@spfn/core 0.2.0-beta.6 → 0.2.0-beta.64

package/dist/nextjs/server.js

@@ -1,8 +1,77 @@
 import { NextResponse } from 'next/server';
 import { env } from '@spfn/core/config';
 import { logger } from '@spfn/core/logger';
+import { randomBytes, createHmac, createHash } from 'crypto';
 
 // src/nextjs/proxy/rpc.ts
+var PROXY_SIGNATURE_HEADER = "x-spfn-proxy-signature";
+var PROXY_TIMESTAMP_HEADER = "x-spfn-proxy-timestamp";
+var PROXY_NONCE_HEADER = "x-spfn-proxy-nonce";
+var PROXY_KEY_ID_HEADER = "x-spfn-proxy-key-id";
+var PROXY_CLIENT_IP_HEADER = "x-spfn-proxy-client-ip";
+var DEFAULT_KEY_ID = "default";
+function parseProxyKey(raw) {
+  const idx = raw.indexOf(":");
+  if (idx === -1) {
+    return { keyId: DEFAULT_KEY_ID, secret: raw };
+  }
+  return { keyId: raw.slice(0, idx) || DEFAULT_KEY_ID, secret: raw.slice(idx + 1) };
+}
+function parseProxyKeySet(raws) {
+  const keys = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of raws) {
+    if (!raw) {
+      continue;
+    }
+    for (const part of raw.split(",")) {
+      const trimmed = part.trim();
+      if (!trimmed) {
+        continue;
+      }
+      const key = parseProxyKey(trimmed);
+      if (!key.secret || seen.has(key.keyId)) {
+        continue;
+      }
+      seen.add(key.keyId);
+      keys.push(key);
+    }
+  }
+  return keys;
+}
+function buildCanonicalString(parts) {
+  return [parts.method.toUpperCase(), parts.path, parts.query, parts.timestamp, parts.nonce, parts.bodyHash].join("\n");
+}
+function hashBody(body) {
+  if (!body || body.length === 0) {
+    return "";
+  }
+  return typeof body === "string" ? createHash("sha256").update(body, "utf8").digest("hex") : createHash("sha256").update(body).digest("hex");
+}
+function computeSignature(secret, parts) {
+  return createHmac("sha256", secret).update(buildCanonicalString(parts)).digest("hex");
+}
+function generateNonce() {
+  return randomBytes(16).toString("hex");
+}
+function signProxyRequest(input) {
+  const timestamp = input.timestamp ?? String(Date.now());
+  const nonce = input.nonce ?? generateNonce();
+  const signature = computeSignature(input.key.secret, {
+    method: input.method,
+    path: input.path,
+    query: input.query ?? "",
+    timestamp,
+    nonce,
+    bodyHash: hashBody(input.body)
+  });
+  return {
+    [PROXY_SIGNATURE_HEADER]: signature,
+    [PROXY_TIMESTAMP_HEADER]: timestamp,
+    [PROXY_NONCE_HEADER]: nonce,
+    [PROXY_KEY_ID_HEADER]: input.key.keyId
+  };
+}
 
 // src/nextjs/shared.ts
 function buildUrlWithParams(path, params) {
@@ -27,6 +96,9 @@ function buildQueryString(query) {
   return `?${searchParams.toString()}`;
 }
 async function parseResponseBody(response) {
+  if (response.status === 204) {
+    return null;
+  }
   const contentType = response.headers.get("content-type");
   if (contentType?.includes("application/json")) {
     const text = await response.text();
@@ -185,6 +257,17 @@ function registerInterceptors(packageName, interceptors) {
 }
 
 // src/nextjs/proxy/helpers.ts
+function clientIpFromForwardedChain(xff, trustedHops) {
+  if (!xff) return void 0;
+  const parts = xff.split(",").map((s) => s.trim()).filter(Boolean);
+  if (parts.length === 0) return void 0;
+  const idx = parts.length - Math.max(1, trustedHops);
+  return parts[idx] ?? parts[0];
+}
+function trustedProxyHops() {
+  const raw = Number.parseInt(process.env.TRUSTED_PROXY_HOPS ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : 1;
+}
 function buildProxyHeaders(sourceHeaders, defaultHeaders) {
   const headers = new Headers();
   const headersToForward2 = [
@@ -193,7 +276,10 @@ function buildProxyHeaders(sourceHeaders, defaultHeaders) {
     "cookie",
     "user-agent",
     "accept",
-    "accept-language"
+    "accept-language",
+    // Forwarded so the backend proxy-guard can enforce its origin allowlist on
+    // the real browser Origin; without this allowedOrigins would be a no-op.
+    "origin"
   ];
   for (const header of headersToForward2) {
     const value = sourceHeaders instanceof Headers ? sourceHeaders.get(header) : sourceHeaders[header];
@@ -201,6 +287,11 @@ function buildProxyHeaders(sourceHeaders, defaultHeaders) {
       headers.set(header, value);
     }
   }
+  const xff = sourceHeaders instanceof Headers ? sourceHeaders.get("x-forwarded-for") : sourceHeaders["x-forwarded-for"];
+  const clientIp = clientIpFromForwardedChain(xff, trustedProxyHops());
+  if (clientIp) {
+    headers.set(PROXY_CLIENT_IP_HEADER, clientIp);
+  }
   for (const [key, value] of Object.entries(defaultHeaders)) {
     headers.set(key, value);
   }
@@ -302,7 +393,7 @@ function buildRequestContext(path, method, headers, body, searchParams, cookiesM
     metadata: {}
   };
 }
-function buildResponseContext(path, method, requestHeaders, requestBody, response, responseBody, requestMetadata) {
+function buildResponseContext(path, method, requestHeaders, requestBody, response, responseBody, requestMetadata, cookies) {
   return {
     path: `/${path}`,
     method,
@@ -317,6 +408,7 @@ function buildResponseContext(path, method, requestHeaders, requestBody, respons
       headers: response.headers,
       body: responseBody
     },
+    cookies,
     setCookies: [],
     metadata: requestMetadata
   };
@@ -324,45 +416,37 @@ function buildResponseContext(path, method, requestHeaders, requestBody, respons
 
 // src/nextjs/proxy/rpc.ts
 var rpcLogger = logger.child("@spfn/core:rpc-proxy");
-function isRouteDef(value) {
-  return value !== null && typeof value === "object" && "handler" in value && "method" in value && "path" in value;
-}
-function isRouter(value) {
-  return value !== null && typeof value === "object" && "routes" in value && "_routes" in value;
-}
-function getRouteByPath(router, routePath) {
-  const parts = routePath.split(".");
-  let current = router.routes;
-  for (const part of parts) {
-    if (!current || typeof current !== "object") {
-      return null;
-    }
-    const next = current[part];
-    if (isRouter(next)) {
-      current = next.routes;
-    } else if (isRouteDef(next)) {
-      return next;
-    } else {
-      current = next;
-    }
-  }
-  if (isRouteDef(current)) {
-    return current;
-  }
-  return null;
-}
 function createRpcProxy(config) {
   const {
-    router,
     apiUrl = env.SPFN_API_URL || "http://localhost:8790",
     debug = env.NODE_ENV === "development",
-    timeout = 3e4,
+    timeout = env.RPC_PROXY_TIMEOUT,
     headers: defaultHeaders = {},
     interceptors,
     autoDiscoverInterceptors = true,
-    disableAutoInterceptors
+    disableAutoInterceptors,
+    proxySecret = env.SPFN_PROXY_SECRET,
+    routeMap
   } = config;
-  const packageRouters = router._packageRouters || [];
+  const proxyKey = proxySecret ? parseProxyKeySet([proxySecret])[0] ?? null : null;
+  if (proxyKey) {
+    try {
+      const basePath = new URL(apiUrl).pathname;
+      if (basePath !== "/" && basePath !== "") {
+        rpcLogger.warn(
+          `SPFN_API_URL has a base path ("${basePath}"). proxy-guard signs route-relative paths, so the backend must receive paths WITHOUT this prefix (e.g. ingress strip) or strict mode will reject all signed requests with 403.`
+        );
+      }
+    } catch {
+    }
+  }
+  function resolveRoute(routeName) {
+    const entry = routeMap[routeName];
+    if (entry) {
+      return { method: entry.method, path: entry.path };
+    }
+    return null;
+  }
   async function handleRpc(request, context) {
     const startTime = Date.now();
     const params = await context.params;
@@ -375,6 +459,7 @@ function createRpcProxy(config) {
         );
       }
       let input = {};
+      let rawFormData = null;
       if (request.method === "GET") {
         const inputParam = request.nextUrl.searchParams.get("input");
         if (inputParam) {
@@ -388,45 +473,63 @@ function createRpcProxy(config) {
           }
         }
       } else {
-        try {
-          input = await request.json();
-        } catch {
-          return NextResponse.json(
-            buildErrorResponse("Bad Request", "Invalid JSON body", debug),
-            { status: 400 }
-          );
-        }
-      }
-      let routeDef = getRouteByPath(router, routeName);
-      if (!routeDef && packageRouters.length > 0) {
-        for (const pkgRouter of packageRouters) {
-          routeDef = getRouteByPath(pkgRouter, routeName);
-          if (routeDef) {
-            if (debug) {
-              rpcLogger.debug(`Route "${routeName}" found in package router`);
+        const contentType = request.headers.get("content-type") || "";
+        if (contentType.includes("multipart/form-data")) {
+          try {
+            rawFormData = await request.formData();
+            const metadataStr = rawFormData.get("__metadata");
+            if (metadataStr && typeof metadataStr === "string") {
+              const metadata = JSON.parse(metadataStr);
+              input.params = metadata.params;
+              input.query = metadata.query;
+              input.headers = metadata.headers;
+              input.cookies = metadata.cookies;
             }
-            break;
+            input.formData = {};
+            rawFormData.forEach((value, key) => {
+              if (key === "__metadata") return;
+              const existing = input.formData[key];
+              if (existing !== void 0) {
+                if (Array.isArray(existing)) {
+                  existing.push(value);
+                } else {
+                  input.formData[key] = [existing, value];
+                }
+              } else {
+                input.formData[key] = value;
+              }
+            });
+          } catch (error) {
+            return NextResponse.json(
+              buildErrorResponse("Bad Request", "Invalid form data", debug),
+              { status: 400 }
+            );
+          }
+        } else {
+          try {
+            input = await request.json();
+          } catch {
+            return NextResponse.json(
+              buildErrorResponse("Bad Request", "Invalid JSON body", debug),
+              { status: 400 }
+            );
           }
         }
       }
-      if (!routeDef) {
+      const routeInfo = resolveRoute(routeName);
+      if (!routeInfo) {
         rpcLogger.warn(`Route not found: ${routeName}`);
         return NextResponse.json(
-          buildErrorResponse("Not Found", `Route "${routeName}" not found in router`, debug),
+          buildErrorResponse("Not Found", `Route "${routeName}" not found`, debug),
           { status: 404 }
         );
       }
-      const { method: targetMethod, path: targetPath } = routeDef;
-      if (!targetMethod || !targetPath) {
-        rpcLogger.warn(`Route "${routeName}" is missing method or path`);
-        return NextResponse.json(
-          buildErrorResponse("Internal Error", `Route "${routeName}" is misconfigured`, debug),
-          { status: 500 }
-        );
-      }
+      const { method: targetMethod, path: targetPath } = routeInfo;
       const inputParams = input.params || {};
       const inputQuery = input.query || {};
       const inputBody = input.body;
+      const inputFormData = input.formData;
+      const hasFormData = rawFormData !== null && inputFormData && Object.keys(inputFormData).length > 0;
       const resolvedPath = buildUrlWithParams(targetPath, inputParams);
       const queryString = buildQueryString(inputQuery);
       const targetUrl = `${apiUrl}${resolvedPath}${queryString}`;
@@ -436,21 +539,35 @@ function createRpcProxy(config) {
           targetMethod,
           targetPath: resolvedPath,
           targetUrl,
-          hasBody: !!inputBody
+          hasBody: !!inputBody,
+          hasFormData
         });
       }
       const headers = buildProxyHeaders(request.headers, defaultHeaders);
+      if (hasFormData) {
+        headers.delete("content-type");
+      }
       const fetchOptions = {
         method: targetMethod,
         headers
       };
-      if (["POST", "PUT", "PATCH"].includes(targetMethod) && inputBody) {
-        fetchOptions.body = JSON.stringify(inputBody);
+      if (["POST", "PUT", "PATCH"].includes(targetMethod)) {
+        if (hasFormData && rawFormData) {
+          const forwardFormData = new FormData();
+          rawFormData.forEach((value, key) => {
+            if (key !== "__metadata") {
+              forwardFormData.append(key, value);
+            }
+          });
+          fetchOptions.body = forwardFormData;
+        } else if (inputBody) {
+          fetchOptions.body = JSON.stringify(inputBody);
+        }
       }
       const allInterceptors = collectInterceptors(autoDiscoverInterceptors, disableAutoInterceptors, interceptors, interceptorRegistry);
       const matchingInterceptors = filterMatchingInterceptors(allInterceptors, resolvedPath, targetMethod);
       if (debug && matchingInterceptors.length > 0) {
-        rpcLogger.debug(`\u{1F3AF} Found ${matchingInterceptors.length} matching interceptors for ${targetMethod} ${resolvedPath}`);
+        rpcLogger.debug(`Found ${matchingInterceptors.length} matching interceptors for ${targetMethod} ${resolvedPath}`);
       }
       const cookiesMap = parseCookiesFromNextRequest(request);
       const requestCtx = buildRequestContext(
@@ -474,6 +591,19 @@ function createRpcProxy(config) {
           fetchOptions.body = JSON.stringify(requestCtx.body);
         }
       }
+      if (proxyKey) {
+        const signedBody = typeof fetchOptions.body === "string" ? fetchOptions.body : void 0;
+        const signatureHeaders = signProxyRequest({
+          key: proxyKey,
+          method: targetMethod,
+          path: resolvedPath,
+          query: queryString,
+          body: signedBody
+        });
+        for (const [headerName, value] of Object.entries(signatureHeaders)) {
+          headers.set(headerName, value);
+        }
+      }
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), timeout);
       try {
@@ -490,7 +620,8 @@ function createRpcProxy(config) {
           inputBody,
           response,
           body,
-          requestCtx.metadata
+          requestCtx.metadata,
+          requestCtx.cookies
         );
         const responseInterceptorsToRun = matchingInterceptors.map((r) => r.response).filter((i) => !!i);
         if (responseInterceptorsToRun.length > 0) {
@@ -517,7 +648,7 @@ function createRpcProxy(config) {
           const setCookieHeader = buildSetCookieHeader(cookie);
           nextResponse.headers.append("Set-Cookie", setCookieHeader);
           if (debug) {
-            rpcLogger.debug("\u{1F36A} Set-Cookie header added", {
+            rpcLogger.debug("Set-Cookie header added", {
               name: cookie.name
             });
           }