@devtune/ai-traffic 0.10.0 → 0.12.0

package/dist/web-bot-auth.js

@@ -0,0 +1,233 @@
+/**
+ * ABOUTME: Collects the Web Bot Auth signature material DevTune needs to verify a signed agent request.
+ * Forwards the signature headers verbatim with the request line and covered fields; never verifies, logs or stores them.
+ */
+const MAX_SIGNATURE_LENGTH = 4096;
+const MAX_SIGNATURE_INPUT_LENGTH = 4096;
+const MAX_SIGNATURE_AGENT_LENGTH = 2048;
+const MAX_METHOD_LENGTH = 16;
+const MAX_TARGET_URI_LENGTH = 8192;
+const MAX_HEADER_VALUE_LENGTH = 4096;
+const SIGNATURE_HEADERS = new Set(["signature", "signature-input", "signature-agent"]);
+/**
+ * Derived components that depend on the path, query or scheme, which a Fetch
+ * runtime may have rewritten: it normalises the path, and behind a
+ * TLS-terminating proxy its `request.url` can be `http:` for an `https:`
+ * request.
+ */
+const FETCH_REWRITTEN_COMPONENTS = new Set([
+    "@path",
+    "@query",
+    "@request-target",
+    "@scheme",
+    "@target-uri",
+]);
+/**
+ * The only header fields ever forwarded with a signature: non-sensitive
+ * request headers. A request whose signature covers any other field, besides
+ * the three signature headers, forwards no signature material at all, since
+ * an unknown field may carry a credential and dropping just that field would
+ * leave a signature that can never verify. Short enough to stay within
+ * ingest's limits of 16 fields and 128-character names.
+ */
+export const WEB_BOT_AUTH_FORWARDED_HEADERS = [
+    "accept",
+    "accept-encoding",
+    "accept-language",
+    "cache-control",
+    "content-length",
+    "content-type",
+    "date",
+    "from",
+    "host",
+    "user-agent",
+];
+const FORWARDED_HEADERS = new Set(WEB_BOT_AUTH_FORWARDED_HEADERS);
+/** RFC 9110 field-value characters: visible ASCII, SP and HTAB. */
+const FIELD_VALUE = /^[\t\x20-\x7e]*$/u;
+/** RFC 9110 method token. */
+const METHOD = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u;
+/** An absolute URI as sent on the wire: visible ASCII, no whitespace. */
+const TARGET_URI = /^[\x21-\x7e]+$/u;
+/**
+ * Reads the material for a request that carries all three of `Signature`,
+ * `Signature-Input` and `Signature-Agent`, or returns null.
+ *
+ * Also returns null when anything would exceed ingest's limits or is not a
+ * value the site could have received, rather than truncating: a truncated
+ * signature can never verify, and the event is then sent exactly as an
+ * unsigned one would be.
+ *
+ * `targetUri` must carry the authority and target the agent sent. A target
+ * that differs from the event's `url` only makes DevTune's check
+ * inconclusive, but a rewritten one that happens to match `url` turns a
+ * genuine signature into a failed one.
+ *
+ * A target with a query, even a bare `?`, forwards nothing. The query can
+ * carry a reset token, an OAuth code or search terms, and DevTune could not
+ * verify the signature anyway: the event's `url` never has a query, so the
+ * target would not match it.
+ */
+export function readWebBotAuth(request) {
+    if (!hasWebBotAuthHeaders(request)) {
+        return null;
+    }
+    const signature = request.headers.get("signature");
+    const signatureInput = request.headers.get("signature-input");
+    const signatureAgent = request.headers.get("signature-agent");
+    const { method } = request;
+    const targetUri = request.targetUri === undefined ? readFetchTargetUri(request) : request.targetUri;
+    if (targetUri === null ||
+        targetUri.includes("?") ||
+        !isFieldValue(signature, MAX_SIGNATURE_LENGTH) ||
+        !isFieldValue(signatureInput, MAX_SIGNATURE_INPUT_LENGTH) ||
+        !isFieldValue(signatureAgent, MAX_SIGNATURE_AGENT_LENGTH) ||
+        !method ||
+        method.length > MAX_METHOD_LENGTH ||
+        !METHOD.test(method) ||
+        targetUri.length > MAX_TARGET_URI_LENGTH ||
+        !TARGET_URI.test(targetUri)) {
+        return null;
+    }
+    const components = readCoveredComponents(signatureInput);
+    // A Fetch runtime has already normalised the path (`/a/../guide` arrives as
+    // `/guide`) and may report a proxied `https:` request as `http:`. The raw
+    // forms are gone, so a signature over them would be checked against a
+    // rewritten base and fail. Signatures over `@authority` and
+    // `signature-agent` alone depend on neither and still forward.
+    if (request.targetUri === undefined &&
+        components.some((component) => FETCH_REWRITTEN_COMPONENTS.has(component))) {
+        return null;
+    }
+    const coveredNames = components.filter((component) => !component.startsWith("@") && !SIGNATURE_HEADERS.has(component));
+    if (coveredNames.some((name) => !FORWARDED_HEADERS.has(name))) {
+        return null;
+    }
+    const headers = new Map();
+    for (const name of coveredNames) {
+        if (headers.has(name)) {
+            continue;
+        }
+        const value = request.headers.getCombined
+            ? request.headers.getCombined(name)
+            : request.headers.get(name);
+        if (value === null) {
+            continue;
+        }
+        if (!isFieldValue(value, MAX_HEADER_VALUE_LENGTH, true)) {
+            return null;
+        }
+        headers.set(name, value);
+    }
+    return {
+        signature,
+        signatureInput,
+        signatureAgent,
+        method,
+        targetUri,
+        ...(headers.size === 0 ? {} : { headers: Object.fromEntries(headers) }),
+    };
+}
+/**
+ * The signed target for a Fetch-compatible runtime, which hands over
+ * `request.url` already normalised: `https://DOCS.example.com:443/guide`
+ * arrives as `https://docs.example.com/guide`. The authority is put back
+ * from the raw header the runtime built `url` from, `X-Forwarded-Host` or
+ * `Host`, and falls back to the raw `Host` when neither matches, so it is
+ * never a rewritten one. The scheme and path still come from `url`, which is
+ * why a signature covering a component that depends on them is not
+ * forwarded from here. Null without a `Host` header, or when `url` has a
+ * query, which `url.search` would hide when it is a bare `?`.
+ */
+function readFetchTargetUri(request) {
+    const host = request.headers.get("host");
+    let url;
+    try {
+        url = new URL(request.url);
+    }
+    catch {
+        return null;
+    }
+    if (!host || request.url.split("#", 1)[0]?.includes("?")) {
+        return null;
+    }
+    const forwardedHost = request.headers.get("x-forwarded-host")?.split(",", 1)[0]?.trim();
+    const authority = [forwardedHost, host].find((candidate) => candidate && normalizeHost(url.protocol, candidate) === url.host) ?? host;
+    return `${url.protocol}//${authority}${url.pathname}`;
+}
+function normalizeHost(protocol, host) {
+    try {
+        return new URL(`${protocol}//${host}`).host;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a request carries all three Web Bot Auth signature headers, the
+ * only requests whose arrival time or signature material is worth reading.
+ */
+export function hasWebBotAuthHeaders(request) {
+    return (request.headers.get("signature") !== null &&
+        request.headers.get("signature-input") !== null &&
+        request.headers.get("signature-agent") !== null);
+}
+/**
+ * Component identifiers a `Signature-Input` covers, across every signature it
+ * labels: header field names and derived components such as `@path`. This is
+ * just enough of RFC 8941 to find the strings that start an inner-list item:
+ * quoted strings are skipped whole, so a parameter value such as `key="a"` or
+ * `keyid="x (y)"` is never mistaken for one. Anything odd in the input is left
+ * for the caller or DevTune's parser to reject.
+ */
+function readCoveredComponents(signatureInput) {
+    const names = [];
+    let inInnerList = false;
+    let previous = "";
+    for (let index = 0; index < signatureInput.length; index += 1) {
+        const char = signatureInput[index];
+        if (char === '"') {
+            const end = findStringEnd(signatureInput, index + 1);
+            if (end === -1) {
+                break;
+            }
+            if (inInnerList && (previous === "(" || previous === " ")) {
+                names.push(signatureInput.slice(index + 1, end).replace(/\\(["\\])/gu, "$1"));
+            }
+            index = end;
+            previous = '"';
+            continue;
+        }
+        if (char === "(") {
+            inInnerList = true;
+        }
+        else if (char === ")") {
+            inInnerList = false;
+        }
+        previous = char ?? "";
+    }
+    return names;
+}
+/** Index of the quote closing an sf-string that opened before `start`, or -1. */
+function findStringEnd(value, start) {
+    for (let index = start; index < value.length; index += 1) {
+        if (value[index] === "\\") {
+            index += 1;
+        }
+        else if (value[index] === '"') {
+            return index;
+        }
+    }
+    return -1;
+}
+/**
+ * Also rejects a non-string, which a hand-written `HeadersLike` can return
+ * for a repeated field and which ingest's schema would refuse.
+ */
+function isFieldValue(value, maxLength, allowEmpty = false) {
+    return (typeof value === "string" &&
+        (allowEmpty || value.length > 0) &&
+        value.length <= maxLength &&
+        FIELD_VALUE.test(value));
+}
+//# sourceMappingURL=web-bot-auth.js.map

package/dist/web-bot-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-bot-auth.js","sourceRoot":"","sources":["../src/web-bot-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqBH,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACvF;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO;IACP,QAAQ;IACR,iBAAiB;IACjB,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,QAAQ;IACR,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,MAAM;IACN,MAAM;IACN,MAAM;IACN,YAAY;CACb,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;AAElE,mEAAmE;AACnE,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,6BAA6B;AAC7B,MAAM,MAAM,GAAG,iCAAiC,CAAC;AACjD,yEAAyE;AACzE,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAsE;IAEtE,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAEpF,IACE,SAAS,KAAK,IAAI;QAClB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,CAAC,YAAY,CAAC,SAAS,EAAE,oBAAoB,CAAC;QAC9C,CAAC,YAAY,CAAC,cAAc,EAAE,0BAA0B,CAAC;QACzD,CAAC,YAAY,CAAC,cAAc,EAAE,0BAA0B,CAAC;QACzD,CAAC,MAAM;QACP,MAAM,CAAC,MAAM,GAAG,iBAAiB;QACjC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACpB,SAAS,CAAC,MAAM,GAAG,qBAAqB;QACxC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,4DAA4D;IAC5D,+DAA+D;IAC/D,IACE,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CACpC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAC/E,CAAC;IAEF,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW;YACvC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;YACnC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,SAAS;QACT,cAAc;QACd,cAAc;QACd,MAAM;QACN,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,OAA6C;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACxF,MAAM,SAAS,GACb,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CACxB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,IAAI,CAChF,IAAI,IAAI,CAAC;IAEZ,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAqC;IACxE,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;QACzC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI;QAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,cAAsB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,aAAa,CAAC,cAAc,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAErD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM;YACR,CAAC;YAED,IAAI,WAAW,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;YAChF,CAAC;YAED,KAAK,GAAG,GAAG,CAAC;YACZ,QAAQ,GAAG,GAAG,CAAC;YAEf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QAED,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,KAAoB,EACpB,SAAiB,EACjB,UAAU,GAAG,KAAK;IAElB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,KAAK,CAAC,MAAM,IAAI,SAAS;QACzB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CACxB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devtune/ai-traffic",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "private": false,
   "description": "Filtered edge-push sensor for DevTune AI Traffic.",
   "license": "MIT",