@revenexx/integrations-node-sdk 1.9.1 → 1.10.0

package/dist/fetch.d.ts

@@ -37,11 +37,33 @@ export interface SafeFetchRetry {
     attempts: number;
     delayMs?: number;
 }
+/**
+ * Binds a request to the one origin its credential belongs to (PO-688).
+ *
+ * Setting it declares the whole request secret-bearing — headers, query, path
+ * and body alike — so nothing has to name which part carries the secret: a
+ * request to any other origin is refused with `CREDENTIAL_ORIGIN`, on the first
+ * hop and on every redirect, before that origin is looked up or sent anything.
+ */
+export interface SafeFetchCredential {
+    /** The only origin this request may reach, e.g. `https://api.pipedrive.com`. */
+    origin: string | URL;
+    /**
+     * What a redirect off that origin does. `'refuse'` (the default) fails the
+     * call. `'strip'` follows it the way an unbound request would — every header
+     * not known to be harmless dropped, a body refused — for a download that is
+     * redirected to a CDN or a signed storage link. A secret in the query or the
+     * path is not protected on such a hop.
+     */
+    crossOriginRedirect?: 'refuse' | 'strip';
+}
 export interface SafeFetchOptions extends RequestInit {
     timeoutMs?: number;
     /** Pass `ctx.signal` so the workflow engine can cancel the request. */
     signal?: AbortSignal;
     retry?: SafeFetchRetry;
+    /** Bind the request to the origin of the credential it carries. */
+    credential?: SafeFetchCredential;
 }
 export declare function safeFetch(url: string | URL, options?: SafeFetchOptions): Promise<Response>;
 /**

package/dist/index.cjs

@@ -542,6 +542,26 @@ function clampResponseBytes(maxBytes) {
   if (!Number.isFinite(maxBytes) || maxBytes < 1) return MAX_RESPONSE_BYTES;
   return Math.min(maxBytes, MAX_RESPONSE_BYTES);
 }
+function boundOrigin(credential) {
+  let parsed;
+  try {
+    parsed = new URL(credential.origin);
+  } catch {
+    parsed = void 0;
+  }
+  if (!parsed || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new NodeError("CREDENTIAL_ORIGIN", "The origin a credential is bound to is not an http(s) address", { status: 0 });
+  }
+  return parsed.origin;
+}
+function credentialOriginRefusal(target, bound, hop) {
+  const what = hop === void 0 ? "a request" : `a ${hop} redirect`;
+  return new NodeError(
+    "CREDENTIAL_ORIGIN",
+    `Refused ${what} to ${target}: the credential it carries is bound to ${bound}`,
+    { status: 0 }
+  );
+}
 async function timedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
   const ac = new AbortController();
   const timer = setTimeout(() => ac.abort(), effectiveMs);
@@ -581,7 +601,16 @@ function hasContent(body) {
   if (body instanceof URLSearchParams) return body.toString().length > 0;
   return true;
 }
-async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
+function refuseUserinfo(url, status = 0) {
+  if (url.username !== "" || url.password !== "") {
+    throw new NodeError(
+      "INVALID_URL",
+      status === 0 ? "Refused a URL with a user name or password in it: pass them in a credential, not in the address" : `Refused a ${status} redirect to a URL with a user name or password in it`,
+      { status: 0 }
+    );
+  }
+}
+async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs, binding) {
   let currentUrl = url;
   let currentInit = { ...fetchOptions, redirect: "manual" };
   await guardUrl(currentUrl, ctxSignal, effectiveMs);
@@ -610,6 +639,10 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
     } catch {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked redirect with an invalid Location header", { status: 0 });
     }
+    refuseUserinfo(nextUrl, redirectStatus);
+    if (binding && binding.crossOriginRedirect === "refuse" && nextUrl.origin !== binding.origin) {
+      throw credentialOriginRefusal(nextUrl.origin, binding.origin, redirectStatus);
+    }
     if (base.protocol === "https:" && nextUrl.protocol !== "https:") {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked https\u2192http downgrade on redirect", { status: 0 });
     }
@@ -630,7 +663,9 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       );
     }
     await guardUrl(nextUrl, ctxSignal, effectiveMs);
-    if (nextUrl.origin !== base.origin) {
+    if (binding && nextUrl.origin !== binding.origin) {
+      for (const name of [...headers.keys()]) headers.delete(name);
+    } else if (nextUrl.origin !== base.origin) {
       for (const name of [...headers.keys()]) {
         if (!headerCrossesOrigin(name)) headers.delete(name);
       }
@@ -640,7 +675,7 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
   }
 }
 async function safeFetch(url, options = {}) {
-  const { timeoutMs = DEFAULT_TIMEOUT_MS, signal: ctxSignal, retry, ...fetchOptions } = options;
+  const { timeoutMs = DEFAULT_TIMEOUT_MS, signal: ctxSignal, retry, credential, ...fetchOptions } = options;
   const effectiveMs = Number.isFinite(timeoutMs) && timeoutMs > 0 ? Math.min(timeoutMs, MAX_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
   const rawAttempts = retry?.attempts ?? DEFAULT_RETRY_ATTEMPTS;
   const safeAttempts = Number.isFinite(rawAttempts) ? Math.min(Math.max(0, rawAttempts), MAX_RETRY_ATTEMPTS) : DEFAULT_RETRY_ATTEMPTS;
@@ -648,14 +683,26 @@ async function safeFetch(url, options = {}) {
   const retryDelayMs = retry?.delayMs ?? DEFAULT_RETRY_DELAY_MS;
   if (ctxSignal?.aborted) throw ctxSignal.reason;
   if (fetchOptions.headers !== void 0) fetchOptions.headers = sendableHeaders(fetchOptions.headers);
+  let parsed;
+  try {
+    parsed = url instanceof URL ? url : new URL(url);
+  } catch {
+    throw new NodeError("INVALID_URL", "Refused an address that cannot be read as a URL", { status: 0 });
+  }
+  refuseUserinfo(parsed);
+  let binding;
+  if (credential) {
+    binding = { origin: boundOrigin(credential), crossOriginRedirect: credential.crossOriginRedirect ?? "refuse" };
+    if (parsed.origin !== binding.origin) throw credentialOriginRefusal(parsed.origin, binding.origin);
+  }
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     if (ctxSignal?.aborted) throw ctxSignal.reason;
     try {
-      return await guardedFetch(url, fetchOptions, ctxSignal, effectiveMs);
+      return await guardedFetch(url, fetchOptions, ctxSignal, effectiveMs, binding);
     } catch (err) {
       if (ctxSignal?.aborted) throw ctxSignal.reason;
-      if (err instanceof NodeError && (err.code === "BLOCKED_ADDRESS" || err.code === "TOO_MANY_REDIRECTS")) {
+      if (err instanceof NodeError && (err.code === "BLOCKED_ADDRESS" || err.code === "TOO_MANY_REDIRECTS" || err.code === "CREDENTIAL_ORIGIN" || err.code === "INVALID_URL")) {
         throw err;
       }
       lastError = err;
@@ -971,15 +1018,23 @@ var BaseCredential = class {
     });
     const text = await readText(res, MAX_TOKEN_RESPONSE_BYTES);
     if (!res.ok) {
-      throw new Error(`token endpoint ${url} -> ${res.status}${formatOAuthError(text)}`);
+      throw new Error(`token endpoint ${endpointForMessage(url)} -> ${res.status}${formatOAuthError(text)}`);
     }
     try {
       return JSON.parse(text);
     } catch {
-      throw new Error(`token endpoint ${url} returned non-JSON body`);
+      throw new Error(`token endpoint ${endpointForMessage(url)} returned non-JSON body`);
     }
   }
 };
+function endpointForMessage(url) {
+  try {
+    const u = new URL(url);
+    return `${u.origin}${u.pathname}`;
+  } catch {
+    return "(unreadable address)";
+  }
+}
 function formatOAuthError(body) {
   try {
     const parsed = JSON.parse(body);

package/dist/index.js

@@ -450,6 +450,26 @@ function clampResponseBytes(maxBytes) {
   if (!Number.isFinite(maxBytes) || maxBytes < 1) return MAX_RESPONSE_BYTES;
   return Math.min(maxBytes, MAX_RESPONSE_BYTES);
 }
+function boundOrigin(credential) {
+  let parsed;
+  try {
+    parsed = new URL(credential.origin);
+  } catch {
+    parsed = void 0;
+  }
+  if (!parsed || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new NodeError("CREDENTIAL_ORIGIN", "The origin a credential is bound to is not an http(s) address", { status: 0 });
+  }
+  return parsed.origin;
+}
+function credentialOriginRefusal(target, bound, hop) {
+  const what = hop === void 0 ? "a request" : `a ${hop} redirect`;
+  return new NodeError(
+    "CREDENTIAL_ORIGIN",
+    `Refused ${what} to ${target}: the credential it carries is bound to ${bound}`,
+    { status: 0 }
+  );
+}
 async function timedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
   const ac = new AbortController();
   const timer = setTimeout(() => ac.abort(), effectiveMs);
@@ -489,7 +509,16 @@ function hasContent(body) {
   if (body instanceof URLSearchParams) return body.toString().length > 0;
   return true;
 }
-async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
+function refuseUserinfo(url, status = 0) {
+  if (url.username !== "" || url.password !== "") {
+    throw new NodeError(
+      "INVALID_URL",
+      status === 0 ? "Refused a URL with a user name or password in it: pass them in a credential, not in the address" : `Refused a ${status} redirect to a URL with a user name or password in it`,
+      { status: 0 }
+    );
+  }
+}
+async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs, binding) {
   let currentUrl = url;
   let currentInit = { ...fetchOptions, redirect: "manual" };
   await guardUrl(currentUrl, ctxSignal, effectiveMs);
@@ -518,6 +547,10 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
     } catch {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked redirect with an invalid Location header", { status: 0 });
     }
+    refuseUserinfo(nextUrl, redirectStatus);
+    if (binding && binding.crossOriginRedirect === "refuse" && nextUrl.origin !== binding.origin) {
+      throw credentialOriginRefusal(nextUrl.origin, binding.origin, redirectStatus);
+    }
     if (base.protocol === "https:" && nextUrl.protocol !== "https:") {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked https\u2192http downgrade on redirect", { status: 0 });
     }
@@ -538,7 +571,9 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       );
     }
     await guardUrl(nextUrl, ctxSignal, effectiveMs);
-    if (nextUrl.origin !== base.origin) {
+    if (binding && nextUrl.origin !== binding.origin) {
+      for (const name of [...headers.keys()]) headers.delete(name);
+    } else if (nextUrl.origin !== base.origin) {
       for (const name of [...headers.keys()]) {
         if (!headerCrossesOrigin(name)) headers.delete(name);
       }
@@ -548,7 +583,7 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
   }
 }
 async function safeFetch(url, options = {}) {
-  const { timeoutMs = DEFAULT_TIMEOUT_MS, signal: ctxSignal, retry, ...fetchOptions } = options;
+  const { timeoutMs = DEFAULT_TIMEOUT_MS, signal: ctxSignal, retry, credential, ...fetchOptions } = options;
   const effectiveMs = Number.isFinite(timeoutMs) && timeoutMs > 0 ? Math.min(timeoutMs, MAX_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
   const rawAttempts = retry?.attempts ?? DEFAULT_RETRY_ATTEMPTS;
   const safeAttempts = Number.isFinite(rawAttempts) ? Math.min(Math.max(0, rawAttempts), MAX_RETRY_ATTEMPTS) : DEFAULT_RETRY_ATTEMPTS;
@@ -556,14 +591,26 @@ async function safeFetch(url, options = {}) {
   const retryDelayMs = retry?.delayMs ?? DEFAULT_RETRY_DELAY_MS;
   if (ctxSignal?.aborted) throw ctxSignal.reason;
   if (fetchOptions.headers !== void 0) fetchOptions.headers = sendableHeaders(fetchOptions.headers);
+  let parsed;
+  try {
+    parsed = url instanceof URL ? url : new URL(url);
+  } catch {
+    throw new NodeError("INVALID_URL", "Refused an address that cannot be read as a URL", { status: 0 });
+  }
+  refuseUserinfo(parsed);
+  let binding;
+  if (credential) {
+    binding = { origin: boundOrigin(credential), crossOriginRedirect: credential.crossOriginRedirect ?? "refuse" };
+    if (parsed.origin !== binding.origin) throw credentialOriginRefusal(parsed.origin, binding.origin);
+  }
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     if (ctxSignal?.aborted) throw ctxSignal.reason;
     try {
-      return await guardedFetch(url, fetchOptions, ctxSignal, effectiveMs);
+      return await guardedFetch(url, fetchOptions, ctxSignal, effectiveMs, binding);
     } catch (err) {
       if (ctxSignal?.aborted) throw ctxSignal.reason;
-      if (err instanceof NodeError && (err.code === "BLOCKED_ADDRESS" || err.code === "TOO_MANY_REDIRECTS")) {
+      if (err instanceof NodeError && (err.code === "BLOCKED_ADDRESS" || err.code === "TOO_MANY_REDIRECTS" || err.code === "CREDENTIAL_ORIGIN" || err.code === "INVALID_URL")) {
         throw err;
       }
       lastError = err;
@@ -844,15 +891,23 @@ var BaseCredential = class {
     });
     const text = await readText(res, MAX_TOKEN_RESPONSE_BYTES);
     if (!res.ok) {
-      throw new Error(`token endpoint ${url} -> ${res.status}${formatOAuthError(text)}`);
+      throw new Error(`token endpoint ${endpointForMessage(url)} -> ${res.status}${formatOAuthError(text)}`);
     }
     try {
       return JSON.parse(text);
     } catch {
-      throw new Error(`token endpoint ${url} returned non-JSON body`);
+      throw new Error(`token endpoint ${endpointForMessage(url)} returned non-JSON body`);
     }
   }
 };
+function endpointForMessage(url) {
+  try {
+    const u = new URL(url);
+    return `${u.origin}${u.pathname}`;
+  } catch {
+    return "(unreadable address)";
+  }
+}
 function formatOAuthError(body) {
   try {
     const parsed = JSON.parse(body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revenexx/integrations-node-sdk",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "TypeScript interfaces and utilities for Revenexx integration nodes",
   "license": "MIT",
   "author": "revenexx GmbH",