@sproutboat/runtime 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @sproutboat/runtime
 
+## 0.11.0
+
+### Minor Changes
+
+- d0e2c05: `request.cf` gains `httpProtocol`, `tlsVersion`, and `tlsCipher` (baronunread/sproutboat#128). Like `clientIp` (#163), these are only populated when the direct peer is listed in `SB_TRUSTED_PROXIES` and it forwarded the corresponding `x-sb-http-protocol` / `x-sb-tls-version` / `x-sb-tls-cipher` header — otherwise they stay absent rather than a guessed or faked value. `colo`, ASN, and geo fields remain out of scope (no GeoIP database on the box).
+
 ## 0.10.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/client-ip.test.js

@@ -17,7 +17,7 @@ const load = new Function(
   "__envMap",
   `${src.slice(start, end)}
    const __sbEnv = (k) => __envMap[k];
-   return { __sbNormalizeIp, __sbIpInCidr, __sbIpTrusted, __sbClientIp, __sbSplitList };`,
+   return { __sbNormalizeIp, __sbIpInCidr, __sbIpTrusted, __sbClientIp, __sbSplitList, __sbTrustedProxyHeader };`,
 );
 const H = load(new Proxy({}, { get: (_, k) => env[k] }));
 
@@ -64,3 +64,22 @@ test("__sbClientIp: an untrusted peer cannot use XFF even if it sends one", () =
   env = { SB_TRUSTED_PROXIES: "10.0.0.0/8" };
   expect(H.__sbClientIp(req({ "x-sb-remote-addr": "198.51.100.9", "x-forwarded-for": "1.1.1.1" }))).toBe("198.51.100.9");
 });
+
+test("__sbTrustedProxyHeader: no trusted proxies configured means the header is ignored", () => {
+  env = {};
+  const r = req({ "x-sb-remote-addr": "127.0.0.1", "x-sb-http-protocol": "HTTP/2" });
+  expect(H.__sbTrustedProxyHeader(r, "x-sb-http-protocol")).toBeUndefined();
+});
+
+test("__sbTrustedProxyHeader: an untrusted direct peer cannot fake it", () => {
+  env = { SB_TRUSTED_PROXIES: "10.0.0.0/8" };
+  const r = req({ "x-sb-remote-addr": "198.51.100.9", "x-sb-tls-version": "TLSv1.3" });
+  expect(H.__sbTrustedProxyHeader(r, "x-sb-tls-version")).toBeUndefined();
+});
+
+test("__sbTrustedProxyHeader: a trusted peer's value passes through, absent stays undefined", () => {
+  env = { SB_TRUSTED_PROXIES: "127.0.0.0/8" };
+  const r = req({ "x-sb-remote-addr": "127.0.0.1", "x-sb-http-protocol": "HTTP/2" });
+  expect(H.__sbTrustedProxyHeader(r, "x-sb-http-protocol")).toBe("HTTP/2");
+  expect(H.__sbTrustedProxyHeader(r, "x-sb-tls-cipher")).toBeUndefined();
+});

package/src/native-fetch-prelude.js

@@ -1739,6 +1739,17 @@ function __sbClientIp(request) {
   }
   return peer;
 }
+// #128 — httpProtocol/tlsVersion/tlsCipher: only a trusted front proxy can set
+// these (an untrusted direct peer could otherwise fake any value), so this
+// reuses the same SB_TRUSTED_PROXIES chain #163 already resolves clientIp
+// against. Undefined when no trusted proxy is configured or it sent nothing —
+// omitted, not faked, matching how clientIp itself falls back to the raw peer.
+function __sbTrustedProxyHeader(request, name) {
+  const peer = __sbNormalizeIp(request.headers.get("x-sb-remote-addr") || "");
+  const trusted = __sbSplitList(__sbEnv("SB_TRUSTED_PROXIES"));
+  if (!trusted.length || !__sbIpTrusted(peer, trusted)) return undefined;
+  return request.headers.get(name) || undefined;
+}
 
 // #57 — ctx.waitUntil: work that must run before the turn completes but must
 // not block the response the handler already built. `waitUntil(p)` just
@@ -1824,9 +1835,18 @@ async function __sbQueueWithDrain(result, tasks) {
 globalThis.__sbEntry = function (handlers, request) {
   const trigger = request.headers.get("x-sb-trigger");
   if (!trigger) {
-    // #163 — expose the resolved client IP the Workers way, before the handler runs.
+    // #163/#128 — expose the request metadata the edge already has, the
+    // Workers way, before the handler runs. httpProtocol/tlsVersion/tlsCipher
+    // are only set when a trusted front proxy forwarded them; colo, ASN and
+    // geo fields stay absent everywhere (#128 explicitly rejects faking them).
     const __cf = request.cf || {};
     __cf.clientIp = __sbClientIp(request);
+    const __httpProtocol = __sbTrustedProxyHeader(request, "x-sb-http-protocol");
+    if (__httpProtocol) __cf.httpProtocol = __httpProtocol;
+    const __tlsVersion = __sbTrustedProxyHeader(request, "x-sb-tls-version");
+    if (__tlsVersion) __cf.tlsVersion = __tlsVersion;
+    const __tlsCipher = __sbTrustedProxyHeader(request, "x-sb-tls-cipher");
+    if (__tlsCipher) __cf.tlsCipher = __tlsCipher;
     request.cf = __cf;
     // #28 — per-invocation CPU time. One fetch turn per process (serial), so the
     // process CPU delta across the handler is this invocation's CPU.