@patchstack/connect 0.4.2 → 0.5.1

package/dist/protect.edge.js

@@ -2913,7 +2913,7 @@ async function installEgressGuard({ shouldBlock, onBlock, onSkip, dnsScreen = tr
   for (const moduleName of ["node:http", "node:https"]) {
     try {
       const mod = await import(moduleName);
-      const restore = patchHttpModule(mod.default ?? mod, block, screen);
+      const restore = patchHttpModule(mod.default ?? mod, block, screen, skip);
       if (restore) restores.push(restore);
     } catch {
     }
@@ -2927,7 +2927,7 @@ async function installEgressGuard({ shouldBlock, onBlock, onSkip, dnsScreen = tr
     }
   };
 }
-function patchHttpModule(http, block, screen) {
+function patchHttpModule(http, block, screen, skip) {
   if (!http || typeof http.request !== "function" || http.__patchstackGuarded) return null;
   const originalRequest = http.request;
   const originalGet = http.get;
@@ -2938,7 +2938,7 @@ function patchHttpModule(http, block, screen) {
     }
     if (target && screen && target.host && screen.isIP(target.host) === 0 && !screen.isExempt(target.host)) {
       try {
-        args = withScreeningLookup(args, target, block, screen.lookup);
+        args = withScreeningLookup(args, target, block, screen.lookup, skip);
       } catch {
       }
     }
@@ -2991,7 +2991,9 @@ function screenResolved(addresses, target, block) {
   }
   return null;
 }
-function withScreeningLookup(args, target, block, lookup) {
+function withScreeningLookup(args, target, block, lookup, skip) {
+  const own = callerLookup(args);
+  const resolve = typeof own === "function" ? own : lookup;
   const screeningLookup = (hostname, options, callback) => {
     let opts = options;
     let cb = callback;
@@ -3000,29 +3002,43 @@ function withScreeningLookup(args, target, block, lookup) {
       opts = {};
     }
     if (!opts || typeof opts !== "object") opts = {};
+    const handOver = (list) => {
+      if (opts.all) return cb(null, list);
+      const first = list[0];
+      if (!first) return cb(new Error(`Patchstack: could not resolve ${hostname}`));
+      return cb(null, first.address, first.family);
+    };
+    let answered = false;
     try {
-      lookup(hostname, { ...opts, all: true }, (err, addresses) => {
+      resolve(hostname, { ...opts, all: true }, (err, addresses) => {
+        answered = true;
         if (err) return cb(err);
         const list = Array.isArray(addresses) ? addresses : [];
-        const blocked = screenResolved(list, target, block);
+        let blocked;
+        try {
+          blocked = screenResolved(list, target, block);
+        } catch {
+          skip("screen-failed", { host: hostname });
+          return handOver(list);
+        }
         if (blocked) {
           return cb(new Error(`Patchstack blocked an outbound request to a disallowed address: ${target.host} resolved to ${blocked}`));
         }
-        if (opts.all) return cb(null, list);
-        const first = list[0];
-        if (!first) return cb(new Error(`Patchstack: could not resolve ${hostname}`));
-        return cb(null, first.address, first.family);
+        return handOver(list);
       });
-    } catch {
-      try {
-        lookup(hostname, opts, cb);
-      } catch {
-        cb(new Error(`Patchstack: lookup failed for ${hostname}`));
-      }
+    } catch (err) {
+      if (answered) throw err;
+      return cb(err);
     }
   };
   return injectLookupOption(args, screeningLookup);
 }
+function callerLookup(args) {
+  for (const arg of args) {
+    if (arg && typeof arg === "object" && !(arg instanceof URL) && typeof arg.lookup === "function") return arg.lookup;
+  }
+  return void 0;
+}
 function injectLookupOption(args, lookup) {
   const first = args[0];
   if (first && typeof first === "object" && !(first instanceof URL)) {
@@ -4602,8 +4618,17 @@ function createServerFnGuard({ protection }) {
     return { rule: body.rule, message: body.message || "Blocked by Patchstack" };
   };
 }
+function listOption(value, fallback, name, onError) {
+  if (value === void 0) return fallback;
+  if (Array.isArray(value)) return value;
+  notify(onError, new Error(`patchstack: \`${name}\` has to be an array; the value configured is ignored`), "onError");
+  return fallback;
+}
 async function createProtection(options = {}) {
   const onError = options.onError;
+  const allowHosts = listOption(options.allowHosts, [], "allowHosts", onError);
+  const configuredResponseRules = listOption(options.responseRules, DEFAULT_RESPONSE_RULES, "responseRules", onError);
+  const configuredEgressRules = listOption(options.egressRules, DEFAULT_EGRESS_RULES, "egressRules", onError);
   const userOnDetect = options.onDetect ?? defaultOnDetect;
   const apiKey = await resolveApiKey(options);
   const firewallLog = apiKey && telemetryEnabled() && options.reportFirewallLog !== false ? createFirewallLogReporter({
@@ -4703,9 +4728,9 @@ async function createProtection(options = {}) {
   const applyBundle = (delivered) => {
     const incoming = delivered.firewall ?? [];
     requestRules = byPhase(incoming, "request");
-    responseRules = [...options.responseRules ?? DEFAULT_RESPONSE_RULES, ...byPhase(incoming, "response")];
+    responseRules = [...configuredResponseRules, ...byPhase(incoming, "response")];
     screenCap = responseScreenCap(responseRules);
-    egressRules = [...options.egressRules ?? DEFAULT_EGRESS_RULES, ...byPhase(incoming, "egress")];
+    egressRules = [...configuredEgressRules, ...byPhase(incoming, "egress")];
     engine = new RuleEngine({
       firewall: requestRules,
       whitelists: delivered.whitelists,
@@ -5174,7 +5199,7 @@ async function createProtection(options = {}) {
       return origEnd(cb);
     };
   };
-  const allow = new Set((options.allowHosts ?? []).map((h) => String(h).toLowerCase()));
+  const allow = new Set(allowHosts.map((h) => String(h).toLowerCase()));
   const egressShouldBlock = (url, host, method) => {
     if (host && allow.has(host.toLowerCase())) return false;
     let egressPath = null;
@@ -5226,10 +5251,17 @@ async function createProtection(options = {}) {
       return { request: requestRules, response: responseRules, egress: egressRules };
     },
     /**
-     * Enforcement coverage: how often the guard FAILED OPEN rather than inspecting, keyed
-     * `<phase>:<reason>` (e.g. `response:body-cap`, `request:body-cap`, `response:live-stream`,
-     * `egress:resolver-failed`). "Always-on" is not "always inspected" — surface this (or pass
-     * `onSkip`) so an unscreened path is visible and alertable rather than silent.
+     * Enforcement coverage: how often the guard failed open rather than inspecting, in the cases it can
+     * observe itself — keyed `<phase>:<reason>` (e.g. `response:body-cap`, `request:body-cap`,
+     * `response:live-stream`, `egress:resolver-failed` for a fetch call whose address could not be
+     * resolved). "Always-on" is not "always inspected", so surface this (or pass `onSkip`) rather than
+     * assuming coverage.
+     *
+     * Not a total, in two ways. An outbound call can miss the address check without being counted:
+     * whether it resolved through the screening resolver depends on the agent and the socket pool,
+     * which this guard cannot observe. And a resolver failure on the node path appears nowhere here
+     * because it is not a bypass — that resolver is the connection's, so the call fails instead.
+     * Zero skips means nothing the guard can see was bypassed, not that nothing was.
      */
     coverage() {
       return { skipped: { ...skipCounts } };
@@ -5362,7 +5394,7 @@ async function createProtection(options = {}) {
       // same skip accounting as the request/response phases.
       onSkip: ({ reason, detail }) => recordSkip("egress", reason, detail),
       dnsScreen: options.screenDns !== false,
-      allowHosts: options.allowHosts
+      allowHosts
     });
   }
   const cwd = options.cwd ?? (typeof process !== "undefined" ? process.cwd() : void 0);