@h-ai/serv 0.1.0-alpha.76 → 1.0.0-beta.2

package/dist/index.js

@@ -1,17 +1,16 @@
-import { validateInputOrFail, resolveRequestLocale, localizeZodError } from './chunk-65XNI7TH.js';
-import { servM, WILDCARD_ROLE, WILDCARD_PERMISSION, implement, buildHaiErrorBody } from './chunk-JAQIEQJS.js';
+import { validateInputOrFail, resolveRequestLocale, localizeZodError } from './chunk-TWMOZPGU.js';
+import { servM, WILDCARD_ROLE, WILDCARD_PERMISSION, implement, buildHaiErrorBody } from './chunk-I3F7RN4I.js';
 import process from 'process';
 import { upgradeWebSocket, serve } from '@hono/node-server';
 import { apiContract, AUDIO_WS_PATH, AudioWsClientMessageSchema } from '@h-ai/api-contract';
 import { audit } from '@h-ai/audit';
-import { core, HaiCommonError, err, ok } from '@h-ai/core';
+import { core, RequestAccessConfigSchema, TrustedProxiesSchema, HaiCommonError, err, ok } from '@h-ai/core';
 import { TRANSPORT_PLAINTEXT_RANGE, createTransportBodyPolicy, TRANSPORT_PROTOCOL, authenticateTransportRequest, TransportTimeError, createTransportErrorResponse, TransportBodyTooLargeError, readTransportBody, TRANSPORT_BODY_LIMITS, isValidSM2PublicKey } from '@h-ai/crypto';
 import { OpenAPIHandler } from '@orpc/openapi/fetch';
 import { RPCHandler } from '@orpc/server/fetch';
 import { Hono } from 'hono';
 import { WebSocketServer } from 'ws';
 import { Buffer } from 'buffer';
-import { BlockList, isIP } from 'net';
 import { z } from 'zod';
 import { getCookie } from 'hono/cookie';
 import { readFile } from 'fs/promises';
@@ -552,66 +551,7 @@ function toArrayBuffer(data) {
 function readRemoteAddress(metadata) {
   if (!metadata || typeof metadata !== "object" || !("remoteAddress" in metadata) || typeof metadata.remoteAddress !== "string")
     return void 0;
-  return normalizeClientIp(metadata.remoteAddress);
-}
-function normalizeClientIp(value) {
-  if (!value)
-    return void 0;
-  const address = value.trim();
-  if (!isIP(address))
-    return void 0;
-  const mapped = address.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-  return mapped?.[1] ?? address;
-}
-function addProxy(blockList, entry) {
-  const [address, prefix, extra] = entry.split("/");
-  const family = address ? isIP(address) : 0;
-  if (!family || extra !== void 0)
-    throw new Error("trustedProxies entries must be IP addresses or CIDRs");
-  const type = family === 4 ? "ipv4" : "ipv6";
-  if (prefix === void 0) {
-    blockList.addAddress(address, type);
-    return;
-  }
-  const bits = Number(prefix);
-  if (!/^\d+$/.test(prefix) || bits < 0 || bits > (family === 4 ? 32 : 128))
-    throw new Error("Invalid trustedProxies CIDR prefix");
-  blockList.addSubnet(address, bits, type);
-}
-function isTrustedProxyEntry(entry) {
-  try {
-    addProxy(new BlockList(), entry);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function createClientIpResolver(trustedProxies) {
-  const proxies = new BlockList();
-  for (const entry of trustedProxies)
-    addProxy(proxies, entry);
-  const trusted = (address) => proxies.check(address, isIP(address) === 4 ? "ipv4" : "ipv6");
-  return (request, remoteAddress) => {
-    const peer = normalizeClientIp(remoteAddress);
-    if (!peer || !trusted(peer))
-      return peer;
-    const forwarded = request.headers.get("x-forwarded-for");
-    if (forwarded === null) {
-      const realIp = request.headers.get("x-real-ip");
-      return realIp === null ? peer : normalizeClientIp(realIp);
-    }
-    const chain = forwarded.split(",");
-    if (chain.length > 32)
-      return void 0;
-    let current = peer;
-    for (let index = chain.length - 1; index >= 0 && trusted(current); index--) {
-      const address = normalizeClientIp(chain[index]);
-      if (!address)
-        return void 0;
-      current = address;
-    }
-    return current;
-  };
+  return core.access.normalizeClientIp(metadata.remoteAddress);
 }
 
 // src/pipelines/serv-pipeline-require-internal-rpc.ts
@@ -743,7 +683,8 @@ var CorsRuntimeConfigInputSchema = z.object({
   credentials: z.boolean().default(false)
 });
 var ServHttpConfigInputSchema = z.object({
-  trustedProxies: z.array(z.string().trim().refine(isTrustedProxyEntry, "Expected an IP address or CIDR")).default([]),
+  trustedProxies: TrustedProxiesSchema.default("auto"),
+  access: RequestAccessConfigSchema.default(false),
   apiPrefix: ApiPrefixSchema.default("/api/v1"),
   openapi: OpenAPIHttpConfigInputSchema.default(false),
   docs: DocsHttpConfigInputSchema.default(false),
@@ -803,7 +744,7 @@ function extractBearerToken(value) {
 function parseRequestContext(input) {
   const headers = input.request.headers;
   const requestId = core.context.get().requestId ?? resolveRequestId(headers.get(HEADER_REQUEST_ID));
-  const ip = normalizeClientIp(Object.hasOwn(input, "ip") ? input.ip : input.remoteAddress);
+  const ip = core.access.normalizeClientIp(Object.hasOwn(input, "ip") ? input.ip : input.remoteAddress);
   const locale = resolveRequestLocale(headers);
   const accessToken = extractBearerToken(headers.get(HEADER_AUTHORIZATION));
   const terminal = headers.get("x-hai-terminal");
@@ -999,6 +940,96 @@ async function readRefreshTokenFromBody(request) {
   const body = await request.json().catch(() => void 0);
   return typeof body?.refreshToken === "string" && body.refreshToken.length > 0 ? body.refreshToken : void 0;
 }
+
+// src/serv-cors.ts
+var DEFAULT_CORS_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE", "OPTIONS"];
+var DEFAULT_CORS_ALLOWED_HEADERS = ["Authorization", "Content-Type", "X-Requested-With", "X-Hai-Reauthentication", "X-Hai-Terminal"];
+var DEFAULT_CORS_MAX_AGE = 86400;
+var corsMiddlewares = /* @__PURE__ */ new WeakSet();
+function isCorsMiddleware(middleware) {
+  return corsMiddlewares.has(middleware);
+}
+function cors(config = {}) {
+  const methods = [...config.methods ?? DEFAULT_CORS_METHODS];
+  const allowedHeaders = [...config.allowedHeaders ?? DEFAULT_CORS_ALLOWED_HEADERS];
+  const exposedHeaders = [.../* @__PURE__ */ new Set(["X-Request-Id", "X-Trace-Id", ...config.exposedHeaders ?? []])];
+  const credentials = config.credentials ?? false;
+  const maxAge = config.maxAge ?? DEFAULT_CORS_MAX_AGE;
+  const originConfig = config.origin ?? "*";
+  const middleware = async (c, next) => {
+    const allowedOrigin = resolveCorsOrigin(c.req.header("Origin"), originConfig);
+    if (c.req.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders({
+          allowedOrigin,
+          allowedHeaders,
+          credentials,
+          exposedHeaders,
+          maxAge,
+          methods,
+          request: c.req.raw
+        })
+      });
+    }
+    await next();
+    const corsHeaders = buildCorsHeaders({
+      allowedOrigin,
+      allowedHeaders,
+      credentials,
+      exposedHeaders,
+      maxAge,
+      methods,
+      request: c.req.raw
+    });
+    for (const [key, value] of corsHeaders) {
+      if (key.toLowerCase() === "vary") {
+        c.res.headers.append(key, value);
+        continue;
+      }
+      c.res.headers.set(key, value);
+    }
+    return void 0;
+  };
+  corsMiddlewares.add(middleware);
+  return middleware;
+}
+function resolveCorsOrigin(origin, configOrigin) {
+  if (!origin)
+    return null;
+  if (configOrigin === "*")
+    return "*";
+  if (typeof configOrigin === "string")
+    return origin === configOrigin ? origin : null;
+  if (Array.isArray(configOrigin))
+    return configOrigin.includes(origin) ? origin : null;
+  if (typeof configOrigin === "function")
+    return configOrigin(origin) ? origin : null;
+  return null;
+}
+function buildCorsHeaders(options) {
+  const headers = new Headers();
+  if (!options.allowedOrigin)
+    return headers;
+  const requestedHeaders = options.request.headers.get("Access-Control-Request-Headers");
+  headers.set("Access-Control-Allow-Origin", options.allowedOrigin);
+  if (options.credentials)
+    headers.set("Access-Control-Allow-Credentials", "true");
+  if (options.allowedOrigin !== "*") {
+    headers.set(
+      "Vary",
+      requestedHeaders ? "Origin, Access-Control-Request-Headers" : "Origin"
+    );
+  }
+  if (options.exposedHeaders.length > 0)
+    headers.set("Access-Control-Expose-Headers", options.exposedHeaders.join(", "));
+  if (options.request.method === "OPTIONS") {
+    headers.set("Access-Control-Allow-Methods", options.methods.join(", "));
+    headers.set("Access-Control-Allow-Headers", requestedHeaders ?? options.allowedHeaders.join(", "));
+    headers.set("Access-Control-Max-Age", String(options.maxAge));
+  }
+  return headers;
+}
 var SCALAR_ROUTE = "/_hai/scalar.js";
 var SCALAR_BROWSER_ENTRY_FALLBACK = "./dist/browser/standalone.js";
 var scalarScriptCache;
@@ -1063,12 +1094,20 @@ function readScalarBrowserEntry(packageInfo) {
 }
 var logger2 = core.logger.child({ module: "serv", scope: "transport" });
 var ENCRYPTABLE_RESPONSE_CONTENT_TYPES = ["application/json"];
-function createTransportMiddleware(manager, keyExchangePath, excludePaths = [], policy = createTransportBodyPolicy(manager.bodyLimits.plaintextBytes)) {
+function createTransportMiddleware(manager, keyExchangePath, excludePaths = [], policy = createTransportBodyPolicy(manager.bodyLimits.plaintextBytes), encryption) {
   return async (c, next) => {
     const pathname = new URL(c.req.url).pathname;
+    if (c.req.method === "OPTIONS")
+      return next();
     if (pathname === keyExchangePath && c.req.method === "POST")
       return handleKeyExchange(c.req.raw, manager);
-    if (shouldExclude(pathname, excludePaths, keyExchangePath))
+    const mode = encryption?.(pathname, c.req.method);
+    if (mode === "disabled") {
+      if (c.req.raw.headers.has(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) || c.req.raw.headers.has(TRANSPORT_PROTOCOL.ENVELOPE_HEADER))
+        return Response.json(err({ ...HaiCommonError.VALIDATION_ERROR, message: servM("serv_transportPlaintextRequired"), traceId: core.context.get().traceId ?? core.context.get().requestId }), { status: 400 });
+      return next();
+    }
+    if (mode !== "required" && shouldExclude(pathname, excludePaths, keyExchangePath))
       return next();
     const clientId = c.req.header(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER);
     if (!clientId)
@@ -1222,7 +1261,10 @@ var API_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
 var audioWsServers = /* @__PURE__ */ new WeakMap();
 function createApp(options) {
   const http = resolveServHttpConfig(options.http);
-  const resolveIp = createClientIpResolver(http.trustedProxies);
+  const resolveIp = core.access.createClientIpResolver(http.trustedProxies);
+  const checkAccess = core.access.createRequestCheck(http.access);
+  if (checkAccess.requiresEncryption && !options.transport)
+    throw new Error("Request access rules require transport encryption, but Serv transport is not configured");
   const app = new Hono();
   const requestAuditContexts = /* @__PURE__ */ new WeakMap();
   app.onError((error, c) => {
@@ -1280,8 +1322,45 @@ function createApp(options) {
     return cachedSpec;
   };
   app.use("*", securityHeaders());
-  if (options.middlewares)
-    mountCustomMiddlewares(app, options.middlewares);
+  const accessDenied = (c) => {
+    const ipAddress = resolveIp(c.req.raw, readRemoteAddress(c.env));
+    const decision = checkAccess(c.req.path, c.req.method, ipAddress);
+    if (decision.allowed) {
+      if (!options.transport && c.req.method !== "OPTIONS" && (c.req.raw.headers.has(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) || c.req.raw.headers.has(TRANSPORT_PROTOCOL.ENVELOPE_HEADER)) && checkAccess.encryption(c.req.path, c.req.method) === "disabled") {
+        return c.json(buildHaiErrorBody(HaiCommonError.VALIDATION_ERROR, servM("serv_transportPlaintextRequired")), 400);
+      }
+      return void 0;
+    }
+    core.logger.info("Request access policy denied", { ruleId: decision.ruleId, reason: decision.reason, method: c.req.method, ipAddress });
+    return c.json(buildHaiErrorBody(HaiCommonError.REQUEST_ACCESS_DENIED, core.i18n.coreM("core_requestAccessDenied")), 403);
+  };
+  const cors2 = options.middlewares?.filter((entry) => isCorsMiddleware(entry.middleware)) ?? [];
+  const custom = options.middlewares?.filter((entry) => !isCorsMiddleware(entry.middleware)) ?? [];
+  for (const entry of cors2) {
+    if (http.access === false) {
+      app.use(entry.path ?? "*", entry.middleware);
+      continue;
+    }
+    app.use(entry.path ?? "*", async (c, next) => {
+      if (c.req.method !== "OPTIONS")
+        return entry.middleware(c, next);
+      const rejected = accessDenied(c);
+      const preflight = await entry.middleware(c, async () => {
+      });
+      if (!rejected)
+        return preflight;
+      if (preflight instanceof Response) {
+        for (const [key, value] of preflight.headers)
+          rejected.headers.set(key, value);
+        rejected.headers.set("content-type", "application/json; charset=utf-8");
+      }
+      return rejected;
+    });
+  }
+  const keyExchangePath = options.transport ? `${http.apiPrefix}${options.transport.keyExchangePath ?? "/_hai/key-exchange"}` : void 0;
+  if (http.access !== false && keyExchangePath) {
+    app.use("*", async (c, next) => c.req.path === keyExchangePath && c.req.method === "POST" ? accessDenied(c) ?? next() : next());
+  }
   if (options.transport) {
     const policy = createTransportBodyPolicy(options.transport.maxPlaintextBytes, options.transport.routePlaintextBytes);
     const mgr = options.transport.crypto.transport.createServer({
@@ -1296,9 +1375,11 @@ function createApp(options) {
         mgr.error
       );
     }
-    const keyExchangePath = `${http.apiPrefix}${options.transport.keyExchangePath ?? "/_hai/key-exchange"}`;
-    app.use("*", createTransportMiddleware(mgr.data, keyExchangePath, options.transport.excludePaths, policy));
+    app.use("*", createTransportMiddleware(mgr.data, keyExchangePath, options.transport.excludePaths, policy, checkAccess.encryption));
   }
+  if (http.access !== false)
+    app.use("*", async (c, next) => accessDenied(c) ?? next());
+  mountCustomMiddlewares(app, custom);
   if (http.health !== false)
     mountHealthRoutes(app, http.health);
   if (options.refreshCookie)
@@ -1478,90 +1559,6 @@ function listen(app, options = {}) {
   return handle;
 }
 
-// src/serv-cors.ts
-var DEFAULT_CORS_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE", "OPTIONS"];
-var DEFAULT_CORS_ALLOWED_HEADERS = ["Authorization", "Content-Type", "X-Requested-With", "X-Hai-Reauthentication", "X-Hai-Terminal"];
-var DEFAULT_CORS_MAX_AGE = 86400;
-function cors(config = {}) {
-  const methods = [...config.methods ?? DEFAULT_CORS_METHODS];
-  const allowedHeaders = [...config.allowedHeaders ?? DEFAULT_CORS_ALLOWED_HEADERS];
-  const exposedHeaders = [.../* @__PURE__ */ new Set(["X-Request-Id", "X-Trace-Id", ...config.exposedHeaders ?? []])];
-  const credentials = config.credentials ?? false;
-  const maxAge = config.maxAge ?? DEFAULT_CORS_MAX_AGE;
-  const originConfig = config.origin ?? "*";
-  return async (c, next) => {
-    const allowedOrigin = resolveCorsOrigin(c.req.header("Origin"), originConfig);
-    if (c.req.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: buildCorsHeaders({
-          allowedOrigin,
-          allowedHeaders,
-          credentials,
-          exposedHeaders,
-          maxAge,
-          methods,
-          request: c.req.raw
-        })
-      });
-    }
-    await next();
-    const corsHeaders = buildCorsHeaders({
-      allowedOrigin,
-      allowedHeaders,
-      credentials,
-      exposedHeaders,
-      maxAge,
-      methods,
-      request: c.req.raw
-    });
-    for (const [key, value] of corsHeaders) {
-      if (key.toLowerCase() === "vary") {
-        c.res.headers.append(key, value);
-        continue;
-      }
-      c.res.headers.set(key, value);
-    }
-    return void 0;
-  };
-}
-function resolveCorsOrigin(origin, configOrigin) {
-  if (!origin)
-    return null;
-  if (configOrigin === "*")
-    return "*";
-  if (typeof configOrigin === "string")
-    return origin === configOrigin ? origin : null;
-  if (Array.isArray(configOrigin))
-    return configOrigin.includes(origin) ? origin : null;
-  if (typeof configOrigin === "function")
-    return configOrigin(origin) ? origin : null;
-  return null;
-}
-function buildCorsHeaders(options) {
-  const headers = new Headers();
-  if (!options.allowedOrigin)
-    return headers;
-  const requestedHeaders = options.request.headers.get("Access-Control-Request-Headers");
-  headers.set("Access-Control-Allow-Origin", options.allowedOrigin);
-  if (options.credentials)
-    headers.set("Access-Control-Allow-Credentials", "true");
-  if (options.allowedOrigin !== "*") {
-    headers.set(
-      "Vary",
-      requestedHeaders ? "Origin, Access-Control-Request-Headers" : "Origin"
-    );
-  }
-  if (options.exposedHeaders.length > 0)
-    headers.set("Access-Control-Expose-Headers", options.exposedHeaders.join(", "));
-  if (options.request.method === "OPTIONS") {
-    headers.set("Access-Control-Allow-Methods", options.methods.join(", "));
-    headers.set("Access-Control-Allow-Headers", requestedHeaders ?? options.allowedHeaders.join(", "));
-    headers.set("Access-Control-Max-Age", String(options.maxAge));
-  }
-  return headers;
-}
-
 // src/serv-runtime-security.ts
 function createRuntimeSecurityPolicy(input) {
   const production = input.environment?.trim().toLowerCase() === "production";