@patchstack/connect 0.3.30 → 0.3.31

package/dist/protect.cjs

@@ -682,7 +682,7 @@ async function walkNodeModules(cwd) {
     seen.set(await (0, import_promises5.realpath)(cwd), -1);
   } catch {
   }
-  return dedupeByShallowest(await walk(root, 0, seen));
+  return dedupeByShallowest(await walk(root, 0, seen, cwd));
 }
 function dedupeByShallowest(found) {
   const best = /* @__PURE__ */ new Map();
@@ -692,7 +692,7 @@ function dedupeByShallowest(found) {
   }
   return [...best.values()].map(({ entry }) => entry);
 }
-async function walk(dir, depth, seen) {
+async function walk(dir, depth, seen, root) {
   let names;
   try {
     names = await (0, import_promises5.readdir)(dir);
@@ -704,7 +704,7 @@ async function walk(dir, depth, seen) {
     const fullPath = import_node_path4.default.join(dir, name);
     const resolved = await claim(fullPath, seen, depth);
     if (resolved === null) return [];
-    if (PACKAGE_STORE_DIRS.has(name)) return walk(fullPath, depth, seen);
+    if (PACKAGE_STORE_DIRS.has(name)) return walk(fullPath, depth, seen, root);
     if (name.startsWith("@")) {
       let subNames;
       try {
@@ -717,16 +717,16 @@ async function walk(dir, depth, seen) {
         const scopedDir = import_node_path4.default.join(fullPath, sub);
         const scopedReal = await claim(scopedDir, seen, depth);
         if (scopedReal === null) return [];
-        return packageAndNested(scopedDir, scopedReal, depth, seen);
+        return packageAndNested(scopedDir, scopedReal, depth, seen, root);
       });
       return scoped.flat();
     }
-    return packageAndNested(fullPath, resolved, depth, seen);
+    return packageAndNested(fullPath, resolved, depth, seen, root);
   });
   return perEntry.flat();
 }
-async function packageAndNested(pkgDir, resolved, depth, seen) {
-  const [own, nested] = await Promise.all([readPackage(pkgDir, depth), walkNested(pkgDir, depth, seen)]);
+async function packageAndNested(pkgDir, resolved, depth, seen, root) {
+  const [own, nested] = await Promise.all([readPackage(pkgDir, depth, root), walkNested(pkgDir, depth, seen, root)]);
   return own === null ? nested : [{ entry: own, realpath: resolved, depth }, ...nested];
 }
 async function mapLimit(items, fn) {
@@ -741,7 +741,10 @@ async function mapLimit(items, fn) {
   await Promise.all(workers);
   return results;
 }
-async function readPackage(pkgDir, depth) {
+function installLocation(root, pkgDir, impl = import_node_path4.default) {
+  return impl.relative(root, pkgDir).split(impl.sep).join("/");
+}
+async function readPackage(pkgDir, depth, root) {
   let raw;
   try {
     raw = await (0, import_promises5.readFile)(import_node_path4.default.join(pkgDir, "package.json"), "utf8");
@@ -760,14 +763,14 @@ async function readPackage(pkgDir, depth) {
   if (typeof parsed.version !== "string" || parsed.version.length === 0) {
     return null;
   }
-  return { name: parsed.name, version: parsed.version, direct: depth === 0 };
+  return { name: parsed.name, version: parsed.version, path: installLocation(root, pkgDir), direct: depth === 0 };
 }
-async function walkNested(pkgDir, depth, seen) {
+async function walkNested(pkgDir, depth, seen, root) {
   const nested = import_node_path4.default.join(pkgDir, "node_modules");
   if (await claim(nested, seen, depth + 1) === null) {
     return [];
   }
-  return walk(nested, depth + 1, seen);
+  return walk(nested, depth + 1, seen, root);
 }
 async function claim(dir, seen, depth) {
   let resolved;
@@ -1453,21 +1456,33 @@ var init_parsers = __esm({
 });
 
 // src/normalize.ts
-function buildWirePayload(manifest) {
+function buildWirePayload(manifest, options = {}) {
+  const withPaths = options.installPaths === true;
   const seen = /* @__PURE__ */ new Map();
   const wirePackages = [];
+  const byIdentity = /* @__PURE__ */ new Map();
+  let entriesWithoutPath = 0;
   for (const entry of manifest.packages) {
+    const identity = `${entry.name}@${entry.version}`;
+    const location = withPaths && entry.path !== void 0 && entry.path !== "" ? entry.path : void 0;
+    if (location === void 0) entriesWithoutPath++;
+    const existing = byIdentity.get(identity);
+    if (existing) {
+      if (location !== void 0) addPath(existing, location);
+      continue;
+    }
     const versions = seen.get(entry.name);
     if (versions) {
-      if (versions.has(entry.version)) {
-        continue;
-      }
       versions.add(entry.version);
     } else {
       seen.set(entry.name, /* @__PURE__ */ new Set([entry.version]));
     }
-    wirePackages.push({ name: entry.name, version: entry.version });
+    const wire = { name: entry.name, version: entry.version };
+    if (location !== void 0) addPath(wire, location);
+    byIdentity.set(identity, wire);
+    wirePackages.push(wire);
   }
+  for (const wire of wirePackages) wire.paths?.sort();
   wirePackages.sort((a, b) => {
     if (a.name === b.name) {
       return compareVersions(a.version, b.version);
@@ -1481,7 +1496,18 @@ function buildWirePayload(manifest) {
     }
   }
   return {
-    payload: { ecosystem: manifest.ecosystem, packages: wirePackages },
+    payload: {
+      ecosystem: manifest.ecosystem,
+      packages: wirePackages,
+      // Every entry had a location, so a missing path anywhere means the package is not installed there.
+      // One entry without one forfeits that for the whole payload: a consumer reading a short `paths` has
+      // no way to tell which entry was the incomplete one.
+      //
+      // No separate check for "locations were not requested": with them off every entry counts as without
+      // one, so this is already false — which is the default, and the safe direction. An explicit
+      // `withPaths &&` here was a guard no test could distinguish from its absence.
+      installPathsComplete: entriesWithoutPath === 0 && manifest.packages.length > 0
+    },
     stats: {
       uniqueNames: seen.size,
       duplicateNames,
@@ -1489,6 +1515,10 @@ function buildWirePayload(manifest) {
     }
   };
 }
+function addPath(wire, installPath) {
+  if (wire.paths === void 0) wire.paths = [installPath];
+  else if (!wire.paths.includes(installPath)) wire.paths.push(installPath);
+}
 function compareVersions(a, b) {
   if (a === b) {
     return 0;
@@ -2553,6 +2583,30 @@ function expandIPv6(host) {
   }
   return out;
 }
+var JWT_CANDIDATE = /(?<![A-Za-z0-9_-])(?<![A-Za-z0-9_-]\.)eyJ[A-Za-z0-9_-]{2,2048}\.[A-Za-z0-9_-]{2,8192}\.[A-Za-z0-9_-]{0,2048}(?![A-Za-z0-9_-])(?!\.[A-Za-z0-9_-])/g;
+function base64UrlToBase64(segment) {
+  const padded = segment.length % 4 === 0 ? segment : segment + "=".repeat(4 - segment.length % 4);
+  return padded.replace(/-/g, "+").replace(/_/g, "/");
+}
+function jwtClaimSpans(text, claim2, value) {
+  const found = /* @__PURE__ */ new Set();
+  if (typeof text !== "string" || typeof claim2 !== "string" || claim2 === "") return [];
+  const wanted = String(value);
+  for (const [token] of text.matchAll(JWT_CANDIDATE)) {
+    const parts = token.split(".");
+    let payload;
+    try {
+      payload = JSON.parse(base64DecodeUtf8(base64UrlToBase64(parts[1])));
+    } catch {
+      continue;
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) continue;
+    if (!Object.prototype.hasOwnProperty.call(payload, claim2)) continue;
+    const actual = payload[claim2];
+    if (typeof actual === "string" && actual === wanted) found.add(token);
+  }
+  return [...found];
+}
 var warnedScopes = /* @__PURE__ */ new Set();
 function warnUnrecognisedScope(when) {
   const key = Object.keys(when).sort().join(",");
@@ -2581,16 +2635,30 @@ function ruleAppliesTo(when, resolver) {
     return true;
   }
 }
+function foldPathForScope(value) {
+  const out = String(value).toLowerCase();
+  return out.endsWith("/") ? out.slice(0, -1) : out;
+}
+var REGEX_SYNTAX = /[\\^$*+?()[\]{}|]/;
+var REGEX_FORM = /^\/(.+?)\/([gimsuy]*)$/s;
+function isRegexForm(pattern) {
+  const parts = REGEX_FORM.exec(pattern);
+  return parts !== null && REGEX_SYNTAX.test(parts[1]);
+}
 function pathMatches(pattern, path7) {
-  if (pattern.length > 2 && pattern.startsWith("/") && pattern.endsWith("/")) {
+  if (isRegexForm(pattern)) {
     const re = safeRegExp(pattern);
     return re ? re.test(path7) : false;
   }
-  if (pattern.includes("*")) {
-    const re = safeRegExp("/^" + pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^?]*") + "$/");
-    return re ? re.test(path7) : false;
+  const target = foldPathForScope(path7);
+  const folded = foldPathForScope(pattern);
+  if (folded.includes("*")) {
+    const trailing = folded.endsWith("/*");
+    const body = (trailing ? folded.slice(0, -2) : folded).replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^?]*");
+    const re = safeRegExp("/^" + body + (trailing ? "(?:/[^?]*)?" : "") + "$/");
+    return re ? re.test(target) : false;
   }
-  return path7 === pattern;
+  return target === folded;
 }
 function normalizeDefaultPort(host) {
   return String(host).toLowerCase().replace(/:(?:80|443)$/, "");
@@ -2743,6 +2811,8 @@ function matchValue(type, value, matchVal, matchObj) {
       const stripped = strValue.replace(/[ _\-,]/g, "");
       return ctypeResult(strValue, /^[\w$€-￿]*$/.test(stripped), matchVal);
     }
+    case "jwt_claim_equals":
+      return jwtClaimSpans(strValue, matchObj?.claim, matchVal).length > 0;
     case "array_key_value":
       return arrayKeyValue(value, matchObj);
     // file_contains (uploaded-file content scanning) is NOT WordPress-specific, but is
@@ -3509,13 +3579,43 @@ var DEFAULT_RESPONSE_RULES = [
     rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:sk_live_[0-9A-Za-z]{16,}|rk_live_[0-9A-Za-z]{16,}|gh[opsu]_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z_]{60,}|glpat-[0-9A-Za-z_-]{20,}|xox[baprs]-[0-9A-Za-z-]{10,}|sk-ant-[0-9A-Za-z_-]{20,}|ya29\\.[0-9A-Za-z_-]{20,}|npm_[0-9A-Za-z]{36})(?![0-9A-Za-z])/" } }]
   },
   {
-    id: "resp-jwt",
-    title: "JWT in response body",
+    id: "resp-supabase-secret-key",
+    title: "Supabase secret key in response body",
     phase: "response",
     category: "secret-exposure",
     action: "redact",
+    // Supabase's opaque key format, which is not a JWT and so is not covered by the JWT rule below.
+    // `sb_secret_` is the elevated one — documented as full access, bypassing Row Level Security,
+    // backend-only — while `sb_publishable_` is meant for public clients and must pass untouched.
+    // Both key systems are live at once: new keys sit alongside the legacy `anon` / `service_role`
+    // JWTs rather than replacing them, so this rule and the JWT rule cover different halves.
+    //
+    // The documented grammar is the prefix, 22 base64url characters, `_`, then an 8-character
+    // base64url checksum. Matching it exactly is what keeps the mask on the key and off the response
+    // around it: a variable-length suffix would either run past the key into adjacent syntax or stop
+    // short and leave the tail of a real key visible. The trailing guard rejects a longer run of key
+    // characters, which is not this format.
+    prefilter: ["sb_secret_"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\bsb_secret_[A-Za-z0-9_-]{22}_[A-Za-z0-9_-]{8}(?![A-Za-z0-9_-])/" } }]
+  },
+  {
+    id: "resp-supabase-service-role-key",
+    title: "Supabase service_role key in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    // Scoped to the one role that must never leave: `service_role` bypasses Row Level Security
+    // entirely. A JWT in a response body is not inherently a leak — the Supabase `anon` key is public
+    // by design and a login response carries the user's own access token — so this decides on the
+    // decoded payload rather than on the shape of the token.
+    //
+    // `jwt_claim_equals` also yields the matching token spans, which is what lets `redact` mask those
+    // tokens and serve the rest of the response.
+    //
+    // A broad any-JWT rule is a reasonable thing to want; it belongs in the managed hardening bundle as
+    // an opt-in, observe-only rule rather than an on-by-default mask.
     prefilter: ["eyJ"],
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\beyJ[A-Za-z0-9_-]{8,}\\.eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\b/" } }]
+    rule_v2: [{ parameter: "response.body", match: { type: "jwt_claim_equals", claim: "role", value: "service_role" } }]
   },
   {
     id: "resp-db-connection-string",
@@ -3798,6 +3898,7 @@ var MATCH_TYPES = Object.freeze([
   "internal_host",
   "is_numeric",
   "isset",
+  "jwt_claim_equals",
   "less_than",
   "more_than",
   "not_contains",
@@ -3823,6 +3924,8 @@ var OPERANDLESS_MATCH_TYPES = Object.freeze([
   "cors_reflected"
 ]);
 var OPERAND_SHAPES = Object.freeze([
+  "positive-number",
+  "boolean",
   "non-empty-string",
   "regex-literal",
   "string-or-string-list",
@@ -3847,6 +3950,14 @@ var MATCH_OPERANDS = Object.freeze({
     required: Object.freeze(["key", "match"]),
     shapes: Object.freeze({ key: "string-or-string-list", match: "object" })
   }),
+  // Decides on a JWT's DECODED payload rather than its shape, and yields the matching token spans so
+  // `redact` masks only those tokens. `claim` names an own, top-level claim; `value` is compared with
+  // exact string equality. Anything not positively identified — undecodable, not JSON, not an object,
+  // oversized, claim missing, claim not a string, or a different value — is a no-match.
+  jwt_claim_equals: Object.freeze({
+    required: Object.freeze(["claim", "value"]),
+    shapes: Object.freeze({ claim: "non-empty-string", value: "non-empty-string" })
+  }),
   regex: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "regex-literal" }) }),
   contains: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-string" }) }),
   stripos: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-string" }) }),
@@ -3872,6 +3983,10 @@ function operandShapeProblem(shape, value) {
   const isScalar = (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean";
   const isHeaderName = (v) => typeof v === "string" && HEADER_NAME.test(v);
   switch (shape) {
+    case "positive-number":
+      return typeof value === "number" && Number.isFinite(value) && value > 0 ? null : "must be a finite positive number";
+    case "boolean":
+      return typeof value === "boolean" ? null : "must be true or false";
     case "non-empty-string":
       return isFilledString(value) ? null : "must be a non-empty string";
     case "regex-literal":
@@ -3954,6 +4069,13 @@ var ACTIONS = Object.freeze([
   "remove-header",
   "harden-cookie"
 ]);
+var RULE_PROPERTY_SHAPES = Object.freeze({
+  max_bytes: "positive-number",
+  bypass_limit: "boolean",
+  ensure: "boolean",
+  prefilter: "non-empty-string-list"
+});
+var ENFORCEMENT_VALUES = Object.freeze(["dry-run"]);
 var WHEN_KEYS = Object.freeze(["path", "method"]);
 var RULE_PROPERTIES = Object.freeze([
   "id",
@@ -4129,6 +4251,24 @@ function whenProblem(when) {
 function isNonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "";
 }
+function nullPropertyProblem(rule) {
+  if (!rule || typeof rule !== "object") return null;
+  for (const property of RULE_PROPERTIES) {
+    if (property in rule && rule[property] === null) {
+      return `"${property}" is present but null; omit it to mean the default, since a null is a value that was meant to be something and is not`;
+    }
+  }
+  return null;
+}
+function rulePropertyProblem(rule) {
+  if (!rule || typeof rule !== "object") return null;
+  for (const [property, shape] of Object.entries(RULE_PROPERTY_SHAPES)) {
+    if (rule[property] === void 0 || rule[property] === null) continue;
+    const problem = operandShapeProblem(shape, rule[property]);
+    if (problem) return `"${property}" ${problem}`;
+  }
+  return null;
+}
 function actionProblem(action, rule) {
   if (action === void 0 || action === null) return null;
   if (!ACTIONS.includes(action)) return `unknown action "${action}"`;
@@ -4193,13 +4333,15 @@ function idOf(rule) {
 }
 function ruleProblem(rule) {
   if (!rule || typeof rule !== "object") return "not an object";
+  const nullReason = nullPropertyProblem(rule);
+  if (nullReason) return nullReason;
   if (rule.phase !== void 0 && !PHASES2.has(rule.phase)) return `unknown phase "${rule.phase}"`;
   const actionReason = actionProblem(rule.action, rule);
   if (actionReason) return actionReason;
   const scopeReason = whenProblem(rule.when);
   if (scopeReason) return scopeReason;
-  const capOverride = rule.max_bytes;
-  if (capOverride !== void 0 && !(Number(capOverride) > 0)) return "max_bytes must be a positive number";
+  const propertyReason = rulePropertyProblem(rule);
+  if (propertyReason) return propertyReason;
   return conditionsProblem(rule.rule_v2);
 }
 function conditionsProblem(conditions, depth = 0) {
@@ -5491,6 +5633,8 @@ function extractRedactors(rule) {
         }
       } else if ((m.type === "contains" || m.type === "stripos") && m.value != null) {
         out.push({ literal: String(m.value) });
+      } else if (m.type === "jwt_claim_equals" && typeof m.claim === "string") {
+        out.push({ jwtClaim: { claim: m.claim, value: String(m.value ?? "") } });
       } else if (m.type === "array_key_value" && m.match && isBodyParam(c.parameter)) {
         const keys = Array.isArray(m.key) ? m.key : [m.key];
         for (const key of keys) {
@@ -5509,7 +5653,11 @@ function applyRedactors(body, redactors, mask, transform) {
   let out = body;
   for (const r of redactors) {
     if (r.re) out = out.replace(r.re, transform ? (m) => transform(m) : mask);
-    else if (r.literal) {
+    else if (r.jwtClaim) {
+      for (const token of jwtClaimSpans(out, r.jwtClaim.claim, r.jwtClaim.value)) {
+        out = out.split(token).join(transform ? transform(token) : mask);
+      }
+    } else if (r.literal) {
       const re = new RegExp(r.literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi");
       out = out.replace(re, (m) => transform ? transform(m) : mask);
     }