@prosopo/provider 5.12.2 → 5.12.3

package/dist/tests/unit/api/captcha/sealedAssetsResolver.unit.test.js

@@ -0,0 +1,151 @@
+import { afterEach, describe, expect, test } from "vitest";
+import { unsealAssetPath } from "../../../../api/captcha/assetSeal.js";
+import { SEAL_KEY_BYTES, toBase64Url, } from "../../../../api/captcha/assetSealFormat.js";
+import { DEFAULT_ASSET_SEAL_TTL_SECONDS, SealedAssetsResolver, getSealedAssetsResolver, } from "../../../../api/captcha/sealedAssetsResolver.js";
+const KEY = new Uint8Array(SEAL_KEY_BYTES).fill(3);
+const KEY_ID = 4;
+const NOW_MS = 1_700_000_000_000;
+const ORIGIN = "https://prosopoimages.b-cdn.net";
+const PATH = "/v5_dataset_flat/images/abc.webp";
+const IMAGE = `${ORIGIN}${PATH}`;
+const resolver = (options = {}) => new SealedAssetsResolver({
+    key: KEY,
+    keyId: KEY_ID,
+    now: () => NOW_MS,
+    ...options,
+});
+const opened = (sealedUrl, nowSeconds = NOW_MS / 1000) => {
+    const segments = new URL(sealedUrl).pathname.split("/");
+    const blob = segments[segments.length - 1]?.replace(/\.[a-z0-9]+$/, "") ?? "";
+    const path = unsealAssetPath({
+        blob,
+        keys: new Map([[KEY_ID, KEY]]),
+        nowSeconds,
+    });
+    if (!path)
+        throw new Error("expected the sealed URL to open");
+    return path;
+};
+const withEnv = (values, run) => {
+    const saved = new Map();
+    for (const [name, value] of Object.entries(values)) {
+        saved.set(name, process.env[name]);
+        if (undefined === value) {
+            Reflect.deleteProperty(process.env, name);
+        }
+        else {
+            process.env[name] = value;
+        }
+    }
+    try {
+        run();
+    }
+    finally {
+        for (const [name, value] of saved) {
+            if (undefined === value) {
+                Reflect.deleteProperty(process.env, name);
+            }
+            else {
+                process.env[name] = value;
+            }
+        }
+    }
+};
+describe("SealedAssetsResolver", () => {
+    test("keeps the image on the same zone", () => {
+        const url = new URL(resolver().resolveAsset(IMAGE).getURL());
+        expect(url.origin).toBe(ORIGIN);
+    });
+    test("replaces the path with an opaque blob under the prefix", () => {
+        const url = new URL(resolver().resolveAsset(IMAGE).getURL());
+        expect(url.pathname).toMatch(/^\/s\/[A-Za-z0-9_-]+\.webp$/);
+        expect(url.pathname).not.toContain("abc");
+        expect(url.pathname).not.toContain("v5_dataset_flat");
+    });
+    test("the blob opens to the original path", () => {
+        expect(opened(resolver().resolveAsset(IMAGE).getURL())).toBe(PATH);
+    });
+    test("gives the same image a different URL every time", () => {
+        const instance = resolver();
+        const urls = new Set(Array.from({ length: 20 }, () => instance.resolveAsset(IMAGE).getURL()));
+        expect(urls.size).toBe(20);
+    });
+    test("expires the URL after the ttl", () => {
+        const url = resolver({ ttlSeconds: 120 }).resolveAsset(IMAGE).getURL();
+        expect(opened(url, NOW_MS / 1000 + 119)).toBe(PATH);
+        expect(() => opened(url, NOW_MS / 1000 + 120)).toThrow();
+    });
+    test("defaults to the same window as a signed URL", () => {
+        const url = resolver().resolveAsset(IMAGE).getURL();
+        expect(opened(url, NOW_MS / 1000 + DEFAULT_ASSET_SEAL_TTL_SECONDS - 1)).toBe(PATH);
+        expect(() => opened(url, NOW_MS / 1000 + DEFAULT_ASSET_SEAL_TTL_SECONDS)).toThrow();
+    });
+    test("honours a configured url prefix", () => {
+        const url = new URL(resolver({ urlPrefix: "img" }).resolveAsset(IMAGE).getURL());
+        expect(url.pathname.startsWith("/img/")).toBe(true);
+    });
+    test("carries the file extension over", () => {
+        for (const [path, expected] of [
+            ["/a/b.webp", ".webp"],
+            ["/a/b.jpeg", ".jpeg"],
+            ["/a/b", ""],
+            ["/a/b.", ""],
+        ]) {
+            const url = resolver().resolveAsset(`${ORIGIN}${path}`).getURL();
+            expect(url.endsWith(`${expected}`)).toBe(true);
+        }
+    });
+    test("preserves the original URI on the asset", () => {
+        expect(resolver().resolveAsset(IMAGE).URI).toBe(IMAGE);
+    });
+    test("passes through anything that is not an http url", () => {
+        for (const uri of ["/local/fixture.webp", "not a url", "file:///a.webp"]) {
+            expect(resolver().resolveAsset(uri).getURL()).toBe(uri);
+        }
+    });
+    test("refuses a url that already has a query string", () => {
+        expect(() => resolver().resolveAsset(`${IMAGE}?v=2`)).toThrow(/query string/);
+    });
+});
+describe("getSealedAssetsResolver", () => {
+    afterEach(() => {
+        Reflect.deleteProperty(process.env, "PROSOPO_ASSET_SEAL_KEYS");
+        Reflect.deleteProperty(process.env, "PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID");
+    });
+    test("is off until keys are configured", () => {
+        withEnv({ PROSOPO_ASSET_SEAL_KEYS: undefined }, () => {
+            expect(getSealedAssetsResolver()).toBeUndefined();
+        });
+    });
+    test("seals with the highest key id by default", () => {
+        withEnv({
+            PROSOPO_ASSET_SEAL_KEYS: `1:${toBase64Url(new Uint8Array(SEAL_KEY_BYTES).fill(1))},${KEY_ID}:${toBase64Url(KEY)}`,
+            PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID: undefined,
+        }, () => {
+            const url = getSealedAssetsResolver()?.resolveAsset(IMAGE).getURL();
+            if (!url)
+                throw new Error("expected a resolver");
+            expect(opened(url, Math.floor(Date.now() / 1000))).toBe(PATH);
+        });
+    });
+    test("seals with the key id it is told to", () => {
+        withEnv({
+            PROSOPO_ASSET_SEAL_KEYS: `${KEY_ID}:${toBase64Url(KEY)},9:${toBase64Url(new Uint8Array(SEAL_KEY_BYTES).fill(9))}`,
+            PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID: String(KEY_ID),
+        }, () => {
+            const url = getSealedAssetsResolver()?.resolveAsset(IMAGE).getURL();
+            if (!url)
+                throw new Error("expected a resolver");
+            expect(opened(url, Math.floor(Date.now() / 1000))).toBe(PATH);
+        });
+    });
+    test("refuses an active key id it does not hold", () => {
+        withEnv({
+            PROSOPO_ASSET_SEAL_KEYS: `${KEY_ID}:${toBase64Url(KEY)}`,
+            PROSOPO_ASSET_SEAL_ACTIVE_KEY_ID: "77",
+        }, () => {
+            expect(() => getSealedAssetsResolver()).toThrow(/77/);
+        });
+    });
+});
+//# sourceMappingURL=sealedAssetsResolver.unit.test.js.map

package/dist/tests/unit/api/captcha/sealedAssetsResolver.unit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedAssetsResolver.unit.test.js","sourceRoot":"","sources":["../../../../../src/tests/unit/api/captcha/sealedAssetsResolver.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EACN,cAAc,EACd,WAAW,GACX,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACN,8BAA8B,EAC9B,oBAAoB,EACpB,uBAAuB,GACvB,MAAM,iDAAiD,CAAC;AAEzD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnD,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,MAAM,GAAG,iCAAiC,CAAC;AACjD,MAAM,IAAI,GAAG,kCAAkC,CAAC;AAChD,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAEjC,MAAM,QAAQ,GAAG,CAChB,UAAuD,EAAE,EAClC,EAAE,CACzB,IAAI,oBAAoB,CAAC;IACxB,GAAG,EAAE,GAAG;IACR,KAAK,EAAE,MAAM;IACb,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM;IACjB,GAAG,OAAO;CACV,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,EAAU,EAAE;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI;QACJ,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,UAAU;KACV,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CACf,MAA0C,EAC1C,GAAe,EACR,EAAE;IACT,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACF,CAAC;IACD,IAAI,CAAC;QACJ,GAAG,EAAE,CAAC;IACP,CAAC;YAAS,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACnC,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACrC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC5D,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,CACnB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CACvE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE;QAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,CACL,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,8BAA8B,GAAG,CAAC,CAAC,CAC/D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,EAAE,CACX,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,8BAA8B,CAAC,CAC3D,CAAC,OAAO,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAClB,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAC3D,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI;YAC9B,CAAC,WAAW,EAAE,OAAO,CAAC;YACtB,CAAC,WAAW,EAAE,OAAO,CAAC;YACtB,CAAC,MAAM,EAAE,EAAE,CAAC;YACZ,CAAC,OAAO,EAAE,EAAE,CAAC;SACb,EAAE,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAC5D,cAAc,CACd,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACxC,SAAS,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC/D,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,EAAE,uBAAuB,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE;YACpD,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QACnD,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE;QACrD,OAAO,CACN;YACC,uBAAuB,EAAE,KAAK,WAAW,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;YACjH,gCAAgC,EAAE,SAAS;SAC3C,EACD,GAAG,EAAE;YACJ,MAAM,GAAG,GAAG,uBAAuB,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAChD,OAAO,CACN;YACC,uBAAuB,EAAE,GAAG,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YACjH,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;SAChD,EACD,GAAG,EAAE;YACJ,MAAM,GAAG,GAAG,uBAAuB,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACtD,OAAO,CACN;YACC,uBAAuB,EAAE,GAAG,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;YACxD,gCAAgC,EAAE,IAAI;SACtC,EACD,GAAG,EAAE;YACJ,MAAM,CAAC,GAAG,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/unit/edge/assetSealHandler.unit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=assetSealHandler.unit.test.d.ts.map

package/dist/tests/unit/edge/assetSealHandler.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSealHandler.unit.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/unit/edge/assetSealHandler.unit.test.ts"],"names":[],"mappings":""}

package/dist/tests/unit/edge/assetSealHandler.unit.test.js

@@ -0,0 +1,145 @@
+import { describe, expect, test } from "vitest";
+import { sealAssetPath } from "../../../api/captcha/assetSeal.js";
+import { SEAL_KEY_BYTES } from "../../../api/captcha/assetSealFormat.js";
+import { SealedAssetsResolver, getSealedAssetsResolver, } from "../../../api/captcha/sealedAssetsResolver.js";
+import { createAssetSealHandler, } from "../../../edge/assetSealHandler.js";
+const KEY = new Uint8Array(SEAL_KEY_BYTES).fill(5);
+const OTHER_KEY = new Uint8Array(SEAL_KEY_BYTES).fill(6);
+const KEY_ID = 2;
+const NOW_MS = 1_700_000_000_000;
+const NOW_SECONDS = NOW_MS / 1000;
+const ZONE = "https://prosopoimages.b-cdn.net";
+const PATH = "/v5_dataset_flat/images/abc.webp";
+const handler = (options = {}) => createAssetSealHandler({
+    keys: options.keys ?? new Map([[KEY_ID, KEY]]),
+    urlPrefix: options.urlPrefix ?? "s",
+    now: () => options.nowMs ?? NOW_MS,
+    ...(options.requiredPathPrefix !== undefined
+        ? { requiredPathPrefix: options.requiredPathPrefix }
+        : {}),
+});
+const sealedUrl = (options = {}) => `${ZONE}/s/${sealAssetPath({
+    path: options.path ?? PATH,
+    key: options.key ?? KEY,
+    keyId: options.keyId ?? KEY_ID,
+    expiresAtSeconds: NOW_SECONDS + (options.ttl ?? 300),
+})}.webp`;
+const rewritten = async (url, handle = handler()) => handle(new Request(url));
+describe("a sealed request", () => {
+    test("is rewritten onto the canonical path", async () => {
+        const result = await rewritten(sealedUrl());
+        expect(result).toBeInstanceOf(Request);
+        expect(new URL(result.url).pathname).toBe(PATH);
+    });
+    test("keeps the zone it arrived on", async () => {
+        const result = await rewritten(sealedUrl());
+        expect(new URL(result.url).origin).toBe(ZONE);
+    });
+    test("carries the method and headers over", async () => {
+        const result = await handler()(new Request(sealedUrl(), {
+            method: "GET",
+            headers: { accept: "image/webp", "x-forwarded-for": "203.0.113.7" },
+        }));
+        expect(result.method).toBe("GET");
+        expect(result.headers.get("accept")).toBe("image/webp");
+        expect(result.headers.get("x-forwarded-for")).toBe("203.0.113.7");
+    });
+    test("drops a query string someone else added", async () => {
+        const result = await rewritten(`${sealedUrl()}?width=99`);
+        expect(new URL(result.url).search).toBe("");
+    });
+    test("rewrites two different seals of one image onto the same path", async () => {
+        const handle = handler();
+        const first = await rewritten(sealedUrl(), handle);
+        const second = await rewritten(sealedUrl(), handle);
+        expect(new URL(first.url).pathname).toBe(new URL(second.url).pathname);
+    });
+});
+describe("what the edge refuses", () => {
+    const refused = async (url, handle) => {
+        const result = await rewritten(url, handle);
+        expect(result).toBeInstanceOf(Response);
+        return result;
+    };
+    test("an expired seal", async () => {
+        const url = sealedUrl({ ttl: 60 });
+        const response = await refused(url, handler({ nowMs: NOW_MS + 60_000 }));
+        expect(response.status).toBe(404);
+    });
+    test("a seal made with a key the edge does not hold", async () => {
+        const response = await refused(sealedUrl({ key: OTHER_KEY, keyId: 7 }));
+        expect(response.status).toBe(404);
+    });
+    test("a tampered blob", async () => {
+        const url = sealedUrl();
+        const flipped = url.replace(/(.)(\.webp)$/, (_, last, ext) => `${"A" === last ? "B" : "A"}${ext}`);
+        const response = await refused(flipped);
+        expect(response.status).toBe(404);
+    });
+    test("a path outside the required prefix", async () => {
+        const response = await refused(sealedUrl({ path: "/elsewhere/a.webp" }), handler({ requiredPathPrefix: "/v5_dataset_flat/" }));
+        expect(response.status).toBe(404);
+    });
+    test("noise under the prefix", async () => {
+        for (const blob of ["", "x", "not-a-seal", "%20"]) {
+            expect((await refused(`${ZONE}/s/${blob}`)).status).toBe(404);
+        }
+    });
+    test("and never lets the refusal be cached", async () => {
+        const response = await refused(sealedUrl({ key: OTHER_KEY, keyId: 7 }));
+        expect(response.headers.get("cache-control")).toBe("no-store");
+    });
+});
+describe("what the edge leaves alone", () => {
+    test("a request that is not under the prefix", async () => {
+        const result = await rewritten(`${ZONE}/health`);
+        expect(result).toBeInstanceOf(Request);
+        expect(new URL(result.url).pathname).toBe("/health");
+    });
+    test("an already-rewritten request, so running twice is safe", async () => {
+        const handle = handler();
+        const once = await rewritten(sealedUrl(), handle);
+        const twice = await handle(once);
+        expect(twice).toBeInstanceOf(Request);
+        expect(new URL(twice.url).pathname).toBe(PATH);
+    });
+    test("a request under a different prefix from the one configured", async () => {
+        const result = await rewritten(sealedUrl(), handler({ urlPrefix: "img" }));
+        expect(result).toBeInstanceOf(Request);
+    });
+});
+describe("the provider and the edge agree", () => {
+    test("what node seals, webcrypto opens", async () => {
+        const url = new SealedAssetsResolver({
+            key: KEY,
+            keyId: KEY_ID,
+            now: () => NOW_MS,
+        })
+            .resolveAsset(`${ZONE}${PATH}`)
+            .getURL();
+        const result = await rewritten(url);
+        expect(new URL(result.url).pathname).toBe(PATH);
+    });
+    test("end to end, from the env the provider reads", async () => {
+        const saved = process.env.PROSOPO_ASSET_SEAL_KEYS;
+        process.env.PROSOPO_ASSET_SEAL_KEYS = `${KEY_ID}:${Buffer.from(KEY).toString("base64")}`;
+        try {
+            const url = getSealedAssetsResolver()
+                ?.resolveAsset(`${ZONE}${PATH}`)
+                .getURL();
+            if (!url)
+                throw new Error("expected a resolver");
+            const result = await rewritten(url, handler({ nowMs: Date.now() }));
+            expect(new URL(result.url).pathname).toBe(PATH);
+        }
+        finally {
+            if (undefined === saved) {
+                Reflect.deleteProperty(process.env, "PROSOPO_ASSET_SEAL_KEYS");
+            }
+            else {
+                process.env.PROSOPO_ASSET_SEAL_KEYS = saved;
+            }
+        }
+    });
+});
+//# sourceMappingURL=assetSealHandler.unit.test.js.map

package/dist/tests/unit/edge/assetSealHandler.unit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetSealHandler.unit.test.js","sourceRoot":"","sources":["../../../../src/tests/unit/edge/assetSealHandler.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EACN,oBAAoB,EACpB,uBAAuB,GACvB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAEN,sBAAsB,GACtB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzD,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,WAAW,GAAG,MAAM,GAAG,IAAI,CAAC;AAClC,MAAM,IAAI,GAAG,iCAAiC,CAAC;AAC/C,MAAM,IAAI,GAAG,kCAAkC,CAAC;AAEhD,MAAM,OAAO,GAAG,CACf,UAKI,EAAE,EACa,EAAE,CACrB,sBAAsB,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,GAAG;IACnC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM;IAClC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;QAC3C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;QACpD,CAAC,CAAC,EAAE,CAAC;CACN,CAAC,CAAC;AAEJ,MAAM,SAAS,GAAG,CACjB,UAKI,EAAE,EACG,EAAE,CACX,GAAG,IAAI,MAAM,aAAa,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;IAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG;IACvB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM;IAC9B,gBAAgB,EAAE,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;CACpD,CAAC,OAAO,CAAC;AAEX,MAAM,SAAS,GAAG,KAAK,EACtB,GAAW,EACX,SAA2B,OAAO,EAAE,EACN,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3D,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IACjC,IAAI,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,GAAG,CAAE,MAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAE5C,MAAM,CAAC,IAAI,GAAG,CAAE,MAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAC7B,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE;YACxB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE;SACnE,CAAC,CACF,CAAC;QAEF,MAAM,CAAE,MAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAE,MAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,MAAM,CAAE,MAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAC9D,aAAa,CACb,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,EAAE,WAAW,CAAC,CAAC;QAE1D,MAAM,CAAC,IAAI,GAAG,CAAE,MAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,IAAI,GAAG,CAAE,KAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpD,IAAI,GAAG,CAAE,MAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,MAAM,OAAO,GAAG,KAAK,EACpB,GAAW,EACX,MAAyB,EACL,EAAE;QACtB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,MAAkB,CAAC;IAC3B,CAAC,CAAC;IAEF,IAAI,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QAEzE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAC1B,cAAc,EACd,CAAC,CAAC,EAAE,IAAY,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CACrE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAExC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC7B,SAAS,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EACxC,OAAO,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CACpD,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,IAAI,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,GAAG,CAAE,MAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAe,CAAC,CAAC;QAE5C,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,GAAG,CAAE,KAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAChD,IAAI,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,oBAAoB,CAAC;YACpC,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,MAAM;YACb,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM;SACjB,CAAC;aACA,YAAY,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;aAC9B,MAAM,EAAE,CAAC;QAEX,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAEpC,MAAM,CAAC,IAAI,GAAG,CAAE,MAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,uBAAuB,EAAE;gBACpC,EAAE,YAAY,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;iBAC/B,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAEjD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAEpE,MAAM,CAAC,IAAI,GAAG,CAAE,MAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;gBAAS,CAAC;YACV,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,KAAK,CAAC;YAC7C,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/edge/entry.ts

@@ -0,0 +1,62 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// @ts-expect-error resolved by the bunny runtime, not by tsc or node
+import * as BunnySDK from "https://esm.sh/@bunny.net/edgescript-sdk@0.13.0-rc.0";
+import { parseSealKeys } from "../src/api/captcha/assetSealFormat.js";
+import {
+	type AssetSealHandler,
+	createAssetSealHandler,
+} from "../src/edge/assetSealHandler.js";
+
+interface PullZoneHandler {
+	onClientRequest: (
+		middleware: (ctx: { request: Request }) => Promise<Request | Response>,
+	) => PullZoneHandler;
+	onOriginRequest: (
+		middleware: (ctx: { request: Request }) => Promise<Request | Response>,
+	) => PullZoneHandler;
+}
+
+interface EdgeSdk {
+	net: {
+		http: { servePullZone: (options: { url: string }) => PullZoneHandler };
+	};
+}
+
+const sdk: EdgeSdk = BunnySDK as EdgeSdk;
+
+const required = (name: string): string => {
+	const value = process.env[name];
+	if (!value) {
+		throw new Error(`${name} is not set on this edge script`);
+	}
+	return value;
+};
+
+const handler: AssetSealHandler = createAssetSealHandler({
+	keys: parseSealKeys(required("PROSOPO_ASSET_SEAL_KEYS")),
+	urlPrefix: process.env.PROSOPO_ASSET_SEAL_URL_PREFIX || "s",
+	...(process.env.PROSOPO_ASSET_SEAL_PATH_PREFIX
+		? { requiredPathPrefix: process.env.PROSOPO_ASSET_SEAL_PATH_PREFIX }
+		: {}),
+});
+
+const pullZone = sdk.net.http.servePullZone({
+	url: process.env.PROSOPO_ASSET_ORIGIN_URL || "https://localhost",
+});
+
+pullZone
+	.onClientRequest((ctx: { request: Request }) => handler(ctx.request))
+	.onOriginRequest((ctx: { request: Request }) => handler(ctx.request));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/provider",
-	"version": "5.12.2",
+	"version": "5.12.3",
 	"author": "PROSOPO LIMITED <info@prosopo.io>",
 	"license": "Apache-2.0",
 	"type": "module",
@@ -14,6 +14,7 @@
 		"build:cross-env": "vite build --config vite.esm.config.ts",
 		"build:tsc": "tsc --build --verbose",
 		"build:cjs": "NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV",
+		"build:edge": "node ./scripts/buildEdgeScript.mjs",
 		"typecheck": "tsc --project tsconfig.types.json",
 		"test:unit": "NODE_ENV=${NODE_ENV:-test}; TEST_TYPE=unit npx vitest run --config ./vite.test.config.ts",
 		"test:integration": "NODE_ENV=${NODE_ENV:-test}; TEST_TYPE=integration DECISION_MACHINE_ARTIFACT_CACHE_TTL_MS=1 npx vitest run --config ./vite.threads.test.config.ts",
@@ -29,7 +30,7 @@
 		"@prosopo/captcha-severity": "1.1.1",
 		"@prosopo/common": "3.1.59",
 		"@prosopo/database": "4.0.39",
-		"@prosopo/datasets": "3.1.88",
+		"@prosopo/datasets": "3.1.89",
 		"@prosopo/env": "3.6.62",
 		"@prosopo/ipinfo": "0.4.8",
 		"@prosopo/keyring": "2.9.95",
@@ -70,6 +71,7 @@
 		"cors": "2.8.6",
 		"del-cli": "6.0.0",
 		"dotenv": "16.4.5",
+		"esbuild": "0.28.2",
 		"npm-run-all": "4.1.5",
 		"testcontainers": "12.1.0",
 		"tslib": "2.7.0",

package/scripts/buildEdgeScript.mjs

@@ -0,0 +1,31 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { build } from "esbuild";
+
+const OUTPUT = "dist/edge/bunny-asset-seal.js";
+
+await build({
+	entryPoints: ["edge/entry.ts"],
+	outfile: OUTPUT,
+	bundle: true,
+	format: "esm",
+	platform: "neutral",
+	target: "es2022",
+	external: ["https://*"],
+	legalComments: "inline",
+	logLevel: "info",
+});
+
+console.log(`edge script written to ${OUTPUT}`);