@geekmidas/manifest 10.0.0-alpha.131 → 10.0.0-alpha.133

package/dist/index.cjs

@@ -33,6 +33,14 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 * this.
 */
 const DEFAULT_POSTGRES_VERSION = 18;
+/** A site's subdomain that means every subdomain — see `SiteDeclaration`. */
+const WILDCARD_SUBDOMAIN = "*";
+/**
+* Whether a declaration is a site answering on every subdomain.
+*/
+function isWildcardSite(declaration) {
+	return declaration?.kind === "site" && declaration.subdomain === "*";
+}
 /**
 * What a `Telemetry` node provides to each process with an edge to it.
 *
@@ -1000,6 +1008,10 @@ function publicEnvFor(declaration, manifest) {
 		const own = provideKey(declaration.id, "url");
 		keys[`${prefix}${own}`] = own;
 	}
+	if (isWildcardSite(declaration)) for (const role of ["domain", "protectedSubdomains"]) {
+		const key = provideKey(declaration.id, role);
+		keys[`${prefix}${key}`] = key;
+	}
 	for (const edge of declaration.dependencies) {
 		const target = manifest[edge.target];
 		if (!target) continue;
@@ -1215,6 +1227,57 @@ function isWebOrigin(origin) {
 	return origin.startsWith("http://") || origin.startsWith("https://");
 }
 //#endregion
+//#region src/origins.ts
+/**
+* Whether a request from `origin` comes from one of `trusted`.
+*
+* An entry matches exactly — scheme, host and port — or, written
+* `https://*.example.com`, matches any one label in place of the `*`:
+* `https://acme.example.com`, never `https://example.com` and never
+* `https://a.b.example.com`. That is the origin a wildcard site's tenants
+* call from, and it is as wide as a wildcard certificate, no wider.
+*
+* A bare `*` trusts nothing: a surface that answers any origin has not said
+* which sites are its own.
+*/
+function trustsOrigin(origin, trusted) {
+	const request = parse(origin);
+	if (!request) return false;
+	return trusted.some((entry) => {
+		const allowed = parse(entry);
+		if (!allowed) return false;
+		if (allowed.scheme !== request.scheme) return false;
+		if (allowed.port !== request.port) return false;
+		const domain = wildcardDomainOf(allowed.host);
+		if (domain === void 0) return allowed.host === request.host;
+		const dot = request.host.indexOf(".");
+		return dot > 0 && LABEL.test(request.host.slice(0, dot)) && request.host.slice(dot + 1) === domain;
+	});
+}
+/**
+* The domain under a wildcard host — `example.com` for `*.example.com` — or
+* `undefined` for a host that is not one.
+*/
+function wildcardDomainOf(host) {
+	return host.startsWith("*.") ? host.slice(2) : void 0;
+}
+/** One DNS label, as a tenant's slug is. */
+const LABEL = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function parse(origin) {
+	if (!origin || origin === "*") return void 0;
+	try {
+		const url = new URL(origin);
+		if (url.origin === "null") return void 0;
+		return {
+			scheme: url.protocol,
+			host: url.hostname.toLowerCase(),
+			port: url.port
+		};
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/secret.ts
 /**
 * What a generated secret looks like, and the one way every stage draws it.
@@ -1267,6 +1330,7 @@ exports.SECRET_LENGTH = SECRET_LENGTH;
 exports.SECRET_SYMBOLS = SECRET_SYMBOLS;
 exports.TELEMETRY_KEYS = TELEMETRY_KEYS;
 exports.UnknownParent = UnknownParent;
+exports.WILDCARD_SUBDOMAIN = WILDCARD_SUBDOMAIN;
 exports.assertDerivations = assertDerivations;
 exports.bucketExpiry = bucketExpiry;
 exports.cacheTable = cacheTable;
@@ -1281,6 +1345,7 @@ exports.environmentCase = environmentCase;
 exports.externalApiUrl = externalApiUrl;
 exports.isDerived = isDerived;
 exports.isWebOrigin = isWebOrigin;
+exports.isWildcardSite = isWildcardSite;
 exports.kebabCase = kebabCase;
 exports.kmsUrl = kmsUrl;
 exports.migrationFolder = migrationFolder;
@@ -1294,5 +1359,7 @@ exports.schemeBase = schemeBase;
 exports.scopedName = scopedName;
 exports.seedFolder = seedFolder;
 exports.serviceKey = serviceKey;
+exports.trustsOrigin = trustsOrigin;
+exports.wildcardDomainOf = wildcardDomainOf;
 
 //# sourceMappingURL=index.cjs.map