@contract-case/case-connector 0.29.0 → 0.30.0

package/dist/src/connectors/grpc/authTokenInterceptor.js

@@ -0,0 +1,37 @@
+import { ServerInterceptingCall, status, } from '@grpc/grpc-js';
+import { createHash, timingSafeEqual } from 'node:crypto';
+// Comparing hashes rather than the raw values keeps the comparison
+// constant-time even when the provided token has a different length
+const hashToken = (token) => createHash('sha256').update(token, 'utf8').digest();
+/**
+ * Creates a server interceptor that rejects any call which doesn't present
+ * the expected token in its `authorization` metadata.
+ *
+ * The token is shared with the client that spawned this connector via the
+ * `CASE_CONNECTOR_TOKEN` environment variable, so only that client (or
+ * processes it chooses to share the token with) can invoke the connector.
+ *
+ * @param expectedToken - the token that callers must present
+ * @returns a {@link ServerInterceptor} enforcing the token
+ */
+export const makeAuthTokenInterceptor = (expectedToken) => (_methodDescriptor, call) => new ServerInterceptingCall(call, {
+    start: (next) => {
+        next({
+            onReceiveMetadata: (metadata, mdNext) => {
+                const provided = metadata.get('authorization');
+                if (provided.length === 1 &&
+                    typeof provided[0] === 'string' &&
+                    timingSafeEqual(hashToken(provided[0]), hashToken(expectedToken))) {
+                    mdNext(metadata);
+                }
+                else {
+                    call.sendStatus({
+                        code: status.UNAUTHENTICATED,
+                        details: "This ContractCase connector requires callers to present the token from the CASE_CONNECTOR_TOKEN environment variable in the 'authorization' metadata of each call",
+                    });
+                }
+            },
+        });
+    },
+});
+//# sourceMappingURL=authTokenInterceptor.js.map

package/dist/src/connectors/grpc/authTokenInterceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authTokenInterceptor.js","sourceRoot":"","sources":["../../../../src/connectors/grpc/authTokenInterceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EAEtB,MAAM,GACP,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,mEAAmE;AACnE,oEAAoE;AACpE,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAC1C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,CAAC,aAAqB,EAAqB,EAAE,CAC7C,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAC1B,IAAI,sBAAsB,CAAC,IAAI,EAAE;IAC/B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,CAAC;YACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC/C,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;oBACrB,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;oBAC/B,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,EACjE,CAAC;oBACD,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,UAAU,CAAC;wBACd,IAAI,EAAE,MAAM,CAAC,eAAe;wBAC5B,OAAO,EACL,mKAAmK;qBACtK,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/src/connectors/grpc/contract-case-stream.d.mts

@@ -1,5 +1,11 @@
+import { Server } from '@grpc/grpc-js';
 /**
  * Starts a gRPC server for defining and verifying ContractCase contracts
+ *
+ * @returns the running server and the port it is listening on
  */
-export declare function main(): void;
+export declare function main(): Promise<{
+    server: Server;
+    port: string;
+}>;
 //# sourceMappingURL=contract-case-stream.d.mts.map

package/dist/src/connectors/grpc/contract-case-stream.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-case-stream.d.mts","sourceRoot":"","sources":["../../../../src/connectors/grpc/contract-case-stream.mts"],"names":[],"mappings":"AAgCA;;GAEG;AACH,wBAAgB,IAAI,IAAI,IAAI,CAkC3B"}
+{"version":3,"file":"contract-case-stream.d.mts","sourceRoot":"","sources":["../../../../src/connectors/grpc/contract-case-stream.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,eAAe,CAAC;AAiC1D;;;;GAIG;AACH,wBAAgB,IAAI,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAiDhE"}

package/dist/src/connectors/grpc/contract-case-stream.mjs

@@ -3,6 +3,7 @@ import { ContractCaseService } from '@contract-case/case-connector-proto';
 import getPort from 'get-port';
 import { contractDefinition } from './contractDefinition.js';
 import { contractVerification } from './contractVerification.js';
+import { makeAuthTokenInterceptor } from './authTokenInterceptor.js';
 import { versionString } from '../../entities/versionString.js';
 import { maintainerLog } from '../../domain/maintainerLog.js';
 const bind = (server, host, freePort) => new Promise((resolve, reject) => {
@@ -19,11 +20,24 @@ const bind = (server, host, freePort) => new Promise((resolve, reject) => {
 });
 /**
  * Starts a gRPC server for defining and verifying ContractCase contracts
+ *
+ * @returns the running server and the port it is listening on
  */
 export function main() {
     maintainerLog(`Starting ContractCase ${versionString}`);
-    const server = new Server();
-    getPort().then((freePort) => {
+    // Only calls that present this token are accepted
+    // - see authTokenInterceptor for details
+    const authToken = process.env['CASE_CONNECTOR_TOKEN'];
+    if (authToken == null || authToken === '') {
+        // Console used here because there's nothing sensible we can do with this error
+        // eslint-disable-next-line no-console
+        console.error(`[${versionString}]`, "ContractCase's internal server requires the CASE_CONNECTOR_TOKEN environment variable to be set to an unguessable random secret, so that only the client that started the server can connect to it");
+        process.exit(1);
+    }
+    const server = new Server({
+        interceptors: [makeAuthTokenInterceptor(authToken)],
+    });
+    return getPort().then((freePort) => {
         server.addService(ContractCaseService, {
             contractDefinition,
             contractVerification,
@@ -39,11 +53,12 @@ export function main() {
             // Must have the port number after the `:`
             // eslint-disable-next-line no-console
             console.log('[SERVER]', `Started on port: ${port}`);
+            return { server, port };
         }, (error) => {
             // Console used here because there's nothing sensible we can do with this error
             // eslint-disable-next-line no-console
             console.error(`[${versionString}]`, `ContractCase's internal server was unable to start: ${error}`);
-            process.exit(1);
+            return process.exit(1);
         });
     });
 }

package/dist/src/connectors/grpc/contract-case-stream.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"contract-case-stream.mjs","sourceRoot":"","sources":["../../../../src/connectors/grpc/contract-case-stream.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,OAAO,MAAM,UAAU,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAI9D,MAAM,IAAI,GAAG,CACX,MAAc,EACd,IAAY,EACZ,QAAgB,EACK,EAAE,CACvB,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;IACtC,aAAa,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,CAAC,SAAS,CACd,OAAO,EACP,iBAAiB,CAAC,cAAc,EAAE,EAClC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;GAEG;AACH,MAAM,UAAU,IAAI;IAClB,aAAa,CAAC,yBAAyB,aAAa,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC1B,MAAM,CAAC,UAAU,CAAC,mBAAmB,EAAE;YACrC,kBAAkB;YAClB,oBAAoB;SACrB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;aACnC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,aAAa,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC,CAAC;aACD,IAAI,CACH,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;YACpB,aAAa,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;YAC3D,6CAA6C;YAC7C,0CAA0C;YAC1C,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,+EAA+E;YAC/E,sCAAsC;YACtC,OAAO,CAAC,KAAK,CACX,IAAI,aAAa,GAAG,EACpB,uDAAuD,KAAK,EAAE,CAC/D,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"contract-case-stream.mjs","sourceRoot":"","sources":["../../../../src/connectors/grpc/contract-case-stream.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,OAAO,MAAM,UAAU,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAI9D,MAAM,IAAI,GAAG,CACX,MAAc,EACd,IAAY,EACZ,QAAgB,EACK,EAAE,CACvB,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;IACtC,aAAa,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,CAAC,SAAS,CACd,OAAO,EACP,iBAAiB,CAAC,cAAc,EAAE,EAClC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,UAAU,IAAI;IAClB,aAAa,CAAC,yBAAyB,aAAa,EAAE,CAAC,CAAC;IACxD,kDAAkD;IAClD,yCAAyC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtD,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAC1C,+EAA+E;QAC/E,sCAAsC;QACtC,OAAO,CAAC,KAAK,CACX,IAAI,aAAa,GAAG,EACpB,oMAAoM,CACrM,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,YAAY,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;KACpD,CAAC,CAAC;IAEH,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjC,MAAM,CAAC,UAAU,CAAC,mBAAmB,EAAE;YACrC,kBAAkB;YAClB,oBAAoB;SACrB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;aACnC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,aAAa,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC,CAAC;aACD,IAAI,CACH,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;YACpB,aAAa,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;YAC3D,6CAA6C;YAC7C,0CAA0C;YAC1C,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,+EAA+E;YAC/E,sCAAsC;YACtC,OAAO,CAAC,KAAK,CACX,IAAI,aAAa,GAAG,EACpB,uDAAuD,KAAK,EAAE,CAC/D,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC,CACF,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/entities/versionString.d.ts

@@ -1,2 +1,2 @@
-export declare const versionString = "case-connector@0.29.0";
+export declare const versionString = "case-connector@0.30.0";
 //# sourceMappingURL=versionString.d.ts.map

package/dist/src/entities/versionString.js

@@ -1,4 +1,4 @@
 const packageName = 'case-connector';
-const version = '0.29.0'; // x-release-please-version
+const version = '0.30.0'; // x-release-please-version
 export const versionString = `${packageName}@${version}`;
 //# sourceMappingURL=versionString.js.map