@noresponse/node 1.0.1 → 2.0.0

package/dist/index.js

@@ -1,244 +0,0 @@
-export { verifyWebhook, webhookAssessment, webhookVerificationResponse } from "./webhooks.js";
-export { fromAuth0, fromClerk, fromOIDC, fromWorkOS } from "./auth.js";
-const LOOKUP_IDENTIFIERS = ["email", "username", "phone"];
-const MATCH_IDENTIFIERS = ["name", "ip"];
-const IDEMPOTENCY = /^[A-Za-z0-9._:-]{16,128}$/;
-const ASSESSMENT_ID = /^asm_[0-9A-HJKMNP-TV-Z]{26}$/;
-const OUTCOMES = ["confirmed_abuse", "account_takeover", "chargeback", "false_positive", "legitimate", "unknown"];
-const EXTERNAL_REF = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
-const RFC3339 = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?(?:Z|[+-][0-9]{2}:[0-9]{2})$/;
-export class NoResponseError extends Error {
-    status;
-    type;
-    code;
-    detail;
-    requestId;
-    retryAfter;
-    retryable;
-    constructor(status, message, type, code, detail, metadata = {}) {
-        super(message);
-        this.status = status;
-        this.type = type;
-        this.code = code;
-        this.detail = detail;
-        this.name = "NoResponseError";
-        this.requestId = metadata.requestId;
-        this.retryAfter = metadata.retryAfter;
-        this.retryable = status === 429 || status === 503;
-    }
-}
-export class NoResponse {
-    config;
-    baseUrl;
-    constructor(config) {
-        this.config = config;
-        if (!config.apiKey)
-            throw new Error("NoResponse API key required");
-        if (config.timeoutMs !== undefined && (!Number.isInteger(config.timeoutMs) || config.timeoutMs <= 0)) {
-            throw new Error("timeoutMs must be a positive integer");
-        }
-        if (config.maxRetries !== undefined && (!Number.isInteger(config.maxRetries) || config.maxRetries < 0)) {
-            throw new Error("maxRetries must be a non-negative integer");
-        }
-        if (config.retryBaseDelayMs !== undefined && (!Number.isInteger(config.retryBaseDelayMs) || config.retryBaseDelayMs < 0)) {
-            throw new Error("retryBaseDelayMs must be a non-negative integer");
-        }
-        const url = new URL(config.baseUrl);
-        if (url.search || url.hash || /[?#]$/.test(config.baseUrl))
-            throw new Error("baseUrl must not include a query or fragment");
-        if (url.protocol !== "https:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
-            throw new Error("NoResponse requires HTTPS outside localhost");
-        }
-        this.baseUrl = url.toString().replace(/\/$/, "");
-    }
-    async assess(input) {
-        const identifiers = {};
-        for (const key of LOOKUP_IDENTIFIERS)
-            if (input[key] !== undefined)
-                identifiers[key] = input[key];
-        if (!Object.keys(identifiers).length)
-            throw new Error("At least one of email, username or phone required");
-        for (const key of MATCH_IDENTIFIERS)
-            if (input[key] !== undefined)
-                identifiers[key] = input[key];
-        if (input.name !== undefined && (input.name.length < 1 || input.name.length > 128))
-            throw new Error("name must be 1-128 characters");
-        if (!IDEMPOTENCY.test(input.idempotencyKey))
-            throw new Error("Valid 16-128 character idempotencyKey required");
-        if (input.deadlineMs !== undefined && (!Number.isInteger(input.deadlineMs) || input.deadlineMs < 50 || input.deadlineMs > 500)) {
-            throw new Error("deadlineMs must be 50–500");
-        }
-        if (input.region !== undefined && !/^[A-Z]{2}$/.test(input.region))
-            throw new Error("region must be an uppercase ISO alpha-2 code");
-        if (input.responseMode !== undefined && input.responseMode !== "standard" && input.responseMode !== "detailed") {
-            throw new Error("responseMode must be standard or detailed; raw is never served");
-        }
-        const body = { account_id: input.accountId, identifiers: identifiers };
-        if (input.requestId !== undefined)
-            body.request_id = input.requestId;
-        if (input.deadlineMs !== undefined)
-            body.deadline_ms = input.deadlineMs;
-        if (input.flow !== undefined || input.region !== undefined) {
-            body.policy_context = { flow: input.flow ?? "signup", ...(input.region !== undefined ? { region: input.region } : {}) };
-        }
-        if (input.responseMode !== undefined)
-            body.response_mode = input.responseMode;
-        if (input.clientContext !== undefined)
-            body.client_context = input.clientContext;
-        if (input.authContext !== undefined)
-            body.auth_context = input.authContext;
-        return this.request("/v1/assessments", {
-            method: "POST", body: JSON.stringify(body), headers: { "Idempotency-Key": input.idempotencyKey },
-        });
-    }
-    async getAssessment(assessmentId, options = {}) {
-        if (!ASSESSMENT_ID.test(assessmentId))
-            throw new Error("Invalid assessment ID");
-        this.validateMode(options.responseMode);
-        const suffix = options.responseMode ? `?response_mode=${options.responseMode}` : "";
-        return this.request(`/v1/assessments/${assessmentId}${suffix}`, { method: "GET" });
-    }
-    async getAssessmentWithHeaders(assessmentId, options = {}) {
-        if (!ASSESSMENT_ID.test(assessmentId))
-            throw new Error("Invalid assessment ID");
-        this.validateMode(options.responseMode);
-        const suffix = options.responseMode ? `?response_mode=${options.responseMode}` : "";
-        let retryAfter;
-        const assessment = await this.request(`/v1/assessments/${assessmentId}${suffix}`, {
-            method: "GET",
-            onResponse: (headers) => { retryAfter = parseRetryAfter(headers.get("Retry-After")); },
-        });
-        return { assessment, retryAfter };
-    }
-    async waitForAssessment(assessmentId, options = {}) {
-        const timeoutMs = options.timeoutMs ?? 30_000;
-        if (!Number.isInteger(timeoutMs) || timeoutMs <= 0)
-            throw new Error("wait timeoutMs must be a positive integer");
-        const deadline = Date.now() + timeoutMs;
-        for (;;) {
-            const { assessment, retryAfter } = await this.getAssessmentWithHeaders(assessmentId, options);
-            if (assessment.status !== "pending")
-                return assessment;
-            const remaining = deadline - Date.now();
-            if (remaining <= 0)
-                throw new Error("Timed out waiting for assessment");
-            const delay = retryAfter === undefined ? 500 : retryAfter * 1000;
-            await new Promise((resolve) => setTimeout(resolve, Math.min(delay, remaining)));
-        }
-    }
-    async queryAssessments(query) {
-        if (!query.account_id || (query.limit !== undefined && (!Number.isInteger(query.limit) || query.limit < 1 || query.limit > 50))) {
-            throw new Error("Invalid assessment query");
-        }
-        if (query.responseMode !== undefined && query.response_mode !== undefined)
-            throw new Error("Supply only one response mode");
-        const mode = query.responseMode ?? query.response_mode;
-        this.validateMode(mode);
-        const body = { account_id: query.account_id };
-        if (query.limit !== undefined)
-            body.limit = query.limit;
-        if (query.cursor !== undefined)
-            body.cursor = query.cursor;
-        if (mode !== undefined)
-            body.response_mode = mode;
-        return this.request("/v1/assessments/query", { method: "POST", body: JSON.stringify(body) });
-    }
-    /**
-     * Report what was later learned about an assessed account. confirmed_abuse, account_takeover and
-     * chargeback report abuse; false_positive and legitimate withdraw this tenant's earlier report;
-     * unknown is recorded only. A retry with the same idempotencyKey and body answers the same record.
-     */
-    async recordOutcome(assessmentId, input) {
-        if (!ASSESSMENT_ID.test(assessmentId))
-            throw new Error("Invalid assessment ID");
-        if (!OUTCOMES.includes(input.outcome))
-            throw new Error(`outcome must be one of ${OUTCOMES.join(", ")}`);
-        if (!IDEMPOTENCY.test(input.idempotencyKey))
-            throw new Error("Valid 16-128 character idempotencyKey required");
-        if (input.observedAt !== undefined && !RFC3339.test(input.observedAt))
-            throw new Error("observedAt must be an RFC 3339 time");
-        if (input.externalRef !== undefined && !EXTERNAL_REF.test(input.externalRef))
-            throw new Error("externalRef must be 1-128 safe characters");
-        if (input.notes !== undefined && (input.notes.length < 1 || [...input.notes].length > 500))
-            throw new Error("notes must be 1-500 characters");
-        const body = { outcome: input.outcome };
-        if (input.observedAt !== undefined)
-            body.observed_at = input.observedAt;
-        if (input.externalRef !== undefined)
-            body.external_ref = input.externalRef;
-        if (input.notes !== undefined)
-            body.notes = input.notes;
-        return this.request(`/v1/assessments/${assessmentId}/outcomes`, {
-            method: "POST", body: JSON.stringify(body), headers: { "Idempotency-Key": input.idempotencyKey },
-        });
-    }
-    validateMode(mode) {
-        if (mode !== undefined && mode !== "standard" && mode !== "detailed")
-            throw new Error("responseMode must be standard or detailed; raw is never served");
-    }
-    async request(path, options) {
-        const transport = this.config.fetch ?? fetch;
-        const maxRetries = this.config.maxRetries ?? 2;
-        const baseDelay = this.config.retryBaseDelayMs ?? 100;
-        let lastError;
-        for (let attempt = 0; attempt <= maxRetries; attempt++) {
-            let response;
-            try {
-                response = await transport(this.baseUrl + path, {
-                    method: options.method,
-                    headers: {
-                        Authorization: `Bearer ${this.config.apiKey}`,
-                        Accept: "application/json",
-                        ...(options.body ? { "Content-Type": "application/json" } : {}),
-                        ...options.headers,
-                    },
-                    body: options.body,
-                    signal: AbortSignal.timeout(this.config.timeoutMs ?? 5000),
-                });
-            }
-            catch (error) {
-                lastError = error;
-                if (attempt >= maxRetries)
-                    throw error;
-                await this.waitForRetry(attempt, undefined, baseDelay);
-                continue;
-            }
-            if (!response.ok) {
-                let problem = {};
-                try {
-                    const parsed = await response.json();
-                    if (parsed !== null && typeof parsed === "object") {
-                        const body = parsed;
-                        problem = {
-                            ...(typeof body.type === "string" ? { type: body.type } : {}),
-                            ...(typeof body.code === "string" ? { code: body.code } : {}),
-                            ...(typeof body.detail === "string" ? { detail: body.detail } : {}),
-                            ...(typeof body.request_id === "string" ? { request_id: body.request_id } : {}),
-                        };
-                    }
-                }
-                catch { /* preserve the typed error for malformed bodies */ }
-                const retryAfter = parseRetryAfter(response.headers.get("Retry-After"));
-                const error = new NoResponseError(response.status, `NoResponse request failed (HTTP ${response.status})`, problem.type, problem.code, problem.detail, { requestId: problem.request_id ?? response.headers.get("X-Request-ID") ?? undefined, retryAfter });
-                lastError = error;
-                if (attempt < maxRetries && error.retryable) {
-                    await this.waitForRetry(attempt, retryAfter, baseDelay);
-                    continue;
-                }
-                throw error;
-            }
-            options.onResponse?.(response.headers);
-            return response.json();
-        }
-        throw lastError instanceof Error ? lastError : new Error("NoResponse request failed");
-    }
-    async waitForRetry(attempt, retryAfter, baseDelay) {
-        const delay = retryAfter !== undefined ? retryAfter * 1000 : baseDelay * (2 ** Math.min(attempt, 6));
-        await new Promise((resolve) => setTimeout(resolve, delay));
-    }
-}
-function parseRetryAfter(value) {
-    if (!value || !/^[1-9][0-9]{0,3}$/.test(value))
-        return undefined;
-    return Number(value);
-}

package/dist/webhooks.d.ts

@@ -1,17 +0,0 @@
-import type { Assessment, WebhookEvent } from "./generated/models.js";
-/**
- * Verify a delivery against the raw request bytes and return the typed event.
- * Header pairs retain duplicates, so a repeated or case-variant header is refused.
- * For assessment.updated, `data` is the assessment exactly as GET returns it;
- * webhookAssessment(event) returns it as a typed Assessment.
- */
-export declare function verifyWebhook(rawBody: Uint8Array, headerPairs: ReadonlyArray<readonly [string, string]>, secrets: Readonly<Record<string, string | Uint8Array>>, nowSeconds?: number): WebhookEvent;
-/**
- * The typed assessment carried by a verified assessment.updated event. Throws for
- * any other event, and for data that is not a full assessment (for example an
- * expiry notice or a pre-v1 pointer payload).
- */
-export declare function webhookAssessment(event: WebhookEvent): Assessment;
-export declare function webhookVerificationResponse(event: WebhookEvent): {
-    challenge: string;
-};

package/dist/webhooks.js

@@ -1,87 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-const EVENT_TYPES = new Set(["assessment.updated", "endpoint.verification"]);
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/** The envelope fields, read from the v1 names (id, type) or the earlier event_id/event_type. */
-function envelope(event) {
-    const body = isRecord(event) ? event : {};
-    return { id: body.id ?? body.event_id, type: body.type ?? body.event_type, data: body.data };
-}
-/**
- * Verify a delivery against the raw request bytes and return the typed event.
- * Header pairs retain duplicates, so a repeated or case-variant header is refused.
- * For assessment.updated, `data` is the assessment exactly as GET returns it;
- * webhookAssessment(event) returns it as a typed Assessment.
- */
-export function verifyWebhook(rawBody, headerPairs, secrets, nowSeconds = Math.floor(Date.now() / 1000)) {
-    const required = ["nr-webhook-id", "nr-webhook-timestamp", "nr-webhook-key-id", "nr-webhook-signature"];
-    const headers = new Map();
-    for (const [key, value] of headerPairs) {
-        const name = key.toLowerCase();
-        if (!required.includes(name))
-            continue;
-        if (headers.has(name))
-            throw new Error("Duplicate webhook header");
-        headers.set(name, value);
-    }
-    if (required.some(name => !headers.get(name)))
-        throw new Error("Missing webhook header");
-    const timestamp = headers.get("nr-webhook-timestamp");
-    if (!/^[0-9]{1,12}$/.test(timestamp) || Math.abs(nowSeconds - Number(timestamp)) > 300) {
-        throw new Error("Invalid webhook timestamp");
-    }
-    const keyId = headers.get("nr-webhook-key-id");
-    if (!/^whk_[A-Za-z0-9]{8,64}$/.test(keyId) || !Object.prototype.hasOwnProperty.call(secrets, keyId)) {
-        throw new Error("Unknown webhook key");
-    }
-    const signature = headers.get("nr-webhook-signature");
-    if (!/^v1=[0-9a-f]{64}$/.test(signature))
-        throw new Error("Malformed webhook signature");
-    const expected = createHmac("sha256", secrets[keyId]).update(timestamp).update(".").update(rawBody).digest();
-    if (!timingSafeEqual(expected, Buffer.from(signature.slice(3), "hex")))
-        throw new Error("Invalid webhook signature");
-    let event;
-    try {
-        event = JSON.parse(Buffer.from(rawBody).toString("utf8"));
-    }
-    catch {
-        throw new Error("Invalid webhook JSON");
-    }
-    const { id, type } = envelope(event);
-    if (!isRecord(event) || id !== headers.get("nr-webhook-id")) {
-        throw new Error("Webhook event ID mismatch");
-    }
-    if (typeof type !== "string" || !EVENT_TYPES.has(type)) {
-        throw new Error("Unknown webhook event");
-    }
-    return event;
-}
-/**
- * The typed assessment carried by a verified assessment.updated event. Throws for
- * any other event, and for data that is not a full assessment (for example an
- * expiry notice or a pre-v1 pointer payload).
- */
-export function webhookAssessment(event) {
-    const { type, data } = envelope(event);
-    if (type !== "assessment.updated")
-        throw new Error("Not an assessment event");
-    if (!isRecord(data) ||
-        typeof data.assessment_id !== "string" ||
-        typeof data.assessment_version !== "number" ||
-        typeof data.status !== "string" ||
-        typeof data.created_at !== "string" ||
-        !Array.isArray(data.incomplete_sources) ||
-        !isRecord(data.timing)) {
-        throw new Error("Webhook data is not a full assessment");
-    }
-    return data;
-}
-export function webhookVerificationResponse(event) {
-    const { type, data } = envelope(event);
-    const challenge = isRecord(data) ? data.challenge : undefined;
-    if (type !== "endpoint.verification" || typeof challenge !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(challenge)) {
-        throw new Error("Invalid endpoint verification event");
-    }
-    return { challenge };
-}