@getstrata/core 0.5.14 → 0.5.16

package/dist/entries/security/safeUrl.js

@@ -1,4 +1,7 @@
 // @bun
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
   status;
@@ -66,6 +69,7 @@ class PreconditionFailedError extends HttpError {
 }
 
 // ../../src/core/security/safeUrl.ts
+var dnsLookup = dnsLookupImpl;
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
   "127.0.0.1",
@@ -137,7 +141,32 @@ function assertSafeOutboundUrl(rawUrl, options = {}) {
   }
   return parsed;
 }
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function setDnsLookupForTests(lookupFn) {
+  dnsLookup = lookupFn;
+}
+function resetDnsLookupForTests() {
+  dnsLookup = dnsLookupImpl;
+}
 export {
+  setDnsLookupForTests,
+  resetDnsLookupForTests,
+  isBlockedIpAddress,
   isBlockedHostname,
+  assertSafeOutboundUrlResolved,
   assertSafeOutboundUrl
 };

package/dist/entries/security/securityEvents.js

@@ -1,41 +1 @@
-// @bun
-// ../../src/core/auth/authContext.ts
-import { AsyncLocalStorage } from "async_hooks";
-var authContext = new AsyncLocalStorage;
-function runWithAuthUser(user, callback) {
-  return authContext.run(user, callback);
-}
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
-}
-
-// ../../src/core/http/requestMetaContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var requestMetaContext = new AsyncLocalStorage2;
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/security/securityEvents.ts
-function logSecurityEvent(event, details = {}) {
-  const meta = currentRequestMeta();
-  const user = currentAuthUser();
-  console.log(JSON.stringify({
-    level: "security",
-    event,
-    timestamp: new Date().toISOString(),
-    ip_address: meta.ipAddress ?? null,
-    user_agent: meta.userAgent ?? null,
-    user_id: user?.id ?? null,
-    ...details
-  }));
-}
-export {
-  logSecurityEvent
-};
+export * from "../../index.js";

package/dist/entries/tenant/tenantContext.js

@@ -1,30 +1 @@
-// @bun
-// ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage } from "async_hooks";
-var tenantContext = new AsyncLocalStorage;
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function currentTenantId() {
-  return currentTenant()?.id ?? 1;
-}
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
-  }
-}
-export {
-  tenantContext,
-  runWithTenant,
-  rateLimitMultiplierForPlan,
-  currentTenantId,
-  currentTenant
-};
+export * from "../../index.js";

package/dist/entries/tenant/tenantMiddleware.js

@@ -1,312 +1 @@
-// @bun
-// ../../src/core/tenant/tenantMiddleware.ts
-import { createHash } from "crypto";
-
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/database/connectionContext.ts
-import { AsyncLocalStorage } from "async_hooks";
-var activeConnection = new AsyncLocalStorage;
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
-}
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
-  }
-  return resolveDatabase();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
-// ../../src/core/errors/http.ts
-class HttpError extends Error {
-  status;
-  details;
-  constructor(status, message, details) {
-    super(message);
-    this.name = new.target.name;
-    this.status = status;
-    this.details = details;
-  }
-}
-
-class BadRequestError extends HttpError {
-  constructor(message = "Bad Request", details) {
-    super(400, message, details);
-  }
-}
-
-class NotFoundError extends HttpError {
-  constructor(message = "Not Found", details) {
-    super(404, message, details);
-  }
-}
-
-class ConflictError extends HttpError {
-  constructor(message = "Conflict", details) {
-    super(409, message, details);
-  }
-}
-
-class UnprocessableEntityError extends HttpError {
-  constructor(message = "Unprocessable Entity", details) {
-    super(422, message, details);
-  }
-}
-
-class ValidationError extends HttpError {
-  constructor(message = "Validation failed", details) {
-    super(422, message, details);
-  }
-}
-
-class ForbiddenError extends HttpError {
-  constructor(message = "Forbidden", details) {
-    super(403, message, details);
-  }
-}
-
-class UnauthorizedError extends HttpError {
-  constructor(message = "Unauthorized", details) {
-    super(401, message, details);
-  }
-}
-
-class PayloadTooLargeError extends HttpError {
-  constructor(message = "Payload Too Large", details) {
-    super(413, message, details);
-  }
-}
-
-class PreconditionFailedError extends HttpError {
-  constructor(message = "Precondition Failed", details) {
-    super(412, message, details);
-  }
-}
-
-// ../../src/core/auth/authContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var authContext = new AsyncLocalStorage2;
-function runWithAuthUser(user, callback) {
-  return authContext.run(user, callback);
-}
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
-}
-
-// ../../src/core/auth/accessControl.ts
-var ROLE_RANK = {
-  member: 1,
-  admin: 2,
-  owner: 3
-};
-function isGlobalAdmin(user) {
-  return user?.role === "admin";
-}
-function hasMinimumOrgRole(role, minimum) {
-  if (!role) {
-    return false;
-  }
-  return ROLE_RANK[role] >= ROLE_RANK[minimum];
-}
-function requireAuthenticatedUser() {
-  const user = currentAuthUser();
-  if (!user) {
-    throw new ForbiddenError("Authentication required.");
-  }
-  return user;
-}
-function resolveUserId(user) {
-  const userId = typeof user.id === "number" ? user.id : Number(user.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    throw new ForbiddenError("Invalid authenticated user.");
-  }
-  return userId;
-}
-
-// ../../src/core/tenant/databaseTenantContext.ts
-async function runWithMigrationBypass(callback) {
-  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
-  try {
-    return await callback();
-  } finally {
-    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
-  }
-}
-
-// ../../src/core/tenant/resolveTenant.ts
-async function resolveTenant(tenantId) {
-  const rows = await connection_default`
-    SELECT id, slug, plan, region
-    FROM tenant
-    WHERE id = ${tenantId}
-    LIMIT 1
-  `;
-  const row = rows[0];
-  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
-}
-
-// ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
-var tenantContext = new AsyncLocalStorage3;
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function currentTenantId() {
-  return currentTenant()?.id ?? 1;
-}
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
-  }
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-async function applyTenantContextToTransaction(transaction, tenantId) {
-  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
-}
-async function runWithTenantDatabase(tenant, callback) {
-  return await getDatabase().begin(async (transaction) => {
-    await applyTenantContextToTransaction(transaction, tenant.id);
-    return await runWithDatabaseConnection(transaction, async () => {
-      return await runWithTenant(tenant, callback);
-    });
-  });
-}
-
-// ../../src/core/tenant/tenantMiddleware.ts
-var DEFAULT_TENANT = {
-  id: 1,
-  slug: "default",
-  plan: "enterprise",
-  region: "eu"
-};
-async function resolveUserTenantId(userId) {
-  return await runWithMigrationBypass(async () => {
-    const rows = await connection_default`
-      SELECT tenant_id
-      FROM users
-      WHERE id = ${userId}
-      LIMIT 1
-    `;
-    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
-  });
-}
-function auditChecksum(payload) {
-  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
-}
-async function resolveTenantForRequest(request) {
-  const user = currentAuthUser();
-  const headerValue = request.headers.get("x-tenant-id")?.trim();
-  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
-  if (user) {
-    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
-    if (Number.isInteger(userId) && userId > 0) {
-      const userTenantId = await resolveUserTenantId(userId);
-      if (!isGlobalAdmin(user)) {
-        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
-          throw new ForbiddenError("Tenant header does not match your account.");
-        }
-        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-      }
-      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
-        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
-      }
-      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-    }
-  }
-  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
-  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
-}
-function createTenantMiddleware() {
-  return async (request, next) => {
-    try {
-      const tenant = await resolveTenantForRequest(request);
-      return await runWithTenantDatabase(tenant, async () => {
-        const response = await next();
-        const headers = new Headers(response.headers);
-        headers.set("x-tenant-id", String(tenant.id));
-        headers.set("x-tenant-region", tenant.region);
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      });
-    } catch (error) {
-      if (error instanceof HttpError) {
-        return Response.json({ error: error.message }, { status: error.status });
-      }
-      throw error;
-    }
-  };
-}
-export {
-  resolveUserTenantId,
-  createTenantMiddleware,
-  auditChecksum,
-  DEFAULT_TENANT
-};
+export * from "../../index.js";

package/dist/entries/tracing/traceContext.js

@@ -1,15 +1 @@
-// @bun
-// ../../src/core/tracing/traceContext.ts
-import { AsyncLocalStorage } from "async_hooks";
-var traceContextStorage = new AsyncLocalStorage;
-function runWithTraceContext(context, callback) {
-  return traceContextStorage.run(context, callback);
-}
-function currentTraceId() {
-  return traceContextStorage.getStore()?.traceId ?? null;
-}
-export {
-  traceContextStorage,
-  runWithTraceContext,
-  currentTraceId
-};
+export * from "../../index.js";