@patchstack/connect 0.3.19 → 0.3.20

package/dist/protect/templates/express-guard.cjs

@@ -10,7 +10,11 @@ async function getProtection() {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
     const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true };
+    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+    // rules periodically — a dependency flagged after boot is then enforced without a restart.
+    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+    const common = { mode, egress: true, refreshMs };
     protection = await createProtection(
       siteUuid
         ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }

package/dist/protect/templates/express-guard.js

@@ -11,7 +11,11 @@ async function getProtection() {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
     const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true };
+    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+    // rules periodically — a dependency flagged after boot is then enforced without a restart.
+    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+    const common = { mode, egress: true, refreshMs };
     protection = await createProtection(
       siteUuid
         ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }

package/dist/protect/templates/express-guard.ts

@@ -11,7 +11,11 @@ async function getProtection() {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
     const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true } as const;
+    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+    // rules periodically — a dependency flagged after boot is then enforced without a restart.
+    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+    const common = { mode, egress: true, refreshMs } as const;
     _protection = await createProtection(
       siteUuid
         ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }

package/dist/protect/templates/fastify-plugin.cjs

@@ -0,0 +1,46 @@
+// Patchstack runtime guard for CommonJS Fastify apps. Managed by `patchstack-connect protect`.
+// Register once: app.register(patchstackFastify)
+const { createProtection } = require("@patchstack/connect/protect");
+const fallbackRules = require("./rules.json");
+
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+let protection;
+
+async function getProtection() {
+  if (!protection) {
+    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+    const token = process.env.PATCHSTACK_WAF_TOKEN;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+    const common = { mode, egress: true };
+    protection = await createProtection(
+      siteUuid
+        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+        : token
+          ? { ...common, token, cacheDir: ".patchstack" }
+          : { ...common, rules: fallbackRules },
+    );
+  }
+  return protection;
+}
+
+async function patchstackFastify(fastify) {
+  const protection = await getProtection();
+  const guard = protection.fetchGuard();
+  fastify.addHook("preHandler", async (request, reply) => {
+    const method = (request.method ?? "GET").toUpperCase();
+    const host = request.headers?.host ?? "localhost";
+    const url = `http://${host}${request.url ?? "/"}`;
+    const hasBody = method !== "GET" && method !== "HEAD" && request.body != null;
+    const body = hasBody ? (typeof request.body === "string" ? request.body : JSON.stringify(request.body)) : undefined;
+    const blocked = await guard(new Request(url, { method, headers: request.headers, body }));
+    if (blocked) {
+      const contentType = blocked.headers.get("content-type");
+      reply.code(blocked.status);
+      if (contentType) reply.header("content-type", contentType);
+      reply.send(await blocked.text());
+      return reply;
+    }
+  });
+}
+
+module.exports = { patchstackFastify };

package/dist/protect/templates/fastify-plugin.js

@@ -0,0 +1,45 @@
+// Patchstack runtime guard for ESM Fastify apps. Managed by `patchstack-connect protect`.
+// Register once: app.register(patchstackFastify)
+import { readFileSync } from "node:fs";
+import { createProtection } from "@patchstack/connect/protect";
+
+const fallbackRules = JSON.parse(readFileSync(new URL("./rules.json", import.meta.url), "utf8"));
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+let protection;
+
+async function getProtection() {
+  if (!protection) {
+    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+    const token = process.env.PATCHSTACK_WAF_TOKEN;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+    const common = { mode, egress: true };
+    protection = await createProtection(
+      siteUuid
+        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+        : token
+          ? { ...common, token, cacheDir: ".patchstack" }
+          : { ...common, rules: fallbackRules },
+    );
+  }
+  return protection;
+}
+
+export async function patchstackFastify(fastify) {
+  const protection = await getProtection();
+  const guard = protection.fetchGuard();
+  fastify.addHook("preHandler", async (request, reply) => {
+    const method = (request.method ?? "GET").toUpperCase();
+    const host = request.headers?.host ?? "localhost";
+    const url = `http://${host}${request.url ?? "/"}`;
+    const hasBody = method !== "GET" && method !== "HEAD" && request.body != null;
+    const body = hasBody ? (typeof request.body === "string" ? request.body : JSON.stringify(request.body)) : undefined;
+    const blocked = await guard(new Request(url, { method, headers: request.headers, body }));
+    if (blocked) {
+      const contentType = blocked.headers.get("content-type");
+      reply.code(blocked.status);
+      if (contentType) reply.header("content-type", contentType);
+      reply.send(await blocked.text());
+      return reply;
+    }
+  });
+}

package/dist/protect/templates/generic-guard.cjs

@@ -0,0 +1,41 @@
+// Patchstack runtime protection — GENERIC guard (CommonJS). Managed by `patchstack-connect protect`.
+// Wire whichever helper fits your server into your request path, then run `protect --check`.
+const { createProtection } = require("@patchstack/connect/protect");
+const fallbackRules = require("./rules.json");
+
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+let protection;
+
+async function getProtection() {
+  if (!protection) {
+    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+    const token = process.env.PATCHSTACK_WAF_TOKEN;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+    const common = { mode, egress: true };
+    protection = await createProtection(
+      siteUuid
+        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+        : token
+          ? { ...common, token, cacheDir: ".patchstack" }
+          : { ...common, rules: fallbackRules },
+    );
+  }
+  return protection;
+}
+
+function protectFetch(handler) {
+  return async (request, ...rest) => {
+    const active = await getProtection();
+    const blocked = await active.fetchGuard()(request);
+    if (blocked) return blocked;
+    return active.screenResponse(await handler(request, ...rest));
+  };
+}
+
+function patchstackMiddleware(req, res, next) {
+  getProtection()
+    .then((active) => active.node()(req, res, next))
+    .catch(() => next()); // fail open
+}
+
+module.exports = { getProtection, protectFetch, patchstackMiddleware };

package/dist/protect/templates/generic-guard.js

@@ -0,0 +1,42 @@
+// Patchstack runtime protection — GENERIC guard (ESM). Managed by `patchstack-connect protect`.
+// Wire whichever helper fits your server into your request path, then run `protect --check`.
+import { readFileSync } from "node:fs";
+import { createProtection } from "@patchstack/connect/protect";
+
+const fallbackRules = JSON.parse(readFileSync(new URL("./rules.json", import.meta.url), "utf8"));
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+let protection;
+
+export async function getProtection() {
+  if (!protection) {
+    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+    const token = process.env.PATCHSTACK_WAF_TOKEN;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+    const common = { mode, egress: true };
+    protection = await createProtection(
+      siteUuid
+        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+        : token
+          ? { ...common, token, cacheDir: ".patchstack" }
+          : { ...common, rules: fallbackRules },
+    );
+  }
+  return protection;
+}
+
+// Web-Fetch: export default { fetch: protectFetch(originalFetch) }
+export function protectFetch(handler) {
+  return async (request, ...rest) => {
+    const active = await getProtection();
+    const blocked = await active.fetchGuard()(request);
+    if (blocked) return blocked;
+    return active.screenResponse(await handler(request, ...rest));
+  };
+}
+
+// Node / Express: app.use(patchstackMiddleware)
+export function patchstackMiddleware(req, res, next) {
+  getProtection()
+    .then((active) => active.node()(req, res, next))
+    .catch(() => next()); // fail open
+}

package/dist/protect/templates/generic-guard.ts

@@ -19,7 +19,11 @@ export async function getProtection() {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
     const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true } as const;
+    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+    // rules periodically — a dependency flagged after boot is then enforced without a restart.
+    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+    const common = { mode, egress: true, refreshMs } as const;
     _protection = await createProtection(
       siteUuid
         ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }

package/dist/protect/templates/guard.ts

@@ -41,7 +41,11 @@ async function getProtection() {
     } catch {
       /* ignore a malformed SUPABASE_URL — just don't add an allow entry */
     }
-    const common = { mode, egress: true, allowHosts };
+    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+    // rules periodically — a dependency flagged after boot is then enforced without a restart.
+    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+    const common = { mode, egress: true, allowHosts, refreshMs };
     _protection = await createProtection(
       siteUuid
         ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" } // live per-site rules; bundled = offline fallback

package/dist/protect/templates/nuxt-middleware.ts

@@ -0,0 +1,43 @@
+// Patchstack runtime guard for Nuxt / Nitro — server middleware. Managed by `patchstack-connect protect`.
+// Runs the request-phase WAF (+ egress SSRF) on every request. Nuxt runs each file in
+// `server/middleware/` as independent middleware, so this file coexists with your own.
+import { defineEventHandler, getRequestURL, readRawBody, setResponseStatus, setResponseHeader } from "h3";
+import { createProtection } from "@patchstack/connect/protect";
+import fallbackRules from "./patchstack.rules.json";
+
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+
+let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+async function getProtection() {
+  if (!_protection) {
+    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+    const token = process.env.PATCHSTACK_WAF_TOKEN;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+    const common = { mode, egress: true } as const;
+    _protection = await createProtection(
+      siteUuid
+        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
+        : token
+          ? { ...common, token, cacheDir: ".patchstack" }
+          : { ...common, rules: fallbackRules as never },
+    );
+  }
+  return _protection;
+}
+
+// #region patchstack-nuxt (managed by patchstack-connect protect — do not edit)
+export default defineEventHandler(async (event) => {
+  const protection = await getProtection();
+  const method = event.method ?? "GET";
+  // readRawBody caches on the event, so your route handlers can still read the body.
+  const body = method !== "GET" && method !== "HEAD" ? await readRawBody(event) : undefined;
+  const blocked = await protection
+    .fetchGuard()(new Request(getRequestURL(event), { method, headers: event.headers, body: body ?? undefined }));
+  if (blocked) {
+    setResponseStatus(event, blocked.status);
+    const contentType = blocked.headers.get("content-type");
+    if (contentType) setResponseHeader(event, "content-type", contentType);
+    return blocked.text(); // 403 — blocked before it reaches your route
+  }
+});
+// #endregion patchstack-nuxt