@infoxchange/make-it-so 2.11.0 → 2.12.0-internal-testing-odic-verify-proxy-fix.1

package/dist/lib/auth/oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/oidc.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,UAAU,EAAa,MAAM,MAAM,CAAC;AAEjE,KAAK,uBAAuB,CAAC,UAAU,SAAS,OAAO,GAAG,KAAK,IAAI;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,SAAS,OAAO,GAAG,KAAK,EAAE,EAC1E,KAAK,EACL,SAAS,EACT,QAAQ,EACR,UAAU,GACX,EAAE,uBAAuB,CAAC,UAAU,CAAC,GAAG,OAAO,CAC9C,UAAU,SAAS,IAAI,GAEf;IAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACxC,UAAU,CACf,CAyCA"}
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/oidc.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,UAAU,EAAa,MAAM,MAAM,CAAC;AAEjE,KAAK,uBAAuB,CAAC,UAAU,SAAS,OAAO,GAAG,KAAK,IAAI;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,SAAS,OAAO,GAAG,KAAK,EAAE,EAC1E,KAAK,EACL,SAAS,EACT,QAAQ,EACR,UAAU,GACX,EAAE,uBAAuB,CAAC,UAAU,CAAC,GAAG,OAAO,CAC9C,UAAU,SAAS,IAAI,GAEf;IAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACxC,UAAU,CACf,CA6CA"}

package/dist/lib/auth/oidc.js

@@ -17,11 +17,14 @@ export async function verifyAccessToken({ token, issuerUrl, audience, safeVerify
         if (!jwksUri) {
             throw new Error("JWKS URI not found in issuer metadata");
         }
+        console.debug("Discovered JWKS URI:", jwksUri);
         const JWKS = createRemoteJWKSet(new URL(jwksUri));
+        console.debug("Discovered JWKS URI 1");
         // Verify the signature and basic claims
         const { payload } = await jwtVerify(token, JWKS, {
             issuer: issuer.metadata.issuer,
         });
+        console.debug("Discovered JWKS URI 2");
         const tokenAud = payload.aud ?? payload.client_id;
         let audienceMatches = false;
         for (const aud of Array.isArray(tokenAud) ? tokenAud : [tokenAud]) {

package/dist/lib/proxy/fetch.d.ts

@@ -0,0 +1,4 @@
+import { fetch as undiciFetch } from "undici";
+export declare function setupProxyGlobally(): void;
+export declare function getProxiedFetch(): typeof undiciFetch;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/lib/proxy/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../../src/lib/proxy/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,IAAI,WAAW,EACrB,MAAM,QAAQ,CAAC;AAEhB,wBAAgB,kBAAkB,SAKjC;AAED,wBAAgB,eAAe,uBAW9B"}

package/dist/lib/proxy/fetch.js

@@ -0,0 +1,17 @@
+import { setGlobalDispatcher, EnvHttpProxyAgent, fetch as undiciFetch, } from "undici";
+export function setupProxyGlobally() {
+    // See https://nodejs.org/api/globals.html#custom-dispatcher
+    // This might stop being needed at some point: https://github.com/actions/create-github-app-token/pull/143#discussion_r1747641337
+    const envHttpProxyAgent = new EnvHttpProxyAgent();
+    setGlobalDispatcher(envHttpProxyAgent);
+}
+export function getProxiedFetch() {
+    const fetch = (input, init = {}) => {
+        if (init.dispatcher) {
+            console.warn("A custom dispatcher was provided to fetch but this is ignored as a proxy agent is being used.");
+        }
+        const envHttpProxyAgent = new EnvHttpProxyAgent();
+        return undiciFetch(input, { ...init, dispatcher: envHttpProxyAgent });
+    };
+    return fetch;
+}

package/dist/lib/proxy/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./fetch.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/proxy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/proxy/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/dist/lib/proxy/index.js

@@ -0,0 +1 @@
+export * from "./fetch.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infoxchange/make-it-so",
-  "version": "2.11.0",
+  "version": "2.12.0-internal-testing-odic-verify-proxy-fix.1",
   "description": "Makes deploying services to IX infra easy",
   "repository": "github:infoxchange/make-it-so",
   "type": "module",
@@ -17,7 +17,8 @@
   "exports": {
     "./cdk-constructs": "./dist/cdk-constructs/index.js",
     "./deployConfig": "./dist/deployConfig.js",
-    "./auth": "./dist/lib/auth/index.js"
+    "./auth": "./dist/lib/auth/index.js",
+    "./proxy": "./dist/lib/proxy/index.js"
   },
   "lint-staged": {
     "**/*": [
@@ -54,6 +55,7 @@
   },
   "dependencies": {
     "jsonwebtoken": "^9.0.2",
+    "undici": "^7.16.0",
     "zod": "^3.24.2"
   }
 }

package/src/lib/auth/oidc.ts

@@ -36,13 +36,17 @@ export async function verifyAccessToken<SafeVerify extends boolean = false>({
     if (!jwksUri) {
       throw new Error("JWKS URI not found in issuer metadata");
     }
+    console.debug("Discovered JWKS URI:", jwksUri);
     const JWKS = createRemoteJWKSet(new URL(jwksUri));
+    console.debug("Discovered JWKS URI 1");
 
     // Verify the signature and basic claims
     const { payload } = await jwtVerify(token, JWKS, {
       issuer: issuer.metadata.issuer,
     });
 
+    console.debug("Discovered JWKS URI 2");
+
     const tokenAud = payload.aud ?? payload.client_id;
     let audienceMatches = false;
     for (const aud of Array.isArray(tokenAud) ? tokenAud : [tokenAud]) {

package/src/lib/proxy/fetch.ts

@@ -0,0 +1,25 @@
+import {
+  setGlobalDispatcher,
+  EnvHttpProxyAgent,
+  fetch as undiciFetch,
+} from "undici";
+
+export function setupProxyGlobally() {
+  // See https://nodejs.org/api/globals.html#custom-dispatcher
+  // This might stop being needed at some point: https://github.com/actions/create-github-app-token/pull/143#discussion_r1747641337
+  const envHttpProxyAgent = new EnvHttpProxyAgent();
+  setGlobalDispatcher(envHttpProxyAgent);
+}
+
+export function getProxiedFetch() {
+  const fetch: typeof undiciFetch = (input, init = {}) => {
+    if (init.dispatcher) {
+      console.warn(
+        "A custom dispatcher was provided to fetch but this is ignored as a proxy agent is being used.",
+      );
+    }
+    const envHttpProxyAgent = new EnvHttpProxyAgent();
+    return undiciFetch(input, { ...init, dispatcher: envHttpProxyAgent });
+  };
+  return fetch;
+}

package/src/lib/proxy/index.ts

@@ -0,0 +1 @@
+export * from "./fetch.js";