@pikku/core 0.12.106 → 0.12.111

package/src/middleware/remote-auth.ts

@@ -1,95 +0,0 @@
-import { UnauthorizedError } from '../errors/errors.js'
-import { pikkuMiddleware } from './middleware-factories.js'
-import {
-  assertStrongKeyMaterial,
-  decryptWithKeyMaterial,
-  REMOTE_SESSION_INFO,
-} from '../crypto-utils.js'
-
-const REMOTE_RPC_PREFIX = '/remote/rpc/'
-
-/**
- * Whether this request targets the remote-RPC surface. Compared case-insensitively
- * because the router matches routes that way (path-to-regexp defaults to
- * `sensitive: false`), so `/Remote/RPC/fn` reaches the same handler as
- * `/remote/rpc/fn`. A case-sensitive check here let a case-varied path slip
- * past the trust gate and the token's `fn` binding while still being dispatched.
- */
-const isRemoteRpcPath = (path: string): boolean =>
-  path.toLowerCase().startsWith(REMOTE_RPC_PREFIX)
-
-export const pikkuRemoteAuthMiddleware = pikkuMiddleware(
-  async ({ secrets, jwt }, { http, setSession }, next) => {
-    if (!http?.request || !secrets) {
-      return next()
-    }
-
-    let secret: string
-    try {
-      secret = (await secrets.getSecret('PIKKU_REMOTE_SECRET')).reveal()
-    } catch {
-      if (isRemoteRpcPath(http.request.path())) {
-        throw new UnauthorizedError()
-      }
-      return next()
-    }
-    assertStrongKeyMaterial('PIKKU_REMOTE_SECRET', secret)
-
-    if (!jwt) {
-      throw new Error('PIKKU_REMOTE_SECRET set but JWT service missing')
-    }
-
-    const authHeader =
-      http.request.header('authorization') ||
-      http.request.header('Authorization')
-
-    if (!authHeader) {
-      throw new UnauthorizedError()
-    }
-
-    const [scheme, token] = authHeader.split(' ')
-    if (scheme !== 'Bearer' || !token) {
-      throw new UnauthorizedError()
-    }
-
-    let payload: any
-    try {
-      payload = await jwt.decode(token)
-    } catch {
-      throw new UnauthorizedError()
-    }
-
-    if (payload?.aud !== 'pikku-remote') {
-      throw new UnauthorizedError()
-    }
-
-    if (payload?.fn && isRemoteRpcPath(http.request.path())) {
-      // The prefix length is the same in any case, so slicing the raw path
-      // keeps the requested function name in its original case for the compare.
-      const fn = decodeURIComponent(
-        http.request.path().slice(REMOTE_RPC_PREFIX.length)
-      )
-      if (fn && payload.fn !== fn) {
-        throw new UnauthorizedError()
-      }
-    }
-
-    if (payload?.session) {
-      try {
-        const decrypted = await decryptWithKeyMaterial<{ session?: unknown }>(
-          'PIKKU_REMOTE_SECRET',
-          secret,
-          REMOTE_SESSION_INFO,
-          payload.session
-        )
-        if (decrypted?.session && setSession) {
-          await setSession(decrypted.session)
-        }
-      } catch {
-        throw new UnauthorizedError()
-      }
-    }
-
-    return next()
-  }
-)

package/src/middleware/remote-jobs-secret.ts

@@ -1,35 +0,0 @@
-import { UnauthorizedError } from '../errors/errors.js'
-import {
-  REMOTE_JOBS_SECRET_HEADER,
-  REMOTE_JOBS_SECRET_VARIABLE,
-} from '../services/remote-jobs.js'
-import { pikkuMiddleware } from './middleware-factories.js'
-
-const constantTimeEqual = (a: string, b: string): boolean => {
-  if (a.length !== b.length) return false
-  let result = 0
-  for (let i = 0; i < a.length; i++) {
-    result |= a.charCodeAt(i) ^ b.charCodeAt(i)
-  }
-  return result === 0
-}
-
-/**
- * Guards the remote job inbox. Fails closed: an unset secret rejects every
- * caller, so the routes are never open just because the deployment forgot to
- * configure one.
- */
-export const remoteJobsSecret = pikkuMiddleware(
-  async ({ variables }, { http }, next) => {
-    const expected = await variables.get(REMOTE_JOBS_SECRET_VARIABLE)
-    const provided = http?.request?.header(REMOTE_JOBS_SECRET_HEADER)
-    if (
-      !expected ||
-      typeof provided !== 'string' ||
-      !constantTimeEqual(provided, expected)
-    ) {
-      throw new UnauthorizedError('invalid dispatch secret')
-    }
-    return next()
-  }
-)

package/src/middleware/require-origin.test.ts

@@ -1,115 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import assert from 'node:assert'
-import { requireOrigin, isAllowedOrigin, toOrigin } from './require-origin.js'
-import { InvalidOriginError } from '../errors/errors.js'
-import { resetPikkuState } from '../pikku-state.js'
-
-beforeEach(() => {
-  resetPikkuState()
-})
-
-const headers = (values: Record<string, string | undefined>) => ({
-  method: () => 'post',
-  header: (name: string) => values[name],
-})
-
-const run = async (
-  config: Parameters<typeof requireOrigin>[0],
-  values: Record<string, string | undefined>
-) => {
-  let reached = false
-  const middleware = requireOrigin(config)
-  await middleware({} as any, { http: { request: headers(values) } } as any, async () => {
-    reached = true
-  })
-  return reached
-}
-
-describe('toOrigin', () => {
-  test('keeps scheme, host and port and drops the rest', () => {
-    assert.equal(toOrigin('https://app.com:8443/a/b?c=1'), 'https://app.com:8443')
-  })
-
-  test('rejects the sandboxed-iframe "null" origin and unparseable values', () => {
-    assert.equal(toOrigin('null'), null)
-    assert.equal(toOrigin(''), null)
-    assert.equal(toOrigin(undefined), null)
-  })
-})
-
-describe('isAllowedOrigin', () => {
-  test('matches the request host exactly', () => {
-    assert.equal(isAllowedOrigin('https://app.com', 'https://app.com', []), true)
-  })
-
-  test('does not suffix-match a lookalike domain', () => {
-    assert.equal(isAllowedOrigin('https://evil-app.com', null, ['https://app.com']), false)
-    assert.equal(isAllowedOrigin('https://app.com.evil.net', null, ['https://app.com']), false)
-  })
-
-  test('normalises a configured origin before comparing', () => {
-    assert.equal(isAllowedOrigin('https://app.com', null, ['https://app.com/path']), true)
-  })
-
-  test('rejects a missing origin', () => {
-    assert.equal(isAllowedOrigin(null, 'https://app.com', ['https://app.com']), false)
-  })
-})
-
-describe('requireOrigin', () => {
-  test('allows a beacon from the request own host', async () => {
-    assert.equal(
-      await run({}, { origin: 'https://app.com', host: 'app.com' }),
-      true
-    )
-  })
-
-  test('falls back to referer when only it is sent', async () => {
-    assert.equal(
-      await run({}, { referer: 'https://app.com/pricing', host: 'app.com' }),
-      true
-    )
-  })
-
-  test('honours x-forwarded-proto when deriving the host origin', async () => {
-    assert.equal(
-      await run(
-        {},
-        { origin: 'http://app.com', host: 'app.com', 'x-forwarded-proto': 'http' }
-      ),
-      true
-    )
-  })
-
-  test('rejects another site with a 403', async () => {
-    await assert.rejects(
-      () => run({}, { origin: 'https://evil.com', host: 'app.com' }),
-      InvalidOriginError
-    )
-  })
-
-  test('rejects a non-browser caller that sends no origin', async () => {
-    await assert.rejects(
-      () => run({}, { host: 'app.com' }),
-      InvalidOriginError
-    )
-  })
-
-  test('resolves configured origins from services when given a function', async () => {
-    assert.equal(
-      await run(
-        { origins: async () => ['https://other.com'] },
-        { origin: 'https://other.com', host: 'app.com' }
-      ),
-      true
-    )
-  })
-
-  test('passes through when there is no http wire at all', async () => {
-    let reached = false
-    await requireOrigin({})({} as any, {} as any, async () => {
-      reached = true
-    })
-    assert.equal(reached, true)
-  })
-})

package/src/middleware/require-origin.ts

@@ -1,79 +0,0 @@
-import type { CoreSingletonServices } from '../types/core.types.js'
-import { InvalidOriginError } from '../errors/errors.js'
-import {
-  pikkuMiddleware,
-  pikkuMiddlewareFactory,
-} from './middleware-factories.js'
-
-/** Scheme + host + port, or null for anything unparseable including the literal `"null"` origin. */
-export const toOrigin = (value: string | null | undefined): string | null => {
-  if (!value) return null
-  try {
-    const url = new URL(value)
-    return url.protocol && url.host ? url.origin : null
-  } catch {
-    return null
-  }
-}
-
-/**
- * Whether a request origin may post to an origin-locked route.
- *
- * The comparison is exact on the parsed origin, never a suffix match:
- * `endsWith('myapp.com')` also accepts `https://evil-myapp.com`.
- */
-export const isAllowedOrigin = (
-  requestOrigin: string | null,
-  hostOrigin: string | null,
-  configuredOrigins: string[]
-): boolean => {
-  if (!requestOrigin) return false
-  if (hostOrigin && requestOrigin === hostOrigin) return true
-  return configuredOrigins.some((allowed) => toOrigin(allowed) === requestOrigin)
-}
-
-/**
- * Rejects a request with a 403 unless its `Origin` is this app's own or explicitly allowed.
- *
- * This is not what `cors()` does. CORS sets response headers and is enforced by the
- * browser, so a non-browser client ignores them and the request still runs; this rejects
- * before the function body. It stops another site's page from posting to an unauthed
- * route — it is not flood control, because `Origin` is trusted from nobody but a browser.
- * A missing `Origin` is rejected too: a real browser sets one on a cross-origin-capable POST.
- */
-export const requireOrigin = pikkuMiddlewareFactory<{
-  /** Extra allowed origins beyond the request's own host, or a resolver for them. */
-  origins?:
-    | string[]
-    | ((services: CoreSingletonServices) => string[] | Promise<string[]>)
-}>(({ origins = [] } = {}) =>
-  pikkuMiddleware({
-    name: 'requireOrigin',
-    description: 'Rejects requests that did not come from this app.',
-    func: async (services, { http }, next) => {
-      const request = http?.request
-      if (!request) return next()
-
-      const requestOrigin =
-        toOrigin(request.header('origin')) ??
-        toOrigin(request.header('referer'))
-
-      const host = request.header('host')
-      const proto = request.header('x-forwarded-proto') ?? 'https'
-      const hostOrigin = host ? toOrigin(`${proto}://${host}`) : null
-
-      const configured =
-        typeof origins === 'function'
-          ? await origins(services as CoreSingletonServices)
-          : origins
-
-      if (!isAllowedOrigin(requestOrigin, hostOrigin, configured)) {
-        throw new InvalidOriginError(
-          `Rejected origin ${requestOrigin ?? '(none)'}`
-        )
-      }
-
-      return next()
-    },
-  })
-)

package/src/middleware/telemetry.ts

@@ -1,83 +0,0 @@
-import {
-  pikkuMiddleware,
-  pikkuMiddlewareFactory,
-} from './middleware-factories.js'
-/** Outermost telemetry: total duration, including every middleware. */
-export const telemetryOuter = pikkuMiddlewareFactory<{
-  environmentId?: string
-  orgId?: string
-} | void>(({ environmentId, orgId } = {}) => {
-  return pikkuMiddleware({
-    name: 'telemetry-outer',
-    priority: 'highest',
-    func: async (services, wire, next) => {
-      const start = performance.now()
-      let outcome = 'ok'
-      let errorMessage: string | undefined
-      try {
-        await next()
-      } catch (e) {
-        outcome = 'error'
-        errorMessage = e instanceof Error ? e.message : String(e)
-        throw e
-      } finally {
-        services.logger.info({
-          __pikku_telemetry: 'end',
-          __pikku_layer: 'outer',
-          traceId: wire.traceId,
-          wireType: wire.wireType,
-          wireId: wire.wireId,
-          totalDuration: Math.round(performance.now() - start),
-          outcome,
-          ...(errorMessage ? { errorMessage } : {}),
-          ...(wire.http
-            ? {
-                httpStatus: wire.http.response?.statusCode,
-                httpMethod: wire.http.request?.method(),
-                httpPath: wire.http.request?.path(),
-              }
-            : {}),
-          ...(environmentId ? { environmentId } : {}),
-          ...(orgId ? { orgId } : {}),
-        })
-      }
-    },
-  })
-})
-
-/** Innermost telemetry: function-only duration, excluding outer middleware. */
-export const telemetryInner = pikkuMiddlewareFactory<{
-  environmentId?: string
-  orgId?: string
-} | void>(({ environmentId, orgId } = {}) => {
-  return pikkuMiddleware({
-    name: 'telemetry-inner',
-    priority: 'lowest',
-    func: async (services, wire, next) => {
-      const start = performance.now()
-      let outcome = 'ok'
-      let errorMessage: string | undefined
-      try {
-        await next()
-      } catch (e) {
-        outcome = 'error'
-        errorMessage = e instanceof Error ? e.message : String(e)
-        throw e
-      } finally {
-        services.logger.info({
-          __pikku_telemetry: 'end',
-          __pikku_layer: 'inner',
-          traceId: wire.traceId,
-          wireType: wire.wireType,
-          wireId: wire.wireId,
-          functionDuration: Math.round(performance.now() - start),
-          outcome,
-          pikkuUserId: wire.pikkuUserId,
-          ...(errorMessage ? { errorMessage } : {}),
-          ...(environmentId ? { environmentId } : {}),
-          ...(orgId ? { orgId } : {}),
-        })
-      }
-    },
-  })
-})