@beignet/core 0.0.32 → 0.0.33
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +35 -0
- package/README.md +344 -19
- package/dist/application/index.d.ts.map +1 -1
- package/dist/application/index.js +63 -47
- package/dist/application/index.js.map +1 -1
- package/dist/events/index.d.ts +6 -0
- package/dist/events/index.d.ts.map +1 -1
- package/dist/events/index.js +20 -10
- package/dist/events/index.js.map +1 -1
- package/dist/jobs/index.d.ts +415 -4
- package/dist/jobs/index.d.ts.map +1 -1
- package/dist/jobs/index.js +392 -3
- package/dist/jobs/index.js.map +1 -1
- package/dist/outbox/index.d.ts +150 -1
- package/dist/outbox/index.d.ts.map +1 -1
- package/dist/outbox/index.js +170 -1
- package/dist/outbox/index.js.map +1 -1
- package/dist/ports/index.d.ts +6 -1
- package/dist/ports/index.d.ts.map +1 -1
- package/dist/ports/index.js +1 -0
- package/dist/ports/index.js.map +1 -1
- package/dist/providers/instrumentation.d.ts +4 -0
- package/dist/providers/instrumentation.d.ts.map +1 -1
- package/dist/providers/instrumentation.js.map +1 -1
- package/dist/schedules/index.d.ts +8 -7
- package/dist/schedules/index.d.ts.map +1 -1
- package/dist/schedules/index.js +47 -16
- package/dist/schedules/index.js.map +1 -1
- package/dist/server/hooks/index.d.ts +1 -0
- package/dist/server/hooks/index.d.ts.map +1 -1
- package/dist/server/hooks/index.js +1 -0
- package/dist/server/hooks/index.js.map +1 -1
- package/dist/server/hooks/rate-limit.d.ts +26 -13
- package/dist/server/hooks/rate-limit.d.ts.map +1 -1
- package/dist/server/hooks/rate-limit.js +28 -34
- package/dist/server/hooks/rate-limit.js.map +1 -1
- package/dist/server/hooks/security.d.ts +179 -0
- package/dist/server/hooks/security.d.ts.map +1 -0
- package/dist/server/hooks/security.js +225 -0
- package/dist/server/hooks/security.js.map +1 -0
- package/dist/server/index.d.ts +8 -0
- package/dist/server/index.d.ts.map +1 -1
- package/dist/server/index.js +8 -0
- package/dist/server/index.js.map +1 -1
- package/dist/server/instrumentation.d.ts.map +1 -1
- package/dist/server/instrumentation.js +22 -6
- package/dist/server/instrumentation.js.map +1 -1
- package/dist/server/request-context.d.ts +4 -0
- package/dist/server/request-context.d.ts.map +1 -1
- package/dist/server/request-context.js +3 -0
- package/dist/server/request-context.js.map +1 -1
- package/dist/server/runtime-integrity.d.ts +84 -0
- package/dist/server/runtime-integrity.d.ts.map +1 -0
- package/dist/server/runtime-integrity.js +160 -0
- package/dist/server/runtime-integrity.js.map +1 -0
- package/dist/server/server.d.ts +10 -0
- package/dist/server/server.d.ts.map +1 -1
- package/dist/server/server.js +55 -1
- package/dist/server/server.js.map +1 -1
- package/dist/server/trusted-proxy.d.ts +77 -0
- package/dist/server/trusted-proxy.d.ts.map +1 -0
- package/dist/server/trusted-proxy.js +129 -0
- package/dist/server/trusted-proxy.js.map +1 -0
- package/dist/tasks/index.d.ts +6 -7
- package/dist/tasks/index.d.ts.map +1 -1
- package/dist/tasks/index.js +22 -5
- package/dist/tasks/index.js.map +1 -1
- package/dist/tenancy/index.d.ts +41 -0
- package/dist/tenancy/index.d.ts.map +1 -0
- package/dist/tenancy/index.js +34 -0
- package/dist/tenancy/index.js.map +1 -0
- package/dist/tracing/execution.d.ts +14 -0
- package/dist/tracing/execution.d.ts.map +1 -0
- package/dist/tracing/execution.js +17 -0
- package/dist/tracing/execution.js.map +1 -0
- package/dist/tracing/index.d.ts +49 -0
- package/dist/tracing/index.d.ts.map +1 -1
- package/dist/tracing/index.js +59 -0
- package/dist/tracing/index.js.map +1 -1
- package/dist/uploads/client.d.ts.map +1 -1
- package/dist/uploads/client.js +44 -6
- package/dist/uploads/client.js.map +1 -1
- package/dist/uploads/index.d.ts +71 -0
- package/dist/uploads/index.d.ts.map +1 -1
- package/dist/uploads/index.js +344 -15
- package/dist/uploads/index.js.map +1 -1
- package/dist/webhooks/index.d.ts +55 -4
- package/dist/webhooks/index.d.ts.map +1 -1
- package/dist/webhooks/index.js +106 -2
- package/dist/webhooks/index.js.map +1 -1
- package/package.json +5 -1
- package/skills/app-architecture/SKILL.md +23 -2
- package/src/application/index.ts +88 -56
- package/src/events/index.ts +27 -14
- package/src/jobs/index.ts +895 -7
- package/src/outbox/index.ts +358 -2
- package/src/ports/index.ts +17 -0
- package/src/providers/instrumentation.ts +4 -0
- package/src/schedules/index.ts +60 -26
- package/src/server/hooks/index.ts +10 -0
- package/src/server/hooks/rate-limit.ts +52 -46
- package/src/server/hooks/security.ts +503 -0
- package/src/server/index.ts +8 -0
- package/src/server/instrumentation.ts +25 -5
- package/src/server/request-context.ts +7 -0
- package/src/server/runtime-integrity.ts +322 -0
- package/src/server/server.ts +86 -1
- package/src/server/trusted-proxy.ts +249 -0
- package/src/tasks/index.ts +29 -12
- package/src/tenancy/index.ts +55 -0
- package/src/tracing/execution.ts +37 -0
- package/src/tracing/index.ts +137 -0
- package/src/uploads/client.ts +65 -6
- package/src/uploads/index.ts +539 -14
- package/src/webhooks/index.ts +238 -9
|
@@ -0,0 +1,179 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Security hooks for @beignet/core/server
|
|
3
|
+
*/
|
|
4
|
+
import type { HttpContractConfig } from "../../contracts/index.js";
|
|
5
|
+
import { type TrustedProxyConfig } from "../trusted-proxy.js";
|
|
6
|
+
import type { HttpRequestLike, ServerHook } from "../types.js";
|
|
7
|
+
/**
|
|
8
|
+
* Strict-Transport-Security configuration.
|
|
9
|
+
*
|
|
10
|
+
* HSTS is disabled by default because it should only be sent by HTTPS
|
|
11
|
+
* deployments that intentionally commit browsers to the configured host policy.
|
|
12
|
+
*/
|
|
13
|
+
export interface StrictTransportSecurityOptions {
|
|
14
|
+
/**
|
|
15
|
+
* HSTS max-age value in seconds.
|
|
16
|
+
*
|
|
17
|
+
* Defaults to one year when `strictTransportSecurity` is configured as an
|
|
18
|
+
* object.
|
|
19
|
+
*/
|
|
20
|
+
maxAgeSec?: number;
|
|
21
|
+
/**
|
|
22
|
+
* Include subdomains in the HSTS policy.
|
|
23
|
+
*/
|
|
24
|
+
includeSubDomains?: boolean;
|
|
25
|
+
/**
|
|
26
|
+
* Mark the policy as eligible for browser preload lists.
|
|
27
|
+
*/
|
|
28
|
+
preload?: boolean;
|
|
29
|
+
}
|
|
30
|
+
/**
|
|
31
|
+
* Response security headers applied by `createSecurityHeadersHooks(...)`.
|
|
32
|
+
*
|
|
33
|
+
* Headers are only added when the response does not already define the same
|
|
34
|
+
* header name. Route handlers can therefore opt into route-specific CSP or
|
|
35
|
+
* download headers without fighting the global hook.
|
|
36
|
+
*/
|
|
37
|
+
export interface SecurityHeadersOptions {
|
|
38
|
+
/**
|
|
39
|
+
* Content Security Policy value. Disabled by default because browser apps need
|
|
40
|
+
* an app-owned asset, image, frame, and script policy.
|
|
41
|
+
*/
|
|
42
|
+
contentSecurityPolicy?: string | false;
|
|
43
|
+
/**
|
|
44
|
+
* Cross-Origin-Opener-Policy value.
|
|
45
|
+
*
|
|
46
|
+
* Defaults to `"same-origin"`.
|
|
47
|
+
*/
|
|
48
|
+
crossOriginOpenerPolicy?: string | false;
|
|
49
|
+
/**
|
|
50
|
+
* Cross-Origin-Resource-Policy value.
|
|
51
|
+
*
|
|
52
|
+
* Defaults to `"same-origin"`.
|
|
53
|
+
*/
|
|
54
|
+
crossOriginResourcePolicy?: string | false;
|
|
55
|
+
/**
|
|
56
|
+
* Permissions-Policy value.
|
|
57
|
+
*
|
|
58
|
+
* Defaults to disabling camera, microphone, and geolocation.
|
|
59
|
+
*/
|
|
60
|
+
permissionsPolicy?: string | false;
|
|
61
|
+
/**
|
|
62
|
+
* Referrer-Policy value.
|
|
63
|
+
*
|
|
64
|
+
* Defaults to `"strict-origin-when-cross-origin"`.
|
|
65
|
+
*/
|
|
66
|
+
referrerPolicy?: string | false;
|
|
67
|
+
/**
|
|
68
|
+
* Strict-Transport-Security value. Pass a string for full control or an object
|
|
69
|
+
* for Beignet to format the header. Disabled by default.
|
|
70
|
+
*/
|
|
71
|
+
strictTransportSecurity?: StrictTransportSecurityOptions | string | false;
|
|
72
|
+
/**
|
|
73
|
+
* X-Content-Type-Options value.
|
|
74
|
+
*
|
|
75
|
+
* Defaults to `"nosniff"`.
|
|
76
|
+
*/
|
|
77
|
+
xContentTypeOptions?: "nosniff" | false;
|
|
78
|
+
/**
|
|
79
|
+
* X-Frame-Options value.
|
|
80
|
+
*
|
|
81
|
+
* Defaults to `"DENY"`. Use `contentSecurityPolicy` with `frame-ancestors`
|
|
82
|
+
* for more precise frame control.
|
|
83
|
+
*/
|
|
84
|
+
xFrameOptions?: "DENY" | "SAMEORIGIN" | false;
|
|
85
|
+
}
|
|
86
|
+
export type CsrfFailureReason = "missing_origin" | "untrusted_origin" | "missing_token" | "invalid_token";
|
|
87
|
+
/**
|
|
88
|
+
* Double-submit cookie token configuration for `createCsrfHooks(...)`.
|
|
89
|
+
*/
|
|
90
|
+
export interface CsrfTokenOptions {
|
|
91
|
+
/**
|
|
92
|
+
* Header that must carry the CSRF token.
|
|
93
|
+
*
|
|
94
|
+
* Defaults to `"x-csrf-token"`.
|
|
95
|
+
*/
|
|
96
|
+
headerName?: string;
|
|
97
|
+
/**
|
|
98
|
+
* Cookie that stores the expected CSRF token.
|
|
99
|
+
*
|
|
100
|
+
* Defaults to `"beignet.csrf"`.
|
|
101
|
+
*/
|
|
102
|
+
cookieName?: string;
|
|
103
|
+
}
|
|
104
|
+
/**
|
|
105
|
+
* Options for `createCsrfHooks(...)`.
|
|
106
|
+
*/
|
|
107
|
+
export interface CsrfHooksOptions {
|
|
108
|
+
/**
|
|
109
|
+
* Unsafe HTTP methods protected by the hook.
|
|
110
|
+
*
|
|
111
|
+
* Defaults to `POST`, `PUT`, `PATCH`, and `DELETE`.
|
|
112
|
+
*/
|
|
113
|
+
protectedMethods?: readonly string[];
|
|
114
|
+
/**
|
|
115
|
+
* Additional trusted origins allowed to send protected requests.
|
|
116
|
+
*
|
|
117
|
+
* The request URL's own origin is always trusted. Use this for sibling
|
|
118
|
+
* frontends such as `https://app.example.com` calling `https://api.example.com`.
|
|
119
|
+
*/
|
|
120
|
+
trustedOrigins?: readonly string[] | ((args: {
|
|
121
|
+
origin: string;
|
|
122
|
+
req: HttpRequestLike;
|
|
123
|
+
contract: HttpContractConfig;
|
|
124
|
+
}) => boolean);
|
|
125
|
+
/**
|
|
126
|
+
* Whether unsafe requests without `Origin` or `Referer` are allowed.
|
|
127
|
+
*
|
|
128
|
+
* Defaults to `true` so server-to-server calls, tests, and older same-origin
|
|
129
|
+
* clients keep working. Set to `false` for cookie-backed browser-only APIs.
|
|
130
|
+
*/
|
|
131
|
+
allowMissingOrigin?: boolean;
|
|
132
|
+
/**
|
|
133
|
+
* Optional double-submit cookie token check.
|
|
134
|
+
*
|
|
135
|
+
* When configured, protected requests must send the same token in the
|
|
136
|
+
* configured header and cookie.
|
|
137
|
+
*/
|
|
138
|
+
token?: false | CsrfTokenOptions;
|
|
139
|
+
/**
|
|
140
|
+
* Shared trusted-proxy policy used when comparing the request's external
|
|
141
|
+
* origin against `Origin` or `Referer`.
|
|
142
|
+
*
|
|
143
|
+
* Configure this only when the app is always behind a platform or reverse
|
|
144
|
+
* proxy that strips or normalizes forwarding headers. Without this option,
|
|
145
|
+
* CSRF uses `req.url` exactly as the adapter provided it.
|
|
146
|
+
*/
|
|
147
|
+
trustedProxy?: TrustedProxyConfig;
|
|
148
|
+
/**
|
|
149
|
+
* App-owned escape hatch for routes that have another verifier, such as
|
|
150
|
+
* provider webhooks or auth callbacks.
|
|
151
|
+
*/
|
|
152
|
+
skip?: (args: {
|
|
153
|
+
req: HttpRequestLike;
|
|
154
|
+
contract: HttpContractConfig;
|
|
155
|
+
params: Record<string, string>;
|
|
156
|
+
}) => boolean | Promise<boolean>;
|
|
157
|
+
}
|
|
158
|
+
/**
|
|
159
|
+
* Apply Beignet's default security response headers to a mutable header record.
|
|
160
|
+
*
|
|
161
|
+
* Existing headers are preserved case-insensitively so route-owned responses can
|
|
162
|
+
* provide more specific policies.
|
|
163
|
+
*/
|
|
164
|
+
export declare function applySecurityHeaders(headers: Record<string, string>, options?: SecurityHeadersOptions): void;
|
|
165
|
+
/**
|
|
166
|
+
* Create a server hook that adds common browser security headers to every
|
|
167
|
+
* response, including native streamed responses.
|
|
168
|
+
*/
|
|
169
|
+
export declare function createSecurityHeadersHooks<Ctx>(options?: SecurityHeadersOptions): ServerHook<Ctx>;
|
|
170
|
+
/**
|
|
171
|
+
* Create CSRF protection for unsafe HTTP methods.
|
|
172
|
+
*
|
|
173
|
+
* The default protects cookie-backed browser routes from cross-origin unsafe
|
|
174
|
+
* requests while still allowing server-to-server calls and tests that do not
|
|
175
|
+
* send browser origin headers. Set `allowMissingOrigin: false` and configure
|
|
176
|
+
* `token` for stricter browser-only APIs.
|
|
177
|
+
*/
|
|
178
|
+
export declare function createCsrfHooks<Ctx>(options?: CsrfHooksOptions): ServerHook<Ctx>;
|
|
179
|
+
//# sourceMappingURL=security.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/server/hooks/security.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACvC;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,8BAA8B,GAAG,MAAM,GAAG,KAAK,CAAC;IAC1E;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IACxC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;CAC/C;AAED,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,eAAe,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,cAAc,CAAC,EACX,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,eAAe,CAAC;QACrB,QAAQ,EAAE,kBAAkB,CAAC;KAC9B,KAAK,OAAO,CAAC,CAAC;IACnB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC;IACjC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;OAGG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;QACZ,GAAG,EAAE,eAAe,CAAC;QACrB,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClC;AAsCD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,GAAE,sBAA2B,GACnC,IAAI,CAyCN;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAC5C,OAAO,GAAE,sBAA2B,GACnC,UAAU,CAAC,GAAG,CAAC,CAYjB;AAwLD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EACjC,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CAAC,GAAG,CAAC,CA2BjB"}
|
|
@@ -0,0 +1,225 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Security hooks for @beignet/core/server
|
|
3
|
+
*/
|
|
4
|
+
import { AppError, httpErrors } from "../../errors/index.js";
|
|
5
|
+
import { resolveTrustedRequest, } from "../trusted-proxy.js";
|
|
6
|
+
const DEFAULT_PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=()";
|
|
7
|
+
const DEFAULT_PROTECTED_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
|
|
8
|
+
const DEFAULT_CSRF_HEADER = "x-csrf-token";
|
|
9
|
+
const DEFAULT_CSRF_COOKIE = "beignet.csrf";
|
|
10
|
+
function headerKey(headers, name) {
|
|
11
|
+
const lowerName = name.toLowerCase();
|
|
12
|
+
return Object.keys(headers).find((key) => key.toLowerCase() === lowerName);
|
|
13
|
+
}
|
|
14
|
+
function setHeaderIfMissing(headers, name, value) {
|
|
15
|
+
if (value === false || value === undefined)
|
|
16
|
+
return;
|
|
17
|
+
if (headerKey(headers, name))
|
|
18
|
+
return;
|
|
19
|
+
headers[name] = value;
|
|
20
|
+
}
|
|
21
|
+
function formatStrictTransportSecurity(config) {
|
|
22
|
+
if (typeof config === "string" || config === false || config === undefined) {
|
|
23
|
+
return config;
|
|
24
|
+
}
|
|
25
|
+
const directives = [`max-age=${config.maxAgeSec ?? 31_536_000}`];
|
|
26
|
+
if (config.includeSubDomains)
|
|
27
|
+
directives.push("includeSubDomains");
|
|
28
|
+
if (config.preload)
|
|
29
|
+
directives.push("preload");
|
|
30
|
+
return directives.join("; ");
|
|
31
|
+
}
|
|
32
|
+
/**
|
|
33
|
+
* Apply Beignet's default security response headers to a mutable header record.
|
|
34
|
+
*
|
|
35
|
+
* Existing headers are preserved case-insensitively so route-owned responses can
|
|
36
|
+
* provide more specific policies.
|
|
37
|
+
*/
|
|
38
|
+
export function applySecurityHeaders(headers, options = {}) {
|
|
39
|
+
setHeaderIfMissing(headers, "Content-Security-Policy", options.contentSecurityPolicy);
|
|
40
|
+
setHeaderIfMissing(headers, "Cross-Origin-Opener-Policy", options.crossOriginOpenerPolicy ?? "same-origin");
|
|
41
|
+
setHeaderIfMissing(headers, "Cross-Origin-Resource-Policy", options.crossOriginResourcePolicy ?? "same-origin");
|
|
42
|
+
setHeaderIfMissing(headers, "Permissions-Policy", options.permissionsPolicy ?? DEFAULT_PERMISSIONS_POLICY);
|
|
43
|
+
setHeaderIfMissing(headers, "Referrer-Policy", options.referrerPolicy ?? "strict-origin-when-cross-origin");
|
|
44
|
+
setHeaderIfMissing(headers, "Strict-Transport-Security", formatStrictTransportSecurity(options.strictTransportSecurity));
|
|
45
|
+
setHeaderIfMissing(headers, "X-Content-Type-Options", options.xContentTypeOptions ?? "nosniff");
|
|
46
|
+
setHeaderIfMissing(headers, "X-Frame-Options", options.xFrameOptions ?? "DENY");
|
|
47
|
+
}
|
|
48
|
+
/**
|
|
49
|
+
* Create a server hook that adds common browser security headers to every
|
|
50
|
+
* response, including native streamed responses.
|
|
51
|
+
*/
|
|
52
|
+
export function createSecurityHeadersHooks(options = {}) {
|
|
53
|
+
return {
|
|
54
|
+
name: "security-headers",
|
|
55
|
+
beforeSend: ({ response }) => {
|
|
56
|
+
const headers = { ...(response.headers ?? {}) };
|
|
57
|
+
applySecurityHeaders(headers, options);
|
|
58
|
+
return {
|
|
59
|
+
...response,
|
|
60
|
+
headers,
|
|
61
|
+
};
|
|
62
|
+
},
|
|
63
|
+
};
|
|
64
|
+
}
|
|
65
|
+
function normalizeOrigin(value, source) {
|
|
66
|
+
try {
|
|
67
|
+
return new URL(value).origin;
|
|
68
|
+
}
|
|
69
|
+
catch {
|
|
70
|
+
throw new Error(`${source} must be an absolute URL origin.`);
|
|
71
|
+
}
|
|
72
|
+
}
|
|
73
|
+
function requestOrigin(req, trustedProxy) {
|
|
74
|
+
return resolveTrustedRequest(req, trustedProxyOriginConfig(trustedProxy))
|
|
75
|
+
.origin;
|
|
76
|
+
}
|
|
77
|
+
function trustedProxyOriginConfig(trustedProxy) {
|
|
78
|
+
if (!trustedProxy)
|
|
79
|
+
return trustedProxy;
|
|
80
|
+
const originConfig = {};
|
|
81
|
+
if (trustedProxy.hostHeader !== undefined) {
|
|
82
|
+
originConfig.hostHeader = trustedProxy.hostHeader;
|
|
83
|
+
}
|
|
84
|
+
if (trustedProxy.protocolHeader !== undefined) {
|
|
85
|
+
originConfig.protocolHeader = trustedProxy.protocolHeader;
|
|
86
|
+
}
|
|
87
|
+
return originConfig;
|
|
88
|
+
}
|
|
89
|
+
function headerOrigin(value) {
|
|
90
|
+
if (!value)
|
|
91
|
+
return undefined;
|
|
92
|
+
try {
|
|
93
|
+
return new URL(value).origin;
|
|
94
|
+
}
|
|
95
|
+
catch {
|
|
96
|
+
return undefined;
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
function originFromRequestHeaders(req) {
|
|
100
|
+
const origin = req.headers.get("origin");
|
|
101
|
+
if (origin)
|
|
102
|
+
return headerOrigin(origin) ?? origin;
|
|
103
|
+
return headerOrigin(req.headers.get("referer"));
|
|
104
|
+
}
|
|
105
|
+
function normalizeTrustedOrigins(trustedOrigins) {
|
|
106
|
+
if (!Array.isArray(trustedOrigins))
|
|
107
|
+
return trustedOrigins;
|
|
108
|
+
return trustedOrigins.map((origin) => normalizeOrigin(origin, "trustedOrigins entries"));
|
|
109
|
+
}
|
|
110
|
+
function isTrustedOrigin(args) {
|
|
111
|
+
if (args.origin === args.requestOrigin)
|
|
112
|
+
return true;
|
|
113
|
+
if (Array.isArray(args.trustedOrigins)) {
|
|
114
|
+
return args.trustedOrigins.includes(args.origin);
|
|
115
|
+
}
|
|
116
|
+
if (typeof args.trustedOrigins === "function") {
|
|
117
|
+
return args.trustedOrigins({
|
|
118
|
+
origin: args.origin,
|
|
119
|
+
req: args.req,
|
|
120
|
+
contract: args.contract,
|
|
121
|
+
});
|
|
122
|
+
}
|
|
123
|
+
return false;
|
|
124
|
+
}
|
|
125
|
+
function decodeCookiePart(value) {
|
|
126
|
+
try {
|
|
127
|
+
return decodeURIComponent(value);
|
|
128
|
+
}
|
|
129
|
+
catch {
|
|
130
|
+
return value;
|
|
131
|
+
}
|
|
132
|
+
}
|
|
133
|
+
function parseCookieHeader(cookieHeader) {
|
|
134
|
+
if (!cookieHeader)
|
|
135
|
+
return {};
|
|
136
|
+
return Object.fromEntries(cookieHeader
|
|
137
|
+
.split(";")
|
|
138
|
+
.map((entry) => entry.trim())
|
|
139
|
+
.filter(Boolean)
|
|
140
|
+
.map((entry) => {
|
|
141
|
+
const separator = entry.indexOf("=");
|
|
142
|
+
if (separator === -1)
|
|
143
|
+
return [entry, ""];
|
|
144
|
+
return [
|
|
145
|
+
decodeCookiePart(entry.slice(0, separator).trim()),
|
|
146
|
+
decodeCookiePart(entry.slice(separator + 1).trim()),
|
|
147
|
+
];
|
|
148
|
+
}));
|
|
149
|
+
}
|
|
150
|
+
function tokensMatch(left, right) {
|
|
151
|
+
if (left.length !== right.length)
|
|
152
|
+
return false;
|
|
153
|
+
let result = 0;
|
|
154
|
+
for (let index = 0; index < left.length; index += 1) {
|
|
155
|
+
result |= left.charCodeAt(index) ^ right.charCodeAt(index);
|
|
156
|
+
}
|
|
157
|
+
return result === 0;
|
|
158
|
+
}
|
|
159
|
+
function csrfError(reason, message) {
|
|
160
|
+
return new AppError(httpErrors.Forbidden, { reason }, message);
|
|
161
|
+
}
|
|
162
|
+
function enforceOrigin(args) {
|
|
163
|
+
const origin = originFromRequestHeaders(args.req);
|
|
164
|
+
if (!origin) {
|
|
165
|
+
if (args.allowMissingOrigin)
|
|
166
|
+
return;
|
|
167
|
+
throw csrfError("missing_origin", "CSRF check failed because the request did not include an Origin or Referer header.");
|
|
168
|
+
}
|
|
169
|
+
if (!isTrustedOrigin({
|
|
170
|
+
origin,
|
|
171
|
+
req: args.req,
|
|
172
|
+
contract: args.contract,
|
|
173
|
+
requestOrigin: requestOrigin(args.req, args.trustedProxy),
|
|
174
|
+
trustedOrigins: args.trustedOrigins,
|
|
175
|
+
})) {
|
|
176
|
+
throw csrfError("untrusted_origin", "CSRF check failed because the request origin is not trusted.");
|
|
177
|
+
}
|
|
178
|
+
}
|
|
179
|
+
function enforceToken(req, token) {
|
|
180
|
+
if (!token)
|
|
181
|
+
return;
|
|
182
|
+
const headerName = token.headerName ?? DEFAULT_CSRF_HEADER;
|
|
183
|
+
const cookieName = token.cookieName ?? DEFAULT_CSRF_COOKIE;
|
|
184
|
+
const headerToken = req.headers.get(headerName);
|
|
185
|
+
const cookieToken = parseCookieHeader(req.headers.get("cookie"))[cookieName];
|
|
186
|
+
if (!headerToken || !cookieToken) {
|
|
187
|
+
throw csrfError("missing_token", `CSRF check failed because ${headerName} and ${cookieName} must both be present.`);
|
|
188
|
+
}
|
|
189
|
+
if (!tokensMatch(headerToken, cookieToken)) {
|
|
190
|
+
throw csrfError("invalid_token", "CSRF check failed because the submitted token does not match the cookie token.");
|
|
191
|
+
}
|
|
192
|
+
}
|
|
193
|
+
/**
|
|
194
|
+
* Create CSRF protection for unsafe HTTP methods.
|
|
195
|
+
*
|
|
196
|
+
* The default protects cookie-backed browser routes from cross-origin unsafe
|
|
197
|
+
* requests while still allowing server-to-server calls and tests that do not
|
|
198
|
+
* send browser origin headers. Set `allowMissingOrigin: false` and configure
|
|
199
|
+
* `token` for stricter browser-only APIs.
|
|
200
|
+
*/
|
|
201
|
+
export function createCsrfHooks(options = {}) {
|
|
202
|
+
const protectedMethods = new Set((options.protectedMethods ?? DEFAULT_PROTECTED_METHODS).map((method) => method.toUpperCase()));
|
|
203
|
+
const allowMissingOrigin = options.allowMissingOrigin ?? true;
|
|
204
|
+
const trustedOrigins = normalizeTrustedOrigins(options.trustedOrigins);
|
|
205
|
+
const token = options.token ?? false;
|
|
206
|
+
return {
|
|
207
|
+
name: "csrf",
|
|
208
|
+
onRequest: async ({ req, contract, params }) => {
|
|
209
|
+
if (!protectedMethods.has(req.method.toUpperCase()))
|
|
210
|
+
return undefined;
|
|
211
|
+
if (await options.skip?.({ req, contract, params }))
|
|
212
|
+
return undefined;
|
|
213
|
+
enforceOrigin({
|
|
214
|
+
req,
|
|
215
|
+
contract,
|
|
216
|
+
allowMissingOrigin,
|
|
217
|
+
trustedOrigins,
|
|
218
|
+
trustedProxy: options.trustedProxy,
|
|
219
|
+
});
|
|
220
|
+
enforceToken(req, token);
|
|
221
|
+
return undefined;
|
|
222
|
+
},
|
|
223
|
+
};
|
|
224
|
+
}
|
|
225
|
+
//# sourceMappingURL=security.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/server/hooks/security.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC;AAqK7B,MAAM,0BAA0B,GAAG,0CAA0C,CAAC;AAC9E,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAC9E,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAC3C,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C,SAAS,SAAS,CAChB,OAA+B,EAC/B,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CACzB,OAA+B,EAC/B,IAAY,EACZ,KAAiC;IAEjC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IACnD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO;IACrC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAyD;IAEzD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,MAAM,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,iBAAiB;QAAE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B,EAC/B,UAAkC,EAAE;IAEpC,kBAAkB,CAChB,OAAO,EACP,yBAAyB,EACzB,OAAO,CAAC,qBAAqB,CAC9B,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,4BAA4B,EAC5B,OAAO,CAAC,uBAAuB,IAAI,aAAa,CACjD,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,8BAA8B,EAC9B,OAAO,CAAC,yBAAyB,IAAI,aAAa,CACnD,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,oBAAoB,EACpB,OAAO,CAAC,iBAAiB,IAAI,0BAA0B,CACxD,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,iBAAiB,EACjB,OAAO,CAAC,cAAc,IAAI,iCAAiC,CAC5D,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,2BAA2B,EAC3B,6BAA6B,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAC/D,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,wBAAwB,EACxB,OAAO,CAAC,mBAAmB,IAAI,SAAS,CACzC,CAAC;IACF,kBAAkB,CAChB,OAAO,EACP,iBAAiB,EACjB,OAAO,CAAC,aAAa,IAAI,MAAM,CAChC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkC,EAAE;IAEpC,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO;gBACL,GAAG,QAAQ;gBACX,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,kCAAkC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,GAAoB,EACpB,YAA4C;IAE5C,OAAO,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;SACtE,MAAM,CAAC;AACZ,CAAC;AAED,SAAS,wBAAwB,CAC/B,YAA4C;IAE5C,IAAI,CAAC,YAAY;QAAE,OAAO,YAAY,CAAC;IAEvC,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,IAAI,YAAY,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1C,YAAY,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC9C,YAAY,CAAC,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;IAC5D,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAoB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IAElD,OAAO,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,uBAAuB,CAC9B,cAAkD;IAElD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC;IAC1D,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnC,eAAe,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAMxB;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEpD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,YAA2B;IAE3B,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,OAAO,MAAM,CAAC,WAAW,CACvB,YAAY;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO;YACL,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE/C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,MAAyB,EAAE,OAAe;IAC3D,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,IAMtB;IACC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO;QACpC,MAAM,SAAS,CACb,gBAAgB,EAChB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,IACE,CAAC,eAAe,CAAC;QACf,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;QACzD,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,EACF,CAAC;QACD,MAAM,SAAS,CACb,kBAAkB,EAClB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,GAAoB,EACpB,KAA+B;IAE/B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAE7E,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,SAAS,CACb,eAAe,EACf,6BAA6B,UAAU,QAAQ,UAAU,wBAAwB,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,CACb,eAAe,EACf,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA4B,EAAE;IAE9B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,CAAC,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrE,MAAM,CAAC,WAAW,EAAE,CACrB,CACF,CAAC;IACF,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAC9D,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAErC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;YAC7C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtE,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEtE,aAAa,CAAC;gBACZ,GAAG;gBACH,QAAQ;gBACR,kBAAkB;gBAClB,cAAc;gBACd,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/server/index.d.ts
CHANGED
|
@@ -41,6 +41,10 @@ export * from "./providers/index.js";
|
|
|
41
41
|
* Ambient request correlation context shared with instrumentation sinks.
|
|
42
42
|
*/
|
|
43
43
|
export { type ActiveRequestContext, clearActiveRequestContext, enterActiveRequestContext, getActiveRequestContext, inheritActiveRequestContext, } from "./request-context.js";
|
|
44
|
+
/**
|
|
45
|
+
* Runtime workflow registration integrity helpers.
|
|
46
|
+
*/
|
|
47
|
+
export * from "./runtime-integrity.js";
|
|
44
48
|
/**
|
|
45
49
|
* Server configuration and route types.
|
|
46
50
|
*/
|
|
@@ -53,6 +57,10 @@ export { contractsFromRoutes, createServer, defineRoute, defineRouteGroup, defin
|
|
|
53
57
|
* Server context blueprint declaration helper.
|
|
54
58
|
*/
|
|
55
59
|
export { defineServerContext } from "./server-context.js";
|
|
60
|
+
/**
|
|
61
|
+
* Trusted proxy request metadata helpers.
|
|
62
|
+
*/
|
|
63
|
+
export * from "./trusted-proxy.js";
|
|
56
64
|
export * from "./types.js";
|
|
57
65
|
/**
|
|
58
66
|
* Contract-aware route binder types and helpers.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C;;GAEG;AACH,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD;;GAEG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D;;GAEG;AACH,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B;;GAEG;AACH,YAAY,EACV,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC;;GAEG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B;;GAEG;AACH,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B;;GAEG;AACH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C;;GAEG;AACH,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD;;GAEG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D;;GAEG;AACH,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B;;GAEG;AACH,YAAY,EACV,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC;;GAEG;AACH,OAAO,EACL,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B;;GAEG;AACH,cAAc,wBAAwB,CAAC;AACvC;;GAEG;AACH,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D;;GAEG;AACH,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B;;GAEG;AACH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC"}
|
package/dist/server/index.js
CHANGED
|
@@ -21,6 +21,10 @@ export * from "./providers/index.js";
|
|
|
21
21
|
* Ambient request correlation context shared with instrumentation sinks.
|
|
22
22
|
*/
|
|
23
23
|
export { clearActiveRequestContext, enterActiveRequestContext, getActiveRequestContext, inheritActiveRequestContext, } from "./request-context.js";
|
|
24
|
+
/**
|
|
25
|
+
* Runtime workflow registration integrity helpers.
|
|
26
|
+
*/
|
|
27
|
+
export * from "./runtime-integrity.js";
|
|
24
28
|
/**
|
|
25
29
|
* Server runtime helpers.
|
|
26
30
|
*/
|
|
@@ -29,6 +33,10 @@ export { contractsFromRoutes, createServer, defineRoute, defineRouteGroup, defin
|
|
|
29
33
|
* Server context blueprint declaration helper.
|
|
30
34
|
*/
|
|
31
35
|
export { defineServerContext } from "./server-context.js";
|
|
36
|
+
/**
|
|
37
|
+
* Trusted proxy request metadata helpers.
|
|
38
|
+
*/
|
|
39
|
+
export * from "./trusted-proxy.js";
|
|
32
40
|
export * from "./types.js";
|
|
33
41
|
/**
|
|
34
42
|
* Contract-aware route binder types and helpers.
|
package/dist/server/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAS9C;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAY3D,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAQ1B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC;;GAEG;AACH,OAAO,EAEL,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAS9C;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAY3D,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAQ1B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC;;GAEG;AACH,OAAO,EAEL,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B;;GAEG;AACH,cAAc,wBAAwB,CAAC;AAavC;;GAEG;AACH,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D;;GAEG;AACH,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B;;GAEG;AACH,OAAO,EAIL,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../src/server/instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EACL,KAAK,iCAAiC,EAGvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,
|
|
1
|
+
{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../src/server/instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EACL,KAAK,iCAAiC,EAGvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAIL,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQ/E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,4BAA4B,CAAC,GAAG,GAAG,OAAO;IACzD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEjC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEpC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;;OAIG;IACH,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,iCAAiC,KACrC,iCAAiC,CAAC;IAEvC;;OAEG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,GAAG,EAAE,eAAe,CAAC;QACrB,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,QAAQ,EAAE,gBAAgB,CAAC;QAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,KAAK,OAAO,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B,CAAC,GAAG;IAC/C;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IACnC;;OAEG;IACH,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACzD;;OAEG;IACH,wBAAwB,IAAI,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;CAClC;AA8GD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAC7C,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,SAAS,GAC7D,4BAA4B,CAAC,GAAG,CAAC,CA4PnC"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { BEIGNET_ERROR_OWNER_HEADER, } from "../contracts/index.js";
|
|
2
2
|
import { redactValue } from "../ports/redaction.js";
|
|
3
3
|
import { resolveProviderInstrumentationPort, } from "../providers/instrumentation.js";
|
|
4
|
-
import { createTraceContext, parseTraceparent, } from "../tracing/index.js";
|
|
4
|
+
import { createTraceContext, parseTraceparent, resolveTracingPort, } from "../tracing/index.js";
|
|
5
5
|
import { clearActiveRequestContext, enterActiveRequestContext, readContextActor, readContextTenant, } from "./request-context.js";
|
|
6
6
|
function getContextRequestId(ctx) {
|
|
7
7
|
if (!ctx || typeof ctx !== "object")
|
|
@@ -16,7 +16,8 @@ function getContextTraceContext(ctx) {
|
|
|
16
16
|
if (!context.traceId &&
|
|
17
17
|
!context.spanId &&
|
|
18
18
|
!context.parentSpanId &&
|
|
19
|
-
!context.traceparent
|
|
19
|
+
!context.traceparent &&
|
|
20
|
+
!context.tracestate) {
|
|
20
21
|
return undefined;
|
|
21
22
|
}
|
|
22
23
|
return {
|
|
@@ -24,6 +25,7 @@ function getContextTraceContext(ctx) {
|
|
|
24
25
|
spanId: context.spanId,
|
|
25
26
|
parentSpanId: context.parentSpanId,
|
|
26
27
|
traceparent: context.traceparent,
|
|
28
|
+
tracestate: context.tracestate,
|
|
27
29
|
};
|
|
28
30
|
}
|
|
29
31
|
function getErrorMessage(error) {
|
|
@@ -97,6 +99,7 @@ export function createServerInstrumentation(options) {
|
|
|
97
99
|
const traceContextHeader = resolvedOptions.traceContextHeader ?? "traceparent";
|
|
98
100
|
const ignorePaths = resolvedOptions.ignorePaths ?? ["/api/devtools"];
|
|
99
101
|
let port;
|
|
102
|
+
let tracing;
|
|
100
103
|
const correlations = new WeakMap();
|
|
101
104
|
const prepareRequest = (req) => {
|
|
102
105
|
const cached = correlations.get(req);
|
|
@@ -108,17 +111,26 @@ export function createServerInstrumentation(options) {
|
|
|
108
111
|
const headerTraceparent = traceContextHeader === false
|
|
109
112
|
? undefined
|
|
110
113
|
: (req.headers.get(traceContextHeader) ?? undefined);
|
|
114
|
+
const parsedTraceparent = parseTraceparent(headerTraceparent);
|
|
115
|
+
const activeTrace = tracing?.current();
|
|
111
116
|
const correlation = {
|
|
112
117
|
requestId: headerRequestId ?? createRequestId(),
|
|
113
|
-
trace:
|
|
114
|
-
|
|
115
|
-
|
|
118
|
+
trace: activeTrace ??
|
|
119
|
+
createTraceContext({
|
|
120
|
+
traceparent: parsedTraceparent?.traceparent,
|
|
121
|
+
tracestate: parsedTraceparent
|
|
122
|
+
? (req.headers.get("tracestate") ?? undefined)
|
|
123
|
+
: undefined,
|
|
124
|
+
}),
|
|
116
125
|
};
|
|
117
126
|
correlations.set(req, correlation);
|
|
118
127
|
return correlation;
|
|
119
128
|
};
|
|
120
129
|
const resolveRequestId = (args) => getContextRequestId(args.ctx) ?? prepareRequest(args.req).requestId;
|
|
121
130
|
const resolveTraceContext = (args) => {
|
|
131
|
+
const activeTrace = tracing?.current();
|
|
132
|
+
if (activeTrace)
|
|
133
|
+
return activeTrace;
|
|
122
134
|
const contextTrace = getContextTraceContext(args.ctx);
|
|
123
135
|
if (contextTrace) {
|
|
124
136
|
return createTraceContext(contextTrace);
|
|
@@ -167,6 +179,7 @@ export function createServerInstrumentation(options) {
|
|
|
167
179
|
spanId: trace.spanId,
|
|
168
180
|
parentSpanId: trace.parentSpanId,
|
|
169
181
|
traceparent: trace.traceparent,
|
|
182
|
+
tracestate: trace.tracestate,
|
|
170
183
|
actor: readContextActor(args.ctx),
|
|
171
184
|
tenant: readContextTenant(args.ctx),
|
|
172
185
|
});
|
|
@@ -234,6 +247,7 @@ export function createServerInstrumentation(options) {
|
|
|
234
247
|
spanId: trace.spanId,
|
|
235
248
|
parentSpanId: trace.parentSpanId,
|
|
236
249
|
traceparent: trace.traceparent,
|
|
250
|
+
tracestate: trace.tracestate,
|
|
237
251
|
method: req.method,
|
|
238
252
|
path,
|
|
239
253
|
contractName: contract.name,
|
|
@@ -269,6 +283,7 @@ export function createServerInstrumentation(options) {
|
|
|
269
283
|
spanId: trace.spanId,
|
|
270
284
|
parentSpanId: trace.parentSpanId,
|
|
271
285
|
traceparent: trace.traceparent,
|
|
286
|
+
tracestate: trace.tracestate,
|
|
272
287
|
message: getErrorMessage(error),
|
|
273
288
|
stack: getErrorStack(error),
|
|
274
289
|
contractName: contract.name,
|
|
@@ -283,6 +298,7 @@ export function createServerInstrumentation(options) {
|
|
|
283
298
|
};
|
|
284
299
|
return {
|
|
285
300
|
attachPorts(ports) {
|
|
301
|
+
tracing = resolveTracingPort(ports);
|
|
286
302
|
if (!enabled)
|
|
287
303
|
return;
|
|
288
304
|
port = resolveProviderInstrumentationPort(ports);
|
|
@@ -290,7 +306,7 @@ export function createServerInstrumentation(options) {
|
|
|
290
306
|
prepareRequest,
|
|
291
307
|
createServiceCorrelation: () => ({
|
|
292
308
|
requestId: createRequestId(),
|
|
293
|
-
trace: createTraceContext(),
|
|
309
|
+
trace: tracing?.current() ?? createTraceContext(),
|
|
294
310
|
}),
|
|
295
311
|
hook: enabled ? hook : undefined,
|
|
296
312
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instrumentation.js","sourceRoot":"","sources":["../../src/server/instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAGL,kCAAkC,GACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,
|
|
1
|
+
{"version":3,"file":"instrumentation.js","sourceRoot":"","sources":["../../src/server/instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAGL,kCAAkC,GACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAgH9B,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,SAAS,GAAI,GAA+B,CAAC,SAAS,CAAC;IAC7D,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,OAAO,GAAG,GAAyB,CAAC;IAC1C,IACE,CAAC,OAAO,CAAC,OAAO;QAChB,CAAC,OAAO,CAAC,MAAM;QACf,CAAC,OAAO,CAAC,YAAY;QACrB,CAAC,OAAO,CAAC,WAAW;QACpB,CAAC,OAAO,CAAC,UAAU,EACnB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,GAAG,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,QAAgB,EAChB,WAA8B;IAE9B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,OAA2C,EAC3C,IAAY;IAEZ,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACxC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,CAC5C,CAAC;IACF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA0B;IAE1B,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACpE,WAAW;QACX,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAiC,EACjC,IAAY;IAEZ,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA8D;IAE9D,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,CAAC;IAClC,MAAM,eAAe,GACnB,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5D,MAAM,eAAe,GAAG,eAAe,CAAC,eAAe,IAAI,cAAc,CAAC;IAC1E,MAAM,kBAAkB,GACtB,eAAe,CAAC,kBAAkB,IAAI,aAAa,CAAC;IACtD,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,CAAC;IAErE,IAAI,IAA6C,CAAC;IAClD,IAAI,OAAgC,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,OAAO,EAAuC,CAAC;IAExE,MAAM,cAAc,GAAG,CAAC,GAAoB,EAAsB,EAAE;QAClE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,eAAe,GACnB,eAAe,KAAK,KAAK;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,CAAC;QACtD,MAAM,iBAAiB,GACrB,kBAAkB,KAAK,KAAK;YAC1B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC,CAAC;QACzD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;QACvC,MAAM,WAAW,GAAuB;YACtC,SAAS,EAAE,eAAe,IAAI,eAAe,EAAE;YAC/C,KAAK,EACH,WAAW;gBACX,kBAAkB,CAAC;oBACjB,WAAW,EAAE,iBAAiB,EAAE,WAAW;oBAC3C,UAAU,EAAE,iBAAiB;wBAC3B,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;wBAC9C,CAAC,CAAC,SAAS;iBACd,CAAC;SACL,CAAC;QACF,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnC,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,IAGzB,EAAU,EAAE,CACX,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,mBAAmB,GAAG,CAAC,IAG5B,EAAgB,EAAE;QACjB,MAAM,WAAW,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;QACvC,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,KAAwC,EAAE,EAAE;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC;wBACV,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,wCAAwC;wBACjD,KAAK,EAAE,WAAW;wBAClB,OAAO,EAAE;4BACP,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC;yBAChC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,qDAAqD;gBACvD,CAAC;gBACD,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,CAAC,IAG5B,EAAE,EAAE;QACH,IAAI,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;YAAE,OAAO;QAC9D,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,yBAAyB,CAAC;YACxB,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YACjC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,IAAI,GAA8B;QACtC,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;YACrB,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7B,sEAAsE;YACtE,2BAA2B;YAC3B,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YACrC,IAAI,eAAe,KAAK,KAAK,IAAI,kBAAkB,KAAK,KAAK,EAAE,CAAC;gBAC9D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;gBACL,GAAG,QAAQ;gBACX,OAAO,EAAE;oBACP,GAAG,QAAQ,CAAC,OAAO;oBACnB,GAAG,CAAC,eAAe,KAAK,KAAK;wBAC3B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC;oBACrC,GAAG,CAAC,kBAAkB,KAAK,KAAK;wBAC9B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;iBACjD;aACF,CAAC;QACJ,CAAC;QACD,SAAS,EAAE,CAAC,EACV,GAAG,EACH,GAAG,EACH,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,MAAM,GACP,EAAE,EAAE;YACH,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAElB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC;oBAAE,OAAO;gBAE7C,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAChE,MAAM,kBAAkB,GACtB,OAAO,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACrD,IAAI,CAAC,oBAAoB,IAAI,CAAC,kBAAkB;oBAAE,OAAO;gBAEzD,IACE,eAAe,CAAC,aAAa;oBAC7B,CAAC,eAAe,CAAC,aAAa,CAAC;wBAC7B,GAAG;wBACH,GAAG,EAAE,GAAsB;wBAC3B,QAAQ;wBACR,QAAQ;wBACR,KAAK;qBACN,CAAC,EACF,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChD,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAEjD,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,CAAC;wBACL,IAAI,EAAE,SAAS;wBACf,SAAS;wBACT,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;wBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,IAAI;wBACJ,YAAY,EAAE,QAAQ,CAAC,IAAI;wBAC3B,aAAa;wBACb,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,UAAU;wBACV,MAAM;wBACN,OAAO,EAAE;4BACP,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC;4BAC5C,KAAK,EAAE;gCACL,YAAY,EAAE,QAAQ,CAAC,IAAI;gCAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;gCAClB,IAAI;6BACL;4BACD,QAAQ,EAAE;gCACR,KAAK,EAAE,aAAa;gCACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;6BACxB;4BACD,UAAU,EAAE;gCACV,WAAW;gCACX,cAAc;gCACd,YAAY;gCACZ,WAAW;6BACZ;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;oBAChC,MAAM,CAAC;wBACL,IAAI,EAAE,OAAO;wBACb,SAAS;wBACT,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;wBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC;wBAC/B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;wBAC3B,YAAY,EAAE,QAAQ,CAAC,IAAI;wBAC3B,KAAK,EAAE,aAAa,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,yBAAyB,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;KACF,CAAC;IAEF,OAAO;QACL,WAAW,CAAC,KAAK;YACf,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,GAAG,kCAAkC,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC;QACD,cAAc;QACd,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/B,SAAS,EAAE,eAAe,EAAE;YAC5B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,kBAAkB,EAAE;SAClD,CAAC;QACF,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACjC,CAAC;AACJ,CAAC"}
|
|
@@ -14,6 +14,7 @@ export interface ActiveRequestContext {
|
|
|
14
14
|
spanId?: string;
|
|
15
15
|
parentSpanId?: string;
|
|
16
16
|
traceparent?: string;
|
|
17
|
+
tracestate?: string;
|
|
17
18
|
/**
|
|
18
19
|
* Actor for the current request or service execution, when known.
|
|
19
20
|
*/
|
|
@@ -71,6 +72,9 @@ export declare function setActiveRequestIdentity(identity: {
|
|
|
71
72
|
export declare function inheritActiveRequestContext<Event extends {
|
|
72
73
|
requestId?: string;
|
|
73
74
|
traceId?: string;
|
|
75
|
+
spanId?: string;
|
|
76
|
+
parentSpanId?: string;
|
|
74
77
|
traceparent?: string;
|
|
78
|
+
tracestate?: string;
|
|
75
79
|
}>(event: Event): Event;
|
|
76
80
|
//# sourceMappingURL=request-context.d.ts.map
|