@bleedingdev/modern-js-bff-core 3.9.0-ultramodern.2 → 3.9.0-ultramodern.21

package/dist/esm/adapter-kit/parity-scenarios/schema.mjs

@@ -1,71 +0,0 @@
-const createSchemaParityScenarios = ()=>[
-        {
-            name: 'schema handler success',
-            policy: false,
-            request: {
-                method: 'patch',
-                path: '/schema',
-                headers: {
-                    'content-type': 'application/json'
-                },
-                body: {
-                    id: 777
-                }
-            },
-            expected: {
-                kind: 'payload',
-                status: 200,
-                payload: {
-                    type: 'HandleSuccess',
-                    value: {
-                        id: 777
-                    }
-                }
-            }
-        },
-        {
-            name: 'schema handler input validation error',
-            policy: false,
-            request: {
-                method: 'patch',
-                path: '/schema',
-                headers: {
-                    'content-type': 'application/json'
-                },
-                body: {
-                    id: 'aaa'
-                }
-            },
-            expected: {
-                kind: 'payload',
-                status: 200,
-                payload: {
-                    type: 'InputValidationError',
-                    message: 'invalid input'
-                }
-            }
-        },
-        {
-            name: 'schema handler output validation error',
-            policy: false,
-            request: {
-                method: 'patch',
-                path: '/schema',
-                headers: {
-                    'content-type': 'application/json'
-                },
-                body: {
-                    id: 'boom'
-                }
-            },
-            expected: {
-                kind: 'payload',
-                status: 200,
-                payload: {
-                    type: 'OutputValidationError',
-                    message: 'invalid output'
-                }
-            }
-        }
-    ];
-export { createSchemaParityScenarios };

package/dist/esm/adapter-kit/parity-scenarios/shared.mjs

@@ -1,21 +0,0 @@
-const PARITY_REQUEST_ID = 'crm';
-const PARITY_PRODUCER_REQUEST_ID = 'crm.producer-a';
-const envelopeHeader = (requestId)=>JSON.stringify(void 0 === requestId ? {} : {
-        requestId
-    });
-const detailHeader = (details)=>JSON.stringify(details);
-const deniedScenario = (name, reason, headers)=>({
-        name,
-        policy: true,
-        request: {
-            method: 'get',
-            path: '/hello',
-            headers
-        },
-        expected: {
-            kind: 'denied',
-            status: 403,
-            reason
-        }
-    });
-export { PARITY_PRODUCER_REQUEST_ID, PARITY_REQUEST_ID, deniedScenario, detailHeader, envelopeHeader };

package/dist/esm/adapter-kit/parity.mjs

@@ -1,148 +0,0 @@
-import { buildOperationContractMap } from "../security/operationContracts.mjs";
-import { HttpMethod } from "../types.mjs";
-import { createCrossProjectDenialScenarios } from "./parity-scenarios/cross-project-denial.mjs";
-import { createEnvelopeParityScenarios } from "./parity-scenarios/envelope.mjs";
-import { createOperationContextDenialScenarios, createOperationContextSuccessScenarios } from "./parity-scenarios/operation-context.mjs";
-import { createSchemaParityScenarios } from "./parity-scenarios/schema.mjs";
-import { PARITY_PRODUCER_REQUEST_ID, PARITY_REQUEST_ID, envelopeHeader } from "./parity-scenarios/shared.mjs";
-const PARITY_FIXTURE_FILENAME = 'bff-core/adapter-kit/parity-fixture.ts';
-const HANDLER_WITH_SCHEMA = 'HANDLER_WITH_SCHEMA';
-const isRecord = (value)=>Boolean(value) && 'object' == typeof value;
-const createSchemaFixtureHandler = ()=>{
-    const handler = (input)=>{
-        const data = isRecord(input) && isRecord(input.data) ? input.data : void 0;
-        const id = data?.id;
-        if ('number' == typeof id) return {
-            type: 'HandleSuccess',
-            value: {
-                id
-            }
-        };
-        if ('boom' === id) return {
-            type: 'OutputValidationError',
-            message: 'invalid output'
-        };
-        return {
-            type: 'InputValidationError',
-            message: 'invalid input'
-        };
-    };
-    return Object.assign(handler, {
-        [HANDLER_WITH_SCHEMA]: true
-    });
-};
-const createParityApiHandlerInfos = ()=>[
-        {
-            name: 'getHello',
-            httpMethod: HttpMethod.Get,
-            routeName: '/hello',
-            routePath: '/hello',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>({
-                    message: 'hello'
-                })
-        },
-        {
-            name: 'postHello',
-            httpMethod: HttpMethod.Post,
-            routeName: '/hello',
-            routePath: '/hello',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>'hello'
-        },
-        {
-            name: 'getNothing',
-            httpMethod: HttpMethod.Get,
-            routeName: '/nothing',
-            routePath: '/nothing',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>void 0
-        },
-        {
-            name: 'postEcho',
-            httpMethod: HttpMethod.Post,
-            routeName: '/echo',
-            routePath: '/echo',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: (input)=>{
-                const normalized = isRecord(input) ? input : {};
-                return {
-                    data: normalized.data ?? null,
-                    query: normalized.query ?? {},
-                    cookie: normalized.cookies ?? null
-                };
-            }
-        },
-        {
-            name: 'getItem',
-            httpMethod: HttpMethod.Get,
-            routeName: '/items/:id',
-            routePath: '/items/:id',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: (id, input)=>({
-                    id,
-                    query: isRecord(input) ? input.query ?? {} : {}
-                })
-        },
-        {
-            name: 'patchSchema',
-            httpMethod: HttpMethod.Patch,
-            routeName: '/schema',
-            routePath: '/schema',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: createSchemaFixtureHandler()
-        }
-    ];
-const createParityBffConfig = ()=>({
-        requestId: PARITY_PRODUCER_REQUEST_ID,
-        crossProjectPolicy: {
-            enabled: true,
-            allowedNamespaces: [
-                PARITY_REQUEST_ID
-            ],
-            allowClientAssertedNamespace: true
-        }
-    });
-const getParityContracts = ()=>buildOperationContractMap({
-        handlers: createParityApiHandlerInfos(),
-        requestId: PARITY_PRODUCER_REQUEST_ID
-    });
-const createAdapterParityScenarios = ()=>{
-    const contracts = getParityContracts();
-    const helloContract = contracts['GET:/hello'];
-    const validEnvelope = envelopeHeader(PARITY_PRODUCER_REQUEST_ID);
-    const validOperationId = helloContract.operationId;
-    const context = {
-        helloContract,
-        validEnvelope,
-        validOperationId
-    };
-    return [
-        ...createEnvelopeParityScenarios(),
-        ...createSchemaParityScenarios(),
-        ...createOperationContextSuccessScenarios(context),
-        ...createCrossProjectDenialScenarios(),
-        ...createOperationContextDenialScenarios(context)
-    ];
-};
-const toParityResult = (res)=>({
-        status: res.status,
-        payload: res.type.includes('json') ? res.body : '' === res.text ? void 0 : res.text
-    });
-const formatValue = (value)=>JSON.stringify(value);
-const assertParityResult = (scenario, res)=>{
-    const result = toParityResult(res);
-    const failures = [];
-    const { expected } = scenario;
-    if (result.status !== expected.status) failures.push(`status: expected ${expected.status}, received ${result.status}`);
-    if ('payload' === expected.kind) {
-        if (formatValue(result.payload) !== formatValue(expected.payload)) failures.push(`payload: expected ${formatValue(expected.payload)}, received ${formatValue(result.payload)}`);
-    } else {
-        const payload = isRecord(result.payload) ? result.payload : {};
-        if ('BFF_CROSS_PROJECT_POLICY_DENIED' !== payload.code) failures.push(`denial code: expected "BFF_CROSS_PROJECT_POLICY_DENIED", received ${formatValue(payload.code)}`);
-        if (payload.reason !== expected.reason) failures.push(`denial reason: expected "${expected.reason}", received ${formatValue(payload.reason)}`);
-        if ('string' != typeof payload.message || 0 === payload.message.length) failures.push(`denial message: expected non-empty string, received ${formatValue(payload.message)}`);
-    }
-    if (failures.length > 0) throw new Error(`Adapter parity scenario "${scenario.name}" failed:\n- ${failures.join('\n- ')}`);
-};
-export { PARITY_PRODUCER_REQUEST_ID, PARITY_REQUEST_ID, assertParityResult, createAdapterParityScenarios, createParityApiHandlerInfos, createParityBffConfig, toParityResult };

package/dist/esm/security/crossProjectPolicy.mjs

@@ -1,259 +0,0 @@
-const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
-const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
-const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
-const DEFAULT_DENY_STATUS = 403;
-const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
-let hasWarnedAdvisoryNamespaceAllowlist = false;
-const splitRoutePath = (routePath)=>routePath.split('/').filter(Boolean);
-const isDynamicRouteSegment = (segment)=>segment.startsWith(':') || '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-const hasTrailingSlash = (routePath)=>routePath.length > 1 && routePath.endsWith('/');
-const hasUnsafePathEncoding = (requestPath)=>{
-    let decoded = requestPath;
-    for(let depth = 0; depth < 8; depth += 1){
-        if (/%(?:2f|5c)/i.test(decoded)) return true;
-        try {
-            const next = decodeURIComponent(decoded);
-            if (next === decoded) return false;
-            decoded = next;
-        } catch  {
-            return true;
-        }
-    }
-    return decoded.includes('%');
-};
-const routeSegmentsMatch = (templateSegments, requestSegments)=>{
-    let templateIndex = 0;
-    let requestIndex = 0;
-    while(templateIndex < templateSegments.length){
-        const segment = templateSegments[templateIndex];
-        const wildcard = '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-        const optional = segment.startsWith(':') && segment.endsWith('?');
-        if (templateIndex < templateSegments.length - 1 && (wildcard || optional)) return false;
-        if (wildcard) return true;
-        const requestSegment = requestSegments[requestIndex];
-        if (void 0 === requestSegment) return optional && templateIndex === templateSegments.length - 1;
-        if (!segment.startsWith(':') && segment !== requestSegment) return false;
-        templateIndex += 1;
-        requestIndex += 1;
-    }
-    return requestIndex === requestSegments.length;
-};
-const routeTemplateMatchScore = (routePath, requestPath)=>{
-    if (hasTrailingSlash(routePath) !== hasTrailingSlash(requestPath)) return;
-    const templateSegments = splitRoutePath(routePath);
-    const requestSegments = splitRoutePath(requestPath);
-    for(let prefixLength = 0; prefixLength <= templateSegments.length; prefixLength += 1){
-        const removedPrefix = templateSegments.slice(0, prefixLength);
-        if (removedPrefix.some(isDynamicRouteSegment)) break;
-        const mountedTemplate = templateSegments.slice(prefixLength);
-        if (!routeSegmentsMatch(mountedTemplate, requestSegments)) continue;
-        const literalSegments = mountedTemplate.filter((segment)=>!isDynamicRouteSegment(segment)).length;
-        const dynamicSegments = mountedTemplate.length - literalSegments;
-        return (0 === prefixLength ? 1000000 : 0) + 10000 * literalSegments - 100 * dynamicSegments - prefixLength;
-    }
-};
-const resolveCrossProjectRequestObservation = (request, policy)=>{
-    const requestMethod = String(request.method || '').trim().toUpperCase();
-    const routePaths = [
-        ...new Set(Object.keys(policy.expectedOperationContracts ?? {}).flatMap((key)=>{
-            if (key.startsWith('operation:')) return [];
-            const separator = key.indexOf(':');
-            if (-1 === separator || key.slice(0, separator).trim().toUpperCase() !== requestMethod) return [];
-            return [
-                key.slice(separator + 1)
-            ];
-        }))
-    ];
-    if (0 === routePaths.length) return;
-    if (hasUnsafePathEncoding(request.pathname)) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    const matches = routePaths.flatMap((routePath)=>{
-        const score = routeTemplateMatchScore(routePath, request.pathname);
-        return void 0 === score ? [] : [
-            {
-                routePath,
-                score
-            }
-        ];
-    });
-    if (0 === matches.length) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    matches.sort((left, right)=>right.score - left.score);
-    return {
-        method: request.method,
-        routePath: matches[1]?.score === matches[0]?.score ? request.pathname : matches[0].routePath
-    };
-};
-const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
-const normalizeStatusCode = (statusCode)=>{
-    if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
-    return DEFAULT_DENY_STATUS;
-};
-const readHeader = (headers, headerName)=>{
-    const lowerHeaderName = headerName.toLowerCase();
-    for (const [name, value] of Object.entries(headers || {}))if (name.toLowerCase() === lowerHeaderName) {
-        if (Array.isArray(value)) return value.length > 0 ? String(value[0]) : void 0;
-        if (null == value) return;
-        return String(value);
-    }
-};
-const extractNamespace = (requestId)=>requestId.split(/[/:.]/)[0]?.trim().toLowerCase();
-const createViolation = (reason, message, status)=>({
-        code: 'BFF_CROSS_PROJECT_POLICY_DENIED',
-        reason,
-        message,
-        status
-    });
-const warnAdvisoryNamespaceAllowlist = ()=>{
-    if (hasWarnedAdvisoryNamespaceAllowlist) return;
-    hasWarnedAdvisoryNamespaceAllowlist = true;
-    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
-};
-const createCrossProjectPolicyEvaluationState = (headers, policy, observedRequest)=>({
-        headers,
-        policy,
-        status: normalizeStatusCode(policy.denyStatus),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        allowClientAssertedNamespace: policy.allowClientAssertedNamespace ?? false,
-        verifyProducerIdentity: 'function' == typeof policy.verifyProducerIdentity ? policy.verifyProducerIdentity : void 0,
-        allowedNamespaces: (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean),
-        envelopeHeader: normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER),
-        operationContextHeader: normalizeHeaderName(policy.operationContextHeader, BFF_OPERATION_CONTEXT_HEADER),
-        operationContextDetailHeader: normalizeHeaderName(policy.operationContextDetailHeader, BFF_OPERATION_CONTEXT_DETAIL_HEADER),
-        requestId: '',
-        detailSchemaHash: '',
-        detailOperationVersion: void 0,
-        observedRequest: observedRequest ? {
-            method: String(observedRequest.method || '').trim().toUpperCase(),
-            routePath: String(observedRequest.routePath || '').trim()
-        } : void 0,
-        complete: false
-    });
-const checkNamespaceAllowlistVerifier = (state)=>{
-    if (state.allowedNamespaces.length > 0 && void 0 === state.verifyProducerIdentity) {
-        if (!state.allowClientAssertedNamespace) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
-        warnAdvisoryNamespaceAllowlist();
-    }
-};
-const checkEnvelopeHeader = (state)=>{
-    const envelopeRaw = readHeader(state.headers, state.envelopeHeader);
-    if (!envelopeRaw) {
-        if (!state.requireEnvelope) {
-            state.complete = true;
-            return;
-        }
-        return createViolation('missing_envelope', `Missing cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    let envelope;
-    try {
-        const parsed = JSON.parse(envelopeRaw);
-        if (!parsed || 'object' != typeof parsed) throw new Error('invalid envelope object');
-        envelope = parsed;
-    } catch (_error) {
-        return createViolation('invalid_envelope', `Invalid cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    const requestId = String(envelope.requestId || '').trim();
-    if (!requestId) return createViolation('missing_request_id', 'Cross-project envelope does not include a valid requestId', state.status);
-    state.requestId = requestId;
-    state.claimedNamespace = extractNamespace(requestId);
-    state.effectiveNamespace = state.claimedNamespace;
-};
-const checkProducerIdentity = (state)=>{
-    if (!state.verifyProducerIdentity) return;
-    const verifiedNamespaceRaw = state.verifyProducerIdentity(state.headers);
-    const verifiedNamespace = 'string' == typeof verifiedNamespaceRaw ? verifiedNamespaceRaw.trim().toLowerCase() : void 0;
-    if (!verifiedNamespace) return createViolation('producer_identity_mismatch', 'Producer identity could not be verified for request', state.status);
-    if (verifiedNamespace !== state.claimedNamespace) return createViolation('producer_identity_mismatch', `Envelope namespace "${state.claimedNamespace || 'unknown'}" does not match verified producer identity "${verifiedNamespace}"`, state.status);
-    state.effectiveNamespace = verifiedNamespace;
-};
-const checkNamespaceAllowlist = (state)=>{
-    if (state.allowedNamespaces.length > 0) {
-        if (!state.effectiveNamespace || !state.allowedNamespaces.includes(state.effectiveNamespace)) return createViolation('namespace_not_allowed', `Producer namespace "${state.effectiveNamespace || 'unknown'}" not allowed`, state.status);
-    }
-};
-const checkOperationContext = (state)=>{
-    if (!state.requireOperationContext) {
-        state.complete = true;
-        return;
-    }
-    const operationContext = readHeader(state.headers, state.operationContextHeader);
-    if (!operationContext) return createViolation('missing_operation_context', `Missing operation context header "${state.operationContextHeader}"`, state.status);
-    if (!operationContext.startsWith(`${state.requestId}:`)) return createViolation('operation_context_mismatch', `Operation context header "${state.operationContextHeader}" does not match requestId "${state.requestId}"`, state.status);
-    state.operationContext = operationContext;
-};
-const checkOperationContextDetails = (state)=>{
-    const operationContextDetailsRaw = readHeader(state.headers, state.operationContextDetailHeader);
-    if (!operationContextDetailsRaw) {
-        if (state.requireOperationContextDetails) return createViolation('missing_operation_context_details', `Missing operation context details header "${state.operationContextDetailHeader}"`, state.status);
-        state.complete = true;
-        return;
-    }
-    let operationContextDetails;
-    try {
-        const parsed = JSON.parse(operationContextDetailsRaw);
-        if (!parsed || 'object' != typeof parsed || Array.isArray(parsed)) throw new Error('invalid operation context details object');
-        operationContextDetails = parsed;
-    } catch (_error) {
-        return createViolation('invalid_operation_context_details', `Invalid operation context details header "${state.operationContextDetailHeader}"`, state.status);
-    }
-    const detailRequestId = String(operationContextDetails.requestId || '').trim();
-    if (detailRequestId && detailRequestId !== state.requestId) return createViolation('operation_context_details_request_id_mismatch', `Operation context details requestId "${detailRequestId}" does not match envelope requestId "${state.requestId}"`, state.status);
-    const detailOperationId = String(operationContextDetails.operationId || '').trim();
-    if (state.operationContext && detailOperationId && detailOperationId !== state.operationContext) return createViolation('operation_context_mismatch', `Operation context details operationId "${detailOperationId}" does not match operation context "${state.operationContext}"`, state.status);
-    state.operationContextDetails = operationContextDetails;
-    state.detailSchemaHash = String(operationContextDetails.schemaHash || '').trim();
-    if (state.requireOperationSchemaHash && !state.detailSchemaHash) return createViolation('missing_operation_schema_hash', `Operation context details header "${state.operationContextDetailHeader}" must include schemaHash`, state.status);
-    state.detailOperationVersion = operationContextDetails.operationVersion;
-    if (state.requireOperationVersion && 'number' != typeof state.detailOperationVersion) return createViolation('missing_operation_version', `Operation context details header "${state.operationContextDetailHeader}" must include operationVersion`, state.status);
-};
-const checkOperationContract = (state)=>{
-    if (!state.operationContextDetails) return;
-    const expectedContracts = state.policy.expectedOperationContracts;
-    if (expectedContracts && 'object' == typeof expectedContracts) {
-        const method = String(state.operationContextDetails.method || '').toUpperCase();
-        const routePath = String(state.operationContextDetails.routePath || '').trim();
-        const operationId = String(state.operationContextDetails.operationId || '').trim();
-        const observedMethod = state.observedRequest?.method;
-        const observedRoutePath = state.observedRequest?.routePath;
-        if (observedMethod && observedRoutePath && (method !== observedMethod || routePath !== observedRoutePath)) return createViolation('operation_context_mismatch', `Client operation "${operationId || `${method}:${routePath}`}" does not match observed request "${observedMethod}:${observedRoutePath}"`, state.status);
-        const contractMethod = observedMethod || method;
-        const contractRoutePath = observedRoutePath || routePath;
-        const expectedContract = expectedContracts[`${contractMethod}:${contractRoutePath}`] || (state.observedRequest ? void 0 : expectedContracts[`operation:${operationId}`]);
-        if (expectedContract) {
-            const assertedOperationId = operationId || state.operationContext || '';
-            const canonicalRouteOperationId = `${state.requestId}:${contractMethod}:${contractRoutePath}`;
-            if (state.observedRequest && assertedOperationId !== expectedContract.operationId && assertedOperationId !== canonicalRouteOperationId) return createViolation('operation_context_mismatch', `Client operation "${assertedOperationId}" does not identify observed contract "${expectedContract.operationId || canonicalRouteOperationId}"`, state.status);
-            if (expectedContract.schemaHash && state.detailSchemaHash && expectedContract.schemaHash !== state.detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-            if ('number' == typeof expectedContract.operationVersion && 'number' == typeof state.detailOperationVersion && expectedContract.operationVersion !== state.detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-        } else if (!state.allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, state.status);
-    }
-};
-const CROSS_PROJECT_POLICY_CHECKS = [
-    checkNamespaceAllowlistVerifier,
-    checkEnvelopeHeader,
-    checkProducerIdentity,
-    checkNamespaceAllowlist,
-    checkOperationContext,
-    checkOperationContextDetails,
-    checkOperationContract
-];
-const evaluateCrossProjectPolicy = (headers, policy, observedRequest)=>{
-    if (!policy?.enabled) return null;
-    const state = createCrossProjectPolicyEvaluationState(headers, policy, observedRequest);
-    for (const check of CROSS_PROJECT_POLICY_CHECKS){
-        const violation = check(state);
-        if (violation) return violation;
-        if (state.complete) break;
-    }
-    return null;
-};
-export { BFF_ENVELOPE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, evaluateCrossProjectPolicy, resolveCrossProjectRequestObservation };

package/dist/esm/security/operationContracts.mjs

@@ -1,127 +0,0 @@
-import { createRequire } from "node:module";
-import { createHash } from "crypto";
-import "reflect-metadata";
-import { HttpMetadata } from "../types.mjs";
-const DEFAULT_OPERATION_VERSION = 1;
-const deriveOperationVersion = (packageVersion)=>{
-    if ('string' != typeof packageVersion) return DEFAULT_OPERATION_VERSION;
-    const match = packageVersion.trim().match(/^v?(\d+)\./);
-    if (!match) return DEFAULT_OPERATION_VERSION;
-    const major = Number.parseInt(match[1], 10);
-    return Number.isInteger(major) && major >= 0 ? major : DEFAULT_OPERATION_VERSION;
-};
-const stableStringify = (value)=>{
-    if (Array.isArray(value)) return `[${value.map((item)=>stableStringify(item)).join(',')}]`;
-    if (value && 'object' == typeof value) {
-        const entries = Object.entries(value).filter(([, entryValue])=>void 0 !== entryValue).sort(([a], [b])=>a.localeCompare(b)).map(([key, entryValue])=>`${JSON.stringify(key)}:${stableStringify(entryValue)}`);
-        return `{${entries.join(',')}}`;
-    }
-    return JSON.stringify(value) ?? 'null';
-};
-const sha256 = (text)=>createHash('sha256').update(text).digest('hex');
-let cachedZodToJSONSchema;
-const ZOD_SPECIFIER = "zod";
-const resolveZodToJSONSchema = ()=>{
-    if (void 0 !== cachedZodToJSONSchema) return cachedZodToJSONSchema;
-    try {
-        const load = createRequire('string' == typeof __filename ? __filename : import.meta.url);
-        const zod = load(ZOD_SPECIFIER);
-        const candidate = zod?.toJSONSchema ?? zod?.z?.toJSONSchema;
-        cachedZodToJSONSchema = 'function' == typeof candidate ? candidate : null;
-    } catch  {
-        cachedZodToJSONSchema = null;
-    }
-    return cachedZodToJSONSchema;
-};
-const INPUT_SCHEMA_METADATA_KEYS = [
-    HttpMetadata.Data,
-    HttpMetadata.Query,
-    HttpMetadata.Params,
-    HttpMetadata.Headers,
-    HttpMetadata.Files
-];
-const serializeSchema = (schema)=>{
-    const toJSONSchema = resolveZodToJSONSchema();
-    if (toJSONSchema) try {
-        return toJSONSchema(schema, {
-            io: 'input',
-            unrepresentable: 'any'
-        });
-    } catch  {}
-    return {
-        __unserializableSchema: true
-    };
-};
-const serializeOperationSchemas = (handler)=>{
-    if ('function' != typeof handler) return;
-    const serialized = {};
-    for (const metadataKey of INPUT_SCHEMA_METADATA_KEYS){
-        let schema;
-        try {
-            schema = Reflect.getMetadata(metadataKey, handler);
-        } catch  {
-            schema = void 0;
-        }
-        if (null != schema) serialized[metadataKey] = serializeSchema(schema);
-    }
-    return Object.keys(serialized).length > 0 ? serialized : void 0;
-};
-const createOperationContractHash = (operation, requestId)=>sha256(stableStringify({
-        httpMethod: String(operation.httpMethod || '').toUpperCase(),
-        name: operation.name,
-        requestId,
-        routePath: operation.routePath,
-        ...operation.schemas ? {
-            schemas: operation.schemas
-        } : {}
-    }));
-const createOperationEntries = (handlers)=>handlers.map((item)=>({
-            name: item.name,
-            httpMethod: String(item.httpMethod || '').toUpperCase(),
-            routePath: item.routePath
-        })).sort((a, b)=>{
-        const keyA = `${a.routePath}:${a.httpMethod}:${a.name}`;
-        const keyB = `${b.routePath}:${b.httpMethod}:${b.name}`;
-        return keyA.localeCompare(keyB);
-    });
-const createOperationSchemaHash = (operationEntries, requestId)=>sha256(stableStringify({
-        operations: [
-            ...operationEntries
-        ].map((item)=>({
-                hash: item.schemaHash ?? createOperationContractHash({
-                    name: item.name,
-                    httpMethod: item.httpMethod,
-                    routePath: item.routePath
-                }, requestId)
-            })).sort((a, b)=>a.hash.localeCompare(b.hash)),
-        requestId
-    }));
-const buildOperationContractMap = ({ handlers, requestId, operationVersion })=>{
-    const normalizedRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId.trim() : 'default';
-    const normalizedOperationVersion = 'number' == typeof operationVersion && Number.isInteger(operationVersion) ? operationVersion : DEFAULT_OPERATION_VERSION;
-    const contracts = {};
-    handlers.forEach((item)=>{
-        const httpMethod = String(item.httpMethod || '').toUpperCase();
-        const schemaHash = createOperationContractHash({
-            name: item.name,
-            httpMethod,
-            routePath: item.routePath,
-            schemas: serializeOperationSchemas(item.handler)
-        }, normalizedRequestId);
-        const operationId = `${normalizedRequestId}:${item.name}`;
-        const contract = {
-            requestId: normalizedRequestId,
-            operationVersion: normalizedOperationVersion,
-            schemaHash,
-            method: httpMethod,
-            routePath: item.routePath,
-            operationId,
-            handlerName: item.name,
-            filename: item.filename
-        };
-        contracts[`${httpMethod}:${item.routePath}`] = contract;
-        contracts[`operation:${operationId}`] = contract;
-    });
-    return contracts;
-};
-export { DEFAULT_OPERATION_VERSION, buildOperationContractMap, createOperationContractHash, createOperationEntries, createOperationSchemaHash, deriveOperationVersion, serializeOperationSchemas };

package/dist/esm/security/resolveCrossProjectPolicy.mjs

@@ -1,27 +0,0 @@
-import { buildOperationContractMap } from "./operationContracts.mjs";
-const resolveCrossProjectPolicy = (input)=>{
-    const { crossProjectPolicy, handlers, requestId, isCrossProjectServer, operationVersion } = input;
-    if (!crossProjectPolicy && !isCrossProjectServer) return;
-    const policy = crossProjectPolicy ?? {};
-    const effectiveRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId : 'default';
-    const generatedContracts = buildOperationContractMap({
-        handlers,
-        requestId: effectiveRequestId,
-        operationVersion
-    });
-    return {
-        ...policy,
-        enabled: policy.enabled ?? Boolean(isCrossProjectServer),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        expectedOperationContracts: {
-            ...policy.expectedOperationContracts ?? {},
-            ...generatedContracts
-        }
-    };
-};
-export { resolveCrossProjectPolicy };