@versori/run 0.2.29 → 0.3.0-veta.1

package/esm/src/connection/internal/CredentialHolder.js

@@ -0,0 +1,66 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _CredentialHolder_value, _CredentialHolder_isValid, _CredentialHolder_refresh, _CredentialHolder_isRefreshing;
+export function alwaysValid() {
+    return true;
+}
+/**
+ * CredentialHolder is a class that holds a credential and provides a way to refresh it.
+ */
+export class CredentialHolder {
+    constructor(initialValue, isValid, refresh) {
+        _CredentialHolder_value.set(this, void 0);
+        _CredentialHolder_isValid.set(this, void 0);
+        _CredentialHolder_refresh.set(this, void 0);
+        _CredentialHolder_isRefreshing.set(this, false);
+        __classPrivateFieldSet(this, _CredentialHolder_value, Promise.resolve(initialValue), "f");
+        __classPrivateFieldSet(this, _CredentialHolder_refresh, refresh, "f");
+        __classPrivateFieldSet(this, _CredentialHolder_isValid, isValid, "f");
+    }
+    async get(refresh = false) {
+        if (refresh) {
+            this.refresh();
+            return __classPrivateFieldGet(this, _CredentialHolder_value, "f");
+        }
+        const value = await __classPrivateFieldGet(this, _CredentialHolder_value, "f");
+        if (!__classPrivateFieldGet(this, _CredentialHolder_isValid, "f").call(this, value)) {
+            this.refresh();
+        }
+        // must return this.#value and not value, since calling `this.refresh()` above will replace
+        // the value with a new promise.
+        return __classPrivateFieldGet(this, _CredentialHolder_value, "f");
+    }
+    refresh() {
+        if (__classPrivateFieldGet(this, _CredentialHolder_isRefreshing, "f")) {
+            return;
+        }
+        __classPrivateFieldSet(this, _CredentialHolder_isRefreshing, true, "f");
+        // refresh works by replacing the existing #value promise with a new one which is pending
+        // on a new promise which is refreshing the credential.
+        // multiple calls to refresh() will be ignored until the first refresh is complete.
+        __classPrivateFieldSet(this, _CredentialHolder_value, new Promise((resolve, reject) => __classPrivateFieldGet(this, _CredentialHolder_refresh, "f").call(this).then((refreshed) => {
+            if (!refreshed) {
+                reject(new Error('Refreshed credential is undefined'));
+                return;
+            }
+            if (!__classPrivateFieldGet(this, _CredentialHolder_isValid, "f").call(this, refreshed)) {
+                reject(new Error('Refreshed credential is invalid'));
+                return;
+            }
+            resolve(refreshed);
+        }).catch((error) => reject(error)).finally(() => {
+            __classPrivateFieldSet(this, _CredentialHolder_isRefreshing, false, "f");
+        })), "f");
+        return;
+    }
+}
+_CredentialHolder_value = new WeakMap(), _CredentialHolder_isValid = new WeakMap(), _CredentialHolder_refresh = new WeakMap(), _CredentialHolder_isRefreshing = new WeakMap();

package/esm/src/connection/internal/FetchBuilder.d.ts

@@ -0,0 +1,15 @@
+import { OutboundMiddleware, FetchLike } from '../types.js';
+import { Connection } from '../../services/platform/mod.js';
+/**
+ * FetchBuilder is used to build a fetch function which can be composed by multiple middlewares for
+ * modifying the request/response and makes the implementation of {@link ConnectionFetchFactory}
+ * easier to understand.
+ */
+export declare class FetchBuilder {
+    #private;
+    middlewares: OutboundMiddleware[];
+    constructor(fetch: FetchLike, cnx: Connection);
+    use(fn: OutboundMiddleware): void;
+    build(): FetchLike;
+}
+//# sourceMappingURL=FetchBuilder.d.ts.map

package/esm/src/connection/internal/FetchBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FetchBuilder.d.ts","sourceRoot":"","sources":["../../../../src/src/connection/internal/FetchBuilder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAI5D;;;;GAIG;AACH,qBAAa,YAAY;;IACrB,WAAW,EAAE,kBAAkB,EAAE,CAAC;gBAKtB,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU;IAM7C,GAAG,CAAC,EAAE,EAAE,kBAAkB;IAI1B,KAAK,IAAI,SAAS;CAWrB"}

package/esm/src/connection/internal/FetchBuilder.js

@@ -0,0 +1,89 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _FetchBuilder_base, _FetchBuilder_cnx;
+import { isValidURL } from '../../dsl/http/versori/helpers.js';
+/**
+ * FetchBuilder is used to build a fetch function which can be composed by multiple middlewares for
+ * modifying the request/response and makes the implementation of {@link ConnectionFetchFactory}
+ * easier to understand.
+ */
+export class FetchBuilder {
+    constructor(fetch, cnx) {
+        Object.defineProperty(this, "middlewares", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        _FetchBuilder_base.set(this, void 0);
+        _FetchBuilder_cnx.set(this, void 0);
+        __classPrivateFieldSet(this, _FetchBuilder_base, fetch, "f");
+        __classPrivateFieldSet(this, _FetchBuilder_cnx, cnx, "f");
+        this.middlewares = [changeRequestbaseURLMiddleware(cnx)];
+    }
+    use(fn) {
+        this.middlewares.push(fn);
+    }
+    build() {
+        let fetch = __classPrivateFieldGet(this, _FetchBuilder_base, "f");
+        for (let i = this.middlewares.length - 1; i >= 0; i--) {
+            // apply middlewares in reverse order so that the actual middleware executes in the
+            // order they were added
+            fetch = this.middlewares[i](fetch);
+        }
+        return fetch;
+    }
+}
+_FetchBuilder_base = new WeakMap(), _FetchBuilder_cnx = new WeakMap();
+function changeBaseUrl(pathname, conn) {
+    const connBaseURL = conn.baseUrl;
+    // if the connection has no baseUrl set, but the pathname is a valid URL, return it as is
+    if (!connBaseURL && isValidURL(pathname)) {
+        return pathname;
+    }
+    // if connBaseURL is undefined, we can't create a URL object
+    if (!connBaseURL) {
+        throw new Error('Connection baseUrl is required but not provided');
+    }
+    const connBaseURLObj = new URL(connBaseURL);
+    let _pathname = pathname;
+    if (isValidURL(pathname)) {
+        const pathnameObj = new URL(pathname);
+        _pathname = pathnameObj.pathname;
+    }
+    const newURL = new URL(_pathname, connBaseURLObj.origin);
+    return newURL.toString();
+}
+function changeRequestInit(info, conn) {
+    if (typeof info === 'string') {
+        if (isValidURL(info)) {
+            return info;
+        }
+        return changeBaseUrl(info, conn);
+    }
+    else if (info instanceof URL) {
+        return info;
+    }
+    else if (info instanceof Request) {
+        const url = changeBaseUrl(info.url, conn);
+        return new Request(url, info);
+    }
+    return info;
+}
+function changeRequestbaseURLMiddleware(conn) {
+    return (fetch) => {
+        return async (input, init = {}) => {
+            const newInput = changeRequestInit(input, conn);
+            return fetch(newInput, init);
+        };
+    };
+}

package/esm/src/connection/internal/HttpClientFactory.d.ts

@@ -0,0 +1,14 @@
+import { credentialv1alpha1 } from '../../services/credentials/mod.js';
+/**
+ * HttpClientFactory is used to create a {@link Deno.HttpClient} for a given {@link credentialv1alpha1.Credential}.
+ *
+ * This is build to support being provided any credential type, and if the credential does not require a specific
+ * client then the factory will return undefined.
+ */
+export declare class HttpClientFactory {
+    private readonly cache;
+    constructor();
+    getClient(credential: credentialv1alpha1.Credential): Deno.HttpClient | undefined;
+    private newMtlsClient;
+}
+//# sourceMappingURL=HttpClientFactory.d.ts.map

package/esm/src/connection/internal/HttpClientFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpClientFactory.d.ts","sourceRoot":"","sources":["../../../../src/src/connection/internal/HttpClientFactory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAEvE;;;;;GAKG;AACH,qBAAa,iBAAiB;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;;IAM1D,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,SAAS;IAcjF,OAAO,CAAC,aAAa;CAaxB"}

package/esm/src/connection/internal/HttpClientFactory.js

@@ -0,0 +1,42 @@
+import { create } from '@bufbuild/protobuf';
+import { LruCache } from '../../../deps/jsr.io/@std/cache/0.2.0/mod.js';
+import { credentialv1alpha1 } from '../../services/credentials/mod.js';
+/**
+ * HttpClientFactory is used to create a {@link Deno.HttpClient} for a given {@link credentialv1alpha1.Credential}.
+ *
+ * This is build to support being provided any credential type, and if the credential does not require a specific
+ * client then the factory will return undefined.
+ */
+export class HttpClientFactory {
+    constructor() {
+        Object.defineProperty(this, "cache", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.cache = new LruCache(100);
+    }
+    getClient(credential) {
+        const cached = this.cache.get(credential.id);
+        if (cached) {
+            return cached;
+        }
+        switch (credential.type) {
+            case credentialv1alpha1.Credential_Type.Certificate:
+                return this.newMtlsClient(credential);
+            default:
+                return undefined;
+        }
+    }
+    newMtlsClient(credential) {
+        const data = create(credentialv1alpha1.CredentialDataCertificateSchema, credential.data);
+        const client = Deno.createHttpClient({
+            cert: new TextDecoder().decode(data.certificate),
+            key: new TextDecoder().decode(data.key),
+            caCerts: data.ca ? [new TextDecoder().decode(data.ca)] : [],
+        });
+        this.cache.set(credential.id, client);
+        return client;
+    }
+}

package/esm/src/connection/internal/InboundConnectionFactory.d.ts

@@ -0,0 +1,19 @@
+import { Client } from '@connectrpc/connect';
+import { Logger } from '../../observability/logging/Logger.js';
+import { credentialv1alpha1, tokensv1 } from '../../services/credentials/mod.js';
+import type * as express from 'express';
+import { Connection } from '../../services/platform/mod.js';
+export declare class ExpressInboundConnectionFactory {
+    private readonly credentials;
+    private readonly tokens;
+    private readonly logger;
+    private readonly cache;
+    constructor(credentials: Client<typeof credentialv1alpha1.CredentialService>, tokens: Client<typeof tokensv1.TokenService>, logger: Logger);
+    handler(cnx: Connection): Promise<express.RequestHandler>;
+    private buildHandlers;
+    private buildHandler;
+    private buildApiKeyHandler;
+    private buildBasicAuthHandler;
+    private buildHmacHandler;
+}
+//# sourceMappingURL=InboundConnectionFactory.d.ts.map

package/esm/src/connection/internal/InboundConnectionFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InboundConnectionFactory.d.ts","sourceRoot":"","sources":["../../../../src/src/connection/internal/InboundConnectionFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,CAAC;AACxC,OAAO,EAIH,UAAU,EAGb,MAAM,gCAAgC,CAAC;AAQxC,qBAAa,+BAA+B;IAGpC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJ3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoD;gBAErD,WAAW,EAAE,MAAM,CAAC,OAAO,kBAAkB,CAAC,iBAAiB,CAAC,EAChE,MAAM,EAAE,MAAM,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,EAC5C,MAAM,EAAE,MAAM;IAKnC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;YAa3C,aAAa;IAc3B,OAAO,CAAC,YAAY;YAuDN,kBAAkB;YAiIlB,qBAAqB;YA2FrB,gBAAgB;CAsJjC"}

package/esm/src/connection/internal/InboundConnectionFactory.js

@@ -0,0 +1,390 @@
+import { credentialv1alpha1 } from '../../services/credentials/mod.js';
+import { create } from '@bufbuild/protobuf';
+import { Buffer } from 'node:buffer';
+import { createHmac } from 'node:crypto';
+import { alwaysValid, CredentialHolder } from './CredentialHolder.js';
+import { isTokenValid } from '../../services/credentials/isTokenValid.js';
+import { LruCache } from '../../../deps/jsr.io/@std/cache/0.2.0/mod.js';
+export class ExpressInboundConnectionFactory {
+    constructor(credentials, tokens, logger) {
+        Object.defineProperty(this, "credentials", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: credentials
+        });
+        Object.defineProperty(this, "tokens", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: tokens
+        });
+        Object.defineProperty(this, "logger", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: logger
+        });
+        Object.defineProperty(this, "cache", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.cache = new LruCache(100);
+    }
+    handler(cnx) {
+        const cached = this.cache.get(cnx.id);
+        if (cached) {
+            return cached;
+        }
+        const handler = this.buildHandlers(cnx);
+        this.cache.set(cnx.id, handler);
+        return handler;
+    }
+    async buildHandlers(cnx) {
+        const handlers = [];
+        for (const [index, cnxCredential] of cnx.credentials.entries()) {
+            const handler = await this.buildHandler(cnxCredential, index, cnx);
+            if (handler) {
+                handlers.push(handler);
+            }
+        }
+        return composeHandlers(handlers);
+    }
+    buildHandler(cnxCredential, index, cnx) {
+        const asc = cnxCredential.authSchemeConfig;
+        const redactedCredential = cnxCredential.credential;
+        if (!asc || !redactedCredential) {
+            this.logger.warn('Connection credential is missing authSchemeConfig or credential', {
+                connectionId: cnx.id,
+                index,
+                asc,
+                redactedCredential,
+            });
+            return Promise.resolve(undefined);
+        }
+        switch (asc.type) {
+            case 'api-key':
+                if (!asc.apiKey) {
+                    this.logger.warn('api-key auth has missing apiKey config', {
+                        connectionId: cnx.id,
+                        index,
+                    });
+                    return Promise.resolve(undefined);
+                }
+                return this.buildApiKeyHandler(asc.apiKey, redactedCredential);
+            case 'basic-auth':
+                return this.buildBasicAuthHandler(redactedCredential);
+            case 'hmac':
+                if (!asc.hmac) {
+                    this.logger.warn('hmac auth has missing hmac config', {
+                        connectionId: cnx.id,
+                        index,
+                    });
+                    return Promise.resolve(undefined);
+                }
+                return this.buildHmacHandler(asc.hmac, redactedCredential);
+            default:
+                this.logger.warn('Unsupported inbound authSchemeConfig type', {
+                    connectionId: cnx.id,
+                    index,
+                    type: asc.type,
+                });
+                return Promise.resolve(undefined);
+        }
+    }
+    async buildApiKeyHandler(cfg, redactedCredential) {
+        const initial = await this.tokens.getToken({
+            credentialId: redactedCredential.id,
+            forceRefresh: false,
+        });
+        if (!initial || !initial.token) {
+            this.logger.error('API key token not found for credential when building handler', {
+                credentialId: redactedCredential.id,
+            });
+            return (_req, res) => {
+                this.logger.warn('API key not configured before deployment, please redeploy your project', { credentialId: redactedCredential.id });
+                res.status(401).json({ error: 'Unauthorised' });
+            };
+        }
+        const holder = new CredentialHolder(initial.token, isTokenValid, async () => {
+            const refreshed = await this.tokens.getToken({
+                credentialId: redactedCredential.id,
+                forceRefresh: false,
+            });
+            return refreshed.token;
+        });
+        let extractor;
+        switch (cfg.in) {
+            case 'header': {
+                const headerKey = cfg.name.toLowerCase();
+                extractor = (req) => {
+                    const headerVal = req.headers[headerKey];
+                    if (Array.isArray(headerVal)) {
+                        return headerVal[0];
+                    }
+                    if (typeof headerVal === 'string') {
+                        return headerVal;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            case 'query': {
+                const name = cfg.name;
+                extractor = (req) => {
+                    const q = req.query?.[name];
+                    if (typeof q === 'string') {
+                        return q;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            case 'cookie': {
+                const name = cfg.name;
+                extractor = (req) => {
+                    const c = req.cookies?.[name];
+                    if (typeof c === 'string') {
+                        return c;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            default:
+                throw new Error('Unsupported apiKey.in value: ' + cfg.in);
+        }
+        async function verify(apiKey) {
+            const expected = await holder.get();
+            if (!expected) {
+                return false;
+            }
+            let expectedKey = expected.tokenType
+                ? `${expected.tokenType} ${expected.accessToken}`
+                : expected.accessToken;
+            if (apiKey === expectedKey || apiKey === expected.accessToken) {
+                return true;
+            }
+            // TODO: Is this a DDOS if they just provide the wrong credential?
+            holder.refresh();
+            expectedKey = expected.tokenType
+                ? `${expected.tokenType} ${expected.accessToken}`
+                : expected.accessToken;
+            return apiKey === expectedKey || apiKey === expected.accessToken;
+        }
+        return async (req, res, next) => {
+            try {
+                const gotKey = extractor(req);
+                if (!gotKey) {
+                    return res.status(401).json({ error: 'Unauthorised' });
+                }
+                if (await verify(gotKey)) {
+                    return next();
+                }
+                return res.status(401).json({ error: 'Unauthorised' });
+            }
+            catch (err) {
+                this.logger.error('Error verifying API key', { err });
+                res.status(401).json({ error: 'Unauthorised' });
+            }
+        };
+    }
+    async buildBasicAuthHandler(redactedCredential) {
+        const response = await this.credentials.get({ id: redactedCredential.id });
+        if (!response || !response.credential) {
+            this.logger.error('BasicAuth credential not found when building handler', {
+                credentialId: redactedCredential.id,
+            });
+            return (_req, res) => {
+                this.logger.warn('BasicAuth not configured before deployment, please redeploy your project', {
+                    credentialId: redactedCredential.id,
+                });
+                res.status(401).json({ error: 'Unauthorised' });
+            };
+        }
+        const holder = new CredentialHolder(response.credential, alwaysValid, async () => {
+            const refreshed = await this.credentials.get({ id: redactedCredential.id });
+            return refreshed.credential;
+        });
+        // Build parser once
+        const parseAuth = (req) => {
+            const headerVal = req.headers['authorization'];
+            const header = Array.isArray(headerVal) ? headerVal[0] : headerVal;
+            if (!header || typeof header !== 'string') {
+                return undefined;
+            }
+            const [scheme, encoded] = header.split(' ');
+            if (!scheme || scheme.toLowerCase() !== 'basic' || !encoded) {
+                return undefined;
+            }
+            let decoded = '';
+            try {
+                decoded = Buffer.from(encoded, 'base64').toString('utf8');
+            }
+            catch (err) {
+                this.logger.warn('Error decoding BasicAuth header', { encoded, error: err });
+                return undefined;
+            }
+            const sep = decoded.indexOf(':');
+            if (sep === -1) {
+                return undefined;
+            }
+            return { username: decoded.slice(0, sep), password: decoded.slice(sep + 1) };
+        };
+        return async (req, res, next) => {
+            try {
+                const parsed = parseAuth(req);
+                if (!parsed) {
+                    return res.status(401).json({ error: 'Unauthorised' });
+                }
+                const c1 = await holder.get();
+                const data1 = create(credentialv1alpha1.CredentialDataBasicAuthSchema, c1.data);
+                if (parsed.username === data1.username && parsed.password === data1.password) {
+                    return next();
+                }
+                const c2 = await holder.get(true);
+                const data2 = create(credentialv1alpha1.CredentialDataBasicAuthSchema, c2.data);
+                if (parsed.username === data2.username && parsed.password === data2.password) {
+                    return next();
+                }
+                return res.status(401).json({ error: 'Unauthorised' });
+            }
+            catch (err) {
+                this.logger.error('Error verifying BasicAuth', { err });
+                res.status(401).json({ error: 'Unauthorised' });
+            }
+        };
+    }
+    async buildHmacHandler(cfg, redactedCredential) {
+        const response = await this.credentials.get({ id: redactedCredential.id });
+        if (!response || !response.credential) {
+            this.logger.error('HMAC credential not found', { credentialId: redactedCredential.id });
+            return (_req, res) => {
+                res.status(401).json({ error: 'Unauthorised' });
+            };
+        }
+        const holder = new CredentialHolder(response.credential, alwaysValid, async () => {
+            const refreshed = await this.credentials.get({ id: redactedCredential.id });
+            return refreshed.credential;
+        });
+        let extractor;
+        switch (cfg.in) {
+            case 'query': {
+                const name = cfg.name;
+                extractor = (req) => {
+                    const q = req.query?.[name];
+                    if (typeof q === 'string') {
+                        return q;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            case 'header': {
+                const headerKey = cfg.name.toLowerCase();
+                extractor = (req) => {
+                    const hv = req.headers[headerKey];
+                    if (Array.isArray(hv)) {
+                        return hv[0];
+                    }
+                    if (typeof hv === 'string') {
+                        return hv;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            case 'cookie': {
+                const name = cfg.name;
+                extractor = (req) => {
+                    const c = req.cookies?.[name];
+                    if (typeof c === 'string') {
+                        return c;
+                    }
+                    return undefined;
+                };
+                break;
+            }
+            default:
+                throw new Error('Unsupported hmac.in value: ' + cfg.in);
+        }
+        const logger = this.logger;
+        async function computeDigest(req) {
+            const cred = await holder.get();
+            const raw = create(credentialv1alpha1.CredentialDataRawSchema, cred.data);
+            const secret = Buffer.from(raw.raw).toString('utf8');
+            const hmac = createHmac(cfg.algorithm, secret);
+            for (const input of cfg.digestInputs) {
+                switch (input) {
+                    case 'body': {
+                        if (typeof req.rawBody === 'undefined') {
+                            const { body: _body, ...rest } = req;
+                            // NOTE: address this in future, at the moment only the JSON body-parser is populating the
+                            // rawBody property, so this should only happen if the user is not using JSON.
+                            logger.warn('request.rawBody missing from request, HMAC signature is likely going to fail, this can happen if the payload is not application/json', { req: { ...rest, body: '**redacted**' } });
+                            return '';
+                        }
+                        hmac.update(req.rawBody);
+                        break;
+                    }
+                    case 'url':
+                        hmac.update(req.originalUrl ?? req.url);
+                        break;
+                    default:
+                        break;
+                }
+            }
+            return hmac.digest(cfg.encoding);
+        }
+        return async (req, res, next) => {
+            try {
+                const provided = extractor(req);
+                if (!provided) {
+                    return res.status(401).json({ error: 'Unauthorised' });
+                }
+                const digest1 = await computeDigest(req);
+                if (provided === digest1) {
+                    return next();
+                }
+                // TODO: Is this a DDOS if they just provide the wrong credential?
+                holder.refresh();
+                const digest2 = await computeDigest(req);
+                if (provided === digest2) {
+                    return next();
+                }
+                return res.status(401).json({ error: 'Unauthorised' });
+            }
+            catch (err) {
+                this.logger.error('Error verifying HMAC', { err });
+                res.status(401).json({ error: 'Unauthorised' });
+            }
+        };
+    }
+}
+function composeHandlers(handlers) {
+    return (req, res, next) => {
+        let index = -1;
+        const dispatch = (i, err) => {
+            if (err) {
+                return next(err);
+            }
+            if (i <= index) {
+                return next(new Error('next() called multiple times'));
+            }
+            index = i;
+            if (i === handlers.length) {
+                return next();
+            }
+            const handler = handlers[i];
+            try {
+                handler(req, res, (err2) => dispatch(i + 1, err2));
+            }
+            catch (e) {
+                next(e);
+            }
+        };
+        dispatch(0);
+    };
+}