@forklaunch/core 3.1.0 → 3.2.1

package/lib/http/index.mjs

@@ -686,8 +686,8 @@ async function getCachedJwks(jwksPublicKeyUrl) {
     return cachedJwks.value;
   } else {
     const jwksResponse = await fetch(jwksPublicKeyUrl);
-    const text = await jwksResponse.text();
-    if (!text) {
+    const text2 = await jwksResponse.text();
+    if (!text2) {
       if (cachedJwks.value) {
         return cachedJwks.value;
       }
@@ -695,7 +695,7 @@ async function getCachedJwks(jwksPublicKeyUrl) {
         `JWKS endpoint returned empty response (status ${jwksResponse.status})`
       );
     }
-    const jwks = JSON.parse(text).keys;
+    const jwks = JSON.parse(text2).keys;
     cachedJwks.value = jwks;
     cachedJwks.lastUpdated = /* @__PURE__ */ new Date();
     cachedJwks.ttl = parseInt(
@@ -1157,7 +1157,166 @@ async function parseRequestAuth(req, res, next) {
 }
 
 // src/http/middleware/request/enrichDetails.middleware.ts
+import { getEnvVar as getEnvVar4 } from "@forklaunch/common";
+
+// src/http/telemetry/requestAudit.ts
 import { getEnvVar as getEnvVar3 } from "@forklaunch/common";
+
+// src/persistence/encryptedType.ts
+import { Type } from "@mikro-orm/core";
+import { AsyncLocalStorage } from "async_hooks";
+var _tenantContext = new AsyncLocalStorage();
+
+// src/persistence/complianceChanges.ts
+var LISTENERS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.changeListeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceChange(listener) {
+  LISTENERS.add(listener);
+  return () => LISTENERS.delete(listener);
+}
+
+// src/persistence/compliantField.ts
+import {
+  Type as Type2
+} from "@mikro-orm/core";
+
+// src/persistence/fieldEncryptor.ts
+var HKDF_SALT = Buffer.alloc(0);
+
+// src/persistence/compliantField.ts
+var LISTENERS2 = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.listeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceAccess(listener) {
+  LISTENERS2.add(listener);
+  return () => LISTENERS2.delete(listener);
+}
+var STATE = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.state")] ??= /* @__PURE__ */ new WeakMap();
+var SLOTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.slots")] ??= /* @__PURE__ */ new WeakMap();
+var LOADED_TENANTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.loadedTenants")] ??= /* @__PURE__ */ new WeakMap();
+
+// src/http/telemetry/auditLogger.ts
+import { createHash as createHash2 } from "crypto";
+var AuditLogger = class {
+  _otel;
+  constructor(otel) {
+    this._otel = otel;
+  }
+  append(entry) {
+    try {
+      this._otel.info(
+        {
+          "log.type": "audit",
+          "audit.timestamp": entry.timestamp,
+          "audit.userId": entry.userId ?? "",
+          "audit.tenantId": entry.tenantId ?? "",
+          "audit.route": entry.route,
+          "audit.method": entry.method,
+          "audit.bodyHash": entry.bodyHash,
+          "audit.status": entry.status,
+          "audit.duration": entry.duration,
+          "audit.redactedFields": entry.redactedFields.join(","),
+          "audit.eventType": entry.eventType,
+          _meta: true
+        },
+        `audit:${entry.eventType} ${entry.method} ${entry.route} ${entry.status}`
+      );
+    } catch (error) {
+      console.error("Failed to emit audit log via OTEL:", error);
+    }
+  }
+  static hashBody(body) {
+    if (body === void 0 || body === null || body === "") {
+      return "";
+    }
+    return createHash2("sha256").update(body).digest("hex");
+  }
+};
+
+// src/http/telemetry/requestAudit.ts
+function auditEnabled() {
+  return getEnvVar3("FORKLAUNCH_AUDIT") !== "off";
+}
+var loggers = /* @__PURE__ */ new WeakMap();
+function loggerFor(otel) {
+  let logger2 = loggers.get(otel);
+  if (!logger2) {
+    logger2 = new AuditLogger(otel);
+    loggers.set(otel, logger2);
+  }
+  return logger2;
+}
+function auditEventType(status) {
+  if (status === 401) return "auth_failure";
+  if (status === 403) return "rbac_deny";
+  if (status === 429) return "rate_limit";
+  return "http";
+}
+var text = (value) => typeof value === "string" && value ? value : null;
+function bodyText(body) {
+  if (body == null || body === "") return void 0;
+  if (typeof body === "string" || Buffer.isBuffer(body)) return String(body);
+  try {
+    return JSON.stringify(body);
+  } catch {
+    return void 0;
+  }
+}
+function recordRequestAudit(otel, req, status, durationMs) {
+  if (!otel || !auditEnabled()) return;
+  const session = req.session && typeof req.session === "object" ? req.session : void 0;
+  loggerFor(otel).append({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    userId: text(session?.sub) ?? text(session?.userId),
+    tenantId: text(session?.activeOrganizationId) ?? text(session?.organizationId),
+    route: req.originalPath ?? req.path ?? "unknown",
+    method: req.method,
+    bodyHash: AuditLogger.hashBody(bodyText(req.body)),
+    status,
+    duration: Math.max(0, Math.round(durationMs)),
+    redactedFields: [],
+    eventType: auditEventType(status)
+  });
+}
+var accessAudit;
+function auditComplianceAccess(otel) {
+  if (!accessAudit && auditEnabled()) {
+    const logger2 = loggerFor(otel);
+    const remove = onComplianceAccess(
+      (event) => logger2.append({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        userId: null,
+        tenantId: event.tenantId || null,
+        route: event.field,
+        method: "READ",
+        bodyHash: "",
+        status: 0,
+        duration: 0,
+        redactedFields: [event.field],
+        eventType: "data_access"
+      })
+    );
+    const removeChanges = onComplianceChange(
+      (event) => logger2.append({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        userId: null,
+        tenantId: event.tenantId,
+        route: `${event.entity}#${event.id}`,
+        method: event.action.toUpperCase(),
+        bodyHash: "",
+        status: 0,
+        duration: 0,
+        redactedFields: event.sensitiveFields,
+        eventType: "data_change"
+      })
+    );
+    accessAudit = () => {
+      remove();
+      removeChanges();
+      accessAudit = void 0;
+    };
+  }
+  return accessAudit ?? (() => void 0);
+}
+
+// src/http/middleware/request/enrichDetails.middleware.ts
 function enrichDetails(path, contractDetails, requestSchema, responseSchemas, openTelemetryCollector, globalOptions) {
   return (req, res, next) => {
     req.originalPath = path;
@@ -1168,12 +1327,20 @@ function enrichDetails(path, contractDetails, requestSchema, responseSchemas, op
     req._globalOptions = globalOptions ?? (() => void 0);
     req.context?.span?.setAttribute(ATTR_API_NAME, req.contractDetails?.name);
     const startTime = process.hrtime();
+    if (openTelemetryCollector) auditComplianceAccess(openTelemetryCollector);
     res.on("finish", () => {
+      const [auditSeconds, auditNanoseconds] = process.hrtime(startTime);
+      recordRequestAudit(
+        openTelemetryCollector,
+        req,
+        Number(res.statusCode),
+        auditSeconds * 1e3 + auditNanoseconds / 1e6
+      );
       const [seconds, nanoseconds] = process.hrtime(startTime);
       const durationMs = seconds + nanoseconds / 1e9;
       httpServerDurationHistogram.record(durationMs, {
-        [ATTR_SERVICE_NAME]: getEnvVar3("OTEL_SERVICE_NAME") || "unknown",
-        [ATTR_APPLICATION_ID]: getEnvVar3("OTEL_APPLICATION_ID"),
+        [ATTR_SERVICE_NAME]: getEnvVar4("OTEL_SERVICE_NAME") || "unknown",
+        [ATTR_APPLICATION_ID]: getEnvVar4("OTEL_APPLICATION_ID"),
         [ATTR_API_NAME]: req.contractDetails?.name || "unknown",
         [ATTR_HTTP_REQUEST_METHOD]: req.method,
         [ATTR_HTTP_ROUTE]: req.originalPath || "unknown",
@@ -2422,7 +2589,7 @@ function instanceGatewaySettings(options2 = {}, feature = "The instance gateway"
   const hmacKey = options2.hmacKey ?? process.env.INSTANCE_HMAC_KEY;
   if (!gatewayUrl || !instanceId || !hmacKey) {
     throw new Error(
-      `${feature} is only available to instances hosted in managed mode: PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY must be set`
+      `${feature} goes through the ForkLaunch managed gateway: PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY must be set. The platform sets them for a managed instance, and at deploy for a component that declares the capability (\`forklaunch infra add <service> <capability>\`), which also points them at the local gateway mock`
     );
   }
   return { gatewayUrl, instanceId, hmacKey };
@@ -2657,17 +2824,17 @@ async function readPreviewCatalog(response) {
   if (!response.body) return invalidCatalog();
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
-  let text = "", bytes = 0;
+  let text2 = "", bytes = 0;
   try {
     for (; ; ) {
       const { done, value } = await reader.read();
       if (done) break;
       bytes += value.byteLength;
       if (bytes > 8192) return invalidCatalog();
-      text += decoder.decode(value, { stream: true });
+      text2 += decoder.decode(value, { stream: true });
     }
-    text += decoder.decode();
-    return previewCatalog(JSON.parse(text));
+    text2 += decoder.decode();
+    return previewCatalog(JSON.parse(text2));
   } catch {
     return invalidCatalog();
   } finally {
@@ -2723,10 +2890,16 @@ var EMAIL_LIMITS = {
   maxSubjectLength: 998,
   /** text + html, UTF-8 bytes. */
   maxBodyBytes: 512 * 1024,
-  maxTags: 10
+  maxTags: 10,
+  /** `listUnsubscribe.url`; keeps the header within SES's limit. */
+  maxUnsubscribeUrlLength: 512
 };
 var ADDRESS = /^[^\s@<>()[\]\\,;:"]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+$/;
 var TAG_PART = /^[A-Za-z0-9_-]{1,256}$/;
+var HEADER_SAFE = /^[\x21-\x7e]+$/;
+var URL_DELIMITERS = /[<>,"\\]/;
+var MAILBOX = /^[A-Za-z0-9._+-]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+$/;
+var UNSUBSCRIBE_FIELDS = /* @__PURE__ */ new Set(["url", "mailto", "oneClick"]);
 function isEmailAddress(address) {
   return typeof address === "string" && address.length <= EMAIL_LIMITS.maxAddressLength && ADDRESS.test(address);
 }
@@ -2751,6 +2924,72 @@ function addresses(value, field) {
   }
   return list;
 }
+function fail(problem) {
+  refuse(`listUnsubscribe: ${problem}`);
+}
+function unsubscribeUrlProblem(url) {
+  if (typeof url !== "string" || url === "") return "url must be a string";
+  if (url.length > EMAIL_LIMITS.maxUnsubscribeUrlLength) {
+    return `url is longer than ${EMAIL_LIMITS.maxUnsubscribeUrlLength} characters`;
+  }
+  if (!HEADER_SAFE.test(url)) {
+    return "url must be printable ASCII with no spaces or line breaks; percent-encode anything else";
+  }
+  if (URL_DELIMITERS.test(url)) {
+    return 'url must not contain < > , " or \\; percent-encode them';
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return "url is not a URL";
+  }
+  if (parsed.protocol !== "https:") return "url must be https";
+  if (parsed.username || parsed.password) {
+    return "url must not carry a user name or password";
+  }
+  return null;
+}
+function validateListUnsubscribe(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    fail("must be an object");
+  }
+  const unknownFields = Object.keys(value).filter(
+    (key) => !UNSUBSCRIBE_FIELDS.has(key)
+  );
+  if (unknownFields.length) {
+    fail(`unknown field ${unknownFields.map((k) => `'${k}'`).join(", ")}`);
+  }
+  const url = "url" in value ? value.url : void 0;
+  const mailto = "mailto" in value ? value.mailto : void 0;
+  const oneClick = "oneClick" in value ? value.oneClick : void 0;
+  if (url === void 0 && mailto === void 0) {
+    fail("needs a url or a mailto");
+  }
+  if (url !== void 0) {
+    const problem = unsubscribeUrlProblem(url);
+    if (problem) fail(problem);
+  }
+  if (mailto !== void 0 && (typeof mailto !== "string" || mailto.length > EMAIL_LIMITS.maxAddressLength || !MAILBOX.test(mailto))) {
+    fail(
+      `mailto: '${String(mailto).slice(0, 80)}' is not a plain mailbox (letters, digits, . _ + - before the @)`
+    );
+  }
+  if (oneClick !== void 0 && typeof oneClick !== "boolean") {
+    fail("oneClick must be true or false");
+  }
+  if (typeof url === "string") {
+    return {
+      url,
+      ...typeof mailto === "string" ? { mailto } : {},
+      ...oneClick === true ? { oneClick: true } : {}
+    };
+  }
+  if (oneClick === true) fail("oneClick needs a url (RFC 8058 posts to it)");
+  if (typeof mailto === "string") return { mailto };
+  return fail("needs a url or a mailto");
+}
 function validateEmailSendRequest(request) {
   const to = addresses(request.to, "to") ?? refuse("to is required");
   const replyTo = addresses(request.replyTo, "replyTo");
@@ -2782,13 +3021,15 @@ function validateEmailSendRequest(request) {
       refuse(`tag '${name}' is reserved`);
     }
   }
+  const listUnsubscribe = validateListUnsubscribe(request.listUnsubscribe);
   return {
     to,
     subject,
     ...request.text !== void 0 ? { text: request.text } : {},
     ...request.html !== void 0 ? { html: request.html } : {},
     ...replyTo ? { replyTo } : {},
-    ...names.length ? { tags } : {}
+    ...names.length ? { tags } : {},
+    ...listUnsubscribe ? { listUnsubscribe } : {}
   };
 }
 function createEmailClient(options2 = {}) {
@@ -2900,7 +3141,7 @@ function validateSmsSend(request) {
     );
   }
 }
-var NOT_MANAGED = "SMS is platform-held: this service must run as a managed instance (PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY set). Locally, run the gateway mock (npx -p @forklaunch/core forklaunch-gateway-mock) and point those variables at it; do not add a Twilio or AWS SDK.";
+var NOT_MANAGED = "SMS goes through the ForkLaunch managed gateway: PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY must be set (the platform sets them for a managed instance, and at deploy for a component that declares sms). Locally, run the gateway mock (npx -p @forklaunch/core forklaunch-gateway-mock) and point those variables at it; do not add a Twilio or AWS SDK.";
 var SmsClient = class {
   transport;
   constructor(options2 = {}) {
@@ -3069,7 +3310,7 @@ function voiceRequestProblem(request) {
 }
 var VoiceClient = class {
   transport;
-  /** Throws when the process is not a managed instance (see instanceGatewaySettings). */
+  /** Throws without the managed gateway settings (see instanceGatewaySettings). */
   constructor(options2 = {}) {
     this.transport = createInstanceGatewayTransport(
       options2,
@@ -3097,8 +3338,8 @@ var VoiceClient = class {
   async send(method, route, body) {
     try {
       const response = await this.transport.request(method, route, body);
-      const text = await response.text();
-      return text ? JSON.parse(text) : void 0;
+      const text2 = await response.text();
+      return text2 ? JSON.parse(text2) : void 0;
     } catch (error) {
       if (error instanceof InstanceGatewayRequestError) {
         throw new VoiceRequestError(
@@ -3231,7 +3472,7 @@ function createStripeClient(options2 = {}) {
   if (!explicitGateway && !isManagedInstance()) {
     if (!options2.apiKey) {
       throw new Error(
-        "createStripeClient: not a managed instance (PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY are unset) and no apiKey was given \u2014 pass { apiKey } for local development, or run the gateway mock (forklaunch-gateway-mock) with the managed env"
+        "createStripeClient: no managed gateway (PLATFORM_GATEWAY_URL, INSTANCE_ID and INSTANCE_HMAC_KEY are unset) and no apiKey was given \u2014 pass { apiKey } for local development, or run the gateway mock (forklaunch-gateway-mock) with the managed env"
       );
     }
     return new StripeClass(options2.apiKey, options2.config);
@@ -4727,7 +4968,7 @@ import {
 import { Readable, Transform } from "stream";
 
 // src/http/telemetry/recordMetric.ts
-import { getEnvVar as getEnvVar4 } from "@forklaunch/common";
+import { getEnvVar as getEnvVar5 } from "@forklaunch/common";
 import {
   ATTR_HTTP_REQUEST_METHOD as ATTR_HTTP_REQUEST_METHOD3,
   ATTR_HTTP_RESPONSE_STATUS_CODE as ATTR_HTTP_RESPONSE_STATUS_CODE3,
@@ -4738,10 +4979,10 @@ function recordMetric(req, res) {
   if (res.metricRecorded) {
     return;
   }
-  const serviceName = getEnvVar4("OTEL_SERVICE_NAME") || "unknown";
+  const serviceName = getEnvVar5("OTEL_SERVICE_NAME") || "unknown";
   const attrs = {
     [ATTR_SERVICE_NAME3]: serviceName,
-    [ATTR_APPLICATION_ID]: getEnvVar4("OTEL_APPLICATION_ID"),
+    [ATTR_APPLICATION_ID]: getEnvVar5("OTEL_APPLICATION_ID"),
     [ATTR_API_NAME]: req.contractDetails?.name,
     [ATTR_HTTP_REQUEST_METHOD3]: req.method,
     [ATTR_HTTP_ROUTE3]: req.originalPath,
@@ -5234,44 +5475,6 @@ function generateOpenApiSpecs(schemaValidator, serverUrls, serverDescriptions, a
   );
 }
 
-// src/http/telemetry/auditLogger.ts
-import { createHash as createHash2 } from "crypto";
-var AuditLogger = class {
-  _otel;
-  constructor(otel) {
-    this._otel = otel;
-  }
-  append(entry) {
-    try {
-      this._otel.info(
-        {
-          "log.type": "audit",
-          "audit.timestamp": entry.timestamp,
-          "audit.userId": entry.userId ?? "",
-          "audit.tenantId": entry.tenantId ?? "",
-          "audit.route": entry.route,
-          "audit.method": entry.method,
-          "audit.bodyHash": entry.bodyHash,
-          "audit.status": entry.status,
-          "audit.duration": entry.duration,
-          "audit.redactedFields": entry.redactedFields.join(","),
-          "audit.eventType": entry.eventType,
-          _meta: true
-        },
-        `audit:${entry.eventType} ${entry.method} ${entry.route} ${entry.status}`
-      );
-    } catch (error) {
-      console.error("Failed to emit audit log via OTEL:", error);
-    }
-  }
-  static hashBody(body) {
-    if (body === void 0 || body === null || body === "") {
-      return "";
-    }
-    return createHash2("sha256").update(body).digest("hex");
-  }
-};
-
 // src/http/telemetry/evaluateTelemetryOptions.ts
 function evaluateTelemetryOptions(telemetryOptions) {
   return {
@@ -5394,6 +5597,9 @@ export {
   VoiceClient,
   VoiceRequestError,
   WhatsAppRequestError,
+  auditComplianceAccess,
+  auditEnabled,
+  auditEventType,
   createContext,
   createEmailClient,
   createHmacToken,
@@ -5446,6 +5652,7 @@ export {
   post,
   put,
   recordMetric,
+  recordRequestAudit,
   resetProcessHandlersForTesting,
   signPlatformEvent,
   smsSegments,
@@ -5454,6 +5661,7 @@ export {
   typedAuthHandler,
   typedHandler,
   validateEmailSendRequest,
+  validateListUnsubscribe,
   validateSmsSend,
   verifyPlatformEvent,
   voiceRequestProblem