@getstrata/core 2.2.39 → 2.2.41

package/dist/entries/auth/oauth/oidcProvider.js

@@ -2,267 +2,8 @@
 // ../../src/core/auth/oauth/oidcProvider.ts
 import { createHash as createHash2, randomBytes } from "crypto";
 
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-import { BadRequestError } from "@getstrata/core/errors/http";
-
-// ../../src/core/runtime/appEnv.ts
-var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
-function normalizeEnvValue(value) {
-  return (value ?? "").trim().toLowerCase();
-}
-function isProductionEnv(env = process.env) {
-  const appEnv = normalizeEnvValue(env.APP_ENV);
-  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
-  if (appEnv === "production" || nodeEnv === "production") {
-    return true;
-  }
-  if (appEnv === "") {
-    return false;
-  }
-  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
-}
-function envFlagEnabled(value) {
-  return value === "true";
-}
-
-// ../../src/core/security/safeUrl.ts
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function parseCanonicalDottedDecimal(hostname) {
-  const parts = hostname.split(".");
-  if (parts.length !== 4) {
-    return null;
-  }
-  const octets = [];
-  for (const part of parts) {
-    if (!/^(0|[1-9]\d{0,2})$/u.test(part)) {
-      return null;
-    }
-    const value = Number.parseInt(part, 10);
-    if (!Number.isInteger(value) || value < 0 || value > 255) {
-      return null;
-    }
-    octets.push(value);
-  }
-  return octets;
-}
-function parseDottedIpv4(hostname) {
-  return parseCanonicalDottedDecimal(hostname);
-}
-function isBlockedIpv4Octets(octets) {
-  const [a = 0, b = 0] = octets;
-  if (a === 10 || a === 127 || a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  if (a === 100 && b >= 64 && b <= 127) {
-    return true;
-  }
-  if (a === 198 && (b === 18 || b === 19)) {
-    return true;
-  }
-  return false;
-}
-function expandIpv6(hostname) {
-  const trimmed = hostname.trim().toLowerCase();
-  const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
-  if (unbracketed.includes("%")) {
-    return null;
-  }
-  const mapped = unbracketed.match(/^::ffff:([0-9a-fx.]+)$/iu);
-  if (mapped?.[1]) {
-    const octets = parseDottedIpv4(mapped[1]);
-    if (!octets) {
-      return null;
-    }
-    return [
-      0,
-      0,
-      0,
-      0,
-      0,
-      65535,
-      octets[0] << 8 | octets[1],
-      octets[2] << 8 | octets[3]
-    ];
-  }
-  const halves = unbracketed.split("::");
-  if (halves.length > 2) {
-    return null;
-  }
-  const parseGroup = (part) => {
-    if (!/^[0-9a-f]{1,4}$/u.test(part)) {
-      return null;
-    }
-    return Number.parseInt(part, 16);
-  };
-  if (halves.length === 1) {
-    const groups = unbracketed.split(":");
-    if (groups.length !== 8) {
-      return null;
-    }
-    const values = groups.map(parseGroup);
-    return values.every((value) => value !== null) ? values : null;
-  }
-  const head = halves[0] ? halves[0].split(":").filter(Boolean) : [];
-  const tail = halves[1] ? halves[1].split(":").filter(Boolean) : [];
-  if (head.length + tail.length > 8) {
-    return null;
-  }
-  const values = [];
-  for (const part of head) {
-    const value = parseGroup(part);
-    if (value === null) {
-      return null;
-    }
-    values.push(value);
-  }
-  while (values.length < 8 - tail.length) {
-    values.push(0);
-  }
-  for (const part of tail) {
-    const value = parseGroup(part);
-    if (value === null) {
-      return null;
-    }
-    values.push(value);
-  }
-  return values.length === 8 ? values : null;
-}
-function isBlockedIpv6(hostname) {
-  const groups = expandIpv6(hostname);
-  if (!groups) {
-    return hostname.includes(":");
-  }
-  const first = groups[0] ?? 0;
-  const second = groups[1] ?? 0;
-  if (groups.every((group) => group === 0)) {
-    return true;
-  }
-  if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) {
-    return true;
-  }
-  if ((first & 65472) === 65152) {
-    return true;
-  }
-  if ((first & 65024) === 64512) {
-    return true;
-  }
-  if ((first & 65280) === 65280) {
-    return true;
-  }
-  if (first === 0 && second === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) {
-    const a = (groups[6] ?? 0) >> 8;
-    const b = (groups[6] ?? 0) & 255;
-    const c = (groups[7] ?? 0) >> 8;
-    const d = (groups[7] ?? 0) & 255;
-    return isBlockedIpv4Octets([a, b, c, d]);
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return isBlockedIpv6(normalized);
-  }
-  if (/^\d+$/u.test(normalized)) {
-    return true;
-  }
-  if (normalized.includes(".")) {
-    const canonical = parseCanonicalDottedDecimal(normalized);
-    if (canonical) {
-      return isBlockedIpv4Octets(canonical);
-    }
-    if (/^[0-9a-fx.]+$/iu.test(normalized)) {
-      return true;
-    }
-  }
-  return false;
-}
-function productionSafeOutboundOptions(options) {
-  if (!isProductionEnv()) {
-    return options;
-  }
-  return { ...options, allowPrivate: false, resolveDns: true };
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  const resolved = productionSafeOutboundOptions(options);
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(resolved.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (!resolved.allowPrivate && isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-function isLiteralIpHostname(hostname) {
-  return parseCanonicalDottedDecimal(hostname) !== null || expandIpv6(hostname) !== null;
-}
-function pinUrlToAddress(url, address) {
-  const pinned = new URL(url.toString());
-  const ipv6 = expandIpv6(address.replace(/^\[|\]$/gu, ""));
-  pinned.hostname = ipv6 ? `[${address.replace(/^\[|\]$/gu, "")}]` : address;
-  return pinned;
-}
-async function resolveSafeOutboundTarget(rawUrl, options = {}) {
-  const resolvedOptions = productionSafeOutboundOptions(options);
-  const parsed = assertSafeOutboundUrl(rawUrl, resolvedOptions);
-  if (resolvedOptions.resolveDns === false || resolvedOptions.allowPrivate) {
-    return { url: parsed, addresses: [] };
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  if (isLiteralIpHostname(hostname)) {
-    return { url: parsed, addresses: [hostname] };
-  }
-  let results;
-  try {
-    results = await dnsLookup(hostname, { all: true, verbatim: true });
-  } catch {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  if (results.length === 0 || results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return { url: parsed, addresses: results.map((result) => result.address) };
-}
-
 // ../../src/core/security/safeFetch.ts
+import { pinUrlToAddress, resolveSafeOutboundTarget } from "@getstrata/core/security/safeUrl";
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 function untilAborted(work, signal) {
   signal.throwIfAborted();
@@ -397,6 +138,26 @@ async function safeFetch(input, init = {}, options = {}) {
 // ../../src/core/auth/oauth/oidcIdToken.ts
 import { createHash, createPublicKey, createVerify } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/security/timingSafeCompare.ts
 import { timingSafeEqual } from "crypto";
 function timingSafeCompareString(left, right) {

package/dist/entries/auth/oauth/providers.js

@@ -85,245 +85,8 @@ function sdkClientClassName() {
   return fromName ? `${fromName}Client` : "AppClient";
 }
 
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-import { BadRequestError } from "@getstrata/core/errors/http";
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function parseCanonicalDottedDecimal(hostname) {
-  const parts = hostname.split(".");
-  if (parts.length !== 4) {
-    return null;
-  }
-  const octets = [];
-  for (const part of parts) {
-    if (!/^(0|[1-9]\d{0,2})$/u.test(part)) {
-      return null;
-    }
-    const value = Number.parseInt(part, 10);
-    if (!Number.isInteger(value) || value < 0 || value > 255) {
-      return null;
-    }
-    octets.push(value);
-  }
-  return octets;
-}
-function parseDottedIpv4(hostname) {
-  return parseCanonicalDottedDecimal(hostname);
-}
-function isBlockedIpv4Octets(octets) {
-  const [a = 0, b = 0] = octets;
-  if (a === 10 || a === 127 || a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  if (a === 100 && b >= 64 && b <= 127) {
-    return true;
-  }
-  if (a === 198 && (b === 18 || b === 19)) {
-    return true;
-  }
-  return false;
-}
-function expandIpv6(hostname) {
-  const trimmed = hostname.trim().toLowerCase();
-  const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
-  if (unbracketed.includes("%")) {
-    return null;
-  }
-  const mapped = unbracketed.match(/^::ffff:([0-9a-fx.]+)$/iu);
-  if (mapped?.[1]) {
-    const octets = parseDottedIpv4(mapped[1]);
-    if (!octets) {
-      return null;
-    }
-    return [
-      0,
-      0,
-      0,
-      0,
-      0,
-      65535,
-      octets[0] << 8 | octets[1],
-      octets[2] << 8 | octets[3]
-    ];
-  }
-  const halves = unbracketed.split("::");
-  if (halves.length > 2) {
-    return null;
-  }
-  const parseGroup = (part) => {
-    if (!/^[0-9a-f]{1,4}$/u.test(part)) {
-      return null;
-    }
-    return Number.parseInt(part, 16);
-  };
-  if (halves.length === 1) {
-    const groups = unbracketed.split(":");
-    if (groups.length !== 8) {
-      return null;
-    }
-    const values = groups.map(parseGroup);
-    return values.every((value) => value !== null) ? values : null;
-  }
-  const head = halves[0] ? halves[0].split(":").filter(Boolean) : [];
-  const tail = halves[1] ? halves[1].split(":").filter(Boolean) : [];
-  if (head.length + tail.length > 8) {
-    return null;
-  }
-  const values = [];
-  for (const part of head) {
-    const value = parseGroup(part);
-    if (value === null) {
-      return null;
-    }
-    values.push(value);
-  }
-  while (values.length < 8 - tail.length) {
-    values.push(0);
-  }
-  for (const part of tail) {
-    const value = parseGroup(part);
-    if (value === null) {
-      return null;
-    }
-    values.push(value);
-  }
-  return values.length === 8 ? values : null;
-}
-function isBlockedIpv6(hostname) {
-  const groups = expandIpv6(hostname);
-  if (!groups) {
-    return hostname.includes(":");
-  }
-  const first = groups[0] ?? 0;
-  const second = groups[1] ?? 0;
-  if (groups.every((group) => group === 0)) {
-    return true;
-  }
-  if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) {
-    return true;
-  }
-  if ((first & 65472) === 65152) {
-    return true;
-  }
-  if ((first & 65024) === 64512) {
-    return true;
-  }
-  if ((first & 65280) === 65280) {
-    return true;
-  }
-  if (first === 0 && second === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) {
-    const a = (groups[6] ?? 0) >> 8;
-    const b = (groups[6] ?? 0) & 255;
-    const c = (groups[7] ?? 0) >> 8;
-    const d = (groups[7] ?? 0) & 255;
-    return isBlockedIpv4Octets([a, b, c, d]);
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return isBlockedIpv6(normalized);
-  }
-  if (/^\d+$/u.test(normalized)) {
-    return true;
-  }
-  if (normalized.includes(".")) {
-    const canonical = parseCanonicalDottedDecimal(normalized);
-    if (canonical) {
-      return isBlockedIpv4Octets(canonical);
-    }
-    if (/^[0-9a-fx.]+$/iu.test(normalized)) {
-      return true;
-    }
-  }
-  return false;
-}
-function productionSafeOutboundOptions(options) {
-  if (!isProductionEnv()) {
-    return options;
-  }
-  return { ...options, allowPrivate: false, resolveDns: true };
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  const resolved = productionSafeOutboundOptions(options);
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(resolved.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (!resolved.allowPrivate && isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-function isLiteralIpHostname(hostname) {
-  return parseCanonicalDottedDecimal(hostname) !== null || expandIpv6(hostname) !== null;
-}
-function pinUrlToAddress(url, address) {
-  const pinned = new URL(url.toString());
-  const ipv6 = expandIpv6(address.replace(/^\[|\]$/gu, ""));
-  pinned.hostname = ipv6 ? `[${address.replace(/^\[|\]$/gu, "")}]` : address;
-  return pinned;
-}
-async function resolveSafeOutboundTarget(rawUrl, options = {}) {
-  const resolvedOptions = productionSafeOutboundOptions(options);
-  const parsed = assertSafeOutboundUrl(rawUrl, resolvedOptions);
-  if (resolvedOptions.resolveDns === false || resolvedOptions.allowPrivate) {
-    return { url: parsed, addresses: [] };
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  if (isLiteralIpHostname(hostname)) {
-    return { url: parsed, addresses: [hostname] };
-  }
-  let results;
-  try {
-    results = await dnsLookup(hostname, { all: true, verbatim: true });
-  } catch {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  if (results.length === 0 || results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return { url: parsed, addresses: results.map((result) => result.address) };
-}
-
 // ../../src/core/security/safeFetch.ts
+import { pinUrlToAddress, resolveSafeOutboundTarget } from "@getstrata/core/security/safeUrl";
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 function untilAborted(work, signal) {
   signal.throwIfAborted();

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -403,7 +403,9 @@ async function renderWebErrorHtml(input) {
   }
 }
 async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  response.headers.set("Cache-Control", "no-store");
+  return response;
 }
 
 // ../../src/core/http/contentNegotiation.ts