@patchstack/connect 0.3.2 → 0.3.3

package/dist/protect/templates/engine.js

@@ -0,0 +1,137 @@
+// @patchstack/protect — the runtime protection engine.
+//
+// One pure function: evaluate(ctx, rules, manifest) -> Verdict.
+// No framework coupling — the framework adapter (the guard) builds `ctx` and acts on the
+// Verdict. This is the offsite-frozen contract between Group 1 (engine) and Group 2 (surface).
+//
+// SCOPE OF THIS BUILD: implements the two demo-critical pieces from the prototype —
+//   - `inline_xss`   (ps-node never implemented it; npm XSS attacks need it)
+//   - `package_cond` (the line between virtual patching and a dumb wall)
+// plus `equals` / `contains` and the `urldecode` mutation. The full rule_v2 zoo
+// (AND/OR, nested rules, whitelists, the ~15 other match types) lands when the
+// ps-node RuleEngine is ported in — this file keeps the same signature so that swap
+// is drop-in.
+
+/** @type {{ALLOW:'ALLOW',LOG:'LOG',BLOCK:'BLOCK',REDIRECT:'REDIRECT'}} */
+export const ACTIONS = { ALLOW: "ALLOW", LOG: "LOG", BLOCK: "BLOCK", REDIRECT: "REDIRECT" };
+
+/** Iteratively URL-decode (catches %2527 -> %27 -> '). Safe on malformed input. */
+export function urldecode(value) {
+  let out = String(value);
+  for (let i = 0; i < 5; i++) {
+    let next;
+    try {
+      next = decodeURIComponent(out.replace(/\+/g, " "));
+    } catch {
+      break;
+    }
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+const MUTATIONS = { urldecode };
+
+function applyMutations(value, mutations) {
+  let v = String(value ?? "");
+  for (const m of mutations ?? []) {
+    if (MUTATIONS[m]) v = MUTATIONS[m](v);
+  }
+  return v;
+}
+
+// Heuristic script-injection detector. Deliberately simple and readable for the demo;
+// the ported engine replaces this with the audited ps-node inline_xss implementation.
+const XSS_PATTERNS = [
+  /<\s*script\b/i,
+  /<\s*\/\s*script\s*>/i,
+  /\bon\w+\s*=/i, // onerror=, onload=, ...
+  /javascript\s*:/i,
+  /<\s*img\b[^>]*\bon\w+\s*=/i,
+  /<\s*svg\b[^>]*\bon\w+\s*=/i,
+  /\bdata\s*:\s*text\/html/i,
+];
+
+function looksLikeInlineXss(value) {
+  const v = String(value ?? "");
+  return XSS_PATTERNS.some((re) => re.test(v));
+}
+
+// Resolve a rule parameter like "insert.title" or "body.content" against ctx.
+// The guard normalizes framework specifics into ctx.body; parameters read from there.
+function resolveParameter(ctx, parameter) {
+  const [, ...rest] = String(parameter).split(".");
+  const key = rest.length ? rest.join(".") : parameter;
+  const body = ctx?.body ?? {};
+  if (key in body) return body[key];
+  // shallow scan for nested payloads (e.g. { record: { title } })
+  for (const v of Object.values(body)) {
+    if (v && typeof v === "object" && key in v) return v[key];
+  }
+  return undefined;
+}
+
+function matchCondition(ctx, cond) {
+  const params = Array.isArray(cond.parameter) ? cond.parameter : [cond.parameter];
+  for (const param of params) {
+    const raw = resolveParameter(ctx, param);
+    if (raw == null) continue;
+    const value = applyMutations(raw, cond.mutations);
+    const type = cond.match?.type;
+    let hit = false;
+    if (type === "inline_xss") hit = looksLikeInlineXss(value);
+    else if (type === "contains") hit = value.includes(cond.match.value);
+    else if (type === "equals") hit = value === cond.match.value;
+    if (hit) {
+      return { param, type, value };
+    }
+  }
+  return null;
+}
+
+// package_cond: only fire if the app actually has the vulnerable package@version.
+// If no manifest is supplied, fail-open on the gate (assume present) — detection already
+// flagged it; the guard can tighten this once it passes the real manifest.
+function packageCondSatisfied(pkgCond, manifest) {
+  if (!pkgCond) return true;
+  if (!manifest || !manifest.packages) return true;
+  const installed = manifest.packages[pkgCond.package];
+  if (installed == null) return false;
+  if (!pkgCond.vulnerable_versions) return true;
+  return pkgCond.vulnerable_versions.includes(installed);
+}
+
+/**
+ * Evaluate one request against the rule set.
+ * @param {import('./index.js').RequestContext} ctx
+ * @param {import('./index.js').Rule[]} rules
+ * @param {import('./index.js').Manifest} [manifest]
+ * @returns {import('./index.js').Verdict}
+ */
+export function evaluate(ctx, rules, manifest) {
+  const trace = [];
+  for (const rule of rules ?? []) {
+    if (!packageCondSatisfied(rule.package_cond, manifest)) {
+      trace.push({ rule_id: rule.id, skipped: "package_cond not satisfied" });
+      continue;
+    }
+    for (const cond of rule.rule_v2 ?? []) {
+      const m = matchCondition(ctx, cond);
+      if (m) {
+        return {
+          matched: true,
+          action: ACTIONS.BLOCK,
+          rule_id: rule.id,
+          vulnerability_id: rule.vulnerability_id ?? null,
+          package: rule.package_cond?.package ?? null,
+          version: manifest?.packages?.[rule.package_cond?.package] ?? null,
+          explain: [`${m.param} matched ${m.type}${cond.mutations?.length ? ` after ${cond.mutations.join("+")}` : ""}`],
+          trace,
+        };
+      }
+    }
+    trace.push({ rule_id: rule.id, matched: false });
+  }
+  return { matched: false, action: ACTIONS.ALLOW, rule_id: null, vulnerability_id: null, package: null, version: null, explain: [], trace };
+}

package/dist/protect/templates/guard.ts

@@ -1,59 +1,102 @@
-// Patchstack runtime protection — installed by `patchstack-connect protect`; the vibe coder
-// never touches this. It runs in the app's own server (e.g. the Cloudflare Worker) and covers
-// both ways a Lovable app talks to its database:
-//   - browser → Supabase directly: the generated Supabase client is patched to tunnel every call
-//     through handleGuardRequest (registered as request middleware in src/start.ts).
-//   - browser → TanStack server function → Supabase: inspectServerFn checks the server-fn args
-//     (registered as function middleware in src/start.ts) before anything is written.
-// Either way Patchstack sees the traffic and runs the same policy.
-//
-// Always-on by default (blocks). Rules come from the Patchstack API per-site (cached); the
-// bundled rules.json is only a fallback for before a token is configured. The engine ships
-// inside @patchstack/connect — nothing else to install.
-import {
-  createProtection,
-  createSupabaseGuard,
-  createServerFnGuard,
-  GUARD_PATH,
-} from "@patchstack/connect/protect";
-import fallbackRules from "./rules.json";
-
-export { GUARD_PATH };
-
-// One shared protection policy for both guards (rules load once).
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
-async function getProtection() {
-  if (!_protection) {
-    // Always-on: block by default. An explicit PATCHSTACK_MODE=dry-run downgrades to log-only.
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    _protection = await createProtection(
-      token
-        ? { token, mode, cacheDir: ".patchstack" } // live per-site rules from the Patchstack API (cached)
-        : { rules: fallbackRules as never, mode }, // demo fallback until a token is set
-    );
-  }
-  return _protection;
+// Patchstack auto-guard — installed automatically by "add Patchstack"; the vibe coder never
+// touches this. It runs in the app's own server (the Cloudflare Worker). The patched Supabase
+// client tunnels every browser data call here; we inspect the payload against the rules, then
+// either block it (virtual patch) or forward it to real Supabase.
+import { evaluate, type Rule } from "./engine.js";
+import rulesData from "./rules.json";
+import { manifest } from "./manifest.js";
+
+export const GUARD_PATH = "/_patchstack/guard";
+
+// Headers that must not be copied verbatim when we re-emit the upstream response.
+const HOP_BY_HOP = new Set(["content-encoding", "content-length", "transfer-encoding", "connection"]);
+
+function mode(): "dry-run" | "block" {
+  // Always-on: protection blocks by default. Only an explicit PATCHSTACK_MODE=dry-run
+  // downgrades to log-only (for testing) — there is no silent dry-run.
+  return process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
 }
 
-// Request-middleware path: the browser tunnels its direct Supabase calls here.
-let _handle: ((request: Request) => Promise<Response>) | undefined;
 export async function handleGuardRequest(request: Request): Promise<Response> {
-  if (!_handle) {
-    _handle = createSupabaseGuard({
-      protection: await getProtection(),
-      supabaseUrl: process.env.SUPABASE_URL,
-    });
+  const target = request.headers.get("x-ps-target");
+  if (!target) return new Response("patchstack: missing x-ps-target", { status: 400 });
+
+  // SSRF guard: the client names the target, but we only ever forward to the app's own
+  // Supabase project (origin known server-side). Anything else — internal hosts, cloud
+  // metadata, a different scheme — is rejected before we make any outbound request.
+  const supabaseUrl = process.env.SUPABASE_URL;
+  let targetUrl: URL;
+  try {
+    targetUrl = new URL(target);
+  } catch {
+    return new Response("patchstack: invalid target", { status: 400 });
   }
-  return _handle(request);
-}
+  if (!supabaseUrl || targetUrl.protocol !== "https:" || targetUrl.origin !== new URL(supabaseUrl).origin) {
+    return new Response("patchstack: target not allowed", { status: 403 });
+  }
+
+  const hasBody = request.method !== "GET" && request.method !== "HEAD";
+  const bodyText = hasBody ? await request.text() : "";
 
-// Function-middleware path: inspect a server function's decoded args before the handler runs.
-// Returns a block receipt (throw on it to abort the call) or null to allow.
-let _inspect: ((data: unknown) => Promise<{ rule?: string; message: string } | null>) | undefined;
-export async function inspectServerFn(data: unknown): Promise<{ rule?: string; message: string } | null> {
-  if (!_inspect) {
-    _inspect = createServerFnGuard({ protection: await getProtection() });
+  let record: Record<string, unknown> = {};
+  if (bodyText) {
+    try {
+      const parsed = JSON.parse(bodyText);
+      record = Array.isArray(parsed) ? (parsed[0] ?? {}) : parsed;
+    } catch {
+      // not JSON — leave record empty; the rule simply won't match
+    }
   }
-  return _inspect(data);
+
+  const ctx = {
+    method: request.method,
+    url: target,
+    headers: Object.fromEntries(request.headers),
+    // expose the record under a few shapes so rule parameters like "insert.title" resolve
+    body: { ...record, insert: record, update: record },
+    ip: request.headers.get("x-forwarded-for") ?? "",
+  };
+
+  const t0 = performance.now();
+  const verdict = evaluate(ctx, (rulesData as { firewall: Rule[] }).firewall, manifest);
+  const latencyMs = Math.round((performance.now() - t0) * 100) / 100;
+
+  // Always log the flag (this is the "dry-run sees it too" behavior).
+  const decision = verdict.matched ? `MATCH ${verdict.rule_id}` : "clean";
+  console.log(`[patchstack] ${request.method} ${new URL(target).pathname} -> ${decision} · mode=${mode()}`);
+
+  if (verdict.matched && mode() === "block") {
+    const receipt = {
+      blocked: true,
+      rule_id: verdict.rule_id,
+      vulnerability_id: verdict.vulnerability_id,
+      package: verdict.package,
+      version: verdict.version,
+      matched_conditions: verdict.explain,
+      latency_ms: latencyMs,
+    };
+    console.log("[patchstack] BLOCKED", JSON.stringify(receipt));
+    return new Response(JSON.stringify(receipt), {
+      status: 403,
+      headers: { "content-type": "application/json", "x-patchstack": "blocked" },
+    });
+  }
+
+  // Forward to real Supabase, server-side.
+  const forwardHeaders = new Headers(request.headers);
+  forwardHeaders.delete("x-ps-target");
+  forwardHeaders.delete("host");
+  const upstream = await fetch(target, {
+    method: request.method,
+    headers: forwardHeaders,
+    body: hasBody ? bodyText : undefined,
+    redirect: "manual",
+  });
+
+  const outHeaders = new Headers();
+  upstream.headers.forEach((value, key) => {
+    if (!HOP_BY_HOP.has(key.toLowerCase())) outHeaders.set(key, value);
+  });
+  const buf = await upstream.arrayBuffer();
+  return new Response(buf, { status: upstream.status, statusText: upstream.statusText, headers: outHeaders });
 }

package/dist/protect/templates/manifest.d.ts

@@ -0,0 +1 @@
+export declare const manifest: { packages: Record<string, string> };

package/dist/protect/templates/rules.json

@@ -1,19 +1,22 @@
 {
-  "_comment": "Demo fallback rules — used only when PATCHSTACK_WAF_TOKEN is unset. In production the guard fetches per-site rules from the Patchstack API (api.patchstack.com/api/get-rules/3, cached to disk). CVE id is representative until aligned with the real corpus.",
+  "_comment": "DEMO SCAFFOLD — static stub; the real per-site rules endpoint does not exist in saas yet. CVE-2022-21681 is a real marked advisory affecting <4.0.10 (demo installs 4.0.0). The demo uses an XSS-shaped payload for visual clarity; exact payload<->CVE alignment is pinned with Group 1's corpus.",
   "firewall": [
     {
       "id": "rm-npm-0001",
       "title": "Block stored XSS via vulnerable markdown renderer (marked)",
       "vulnerability_id": "CVE-2022-21681",
+      "package_cond": {
+        "package": "marked",
+        "vulnerable_versions": ["4.0.0"]
+      },
       "rule_v2": [
         {
-          "parameter": "post.title",
+          "parameter": ["insert.title", "body.title", "update.title"],
           "mutations": ["urldecode"],
           "match": { "type": "inline_xss" }
         }
       ]
     }
   ],
-  "whitelists": [],
-  "whitelist_keys": {}
+  "whitelists": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patchstack/connect",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Patchstack connector for JavaScript applications. Scans your lockfile and reports installed packages to Patchstack for vulnerability monitoring.",
   "keywords": [
     "patchstack",
@@ -21,11 +21,6 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
-    },
-    "./protect": {
-      "types": "./dist/protect.d.ts",
-      "import": "./dist/protect.js",
-      "require": "./dist/protect.cjs"
     }
   },
   "bin": {
@@ -34,6 +29,7 @@
   "files": [
     "dist",
     "README.md",
+    "AGENT-INSTALL.md",
     "LICENSE"
   ],
   "scripts": {