@patchstack/connect 0.3.28 → 0.3.30

package/dist/protect/templates/generic-guard.ts

@@ -10,31 +10,48 @@ import fallbackRules from "./rules.json";
 // Baked by `patchstack-connect protect` from .patchstackrc.json when available.
 const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
 
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+let _protection: Promise<Awaited<ReturnType<typeof createProtection>>> | undefined;
 
-/** One memoized protection policy. Rules come from the Patchstack API per-site (cached); the
- *  bundled rules.json is the fallback until a site UUID / token is configured. */
+/**
+ * One protection policy, memoized on the IN-FLIGHT promise rather than the resolved value.
+ *
+ * A cold start takes several concurrent requests. Caching only the finished value lets each of them see an
+ * empty cache and start its own build — several rule fetches, several refresh loops, and several policies
+ * where the app is meant to have one. Holding the promise means the first request starts it and the rest
+ * await the same one.
+ *
+ * A failed build is not cached: the slot is cleared so the next request tries again rather than inheriting
+ * one bad boot for the life of the process.
+ */
 export async function getProtection() {
   if (!_protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
-    // rules periodically — a dependency flagged after boot is then enforced without a restart.
-    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
-    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
-    const common = { mode, egress: true, refreshMs } as const;
-    _protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules as never },
-    );
+    _protection = buildProtection().catch((err) => {
+      _protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return _protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+  // rules periodically — a dependency flagged after boot is then enforced without a restart.
+  // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+  const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+  const common = { mode, egress: true, refreshMs } as const;
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules as never },
+  );
+}
+
 // --- Web Fetch (Cloudflare Workers, Bun, Deno, Hono, Next edge, TanStack server.ts) ---------
 // Wrap your fetch handler:  export default { fetch: protectFetch(originalFetch) }
 export function protectFetch<H extends (request: Request, ...rest: unknown[]) => unknown>(handler: H): H {
@@ -42,12 +59,16 @@ export function protectFetch<H extends (request: Request, ...rest: unknown[]) =>
     const protection = await getProtection();
     const blocked = await protection.fetchGuard()(request);
     if (blocked) return blocked;
-    return protection.screenResponse(await handler(request, ...rest) as Response);
+    // Response rules can be scoped to a route or a method, and the engine can only apply that scope if it is
+    // given the request the response belongs to. Passed through here for that reason: without it a scoped
+    // response rule is delivered, counted as protection, and never matches anything.
+    return protection.screenResponse(await handler(request, ...rest) as Response, request);
   }) as H;
 }
 
 // --- Node / Express -------------------------------------------------------------------------
-// Add before your routes:  app.use(patchstackMiddleware)
+// app.use(patchstackMiddleware) — register it before any body parser and before your routes. This guard
+// reads the request stream itself and exposes what it read as req.body, so a parser is not also needed.
 export function patchstackMiddleware(req: unknown, res: unknown, next: (err?: unknown) => void) {
   getProtection()
     .then((protection) => (protection.node() as (a: unknown, b: unknown, c: (e?: unknown) => void) => void)(req, res, next))

package/dist/protect/templates/guard.ts

@@ -26,37 +26,54 @@ const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
 export { GUARD_PATH };
 
 // One shared protection policy for both guards (rules load once).
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+/**
+ * One protection policy, memoized on the IN-FLIGHT promise rather than the resolved value.
+ *
+ * A cold start takes several concurrent requests. Caching only the finished value lets each of them see an
+ * empty cache and start its own build — several rule fetches, several refresh loops, and several policies
+ * where the app is meant to have one. Holding the promise means the first request starts it and the rest
+ * await the same one. A failed build is not cached, so the next request retries rather than inheriting one
+ * bad boot for the life of the process.
+ */
+let _protection: Promise<Awaited<ReturnType<typeof createProtection>>> | undefined;
 async function getProtection() {
   if (!_protection) {
-    // Always-on: block by default. An explicit PATCHSTACK_MODE=dry-run downgrades to log-only.
-    const mode: "block" | "dry-run" = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    // Egress SSRF screening: block the app's outbound calls to internal / metadata addresses,
-    // but never its own Supabase project.
-    let allowHosts: string[] = [];
-    try {
-      if (process.env.SUPABASE_URL) allowHosts = [new URL(process.env.SUPABASE_URL).host];
-    } catch {
-      /* ignore a malformed SUPABASE_URL — just don't add an allow entry */
-    }
-    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
-    // rules periodically — a dependency flagged after boot is then enforced without a restart.
-    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
-    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
-    const common = { mode, egress: true, allowHosts, refreshMs };
-    _protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" } // live per-site rules; bundled = offline fallback
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" } // live per-site WAF rules from the Patchstack API (cached)
-          : { ...common, rules: fallbackRules as never }, // demo fallback until a site UUID / token is set
-    );
+    _protection = buildProtection().catch((err) => {
+      _protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return _protection;
 }
 
+async function buildProtection() {
+  // Always-on: block by default. An explicit PATCHSTACK_MODE=dry-run downgrades to log-only.
+  const mode: "block" | "dry-run" = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  // Egress SSRF screening: block the app's outbound calls to internal / metadata addresses,
+  // but never its own Supabase project.
+  let allowHosts: string[] = [];
+  try {
+    if (process.env.SUPABASE_URL) allowHosts = [new URL(process.env.SUPABASE_URL).host];
+  } catch {
+    /* ignore a malformed SUPABASE_URL — just don't add an allow entry */
+  }
+  // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+  // rules periodically — a dependency flagged after boot is then enforced without a restart.
+  // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+  const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+  const common = { mode, egress: true, allowHosts, refreshMs };
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" } // live per-site rules; bundled = offline fallback
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" } // live per-site WAF rules from the Patchstack API (cached)
+        : { ...common, rules: fallbackRules as never }, // demo fallback until a site UUID / token is set
+  );
+}
+
 // Request-middleware path: the browser tunnels its direct Supabase calls here.
 let _handle: ((request: Request) => Promise<Response>) | undefined;
 export async function handleGuardRequest(request: Request): Promise<Response> {
@@ -84,11 +101,14 @@ export async function inspectServerFn(data: unknown): Promise<{ rule?: string; m
 // src/start.ts (the browser→Supabase tunnel screens its own forwarded response). Only acts on a
 // web Response (text/JSON/HTML) — anything else, or any error, passes through untouched (fail-open,
 // never breaks a response).
-export async function screenResponse<T>(response: T): Promise<T> {
+// `request` is optional but should be passed wherever it is available: response rules can be scoped to a
+// route or a method, and the engine can only apply that scope if it is given the request the response
+// belongs to. Without it a scoped response rule is delivered, counted as protection, and matches nothing.
+export async function screenResponse<T>(response: T, request?: Request): Promise<T> {
   try {
     if (!(response instanceof Response)) return response;
     const protection = await getProtection();
-    return (protection.screenResponse ? await protection.screenResponse(response) : response) as T;
+    return (protection.screenResponse ? await protection.screenResponse(response, request) : response) as T;
   } catch {
     return response; // fail open
   }

package/dist/protect/templates/next-middleware.ts

@@ -7,24 +7,41 @@ import fallbackRules from "./patchstack.rules.json";
 
 const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
 
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+/**
+ * One protection policy, memoized on the IN-FLIGHT promise rather than the resolved value.
+ *
+ * A cold start takes several concurrent requests. Caching only the finished value lets each of them see an
+ * empty cache and start its own build — several rule fetches, several refresh loops, and several policies
+ * where the app is meant to have one. Holding the promise means the first request starts it and the rest
+ * await the same one. A failed build is not cached, so the next request retries rather than inheriting one
+ * bad boot for the life of the process.
+ */
+let _protection: Promise<Awaited<ReturnType<typeof createProtection>>> | undefined;
 async function getProtection() {
   if (!_protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true } as const;
-    _protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules as never },
-    );
+    _protection = buildProtection().catch((err) => {
+      _protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return _protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true } as const;
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules as never },
+  );
+}
+
 // #region patchstack-next (managed by patchstack-connect protect — do not edit)
 export async function middleware(request: Request) {
   const protection = await getProtection();

package/dist/protect/templates/nuxt-middleware.ts

@@ -7,24 +7,41 @@ import fallbackRules from "./patchstack.rules.json";
 
 const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
 
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+/**
+ * One protection policy, memoized on the IN-FLIGHT promise rather than the resolved value.
+ *
+ * A cold start takes several concurrent requests. Caching only the finished value lets each of them see an
+ * empty cache and start its own build — several rule fetches, several refresh loops, and several policies
+ * where the app is meant to have one. Holding the promise means the first request starts it and the rest
+ * await the same one. A failed build is not cached, so the next request retries rather than inheriting one
+ * bad boot for the life of the process.
+ */
+let _protection: Promise<Awaited<ReturnType<typeof createProtection>>> | undefined;
 async function getProtection() {
   if (!_protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true } as const;
-    _protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules as never },
-    );
+    _protection = buildProtection().catch((err) => {
+      _protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return _protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true } as const;
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules as never },
+  );
+}
+
 // #region patchstack-nuxt (managed by patchstack-connect protect — do not edit)
 export default defineEventHandler(async (event) => {
   const protection = await getProtection();

package/dist/protect/templates/rules.json

@@ -21,7 +21,7 @@
       "title": "Path traversal in a file/path parameter",
       "category": "lfi",
       "rule_v2": [
-        { "parameter": ["get.file", "post.file", "raw.file", "get.path", "post.path"], "mutations": ["urldecode"], "match": { "type": "contains", "value": ".." } }
+        { "parameter": ["get.file", "post.file", "get.path", "post.path"], "mutations": ["urldecode"], "match": { "type": "contains", "value": ".." } }
       ]
     },
     {
@@ -29,7 +29,7 @@
       "title": "SSRF via a url parameter pointing at an internal/metadata address",
       "category": "ssrf",
       "rule_v2": [
-        { "parameter": ["get.url", "post.url", "raw.url"], "mutations": ["urldecode"], "match": { "type": "regex", "value": "/localhost|127\\.0\\.0\\.1|169\\.254\\.169\\.254|::1|metadata\\.google/i" } }
+        { "parameter": ["get.url", "post.url"], "mutations": ["urldecode"], "match": { "type": "regex", "value": "/localhost|127\\.0\\.0\\.1|169\\.254\\.169\\.254|::1|metadata\\.google/i" } }
       ]
     },
     {

package/dist/protect/templates/sveltekit-hooks.ts

@@ -7,29 +7,49 @@ import fallbackRules from "./patchstack.rules.json";
 
 const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
 
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+/**
+ * One protection policy, memoized on the IN-FLIGHT promise rather than the resolved value.
+ *
+ * A cold start takes several concurrent requests. Caching only the finished value lets each of them see an
+ * empty cache and start its own build — several rule fetches, several refresh loops, and several policies
+ * where the app is meant to have one. Holding the promise means the first request starts it and the rest
+ * await the same one. A failed build is not cached, so the next request retries rather than inheriting one
+ * bad boot for the life of the process.
+ */
+let _protection: Promise<Awaited<ReturnType<typeof createProtection>>> | undefined;
 async function getProtection() {
   if (!_protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true } as const;
-    _protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules as never },
-    );
+    _protection = buildProtection().catch((err) => {
+      _protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return _protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true } as const;
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules as never },
+  );
+}
+
 // #region patchstack-sveltekit (managed by patchstack-connect protect — do not edit)
 export const handle: Handle = async ({ event, resolve }) => {
   const protection = await getProtection();
   const blocked = await protection.fetchGuard()(event.request);
   if (blocked) return blocked; // 403 — blocked before it reaches your route
-  return protection.screenResponse(await resolve(event));
+  // Response rules can be scoped to a route or a method, and the engine can only apply that scope if it is
+  // given the request the response belongs to. Passed through here for that reason: without it a scoped
+  // response rule is delivered, counted as protection, and never matches anything.
+  return protection.screenResponse(await resolve(event), event.request);
 };
 // #endregion patchstack-sveltekit