@sockethub/server 5.0.0-alpha.13 → 5.0.0-alpha.15

package/README.md

@@ -87,6 +87,32 @@ Default: `localhost`
 Overrides `REDIS_HOST` and `REDIS_PORT`, can specify a full redis connect URL
 (e.g. `redis://username:password@host:port`)
 
+#### HTTP Actions
+
+Enable the HTTP streaming endpoint and tune limits:
+
+- SOCKETHUB_HTTP_ACTIONS_ENABLED
+- SOCKETHUB_HTTP_ACTIONS_PATH
+- SOCKETHUB_HTTP_ACTIONS_REQUIRE_REQUEST_ID
+- SOCKETHUB_HTTP_ACTIONS_MAX_MESSAGES_PER_REQUEST
+- SOCKETHUB_HTTP_ACTIONS_MAX_PAYLOAD_BYTES
+- SOCKETHUB_HTTP_ACTIONS_IDEMPOTENCY_TTL_MS
+- SOCKETHUB_HTTP_ACTIONS_REQUEST_TIMEOUT_MS
+- SOCKETHUB_HTTP_ACTIONS_IDLE_TIMEOUT_MS
+
+Request handling stays on Sockethub's existing core path:
+
+- validate message shape
+- store credentials (when applicable)
+- enqueue to Redis
+- process in platform child process
+- stream each result line back to the HTTP client
+
+HTTP actions only change transport and replay behavior. They do not create a
+separate platform routing model.
+
+See [`docs/configuration.md`](../../docs/configuration.md) for details and examples.
+
 #### Sentry Configuration
 
 Sentry error reporting can be configured via environment variable or config file:

package/dist/cors.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Parse the `sockethub:cors:origin` config value into either `"*"` (any
+ * origin) or a normalized origin allow-list. Both the socket.io listener and
+ * the HTTP actions routes resolve their CORS policy through this single
+ * parser so the two transports can never drift apart.
+ *
+ * Browsers serialize the `Origin` request header as a lowercase
+ * `scheme://host[:port]` with default ports omitted and no trailing slash or
+ * path. Configured entries are normalized to that same serialization before
+ * matching, so values like `https://App.example.com/` still match what the
+ * browser actually sends. Entries that cannot yield a usable origin are
+ * dropped with a warning rather than left in the list where they would
+ * silently never match.
+ *
+ * A restrictive config that yields no valid origins returns an empty list
+ * (blocking all cross-origin requests) instead of falling back to `"*"`:
+ * when an operator attempted to restrict origins, failing closed is the only
+ * safe interpretation.
+ */
+export declare function parseCorsOrigins(configured: unknown): "*" | Array<string>;
+/**
+ * Resolve the `Access-Control-Allow-Origin` value for a request against an
+ * allow-list already parsed by `parseCorsOrigins`. Returns `"*"` when any
+ * origin is allowed, the request's own origin when it is in the allow-list,
+ * or `undefined` when it is not allowed (the browser then blocks the
+ * response). The request origin is run through the same URL normalization as
+ * the configured entries, so matching never depends on the client sending
+ * the canonical serialization.
+ */
+export declare function resolveAllowedOrigin(allowedOrigins: "*" | Array<string>, requestOrigin: string | undefined): string | undefined;

package/dist/http/actions.d.ts

@@ -0,0 +1,29 @@
+/**
+ * HTTP actions endpoint.
+ *
+ * Accepts ActivityStreams via POST, streams NDJSON results as jobs complete,
+ * and optionally caches results in Redis for idempotent replay + GET retrieval.
+ */
+import type { RedisConfig } from "@sockethub/data-layer";
+import { type CredentialsStoreInterface } from "@sockethub/data-layer";
+import { type Express, type RequestHandler } from "express";
+import { createMessageHandlers } from "../message-handlers.js";
+import type ProcessManager from "../process-manager.js";
+interface HttpActionsOptions {
+    processManager: ProcessManager;
+    parentId: string;
+    parentSecret1: string;
+}
+interface HttpActionsDependencies {
+    getConfig?: (key: string) => unknown;
+    createRateLimiter?: (opts: {
+        windowMs: number;
+        max: number;
+    }) => RequestHandler;
+    createMessageHandlers?: typeof createMessageHandlers;
+    createCredentialsStore?: (parentId: string, sessionId: string, secret: string, redisConfig: RedisConfig) => CredentialsStoreInterface;
+    getIdempotencyRedisConnection?: () => ReturnType<typeof getIdempotencyRedisConnection>;
+}
+declare function getIdempotencyRedisConnection(): import("ioredis").default;
+export declare function registerHttpActionsRoutes(app: Express, options: HttpActionsOptions, deps?: HttpActionsDependencies): void;
+export {};

package/dist/http/session-registry.d.ts

@@ -0,0 +1,3 @@
+export declare function registerHttpSession(platformId: string): void;
+export declare function unregisterHttpSession(platformId: string): void;
+export declare function hasHttpSessions(platformId: string): boolean;