@suveren/gateway 0.8.7 → 0.10.0

package/node_modules/hono/dist/middleware/etag/digest.js

@@ -1,79 +1,61 @@
-// src/middleware/etag/digest.ts
-var mergeBuffers = (buffer1, buffer2) => {
-  if (!buffer1) {
-    return buffer2;
-  }
-  const merged = new Uint8Array(
-    new ArrayBuffer(buffer1.byteLength + buffer2.byteLength)
-  );
-  merged.set(new Uint8Array(buffer1), 0);
-  merged.set(buffer2, buffer1.byteLength);
-  return merged;
+//#region src/middleware/etag/digest.ts
+const mergeBuffers = (buffer1, buffer2) => {
+	if (!buffer1) return buffer2;
+	const merged = new Uint8Array(new ArrayBuffer(buffer1.byteLength + buffer2.byteLength));
+	merged.set(new Uint8Array(buffer1), 0);
+	merged.set(buffer2, buffer1.byteLength);
+	return merged;
 };
-var CHUNK_SIZE = 256 * 1024;
-var generateDigest = async (stream, generator) => {
-  if (!stream) {
-    return null;
-  }
-  let result = void 0;
-  let chunk;
-  let chunkLength = 0;
-  const digest = async (body) => {
-    result = await generator(mergeBuffers(result, body));
-  };
-  const reader = stream.getReader();
-  for (; ; ) {
-    const { value, done } = await reader.read();
-    if (done) {
-      break;
-    }
-    let offset = 0;
-    while (offset < value.byteLength) {
-      const remaining = value.byteLength - offset;
-      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
-        await digest(value.subarray(offset, offset + CHUNK_SIZE));
-        offset += CHUNK_SIZE;
-        continue;
-      }
-      const requiredLength = chunkLength + remaining;
-      if (requiredLength < CHUNK_SIZE) {
-        if (!chunk) {
-          chunk = value.slice(offset);
-        } else {
-          if (chunk.byteLength < requiredLength) {
-            const nextChunk = new Uint8Array(
-              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
-            );
-            nextChunk.set(chunk.subarray(0, chunkLength));
-            chunk = nextChunk;
-          }
-          chunk.set(value.subarray(offset), chunkLength);
-        }
-        chunkLength = requiredLength;
-        break;
-      }
-      const length = CHUNK_SIZE - chunkLength;
-      if (chunk?.byteLength !== CHUNK_SIZE) {
-        const nextChunk = new Uint8Array(new ArrayBuffer(CHUNK_SIZE));
-        if (chunk) {
-          nextChunk.set(chunk.subarray(0, chunkLength));
-        }
-        chunk = nextChunk;
-      }
-      chunk.set(value.subarray(offset, offset + length), chunkLength);
-      await digest(chunk);
-      chunkLength = 0;
-      offset += length;
-    }
-  }
-  if (chunk && chunkLength > 0) {
-    await digest(chunk.subarray(0, chunkLength));
-  }
-  if (!result) {
-    return null;
-  }
-  return Array.prototype.map.call(new Uint8Array(result), (x) => x.toString(16).padStart(2, "0")).join("");
-};
-export {
-  generateDigest
+const CHUNK_SIZE = 262144;
+const generateDigest = async (stream, generator) => {
+	if (!stream) return null;
+	let result = void 0;
+	let chunk;
+	let chunkLength = 0;
+	const digest = async (body) => {
+		result = await generator(mergeBuffers(result, body));
+	};
+	const reader = stream.getReader();
+	for (;;) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		let offset = 0;
+		while (offset < value.byteLength) {
+			const remaining = value.byteLength - offset;
+			if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+				await digest(value.subarray(offset, offset + CHUNK_SIZE));
+				offset += CHUNK_SIZE;
+				continue;
+			}
+			const requiredLength = chunkLength + remaining;
+			if (requiredLength < CHUNK_SIZE) {
+				if (!chunk) chunk = value.slice(offset);
+				else {
+					if (chunk.byteLength < requiredLength) {
+						const nextChunk = new Uint8Array(new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2))));
+						nextChunk.set(chunk.subarray(0, chunkLength));
+						chunk = nextChunk;
+					}
+					chunk.set(value.subarray(offset), chunkLength);
+				}
+				chunkLength = requiredLength;
+				break;
+			}
+			const length = CHUNK_SIZE - chunkLength;
+			if (chunk?.byteLength !== CHUNK_SIZE) {
+				const nextChunk = new Uint8Array(/* @__PURE__ */ new ArrayBuffer(CHUNK_SIZE));
+				if (chunk) nextChunk.set(chunk.subarray(0, chunkLength));
+				chunk = nextChunk;
+			}
+			chunk.set(value.subarray(offset, offset + length), chunkLength);
+			await digest(chunk);
+			chunkLength = 0;
+			offset += length;
+		}
+	}
+	if (chunk && chunkLength > 0) await digest(chunk.subarray(0, chunkLength));
+	if (!result) return null;
+	return Array.prototype.map.call(new Uint8Array(result), (x) => x.toString(16).padStart(2, "0")).join("");
 };
+//#endregion
+export { generateDigest };

package/node_modules/hono/dist/middleware/etag/index.js

@@ -1,76 +1,77 @@
-// src/middleware/etag/index.ts
 import { generateDigest } from "./digest.js";
-var RETAINED_304_HEADERS = [
-  "cache-control",
-  "content-location",
-  "date",
-  "etag",
-  "expires",
-  "vary"
+//#region src/middleware/etag/index.ts
+/**
+* Default headers to pass through on 304 responses. From the spec:
+* > The response must not contain a body and must include the headers that
+* > would have been sent in an equivalent 200 OK response: Cache-Control,
+* > Content-Location, Date, ETag, Expires, and Vary.
+*/
+const RETAINED_304_HEADERS = [
+	"cache-control",
+	"content-location",
+	"date",
+	"etag",
+	"expires",
+	"vary"
 ];
-var stripWeak = (tag) => tag.replace(/^W\//, "");
-function etagMatches(etag2, ifNoneMatch) {
-  return ifNoneMatch != null && ifNoneMatch.split(",").some((t) => stripWeak(t.trim()) === stripWeak(etag2));
+const stripWeak = (tag) => tag.replace(/^W\//, "");
+function etagMatches(etag, ifNoneMatch) {
+	return ifNoneMatch != null && ifNoneMatch.split(",").some((t) => stripWeak(t.trim()) === stripWeak(etag));
 }
 function initializeGenerator(generator) {
-  if (!generator) {
-    if (crypto && crypto.subtle) {
-      generator = (body) => crypto.subtle.digest(
-        {
-          name: "SHA-1"
-        },
-        body
-      );
-    }
-  }
-  return generator;
+	if (!generator) {
+		if (crypto && crypto.subtle) generator = (body) => crypto.subtle.digest({ name: "SHA-1" }, body);
+	}
+	return generator;
 }
-var etag = (options) => {
-  const retainedHeaders = options?.retainedHeaders ?? RETAINED_304_HEADERS;
-  const weak = options?.weak ?? false;
-  const generator = initializeGenerator(options?.generateDigest);
-  return async function etag2(c, next) {
-    const ifNoneMatch = c.req.header("If-None-Match") ?? null;
-    await next();
-    if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) {
-      return;
-    }
-    const res = c.res;
-    let etag3 = res.headers.get("ETag");
-    if (!etag3) {
-      if (!generator) {
-        return;
-      }
-      const hash = await generateDigest(
-        // This type casing avoids the type error for `deno publish`
-        res.clone().body,
-        generator
-      );
-      if (hash === null) {
-        return;
-      }
-      etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
-    }
-    const matched = ifNoneMatch === "*" || etagMatches(etag3, ifNoneMatch);
-    if (matched) {
-      c.res = new Response(null, {
-        status: 304,
-        statusText: "Not Modified",
-        headers: {
-          ETag: etag3
-        }
-      });
-      for (const key of Array.from(c.res.headers.keys())) {
-        if (retainedHeaders.indexOf(key.toLowerCase()) === -1) {
-          c.res.headers.delete(key);
-        }
-      }
-    } else {
-      c.res.headers.set("ETag", etag3);
-    }
-  };
-};
-export {
-  RETAINED_304_HEADERS,
-  etag
+/**
+* ETag Middleware for Hono.
+*
+* @see {@link https://hono.dev/docs/middleware/builtin/etag}
+*
+* @param {ETagOptions} [options] - The options for the ETag middleware.
+* @param {boolean} [options.weak=false] - Define using or not using a weak validation. If true is set, then `W/` is added to the prefix of the value.
+* @param {string[]} [options.retainedHeaders=RETAINED_304_HEADERS] - The headers that you want to retain in the 304 Response.
+* @param {function(Uint8Array): ArrayBuffer | Promise<ArrayBuffer>} [options.generateDigest] -
+* A custom digest generation function. By default, it uses 'SHA-1'
+* This function is called with the response body as a `Uint8Array` and should return a hash as an `ArrayBuffer` or a Promise of one.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Hono()
+*
+* app.use('/etag/*', etag())
+* app.get('/etag/abc', (c) => {
+*   return c.text('Hono is hot')
+* })
+* ```
+*/
+const etag = (options) => {
+	const retainedHeaders = new Set((options?.retainedHeaders ?? RETAINED_304_HEADERS).map((header) => header.toLowerCase()));
+	const weak = options?.weak ?? false;
+	const generator = initializeGenerator(options?.generateDigest);
+	return async function etag(c, next) {
+		const ifNoneMatch = c.req.header("If-None-Match") ?? null;
+		await next();
+		if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) return;
+		const res = c.res;
+		let etag = res.headers.get("ETag");
+		if (!etag) {
+			if (!generator) return;
+			const hash = await generateDigest(res.clone().body, generator);
+			if (hash === null) return;
+			etag = weak ? `W/"${hash}"` : `"${hash}"`;
+		}
+		if (ifNoneMatch === "*" || etagMatches(etag, ifNoneMatch)) {
+			c.res = new Response(null, {
+				status: 304,
+				statusText: "Not Modified",
+				headers: { ETag: etag }
+			});
+			for (const key of Array.from(c.res.headers.keys())) if (!retainedHeaders.has(key.toLowerCase())) c.res.headers.delete(key);
+		} else c.res.headers.set("ETag", etag);
+	};
 };
+//#endregion
+export { RETAINED_304_HEADERS, etag };

package/node_modules/hono/dist/middleware/ip-restriction/index.js

@@ -1,162 +1,167 @@
-// src/middleware/ip-restriction/index.ts
 import { HTTPException } from "../../http-exception.js";
-import {
-  convertIPv4MappedIPv6ToIPv4,
-  convertIPv4ToBinary,
-  convertIPv6BinaryToString,
-  convertIPv6ToBinary,
-  distinctRemoteAddr,
-  isIPv4MappedIPv6,
-  INVALID_IP_ADDRESS_ERROR_CODE
-} from "../../utils/ipaddr.js";
-var IS_CIDR_NOTATION_REGEX = /\/[^/]*$/;
-var parseCidrPrefix = (rule, prefix, max) => {
-  if (!/^[0-9]{1,3}$/.test(prefix)) {
-    throw new TypeError(`Invalid rule: ${rule}`);
-  }
-  const parsedPrefix = parseInt(prefix);
-  if (parsedPrefix > max) {
-    throw new TypeError(`Invalid rule: ${rule}`);
-  }
-  return parsedPrefix;
+import { convertIPv4MappedIPv6ToIPv4, convertIPv4ToBinary, convertIPv6BinaryToString, convertIPv6ToBinary, distinctRemoteAddr, isIPv4MappedIPv6 } from "../../utils/ipaddr.js";
+//#region src/middleware/ip-restriction/index.ts
+const IS_CIDR_NOTATION_REGEX = /\/[^/]*$/;
+const parseCidrPrefix = (rule, prefix, max) => {
+	if (!/^[0-9]{1,3}$/.test(prefix)) throw new TypeError(`Invalid rule: ${rule}`);
+	const parsedPrefix = parseInt(prefix);
+	if (parsedPrefix > max) throw new TypeError(`Invalid rule: ${rule}`);
+	return parsedPrefix;
 };
-var buildMatcher = (rules) => {
-  const functionRules = [];
-  const staticRules = /* @__PURE__ */ new Set();
-  const staticIPv4Rules = /* @__PURE__ */ new Set();
-  const staticIPv6Rules = /* @__PURE__ */ new Set();
-  const cidrRules = [];
-  const registerStaticRule = (rule) => {
-    const type = distinctRemoteAddr(rule);
-    if (type === void 0) {
-      throw new TypeError(`Invalid rule: ${rule}`);
-    }
-    if (type === "IPv4") {
-      const ipv4binary = convertIPv4ToBinary(rule);
-      staticRules.add(rule);
-      staticRules.add(`::ffff:${rule}`);
-      staticIPv4Rules.add(ipv4binary);
-      staticIPv6Rules.add(0xffffn << 32n | ipv4binary);
-    } else {
-      const ipv6binary = convertIPv6ToBinary(rule);
-      const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
-      staticRules.add(ipv6Addr);
-      staticIPv6Rules.add(ipv6binary);
-      if (isIPv4MappedIPv6(ipv6binary)) {
-        staticRules.add(ipv6Addr.substring(7));
-        staticIPv4Rules.add(convertIPv4MappedIPv6ToIPv4(ipv6binary));
-      }
-    }
-  };
-  for (let rule of rules) {
-    if (rule === "*") {
-      return () => true;
-    } else if (typeof rule === "function") {
-      functionRules.push(rule);
-    } else {
-      if (IS_CIDR_NOTATION_REGEX.test(rule)) {
-        const separatedRule = rule.split("/");
-        const addrStr = separatedRule[0];
-        const type = distinctRemoteAddr(addrStr);
-        if (type === void 0) {
-          throw new TypeError(`Invalid rule: ${rule}`);
-        }
-        let isIPv4 = type === "IPv4";
-        let prefix = parseCidrPrefix(rule, separatedRule[1], isIPv4 ? 32 : 128);
-        if (isIPv4 ? prefix === 32 : prefix === 128) {
-          rule = addrStr;
-        } else {
-          let addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr);
-          if (type === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
-            isIPv4 = true;
-            addr = convertIPv4MappedIPv6ToIPv4(addr);
-            prefix -= 96;
-          }
-          const mask = (1n << BigInt(prefix)) - 1n << BigInt((isIPv4 ? 32 : 128) - prefix);
-          cidrRules.push([isIPv4, addr & mask, mask]);
-          continue;
-        }
-      }
-      registerStaticRule(rule);
-    }
-  }
-  return (remote) => {
-    if (staticRules.has(remote.addr)) {
-      return true;
-    }
-    const remoteAddr = remote.binaryAddr ||= (remote.isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(remote.addr);
-    const remoteIPv4Addr = remote.isIPv4 || isIPv4MappedIPv6(remoteAddr) ? remote.isIPv4 ? remoteAddr : convertIPv4MappedIPv6ToIPv4(remoteAddr) : void 0;
-    if ((remote.isIPv4 ? staticIPv4Rules : staticIPv6Rules).has(remoteAddr)) {
-      return true;
-    }
-    for (const [isIPv4, addr, mask] of cidrRules) {
-      if (isIPv4) {
-        if (remoteIPv4Addr === void 0) {
-          continue;
-        }
-        if ((remoteIPv4Addr & mask) === addr) {
-          return true;
-        }
-        continue;
-      }
-      if (remote.isIPv4) {
-        continue;
-      }
-      if ((remoteAddr & mask) === addr) {
-        return true;
-      }
-    }
-    for (const rule of functionRules) {
-      if (rule({ addr: remote.addr, type: remote.type })) {
-        return true;
-      }
-    }
-    return false;
-  };
+const buildMatcher = (rules) => {
+	const functionRules = [];
+	const staticRules = /* @__PURE__ */ new Set();
+	const staticIPv4Rules = /* @__PURE__ */ new Set();
+	const staticIPv6Rules = /* @__PURE__ */ new Set();
+	const cidrRules = [];
+	const registerStaticRule = (rule) => {
+		const type = distinctRemoteAddr(rule);
+		if (type === void 0) throw new TypeError(`Invalid rule: ${rule}`);
+		if (type === "IPv4") {
+			const ipv4binary = convertIPv4ToBinary(rule);
+			staticRules.add(rule);
+			staticRules.add(`::ffff:${rule}`);
+			staticIPv4Rules.add(ipv4binary);
+			staticIPv6Rules.add(65535n << 32n | ipv4binary);
+		} else {
+			const ipv6binary = convertIPv6ToBinary(rule);
+			const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
+			staticRules.add(ipv6Addr);
+			staticIPv6Rules.add(ipv6binary);
+			if (isIPv4MappedIPv6(ipv6binary)) {
+				staticRules.add(ipv6Addr.substring(7));
+				staticIPv4Rules.add(convertIPv4MappedIPv6ToIPv4(ipv6binary));
+			}
+		}
+	};
+	for (let rule of rules) if (rule === "*") return () => true;
+	else if (typeof rule === "function") functionRules.push(rule);
+	else {
+		if (IS_CIDR_NOTATION_REGEX.test(rule)) {
+			const separatedRule = rule.split("/");
+			const addrStr = separatedRule[0];
+			const type = distinctRemoteAddr(addrStr);
+			if (type === void 0) throw new TypeError(`Invalid rule: ${rule}`);
+			let isIPv4 = type === "IPv4";
+			let prefix = parseCidrPrefix(rule, separatedRule[1], isIPv4 ? 32 : 128);
+			if (isIPv4 ? prefix === 32 : prefix === 128) rule = addrStr;
+			else {
+				let addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr);
+				if (type === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
+					isIPv4 = true;
+					addr = convertIPv4MappedIPv6ToIPv4(addr);
+					prefix -= 96;
+				}
+				const mask = (1n << BigInt(prefix)) - 1n << BigInt((isIPv4 ? 32 : 128) - prefix);
+				cidrRules.push([
+					isIPv4,
+					addr & mask,
+					mask
+				]);
+				continue;
+			}
+		}
+		registerStaticRule(rule);
+	}
+	return (remote) => {
+		if (staticRules.has(remote.addr)) return true;
+		const remoteAddr = remote.binaryAddr ||= (remote.isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(remote.addr);
+		const remoteIPv4Addr = remote.isIPv4 || isIPv4MappedIPv6(remoteAddr) ? remote.isIPv4 ? remoteAddr : convertIPv4MappedIPv6ToIPv4(remoteAddr) : void 0;
+		if ((remote.isIPv4 ? staticIPv4Rules : staticIPv6Rules).has(remoteAddr)) return true;
+		for (const [isIPv4, addr, mask] of cidrRules) {
+			if (isIPv4) {
+				if (remoteIPv4Addr === void 0) continue;
+				if ((remoteIPv4Addr & mask) === addr) return true;
+				continue;
+			}
+			if (remote.isIPv4) continue;
+			if ((remoteAddr & mask) === addr) return true;
+		}
+		for (const rule of functionRules) if (rule({
+			addr: remote.addr,
+			type: remote.type
+		})) return true;
+		return false;
+	};
 };
-var ipRestriction = (getIP, { denyList = [], allowList = [] }, onError) => {
-  const allowLength = allowList.length;
-  const denyMatcher = buildMatcher(denyList);
-  const allowMatcher = buildMatcher(allowList);
-  const blockError = (c) => new HTTPException(403, {
-    res: c.text("Forbidden", {
-      status: 403
-    })
-  });
-  return async function ipRestriction2(c, next) {
-    const connInfo = getIP(c);
-    const addr = typeof connInfo === "string" ? connInfo : connInfo.remote.address;
-    if (!addr) {
-      throw blockError(c);
-    }
-    const type = typeof connInfo !== "string" && connInfo.remote.addressType || distinctRemoteAddr(addr);
-    const remoteData = { addr, type, isIPv4: type === "IPv4" };
-    try {
-      if (denyMatcher(remoteData)) {
-        if (onError) {
-          return onError({ addr, type }, c);
-        }
-        throw blockError(c);
-      }
-      if (allowMatcher(remoteData)) {
-        return await next();
-      }
-    } catch (e) {
-      if (e instanceof TypeError && e.code === INVALID_IP_ADDRESS_ERROR_CODE) {
-        throw blockError(c);
-      }
-      throw e;
-    }
-    if (allowLength === 0) {
-      return await next();
-    } else {
-      if (onError) {
-        return await onError({ addr, type }, c);
-      }
-      throw blockError(c);
-    }
-  };
-};
-export {
-  ipRestriction
+/**
+* IP Restriction Middleware for Hono.
+*
+* @see {@link https://hono.dev/docs/middleware/builtin/ip-restriction}
+*
+* @param {GetConnInfo | ((c: Context) => string)} getIP - A function to retrieve the client IP address. Use `getConnInfo` from the appropriate runtime adapter.
+* @param {IPRestrictionRules} rules - An object with optional `denyList` and `allowList` arrays of IP rules. Each rule can be a static IP, a CIDR range, or a custom function.
+* @param {(remote: { addr: string; type: AddressType }, c: Context) => Response | Promise<Response>} [onError] - Optional custom handler invoked when a request is blocked. Defaults to returning a 403 Forbidden response.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* import { Hono } from 'hono'
+* import { ipRestriction } from 'hono/ip-restriction'
+* import { getConnInfo } from 'hono/cloudflare-workers'
+*
+* const app = new Hono()
+*
+* app.use(
+*   '*',
+*   ipRestriction(getConnInfo, {
+*     // Block a specific IP and an entire subnet
+*     denyList: ['192.168.0.5', '10.0.0.0/8'],
+*     // Only allow requests from localhost and a private range
+*     allowList: ['127.0.0.1', '::1', '192.168.1.0/24'],
+*   })
+* )
+*
+* // With a custom error handler
+* app.use(
+*   '/admin/*',
+*   ipRestriction(
+*     getConnInfo,
+*     { allowList: ['203.0.113.0/24'] },
+*     (remote, c) => c.text(`Access denied for ${remote.addr}`, 403)
+*   )
+* )
+*
+* app.get('/', (c) => c.text('Hello!'))
+* ```
+*/
+const ipRestriction = (getIP, { denyList = [], allowList = [] }, onError) => {
+	const allowLength = allowList.length;
+	const denyMatcher = buildMatcher(denyList);
+	const allowMatcher = buildMatcher(allowList);
+	const blockError = (c) => new HTTPException(403, { res: c.text("Forbidden", { status: 403 }) });
+	return async function ipRestriction(c, next) {
+		const connInfo = getIP(c);
+		const addr = typeof connInfo === "string" ? connInfo : connInfo.remote.address;
+		if (!addr) throw blockError(c);
+		const type = typeof connInfo !== "string" && connInfo.remote.addressType || distinctRemoteAddr(addr);
+		const remoteData = {
+			addr,
+			type,
+			isIPv4: type === "IPv4"
+		};
+		try {
+			if (denyMatcher(remoteData)) {
+				if (onError) return onError({
+					addr,
+					type
+				}, c);
+				throw blockError(c);
+			}
+			if (allowMatcher(remoteData)) return await next();
+		} catch (e) {
+			if (e instanceof TypeError && e.code === "ERR_INVALID_IP_ADDRESS") throw blockError(c);
+			throw e;
+		}
+		if (allowLength === 0) return await next();
+		else {
+			if (onError) return await onError({
+				addr,
+				type
+			}, c);
+			throw blockError(c);
+		}
+	};
 };
+//#endregion
+export { ipRestriction };