dist"
   ],
@@ -40,7 +40,7 @@
     "hono": "^4.6.8"
   },
   "dependencies": {
-    "@authhero/adapter-interfaces": "3.9.0"
+    "@authhero/adapter-interfaces": "3.10.0"
   },
   "scripts": {
     "build": "vite build && tsc -p tsconfig.types.json && rollup -c rollup.dts.config.mjs",