@squiz/dx-common-lib 1.70.0 → 1.71.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Change Log
 
+## 1.71.1
+
+### Patch Changes
+
+- 6605896: update deprecated packages
+
+## 1.71.0
+
+### Minor Changes
+
+- aa3ade1: Secure component ESI tags generated by Page Render
+
 ## 1.70.0
 
 ### Minor Changes

package/lib/api-key-validation/ApiKeyValidationService.d.ts

@@ -4,4 +4,5 @@ export interface ApiKeyValidationService {
      * @deprecated Suggest moving towards using JWT authentication.
      */
     getInterServiceKeys(): string[];
+    getEsiSecretToken(): string;
 }

package/lib/api-key-validation/CloudflareApiKeyService.d.ts

@@ -3,6 +3,7 @@ import { ApiKeyValidationService } from './ApiKeyValidationService';
 import { Logger } from '@squiz/dx-logger-lib';
 export interface CloudFlareKeys {
     'inter-service-keys': string[];
+    'esi-secret-token': string;
 }
 export declare class CloudflareApiKeyService implements ApiKeyValidationService {
     protected secretName: string;
@@ -13,4 +14,5 @@ export declare class CloudflareApiKeyService implements ApiKeyValidationService
     protected getValidApiKeys(): Promise<CloudFlareKeys>;
     refreshApiKeys(): Promise<void>;
     getInterServiceKeys(): string[];
+    getEsiSecretToken(): string;
 }

package/lib/api-key-validation/CloudflareApiKeyService.js

@@ -6,6 +6,7 @@ const UnAuthenticatedRequestError_1 = require("../error/UnAuthenticatedRequestEr
 const dx_logger_lib_1 = require("@squiz/dx-logger-lib");
 let validKeys = {
     'inter-service-keys': [],
+    'esi-secret-token': '',
 };
 let refreshInterval;
 // number must be smaller than 24 days.
@@ -42,16 +43,21 @@ class CloudflareApiKeyService {
         }
         try {
             if (!secretValue.SecretString) {
-                throw new Error('cloudflare api key SecretString undefined');
+                throw new Error('Cloudflare api key SecretString undefined');
             }
-            const secret = JSON.parse(secretValue.SecretString);
-            if (secret['inter-service-keys']) {
-                return secret;
+            try {
+                const secret = JSON.parse(secretValue.SecretString);
+                if (secret['inter-service-keys'] && secret['esi-secret-token']) {
+                    return secret;
+                }
             }
-            throw new Error('api keys retrieved and decoded successfully but contained no values');
+            catch (e) {
+                throw new Error('Invalid JSON');
+            }
+            throw new Error('Missing all required keys');
         }
         catch (e) {
-            throw new Error('failed to decode cloudflare api key values');
+            throw new Error(`Failed to decode cloudflare api key values: ${e.message}`);
         }
     }
     async refreshApiKeys() {
@@ -68,6 +74,9 @@ class CloudflareApiKeyService {
     getInterServiceKeys() {
         return validKeys['inter-service-keys'];
     }
+    getEsiSecretToken() {
+        return validKeys['esi-secret-token'];
+    }
 }
 exports.CloudflareApiKeyService = CloudflareApiKeyService;
 //# sourceMappingURL=CloudflareApiKeyService.js.map

package/lib/api-key-validation/CloudflareApiKeyService.js.map

@@ -1 +1 @@
-{"version":3,"file":"CloudflareApiKeyService.js","sourceRoot":"","sources":["../../src/api-key-validation/CloudflareApiKeyService.ts"],"names":[],"mappings":";;;AAAA,4EAIyC;AACzC,sFAAmF;AAEnF,wDAAyD;AAMzD,IAAI,SAAS,GAAmB;IAC9B,oBAAoB,EAAE,EAAE;CACzB,CAAC;AAEF,IAAI,eAA+C,CAAC;AACpD,uCAAuC;AACvC,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,qCAAqC;AAEjF,MAAa,uBAAuB;IAIlC,YAAsB,UAAkB,EAAE,MAAe;QAAnC,eAAU,GAAV,UAAU,CAAQ;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,6CAAoB,CAAC;QAC5C,yBAAyB;QACzB,4BAA4B;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAA,yBAAS,EAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEM,sBAAsB,CAAC,GAAW;QACvC,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,yDAA2B,CAAC,4CAA4C,CAAC,CAAC;QACtF,CAAC;QAED,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAES,KAAK,CAAC,eAAe;QAC7B,IAAI,WAAwC,CAAC;QAE7C,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CACzC,IAAI,8CAAqB,CAAC;gBACxB,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YAEpD,IAAI,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,cAAc;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpC,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,oBAAoB,CAAC,CAAC,MAAM,2BAA2B,CAAC,CAAC;QAE7F,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;gBACvC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9B,CAAC,EAAE,aAAa,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,wEAAwE;IACjE,mBAAmB;QACxB,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACzC,CAAC;CACF;AAxED,0DAwEC"}
+{"version":3,"file":"CloudflareApiKeyService.js","sourceRoot":"","sources":["../../src/api-key-validation/CloudflareApiKeyService.ts"],"names":[],"mappings":";;;AAAA,4EAIyC;AACzC,sFAAmF;AAEnF,wDAAyD;AAOzD,IAAI,SAAS,GAAmB;IAC9B,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,IAAI,eAA+C,CAAC;AACpD,uCAAuC;AACvC,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,qCAAqC;AAEjF,MAAa,uBAAuB;IAIlC,YAAsB,UAAkB,EAAE,MAAe;QAAnC,eAAU,GAAV,UAAU,CAAQ;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,6CAAoB,CAAC;QAC5C,yBAAyB;QACzB,4BAA4B;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAA,yBAAS,EAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEM,sBAAsB,CAAC,GAAW;QACvC,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,yDAA2B,CAAC,4CAA4C,CAAC,CAAC;QACtF,CAAC;QAED,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAES,KAAK,CAAC,eAAe;QAC7B,IAAI,WAAwC,CAAC;QAE7C,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CACzC,IAAI,8CAAqB,CAAC;gBACxB,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC1B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAmB,CAAC;gBACtE,IAAI,MAAM,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBAC/D,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,+CAAgD,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,cAAc;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpC,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,oBAAoB,CAAC,CAAC,MAAM,2BAA2B,CAAC,CAAC;QAE7F,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;gBACvC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9B,CAAC,EAAE,aAAa,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,wEAAwE;IACjE,mBAAmB;QACxB,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACzC,CAAC;IAEM,iBAAiB;QACtB,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;CACF;AA9ED,0DA8EC"}

package/lib/api-key-validation/CloudflareApiKeyService.spec.js

@@ -11,18 +11,26 @@ describe('CloudflareApiKeyService', () => {
     describe('refreshApiKeys', () => {
         it('should throw an error if the secret value is not in the expected format', async () => {
             sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: 'bad json' }));
-            await expect(service.refreshApiKeys()).rejects.toThrowError(new Error('failed to decode cloudflare api key values'));
+            await expect(service.refreshApiKeys()).rejects.toThrowError(new Error('Failed to decode cloudflare api key values: Invalid JSON'));
+        });
+        it('should throw an error if the secret value missing "inter-service-keys" value', async () => {
+            sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"esi-secret-token": "foo"}' }));
+            await expect(service.refreshApiKeys()).rejects.toThrowError(new Error('Failed to decode cloudflare api key values: Missing all required keys'));
+        });
+        it('should throw an error if the secret value missing "esi-secret-token" value', async () => {
+            sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys": []}' }));
+            await expect(service.refreshApiKeys()).rejects.toThrowError(new Error('Failed to decode cloudflare api key values: Missing all required keys'));
         });
         it('should make a request to the aws secrets manager when refreshing the keys', async () => {
             sendSpy.mockClear();
-            sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":[]}' }));
+            sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }));
             await service.refreshApiKeys();
             expect(sendSpy.mock.lastCall[0].input).toEqual({ SecretId: 'my-secret-name' });
             expect(sendSpy.mock.lastCall[0]).toBeInstanceOf(client_secrets_manager_1.GetSecretValueCommand);
         });
         it('should start a refresh timer once called, but only once', (done) => {
             sendSpy.mockClear();
-            sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":["my-new-key"]}' }));
+            sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":["my-new-key"], "esi-secret-token": "foo"}' }));
             const spy = jest.spyOn(service, 'refreshApiKeys');
             expect(spy).not.toBeCalled();
             expect(setInterval).toHaveBeenCalledTimes(1); // for the above 2 tests
@@ -38,7 +46,7 @@ describe('CloudflareApiKeyService', () => {
     describe('interServiceKeyIsValid', () => {
         describe('when there are no api keys', () => {
             beforeAll(async () => {
-                sendSpy.mockImplementation(() => Promise.resolve({ SecretString: '{"inter-service-keys":[]}' }));
+                sendSpy.mockImplementation(() => Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }));
                 await service.refreshApiKeys();
             });
             it('should throw an unauthenticated request error when validating a key if there are no keys to validate against', () => {
@@ -48,7 +56,7 @@ describe('CloudflareApiKeyService', () => {
         describe('when there are api keys', () => {
             beforeAll(async () => {
                 sendSpy.mockImplementation(() => Promise.resolve({
-                    SecretString: '{"keys":["my-key", "my-other-key"], "inter-service-keys":["my-inter-service-key"]}',
+                    SecretString: '{"keys":["my-key", "my-other-key"], "inter-service-keys":["my-inter-service-key"], "esi-secret-token": "foo"}',
                 }));
                 await service.refreshApiKeys();
             });
@@ -57,5 +65,21 @@ describe('CloudflareApiKeyService', () => {
             });
         });
     });
+    describe('getInterServiceKeys', () => {
+        it('should return "esi-secret-token" from the secret manager', async () => {
+            sendSpy.mockClear();
+            sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":["some-key"], "esi-secret-token": "foo"}' }));
+            await service.refreshApiKeys();
+            expect(service.getInterServiceKeys()).toEqual(['some-key']);
+        });
+    });
+    describe('getEsiSecretToken', () => {
+        it('should return "esi-secret-token" from the secret manager', async () => {
+            sendSpy.mockClear();
+            sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }));
+            await service.refreshApiKeys();
+            expect(service.getEsiSecretToken()).toEqual('foo');
+        });
+    });
 });
 //# sourceMappingURL=CloudflareApiKeyService.spec.js.map

package/lib/api-key-validation/CloudflareApiKeyService.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"CloudflareApiKeyService.spec.js","sourceRoot":"","sources":["../../src/api-key-validation/CloudflareApiKeyService.spec.ts"],"names":[],"mappings":";;AAAA,4EAA8F;AAC9F,sFAAmF;AACnF,uEAAoE;AAEpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,6CAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAEnE,IAAI,CAAC,aAAa,EAAE,CAAC;AACrB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAElC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,OAAO,GAAG,IAAI,iDAAuB,CAAC,gBAAgB,CAAC,CAAC;IAE9D,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;YACvF,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAEpF,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CACzD,IAAI,KAAK,CAAC,4CAA4C,CAAC,CACxD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;YACzF,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;YACrG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YAE/B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC/E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,8CAAqB,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,CAAC,IAAI,EAAE,EAAE;YACrE,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YACjH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAElD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;YACtE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAE5B,MAAM,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAE/B,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACnE,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,CAAC,CAAC,CAAC;QACR,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;YAC1C,SAAS,CAAC,KAAK,IAAI,EAAE;gBACnB,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;gBACjG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8GAA8G,EAAE,GAAG,EAAE;gBACtH,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CACnE,IAAI,yDAA2B,CAAC,4CAA4C,CAAC,CAC9E,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACvC,SAAS,CAAC,KAAK,IAAI,EAAE;gBACnB,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAC9B,OAAO,CAAC,OAAO,CAAC;oBACd,YAAY,EAAE,oFAAoF;iBACnG,CAAC,CACH,CAAC;gBACF,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;gBACrE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"CloudflareApiKeyService.spec.js","sourceRoot":"","sources":["../../src/api-key-validation/CloudflareApiKeyService.spec.ts"],"names":[],"mappings":";;AAAA,4EAA8F;AAC9F,sFAAmF;AACnF,uEAAoE;AAEpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,6CAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAEnE,IAAI,CAAC,aAAa,EAAE,CAAC;AACrB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAElC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,OAAO,GAAG,IAAI,iDAAuB,CAAC,gBAAgB,CAAC,CAAC;IAE9D,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;YACvF,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAEpF,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CACzD,IAAI,KAAK,CAAC,0DAA0D,CAAC,CACtE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;YAC5F,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YAEvG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CACzD,IAAI,KAAK,CAAC,uEAAuE,CAAC,CACnF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;YAC1F,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;YAEtG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CACzD,IAAI,KAAK,CAAC,uEAAuE,CAAC,CACnF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;YACzF,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAClC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,sDAAsD,EAAE,CAAC,CAC1F,CAAC;YACF,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YAE/B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC/E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,8CAAqB,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,CAAC,IAAI,EAAE,EAAE;YACrE,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAClC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,kEAAkE,EAAE,CAAC,CACtG,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAElD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;YACtE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAE5B,MAAM,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAE/B,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACnE,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,CAAC,CAAC,CAAC;QACR,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;YAC1C,SAAS,CAAC,KAAK,IAAI,EAAE;gBACnB,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAC9B,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,sDAAsD,EAAE,CAAC,CAC1F,CAAC;gBACF,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8GAA8G,EAAE,GAAG,EAAE;gBACtH,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CACnE,IAAI,yDAA2B,CAAC,4CAA4C,CAAC,CAC9E,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACvC,SAAS,CAAC,KAAK,IAAI,EAAE;gBACnB,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAC9B,OAAO,CAAC,OAAO,CAAC;oBACd,YAAY,EACV,+GAA+G;iBAClH,CAAC,CACH,CAAC;gBACF,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;gBACrE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAClC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,gEAAgE,EAAE,CAAC,CACpG,CAAC;YACF,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YAE/B,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAClC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,sDAAsD,EAAE,CAAC,CAC1F,CAAC;YACF,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;YAE/B,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/lib/api-key-validation/DevelopmentApiKeyService.d.ts

@@ -1,10 +1,12 @@
 import { Logger } from '@squiz/dx-logger-lib';
 import { ApiKeyValidationService } from './ApiKeyValidationService';
 import { IncomingMessage } from 'http';
+export declare const DEVELOPMENT_ESI_SECRET = "cf-secret-token";
 export declare class DevelopmentApiKeyService implements ApiKeyValidationService {
     private logger;
     constructor(logger?: Logger);
     matrixKeyIsValid(key: string | undefined, request: IncomingMessage): boolean;
     interServiceKeyIsValid(key: string | undefined): boolean;
     getInterServiceKeys(): string[];
+    getEsiSecretToken(): string;
 }

package/lib/api-key-validation/DevelopmentApiKeyService.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DevelopmentApiKeyService = void 0;
+exports.DevelopmentApiKeyService = exports.DEVELOPMENT_ESI_SECRET = void 0;
 const dx_logger_lib_1 = require("@squiz/dx-logger-lib");
+exports.DEVELOPMENT_ESI_SECRET = `cf-secret-token`;
 class DevelopmentApiKeyService {
     constructor(logger) {
         this.logger = logger || (0, dx_logger_lib_1.getLogger)({ name: 'DevelopmentApiKeyService' });
@@ -21,6 +22,9 @@ class DevelopmentApiKeyService {
     getInterServiceKeys() {
         return ['inter-service-api-key'];
     }
+    getEsiSecretToken() {
+        return exports.DEVELOPMENT_ESI_SECRET;
+    }
 }
 exports.DevelopmentApiKeyService = DevelopmentApiKeyService;
 //# sourceMappingURL=DevelopmentApiKeyService.js.map

package/lib/api-key-validation/DevelopmentApiKeyService.js.map

@@ -1 +1 @@
-{"version":3,"file":"DevelopmentApiKeyService.js","sourceRoot":"","sources":["../../src/api-key-validation/DevelopmentApiKeyService.ts"],"names":[],"mappings":";;;AAAA,wDAAyD;AAIzD,MAAa,wBAAwB;IAGnC,YAAmB,MAAe;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAA,yBAAS,EAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC1E,CAAC;IACM,gBAAgB,CAAC,GAAuB,EAAE,OAAwB;;QACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;YACpE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,MAAA,OAAO,CAAC,OAAO,0CAAG,YAAY,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACM,sBAAsB,CAAC,GAAuB;QACnD,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,wEAAwE;IACjE,mBAAmB;QACxB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACnC,CAAC;CACF;AApBD,4DAoBC"}
+{"version":3,"file":"DevelopmentApiKeyService.js","sourceRoot":"","sources":["../../src/api-key-validation/DevelopmentApiKeyService.ts"],"names":[],"mappings":";;;AAAA,wDAAyD;AAI5C,QAAA,sBAAsB,GAAG,iBAAiB,CAAC;AAExD,MAAa,wBAAwB;IAGnC,YAAmB,MAAe;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAA,yBAAS,EAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC1E,CAAC;IACM,gBAAgB,CAAC,GAAuB,EAAE,OAAwB;;QACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;YACpE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,MAAA,OAAO,CAAC,OAAO,0CAAG,YAAY,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACM,sBAAsB,CAAC,GAAuB;QACnD,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,wEAAwE;IACjE,mBAAmB;QACxB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACnC,CAAC;IAEM,iBAAiB;QACtB,OAAO,8BAAsB,CAAC;IAChC,CAAC;CACF;AAxBD,4DAwBC"}

package/lib/api-key-validation/DevelopmentApiKeyService.spec.js

@@ -17,5 +17,16 @@ describe('DevelopmentApiKeyService', () => {
             expect(service.interServiceKeyIsValid('invalid-api-key')).toEqual(false);
         });
     });
+    describe('getInterServiceKeys', () => {
+        it('should return a fixed value', async () => {
+            console.log(service.getInterServiceKeys());
+            expect(service.getInterServiceKeys()).toEqual(['inter-service-api-key']);
+        });
+    });
+    describe('getEsiSecretToken', () => {
+        it('should return a fixed value', async () => {
+            expect(service.getEsiSecretToken()).toEqual('cf-secret-token');
+        });
+    });
 });
 //# sourceMappingURL=DevelopmentApiKeyService.spec.js.map

package/lib/api-key-validation/DevelopmentApiKeyService.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"DevelopmentApiKeyService.spec.js","sourceRoot":"","sources":["../../src/api-key-validation/DevelopmentApiKeyService.spec.ts"],"names":[],"mappings":";;AAAA,yEAAsE;AAEtE,wDAAiD;AAEjD,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,MAAM,OAAO,GAAG,IAAI,mDAAwB,CAAC,IAAA,yBAAS,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAExF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC9D,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"DevelopmentApiKeyService.spec.js","sourceRoot":"","sources":["../../src/api-key-validation/DevelopmentApiKeyService.spec.ts"],"names":[],"mappings":";;AAAA,yEAAsE;AAEtE,wDAAiD;AAEjD,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,MAAM,OAAO,GAAG,IAAI,mDAAwB,CAAC,IAAA,yBAAS,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAExF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC9D,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/lib/esi-mac-token-generator/EsiMacTokenGenerator.d.ts

@@ -0,0 +1,8 @@
+export declare class EsiMacTokenGenerator {
+    private secret;
+    private key;
+    private encoder;
+    constructor(secret: string);
+    generateMac(requestUrl: string, esiUrl: string): Promise<string>;
+    private getKey;
+}

package/lib/esi-mac-token-generator/EsiMacTokenGenerator.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EsiMacTokenGenerator = void 0;
+class EsiMacTokenGenerator {
+    constructor(secret) {
+        this.secret = secret;
+        this.key = undefined;
+        this.encoder = new TextEncoder();
+    }
+    async generateMac(requestUrl, esiUrl) {
+        const signatureString = `${requestUrl}|${esiUrl}`;
+        const key = await this.getKey();
+        const mac = await crypto.subtle.sign('HMAC', key, this.encoder.encode(signatureString));
+        return Buffer.from(mac).toString('base64');
+    }
+    async getKey() {
+        if (this.key === undefined) {
+            this.key = await crypto.subtle.importKey('raw', this.encoder.encode(this.secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
+        }
+        return this.key;
+    }
+}
+exports.EsiMacTokenGenerator = EsiMacTokenGenerator;
+//# sourceMappingURL=EsiMacTokenGenerator.js.map

package/lib/esi-mac-token-generator/EsiMacTokenGenerator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EsiMacTokenGenerator.js","sourceRoot":"","sources":["../../src/esi-mac-token-generator/EsiMacTokenGenerator.ts"],"names":[],"mappings":";;;AAAA,MAAa,oBAAoB;IAI/B,YAAoB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAH1B,QAAG,GAA0B,SAAS,CAAC;QAI7C,IAAI,CAAC,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IACnC,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,UAAkB,EAAE,MAAc;QACzD,MAAM,eAAe,GAAG,GAAG,UAAU,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;CACF;AA3BD,oDA2BC"}

package/lib/esi-mac-token-generator/EsiMacTokenGenerator.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/esi-mac-token-generator/EsiMacTokenGenerator.spec.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const EsiMacTokenGenerator_1 = require("./EsiMacTokenGenerator");
+describe('EsiMacTokenGenerator', () => {
+    it('should return an valid MAC', async () => {
+        const secret = 'some-secret';
+        const service = new EsiMacTokenGenerator_1.EsiMacTokenGenerator(secret);
+        const requestUrl = 'http://some.url';
+        const esiUrl = 'http://some.esi.url';
+        const mac = await service.generateMac(requestUrl, esiUrl);
+        expect(mac).toEqual('NvARK6dlXV0dnVlnTSxTbGaT+VuDDIVY8FFdzBsf2c4=');
+        // verify the code
+        const encoder = new TextEncoder();
+        const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, [
+            'sign',
+            'verify',
+        ]);
+        const signature = `${requestUrl}|${esiUrl}`;
+        const verify = await crypto.subtle.verify('HMAC', key, Buffer.from(mac, 'base64'), encoder.encode(signature));
+        expect(verify).toEqual(true);
+    });
+});
+//# sourceMappingURL=EsiMacTokenGenerator.spec.js.map

package/lib/esi-mac-token-generator/EsiMacTokenGenerator.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EsiMacTokenGenerator.spec.js","sourceRoot":"","sources":["../../src/esi-mac-token-generator/EsiMacTokenGenerator.spec.ts"],"names":[],"mappings":";;AAAA,iEAA8D;AAE9D,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,GAAG,aAAa,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,2CAAoB,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,iBAAiB,CAAC;QACrC,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;QAEpE,kBAAkB;QAClB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;YACjH,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,GAAG,UAAU,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9G,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/lib/index.d.ts

@@ -14,3 +14,4 @@ export * from './edge-components-secret-key-service/DevelopmentEdgeComponentsSec
 export * from './edge-components-secret-key-service/ProductionEdgeComponentsSecretKeyService';
 export * from './edge-components-secret-key-service/EdgeComponentsSecretKeyService';
 export * from './edge-components-secret-key-service/getEdgeComponentsSecretService';
+export * from './esi-mac-token-generator/EsiMacTokenGenerator';

package/lib/index.js

@@ -30,4 +30,5 @@ __exportStar(require("./edge-components-secret-key-service/DevelopmentEdgeCompon
 __exportStar(require("./edge-components-secret-key-service/ProductionEdgeComponentsSecretKeyService"), exports);
 __exportStar(require("./edge-components-secret-key-service/EdgeComponentsSecretKeyService"), exports);
 __exportStar(require("./edge-components-secret-key-service/getEdgeComponentsSecretService"), exports);
+__exportStar(require("./esi-mac-token-generator/EsiMacTokenGenerator"), exports);
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,0CAAwB;AACxB,yCAAuB;AACvB,qDAAmC;AACnC,iEAA+C;AAC/C,+DAA6C;AAC7C,+EAA6D;AAC7D,+EAA6D;AAC7D,gFAA8D;AAC9D,wEAAsD;AACtD,0CAAwB;AACxB,+CAA6B;AAC7B,iHAA+F;AAC/F,gHAA8F;AAC9F,sGAAoF;AACpF,sGAAoF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,0CAAwB;AACxB,yCAAuB;AACvB,qDAAmC;AACnC,iEAA+C;AAC/C,+DAA6C;AAC7C,+EAA6D;AAC7D,+EAA6D;AAC7D,gFAA8D;AAC9D,wEAAsD;AACtD,0CAAwB;AACxB,+CAA6B;AAC7B,iHAA+F;AAC/F,gHAA8F;AAC9F,sGAAoF;AACpF,sGAAoF;AACpF,iFAA+D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@squiz/dx-common-lib",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "description": "",
   "main": "lib/index.js",
   "private": false,
@@ -18,14 +18,14 @@
   "dependencies": {
     "@aws-sdk/client-secrets-manager": "3.651.1",
     "@squiz/dx-logger-lib": "^1.65.1",
-    "archiver": "5.3.1",
+    "archiver": "7.0.1",
     "escape-string-regexp": "4.0.0",
     "fs-extra": "11.1.0",
     "html-entities": "^2.4.0",
     "lodash.clonedeep": "4.5.0"
   },
   "devDependencies": {
-    "@types/archiver": "5.3.1",
+    "@types/archiver": "6.0.3",
     "@types/express": "4.17.17",
     "@types/fs-extra": "11.0.1",
     "@types/jest": "28.1.8",

package/src/api-key-validation/ApiKeyValidationService.ts

@@ -5,4 +5,6 @@ export interface ApiKeyValidationService {
    * @deprecated Suggest moving towards using JWT authentication.
    */
   getInterServiceKeys(): string[];
+
+  getEsiSecretToken(): string;
 }

package/src/api-key-validation/CloudflareApiKeyService.spec.ts

@@ -15,13 +15,31 @@ describe('CloudflareApiKeyService', () => {
       sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: 'bad json' }));
 
       await expect(service.refreshApiKeys()).rejects.toThrowError(
-        new Error('failed to decode cloudflare api key values'),
+        new Error('Failed to decode cloudflare api key values: Invalid JSON'),
+      );
+    });
+
+    it('should throw an error if the secret value missing "inter-service-keys" value', async () => {
+      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"esi-secret-token": "foo"}' }));
+
+      await expect(service.refreshApiKeys()).rejects.toThrowError(
+        new Error('Failed to decode cloudflare api key values: Missing all required keys'),
+      );
+    });
+
+    it('should throw an error if the secret value missing "esi-secret-token" value', async () => {
+      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys": []}' }));
+
+      await expect(service.refreshApiKeys()).rejects.toThrowError(
+        new Error('Failed to decode cloudflare api key values: Missing all required keys'),
       );
     });
 
     it('should make a request to the aws secrets manager when refreshing the keys', async () => {
       sendSpy.mockClear();
-      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":[]}' }));
+      sendSpy.mockImplementationOnce(() =>
+        Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }),
+      );
       await service.refreshApiKeys();
 
       expect(sendSpy.mock.lastCall[0].input).toEqual({ SecretId: 'my-secret-name' });
@@ -30,7 +48,9 @@ describe('CloudflareApiKeyService', () => {
 
     it('should start a refresh timer once called, but only once', (done) => {
       sendSpy.mockClear();
-      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":["my-new-key"]}' }));
+      sendSpy.mockImplementationOnce(() =>
+        Promise.resolve({ SecretString: '{"inter-service-keys":["my-new-key"], "esi-secret-token": "foo"}' }),
+      );
       const spy = jest.spyOn(service, 'refreshApiKeys');
 
       expect(spy).not.toBeCalled();
@@ -50,7 +70,9 @@ describe('CloudflareApiKeyService', () => {
   describe('interServiceKeyIsValid', () => {
     describe('when there are no api keys', () => {
       beforeAll(async () => {
-        sendSpy.mockImplementation(() => Promise.resolve({ SecretString: '{"inter-service-keys":[]}' }));
+        sendSpy.mockImplementation(() =>
+          Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }),
+        );
         await service.refreshApiKeys();
       });
 
@@ -65,7 +87,8 @@ describe('CloudflareApiKeyService', () => {
       beforeAll(async () => {
         sendSpy.mockImplementation(() =>
           Promise.resolve({
-            SecretString: '{"keys":["my-key", "my-other-key"], "inter-service-keys":["my-inter-service-key"]}',
+            SecretString:
+              '{"keys":["my-key", "my-other-key"], "inter-service-keys":["my-inter-service-key"], "esi-secret-token": "foo"}',
           }),
         );
         await service.refreshApiKeys();
@@ -76,4 +99,28 @@ describe('CloudflareApiKeyService', () => {
       });
     });
   });
+
+  describe('getInterServiceKeys', () => {
+    it('should return "esi-secret-token" from the secret manager', async () => {
+      sendSpy.mockClear();
+      sendSpy.mockImplementationOnce(() =>
+        Promise.resolve({ SecretString: '{"inter-service-keys":["some-key"], "esi-secret-token": "foo"}' }),
+      );
+      await service.refreshApiKeys();
+
+      expect(service.getInterServiceKeys()).toEqual(['some-key']);
+    });
+  });
+
+  describe('getEsiSecretToken', () => {
+    it('should return "esi-secret-token" from the secret manager', async () => {
+      sendSpy.mockClear();
+      sendSpy.mockImplementationOnce(() =>
+        Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }),
+      );
+      await service.refreshApiKeys();
+
+      expect(service.getEsiSecretToken()).toEqual('foo');
+    });
+  });
 });

package/src/api-key-validation/CloudflareApiKeyService.ts

@@ -9,10 +9,12 @@ import { getLogger, Logger } from '@squiz/dx-logger-lib';
 
 export interface CloudFlareKeys {
   'inter-service-keys': string[];
+  'esi-secret-token': string;
 }
 
 let validKeys: CloudFlareKeys = {
   'inter-service-keys': [],
+  'esi-secret-token': '',
 };
 
 let refreshInterval: ReturnType<typeof setInterval>;
@@ -61,17 +63,19 @@ export class CloudflareApiKeyService implements ApiKeyValidationService {
 
     try {
       if (!secretValue.SecretString) {
-        throw new Error('cloudflare api key SecretString undefined');
+        throw new Error('Cloudflare api key SecretString undefined');
       }
-      const secret = JSON.parse(secretValue.SecretString);
-
-      if (secret['inter-service-keys']) {
-        return secret;
+      try {
+        const secret = JSON.parse(secretValue.SecretString) as CloudFlareKeys;
+        if (secret['inter-service-keys'] && secret['esi-secret-token']) {
+          return secret;
+        }
+      } catch (e) {
+        throw new Error('Invalid JSON');
       }
-
-      throw new Error('api keys retrieved and decoded successfully but contained no values');
+      throw new Error('Missing all required keys');
     } catch (e) {
-      throw new Error('failed to decode cloudflare api key values');
+      throw new Error(`Failed to decode cloudflare api key values: ${(e as Error).message}`);
     }
   }
 
@@ -92,4 +96,8 @@ export class CloudflareApiKeyService implements ApiKeyValidationService {
   public getInterServiceKeys(): string[] {
     return validKeys['inter-service-keys'];
   }
+
+  public getEsiSecretToken(): string {
+    return validKeys['esi-secret-token'];
+  }
 }

package/src/api-key-validation/DevelopmentApiKeyService.spec.ts

@@ -20,4 +20,17 @@ describe('DevelopmentApiKeyService', () => {
       expect(service.interServiceKeyIsValid('invalid-api-key')).toEqual(false);
     });
   });
+
+  describe('getInterServiceKeys', () => {
+    it('should return a fixed value', async () => {
+      console.log(service.getInterServiceKeys());
+      expect(service.getInterServiceKeys()).toEqual(['inter-service-api-key']);
+    });
+  });
+
+  describe('getEsiSecretToken', () => {
+    it('should return a fixed value', async () => {
+      expect(service.getEsiSecretToken()).toEqual('cf-secret-token');
+    });
+  });
 });

package/src/api-key-validation/DevelopmentApiKeyService.ts

@@ -2,6 +2,8 @@ import { getLogger, Logger } from '@squiz/dx-logger-lib';
 import { ApiKeyValidationService } from './ApiKeyValidationService';
 import { IncomingMessage } from 'http';
 
+export const DEVELOPMENT_ESI_SECRET = `cf-secret-token`;
+
 export class DevelopmentApiKeyService implements ApiKeyValidationService {
   private logger: Logger;
 
@@ -22,4 +24,8 @@ export class DevelopmentApiKeyService implements ApiKeyValidationService {
   public getInterServiceKeys(): string[] {
     return ['inter-service-api-key'];
   }
+
+  public getEsiSecretToken(): string {
+    return DEVELOPMENT_ESI_SECRET;
+  }
 }

package/src/esi-mac-token-generator/EsiMacTokenGenerator.spec.ts

@@ -0,0 +1,25 @@
+import { EsiMacTokenGenerator } from './EsiMacTokenGenerator';
+
+describe('EsiMacTokenGenerator', () => {
+  it('should return an valid MAC', async () => {
+    const secret = 'some-secret';
+    const service = new EsiMacTokenGenerator(secret);
+
+    const requestUrl = 'http://some.url';
+    const esiUrl = 'http://some.esi.url';
+    const mac = await service.generateMac(requestUrl, esiUrl);
+
+    expect(mac).toEqual('NvARK6dlXV0dnVlnTSxTbGaT+VuDDIVY8FFdzBsf2c4=');
+
+    // verify the code
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, [
+      'sign',
+      'verify',
+    ]);
+
+    const signature = `${requestUrl}|${esiUrl}`;
+    const verify = await crypto.subtle.verify('HMAC', key, Buffer.from(mac, 'base64'), encoder.encode(signature));
+    expect(verify).toEqual(true);
+  });
+});

package/src/esi-mac-token-generator/EsiMacTokenGenerator.ts

@@ -0,0 +1,28 @@
+export class EsiMacTokenGenerator {
+  private key: CryptoKey | undefined = undefined;
+  private encoder: TextEncoder;
+
+  constructor(private secret: string) {
+    this.encoder = new TextEncoder();
+  }
+
+  public async generateMac(requestUrl: string, esiUrl: string): Promise<string> {
+    const signatureString = `${requestUrl}|${esiUrl}`;
+    const key = await this.getKey();
+    const mac = await crypto.subtle.sign('HMAC', key, this.encoder.encode(signatureString));
+    return Buffer.from(mac).toString('base64');
+  }
+
+  private async getKey() {
+    if (this.key === undefined) {
+      this.key = await crypto.subtle.importKey(
+        'raw',
+        this.encoder.encode(this.secret),
+        { name: 'HMAC', hash: 'SHA-256' },
+        false,
+        ['sign', 'verify'],
+      );
+    }
+    return this.key;
+  }
+}

package/src/index.ts

@@ -14,3 +14,4 @@ export * from './edge-components-secret-key-service/DevelopmentEdgeComponentsSec
 export * from './edge-components-secret-key-service/ProductionEdgeComponentsSecretKeyService';
 export * from './edge-components-secret-key-service/EdgeComponentsSecretKeyService';
 export * from './edge-components-secret-key-service/getEdgeComponentsSecretService';
+export * from './esi-mac-token-generator/EsiMacTokenGenerator';