@neat.is/core 0.3.6 → 0.3.8

package/dist/index.cjs

@@ -40,6 +40,75 @@ var init_cjs_shims = __esm({
   }
 });
 
+// src/auth.ts
+function isLoopbackHost(host) {
+  if (!host) return false;
+  return LOOPBACK_HOSTS.has(host);
+}
+function assertBindAuthority(host, token) {
+  if (token && token.length > 0) return;
+  if (isLoopbackHost(host)) return;
+  throw new BindAuthorityError(host);
+}
+function mountBearerAuth(app, opts) {
+  if (!opts.token || opts.token.length === 0) return;
+  if (opts.trustProxy) return;
+  const expected = Buffer.from(opts.token, "utf8");
+  const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  app.addHook("preHandler", (req, reply, done) => {
+    const path37 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    for (const suffix of suffixes) {
+      if (path37 === suffix || path37.endsWith(suffix)) {
+        done();
+        return;
+      }
+    }
+    const header = req.headers.authorization;
+    if (typeof header !== "string" || !header.startsWith("Bearer ")) {
+      void reply.code(401).send({ error: "unauthorized" });
+      return;
+    }
+    const provided = Buffer.from(header.slice("Bearer ".length).trim(), "utf8");
+    if (provided.length !== expected.length || !(0, import_node_crypto.timingSafeEqual)(provided, expected)) {
+      void reply.code(401).send({ error: "unauthorized" });
+      return;
+    }
+    done();
+  });
+}
+function readAuthEnv(env = process.env) {
+  const t = env.NEAT_AUTH_TOKEN;
+  const ot = env.NEAT_OTEL_TOKEN;
+  return {
+    authToken: t && t.length > 0 ? t : void 0,
+    otelToken: ot && ot.length > 0 ? ot : t && t.length > 0 ? t : void 0,
+    trustProxy: env.NEAT_AUTH_PROXY === "true"
+  };
+}
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, DEFAULT_UNAUTH_SUFFIXES;
+var init_auth = __esm({
+  "src/auth.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_crypto = require("crypto");
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+      "127.0.0.1",
+      "localhost",
+      "::1",
+      "::ffff:127.0.0.1"
+    ]);
+    BindAuthorityError = class extends Error {
+      constructor(host) {
+        super(
+          `NEAT refuses to bind on a public interface without \`NEAT_AUTH_TOKEN\` set (host="${host}"). Set the token or bind to loopback only.`
+        );
+        this.name = "BindAuthorityError";
+      }
+    };
+    DEFAULT_UNAUTH_SUFFIXES = ["/health", "/healthz", "/readyz"];
+  }
+});
+
 // src/otel-grpc.ts
 var otel_grpc_exports = {};
 __export(otel_grpc_exports, {
@@ -122,8 +191,21 @@ function loadTraceService() {
 async function startOtelGrpcReceiver(opts) {
   const server = new grpc.Server();
   const service = loadTraceService();
+  const requiresAuth = !opts.trustProxy && !!opts.authToken && opts.authToken.length > 0;
+  const expectedHeader = requiresAuth ? `Bearer ${opts.authToken}` : "";
   server.addService(service, {
     Export: (call, callback) => {
+      if (requiresAuth) {
+        const meta = call.metadata.get("authorization");
+        const got = meta.length > 0 ? String(meta[0]) : "";
+        const a = Buffer.from(got, "utf8");
+        const b = Buffer.from(expectedHeader, "utf8");
+        const ok = a.length === b.length && (0, import_node_crypto2.timingSafeEqual)(a, b);
+        if (!ok) {
+          callback({ code: grpc.status.UNAUTHENTICATED, message: "unauthorized" });
+          return;
+        }
+      }
       void (async () => {
         try {
           const reshaped = reshapeGrpcRequest(call.request ?? {});
@@ -156,13 +238,14 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path34, grpc, protoLoader;
+var import_node_url, import_node_path34, import_node_crypto2, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
     import_node_path34 = __toESM(require("path"), 1);
+    import_node_crypto2 = require("crypto");
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
     init_otel();
@@ -257,8 +340,7 @@ function parseOtlpRequest(body) {
   }
   return out;
 }
-function loadProtobufDecoder() {
-  if (exportTraceServiceRequestType) return exportTraceServiceRequestType;
+function loadProtoRoot() {
   const here = import_node_path35.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
   const protoRoot = import_node_path35.default.resolve(here, "..", "proto");
   const root = new import_protobufjs.default.Root();
@@ -267,11 +349,32 @@ function loadProtobufDecoder() {
     "opentelemetry/proto/collector/trace/v1/trace_service.proto",
     { keepCase: true }
   );
+  return root;
+}
+function loadProtobufDecoder() {
+  if (exportTraceServiceRequestType) return exportTraceServiceRequestType;
+  const root = loadProtoRoot();
   exportTraceServiceRequestType = root.lookupType(
     "opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest"
   );
   return exportTraceServiceRequestType;
 }
+function loadProtobufResponseEncoder() {
+  if (exportTraceServiceResponseType) return exportTraceServiceResponseType;
+  const root = loadProtoRoot();
+  exportTraceServiceResponseType = root.lookupType(
+    "opentelemetry.proto.collector.trace.v1.ExportTraceServiceResponse"
+  );
+  return exportTraceServiceResponseType;
+}
+function encodeProtobufResponseBody() {
+  if (cachedProtobufResponseBody) return cachedProtobufResponseBody;
+  const Type = loadProtobufResponseEncoder();
+  const msg = Type.create({});
+  const encoded = Type.encode(msg).finish();
+  cachedProtobufResponseBody = Buffer.from(encoded);
+  return cachedProtobufResponseBody;
+}
 async function decodeProtobufBody(buf) {
   const Type = loadProtobufDecoder();
   const decoded = Type.decode(buf).toJSON();
@@ -283,6 +386,7 @@ async function buildOtelReceiver(opts) {
     logger: false,
     bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024
   });
+  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
   const queue = [];
   let draining = false;
   let drainPromise = Promise.resolve();
@@ -318,7 +422,9 @@ async function buildOtelReceiver(opts) {
   app.post("/v1/traces", async (req, reply) => {
     const ct = (req.headers["content-type"] ?? "").toString().split(";")[0].trim().toLowerCase();
     let body;
+    let responseFlavor;
     if (ct === "application/x-protobuf") {
+      responseFlavor = "protobuf";
       try {
         body = await decodeProtobufBody(req.body);
       } catch (err) {
@@ -327,6 +433,7 @@ async function buildOtelReceiver(opts) {
         });
       }
     } else if (!ct || ct === "application/json") {
+      responseFlavor = "json";
       body = req.body ?? {};
     } else {
       return reply.code(415).send({ error: `unsupported content-type: ${ct}` });
@@ -344,7 +451,11 @@ async function buildOtelReceiver(opts) {
       }
     }
     enqueue(spans);
-    return reply.code(200).send({ partialSuccess: {} });
+    if (responseFlavor === "protobuf") {
+      const buf = encodeProtobufResponseBody();
+      return reply.code(200).header("content-type", "application/x-protobuf").send(buf);
+    }
+    return reply.code(200).header("content-type", "application/json").send({ partialSuccess: {} });
   });
   const decorated = app;
   decorated.flushPending = async () => {
@@ -362,7 +473,7 @@ function logSpanHandler(span) {
     `otel: ${span.service} ${span.name} parent=${parent} status=${status2}${db}`
   );
 }
-var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType;
+var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
@@ -371,7 +482,10 @@ var init_otel = __esm({
     import_node_url2 = require("url");
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
+    init_auth();
     exportTraceServiceRequestType = null;
+    exportTraceServiceResponseType = null;
+    cachedProtobufResponseBody = null;
   }
 });
 
@@ -4814,6 +4928,7 @@ data: ${JSON.stringify(envelope.payload)}
 }
 
 // src/api.ts
+init_auth();
 function serializeGraph(graph) {
   const nodes = [];
   graph.forEachNode((_id, attrs) => {
@@ -5179,6 +5294,7 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = (0, import_fastify.default)({ logger: false });
   await app.register(import_cors.default, { origin: true });
+  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -5249,6 +5365,7 @@ init_cjs_shims();
 var import_node_fs21 = require("fs");
 var import_node_path36 = __toESM(require("path"), 1);
 init_otel();
+init_auth();
 function neatHomeFor(opts) {
   if (opts.neatHome && opts.neatHome.length > 0) return import_node_path36.default.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
@@ -5259,13 +5376,35 @@ function neatHomeFor(opts) {
 function routeSpanToProject(serviceName, projects) {
   if (!serviceName) return DEFAULT_PROJECT;
   for (const entry of projects) {
-    if (entry.status !== "active") continue;
-    if (entry.languages.length === 0) {
-    }
+    if (entry.status === "paused") continue;
     if (entry.name === serviceName) return entry.name;
   }
+  const candidates = [];
+  for (const entry of projects) {
+    if (entry.status === "paused") continue;
+    if (isTokenPrefix(entry.name, serviceName)) candidates.push(entry);
+  }
+  if (candidates.length > 0) {
+    candidates.sort((a, b) => b.name.length - a.name.length);
+    return candidates[0].name;
+  }
+  for (const entry of projects) {
+    if (entry.status === "paused") continue;
+    if (isTokenContained(entry.name, serviceName)) return entry.name;
+  }
   return DEFAULT_PROJECT;
 }
+function isTokenPrefix(prefix, full) {
+  if (prefix.length >= full.length) return false;
+  if (!full.startsWith(prefix)) return false;
+  const sep = full.charAt(prefix.length);
+  return sep === "-" || sep === "_";
+}
+function isTokenContained(needle, haystack) {
+  if (!haystack.includes(needle)) return false;
+  const tokens = haystack.split(/[-_]/);
+  return tokens.includes(needle);
+}
 async function bootstrapProject(entry) {
   const paths = pathsForProject(entry.name, import_node_path36.default.join(entry.path, "neat-out"));
   try {
@@ -5345,6 +5484,17 @@ async function startDaemon(opts = {}) {
 `);
   const slots = /* @__PURE__ */ new Map();
   const registry = new Projects();
+  const DROP_WARN_INTERVAL_MS = 6e4;
+  const lastDropWarnAt = /* @__PURE__ */ new Map();
+  function warnDroppedSpan(project, reason) {
+    const now = Date.now();
+    const prev = lastDropWarnAt.get(project) ?? 0;
+    if (now - prev < DROP_WARN_INTERVAL_MS) return;
+    lastDropWarnAt.set(project, now);
+    console.warn(
+      `[neatd] dropping span for project "${project}" \u2014 project status: broken (${reason}). Run \`neatd reload\` to retry bootstrap.`
+    );
+  }
   function upsertRegistryFromSlot(slot) {
     if (slot.status !== "active") return;
     registry.set(slot.entry.name, {
@@ -5353,12 +5503,38 @@ async function startDaemon(opts = {}) {
       graph: slot.graph
     });
   }
+  async function tryRecoverSlot(entry) {
+    try {
+      const fresh = await bootstrapProject(entry);
+      slots.set(entry.name, fresh);
+      upsertRegistryFromSlot(fresh);
+      if (fresh.status === "active") {
+        await setStatus(entry.name, "active").catch(() => {
+        });
+        console.log(
+          `neatd: project "${entry.name}" recovered from broken \u2014 active`
+        );
+      }
+      return fresh;
+    } catch (err) {
+      console.warn(
+        `neatd: project "${entry.name}" still broken after recovery attempt \u2014 ${err.message}`
+      );
+      return slots.get(entry.name);
+    }
+  }
   async function loadAll() {
     const projects = await listProjects();
     const seen = /* @__PURE__ */ new Set();
     for (const entry of projects) {
       seen.add(entry.name);
-      if (slots.has(entry.name)) continue;
+      const existing = slots.get(entry.name);
+      if (existing) {
+        if (existing.status === "broken") {
+          await tryRecoverSlot(entry);
+        }
+        continue;
+      }
       try {
         const slot = await bootstrapProject(entry);
         slots.set(entry.name, slot);
@@ -5396,8 +5572,14 @@ async function startDaemon(opts = {}) {
     const host = resolveHost(opts);
     const restPort = resolveRestPort(opts);
     const otlpPort = resolveOtlpPort(opts);
+    const auth = readAuthEnv();
+    assertBindAuthority(host, auth.authToken);
     try {
-      restApp = await buildApi({ projects: registry });
+      restApp = await buildApi({
+        projects: registry,
+        authToken: auth.authToken,
+        trustProxy: auth.trustProxy
+      });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(`neatd: REST listening on ${restAddress}`);
     } catch (err) {
@@ -5415,13 +5597,30 @@ async function startDaemon(opts = {}) {
         `neatd: failed to bind REST on port ${restPort} \u2014 ${err.message}`
       );
     }
+    async function resolveTargetSlot(serviceName) {
+      const liveEntries = await listProjects().catch(() => []);
+      const target = routeSpanToProject(serviceName, liveEntries);
+      let slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
+      if (!slot) return null;
+      if (slot.status === "broken") {
+        const entry = liveEntries.find((e) => e.name === slot.entry.name);
+        if (entry) {
+          slot = await tryRecoverSlot(entry);
+        }
+        if (slot.status !== "active") {
+          warnDroppedSpan(slot.entry.name, slot.errorReason ?? "unknown");
+          return null;
+        }
+      }
+      return slot.status === "active" ? slot : null;
+    }
     try {
       otlpApp = await buildOtelReceiver({
+        authToken: auth.otelToken,
+        trustProxy: auth.trustProxy,
         onSpan: async (span) => {
-          const liveEntries = await listProjects().catch(() => []);
-          const target = routeSpanToProject(span.service, liveEntries);
-          const slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
-          if (!slot || slot.status !== "active") return;
+          const slot = await resolveTargetSlot(span.service);
+          if (!slot) return;
           await handleSpan(
             {
               graph: slot.graph,
@@ -5434,10 +5633,8 @@ async function startDaemon(opts = {}) {
           );
         },
         onErrorSpanSync: async (span) => {
-          const liveEntries = await listProjects().catch(() => []);
-          const target = routeSpanToProject(span.service, liveEntries);
-          const slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
-          if (!slot || slot.status !== "active") return;
+          const slot = await resolveTargetSlot(span.service);
+          if (!slot) return;
           await makeErrorSpanWriter(slot.paths.errorsPath)(span);
         }
       });