@friggframework/core 2.0.0--canary.690.08cd07e.0 → 2.0.0--canary.693.d8859c2.0

package/modules/proxy/proxy-bases.js

@@ -1,169 +0,0 @@
-const { ProxyConfigError } = require('./proxy-errors');
-
-/**
- * Named base URLs for the entity proxy (ADR-052, amendment 2026-10-18).
- *
- * A module declares where its API lives. One host is `proxy.baseUrl`, which
- * means `{ default: baseUrl }`. A module whose API spans several hosts (Google:
- * Drive, Docs, Sheets, Analytics Data, Ads) declares `proxy.baseUrls`, a map of
- * name to URL. A caller picks a base by NAME in the proxy request's `base`
- * field; it never supplies a URL or a host, so the host still comes only from
- * the module.
- */
-
-const DEFAULT_BASE = 'default';
-const BASE_NAME = /^[a-z][a-z0-9-]*$/;
-
-const isPlainObject = (value) =>
-    value !== null && typeof value === 'object' && !Array.isArray(value);
-
-const describeRule = (rule) =>
-    `${rule && typeof rule.method === 'string' ? rule.method : '?'} ${
-        rule && typeof rule.path === 'string' ? rule.path : '?'
-    }`;
-
-function isValidBaseName(name) {
-    return typeof name === 'string' && name.length <= 64 && BASE_NAME.test(name);
-}
-
-function assertBaseUrl(moduleName, name, value) {
-    const where = `Module ${moduleName} proxy.baseUrls.${name}`;
-    if (typeof value !== 'string') {
-        throw new ProxyConfigError(`${where} must be an absolute https URL string (functions are not accepted)`);
-    }
-    let url;
-    try {
-        url = new URL(value);
-    } catch {
-        throw new ProxyConfigError(`${where} is not a valid absolute URL`);
-    }
-    if (url.protocol !== 'https:') {
-        throw new ProxyConfigError(`${where} must use https`);
-    }
-    if (url.username || url.password || url.search || url.hash) {
-        throw new ProxyConfigError(
-            `${where} must not carry credentials, a query or a fragment`
-        );
-    }
-}
-
-/**
- * The bases a module declares, validated.
- *
- * @param {object} definition - a module definition
- * @returns {{ names: string[], values: Map<string, string|Function|undefined>, declared: boolean }}
- *   `declared` is false when the module names no base of its own; it then has
- *   the single base `default`, resolved from the requester at call time.
- * @throws {ProxyConfigError}
- */
-function resolveModuleBases(definition) {
-    const moduleName = definition?.moduleName ?? '(unnamed)';
-    const proxy = definition?.proxy;
-    const hasBaseUrl = proxy?.baseUrl !== undefined;
-    const hasBaseUrls = proxy?.baseUrls !== undefined;
-
-    if (hasBaseUrl && hasBaseUrls) {
-        throw new ProxyConfigError(
-            `Module ${moduleName} declares both proxy.baseUrl and proxy.baseUrls; use one ` +
-                '(baseUrl means { default: baseUrl })'
-        );
-    }
-    if (hasBaseUrls) {
-        if (!isPlainObject(proxy.baseUrls) || Object.keys(proxy.baseUrls).length === 0) {
-            throw new ProxyConfigError(
-                `Module ${moduleName} proxy.baseUrls must be a non-empty object of name to URL`
-            );
-        }
-        const values = new Map();
-        for (const [name, value] of Object.entries(proxy.baseUrls)) {
-            if (!isValidBaseName(name)) {
-                throw new ProxyConfigError(
-                    `Module ${moduleName} proxy.baseUrls has the invalid name ${JSON.stringify(
-                        name
-                    )}; names match ${BASE_NAME}`
-                );
-            }
-            assertBaseUrl(moduleName, name, value);
-            values.set(name, value);
-        }
-        return { names: [...values.keys()], values, declared: true };
-    }
-    return {
-        names: [DEFAULT_BASE],
-        values: new Map([[DEFAULT_BASE, proxy?.baseUrl]]),
-        declared: hasBaseUrl,
-    };
-}
-
-/** The base a rule applies to; a rule without `base` applies to `default`. */
-const ruleBase = (rule) => (rule && rule.base !== undefined ? rule.base : DEFAULT_BASE);
-
-/**
- * Load-time check of every allow rule that names a base: the app's
- * `managementApi.proxy.modules.<module>.allow` and each module's own
- * `proxy.allow`. A rule for a base the module does not declare could never
- * match, which reads as "allowed" and is not, so it stops the app.
- *
- * @param {Array<object>} moduleDefinitions
- * @param {{ modules?: Object }} [proxyConfig] - resolved managementApi.proxy
- * @throws {ProxyConfigError}
- */
-function assertProxyConfig(moduleDefinitions, proxyConfig = {}) {
-    const namesByModule = new Map();
-    for (const definition of moduleDefinitions || []) {
-        if (!definition?.moduleName) continue;
-        const { names } = resolveModuleBases(definition);
-        namesByModule.set(definition.moduleName, names);
-        const own = definition.proxy?.allow;
-        if (Array.isArray(own)) {
-            assertRulesUseDeclaredBases(
-                definition.moduleName,
-                names,
-                own,
-                `Module ${definition.moduleName} proxy.allow`
-            );
-        }
-    }
-    for (const [moduleName, override] of Object.entries(proxyConfig.modules || {})) {
-        const names = namesByModule.get(moduleName);
-        // An override for a module that is not registered is not new: it never applied.
-        if (!names || !Array.isArray(override?.allow)) continue;
-        assertRulesUseDeclaredBases(
-            moduleName,
-            names,
-            override.allow,
-            `managementApi.proxy.modules.${moduleName}.allow`
-        );
-    }
-}
-
-function assertRulesUseDeclaredBases(moduleName, names, rules, where) {
-    for (const rule of rules) {
-        if (!isPlainObject(rule) || rule.base === undefined) continue;
-        if (!isValidBaseName(rule.base) || !names.includes(rule.base)) {
-            throw new ProxyConfigError(
-                `${where}: the rule ${describeRule(rule)} names the base ${JSON.stringify(
-                    rule.base
-                )}, which module ${moduleName} does not declare (declared: ${names.join(', ')})`
-            );
-        }
-    }
-    // A rule with no base means `default`; the module must have one.
-    if (!names.includes(DEFAULT_BASE)) {
-        const bare = rules.find((rule) => isPlainObject(rule) && rule.base === undefined);
-        if (bare) {
-            throw new ProxyConfigError(
-                `${where}: the rule ${describeRule(bare)} names no base, so it applies to ` +
-                    `"default", which module ${moduleName} does not declare (declared: ${names.join(', ')})`
-            );
-        }
-    }
-}
-
-module.exports = {
-    DEFAULT_BASE,
-    isValidBaseName,
-    resolveModuleBases,
-    ruleBase,
-    assertProxyConfig,
-};

package/modules/proxy/proxy-errors.js

@@ -1,31 +0,0 @@
-/**
- * A proxied call was refused or failed in a way the Management API maps to a
- * documented status (ADR-052 §10). `code` is the public error code; nothing
- * here carries the upstream URL, headers or credential material.
- */
-class ProxyRequestError extends Error {
-    /**
-     * @param {string} code - e.g. INVALID_PROXY_REQUEST, PROXY_NOT_ALLOWED, TIMEOUT
-     * @param {string} message - safe to show the caller
-     * @param {Object} [details] - safe structured details
-     */
-    constructor(code, message, details) {
-        super(message);
-        this.name = 'ProxyRequestError';
-        this.code = code;
-        this.details = details;
-    }
-}
-
-/**
- * A module definition or the app's proxy settings are wrong. Thrown at load,
- * so the app stops starting instead of failing on the first proxied call.
- */
-class ProxyConfigError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ProxyConfigError';
-    }
-}
-
-module.exports = { ProxyRequestError, ProxyConfigError };

package/modules/proxy/proxy-path.js

@@ -1,183 +0,0 @@
-const { ProxyRequestError } = require('./proxy-errors');
-const { DEFAULT_BASE, ruleBase } = require('./proxy-bases');
-
-/**
- * Path rules for the entity proxy (ADR-052 §4). The caller supplies a path
- * relative to the module's base URL and nothing else: the host, scheme and
- * port always come from the module.
- */
-
-const invalid = (reason) =>
-    new ProxyRequestError('INVALID_PROXY_REQUEST', `Invalid proxy path: ${reason}`, {
-        field: 'path',
-    });
-
-// Control characters (C0, DEL, C1), any whitespace, and invisible format
-// characters such as zero-width spaces and byte-order marks.
-const FORBIDDEN_CHARS = /[\x00-\x20\x7f-\x9f]|\s|\p{Cf}/u;
-
-/**
- * Validates and normalises a caller-supplied path.
- *
- * - must start with a single `/`; `//` (anywhere), `\`, `?`, `#`, control
- *   and whitespace characters are rejected;
- * - encoded separators (`%2f`, `%5c`) are rejected, then the path is
- *   percent-decoded exactly once; a `%` left after decoding (double
- *   encoding) is rejected, as is any decoded control or whitespace
- *   character other than a space (`%20`);
- * - `.` and `..` segments are rejected rather than resolved.
- *
- * @param {unknown} path
- * @returns {string} the decoded path, e.g. `/crm/v3/objects/contacts`
- * @throws {ProxyRequestError} INVALID_PROXY_REQUEST
- */
-function normalizeProxyPath(path) {
-    if (typeof path !== 'string' || path.length === 0) {
-        throw invalid('path must be a non-empty string');
-    }
-    if (path.length > 2048) throw invalid('path is too long');
-    if (!path.startsWith('/')) throw invalid('path must start with /');
-    if (path.startsWith('//') || path.includes('//')) {
-        throw invalid('empty path segments (//) are not allowed');
-    }
-    if (path.includes('\\')) throw invalid('backslashes are not allowed');
-    if (path.includes('?') || path.includes('#')) {
-        throw invalid('send the query string in `query`, not in the path');
-    }
-    if (FORBIDDEN_CHARS.test(path)) {
-        throw invalid('control and whitespace characters are not allowed');
-    }
-    if (/%(2f|5c)/i.test(path)) {
-        throw invalid('encoded path separators are not allowed');
-    }
-
-    let decoded;
-    try {
-        decoded = decodeURIComponent(path);
-    } catch {
-        throw invalid('malformed percent-encoding');
-    }
-    if (
-        decoded.includes('%') ||
-        decoded.includes('\\') ||
-        decoded.includes('?') ||
-        decoded.includes('#') ||
-        decoded.includes('//') ||
-        // An encoded space (%20) is a legitimate path character; every other
-        // control or whitespace character stays forbidden.
-        FORBIDDEN_CHARS.test(decoded.replaceAll(' ', ''))
-    ) {
-        throw invalid('encoded characters decode to something not allowed');
-    }
-
-    const segments = decoded.split('/').slice(1);
-    if (segments.some((segment) => segment === '.' || segment === '..')) {
-        throw invalid('dot segments (. and ..) are not allowed');
-    }
-    return decoded;
-}
-
-/**
- * Joins a module base URL and a normalised path, then proves the result
- * cannot leave the module's API: https only, same origin as the base URL,
- * and under the base URL's path.
- *
- * @param {string} baseUrl - from the module, never from the request
- * @param {string} normalizedPath - from normalizeProxyPath()
- * @returns {{ url: string, basePath: string, origin: string }} `url` is not
- *   percent-encoded; the Requester encodes it once.
- * @throws {ProxyRequestError} PROXY_NOT_CONFIGURED or INVALID_PROXY_REQUEST
- */
-function joinProxyUrl(baseUrl, normalizedPath) {
-    let base;
-    try {
-        base = new URL(baseUrl);
-    } catch {
-        throw new ProxyRequestError(
-            'PROXY_NOT_CONFIGURED',
-            'The module has no valid base URL to proxy to'
-        );
-    }
-    if (base.protocol !== 'https:') {
-        throw new ProxyRequestError(
-            'PROXY_NOT_CONFIGURED',
-            'The module base URL must use https to be proxied'
-        );
-    }
-    if (base.username || base.password || base.search || base.hash) {
-        throw new ProxyRequestError(
-            'PROXY_NOT_CONFIGURED',
-            'The module base URL must not carry credentials, a query or a fragment'
-        );
-    }
-
-    const basePath = base.pathname.replace(/\/+$/, '');
-    const url = `${base.origin}${basePath}${normalizedPath}`;
-
-    let joined;
-    try {
-        joined = new URL(url);
-    } catch {
-        throw invalid('the joined URL is not valid');
-    }
-    const joinedPath = decodeURIComponent(joined.pathname);
-    if (
-        joined.protocol !== 'https:' ||
-        joined.origin !== base.origin ||
-        joined.username ||
-        joined.password ||
-        !(joinedPath === basePath || joinedPath.startsWith(`${basePath}/`))
-    ) {
-        throw invalid('the path leaves the module API');
-    }
-    return { url, basePath, origin: base.origin };
-}
-
-/**
- * Finds the allow-list rule that permits `method` on `path` of `base`.
- *
- * Patterns use `:param` for exactly one segment and a trailing `/**` for a
- * subtree (the prefix itself included). `method: '*'` matches any method.
- *
- * @param {Array<{method: string, path: string}>} rules
- * @param {string} method - upper case
- * @param {string} path - normalised path
- * @param {string} [base='default'] - the named base the request targets; a
- *   rule applies to its own `base` only (no `base` means `default`)
- * @returns {{method: string, path: string, base?: string}|null}
- */
-function matchAllowRule(rules, method, path, base = DEFAULT_BASE) {
-    const requestSegments = path.split('/').slice(1);
-    for (const rule of rules || []) {
-        if (!rule || typeof rule.path !== 'string' || typeof rule.method !== 'string') {
-            continue;
-        }
-        if (ruleBase(rule) !== base) continue;
-        const ruleMethod = rule.method.toUpperCase();
-        if (ruleMethod !== '*' && ruleMethod !== method) continue;
-        if (patternMatches(rule.path, requestSegments)) return rule;
-    }
-    return null;
-}
-
-function patternMatches(pattern, requestSegments) {
-    if (!pattern.startsWith('/')) return false;
-    let patternSegments = pattern.split('/').slice(1);
-    let subtree = false;
-    if (patternSegments[patternSegments.length - 1] === '**') {
-        subtree = true;
-        patternSegments = patternSegments.slice(0, -1);
-    }
-    if (subtree) {
-        if (requestSegments.length < patternSegments.length) return false;
-    } else if (requestSegments.length !== patternSegments.length) {
-        return false;
-    }
-    return patternSegments.every((segment, index) => {
-        const actual = requestSegments[index];
-        if (segment.startsWith(':')) return actual !== undefined && actual !== '';
-        return segment === actual;
-    });
-}
-
-module.exports = { normalizeProxyPath, joinProxyUrl, matchAllowRule };

package/modules/proxy/proxy-policy.js

@@ -1,277 +0,0 @@
-const { ProxyRequestError } = require('./proxy-errors');
-const { isValidBaseName } = require('./proxy-bases');
-
-/**
- * What the entity proxy accepts and returns (ADR-052 §5-§7). Pure functions:
- * no I/O, so every rule is unit-tested on its own.
- */
-
-const PROXY_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
-const METHODS_WITH_BODY = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
-
-/** Request headers a caller may always send (lower case). */
-const ALLOWED_REQUEST_HEADERS = [
-    'accept',
-    'content-type',
-    'accept-language',
-    'if-match',
-    'if-none-match',
-];
-
-/** Request headers that are refused outright, even if a module lists them. */
-const REJECTED_REQUEST_HEADERS = [
-    'authorization',
-    'proxy-authorization',
-    'cookie',
-    'host',
-    'forwarded',
-    'x-real-ip',
-    'x-api-key',
-];
-const REJECTED_REQUEST_HEADER_PREFIXES = ['x-forwarded-'];
-
-/** Response headers never passed back (credentials and hop-by-hop). */
-const REMOVED_RESPONSE_HEADERS = [
-    'authorization',
-    'proxy-authorization',
-    'proxy-authenticate',
-    'set-cookie',
-    'set-cookie2',
-    'www-authenticate',
-    'x-api-key',
-    'connection',
-    'keep-alive',
-    'te',
-    'trailer',
-    'transfer-encoding',
-    'upgrade',
-    // The body is re-encoded as JSON, so these no longer describe it.
-    'content-length',
-    'content-encoding',
-];
-
-const invalid = (message, details) =>
-    new ProxyRequestError('INVALID_PROXY_REQUEST', message, details);
-
-/**
- * A query key ending in `[]` is sent as one `key=value` pair per array
- * element; the requester applies the same rule (see
- * `_rawRequest` in requester.js).
- */
-const isRepeatedQueryKey = (key) => key.endsWith('[]');
-
-const isPlainObject = (value) =>
-    value !== null && typeof value === 'object' && !Array.isArray(value);
-
-/**
- * Validates the request body of POST /api/v2/entities/:id/proxy and returns
- * it with the method upper-cased and the body serialised.
- *
- * @param {unknown} request
- * @param {{ maxRequestBytes: number }} limits
- * @returns {{ method: string, path: string, base?: string, query?: Object, headers: Object, body?: string, requestBytes: number, bodyIsJson: boolean }}
- */
-function validateProxyRequest(request, { maxRequestBytes }) {
-    if (!isPlainObject(request)) throw invalid('The proxy request must be a JSON object');
-    const method = typeof request.method === 'string' ? request.method.toUpperCase() : '';
-    if (!PROXY_METHODS.includes(method)) {
-        throw invalid(`method must be one of ${PROXY_METHODS.join(', ')}`, { field: 'method' });
-    }
-    if (typeof request.path !== 'string') {
-        throw invalid('path is required', { field: 'path' });
-    }
-
-    // `base` is a name, never a URL or host; anything else is refused before
-    // a module is looked up. Omitted means `default` (the caller applies it).
-    let base;
-    if (request.base !== undefined && request.base !== null) {
-        if (typeof request.base !== 'string' || !isValidBaseName(request.base)) {
-            throw invalid(
-                'base must be the name of one of the module\'s base URLs (lower case letters, digits and -), not a URL or host',
-                { field: 'base' }
-            );
-        }
-        base = request.base;
-    }
-
-    let query;
-    if (request.query !== undefined && request.query !== null) {
-        if (!isPlainObject(request.query)) throw invalid('query must be an object', { field: 'query' });
-        query = {};
-        for (const [key, value] of Object.entries(request.query)) {
-            const scalar = ['string', 'number', 'boolean'].includes(typeof value);
-            const list = Array.isArray(value) && value.every((v) => typeof v === 'string');
-            if (!scalar && !list) {
-                throw invalid(`query.${key} must be a string, number, boolean or array of strings`, {
-                    field: `query.${key}`,
-                });
-            }
-            // A key ending in `[]` (`fields[]`) is sent once per value, as
-            // Airtable and Fathom expect; every other array goes comma-separated.
-            if (list) {
-                query[key] = isRepeatedQueryKey(key) ? [...value] : value.join(',');
-            } else {
-                query[key] = value;
-            }
-        }
-    }
-
-    const headers = {};
-    if (request.headers !== undefined && request.headers !== null) {
-        if (!isPlainObject(request.headers)) throw invalid('headers must be an object', { field: 'headers' });
-        for (const [name, value] of Object.entries(request.headers)) {
-            if (typeof value !== 'string') {
-                throw invalid(`header ${name} must be a string`, { field: `headers.${name}` });
-            }
-            headers[name.toLowerCase()] = value;
-        }
-    }
-
-    let body;
-    let bodyIsJson = false;
-    if (request.body !== undefined && request.body !== null) {
-        if (!METHODS_WITH_BODY.has(method)) {
-            throw invalid(`${method} requests cannot have a body`, { field: 'body' });
-        }
-        if (typeof request.body === 'string') {
-            body = request.body;
-        } else {
-            body = JSON.stringify(request.body);
-            bodyIsJson = true;
-        }
-    }
-    const requestBytes = body === undefined ? 0 : Buffer.byteLength(body);
-    if (requestBytes > maxRequestBytes) {
-        throw new ProxyRequestError(
-            'PAYLOAD_TOO_LARGE',
-            `The proxied request body is larger than ${maxRequestBytes} bytes`
-        );
-    }
-    return { method, path: request.path, ...(base !== undefined && { base }), query, headers, body, bodyIsJson, requestBytes };
-}
-
-const isWildcardRule = (rule) => rule?.method === '*' || rule?.path === '/**';
-
-// A rule's `base` is checked against the module's declared bases at load, by
-// assertProxyConfig (proxy-bases.js); here only its shape is.
-const isValidRule = (rule) =>
-    isPlainObject(rule) &&
-    typeof rule.method === 'string' &&
-    typeof rule.path === 'string' &&
-    rule.path.startsWith('/') &&
-    (rule.base === undefined || isValidBaseName(rule.base));
-
-/**
- * The allow-list in force for a module: the app definition's list for it when
- * one is given (`managementApi.proxy.modules[name].allow`), otherwise the
- * module's own `proxy.allow`. A module cannot grant itself a wildcard; only
- * the app definition can. No list means nothing may be proxied.
- *
- * @returns {{ rules: Array<{method: string, path: string}>, source: 'app'|'module'|'none', ignored: number }}
- */
-function resolveAllowRules(definition, moduleOverrides = {}) {
-    const override = moduleOverrides?.[definition.moduleName]?.allow;
-    if (Array.isArray(override)) {
-        return { rules: override.filter(isValidRule), source: 'app', ignored: 0 };
-    }
-    const declared = Array.isArray(definition.proxy?.allow) ? definition.proxy.allow : [];
-    const rules = declared.filter((rule) => isValidRule(rule) && !isWildcardRule(rule));
-    return {
-        rules,
-        source: rules.length ? 'module' : 'none',
-        ignored: declared.length - rules.length,
-    };
-}
-
-/**
- * Keeps only the request headers the caller may set. A header from the
- * rejected list (credentials, Host, forwarding headers, or one the module's
- * own auth sets) fails the request instead of being dropped quietly.
- *
- * @param {Object} headers - lower-cased names
- * @param {Object} options
- * @param {string[]} [options.moduleHeaders] - from the module's `proxy.headers`
- * @param {string[]} [options.authHeaderNames] - headers the module's auth sets
- */
-function filterRequestHeaders(headers, { moduleHeaders = [], authHeaderNames = [] } = {}) {
-    const rejected = new Set([
-        ...REJECTED_REQUEST_HEADERS,
-        ...authHeaderNames.filter(Boolean).map((name) => String(name).toLowerCase()),
-    ]);
-    const allowed = new Set([
-        ...ALLOWED_REQUEST_HEADERS,
-        ...moduleHeaders.map((name) => String(name).toLowerCase()),
-    ]);
-    const kept = {};
-    for (const [name, value] of Object.entries(headers)) {
-        if (
-            rejected.has(name) ||
-            REJECTED_REQUEST_HEADER_PREFIXES.some((prefix) => name.startsWith(prefix))
-        ) {
-            throw invalid(`The ${name} header cannot be sent through the proxy`, {
-                field: `headers.${name}`,
-            });
-        }
-        if (allowed.has(name)) kept[name] = value;
-    }
-    return kept;
-}
-
-/**
- * Removes credential and hop-by-hop headers from an upstream response, and
- * the Location of a redirect the proxy refused to follow.
- */
-function filterResponseHeaders(headers, { redirectBlocked = false, authHeaderNames = [] } = {}) {
-    const removed = new Set([
-        ...REMOVED_RESPONSE_HEADERS,
-        ...authHeaderNames.filter(Boolean).map((name) => String(name).toLowerCase()),
-    ]);
-    if (redirectBlocked) removed.add('location');
-    const kept = {};
-    for (const [name, value] of Object.entries(headers || {})) {
-        if (!removed.has(name.toLowerCase())) kept[name.toLowerCase()] = value;
-    }
-    return kept;
-}
-
-const JSON_TYPE = /^application\/([a-z0-9.+-]*\+)?json\b/i;
-const TEXT_TYPE = /^(text\/|application\/(xml|x-www-form-urlencoded|javascript|graphql)\b|[a-z]+\/[a-z0-9.+-]*\+xml\b)/i;
-
-/**
- * Turns the upstream body into the `data` of the proxy response: parsed JSON,
- * text, or (only if the module allows binary) base64.
- *
- * @returns {{ data: unknown, encoding?: 'base64' }}
- */
-function decodeResponseBody(body, contentType, { binary = false } = {}) {
-    if (!body || body.length === 0) return { data: null };
-    if (JSON_TYPE.test(contentType)) {
-        const text = body.toString('utf8');
-        try {
-            return { data: JSON.parse(text) };
-        } catch {
-            return { data: text };
-        }
-    }
-    if (!contentType || TEXT_TYPE.test(contentType)) {
-        return { data: body.toString('utf8') };
-    }
-    if (binary) return { data: body.toString('base64'), encoding: 'base64' };
-    throw new ProxyRequestError(
-        'UNSUPPORTED_MEDIA_TYPE',
-        'The upstream response is binary and this module does not allow binary proxying',
-        { contentType: contentType.split(';')[0] }
-    );
-}
-
-module.exports = {
-    PROXY_METHODS,
-    ALLOWED_REQUEST_HEADERS,
-    REJECTED_REQUEST_HEADERS,
-    REMOVED_RESPONSE_HEADERS,
-    validateProxyRequest,
-    resolveAllowRules,
-    filterRequestHeaders,
-    filterResponseHeaders,
-    decodeResponseBody,
-};