@redocly/realm 0.138.0-next.2 → 0.138.0-next.3

package/dist/server/plugins/markdown/search/nodes/tag-node.js

@@ -1 +1 @@
-import{SectionNode as r,WithCounterId as o}from"./section-node.js";const i=["title","alt","name","label"];class s extends o(r){constructor(t){super(t)}getUrl(t){return this.parentNode?.getUrl(t)??t}getPath(t){let e=this.parentNode?.getPath(t);return e||(e=this.content?[this.content]:[]),e}}export{i as TAG_TITLE_ATTRIBUTES,s as TagNode};
+import{SectionNode as r,WithCounterId as o}from"./section-node.js";const i=["title","name","label"];class s extends o(r){constructor(t){super(t)}getUrl(t){return this.parentNode?.getUrl(t)??t}getPath(t){let e=this.parentNode?.getPath(t);return e||(e=this.content?[this.content]:[]),e}}export{i as TAG_TITLE_ATTRIBUTES,s as TagNode};

package/dist/server/plugins/mcp/audit/audit-log.js

@@ -1 +1 @@
-import{createHash as a}from"node:crypto";import{logger as c}from"../../../tools/notifiers/logger.js";import{AUDIT_LOG_PREFIX as u}from"./constants.js";import{redactSecretsFromString as f}from"../gateway-mcp/fetch/redact.js";import{redactSecretShapes as p}from"./secret-patterns.js";import{AUDIT_LOG_PREFIX as I}from"./constants.js";const s=4096,d="redacted",m=new Set(["access_token","api-key","api_key","apikey","auth","code","id_token","key","password","refresh_token","secret","session","sig","signature","token","x-amz-credential","x-amz-security-token","x-amz-signature"]);function h(t){return a("sha256").update(t,"utf8").digest("hex")}function g(t){if(t.length<=s)return t;const e=t.slice(0,s),r=e.search(/\s\S*$/),n=r>0?e.slice(0,r):e;return`${n}\u2026[truncated: kept ${n.length} of ${t.length} chars]`}function i(t,e=[]){return p(f(g(t),e))}function S(t){return{sha256:h(t),bytes:Buffer.byteLength(t,"utf8")}}function $(t){return Object.keys(t??{}).map(e=>e.toLowerCase()).sort().join(",")}function E(t,e=[]){let r;try{r=new URL(t)}catch{return i(t,e)}for(const n of[...r.searchParams.keys()])m.has(n.toLowerCase())&&r.searchParams.set(n,d);return r.username="",r.password="",i(r.href,e)}function R(t,e){const r=Object.entries(e).filter(([,n])=>n!==void 0&&n!=="").map(([n,o])=>typeof o=="string"?`${n}=${JSON.stringify(o)}`:`${n}=${String(o)}`).join(" ");try{c.infoPreSanitized(`${u} ${t} ${r}`)}catch{}}export{s as AUDIT_FIELD_MAX_CHARS,I as AUDIT_LOG_PREFIX,$ as auditHeaderNames,i as auditInput,S as auditOutputDigest,h as auditSha256,E as auditUrl,R as logAuditRecord,g as truncateAuditField};
+import{createHash as c}from"node:crypto";import{logger as s}from"../../../tools/notifiers/logger.js";import{redactUrl as f}from"../../../utils/redact-url.js";import{AUDIT_LOG_PREFIX as p}from"./constants.js";import{redactSecretsFromString as u}from"../gateway-mcp/fetch/redact.js";import{redactSecretShapes as a}from"./secret-patterns.js";import{AUDIT_LOG_PREFIX as L}from"./constants.js";const i=4096;function d(t){return c("sha256").update(t,"utf8").digest("hex")}function m(t){if(t.length<=i)return t;const r=t.slice(0,i),o=r.search(/\s\S*$/),e=o>0?r.slice(0,o):r;return`${e}\u2026[truncated: kept ${e.length} of ${t.length} chars]`}function h(t,r=[]){return a(u(m(t),r))}function _(t){return{sha256:d(t),bytes:Buffer.byteLength(t,"utf8")}}function l(t){return Object.keys(t??{}).map(r=>r.toLowerCase()).sort().join(",")}function O(t,r=[]){return h(f(t),r)}function y(t,r){const o=Object.entries(r).filter(([,e])=>e!==void 0&&e!=="").map(([e,n])=>typeof n=="string"?`${e}=${JSON.stringify(n)}`:`${e}=${String(n)}`).join(" ");try{s.infoPreSanitized(`${p} ${t} ${o}`)}catch{}}export{i as AUDIT_FIELD_MAX_CHARS,L as AUDIT_LOG_PREFIX,l as auditHeaderNames,h as auditInput,_ as auditOutputDigest,d as auditSha256,O as auditUrl,y as logAuditRecord,m as truncateAuditField};

package/dist/server/utils/redact-url.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Full URL with its query string, credential-shaped parameter values replaced and userinfo removed.
+ * An unparseable input comes back unchanged.
+ */
+export declare function redactUrl(rawUrl: string): string;
+//# sourceMappingURL=redact-url.d.ts.map

package/dist/server/utils/redact-url.js

@@ -0,0 +1 @@
+const r="redacted",a=new Set(["access_token","api-key","api_key","apikey","assertion","auth","client_secret","code","code_verifier","id_token","id_token_hint","key","password","refresh_token","samlresponse","secret","session","sig","signature","token","x-amz-credential","x-amz-security-token","x-amz-signature"]);function n(s){let e;try{e=new URL(s)}catch{return s}for(const t of[...e.searchParams.keys()])a.has(t.toLowerCase())&&e.searchParams.set(t,r);return e.username="",e.password="",e.href}export{n as redactUrl};

package/dist/server/web-server/jwt/jwt.js

@@ -1 +1 @@
-import"../../node-crypto-polyfill.js";import{utf8ToUint8Array as u,encodeBase64URL as w,arrayBufferToBase64URL as m,decodeBase64URL as d}from"./encode.js";import{decodeJwtSignature as g}from"./decode-jwt-signature.js";import{AlgorithmTypes as s,JwtAlgorithmNotImplemented as H,JwtTokenInvalid as S,JwtTokenNotBefore as b,JwtTokenExpired as E,JwtTokenSignatureMismatched as K,CryptoKeyFormat as h,CryptoKeyUsage as l}from"./types.js";const p=t=>{switch(t.toUpperCase()){case"HS256":return{name:"HMAC",hash:{name:"SHA-256"}};case"HS384":return{name:"HMAC",hash:{name:"SHA-384"}};case"HS512":return{name:"HMAC",hash:{name:"SHA-512"}};case"RS256":return{name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-256"}};case"ES256":return{name:"ECDSA",namedCurve:"P-256",hash:{name:"SHA-256"}};default:throw new H(t)}},A=async(t,e,n=s.HS256)=>{if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");e.startsWith("-----BEGIN PRIVATE KEY-----")&&(e=e.replace("-----BEGIN PRIVATE KEY-----","").replace("-----END PRIVATE KEY-----","").split(/\\n|\n/).join("").trim(),e=atob(e));const r=n===s.RS256||n===s.ES256,a=await crypto.subtle.importKey(r?h.PKCS8:h.RAW,r?T(e):u(e),p(n),!1,[l.Sign]);return await crypto.subtle.sign(p(n),a,u(t))};function T(t){const e=new ArrayBuffer(t.length),n=new Uint8Array(e);for(let r=0,a=t.length;r<a;r++)n[r]=t.charCodeAt(r);return e}const U=async(t,e,n=s.HS256,r)=>{const a=await w(JSON.stringify(t)),i=`${await w(JSON.stringify({alg:n,typ:"JWT",kid:r}))}.${a}`,c=await m(await A(i,e,n));return`${i}.${c}`},v=async(t,e,n=s.HS256,r=!1)=>{const a=t.split(".");if(a.length!==3)throw new S(t);const{payload:o}=C(t),i=Math.floor(Date.now()/1e3);if(typeof o.nbf=="number"&&o.nbf>i)throw new b(t);if(!r&&typeof o.exp=="number"&&o.exp<=i)throw new E(t);const c=a.slice(0,2).join("."),f=a[2];let y=!1;if(typeof e!="string"?y=await R(c,f,e,n):y=await m(await A(c,e,n))===f,!y)throw new K(t);return!0},C=t=>{try{const[e,n]=t.split("."),r=JSON.parse(d(e)),a=JSON.parse(d(n));return{header:r,payload:a}}catch{throw new S(t)}},R=async(t,e,n,r)=>{const a=await crypto.subtle.importKey("jwk",n,p(r),!1,[l.Verify]);return await crypto.subtle.verify(p(r),a,g(e),u(t))};export{C as decode,U as sign,v as verify};
+import"../../node-crypto-polyfill.js";import{utf8ToUint8Array as u,encodeBase64URL as w,arrayBufferToBase64URL as m,decodeBase64URL as d}from"./encode.js";import{decodeJwtSignature as g}from"./decode-jwt-signature.js";import{AlgorithmTypes as s,JwtAlgorithmNotImplemented as H,JwtTokenInvalid as S,JwtTokenNotBefore as b,JwtTokenExpired as E,JwtTokenSignatureMismatched as K,CryptoKeyFormat as h,CryptoKeyUsage as l}from"./types.js";const p=e=>{switch(e.toUpperCase()){case"HS256":return{name:"HMAC",hash:{name:"SHA-256"}};case"HS384":return{name:"HMAC",hash:{name:"SHA-384"}};case"HS512":return{name:"HMAC",hash:{name:"SHA-512"}};case"RS256":return{name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-256"}};case"ES256":return{name:"ECDSA",namedCurve:"P-256",hash:{name:"SHA-256"}};default:throw new H(e)}},A=async(e,t,n=s.HS256)=>{if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");t.startsWith("-----BEGIN PRIVATE KEY-----")&&(t=t.replace("-----BEGIN PRIVATE KEY-----","").replace("-----END PRIVATE KEY-----","").split(/\\n|\n/).join("").trim(),t=atob(t));const r=n===s.RS256||n===s.ES256,a=await crypto.subtle.importKey(r?h.PKCS8:h.RAW,r?T(t):u(t),p(n),!1,[l.Sign]);return await crypto.subtle.sign(p(n),a,u(e))};function T(e){const t=new ArrayBuffer(e.length),n=new Uint8Array(t);for(let r=0,a=e.length;r<a;r++)n[r]=e.charCodeAt(r);return t}const U=async(e,t,n=s.HS256,r)=>{const a=await w(JSON.stringify(e)),i=`${await w(JSON.stringify({alg:n,typ:"JWT",kid:r}))}.${a}`,c=await m(await A(i,t,n));return`${i}.${c}`},v=async(e,t,n=s.HS256,r=!1)=>{const a=e.split(".");if(a.length!==3)throw new S;const{payload:o}=C(e),i=Math.floor(Date.now()/1e3);if(typeof o.nbf=="number"&&o.nbf>i)throw new b;if(!r&&typeof o.exp=="number"&&o.exp<=i)throw new E;const c=a.slice(0,2).join("."),f=a[2];let y=!1;if(typeof t!="string"?y=await R(c,f,t,n):y=await m(await A(c,t,n))===f,!y)throw new K;return!0},C=e=>{try{const[t,n]=e.split("."),r=JSON.parse(d(t)),a=JSON.parse(d(n));return{header:r,payload:a}}catch{throw new S}},R=async(e,t,n,r)=>{const a=await crypto.subtle.importKey("jwk",n,p(r),!1,[l.Verify]);return await crypto.subtle.verify(p(r),a,g(t),u(e))};export{C as decode,U as sign,v as verify};

package/dist/server/web-server/jwt/types.d.ts

@@ -5,16 +5,16 @@ export declare class JwtAlgorithmNotImplemented extends Error {
     constructor(token: string);
 }
 export declare class JwtTokenInvalid extends Error {
-    constructor(token: string);
+    constructor();
 }
 export declare class JwtTokenNotBefore extends Error {
-    constructor(token: string);
+    constructor();
 }
 export declare class JwtTokenExpired extends Error {
-    constructor(token: string);
+    constructor();
 }
 export declare class JwtTokenSignatureMismatched extends Error {
-    constructor(token: string);
+    constructor();
 }
 export declare enum AlgorithmTypes {
     HS256 = "HS256",

package/dist/server/web-server/jwt/types.js

@@ -1 +1 @@
-class o extends Error{constructor(r){super(`invalid JWT token: ${r}`),this.name="JwtAlgorithmNotImplemented"}}class s extends Error{constructor(r){super(`invalid JWT token: ${r}`),this.name="JwtTokenInvalid"}}class c extends Error{constructor(r){super(`token (${r}) is being used before it's valid`),this.name="JwtTokenNotBefore"}}class d extends Error{constructor(r){super(`token (${r}) expired`),this.name="JwtTokenExpired"}}class a extends Error{constructor(r){super(`token(${r}) signature mismatched`),this.name="JwtTokenSignatureMismatched"}}var t;(function(e){e.HS256="HS256",e.HS384="HS384",e.HS512="HS512",e.RS256="RS256",e.ES256="ES256"})(t||(t={}));var n;(function(e){e.RAW="raw",e.PKCS8="pkcs8",e.SPKI="spki",e.JWK="jwk"})(n||(n={}));var i;(function(e){e.Ecrypt="encrypt",e.Decrypt="decrypt",e.Sign="sign",e.Verify="verify",e.Deriverkey="deriveKey",e.DeriveBits="deriveBits",e.WrapKey="wrapKey",e.UnwrapKey="unwrapKey"})(i||(i={}));export{t as AlgorithmTypes,n as CryptoKeyFormat,i as CryptoKeyUsage,o as JwtAlgorithmNotImplemented,d as JwtTokenExpired,s as JwtTokenInvalid,c as JwtTokenNotBefore,a as JwtTokenSignatureMismatched};
+class o extends Error{constructor(i){super(`invalid JWT token: ${i}`),this.name="JwtAlgorithmNotImplemented"}}class s extends Error{constructor(){super("invalid JWT token"),this.name="JwtTokenInvalid"}}class c extends Error{constructor(){super("token is being used before it's valid"),this.name="JwtTokenNotBefore"}}class d extends Error{constructor(){super("token expired"),this.name="JwtTokenExpired"}}class a extends Error{constructor(){super("token signature mismatched"),this.name="JwtTokenSignatureMismatched"}}var r;(function(e){e.HS256="HS256",e.HS384="HS384",e.HS512="HS512",e.RS256="RS256",e.ES256="ES256"})(r||(r={}));var t;(function(e){e.RAW="raw",e.PKCS8="pkcs8",e.SPKI="spki",e.JWK="jwk"})(t||(t={}));var n;(function(e){e.Ecrypt="encrypt",e.Decrypt="decrypt",e.Sign="sign",e.Verify="verify",e.Deriverkey="deriveKey",e.DeriveBits="deriveBits",e.WrapKey="wrapKey",e.UnwrapKey="unwrapKey"})(n||(n={}));export{r as AlgorithmTypes,t as CryptoKeyFormat,n as CryptoKeyUsage,o as JwtAlgorithmNotImplemented,d as JwtTokenExpired,s as JwtTokenInvalid,c as JwtTokenNotBefore,a as JwtTokenSignatureMismatched};

package/dist/server/web-server/middleware/telemetry-middleware.js

@@ -1 +1 @@
-import{withPathPrefix as u}from"@redocly/theme/core/utils";import{OTEL_EXCLUDED_ROUTES as o}from"../../constants/common.js";import{telemetryTraceStep as m}from"../../telemetry/helpers/trace-step.js";import{getClientIp as d}from"../utils/get-client-ip.js";function A(){return async(e,t)=>{if(o.some(r=>e.req.path===u(r)))return t();await m("com.redocly.request.performed",async r=>{r?.setAttribute("id",e.req.path||""),r?.setAttribute("object","request"),r?.setAttribute("uri",e.req.url||""),r?.setAttribute("method",e.req.method||""),r?.setAttribute("host",e.req.header("host")||""),r?.setAttribute("url",e.req.url||""),r?.setAttribute("path",e.req.path||""),r?.setAttribute("user_agent",e.req.header("user-agent")||"");const i=e.get("auth")?.claims?.id||e.get("auth")?.claims?.sub,s=d(e.req.raw)||e.req.raw.context.remoteAddr?.ipAddress;r?.setAttribute("user_id",i),r?.setAttribute("user_ip",s),await t()})}}export{A as telemetryMiddleware};
+import{withPathPrefix as o}from"@redocly/theme/core/utils";import{OTEL_EXCLUDED_ROUTES as m}from"../../constants/common.js";import{telemetryTraceStep as d}from"../../telemetry/helpers/trace-step.js";import{redactUrl as a}from"../../utils/redact-url.js";import{getClientIp as h}from"../utils/get-client-ip.js";function f(){return async(t,r)=>{if(m.some(e=>t.req.path===o(e)))return r();await d("com.redocly.request.performed",async e=>{const i=a(t.req.url);e?.setAttribute("id",t.req.path||""),e?.setAttribute("object","request"),e?.setAttribute("uri",i),e?.setAttribute("method",t.req.method||""),e?.setAttribute("host",t.req.header("host")||""),e?.setAttribute("url",i),e?.setAttribute("path",t.req.path||""),e?.setAttribute("user_agent",t.req.header("user-agent")||"");const s=t.get("auth")?.claims?.id||t.get("auth")?.claims?.sub,u=h(t.req.raw)||t.req.raw.context.remoteAddr?.ipAddress;e?.setAttribute("user_id",s),e?.setAttribute("user_ip",u),await r()})}}export{f as telemetryMiddleware};

package/dist/types/entitlements.d.ts

@@ -40,6 +40,7 @@ export type PlanGates = {
     [FEATURE.gatewayFetchRatePerMin]: number;
     [FEATURE.gatewayFetchQuotaPerDay]: number;
     [FEATURE.gatewayFetchBudgetPerExec]: number;
+    [FEATURE.cookieConsent]: boolean;
 };
 export type Entitlements = {
     [key in Feature]: boolean | number | string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/realm",
-  "version": "0.138.0-next.2",
+  "version": "0.138.0-next.3",
   "description": "",
   "type": "module",
   "bin": {
@@ -33,13 +33,13 @@
     "@opentelemetry/sdk-trace-web": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.40.0",
     "@redocly/ajv": "8.18.0",
-    "@redocly/api-docs": "0.3.0-next.2",
-    "@redocly/config": "0.57.0",
+    "@redocly/api-docs": "0.3.0-next.3",
+    "@redocly/config": "0.58.0",
     "@redocly/openapi-core": "2.53.0",
     "@redocly/portal-legacy-ui": "0.19.0",
     "@redocly/portal-plugin-mock-server": "0.22.0",
-    "@redocly/realm-asyncapi-sdk": "0.16.0-next.0",
-    "@redocly/theme": "0.70.0-next.2",
+    "@redocly/realm-asyncapi-sdk": "0.16.0-next.1",
+    "@redocly/theme": "0.70.0-next.3",
     "@shikijs/transformers": "3.21.0",
     "@tanstack/react-query": "5.62.3",
     "@tanstack/react-table": "8.21.3",