@getstrata/core 1.0.8 → 1.1.0

package/dist/entries/tracing/tracingMiddleware.js

@@ -1,7 +1,4 @@
 // @bun
-// ../../src/core/tracing/otel.ts
-import { randomBytes } from "crypto";
-
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -22,6 +19,9 @@ function envFlagEnabled(value) {
   return value === "true";
 }
 
+// ../../src/core/tracing/otel.ts
+import { randomBytes } from "crypto";
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -85,6 +85,293 @@ function sdkClientClassName() {
   return fromName ? `${fromName}Client` : "AppClient";
 }
 
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+import { BadRequestError } from "@getstrata/core/errors/http";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function parseCanonicalDottedDecimal(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) {
+    return null;
+  }
+  const octets = [];
+  for (const part of parts) {
+    if (!/^(0|[1-9]\d{0,2})$/u.test(part)) {
+      return null;
+    }
+    const value = Number.parseInt(part, 10);
+    if (!Number.isInteger(value) || value < 0 || value > 255) {
+      return null;
+    }
+    octets.push(value);
+  }
+  return octets;
+}
+function parseDottedIpv4(hostname) {
+  return parseCanonicalDottedDecimal(hostname);
+}
+function isBlockedIpv4Octets(octets) {
+  const [a = 0, b = 0] = octets;
+  if (a === 10 || a === 127 || a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  if (a === 100 && b >= 64 && b <= 127) {
+    return true;
+  }
+  if (a === 198 && (b === 18 || b === 19)) {
+    return true;
+  }
+  return false;
+}
+function expandIpv6(hostname) {
+  const trimmed = hostname.trim().toLowerCase();
+  const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+  if (unbracketed.includes("%")) {
+    return null;
+  }
+  const mapped = unbracketed.match(/^::ffff:([0-9a-fx.]+)$/iu);
+  if (mapped?.[1]) {
+    const octets = parseDottedIpv4(mapped[1]);
+    if (!octets) {
+      return null;
+    }
+    return [
+      0,
+      0,
+      0,
+      0,
+      0,
+      65535,
+      octets[0] << 8 | octets[1],
+      octets[2] << 8 | octets[3]
+    ];
+  }
+  const halves = unbracketed.split("::");
+  if (halves.length > 2) {
+    return null;
+  }
+  const parseGroup = (part) => {
+    if (!/^[0-9a-f]{1,4}$/u.test(part)) {
+      return null;
+    }
+    return Number.parseInt(part, 16);
+  };
+  if (halves.length === 1) {
+    const groups = unbracketed.split(":");
+    if (groups.length !== 8) {
+      return null;
+    }
+    const values = groups.map(parseGroup);
+    return values.every((value) => value !== null) ? values : null;
+  }
+  const head = halves[0] ? halves[0].split(":").filter(Boolean) : [];
+  const tail = halves[1] ? halves[1].split(":").filter(Boolean) : [];
+  if (head.length + tail.length > 8) {
+    return null;
+  }
+  const values = [];
+  for (const part of head) {
+    const value = parseGroup(part);
+    if (value === null) {
+      return null;
+    }
+    values.push(value);
+  }
+  while (values.length < 8 - tail.length) {
+    values.push(0);
+  }
+  for (const part of tail) {
+    const value = parseGroup(part);
+    if (value === null) {
+      return null;
+    }
+    values.push(value);
+  }
+  return values.length === 8 ? values : null;
+}
+function isBlockedIpv6(hostname) {
+  const groups = expandIpv6(hostname);
+  if (!groups) {
+    return hostname.includes(":");
+  }
+  const first = groups[0] ?? 0;
+  const second = groups[1] ?? 0;
+  if (groups.every((group) => group === 0)) {
+    return true;
+  }
+  if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) {
+    return true;
+  }
+  if ((first & 65472) === 65152) {
+    return true;
+  }
+  if ((first & 65024) === 64512) {
+    return true;
+  }
+  if ((first & 65280) === 65280) {
+    return true;
+  }
+  if (first === 0 && second === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) {
+    const a = (groups[6] ?? 0) >> 8;
+    const b = (groups[6] ?? 0) & 255;
+    const c = (groups[7] ?? 0) >> 8;
+    const d = (groups[7] ?? 0) & 255;
+    return isBlockedIpv4Octets([a, b, c, d]);
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return isBlockedIpv6(normalized);
+  }
+  if (/^\d+$/u.test(normalized)) {
+    return true;
+  }
+  if (normalized.includes(".")) {
+    const canonical = parseCanonicalDottedDecimal(normalized);
+    if (canonical) {
+      return isBlockedIpv4Octets(canonical);
+    }
+    if (/^[0-9a-fx.]+$/iu.test(normalized)) {
+      return true;
+    }
+  }
+  return false;
+}
+function productionSafeOutboundOptions(options) {
+  if (!isProductionEnv()) {
+    return options;
+  }
+  return { ...options, allowPrivate: false, resolveDns: true };
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  const resolved = productionSafeOutboundOptions(options);
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(resolved.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (!resolved.allowPrivate && isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+function isLiteralIpHostname(hostname) {
+  return parseCanonicalDottedDecimal(hostname) !== null || expandIpv6(hostname) !== null;
+}
+function pinUrlToAddress(url, address) {
+  const pinned = new URL(url.toString());
+  const ipv6 = expandIpv6(address.replace(/^\[|\]$/gu, ""));
+  pinned.hostname = ipv6 ? `[${address.replace(/^\[|\]$/gu, "")}]` : address;
+  return pinned;
+}
+async function resolveSafeOutboundTarget(rawUrl, options = {}) {
+  const resolvedOptions = productionSafeOutboundOptions(options);
+  const parsed = assertSafeOutboundUrl(rawUrl, resolvedOptions);
+  if (resolvedOptions.resolveDns === false || resolvedOptions.allowPrivate) {
+    return { url: parsed, addresses: [] };
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  if (isLiteralIpHostname(hostname)) {
+    return { url: parsed, addresses: [hostname] };
+  }
+  let results;
+  try {
+    results = await dnsLookup(hostname, { all: true, verbatim: true });
+  } catch {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  if (results.length === 0 || results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return { url: parsed, addresses: results.map((result) => result.address) };
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? true;
+  const urlOptions = {
+    allowHttp: options.allowHttp,
+    resolveDns,
+    allowPrivate: options.allowPrivate
+  };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let current = await resolveSafeOutboundTarget(input, urlOptions);
+    let redirectCount = 0;
+    while (true) {
+      const address = current.addresses[0];
+      const fetchUrl = address ? pinUrlToAddress(current.url, address).toString() : current.url.toString();
+      const headers = new Headers(init.headers);
+      if (address && !headers.has("host")) {
+        headers.set("Host", current.url.host);
+      }
+      const fetchInit = {
+        ...init,
+        headers,
+        signal: controller.signal,
+        redirect: "manual"
+      };
+      if (address) {
+        fetchInit.tls = { serverName: current.url.hostname };
+      }
+      const response = await fetch(fetchUrl, fetchInit);
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        current = await resolveSafeOutboundTarget(new URL(location, current.url).toString(), urlOptions);
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
 // ../../src/core/tracing/otel.ts
 function randomHex(bytes) {
   return randomBytes(bytes).toString("hex");
@@ -111,7 +398,7 @@ async function exportOtelSpan(span) {
   }
   const serviceName = otelServiceName();
   const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
-  await fetch(url, {
+  await safeFetch(url, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
@@ -124,6 +411,11 @@ async function exportOtelSpan(span) {
         }
       ]
     })
+  }, {
+    allowHttp: !isProductionEnv(),
+    allowPrivate: !isProductionEnv(),
+    timeoutMs: 5000,
+    maxRedirects: 0
   });
 }
 
@@ -148,9 +440,20 @@ function runWithTraceContext(context, callback) {
 }
 
 // ../../src/core/tracing/tracingMiddleware.ts
+function readClientTraceId(request) {
+  if (!envFlagEnabled(process.env.APP_DEBUG)) {
+    return null;
+  }
+  const raw = request.headers.get("x-trace-id")?.trim() ?? "";
+  if (!raw) {
+    return null;
+  }
+  const compact = raw.replace(/-/g, "");
+  return /^[0-9a-f]{32}$/iu.test(compact) ? compact.toLowerCase() : null;
+}
 function createTracingMiddleware() {
   return async (request, next) => {
-    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
+    const traceId = readClientTraceId(request) ?? crypto.randomUUID().replace(/-/g, "");
     const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
     const startedAt = performance.now();
     const path = new URL(request.url).pathname;

package/dist/framework/public-api.d.ts

@@ -6,8 +6,8 @@ export type { AdminColumn, AdminColumnType, AdminResource, AdminResourceDefiniti
 export { AdminResourceRegistry, formatAdminValue, } from "../core/admin/index.ts";
 export type { AbilityChecker } from "../core/auth/abilityChecker.ts";
 export { isGlobalAdmin, resolveUserId } from "../core/auth/accessControl.ts";
-export type { AuthUser } from "../core/auth/authContext.ts";
-export { authContext, currentAuthUser, runWithAuthUser } from "../core/auth/authContext.ts";
+export type { AuthUser, CredentialSource } from "../core/auth/authContext.ts";
+export { authContext, currentAuthUser, currentCredentialSource, runWithAuthContext, runWithAuthUser, } from "../core/auth/authContext.ts";
 export { BasicAuthGuard } from "../core/auth/basicAuthGuard.ts";
 export type { AuthGuard } from "../core/auth/guard.ts";
 export { ApiTokenGuard, AuthManager, CompositeGuard, DatabaseTokenGuard, GuestGuard, } from "../core/auth/guard.ts";
@@ -18,7 +18,12 @@ export { configureMembershipLookup, currentOrganizationIds, currentOrgRole, hasM
 export { createMembershipMiddleware } from "../core/auth/membershipMiddleware.ts";
 export { appendOrganizationScope, appendProjectScope, assertOrganizationReadable, assertResourceInCurrentTenant, emptyPaginateResult, resolveOrganizationScope, scopedOrganizationIds, } from "../core/auth/membershipScope.ts";
 export { default as MembershipService, resolveMembershipService, } from "../core/auth/membershipService.ts";
+export { createOidcHandshake, OidcProvider } from "../core/auth/oauth/oidcProvider.ts";
+export { SamlProvider } from "../core/auth/oauth/samlProvider.ts";
+export { AUTH_ONE_TIME_PURPOSES, generateOneTimeToken, hashOneTimeToken, } from "../core/auth/oneTimeToken.ts";
+export { completePasswordLogin } from "../core/auth/passwordLogin.ts";
 export { Policy, PolicyGate } from "../core/auth/policy.ts";
+export { consumeSamlAssertion, createSamlServiceProvider, InMemorySamlAssertionReplayStore, readSamlEnvOptions, resetSamlReplayCacheForTests, SamlServiceProvider, setNodeSamlLoaderForTests, setSamlAssertionReplayStoreForTests, } from "../core/auth/saml/samlServiceProvider.ts";
 export { createScimAuthMiddleware } from "../core/auth/scimAuthMiddleware.ts";
 export { createTokenAbilityChecker } from "../core/auth/tokenAbilityChecker.ts";
 export { type CacheDriver, type CreateCacheStoreOptions, createCacheStore, } from "../core/cache/createCacheStore.ts";
@@ -130,11 +135,13 @@ export { resolveApplicationAuth, resolveApplicationCache, resolveApplicationConf
 export type { ScheduledTask } from "../core/scheduler/schedule.ts";
 export { appSchedule, runDueScheduledTasks, Schedule } from "../core/scheduler/schedule.ts";
 export { guestCanViewResource, isPublicReadsEnabled } from "../core/security/publicReads.ts";
-export { assertSafeOutboundUrl, assertSafeOutboundUrlResolved, isBlockedHostname, isBlockedIpAddress, resetDnsLookupForTests, setDnsLookupForTests, } from "../core/security/safeUrl.ts";
+export { assertPathUnderRoot, assertUrlPathUnderRoot } from "../core/security/safePath.ts";
+export { assertSafeOutboundUrl, assertSafeOutboundUrlResolved, isBlockedHostname, isBlockedIpAddress, pinUrlToAddress, resetDnsLookupForTests, resolveSafeOutboundTarget, setDnsLookupForTests, } from "../core/security/safeUrl.ts";
 export type { SecurityEventDetails } from "../core/security/securityEvents.ts";
 export { logSecurityEvent } from "../core/security/securityEvents.ts";
 export type { StorageDriver } from "../core/storage/storage.ts";
 export { createStorageDriver, LocalStorageDriver, resetDefaultStorage, StorageManager, } from "../core/storage/storage.ts";
+export { enableTenantRlsSql, enableUserOwnedRlsSql, generatedRlsBootstrapSql, RLS_HELPER_SQL, } from "../core/tenant/enableTenantRls.ts";
 export type { TenancyDriver } from "../core/tenant/tenancyConfig.ts";
 export { isRlsTenancy, isTenancyEnabled, readTenancyDriver, } from "../core/tenant/tenancyConfig.ts";
 export type { TenantContext } from "../core/tenant/tenantContext.ts";