@serve.zone/dcrouter 13.41.1 → 13.42.0

package/ts/config/classes.route-config-manager.ts

@@ -1,15 +1,20 @@
 import * as plugins from '../plugins.js';
 import { logger } from '../logger.js';
 import { RouteDoc } from '../db/index.js';
+import { routePathClasses } from '../../ts_interfaces/data/route-management.js';
 import type {
   IRoute,
   IMergedRoute,
   IRouteWarning,
   IRouteMetadata,
+  IRoutePathPolicyBinding,
+  IRouteSourcePolicy,
+  IRouteSecurity,
 } from '../../ts_interfaces/data/route-management.js';
 import type { IDcRouterRouteConfig } from '../../ts_interfaces/data/remoteingress.js';
 import { type IHttp3Config, augmentRouteWithHttp3 } from '../http3/index.js';
 import type { ReferenceResolver } from './classes.reference-resolver.js';
+import { SourcePolicyCompiler } from './classes.source-policy-compiler.js';
 
 export type TVpnClientAllowEntry = string | { clientId: string; domains: string[] };
 
@@ -131,6 +136,10 @@ export class RouteConfigManager {
   ): Promise<string> {
     const id = plugins.uuid.v4();
     const now = Date.now();
+    const sourcePolicyPayloadError = SourcePolicyCompiler.validateSourcePolicyPayload(metadata?.sourcePolicy);
+    if (sourcePolicyPayloadError) {
+      throw new Error(sourcePolicyPayloadError);
+    }
 
     // Ensure route has a name
     if (!route.name) {
@@ -144,6 +153,10 @@ export class RouteConfigManager {
       route = resolved.route;
       resolvedMetadata = this.normalizeRouteMetadata(resolved.metadata);
     }
+    const sourcePolicyValidationError = this.validateSourcePolicy(resolvedMetadata?.sourcePolicy, route);
+    if (sourcePolicyValidationError) {
+      throw new Error(sourcePolicyValidationError);
+    }
 
     const stored: IRoute = {
       id,
@@ -174,8 +187,15 @@ export class RouteConfigManager {
     if (!stored) {
       return { success: false, message: 'Route not found' };
     }
+    const sourcePolicyPayloadError = SourcePolicyCompiler.validateSourcePolicyPayload(patch.metadata?.sourcePolicy);
+    if (sourcePolicyPayloadError) {
+      return { success: false, message: sourcePolicyPayloadError };
+    }
 
     const previousSourceProfileRef = stored.metadata?.sourceProfileRef;
+    const previousRoute = structuredClone(stored.route);
+    const previousMetadata = structuredClone(stored.metadata);
+    const previousEnabled = stored.enabled;
 
     const isToggleOnlyPatch = patch.enabled !== undefined
       && patch.route === undefined
@@ -234,6 +254,14 @@ export class RouteConfigManager {
       stored.metadata = this.normalizeRouteMetadata(resolved.metadata);
     }
 
+    const sourcePolicyValidationError = this.validateSourcePolicy(stored.metadata?.sourcePolicy, stored.route);
+    if (sourcePolicyValidationError) {
+      stored.route = previousRoute;
+      stored.metadata = previousMetadata;
+      stored.enabled = previousEnabled;
+      return { success: false, message: sourcePolicyValidationError };
+    }
+
     stored.updatedAt = Date.now();
 
     await this.persistRoute(stored);
@@ -454,6 +482,7 @@ export class RouteConfigManager {
 
     const normalized: IRouteMetadata = {
       sourceProfileRef: normalizeString(metadata.sourceProfileRef),
+      sourcePolicy: this.normalizeSourcePolicy(metadata.sourcePolicy),
       networkTargetRef: normalizeString(metadata.networkTargetRef),
       sourceProfileName: normalizeString(metadata.sourceProfileName),
       networkTargetName: normalizeString(metadata.networkTargetName),
@@ -482,7 +511,7 @@ export class RouteConfigManager {
     if (!normalized.networkTargetRef) {
       normalized.networkTargetName = undefined;
     }
-    if (!normalized.sourceProfileRef && !normalized.networkTargetRef) {
+    if (!normalized.sourceProfileRef && !normalized.sourcePolicy && !normalized.networkTargetRef) {
       normalized.lastResolvedAt = undefined;
     }
     if (normalized.ownerType !== 'gatewayClient' && normalized.ownerType !== 'workhoster') {
@@ -507,6 +536,128 @@ export class RouteConfigManager {
     return normalized;
   }
 
+  private normalizeSourcePolicy(sourcePolicy?: Partial<IRouteSourcePolicy>): IRouteSourcePolicy | undefined {
+    const bindings = sourcePolicy?.bindings;
+    if (!Array.isArray(bindings)) {
+      return undefined;
+    }
+
+    const normalizedBindings: IRouteSourcePolicy['bindings'] = [];
+    for (const binding of bindings) {
+      const sourceProfileRef = typeof binding.sourceProfileRef === 'string'
+        ? binding.sourceProfileRef.trim()
+        : '';
+      if (!sourceProfileRef) {
+        continue;
+      }
+      const normalizedRateLimit = this.normalizeRateLimit(binding.rateLimit);
+      const normalizedPathPolicies = this.normalizePathPolicies(binding.pathPolicies);
+
+      normalizedBindings.push({
+        ...(typeof binding.id === 'string' && binding.id.trim() ? { id: binding.id.trim() } : {}),
+        sourceProfileRef,
+        ...(typeof binding.sourceProfileName === 'string' && binding.sourceProfileName.trim()
+          ? { sourceProfileName: binding.sourceProfileName.trim() }
+          : {}),
+        ...(normalizedRateLimit ? { rateLimit: normalizedRateLimit } : {}),
+        ...(typeof binding.maxConnections === 'number' && Number.isFinite(binding.maxConnections) && binding.maxConnections >= 0
+          ? { maxConnections: binding.maxConnections }
+          : {}),
+        ...(binding.onExceeded?.type === '429'
+          ? {
+              onExceeded: {
+                type: '429' as const,
+                ...(typeof binding.onExceeded.errorMessage === 'string' && binding.onExceeded.errorMessage.trim()
+                  ? { errorMessage: binding.onExceeded.errorMessage.trim() }
+                  : {}),
+              },
+            }
+          : {}),
+        ...(normalizedPathPolicies ? { pathPolicies: normalizedPathPolicies } : {}),
+      });
+    }
+
+    return normalizedBindings.length > 0 ? { bindings: normalizedBindings } : undefined;
+  }
+
+  private normalizePathPolicies(
+    pathPolicies?: IRoutePathPolicyBinding[],
+  ): IRoutePathPolicyBinding[] | undefined {
+    if (!Array.isArray(pathPolicies)) {
+      return undefined;
+    }
+
+    const validClasses = new Set<string>(routePathClasses);
+    const normalizedPathPolicies: IRoutePathPolicyBinding[] = [];
+    for (const pathPolicy of pathPolicies) {
+      if (!validClasses.has(pathPolicy.pathClass)) {
+        continue;
+      }
+
+      const normalizedRateLimit = this.normalizeRateLimit(pathPolicy.rateLimit);
+      const pathPatterns = Array.isArray(pathPolicy.pathPatterns)
+        ? [...new Set(pathPolicy.pathPatterns
+            .map((pattern) => typeof pattern === 'string' ? pattern.trim() : '')
+            .filter(Boolean))]
+        : undefined;
+
+      normalizedPathPolicies.push({
+        ...(typeof pathPolicy.id === 'string' && pathPolicy.id.trim() ? { id: pathPolicy.id.trim() } : {}),
+        pathClass: pathPolicy.pathClass,
+        ...(pathPatterns?.length ? { pathPatterns } : {}),
+        ...(normalizedRateLimit ? { rateLimit: normalizedRateLimit } : {}),
+        ...(typeof pathPolicy.maxConnections === 'number' && Number.isFinite(pathPolicy.maxConnections) && pathPolicy.maxConnections >= 0
+          ? { maxConnections: pathPolicy.maxConnections }
+          : {}),
+        ...(pathPolicy.onExceeded?.type === '429'
+          ? {
+              onExceeded: {
+                type: '429' as const,
+                ...(typeof pathPolicy.onExceeded.errorMessage === 'string' && pathPolicy.onExceeded.errorMessage.trim()
+                  ? { errorMessage: pathPolicy.onExceeded.errorMessage.trim() }
+                  : {}),
+              },
+            }
+          : {}),
+      });
+    }
+
+    return normalizedPathPolicies.length > 0 ? normalizedPathPolicies : undefined;
+  }
+
+  private validateSourcePolicy(
+    sourcePolicy: IRouteSourcePolicy | undefined,
+    route: IDcRouterRouteConfig,
+  ): string | undefined {
+    const shapeError = SourcePolicyCompiler.validateSourcePolicyShape(sourcePolicy, route);
+    if (shapeError) {
+      return shapeError;
+    }
+    return SourcePolicyCompiler.validateResolvedSourcePolicy(sourcePolicy, this.referenceResolver);
+  }
+
+  private normalizeRateLimit(rateLimit?: IRouteSecurity['rateLimit']): IRouteSecurity['rateLimit'] | undefined {
+    if (!rateLimit || typeof rateLimit !== 'object') {
+      return undefined;
+    }
+
+    const maxRequests = Number(rateLimit.maxRequests);
+    const window = Number(rateLimit.window);
+    if (!Number.isFinite(maxRequests) || maxRequests < 0 || !Number.isFinite(window) || window < 0) {
+      return undefined;
+    }
+
+    return {
+      enabled: rateLimit.enabled !== false,
+      maxRequests,
+      window,
+      keyBy: 'ip',
+      ...(typeof rateLimit.errorMessage === 'string' && rateLimit.errorMessage.trim()
+        ? { errorMessage: rateLimit.errorMessage.trim() }
+        : {}),
+    };
+  }
+
   // =========================================================================
   // Private: warnings
   // =========================================================================
@@ -569,10 +720,10 @@ export class RouteConfigManager {
 
       const enabledRoutes: plugins.smartproxy.IRouteConfig[] = [];
 
-      // Add all enabled routes with HTTP/3 and VPN augmentation
+      // Add all enabled routes with HTTP/3, VPN, and source-policy augmentation
       for (const route of this.routes.values()) {
         if (route.enabled) {
-          enabledRoutes.push(this.prepareStoredRouteForApply(route));
+          enabledRoutes.push(...this.prepareStoredRoutesForApply(route));
         }
       }
 
@@ -592,9 +743,15 @@ export class RouteConfigManager {
     });
   }
 
-  private prepareStoredRouteForApply(storedRoute: IRoute): plugins.smartproxy.IRouteConfig {
+  private prepareStoredRoutesForApply(storedRoute: IRoute): plugins.smartproxy.IRouteConfig[] {
     const hydratedRoute = this.hydrateStoredRoute?.(storedRoute);
-    return this.prepareRouteForApply(hydratedRoute || storedRoute.route, storedRoute.id);
+    const sourcePolicyRoutes = SourcePolicyCompiler.compileRoute(
+      hydratedRoute || storedRoute.route,
+      storedRoute.metadata,
+      this.referenceResolver,
+      storedRoute.id,
+    );
+    return sourcePolicyRoutes.map((route) => this.prepareRouteForApply(route, storedRoute.id));
   }
 
   private prepareRouteForApply(