@toa.io/extensions.origins 0.10.0-dev.13 → 0.10.0-dev.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/extensions.origins",
-  "version": "0.10.0-dev.13",
+  "version": "0.10.0-dev.15",
   "description": "Toa Origins",
   "author": "temich <tema.gurtovoy@gmail.com>",
   "homepage": "https://github.com/toa-io/toa#readme",
@@ -19,15 +19,15 @@
     "test": "echo \"Error: run tests from root\" && exit 1"
   },
   "dependencies": {
-    "@toa.io/core": "1.1.0-dev.13",
-    "@toa.io/generic": "0.11.0-dev.13",
-    "@toa.io/schemas": "0.8.4-dev.13",
-    "@toa.io/yaml": "0.7.6-dev.13",
+    "@toa.io/core": "1.1.0-dev.15",
+    "@toa.io/generic": "0.11.0-dev.15",
+    "@toa.io/schemas": "0.8.4-dev.15",
+    "@toa.io/yaml": "0.7.6-dev.15",
     "comq": "0.7.0",
     "node-fetch": "2.6.7"
   },
   "devDependencies": {
     "@types/node-fetch": "2.6.2"
   },
-  "gitHead": "8c824ed7448e01f0ddf44500a4a6e692d35eaa1b"
+  "gitHead": "f479f6e79d5caaa207da4d0a3192425def1abf75"
 }

package/source/.credentials.js

@@ -0,0 +1,14 @@
+'use strict'
+
+/**
+ * @param {string} reference
+ */
+function check (reference) {
+  if (typeof reference !== 'string') return // aspect properties object
+
+  const url = new URL(reference)
+
+  if (url.username !== '' || url.password !== '') throw new Error('Origins must not contain credentials. Please use environment secrets instead.')
+}
+
+exports.check = check

package/source/deployment.js

@@ -4,6 +4,7 @@ const { merge } = require('@toa.io/generic')
 const schemas = require('./schemas')
 const protocols = require('./protocols')
 const create = require('./.deployment')
+const credentials = require('./.credentials')
 
 /**
  * @param {toa.norm.context.dependencies.Instance[]} instances
@@ -11,7 +12,7 @@ const create = require('./.deployment')
  * @returns {toa.deployment.dependency.Declaration}
  */
 function deployment (instances, annotations = {}) {
-  schemas.annotations.validate(annotations)
+  validate(annotations)
 
   const uris = create.uris(instances, annotations)
   const variables = { ...uris }
@@ -25,4 +26,16 @@ function deployment (instances, annotations = {}) {
   return { variables }
 }
 
+/**
+ * @param {toa.origins.Annotations} annotations
+ * @return {void}
+ */
+function validate (annotations) {
+  schemas.annotations.validate(annotations)
+
+  for (const component of Object.values(annotations)) {
+    Object.values(component).forEach(credentials.check)
+  }
+}
+
 exports.deployment = deployment

package/source/deployment.test.js

@@ -100,6 +100,18 @@ it('should create variables', () => {
   expect(variable.value).toStrictEqual(base64)
 })
 
+it.each(['http', 'amqp'])('should throw if %s annotation contains credentials',
+  async (protocol) => {
+    /** @type {toa.origins.Annotations} */
+    const annotations = {
+      [component.locator.id]: {
+        [origin]: protocol + '://dev:sec@host-' + generate()
+      }
+    }
+
+    expect(() => deployment(components, annotations)).toThrow('Origins must not contain credentials')
+  })
+
 describe('amqp', () => {
   beforeEach(() => {
     const amqpComponents = components.filter(

package/source/manifest.js

@@ -3,6 +3,7 @@
 const { remap, echo, shards } = require('@toa.io/generic')
 const schemas = require('./schemas')
 const protocols = require('./protocols')
+const credentials = require('./.credentials')
 
 /**
  * @param {toa.origins.Manifest} manifest
@@ -29,6 +30,8 @@ function manifest (manifest) {
 function validate (manifest) {
   manifest = remap(manifest, (value) => shards(value)[0])
   schemas.manifest.validate(manifest)
+
+  Object.values(manifest).forEach(credentials.check)
 }
 
 function supports (provider, url) {

package/source/manifest.test.js

@@ -73,3 +73,10 @@ it('should handle port shards', async () => {
 
   expect(() => manifest(input)).not.toThrow()
 })
+
+it.each(['dev:sec', 'dev'])('should throw if url contains credentials (%s)',
+  async (credentials) => {
+    const input = { foo: `http://${credentials}@${generate()}:888{0-9}` }
+
+    expect(() => manifest(input)).toThrow('must not contain credentials')
+  })