@medialane/sdk 0.88.0 → 0.90.0

package/dist/index.cjs

@@ -296,15 +296,15 @@ var ApiClient = class {
   }
   async request(path, init, opts) {
     const url = `${this.baseUrl.replace(/\/$/, "")}${path}`;
-    const headers = { ...this.baseHeaders };
+    const headers2 = { ...this.baseHeaders };
     if (!(init?.body instanceof FormData)) {
-      headers["Content-Type"] = "application/json";
+      headers2["Content-Type"] = "application/json";
     }
     const allowed = (status) => opts?.allow404 === true && status === 404 || opts?.allow403 === true && status === 403;
     const res = await withRetry(async () => {
       const response = await fetch(url, {
         ...init,
-        headers: { ...headers, ...init?.headers }
+        headers: { ...headers2, ...init?.headers }
       });
       if (!response.ok && !allowed(response.status)) {
         const text = await response.text().catch(() => response.statusText);
@@ -1342,7 +1342,7 @@ function proxyError(code, message, status) {
 }
 function createBackendProxyHandler(config) {
   const doFetch = config.fetchImpl ?? fetch;
-  const endpoint = `${config.backendUrl.replace(/\/$/, "")}/${config.path.replace(/^\//, "")}`;
+  const endpoint2 = `${config.backendUrl.replace(/\/$/, "")}/${config.path.replace(/^\//, "")}`;
   return async function handleBackendProxy(req) {
     if (!isSameOrigin(req)) {
       return proxyError(-32600, "Cross-origin requests are not allowed", 403);
@@ -1360,7 +1360,7 @@ function createBackendProxyHandler(config) {
       return proxyError(-32700, "Parse error", 400);
     }
     try {
-      const upstream = await doFetch(endpoint, {
+      const upstream = await doFetch(endpoint2, {
         method: "POST",
         headers: { "Content-Type": "application/json", "x-api-key": config.apiKey },
         body: JSON.stringify(body)
@@ -1381,6 +1381,115 @@ function createRpcProxyHandler(config) {
   return createBackendProxyHandler({ ...config, path: "/v1/rpc" });
 }
 
+// src/server/ssrf-guard.ts
+var ALLOWED_IMAGE_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/jpg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "image/svg+xml",
+  "image/avif",
+  "image/bmp",
+  "image/tiff"
+]);
+var MAX_IMAGE_REDIRECTS = 5;
+var MAX_IMAGE_PROXY_BYTES = 15 * 1024 * 1024;
+function isPrivateHost(hostname) {
+  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "localhost" || h === "127.0.0.1" || h === "0.0.0.0") return true;
+  if (/^\d+$/.test(h)) {
+    const n = parseInt(h, 10);
+    if (n === 2130706433 || n === 0 || n >= 2886729728 && n <= 2887778303 || n >= 3232235520 && n <= 3232301055 || n >= 167772160 && n <= 184549375 || n >= 2851995648 && n <= 2852061183) return true;
+  }
+  if (/^0x[0-9a-f]+$/i.test(h)) {
+    const n = parseInt(h, 16);
+    if (n === 2130706433 || n === 0 || n >= 2886729728 && n <= 2887778303 || n >= 3232235520 && n <= 3232301055 || n >= 167772160 && n <= 184549375 || n >= 2851995648 && n <= 2852061183) return true;
+  }
+  if (/^0\d+\.\d+\.\d+\.\d+$/.test(h)) return true;
+  if (h === "::1" || /^0*:0*:0*:0*:0*:0*:0*:0*1$/.test(h)) return true;
+  const v4mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+  if (v4mapped) return isPrivateHost(v4mapped[1]);
+  if (/^10\./.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
+  if (/^192\.168\./.test(h)) return true;
+  if (/^169\.254\./.test(h)) return true;
+  if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(h)) return true;
+  if (/^fe80:/i.test(h)) return true;
+  if (/^f[cd][0-9a-f]{2}:/i.test(h)) return true;
+  if (h.endsWith(".local")) return true;
+  if (h === "metadata.google.internal") return true;
+  if (h === "metadata.azure.internal") return true;
+  return false;
+}
+function validateUrl(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return { error: "Invalid url", status: 400 };
+  }
+  if (parsed.protocol !== "https:") {
+    return { error: "Only https URLs allowed", status: 400 };
+  }
+  if (parsed.username || parsed.password) {
+    return { error: "URL credentials not allowed", status: 400 };
+  }
+  if (isPrivateHost(parsed.hostname)) {
+    return { error: "URL not allowed", status: 400 };
+  }
+  return { url: parsed };
+}
+
+// src/server/backend-metadata.ts
+function endpoint(config, path) {
+  return `${config.backendUrl.replace(/\/$/, "")}/v1/metadata/${path}`;
+}
+function headers(config, extra) {
+  return { "x-api-key": config.apiKey, ...extra };
+}
+async function uploadJsonToBackend(config, json) {
+  const res = await (config.fetchImpl ?? fetch)(endpoint(config, "upload"), {
+    method: "POST",
+    headers: headers(config, { "Content-Type": "application/json" }),
+    body: JSON.stringify(json)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.data) throw new Error(data.error ?? "Metadata upload failed");
+  return { cid: data.data.cid, uri: data.data.url };
+}
+async function uploadFileToBackend(config, file) {
+  const form = new FormData();
+  form.append("file", file, file.name);
+  const res = await (config.fetchImpl ?? fetch)(endpoint(config, "upload-file"), {
+    method: "POST",
+    headers: headers(config),
+    body: form
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.data) throw new Error(data.error ?? "File upload failed");
+  return { cid: data.data.cid, uri: data.data.url };
+}
+async function uploadDirectoryToBackend(config, files) {
+  const res = await (config.fetchImpl ?? fetch)(endpoint(config, "upload-directory"), {
+    method: "POST",
+    headers: headers(config, { "Content-Type": "application/json" }),
+    body: JSON.stringify({ files })
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.data) throw new Error(data.error ?? "Directory pin failed");
+  return data.data;
+}
+async function getBackendSignedUrl(config, kind = "image") {
+  const res = await (config.fetchImpl ?? fetch)(`${endpoint(config, "signed-url")}?kind=${kind}`, {
+    method: "GET",
+    headers: headers(config)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.data) throw new Error(data.error ?? "Failed to create upload URL");
+  return data.data.url;
+}
+
 // src/metadata.ts
 var RESERVED_TRAITS = /* @__PURE__ */ new Set([
   "Creator",
@@ -1474,12 +1583,15 @@ function resolveSafeImageContentType(contentType) {
 }
 var MAX_IPFS_GATEWAY_RESPONSE_BYTES = 25 * 1024 * 1024;
 
+exports.ALLOWED_IMAGE_CONTENT_TYPES = ALLOWED_IMAGE_CONTENT_TYPES;
 exports.ApiClient = ApiClient;
 exports.CHAINS = CHAINS;
 exports.DEFAULT_CHAIN = DEFAULT_CHAIN;
 exports.DEFAULT_CURRENCY = DEFAULT_CURRENCY;
 exports.FeeConfigSchema = FeeConfigSchema;
 exports.IPFS_SAFE_CONTENT_TYPE_PREFIXES = IPFS_SAFE_CONTENT_TYPE_PREFIXES;
+exports.MAX_IMAGE_PROXY_BYTES = MAX_IMAGE_PROXY_BYTES;
+exports.MAX_IMAGE_REDIRECTS = MAX_IMAGE_REDIRECTS;
 exports.MAX_IPFS_GATEWAY_RESPONSE_BYTES = MAX_IPFS_GATEWAY_RESPONSE_BYTES;
 exports.MedialaneApiError = MedialaneApiError;
 exports.OPEN_LICENSES = OPEN_LICENSES;
@@ -1530,6 +1642,7 @@ exports.createRateLimiter = createRateLimiter;
 exports.createRpcProxyHandler = createRpcProxyHandler;
 exports.encodeU256 = encodeU256;
 exports.formatAmount = formatAmount;
+exports.getBackendSignedUrl = getBackendSignedUrl;
 exports.getCoordinates = getCoordinates;
 exports.getDerivativesTerm = getDerivativesTerm;
 exports.getListableTokens = getListableTokens;
@@ -1539,6 +1652,7 @@ exports.getStarknetCoordinates = getStarknetCoordinates;
 exports.getTokenByAddress = getTokenByAddress;
 exports.getTokenBySymbol = getTokenBySymbol;
 exports.hasCapability = hasCapability;
+exports.isPrivateHost = isPrivateHost;
 exports.isSameOrigin = isSameOrigin;
 exports.isServiceId = isServiceId;
 exports.isTransientRpcError = isTransientRpcError;
@@ -1556,5 +1670,9 @@ exports.resolveSafeImageContentType = resolveSafeImageContentType;
 exports.shortenAddress = shortenAddress;
 exports.stringifyBigInts = stringifyBigInts;
 exports.u256ToBigInt = u256ToBigInt;
+exports.uploadDirectoryToBackend = uploadDirectoryToBackend;
+exports.uploadFileToBackend = uploadFileToBackend;
+exports.uploadJsonToBackend = uploadJsonToBackend;
+exports.validateUrl = validateUrl;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map