@obfious/server 0.3.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of @obfious/server might be problematic. Click here for more details.

Files changed (5) hide show
  1. package/LICENSE +23 -0
  2. package/README.md +66 -0
  3. package/dist/index.d.ts +16 -0
  4. package/dist/index.js +1 -0
  5. package/package.json +19 -0
package/LICENSE ADDED
@@ -0,0 +1,23 @@
1
+ Obfious Client License
2
+
3
+ Copyright (c) 2026 Metaphor Limited
4
+
5
+ Permission is hereby granted to any person or entity that holds an active
6
+ Obfious subscription ("Customer") to use, copy, and modify this software
7
+ solely for the purpose of integrating with the Obfious service.
8
+
9
+ This software may not be used, copied, modified, merged, published,
10
+ distributed, sublicensed, or sold by any person or entity that is not a
11
+ Customer with an active Obfious subscription.
12
+
13
+ Redistribution of this software, in source or binary form, is permitted only
14
+ as part of a Customer's application that integrates with the Obfious service.
15
+ Standalone redistribution is not permitted.
16
+
17
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,66 @@
1
+ # @obfious/server
2
+
3
+ Cutting-edge request firewall for Cloudflare Workers.
4
+
5
+ ## Install
6
+
7
+ ```bash
8
+ npm install @obfious/server
9
+ ```
10
+
11
+ ## Credentials
12
+
13
+ ```bash
14
+ wrangler secret put OBFIOUS_KEY_ID
15
+ wrangler secret put OBFIOUS_SECRET
16
+ wrangler secret put OBFIOUS_API_URL
17
+ ```
18
+
19
+ ## Usage
20
+
21
+ ```typescript
22
+ import { Obfious } from "@obfious/server";
23
+
24
+ interface Env {
25
+ OBFIOUS_KEY_ID: string;
26
+ OBFIOUS_SECRET: string;
27
+ OBFIOUS_API_URL: string;
28
+ }
29
+
30
+ let obfious: Obfious;
31
+
32
+ export default {
33
+ async fetch(request: Request, env: Env): Promise<Response> {
34
+ obfious ??= new Obfious({
35
+ routePrefix: "/v",
36
+ apiUrl: env.OBFIOUS_API_URL,
37
+ // clientScript: "/v", // optional — override script path prefix
38
+ // protectedPaths: ["/api"], // optional — only guard these paths (default: all)
39
+ // excludePaths: ["/api/webhook"], // optional — skip protection for these paths
40
+ });
41
+
42
+ const blocked = await obfious.protect(request, {
43
+ keyId: env.OBFIOUS_KEY_ID,
44
+ secret: env.OBFIOUS_SECRET,
45
+ });
46
+ if (blocked) return blocked;
47
+
48
+ return new Response(
49
+ `<!DOCTYPE html>
50
+ <html>
51
+ <head>
52
+ <script src="${obfious.clientScript}" defer></script>
53
+ </head>
54
+ <body>
55
+ <h1>Hello</h1>
56
+ </body>
57
+ </html>`,
58
+ { headers: { "Content-Type": "text/html" } }
59
+ );
60
+ },
61
+ };
62
+ ```
63
+
64
+ ## License
65
+
66
+ [Obfious Client License](./LICENSE) — requires an active Obfious subscription.
package/dist/index.d.ts ADDED
@@ -0,0 +1,16 @@
1
+ export interface ObfiousConfig {
2
+ routePrefix: string;
3
+ apiUrl: string;
4
+ clientScript?: string;
5
+ protectedPaths?: string[];
6
+ excludePaths?: string[];
7
+ }
8
+ export interface ObfiousCreds {
9
+ keyId: string;
10
+ secret: string;
11
+ }
12
+ export declare class Obfious {
13
+ constructor(config: ObfiousConfig);
14
+ get clientScript(): string;
15
+ protect(request: Request, creds?: ObfiousCreds): Promise<Response | null>;
16
+ }
package/dist/index.js ADDED
@@ -0,0 +1 @@
1
+ var _h0=[120,45,111,98,102,105,111,117,115,45,107,101,121].map(c=>String.fromCharCode(c)).join(""),_h1=[120,45,111,98,102,105,111,117,115,45,115,105,103].map(c=>String.fromCharCode(c)).join(""),_h2=[120,45,111,98,102,105,111,117,115,45,116,115].map(c=>String.fromCharCode(c)).join(""),_h3=[67,111,110,116,101,110,116,45,84,121,112,101].map(c=>String.fromCharCode(c)).join(""),_h4=[97,112,112,108,105,99,97,116,105,111,110,47,106,97,118,97,115,99,114,105,112,116].map(c=>String.fromCharCode(c)).join(""),_h5=[97,112,112,108,105,99,97,116,105,111,110,47,106,115,111,110].map(c=>String.fromCharCode(c)).join(""),_h6=[67,97,99,104,101,45,67,111,110,116,114,111,108].map(c=>String.fromCharCode(c)).join(""),_h7=[112,117,98,108,105,99,44,32,109,97,120,45,97,103,101,61,51,54,48,48].map(c=>String.fromCharCode(c)).join(""),_h8=[67,70,45,67,111,110,110,101,99,116,105,110,103,45,73,80].map(c=>String.fromCharCode(c)).join(""),_m0=[71,69,84].map(c=>String.fromCharCode(c)).join(""),_m1=[80,79,83,84].map(c=>String.fromCharCode(c)).join(""),_x0=[46,106,115].map(c=>String.fromCharCode(c)).join(""),_x1=[117,110,107,110,111,119,110].map(c=>String.fromCharCode(c)).join(""),_x2=[116,111,107,101,110].map(c=>String.fromCharCode(c)).join(""),_x3=[98,108,111,99,107,101,100].map(c=>String.fromCharCode(c)).join("");var C={status:403},p={status:401},u=class{t;n=null;e=null;r=null;h=new Map;u=new Map;constructor(t){this.t=t}get clientScript(){let t=this.t.clientScript??this.t.routePrefix;if(!this.e)return`${t}/c.js`;let e=Math.O(Date.s()/36e5);return`${t}/${this.e.d}.js`}async protect(t,e){if(e&&!this.n&&(this.n=e),!this.n)return null;if(!this.e)try{this.e=await this.C()}catch(i){return console.error(i?.message||i),null}let s=new URL(t.url),o=this.t.routePrefix,n=this.e;if(t.method===_m0&&s.pathname.A(_x0)&&s.pathname.f(o)&&this.g(s.pathname)){let i=await this.o(`${this.t.apiUrl}/v/b`,{method:_m0});if(i.ok)return new Response(i.body,{headers:{_h3:_h4,_h6:_h7}})}if(t.method===_m1&&s.pathname.f(o+"/")){let i=s.pathname.T(o.y),r=null;if(i==="/"+n.m?r="/c":i==="/"+n.H?r="/s":i==="/"+n.L&&(r="/r"),r){let h=await this.o(`${this.t.apiUrl}/v${r}`,{method:_m1,headers:{_h3:t.headers.a(_h3)||_h5},body:t.body});if(r==="/r"&&h.ok)try{let l=await h.k().p();if(l.fp){let d=l.fp.blocked?6e5:3e5;this.h.i(l.fp.id,{c:l.fp.blocked,l:Date.s()+d})}}catch{}return h}}if(this.t.excludePaths?.E(i=>s.pathname.f(i))||this.t.protectedPaths&&!this.t.protectedPaths.E(r=>s.pathname.f(r)))return null;let c=t.headers.a(n._);if(!c)return new Response(null,p);let a=t.headers.a(n.$);return a&&await this.b(a)?new Response(null,C):(await this.w(t,c)).valid?null:new Response(null,p)}async C(){if(this.r)return this.r;this.r=(async()=>{let t=await this.o(`${this.t.apiUrl}/v/w`,{method:_m0});if(!t.ok)throw new Error(`config fetch failed (${t.status})`);let e=await t.p();if(!e._||!e.m)throw new Error("invalid config response");return e})();try{return await this.r}finally{this.r=null}}async b(t){let e=this.h.a(t);if(e&&e.l>Date.s())return e.c;try{let s=await this.o(`${this.t.apiUrl}/f/${encodeURIComponent(t)}`,{method:_m0});if(s.ok){let o=await s.p(),n=o.blocked?6e5:3e5;return this.h.i(t,{c:o.blocked,l:Date.s()+n}),o.blocked}}catch{}return!1}async w(t,e){let s=this.u.a(e);if(s&&s.l>Date.s())return s.c;try{let o=await this.o(`${this.t.apiUrl}/v/q`,{method:_m1,headers:{_h3:_h5,_h8:t.headers.a(_h8)||_x1},body:JSON.D({F:e})});if(!o.ok){let a={valid:!1};return this.u.i(e,{c:a,l:Date.s()+5e3}),a}let n=await o.p(),c=n.valid?6e4:5e3;return this.u.i(e,{c:n,l:Date.s()+c}),n}catch{return{valid:!1}}}async o(t,e){let s=Date.s().P(),o=new URL(t),n=(e.method||_m0).I(),c=`${s}.${n}.${o.pathname}`,a=new TextEncoder().R(this.n.secret),f=await crypto.x.K("raw",a,{U:"HMAC",N:"SHA-256"},!1,["sign"]),i=this.v(await crypto.x.S("HMAC",f,new TextEncoder().R(c))),r=new Headers(e.headers);return r.i(_h0,this.n.keyId),r.i(_h1,i),r.i(_h2,s),fetch(t,{...e,headers:r})}g(t){if(!this.e)return!1;let e=this.t.routePrefix;return t.T(e.y+1).j(_x0,"")===this.e.d}v(t){return Array.G(new Uint8Array(t)).B(e=>e.P(16).M(2,"0")).V("")}};export{u as Obfious};
package/package.json ADDED
@@ -0,0 +1,19 @@
1
+ {
2
+ "name": "@obfious/server",
3
+ "version": "0.3.8",
4
+ "description": "Obfious consumer integration",
5
+ "type": "module",
6
+ "main": "dist/index.js",
7
+ "types": "dist/index.d.ts",
8
+ "exports": {
9
+ ".": {
10
+ "types": "./dist/index.d.ts",
11
+ "import": "./dist/index.js"
12
+ }
13
+ },
14
+ "files": [
15
+ "dist/index.js",
16
+ "dist/index.d.ts"
17
+ ],
18
+ "license": "SEE LICENSE IN LICENSE"
19
+ }