@protobase/server 0.67.6 → 0.67.8

package/dist/jobs/database.js

@@ -19,7 +19,7 @@ const transactionStatements = (text) => {
 };
 /**
 * pg-boss's database over the app's own Kysely pool or transaction: one connection pool for the app and its jobs, the
-* same driver on Node, Bun and PGlite. Every statement runs on its own, or inside one transaction for pg-boss's
+* same driver on Node and Bun. Every statement runs on its own, or inside one transaction for pg-boss's
 * transaction texts, which works through a pooler in transaction mode: pg-boss takes only transaction-scoped locks.
 */
 const jobsDatabase = (db) => ({ executeSql: async (text, values) => {

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.67.6";
+var version = "0.67.8";
 //#endregion
 export { version };

package/dist/webhooks/attempt.js

@@ -2,15 +2,22 @@ import { invokeFunction } from "../functions/define-function.js";
 import { retryAfterMs } from "./retry-schedule.js";
 import { standardWebhookHeaders } from "./standard-webhooks.js";
 import { subscriberSession } from "./subscriber-view.js";
+import { AddressRefusedError, pinnedRequest } from "./table/pinned-request.js";
+import { readLimited } from "./table/read-limited.js";
 //#region src/webhooks/attempt.ts
 /** How long a receiver has to answer. */
 const attemptTimeoutMs = 15e3;
-const excerpt = async (response) => (await response.text()).slice(0, 200);
+/** How much of a failing answer is read; the rest is cancelled. */
+const excerptBytes = 4096;
+const excerpt = async (response) => new TextDecoder().decode(await readLimited(response, excerptBytes)).slice(0, 200);
 const resultOf = async (response) => {
-	if (response.status >= 200 && response.status < 300) return {
-		ok: true,
-		status: response.status
-	};
+	if (response.status >= 200 && response.status < 300) {
+		await response.body?.cancel();
+		return {
+			ok: true,
+			status: response.status
+		};
+	}
 	const body = await excerpt(response);
 	const wait = retryAfterMs(response.headers.get("retry-after"));
 	return {
@@ -21,20 +28,19 @@ const resultOf = async (response) => {
 		final: response.status === 410
 	};
 };
-const request = async (url, event, options, signal) => {
+const delivery = async (event, options, signal) => {
 	const body = JSON.stringify(options.body ? options.body(event) : event);
 	const signed = await standardWebhookHeaders(event.id, Math.floor(Date.now() / 1e3), body, options.secret);
-	return new Request(url, {
+	return {
 		method: "POST",
-		headers: {
+		headers: new Headers({
 			...options.headers,
 			...signed,
 			"content-type": "application/json"
-		},
+		}),
 		body,
-		redirect: "manual",
 		signal
-	});
+	};
 };
 const callFunction = async (name, subscription, event, options, context, signal) => {
 	const fn = context.functions[name];
@@ -63,7 +69,7 @@ const callFunction = async (name, subscription, event, options, context, signal)
 			of: noCalls
 		}
 	};
-	return invokeFunction(name, fn, await request("http://protobase.internal/", event, options, signal), fn.options.public ? functionContext : {
+	return invokeFunction(name, fn, new Request("http://protobase.internal/", await delivery(event, options, signal)), fn.options.public ? functionContext : {
 		...functionContext,
 		...caller
 	});
@@ -71,7 +77,7 @@ const callFunction = async (name, subscription, event, options, context, signal)
 const failure = (error) => ({
 	ok: false,
 	error: error instanceof Error ? error.message : String(error),
-	final: false
+	final: error instanceof AddressRefusedError
 });
 /** One try of one event to one subscription's target, within `attemptTimeoutMs`. It never throws. */
 const attemptDelivery = async (subscription, event, context) => {
@@ -87,16 +93,14 @@ const attemptDelivery = async (subscription, event, context) => {
 			return { ok: true };
 		}
 		if ("function" in options) return await resultOf(await callFunction(options.function, subscription, event, options, context, signal));
-		const blocked = await context.checkUrl?.(options.url);
-		if (blocked) return {
-			ok: false,
-			error: blocked,
-			final: true
+		const pinned = {
+			allowPrivateAddresses: context.allowPrivateAddresses,
+			...context.resolve && { resolve: context.resolve }
 		};
-		return await resultOf(await fetch(await request(options.url, event, options, signal)));
+		return await resultOf(await pinnedRequest(options.url, await delivery(event, options, signal), pinned));
 	} catch (error) {
 		return failure(error);
 	}
 };
 //#endregion
-export { attemptDelivery, attemptTimeoutMs };
+export { attemptDelivery, attemptTimeoutMs, excerptBytes };

package/dist/webhooks/table/address-check.js

@@ -6,21 +6,52 @@ const privateV4 = (address) => {
 	const [a, b] = v4(address);
 	return a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b < 128 || a === 169 && b === 254 || a === 172 && b >= 16 && b < 32 || a === 192 && b === 168;
 };
+const v6Groups = (address) => {
+	const halves = address.toLowerCase().replace(/%.*$/, "").replace(/(\d+)\.(\d+)\.(\d+)\.(\d+)$/, (_, a, b, c, d) => `${(+a << 8 | +b).toString(16)}:${(+c << 8 | +d).toString(16)}`).split("::");
+	if (halves.length > 2) return;
+	const groups = (half) => half ? half.split(":") : [];
+	const head = groups(halves[0]);
+	const tail = groups(halves[1]);
+	const zeros = halves.length === 2 ? 8 - head.length - tail.length : 0;
+	const all = [
+		...head,
+		...Array(Math.max(zeros, 0)).fill("0"),
+		...tail
+	];
+	if (all.length !== 8 || !all.every((group) => /^[0-9a-f]{1,4}$/.test(group))) return;
+	return all.map((group) => parseInt(group, 16));
+};
+const embeddedV4 = (high, low) => privateV4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
 const privateV6 = (address) => {
-	const lower = address.toLowerCase();
-	const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
-	if (mapped) return privateV4(mapped[1]);
-	return lower === "::" || lower === "::1" || /^f[cd]/.test(lower) || /^fe[89ab]/.test(lower) || /^ff/.test(lower);
+	const g = v6Groups(address);
+	if (!g) return true;
+	const zeroUpTo = (end) => g.slice(0, end).every((group) => group === 0);
+	if (zeroUpTo(5) && (g[5] === 0 || g[5] === 65535)) return embeddedV4(g[6], g[7]);
+	if (zeroUpTo(4) && g[4] === 65535 && g[5] === 0) return embeddedV4(g[6], g[7]);
+	if (g[0] === 100 && g[1] === 65435) return g.slice(2, 6).every((group) => group === 0) ? embeddedV4(g[6], g[7]) : true;
+	if (g[0] === 8194) return embeddedV4(g[1], g[2]);
+	return (g[0] & 65024) === 64512 || (g[0] & 65408) === 65152 || g[0] >> 8 === 255;
+};
+/**
+* Whether an IP address is one a webhook must not reach: the server's own host or network. Anything that is not an IP
+* address is refused too, so no unknown form gets through.
+*/
+const isPrivateAddress = (address) => {
+	const family = isIP(address);
+	if (family === 4) return privateV4(address);
+	if (family === 6) return privateV6(address);
+	return true;
 };
-/** Whether an IP address is one a webhook must not reach: the server's own host or network. */
-const isPrivateAddress = (address) => isIP(address) === 4 ? privateV4(address) : privateV6(address);
 /**
 * What is wrong with a URL whose host is, or resolves to, a private, loopback or link-local address, so a subscription someone
-* makes in the admin app cannot reach the server's own network. The address is resolved again when the request is
-* sent, so a host that answers differently the second time still gets through: a firewall rule is the stronger guard.
+* makes in the admin app cannot reach the server's own network. It gives the early error when a subscription is saved;
+* each delivery checks again in `pinnedRequest` and connects to the very address it checked, so a host that answers
+* differently later cannot steer it elsewhere.
 */
 const checkWebhookUrl = async (url) => {
-	const host = new URL(url).hostname.replace(/^\[|\]$/g, "");
+	const target = new URL(url);
+	if (target.protocol !== "http:" && target.protocol !== "https:") return `${target.protocol} URLs are not sent to; webhooks use http or https`;
+	const host = target.hostname.replace(/^\[|\]$/g, "");
 	const blocked = (isIP(host) ? [host] : (await lookup(host, { all: true })).map((entry) => entry.address)).find(isPrivateAddress);
 	return blocked ? `${host} is a private address (${blocked}); webhooks reach public addresses only` : void 0;
 };

package/dist/webhooks/table/pinned-request.js

@@ -0,0 +1,84 @@
+import { isPrivateAddress } from "./address-check.js";
+import { lookup } from "node:dns/promises";
+import { request } from "node:http";
+import { request as request$1 } from "node:https";
+import { isIP } from "node:net";
+import { Readable } from "node:stream";
+//#region src/webhooks/table/pinned-request.ts
+/** The system resolver, every address of the host. */
+const resolveHost = async (host) => (await lookup(host, { all: true })).map((entry) => entry.address);
+/** A request refused before it was sent, for its URL's scheme or address. The message names the host, never the URL. */
+var AddressRefusedError = class extends Error {};
+const noLookup = (_host, _options, callback) => callback(/* @__PURE__ */ new Error("A pinned request resolves no host"), "", 4);
+const resolveWithin = (resolve, host, signal) => {
+	signal?.throwIfAborted();
+	if (!signal) return resolve(host);
+	return Promise.race([resolve(host), new Promise((_, reject) => signal.addEventListener("abort", () => reject(signal.reason), { once: true }))]);
+};
+const checkedAddresses = async (host, options, signal) => {
+	const addresses = isIP(host) ? [host] : await resolveWithin(options.resolve ?? resolveHost, host, signal);
+	if (addresses.length === 0) throw new AddressRefusedError(`${host} resolves to no address`);
+	if (addresses.find((address) => typeof address !== "string" || isIP(address) === 0) !== void 0) throw new AddressRefusedError(`${host} resolves to something that is not an IP address`);
+	const blocked = options.allowPrivateAddresses ? void 0 : addresses.find(isPrivateAddress);
+	if (blocked !== void 0) throw new AddressRefusedError(`${host} is a private address (${blocked}); requests reach public addresses only`);
+	return addresses;
+};
+const nullBodyStatuses = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+const toResponse = (message, status) => {
+	const headers = new Headers();
+	for (let index = 0; index < message.rawHeaders.length; index += 2) headers.append(message.rawHeaders[index], message.rawHeaders[index + 1]);
+	if (nullBodyStatuses.has(status)) {
+		message.resume();
+		return new Response(null, {
+			status,
+			headers
+		});
+	}
+	return new Response(Readable.toWeb(message), {
+		status,
+		headers
+	});
+};
+/**
+* An http(s) request to a URL someone else chose, which reaches only the address it checked. It resolves the host once,
+* refuses it unless every address is public (or `allowPrivateAddresses`), and connects to the first one, with the host
+* name as the `Host` header and as the TLS server name the certificate is checked against. A redirect is returned as
+* it is and never followed: a caller that follows one calls this again with its URL, so the new host is checked too.
+*/
+const pinnedRequest = async (url, init, options = {}) => {
+	const target = new URL(url);
+	if (target.protocol !== "http:" && target.protocol !== "https:") throw new AddressRefusedError(`${target.protocol} URLs are not requested; use http or https`);
+	const host = target.hostname.replace(/^\[|\]$/g, "");
+	const address = (await checkedAddresses(host, options, init.signal))[0];
+	const headers = Object.fromEntries(new Headers(init.headers));
+	if (init.body !== void 0) headers["content-length"] = String(Buffer.byteLength(init.body));
+	headers.host = target.host;
+	const send = target.protocol === "https:" ? request$1 : request;
+	return new Promise((resolve, reject) => {
+		const request = send({
+			host: address,
+			family: isIP(address),
+			port: target.port || (target.protocol === "https:" ? 443 : 80),
+			path: `${target.pathname}${target.search}`,
+			method: init.method,
+			headers,
+			lookup: noLookup,
+			...isIP(host) === 0 && { servername: host },
+			...options.ca && { ca: options.ca },
+			...init.signal && { signal: init.signal }
+		}, (message) => {
+			const status = message.statusCode ?? 0;
+			if (status >= 200 && status <= 599) return resolve(toResponse(message, status));
+			message.destroy();
+			reject(/* @__PURE__ */ new Error(`${host} answered with status ${status}`));
+		});
+		request.on("error", reject);
+		request.end(init.body);
+	});
+};
+//#endregion
+export { AddressRefusedError, pinnedRequest, resolveHost };

package/dist/webhooks/table/read-limited.js

@@ -0,0 +1,18 @@
+//#region src/webhooks/table/read-limited.ts
+/** Reads at most `limit` bytes of a response body, then cancels the rest, so a sender that never stops writing costs no more. */
+const readLimited = async (response, limit) => {
+	const reader = response.body?.getReader();
+	if (!reader) return /* @__PURE__ */ new Uint8Array();
+	const chunks = [];
+	let read = 0;
+	while (read < limit) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		chunks.push(value);
+		read += value.length;
+	}
+	await reader.cancel();
+	return Buffer.concat(chunks).subarray(0, limit);
+};
+//#endregion
+export { readLimited };

package/dist/webhooks/table/webhook-table.js

@@ -1,11 +1,11 @@
 import { betterAuthOwnerRoles } from "./owner-roles.js";
-import { webhooksSchema } from "./options.js";
 import { checkWebhookUrl } from "./address-check.js";
+import { webhooksSchema } from "./options.js";
 import { tableSubscriptions } from "./table-subscriptions.js";
 //#region src/webhooks/table/webhook-table.ts
 /**
 * What `createAdmin` needs for the subscriptions of `webhooks`: the table, the owners' current roles (from Better Auth
-* unless the options say otherwise) and, unless allowed, the check that keeps URLs off private addresses.
+* unless the options say otherwise) and, unless allowed, the save-time check that keeps URLs off private addresses.
 */
 const webhookTable = (options, auth) => {
 	const ownerRoles = options.ownerRoles ?? (auth && betterAuthOwnerRoles(auth));
@@ -16,6 +16,7 @@ const webhookTable = (options, auth) => {
 			ownerRoles,
 			deliveryLog: Boolean(options.deliveryLog)
 		}),
+		allowPrivateAddresses: Boolean(options.allowPrivateAddresses),
 		...!options.allowPrivateAddresses && { checkUrl: checkWebhookUrl }
 	};
 };

package/dist/webhooks/webhooks.js

@@ -77,7 +77,7 @@ const createWebhooks = ({ deps, subscriptions, functions, channels, schema, log,
 	const attempt = async (subscription, event, db, tried, signal) => {
 		const id = tableId(subscription);
 		const started = performance.now();
-		const checkUrl = id === void 0 ? void 0 : table?.checkUrl;
+		const allowPrivateAddresses = id === void 0 || Boolean(table?.allowPrivateAddresses);
 		const result = await attemptDelivery(subscription, event, {
 			db,
 			functions,
@@ -85,7 +85,7 @@ const createWebhooks = ({ deps, subscriptions, functions, channels, schema, log,
 			channels,
 			attempt: tried,
 			signal,
-			...checkUrl && { checkUrl }
+			allowPrivateAddresses
 		});
 		if (id !== void 0) await table.subscriptions.record(db, id, event, tried, result, performance.now() - started);
 		return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.67.6",
+  "version": "0.67.8",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,9 +44,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.67.6",
-    "@protobase/query": "0.67.6",
-    "@protobase/schema": "0.67.6",
+    "@protobase/layout": "0.67.8",
+    "@protobase/query": "0.67.8",
+    "@protobase/schema": "0.67.8",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",