@chidchanun/bcp 0.1.0

package/packages/server/src/security-proxy.ts

@@ -0,0 +1,406 @@
+import * as http from "node:http";
+
+import {
+    applySecurityHeaders,
+    getConfiguredBodyLimit,
+} from "./security.js";
+
+export interface SecurityProxyOptions {
+    port: number;
+    hostname: string;
+    upstreamPort: number;
+    upstreamHostname?: string;
+}
+
+export function createSecurityProxy(
+    options: SecurityProxyOptions
+) {
+    const upstreamHostname =
+        options.upstreamHostname ??
+        "127.0.0.1";
+
+    let server:
+        http.Server | null =
+        null;
+
+    async function start(): Promise<void> {
+        if (server) {
+            return;
+        }
+
+        server =
+            http.createServer(
+                (
+                    req,
+                    res
+                ) => {
+                    applySecurityHeaders(
+                        res
+                    );
+
+                    const bodyLimit =
+                        getConfiguredBodyLimit();
+
+                    if (
+                        declaredBodyTooLarge(
+                            req,
+                            bodyLimit
+                        )
+                    ) {
+                        req.resume();
+                        sendPayloadTooLarge(
+                            res,
+                            bodyLimit
+                        );
+                        return;
+                    }
+
+                    proxyRequest(
+                        req,
+                        res,
+                        upstreamHostname,
+                        options.upstreamPort,
+                        bodyLimit
+                    );
+                }
+            );
+
+        server.keepAliveTimeout =
+            65_000;
+        server.headersTimeout =
+            66_000;
+
+        await listen(
+            server,
+            options.port,
+            options.hostname
+        );
+    }
+
+    async function stop(): Promise<void> {
+        if (!server) {
+            return;
+        }
+
+        const current =
+            server;
+        server =
+            null;
+
+        await closeServer(
+            current
+        );
+    }
+
+    return {
+        start,
+        stop,
+    };
+}
+
+function proxyRequest(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    upstreamHostname: string,
+    upstreamPort: number,
+    bodyLimit: number
+): void {
+    const upstream =
+        http.request({
+            hostname:
+                upstreamHostname,
+            port:
+                upstreamPort,
+            method:
+                req.method ??
+                "GET",
+            path:
+                req.url ??
+                "/",
+            headers:
+                req.headers,
+        });
+
+    let received = 0;
+    let rejected = false;
+
+    upstream.on(
+        "response",
+        (upstreamResponse) => {
+            if (rejected) {
+                upstreamResponse.resume();
+                return;
+            }
+
+            for (
+                const [
+                    name,
+                    value,
+                ]
+                of Object.entries(
+                    upstreamResponse.headers
+                )
+            ) {
+                if (
+                    value !== undefined
+                ) {
+                    res.setHeader(
+                        name,
+                        value
+                    );
+                }
+            }
+
+            res.statusCode =
+                upstreamResponse.statusCode ??
+                502;
+
+            if (
+                upstreamResponse.statusMessage
+            ) {
+                res.statusMessage =
+                    upstreamResponse.statusMessage;
+            }
+
+            upstreamResponse.pipe(
+                res
+            );
+        }
+    );
+
+    upstream.on(
+        "error",
+        (error) => {
+            if (rejected) {
+                return;
+            }
+
+            console.error(
+                "[BCP Security] upstream request failed:",
+                error
+            );
+
+            if (
+                res.headersSent
+            ) {
+                res.destroy(
+                    error
+                );
+                return;
+            }
+
+            res.writeHead(
+                502,
+                {
+                    "Content-Type":
+                        "text/plain; charset=utf-8",
+                    "Cache-Control":
+                        "no-store",
+                }
+            );
+            res.end(
+                "Bad Gateway"
+            );
+        }
+    );
+
+    req.on(
+        "data",
+        (chunk) => {
+            if (rejected) {
+                return;
+            }
+
+            const buffer =
+                Buffer.isBuffer(
+                    chunk
+                )
+                    ? chunk
+                    : Buffer.from(
+                        chunk
+                    );
+
+            received +=
+                buffer.length;
+
+            if (
+                received > bodyLimit
+            ) {
+                rejected =
+                    true;
+                upstream.destroy();
+
+                if (
+                    !res.headersSent
+                ) {
+                    sendPayloadTooLarge(
+                        res,
+                        bodyLimit
+                    );
+                } else {
+                    res.destroy();
+                }
+
+                return;
+            }
+
+            upstream.write(
+                buffer
+            );
+        }
+    );
+
+    req.on(
+        "end",
+        () => {
+            if (!rejected) {
+                upstream.end();
+            }
+        }
+    );
+
+    req.on(
+        "error",
+        (error) => {
+            upstream.destroy(
+                error
+            );
+        }
+    );
+}
+
+function declaredBodyTooLarge(
+    req: http.IncomingMessage,
+    limit: number
+): boolean {
+    const raw =
+        req.headers[
+            "content-length"
+        ];
+    const value =
+        Array.isArray(
+            raw
+        )
+            ? raw[0]
+            : raw;
+
+    if (!value) {
+        return false;
+    }
+
+    const parsed =
+        Number(
+            value
+        );
+
+    return (
+        Number.isInteger(
+            parsed
+        ) &&
+        parsed > limit
+    );
+}
+
+function sendPayloadTooLarge(
+    res: http.ServerResponse,
+    limit: number
+): void {
+    const body =
+        Buffer.from(
+            JSON.stringify({
+                error:
+                    "Payload Too Large",
+                limit,
+            })
+        );
+
+    res.writeHead(
+        413,
+        {
+            "Content-Type":
+                "application/json; charset=utf-8",
+            "Content-Length":
+                body.length,
+            "Cache-Control":
+                "no-store",
+        }
+    );
+    res.end(
+        body
+    );
+}
+
+function listen(
+    server: http.Server,
+    port: number,
+    hostname: string
+): Promise<void> {
+    return new Promise(
+        (
+            resolve,
+            reject
+        ) => {
+            const onError =
+                (error: Error) => {
+                    server.off(
+                        "listening",
+                        onListening
+                    );
+                    reject(
+                        error
+                    );
+                };
+
+            const onListening =
+                () => {
+                    server.off(
+                        "error",
+                        onError
+                    );
+                    resolve();
+                };
+
+            server.once(
+                "error",
+                onError
+            );
+            server.once(
+                "listening",
+                onListening
+            );
+            server.listen(
+                port,
+                hostname
+            );
+        }
+    );
+}
+
+function closeServer(
+    server: http.Server
+): Promise<void> {
+    if (
+        !server.listening
+    ) {
+        return Promise.resolve();
+    }
+
+    return new Promise(
+        (
+            resolve,
+            reject
+        ) => {
+            server.close(
+                (error) => {
+                    if (error) {
+                        reject(
+                            error
+                        );
+                        return;
+                    }
+                    resolve();
+                }
+            );
+        }
+    );
+}