@revenexx/integrations-node-sdk 1.7.0 → 1.8.1

package/dist/index.cjs

@@ -61,6 +61,7 @@ __export(index_exports, {
   extractCredentialManifests: () => extractCredentialManifests,
   extractManifest: () => extractManifest,
   extractManifests: () => extractManifests,
+  headerCrossesOrigin: () => headerCrossesOrigin,
   httpErrorResult: () => httpErrorResult,
   isBlockedAddress: () => isBlockedAddress,
   isNodeWithIteration: () => isNodeWithIteration,
@@ -475,6 +476,63 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var MAX_TIMEOUT_MS = 12e4;
 var MAX_REDIRECTS = 5;
 var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var CROSS_ORIGIN_SAFE_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "content-encoding",
+  "content-language",
+  "content-type",
+  "idempotency-key",
+  "if-match",
+  "if-modified-since",
+  "if-none-match",
+  "if-range",
+  "if-unmodified-since",
+  "range",
+  "soapaction",
+  "user-agent"
+]);
+function headerCrossesOrigin(name) {
+  return CROSS_ORIGIN_SAFE_HEADERS.has(name.trim().toLowerCase());
+}
+var UNSENDABLE_IN_HEADER_VALUE = /[\0-\x08\x0a-\x1f\x7f\u0100-\uffff]/;
+var HEADER_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function isHttpWhitespace(code) {
+  return code === 9 || code === 10 || code === 13 || code === 32;
+}
+function trimHttpWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isHttpWhitespace(value.charCodeAt(start))) start++;
+  while (end > start && isHttpWhitespace(value.charCodeAt(end - 1))) end--;
+  return value.slice(start, end);
+}
+function invalidHeader(detail) {
+  return new NodeError("INVALID_HEADER", detail, { status: 0 });
+}
+function sendableHeaders(headers) {
+  if (typeof headers !== "object" || headers === null) {
+    throw invalidHeader("Headers must be an object or a list of pairs");
+  }
+  if (!(Symbol.iterator in headers) && Object.getOwnPropertySymbols(headers).length > 0) {
+    throw invalidHeader("A header name must be a string, not a symbol");
+  }
+  const entries = Symbol.iterator in headers ? Array.from(headers) : Object.entries(headers);
+  return entries.map((entry, i) => {
+    const pair = typeof entry === "object" && entry !== null && Symbol.iterator in entry ? Array.from(entry) : [];
+    if (pair.length !== 2) throw invalidHeader(`Header entry ${i} is not a name/value pair`);
+    const name = String(pair[0]);
+    const value = String(pair[1]);
+    if (!HEADER_NAME_TOKEN.test(name)) {
+      throw invalidHeader(`Header name ${JSON.stringify(name)} cannot be sent`);
+    }
+    if (UNSENDABLE_IN_HEADER_VALUE.test(trimHttpWhitespace(value))) {
+      throw invalidHeader(`Header ${JSON.stringify(name)} has a character in its value that cannot be sent`);
+    }
+    return [name, value];
+  });
+}
 var DEFAULT_RETRY_ATTEMPTS = 0;
 var MAX_RETRY_ATTEMPTS = 5;
 var DEFAULT_RETRY_DELAY_MS = 1e3;
@@ -547,7 +605,7 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked https\u2192http downgrade on redirect", { status: 0 });
     }
     await guardUrl(nextUrl, ctxSignal, effectiveMs);
-    const headers = new Headers(currentInit.headers ?? void 0);
+    const headers = new Headers(currentInit.headers);
     let method = (currentInit.method ?? "GET").toUpperCase();
     let body = currentInit.body;
     if (redirectStatus === 303 || (redirectStatus === 301 || redirectStatus === 302) && method === "POST") {
@@ -557,9 +615,9 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       headers.delete("content-length");
     }
     if (nextUrl.origin !== base.origin) {
-      headers.delete("authorization");
-      headers.delete("cookie");
-      headers.delete("proxy-authorization");
+      for (const name of [...headers.keys()]) {
+        if (!headerCrossesOrigin(name)) headers.delete(name);
+      }
     }
     currentUrl = nextUrl;
     currentInit = { ...currentInit, method, body, headers, redirect: "manual" };
@@ -572,6 +630,8 @@ async function safeFetch(url, options = {}) {
   const safeAttempts = Number.isFinite(rawAttempts) ? Math.min(Math.max(0, rawAttempts), MAX_RETRY_ATTEMPTS) : DEFAULT_RETRY_ATTEMPTS;
   const maxAttempts = safeAttempts + 1;
   const retryDelayMs = retry?.delayMs ?? DEFAULT_RETRY_DELAY_MS;
+  if (ctxSignal?.aborted) throw ctxSignal.reason;
+  if (fetchOptions.headers !== void 0) fetchOptions.headers = sendableHeaders(fetchOptions.headers);
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     if (ctxSignal?.aborted) throw ctxSignal.reason;
@@ -1115,6 +1175,7 @@ function base64Url(buf) {
   extractCredentialManifests,
   extractManifest,
   extractManifests,
+  headerCrossesOrigin,
   httpErrorResult,
   isBlockedAddress,
   isNodeWithIteration,

package/dist/index.d.cts

@@ -771,6 +771,18 @@ declare const DEFAULT_TIMEOUT_MS = 30000;
 declare const MAX_TIMEOUT_MS = 120000;
 /** Maximum number of redirect hops `safeFetch` follows before giving up. */
 declare const MAX_REDIRECTS = 5;
+/**
+ * Whether a request header with this name goes on to the next hop when
+ * {@link safeFetch} follows a redirect to another origin — `true` for `Accept`,
+ * `Accept-Encoding`, `Accept-Language`, `Content-Encoding`, `Content-Language`,
+ * `Content-Type`, `Idempotency-Key`, `If-Match`, `If-Modified-Since`,
+ * `If-None-Match`, `If-Range`, `If-Unmodified-Since`, `Range`, `SOAPAction` and
+ * `User-Agent`, in any case, and `false` for every other name. The keep-list is by
+ * name, so it can only keep a secret out of the headers it drops: a credential
+ * whose header name the author chooses must refuse a name this answers `true`
+ * for, or its key would cross with the harmless headers.
+ */
+declare function headerCrossesOrigin(name: string): boolean;
 declare const DEFAULT_RETRY_ATTEMPTS = 0;
 declare const MAX_RETRY_ATTEMPTS = 5;
 declare const DEFAULT_RETRY_DELAY_MS = 1000;
@@ -1239,4 +1251,4 @@ declare abstract class OAuth2AuthCodeCredential extends BaseCredential implement
     test(_ctx: ICredentialContext, config: Config): Promise<ICredentialTestResult>;
 }
 
-export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, packageIconProblem, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };
+export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, headerCrossesOrigin, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, packageIconProblem, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };

package/dist/index.d.ts

@@ -771,6 +771,18 @@ declare const DEFAULT_TIMEOUT_MS = 30000;
 declare const MAX_TIMEOUT_MS = 120000;
 /** Maximum number of redirect hops `safeFetch` follows before giving up. */
 declare const MAX_REDIRECTS = 5;
+/**
+ * Whether a request header with this name goes on to the next hop when
+ * {@link safeFetch} follows a redirect to another origin — `true` for `Accept`,
+ * `Accept-Encoding`, `Accept-Language`, `Content-Encoding`, `Content-Language`,
+ * `Content-Type`, `Idempotency-Key`, `If-Match`, `If-Modified-Since`,
+ * `If-None-Match`, `If-Range`, `If-Unmodified-Since`, `Range`, `SOAPAction` and
+ * `User-Agent`, in any case, and `false` for every other name. The keep-list is by
+ * name, so it can only keep a secret out of the headers it drops: a credential
+ * whose header name the author chooses must refuse a name this answers `true`
+ * for, or its key would cross with the harmless headers.
+ */
+declare function headerCrossesOrigin(name: string): boolean;
 declare const DEFAULT_RETRY_ATTEMPTS = 0;
 declare const MAX_RETRY_ATTEMPTS = 5;
 declare const DEFAULT_RETRY_DELAY_MS = 1000;
@@ -1239,4 +1251,4 @@ declare abstract class OAuth2AuthCodeCredential extends BaseCredential implement
     test(_ctx: ICredentialContext, config: Config): Promise<ICredentialTestResult>;
 }
 
-export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, packageIconProblem, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };
+export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, headerCrossesOrigin, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, packageIconProblem, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };

package/dist/index.js

@@ -384,6 +384,63 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var MAX_TIMEOUT_MS = 12e4;
 var MAX_REDIRECTS = 5;
 var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var CROSS_ORIGIN_SAFE_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "content-encoding",
+  "content-language",
+  "content-type",
+  "idempotency-key",
+  "if-match",
+  "if-modified-since",
+  "if-none-match",
+  "if-range",
+  "if-unmodified-since",
+  "range",
+  "soapaction",
+  "user-agent"
+]);
+function headerCrossesOrigin(name) {
+  return CROSS_ORIGIN_SAFE_HEADERS.has(name.trim().toLowerCase());
+}
+var UNSENDABLE_IN_HEADER_VALUE = /[\0-\x08\x0a-\x1f\x7f\u0100-\uffff]/;
+var HEADER_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function isHttpWhitespace(code) {
+  return code === 9 || code === 10 || code === 13 || code === 32;
+}
+function trimHttpWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isHttpWhitespace(value.charCodeAt(start))) start++;
+  while (end > start && isHttpWhitespace(value.charCodeAt(end - 1))) end--;
+  return value.slice(start, end);
+}
+function invalidHeader(detail) {
+  return new NodeError("INVALID_HEADER", detail, { status: 0 });
+}
+function sendableHeaders(headers) {
+  if (typeof headers !== "object" || headers === null) {
+    throw invalidHeader("Headers must be an object or a list of pairs");
+  }
+  if (!(Symbol.iterator in headers) && Object.getOwnPropertySymbols(headers).length > 0) {
+    throw invalidHeader("A header name must be a string, not a symbol");
+  }
+  const entries = Symbol.iterator in headers ? Array.from(headers) : Object.entries(headers);
+  return entries.map((entry, i) => {
+    const pair = typeof entry === "object" && entry !== null && Symbol.iterator in entry ? Array.from(entry) : [];
+    if (pair.length !== 2) throw invalidHeader(`Header entry ${i} is not a name/value pair`);
+    const name = String(pair[0]);
+    const value = String(pair[1]);
+    if (!HEADER_NAME_TOKEN.test(name)) {
+      throw invalidHeader(`Header name ${JSON.stringify(name)} cannot be sent`);
+    }
+    if (UNSENDABLE_IN_HEADER_VALUE.test(trimHttpWhitespace(value))) {
+      throw invalidHeader(`Header ${JSON.stringify(name)} has a character in its value that cannot be sent`);
+    }
+    return [name, value];
+  });
+}
 var DEFAULT_RETRY_ATTEMPTS = 0;
 var MAX_RETRY_ATTEMPTS = 5;
 var DEFAULT_RETRY_DELAY_MS = 1e3;
@@ -456,7 +513,7 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked https\u2192http downgrade on redirect", { status: 0 });
     }
     await guardUrl(nextUrl, ctxSignal, effectiveMs);
-    const headers = new Headers(currentInit.headers ?? void 0);
+    const headers = new Headers(currentInit.headers);
     let method = (currentInit.method ?? "GET").toUpperCase();
     let body = currentInit.body;
     if (redirectStatus === 303 || (redirectStatus === 301 || redirectStatus === 302) && method === "POST") {
@@ -466,9 +523,9 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       headers.delete("content-length");
     }
     if (nextUrl.origin !== base.origin) {
-      headers.delete("authorization");
-      headers.delete("cookie");
-      headers.delete("proxy-authorization");
+      for (const name of [...headers.keys()]) {
+        if (!headerCrossesOrigin(name)) headers.delete(name);
+      }
     }
     currentUrl = nextUrl;
     currentInit = { ...currentInit, method, body, headers, redirect: "manual" };
@@ -481,6 +538,8 @@ async function safeFetch(url, options = {}) {
   const safeAttempts = Number.isFinite(rawAttempts) ? Math.min(Math.max(0, rawAttempts), MAX_RETRY_ATTEMPTS) : DEFAULT_RETRY_ATTEMPTS;
   const maxAttempts = safeAttempts + 1;
   const retryDelayMs = retry?.delayMs ?? DEFAULT_RETRY_DELAY_MS;
+  if (ctxSignal?.aborted) throw ctxSignal.reason;
+  if (fetchOptions.headers !== void 0) fetchOptions.headers = sendableHeaders(fetchOptions.headers);
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     if (ctxSignal?.aborted) throw ctxSignal.reason;
@@ -988,6 +1047,7 @@ export {
   extractCredentialManifests,
   extractManifest,
   extractManifests,
+  headerCrossesOrigin,
   httpErrorResult,
   isBlockedAddress,
   isNodeWithIteration,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revenexx/integrations-node-sdk",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "TypeScript interfaces and utilities for Revenexx integration nodes",
   "license": "MIT",
   "author": "revenexx GmbH",