@sockethub/server 5.0.0-alpha.14 → 5.0.0-alpha.16

package/dist/config-schema.d.ts

@@ -0,0 +1,58 @@
+import convict from "convict";
+/**
+ * The convict configuration schema, derived from the canonical JSON schema in
+ * `@sockethub/schemas` so defaults, types and enums have a single source of
+ * truth. This module only layers on the server-specific concerns the JSON
+ * schema cannot express: environment variable and command-line argument
+ * bindings, and convict format refinements ("nat", "port").
+ */
+type JsonSchemaNode = {
+    type?: string | Array<string>;
+    enum?: Array<unknown>;
+    default?: unknown;
+    description?: string;
+    properties?: Record<string, JsonSchemaNode>;
+};
+type OverlayEntry = {
+    /** Convict format override (e.g. "nat", "port", "*"). */
+    format?: unknown;
+    /** Environment variable bound to this key. */
+    env?: string;
+    /**
+     * Treat an empty-string value of `env` as unset so it falls back to the
+     * config file / default, preserving the historical `process.env.X || ...`
+     * behavior (convict would otherwise apply the empty string as an
+     * override). Deliberately NOT set for SOCKETHUB_CORS_ORIGIN, where an
+     * empty string must stay applied so CORS fails closed.
+     */
+    emptyEnvIsUnset?: boolean;
+    /** Command-line argument bound to this key. */
+    arg?: string;
+    /**
+     * Treat this object node as a single convict leaf (validated as a whole
+     * by the JSON schema pass) instead of recursing into its properties.
+     */
+    leaf?: boolean;
+    /** Default for leaves the JSON schema declares no default for. */
+    default?: unknown;
+};
+/**
+ * Build the convict schema definition from a JSON schema plus a server
+ * overlay. Exported for tests; production code uses {@link buildSchema}.
+ * Throws when an overlay entry references a path the JSON schema does not
+ * declare, or when a leaf ends up without a default.
+ */
+export declare function buildConvictDefinition(jsonSchema: JsonSchemaNode, overlays: Record<string, OverlayEntry>): Record<string, unknown>;
+export declare function buildSchema(): convict.Config<Record<string, unknown>>;
+/**
+ * Environment variables where an empty-string value means "unset" rather
+ * than an override (historical `process.env.X || <config>` semantics).
+ */
+export declare const EMPTY_ENV_IS_UNSET_VARS: ReadonlyArray<string>;
+/**
+ * The fully materialized default configuration tree, straight from the JSON
+ * schema (no environment or command-line overrides applied). The `$schema`
+ * key is omitted; callers stamp their own reference.
+ */
+export declare function getDefaultConfig(): Record<string, unknown>;
+export {};

package/dist/cors.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Parse the `sockethub:cors:origin` config value into either `"*"` (any
+ * origin) or a normalized origin allow-list. Both the socket.io listener and
+ * the HTTP actions routes resolve their CORS policy through this single
+ * parser so the two transports can never drift apart.
+ *
+ * Browsers serialize the `Origin` request header as a lowercase
+ * `scheme://host[:port]` with default ports omitted and no trailing slash or
+ * path. Configured entries are normalized to that same serialization before
+ * matching, so values like `https://App.example.com/` still match what the
+ * browser actually sends. Entries that cannot yield a usable origin are
+ * dropped with a warning rather than left in the list where they would
+ * silently never match.
+ *
+ * A restrictive config that yields no valid origins returns an empty list
+ * (blocking all cross-origin requests) instead of falling back to `"*"`:
+ * when an operator attempted to restrict origins, failing closed is the only
+ * safe interpretation.
+ */
+export declare function parseCorsOrigins(configured: unknown): "*" | Array<string>;
+/**
+ * Resolve the `Access-Control-Allow-Origin` value for a request against an
+ * allow-list already parsed by `parseCorsOrigins`. Returns `"*"` when any
+ * origin is allowed, the request's own origin when it is in the allow-list,
+ * or `undefined` when it is not allowed (the browser then blocks the
+ * response). The request origin is run through the same URL normalization as
+ * the configured entries, so matching never depends on the client sending
+ * the canonical serialization.
+ */
+export declare function resolveAllowedOrigin(allowedOrigins: "*" | Array<string>, requestOrigin: string | undefined): string | undefined;

package/dist/http/actions.d.ts

@@ -24,14 +24,6 @@ interface HttpActionsDependencies {
     createCredentialsStore?: (parentId: string, sessionId: string, secret: string, redisConfig: RedisConfig) => CredentialsStoreInterface;
     getIdempotencyRedisConnection?: () => ReturnType<typeof getIdempotencyRedisConnection>;
 }
-/**
- * Resolve the `Access-Control-Allow-Origin` value for a request, using the same
- * `sockethub:cors:origin` config that governs socket.io. Returns `"*"` when any
- * origin is allowed, the request's own origin when it is in a configured
- * allow-list, or `undefined` when the origin is not allowed (the browser then
- * blocks the response).
- */
-export declare function resolveAllowedOrigin(configuredOrigin: string | undefined, requestOrigin: string | undefined): string | undefined;
 declare function getIdempotencyRedisConnection(): import("ioredis").default;
 export declare function registerHttpActionsRoutes(app: Express, options: HttpActionsOptions, deps?: HttpActionsDependencies): void;
 export {};