@intentius/chant 0.8.0 → 0.8.1

package/dist/audit/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/audit/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AASD,KAAK,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;CACvB;AAQD,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC,UAAU,UAAU;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAqBpD;AAmHD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA6B5H;AAID;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB7B;AAeD,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAsB/D;AAkBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1D,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA+B7B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB7B"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/audit/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AASD,KAAK,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;CACvB;AAQD,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC,UAAU,UAAU;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAqBpD;AAuKD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA6B5H;AAID;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB7B;AAeD,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAsB/D;AAkBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1D,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA+B7B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/fetch.test.ts

@@ -35,6 +35,13 @@ function gitTreeMock(files: Record<string, string>, sizes: Record<string, number
       const tree = Object.keys(files).map((path) => ({ path, type: "blob", size: sizes[path] ?? files[path].length }));
       return new Response(JSON.stringify({ tree }), { status: 200 });
     }
+    // GitHub content comes from the raw CDN first (plain text, no base64).
+    const rawm = u.match(/raw\.githubusercontent\.com\/[^/]+\/[^/]+\/[^/]+\/(.+)$/);
+    if (rawm) {
+      const path = decodeURIComponent(rawm[1]);
+      if (files[path] === undefined) return new Response("not found", { status: 404 });
+      return new Response(files[path], { status: 200 });
+    }
     const cm = u.match(/\/contents\/(.+?)\?/);
     if (cm) {
       const path = decodeURIComponent(cm[1]);
@@ -99,6 +106,49 @@ describe("fetchRepoFiles", () => {
     expect(auth).toContain("Bearer secret");
   });
 
+  test("always sends a User-Agent, even without a token (GitHub 403s otherwise)", async () => {
+    const { impl, calls } = gitTreeMock({ ".github/workflows/ci.yml": CI_YAML });
+    await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl });
+    const uas = calls.map((c) => (c.init?.headers as Record<string, string>)?.["User-Agent"]);
+    expect(uas.every((ua) => typeof ua === "string" && ua.length > 0)).toBe(true);
+  });
+
+  test("github: reads content from the raw CDN (no contents-API burst)", async () => {
+    const { impl, calls } = gitTreeMock({ ".github/workflows/ci.yml": CI_YAML });
+    const files = await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl });
+    expect(files[0].content).toContain("permissions: write-all");
+    // Content came from raw.githubusercontent.com — the contents API was not hit.
+    expect(calls.some((c) => c.url.includes("raw.githubusercontent.com"))).toBe(true);
+    expect(calls.some((c) => c.url.includes("/contents/"))).toBe(false);
+  });
+
+  test("does not send the auth token cross-host to the raw CDN", async () => {
+    const { impl, calls } = gitTreeMock({ ".github/workflows/ci.yml": CI_YAML });
+    await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl, token: "secret" });
+    const rawCall = calls.find((c) => c.url.includes("raw.githubusercontent.com"));
+    expect((rawCall?.init?.headers as Record<string, string>)?.Authorization).toBeUndefined();
+  });
+
+  test("encodes path segments with spaces (would 403 unencoded)", async () => {
+    const spaced = ".changes/v1.16/NEW FEATURES.yaml";
+    const { impl, calls } = gitTreeMock({ [spaced]: "kind: Changelog\n" });
+    const files = await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl });
+    expect(files.map((f) => f.path)).toContain(spaced);
+    expect(calls.some((c) => c.url.includes("NEW%20FEATURES.yaml"))).toBe(true);
+  });
+
+  test("a single file's failure does not abort the whole walk", async () => {
+    // raw 404s for the bad path → contents API also 404s → that file is skipped,
+    // not fatal; the good file still comes back.
+    const { impl } = gitTreeMock({ ".github/workflows/ci.yml": CI_YAML, "k8s/deploy.yaml": "kind: Deployment\n" });
+    const broken = (async (url: string | URL | Request, init?: RequestInit) => {
+      if (String(url).includes("deploy.yaml")) return new Response("forbidden", { status: 403 });
+      return impl(url, init);
+    }) as unknown as typeof fetch;
+    const files = await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: broken });
+    expect(files.map((f) => f.path)).toEqual([".github/workflows/ci.yml"]);
+  });
+
   test("skips a file over the per-file size cap (reported by the tree)", async () => {
     const { impl } = gitTreeMock({ ".github/workflows/ci.yml": CI_YAML }, { ".github/workflows/ci.yml": 10_000_000 });
     const files = await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl, maxBytesPerFile: 1024 });

package/src/audit/fetch.ts

@@ -80,11 +80,16 @@ export function parseRepoUrl(url: string): ParsedRepo {
   return { host, owner: parts[0], repo: parts[1].replace(/\.git$/, "") };
 }
 
+/** GitHub (and good manners) require a User-Agent — workerd's fetch sends none,
+ * so a missing UA 403s every request. Always set one, with or without a token. */
+const USER_AGENT = "chant-audit (+https://github.com/intentius/chant)";
+
 function authHeaders(kind: HostKind, token?: string): Record<string, string> {
-  if (!token) return {};
-  if (kind === "github") return { Authorization: `Bearer ${token}` };
-  if (kind === "forgejo") return { Authorization: `token ${token}` };
-  return { "PRIVATE-TOKEN": token };
+  const base = { "User-Agent": USER_AGENT };
+  if (!token) return base;
+  if (kind === "github") return { ...base, Authorization: `Bearer ${token}` };
+  if (kind === "forgejo") return { ...base, Authorization: `token ${token}` };
+  return { ...base, "PRIVATE-TOKEN": token };
 }
 
 function timeoutSignal(ms: number): AbortSignal | undefined {
@@ -173,22 +178,69 @@ async function listTree(host: HostConfig, owner: string, repo: string, ref: stri
   return tree.filter((e) => e.type === "blob").map((e) => ({ path: e.path, type: "blob", size: e.size }));
 }
 
-/** Fetch one file's content per host (base64 contents API, or GitLab raw). */
+/**
+ * Resilient GET → text. Returns undefined on any error or non-ok status, so one
+ * file's failure (a bad path, a 403 secondary rate-limit, a timeout) never
+ * aborts the whole walk. `redirect: "manual"` keeps the SSRF posture — a 3xx is
+ * skipped, never followed.
+ */
+async function fetchText(url: string, headers: Record<string, string>, doFetch: typeof fetch, ms: number): Promise<string | undefined> {
+  let res: Response;
+  try {
+    res = await doFetch(url, { headers, redirect: "manual", signal: timeoutSignal(ms) });
+  } catch {
+    return undefined;
+  }
+  if (!res.ok) return undefined;
+  try {
+    return await res.text();
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Fetch one file's content. GitHub reads from the raw CDN first — a burst of
+ * contents-API calls trips GitHub's *secondary* rate limit on large repos
+ * (dozens of files), whereas raw.githubusercontent.com isn't subject to it and
+ * needs no auth for public repos. The contents API is the fallback for private
+ * repos (raw 404s there without auth). GitLab uses its raw endpoint; Forgejo
+ * uses the contents API.
+ */
 async function fetchFileContent(host: HostConfig, owner: string, repo: string, path: string, ref: string, doFetch: typeof fetch, headers: Record<string, string>, ms: number): Promise<string | undefined> {
+  // Encode each segment (keep the slashes) — paths can contain spaces and other
+  // characters that make an unencoded URL malformed and 403 (e.g. GitHub's
+  // changelog fragments like ".changes/v1.16/NEW FEATURES-….yaml").
+  const encodedPath = path.split("/").map(encodeURIComponent).join("/");
+
   if (host.kind === "gitlab") {
     const url = `${host.api}/projects/${projectId(owner, repo)}/repository/files/${encodeURIComponent(path)}/raw?ref=${encodeURIComponent(ref)}`;
-    let res: Response;
-    try {
-      res = await doFetch(url, { headers, redirect: "manual", signal: timeoutSignal(ms) });
-    } catch {
-      return undefined;
-    }
-    if (!res.ok) return undefined;
-    return await res.text();
+    return fetchText(url, headers, doFetch, ms);
+  }
+
+  if (host.kind === "github") {
+    // No token sent cross-host to the CDN; public repos need none.
+    const rawUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${encodeURIComponent(ref)}/${encodedPath}`;
+    const raw = await fetchText(rawUrl, { "User-Agent": USER_AGENT }, doFetch, ms);
+    if (raw !== undefined) return raw;
+    // Private repo (raw 404s without auth) — fall through to the contents API.
+  }
+
+  // Contents API: base64 JSON. Forgejo always; GitHub private-repo fallback.
+  const url = `${host.api}/repos/${owner}/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(ref)}`;
+  let res: Response;
+  try {
+    res = await doFetch(url, { headers, redirect: "manual", signal: timeoutSignal(ms) });
+  } catch {
+    return undefined;
+  }
+  if (!res.ok) return undefined;
+  let file: ContentsEntry | null;
+  try {
+    file = (await res.json()) as ContentsEntry | null;
+  } catch {
+    return undefined;
   }
-  const url = `${host.api}/repos/${owner}/${repo}/contents/${path}?ref=${encodeURIComponent(ref)}`;
-  const { body } = await getJsonAt(url, headers, doFetch, ms);
-  const file = body as ContentsEntry | null;
   if (!file?.content) return undefined;
   return Buffer.from(file.content, (file.encoding as BufferEncoding) ?? "base64").toString("utf-8");
 }
@@ -251,6 +303,7 @@ export async function resolveActionSha(
     const res = await doFetch(url, {
       headers: {
         Accept: "application/vnd.github+json",
+        "User-Agent": USER_AGENT,
         ...(opts.token ? { Authorization: `Bearer ${opts.token}` } : {}),
       },
       redirect: "manual",
@@ -347,16 +400,16 @@ export async function resolveImageDigest(
   const manifestUrl = `https://${parsed.registry}/v2/${parsed.repository}/manifests/${encodeURIComponent(parsed.tag)}`;
 
   try {
-    let res = await doFetch(manifestUrl, { headers: { Accept: accept }, redirect: "manual", signal: timeoutSignal(ms) });
+    let res = await doFetch(manifestUrl, { headers: { Accept: accept, "User-Agent": USER_AGENT }, redirect: "manual", signal: timeoutSignal(ms) });
     if (res.status === 401) {
       const tokenUrl = tokenUrlFromChallenge(res.headers.get("www-authenticate") ?? "");
       if (!tokenUrl) return undefined;
-      const tokRes = await doFetch(tokenUrl, { redirect: "manual", signal: timeoutSignal(ms) });
+      const tokRes = await doFetch(tokenUrl, { headers: { "User-Agent": USER_AGENT }, redirect: "manual", signal: timeoutSignal(ms) });
       if (!tokRes.ok) return undefined;
       const tok = (await tokRes.json()) as { token?: string; access_token?: string };
       const bearer = tok.token ?? tok.access_token;
       if (!bearer) return undefined;
-      res = await doFetch(manifestUrl, { headers: { Accept: accept, Authorization: `Bearer ${bearer}` }, redirect: "manual", signal: timeoutSignal(ms) });
+      res = await doFetch(manifestUrl, { headers: { Accept: accept, "User-Agent": USER_AGENT, Authorization: `Bearer ${bearer}` }, redirect: "manual", signal: timeoutSignal(ms) });
     }
     if (!res.ok) return undefined;
     const digest = res.headers.get("docker-content-digest");