@dcl/http-server 2.0.1 → 2.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/metrics.js +20 -3
- package/dist/metrics.js.map +1 -1
- package/package.json +2 -5
package/dist/metrics.js
CHANGED
|
@@ -2,8 +2,24 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.getDefaultHttpMetrics = getDefaultHttpMetrics;
|
|
4
4
|
exports.instrumentHttpServerWithPromClientRegistry = instrumentHttpServerWithPromClientRegistry;
|
|
5
|
+
const crypto_1 = require("crypto");
|
|
5
6
|
const interfaces_1 = require("@well-known-components/interfaces");
|
|
6
7
|
const router_1 = require("./router");
|
|
8
|
+
/**
|
|
9
|
+
* Builds a constant-time comparator for the configured bearer token. The expected
|
|
10
|
+
* token is hashed once up front; each candidate is hashed and compared with
|
|
11
|
+
* `timingSafeEqual`. Hashing to fixed-length digests means the comparison never
|
|
12
|
+
* throws on a length mismatch and does not leak the token length through timing.
|
|
13
|
+
*/
|
|
14
|
+
function createBearerTokenComparator(expected) {
|
|
15
|
+
const expectedHash = (0, crypto_1.createHash)('sha256').update(expected).digest();
|
|
16
|
+
return (candidate) => {
|
|
17
|
+
if (typeof candidate !== 'string')
|
|
18
|
+
return false;
|
|
19
|
+
const candidateHash = (0, crypto_1.createHash)('sha256').update(candidate).digest();
|
|
20
|
+
return (0, crypto_1.timingSafeEqual)(candidateHash, expectedHash);
|
|
21
|
+
};
|
|
22
|
+
}
|
|
7
23
|
const httpLabels = ['method', 'handler', 'code'];
|
|
8
24
|
const metrics = {
|
|
9
25
|
http_request_duration_seconds: {
|
|
@@ -47,6 +63,7 @@ async function instrumentHttpServerWithPromClientRegistry(options) {
|
|
|
47
63
|
const { config, registry } = options;
|
|
48
64
|
const metricsPath = (await config.getString(_configKey('PUBLIC_PATH'))) || '/metrics';
|
|
49
65
|
const bearerToken = await config.getString(_configKey('BEARER_TOKEN'));
|
|
66
|
+
const compareBearerToken = bearerToken ? createBearerTokenComparator(bearerToken) : undefined;
|
|
50
67
|
const resetEveryNight = (await config.getString(_configKey('RESET_AT_NIGHT'))) == 'true';
|
|
51
68
|
const router = new router_1.Router();
|
|
52
69
|
function calculateNextReset() {
|
|
@@ -55,12 +72,12 @@ async function instrumentHttpServerWithPromClientRegistry(options) {
|
|
|
55
72
|
let nextReset = calculateNextReset();
|
|
56
73
|
// TODO: optional basic auth for /metrics
|
|
57
74
|
router.get(metricsPath, async (ctx) => {
|
|
58
|
-
if (
|
|
75
|
+
if (compareBearerToken) {
|
|
59
76
|
const header = ctx.request.headers.get('authorization');
|
|
60
77
|
if (!header)
|
|
61
78
|
return { status: 401 };
|
|
62
|
-
const [
|
|
63
|
-
if (
|
|
79
|
+
const [scheme, value] = header.split(' ');
|
|
80
|
+
if (scheme !== 'Bearer' || !compareBearerToken(value)) {
|
|
64
81
|
return { status: 401 };
|
|
65
82
|
}
|
|
66
83
|
}
|
package/dist/metrics.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":";;AAgDA,sDAEC;AAoBD,gGAiFC;AAvJD,mCAAoD;AACpD,kEAAuF;AAEvF,qCAAiC;AAEjC;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,QAAgB;IACnD,MAAM,YAAY,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAA;IACnE,OAAO,CAAC,SAA6B,EAAE,EAAE;QACvC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC/C,MAAM,aAAa,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAA;QACrE,OAAO,IAAA,wBAAe,EAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IACrD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,CAAA;AAEzD,MAAM,OAAO,GAAG;IACd,6BAA6B,EAAE;QAC7B,IAAI,EAAE,8BAAiB,CAAC,aAAa;QACrC,IAAI,EAAE,8BAA8B;QACpC,UAAU,EAAE,UAAU;KACvB;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,8BAAiB,CAAC,WAAW;QACnC,IAAI,EAAE,+BAA+B;QACrC,UAAU,EAAE,UAAU;KACvB;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,8BAAiB,CAAC,aAAa;QACrC,IAAI,EAAE,yCAAyC;QAC/C,UAAU,EAAE,UAAU;KACvB;CACF,CAAA;AAOD;;GAEG;AACH,SAAgB,qBAAqB;IACnC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,cAAc,GAAG,EAAE,GAAG,KAAI,CAAC,EAAE,CAAA;AAEnC;;;GAGG;AACH,MAAM,aAAa,GAAG,aAAsB,CAAA;AAE5C;;GAEG;AACH,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,GAAG,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAA;AACrE,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,0CAA0C,CAAmB,OAKlF;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAEpC,MAAM,WAAW,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,UAAU,CAAA;IACrF,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;IACtE,MAAM,kBAAkB,GAAG,WAAW,CAAC,CAAC,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7F,MAAM,eAAe,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;IAExF,MAAM,MAAM,GAAG,IAAI,eAAM,EAAM,CAAA;IAE/B,SAAS,kBAAkB;QACzB,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAA;IACrF,CAAC;IAED,IAAI,SAAS,GAAW,kBAAkB,EAAE,CAAA;IAE5C,yCAAyC;IACzC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpC,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YACvD,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;YACnC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;YACxB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAA;QAErC,mFAAmF;QACnF,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC9C,SAAS,GAAG,kBAAkB,EAAE,CAAA;YAChC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAA;QAC5B,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI;YACJ,OAAO,EAAE;gBACP,cAAc,EAAE,QAAQ,CAAC,WAAW;aACrC;SACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACrC,IAAI,MAAM,GAAG;YACX,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;YAC1B,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,GAAG;SACV,CAAA;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAA;QAC5F,MAAM,GAAG,GAAG,gBAAgB,EAAE,GAAG,IAAI,cAAc,CAAC,GAAG,CAAA;QACvD,IAAI,GAA+C,CAAA;QAEnD,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC,CAAA;QAC7B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAA;YAEhD,IAAK,GAAW,CAAC,UAAU,EAAE,CAAC;gBAC5B,MAAM,CAAC,OAAO,GAAI,GAAW,CAAC,UAAU,CAAA;YAC1C,CAAC;YAED,0FAA0F;YAC1F,2FAA2F;YAC3F,4FAA4F;YAC5F,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAA;YAC1E,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;YACvE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;YACxD,GAAG,CAAC,MAAM,CAAC,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;AACzC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dcl/http-server",
|
|
3
|
-
"version": "2.0.
|
|
3
|
+
"version": "2.0.2",
|
|
4
4
|
"description": "http server component",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -21,7 +21,7 @@
|
|
|
21
21
|
"on-finished": "^2.4.1",
|
|
22
22
|
"path-to-regexp": "^6.3.0",
|
|
23
23
|
"reflect-metadata": "^0.2.2",
|
|
24
|
-
"@dcl/core-commons": "0.10.
|
|
24
|
+
"@dcl/core-commons": "0.10.1"
|
|
25
25
|
},
|
|
26
26
|
"devDependencies": {
|
|
27
27
|
"@types/busboy": "^1.5.4",
|
|
@@ -29,7 +29,6 @@
|
|
|
29
29
|
"@types/http-errors": "^2.0.4",
|
|
30
30
|
"@types/jest": "^30.0.0",
|
|
31
31
|
"@types/node": "^20.3.2",
|
|
32
|
-
"@types/node-fetch": "^2.6.12",
|
|
33
32
|
"@types/on-finished": "^2.3.4",
|
|
34
33
|
"@types/ws": "^8.5.4",
|
|
35
34
|
"@well-known-components/env-config-provider": "^1.1.1",
|
|
@@ -37,9 +36,7 @@
|
|
|
37
36
|
"@well-known-components/test-helpers": "^1.3.0",
|
|
38
37
|
"@jest/test-sequencer": "^30.0.2",
|
|
39
38
|
"busboy": "^1.6.0",
|
|
40
|
-
"form-data": "^4.0.0",
|
|
41
39
|
"jest": "^30.0.2",
|
|
42
|
-
"node-fetch": "^2.6.9",
|
|
43
40
|
"ts-jest": "^29.4.0",
|
|
44
41
|
"typescript": "^5.8.2",
|
|
45
42
|
"undici": "^7.4.0",
|