@bgord/bun 1.23.1 → 1.23.3

package/src/shield-hcaptcha.strategy.ts

@@ -6,10 +6,12 @@ export const ShieldHcaptchaStrategyError = { Rejected: "shield.hcaptcha.rejected
 
 export const ShieldHcaptchaStrategyField = "h-captcha-response";
 
+export type ShieldHcaptchaConfig = { secretKey: HCaptchaSecretKeyType; hostname: string };
+
 export class ShieldHcaptchaStrategy {
   private readonly hcaptcha = new HCaptchaService();
 
-  constructor(private readonly secretKey: HCaptchaSecretKeyType) {}
+  constructor(private readonly config: ShieldHcaptchaConfig) {}
 
   async evaluate(context: HasRequestForm & HasRequestJson): Promise<boolean> {
     try {
@@ -23,9 +25,12 @@ export class ShieldHcaptchaStrategy {
 
       if (!token) return false;
 
-      const result = await this.hcaptcha.verify(this.secretKey, token);
+      const result = await this.hcaptcha.verify(this.config.secretKey, token);
+
+      if (!result.success) return false;
+      if (result.hostname !== this.config.hostname) return false;
 
-      return result.success;
+      return true;
     } catch {
       return false;
     }

package/src/shield-recaptcha.strategy.ts

@@ -4,8 +4,13 @@ import * as v from "valibot";
 import type { RecaptchaSecretKeyType } from "./recaptcha-secret-key.vo";
 import type { HasIdentityIp, HasRequestForm, HasRequestJson } from "./request-context.port";
 
-export type ShieldRecaptchaConfig = { secretKey: RecaptchaSecretKeyType; threshold?: number };
-export type RecaptchaResult = { success: boolean; score: number };
+export type ShieldRecaptchaConfig = {
+  secretKey: RecaptchaSecretKeyType;
+  hostname: string;
+  action?: string;
+  threshold?: number;
+};
+export type RecaptchaResult = { success: boolean; score: number; hostname?: string; action?: string };
 
 export const ShieldRecaptchaStrategyError = { Rejected: "shield.recaptcha.rejected" };
 
@@ -51,6 +56,8 @@ export class ShieldRecaptchaStrategy {
 
       if (!result.success) return false;
       if (typeof result.score !== "number" || result.score < threshold) return false;
+      if (result.hostname !== this.config.hostname) return false;
+      if (this.config.action !== undefined && result.action !== this.config.action) return false;
 
       return true;
     } catch {

package/src/subject-segment-remote-ip.strategy.ts

@@ -0,0 +1,14 @@
+import type { HasIdentityRemoteIp } from "./request-context.port";
+import {
+  SubjectSegmentRequestEmpty,
+  type SubjectSegmentRequestStrategy,
+  type SubjectSegmentType,
+} from "./subject-segment-request.strategy";
+
+export class SubjectSegmentRemoteIpStrategy implements SubjectSegmentRequestStrategy {
+  readonly label = "remote-ip";
+
+  create(context: HasIdentityRemoteIp): SubjectSegmentType {
+    return context.identity.remoteIp() ?? SubjectSegmentRequestEmpty;
+  }
+}

package/src/subject-segment-request.strategy.ts

@@ -1,5 +1,6 @@
 import type {
   HasIdentityIp,
+  HasIdentityRemoteIp,
   HasIdentityUserId,
   HasRequestCookie,
   HasRequestHeader,
@@ -21,6 +22,7 @@ type RequestContextCapabilities = HasRequestCookie &
   HasRequestQueries &
   HasRequestParam &
   HasIdentityIp &
+  HasIdentityRemoteIp &
   HasIdentityUserId;
 
 export interface SubjectSegmentRequestStrategy {

package/src/webhook-body-builder-signed-headers.strategy.ts

@@ -0,0 +1,12 @@
+import type { HasRequestHeader, HasRequestText } from "./request-context.port";
+import type { WebhookBodyBuilderStrategy } from "./webhook-body-builder.strategy";
+
+export class WebhookBodyBuilderSignedHeadersStrategy implements WebhookBodyBuilderStrategy {
+  constructor(private readonly headers: ReadonlyArray<string>) {}
+
+  async build(context: HasRequestHeader & HasRequestText): Promise<string> {
+    const headers = this.headers.map((name) => [name, context.request.header(name) ?? null]);
+
+    return JSON.stringify([headers, await context.request.text()]);
+  }
+}

package/src/webhook-signature.vo.ts

@@ -3,11 +3,16 @@ import * as v from "valibot";
 export const WebhookSignatureError = {
   Type: "webhook.signature.type",
   Empty: "webhook.signature.empty",
+  InvalidHex: "webhook.signature.invalid.hex",
 };
 
+// Hex chars allowed
+const CHARS_WHITELIST = /^[a-fA-F0-9]+$/;
+
 export const WebhookSignature = v.pipe(
   v.string(WebhookSignatureError.Type),
   v.nonEmpty(WebhookSignatureError.Empty),
+  v.regex(CHARS_WHITELIST, WebhookSignatureError.InvalidHex),
   // Stryker disable next-line StringLiteral
   v.brand("WebhookSignature"),
 );

package/src/webhook-verifier-sha256.strategy.ts

@@ -9,9 +9,10 @@ export class WebhookVerifierSha256Strategy implements WebhookVerifierStrategy {
   constructor(private readonly config: Config) {}
 
   verify(body: string, signature: WebhookSignatureType): boolean {
-    const digest = this.config.WebhookSignatureCreator.create(body);
+    const digest = Buffer.from(this.config.WebhookSignatureCreator.create(body));
+    const candidate = Buffer.from(signature);
 
-    if (digest.length !== signature.length) return false;
-    return timingSafeEqual(Buffer.from(digest), Buffer.from(signature));
+    if (digest.length !== candidate.length) return false;
+    return timingSafeEqual(digest, candidate);
   }
 }

package/src/woodchopper.ts

@@ -24,7 +24,7 @@ export type WoodchopperConfig = {
   level: LogLevelEnum;
   environment: NodeEnvironmentEnum;
   dispatcher: WoodchopperDispatcher;
-  redactor?: RedactorStrategy;
+  redactor: RedactorStrategy;
   diagnostics?: WoodchopperDiagnosticsStrategy;
 };
 
@@ -88,9 +88,7 @@ export class Woodchopper implements LoggerPort, LoggerStatsProviderPort {
 
     let withRedaction: LoggerEntry;
     try {
-      withRedaction = this.config.redactor
-        ? this.config.redactor.redact(withInjectedFields)
-        : withInjectedFields;
+      withRedaction = this.config.redactor.redact(withInjectedFields);
     } catch (error) {
       this.stats.recordDropped();
       this.config.diagnostics?.handle({ kind: "redaction", error });