@lovrozagar/honey 0.6.8 → 0.7.0

package/src/trust.ts

@@ -0,0 +1,117 @@
+import { directClientInfo, isValidHost, TRUST_OFF, type ClientInfo, type TrustSetting } from "./client-info.ts"
+import { registerFeature } from "./feature-slots.ts"
+import { canonicalIp, ipInRange, parseIp, parseIpRange, type IpRange } from "./ip.ts"
+
+export type { ClientInfo, TrustSetting } from "./client-info.ts"
+export { hasValidHost, isValidHost, TRUST_OFF } from "./client-info.ts"
+
+/**
+ * Who sent a request, and over what. One setting, `app.trustProxy()`, decides it for every
+ * feature that asks: `ctx.ip`, `ipRestrict`, loggers, `proxy()` forwarding headers.
+ *
+ * - off (the default): the peer the runtime reports is the client; forwarding headers are
+ *   client-controlled text and ignored.
+ * - a hop count: that many reverse proxies stand in front of the app, each appending the
+ *   address of its own peer to `X-Forwarded-For`. The client is the entry the outermost one
+ *   wrote; entries further left were sent by the client and are ignored.
+ * - a list of addresses and CIDR ranges: proxies are recognized by address. Starting at the
+ *   peer, every trusted hop is skipped; the first untrusted address is the client.
+ */
+export type TrustProxy = false | number | readonly string[]
+
+/** How a compiled setting finds the client: a fixed hop count, or proxies known by address. */
+type TrustRule =
+	| { readonly kind: "hops"; readonly hops: number }
+	| { readonly kind: "ranges"; readonly ranges: readonly IpRange[] }
+
+function withResolver(rule: TrustRule): TrustSetting {
+	return Object.freeze({
+		kind: rule.kind,
+		resolve: (req: Request, peer: string | null) => resolveRule(rule, req, peer),
+	})
+}
+
+export function compileTrust(value: TrustProxy): TrustSetting {
+	if (value === false || value === 0) return TRUST_OFF
+	if (typeof value === "number") {
+		if (!Number.isInteger(value) || value < 0) {
+			throw new Error(`trustProxy: a hop count must be a non-negative integer, got ${value}`)
+		}
+		return withResolver({ hops: value, kind: "hops" })
+	}
+	if (!Array.isArray(value) || value.length === 0) {
+		throw new Error("trustProxy: pass false, a hop count, or a non-empty list of proxy addresses and CIDR ranges")
+	}
+	const ranges = value.map((rule) => {
+		const range = typeof rule === "string" ? parseIpRange(rule) : null
+		if (range === null) throw new Error(`trustProxy: ${JSON.stringify(rule)} is not an IP address or CIDR range`)
+		return range
+	})
+	return withResolver({ kind: "ranges", ranges })
+}
+
+function listHeader(headers: Headers, name: string): string[] {
+	const raw = headers.get(name)
+	if (raw === null) return []
+	const out: string[] = []
+	for (const part of raw.split(",")) {
+		const v = part.trim()
+		if (v !== "") out.push(v)
+	}
+	return out
+}
+
+/**
+ * How many proxies in front of the app this request passed through that the setting trusts.
+ * Each one appended one `X-Forwarded-For` entry, so the client is the entry `count` from the
+ * right. `null` when a hop the walk must read is not an address.
+ */
+function trustedHops(trust: TrustRule, peer: string | null, forwarded: readonly string[]): number | null {
+	if (trust.kind === "hops") return trust.hops
+	const isTrusted = (text: string): boolean | null => {
+		const addr = parseIp(text)
+		if (addr === null) return null
+		return trust.ranges.some((r) => ipInRange(addr, r))
+	}
+	if (peer === null) return 0
+	const peerTrusted = isTrusted(peer)
+	if (peerTrusted !== true) return 0
+	let count = 1
+	for (let i = forwarded.length - 1; i > 0; i--) {
+		const trusted = isTrusted(forwarded[i])
+		if (trusted === null) return null
+		if (!trusted) break
+		count++
+	}
+	return count
+}
+
+/** The value the outermost trusted hop wrote: `count` from the right, or the leftmost when the list is shorter. */
+function pick(values: readonly string[], count: number): string | undefined {
+	if (values.length === 0) return undefined
+	const idx = values.length - count
+	return values[idx < 0 ? 0 : idx]
+}
+
+function resolveRule(rule: TrustRule, req: Request, peer: string | null): ClientInfo {
+	const direct = directClientInfo(req, peer)
+	const forwarded = listHeader(req.headers, "x-forwarded-for")
+	const count = trustedHops(rule, peer, forwarded)
+	if (count === null) return { ...direct, ip: null }
+	if (count === 0) return direct
+
+	const client = pick(forwarded, count)
+	const ip = client === undefined ? direct.ip : canonicalIp(client)
+
+	const proto = pick(listHeader(req.headers, "x-forwarded-proto"), count)?.toLowerCase()
+	const protocol = proto === "https" || proto === "http" ? proto : direct.protocol
+	const fwdHost = pick(listHeader(req.headers, "x-forwarded-host"), count)
+	const host = fwdHost !== undefined && isValidHost(fwdHost) ? fwdHost : direct.host
+	return { host, ip, protocol }
+}
+
+/** The client of `req` under `trust`; the same answer `ctx.ip` and `clientInfo()` give. */
+/** The client a request comes from under `trust`; the core's own resolver, re-exported. */
+export { resolveClient as resolveClientInfo } from "./client-info.ts"
+
+registerFeature("trust", { compileTrust })

package/src/ts-type-emitter.ts

@@ -1,6 +1,10 @@
 /** JSON Schema IR → TypeScript type string emitter. Mirrors jsonSchemaToTS logic case-for-case. */
 
 import type { IRSchema } from "./codegen-ir.ts"
+import { arrayOf, intersectionOf, literalType, unionOf } from "./type-emitter.ts"
+
+/* a cycle guard only — resolved specs carry no cycles, so legitimately deep nesting is kept */
+const MAX_DEPTH = 64
 
 /* TS keywords that are valid identifiers but require quoting as object property keys */
 const TS_RESERVED = new Set([
@@ -80,38 +84,38 @@ const TS_RESERVED = new Set([
  * (File included) inside a multipart form body.
  */
 export function irToTs(ir: IRSchema, depth = 0, binary = "string"): string {
-	if (depth > 8) return "unknown"
+	if (depth > MAX_DEPTH) return "unknown"
 
 	switch (ir.kind) {
 		case "scalar":
 			return emitScalar(ir)
 
 		case "const":
-			return typeof ir.value === "string" ? JSON.stringify(ir.value) : String(ir.value)
+			return literalType(ir.value)
 
 		case "object":
 			return emitObject(ir, depth, binary)
 
 		case "array": {
-			const el = irToTs(ir.items, depth + 1, binary)
-			return el.includes("|") || el.includes("&") ? `(${el})[]` : `${el}[]`
+			return arrayOf(irToTs(ir.items, depth + 1, binary))
 		}
 
 		case "tuple":
 			return `[${ir.items.map((i) => irToTs(i, depth + 1, binary)).join(", ")}]`
 
 		case "union":
-			return ir.variants.map((v) => irToTs(v, depth + 1, binary)).join(" | ")
+			return unionOf(ir.variants.map((v) => irToTs(v, depth + 1, binary)))
 
 		case "allOf":
-			return ir.parts.map((p) => irToTs(p, depth + 1, binary)).join(" & ")
+			/* `(A | B) & C`, never `A | B & C` */
+			return intersectionOf(ir.parts.map((p) => irToTs(p, depth + 1, binary)))
 
+		/* refs are resolved before emit; one left over names nothing this file declares */
 		case "ref":
-			return ir.name
+			return "unknown"
 
 		case "nullable": {
-			const inner = irToTs(ir.inner, depth + 1, binary)
-			return `${inner} | null`
+			return unionOf([irToTs(ir.inner, depth + 1, binary), "null"])
 		}
 
 		/* binary kind arises from {type: "string", format: "binary"}; see `binary` above */
@@ -125,7 +129,7 @@ export function irToTs(ir: IRSchema, depth = 0, binary = "string"): string {
 
 function emitScalar(ir: Extract<IRSchema, { kind: "scalar" }>): string {
 	if (ir.enum) {
-		return ir.enum.map((v) => (typeof v === "string" ? JSON.stringify(v) : String(v))).join(" | ")
+		return unionOf(ir.enum.map(literalType))
 	}
 
 	if (ir.type === "string") return "string"
@@ -145,7 +149,8 @@ function emitObject(ir: Extract<IRSchema, { kind: "object" }>, depth: number, bi
 		return "Record<string, unknown>"
 	}
 
-	const sortedFields = fields.slice().sort((a, b) => a.name.localeCompare(b.name))
+	/* code-unit order: the same output on every machine, whatever its locale */
+	const sortedFields = fields.slice().sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
 
 	const entries = sortedFields.map((field) => {
 		const opt = field.required ? "" : "?"
@@ -154,8 +159,9 @@ function emitObject(ir: Extract<IRSchema, { kind: "object" }>, depth: number, bi
 		return `${key}${opt}: ${irToTs(field.schema, depth + 1, binary)}`
 	})
 
+	/* an index signature beside fields of other types is TS2411; an intersection says the same thing */
 	if (additional) {
-		entries.push(`[k: string]: ${irToTs(additional, depth + 1, binary)}`)
+		return `{ ${entries.join("; ")} } & { [k: string]: ${irToTs(additional, depth + 1, binary)} }`
 	}
 
 	return `{ ${entries.join("; ")} }`