@loadstrike/loadstrike-sdk 1.0.30201 → 1.0.30401

package/dist/cjs/transports.js

@@ -638,9 +638,13 @@ class WebSocketEndpointDefinitionModel extends TrafficEndpointDefinitionModel {
             parsed = new URL(url);
         }
         catch {
+            // Diagnostic text only; no connection is opened here.
+            // nosemgrep: vulnerability-tools.semgrep-rules.javascript.lang.security.detect-insecure-websocket
             throw new Error("Url must be an absolute ws:// or wss:// URI.");
         }
         if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
+            // Diagnostic text only; no connection is opened here.
+            // nosemgrep: vulnerability-tools.semgrep-rules.javascript.lang.security.detect-insecure-websocket
             throw new Error("Url must be an absolute ws:// or wss:// URI.");
         }
         if (this.ConnectTimeoutSeconds <= 0) {
@@ -1275,11 +1279,13 @@ function validateHttpAuthOptionsModel(target) {
 }
 function validateKafkaSaslOptionsModel(target) {
     switch (normalizeToken(target.Mechanism)) {
-        case "oauthbearer":
-            if (!String(target.OAuthBearerTokenEndpointUrl ?? "").trim()) {
-                throw new Error("OAuthBearerTokenEndpointUrl must be provided when SASL mechanism is OAuthBearer.");
-            }
+        case "oauthbearer": {
+            const additionalSettings = target.AdditionalSettings;
+            validateKafkaOAuthBearerCredentials(String(target.AccessToken ?? "").trim() || String(target.OAuthBearerToken ?? "").trim(), String(target.OAuthBearerTokenEndpointUrl ?? "").trim()
+                || String(target.TokenEndpoint ?? "").trim()
+                || optionString(additionalSettings, "TokenEndpoint", "tokenEndpoint"), optionString(additionalSettings, "ClientId", "clientId"), optionString(additionalSettings, "ClientSecret", "clientSecret"));
             return;
+        }
         default:
             if (!String(target.Username ?? "").trim()) {
                 throw new Error("Username must be provided for SASL authentication.");
@@ -1828,21 +1834,12 @@ class KafkaEndpointAdapter extends CallbackAdapter {
         if (!this.consumerStartPromise) {
             this.consumerStartPromise = (async () => {
                 const options = this.endpoint.kafka ?? {};
-                const useConfluentClient = shouldUseConfluentKafkaClient(this.endpoint);
                 const kafka = await createKafkaClient(this.endpoint);
                 const consumer = kafka.consumer(buildKafkaConsumerOptions(this.endpoint));
                 await consumer.connect();
-                if (useConfluentClient) {
-                    await consumer.subscribe({
-                        topics: [optionString(options, "Topic", "topic")]
-                    });
-                }
-                else {
-                    await consumer.subscribe({
-                        topic: optionString(options, "Topic", "topic"),
-                        fromBeginning: optionBoolean(options, true, "StartFromEarliest", "startFromEarliest")
-                    });
-                }
+                await consumer.subscribe({
+                    topics: [optionString(options, "Topic", "topic")]
+                });
                 await consumer.run({
                     eachMessage: async ({ message }) => {
                         this.queue.push(createBrokerPayload(fromKafkaHeaders(message.headers), bufferToUint8Array(message.value), this.endpoint, headerValue(message.headers, "content-type")));
@@ -3178,9 +3175,13 @@ function validateWebSocketEndpoint(endpoint, mode) {
         parsed = new URL(url);
     }
     catch {
+        // Diagnostic text only; no connection is opened here.
+        // nosemgrep: vulnerability-tools.semgrep-rules.javascript.lang.security.detect-insecure-websocket
         throw new Error("Url must be an absolute ws:// or wss:// URI.");
     }
     if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
+        // Diagnostic text only; no connection is opened here.
+        // nosemgrep: vulnerability-tools.semgrep-rules.javascript.lang.security.detect-insecure-websocket
         throw new Error("Url must be an absolute ws:// or wss:// URI.");
     }
     const connectMs = optionNumber(options, "ConnectTimeoutMs", "connectTimeoutMs");
@@ -3256,7 +3257,8 @@ function validateKafkaEndpoint(endpoint, mode, hasModeDelegate) {
 function validateKafkaSaslOptions(options) {
     const mechanism = optionString(options, "Mechanism", "mechanism") || "Plain";
     if (mechanism.toLowerCase() === "oauthbearer") {
-        requireNonEmptyString(optionString(options, "OAuthBearerTokenEndpointUrl", "oauthBearerTokenEndpointUrl", "TokenEndpoint", "tokenEndpoint") || optionString(asRecordOrEmpty(pickProtocolValue(options, "AdditionalSettings", "additionalSettings")), "TokenEndpoint", "tokenEndpoint"), "OAuthBearerTokenEndpointUrl must be provided when SASL mechanism is OAuthBearer.");
+        const additionalSettings = asRecordOrEmpty(pickProtocolValue(options, "AdditionalSettings", "additionalSettings"));
+        validateKafkaOAuthBearerCredentials(optionString(options, "AccessToken", "accessToken", "OAuthBearerToken", "oauthBearerToken"), optionString(options, "OAuthBearerTokenEndpointUrl", "oauthBearerTokenEndpointUrl", "TokenEndpoint", "tokenEndpoint") || optionString(additionalSettings, "TokenEndpoint", "tokenEndpoint"), optionString(additionalSettings, "ClientId", "clientId"), optionString(additionalSettings, "ClientSecret", "clientSecret"));
         return;
     }
     requireNonEmptyString(optionString(options, "Username", "username"), "Username must be provided for SASL authentication.");
@@ -4249,74 +4251,31 @@ function pickProtocolValue(options, ...keys) {
     }
     return undefined;
 }
-function buildKafkaClientOptions(endpoint) {
-    const options = endpoint.kafka ?? {};
-    const securityProtocol = (optionString(options, "SecurityProtocol", "securityProtocol") || "Plaintext").toLowerCase();
-    const bootstrapServers = optionString(options, "BootstrapServers", "bootstrapServers")
-        .split(",")
-        .map((value) => value.trim())
-        .filter((value) => value.length > 0);
-    const clientOptions = {
-        clientId: `${endpoint.name}-${(0, node_crypto_1.randomUUID)().slice(0, 8)}`,
-        brokers: bootstrapServers,
-        ssl: securityProtocol === "ssl" || securityProtocol === "saslssl"
-    };
-    if (securityProtocol === "saslplaintext" || securityProtocol === "saslssl") {
-        const saslOptions = asRecordOrEmpty(pickProtocolValue(options, "Sasl", "sasl"));
-        const mechanism = (optionString(saslOptions, "Mechanism", "mechanism") || "Plain").toLowerCase();
-        if (mechanism === "oauthbearer") {
-            clientOptions.sasl = {
-                mechanism: "oauthbearer",
-                oauthBearerProvider: async () => ({
-                    value: await resolveKafkaOAuthBearerToken(saslOptions)
-                })
-            };
-        }
-        else {
-            clientOptions.sasl = {
-                mechanism: mapKafkaSaslMechanism(mechanism),
-                username: optionString(saslOptions, "Username", "username"),
-                password: optionString(saslOptions, "Password", "password")
-            };
-        }
+let kafkaClientFactoryForTests = null;
+async function createKafkaClient(endpoint) {
+    if (kafkaClientFactoryForTests) {
+        return await kafkaClientFactoryForTests(endpoint);
     }
-    return clientOptions;
+    const { KafkaJS } = await Promise.resolve().then(() => __importStar(require("@confluentinc/kafka-javascript")));
+    return new KafkaJS.Kafka(buildConfluentKafkaClientOptions(endpoint));
 }
-async function createKafkaClient(endpoint) {
-    if (shouldUseConfluentKafkaClient(endpoint)) {
-        const { KafkaJS } = await Promise.resolve().then(() => __importStar(require("@confluentinc/kafka-javascript")));
-        return new KafkaJS.Kafka(buildConfluentKafkaClientOptions(endpoint));
+function validateKafkaOAuthBearerCredentials(directToken, tokenEndpoint, clientId, clientSecret) {
+    if (directToken.trim()) {
+        return;
+    }
+    if (!tokenEndpoint.trim() || !clientId.trim() || !clientSecret.trim()) {
+        throw new Error("Kafka OAuthBearer requires a direct access token or token endpoint with client credentials.");
     }
-    const { Kafka } = await Promise.resolve().then(() => __importStar(require("kafkajs")));
-    return new Kafka(buildKafkaClientOptions(endpoint));
 }
 function buildKafkaConsumerOptions(endpoint) {
     const options = endpoint.kafka ?? {};
     const groupId = optionString(options, "ConsumerGroupId", "consumerGroupId");
     const fromBeginning = optionBoolean(options, true, "StartFromEarliest", "startFromEarliest");
-    if (shouldUseConfluentKafkaClient(endpoint)) {
-        return {
-            "group.id": groupId,
-            "auto.offset.reset": fromBeginning ? "earliest" : "latest",
-            "enable.auto.commit": true
-        };
-    }
-    return { groupId };
-}
-function shouldUseConfluentKafkaClient(endpoint) {
-    const options = endpoint.kafka ?? {};
-    const securityProtocol = (optionString(options, "SecurityProtocol", "securityProtocol") || "Plaintext").toLowerCase();
-    if (securityProtocol !== "saslplaintext" && securityProtocol !== "saslssl") {
-        return Object.keys(toStringRecord(pickProtocolValue(options, "ConfluentSettings", "confluentSettings"))).length > 0;
-    }
-    const saslOptions = asRecordOrEmpty(pickProtocolValue(options, "Sasl", "sasl"));
-    const mechanism = (optionString(saslOptions, "Mechanism", "mechanism") || "Plain").toLowerCase();
-    const confluentSettings = toStringRecord(pickProtocolValue(options, "ConfluentSettings", "confluentSettings"));
-    const additionalSettings = toStringRecord(pickProtocolValue(saslOptions, "AdditionalSettings", "additionalSettings"));
-    const hasDirectOAuthToken = mechanism === "oauthbearer" && Boolean(optionString(saslOptions, "AccessToken", "accessToken", "OAuthBearerToken", "oauthBearerToken"));
-    return mechanism === "gssapi"
-        || Object.keys(confluentSettings).length > 0
-        || (Object.keys(additionalSettings).length > 0 && !hasDirectOAuthToken);
+    return {
+        "group.id": groupId,
+        "auto.offset.reset": fromBeginning ? "earliest" : "latest",
+        "enable.auto.commit": true
+    };
 }
 function buildConfluentKafkaClientOptions(endpoint) {
     const options = endpoint.kafka ?? {};
@@ -4332,30 +4291,41 @@ function buildConfluentKafkaClientOptions(endpoint) {
         const additionalSettings = toStringRecord(pickProtocolValue(saslOptions, "AdditionalSettings", "additionalSettings"));
         base["sasl.mechanism"] = mapConfluentKafkaSaslMechanism(mechanism);
         if (mechanism.toLowerCase() === "oauthbearer") {
+            const directToken = optionString(saslOptions, "AccessToken", "accessToken", "OAuthBearerToken", "oauthBearerToken");
             const tokenEndpoint = optionString(saslOptions, "OAuthBearerTokenEndpointUrl", "oauthBearerTokenEndpointUrl", "TokenEndpoint", "tokenEndpoint") || optionString(additionalSettings, "TokenEndpoint", "tokenEndpoint");
-            if (tokenEndpoint) {
-                base["sasl.oauthbearer.method"] = "oidc";
-                base["sasl.oauthbearer.token.endpoint.url"] = tokenEndpoint;
-            }
             const clientId = optionString(additionalSettings, "ClientId", "clientId");
-            if (clientId) {
-                base["sasl.oauthbearer.client.id"] = clientId;
-            }
             const clientSecret = optionString(additionalSettings, "ClientSecret", "clientSecret");
-            if (clientSecret) {
-                base["sasl.oauthbearer.client.secret"] = clientSecret;
-            }
             const scope = optionString(additionalSettings, "Scope", "scope");
-            if (scope) {
-                base["sasl.oauthbearer.scope"] = scope;
-            }
             const grantType = optionString(additionalSettings, "GrantType", "grantType");
-            if (grantType) {
-                base["sasl.oauthbearer.grant.type"] = grantType;
-            }
             const extensions = optionString(additionalSettings, "Extensions", "extensions");
-            if (extensions) {
-                base["sasl.oauthbearer.extensions"] = extensions;
+            if (directToken) {
+                const principal = optionString(additionalSettings, "Principal", "principal")
+                    || optionString(saslOptions, "Username", "username")
+                    || "loadstrike";
+                base.oauthbearer_token_refresh_cb = async () => ({
+                    tokenValue: directToken,
+                    lifetime: Date.now() + 60 * 60 * 1000,
+                    principal,
+                    extensions: parseKafkaOAuthExtensions(extensions)
+                });
+            }
+            else {
+                if (!tokenEndpoint || !clientId || !clientSecret) {
+                    throw new Error("Kafka OAuthBearer requires a direct access token or token endpoint with client credentials.");
+                }
+                base["sasl.oauthbearer.method"] = "oidc";
+                base["sasl.oauthbearer.token.endpoint.url"] = tokenEndpoint;
+                base["sasl.oauthbearer.client.id"] = clientId;
+                base["sasl.oauthbearer.client.secret"] = clientSecret;
+                if (scope) {
+                    base["sasl.oauthbearer.scope"] = scope;
+                }
+                if (grantType) {
+                    base["sasl.oauthbearer.grant.type"] = grantType;
+                }
+                if (extensions) {
+                    base["sasl.oauthbearer.extensions"] = extensions;
+                }
             }
         }
         else {
@@ -4374,7 +4344,9 @@ function buildConfluentKafkaClientOptions(endpoint) {
                 || key === "Extensions"
                 || key === "extensions"
                 || key === "TokenEndpoint"
-                || key === "tokenEndpoint") {
+                || key === "tokenEndpoint"
+                || key === "Principal"
+                || key === "principal") {
                 continue;
             }
             base[key] = value;
@@ -4385,53 +4357,20 @@ function buildConfluentKafkaClientOptions(endpoint) {
     }
     return base;
 }
-async function resolveKafkaOAuthBearerToken(options) {
-    const directToken = optionString(options, "AccessToken", "accessToken", "OAuthBearerToken", "oauthBearerToken");
-    if (directToken) {
-        return directToken;
-    }
-    const additional = asRecordOrEmpty(pickProtocolValue(options, "AdditionalSettings", "additionalSettings"));
-    const tokenEndpoint = optionString(options, "OAuthBearerTokenEndpointUrl", "oauthBearerTokenEndpointUrl", "TokenEndpoint", "tokenEndpoint") || optionString(additional, "TokenEndpoint", "tokenEndpoint");
-    const clientId = optionString(additional, "ClientId", "clientId");
-    const clientSecret = optionString(additional, "ClientSecret", "clientSecret");
-    if (!tokenEndpoint || !clientId || !clientSecret) {
-        throw new Error("Kafka OAuthBearer requires a direct access token or token endpoint with client credentials.");
-    }
-    const form = new URLSearchParams();
-    form.set("grant_type", "client_credentials");
-    form.set("client_id", clientId);
-    form.set("client_secret", clientSecret);
-    const scope = optionString(additional, "Scope", "scope");
-    if (scope) {
-        form.set("scope", scope);
-    }
-    const response = await fetch(tokenEndpoint, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: form.toString()
-    });
-    if (!response.ok) {
-        throw new Error(`Kafka OAuthBearer token request failed with status ${response.status}.`);
-    }
-    const payload = parseMaybeJson(await response.text());
-    if (!isRecord(payload) || !payload.access_token) {
-        throw new Error("Kafka OAuthBearer token response did not contain access_token.");
-    }
-    return String(payload.access_token);
-}
-function mapKafkaSaslMechanism(mechanism) {
-    switch (mechanism) {
-        case "plain":
-            return "plain";
-        case "scramsha256":
-        case "scram-sha-256":
-            return "scram-sha-256";
-        case "scramsha512":
-        case "scram-sha-512":
-            return "scram-sha-512";
-        default:
-            throw new Error(`Unsupported Kafka SASL mechanism: ${mechanism}.`);
+function parseKafkaOAuthExtensions(value) {
+    const parsed = {};
+    for (const entry of value.split(",")) {
+        const separatorIndex = entry.indexOf("=");
+        if (separatorIndex <= 0) {
+            continue;
+        }
+        const key = entry.slice(0, separatorIndex).trim();
+        if (!key) {
+            continue;
+        }
+        parsed[key] = entry.slice(separatorIndex + 1).trim();
     }
+    return parsed;
 }
 function mapConfluentKafkaSecurityProtocol(protocol) {
     switch (protocol.toLowerCase()) {
@@ -4715,7 +4654,6 @@ exports.__loadstrikeTestExports = {
     applyHttpAuthHeaders,
     buildHttpRequestBody,
     buildConfluentKafkaClientOptions,
-    buildKafkaClientOptions,
     canonicalizeHttpResponseSource,
     createDelegateRequestEndpointView,
     createNatsHeaders,
@@ -4731,7 +4669,6 @@ exports.__loadstrikeTestExports = {
     injectTrackingValue,
     mapConfluentKafkaSaslMechanism,
     mapConfluentKafkaSecurityProtocol,
-    mapKafkaSaslMechanism,
     parseBodyObject,
     partitionFromKey,
     payloadBodyAsUtf8,
@@ -4739,10 +4676,8 @@ exports.__loadstrikeTestExports = {
     protocolBus: protocolBus,
     readFirstRedisStreamEntry,
     resolveConnectionMetadata,
-    resolveKafkaOAuthBearerToken,
     serializePayloadBody,
     setJsonBodyValue,
-    shouldUseConfluentKafkaClient,
     toHeaderRecord,
     toKafkaHeadersWithContentType,
     toSqsMessageAttributes,
@@ -4750,6 +4685,9 @@ exports.__loadstrikeTestExports = {
     setSqsClientFactoryForTests: (factory) => {
         sqsClientFactoryForTests = factory;
     },
+    setKafkaClientFactoryForTests: (factory) => {
+        kafkaClientFactoryForTests = factory;
+    },
     validateHttpEndpoint,
     validateTrackingSelectorPath
 };