@cedarjs/uploads 7.0.0-canary.3114

package/dist/webhooks/sns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sns.d.ts","sourceRoot":"","sources":["../../src/webhooks/sns.ts"],"names":[],"mappings":"AAIA,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;IAC7E,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAiCD,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAQ1C,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAmBhE;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,QAY9C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAY3D;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AAkD/D,MAAM,WAAW,uBAAuB;IACtC,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CACpC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,UAAU,EACnB,EACE,QAAQ,EACR,gBAA0C,GAC3C,EAAE,uBAAuB,GACzB,OAAO,CAAC,IAAI,CAAC,CA0Cf"}

package/dist/webhooks/sns.js

@@ -0,0 +1,131 @@
+import { createPublicKey, verify } from "node:crypto";
+import { UploadError } from "../errors.js";
+const SIGNED_FIELDS = {
+  Notification: [
+    "Message",
+    "MessageId",
+    "Subject",
+    "Timestamp",
+    "TopicArn",
+    "Type"
+  ],
+  SubscriptionConfirmation: [
+    "Message",
+    "MessageId",
+    "SubscribeURL",
+    "Timestamp",
+    "Token",
+    "TopicArn",
+    "Type"
+  ],
+  UnsubscribeConfirmation: [
+    "Message",
+    "MessageId",
+    "SubscribeURL",
+    "Timestamp",
+    "Token",
+    "TopicArn",
+    "Type"
+  ]
+};
+const SNS_HOST = /^sns\.[a-z0-9-]+\.amazonaws\.com(\.cn)?$/;
+const SNS_FETCH_TIMEOUT_MS = 1e4;
+const CERT_CACHE_LIMIT = 16;
+const CERT_CACHE_TTL_MS = 60 * 60 * 1e3;
+function isSnsMessage(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const m = value;
+  return (m.Type === "Notification" || m.Type === "SubscriptionConfirmation" || m.Type === "UnsubscribeConfirmation") && typeof m.MessageId === "string" && typeof m.TopicArn === "string" && typeof m.Message === "string" && typeof m.Timestamp === "string" && typeof m.SignatureVersion === "string" && typeof m.Signature === "string" && typeof m.SigningCertURL === "string";
+}
+function assertTrustedSnsUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new UploadError("FORBIDDEN", "Invalid SNS URL.");
+  }
+  if (parsed.protocol !== "https:" || !SNS_HOST.test(parsed.hostname)) {
+    throw new UploadError("FORBIDDEN", "Untrusted SNS URL.");
+  }
+}
+function snsStringToSign(message) {
+  const lines = [];
+  for (const field of SIGNED_FIELDS[message.Type]) {
+    const value = message[field];
+    if (typeof value === "string") {
+      lines.push(field, value);
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+const certCache = /* @__PURE__ */ new Map();
+async function defaultFetchCertificate(url) {
+  const now = Date.now();
+  const cached = certCache.get(url);
+  if (cached && cached.expiresAt > now) {
+    return cached.pending;
+  }
+  const pending = fetch(url, {
+    signal: AbortSignal.timeout(SNS_FETCH_TIMEOUT_MS)
+  }).then(async (res) => {
+    if (!res.ok) {
+      throw new UploadError(
+        "FORBIDDEN",
+        `Could not fetch the SNS signing certificate (HTTP ${res.status}).`
+      );
+    }
+    return res.text();
+  });
+  pending.catch(() => certCache.delete(url));
+  if (certCache.size >= CERT_CACHE_LIMIT) {
+    const oldest = certCache.keys().next().value;
+    if (oldest !== void 0) {
+      certCache.delete(oldest);
+    }
+  }
+  certCache.set(url, { pending, expiresAt: now + CERT_CACHE_TTL_MS });
+  return pending;
+}
+async function verifySnsMessage(message, {
+  topicArn,
+  fetchCertificate = defaultFetchCertificate
+}) {
+  if (message.TopicArn !== topicArn) {
+    throw new UploadError(
+      "FORBIDDEN",
+      `SNS message is from topic '${message.TopicArn}', not the configured topic.`
+    );
+  }
+  assertTrustedSnsUrl(message.SigningCertURL);
+  const algorithm = message.SignatureVersion === "1" ? "RSA-SHA1" : message.SignatureVersion === "2" ? "RSA-SHA256" : null;
+  if (!algorithm) {
+    throw new UploadError(
+      "FORBIDDEN",
+      `Unsupported SNS signature version '${message.SignatureVersion}'.`
+    );
+  }
+  const certificate = await fetchCertificate(message.SigningCertURL);
+  let valid = false;
+  try {
+    valid = verify(
+      algorithm,
+      Buffer.from(snsStringToSign(message), "utf8"),
+      createPublicKey(certificate),
+      Buffer.from(message.Signature, "base64")
+    );
+  } catch (e) {
+    throw new UploadError("FORBIDDEN", "Could not verify SNS signature.", e);
+  }
+  if (!valid) {
+    throw new UploadError("FORBIDDEN", "Invalid SNS signature.");
+  }
+}
+export {
+  SNS_FETCH_TIMEOUT_MS,
+  assertTrustedSnsUrl,
+  isSnsMessage,
+  snsStringToSign,
+  verifySnsMessage
+};

package/package.json

@@ -0,0 +1,147 @@
+{
+  "name": "@cedarjs/uploads",
+  "version": "7.0.0-canary.3114",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cedarjs/cedar.git",
+    "directory": "packages/uploads"
+  },
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "default": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./s3": {
+      "default": {
+        "types": "./dist/s3.d.ts",
+        "default": "./dist/s3.js"
+      }
+    },
+    "./web": {
+      "default": {
+        "types": "./dist/web/index.d.ts",
+        "default": "./dist/web/index.js"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.test.d.*"
+  ],
+  "scripts": {
+    "build": "node ./build.mts",
+    "build:pack": "yarn pack -o cedarjs-uploads.tgz",
+    "build:types": "tsc --build --verbose ./tsconfig.build.json",
+    "check:attw": "yarn cedar-fwtools-attw",
+    "check:package": "concurrently npm:check:attw yarn publint",
+    "setup:test": "npx prisma db push --accept-data-loss --config ./src/__tests__/prisma.config.ts && npx prisma generate --config ./src/__tests__/prisma.config.ts",
+    "test": "vitest run",
+    "test:watch": "vitest watch"
+  },
+  "dependencies": {
+    "@cedarjs/api": "7.0.0-canary.3114",
+    "@cedarjs/context": "7.0.0-canary.3114",
+    "@cedarjs/graphql-server": "7.0.0-canary.3114",
+    "@fastify/multipart": "9.4.0",
+    "graphql": "16.14.2",
+    "mime-types": "2.1.35"
+  },
+  "devDependencies": {
+    "@apollo/client": "4.2.12",
+    "@arethetypeswrong/cli": "0.18.5",
+    "@aws-sdk/client-s3": "3.1127.0",
+    "@aws-sdk/s3-request-presigner": "3.1127.0",
+    "@cedarjs/framework-tools": "7.0.0-canary.3114",
+    "@cedarjs/web": "7.0.0-canary.3114",
+    "@prisma/adapter-better-sqlite3": "7.10.0",
+    "@prisma/client": "7.10.0",
+    "@testing-library/dom": "10.4.1",
+    "@testing-library/jest-dom": "6.9.1",
+    "@testing-library/react": "16.3.3",
+    "@types/aws-lambda": "8.10.163",
+    "@types/better-sqlite3": "7.6.13",
+    "@types/mime-types": "2.1.4",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
+    "@uppy/aws-s3": "6.0.0",
+    "@uppy/core": "6.0.0",
+    "@uppy/dashboard": "6.0.0",
+    "@uppy/drag-drop": "6.0.0",
+    "@uppy/react": "6.0.0",
+    "@uppy/xhr-upload": "6.0.0",
+    "better-sqlite3": "12.11.1",
+    "concurrently": "9.2.4",
+    "esbuild": "0.28.2",
+    "fastify": "5.12.1",
+    "jsdom": "27.4.0",
+    "prisma": "7.10.0",
+    "publint": "0.3.24",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "typescript": "5.9.3",
+    "vitest": "4.1.11",
+    "zx": "8.8.5"
+  },
+  "peerDependencies": {
+    "@apollo/client": "4.2.12",
+    "@aws-sdk/client-s3": "^3.0.0",
+    "@aws-sdk/s3-request-presigner": "^3.0.0",
+    "@cedarjs/web": "7.0.0-canary.3114",
+    "@uppy/aws-s3": "^6.0.0",
+    "@uppy/core": "^6.0.0",
+    "@uppy/dashboard": "^6.0.0",
+    "@uppy/drag-drop": "^6.0.0",
+    "@uppy/react": "^6.0.0",
+    "@uppy/xhr-upload": "^6.0.0",
+    "fastify": "5.12.1",
+    "react": "19.2.8"
+  },
+  "peerDependenciesMeta": {
+    "@apollo/client": {
+      "optional": true
+    },
+    "@aws-sdk/client-s3": {
+      "optional": true
+    },
+    "@aws-sdk/s3-request-presigner": {
+      "optional": true
+    },
+    "@cedarjs/web": {
+      "optional": true
+    },
+    "@uppy/aws-s3": {
+      "optional": true
+    },
+    "@uppy/core": {
+      "optional": true
+    },
+    "@uppy/dashboard": {
+      "optional": true
+    },
+    "@uppy/drag-drop": {
+      "optional": true
+    },
+    "@uppy/react": {
+      "optional": true
+    },
+    "@uppy/xhr-upload": {
+      "optional": true
+    },
+    "fastify": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}