@webiny/api-core 6.5.0-beta.1 → 6.5.0-beta.11

package/idp/JwksCache.js

@@ -1,26 +1,53 @@
-class JwksCache {
+import { createImplementation } from "@webiny/feature/api";
+import { z } from "zod";
+import { HttpClient } from "../features/httpClient/index.js";
+import { JwkCache } from "./abstractions.js";
+const oidcConfigurationSchema = z.object({
+    jwks_uri: z.string()
+});
+const jwksSchema = z.object({
+    keys: z.array(z.looseObject({
+        kid: z.string().optional()
+    }))
+});
+function getOpenidConfigurationUrl(issuer) {
+    const openidUrl = new URL(issuer);
+    const pathname = openidUrl.pathname + "/.well-known/openid-configuration";
+    openidUrl.pathname = pathname.replace(/\/+/g, "/");
+    return openidUrl.toString();
+}
+class JwksCacheImpl {
+    constructor(httpClient){
+        this.httpClient = httpClient;
+        this.cache = new Map();
+    }
     async getKeys(issuer) {
         const cached = this.cache.get(issuer);
-        if (cached) return cached.jwks;
-        const openidUrl = new URL(issuer);
-        const pathname = openidUrl.pathname + "/.well-known/openid-configuration";
-        openidUrl.pathname = pathname.replace(/\/+/g, "/");
-        const oidcConfig = await fetch(openidUrl.toString()).then((res)=>res.json());
-        const jwksResponse = await fetch(oidcConfig.jwks_uri).then((res)=>res.json());
+        if (cached) return cached;
+        const openidConfigurationUrl = getOpenidConfigurationUrl(issuer);
+        const oidcConfig = await this.fetchJson(openidConfigurationUrl, oidcConfigurationSchema);
+        const jwksResponse = await this.fetchJson(oidcConfig.jwks_uri, jwksSchema);
         const jwks = jwksResponse.keys;
-        this.cache.set(issuer, {
-            oidcConfig,
-            jwks
-        });
+        this.cache.set(issuer, jwks);
         return jwks;
     }
-    clearCache() {
-        this.cache.clear();
-    }
-    constructor(){
-        this.cache = new Map();
+    async fetchJson(url, schema) {
+        const response = await this.httpClient.requestJson({
+            url
+        });
+        if (response.isFail()) throw response.error;
+        const result = schema.safeParse(response.value);
+        if (!result.success) throw new Error(`Invalid response from "${url}": ${result.error.message}`);
+        return result.data;
     }
 }
+const JwksCache = createImplementation({
+    abstraction: JwkCache,
+    implementation: JwksCacheImpl,
+    dependencies: [
+        HttpClient
+    ]
+});
 export { JwksCache };
 
 //# sourceMappingURL=JwksCache.js.map

package/idp/JwksCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"idp/JwksCache.js","sources":["../../src/idp/JwksCache.ts"],"sourcesContent":["import type { Jwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport { JwkCache } from \"./abstractions.js\";\n\ninterface OidcConfiguration {\n    jwks_uri: string;\n    [key: string]: any;\n}\n\ninterface CacheEntry {\n    oidcConfig: OidcConfiguration;\n    jwks: Jwk[];\n}\n\nexport class JwksCache implements JwkCache.Interface {\n    private cache = new Map<string, CacheEntry>();\n\n    async getKeys(issuer: string): Promise<Jwk[]> {\n        // Check cache first\n        const cached = this.cache.get(issuer);\n        if (cached) {\n            return cached.jwks;\n        }\n\n        // Fetch OIDC configuration\n        const openidUrl = new URL(issuer);\n        const pathname = openidUrl.pathname + \"/.well-known/openid-configuration\";\n        openidUrl.pathname = pathname.replace(/\\/+/g, \"/\");\n\n        const oidcConfig = await fetch(openidUrl.toString()).then(\n            res => res.json() as Promise<OidcConfiguration>\n        );\n\n        // Fetch JWKs from jwks_uri\n        const jwksResponse = await fetch(oidcConfig.jwks_uri).then(res => res.json());\n        const jwks = jwksResponse.keys as Jwk[];\n\n        // Cache both config and JWKs\n        this.cache.set(issuer, {\n            oidcConfig,\n            jwks\n        });\n\n        return jwks;\n    }\n\n    clearCache(): void {\n        this.cache.clear();\n    }\n}\n"],"names":["JwksCache","issuer","cached","openidUrl","URL","pathname","oidcConfig","fetch","res","jwksResponse","jwks","Map"],"mappings":"AAaO,MAAMA;IAGT,MAAM,QAAQC,MAAc,EAAkB;QAE1C,MAAMC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAACD;QAC9B,IAAIC,QACA,OAAOA,OAAO,IAAI;QAItB,MAAMC,YAAY,IAAIC,IAAIH;QAC1B,MAAMI,WAAWF,UAAU,QAAQ,GAAG;QACtCA,UAAU,QAAQ,GAAGE,SAAS,OAAO,CAAC,QAAQ;QAE9C,MAAMC,aAAa,MAAMC,MAAMJ,UAAU,QAAQ,IAAI,IAAI,CACrDK,CAAAA,MAAOA,IAAI,IAAI;QAInB,MAAMC,eAAe,MAAMF,MAAMD,WAAW,QAAQ,EAAE,IAAI,CAACE,CAAAA,MAAOA,IAAI,IAAI;QAC1E,MAAME,OAAOD,aAAa,IAAI;QAG9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAACR,QAAQ;YACnBK;YACAI;QACJ;QAEA,OAAOA;IACX;IAEA,aAAmB;QACf,IAAI,CAAC,KAAK,CAAC,KAAK;IACpB;;aAjCQ,KAAK,GAAG,IAAIC;;AAkCxB"}
+{"version":3,"file":"idp/JwksCache.js","sources":["../../src/idp/JwksCache.ts"],"sourcesContent":["import { createImplementation } from \"@webiny/feature/api\";\nimport { z } from \"zod\";\nimport type { Jwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport { HttpClient } from \"~/features/httpClient/index.js\";\nimport { JwkCache } from \"./abstractions.js\";\n\nconst oidcConfigurationSchema = z.object({\n    jwks_uri: z.string()\n});\n\nconst jwksSchema = z.object({\n    keys: z.array(z.looseObject({ kid: z.string().optional() }))\n});\n\nfunction getOpenidConfigurationUrl(issuer: string): string {\n    const openidUrl = new URL(issuer);\n    const pathname = openidUrl.pathname + \"/.well-known/openid-configuration\";\n    openidUrl.pathname = pathname.replace(/\\/+/g, \"/\");\n    return openidUrl.toString();\n}\n\nclass JwksCacheImpl implements JwkCache.Interface {\n    private cache = new Map<string, Jwk[]>();\n\n    constructor(private readonly httpClient: HttpClient.Interface) {}\n\n    async getKeys(issuer: string): Promise<Jwk[]> {\n        const cached = this.cache.get(issuer);\n        if (cached) {\n            return cached;\n        }\n\n        const openidConfigurationUrl = getOpenidConfigurationUrl(issuer);\n        const oidcConfig = await this.fetchJson(openidConfigurationUrl, oidcConfigurationSchema);\n        const jwksResponse = await this.fetchJson(oidcConfig.jwks_uri, jwksSchema);\n        const jwks: Jwk[] = jwksResponse.keys;\n\n        this.cache.set(issuer, jwks);\n\n        return jwks;\n    }\n\n    // Throws, so a failed fetch fails the token verification instead of caching a bad answer.\n    private async fetchJson<T>(url: string, schema: z.ZodType<T>): Promise<T> {\n        const response = await this.httpClient.requestJson({ url });\n        if (response.isFail()) {\n            throw response.error;\n        }\n\n        const result = schema.safeParse(response.value);\n        if (!result.success) {\n            throw new Error(`Invalid response from \"${url}\": ${result.error.message}`);\n        }\n\n        return result.data;\n    }\n}\n\nexport const JwksCache = createImplementation({\n    abstraction: JwkCache,\n    implementation: JwksCacheImpl,\n    dependencies: [HttpClient]\n});\n"],"names":["oidcConfigurationSchema","z","jwksSchema","getOpenidConfigurationUrl","issuer","openidUrl","URL","pathname","JwksCacheImpl","httpClient","Map","cached","openidConfigurationUrl","oidcConfig","jwksResponse","jwks","url","schema","response","result","Error","JwksCache","createImplementation","JwkCache","HttpClient"],"mappings":";;;;AAMA,MAAMA,0BAA0BC,EAAE,MAAM,CAAC;IACrC,UAAUA,EAAE,MAAM;AACtB;AAEA,MAAMC,aAAaD,EAAE,MAAM,CAAC;IACxB,MAAMA,EAAE,KAAK,CAACA,EAAE,WAAW,CAAC;QAAE,KAAKA,EAAE,MAAM,GAAG,QAAQ;IAAG;AAC7D;AAEA,SAASE,0BAA0BC,MAAc;IAC7C,MAAMC,YAAY,IAAIC,IAAIF;IAC1B,MAAMG,WAAWF,UAAU,QAAQ,GAAG;IACtCA,UAAU,QAAQ,GAAGE,SAAS,OAAO,CAAC,QAAQ;IAC9C,OAAOF,UAAU,QAAQ;AAC7B;AAEA,MAAMG;IAGF,YAA6BC,UAAgC,CAAE;aAAlCA,UAAU,GAAVA;aAFrB,KAAK,GAAG,IAAIC;IAE4C;IAEhE,MAAM,QAAQN,MAAc,EAAkB;QAC1C,MAAMO,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAACP;QAC9B,IAAIO,QACA,OAAOA;QAGX,MAAMC,yBAAyBT,0BAA0BC;QACzD,MAAMS,aAAa,MAAM,IAAI,CAAC,SAAS,CAACD,wBAAwBZ;QAChE,MAAMc,eAAe,MAAM,IAAI,CAAC,SAAS,CAACD,WAAW,QAAQ,EAAEX;QAC/D,MAAMa,OAAcD,aAAa,IAAI;QAErC,IAAI,CAAC,KAAK,CAAC,GAAG,CAACV,QAAQW;QAEvB,OAAOA;IACX;IAGA,MAAc,UAAaC,GAAW,EAAEC,MAAoB,EAAc;QACtE,MAAMC,WAAW,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAEF;QAAI;QACzD,IAAIE,SAAS,MAAM,IACf,MAAMA,SAAS,KAAK;QAGxB,MAAMC,SAASF,OAAO,SAAS,CAACC,SAAS,KAAK;QAC9C,IAAI,CAACC,OAAO,OAAO,EACf,MAAM,IAAIC,MAAM,CAAC,uBAAuB,EAAEJ,IAAI,GAAG,EAAEG,OAAO,KAAK,CAAC,OAAO,EAAE;QAG7E,OAAOA,OAAO,IAAI;IACtB;AACJ;AAEO,MAAME,YAAYC,qBAAqB;IAC1C,aAAaC;IACb,gBAAgBf;IAChB,cAAc;QAACgB;KAAW;AAC9B"}

package/idp/feature.js

@@ -1,6 +1,5 @@
 import { createFeature } from "@webiny/feature/api";
 import { JwtAuthenticator } from "./JwtAuthenticator.js";
-import { JwkCache } from "./abstractions.js";
 import { JwksCache } from "./JwksCache.js";
 import { OidcJwtIdentityProvider } from "./OidcJwtIdentityProvider.js";
 const IdpAuthenticatorFeature = createFeature({
@@ -8,7 +7,7 @@ const IdpAuthenticatorFeature = createFeature({
     register (container) {
         container.register(JwtAuthenticator);
         container.register(OidcJwtIdentityProvider);
-        container.registerInstance(JwkCache, new JwksCache());
+        container.register(JwksCache).inSingletonScope();
     }
 });
 export { IdpAuthenticatorFeature };

package/idp/feature.js.map

@@ -1 +1 @@
-{"version":3,"file":"idp/feature.js","sources":["../../src/idp/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { JwtAuthenticator } from \"./JwtAuthenticator.js\";\nimport { JwkCache } from \"./abstractions.js\";\nimport { JwksCache } from \"./JwksCache.js\";\nimport { OidcJwtIdentityProvider } from \"~/idp/OidcJwtIdentityProvider.js\";\n\nexport const IdpAuthenticatorFeature = createFeature({\n    name: \"IdpAuthenticator\",\n    register(container) {\n        container.register(JwtAuthenticator);\n        container.register(OidcJwtIdentityProvider);\n        container.registerInstance(JwkCache, new JwksCache());\n    }\n});\n"],"names":["IdpAuthenticatorFeature","createFeature","container","JwtAuthenticator","OidcJwtIdentityProvider","JwkCache","JwksCache"],"mappings":";;;;;AAMO,MAAMA,0BAA0BC,cAAc;IACjD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE;QACnBF,UAAU,gBAAgB,CAACG,UAAU,IAAIC;IAC7C;AACJ"}
+{"version":3,"file":"idp/feature.js","sources":["../../src/idp/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { JwtAuthenticator } from \"./JwtAuthenticator.js\";\nimport { JwksCache } from \"./JwksCache.js\";\nimport { OidcJwtIdentityProvider } from \"~/idp/OidcJwtIdentityProvider.js\";\n\nexport const IdpAuthenticatorFeature = createFeature({\n    name: \"IdpAuthenticator\",\n    register(container) {\n        container.register(JwtAuthenticator);\n        container.register(OidcJwtIdentityProvider);\n        // Singleton, so the keys stay cached for the life of the process.\n        container.register(JwksCache).inSingletonScope();\n    }\n});\n"],"names":["IdpAuthenticatorFeature","createFeature","container","JwtAuthenticator","OidcJwtIdentityProvider","JwksCache"],"mappings":";;;;AAKO,MAAMA,0BAA0BC,cAAc;IACjD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE;QAEnBF,UAAU,QAAQ,CAACG,WAAW,gBAAgB;IAClD;AACJ"}

package/legacy/security/plugins/secureHeaders.js

@@ -6,6 +6,7 @@ const whitelistedHeaders = [
     "content-type",
     "x-tenant",
     "x-apollo-tracing",
+    "x-webiny-debug",
     "apollo-query-plan-experimental"
 ];
 const setupSecureHeaders = ()=>createHandlerOnRequest(async (request, reply)=>{

package/legacy/security/plugins/secureHeaders.js.map

@@ -1 +1 @@
-{"version":3,"file":"legacy/security/plugins/secureHeaders.js","sources":["../../../../src/legacy/security/plugins/secureHeaders.ts"],"sourcesContent":["import { createHandlerOnRequest, ResponseHeaders } from \"@webiny/handler\";\n\nconst whitelistedHeaders = [\n    \"accept\",\n    \"authorization\",\n    \"cache-control\",\n    \"content-type\",\n    \"x-tenant\",\n    \"x-apollo-tracing\",\n    \"apollo-query-plan-experimental\"\n];\n\nexport const setupSecureHeaders = () => {\n    return createHandlerOnRequest(async (request, reply) => {\n        const isOptions = request.method === \"OPTIONS\";\n\n        const headers = ResponseHeaders.create();\n        headers.set(\"access-control-allow-origin\", request.headers[\"origin\"]);\n        headers.set(\"access-control-allow-credentials\", \"true\");\n\n        if (isOptions) {\n            headers.set(\"cache-control\", \"public, max-age=86400\");\n            headers.set(\"content-type\", \"application/json; charset=utf-8\");\n            headers.set(\"access-control-max-age\", \"86400\");\n            headers.set(\"access-control-allow-methods\", \"OPTIONS,POST,GET,DELETE,PUT,PATCH\");\n            headers.set(\"access-control-allow-headers\", whitelistedHeaders.join(\", \"));\n        } else {\n            headers.set(\"x-tenant\", request.headers[\"x-tenant\"] || \"root\");\n            headers.set(\"vary\", \"origin\");\n        }\n\n        reply.headers(headers.getHeaders());\n    });\n};\n"],"names":["whitelistedHeaders","setupSecureHeaders","createHandlerOnRequest","request","reply","isOptions","headers","ResponseHeaders"],"mappings":";AAEA,MAAMA,qBAAqB;IACvB;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAEM,MAAMC,qBAAqB,IACvBC,uBAAuB,OAAOC,SAASC;QAC1C,MAAMC,YAAYF,AAAmB,cAAnBA,QAAQ,MAAM;QAEhC,MAAMG,UAAUC,gBAAgB,MAAM;QACtCD,QAAQ,GAAG,CAAC,+BAA+BH,QAAQ,OAAO,CAAC,SAAS;QACpEG,QAAQ,GAAG,CAAC,oCAAoC;QAEhD,IAAID,WAAW;YACXC,QAAQ,GAAG,CAAC,iBAAiB;YAC7BA,QAAQ,GAAG,CAAC,gBAAgB;YAC5BA,QAAQ,GAAG,CAAC,0BAA0B;YACtCA,QAAQ,GAAG,CAAC,gCAAgC;YAC5CA,QAAQ,GAAG,CAAC,gCAAgCN,mBAAmB,IAAI,CAAC;QACxE,OAAO;YACHM,QAAQ,GAAG,CAAC,YAAYH,QAAQ,OAAO,CAAC,WAAW,IAAI;YACvDG,QAAQ,GAAG,CAAC,QAAQ;QACxB;QAEAF,MAAM,OAAO,CAACE,QAAQ,UAAU;IACpC"}
+{"version":3,"file":"legacy/security/plugins/secureHeaders.js","sources":["../../../../src/legacy/security/plugins/secureHeaders.ts"],"sourcesContent":["import { createHandlerOnRequest, ResponseHeaders } from \"@webiny/handler\";\n\nconst whitelistedHeaders = [\n    \"accept\",\n    \"authorization\",\n    \"cache-control\",\n    \"content-type\",\n    \"x-tenant\",\n    \"x-apollo-tracing\",\n    \"x-webiny-debug\",\n    \"apollo-query-plan-experimental\"\n];\n\nexport const setupSecureHeaders = () => {\n    return createHandlerOnRequest(async (request, reply) => {\n        const isOptions = request.method === \"OPTIONS\";\n\n        const headers = ResponseHeaders.create();\n        headers.set(\"access-control-allow-origin\", request.headers[\"origin\"]);\n        headers.set(\"access-control-allow-credentials\", \"true\");\n\n        if (isOptions) {\n            headers.set(\"cache-control\", \"public, max-age=86400\");\n            headers.set(\"content-type\", \"application/json; charset=utf-8\");\n            headers.set(\"access-control-max-age\", \"86400\");\n            headers.set(\"access-control-allow-methods\", \"OPTIONS,POST,GET,DELETE,PUT,PATCH\");\n            headers.set(\"access-control-allow-headers\", whitelistedHeaders.join(\", \"));\n        } else {\n            headers.set(\"x-tenant\", request.headers[\"x-tenant\"] || \"root\");\n            headers.set(\"vary\", \"origin\");\n        }\n\n        reply.headers(headers.getHeaders());\n    });\n};\n"],"names":["whitelistedHeaders","setupSecureHeaders","createHandlerOnRequest","request","reply","isOptions","headers","ResponseHeaders"],"mappings":";AAEA,MAAMA,qBAAqB;IACvB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAEM,MAAMC,qBAAqB,IACvBC,uBAAuB,OAAOC,SAASC;QAC1C,MAAMC,YAAYF,AAAmB,cAAnBA,QAAQ,MAAM;QAEhC,MAAMG,UAAUC,gBAAgB,MAAM;QACtCD,QAAQ,GAAG,CAAC,+BAA+BH,QAAQ,OAAO,CAAC,SAAS;QACpEG,QAAQ,GAAG,CAAC,oCAAoC;QAEhD,IAAID,WAAW;YACXC,QAAQ,GAAG,CAAC,iBAAiB;YAC7BA,QAAQ,GAAG,CAAC,gBAAgB;YAC5BA,QAAQ,GAAG,CAAC,0BAA0B;YACtCA,QAAQ,GAAG,CAAC,gCAAgC;YAC5CA,QAAQ,GAAG,CAAC,gCAAgCN,mBAAmB,IAAI,CAAC;QACxE,OAAO;YACHM,QAAQ,GAAG,CAAC,YAAYH,QAAQ,OAAO,CAAC,WAAW,IAAI;YACvDG,QAAQ,GAAG,CAAC,QAAQ;QACxB;QAEAF,MAAM,OAAO,CAACE,QAAQ,UAAU;IACpC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@webiny/api-core",
-	"version": "6.5.0-beta.1",
+	"version": "6.5.0-beta.11",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -14,38 +14,39 @@
 		"./*": "./*"
 	},
 	"dependencies": {
-		"@ai-sdk/anthropic": "4.0.49",
-		"@ai-sdk/google": "4.0.64",
-		"@ai-sdk/openai": "4.0.60",
-		"@webiny/api": "6.5.0-beta.1",
-		"@webiny/di": "1.0.2",
-		"@webiny/error": "6.5.0-beta.1",
-		"@webiny/feature": "6.5.0-beta.1",
-		"@webiny/feature-flags": "6.5.0-beta.1",
-		"@webiny/handler": "6.5.0-beta.1",
-		"@webiny/handler-db": "6.5.0-beta.1",
-		"@webiny/handler-graphql": "6.5.0-beta.1",
-		"@webiny/plugins": "6.5.0-beta.1",
-		"@webiny/utils": "6.5.0-beta.1",
-		"@webiny/wcp": "6.5.0-beta.1",
-		"ai": "7.0.34",
+		"@ai-sdk/anthropic": "4.0.71",
+		"@ai-sdk/google": "4.0.87",
+		"@ai-sdk/openai": "4.0.83",
+		"@openrouter/ai-sdk-provider": "3.1.0",
+		"@webiny/api": "6.5.0-beta.11",
+		"@webiny/di": "1.1.0",
+		"@webiny/error": "6.5.0-beta.11",
+		"@webiny/feature": "6.5.0-beta.11",
+		"@webiny/feature-flags": "6.5.0-beta.11",
+		"@webiny/handler": "6.5.0-beta.11",
+		"@webiny/handler-db": "6.5.0-beta.11",
+		"@webiny/handler-graphql": "6.5.0-beta.11",
+		"@webiny/plugins": "6.5.0-beta.11",
+		"@webiny/utils": "6.5.0-beta.11",
+		"@webiny/wcp": "6.5.0-beta.11",
+		"ai": "7.0.127",
 		"dataloader": "2.2.3",
-		"jose": "6.2.3",
+		"jose": "6.2.12",
 		"jsonwebtoken": "9.0.3",
 		"lodash": "4.18.1",
-		"minimatch": "10.2.5",
-		"pino": "10.3.1",
+		"minimatch": "10.2.6",
+		"pino": "10.4.0",
 		"pino-lambda": "4.4.1",
-		"zod": "4.4.3"
+		"zod": "4.6.5"
 	},
 	"devDependencies": {
 		"@types/jsonwebtoken": "9.0.10",
-		"@webiny/build-tools": "6.5.0-beta.1",
-		"@webiny/handler-aws": "6.5.0-beta.1",
-		"@webiny/project-utils": "6.5.0-beta.1",
+		"@webiny/build-tools": "6.5.0-beta.11",
+		"@webiny/handler-aws": "6.5.0-beta.11",
+		"@webiny/project-utils": "6.5.0-beta.11",
 		"rimraf": "6.1.3",
 		"typescript": "7.0.2",
-		"vitest": "4.1.10"
+		"vitest": "5.0.3"
 	},
 	"publishConfig": {
 		"access": "public"