@undefineds.co/xpod 0.4.14 → 0.4.16

package/dist/http/InternalPodDataHttpHandler.js

@@ -1,551 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InternalPodDataHttpHandler = void 0;
-const node_crypto_1 = require("node:crypto");
-const promises_1 = require("node:stream/promises");
-const global_logger_factory_1 = require("global-logger-factory");
-const sparqljs_1 = require("sparqljs");
-const community_server_1 = require("@solid/community-server");
-const AiConnectionsServiceAccess_1 = require("../api/ai-gateway/service-access/AiConnectionsServiceAccess");
-const AiConfigServiceAccess_1 = require("../api/ai-gateway/service-access/AiConfigServiceAccess");
-const GatewayAdminProxyAuth_1 = require("../runtime/GatewayAdminProxyAuth");
-const ResourceReadContext_1 = require("../storage/ResourceReadContext");
-const ALLOWED_METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']);
-const DEFAULT_NONCE_TTL_MS = 120_000;
-const DEFAULT_NONCE_MAX_ENTRIES = 10_000;
-const MODEL_QUERY_MAX_BODY_BYTES = 256 * 1024;
-class InternalPodDataHttpHandler extends community_server_1.HttpHandler {
-    constructor(options) {
-        super();
-        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
-        this.eTagHandler = new community_server_1.BasicETagHandler();
-        this.conditionsParser = new community_server_1.BasicConditionsParser(this.eTagHandler);
-        this.resourceStore = options.resourceStore;
-        this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;
-        this.patchBodyParser = options.patchBodyParser;
-        this.sparqlHandler = options.sparqlHandler;
-        this.deploymentBaseUrl = this.parseOptionalUrl(options.baseUrl ?? process.env.CSS_BASE_URL);
-        this.basePath = options.basePath ?? '/.internal/pod-data';
-        const nonceOptions = options;
-        this.seenNonces = new BoundedTtlNonceCache({
-            ttlMs: nonceOptions.nonceTtlMs ?? DEFAULT_NONCE_TTL_MS,
-            maxEntries: nonceOptions.nonceMaxEntries ?? DEFAULT_NONCE_MAX_ENTRIES,
-            now: nonceOptions.now,
-        });
-    }
-    async canHandle({ request }) {
-        if (this.requestPathname(request) !== this.basePath) {
-            throw new community_server_1.NotImplementedHttpError('Not an internal Pod data request.');
-        }
-    }
-    async handle({ request, response }) {
-        if (this.requestPathname(request) !== this.basePath) {
-            throw new community_server_1.NotImplementedHttpError('Not an internal Pod data request.');
-        }
-        const intent = this.verifyRequest(request);
-        if (!intent) {
-            this.writeNotFound(response);
-            return;
-        }
-        try {
-            await (0, ResourceReadContext_1.withDirectDataRead)(() => this.delegate(request, response, intent));
-        }
-        catch (error) {
-            if (isHttpNotFound(error)) {
-                if (intent.method === 'GET' && !isGatewayAccessKeySecretResource(intent)) {
-                    this.writeEmptyGraph(response);
-                }
-                else {
-                    this.writeNotFound(response);
-                }
-                return;
-            }
-            throw error;
-        }
-    }
-    verifyRequest(request) {
-        const method = request.method?.toUpperCase();
-        if (!ALLOWED_METHODS.has(method ?? '')) {
-            this.logRejectedRequest('method_not_allowed');
-            return undefined;
-        }
-        if (!(0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(request.socket.remoteAddress)) {
-            this.logRejectedRequest('non_loopback_transport');
-            return undefined;
-        }
-        const verification = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
-            headers: request.headers,
-            secret: this.gatewayAdminProxyAuthSecret,
-            method,
-            url: request.url,
-        });
-        if (!verification.valid || !verification.originalClientLoopback || !verification.intent || !verification.nonce) {
-            this.logRejectedRequest(verification.reason ?? 'invalid_runtime_marker');
-            return undefined;
-        }
-        if (!this.intentMatchesRequest(verification.intent, method)) {
-            this.logRejectedRequest('intent_mismatch');
-            return undefined;
-        }
-        if (!this.isHostedOwnerResource(verification.intent)) {
-            this.logRejectedRequest('owner_resource_outside_deployment');
-            return undefined;
-        }
-        if (!this.isAllowedAiConnectionResource(verification.intent)) {
-            this.logRejectedRequest('resource_not_allowed');
-            return undefined;
-        }
-        if (!this.seenNonces.consume(verification.nonce)) {
-            this.logRejectedRequest('nonce_rejected');
-            return undefined;
-        }
-        return verification.intent;
-    }
-    logRejectedRequest(reason) {
-        this.logger.warn(`Rejected internal Pod data request: ${reason}`);
-    }
-    intentMatchesRequest(intent, method) {
-        if (intent.method !== method) {
-            return false;
-        }
-        if (intent.scopes.length === 0) {
-            return false;
-        }
-        if (intent.principalKind === 'gateway-key-verifier') {
-            return intent.scopes.length === 1 && ((intent.scopes[0] === 'ai:gateway-key:verify' && (method === 'GET' || method === 'HEAD' || method === 'POST'))
-                || (intent.scopes[0] === 'ai:gateway-key:touch' && (method === 'GET' || method === 'HEAD' || method === 'PATCH')));
-        }
-        if (method === 'POST') {
-            const endpointKind = trustedSparqlEndpointKind(resourceOwnerWebId(intent), intent.resourceUrl);
-            if (endpointKind === 'settings') {
-                return intentHasScope(intent, 'ai:credentials:read') || intentHasScope(intent, 'ai:credentials:write');
-            }
-            if (endpointKind === 'models') {
-                return intentHasScope(intent, 'ai:credentials:read');
-            }
-            if (endpointKind === 'gatewayAccessKeys') {
-                return intentHasScope(intent, 'ai:credentials:read');
-            }
-        }
-        return intentHasScope(intent, method === 'GET' || method === 'HEAD' ? 'ai:credentials:read' : 'ai:credentials:write');
-    }
-    isHostedOwnerResource(intent) {
-        if (!this.deploymentBaseUrl) {
-            return false;
-        }
-        let resourceUrl;
-        try {
-            resourceUrl = new URL(intent.resourceUrl);
-        }
-        catch {
-            return false;
-        }
-        const podRoot = podRootFromIntent(intent);
-        if (!podRoot || !this.isInsideDeployment(podRoot) || !this.isInsideDeployment(resourceUrl)) {
-            return false;
-        }
-        return resourceUrl.origin === podRoot.origin &&
-            resourceUrl.pathname.startsWith(podRoot.pathname);
-    }
-    isAllowedAiConnectionResource(intent) {
-        let resourceUrl;
-        try {
-            resourceUrl = new URL(intent.resourceUrl);
-        }
-        catch {
-            return false;
-        }
-        if (intent.principalKind === 'gateway-key-verifier') {
-            return isAllowedGatewayKeyVerifierResource(intent, resourceUrl);
-        }
-        const resourceOwner = resourceOwnerWebId(intent);
-        const sparqlQuery = trustedSparqlQueryForOwner(resourceOwner, resourceUrl);
-        if (sparqlQuery !== undefined) {
-            return intent.method === 'GET';
-        }
-        if (trustedSparqlEndpointKind(resourceOwner, intent.resourceUrl) !== undefined) {
-            return intent.method === 'POST' && !resourceUrl.search && !resourceUrl.hash;
-        }
-        if (resourceUrl.hash || resourceUrl.search) {
-            return false;
-        }
-        const allowed = (0, AiConnectionsServiceAccess_1.createAiConnectionsServiceAccess)({
-            ownerWebId: resourceOwner,
-            serviceWebId: intent.ownerWebId,
-        }).resources.map((resource) => resource.url);
-        allowed.push(...(0, AiConfigServiceAccess_1.createAiConfigResourceUrls)(resourceOwner));
-        return allowed.includes(resourceUrl.href);
-    }
-    async delegate(request, response, intent) {
-        const resourceUrl = new URL(intent.resourceUrl);
-        const sparqlOperation = await trustedSparqlOperationForRequest(request, resourceOwnerWebId(intent), resourceUrl, intent.method);
-        if (sparqlOperation !== undefined) {
-            if (!this.sparqlHandler) {
-                throw new community_server_1.NotImplementedHttpError('Internal settings SPARQL delegation is not configured.');
-            }
-            if (!intentAllowsSparqlOperation(intent, sparqlOperation.kind)) {
-                this.logRejectedRequest(`sparql_scope_mismatch:${sparqlOperation.kind}`);
-                this.writeNotFound(response);
-                return;
-            }
-            if (intent.method === 'POST' && intent.bodyDigest !== sparqlOperation.bodyDigest) {
-                this.logRejectedRequest(`sparql_body_digest_mismatch:${intent.bodyDigest?.slice(0, 12) ?? 'missing'}:${sparqlOperation.bodyDigest?.slice(0, 12) ?? 'missing'}`);
-                this.writeNotFound(response);
-                return;
-            }
-            const input = {
-                ownerWebId: resourceOwnerWebId(intent),
-                endpointUrl: intent.resourceUrl,
-                query: sparqlOperation.sparql,
-                request,
-                response,
-            };
-            if (sparqlOperation.kind === 'query') {
-                await this.sparqlHandler.handleTrustedInternalSelect(input);
-            }
-            else {
-                await this.sparqlHandler.handleTrustedInternalUpdate(input);
-            }
-            return;
-        }
-        if (trustedSparqlEndpointKind(resourceOwnerWebId(intent), intent.resourceUrl) !== undefined) {
-            this.logRejectedRequest(`sparql_operation_unsupported:${firstHeader(request.headers['content-type']) ?? 'missing-content-type'}`);
-            this.writeNotFound(response);
-            return;
-        }
-        const identifier = { path: intent.resourceUrl };
-        switch (intent.method) {
-            case 'GET': {
-                const representation = await this.resourceStore.getRepresentation(identifier, resourceReadPreferences(intent));
-                response.statusCode = 200;
-                response.setHeader('Content-Type', representation.metadata.contentType ?? 'text/turtle');
-                this.writeETag(representation, response);
-                await this.pipeRepresentation(representation, response);
-                return;
-            }
-            case 'HEAD': {
-                const representation = await this.resourceStore.getRepresentation(identifier, resourceReadPreferences(intent));
-                response.statusCode = 200;
-                response.setHeader('Content-Type', representation.metadata.contentType ?? 'text/turtle');
-                this.writeETag(representation, response);
-                representation.data.destroy();
-                response.end();
-                return;
-            }
-            case 'PUT': {
-                const conditions = await this.conditionsParser.handleSafe(request);
-                await this.resourceStore.setRepresentation(identifier, this.createRepresentation(request, intent.resourceUrl), conditions);
-                response.statusCode = 204;
-                response.end();
-                return;
-            }
-            case 'PATCH': {
-                await this.resourceStore.modifyResource(identifier, await this.createPatch(request, intent.resourceUrl));
-                response.statusCode = 204;
-                response.end();
-                return;
-            }
-            case 'DELETE': {
-                await this.resourceStore.deleteResource(identifier);
-                response.statusCode = 204;
-                response.end();
-            }
-        }
-    }
-    createRepresentation(request, resourceUrl) {
-        const contentType = firstHeader(request.headers['content-type']) ?? 'text/turtle';
-        return new community_server_1.BasicRepresentation(request, new community_server_1.RepresentationMetadata({ path: resourceUrl }, contentType));
-    }
-    writeETag(representation, response) {
-        const eTag = this.eTagHandler.getETag(representation.metadata);
-        if (eTag) {
-            response.setHeader('ETag', eTag);
-        }
-    }
-    async createPatch(request, resourceUrl) {
-        if (!this.patchBodyParser) {
-            throw new community_server_1.NotImplementedHttpError('Internal Pod data PATCH requires a PatchBodyParser.');
-        }
-        const contentType = firstHeader(request.headers['content-type']) ?? 'application/sparql-update';
-        const metadata = new community_server_1.RepresentationMetadata({ path: resourceUrl }, contentType);
-        return this.patchBodyParser.handleSafe({ request, metadata });
-    }
-    async pipeRepresentation(representation, response) {
-        await (0, promises_1.pipeline)(representation.data, response);
-    }
-    writeNotFound(response) {
-        response.statusCode = 404;
-        response.setHeader('Cache-Control', 'no-store');
-        response.end('Not Found');
-    }
-    writeEmptyGraph(response) {
-        response.statusCode = 200;
-        response.setHeader('Content-Type', 'text/turtle');
-        response.setHeader('Cache-Control', 'no-store');
-        response.end();
-    }
-    requestPathname(request) {
-        const requestUrl = request.url ?? '/';
-        try {
-            // Route ownership is path-based. Do not let an untrusted or proxy-shaped
-            // Host header make URL parsing throw and silently skip this first handler.
-            return requestUrl.startsWith('/')
-                ? new URL(requestUrl, 'http://xpod.internal').pathname
-                : new URL(requestUrl).pathname;
-        }
-        catch {
-            return undefined;
-        }
-    }
-    parseOptionalUrl(value) {
-        if (!value) {
-            return undefined;
-        }
-        try {
-            return new URL(ensureTrailingSlash(value));
-        }
-        catch {
-            return undefined;
-        }
-    }
-    isInsideDeployment(url) {
-        return this.deploymentBaseUrl !== undefined &&
-            url.origin === this.deploymentBaseUrl.origin &&
-            url.pathname.startsWith(this.deploymentBaseUrl.pathname);
-    }
-}
-exports.InternalPodDataHttpHandler = InternalPodDataHttpHandler;
-function isHttpNotFound(error) {
-    return typeof error === 'object' &&
-        error !== null &&
-        ('statusCode' in error ? error.statusCode === 404 : error.name === 'NotFoundHttpError');
-}
-function firstHeader(value) {
-    return Array.isArray(value) ? value[0] : value;
-}
-function hostedPodRootFromOwner(ownerUrl) {
-    if (ownerUrl.hash !== '#me') {
-        return undefined;
-    }
-    if (!ownerUrl.pathname.endsWith('/profile/card')) {
-        return undefined;
-    }
-    const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);
-    if (!podPath || !podPath.endsWith('/')) {
-        return undefined;
-    }
-    return new URL(podPath, ownerUrl.origin);
-}
-function podRootFromIntent(intent) {
-    if (!intent.podBaseUrl) {
-        try {
-            return hostedPodRootFromOwner(new URL(intent.ownerWebId));
-        }
-        catch {
-            return undefined;
-        }
-    }
-    try {
-        const root = new URL(intent.podBaseUrl);
-        root.search = '';
-        root.hash = '';
-        root.pathname = ensureTrailingSlash(root.pathname);
-        return root;
-    }
-    catch {
-        return undefined;
-    }
-}
-function resourceOwnerWebId(intent) {
-    const podRoot = podRootFromIntent(intent);
-    return podRoot ? new URL('profile/card#me', podRoot).href : intent.ownerWebId;
-}
-function resourceReadPreferences(intent) {
-    return isGatewayAccessKeySecretResource(intent)
-        ? { type: { 'application/json': 1, '*/*': 0.1 } }
-        : { type: { 'text/turtle': 1, '*/*': 0.1 } };
-}
-function isGatewayAccessKeySecretResource(intent) {
-    try {
-        const resource = new URL(intent.resourceUrl);
-        const expected = new URL((0, AiConnectionsServiceAccess_1.resolveGatewayAccessKeySecretResourceUrl)(resourceOwnerWebId(intent)));
-        return resource.href === expected.href;
-    }
-    catch {
-        return false;
-    }
-}
-async function trustedSparqlOperationForRequest(request, ownerWebId, resourceUrl, method) {
-    const queryFromUrl = trustedSparqlQueryForOwner(ownerWebId, resourceUrl);
-    if (queryFromUrl !== undefined) {
-        return method === 'GET' ? { kind: 'query', sparql: queryFromUrl } : undefined;
-    }
-    const endpointKind = trustedSparqlEndpointKind(ownerWebId, resourceUrl);
-    if (method !== 'POST' || !endpointKind || resourceUrl.search || resourceUrl.hash) {
-        return undefined;
-    }
-    const body = await readRequestBody(request);
-    if (!body) {
-        return undefined;
-    }
-    const contentType = firstHeader(request.headers['content-type'])?.split(';', 1)[0].trim().toLowerCase();
-    let declaredKind;
-    let sparql;
-    if (contentType === 'application/sparql-query') {
-        declaredKind = 'query';
-        sparql = body.toString('utf8').trim();
-    }
-    else if (contentType === 'application/sparql-update') {
-        declaredKind = 'update';
-        sparql = body.toString('utf8').trim();
-    }
-    else if (contentType === 'application/x-www-form-urlencoded') {
-        const params = new URLSearchParams(body.toString('utf8'));
-        const keys = Array.from(params.keys());
-        const operation = keys.length === 1 && (keys[0] === 'query' || keys[0] === 'update')
-            ? keys[0]
-            : undefined;
-        if (operation) {
-            declaredKind = operation;
-            sparql = params.get(operation)?.trim();
-        }
-    }
-    const parsedKind = sparql ? parseSparqlKind(sparql) : undefined;
-    if (!declaredKind || !sparql || parsedKind !== declaredKind ||
-        (endpointKind !== 'settings' && parsedKind !== 'query')) {
-        return undefined;
-    }
-    return {
-        kind: parsedKind,
-        sparql,
-        bodyDigest: (0, node_crypto_1.createHash)('sha256').update(body).digest('hex'),
-    };
-}
-function trustedSparqlQueryForOwner(ownerWebId, resourceUrl) {
-    if (!trustedSparqlEndpointKind(ownerWebId, resourceUrl) || resourceUrl.hash) {
-        return undefined;
-    }
-    const keys = Array.from(resourceUrl.searchParams.keys());
-    if (keys.length !== 1 || keys[0] !== 'query') {
-        return undefined;
-    }
-    const query = resourceUrl.searchParams.get('query')?.trim();
-    return query && parseSparqlKind(query) === 'query' ? query : undefined;
-}
-function trustedSparqlEndpointKind(ownerWebId, resourceUrlValue) {
-    let ownerUrl;
-    let resourceUrl;
-    try {
-        ownerUrl = new URL(ownerWebId);
-        resourceUrl = typeof resourceUrlValue === 'string' ? new URL(resourceUrlValue) : resourceUrlValue;
-    }
-    catch {
-        return undefined;
-    }
-    const podRoot = hostedPodRootFromOwner(ownerUrl);
-    if (!podRoot || resourceUrl.origin !== podRoot.origin) {
-        return undefined;
-    }
-    if (resourceUrl.pathname === `${podRoot.pathname}settings/providers/-/sparql`) {
-        return 'models';
-    }
-    if ((0, AiConnectionsServiceAccess_1.isGatewayAccessKeySparqlEndpoint)(ownerWebId, resourceUrl)) {
-        return 'gatewayAccessKeys';
-    }
-    return resourceUrl.pathname === `${podRoot.pathname}settings/-/sparql` ? 'settings' : undefined;
-}
-function isAllowedGatewayKeyVerifierResource(intent, resourceUrl) {
-    const ownerWebId = resourceOwnerWebId(intent);
-    let documentUrl;
-    try {
-        documentUrl = new URL((0, AiConnectionsServiceAccess_1.resolveGatewayAccessKeyResourceUrl)(ownerWebId));
-    }
-    catch {
-        return false;
-    }
-    const exactDocument = resourceUrl.href === documentUrl.href;
-    if (intent.scopes[0] === 'ai:gateway-key:touch') {
-        return exactDocument && (intent.method === 'GET' || intent.method === 'HEAD' || intent.method === 'PATCH');
-    }
-    if (intent.scopes[0] !== 'ai:gateway-key:verify') {
-        return false;
-    }
-    if (exactDocument) {
-        return intent.method === 'GET' || intent.method === 'HEAD';
-    }
-    if (!(0, AiConnectionsServiceAccess_1.isGatewayAccessKeySparqlEndpoint)(ownerWebId, resourceUrl)) {
-        return false;
-    }
-    if (intent.method === 'GET') {
-        return trustedSparqlQueryForOwner(ownerWebId, resourceUrl) !== undefined;
-    }
-    return intent.method === 'POST' && !resourceUrl.search && !resourceUrl.hash;
-}
-function parseSparqlKind(value) {
-    try {
-        const parsed = new sparqljs_1.Parser({ baseIRI: 'urn:xpod:internal-sparql:' }).parse(value);
-        return parsed.type === 'update' ? 'update' : parsed.type === 'query' ? 'query' : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function intentHasScope(intent, requiredScope) {
-    return intent.scopes.some((scope) => scope === requiredScope || scope === 'ai:credentials:*' || scope === 'ai:*');
-}
-function intentAllowsSparqlOperation(intent, operation) {
-    if (intent.principalKind === 'gateway-key-verifier') {
-        return operation === 'query'
-            && intent.scopes.length === 1
-            && intent.scopes[0] === 'ai:gateway-key:verify';
-    }
-    return intentHasScope(intent, operation === 'query' ? 'ai:credentials:read' : 'ai:credentials:write');
-}
-async function readRequestBody(request) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of request) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += buffer.byteLength;
-        if (size > MODEL_QUERY_MAX_BODY_BYTES) {
-            return undefined;
-        }
-        chunks.push(buffer);
-    }
-    if (size === 0) {
-        return undefined;
-    }
-    return Buffer.concat(chunks, size);
-}
-function ensureTrailingSlash(value) {
-    return value.endsWith('/') ? value : `${value}/`;
-}
-class BoundedTtlNonceCache {
-    constructor(options) {
-        this.entries = new Map();
-        this.ttlMs = Math.max(1, options.ttlMs);
-        this.maxEntries = Math.max(1, options.maxEntries);
-        this.now = options.now ?? Date.now;
-    }
-    consume(nonce) {
-        const now = this.now();
-        this.pruneExpired(now);
-        if (this.entries.has(nonce)) {
-            return false;
-        }
-        if (this.entries.size >= this.maxEntries) {
-            return false;
-        }
-        this.entries.set(nonce, now + this.ttlMs);
-        return true;
-    }
-    pruneExpired(now) {
-        for (const [nonce, expiresAt] of this.entries) {
-            if (expiresAt > now) {
-                continue;
-            }
-            this.entries.delete(nonce);
-        }
-    }
-}
-//# sourceMappingURL=InternalPodDataHttpHandler.js.map