@vtex/api 6.45.4

package/lib/service/worker/runtime/http/index.d.ts

@@ -0,0 +1,5 @@
+import TokenBucket from 'tokenbucket';
+import { IOClients } from '../../../../clients/IOClients';
+import { ClientsConfig, ParamsContext, RecorderState, ServiceRoute } from '../typings';
+export declare const createPrivateHttpRoute: <T extends IOClients, U extends RecorderState, V extends ParamsContext>(clientsConfig: ClientsConfig<T>, serviceHandler: import("koa-compose").Middleware<import("../typings").ServiceContext<T, U, V>> | import("koa-compose").Middleware<import("../typings").ServiceContext<T, U, V>>[], serviceRoute: ServiceRoute, routeId: string, globalLimiter: TokenBucket | undefined) => import("koa-compose").ComposedMiddleware<import("../typings").ServiceContext<T, U, V>>;
+export declare const createPublicHttpRoute: <T extends IOClients, U extends RecorderState, V extends ParamsContext>(clientsConfig: ClientsConfig<T>, serviceHandler: import("koa-compose").Middleware<import("../typings").ServiceContext<T, U, V>> | import("koa-compose").Middleware<import("../typings").ServiceContext<T, U, V>>[], serviceRoute: ServiceRoute, routeId: string, globalLimiter: TokenBucket | undefined) => import("koa-compose").ComposedMiddleware<import("../typings").ServiceContext<T, U, V>>;

package/lib/service/worker/runtime/http/index.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tracingMiddlewares_1 = require("../../../tracing/tracingMiddlewares");
+const compose_1 = require("../utils/compose");
+const toArray_1 = require("../utils/toArray");
+const authTokens_1 = require("./middlewares/authTokens");
+const cancellationToken_1 = require("./middlewares/cancellationToken");
+const clients_1 = require("./middlewares/clients");
+const context_1 = require("./middlewares/context");
+const rateLimit_1 = require("./middlewares/rateLimit");
+const requestStats_1 = require("./middlewares/requestStats");
+const setCookie_1 = require("./middlewares/setCookie");
+const settings_1 = require("./middlewares/settings");
+const timings_1 = require("./middlewares/timings");
+const vary_1 = require("./middlewares/vary");
+exports.createPrivateHttpRoute = (clientsConfig, serviceHandler, serviceRoute, routeId, globalLimiter) => {
+    var _a, _b;
+    const { implementation, options } = clientsConfig;
+    const middlewares = toArray_1.toArray(serviceHandler);
+    const pipeline = [
+        tracingMiddlewares_1.nameSpanOperationMiddleware('private-handler', routeId),
+        context_1.createPvtContextMiddleware(routeId, serviceRoute),
+        cancellationToken_1.cancellationToken,
+        requestStats_1.trackIncomingRequestStats,
+        vary_1.vary,
+        authTokens_1.authTokens,
+        clients_1.clients(implementation, options),
+        ...(serviceRoute.settingsType === 'workspace' || serviceRoute.settingsType === 'userAndWorkspace' ? [settings_1.getServiceSettings()] : []),
+        timings_1.timings,
+        rateLimit_1.concurrentRateLimiter((_a = serviceRoute === null || serviceRoute === void 0 ? void 0 : serviceRoute.rateLimitPerReplica) === null || _a === void 0 ? void 0 : _a.concurrent),
+        rateLimit_1.perMinuteRateLimiter((_b = serviceRoute === null || serviceRoute === void 0 ? void 0 : serviceRoute.rateLimitPerReplica) === null || _b === void 0 ? void 0 : _b.perMinute, globalLimiter),
+        tracingMiddlewares_1.traceUserLandRemainingPipelineMiddleware(),
+        ...middlewares,
+    ];
+    return compose_1.compose(pipeline);
+};
+exports.createPublicHttpRoute = (clientsConfig, serviceHandler, serviceRoute, routeId, globalLimiter) => {
+    var _a, _b;
+    const { implementation, options } = clientsConfig;
+    const middlewares = toArray_1.toArray(serviceHandler);
+    const pipeline = [
+        tracingMiddlewares_1.nameSpanOperationMiddleware('public-handler', routeId),
+        context_1.createPubContextMiddleware(routeId, serviceRoute),
+        cancellationToken_1.cancellationToken,
+        requestStats_1.trackIncomingRequestStats,
+        vary_1.vary,
+        authTokens_1.authTokens,
+        clients_1.clients(implementation, options),
+        ...(serviceRoute.settingsType === 'workspace' || serviceRoute.settingsType === 'userAndWorkspace' ? [settings_1.getServiceSettings()] : []),
+        setCookie_1.removeSetCookie,
+        timings_1.timings,
+        rateLimit_1.concurrentRateLimiter((_a = serviceRoute === null || serviceRoute === void 0 ? void 0 : serviceRoute.rateLimitPerReplica) === null || _a === void 0 ? void 0 : _a.concurrent),
+        rateLimit_1.perMinuteRateLimiter((_b = serviceRoute === null || serviceRoute === void 0 ? void 0 : serviceRoute.rateLimitPerReplica) === null || _b === void 0 ? void 0 : _b.perMinute, globalLimiter),
+        tracingMiddlewares_1.traceUserLandRemainingPipelineMiddleware(),
+        ...middlewares,
+    ];
+    return compose_1.compose(pipeline);
+};

package/lib/service/worker/runtime/http/middlewares/authTokens.d.ts

@@ -0,0 +1,3 @@
+import { IOClients } from '../../../../../clients/IOClients';
+import { ParamsContext, RecorderState, ServiceContext } from '../../typings';
+export declare function authTokens<T extends IOClients, U extends RecorderState, V extends ParamsContext>(ctx: ServiceContext<T, U, V>, next: () => Promise<void>): Promise<void>;

package/lib/service/worker/runtime/http/middlewares/authTokens.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const JANUS_ENV_COOKIE_KEY = 'vtex-commerce-env';
+const VTEX_ID_COOKIE_KEY = 'VtexIdclientAutCookie';
+async function authTokens(ctx, next) {
+    const { vtex: { account } } = ctx;
+    ctx.vtex.adminUserAuthToken = ctx.cookies.get(VTEX_ID_COOKIE_KEY);
+    ctx.vtex.storeUserAuthToken = ctx.cookies.get(`${VTEX_ID_COOKIE_KEY}_${account}`);
+    ctx.vtex.janusEnv = ctx.cookies.get(JANUS_ENV_COOKIE_KEY);
+    await next();
+}
+exports.authTokens = authTokens;

package/lib/service/worker/runtime/http/middlewares/cancellationToken.d.ts

@@ -0,0 +1,3 @@
+import { IOClients } from '../../../../../clients/IOClients';
+import { ParamsContext, RecorderState, ServiceContext } from '../../typings';
+export declare function cancellationToken<T extends IOClients, U extends RecorderState, V extends ParamsContext>(ctx: ServiceContext<T, U, V>, next: () => Promise<void>): Promise<void>;

package/lib/service/worker/runtime/http/middlewares/cancellationToken.js

@@ -0,0 +1,18 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const axios_1 = __importDefault(require("axios"));
+const constants_1 = require("../../../../../constants");
+async function cancellationToken(ctx, next) {
+    if (constants_1.cancellableMethods.has(ctx.method.toUpperCase())) {
+        ctx.vtex.cancellation = {
+            cancelable: true,
+            cancelled: false,
+            source: axios_1.default.CancelToken.source(),
+        };
+    }
+    await next();
+}
+exports.cancellationToken = cancellationToken;

package/lib/service/worker/runtime/http/middlewares/clients.d.ts

@@ -0,0 +1,4 @@
+import { ClientsImplementation, IOClients } from '../../../../../clients/IOClients';
+import { InstanceOptions } from '../../../../../HttpClient';
+import { ParamsContext, RecorderState, ServiceContext } from '../../typings';
+export declare function clients<T extends IOClients, U extends RecorderState, V extends ParamsContext>(ClientsImpl: ClientsImplementation<T>, clientOptions: Record<string, InstanceOptions>): (ctx: ServiceContext<T, U, V>, next: () => Promise<void>) => Promise<void>;

package/lib/service/worker/runtime/http/middlewares/clients.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+function clients(ClientsImpl, clientOptions) {
+    return async function withClients(ctx, next) {
+        if (ctx.serverTiming) {
+            ctx.vtex.serverTiming = ctx.serverTiming;
+        }
+        ctx.clients = new ClientsImpl(clientOptions, ctx.vtex);
+        await next();
+    };
+}
+exports.clients = clients;

package/lib/service/worker/runtime/http/middlewares/context.d.ts

@@ -0,0 +1,4 @@
+import { IOClients } from '../../../../../clients/IOClients';
+import { ParamsContext, RecorderState, ServiceContext, ServiceRoute } from './../../typings';
+export declare const createPvtContextMiddleware: (routeId: string, { smartcache }: ServiceRoute) => <T extends IOClients, U extends RecorderState, V extends ParamsContext>(ctx: ServiceContext<T, U, V>, next: () => Promise<void>) => Promise<void>;
+export declare const createPubContextMiddleware: (routeId: string, { smartcache }: ServiceRoute) => <T extends IOClients, U extends RecorderState, V extends ParamsContext>(ctx: ServiceContext<T, U, V>, next: () => Promise<void>) => Promise<void>;

package/lib/service/worker/runtime/http/middlewares/context.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const querystring_1 = require("querystring");
+const constants_1 = require("../../../../../constants");
+const context_1 = require("../../utils/context");
+exports.createPvtContextMiddleware = (routeId, { smartcache }) => {
+    return async function pvtContext(ctx, next) {
+        const { params, request: { header }, } = ctx;
+        ctx.vtex = {
+            ...context_1.prepareHandlerCtx(header, ctx.tracing),
+            ...(smartcache && { recorder: ctx.state.recorder }),
+            route: {
+                id: routeId,
+                params,
+                type: 'private',
+            },
+        };
+        await next();
+    };
+};
+exports.createPubContextMiddleware = (routeId, { smartcache }) => {
+    return async function pubContext(ctx, next) {
+        const { request: { header }, } = ctx;
+        ctx.vtex = {
+            ...context_1.prepareHandlerCtx(header, ctx.tracing),
+            ...(smartcache && { recorder: ctx.state.recorder }),
+            route: {
+                declarer: header[constants_1.COLOSSUS_ROUTE_DECLARER_HEADER],
+                id: routeId,
+                params: querystring_1.parse(header[constants_1.COLOSSUS_PARAMS_HEADER]),
+                type: 'public',
+            },
+        };
+        await next();
+    };
+};

package/lib/service/worker/runtime/http/middlewares/error.d.ts

@@ -0,0 +1,2 @@
+import { ServiceContext } from '../../typings';
+export declare function error(ctx: ServiceContext, next: () => Promise<void>): Promise<void>;

package/lib/service/worker/runtime/http/middlewares/error.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const constants_1 = require("../../../../../constants");
+const RequestCancelledError_1 = require("../../../../../errors/RequestCancelledError");
+const TooManyRequestsError_1 = require("../../../../../errors/TooManyRequestsError");
+const error_1 = require("../../../../../utils/error");
+const logger_1 = require("../../../../logger");
+const CACHE_CONTROL_HEADER = 'cache-control';
+const META_HEADER = 'x-vtex-meta';
+const ETAG_HEADER = 'etag';
+const TWO_SECONDS_S = 2;
+const production = process.env.VTEX_PRODUCTION === 'true';
+// todo: unify GraphQL and REST exception treatment
+const logAndRemoveSensitiveData = (ctx, err) => {
+    const { method, status, query, vtex: { operationId, requestId, route: { id, params, }, serverTiming, }, headers: { 'x-forwarded-path': forwardedPath, 'x-forwarded-host': forwardedHost, 'x-forwarded-proto': forwardedProto, 'x-vtex-caller': caller, 'x-vtex-platform': platform, 'x-vtex-product': product, 'x-vtex-locale': locale, }, } = ctx;
+    // Grab level from originalError, default to "error" level.
+    let level = err && err.level;
+    if (!level || !(level === logger_1.LogLevel.Error || level === logger_1.LogLevel.Warn)) {
+        level = logger_1.LogLevel.Error;
+    }
+    const log = {
+        ...err,
+        caller,
+        forwardedHost,
+        forwardedPath,
+        forwardedProto,
+        locale,
+        method,
+        operationId,
+        params,
+        platform,
+        product,
+        query,
+        requestId,
+        routeId: id,
+        serverTiming,
+        status,
+    };
+    // Use sendLog directly to avoid cleaning error twice.
+    ctx.vtex.logger.log(log, level);
+    if (!constants_1.LINKED) {
+        error_1.SENSITIVE_EXCEPTION_FIELDS.forEach(field => {
+            delete err[field];
+        });
+    }
+};
+async function error(ctx, next) {
+    var _a;
+    try {
+        await next();
+    }
+    catch (e) {
+        if (e instanceof RequestCancelledError_1.RequestCancelledError) {
+            ctx.status = RequestCancelledError_1.cancelledRequestStatus;
+            return;
+        }
+        if (e instanceof TooManyRequestsError_1.TooManyRequestsError) {
+            ctx.status = TooManyRequestsError_1.tooManyRequestsStatus;
+            return;
+        }
+        console.error('[node-vtex-api error]', e);
+        const err = error_1.cleanError(e);
+        // Add response
+        ctx.status = e && e.status >= 400 && e.status <= 599
+            ? e.status
+            : ctx.status >= 500 && ctx.status <= 599
+                ? ctx.status
+                : 500;
+        // Do not generate etag for errors
+        ctx.remove(META_HEADER);
+        ctx.remove(ETAG_HEADER);
+        (_a = ctx.vtex.recorder) === null || _a === void 0 ? void 0 : _a.clear();
+        // In production errors, add two second cache
+        if (production) {
+            ctx.set(CACHE_CONTROL_HEADER, `public, max-age=${TWO_SECONDS_S}`);
+        }
+        else {
+            ctx.set(CACHE_CONTROL_HEADER, `no-cache, no-store`);
+        }
+        logAndRemoveSensitiveData(ctx, err);
+        ctx.body = ctx.body || err;
+    }
+}
+exports.error = error;

package/lib/service/worker/runtime/http/middlewares/rateLimit.d.ts

@@ -0,0 +1,6 @@
+import TokenBucket from 'tokenbucket';
+import { ServiceContext } from '../../typings';
+declare function noopMiddleware(_: ServiceContext, next: () => Promise<void>): Promise<void>;
+export declare function perMinuteRateLimiter(rateLimit?: number, globalLimiter?: TokenBucket): typeof noopMiddleware;
+export declare function concurrentRateLimiter(rateLimit?: number): typeof noopMiddleware;
+export {};

package/lib/service/worker/runtime/http/middlewares/rateLimit.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const errors_1 = require("../../../../../errors");
+const tokenBucket_1 = require("../../utils/tokenBucket");
+const responseMessageConcurrent = 'Rate Exceeded: Too many requests in execution';
+const responseMessagePerMinute = 'Rate Exceeded: Too many requests per minute';
+function noopMiddleware(_, next) {
+    return next();
+}
+function perMinuteRateLimiter(rateLimit, globalLimiter) {
+    if (!rateLimit && !globalLimiter) {
+        return noopMiddleware;
+    }
+    const tokenBucket = tokenBucket_1.createTokenBucket(rateLimit, globalLimiter);
+    return function perMinuteRateMiddleware(ctx, next) {
+        if (!tokenBucket.removeTokensSync(1)) {
+            throw new errors_1.TooManyRequestsError(responseMessagePerMinute);
+        }
+        return next();
+    };
+}
+exports.perMinuteRateLimiter = perMinuteRateLimiter;
+function concurrentRateLimiter(rateLimit) {
+    if (!rateLimit) {
+        return noopMiddleware;
+    }
+    let reqsInExecution = 0;
+    const maxRequests = rateLimit;
+    return async function concurrentRateMiddleware(ctx, next) {
+        if (reqsInExecution >= maxRequests) {
+            throw new errors_1.TooManyRequestsError(responseMessageConcurrent);
+        }
+        reqsInExecution++;
+        try {
+            await next();
+        }
+        finally {
+            reqsInExecution--;
+        }
+    };
+}
+exports.concurrentRateLimiter = concurrentRateLimiter;

package/lib/service/worker/runtime/http/middlewares/requestStats.d.ts

@@ -0,0 +1,17 @@
+import { IOClients } from '../../../../../clients/IOClients';
+import { ParamsContext, RecorderState, ServiceContext } from '../../typings';
+export declare const cancelMessage = "Request cancelled";
+declare class IncomingRequestStats {
+    aborted: number;
+    closed: number;
+    total: number;
+    get(): {
+        aborted: number;
+        closed: number;
+        total: number;
+    };
+    clear(): void;
+}
+export declare const incomingRequestStats: IncomingRequestStats;
+export declare function trackIncomingRequestStats<T extends IOClients, U extends RecorderState, V extends ParamsContext>(ctx: ServiceContext<T, U, V>, next: () => Promise<void>): Promise<void>;
+export {};

package/lib/service/worker/runtime/http/middlewares/requestStats.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cancelMessage = 'Request cancelled';
+class IncomingRequestStats {
+    constructor() {
+        this.aborted = 0;
+        this.closed = 0;
+        this.total = 0;
+    }
+    get() {
+        return {
+            aborted: this.aborted,
+            closed: this.closed,
+            total: this.total,
+        };
+    }
+    clear() {
+        this.aborted = 0;
+        this.closed = 0;
+        this.total = 0;
+    }
+}
+exports.incomingRequestStats = new IncomingRequestStats();
+const requestClosed = () => {
+    exports.incomingRequestStats.closed++;
+};
+const requestAborted = (ctx) => () => {
+    exports.incomingRequestStats.aborted++;
+    if (ctx.vtex.cancellation && ctx.vtex.cancellation.cancelable) {
+        ctx.vtex.cancellation.source.cancel(exports.cancelMessage);
+        ctx.vtex.cancellation.cancelled = true;
+    }
+};
+async function trackIncomingRequestStats(ctx, next) {
+    ctx.req.on('close', requestClosed);
+    ctx.req.on('aborted', requestAborted(ctx));
+    exports.incomingRequestStats.total++;
+    await next();
+}
+exports.trackIncomingRequestStats = trackIncomingRequestStats;

package/lib/service/worker/runtime/http/middlewares/setCookie.d.ts

@@ -0,0 +1,3 @@
+import { IOClients } from '../../../../../clients/IOClients';
+import { ParamsContext, RecorderState, ServiceContext } from '../../typings';
+export declare function removeSetCookie<T extends IOClients, U extends RecorderState, V extends ParamsContext>(ctx: ServiceContext<T, U, V>, next: () => Promise<void>): Promise<void>;

package/lib/service/worker/runtime/http/middlewares/setCookie.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ramda_1 = require("ramda");
+const BLACKLISTED_COOKIES = new Set(['checkout.vtex.com']);
+const warnMessage = (keys) => `Removing set-cookie from response since cache-control has as public scope.
+This can be a huge security risk. Please remove either the public scope or set-cookie from your response.
+Cookies dropped:
+
+  ${keys.join('\n\t')}
+`;
+const findStr = (target, set) => ramda_1.find((a) => a.toLocaleLowerCase() === target, set);
+const findScopeInCacheControl = (cacheControl) => {
+    const splitted = cacheControl && cacheControl.split(/\s*,\s*/g);
+    const scopePublic = splitted && findStr('public', splitted);
+    return scopePublic;
+};
+const cookieKey = (cookie) => ramda_1.compose(ramda_1.head, ramda_1.split('='))(cookie);
+const indexCookieByKeys = (setCookie) => ramda_1.map((cookie) => [cookieKey(cookie), cookie], setCookie);
+async function removeSetCookie(ctx, next) {
+    const { vtex: { logger } } = ctx;
+    await next();
+    const setCookie = ctx.response.headers['set-cookie'];
+    if (!setCookie || ramda_1.isEmpty(setCookie)) {
+        return;
+    }
+    const cacheControl = ctx.response.headers['cache-control'];
+    const scope = findScopeInCacheControl(cacheControl);
+    if (scope === 'public') {
+        const indexedCookies = indexCookieByKeys(setCookie);
+        const cookies = ramda_1.reduce((acc, [key, payload]) => {
+            if (BLACKLISTED_COOKIES.has(key)) {
+                acc.droppedKeys.push(key);
+            }
+            else {
+                acc.addedPayload.push(payload);
+            }
+            return acc;
+        }, {
+            addedPayload: [],
+            droppedKeys: [],
+        }, indexedCookies);
+        if (cookies.droppedKeys.length > 0) {
+            ctx.set('set-cookie', cookies.addedPayload);
+            console.warn(warnMessage(cookies.droppedKeys));
+            logger.warn({
+                cookieKeys: cookies.droppedKeys,
+                message: 'Setting cookies in a public route!',
+            });
+        }
+    }
+}
+exports.removeSetCookie = removeSetCookie;

package/lib/service/worker/runtime/http/middlewares/settings.d.ts

@@ -0,0 +1,9 @@
+import { AppMetaInfo, Apps } from '../../../../../clients/infra/Apps';
+import { IOClients } from '../../../../../clients/IOClients';
+import { RequestTracingConfig } from '../../../../../HttpClient';
+import { Assets } from './../../../../../clients/infra/Assets';
+import { ParamsContext, RecorderState, ServiceContext } from './../../typings';
+export declare const getFilteredDependencies: (appAtMajor: string, dependencies: AppMetaInfo[]) => AppMetaInfo[];
+export declare const getDependenciesHash: (dependencies: AppMetaInfo[]) => string;
+export declare const getDependenciesSettings: (apps: Apps, assets: Assets, tracingConfig?: RequestTracingConfig | undefined) => Promise<Record<string, any>[]>;
+export declare const getServiceSettings: () => <T extends IOClients, U extends RecorderState, V extends ParamsContext>(ctx: ServiceContext<T, U, V>, next: () => Promise<void>) => Promise<void>;