@prosopo/provider 4.15.14 → 4.15.16

package/dist/api/startProviderApi.js

@@ -1,245 +1,218 @@
-import fs from "node:fs";
-import https__default from "node:https";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { createApiExpressDefaultEndpointAdapter, requestLoggerMiddleware, authMiddleware, apiExpressRouterFactory } from "@prosopo/api-express-router";
-import { i18nMiddleware } from "@prosopo/locale";
-import { parseLogLevel } from "@prosopo/logger";
-import { ClientApiPaths, AdminApiPaths } from "@prosopo/types";
-import { AccessRuleApiRoutes, getExpressApiRuleRateLimits } from "@prosopo/user-access-policy/api";
-import cors from "cors";
-import express from "express";
-import rateLimit from "express-rate-limit";
-import { createApiAdminRoutesProvider } from "./admin/createApiAdminRoutesProvider.js";
+import { metricsMiddleware } from "./metrics.js";
 import { getVerdictCache } from "./blacklistRequestInspector.js";
 import { blockMiddleware } from "./block.js";
 import { prosopoRouter } from "./captcha.js";
-import { domainMiddleware } from "./domainMiddleware.js";
+import { prosopoVerifyRouter } from "./verify.js";
+import { ja4Middleware } from "./ja4Middleware.js";
 import { handshakeTimingMiddleware } from "./handshakeTimingMiddleware.js";
+import { publicRouter } from "./public.js";
+import { domainMiddleware } from "./domainMiddleware.js";
+import { createApiAdminRoutesProvider } from "./admin/createApiAdminRoutesProvider.js";
 import { headerCheckMiddleware } from "./headerCheckMiddleware.js";
 import { ignoreMiddleware } from "./ignoreMiddleware.js";
 import { ipInfoMiddleware } from "./ipInfoMiddleware.js";
-import { ja4Middleware } from "./ja4Middleware.js";
-import { metricsMiddleware } from "./metrics.js";
-import { publicRouter } from "./public.js";
 import { robotsMiddleware } from "./robotsMiddleware.js";
-import { prosopoVerifyRouter } from "./verify.js";
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const certPath = path.resolve(__dirname, "../../../../certs");
-const keyPath = path.join(certPath, "server.key");
-const crtPath = path.join(certPath, "server.crt");
-const isTlsAvailable = () => {
-  return fs.existsSync(keyPath) && fs.existsSync(crtPath);
+import { parseLogLevel } from "@prosopo/logger";
+import { AdminApiPaths, ClientApiPaths } from "@prosopo/types";
+import https from "node:https";
+import fs from "node:fs";
+import { apiExpressRouterFactory, authMiddleware, createApiExpressDefaultEndpointAdapter, requestLoggerMiddleware } from "@prosopo/api-express-router";
+import express from "express";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { i18nMiddleware } from "@prosopo/locale";
+import { AccessRuleApiRoutes, getExpressApiRuleRateLimits } from "@prosopo/user-access-policy/api";
+import cors from "cors";
+import rateLimit from "express-rate-limit";
+//#region src/api/startProviderApi.ts
+var __dirname = path.dirname(fileURLToPath(import.meta.url));
+var certPath = path.resolve(__dirname, "../../../../certs");
+var keyPath = path.join(certPath, "server.key");
+var crtPath = path.join(certPath, "server.crt");
+/**
+* Check if TLS certificates are available
+* @returns True if both key and cert files exist
+*/
+var isTlsAvailable = () => {
+	return fs.existsSync(keyPath) && fs.existsSync(crtPath);
 };
-const getClientApiPathsExpectingProsopoHeaders = () => {
-  const paths = Object.values(ClientApiPaths).filter(
-    (path2) => path2.indexOf("verify") === -1 && path2.indexOf("spam") === -1
-  );
-  return paths;
+/**
+* Get client API paths that expect Prosopo headers (like site key) for validation, excluding verify and spam routes
+* @returns Array of ClientApiPaths excluding verify and spam routes
+*/
+var getClientApiPathsExpectingProsopoHeaders = () => {
+	return Object.values(ClientApiPaths).filter((path) => path.indexOf("verify") === -1 && path.indexOf("spam") === -1);
 };
-const getUserFromJWT = (req) => {
-  try {
-    const authHeader = req.headers.Authorization || req.headers.authorization;
-    if (!authHeader || typeof authHeader !== "string") {
-      return void 0;
-    }
-    const jwt = authHeader.replace("Bearer ", "");
-    if (!jwt) {
-      return void 0;
-    }
-    const parts = jwt.split(".");
-    if (parts.length !== 3 || !parts[1]) {
-      return void 0;
-    }
-    const payload = JSON.parse(
-      Buffer.from(parts[1], "base64url").toString("utf-8")
-    );
-    return payload.sub;
-  } catch (e) {
-    return void 0;
-  }
+/**
+* Extract authenticated user address from JWT for rate limiting
+* @param req Express request object
+* @returns User address from JWT or undefined
+*/
+var getUserFromJWT = (req) => {
+	try {
+		const authHeader = req.headers.Authorization || req.headers.authorization;
+		if (!authHeader || typeof authHeader !== "string") return;
+		const jwt = authHeader.replace("Bearer ", "");
+		if (!jwt) return;
+		const parts = jwt.split(".");
+		if (parts.length !== 3 || !parts[1]) return;
+		return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8")).sub;
+	} catch (e) {
+		return;
+	}
 };
+/**
+* Start the Prosopo Provider API server
+*
+* This function creates and configures an Express server with all necessary middleware
+* for the Prosopo Provider API, including:
+* - CORS support
+* - Rate limiting (disabled in test/development environments)
+* - Authentication and authorization
+* - Request validation (headers, domains, etc.)
+* - Blocking and security middleware
+* - Admin and client API routes
+* - Access rule management
+*
+* @param env - The ProviderEnvironment containing configuration and database connections
+* @param admin - Whether to enable admin mode (currently unused, kept for compatibility)
+* @param port - Optional port override. If not provided, uses env.config.server.port
+* @returns Promise<Server> - The Node.js HTTP server instance
+*
+* @example
+* ```typescript
+* const env = new ProviderEnvironment(config);
+* await env.isReady();
+* const server = await startProviderApi(env);
+* ```
+*/
 async function startProviderApi(env, admin = false, port) {
-  env.logger.info(() => ({ msg: "Starting Prosopo API" }));
-  const apiApp = express();
-  const apiPort = port || env.config.server?.port;
-  const apiEndpointAdapter = createApiExpressDefaultEndpointAdapter(
-    parseLogLevel(env.config.logLevel)
-  );
-  let apiRuleRoutesProvider;
-  let apiAdminRoutesProvider;
-  try {
-    apiRuleRoutesProvider = new AccessRuleApiRoutes(
-      env.getDb().getUserAccessRulesStorage(),
-      env.logger
-    );
-    apiAdminRoutesProvider = createApiAdminRoutesProvider(env);
-  } catch (err) {
-    env.logger.warn(() => ({
-      msg: "Skipping admin/access-rule routes; DB unavailable",
-      err
-    }));
-  }
-  const clientPathsExcludingVerify = getClientApiPathsExpectingProsopoHeaders();
-  env.logger.debug(() => ({
-    msg: "Adding headerCheckMiddleware",
-    paths: clientPathsExcludingVerify
-  }));
-  apiApp.set("trust proxy", 1);
-  apiApp.use(
-    cors({
-      exposedHeaders: ["x-prosopo-meta"],
-      allowedHeaders: [
-        "Accept",
-        "Accept-Language",
-        "Authorization",
-        "Content-Language",
-        "Content-Type",
-        "Prosopo-Site-Key",
-        "Prosopo-User",
-        "x-prosopo-meta"
-      ],
-      maxAge: 86400
-    })
-  );
-  apiApp.use(express.json({ limit: "1mb" }));
-  apiApp.use(publicRouter(env));
-  apiApp.use(metricsMiddleware());
-  const isTestOrDevelopmentEnv = process.env.NODE_ENV === "test" || env.config.defaultEnvironment === "development";
-  if (!isTestOrDevelopmentEnv) {
-    const configRateLimits = env.config.rateLimits;
-    const rateLimits = {
-      ...configRateLimits,
-      ...getExpressApiRuleRateLimits()
-    };
-    const adminPaths = Object.values(AdminApiPaths);
-    const rateLimitHandler = (path2) => (req, res, _next, options) => {
-      env.logger.warn(() => ({
-        msg: "Rate limit exceeded",
-        data: {
-          path: path2,
-          ip: req.ip,
-          siteKey: req.headers["prosopo-site-key"]
-        }
-      }));
-      res.status(options.statusCode).send(options.message);
-    };
-    for (const [path2, limit] of Object.entries(rateLimits)) {
-      const enumPath = path2;
-      if (adminPaths.includes(enumPath)) {
-        apiApp.use(
-          enumPath,
-          rateLimit({
-            ...limit,
-            handler: rateLimitHandler(enumPath),
-            keyGenerator: (req) => {
-              const user = getUserFromJWT(req);
-              return user || req.ip || "unknown";
-            }
-          })
-        );
-      } else if (path2 === ClientApiPaths.VerifyImageCaptchaSolutionDapp || path2 === ClientApiPaths.VerifyPowCaptchaSolution) {
-        apiApp.use(
-          enumPath,
-          rateLimit({
-            ...limit,
-            handler: rateLimitHandler(enumPath),
-            keyGenerator: (req) => {
-              const siteKey = req.headers["prosopo-site-key"];
-              return siteKey || req.ip || "unknown";
-            }
-          })
-        );
-      } else {
-        apiApp.use(
-          enumPath,
-          rateLimit({ ...limit, handler: rateLimitHandler(enumPath) })
-        );
-      }
-    }
-  }
-  const i18Middleware = await i18nMiddleware({});
-  apiApp.use(robotsMiddleware());
-  apiApp.use(ignoreMiddleware());
-  apiApp.use(requestLoggerMiddleware(env));
-  apiApp.use(i18Middleware);
-  apiApp.use(ja4Middleware(env));
-  apiApp.use(handshakeTimingMiddleware(env));
-  apiApp.use(ipInfoMiddleware(env));
-  apiApp.use(clientPathsExcludingVerify, headerCheckMiddleware(env));
-  apiApp.use(prosopoVerifyRouter(env));
-  env.logger.info(() => ({ msg: "Enabling admin auth middleware" }));
-  apiApp.use(
-    "/v1/prosopo/provider/admin",
-    authMiddleware(env.pair, env.authAccount)
-  );
-  if (apiRuleRoutesProvider) {
-    const userAccessRuleRoutes = apiRuleRoutesProvider.getRoutes();
-    for (const userAccessRuleRoute in userAccessRuleRoutes) {
-      apiApp.use(
-        userAccessRuleRoute,
-        authMiddleware(env.pair, env.authAccount)
-      );
-    }
-    for (const userAccessRuleRoute in userAccessRuleRoutes) {
-      apiApp.use(userAccessRuleRoute, (req, res, next) => {
-        if (req.method === "POST") {
-          res.on("finish", () => {
-            if (res.statusCode >= 200 && res.statusCode < 300) {
-              getVerdictCache().clear();
-            }
-          });
-        }
-        next();
-      });
-    }
-    apiApp.use(
-      apiExpressRouterFactory.createRouter(
-        apiRuleRoutesProvider,
-        apiEndpointAdapter
-      )
-    );
-  }
-  if (apiAdminRoutesProvider) {
-    apiApp.use(
-      apiExpressRouterFactory.createRouter(
-        apiAdminRoutesProvider,
-        // unlike the default one, it should have errorStatusCode as 400
-        createApiExpressDefaultEndpointAdapter(
-          parseLogLevel(env.config.logLevel),
-          400
-        )
-      )
-    );
-  }
-  apiApp.use(blockMiddleware(env));
-  apiApp.use("/v1/prosopo/provider/client/", domainMiddleware(env));
-  apiApp.use(prosopoRouter(env));
-  const useTls = fs.existsSync(keyPath) && fs.existsSync(crtPath);
-  if (useTls) {
-    env.logger.info(() => ({ msg: "Starting Provider API with HTTPS" }));
-    const httpsOptions = {
-      key: fs.readFileSync(keyPath),
-      cert: fs.readFileSync(crtPath)
-    };
-    const httpsServer = https__default.createServer(httpsOptions, apiApp);
-    return httpsServer.listen(apiPort, () => {
-      env.logger.info(() => ({
-        data: { apiPort, protocol: "https" },
-        msg: "Prosopo app listening with HTTPS"
-      }));
-    });
-  }
-  return apiApp.listen(apiPort, () => {
-    env.logger.info(() => ({
-      data: { apiPort },
-      msg: "Prosopo app listening"
-    }));
-  });
+	env.logger.info(() => ({ msg: "Starting Prosopo API" }));
+	const apiApp = express();
+	const apiPort = port || env.config.server?.port;
+	const apiEndpointAdapter = createApiExpressDefaultEndpointAdapter(parseLogLevel(env.config.logLevel));
+	let apiRuleRoutesProvider;
+	let apiAdminRoutesProvider;
+	try {
+		apiRuleRoutesProvider = new AccessRuleApiRoutes(env.getDb().getUserAccessRulesStorage(), env.logger);
+		apiAdminRoutesProvider = createApiAdminRoutesProvider(env);
+	} catch (err) {
+		env.logger.warn(() => ({
+			msg: "Skipping admin/access-rule routes; DB unavailable",
+			err
+		}));
+	}
+	const clientPathsExcludingVerify = getClientApiPathsExpectingProsopoHeaders();
+	env.logger.debug(() => ({
+		msg: "Adding headerCheckMiddleware",
+		paths: clientPathsExcludingVerify
+	}));
+	apiApp.set("trust proxy", 1);
+	apiApp.use(cors({
+		exposedHeaders: ["x-prosopo-meta"],
+		allowedHeaders: [
+			"Accept",
+			"Accept-Language",
+			"Authorization",
+			"Content-Language",
+			"Content-Type",
+			"Prosopo-Site-Key",
+			"Prosopo-User",
+			"x-prosopo-meta"
+		],
+		maxAge: 86400
+	}));
+	apiApp.use(express.json({ limit: "1mb" }));
+	apiApp.use(publicRouter(env));
+	apiApp.use(metricsMiddleware());
+	if (!(process.env.NODE_ENV === "test" || env.config.defaultEnvironment === "development")) {
+		const rateLimits = {
+			...env.config.rateLimits,
+			...getExpressApiRuleRateLimits()
+		};
+		const adminPaths = Object.values(AdminApiPaths);
+		const rateLimitHandler = (path) => (req, res, _next, options) => {
+			env.logger.warn(() => ({
+				msg: "Rate limit exceeded",
+				data: {
+					path,
+					ip: req.ip,
+					siteKey: req.headers["prosopo-site-key"]
+				}
+			}));
+			res.status(options.statusCode).send(options.message);
+		};
+		for (const [path, limit] of Object.entries(rateLimits)) {
+			const enumPath = path;
+			if (adminPaths.includes(enumPath)) apiApp.use(enumPath, rateLimit({
+				...limit,
+				handler: rateLimitHandler(enumPath),
+				keyGenerator: (req) => {
+					return getUserFromJWT(req) || req.ip || "unknown";
+				}
+			}));
+			else if (path === ClientApiPaths.VerifyImageCaptchaSolutionDapp || path === ClientApiPaths.VerifyPowCaptchaSolution) apiApp.use(enumPath, rateLimit({
+				...limit,
+				handler: rateLimitHandler(enumPath),
+				keyGenerator: (req) => {
+					return req.headers["prosopo-site-key"] || req.ip || "unknown";
+				}
+			}));
+			else apiApp.use(enumPath, rateLimit({
+				...limit,
+				handler: rateLimitHandler(enumPath)
+			}));
+		}
+	}
+	const i18Middleware = await i18nMiddleware({});
+	apiApp.use(robotsMiddleware());
+	apiApp.use(ignoreMiddleware());
+	apiApp.use(requestLoggerMiddleware(env));
+	apiApp.use(i18Middleware);
+	apiApp.use(ja4Middleware(env));
+	apiApp.use(handshakeTimingMiddleware(env));
+	apiApp.use(ipInfoMiddleware(env));
+	apiApp.use(clientPathsExcludingVerify, headerCheckMiddleware(env));
+	apiApp.use(prosopoVerifyRouter(env));
+	env.logger.info(() => ({ msg: "Enabling admin auth middleware" }));
+	apiApp.use("/v1/prosopo/provider/admin", authMiddleware(env.pair, env.authAccount));
+	if (apiRuleRoutesProvider) {
+		const userAccessRuleRoutes = apiRuleRoutesProvider.getRoutes();
+		for (const userAccessRuleRoute in userAccessRuleRoutes) apiApp.use(userAccessRuleRoute, authMiddleware(env.pair, env.authAccount));
+		for (const userAccessRuleRoute in userAccessRuleRoutes) apiApp.use(userAccessRuleRoute, (req, res, next) => {
+			if (req.method === "POST") res.on("finish", () => {
+				if (res.statusCode >= 200 && res.statusCode < 300) getVerdictCache().clear();
+			});
+			next();
+		});
+		apiApp.use(apiExpressRouterFactory.createRouter(apiRuleRoutesProvider, apiEndpointAdapter));
+	}
+	if (apiAdminRoutesProvider) apiApp.use(apiExpressRouterFactory.createRouter(apiAdminRoutesProvider, createApiExpressDefaultEndpointAdapter(parseLogLevel(env.config.logLevel), 400)));
+	apiApp.use(blockMiddleware(env));
+	apiApp.use("/v1/prosopo/provider/client/", domainMiddleware(env));
+	apiApp.use(prosopoRouter(env));
+	if (fs.existsSync(keyPath) && fs.existsSync(crtPath)) {
+		env.logger.info(() => ({ msg: "Starting Provider API with HTTPS" }));
+		const httpsOptions = {
+			key: fs.readFileSync(keyPath),
+			cert: fs.readFileSync(crtPath)
+		};
+		return https.createServer(httpsOptions, apiApp).listen(apiPort, () => {
+			env.logger.info(() => ({
+				data: {
+					apiPort,
+					protocol: "https"
+				},
+				msg: "Prosopo app listening with HTTPS"
+			}));
+		});
+	}
+	return apiApp.listen(apiPort, () => {
+		env.logger.info(() => ({
+			data: { apiPort },
+			msg: "Prosopo app listening"
+		}));
+	});
 }
-export {
-  getClientApiPathsExpectingProsopoHeaders,
-  getUserFromJWT,
-  isTlsAvailable,
-  startProviderApi
-};
+//#endregion
+export { getClientApiPathsExpectingProsopoHeaders, getUserFromJWT, isTlsAvailable, startProviderApi };

package/dist/api/testSiteKey.js

@@ -1,17 +1,17 @@
-import { getTestSiteKeyMode, TestSiteKeyMode } from "@prosopo/types";
-const isReservedTestSiteKey = (siteKey) => getTestSiteKeyMode(siteKey) !== null;
-const resolveTestSiteKeyVerdict = (siteKey, logger) => {
-  const mode = getTestSiteKeyMode(siteKey);
-  if (mode === null) {
-    return null;
-  }
-  logger?.warn(() => ({
-    msg: "Reserved TEST site key - forcing deterministic captcha verdict",
-    data: { siteKey, mode }
-  }));
-  return mode === TestSiteKeyMode.Pass;
-};
-export {
-  isReservedTestSiteKey,
-  resolveTestSiteKeyVerdict
+import { TestSiteKeyMode, getTestSiteKeyMode } from "@prosopo/types";
+//#region src/api/testSiteKey.ts
+var isReservedTestSiteKey = (siteKey) => getTestSiteKeyMode(siteKey) !== null;
+var resolveTestSiteKeyVerdict = (siteKey, logger) => {
+	const mode = getTestSiteKeyMode(siteKey);
+	if (mode === null) return null;
+	logger?.warn(() => ({
+		msg: "Reserved TEST site key - forcing deterministic captcha verdict",
+		data: {
+			siteKey,
+			mode
+		}
+	}));
+	return mode === TestSiteKeyMode.Pass;
 };
+//#endregion
+export { isReservedTestSiteKey, resolveTestSiteKeyVerdict };

package/dist/api/validateAddress.js

@@ -1,25 +1,27 @@
 import { ProsopoApiError } from "@prosopo/common";
 import { validateAddress } from "@prosopo/util-crypto";
-const validateSiteKey = (siteKey, logger) => {
-  return validateAddr(siteKey, "API.INVALID_SITE_KEY", logger);
+//#region src/api/validateAddress.ts
+var validateSiteKey = (siteKey, logger) => {
+	return validateAddr(siteKey, "API.INVALID_SITE_KEY", logger);
 };
-const validateAddr = (address, translationKey = "CONTRACT.INVALID_ADDRESS", logger) => {
-  try {
-    const valid = validateAddress(address, false, 42);
-    if (!valid) {
-      throw new ProsopoApiError(translationKey, {
-        context: { code: 400, siteKey: address },
-        logger
-      });
-    }
-  } catch (err) {
-    throw new ProsopoApiError(translationKey, {
-      context: { code: 400, siteKey: address },
-      logger
-    });
-  }
-};
-export {
-  validateAddr,
-  validateSiteKey
+var validateAddr = (address, translationKey = "CONTRACT.INVALID_ADDRESS", logger) => {
+	try {
+		if (!validateAddress(address, false, 42)) throw new ProsopoApiError(translationKey, {
+			context: {
+				code: 400,
+				siteKey: address
+			},
+			logger
+		});
+	} catch (err) {
+		throw new ProsopoApiError(translationKey, {
+			context: {
+				code: 400,
+				siteKey: address
+			},
+			logger
+		});
+	}
 };
+//#endregion
+export { validateAddr, validateSiteKey };