@loadstrike/loadstrike-sdk 1.0.30201 → 1.0.31001

package/dist/esm/transports.js

@@ -596,10 +596,10 @@ class WebSocketEndpointDefinitionModel extends TrafficEndpointDefinitionModel {
             parsed = new URL(url);
         }
         catch {
-            throw new Error("Url must be an absolute ws:// or wss:// URI.");
+            throw new Error("Url must be an absolute WebSocket URI using the ws or wss scheme.");
         }
         if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
-            throw new Error("Url must be an absolute ws:// or wss:// URI.");
+            throw new Error("Url must be an absolute WebSocket URI using the ws or wss scheme.");
         }
         if (this.ConnectTimeoutSeconds <= 0) {
             throw new RangeError("ConnectTimeout must be greater than zero.");
@@ -1233,11 +1233,13 @@ function validateHttpAuthOptionsModel(target) {
 }
 function validateKafkaSaslOptionsModel(target) {
     switch (normalizeToken(target.Mechanism)) {
-        case "oauthbearer":
-            if (!String(target.OAuthBearerTokenEndpointUrl ?? "").trim()) {
-                throw new Error("OAuthBearerTokenEndpointUrl must be provided when SASL mechanism is OAuthBearer.");
-            }
+        case "oauthbearer": {
+            const additionalSettings = target.AdditionalSettings;
+            validateKafkaOAuthBearerCredentials(String(target.AccessToken ?? "").trim() || String(target.OAuthBearerToken ?? "").trim(), String(target.OAuthBearerTokenEndpointUrl ?? "").trim()
+                || String(target.TokenEndpoint ?? "").trim()
+                || optionString(additionalSettings, "TokenEndpoint", "tokenEndpoint"), optionString(additionalSettings, "ClientId", "clientId"), optionString(additionalSettings, "ClientSecret", "clientSecret"));
             return;
+        }
         default:
             if (!String(target.Username ?? "").trim()) {
                 throw new Error("Username must be provided for SASL authentication.");
@@ -1786,21 +1788,12 @@ class KafkaEndpointAdapter extends CallbackAdapter {
         if (!this.consumerStartPromise) {
             this.consumerStartPromise = (async () => {
                 const options = this.endpoint.kafka ?? {};
-                const useConfluentClient = shouldUseConfluentKafkaClient(this.endpoint);
                 const kafka = await createKafkaClient(this.endpoint);
                 const consumer = kafka.consumer(buildKafkaConsumerOptions(this.endpoint));
                 await consumer.connect();
-                if (useConfluentClient) {
-                    await consumer.subscribe({
-                        topics: [optionString(options, "Topic", "topic")]
-                    });
-                }
-                else {
-                    await consumer.subscribe({
-                        topic: optionString(options, "Topic", "topic"),
-                        fromBeginning: optionBoolean(options, true, "StartFromEarliest", "startFromEarliest")
-                    });
-                }
+                await consumer.subscribe({
+                    topics: [optionString(options, "Topic", "topic")]
+                });
                 await consumer.run({
                     eachMessage: async ({ message }) => {
                         this.queue.push(createBrokerPayload(fromKafkaHeaders(message.headers), bufferToUint8Array(message.value), this.endpoint, headerValue(message.headers, "content-type")));
@@ -3135,10 +3128,10 @@ function validateWebSocketEndpoint(endpoint, mode) {
         parsed = new URL(url);
     }
     catch {
-        throw new Error("Url must be an absolute ws:// or wss:// URI.");
+        throw new Error("Url must be an absolute WebSocket URI using the ws or wss scheme.");
     }
     if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
-        throw new Error("Url must be an absolute ws:// or wss:// URI.");
+        throw new Error("Url must be an absolute WebSocket URI using the ws or wss scheme.");
     }
     const connectMs = optionNumber(options, "ConnectTimeoutMs", "connectTimeoutMs");
     const connectSeconds = optionNumber(options, "ConnectTimeoutSeconds", "connectTimeoutSeconds", "ConnectTimeout", "connectTimeout");
@@ -3213,7 +3206,8 @@ function validateKafkaEndpoint(endpoint, mode, hasModeDelegate) {
 function validateKafkaSaslOptions(options) {
     const mechanism = optionString(options, "Mechanism", "mechanism") || "Plain";
     if (mechanism.toLowerCase() === "oauthbearer") {
-        requireNonEmptyString(optionString(options, "OAuthBearerTokenEndpointUrl", "oauthBearerTokenEndpointUrl", "TokenEndpoint", "tokenEndpoint") || optionString(asRecordOrEmpty(pickProtocolValue(options, "AdditionalSettings", "additionalSettings")), "TokenEndpoint", "tokenEndpoint"), "OAuthBearerTokenEndpointUrl must be provided when SASL mechanism is OAuthBearer.");
+        const additionalSettings = asRecordOrEmpty(pickProtocolValue(options, "AdditionalSettings", "additionalSettings"));
+        validateKafkaOAuthBearerCredentials(optionString(options, "AccessToken", "accessToken", "OAuthBearerToken", "oauthBearerToken"), optionString(options, "OAuthBearerTokenEndpointUrl", "oauthBearerTokenEndpointUrl", "TokenEndpoint", "tokenEndpoint") || optionString(additionalSettings, "TokenEndpoint", "tokenEndpoint"), optionString(additionalSettings, "ClientId", "clientId"), optionString(additionalSettings, "ClientSecret", "clientSecret"));
         return;
     }
     requireNonEmptyString(optionString(options, "Username", "username"), "Username must be provided for SASL authentication.");
@@ -3567,7 +3561,13 @@ function extractJsonPath(value, arrayPath) {
     if (!normalized) {
         return value;
     }
-    const tokens = normalized.replace(/\[(\d+)\]/g, ".$1").split(".").filter((x) => x.length > 0);
+    let tokens;
+    try {
+        tokens = safeJsonPathSegments(normalized.replace(/\[(\d+)\]/g, ".$1"));
+    }
+    catch {
+        return null;
+    }
     for (const token of tokens) {
         if (current == null) {
             return null;
@@ -3577,13 +3577,17 @@ function extractJsonPath(value, arrayPath) {
             if (!Number.isInteger(index) || index < 0 || index >= current.length) {
                 return null;
             }
-            current = current[index];
+            current = current.at(index);
             continue;
         }
-        if (!isRecord(current) || !(token in current)) {
+        if (!isRecord(current)) {
             return null;
         }
-        current = current[token];
+        const descriptor = Object.getOwnPropertyDescriptor(current, token);
+        if (!descriptor || !("value" in descriptor)) {
+            return null;
+        }
+        current = descriptor.value;
     }
     return current;
 }
@@ -3600,7 +3604,7 @@ function parseMaybeJson(value) {
     }
 }
 function headersToRecord(value) {
-    const headers = {};
+    const headers = Object.create(null);
     value.forEach((headerValue, key) => {
         headers[key] = headerValue;
     });
@@ -3954,11 +3958,22 @@ function extractTrackingValue(payload, selector) {
             return null;
         }
         let current = body;
-        for (const segment of selector.slice("json:".length).trim().replace(/^\$\./, "").split(".").filter(Boolean)) {
+        const path = selector.slice("json:".length).trim().replace(/^\$\./, "");
+        let segments;
+        try {
+            segments = safeJsonPathSegments(path);
+        }
+        catch {
+            return null;
+        }
+        for (const segment of segments) {
             if (!isRecord(current)) {
                 return null;
             }
-            current = current[segment];
+            if (!Object.prototype.hasOwnProperty.call(current, segment)) {
+                return null;
+            }
+            current = readOwnJsonProperty(current, segment);
         }
         return current == null ? null : String(current);
     }
@@ -3989,23 +4004,61 @@ function injectTrackingValue(payload, selector, value) {
 }
 function setJsonBodyValue(body, path, value) {
     const target = parseBodyObject(body) ?? {};
-    const clone = cloneBody(target);
-    const segments = path.split(".").filter(Boolean);
+    const clone = cloneJsonRecord(target);
+    const segments = safeJsonPathSegments(path);
     if (!segments.length) {
         return clone;
     }
     let current = clone;
     for (let i = 0; i < segments.length - 1; i += 1) {
         const segment = segments[i];
-        const next = current[segment];
+        let next = readOwnJsonProperty(current, segment);
         if (!isRecord(next)) {
-            current[segment] = {};
+            next = {};
+            defineJsonProperty(current, segment, next);
         }
-        current = current[segment];
+        current = next;
     }
-    current[segments[segments.length - 1]] = value;
+    defineJsonProperty(current, segments[segments.length - 1], value);
     return clone;
 }
+const FORBIDDEN_JSON_PATH_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+function safeJsonPathSegments(path) {
+    const segments = path.split(".").filter(Boolean);
+    const forbidden = segments.find((segment) => FORBIDDEN_JSON_PATH_SEGMENTS.has(segment));
+    if (forbidden) {
+        throw new Error(`Tracking selector contains forbidden JSON path segment '${forbidden}'.`);
+    }
+    return segments;
+}
+function defineJsonProperty(target, key, value) {
+    Object.defineProperty(target, key, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true
+    });
+}
+function readOwnJsonProperty(target, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(target, key);
+    return descriptor && "value" in descriptor ? descriptor.value : undefined;
+}
+function cloneJsonRecord(source) {
+    const target = {};
+    for (const [key, value] of Object.entries(source)) {
+        defineJsonProperty(target, key, cloneJsonValue(value));
+    }
+    return target;
+}
+function cloneJsonValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => cloneJsonValue(entry));
+    }
+    if (isRecord(value)) {
+        return cloneJsonRecord(value);
+    }
+    return value;
+}
 function parseBodyObject(body) {
     if (body instanceof Uint8Array) {
         return parseBodyObject(new TextDecoder().decode(body));
@@ -4206,74 +4259,31 @@ function pickProtocolValue(options, ...keys) {
     }
     return undefined;
 }
-function buildKafkaClientOptions(endpoint) {
-    const options = endpoint.kafka ?? {};
-    const securityProtocol = (optionString(options, "SecurityProtocol", "securityProtocol") || "Plaintext").toLowerCase();
-    const bootstrapServers = optionString(options, "BootstrapServers", "bootstrapServers")
-        .split(",")
-        .map((value) => value.trim())
-        .filter((value) => value.length > 0);
-    const clientOptions = {
-        clientId: `${endpoint.name}-${randomUUID().slice(0, 8)}`,
-        brokers: bootstrapServers,
-        ssl: securityProtocol === "ssl" || securityProtocol === "saslssl"
-    };
-    if (securityProtocol === "saslplaintext" || securityProtocol === "saslssl") {
-        const saslOptions = asRecordOrEmpty(pickProtocolValue(options, "Sasl", "sasl"));
-        const mechanism = (optionString(saslOptions, "Mechanism", "mechanism") || "Plain").toLowerCase();
-        if (mechanism === "oauthbearer") {
-            clientOptions.sasl = {
-                mechanism: "oauthbearer",
-                oauthBearerProvider: async () => ({
-                    value: await resolveKafkaOAuthBearerToken(saslOptions)
-                })
-            };
-        }
-        else {
-            clientOptions.sasl = {
-                mechanism: mapKafkaSaslMechanism(mechanism),
-                username: optionString(saslOptions, "Username", "username"),
-                password: optionString(saslOptions, "Password", "password")
-            };
-        }
+let kafkaClientFactoryForTests = null;
+async function createKafkaClient(endpoint) {
+    if (kafkaClientFactoryForTests) {
+        return await kafkaClientFactoryForTests(endpoint);
     }
-    return clientOptions;
+    const { KafkaJS } = await import("@confluentinc/kafka-javascript");
+    return new KafkaJS.Kafka(buildConfluentKafkaClientOptions(endpoint));
 }
-async function createKafkaClient(endpoint) {
-    if (shouldUseConfluentKafkaClient(endpoint)) {
-        const { KafkaJS } = await import("@confluentinc/kafka-javascript");
-        return new KafkaJS.Kafka(buildConfluentKafkaClientOptions(endpoint));
+function validateKafkaOAuthBearerCredentials(directToken, tokenEndpoint, clientId, clientSecret) {
+    if (directToken.trim()) {
+        return;
+    }
+    if (!tokenEndpoint.trim() || !clientId.trim() || !clientSecret.trim()) {
+        throw new Error("Kafka OAuthBearer requires a direct access token or token endpoint with client credentials.");
     }
-    const { Kafka } = await import("kafkajs");
-    return new Kafka(buildKafkaClientOptions(endpoint));
 }
 function buildKafkaConsumerOptions(endpoint) {
     const options = endpoint.kafka ?? {};
     const groupId = optionString(options, "ConsumerGroupId", "consumerGroupId");
     const fromBeginning = optionBoolean(options, true, "StartFromEarliest", "startFromEarliest");
-    if (shouldUseConfluentKafkaClient(endpoint)) {
-        return {
-            "group.id": groupId,
-            "auto.offset.reset": fromBeginning ? "earliest" : "latest",
-            "enable.auto.commit": true
-        };
-    }
-    return { groupId };
-}
-function shouldUseConfluentKafkaClient(endpoint) {
-    const options = endpoint.kafka ?? {};
-    const securityProtocol = (optionString(options, "SecurityProtocol", "securityProtocol") || "Plaintext").toLowerCase();
-    if (securityProtocol !== "saslplaintext" && securityProtocol !== "saslssl") {
-        return Object.keys(toStringRecord(pickProtocolValue(options, "ConfluentSettings", "confluentSettings"))).length > 0;
-    }
-    const saslOptions = asRecordOrEmpty(pickProtocolValue(options, "Sasl", "sasl"));
-    const mechanism = (optionString(saslOptions, "Mechanism", "mechanism") || "Plain").toLowerCase();
-    const confluentSettings = toStringRecord(pickProtocolValue(options, "ConfluentSettings", "confluentSettings"));
-    const additionalSettings = toStringRecord(pickProtocolValue(saslOptions, "AdditionalSettings", "additionalSettings"));
-    const hasDirectOAuthToken = mechanism === "oauthbearer" && Boolean(optionString(saslOptions, "AccessToken", "accessToken", "OAuthBearerToken", "oauthBearerToken"));
-    return mechanism === "gssapi"
-        || Object.keys(confluentSettings).length > 0
-        || (Object.keys(additionalSettings).length > 0 && !hasDirectOAuthToken);
+    return {
+        "group.id": groupId,
+        "auto.offset.reset": fromBeginning ? "earliest" : "latest",
+        "enable.auto.commit": true
+    };
 }
 function buildConfluentKafkaClientOptions(endpoint) {
     const options = endpoint.kafka ?? {};
@@ -4289,30 +4299,41 @@ function buildConfluentKafkaClientOptions(endpoint) {
         const additionalSettings = toStringRecord(pickProtocolValue(saslOptions, "AdditionalSettings", "additionalSettings"));
         base["sasl.mechanism"] = mapConfluentKafkaSaslMechanism(mechanism);
         if (mechanism.toLowerCase() === "oauthbearer") {
+            const directToken = optionString(saslOptions, "AccessToken", "accessToken", "OAuthBearerToken", "oauthBearerToken");
             const tokenEndpoint = optionString(saslOptions, "OAuthBearerTokenEndpointUrl", "oauthBearerTokenEndpointUrl", "TokenEndpoint", "tokenEndpoint") || optionString(additionalSettings, "TokenEndpoint", "tokenEndpoint");
-            if (tokenEndpoint) {
-                base["sasl.oauthbearer.method"] = "oidc";
-                base["sasl.oauthbearer.token.endpoint.url"] = tokenEndpoint;
-            }
             const clientId = optionString(additionalSettings, "ClientId", "clientId");
-            if (clientId) {
-                base["sasl.oauthbearer.client.id"] = clientId;
-            }
             const clientSecret = optionString(additionalSettings, "ClientSecret", "clientSecret");
-            if (clientSecret) {
-                base["sasl.oauthbearer.client.secret"] = clientSecret;
-            }
             const scope = optionString(additionalSettings, "Scope", "scope");
-            if (scope) {
-                base["sasl.oauthbearer.scope"] = scope;
-            }
             const grantType = optionString(additionalSettings, "GrantType", "grantType");
-            if (grantType) {
-                base["sasl.oauthbearer.grant.type"] = grantType;
-            }
             const extensions = optionString(additionalSettings, "Extensions", "extensions");
-            if (extensions) {
-                base["sasl.oauthbearer.extensions"] = extensions;
+            if (directToken) {
+                const principal = optionString(additionalSettings, "Principal", "principal")
+                    || optionString(saslOptions, "Username", "username")
+                    || "loadstrike";
+                base.oauthbearer_token_refresh_cb = async () => ({
+                    tokenValue: directToken,
+                    lifetime: Date.now() + 60 * 60 * 1000,
+                    principal,
+                    extensions: parseKafkaOAuthExtensions(extensions)
+                });
+            }
+            else {
+                if (!tokenEndpoint || !clientId || !clientSecret) {
+                    throw new Error("Kafka OAuthBearer requires a direct access token or token endpoint with client credentials.");
+                }
+                base["sasl.oauthbearer.method"] = "oidc";
+                base["sasl.oauthbearer.token.endpoint.url"] = tokenEndpoint;
+                base["sasl.oauthbearer.client.id"] = clientId;
+                base["sasl.oauthbearer.client.secret"] = clientSecret;
+                if (scope) {
+                    base["sasl.oauthbearer.scope"] = scope;
+                }
+                if (grantType) {
+                    base["sasl.oauthbearer.grant.type"] = grantType;
+                }
+                if (extensions) {
+                    base["sasl.oauthbearer.extensions"] = extensions;
+                }
             }
         }
         else {
@@ -4331,7 +4352,9 @@ function buildConfluentKafkaClientOptions(endpoint) {
                 || key === "Extensions"
                 || key === "extensions"
                 || key === "TokenEndpoint"
-                || key === "tokenEndpoint") {
+                || key === "tokenEndpoint"
+                || key === "Principal"
+                || key === "principal") {
                 continue;
             }
             base[key] = value;
@@ -4342,53 +4365,20 @@ function buildConfluentKafkaClientOptions(endpoint) {
     }
     return base;
 }
-async function resolveKafkaOAuthBearerToken(options) {
-    const directToken = optionString(options, "AccessToken", "accessToken", "OAuthBearerToken", "oauthBearerToken");
-    if (directToken) {
-        return directToken;
-    }
-    const additional = asRecordOrEmpty(pickProtocolValue(options, "AdditionalSettings", "additionalSettings"));
-    const tokenEndpoint = optionString(options, "OAuthBearerTokenEndpointUrl", "oauthBearerTokenEndpointUrl", "TokenEndpoint", "tokenEndpoint") || optionString(additional, "TokenEndpoint", "tokenEndpoint");
-    const clientId = optionString(additional, "ClientId", "clientId");
-    const clientSecret = optionString(additional, "ClientSecret", "clientSecret");
-    if (!tokenEndpoint || !clientId || !clientSecret) {
-        throw new Error("Kafka OAuthBearer requires a direct access token or token endpoint with client credentials.");
-    }
-    const form = new URLSearchParams();
-    form.set("grant_type", "client_credentials");
-    form.set("client_id", clientId);
-    form.set("client_secret", clientSecret);
-    const scope = optionString(additional, "Scope", "scope");
-    if (scope) {
-        form.set("scope", scope);
-    }
-    const response = await fetch(tokenEndpoint, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: form.toString()
-    });
-    if (!response.ok) {
-        throw new Error(`Kafka OAuthBearer token request failed with status ${response.status}.`);
-    }
-    const payload = parseMaybeJson(await response.text());
-    if (!isRecord(payload) || !payload.access_token) {
-        throw new Error("Kafka OAuthBearer token response did not contain access_token.");
-    }
-    return String(payload.access_token);
-}
-function mapKafkaSaslMechanism(mechanism) {
-    switch (mechanism) {
-        case "plain":
-            return "plain";
-        case "scramsha256":
-        case "scram-sha-256":
-            return "scram-sha-256";
-        case "scramsha512":
-        case "scram-sha-512":
-            return "scram-sha-512";
-        default:
-            throw new Error(`Unsupported Kafka SASL mechanism: ${mechanism}.`);
+function parseKafkaOAuthExtensions(value) {
+    const parsed = {};
+    for (const entry of value.split(",")) {
+        const separatorIndex = entry.indexOf("=");
+        if (separatorIndex <= 0) {
+            continue;
+        }
+        const key = entry.slice(0, separatorIndex).trim();
+        if (!key) {
+            continue;
+        }
+        parsed[key] = entry.slice(separatorIndex + 1).trim();
     }
+    return parsed;
 }
 function mapConfluentKafkaSecurityProtocol(protocol) {
     switch (protocol.toLowerCase()) {
@@ -4672,14 +4662,15 @@ export const __loadstrikeTestExports = {
     applyHttpAuthHeaders,
     buildHttpRequestBody,
     buildConfluentKafkaClientOptions,
-    buildKafkaClientOptions,
     canonicalizeHttpResponseSource,
     createDelegateRequestEndpointView,
     createNatsHeaders,
     createRedisStreamPayload,
     deserializeBrokerPayloadBody,
+    extractJsonPath,
     extractTrackingValue,
     fromKafkaHeaders,
+    headersToRecord,
     headerValue,
     attachDotNetTrackingPayloadAliases,
     attachPayloadHelpers,
@@ -4688,7 +4679,6 @@ export const __loadstrikeTestExports = {
     injectTrackingValue,
     mapConfluentKafkaSaslMechanism,
     mapConfluentKafkaSecurityProtocol,
-    mapKafkaSaslMechanism,
     parseBodyObject,
     partitionFromKey,
     payloadBodyAsUtf8,
@@ -4696,10 +4686,8 @@ export const __loadstrikeTestExports = {
     protocolBus: protocolBus,
     readFirstRedisStreamEntry,
     resolveConnectionMetadata,
-    resolveKafkaOAuthBearerToken,
     serializePayloadBody,
     setJsonBodyValue,
-    shouldUseConfluentKafkaClient,
     toHeaderRecord,
     toKafkaHeadersWithContentType,
     toSqsMessageAttributes,
@@ -4707,6 +4695,9 @@ export const __loadstrikeTestExports = {
     setSqsClientFactoryForTests: (factory) => {
         sqsClientFactoryForTests = factory;
     },
+    setKafkaClientFactoryForTests: (factory) => {
+        kafkaClientFactoryForTests = factory;
+    },
     validateHttpEndpoint,
     validateTrackingSelectorPath
 };