@camada/node 0.3.0 → 0.3.2

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse, Server } from 'node:http';
-import { a as CamadaOptions, C as Camada } from './camada-Dh_9D6Sx.js';
-export { R as ResolvedEnv, c as createCamada, r as resolveEnv } from './camada-Dh_9D6Sx.js';
+import { a as CamadaOptions, C as Camada } from './camada-CFmJTruP.js';
+export { R as ResolvedEnv, c as createCamada, r as resolveEnv } from './camada-CFmJTruP.js';
 export { parseTrustedProxyEnv } from '@camada/core';
 
 declare function getDefault(): Camada;

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   index_default,
   parseTrustedProxyEnv,
   resolveEnv
-} from "./chunk-CR3UHMBJ.js";
+} from "./chunk-V3UWO5OT.js";
 export {
   Camada,
   configure,

package/dist/koa.cjs

@@ -86,10 +86,41 @@ function readBody(req, done) {
   req.on("end", () => done(dead ? "" : Buffer.concat(chunks).toString("utf8")));
   req.on("error", () => done(""));
 }
+var FORM_FIELDS = ["nonce", "solution", "to"];
+function parsedBody(req) {
+  const b = req.body;
+  if (typeof b === "string") return b;
+  if (Buffer.isBuffer(b)) return b.toString("utf8");
+  return b && typeof b === "object" ? b : null;
+}
+function readForm(req, done) {
+  if (!req.readableEnded) {
+    readBody(req, (body) => done((0, import_core2.parseFormBody)(body)));
+    return;
+  }
+  const b = parsedBody(req);
+  if (typeof b === "string") {
+    done(b.length > BODY_MAX ? {} : (0, import_core2.parseFormBody)(b));
+    return;
+  }
+  const form = /* @__PURE__ */ Object.create(null);
+  for (const k of FORM_FIELDS) {
+    const v = b?.[k];
+    if (typeof v === "string") form[k] = v;
+  }
+  done(form);
+}
 var isHttps = (req) => !!req.socket?.encrypted || req.headers["x-forwarded-proto"] === "https";
-function writeChallengePage(res, html) {
-  res.writeHead(403, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "x-camada-challenge": "1" });
-  res.end(html);
+function writeChallengePage(res, o) {
+  res.removeHeader("content-security-policy");
+  res.removeHeader("content-security-policy-report-only");
+  res.writeHead(403, {
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+    "x-camada-challenge": "1",
+    "content-security-policy": (0, import_core2.challengePageCsp)(o.bits)
+  });
+  res.end((0, import_core2.challengePage)(o));
 }
 function writeChallengeJson(res) {
   res.writeHead(403, { "content-type": "application/json", "cache-control": "no-store", "x-camada-challenge": "1" });
@@ -97,7 +128,7 @@ function writeChallengeJson(res) {
 }
 
 // package.json
-var version = "0.3.0";
+var version = "0.3.2";
 var name = "@camada/node";
 
 // src/version.ts
@@ -113,6 +144,28 @@ var headerReader = (req) => (name2) => {
   const v = req.headers[name2];
   return v == null ? null : Array.isArray(v) ? v.join(", ") : v;
 };
+var splitUrl = (raw) => {
+  const qi = raw.indexOf("?");
+  return qi === -1 ? { path: raw, query: "" } : { path: raw.slice(0, qi), query: raw.slice(qi) };
+};
+function pathAndQuery(req) {
+  return splitUrl(req.originalUrl || req.url || "/");
+}
+var atEndpoint = (req, path, endpoint) => path === endpoint || splitUrl(req.url || "/").path === endpoint;
+function mountPrefix(req) {
+  if (!req.originalUrl) return "";
+  const full = splitUrl(req.originalUrl).path, rel = splitUrl(req.url || "/").path;
+  return rel !== "/" && full !== rel && full.endsWith(rel) ? full.slice(0, full.length - rel.length) : "";
+}
+function onUnixListener(socket) {
+  const srv = socket?.server;
+  if (!srv) return false;
+  try {
+    if (typeof srv.address?.() === "string") return true;
+  } catch {
+  }
+  return typeof srv._pipeName === "string";
+}
 var cookieValue = (cookie, name2) => {
   const src = "; " + cookie;
   const i = src.indexOf("; " + name2 + "=");
@@ -141,15 +194,22 @@ var Camada = class {
   fpPath;
   challengeOn;
   challengePath;
+  challengePathSet;
+  // configured explicitly: used as given, never prefixed
+  scriptPathSet;
   kit = null;
   envSource;
+  waitUntil;
   constructor(opts = {}) {
     this.envSource = opts.env ?? process.env;
     this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.waitUntil = opts.waitUntil;
     this.scriptPath = opts.scriptPath ?? SCRIPT_PATH;
     this.fpPath = opts.fpPath ?? FP_PATH;
     this.challengeOn = opts.challenge !== false && this.envSource.CAMADA_CHALLENGE !== "0";
     this.challengePath = opts.challengePath ?? CHALLENGE_PATH;
+    this.challengePathSet = opts.challengePath != null;
+    this.scriptPathSet = opts.scriptPath != null;
     this.env = resolveEnv(this.envSource);
     if (!this.env) return;
     if (this.envSource.CAMADA_DISABLED === "1") return;
@@ -173,9 +233,43 @@ var Camada = class {
   trustedProxy() {
     return this.env?.trustedProxy ?? this.snap?.config?.trusted_proxy ?? null;
   }
+  /** The client IP per the trusted-proxy config (team contract C6 v3). No socket at all, or a
+   *  unix-socket listener (nginx/Passenger in front, where Node never has a peer): core's no-peer
+   *  X-Forwarded-For walk, which trusts the local proxy. A TCP socket with no readable peer (the
+   *  client reset the connection before camada ran, e.g. behind an async middleware) is
+   *  unidentifiable: the walk would believe whatever the client wrote. So: null, the stance every
+   *  ip-bound feature already takes (no ip rules, no challenge). */
+  clientIp(req) {
+    const peer = req.socket?.remoteAddress;
+    if (!peer && req.socket && !onUnixListener(req.socket)) return null;
+    return (0, import_core3.resolveClientIp)(peer ?? null, req.headers["x-forwarded-for"], this.trustedProxy());
+  }
+  /** Where the challenge form posts: under the mount prefix, so it reaches camada, unless the
+   *  path was configured explicitly. */
+  challengeAction(req) {
+    return this.challengePathSet ? this.challengePath : (req.camadaPrefix ?? mountPrefix(req)) + this.challengePath;
+  }
   beaconEnabled() {
     return this.snap?.config?.beacon !== false;
   }
+  /** Queues a row. With CAMADA_SERVERLESS=1 it also starts the POST now: the platform freezes the
+   *  process once the response is out, so the 15 s interval would never run. Never throws. */
+  enqueue(row, req) {
+    const q = this.queue;
+    q.push(row);
+    if (!this.env?.serverless) return;
+    if (req?.camadaOpen) return;
+    this.flushFor(req);
+  }
+  /** Serverless: start the POST now and hand it to waitUntil. Never throws. */
+  flushFor(req) {
+    const q = this.queue;
+    (0, import_core3.guarded)(() => {
+      const tracks = req?.camadaTracks ?? [];
+      const p = Promise.allSettled(tracks).then(() => q.flush()).then(() => q.size > 0 ? q.flush() : void 0);
+      this.waitUntil?.(p);
+    }, void 0);
+  }
   /** True when camada fully handled the request. Synchronous; never throws. */
   handle(req, res) {
     return (0, import_core3.guarded)(() => this.handleInner(req, res), false);
@@ -183,15 +277,13 @@ var Camada = class {
   handleInner(req, res) {
     if (this.disabled || !this.snap || !this.queue || !this.env) return false;
     const t0 = Date.now();
-    this.snap.ensureFresh();
-    const rawUrl = req.url || "/";
-    const qi = rawUrl.indexOf("?");
-    const path = qi === -1 ? rawUrl : rawUrl.slice(0, qi);
-    const query = qi === -1 ? "" : rawUrl.slice(qi);
-    const ip = (0, import_core3.resolveClientIp)(req.socket?.remoteAddress, req.headers["x-forwarded-for"], this.trustedProxy());
+    this.snap.ensureFresh(this.env.serverless ? this.waitUntil : void 0);
+    const { path, query } = pathAndQuery(req);
+    const ip = this.clientIp(req);
+    req.camadaPrefix = mountPrefix(req);
     const v = this.snap.verdict({ ip, path, ua: req.headers["user-agent"], header: headerReader(req) });
     if (v.block) {
-      const headers = { "x-block-reason": v.reason ?? "", "x-block-version": v.version ?? "", "content-type": "text/plain" };
+      const headers = { "x-block-reason": v.reason ?? "", "x-block-version": v.version ?? "", "content-type": "text/plain", "cache-control": "no-store" };
       if (v.rule) headers["x-block-rule"] = v.rule;
       res.writeHead(403, headers);
       res.end("Forbidden");
@@ -199,11 +291,11 @@ var Camada = class {
       ev.st = 403;
       ev.blk = v.reason;
       if (v.rule) ev.rl = v.rule;
-      this.queue.push(ev);
+      this.enqueue(ev);
       return true;
     }
     if (this.challengeOn && this.kit && ip) {
-      if (req.method === "POST" && path === this.challengePath) {
+      if (req.method === "POST" && atEndpoint(req, path, this.challengePath)) {
         this.verifyChallenge(req, res, ip);
         return true;
       }
@@ -213,12 +305,12 @@ var Camada = class {
       }
     }
     if (this.beaconEnabled()) {
-      if (req.method === "GET" && path === this.scriptPath) {
+      if (req.method === "GET" && atEndpoint(req, path, this.scriptPath)) {
         res.writeHead(200, { "content-type": "application/javascript", "cache-control": "public, max-age=3600" });
         res.end(import_iife_string.default);
         return true;
       }
-      if (req.method === "POST" && path === this.fpPath) {
+      if (req.method === "POST" && atEndpoint(req, path, this.fpPath)) {
         this.relayBeacon(req, res, ip);
         return true;
       }
@@ -237,16 +329,22 @@ var Camada = class {
     const excluded = (cfg?.exclude || []).some((x) => path.startsWith(x));
     if (!excluded && Math.random() < (cfg?.sample ?? 1)) {
       let shipped = false;
+      req.camadaOpen = true;
       const ship = () => (0, import_core3.guarded)(() => {
-        if (shipped || req.camadaChallenged) return;
+        req.camadaOpen = false;
+        if (shipped) return;
         shipped = true;
+        if (req.camadaChallenged) {
+          if (this.env?.serverless) this.flushFor(req);
+          return;
+        }
         const ev = this.buildEvent(req, path, query, ip, { rid, sid, newSession });
         ev.ts = t0;
         ev.st = res.statusCode;
         ev.dur = Date.now() - t0;
         if (req.route?.path) ev.rt = String(req.route.path);
         if (v.warn && v.rule) ev.wrn = v.rule;
-        this.queue.push(ev);
+        this.enqueue(ev, req);
       }, void 0);
       res.once("finish", ship);
       res.once("close", ship);
@@ -264,8 +362,32 @@ var Camada = class {
   }
   /** Reads the beacon POST (≤32 KB), answers 204 immediately, and queues the beacon as a `sig: 1`
    *  row with the trusted-proxy-resolved client IP: it rides the next event batch, so the analyst
-   *  sees one request per flush instead of one per page view. Junk bodies are dropped, never shipped. */
+   *  sees one request per flush instead of one per page view. Junk bodies are dropped, never shipped.
+   *  A body parser mounted before camada (express.json(), always on Nest) has already drained the
+   *  stream: its `req.body` is used instead, and the request is answered either way. */
   relayBeacon(req, res, ip) {
+    const accept = (parsed) => {
+      res.writeHead(204, { "cache-control": "no-store" });
+      res.end();
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || Buffer.isBuffer(parsed)) return;
+      this.enqueue({ ...parsed, sig: 1, ip, tap: import_core3.TAP_NODE });
+    };
+    const fromText = (text) => {
+      try {
+        return JSON.parse(text);
+      } catch {
+        return null;
+      }
+    };
+    if (req.readableEnded) {
+      const b = parsedBody(req);
+      if ((typeof b === "string" ? b : b ? JSON.stringify(b) : "").length > FP_MAX) {
+        res.writeHead(413).end();
+        return;
+      }
+      accept(typeof b === "string" ? fromText(b) : b);
+      return;
+    }
     const chunks = [];
     let size = 0, dead = false;
     req.on("data", (c) => {
@@ -280,16 +402,7 @@ var Camada = class {
     });
     req.on("end", () => (0, import_core3.guarded)(() => {
       if (dead) return;
-      res.writeHead(204, { "cache-control": "no-store" });
-      res.end();
-      let parsed;
-      try {
-        parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-      } catch {
-        return;
-      }
-      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return;
-      this.queue.push({ ...parsed, sig: 1, ip, tap: import_core3.TAP_NODE });
+      accept(fromText(Buffer.concat(chunks).toString("utf8")));
     }, void 0));
     req.on("error", () => {
       try {
@@ -306,7 +419,7 @@ var Camada = class {
   serveChallengeInner(req, res, ip, target) {
     const to = (0, import_core3.safeReturnTo)(target);
     if ((0, import_core3.wantsHtml)(req.headers.accept ?? null, req.headers["sec-fetch-dest"] ?? null)) {
-      writeChallengePage(res, (0, import_core3.challengePage)({ nonce: this.kit.nonce(ip, Date.now()), action: this.challengePath, to }));
+      writeChallengePage(res, { nonce: this.kit.nonce(ip, Date.now()), action: this.challengeAction(req), to });
     } else {
       writeChallengeJson(res);
     }
@@ -321,7 +434,7 @@ var Camada = class {
       );
       ev.st = 403;
       ev.blk = "challenge";
-      this.queue.push(ev);
+      this.enqueue(ev);
     }, void 0);
   }
   /** The request's existing session, so challenge rows join the session that produced them. */
@@ -331,12 +444,11 @@ var Camada = class {
   /** POST from the challenge page: validate the nonce and the proof of work, set `_cch`, 302
    *  back to the (sanitised, same-site) original URL, and ship `{ st: 200, ch: 1 }`. */
   verifyChallenge(req, res, ip) {
-    readBody(req, (body) => (0, import_core3.guarded)(() => {
-      const form = (0, import_core3.parseFormBody)(body);
+    readForm(req, (form) => (0, import_core3.guarded)(() => {
       const to = (0, import_core3.safeReturnTo)(form.to);
       const now = Date.now();
       if (!this.kit.verify(ip, now, form.nonce, form.solution)) {
-        writeChallengePage(res, (0, import_core3.challengePage)({ nonce: this.kit.nonce(ip, now), action: this.challengePath, to }));
+        writeChallengePage(res, { nonce: this.kit.nonce(ip, now), action: this.challengeAction(req), to });
         return;
       }
       res.writeHead(302, {
@@ -345,10 +457,10 @@ var Camada = class {
         "cache-control": "no-store"
       });
       res.end();
-      const ev = this.buildEvent(req, this.challengePath, "", ip, { rid: (0, import_node_crypto2.randomUUID)(), sid: this.sessionOf(req), newSession: false });
+      const ev = this.buildEvent(req, this.challengeAction(req), "", ip, { rid: (0, import_node_crypto2.randomUUID)(), sid: this.sessionOf(req), newSession: false });
       ev.st = 200;
       ev.ch = 1;
-      this.queue.push(ev);
+      this.enqueue(ev);
     }, void 0));
   }
   /**
@@ -380,17 +492,15 @@ var Camada = class {
   }
   shipUpgrade(req, t0) {
     if (this.disabled || !this.queue) return;
-    const rawUrl = req.url || "/";
-    const qi = rawUrl.indexOf("?");
-    const path = qi === -1 ? rawUrl : rawUrl.slice(0, qi);
+    const { path, query } = pathAndQuery(req);
     const cfg = this.snap?.config;
     if ((cfg?.exclude || []).some((x) => path.startsWith(x)) || Math.random() >= (cfg?.sample ?? 1)) return;
-    const ip = (0, import_core3.resolveClientIp)(req.socket?.remoteAddress, req.headers["x-forwarded-for"], this.trustedProxy());
-    const ev = this.buildEvent(req, path, qi === -1 ? "" : rawUrl.slice(qi), ip, { rid: (0, import_node_crypto2.randomUUID)(), sid: this.sessionOf(req), newSession: false });
+    const ip = this.clientIp(req);
+    const ev = this.buildEvent(req, path, query, ip, { rid: (0, import_node_crypto2.randomUUID)(), sid: this.sessionOf(req), newSession: false });
     ev.ts = t0;
     ev.st = 101;
     ev.dur = Date.now() - t0;
-    this.queue.push(ev);
+    this.enqueue(ev);
   }
   /** Serve the challenge for this request on demand — for a route the app wants to gate itself
    *  (the example's /challenge-me). Returns false when the client already holds a valid `_cch`,
@@ -398,10 +508,11 @@ var Camada = class {
   serveChallenge(req, res) {
     return (0, import_core3.guarded)(() => {
       if (this.disabled || !this.kit || !this.queue) return false;
-      const ip = (0, import_core3.resolveClientIp)(req.socket?.remoteAddress, req.headers["x-forwarded-for"], this.trustedProxy());
+      const ip = this.clientIp(req);
       if (!ip || this.challengePassed(req, ip)) return false;
       req.camadaChallenged = true;
-      this.serveChallengeInner(req, res, ip, req.url || "/");
+      const { path, query } = pathAndQuery(req);
+      this.serveChallengeInner(req, res, ip, path + query);
       return true;
     }, false);
   }
@@ -409,7 +520,9 @@ var Camada = class {
   scriptTag(req) {
     if (this.disabled || !this.beaconEnabled()) return "";
     const rid = req.camada?.rid;
-    return `<script src="${this.scriptPath}${rid ? `?r=${rid}` : ""}" async></script>`;
+    const r = req;
+    const src = this.scriptPathSet ? this.scriptPath : (r.camadaPrefix ?? mountPrefix(r)) + this.scriptPath;
+    return `<script src="${src}${rid ? `?r=${rid}` : ""}" async></script>`;
   }
   /** App-context outcome events (login failed, signup, …). The identifier is HMAC-hashed
    *  in-process; the raw value never reaches the queue. */
@@ -417,10 +530,12 @@ var Camada = class {
     (0, import_core3.guarded)(() => {
       if (this.disabled || !this.queue || !this.env) return;
       const ctx = req.camada;
-      void (async () => {
+      const r = req;
+      const row = (async () => {
         const uid = data?.user ? await (0, import_core3.hashUserId)(data.user, this.env.ingestToken, (globalThis.crypto ?? import_node_crypto2.webcrypto).subtle) : null;
-        this.queue.push({ tap: import_core3.TAP_NODE, et: event, uid, rid: ctx?.rid ?? null, sid: ctx?.sid ?? null, ip: ctx?.ip ?? null, ts: Date.now() });
+        this.enqueue({ tap: import_core3.TAP_NODE, et: event, uid, rid: ctx?.rid ?? null, sid: ctx?.sid ?? null, ip: ctx?.ip ?? null, ts: Date.now() }, r);
       })().catch(import_core3.logRateLimited);
+      if (r.camadaOpen) (r.camadaTracks ??= []).push(row);
     }, void 0);
   }
   /** Express/Connect middleware (also what NestJS on the default platform consumes). */
@@ -429,9 +544,11 @@ var Camada = class {
       if (!this.handle(req, res)) next();
     };
   }
+  /** Stops polling and the event queue. The promise settles once rows still queued behind a drain
+   *  in flight or a 429 hold are sent (or counted dropped); it never rejects. */
   stop() {
     this.snap?.stop();
-    this.queue?.stop();
+    return this.queue?.stop() ?? Promise.resolve();
   }
 };
 function createCamada(opts = {}) {
@@ -449,6 +566,8 @@ function getDefault() {
 // src/koa.ts
 function camadaKoa(engine) {
   return async (ctx, next) => {
+    ctx.req.body ??= ctx.request?.body;
+    ctx.req.originalUrl ??= ctx.originalUrl;
     if ((engine ?? getDefault()).handle(ctx.req, ctx.res)) {
       ctx.respond = false;
       return;