@shushed/helpers 0.0.199 → 0.0.200-runtime-url-fix-20251125155626

package/dist/cjs/src-public/getEventTime.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = getEventTime;
+function getEventTime(x, defaultValue) {
+    const possibleKeys = [
+        'last_modified_date_time',
+        'last_modified_date',
+        'last_modified_datetime',
+        'last_modified_date_time',
+        'lastModifiedAt',
+        'last_modified_at',
+        'SystemModifiedAt',
+        'system_modified_at',
+        'lastUpdatedAt',
+        'modified_at',
+        'last_updated_at',
+        'modifiedAt'
+    ];
+    for (let i = 0; i < possibleKeys.length; i++) {
+        if (x[possibleKeys[i]]) {
+            const possibleDateTime = new Date(x[possibleKeys[i]]);
+            if (!isNaN(possibleDateTime.getTime())) {
+                return possibleDateTime;
+            }
+        }
+    }
+    return defaultValue;
+}

package/dist/cjs/src-public/index.js

@@ -0,0 +1,50 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisConnectionError = exports.RateLimit = exports.setHeaders = exports.DatoHelper = exports.AirtableHelper = exports.BigQueryHelper = exports.JWKSHelper = exports.CloudTasksHelper = exports.Secrets = exports.SchedulerHelper = exports.Logging = exports.Runtime = exports.PubSubHelper = exports.EnvEngine = exports.validate = void 0;
+var validate_1 = require("./validate");
+Object.defineProperty(exports, "validate", { enumerable: true, get: function () { return __importDefault(validate_1).default; } });
+__exportStar(require("./sanitize"), exports);
+__exportStar(require("./utils"), exports);
+var env_1 = require("./env");
+Object.defineProperty(exports, "EnvEngine", { enumerable: true, get: function () { return __importDefault(env_1).default; } });
+var pubsub_1 = require("./pubsub");
+Object.defineProperty(exports, "PubSubHelper", { enumerable: true, get: function () { return __importDefault(pubsub_1).default; } });
+var runtime_1 = require("./runtime");
+Object.defineProperty(exports, "Runtime", { enumerable: true, get: function () { return __importDefault(runtime_1).default; } });
+Object.defineProperty(exports, "Logging", { enumerable: true, get: function () { return runtime_1.Logging; } });
+var scheduler_1 = require("./scheduler");
+Object.defineProperty(exports, "SchedulerHelper", { enumerable: true, get: function () { return __importDefault(scheduler_1).default; } });
+var secret_1 = require("./secret");
+Object.defineProperty(exports, "Secrets", { enumerable: true, get: function () { return __importDefault(secret_1).default; } });
+var cloudtasks_1 = require("./cloudtasks");
+Object.defineProperty(exports, "CloudTasksHelper", { enumerable: true, get: function () { return __importDefault(cloudtasks_1).default; } });
+var jwks_1 = require("./jwks");
+Object.defineProperty(exports, "JWKSHelper", { enumerable: true, get: function () { return __importDefault(jwks_1).default; } });
+var bigquery_1 = require("./bigquery");
+Object.defineProperty(exports, "BigQueryHelper", { enumerable: true, get: function () { return __importDefault(bigquery_1).default; } });
+var airtable_1 = require("./airtable");
+Object.defineProperty(exports, "AirtableHelper", { enumerable: true, get: function () { return __importDefault(airtable_1).default; } });
+var dato_1 = require("./dato");
+Object.defineProperty(exports, "DatoHelper", { enumerable: true, get: function () { return __importDefault(dato_1).default; } });
+var setHeaders_1 = require("./setHeaders");
+Object.defineProperty(exports, "setHeaders", { enumerable: true, get: function () { return __importDefault(setHeaders_1).default; } });
+var rateLimit_1 = require("./rateLimit");
+Object.defineProperty(exports, "RateLimit", { enumerable: true, get: function () { return __importDefault(rateLimit_1).default; } });
+Object.defineProperty(exports, "RedisConnectionError", { enumerable: true, get: function () { return rateLimit_1.RedisConnectionError; } });

package/dist/cjs/src-public/ipValidation.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidIp = isValidIp;
+exports.isValidCidr = isValidCidr;
+exports.validateIpOrCidr = validateIpOrCidr;
+exports.isIpInCidr = isIpInCidr;
+exports.isIpInCidrs = isIpInCidrs;
+exports.getClientIp = getClientIp;
+const net_1 = require("net");
+function isValidIp(value) {
+    if (!value)
+        return false;
+    return (0, net_1.isIP)(value.trim()) !== 0;
+}
+function isValidCidr(value) {
+    if (!value)
+        return false;
+    const trimmed = value.trim();
+    const parts = trimmed.split('/');
+    if (parts.length !== 2)
+        return false;
+    const [ip, maskStr] = parts;
+    const ipVersion = (0, net_1.isIP)(ip);
+    if (ipVersion === 0)
+        return false;
+    if (!/^[0-9]{1,3}$/.test(maskStr))
+        return false;
+    const mask = Number(maskStr);
+    if (!Number.isInteger(mask))
+        return false;
+    if (ipVersion === 4)
+        return mask >= 0 && mask <= 32;
+    return mask >= 0 && mask <= 128;
+}
+function validateIpOrCidr(value) {
+    if (!value)
+        return false;
+    const trimmed = value.trim();
+    return trimmed.includes('/') ? isValidCidr(trimmed) : isValidIp(trimmed);
+}
+function ipv4ToInt(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return null;
+    let val = 0 >>> 0;
+    for (let i = 0; i < 4; i++) {
+        const n = Number(parts[i]);
+        if (!Number.isInteger(n) || n < 0 || n > 255)
+            return null;
+        val = ((val << 8) | n) >>> 0;
+    }
+    return val >>> 0;
+}
+function ipv6ToBigInt(ip) {
+    const hasIpv4Tail = ip.includes('.');
+    let head = ip;
+    let tailHextets = [];
+    if (hasIpv4Tail) {
+        const lastColon = ip.lastIndexOf(':');
+        const ipv4 = ip.slice(lastColon + 1);
+        const ipv4Num = ipv4ToInt(ipv4);
+        if (ipv4Num == null)
+            return null;
+        const hi = ((ipv4Num >>> 16) & 0xffff) >>> 0;
+        const lo = (ipv4Num & 0xffff) >>> 0;
+        tailHextets = [hi.toString(16), lo.toString(16)];
+        head = ip.slice(0, lastColon);
+    }
+    const doubleColon = head.indexOf('::');
+    let groups = [];
+    if (doubleColon !== -1) {
+        const left = head.slice(0, doubleColon).split(':').filter(Boolean);
+        const right = head.slice(doubleColon + 2).split(':').filter(Boolean);
+        const missing = Math.max(0, 8 - (left.length + right.length + tailHextets.length));
+        groups = [...left, ...new Array(missing).fill('0'), ...right];
+    }
+    else {
+        groups = head.split(':').filter(Boolean);
+    }
+    if (groups.length + tailHextets.length !== 8) {
+        if (groups.length + tailHextets.length < 8) {
+            const missing = 8 - (groups.length + tailHextets.length);
+            groups = [...groups, ...new Array(missing).fill('0')];
+        }
+        else {
+            return null;
+        }
+    }
+    if (tailHextets.length) {
+        groups = [...groups.slice(0, 6), ...tailHextets];
+    }
+    if (groups.length !== 8)
+        return null;
+    let result = 0n;
+    for (let i = 0; i < 8; i++) {
+        const part = groups[i];
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
+            return null;
+        const n = BigInt(parseInt(part, 16));
+        result = (result << 16n) | n;
+    }
+    return result;
+}
+function ipv4CidrContains(ip, cidr) {
+    const [base, maskStr] = cidr.split('/');
+    const ipInt = ipv4ToInt(ip);
+    const baseInt = ipv4ToInt(base);
+    if (ipInt == null || baseInt == null)
+        return false;
+    const maskBits = Number(maskStr);
+    if (!Number.isInteger(maskBits) || maskBits < 0 || maskBits > 32)
+        return false;
+    const mask = maskBits === 0 ? 0 : (~0 << (32 - maskBits)) >>> 0;
+    return ((ipInt & mask) >>> 0) === ((baseInt & mask) >>> 0);
+}
+function ipv6CidrContains(ip, cidr) {
+    const [base, maskStr] = cidr.split('/');
+    const ipBig = ipv6ToBigInt(ip);
+    const baseBig = ipv6ToBigInt(base);
+    if (ipBig == null || baseBig == null)
+        return false;
+    const maskBits = Number(maskStr);
+    if (!Number.isInteger(maskBits) || maskBits < 0 || maskBits > 128)
+        return false;
+    const prefix = BigInt(maskBits);
+    const mask = prefix === 0n ? 0n : ((1n << prefix) - 1n) << (128n - prefix);
+    return (ipBig & mask) === (baseBig & mask);
+}
+function isIpInCidr(ip, cidr) {
+    const version = (0, net_1.isIP)(ip.trim());
+    if (version === 0)
+        return false;
+    if (!isValidCidr(cidr))
+        return false;
+    const cidrIpVersion = (0, net_1.isIP)(cidr.split('/')[0]);
+    if (cidrIpVersion !== version)
+        return false;
+    return version === 4 ? ipv4CidrContains(ip, cidr) : ipv6CidrContains(ip, cidr);
+}
+function isIpInCidrs(ip, cidrs) {
+    if (!Array.isArray(cidrs) || cidrs.length === 0)
+        return false;
+    for (let i = 0; i < cidrs.length; i++) {
+        const c = cidrs[i];
+        if (typeof c !== 'string')
+            continue;
+        if (isIpInCidr(ip, c.trim()))
+            return true;
+    }
+    return false;
+}
+function getClientIp(req) {
+    const xForwardedFor = req.headers["x-forwarded-for"];
+    if (typeof xForwardedFor === "string" && xForwardedFor.length > 0) {
+        const clientIp = xForwardedFor.split(",")[0].trim();
+        if (clientIp)
+            return clientIp;
+    }
+    return req.socket.remoteAddress ?? undefined;
+}
+exports.default = {
+    isValidIp,
+    isValidCidr,
+    validateIpOrCidr,
+    isIpInCidr,
+    isIpInCidrs,
+};

package/dist/cjs/src-public/jwks.js

@@ -0,0 +1,108 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CACHE_TABLE = void 0;
+const jose_1 = require("jose");
+const runtime_1 = __importDefault(require("./runtime"));
+exports.CACHE_TABLE = 'cache-global';
+class JWKSHelper extends runtime_1.default {
+    firestore;
+    constructor(opts, firestore) {
+        super(opts);
+        this.firestore = firestore;
+    }
+    async validateAuthorizationHeader(authorizationHeader, expectedServiceAccount = null) {
+        const splitted = authorizationHeader.split(".");
+        const keyMeta = JSON.parse(Buffer.from(splitted[0], "base64").toString('utf-8')) || {};
+        const meta = JSON.parse(Buffer.from(splitted[1], "base64").toString('utf-8')) || {};
+        if (!meta.email_verified) {
+            throw new Error("Authorization header - Email not verified");
+        }
+        if (expectedServiceAccount !== false) {
+            if (expectedServiceAccount === null) {
+                expectedServiceAccount = `runtime@${process.env.GCLOUD_PROJECT}.iam.gserviceaccount.com`;
+            }
+            if (meta.email !== expectedServiceAccount) {
+                throw new Error(`Authorization header - Wrong service account, got ${meta?.email}, expected ${expectedServiceAccount}`);
+            }
+        }
+        if (!keyMeta.kid || !keyMeta.alg) {
+            throw new Error("Malformed Authorization Header. KID is missing");
+        }
+        const key = await this.getKey(keyMeta.kid);
+        if (!key) {
+            throw new Error("Incorrect Authorization Header. The key has not been found in the Google JWKS set");
+        }
+        const importedKey = await (0, jose_1.importJWK)(key, keyMeta.alg);
+        let validationCorrect = true;
+        try {
+            await (0, jose_1.jwtVerify)(authorizationHeader, importedKey, {
+                issuer: ['https://accounts.google.com', 'accounts.google.com'],
+                clockTolerance: 0,
+                audience: process.env.GCLOUD_PROJECT + "/" + this.triggerId,
+            });
+        }
+        catch (err) {
+            validationCorrect = false;
+        }
+        if (!validationCorrect) {
+            throw new Error("Incorrect Authorization Header. The JWT is not valid");
+        }
+        return {
+            email: meta.email,
+        };
+    }
+    async getKey(keyId) {
+        const jwks = typeof global.jwks !== 'undefined' ? global.jwks : null;
+        let parsedJwks = null;
+        if (jwks) {
+            try {
+                parsedJwks = JSON.parse(jwks);
+            }
+            catch (err) {
+                err.message.toString();
+            }
+        }
+        let keyData = parsedJwks?.keys?.find((x) => x.kid === keyId);
+        let cachedItem;
+        if (!keyData) {
+            cachedItem = await this.firestore.collection(exports.CACHE_TABLE).doc('google-jwks').get();
+            if (cachedItem.exists && cachedItem.data()?.expires_at.toDate() > new Date()) {
+                keyData = cachedItem.data()?.value;
+            }
+        }
+        keyData = parsedJwks?.keys.find((x) => x.kid === keyId);
+        if (!keyData) {
+            const result = (await this.fetchJWKS());
+            parsedJwks = result.jwks;
+            if (cachedItem) {
+                cachedItem.ref.set({
+                    value: parsedJwks,
+                    expires_at: result.expiresAt
+                }, { merge: true });
+            }
+            keyData = parsedJwks?.keys.find((x) => x.kid === keyId);
+        }
+        if (parsedJwks && cachedItem) {
+            global.jwks = JSON.stringify(parsedJwks);
+        }
+        return keyData;
+    }
+    async fetchJWKS() {
+        const date = new Date();
+        let expiresAt = new Date(Date.now() + 1000 * 60 * 60);
+        const response = await fetch("https://www.googleapis.com/oauth2/v3/certs");
+        const maxAgePair = response.headers.get("Cache-Control")?.split(',').map(x => x.trim().split('=')).find(x => x[0] === 'max-age');
+        if (maxAgePair && maxAgePair.length === 2) {
+            expiresAt = new Date(date.getTime() + parseInt(maxAgePair[1], 10) * 1000);
+        }
+        const jwks = await response.json();
+        return {
+            expiresAt,
+            jwks: jwks
+        };
+    }
+}
+exports.default = JWKSHelper;