@vendure/core 3.6.4-master-202605180309 → 3.6.4-master-202605200308
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/resolvers/admin/promotion.resolver.js +9 -2
- package/dist/api/resolvers/admin/promotion.resolver.js.map +1 -1
- package/dist/config/asset-import-strategy/assert-public-url.d.ts +37 -0
- package/dist/config/asset-import-strategy/assert-public-url.js +170 -0
- package/dist/config/asset-import-strategy/assert-public-url.js.map +1 -0
- package/dist/config/asset-import-strategy/default-asset-import-strategy.d.ts +37 -4
- package/dist/config/asset-import-strategy/default-asset-import-strategy.js +58 -15
- package/dist/config/asset-import-strategy/default-asset-import-strategy.js.map +1 -1
- package/dist/config/index.d.ts +1 -0
- package/dist/config/index.js +1 -0
- package/dist/config/index.js.map +1 -1
- package/dist/migration-utils/v3_6_asset_translations.js +11 -2
- package/dist/migration-utils/v3_6_asset_translations.js.map +1 -1
- package/package.json +2 -2
|
@@ -56,12 +56,19 @@ let PromotionResolver = class PromotionResolver {
|
|
|
56
56
|
return this.promotionService.getPromotionActions(ctx);
|
|
57
57
|
}
|
|
58
58
|
createPromotion(ctx, args) {
|
|
59
|
-
|
|
59
|
+
// Note: PromotionItemAction and PromotionOrderAction share the same
|
|
60
|
+
// pool of action defs in getAvailableDefsOfType(), so a single call
|
|
61
|
+
// with either type will decode ID args for all promotion actions.
|
|
62
|
+
this.configurableOperationCodec.decodeConfigurableOperationIds(promotion_action_1.PromotionItemAction, args.input.actions);
|
|
60
63
|
this.configurableOperationCodec.decodeConfigurableOperationIds(promotion_condition_1.PromotionCondition, args.input.conditions);
|
|
61
64
|
return this.promotionService.createPromotion(ctx, args.input).then(this.encodeConditionsAndActions);
|
|
62
65
|
}
|
|
63
66
|
updatePromotion(ctx, args) {
|
|
64
|
-
|
|
67
|
+
// Note: PromotionItemAction and PromotionOrderAction share the same
|
|
68
|
+
// pool of action defs in getAvailableDefsOfType(), so a single call
|
|
69
|
+
// with either type will decode ID args for all promotion actions.
|
|
70
|
+
// Calling decode twice on the same input array would cause double-decoding,
|
|
71
|
+
// which breaks custom EntityIdStrategies (e.g. hashed IDs).
|
|
65
72
|
this.configurableOperationCodec.decodeConfigurableOperationIds(promotion_action_1.PromotionItemAction, args.input.actions || []);
|
|
66
73
|
this.configurableOperationCodec.decodeConfigurableOperationIds(promotion_condition_1.PromotionCondition, args.input.conditions || []);
|
|
67
74
|
return this.promotionService.updatePromotion(ctx, args.input).then(this.encodeConditionsAndActions);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"promotion.resolver.js","sourceRoot":"","sources":["../../../../src/api/resolvers/admin/promotion.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAkE;AAClE,yEAa6C;AAI7C,iFAAuG;AACvG,uFAAmF;AACnF,iFAAuE;AACvE,mFAA+E;AAC/E,4FAAuF;AACvF,kEAA8D;AAC9D,sEAAyD;AACzD,8EAAgF;AAChF,0FAAiE;AACjE,kFAAqE;AAG9D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC1B,YACY,gBAAkC,EAClC,0BAAsD;QADtD,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,+BAA0B,GAA1B,0BAA0B,CAA4B;
|
|
1
|
+
{"version":3,"file":"promotion.resolver.js","sourceRoot":"","sources":["../../../../src/api/resolvers/admin/promotion.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAkE;AAClE,yEAa6C;AAI7C,iFAAuG;AACvG,uFAAmF;AACnF,iFAAuE;AACvE,mFAA+E;AAC/E,4FAAuF;AACvF,kEAA8D;AAC9D,sEAAyD;AACzD,8EAAgF;AAChF,0FAAiE;AACjE,kFAAqE;AAG9D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC1B,YACY,gBAAkC,EAClC,0BAAsD;QADtD,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,+BAA0B,GAA1B,0BAA0B,CAA4B;QA0HlE;;WAEG;QACK,+BAA0B,GAAG,CAGjC,cAAiB,EAChB,EAAE;YACH,IAAI,cAAc,YAAY,4BAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,0BAA0B,CAAC,8BAA8B,CAC1D,uCAAoB,EACpB,cAAc,CAAC,OAAO,CACzB,CAAC;gBACF,IAAI,CAAC,0BAA0B,CAAC,8BAA8B,CAC1D,wCAAkB,EAClB,cAAc,CAAC,UAAU,CAC5B,CAAC;YACN,CAAC;YACD,OAAO,cAAc,CAAC;QAC1B,CAAC,CAAC;IA5IC,CAAC;IAIJ,UAAU,CACC,GAAmB,EAClB,IAAyB,EACX,SAAmC;QAEzD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACvF,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACnD,OAAO,GAAG,CAAC;QACf,CAAC,CAAC,CAAC;IACP,CAAC;IAID,SAAS,CACE,GAAmB,EAClB,IAAwB,EACV,SAAmC;QAEzD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxG,CAAC;IAID,mBAAmB,CAAQ,GAAmB;QAC1C,OAAO,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAID,gBAAgB,CAAQ,GAAmB;QACvC,OAAO,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IAKD,eAAe,CACJ,GAAmB,EAClB,IAAiC;QAEzC,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,IAAI,CAAC,0BAA0B,CAAC,8BAA8B,CAC1D,sCAAmB,EACnB,IAAI,CAAC,KAAK,CAAC,OAAO,CACrB,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,8BAA8B,CAC1D,wCAAkB,EAClB,IAAI,CAAC,KAAK,CAAC,UAAU,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxG,CAAC;IAKD,eAAe,CACJ,GAAmB,EAClB,IAAiC;QAEzC,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,CAAC,0BAA0B,CAAC,8BAA8B,CAC1D,sCAAmB,EACnB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAC3B,CAAC;QACF,IAAI,CAAC,0BAA0B,CAAC,8BAA8B,CAC1D,wCAAkB,EAClB,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAC9B,CAAC;QACF,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxG,CAAC;IAKD,eAAe,CACJ,GAAmB,EAClB,IAAiC;QAEzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAKD,gBAAgB,CACL,GAAmB,EAClB,IAAkC;QAE1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAKD,yBAAyB,CACd,GAAmB,EAClB,IAA2C;QAEnD,OAAO,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAKD,2BAA2B,CAChB,GAAmB,EAClB,IAA6C;QAErD,OAAO,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;CAsBJ,CAAA;AAjJY,8CAAiB;AAQ1B;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,uBAAK,EAAC,4BAAU,CAAC,aAAa,CAAC;IAE3B,WAAA,IAAA,+BAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;IACN,WAAA,IAAA,+BAAS,EAAC,4BAAS,CAAC,CAAA;;qCAFT,gCAAc;;mDAQ7B;AAID;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,uBAAK,EAAC,4BAAU,CAAC,aAAa,CAAC;IAE3B,WAAA,IAAA,+BAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;IACN,WAAA,IAAA,+BAAS,EAAC,4BAAS,CAAC,CAAA;;qCAFT,gCAAc;;kDAK7B;AAID;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,uBAAK,EAAC,4BAAU,CAAC,aAAa,CAAC;IACX,WAAA,IAAA,+BAAG,GAAE,CAAA;;qCAAM,gCAAc;;4DAE7C;AAID;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,uBAAK,EAAC,4BAAU,CAAC,aAAa,CAAC;IACd,WAAA,IAAA,+BAAG,GAAE,CAAA;;qCAAM,gCAAc;;yDAE1C;AAKD;IAHC,IAAA,mCAAW,GAAE;IACb,IAAA,kBAAQ,GAAE;IACV,IAAA,uBAAK,EAAC,4BAAU,CAAC,eAAe,CAAC;IAE7B,WAAA,IAAA,+BAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;;qCADK,gCAAc;;wDAe7B;AAKD;IAHC,IAAA,mCAAW,GAAE;IACb,IAAA,kBAAQ,GAAE;IACV,IAAA,uBAAK,EAAC,4BAAU,CAAC,eAAe,CAAC;IAE7B,WAAA,IAAA,+BAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;;qCADK,gCAAc;;wDAiB7B;AAKD;IAHC,IAAA,mCAAW,GAAE;IACb,IAAA,kBAAQ,GAAE;IACV,IAAA,uBAAK,EAAC,4BAAU,CAAC,eAAe,CAAC;IAE7B,WAAA,IAAA,+BAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;;qCADK,gCAAc;;wDAI7B;AAKD;IAHC,IAAA,mCAAW,GAAE;IACb,IAAA,kBAAQ,GAAE;IACV,IAAA,uBAAK,EAAC,4BAAU,CAAC,eAAe,CAAC;IAE7B,WAAA,IAAA,+BAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;;qCADK,gCAAc;;yDAI7B;AAKD;IAHC,IAAA,mCAAW,GAAE;IACb,IAAA,kBAAQ,GAAE;IACV,IAAA,uBAAK,EAAC,4BAAU,CAAC,eAAe,CAAC;IAE7B,WAAA,IAAA,+BAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;;qCADK,gCAAc;;kEAI7B;AAKD;IAHC,IAAA,mCAAW,GAAE;IACb,IAAA,kBAAQ,GAAE;IACV,IAAA,uBAAK,EAAC,4BAAU,CAAC,eAAe,CAAC;IAE7B,WAAA,IAAA,+BAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;;qCADK,gCAAc;;oEAI7B;4BA3HQ,iBAAiB;IAD7B,IAAA,kBAAQ,EAAC,WAAW,CAAC;qCAGY,oCAAgB;QACN,yDAA0B;GAHzD,iBAAiB,CAiJ7B"}
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
export interface PinnedAddress {
|
|
2
|
+
address: string;
|
|
3
|
+
family: 4 | 6;
|
|
4
|
+
}
|
|
5
|
+
export type DnsResolverFn = (hostname: string) => Promise<Array<{
|
|
6
|
+
address: string;
|
|
7
|
+
family: number;
|
|
8
|
+
}>>;
|
|
9
|
+
/**
|
|
10
|
+
* @description
|
|
11
|
+
* Validates a URL before allowing the asset importer to fetch it. Rejects:
|
|
12
|
+
* - non-http(s) schemes
|
|
13
|
+
* - hostnames that resolve to private, loopback, link-local, IPv4-mapped IPv6
|
|
14
|
+
* or other non-public address ranges (covers SSRF against cloud metadata and
|
|
15
|
+
* internal services)
|
|
16
|
+
*
|
|
17
|
+
* On success, returns the parsed URL plus the address that was validated so the
|
|
18
|
+
* caller can connect directly to that IP. Pinning the validated IP for the
|
|
19
|
+
* subsequent fetch closes the DNS-rebinding TOCTOU window — without it,
|
|
20
|
+
* `http.get` would perform a second, independent DNS lookup and could resolve
|
|
21
|
+
* the same hostname to a private IP this time around.
|
|
22
|
+
*
|
|
23
|
+
* On failure, the thrown {@link InternalServerError} carries a generic message;
|
|
24
|
+
* the specific reason (URL, resolved IP, remediation hint) is emitted via
|
|
25
|
+
* `Logger.warn` so operators can see it without the client learning about the
|
|
26
|
+
* `allowPrivateNetworks` bypass.
|
|
27
|
+
*
|
|
28
|
+
* Exported for unit testing; production callers should not pass a resolver
|
|
29
|
+
* override.
|
|
30
|
+
*/
|
|
31
|
+
export declare function assertPublicUrl(urlString: string, options?: {
|
|
32
|
+
allowPrivateNetworks?: boolean;
|
|
33
|
+
resolver?: DnsResolverFn;
|
|
34
|
+
}): Promise<{
|
|
35
|
+
url: URL;
|
|
36
|
+
pinned: PinnedAddress | null;
|
|
37
|
+
}>;
|
|
@@ -0,0 +1,170 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.assertPublicUrl = assertPublicUrl;
|
|
4
|
+
const promises_1 = require("dns/promises");
|
|
5
|
+
const net_1 = require("net");
|
|
6
|
+
const errors_1 = require("../../common/error/errors");
|
|
7
|
+
const vendure_logger_1 = require("../logger/vendure-logger");
|
|
8
|
+
const loggerCtx = 'DefaultAssetImportStrategy';
|
|
9
|
+
/**
|
|
10
|
+
* BlockList covering private, loopback, link-local, IPv4-mapped IPv6, 6to4,
|
|
11
|
+
* Teredo, NAT64, discard and unspecified ranges. Used by {@link assertPublicUrl}
|
|
12
|
+
* to prevent the `DefaultAssetImportStrategy` from issuing requests that could
|
|
13
|
+
* be abused for server-side request forgery against the host's internal network
|
|
14
|
+
* or cloud metadata services (e.g. `169.254.169.254`).
|
|
15
|
+
*/
|
|
16
|
+
const privateBlockList = (() => {
|
|
17
|
+
const bl = new net_1.BlockList();
|
|
18
|
+
// IPv4
|
|
19
|
+
bl.addSubnet('0.0.0.0', 8); // current network
|
|
20
|
+
bl.addSubnet('10.0.0.0', 8); // RFC 1918
|
|
21
|
+
bl.addSubnet('100.64.0.0', 10); // CGNAT (RFC 6598)
|
|
22
|
+
bl.addSubnet('127.0.0.0', 8); // loopback
|
|
23
|
+
bl.addSubnet('169.254.0.0', 16); // link-local + cloud metadata
|
|
24
|
+
bl.addSubnet('172.16.0.0', 12); // RFC 1918
|
|
25
|
+
bl.addSubnet('192.0.0.0', 24); // IETF protocol assignments
|
|
26
|
+
bl.addSubnet('192.168.0.0', 16); // RFC 1918
|
|
27
|
+
bl.addSubnet('198.18.0.0', 15); // network benchmarking
|
|
28
|
+
// IPv6
|
|
29
|
+
bl.addAddress('::', 'ipv6'); // unspecified
|
|
30
|
+
bl.addAddress('::1', 'ipv6'); // loopback
|
|
31
|
+
bl.addSubnet('64:ff9b::', 96, 'ipv6'); // NAT64 (could tunnel to private v4)
|
|
32
|
+
bl.addSubnet('100::', 64, 'ipv6'); // discard prefix
|
|
33
|
+
bl.addSubnet('2001::', 32, 'ipv6'); // Teredo
|
|
34
|
+
bl.addSubnet('2002::', 16, 'ipv6'); // 6to4
|
|
35
|
+
bl.addSubnet('fc00::', 7, 'ipv6'); // unique local
|
|
36
|
+
bl.addSubnet('fe80::', 10, 'ipv6'); // link-local
|
|
37
|
+
// IPv4-mapped IPv6 (`::ffff:a.b.c.d`) is handled separately in
|
|
38
|
+
// `isBlocked()` below — adding it as a BlockList subnet would create false
|
|
39
|
+
// positives for plain IPv4 lookups due to a Node-internal v6→v4 projection.
|
|
40
|
+
return bl;
|
|
41
|
+
})();
|
|
42
|
+
/**
|
|
43
|
+
* Matches `::ffff:` prefix in any casing. The trailing segment is checked with
|
|
44
|
+
* `isIP` rather than parsed by us, so this regex only gates the lookup.
|
|
45
|
+
*/
|
|
46
|
+
const IPV4_MAPPED_IPV6_PREFIX = /^::ffff:/i;
|
|
47
|
+
/**
|
|
48
|
+
* Checks an address against the private BlockList. Handles IPv4-mapped IPv6
|
|
49
|
+
* addresses (`::ffff:a.b.c.d`) by extracting the embedded IPv4 and re-checking
|
|
50
|
+
* against the IPv4 ranges — Node's BlockList does not project v6 → v4
|
|
51
|
+
* automatically, and adding the `::ffff:0:0/96` subnet to the BlockList causes
|
|
52
|
+
* plain IPv4 lookups to false-positive due to an internal mapping quirk.
|
|
53
|
+
*/
|
|
54
|
+
function isBlocked(address, family) {
|
|
55
|
+
if (family === 6 && IPV4_MAPPED_IPV6_PREFIX.test(address)) {
|
|
56
|
+
const embedded = address.slice('::ffff:'.length);
|
|
57
|
+
if ((0, net_1.isIP)(embedded) === 4) {
|
|
58
|
+
return privateBlockList.check(embedded, 'ipv4');
|
|
59
|
+
}
|
|
60
|
+
// Hex-form IPv4-mapped (e.g. `::ffff:7f00:1`). Convert the trailing two
|
|
61
|
+
// 16-bit groups to dotted-quad and re-check.
|
|
62
|
+
const hexMatch = embedded.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
|
|
63
|
+
if (hexMatch) {
|
|
64
|
+
const high = parseInt(hexMatch[1], 16);
|
|
65
|
+
const low = parseInt(hexMatch[2], 16);
|
|
66
|
+
if (Number.isFinite(high) && Number.isFinite(low) && high <= 0xffff && low <= 0xffff) {
|
|
67
|
+
/* eslint-disable no-bitwise */
|
|
68
|
+
const dotted = [(high >> 8) & 0xff, high & 0xff, (low >> 8) & 0xff, low & 0xff].join('.');
|
|
69
|
+
/* eslint-enable no-bitwise */
|
|
70
|
+
return privateBlockList.check(dotted, 'ipv4');
|
|
71
|
+
}
|
|
72
|
+
}
|
|
73
|
+
// Fall through: an unparseable `::ffff:` form is itself suspicious. Block.
|
|
74
|
+
return true;
|
|
75
|
+
}
|
|
76
|
+
return privateBlockList.check(address, family === 6 ? 'ipv6' : 'ipv4');
|
|
77
|
+
}
|
|
78
|
+
const MAX_LOGGED_URL_LENGTH = 200;
|
|
79
|
+
const GENERIC_REJECTION_MESSAGE = 'Refusing to fetch asset URL: target is not a public network address';
|
|
80
|
+
const GENERIC_INVALID_URL_MESSAGE = 'Refusing to fetch asset URL: invalid or unsupported URL';
|
|
81
|
+
/**
|
|
82
|
+
* Truncates and strips control characters from a URL before it is embedded in
|
|
83
|
+
* log messages. Prevents log forgery via CRLF injection in attacker-controlled
|
|
84
|
+
* URLs.
|
|
85
|
+
*/
|
|
86
|
+
function safeForLog(value) {
|
|
87
|
+
return value.replace(/[\x00-\x1f\x7f]/g, '?').slice(0, MAX_LOGGED_URL_LENGTH);
|
|
88
|
+
}
|
|
89
|
+
const defaultResolver = hostname => (0, promises_1.lookup)(hostname, { all: true, verbatim: true });
|
|
90
|
+
/**
|
|
91
|
+
* @description
|
|
92
|
+
* Validates a URL before allowing the asset importer to fetch it. Rejects:
|
|
93
|
+
* - non-http(s) schemes
|
|
94
|
+
* - hostnames that resolve to private, loopback, link-local, IPv4-mapped IPv6
|
|
95
|
+
* or other non-public address ranges (covers SSRF against cloud metadata and
|
|
96
|
+
* internal services)
|
|
97
|
+
*
|
|
98
|
+
* On success, returns the parsed URL plus the address that was validated so the
|
|
99
|
+
* caller can connect directly to that IP. Pinning the validated IP for the
|
|
100
|
+
* subsequent fetch closes the DNS-rebinding TOCTOU window — without it,
|
|
101
|
+
* `http.get` would perform a second, independent DNS lookup and could resolve
|
|
102
|
+
* the same hostname to a private IP this time around.
|
|
103
|
+
*
|
|
104
|
+
* On failure, the thrown {@link InternalServerError} carries a generic message;
|
|
105
|
+
* the specific reason (URL, resolved IP, remediation hint) is emitted via
|
|
106
|
+
* `Logger.warn` so operators can see it without the client learning about the
|
|
107
|
+
* `allowPrivateNetworks` bypass.
|
|
108
|
+
*
|
|
109
|
+
* Exported for unit testing; production callers should not pass a resolver
|
|
110
|
+
* override.
|
|
111
|
+
*/
|
|
112
|
+
async function assertPublicUrl(urlString, options = {}) {
|
|
113
|
+
var _a;
|
|
114
|
+
let url;
|
|
115
|
+
try {
|
|
116
|
+
url = new URL(urlString);
|
|
117
|
+
}
|
|
118
|
+
catch (_) {
|
|
119
|
+
vendure_logger_1.Logger.warn(`Refusing to fetch invalid URL: ${safeForLog(urlString)}`, loggerCtx);
|
|
120
|
+
throw new errors_1.InternalServerError(GENERIC_INVALID_URL_MESSAGE);
|
|
121
|
+
}
|
|
122
|
+
if (url.protocol !== 'http:' && url.protocol !== 'https:') {
|
|
123
|
+
vendure_logger_1.Logger.warn(`Refusing to fetch URL with unsupported protocol "${url.protocol}": ${safeForLog(urlString)}`, loggerCtx);
|
|
124
|
+
throw new errors_1.InternalServerError(GENERIC_INVALID_URL_MESSAGE);
|
|
125
|
+
}
|
|
126
|
+
if (options.allowPrivateNetworks) {
|
|
127
|
+
return { url, pinned: null };
|
|
128
|
+
}
|
|
129
|
+
// WHATWG URL keeps the brackets around IPv6 literals in `hostname`; strip
|
|
130
|
+
// them so `isIP` and the BlockList can parse the address. Also drop any
|
|
131
|
+
// zone-id suffix (e.g. `fe80::1%eth0`) since BlockList does not accept
|
|
132
|
+
// zone-tagged addresses.
|
|
133
|
+
const hostname = url.hostname.replace(/^\[|\]$/g, '').replace(/%.*$/, '');
|
|
134
|
+
const resolve = (_a = options.resolver) !== null && _a !== void 0 ? _a : defaultResolver;
|
|
135
|
+
let addresses;
|
|
136
|
+
const literalFamily = (0, net_1.isIP)(hostname);
|
|
137
|
+
if (literalFamily === 4 || literalFamily === 6) {
|
|
138
|
+
addresses = [{ address: hostname, family: literalFamily }];
|
|
139
|
+
}
|
|
140
|
+
else if (literalFamily === 0 && hostname.length > 0) {
|
|
141
|
+
try {
|
|
142
|
+
addresses = await resolve(hostname);
|
|
143
|
+
}
|
|
144
|
+
catch (e) {
|
|
145
|
+
const message = e instanceof Error ? e.message : String(e);
|
|
146
|
+
vendure_logger_1.Logger.warn(`Refusing to fetch ${safeForLog(urlString)}: DNS lookup failed (${safeForLog(message)})`, loggerCtx);
|
|
147
|
+
throw new errors_1.InternalServerError(GENERIC_REJECTION_MESSAGE);
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
else {
|
|
151
|
+
vendure_logger_1.Logger.warn(`Refusing to fetch URL with empty hostname: ${safeForLog(urlString)}`, loggerCtx);
|
|
152
|
+
throw new errors_1.InternalServerError(GENERIC_INVALID_URL_MESSAGE);
|
|
153
|
+
}
|
|
154
|
+
for (const { address, family } of addresses) {
|
|
155
|
+
const normalisedFamily = family === 6 ? 6 : 4;
|
|
156
|
+
if (isBlocked(address, normalisedFamily)) {
|
|
157
|
+
vendure_logger_1.Logger.warn(`Refusing to fetch ${safeForLog(urlString)}: resolves to non-public address ${address}. ` +
|
|
158
|
+
'Set `assetImportStrategy: new DefaultAssetImportStrategy({ allowPrivateNetworks: true })` ' +
|
|
159
|
+
'in your VendureConfig if this is intentional (e.g. a trusted internal asset server).', loggerCtx);
|
|
160
|
+
throw new errors_1.InternalServerError(GENERIC_REJECTION_MESSAGE);
|
|
161
|
+
}
|
|
162
|
+
}
|
|
163
|
+
const first = addresses[0];
|
|
164
|
+
const pinned = {
|
|
165
|
+
address: first.address,
|
|
166
|
+
family: first.family === 6 ? 6 : 4,
|
|
167
|
+
};
|
|
168
|
+
return { url, pinned };
|
|
169
|
+
}
|
|
170
|
+
//# sourceMappingURL=assert-public-url.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"assert-public-url.js","sourceRoot":"","sources":["../../../src/config/asset-import-strategy/assert-public-url.ts"],"names":[],"mappings":";;AA4HA,0CAsEC;AAlMD,2CAAsC;AACtC,6BAAsC;AAEtC,sDAAgE;AAChE,6DAAkD;AAElD,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE;IAC3B,MAAM,EAAE,GAAG,IAAI,eAAS,EAAE,CAAC;IAC3B,OAAO;IACP,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;IAC9C,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;IACxC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB;IACnD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;IACzC,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,8BAA8B;IAC/D,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;IAC3C,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,4BAA4B;IAC3D,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;IAC5C,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB;IACvD,OAAO;IACP,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc;IAC3C,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;IACzC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,qCAAqC;IAC5E,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB;IACpD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;IAC7C,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO;IAC3C,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe;IAClD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa;IACjD,+DAA+D;IAC/D,2EAA2E;IAC3E,4EAA4E;IAC5E,OAAO,EAAE,CAAC;AACd,CAAC,CAAC,EAAE,CAAC;AAEL;;;GAGG;AACH,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAE5C;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,MAAa;IAC7C,IAAI,MAAM,KAAK,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,IAAA,UAAI,EAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,wEAAwE;QACxE,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACtE,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;gBACnF,+BAA+B;gBAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1F,8BAA8B;gBAC9B,OAAO,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClD,CAAC;QACL,CAAC;QACD,2EAA2E;QAC3E,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,yBAAyB,GAAG,qEAAqE,CAAC;AACxG,MAAM,2BAA2B,GAAG,yDAAyD,CAAC;AAE9F;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAClF,CAAC;AASD,MAAM,eAAe,GAAkB,QAAQ,CAAC,EAAE,CAAC,IAAA,iBAAM,EAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,UAAU,eAAe,CACjC,SAAiB,EACjB,UAAwE,EAAE;;IAE1E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,uBAAM,CAAC,IAAI,CAAC,kCAAkC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAClF,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,uBAAM,CAAC,IAAI,CACP,oDAAoD,GAAG,CAAC,QAAQ,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,EAC7F,SAAS,CACZ,CAAC;QACF,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,yBAAyB;IACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,eAAe,CAAC;IAEpD,IAAI,SAAqD,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAA,UAAI,EAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,aAAa,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC7C,SAAS,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACD,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,uBAAM,CAAC,IAAI,CACP,qBAAqB,UAAU,CAAC,SAAS,CAAC,wBAAwB,UAAU,CAAC,OAAO,CAAC,GAAG,EACxF,SAAS,CACZ,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,uBAAM,CAAC,IAAI,CAAC,8CAA8C,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9F,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAU,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACvC,uBAAM,CAAC,IAAI,CACP,qBAAqB,UAAU,CAAC,SAAS,CAAC,oCAAoC,OAAO,IAAI;gBACrF,4FAA4F;gBAC5F,sFAAsF,EAC1F,SAAS,CACZ,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAkB;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC"}
|
|
@@ -1,6 +1,42 @@
|
|
|
1
1
|
import { Readable } from 'stream';
|
|
2
2
|
import { Injector } from '../../common/injector';
|
|
3
3
|
import { AssetImportStrategy } from './asset-import-strategy';
|
|
4
|
+
/**
|
|
5
|
+
* @description
|
|
6
|
+
* Options for {@link DefaultAssetImportStrategy}.
|
|
7
|
+
*
|
|
8
|
+
* @since 1.7.0
|
|
9
|
+
* @docsCategory import-export
|
|
10
|
+
*/
|
|
11
|
+
export interface DefaultAssetImportStrategyOptions {
|
|
12
|
+
/**
|
|
13
|
+
* @description
|
|
14
|
+
* Delay between retries when a fetch fails, in milliseconds.
|
|
15
|
+
*
|
|
16
|
+
* @default 200
|
|
17
|
+
*/
|
|
18
|
+
retryDelayMs?: number;
|
|
19
|
+
/**
|
|
20
|
+
* @description
|
|
21
|
+
* Maximum number of retries when a fetch fails.
|
|
22
|
+
*
|
|
23
|
+
* @default 3
|
|
24
|
+
*/
|
|
25
|
+
retryCount?: number;
|
|
26
|
+
/**
|
|
27
|
+
* @description
|
|
28
|
+
* If `true`, the strategy permits fetching from hostnames that resolve to
|
|
29
|
+
* private, loopback, link-local or other non-public IP addresses. The
|
|
30
|
+
* default `false` rejects such hostnames in order to mitigate server-side
|
|
31
|
+
* request forgery against the host's internal network and cloud metadata
|
|
32
|
+
* services. Enable only when importing from a trusted internal asset
|
|
33
|
+
* server or for local development.
|
|
34
|
+
*
|
|
35
|
+
* @default false
|
|
36
|
+
* @since 3.6.4
|
|
37
|
+
*/
|
|
38
|
+
allowPrivateNetworks?: boolean;
|
|
39
|
+
}
|
|
4
40
|
/**
|
|
5
41
|
* @description
|
|
6
42
|
* The DefaultAssetImportStrategy is able to import paths from the local filesystem (taking into account the
|
|
@@ -12,10 +48,7 @@ import { AssetImportStrategy } from './asset-import-strategy';
|
|
|
12
48
|
export declare class DefaultAssetImportStrategy implements AssetImportStrategy {
|
|
13
49
|
private options?;
|
|
14
50
|
private configService;
|
|
15
|
-
constructor(options?:
|
|
16
|
-
retryDelayMs: number;
|
|
17
|
-
retryCount: number;
|
|
18
|
-
} | undefined);
|
|
51
|
+
constructor(options?: DefaultAssetImportStrategyOptions | undefined);
|
|
19
52
|
init(injector: Injector): void;
|
|
20
53
|
getStreamFromPath(assetPath: string): Readable | Promise<Readable>;
|
|
21
54
|
private getStreamFromUrl;
|
|
@@ -10,25 +10,67 @@ const https_1 = __importDefault(require("https"));
|
|
|
10
10
|
const path_1 = __importDefault(require("path"));
|
|
11
11
|
const rxjs_1 = require("rxjs");
|
|
12
12
|
const operators_1 = require("rxjs/operators");
|
|
13
|
-
const url_1 = require("url");
|
|
14
13
|
const config_service_1 = require("../config.service");
|
|
15
14
|
const vendure_logger_1 = require("../logger/vendure-logger");
|
|
16
|
-
|
|
15
|
+
const assert_public_url_1 = require("./assert-public-url");
|
|
16
|
+
const loggerCtx = 'DefaultAssetImportStrategy';
|
|
17
|
+
const MAX_LOGGED_URL_LENGTH = 200;
|
|
18
|
+
function safeForLog(value) {
|
|
19
|
+
return value.replace(/[\x00-\x1f\x7f]/g, '?').slice(0, MAX_LOGGED_URL_LENGTH);
|
|
20
|
+
}
|
|
21
|
+
/**
|
|
22
|
+
* Issues an HTTP(S) GET for the asset. If `pinned` is provided, the request is
|
|
23
|
+
* directed at that exact IP address with the original hostname preserved in the
|
|
24
|
+
* `Host` header (and as the TLS SNI `servername` for HTTPS). This avoids a
|
|
25
|
+
* second, independent DNS lookup that could resolve the hostname to a private
|
|
26
|
+
* IP between {@link assertPublicUrl} validation and this fetch (DNS rebinding).
|
|
27
|
+
*
|
|
28
|
+
* The implementation deliberately does NOT follow redirects — Node's default.
|
|
29
|
+
* Enabling redirect-following here would re-open the SSRF surface that this
|
|
30
|
+
* file is meant to close, because the redirect target would bypass the
|
|
31
|
+
* `assertPublicUrl` validation.
|
|
32
|
+
*/
|
|
33
|
+
function fetchUrl(url, pinned) {
|
|
17
34
|
return new Promise((resolve, reject) => {
|
|
18
|
-
const
|
|
19
|
-
const get =
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
35
|
+
const isHttps = url.protocol === 'https:';
|
|
36
|
+
const get = isHttps ? https_1.default.get : http_1.default.get;
|
|
37
|
+
const port = url.port ? Number(url.port) : isHttps ? 443 : 80;
|
|
38
|
+
// `url.host` preserves the port only when it is non-default, which is
|
|
39
|
+
// exactly what we want for the Host header.
|
|
40
|
+
const hostHeader = url.host;
|
|
41
|
+
const requestOptions = pinned
|
|
42
|
+
? {
|
|
43
|
+
host: pinned.address,
|
|
44
|
+
port,
|
|
45
|
+
path: `${url.pathname}${url.search}`,
|
|
46
|
+
family: pinned.family,
|
|
47
|
+
headers: { Host: hostHeader },
|
|
48
|
+
timeout: 5000,
|
|
49
|
+
}
|
|
50
|
+
: {
|
|
51
|
+
// No pinned IP: caller opted into `allowPrivateNetworks`, fall
|
|
52
|
+
// back to the URL-driven path. Node performs its own DNS lookup
|
|
53
|
+
// here, which is fine because the operator has accepted the
|
|
54
|
+
// private-network risk.
|
|
55
|
+
host: url.hostname,
|
|
56
|
+
port,
|
|
57
|
+
path: `${url.pathname}${url.search}`,
|
|
58
|
+
headers: { Host: hostHeader },
|
|
59
|
+
timeout: 5000,
|
|
60
|
+
};
|
|
61
|
+
if (isHttps && pinned) {
|
|
62
|
+
requestOptions.servername = url.hostname;
|
|
63
|
+
}
|
|
64
|
+
get(requestOptions, res => {
|
|
23
65
|
const { statusCode } = res;
|
|
24
66
|
if (statusCode !== 200) {
|
|
25
|
-
vendure_logger_1.Logger.error(`Failed to fetch "${
|
|
26
|
-
reject(new Error(`Request failed. Status code: ${statusCode
|
|
67
|
+
vendure_logger_1.Logger.error(`Failed to fetch "${safeForLog(url.toString())}", statusCode: ${statusCode !== null && statusCode !== void 0 ? statusCode : 'unknown'}`, loggerCtx);
|
|
68
|
+
reject(new Error(`Request failed. Status code: ${statusCode !== null && statusCode !== void 0 ? statusCode : 'unknown'}`));
|
|
27
69
|
}
|
|
28
70
|
else {
|
|
29
71
|
resolve(res);
|
|
30
72
|
}
|
|
31
|
-
});
|
|
73
|
+
}).on('error', err => reject(err));
|
|
32
74
|
});
|
|
33
75
|
}
|
|
34
76
|
/**
|
|
@@ -54,12 +96,13 @@ class DefaultAssetImportStrategy {
|
|
|
54
96
|
return this.getStreamFromLocalFile(assetPath);
|
|
55
97
|
}
|
|
56
98
|
}
|
|
57
|
-
getStreamFromUrl(assetUrl) {
|
|
99
|
+
async getStreamFromUrl(assetUrl) {
|
|
58
100
|
var _a;
|
|
59
|
-
const { retryCount, retryDelayMs } = (_a = this.options) !== null && _a !== void 0 ? _a : {};
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
vendure_logger_1.Logger.verbose(
|
|
101
|
+
const { retryCount, retryDelayMs, allowPrivateNetworks } = (_a = this.options) !== null && _a !== void 0 ? _a : {};
|
|
102
|
+
const { url, pinned } = await (0, assert_public_url_1.assertPublicUrl)(assetUrl, { allowPrivateNetworks });
|
|
103
|
+
return (0, rxjs_1.lastValueFrom)((0, rxjs_1.from)(fetchUrl(url, pinned)).pipe((0, operators_1.retryWhen)(errors => errors.pipe((0, operators_1.tap)(value => {
|
|
104
|
+
vendure_logger_1.Logger.verbose(String(value), loggerCtx);
|
|
105
|
+
vendure_logger_1.Logger.verbose(`retrying fetchUrl for ${safeForLog(assetUrl)}`, loggerCtx);
|
|
63
106
|
}), (0, operators_1.delay)(retryDelayMs !== null && retryDelayMs !== void 0 ? retryDelayMs : 200), (0, operators_1.take)(retryCount !== null && retryCount !== void 0 ? retryCount : 3)))));
|
|
64
107
|
}
|
|
65
108
|
getStreamFromLocalFile(assetPath) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"default-asset-import-strategy.js","sourceRoot":"","sources":["../../../src/config/asset-import-strategy/default-asset-import-strategy.ts"],"names":[],"mappings":";;;;;;AAAA,wDAA0B;AAC1B,gDAAwB;AACxB,kDAA0B;AAC1B,gDAAwB;AACxB,+BAA2C;AAC3C,8CAA6D;
|
|
1
|
+
{"version":3,"file":"default-asset-import-strategy.js","sourceRoot":"","sources":["../../../src/config/asset-import-strategy/default-asset-import-strategy.ts"],"names":[],"mappings":";;;;;;AAAA,wDAA0B;AAC1B,gDAAwB;AACxB,kDAA0B;AAC1B,gDAAwB;AACxB,+BAA2C;AAC3C,8CAA6D;AAK7D,sDAAkD;AAClD,6DAAkD;AAElD,2DAAqE;AAGrE,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAC/C,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,SAAS,UAAU,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,QAAQ,CAAC,GAAQ,EAAE,MAA4B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,cAAI,CAAC,GAAG,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,sEAAsE;QACtE,4CAA4C;QAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,MAAM,cAAc,GAAwB,MAAM;YAC9C,CAAC,CAAC;gBACI,IAAI,EAAE,MAAM,CAAC,OAAO;gBACpB,IAAI;gBACJ,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gBAC7B,OAAO,EAAE,IAAI;aAChB;YACH,CAAC,CAAC;gBACI,+DAA+D;gBAC/D,gEAAgE;gBAChE,4DAA4D;gBAC5D,wBAAwB;gBACxB,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,IAAI;gBACJ,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gBAC7B,OAAO,EAAE,IAAI;aAChB,CAAC;QACR,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACnB,cAAuC,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC;QACvE,CAAC;QACD,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;YAC3B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;gBACrB,uBAAM,CAAC,KAAK,CACR,oBAAoB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,kBAAkB,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,SAAS,EAAE,EACzF,SAAS,CACZ,CAAC;gBACF,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,SAAS,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACL,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACP,CAAC;AAuCD;;;;;;;GAOG;AACH,MAAa,0BAA0B;IAGnC,YAAoB,OAA2C;QAA3C,YAAO,GAAP,OAAO,CAAoC;IAAG,CAAC;IAEnE,IAAI,CAAC,QAAkB;QACnB,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,8BAAa,CAAC,CAAC;IACrD,CAAC;IAED,iBAAiB,CAAC,SAAiB;QAC/B,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB;;QAC3C,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,oBAAoB,EAAE,GAAG,MAAA,IAAI,CAAC,OAAO,mCAAI,EAAE,CAAC;QAC9E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,mCAAe,EAAC,QAAQ,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAClF,OAAO,IAAA,oBAAa,EAChB,IAAA,WAAI,EAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAC5B,IAAA,qBAAS,EAAC,MAAM,CAAC,EAAE,CACf,MAAM,CAAC,IAAI,CACP,IAAA,eAAG,EAAC,KAAK,CAAC,EAAE;YACR,uBAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;YACzC,uBAAM,CAAC,OAAO,CAAC,yBAAyB,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC/E,CAAC,CAAC,EACF,IAAA,iBAAK,EAAC,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,GAAG,CAAC,EAC1B,IAAA,gBAAI,EAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,CAAC,CAAC,CACxB,CACJ,CACJ,CACJ,CAAC;IACN,CAAC;IAEO,sBAAsB,CAAC,SAAiB;QAC5C,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC;QACnE,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAEvD,IAAI,kBAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,kBAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,kBAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;oBAC7C,OAAO,MAAM,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,MAAM,GAAG,CAAC;gBACd,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,GAAG,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,kBAAkB,CAAC,CAAC;QACzD,CAAC;IACL,CAAC;CACJ;AAxDD,gEAwDC"}
|
package/dist/config/index.d.ts
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
export * from './api-key-strategy/api-key-strategy';
|
|
2
2
|
export * from './api-key-strategy/random-bytes-api-key-strategy';
|
|
3
3
|
export * from './asset-import-strategy/asset-import-strategy';
|
|
4
|
+
export * from './asset-import-strategy/default-asset-import-strategy';
|
|
4
5
|
export * from './asset-naming-strategy/asset-naming-strategy';
|
|
5
6
|
export * from './asset-naming-strategy/default-asset-naming-strategy';
|
|
6
7
|
export * from './asset-preview-strategy/asset-preview-strategy';
|
package/dist/config/index.js
CHANGED
|
@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
17
17
|
__exportStar(require("./api-key-strategy/api-key-strategy"), exports);
|
|
18
18
|
__exportStar(require("./api-key-strategy/random-bytes-api-key-strategy"), exports);
|
|
19
19
|
__exportStar(require("./asset-import-strategy/asset-import-strategy"), exports);
|
|
20
|
+
__exportStar(require("./asset-import-strategy/default-asset-import-strategy"), exports);
|
|
20
21
|
__exportStar(require("./asset-naming-strategy/asset-naming-strategy"), exports);
|
|
21
22
|
__exportStar(require("./asset-naming-strategy/default-asset-naming-strategy"), exports);
|
|
22
23
|
__exportStar(require("./asset-preview-strategy/asset-preview-strategy"), exports);
|
package/dist/config/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sEAAoD;AACpD,mFAAiE;AACjE,gFAA8D;AAC9D,gFAA8D;AAC9D,wFAAsE;AACtE,kFAAgE;AAChE,kFAAgE;AAChE,iEAA+C;AAC/C,0EAAwD;AACxD,gFAA8D;AAC9D,8EAA4D;AAC5D,6EAA2D;AAC3D,wEAAsD;AACtD,wEAAsD;AACtD,mEAAiD;AACjD,sEAAoD;AACpD,qEAAmD;AACnD,8DAA4C;AAC5C,uEAAqD;AACrD,6FAA2E;AAC3E,0FAAwE;AACxE,2EAAyD;AACzD,4EAA0D;AAC1D,kFAAgE;AAChE,uFAAqE;AACrE,qFAAmE;AACnE,kFAAgE;AAChE,mEAAiD;AACjD,oEAAkD;AAClD,mDAAiC;AACjC,kDAAgC;AAChC,mDAAiC;AACjC,oEAAkD;AAClD,mDAAiC;AACjC,6EAA2D;AAC3D,sEAAoD;AACpD,iEAA+C;AAC/C,kEAAgD;AAChD,iEAA+C;AAC/C,6DAA2C;AAC3C,oEAAkD;AAClD,8DAA4C;AAC5C,0DAAwC;AACxC,yDAAuC;AACvC,4DAA0C;AAC1C,4EAA0D;AAC1D,oEAAkD;AAClD,oEAAkD;AAClD,2EAAyD;AACzD,6EAA2D;AAC3D,iEAA+C;AAC/C,0DAAwC;AACxC,uDAAqC;AACrC,0DAAwC;AACxC,iDAA+B;AAC/B,gEAA8C;AAC9C,0EAAwD;AACxD,wEAAsD;AACtD,kFAAgE;AAChE,0EAAwD;AACxD,wEAAsD;AACtD,gEAA8C;AAC9C,wEAAsD;AACtD,4EAA0D;AAC1D,kEAAgD;AAChD,gEAA8C;AAC9C,wEAAsD;AACtD,8DAA4C;AAC5C,4DAA0C;AAC1C,gFAA8D;AAC9D,+DAA6C;AAC7C,gEAA8C;AAC9C,wDAAsC;AACtC,gEAA8C;AAC9C,oEAAkD;AAClD,gEAA8C;AAC9C,+EAA6D;AAC7D,6DAA2C;AAC3C,oEAAkD;AAClD,yEAAuD;AACvD,2EAAyD;AACzD,+EAA6D;AAC7D,mEAAiD;AACjD,4DAA0C;AAC1C,8CAA4B;AAC5B,kEAAgD;AAChD,iFAA+D;AAC/D,mFAAiE;AACjE,8EAA4D;AAC5D,yEAAuD;AACvD,sFAAoE;AACpE,wEAAsD;AACtD,gFAA8D;AAC9D,yFAAuE;AACvE,8FAA4E;AAC5E,wEAAsD;AACtD,iFAA+D;AAC/D,sFAAoE;AACpE,kEAAgD;AAChD,iEAA+C;AAC/C,oEAAkD;AAClD,wEAAsD;AACtD,+EAA6D;AAC7D,8EAA4D;AAC5D,kEAAgD;AAChD,6EAA2D;AAC3D,uEAAqD;AACrD,sEAAoD;AACpD,0DAAwC;AACxC,mDAAiC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sEAAoD;AACpD,mFAAiE;AACjE,gFAA8D;AAC9D,wFAAsE;AACtE,gFAA8D;AAC9D,wFAAsE;AACtE,kFAAgE;AAChE,kFAAgE;AAChE,iEAA+C;AAC/C,0EAAwD;AACxD,gFAA8D;AAC9D,8EAA4D;AAC5D,6EAA2D;AAC3D,wEAAsD;AACtD,wEAAsD;AACtD,mEAAiD;AACjD,sEAAoD;AACpD,qEAAmD;AACnD,8DAA4C;AAC5C,uEAAqD;AACrD,6FAA2E;AAC3E,0FAAwE;AACxE,2EAAyD;AACzD,4EAA0D;AAC1D,kFAAgE;AAChE,uFAAqE;AACrE,qFAAmE;AACnE,kFAAgE;AAChE,mEAAiD;AACjD,oEAAkD;AAClD,mDAAiC;AACjC,kDAAgC;AAChC,mDAAiC;AACjC,oEAAkD;AAClD,mDAAiC;AACjC,6EAA2D;AAC3D,sEAAoD;AACpD,iEAA+C;AAC/C,kEAAgD;AAChD,iEAA+C;AAC/C,6DAA2C;AAC3C,oEAAkD;AAClD,8DAA4C;AAC5C,0DAAwC;AACxC,yDAAuC;AACvC,4DAA0C;AAC1C,4EAA0D;AAC1D,oEAAkD;AAClD,oEAAkD;AAClD,2EAAyD;AACzD,6EAA2D;AAC3D,iEAA+C;AAC/C,0DAAwC;AACxC,uDAAqC;AACrC,0DAAwC;AACxC,iDAA+B;AAC/B,gEAA8C;AAC9C,0EAAwD;AACxD,wEAAsD;AACtD,kFAAgE;AAChE,0EAAwD;AACxD,wEAAsD;AACtD,gEAA8C;AAC9C,wEAAsD;AACtD,4EAA0D;AAC1D,kEAAgD;AAChD,gEAA8C;AAC9C,wEAAsD;AACtD,8DAA4C;AAC5C,4DAA0C;AAC1C,gFAA8D;AAC9D,+DAA6C;AAC7C,gEAA8C;AAC9C,wDAAsC;AACtC,gEAA8C;AAC9C,oEAAkD;AAClD,gEAA8C;AAC9C,+EAA6D;AAC7D,6DAA2C;AAC3C,oEAAkD;AAClD,yEAAuD;AACvD,2EAAyD;AACzD,+EAA6D;AAC7D,mEAAiD;AACjD,4DAA0C;AAC1C,8CAA4B;AAC5B,kEAAgD;AAChD,iFAA+D;AAC/D,mFAAiE;AACjE,8EAA4D;AAC5D,yEAAuD;AACvD,sFAAoE;AACpE,wEAAsD;AACtD,gFAA8D;AAC9D,yFAAuE;AACvE,8FAA4E;AAC5E,wEAAsD;AACtD,iFAA+D;AAC/D,sFAAoE;AACpE,kEAAgD;AAChD,iEAA+C;AAC/C,oEAAkD;AAClD,wEAAsD;AACtD,+EAA6D;AAC7D,8EAA4D;AAC5D,kEAAgD;AAChD,6EAA2D;AAC3D,uEAAqD;AACrD,sEAAoD;AACpD,0DAAwC;AACxC,mDAAiC"}
|
|
@@ -43,13 +43,22 @@ async function migrateAssetTranslationData(queryRunner) {
|
|
|
43
43
|
return;
|
|
44
44
|
}
|
|
45
45
|
const esc = (name) => queryRunner.connection.driver.escape(name);
|
|
46
|
-
// 1.
|
|
46
|
+
// 1. If there is no asset data to migrate, skip entirely. This covers the
|
|
47
|
+
// fresh-install case where migrations run against an empty database before
|
|
48
|
+
// the default channel has been populated.
|
|
49
|
+
const assetCounts = await queryRunner.query(`SELECT COUNT(*) AS ${esc('count')} FROM ${esc('asset')} WHERE ${esc('name')} IS NOT NULL`);
|
|
50
|
+
const assetCount = Number(assetCounts[0].count);
|
|
51
|
+
if (assetCount === 0) {
|
|
52
|
+
console.log('No asset rows with a name to migrate. Skipping asset translation data migration.');
|
|
53
|
+
return;
|
|
54
|
+
}
|
|
55
|
+
// 2. Get the default language code from the default channel
|
|
47
56
|
const rows = await queryRunner.query(`SELECT ${esc('defaultLanguageCode')} FROM ${esc('channel')} WHERE ${esc('code')} = '__default_channel__'`);
|
|
48
57
|
if (!(rows === null || rows === void 0 ? void 0 : rows.length)) {
|
|
49
58
|
throw new Error('Could not find the default channel. The __default_channel__ must exist before running this migration.');
|
|
50
59
|
}
|
|
51
60
|
const defaultLanguageCode = rows[0].defaultLanguageCode;
|
|
52
|
-
//
|
|
61
|
+
// 3. Copy asset names into the asset_translation table
|
|
53
62
|
await queryRunner.query(`INSERT INTO ${esc('asset_translation')} (${esc('createdAt')}, ${esc('updatedAt')}, ${esc('languageCode')}, ${esc('name')}, ${esc('baseId')})
|
|
54
63
|
SELECT a.${esc('createdAt')}, a.${esc('updatedAt')}, '${defaultLanguageCode}', a.${esc('name')}, a.${esc('id')}
|
|
55
64
|
FROM ${esc('asset')} a
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"v3_6_asset_translations.js","sourceRoot":"","sources":["../../src/migration-utils/v3_6_asset_translations.ts"],"names":[],"mappings":";;AAwCA,
|
|
1
|
+
{"version":3,"file":"v3_6_asset_translations.js","sourceRoot":"","sources":["../../src/migration-utils/v3_6_asset_translations.ts"],"names":[],"mappings":";;AAwCA,kEA+CC;AAlFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACI,KAAK,UAAU,2BAA2B,CAAC,WAAwB;IACtE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACP,2CAA2C,GAAG,+CAA+C,CAChG,CAAC;QACF,OAAO;IACX,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEzE,0EAA0E;IAC1E,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,WAAW,GAAsC,MAAM,WAAW,CAAC,KAAK,CAC1E,sBAAsB,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,MAAM,CAAC,cAAc,CAC7F,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO;IACX,CAAC;IAED,4DAA4D;IAC5D,MAAM,IAAI,GAA2C,MAAM,WAAW,CAAC,KAAK,CACxE,UAAU,GAAG,CAAC,qBAAqB,CAAC,SAAS,GAAG,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,MAAM,CAAC,0BAA0B,CAC7G,CAAC;IACF,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,CAAA,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACX,uGAAuG,CAC1G,CAAC;IACN,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAExD,uDAAuD;IACvD,MAAM,WAAW,CAAC,KAAK,CACnB,eAAe,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,cAAc,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC;oBAC/H,GAAG,CAAC,WAAW,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,MAAM,mBAAmB,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC;gBACvG,GAAG,CAAC,OAAO,CAAC;mBACT,GAAG,CAAC,MAAM,CAAC;;6BAED,GAAG,CAAC,mBAAmB,CAAC;uBAC9B,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC;WAC1C,CACN,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;AACrF,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vendure/core",
|
|
3
|
-
"version": "3.6.4-master-
|
|
3
|
+
"version": "3.6.4-master-202605200308",
|
|
4
4
|
"description": "A modern, headless ecommerce framework",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -49,7 +49,7 @@
|
|
|
49
49
|
"@nestjs/platform-express": "^11.0.12",
|
|
50
50
|
"@nestjs/terminus": "^11.0.0",
|
|
51
51
|
"@nestjs/typeorm": "^11.0.0",
|
|
52
|
-
"@vendure/common": "^3.6.4-master-
|
|
52
|
+
"@vendure/common": "^3.6.4-master-202605200308",
|
|
53
53
|
"bcrypt": "^6.0.0",
|
|
54
54
|
"body-parser": "^1.20.2",
|
|
55
55
|
"cookie-session": "^2.1.0",
|