@infoxchange/make-it-so 2.11.0 → 2.12.0-internal-testing-odic-verify-proxy-fix.2

package/dist/lib/auth/oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/oidc.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,UAAU,EAAa,MAAM,MAAM,CAAC;AAEjE,KAAK,uBAAuB,CAAC,UAAU,SAAS,OAAO,GAAG,KAAK,IAAI;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,SAAS,OAAO,GAAG,KAAK,EAAE,EAC1E,KAAK,EACL,SAAS,EACT,QAAQ,EACR,UAAU,GACX,EAAE,uBAAuB,CAAC,UAAU,CAAC,GAAG,OAAO,CAC9C,UAAU,SAAS,IAAI,GAEf;IAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACxC,UAAU,CACf,CAyCA"}
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/oidc.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,UAAU,EAAa,MAAM,MAAM,CAAC;AAEjE,KAAK,uBAAuB,CAAC,UAAU,SAAS,OAAO,GAAG,KAAK,IAAI;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,SAAS,OAAO,GAAG,KAAK,EAAE,EAC1E,KAAK,EACL,SAAS,EACT,QAAQ,EACR,UAAU,GACX,EAAE,uBAAuB,CAAC,UAAU,CAAC,GAAG,OAAO,CAC9C,UAAU,SAAS,IAAI,GAEf;IAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACxC,UAAU,CACf,CA+CA"}

package/dist/lib/auth/oidc.js

@@ -12,16 +12,21 @@ import { createRemoteJWKSet, jwtVerify } from "jose";
  */
 export async function verifyAccessToken({ token, issuerUrl, audience, safeVerify, }) {
     try {
+        console.debug("Discovered JWKS URI aa:", issuerUrl);
         const issuer = await Issuer.discover(issuerUrl);
+        console.debug("Discovered JWKS URI aa 2");
         const jwksUri = issuer.metadata.jwks_uri;
         if (!jwksUri) {
             throw new Error("JWKS URI not found in issuer metadata");
         }
+        console.debug("Discovered JWKS URI:", jwksUri);
         const JWKS = createRemoteJWKSet(new URL(jwksUri));
+        console.debug("Discovered JWKS URI 1");
         // Verify the signature and basic claims
         const { payload } = await jwtVerify(token, JWKS, {
             issuer: issuer.metadata.issuer,
         });
+        console.debug("Discovered JWKS URI 2");
         const tokenAud = payload.aud ?? payload.client_id;
         let audienceMatches = false;
         for (const aud of Array.isArray(tokenAud) ? tokenAud : [tokenAud]) {

package/dist/lib/proxy/fetch.d.ts

@@ -0,0 +1,4 @@
+import { fetch as undiciFetch } from "undici";
+export declare function setupProxyGlobally(): void;
+export declare function getProxiedFetch(): typeof undiciFetch;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/lib/proxy/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../../src/lib/proxy/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,IAAI,WAAW,EACrB,MAAM,QAAQ,CAAC;AAGhB,wBAAgB,kBAAkB,SAcjC;AAED,wBAAgB,eAAe,uBAY9B"}

package/dist/lib/proxy/fetch.js

@@ -0,0 +1,27 @@
+import { setGlobalDispatcher, EnvHttpProxyAgent, fetch as undiciFetch, } from "undici";
+import { bootstrap } from "global-agent";
+export function setupProxyGlobally() {
+    // To cover libraries that use fetch
+    // See https://nodejs.org/api/globals.html#custom-dispatcher
+    // This might stop being needed at some point: https://github.com/actions/create-github-app-token/pull/143#discussion_r1747641337
+    const envHttpProxyAgent = new EnvHttpProxyAgent();
+    setGlobalDispatcher(envHttpProxyAgent);
+    // To cover libraries that use the http/https object
+    if (!process.env.GLOBAL_AGENT_HTTP_PROXY) {
+        process.env.GLOBAL_AGENT_HTTP_PROXY = process.env.HTTP_PROXY;
+        process.env.GLOBAL_AGENT_HTTPS_PROXY =
+            process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY;
+    }
+    bootstrap();
+}
+export function getProxiedFetch() {
+    const fetch = (input, init = {}) => {
+        console.log("Using proxied fetch for request to:", input);
+        if (init.dispatcher) {
+            console.warn("A custom dispatcher was provided to fetch but this is ignored as a proxy agent is being used.");
+        }
+        const envHttpProxyAgent = new EnvHttpProxyAgent();
+        return undiciFetch(input, { ...init, dispatcher: envHttpProxyAgent });
+    };
+    return fetch;
+}

package/dist/lib/proxy/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./fetch.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/proxy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/proxy/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/dist/lib/proxy/index.js

@@ -0,0 +1 @@
+export * from "./fetch.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infoxchange/make-it-so",
-  "version": "2.11.0",
+  "version": "2.12.0-internal-testing-odic-verify-proxy-fix.2",
   "description": "Makes deploying services to IX infra easy",
   "repository": "github:infoxchange/make-it-so",
   "type": "module",
@@ -17,7 +17,8 @@
   "exports": {
     "./cdk-constructs": "./dist/cdk-constructs/index.js",
     "./deployConfig": "./dist/deployConfig.js",
-    "./auth": "./dist/lib/auth/index.js"
+    "./auth": "./dist/lib/auth/index.js",
+    "./proxy": "./dist/lib/proxy/index.js"
   },
   "lint-staged": {
     "**/*": [
@@ -32,6 +33,7 @@
     "@eslint/js": "^9.3.0",
     "@tsconfig/node21": "^21.0.3",
     "@types/aws-cloudfront-function": "^1.0.6",
+    "@types/global-agent": "^3.0.0",
     "@types/jsonwebtoken": "^9.0.10",
     "aws-cdk-lib": "2.142.1",
     "constructs": "^10.3.0",
@@ -53,7 +55,9 @@
     "sst": "^2.0.0"
   },
   "dependencies": {
+    "global-agent": "^3.0.0",
     "jsonwebtoken": "^9.0.2",
+    "undici": "^7.16.0",
     "zod": "^3.24.2"
   }
 }

package/src/lib/auth/oidc.ts

@@ -31,18 +31,24 @@ export async function verifyAccessToken<SafeVerify extends boolean = false>({
     : JWTPayload
 > {
   try {
+    console.debug("Discovered JWKS URI aa:", issuerUrl);
     const issuer = await Issuer.discover(issuerUrl);
+    console.debug("Discovered JWKS URI aa 2");
     const jwksUri = issuer.metadata.jwks_uri;
     if (!jwksUri) {
       throw new Error("JWKS URI not found in issuer metadata");
     }
+    console.debug("Discovered JWKS URI:", jwksUri);
     const JWKS = createRemoteJWKSet(new URL(jwksUri));
+    console.debug("Discovered JWKS URI 1");
 
     // Verify the signature and basic claims
     const { payload } = await jwtVerify(token, JWKS, {
       issuer: issuer.metadata.issuer,
     });
 
+    console.debug("Discovered JWKS URI 2");
+
     const tokenAud = payload.aud ?? payload.client_id;
     let audienceMatches = false;
     for (const aud of Array.isArray(tokenAud) ? tokenAud : [tokenAud]) {

package/src/lib/proxy/fetch.ts

@@ -0,0 +1,36 @@
+import {
+  setGlobalDispatcher,
+  EnvHttpProxyAgent,
+  fetch as undiciFetch,
+} from "undici";
+import { bootstrap } from "global-agent";
+
+export function setupProxyGlobally() {
+  // To cover libraries that use fetch
+  // See https://nodejs.org/api/globals.html#custom-dispatcher
+  // This might stop being needed at some point: https://github.com/actions/create-github-app-token/pull/143#discussion_r1747641337
+  const envHttpProxyAgent = new EnvHttpProxyAgent();
+  setGlobalDispatcher(envHttpProxyAgent);
+
+  // To cover libraries that use the http/https object
+  if (!process.env.GLOBAL_AGENT_HTTP_PROXY) {
+    process.env.GLOBAL_AGENT_HTTP_PROXY = process.env.HTTP_PROXY;
+    process.env.GLOBAL_AGENT_HTTPS_PROXY =
+      process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY;
+  }
+  bootstrap();
+}
+
+export function getProxiedFetch() {
+  const fetch: typeof undiciFetch = (input, init = {}) => {
+    console.log("Using proxied fetch for request to:", input);
+    if (init.dispatcher) {
+      console.warn(
+        "A custom dispatcher was provided to fetch but this is ignored as a proxy agent is being used.",
+      );
+    }
+    const envHttpProxyAgent = new EnvHttpProxyAgent();
+    return undiciFetch(input, { ...init, dispatcher: envHttpProxyAgent });
+  };
+  return fetch;
+}

package/src/lib/proxy/index.ts

@@ -0,0 +1 @@
+export * from "./fetch.js";