npm - @restforgejs/platform - Versions diffs - 4.2.8 → 4.3.1 - Mend

@restforgejs/platform 4.2.8 → 4.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (324) hide show

package/generators/cli/endpoint/create.js CHANGED Viewed

@@ -90,7 +90,7 @@ module.exports = {
             type: 'string',
             required: false,
             default: null,
-            description: 'Tipe database (postgres|mysql|oracle|sqlite). Default: auto-detect dari config'
+            description: 'Tipe database (postgres|mysql|oracle). Default: postgres'
         },
         config: {
             type: 'string',

package/generators/cli/key/generate.js CHANGED Viewed

@@ -17,6 +17,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { generateApiKey, validateApiKey } = require('../../lib/utils/key-generator');
 const { updateEnvKey, hasEnvKey, getEnvValue, backupEnvFile } = require('../../lib/utils/env-manager');
+const { validatePathWithinBase } = require('../../lib/utils/path-validator');
 module.exports = {
     resource: 'key',
@@ -43,7 +44,7 @@ module.exports = {
     ],
     async handler(args) {
         const workingDir = process.cwd();
-        const outputFile = path.resolve(workingDir, args.output);
+        const outputFile = validatePathWithinBase(args.output, workingDir);
         const outputRelative = path.relative(workingDir, outputFile);
         console.log('');

package/generators/cli/key/revoke.js CHANGED Viewed

@@ -17,6 +17,7 @@ const path = require('node:path');
 const readline = require('node:readline');
 const { findEnvFiles, getEnvValue, removeEnvKey, backupEnvFile } = require('../../lib/utils/env-manager');
 const { maskApiKey } = require('../../lib/utils/key-generator');
+const { validatePathWithinBase } = require('../../lib/utils/path-validator');
 function createReadlineInterface() {
     return readline.createInterface({
@@ -155,7 +156,7 @@ module.exports = {
         let selectedFile = null;
         if (args.file) {
-            const filePath = path.resolve(baseDir, args.file);
+            const filePath = validatePathWithinBase(args.file, baseDir);
             const relativePath = path.relative(baseDir, filePath);
             const key = getEnvValue(filePath, 'KEY');

package/generators/cli/payload/diff.js CHANGED Viewed

@@ -20,8 +20,9 @@ module.exports = {
     flags: {
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         table: {
             type: 'string',

package/generators/cli/payload/generate.js CHANGED Viewed

@@ -22,8 +22,9 @@ module.exports = {
     flags: {
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         table: {
             type: 'string',

package/generators/cli/payload/sync.js CHANGED Viewed

@@ -21,8 +21,9 @@ module.exports = {
     flags: {
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         table: {
             type: 'string',

package/generators/cli/payload/validate.js CHANGED Viewed

@@ -20,8 +20,9 @@ module.exports = {
     flags: {
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         table: {
             type: 'string',

package/generators/cli/processor/create.js CHANGED Viewed

@@ -26,6 +26,7 @@ const ConflictChecker = require('../../lib/utils/conflict-checker');
 const MetadataManager = require('../../lib/utils/metadata-manager');
 const SensitiveFieldMasker = require('../../lib/utils/sensitive-field-masker');
 const ProcessorValidationGenerator = require('../../lib/generators/processor-validation-generator');
+const { validateSafeName } = require('../../lib/utils/path-validator');
 const isBun = typeof Bun !== 'undefined';
@@ -272,11 +273,19 @@ async function execute(config) {
       next();
     });
-    // Middleware untuk validasi API key jika diperlukan
+    // Middleware untuk validasi API key jika diperlukan (constant-time comparison)
     if (config.key) {
+      const crypto = require('crypto');
+      const expectedKey = Buffer.from(config.key);
       app.use((req, res, next) => {
         const apiKey = req.headers['x-api-key'];
-        if (!apiKey || apiKey !== config.key) {
+        if (!apiKey) {
+          return res.status(401).json({ error: 'Unauthorized: Invalid API Key' });
+        }
+        const providedKey = Buffer.from(apiKey);
+        if (expectedKey.length !== providedKey.length ||
+            !crypto.timingSafeEqual(expectedKey, providedKey)) {
           return res.status(401).json({ error: 'Unauthorized: Invalid API Key' });
         }
         next();
@@ -870,7 +879,7 @@ module.exports = {
             type: 'string',
             required: false,
             default: null,
-            description: 'Tipe database (postgres|mysql|oracle|sqlite). Default: auto-detect dari config'
+            description: 'Tipe database (postgres|mysql|oracle). Default: postgres'
         },
         force: {
             type: 'boolean',
@@ -891,6 +900,8 @@ module.exports = {
     ],
     async handler(args) {
         try {
+            validateSafeName(args.project, 'project');
+            validateSafeName(args.name, 'processor');
             const project = ArgumentValidator.validateProjectName(args.project);
             const endpoint = ArgumentValidator.validateEndpointName(args.name);
             const payloadFile = ArgumentValidator.validatePayloadName(args.payload);

package/generators/cli/project/delete.js CHANGED Viewed

@@ -16,6 +16,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const readline = require('node:readline');
+const { validateSafeName } = require('../../lib/utils/path-validator');
 const isBun = typeof Bun !== 'undefined';
@@ -228,7 +229,7 @@ module.exports = {
         'npx restforge project delete --project=my-app --yes'
     ],
     async handler(args) {
-        const moduleName = args.project;
+        const moduleName = validateSafeName(args.project, 'project');
         const autoConfirm = args.yes === true;
         const workingDir = getWorkingDirectory();

package/generators/cli/query/validate.js CHANGED Viewed

@@ -33,8 +33,9 @@ module.exports = {
     flags: {
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         sql: {
             type: 'string',

package/generators/cli/schema/apply.js CHANGED Viewed

@@ -219,8 +219,9 @@ module.exports = {
         },
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         table: {
             type: 'string',

package/generators/cli/schema/describe.js CHANGED Viewed

@@ -51,8 +51,9 @@ module.exports = {
     flags: {
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         table: {
             type: 'string',

package/generators/cli/schema/diff.js CHANGED Viewed

@@ -148,8 +148,9 @@ module.exports = {
         },
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         table: {
             type: 'string',

package/generators/cli/schema/introspect.js CHANGED Viewed

@@ -238,8 +238,9 @@ module.exports = {
     flags: {
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         output: {
             type: 'string',

package/generators/cli/schema/list.js CHANGED Viewed

@@ -23,8 +23,9 @@ module.exports = {
     flags: {
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         schema: {
             type: 'string',

package/generators/cli/schema/migrate.js CHANGED Viewed

@@ -87,8 +87,9 @@ module.exports = {
         },
         config: {
             type: 'string',
-            required: true,
-            description: 'File config database (.env)'
+            required: false,
+            default: null,
+            description: 'File config database (.env). Fallback ke `.restforge/defaults.json` bila tidak disediakan eksplisit (set via `config set-default`)'
         },
         drop: {
             type: 'boolean',