@metamask/snaps-cli 7.0.0 → 7.1.0

package/dist/webpack/server.mjs

@@ -4,11 +4,10 @@ function $importDefault(module) {
     }
     return module;
 }
-import { logError, NpmSnapFileNames, readJsonFile } from "@metamask/snaps-utils/node";
-import { createServer } from "http";
+import { NpmSnapFileNames, readJsonFile } from "@metamask/snaps-utils/node";
+import $express, { static as expressStatic } from "express/index.js";
+const express = $importDefault($express);
 import { join, relative, resolve as resolvePath, sep, posix } from "path";
-import $serveMiddleware from "serve-handler";
-const serveMiddleware = $importDefault($serveMiddleware);
 /**
  * Get the relative path from one path to another.
  *
@@ -46,6 +45,22 @@ export function getAllowedPaths(config, manifest) {
         ...otherFiles,
     ];
 }
+/**
+ * Get whether the request path is allowed. This is used to check if the request
+ * path is in the list of allowed paths for the static server.
+ *
+ * @param request - The request object.
+ * @param config - The config object.
+ * @returns A promise that resolves to `true` if the path is allowed, or
+ * `false` if it is not.
+ */
+async function isAllowedPath(request, config) {
+    const manifestPath = join(config.server.root, NpmSnapFileNames.Manifest);
+    const { result } = await readJsonFile(manifestPath);
+    const allowedPaths = getAllowedPaths(config, result);
+    const path = request.path.slice(1);
+    return allowedPaths.some((allowedPath) => path === allowedPath);
+}
 /**
  * Get a static server for development purposes.
  *
@@ -54,61 +69,38 @@ export function getAllowedPaths(config, manifest) {
  * difficult to customize.
  *
  * @param config - The config object.
+ * @param middleware - An array of middleware functions to run before serving
+ * the static files.
  * @returns An object with a `listen` method that returns a promise that
  * resolves when the server is listening.
  */
-export function getServer(config) {
-    /**
-     * Get the response for a request. This is extracted into a function so that
-     * we can easily catch errors and send a 500 response.
-     *
-     * @param request - The request.
-     * @param response - The response.
-     * @returns A promise that resolves when the response is sent.
-     */
-    async function getResponse(request, response) {
-        const manifestPath = join(config.server.root, NpmSnapFileNames.Manifest);
-        const { result } = await readJsonFile(manifestPath);
-        const allowedPaths = getAllowedPaths(config, result);
-        const pathname = request.url &&
-            request.headers.host &&
-            new URL(request.url, `http://${request.headers.host}`).pathname;
-        const path = pathname?.slice(1);
-        const allowed = allowedPaths.some((allowedPath) => path === allowedPath);
-        if (!allowed) {
-            response.statusCode = 404;
-            response.end();
-            return;
-        }
-        await serveMiddleware(request, response, {
-            public: config.server.root,
-            directoryListing: false,
-            headers: [
-                {
-                    source: '**/*',
-                    headers: [
-                        {
-                            key: 'Cache-Control',
-                            value: 'no-cache',
-                        },
-                        {
-                            key: 'Access-Control-Allow-Origin',
-                            value: '*',
-                        },
-                    ],
-                },
-            ],
-        });
-    }
-    const server = createServer((request, response) => {
-        getResponse(request, response).catch(
-        /* istanbul ignore next */
-        (error) => {
-            logError(error);
-            response.statusCode = 500;
+export function getServer(config, middleware = []) {
+    const app = express();
+    // Run "middleware" functions before serving the static files.
+    middleware.forEach((fn) => fn(app));
+    // Check for allowed paths in the request URL.
+    app.use((request, response, next) => {
+        isAllowedPath(request, config)
+            .then((allowed) => {
+            if (allowed) {
+                // eslint-disable-next-line promise/no-callback-in-promise
+                next();
+                return;
+            }
+            response.status(404);
             response.end();
-        });
+        })
+            // eslint-disable-next-line promise/no-callback-in-promise
+            .catch(next);
     });
+    // Serve the static files.
+    app.use(expressStatic(config.server.root, {
+        dotfiles: 'deny',
+        setHeaders: (res) => {
+            res.setHeader('Cache-Control', 'no-cache');
+            res.setHeader('Access-Control-Allow-Origin', '*');
+        },
+    }));
     /**
      * Start the server on the port specified in the config.
      *
@@ -120,25 +112,24 @@ export function getServer(config) {
      */
     const listen = async (port = config.server.port) => {
         return new Promise((resolve, reject) => {
-            try {
-                server.listen(port, () => {
-                    const close = async () => {
-                        await new Promise((resolveClose, rejectClose) => {
-                            server.close((closeError) => {
-                                if (closeError) {
-                                    return rejectClose(closeError);
-                                }
-                                return resolveClose();
-                            });
+            // eslint-disable-next-line consistent-return
+            const server = app.listen(port, (error) => {
+                if (error) {
+                    return reject(error);
+                }
+                const close = async () => {
+                    await new Promise((resolveClose, rejectClose) => {
+                        server.close((closeError) => {
+                            if (closeError) {
+                                return rejectClose(closeError);
+                            }
+                            return resolveClose();
                         });
-                    };
-                    const address = server.address();
-                    resolve({ port: address.port, server, close });
-                });
-            }
-            catch (listenError) {
-                reject(listenError);
-            }
+                    });
+                };
+                const address = server.address();
+                resolve({ port: address.port, server, close });
+            });
         });
     };
     return { listen };

package/dist/webpack/server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.mjs","sourceRoot":"","sources":["../../src/webpack/server.ts"],"names":[],"mappings":";;;;;;AACA,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACb,mCAAmC;AAEpC,OAAO,EAAE,YAAY,EAAE,aAAa;AAEpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa;AAC1E,OAAO,gBAAe,sBAAsB;;AAI5C;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,EAAU;IAC/C,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAuB,EACvB,QAAsB;IAEtB,MAAM,cAAc,GAClB,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CACtC,CACF,IAAI,EAAE,CAAC;IAEV,MAAM,iBAAiB,GACrB,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAC5C,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAC9C,CACF,IAAI,EAAE,CAAC;IAEV,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ;QACtD,CAAC,CAAC;YACE,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CACtC,CACF;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,MAAM,CAAC,MAAM,CAAC,QAAQ,CACvB,CACF;QACD,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAC3D;QACD,GAAG,cAAc;QACjB,GAAG,iBAAiB;QACpB,GAAG,UAAU;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C;;;;;;;OAOG;IACH,KAAK,UAAU,WAAW,CACxB,OAAwB,EACxB,QAAwB;QAExB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAe,YAAY,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAErD,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG;YACX,OAAO,CAAC,OAAO,CAAC,IAAI;YACpB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QAClE,MAAM,IAAI,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAEzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YAC1B,gBAAgB,EAAE,KAAK;YACvB,OAAO,EAAE;gBACP;oBACE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP;4BACE,GAAG,EAAE,eAAe;4BACpB,KAAK,EAAE,UAAU;yBAClB;wBACD;4BACE,GAAG,EAAE,6BAA6B;4BAClC,KAAK,EAAE,GAAG;yBACX;qBACF;iBACF;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK;QAClC,0BAA0B;QAC1B,CAAC,KAAK,EAAE,EAAE;YACR,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;QACjD,OAAO,IAAI,OAAO,CAIf,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;oBACvB,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;wBACvB,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;4BACpD,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;gCAC1B,IAAI,UAAU,EAAE,CAAC;oCACf,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;gCACjC,CAAC;gCAED,OAAO,YAAY,EAAE,CAAC;4BACxB,CAAC,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC;oBAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;oBAChD,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjD,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,CAAC,WAAW,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC","sourcesContent":["import type { SnapManifest } from '@metamask/snaps-utils';\nimport {\n  logError,\n  NpmSnapFileNames,\n  readJsonFile,\n} from '@metamask/snaps-utils/node';\nimport type { IncomingMessage, Server, ServerResponse } from 'http';\nimport { createServer } from 'http';\nimport type { AddressInfo } from 'net';\nimport { join, relative, resolve as resolvePath, sep, posix } from 'path';\nimport serveMiddleware from 'serve-handler';\n\nimport type { ProcessedConfig } from '../config';\n\n/**\n * Get the relative path from one path to another.\n *\n * Note: This is a modified version of `path.relative` that uses Posix\n * separators for URL-compatibility.\n *\n * @param from - The path to start from.\n * @param to - The path to end at.\n * @returns The relative path.\n */\nfunction getRelativePath(from: string, to: string) {\n  return relative(from, to).split(sep).join(posix.sep);\n}\n\n/**\n * Get the allowed paths for the static server. This includes the output file,\n * the manifest file, and any auxiliary/localization files.\n *\n * @param config - The config object.\n * @param manifest - The Snap manifest object.\n * @returns An array of allowed paths.\n */\nexport function getAllowedPaths(\n  config: ProcessedConfig,\n  manifest: SnapManifest,\n) {\n  const auxiliaryFiles =\n    manifest.source.files?.map((file) =>\n      getRelativePath(\n        config.server.root,\n        resolvePath(config.server.root, file),\n      ),\n    ) ?? [];\n\n  const localizationFiles =\n    manifest.source.locales?.map((localization) =>\n      getRelativePath(\n        config.server.root,\n        resolvePath(config.server.root, localization),\n      ),\n    ) ?? [];\n\n  const otherFiles = manifest.source.location.npm.iconPath\n    ? [\n        getRelativePath(\n          config.server.root,\n          resolvePath(\n            config.server.root,\n            manifest.source.location.npm.iconPath,\n          ),\n        ),\n      ]\n    : [];\n\n  return [\n    getRelativePath(\n      config.server.root,\n      resolvePath(\n        config.server.root,\n        config.output.path,\n        config.output.filename,\n      ),\n    ),\n    getRelativePath(\n      config.server.root,\n      resolvePath(config.server.root, NpmSnapFileNames.Manifest),\n    ),\n    ...auxiliaryFiles,\n    ...localizationFiles,\n    ...otherFiles,\n  ];\n}\n\n/**\n * Get a static server for development purposes.\n *\n * Note: We're intentionally not using `webpack-dev-server` here because it\n * adds a lot of extra stuff to the output that we don't need, and it's\n * difficult to customize.\n *\n * @param config - The config object.\n * @returns An object with a `listen` method that returns a promise that\n * resolves when the server is listening.\n */\nexport function getServer(config: ProcessedConfig) {\n  /**\n   * Get the response for a request. This is extracted into a function so that\n   * we can easily catch errors and send a 500 response.\n   *\n   * @param request - The request.\n   * @param response - The response.\n   * @returns A promise that resolves when the response is sent.\n   */\n  async function getResponse(\n    request: IncomingMessage,\n    response: ServerResponse,\n  ) {\n    const manifestPath = join(config.server.root, NpmSnapFileNames.Manifest);\n    const { result } = await readJsonFile<SnapManifest>(manifestPath);\n    const allowedPaths = getAllowedPaths(config, result);\n\n    const pathname =\n      request.url &&\n      request.headers.host &&\n      new URL(request.url, `http://${request.headers.host}`).pathname;\n    const path = pathname?.slice(1);\n    const allowed = allowedPaths.some((allowedPath) => path === allowedPath);\n\n    if (!allowed) {\n      response.statusCode = 404;\n      response.end();\n      return;\n    }\n\n    await serveMiddleware(request, response, {\n      public: config.server.root,\n      directoryListing: false,\n      headers: [\n        {\n          source: '**/*',\n          headers: [\n            {\n              key: 'Cache-Control',\n              value: 'no-cache',\n            },\n            {\n              key: 'Access-Control-Allow-Origin',\n              value: '*',\n            },\n          ],\n        },\n      ],\n    });\n  }\n\n  const server = createServer((request, response) => {\n    getResponse(request, response).catch(\n      /* istanbul ignore next */\n      (error) => {\n        logError(error);\n        response.statusCode = 500;\n        response.end();\n      },\n    );\n  });\n\n  /**\n   * Start the server on the port specified in the config.\n   *\n   * @param port - The port to listen on.\n   * @returns A promise that resolves when the server is listening. The promise\n   * resolves to an object with the port and the server instance. Note that if\n   * the `config.server.port` is `0`, the OS will choose a random port for us,\n   * so we need to get the port from the server after it starts.\n   */\n  const listen = async (port = config.server.port) => {\n    return new Promise<{\n      port: number;\n      server: Server;\n      close: () => Promise<void>;\n    }>((resolve, reject) => {\n      try {\n        server.listen(port, () => {\n          const close = async () => {\n            await new Promise<void>((resolveClose, rejectClose) => {\n              server.close((closeError) => {\n                if (closeError) {\n                  return rejectClose(closeError);\n                }\n\n                return resolveClose();\n              });\n            });\n          };\n\n          const address = server.address() as AddressInfo;\n          resolve({ port: address.port, server, close });\n        });\n      } catch (listenError) {\n        reject(listenError);\n      }\n    });\n  };\n\n  return { listen };\n}\n"]}
+{"version":3,"file":"server.mjs","sourceRoot":"","sources":["../../src/webpack/server.ts"],"names":[],"mappings":";;;;;;AACA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,mCAAmC;AAE5E,OAAO,UAAS,EAAE,MAAM,IAAI,aAAa,EAAE,yBAAgB;;AAG3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa;AAI1E;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,EAAU;IAC/C,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAuB,EACvB,QAAsB;IAEtB,MAAM,cAAc,GAClB,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CACtC,CACF,IAAI,EAAE,CAAC;IAEV,MAAM,iBAAiB,GACrB,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAC5C,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAC9C,CACF,IAAI,EAAE,CAAC;IAEV,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ;QACtD,CAAC,CAAC;YACE,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CACtC,CACF;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,MAAM,CAAC,MAAM,CAAC,QAAQ,CACvB,CACF;QACD,eAAe,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAC3D;QACD,GAAG,cAAc;QACjB,GAAG,iBAAiB;QACpB,GAAG,UAAU;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,MAAuB;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAe,YAAY,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;AAClE,CAAC;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CACvB,MAAuB,EACvB,aAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,8DAA8D;IAC9D,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpC,8CAA8C;IAC9C,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAClC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC;aAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,IAAI,OAAO,EAAE,CAAC;gBACZ,0DAA0D;gBAC1D,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC;YACF,0DAA0D;aACzD,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,GAAG,CAAC,GAAG,CACL,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;KACF,CAAC,CACH,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;QACjD,OAAO,IAAI,OAAO,CAIf,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrB,6CAA6C;YAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;gBACxC,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;gBAED,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;oBACvB,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;wBACpD,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;4BAC1B,IAAI,UAAU,EAAE,CAAC;gCACf,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;4BACjC,CAAC;4BAED,OAAO,YAAY,EAAE,CAAC;wBACxB,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC;gBAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;gBAChD,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC","sourcesContent":["import type { SnapManifest } from '@metamask/snaps-utils';\nimport { NpmSnapFileNames, readJsonFile } from '@metamask/snaps-utils/node';\nimport type { Express, Request } from 'express';\nimport express, { static as expressStatic } from 'express';\nimport type { Server } from 'http';\nimport type { AddressInfo } from 'net';\nimport { join, relative, resolve as resolvePath, sep, posix } from 'path';\n\nimport type { ProcessedConfig } from '../config';\n\n/**\n * Get the relative path from one path to another.\n *\n * Note: This is a modified version of `path.relative` that uses Posix\n * separators for URL-compatibility.\n *\n * @param from - The path to start from.\n * @param to - The path to end at.\n * @returns The relative path.\n */\nfunction getRelativePath(from: string, to: string) {\n  return relative(from, to).split(sep).join(posix.sep);\n}\n\n/**\n * Get the allowed paths for the static server. This includes the output file,\n * the manifest file, and any auxiliary/localization files.\n *\n * @param config - The config object.\n * @param manifest - The Snap manifest object.\n * @returns An array of allowed paths.\n */\nexport function getAllowedPaths(\n  config: ProcessedConfig,\n  manifest: SnapManifest,\n) {\n  const auxiliaryFiles =\n    manifest.source.files?.map((file) =>\n      getRelativePath(\n        config.server.root,\n        resolvePath(config.server.root, file),\n      ),\n    ) ?? [];\n\n  const localizationFiles =\n    manifest.source.locales?.map((localization) =>\n      getRelativePath(\n        config.server.root,\n        resolvePath(config.server.root, localization),\n      ),\n    ) ?? [];\n\n  const otherFiles = manifest.source.location.npm.iconPath\n    ? [\n        getRelativePath(\n          config.server.root,\n          resolvePath(\n            config.server.root,\n            manifest.source.location.npm.iconPath,\n          ),\n        ),\n      ]\n    : [];\n\n  return [\n    getRelativePath(\n      config.server.root,\n      resolvePath(\n        config.server.root,\n        config.output.path,\n        config.output.filename,\n      ),\n    ),\n    getRelativePath(\n      config.server.root,\n      resolvePath(config.server.root, NpmSnapFileNames.Manifest),\n    ),\n    ...auxiliaryFiles,\n    ...localizationFiles,\n    ...otherFiles,\n  ];\n}\n\n/**\n * Get whether the request path is allowed. This is used to check if the request\n * path is in the list of allowed paths for the static server.\n *\n * @param request - The request object.\n * @param config - The config object.\n * @returns A promise that resolves to `true` if the path is allowed, or\n * `false` if it is not.\n */\nasync function isAllowedPath(request: Request, config: ProcessedConfig) {\n  const manifestPath = join(config.server.root, NpmSnapFileNames.Manifest);\n  const { result } = await readJsonFile<SnapManifest>(manifestPath);\n  const allowedPaths = getAllowedPaths(config, result);\n\n  const path = request.path.slice(1);\n  return allowedPaths.some((allowedPath) => path === allowedPath);\n}\n\ntype Middleware = (app: Express) => void;\n\n/**\n * Get a static server for development purposes.\n *\n * Note: We're intentionally not using `webpack-dev-server` here because it\n * adds a lot of extra stuff to the output that we don't need, and it's\n * difficult to customize.\n *\n * @param config - The config object.\n * @param middleware - An array of middleware functions to run before serving\n * the static files.\n * @returns An object with a `listen` method that returns a promise that\n * resolves when the server is listening.\n */\nexport function getServer(\n  config: ProcessedConfig,\n  middleware: Middleware[] = [],\n) {\n  const app = express();\n\n  // Run \"middleware\" functions before serving the static files.\n  middleware.forEach((fn) => fn(app));\n\n  // Check for allowed paths in the request URL.\n  app.use((request, response, next) => {\n    isAllowedPath(request, config)\n      .then((allowed) => {\n        if (allowed) {\n          // eslint-disable-next-line promise/no-callback-in-promise\n          next();\n          return;\n        }\n\n        response.status(404);\n        response.end();\n      })\n      // eslint-disable-next-line promise/no-callback-in-promise\n      .catch(next);\n  });\n\n  // Serve the static files.\n  app.use(\n    expressStatic(config.server.root, {\n      dotfiles: 'deny',\n      setHeaders: (res) => {\n        res.setHeader('Cache-Control', 'no-cache');\n        res.setHeader('Access-Control-Allow-Origin', '*');\n      },\n    }),\n  );\n\n  /**\n   * Start the server on the port specified in the config.\n   *\n   * @param port - The port to listen on.\n   * @returns A promise that resolves when the server is listening. The promise\n   * resolves to an object with the port and the server instance. Note that if\n   * the `config.server.port` is `0`, the OS will choose a random port for us,\n   * so we need to get the port from the server after it starts.\n   */\n  const listen = async (port = config.server.port) => {\n    return new Promise<{\n      port: number;\n      server: Server;\n      close: () => Promise<void>;\n    }>((resolve, reject) => {\n      // eslint-disable-next-line consistent-return\n      const server = app.listen(port, (error) => {\n        if (error) {\n          return reject(error);\n        }\n\n        const close = async () => {\n          await new Promise<void>((resolveClose, rejectClose) => {\n            server.close((closeError) => {\n              if (closeError) {\n                return rejectClose(closeError);\n              }\n\n              return resolveClose();\n            });\n          });\n        };\n\n        const address = server.address() as AddressInfo;\n        resolve({ port: address.port, server, close });\n      });\n    });\n  };\n\n  return { listen };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask/snaps-cli",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "description": "A CLI for developing MetaMask Snaps",
   "keywords": [
     "MetaMask",
@@ -64,11 +64,12 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
+    "@metamask/snaps-sandbox": "^1.0.0",
     "@metamask/snaps-sdk": "^6.22.0",
     "@metamask/snaps-utils": "^9.2.0",
     "@metamask/snaps-webpack-plugin": "^4.2.1",
     "@metamask/superstruct": "^3.2.1",
-    "@metamask/utils": "^11.2.0",
+    "@metamask/utils": "^11.4.0",
     "@swc/core": "1.3.78",
     "assert": "^2.0.0",
     "browserify-zlib": "^0.2.0",
@@ -79,6 +80,7 @@
     "crypto-browserify": "^3.12.0",
     "domain-browser": "^4.22.0",
     "events": "^3.3.0",
+    "express": "^5.1.0",
     "fork-ts-checker-webpack-plugin": "^9.0.2",
     "https-browserify": "^1.0.0",
     "ora": "^5.4.1",
@@ -89,7 +91,6 @@
     "querystring-es3": "^0.2.1",
     "readable-stream": "^3.6.2",
     "semver": "^7.5.4",
-    "serve-handler": "^6.1.5",
     "stream-browserify": "^3.0.0",
     "stream-http": "^3.2.0",
     "string_decoder": "^1.3.0",
@@ -111,9 +112,9 @@
     "@metamask/auto-changelog": "^5.0.1",
     "@swc/jest": "^0.2.26",
     "@ts-bridge/cli": "^0.6.1",
+    "@types/express": "^5.0.1",
     "@types/jest": "^27.5.1",
     "@types/node": "18.14.2",
-    "@types/serve-handler": "^6.1.0",
     "@types/yargs": "^17.0.24",
     "cross-fetch": "^3.1.5",
     "deepmerge": "^4.2.2",