@validate.qa/runner 1.0.100 → 1.0.102

package/dist/{chunk-GIIIVO2W.mjs → chunk-E2RRAE27.mjs}

@@ -1,7 +1,7 @@
 import {
   dist_exports,
   init_dist
-} from "./chunk-MBKGTELT.mjs";
+} from "./chunk-3JM6XTSZ.mjs";
 import {
   __commonJS,
   __require,
@@ -21,8 +21,12 @@ var require_survey_network_guard = __commonJS({
     exports.maskedPath = maskedPath;
     exports.bodyKeysOf = bodyKeysOf;
     exports.graphqlDocumentIsQueryOnly = graphqlDocumentIsQueryOnly;
+    exports.graphqlOperationRoots = graphqlOperationRoots;
     exports.isTokenRefreshWrite = isTokenRefreshWrite;
     exports.isSignInPathWrite = isSignInPathWrite;
+    exports.graphqlUrlCarriesQuery = graphqlUrlCarriesQuery;
+    exports.graphqlUrlQueriesAreReads = graphqlUrlQueriesAreReads;
+    exports.graphqlGetMayWrite = graphqlGetMayWrite;
     exports.writeShapedGet = writeShapedGet;
     exports.decideSurveyRequest = decideSurveyRequest;
     exports.installSurveyNetworkGuard = installSurveyNetworkGuard;
@@ -299,6 +303,100 @@ var require_survey_network_guard = __commonJS({
       }
       return depth === 0 && parens === 0 && objects === 0 && sawOperation;
     }
+    function graphqlOperationRoots(text) {
+      const tokens = lexGraphql(text);
+      if (!tokens)
+        return null;
+      const ops = [];
+      let depth = 0;
+      let parens = 0;
+      let objects = 0;
+      let defStart = true;
+      let kind = null;
+      let current = null;
+      let prev = "";
+      for (const tok of tokens) {
+        const last = prev;
+        prev = tok;
+        if (tok === "(") {
+          parens++;
+          continue;
+        }
+        if (tok === ")") {
+          parens--;
+          if (parens < 0 || objects !== 0)
+            return null;
+          continue;
+        }
+        if (parens > 0) {
+          if (tok === "{")
+            objects++;
+          else if (tok === "}") {
+            objects--;
+            if (objects < 0)
+              return null;
+          }
+          continue;
+        }
+        if (tok === "{") {
+          if (depth === 0) {
+            if (defStart)
+              kind = "query";
+            else if (kind === null)
+              return null;
+            current = kind === "fragment" ? null : { kind, roots: [] };
+            if (current)
+              ops.push(current);
+            defStart = false;
+          }
+          depth++;
+          continue;
+        }
+        if (tok === "}") {
+          depth--;
+          if (depth < 0)
+            return null;
+          if (depth === 0) {
+            defStart = true;
+            kind = null;
+            current = null;
+          }
+          continue;
+        }
+        if (depth === 0) {
+          if (!/^[_A-Za-z]/.test(tok)) {
+            if (tok === "@")
+              continue;
+            return null;
+          }
+          if (defStart) {
+            if (tok !== "query" && tok !== "mutation" && tok !== "fragment")
+              return null;
+            kind = tok;
+            defStart = false;
+          }
+          continue;
+        }
+        if (depth > 1 || !current)
+          continue;
+        if (/^[_A-Za-z]/.test(tok)) {
+          if (last === "@")
+            continue;
+          if (last === ":") {
+            if (current.roots.length === 0)
+              return null;
+            current.roots[current.roots.length - 1] = tok;
+            continue;
+          }
+          current.roots.push(tok);
+          continue;
+        }
+        if (tok === ":" || tok === "@")
+          continue;
+        return null;
+      }
+      return depth === 0 && parens === 0 && objects === 0 ? ops : null;
+    }
     function isGraphqlQueryOnly(postData) {
       if (!postData || postData.length > MAX_BODY_CHARS)
         return false;
@@ -336,6 +434,34 @@ var require_survey_network_guard = __commonJS({
       "remove"
     ]);
     var NOT_A_SESSION_END = (segs) => !segs.some((seg) => SESSION_END_SEGMENTS.has(seg));
+    var DESTRUCTIVE_WORDS = /* @__PURE__ */ new Set([
+      "delete",
+      "remove",
+      "destroy",
+      "deactivate",
+      "terminate",
+      "purge",
+      "wipe",
+      "erase",
+      "cancel",
+      "close",
+      "revoke",
+      "unlink",
+      "disconnect"
+    ]);
+    var DESTRUCTIVE_PREFIXES = ["delete", "remove", "destroy", "deactivate", "terminate", "purge"];
+    function hasDestructiveSegment(rawSegs) {
+      return rawSegs.some((raw) => {
+        let seg = raw;
+        try {
+          seg = decodeURIComponent(raw);
+        } catch {
+        }
+        const words = seg.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/);
+        return words.some((word) => DESTRUCTIVE_WORDS.has(word) || DESTRUCTIVE_PREFIXES.some((p) => word.startsWith(p)));
+      });
+    }
+    var rawPathSegments = (pathname) => pathname.split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     var pathSegments = (pathname) => pathname.toLowerCase().split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     function isTokenRefreshWrite(method, pathname, recentAction = false) {
       if (method.toUpperCase() !== "POST")
@@ -352,6 +478,8 @@ var require_survey_network_guard = __commonJS({
     var AUTH_PAGE_PATH_RE = /(?:^|\/)(?:log-?in|sign-?in|sign_in|auth|oauth2?|sso|callback)(?:\/|$)/;
     var SIGN_IN_SEGMENT_RE = /^(?:log-?in|sign-?in|sign_in)$/;
     var CALLBACK_ROOT_SEGMENTS = /* @__PURE__ */ new Set(["auth", "oauth", "oauth2", "sso"]);
+    var CALLBACK_PROTOCOL_SEGMENTS = /* @__PURE__ */ new Set(["oidc", "openid", "openid-connect", "openidconnect", "saml", "saml2", "oauth", "oauth2"]);
+    var API_VERSION_SEGMENT_RE = /^v[0-9]{1,3}$/;
     var PROVIDER_SEGMENT_RE = /^[a-z][a-z0-9_-]{0,39}$/;
     var NOT_A_PROVIDER_SEGMENTS = /* @__PURE__ */ new Set([
       "link",
@@ -390,14 +518,21 @@ var require_survey_network_guard = __commonJS({
       if (!NOT_A_SESSION_END(segs))
         return false;
       if (AUTH_END_PATH_RE.test(`/${segs.join("/")}`))
-        return true;
+        return !hasDestructiveSegment(rawPathSegments(pathname).slice(0, -1));
+      let top = segs[0] === "api" ? 1 : 0;
+      if (top < segs.length && API_VERSION_SEGMENT_RE.test(segs[top]))
+        top += 1;
+      const below = segs.length - top;
+      const isProvider = (seg) => PROVIDER_SEGMENT_RE.test(seg) && !NOT_A_PROVIDER_SEGMENTS.has(seg);
       const provider = segs[segs.length - 1];
-      const authRootAtTop = segs.length === 3 || segs[segs.length - 4] === "api" && (segs.length === 4 || segs[segs.length - 3] === "auth");
-      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && PROVIDER_SEGMENT_RE.test(provider) && !NOT_A_PROVIDER_SEGMENTS.has(provider)) {
+      const authRootAtTop = below === 3 || segs[segs.length - 4] === "api" && segs[segs.length - 3] === "auth";
+      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && isProvider(provider)) {
         const step = segs[segs.length - 2];
         if (step === "callback" || step === "signin")
           return true;
       }
+      if (below === 4 && CALLBACK_ROOT_SEGMENTS.has(segs[top]) && CALLBACK_PROTOCOL_SEGMENTS.has(segs[top + 1]) && isProvider(segs[top + 2]) && segs[top + 3] === "callback")
+        return true;
       if (segs.length < 2 || segs[segs.length - 1] !== "callback")
         return false;
       const parent = segs[segs.length - 2];
@@ -424,7 +559,7 @@ var require_survey_network_guard = __commonJS({
       try {
         const a = new URL(url);
         const b = new URL(appBaseUrl);
-        const path = (u) => u.pathname.replace(/\/+$/, "");
+        const path = (u) => (0, shared_1.stripTrailingSlashes)(u.pathname);
         return a.origin === b.origin && path(a) === path(b);
       } catch {
         return false;
@@ -446,9 +581,18 @@ var require_survey_network_guard = __commonJS({
       const bodyHash = (0, node_crypto_1.createHash)("sha256").update(req.postData ?? "").digest("hex").slice(0, 16);
       return `${record.method} ${url.hostname.toLowerCase()}${url.pathname} ${bodyHash}`;
     }
-    function isGraphqlGetWrite(url, s) {
-      const doc = url.searchParams.get("query");
-      return doc !== null && isGraphqlEndpoint(url, s) && !graphqlDocumentIsQueryOnly(doc);
+    function graphqlUrlCarriesQuery(params) {
+      return params.has("query");
+    }
+    function graphqlUrlQueriesAreReads(params) {
+      return params.getAll("query").every((doc) => doc.trim() !== "" && graphqlDocumentIsQueryOnly(doc));
+    }
+    function graphqlGetMayWrite(url, body) {
+      const docs = url.searchParams.getAll("query");
+      return docs.length > 0 && (typeof body === "string" && body.length > 0 || docs.some((doc) => !graphqlDocumentIsQueryOnly(doc)));
+    }
+    function isGraphqlGetWrite(url, s, body) {
+      return isGraphqlEndpoint(url, s) && graphqlGetMayWrite(url, body);
     }
     exports.WRITE_VERBS = /* @__PURE__ */ new Set([
       "cancel",
@@ -652,7 +796,7 @@ var require_survey_network_guard = __commonJS({
       if (url.protocol !== "http:" && url.protocol !== "https:")
         return { action: "allow", rule: readMethod ? "read" : "non-http" };
       const appSite = isAppSite(url.hostname, s.appBaseUrl);
-      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s);
+      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s, req.postData);
       const inActionWindow = s.lastActionAt > 0 && s.now - s.lastActionAt <= ACTION_NAVIGATION_WINDOW_MS;
       const typedLoad = s.agentLoad === true && req.resourceType === "document";
       const writeShaped = method === "GET" && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
@@ -686,7 +830,7 @@ var require_survey_network_guard = __commonJS({
         return { action: "allow", rule: "extra-pattern", reason: extra.reason, record };
       if (graphqlGet)
         return { action: "block", rule: "app-write", record };
-      if (method === "POST" && isGraphqlEndpoint(url, s) && isGraphqlQueryOnly(req.postData))
+      if (method === "POST" && isGraphqlEndpoint(url, s) && graphqlUrlQueriesAreReads(url.searchParams) && isGraphqlQueryOnly(req.postData))
         return { action: "allow", rule: "graphql-query", record };
       const passive = s.lastNavigationAt > 0 && (s.lastActionAt === 0 || s.lastNavigationAt >= s.lastActionAt) && s.now - s.lastNavigationAt <= s.passiveWindowMs;
       const signature = learnableSignature(req, url, record, s);
@@ -718,7 +862,7 @@ var require_survey_network_guard = __commonJS({
         const re = new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ""));
         return { reason, test: (hostPath) => re.test(hostPath) };
       }
-      const p = pattern.trim().toLowerCase().replace(/\/+$/, "");
+      const p = (0, shared_1.stripTrailingSlashes)(pattern.trim().toLowerCase());
       if (p.includes("/"))
         return { reason, test: (hostPath) => hostPath.toLowerCase() === p || hostPath.toLowerCase().startsWith(`${p}/`) };
       return { reason, test: (hostPath) => {

package/dist/chunk-E2VEMBQQ.mjs

@@ -0,0 +1,291 @@
+import {
+  require_run_write_guard
+} from "./chunk-4WLP3RWN.mjs";
+import {
+  require_survey_network_guard
+} from "./chunk-E2RRAE27.mjs";
+import {
+  __commonJS,
+  __require
+} from "./chunk-WQXBGQU4.mjs";
+
+// ../runner-core/dist/services/run-write-guard-preload.js
+var require_run_write_guard_preload = __commonJS({
+  "../runner-core/dist/services/run-write-guard-preload.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.VERIFIED_PLAYWRIGHT_CORE = exports.installRunWriteGuard = exports.installNodeFetchGuard = exports.clearRunWriteRelay = exports.addRunWriteBrokerToken = exports.addRunWriteAuthHandler = void 0;
+    exports.describeBuiltRequest = describeBuiltRequest;
+    exports.installHttpGuard = installHttpGuard;
+    exports.installPlaywrightContextGuard = installPlaywrightContextGuard;
+    exports.startRunWriteGuardPreload = startRunWriteGuardPreload;
+    var node_module_1 = __require("module");
+    var node_path_1 = __require("path");
+    var survey_network_guard_js_1 = require_survey_network_guard();
+    var run_write_guard_js_1 = require_run_write_guard();
+    var run_write_guard_js_2 = require_run_write_guard();
+    Object.defineProperty(exports, "addRunWriteAuthHandler", { enumerable: true, get: function() {
+      return run_write_guard_js_2.addRunWriteAuthHandler;
+    } });
+    Object.defineProperty(exports, "addRunWriteBrokerToken", { enumerable: true, get: function() {
+      return run_write_guard_js_2.addRunWriteBrokerToken;
+    } });
+    Object.defineProperty(exports, "clearRunWriteRelay", { enumerable: true, get: function() {
+      return run_write_guard_js_2.clearRunWriteRelay;
+    } });
+    Object.defineProperty(exports, "installNodeFetchGuard", { enumerable: true, get: function() {
+      return run_write_guard_js_2.installNodeFetchGuard;
+    } });
+    Object.defineProperty(exports, "installRunWriteGuard", { enumerable: true, get: function() {
+      return run_write_guard_js_2.installRunWriteGuard;
+    } });
+    var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+    var MAX_DECIDED_BODY_BYTES = 1024 * 1024;
+    function describeBuiltRequest(req) {
+      const method = typeof req.method === "string" && req.method ? req.method.toUpperCase() : "GET";
+      const protocol = req.protocol === "https:" ? "https:" : "http:";
+      const path = typeof req.path === "string" && req.path.startsWith("/") ? req.path : null;
+      if (path === null)
+        throw new Error("unusable request path");
+      if (typeof req.socketPath === "string" && req.socketPath) {
+        return { method, url: `${protocol}//unix-socket.invalid${path}` };
+      }
+      if (typeof req.host !== "string" || !req.host)
+        throw new Error("unusable request host");
+      const host = req.host.includes(":") && !req.host.startsWith("[") ? `[${req.host}]` : req.host;
+      return { method, url: new URL(`${protocol}//${host}${path}`).href };
+    }
+    function headerString(value) {
+      if (typeof value === "string")
+        return value;
+      if (Array.isArray(value))
+        return value.map(String).join(", ");
+      if (typeof value === "number")
+        return String(value);
+      return null;
+    }
+    function installHttpGuard(policy, opts, mod) {
+      if (policy.mode === "off")
+        return void 0;
+      const original = mod.request;
+      if (typeof original !== "function" || original.__vqaWriteGuarded)
+        return void 0;
+      const guard = new run_write_guard_js_1.RunWriteGuard(policy, opts);
+      const wrapped = function guardedRequest(...args) {
+        const req = original.apply(this, args);
+        const fields = req;
+        const connectedTo = { host: fields.host, socketPath: fields.socketPath, protocol: fields.protocol };
+        const chunks = [];
+        let bytes = 0;
+        let state = "pending";
+        const held = () => state === "held";
+        const originalWrite = req.write.bind(req);
+        const originalEnd = req.end.bind(req);
+        const originalFlushHeaders = req.flushHeaders.bind(req);
+        const take = (chunk, encoding) => {
+          if (chunk === void 0 || chunk === null || typeof chunk === "function")
+            return;
+          const buf = Buffer.isBuffer(chunk) ? chunk : chunk instanceof Uint8Array ? Buffer.from(chunk) : Buffer.from(String(chunk), typeof encoding === "string" ? encoding : "utf8");
+          chunks.push(buf);
+          bytes += buf.length;
+        };
+        const decide = (withBody) => {
+          const builtLine = typeof fields._header === "string" ? /^([A-Z]+) (\S+) HTTP\//.exec(fields._header) : null;
+          let described = null;
+          try {
+            described = describeBuiltRequest({
+              ...connectedTo,
+              method: builtLine ? builtLine[1] : fields.method,
+              path: builtLine ? builtLine[2] : fields.path
+            });
+          } catch {
+            described = null;
+          }
+          const moved = fields.host !== connectedTo.host || fields.socketPath !== connectedTo.socketPath || fields.protocol !== connectedTo.protocol;
+          let decision;
+          try {
+            if (!described || moved || typeof fields._header === "string" && !builtLine)
+              throw new Error("undescribable request");
+            const host = new URL(described.url).hostname.toLowerCase();
+            decision = LOOPBACK_HOSTS.has(host) && !policy.appSites.includes(host) ? { action: "allow", rule: "non-http" } : guard.decide({
+              method: described.method,
+              url: described.url,
+              postData: withBody ? Buffer.concat(chunks).toString("utf8") : null,
+              contentType: headerString(req.getHeader("content-type")),
+              amzTarget: headerString(req.getHeader("x-amz-target"))
+            });
+          } catch {
+            decision = {
+              action: "write",
+              rule: "decision-error",
+              record: { method: described?.method ?? "REQUEST", host: "", path: described ? (0, survey_network_guard_js_1.maskedPath)(described.url) : "(undescribable)", keys: [], rule: "decision-error" }
+            };
+          }
+          if (decision.action === "write" && decision.record) {
+            guard.note(decision.record);
+            if (guard.holds(decision.rule)) {
+              state = "held";
+              chunks.length = 0;
+              req.destroy(new Error(`blocked by the run write guard: ${decision.record.method} ${decision.record.host}${decision.record.path}`));
+              return;
+            }
+          }
+          state = "allowed";
+          for (const buf of chunks.splice(0))
+            originalWrite(buf);
+        };
+        req.write = (chunk, encoding, cb) => {
+          const done = typeof encoding === "function" ? encoding : cb;
+          if (state === "allowed")
+            return originalWrite(chunk, encoding, cb);
+          if (state === "pending") {
+            take(chunk, encoding);
+            if (bytes > MAX_DECIDED_BODY_BYTES)
+              decide(false);
+          }
+          if (held()) {
+            if (done)
+              process.nextTick(done, new Error("blocked by the run write guard"));
+            return false;
+          }
+          if (done)
+            process.nextTick(done);
+          return true;
+        };
+        req.flushHeaders = () => {
+          if (state === "allowed")
+            originalFlushHeaders();
+        };
+        req.end = (chunk, encoding, cb) => {
+          if (state === "allowed")
+            return originalEnd(chunk, encoding, cb);
+          if (state === "held")
+            return req;
+          const done = [chunk, encoding, cb].find((a) => typeof a === "function");
+          if (typeof chunk !== "function")
+            take(chunk, typeof encoding === "function" ? void 0 : encoding);
+          decide(bytes <= MAX_DECIDED_BODY_BYTES);
+          if (held())
+            return req;
+          return originalEnd(done);
+        };
+        return req;
+      };
+      Object.defineProperty(wrapped, "__vqaWriteGuarded", { value: true });
+      const wrappedGet = function guardedGet(...args) {
+        const req = wrapped.apply(this, args);
+        req.end();
+        return req;
+      };
+      Object.defineProperty(wrappedGet, "__vqaWriteGuarded", { value: true });
+      const install = (name, value) => {
+        if (policy.mode === "block") {
+          Object.defineProperty(mod, name, { value, writable: false, configurable: false, enumerable: true });
+        } else {
+          mod[name] = value;
+        }
+      };
+      install("request", wrapped);
+      if (typeof mod.get === "function")
+        install("get", wrappedGet);
+      return guard;
+    }
+    exports.VERIFIED_PLAYWRIGHT_CORE = /^1\.64\./;
+    function installPlaywrightContextGuard(policy, opts, from = __filename) {
+      if (policy.mode === "off")
+        return true;
+      let pw;
+      let version = "";
+      try {
+        const req = (0, node_module_1.createRequire)(from);
+        let base = from;
+        try {
+          base = (0, node_path_1.dirname)(req.resolve("@playwright/test/package.json"));
+        } catch {
+        }
+        try {
+          base = (0, node_path_1.dirname)((0, node_module_1.createRequire)(`${base}/`).resolve("playwright/package.json"));
+        } catch {
+        }
+        const fromPlaywright = (0, node_module_1.createRequire)(`${base}/`);
+        version = String(fromPlaywright("playwright-core/package.json").version ?? "");
+        pw = fromPlaywright("playwright-core");
+      } catch {
+        return false;
+      }
+      if (!exports.VERIFIED_PLAYWRIGHT_CORE.test(version)) {
+        if (policy.mode === "block")
+          return false;
+        opts.onLog?.(`[run-write-guard] observe: playwright-core ${version || "(unknown)"} is not a version the context hook was verified on`);
+      }
+      const add = pw?._instrumentation?.addListener;
+      if (typeof add !== "function")
+        return false;
+      add.call(pw._instrumentation, {
+        // Block mode: the context's service workers are off (design §4), whatever the test asked for.
+        // Playwright passes the options object it builds the context from (browser.newContext,
+        // launchPersistentContext); a context whose options cannot be set is still routed below.
+        runBeforeCreateBrowserContext: async (options) => {
+          if (options && typeof options === "object")
+            Object.assign(options, (0, run_write_guard_js_1.runWriteContextOptions)(policy));
+        },
+        runAfterCreateBrowserContext: async (context) => {
+          await (0, run_write_guard_js_1.installRunWriteGuard)(context, policy, opts);
+        }
+      });
+      return true;
+    }
+    function startRunWriteGuardPreload(env = process.env) {
+      const raw = env[run_write_guard_js_1.RUN_WRITE_POLICY_ENV];
+      if (!raw)
+        return [];
+      let policy = null;
+      try {
+        policy = (0, run_write_guard_js_1.parseRunWritePolicy)(JSON.parse(raw));
+      } catch {
+        policy = null;
+      }
+      if (!policy) {
+        console.log(`${run_write_guard_js_1.RUN_WRITE_UNAVAILABLE_LINE}the run write policy could not be read`);
+        return ["policy"];
+      }
+      if (policy.mode === "off")
+        return [];
+      const names = (env[run_write_guard_js_1.RUN_WRITE_SIGNIN_VARS_ENV] ?? "").split(",").map((n) => n.trim()).filter((n) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(n)).slice(0, 16);
+      const signInSecrets = names.map((n) => env[n]).filter((v) => typeof v === "string");
+      const opts = { onLog: (line) => console.log(line), signInSecrets };
+      const missing = [];
+      try {
+        (0, run_write_guard_js_1.installNodeFetchGuard)(policy, opts);
+      } catch {
+        missing.push("fetch");
+      }
+      const nodeRequire = (0, node_module_1.createRequire)(__filename);
+      try {
+        installHttpGuard(policy, opts, nodeRequire("node:http"));
+      } catch {
+        missing.push("http");
+      }
+      try {
+        installHttpGuard(policy, opts, nodeRequire("node:https"));
+      } catch {
+        missing.push("https");
+      }
+      try {
+        (0, node_module_1.syncBuiltinESMExports)();
+      } catch {
+      }
+      if (!installPlaywrightContextGuard(policy, opts))
+        missing.push("browser contexts");
+      for (const piece of missing)
+        console.log(`${run_write_guard_js_1.RUN_WRITE_UNAVAILABLE_LINE}the preload could not guard ${piece}`);
+      return missing;
+    }
+    if (process.env[run_write_guard_js_1.RUN_WRITE_POLICY_ENV])
+      startRunWriteGuardPreload();
+  }
+});
+
+export {
+  require_run_write_guard_preload
+};