@versori/run 0.2.28 → 0.3.0-veta.1

package/script/src/connection/internal/InboundConnectionFactory.js

@@ -0,0 +1,394 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExpressInboundConnectionFactory = void 0;
+const mod_js_1 = require("../../services/credentials/mod.js");
+const protobuf_1 = require("@bufbuild/protobuf");
+const node_buffer_1 = require("node:buffer");
+const node_crypto_1 = require("node:crypto");
+const CredentialHolder_js_1 = require("./CredentialHolder.js");
+const isTokenValid_js_1 = require("../../services/credentials/isTokenValid.js");
+const mod_js_2 = require("../../../deps/jsr.io/@std/cache/0.2.0/mod.js");
+class ExpressInboundConnectionFactory {
+    constructor(credentials, tokens, logger) {
+        Object.defineProperty(this, "credentials", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: credentials
+        });
+        Object.defineProperty(this, "tokens", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: tokens
+        });
+        Object.defineProperty(this, "logger", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: logger
+        });
+        Object.defineProperty(this, "cache", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.cache = new mod_js_2.LruCache(100);
+    }
+    handler(cnx) {
+        const cached = this.cache.get(cnx.id);
+        if (cached) {
+            return cached;
+        }
+        const handler = this.buildHandlers(cnx);
+        this.cache.set(cnx.id, handler);
+        return handler;
+    }
+    async buildHandlers(cnx) {
+        const handlers = [];
+        for (const [index, cnxCredential] of cnx.credentials.entries()) {
+            const handler = await this.buildHandler(cnxCredential, index, cnx);
+            if (handler) {
+                handlers.push(handler);
+            }
+        }
+        return composeHandlers(handlers);
+    }
+    buildHandler(cnxCredential, index, cnx) {
+        const asc = cnxCredential.authSchemeConfig;
+        const redactedCredential = cnxCredential.credential;
+        if (!asc || !redactedCredential) {
+            this.logger.warn('Connection credential is missing authSchemeConfig or credential', {
+                connectionId: cnx.id,
+                index,
+                asc,
+                redactedCredential,
+            });
+            return Promise.resolve(undefined);
+        }
+        switch (asc.type) {
+            case 'api-key':
+                if (!asc.apiKey) {
+                    this.logger.warn('api-key auth has missing apiKey config', {
+                        connectionId: cnx.id,
+                        index,
+                    });
+                    return Promise.resolve(undefined);
+                }
+                return this.buildApiKeyHandler(asc.apiKey, redactedCredential);
+            case 'basic-auth':
+                return this.buildBasicAuthHandler(redactedCredential);
+            case 'hmac':
+                if (!asc.hmac) {
+                    this.logger.warn('hmac auth has missing hmac config', {
+                        connectionId: cnx.id,
+                        index,
+                    });
+                    return Promise.resolve(undefined);
+                }
+                return this.buildHmacHandler(asc.hmac, redactedCredential);
+            default:
+                this.logger.warn('Unsupported inbound authSchemeConfig type', {
+                    connectionId: cnx.id,
+                    index,
+                    type: asc.type,
+                });
+                return Promise.resolve(undefined);
+        }
+    }
+    async buildApiKeyHandler(cfg, redactedCredential) {
+        const initial = await this.tokens.getToken({
+            credentialId: redactedCredential.id,
+            forceRefresh: false,
+        });
+        if (!initial || !initial.token) {
+            this.logger.error('API key token not found for credential when building handler', {
+                credentialId: redactedCredential.id,
+            });
+            return (_req, res) => {
+                this.logger.warn('API key not configured before deployment, please redeploy your project', { credentialId: redactedCredential.id });
+                res.status(401).json({ error: 'Unauthorised' });
+            };
+        }
+        const holder = new CredentialHolder_js_1.CredentialHolder(initial.token, isTokenValid_js_1.isTokenValid, async () => {
+            const refreshed = await this.tokens.getToken({
+                credentialId: redactedCredential.id,
+                forceRefresh: false,
+            });
+            return refreshed.token;
+        });
+        let extractor;
+        switch (cfg.in) {
+            case 'header': {
+                const headerKey = cfg.name.toLowerCase();
+                extractor = (req) => {
+                    const headerVal = req.headers[headerKey];
+                    if (Array.isArray(headerVal)) {
+                        return headerVal[0];
+                    }
+                    if (typeof headerVal === 'string') {
+                        return headerVal;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            case 'query': {
+                const name = cfg.name;
+                extractor = (req) => {
+                    const q = req.query?.[name];
+                    if (typeof q === 'string') {
+                        return q;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            case 'cookie': {
+                const name = cfg.name;
+                extractor = (req) => {
+                    const c = req.cookies?.[name];
+                    if (typeof c === 'string') {
+                        return c;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            default:
+                throw new Error('Unsupported apiKey.in value: ' + cfg.in);
+        }
+        async function verify(apiKey) {
+            const expected = await holder.get();
+            if (!expected) {
+                return false;
+            }
+            let expectedKey = expected.tokenType
+                ? `${expected.tokenType} ${expected.accessToken}`
+                : expected.accessToken;
+            if (apiKey === expectedKey || apiKey === expected.accessToken) {
+                return true;
+            }
+            // TODO: Is this a DDOS if they just provide the wrong credential?
+            holder.refresh();
+            expectedKey = expected.tokenType
+                ? `${expected.tokenType} ${expected.accessToken}`
+                : expected.accessToken;
+            return apiKey === expectedKey || apiKey === expected.accessToken;
+        }
+        return async (req, res, next) => {
+            try {
+                const gotKey = extractor(req);
+                if (!gotKey) {
+                    return res.status(401).json({ error: 'Unauthorised' });
+                }
+                if (await verify(gotKey)) {
+                    return next();
+                }
+                return res.status(401).json({ error: 'Unauthorised' });
+            }
+            catch (err) {
+                this.logger.error('Error verifying API key', { err });
+                res.status(401).json({ error: 'Unauthorised' });
+            }
+        };
+    }
+    async buildBasicAuthHandler(redactedCredential) {
+        const response = await this.credentials.get({ id: redactedCredential.id });
+        if (!response || !response.credential) {
+            this.logger.error('BasicAuth credential not found when building handler', {
+                credentialId: redactedCredential.id,
+            });
+            return (_req, res) => {
+                this.logger.warn('BasicAuth not configured before deployment, please redeploy your project', {
+                    credentialId: redactedCredential.id,
+                });
+                res.status(401).json({ error: 'Unauthorised' });
+            };
+        }
+        const holder = new CredentialHolder_js_1.CredentialHolder(response.credential, CredentialHolder_js_1.alwaysValid, async () => {
+            const refreshed = await this.credentials.get({ id: redactedCredential.id });
+            return refreshed.credential;
+        });
+        // Build parser once
+        const parseAuth = (req) => {
+            const headerVal = req.headers['authorization'];
+            const header = Array.isArray(headerVal) ? headerVal[0] : headerVal;
+            if (!header || typeof header !== 'string') {
+                return undefined;
+            }
+            const [scheme, encoded] = header.split(' ');
+            if (!scheme || scheme.toLowerCase() !== 'basic' || !encoded) {
+                return undefined;
+            }
+            let decoded = '';
+            try {
+                decoded = node_buffer_1.Buffer.from(encoded, 'base64').toString('utf8');
+            }
+            catch (err) {
+                this.logger.warn('Error decoding BasicAuth header', { encoded, error: err });
+                return undefined;
+            }
+            const sep = decoded.indexOf(':');
+            if (sep === -1) {
+                return undefined;
+            }
+            return { username: decoded.slice(0, sep), password: decoded.slice(sep + 1) };
+        };
+        return async (req, res, next) => {
+            try {
+                const parsed = parseAuth(req);
+                if (!parsed) {
+                    return res.status(401).json({ error: 'Unauthorised' });
+                }
+                const c1 = await holder.get();
+                const data1 = (0, protobuf_1.create)(mod_js_1.credentialv1alpha1.CredentialDataBasicAuthSchema, c1.data);
+                if (parsed.username === data1.username && parsed.password === data1.password) {
+                    return next();
+                }
+                const c2 = await holder.get(true);
+                const data2 = (0, protobuf_1.create)(mod_js_1.credentialv1alpha1.CredentialDataBasicAuthSchema, c2.data);
+                if (parsed.username === data2.username && parsed.password === data2.password) {
+                    return next();
+                }
+                return res.status(401).json({ error: 'Unauthorised' });
+            }
+            catch (err) {
+                this.logger.error('Error verifying BasicAuth', { err });
+                res.status(401).json({ error: 'Unauthorised' });
+            }
+        };
+    }
+    async buildHmacHandler(cfg, redactedCredential) {
+        const response = await this.credentials.get({ id: redactedCredential.id });
+        if (!response || !response.credential) {
+            this.logger.error('HMAC credential not found', { credentialId: redactedCredential.id });
+            return (_req, res) => {
+                res.status(401).json({ error: 'Unauthorised' });
+            };
+        }
+        const holder = new CredentialHolder_js_1.CredentialHolder(response.credential, CredentialHolder_js_1.alwaysValid, async () => {
+            const refreshed = await this.credentials.get({ id: redactedCredential.id });
+            return refreshed.credential;
+        });
+        let extractor;
+        switch (cfg.in) {
+            case 'query': {
+                const name = cfg.name;
+                extractor = (req) => {
+                    const q = req.query?.[name];
+                    if (typeof q === 'string') {
+                        return q;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            case 'header': {
+                const headerKey = cfg.name.toLowerCase();
+                extractor = (req) => {
+                    const hv = req.headers[headerKey];
+                    if (Array.isArray(hv)) {
+                        return hv[0];
+                    }
+                    if (typeof hv === 'string') {
+                        return hv;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            case 'cookie': {
+                const name = cfg.name;
+                extractor = (req) => {
+                    const c = req.cookies?.[name];
+                    if (typeof c === 'string') {
+                        return c;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            default:
+                throw new Error('Unsupported hmac.in value: ' + cfg.in);
+        }
+        const logger = this.logger;
+        async function computeDigest(req) {
+            const cred = await holder.get();
+            const raw = (0, protobuf_1.create)(mod_js_1.credentialv1alpha1.CredentialDataRawSchema, cred.data);
+            const secret = node_buffer_1.Buffer.from(raw.raw).toString('utf8');
+            const hmac = (0, node_crypto_1.createHmac)(cfg.algorithm, secret);
+            for (const input of cfg.digestInputs) {
+                switch (input) {
+                    case 'body': {
+                        if (typeof req.rawBody === 'undefined') {
+                            const { body: _body, ...rest } = req;
+                            // NOTE: address this in future, at the moment only the JSON body-parser is populating the
+                            // rawBody property, so this should only happen if the user is not using JSON.
+                            logger.warn('request.rawBody missing from request, HMAC signature is likely going to fail, this can happen if the payload is not application/json', { req: { ...rest, body: '**redacted**' } });
+                            return '';
+                        }
+                        hmac.update(req.rawBody);
+                        break;
+                    }
+                    case 'url':
+                        hmac.update(req.originalUrl ?? req.url);
+                        break;
+                    default:
+                        break;
+                }
+            }
+            return hmac.digest(cfg.encoding);
+        }
+        return async (req, res, next) => {
+            try {
+                const provided = extractor(req);
+                if (!provided) {
+                    return res.status(401).json({ error: 'Unauthorised' });
+                }
+                const digest1 = await computeDigest(req);
+                if (provided === digest1) {
+                    return next();
+                }
+                // TODO: Is this a DDOS if they just provide the wrong credential?
+                holder.refresh();
+                const digest2 = await computeDigest(req);
+                if (provided === digest2) {
+                    return next();
+                }
+                return res.status(401).json({ error: 'Unauthorised' });
+            }
+            catch (err) {
+                this.logger.error('Error verifying HMAC', { err });
+                res.status(401).json({ error: 'Unauthorised' });
+            }
+        };
+    }
+}
+exports.ExpressInboundConnectionFactory = ExpressInboundConnectionFactory;
+function composeHandlers(handlers) {
+    return (req, res, next) => {
+        let index = -1;
+        const dispatch = (i, err) => {
+            if (err) {
+                return next(err);
+            }
+            if (i <= index) {
+                return next(new Error('next() called multiple times'));
+            }
+            index = i;
+            if (i === handlers.length) {
+                return next();
+            }
+            const handler = handlers[i];
+            try {
+                handler(req, res, (err2) => dispatch(i + 1, err2));
+            }
+            catch (e) {
+                next(e);
+            }
+        };
+        dispatch(0);
+    };
+}

package/script/src/connection/internal/OutboundConnectionFactory.d.ts

@@ -0,0 +1,31 @@
+import { Client } from '@connectrpc/connect';
+import { Logger } from '../../mod.js';
+import { credentialv1alpha1, tokensv1, oauth1v1 } from '../../services/credentials/mod.js';
+import { Connection } from '../../services/platform/mod.js';
+import { FetchLike } from '../types.js';
+import { HttpClientFactory } from './HttpClientFactory.js';
+export declare class OutboundConnectionFactory {
+    private readonly httpClientFactory;
+    private readonly credentials;
+    private readonly tokens;
+    private readonly oauth1;
+    private readonly logger;
+    private readonly cache;
+    constructor(httpClientFactory: HttpClientFactory, credentials: Client<typeof credentialv1alpha1.CredentialService>, tokens: Client<typeof tokensv1.TokenService>, oauth1: Client<typeof oauth1v1.AuthorizationService>, logger: Logger);
+    fetcher(cnx: Connection): Promise<FetchLike>;
+    private buildFetcher;
+    private buildMiddleware;
+    private buildCertificateMiddleware;
+    private buildApiKeyMiddleware;
+    private buildApiKeyHeaderMiddleware;
+    private buildApiKeyQueryMiddleware;
+    private buildApiKeyCookieMiddleware;
+    private buildBasicAuthMiddleware;
+    private buildOAuth1Middleware;
+    private buildBasicAuthHeaderMiddleware;
+    private buildOAuth1HeaderMiddleware;
+    private buildJwtBearerMiddleware;
+    private buildOAuth2Middleware;
+    private buildAuthorizationHeaderMiddleware;
+}
+//# sourceMappingURL=OutboundConnectionFactory.d.ts.map

package/script/src/connection/internal/OutboundConnectionFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OutboundConnectionFactory.d.ts","sourceRoot":"","sources":["../../../../src/src/connection/internal/OutboundConnectionFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAGH,UAAU,EAGb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAsB,MAAM,aAAa,CAAC;AAG5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAI3D,qBAAa,yBAAyB;IAI9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAP3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;gBAGxC,iBAAiB,EAAE,iBAAiB,EACpC,WAAW,EAAE,MAAM,CAAC,OAAO,kBAAkB,CAAC,iBAAiB,CAAC,EAChE,MAAM,EAAE,MAAM,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,EAC5C,MAAM,EAAE,MAAM,CAAC,OAAO,QAAQ,CAAC,oBAAoB,CAAC,EACpD,MAAM,EAAE,MAAM;IAKnC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;YAkB9B,YAAY;IAmB1B,OAAO,CAAC,eAAe;YAiDT,0BAA0B;YAwB1B,qBAAqB;IA4DnC,OAAO,CAAC,2BAA2B;IAuBnC,OAAO,CAAC,0BAA0B;IAkDlC,OAAO,CAAC,2BAA2B;YA0BrB,wBAAwB;YAkCxB,qBAAqB;IAiCnC,OAAO,CAAC,8BAA8B;IAuBtC,OAAO,CAAC,2BAA2B;YA2ErB,wBAAwB;YAkCxB,qBAAqB;IA6CnC,OAAO,CAAC,kCAAkC;CAyB7C"}