@webiny/api-core 6.5.0-beta.1 → 6.5.0-beta.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/ApiCoreFeature.js +2 -0
- package/ApiCoreFeature.js.map +1 -1
- package/createApiCore.d.ts +1 -1
- package/createApiCore.js +3 -1
- package/createApiCore.js.map +1 -1
- package/features/debugger/Debugger.d.ts +23 -0
- package/features/debugger/Debugger.js +134 -0
- package/features/debugger/Debugger.js.map +1 -0
- package/features/debugger/GraphQLDebuggerTransport.d.ts +26 -0
- package/features/debugger/GraphQLDebuggerTransport.js +45 -0
- package/features/debugger/GraphQLDebuggerTransport.js.map +1 -0
- package/features/debugger/__tests__/matchNamespace.test.d.ts +1 -0
- package/features/debugger/__tests__/matchNamespace.test.js +67 -0
- package/features/debugger/__tests__/matchNamespace.test.js.map +1 -0
- package/features/debugger/__tests__/serialize.test.d.ts +1 -0
- package/features/debugger/__tests__/serialize.test.js +220 -0
- package/features/debugger/__tests__/serialize.test.js.map +1 -0
- package/features/debugger/abstractions.d.ts +100 -0
- package/features/debugger/abstractions.js +6 -0
- package/features/debugger/abstractions.js.map +1 -0
- package/features/debugger/feature.d.ts +5 -0
- package/features/debugger/feature.js +15 -0
- package/features/debugger/feature.js.map +1 -0
- package/features/debugger/index.d.ts +7 -0
- package/features/debugger/index.js +7 -0
- package/features/debugger/limits.d.ts +18 -0
- package/features/debugger/limits.js +11 -0
- package/features/debugger/limits.js.map +1 -0
- package/features/debugger/matchNamespace.d.ts +21 -0
- package/features/debugger/matchNamespace.js +48 -0
- package/features/debugger/matchNamespace.js.map +1 -0
- package/features/debugger/permissions.d.ts +33 -0
- package/features/debugger/permissions.js +12 -0
- package/features/debugger/permissions.js.map +1 -0
- package/features/debugger/permissionsSchema.d.ts +17 -0
- package/features/debugger/permissionsSchema.js +18 -0
- package/features/debugger/permissionsSchema.js.map +1 -0
- package/features/debugger/plugins.d.ts +4 -0
- package/features/debugger/plugins.js +82 -0
- package/features/debugger/plugins.js.map +1 -0
- package/features/debugger/serialize.d.ts +11 -0
- package/features/debugger/serialize.js +121 -0
- package/features/debugger/serialize.js.map +1 -0
- package/legacy/security/plugins/secureHeaders.js +1 -0
- package/legacy/security/plugins/secureHeaders.js.map +1 -1
- package/package.json +14 -14
|
@@ -0,0 +1,121 @@
|
|
|
1
|
+
const UNDEFINED = "#[Undefined value]";
|
|
2
|
+
const CIRCULAR = "#[Circular]";
|
|
3
|
+
const DEPTH_LIMIT = "#[Depth limit]";
|
|
4
|
+
const isPlainValue = (value)=>{
|
|
5
|
+
const type = typeof value;
|
|
6
|
+
return "string" === type || "number" === type || "boolean" === type || null === value;
|
|
7
|
+
};
|
|
8
|
+
const describeBinary = (value)=>{
|
|
9
|
+
const name = value.constructor?.name || "TypedArray";
|
|
10
|
+
return `#[${name} ${value.byteLength} bytes]`;
|
|
11
|
+
};
|
|
12
|
+
const walk = (value, limits, seen, depth)=>{
|
|
13
|
+
if (void 0 === value) return UNDEFINED;
|
|
14
|
+
if (isPlainValue(value)) {
|
|
15
|
+
if ("string" == typeof value && value.length > limits.stringLength) {
|
|
16
|
+
const kept = value.slice(0, limits.stringLength);
|
|
17
|
+
return `${kept}…(${value.length - limits.stringLength} more)`;
|
|
18
|
+
}
|
|
19
|
+
if ("number" == typeof value && !Number.isFinite(value)) return String(value);
|
|
20
|
+
return value;
|
|
21
|
+
}
|
|
22
|
+
if ("bigint" == typeof value) return `${value.toString()}n`;
|
|
23
|
+
if ("symbol" == typeof value) return String(value);
|
|
24
|
+
if ("function" == typeof value) return `#[Function: ${value.name || "anonymous"}]`;
|
|
25
|
+
if (value instanceof Error) return {
|
|
26
|
+
name: value.name,
|
|
27
|
+
message: value.message,
|
|
28
|
+
stack: value.stack
|
|
29
|
+
};
|
|
30
|
+
if (value instanceof Date) return value.toISOString();
|
|
31
|
+
if (value instanceof RegExp) return value.toString();
|
|
32
|
+
if (ArrayBuffer.isView(value)) return describeBinary(value);
|
|
33
|
+
if (value instanceof ArrayBuffer) return `#[ArrayBuffer ${value.byteLength} bytes]`;
|
|
34
|
+
if (depth >= limits.depth) return DEPTH_LIMIT;
|
|
35
|
+
if ("object" != typeof value || null === value) return String(value);
|
|
36
|
+
if (seen.has(value)) return CIRCULAR;
|
|
37
|
+
seen.add(value);
|
|
38
|
+
try {
|
|
39
|
+
if (Array.isArray(value)) {
|
|
40
|
+
const kept = value.slice(0, limits.arrayLength).map((item)=>walk(item, limits, seen, depth + 1));
|
|
41
|
+
if (value.length > limits.arrayLength) kept.push(`…(${value.length - limits.arrayLength} more items)`);
|
|
42
|
+
return kept;
|
|
43
|
+
}
|
|
44
|
+
if (value instanceof Map) {
|
|
45
|
+
const entries = [];
|
|
46
|
+
for (const [key, item] of value.entries()){
|
|
47
|
+
if (entries.length >= limits.arrayLength) {
|
|
48
|
+
entries.push(`…(${value.size - limits.arrayLength} more entries)`);
|
|
49
|
+
break;
|
|
50
|
+
}
|
|
51
|
+
entries.push([
|
|
52
|
+
walk(key, limits, seen, depth + 1),
|
|
53
|
+
walk(item, limits, seen, depth + 1)
|
|
54
|
+
]);
|
|
55
|
+
}
|
|
56
|
+
return {
|
|
57
|
+
__type: "Map",
|
|
58
|
+
entries
|
|
59
|
+
};
|
|
60
|
+
}
|
|
61
|
+
if (value instanceof Set) {
|
|
62
|
+
const items = [];
|
|
63
|
+
for (const item of value.values()){
|
|
64
|
+
if (items.length >= limits.arrayLength) {
|
|
65
|
+
items.push(`…(${value.size - limits.arrayLength} more items)`);
|
|
66
|
+
break;
|
|
67
|
+
}
|
|
68
|
+
items.push(walk(item, limits, seen, depth + 1));
|
|
69
|
+
}
|
|
70
|
+
return {
|
|
71
|
+
__type: "Set",
|
|
72
|
+
items
|
|
73
|
+
};
|
|
74
|
+
}
|
|
75
|
+
const result = {};
|
|
76
|
+
for (const key of Object.keys(value)){
|
|
77
|
+
let item;
|
|
78
|
+
try {
|
|
79
|
+
item = value[key];
|
|
80
|
+
} catch (ex) {
|
|
81
|
+
result[key] = `#[Throws: ${ex instanceof Error ? ex.message : String(ex)}]`;
|
|
82
|
+
continue;
|
|
83
|
+
}
|
|
84
|
+
if (void 0 !== item) result[key] = walk(item, limits, seen, depth + 1);
|
|
85
|
+
}
|
|
86
|
+
return result;
|
|
87
|
+
} finally{
|
|
88
|
+
seen.delete(value);
|
|
89
|
+
}
|
|
90
|
+
};
|
|
91
|
+
const serialize = (value, limits)=>{
|
|
92
|
+
let json;
|
|
93
|
+
try {
|
|
94
|
+
const walked = walk(value, limits, new WeakSet(), 0);
|
|
95
|
+
json = JSON.stringify(walked) ?? JSON.stringify(UNDEFINED);
|
|
96
|
+
} catch (ex) {
|
|
97
|
+
const message = ex instanceof Error ? ex.message : String(ex);
|
|
98
|
+
json = JSON.stringify({
|
|
99
|
+
__serializationFailed: true,
|
|
100
|
+
message
|
|
101
|
+
});
|
|
102
|
+
}
|
|
103
|
+
let bytes = Buffer.byteLength(json, "utf8");
|
|
104
|
+
let truncated = false;
|
|
105
|
+
if (bytes > limits.entryBytes) {
|
|
106
|
+
json = JSON.stringify({
|
|
107
|
+
truncated: true,
|
|
108
|
+
originalBytes: bytes
|
|
109
|
+
});
|
|
110
|
+
bytes = Buffer.byteLength(json, "utf8");
|
|
111
|
+
truncated = true;
|
|
112
|
+
}
|
|
113
|
+
return {
|
|
114
|
+
json,
|
|
115
|
+
bytes,
|
|
116
|
+
truncated
|
|
117
|
+
};
|
|
118
|
+
};
|
|
119
|
+
export { serialize };
|
|
120
|
+
|
|
121
|
+
//# sourceMappingURL=serialize.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"features/debugger/serialize.js","sources":["../../../src/features/debugger/serialize.ts"],"sourcesContent":["import type { IDebuggerLimits } from \"./limits.js\";\n\nexport interface ISerializeResult {\n json: string;\n bytes: number;\n /** True if the value was replaced by the per-entry cap marker. */\n truncated: boolean;\n}\n\n/**\n * Markers stand in for values that cannot be represented as JSON.\n *\n * They are prefixed with `#` so a reader can tell at a glance that a value was substituted by the\n * serializer rather than being what the code actually held - the previous `[undefined]` read as an\n * array literal in documents that are full of real arrays.\n */\nconst UNDEFINED = \"#[Undefined value]\";\nconst CIRCULAR = \"#[Circular]\";\nconst DEPTH_LIMIT = \"#[Depth limit]\";\n\nconst isPlainValue = (value: unknown): boolean => {\n const type = typeof value;\n return type === \"string\" || type === \"number\" || type === \"boolean\" || value === null;\n};\n\nconst describeBinary = (value: ArrayBufferView): string => {\n const name = value.constructor?.name || \"TypedArray\";\n return `#[${name} ${value.byteLength} bytes]`;\n};\n\n/**\n * Walks a value into a JSON-safe structure, applying depth, string and array caps as it goes.\n *\n * Caps are applied during the walk rather than by slicing the finished JSON string, so the output is\n * always parseable.\n *\n * A custom `toJSON` is never invoked - own properties are enumerated instead. That means an object\n * is reported as its internals rather than its intended representation, which is what you want when\n * debugging, and it removes a whole class of failure where a third-party `toJSON` throws.\n */\nconst walk = (\n value: unknown,\n limits: IDebuggerLimits,\n seen: WeakSet<object>,\n depth: number\n): unknown => {\n if (value === undefined) {\n /**\n * Only reached for array elements and for a top-level payload. Object properties holding\n * `undefined` are dropped before they get here, matching `JSON.stringify`.\n *\n * Inside an array the element cannot be dropped without shifting every later index, and\n * `JSON.stringify` would turn it into `null` - which is a meaningful value in its own right.\n */\n return UNDEFINED;\n }\n\n if (isPlainValue(value)) {\n if (typeof value === \"string\" && value.length > limits.stringLength) {\n const kept = value.slice(0, limits.stringLength);\n return `${kept}…(${value.length - limits.stringLength} more)`;\n }\n /**\n * Infinity and NaN serialize to `null`, which silently loses the distinction. Keep them\n * readable instead.\n */\n if (typeof value === \"number\" && !Number.isFinite(value)) {\n return String(value);\n }\n return value;\n }\n\n if (typeof value === \"bigint\") {\n return `${value.toString()}n`;\n }\n\n if (typeof value === \"symbol\") {\n return String(value);\n }\n\n if (typeof value === \"function\") {\n return `#[Function: ${value.name || \"anonymous\"}]`;\n }\n\n if (value instanceof Error) {\n return {\n name: value.name,\n message: value.message,\n stack: value.stack\n };\n }\n\n if (value instanceof Date) {\n return value.toISOString();\n }\n\n if (value instanceof RegExp) {\n return value.toString();\n }\n\n if (ArrayBuffer.isView(value)) {\n return describeBinary(value);\n }\n\n if (value instanceof ArrayBuffer) {\n return `#[ArrayBuffer ${value.byteLength} bytes]`;\n }\n\n if (depth >= limits.depth) {\n return DEPTH_LIMIT;\n }\n\n if (typeof value !== \"object\" || value === null) {\n return String(value);\n }\n\n if (seen.has(value)) {\n return CIRCULAR;\n }\n seen.add(value);\n\n try {\n if (Array.isArray(value)) {\n const kept = value.slice(0, limits.arrayLength).map(item => {\n return walk(item, limits, seen, depth + 1);\n });\n if (value.length > limits.arrayLength) {\n kept.push(`…(${value.length - limits.arrayLength} more items)`);\n }\n return kept;\n }\n\n if (value instanceof Map) {\n const entries: unknown[] = [];\n for (const [key, item] of value.entries()) {\n if (entries.length >= limits.arrayLength) {\n entries.push(`…(${value.size - limits.arrayLength} more entries)`);\n break;\n }\n entries.push([\n walk(key, limits, seen, depth + 1),\n walk(item, limits, seen, depth + 1)\n ]);\n }\n return { __type: \"Map\", entries };\n }\n\n if (value instanceof Set) {\n const items: unknown[] = [];\n for (const item of value.values()) {\n if (items.length >= limits.arrayLength) {\n items.push(`…(${value.size - limits.arrayLength} more items)`);\n break;\n }\n items.push(walk(item, limits, seen, depth + 1));\n }\n return { __type: \"Set\", items };\n }\n\n const result: Record<string, unknown> = {};\n for (const key of Object.keys(value)) {\n /**\n * A getter can throw. One bad property must not take down the whole entry, let alone the\n * request that is being observed.\n */\n let item: unknown;\n try {\n item = (value as Record<string, unknown>)[key];\n } catch (ex) {\n result[key] = `#[Throws: ${ex instanceof Error ? ex.message : String(ex)}]`;\n continue;\n }\n\n /**\n * Drop the key, as `JSON.stringify` does.\n *\n * Captured payloads are frequently copies of something that went over the wire, and the\n * wire never carried these keys - keeping them would describe a request that was never\n * made.\n */\n if (item === undefined) {\n continue;\n }\n\n result[key] = walk(item, limits, seen, depth + 1);\n }\n return result;\n } finally {\n /**\n * Only guard against cycles along the current branch. Without this, a value referenced twice\n * as siblings would report the second one as circular.\n */\n seen.delete(value);\n }\n};\n\n/**\n * Serializes a captured payload to JSON, never throwing and always producing valid JSON.\n */\nexport const serialize = (value: unknown, limits: IDebuggerLimits): ISerializeResult => {\n let json: string;\n\n try {\n const walked = walk(value, limits, new WeakSet(), 0);\n json = JSON.stringify(walked) ?? JSON.stringify(UNDEFINED);\n } catch (ex) {\n const message = ex instanceof Error ? ex.message : String(ex);\n json = JSON.stringify({ __serializationFailed: true, message });\n }\n\n let bytes = Buffer.byteLength(json, \"utf8\");\n let truncated = false;\n\n if (bytes > limits.entryBytes) {\n /**\n * Slicing the string would produce invalid JSON, so the payload is replaced wholesale.\n */\n json = JSON.stringify({ truncated: true, originalBytes: bytes });\n bytes = Buffer.byteLength(json, \"utf8\");\n truncated = true;\n }\n\n return { json, bytes, truncated };\n};\n"],"names":["UNDEFINED","CIRCULAR","DEPTH_LIMIT","isPlainValue","value","type","describeBinary","name","walk","limits","seen","depth","undefined","kept","Number","String","Error","Date","RegExp","ArrayBuffer","Array","item","Map","entries","key","Set","items","result","Object","ex","serialize","json","walked","WeakSet","JSON","message","bytes","Buffer","truncated"],"mappings":"AAgBA,MAAMA,YAAY;AAClB,MAAMC,WAAW;AACjB,MAAMC,cAAc;AAEpB,MAAMC,eAAe,CAACC;IAClB,MAAMC,OAAO,OAAOD;IACpB,OAAOC,AAAS,aAATA,QAAqBA,AAAS,aAATA,QAAqBA,AAAS,cAATA,QAAsBD,AAAU,SAAVA;AAC3E;AAEA,MAAME,iBAAiB,CAACF;IACpB,MAAMG,OAAOH,MAAM,WAAW,EAAE,QAAQ;IACxC,OAAO,CAAC,EAAE,EAAEG,KAAK,CAAC,EAAEH,MAAM,UAAU,CAAC,OAAO,CAAC;AACjD;AAYA,MAAMI,OAAO,CACTJ,OACAK,QACAC,MACAC;IAEA,IAAIP,AAAUQ,WAAVR,OAQA,OAAOJ;IAGX,IAAIG,aAAaC,QAAQ;QACrB,IAAI,AAAiB,YAAjB,OAAOA,SAAsBA,MAAM,MAAM,GAAGK,OAAO,YAAY,EAAE;YACjE,MAAMI,OAAOT,MAAM,KAAK,CAAC,GAAGK,OAAO,YAAY;YAC/C,OAAO,GAAGI,KAAK,EAAE,EAAET,MAAM,MAAM,GAAGK,OAAO,YAAY,CAAC,MAAM,CAAC;QACjE;QAKA,IAAI,AAAiB,YAAjB,OAAOL,SAAsB,CAACU,OAAO,QAAQ,CAACV,QAC9C,OAAOW,OAAOX;QAElB,OAAOA;IACX;IAEA,IAAI,AAAiB,YAAjB,OAAOA,OACP,OAAO,GAAGA,MAAM,QAAQ,GAAG,CAAC,CAAC;IAGjC,IAAI,AAAiB,YAAjB,OAAOA,OACP,OAAOW,OAAOX;IAGlB,IAAI,AAAiB,cAAjB,OAAOA,OACP,OAAO,CAAC,YAAY,EAAEA,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC;IAGtD,IAAIA,iBAAiBY,OACjB,OAAO;QACH,MAAMZ,MAAM,IAAI;QAChB,SAASA,MAAM,OAAO;QACtB,OAAOA,MAAM,KAAK;IACtB;IAGJ,IAAIA,iBAAiBa,MACjB,OAAOb,MAAM,WAAW;IAG5B,IAAIA,iBAAiBc,QACjB,OAAOd,MAAM,QAAQ;IAGzB,IAAIe,YAAY,MAAM,CAACf,QACnB,OAAOE,eAAeF;IAG1B,IAAIA,iBAAiBe,aACjB,OAAO,CAAC,cAAc,EAAEf,MAAM,UAAU,CAAC,OAAO,CAAC;IAGrD,IAAIO,SAASF,OAAO,KAAK,EACrB,OAAOP;IAGX,IAAI,AAAiB,YAAjB,OAAOE,SAAsBA,AAAU,SAAVA,OAC7B,OAAOW,OAAOX;IAGlB,IAAIM,KAAK,GAAG,CAACN,QACT,OAAOH;IAEXS,KAAK,GAAG,CAACN;IAET,IAAI;QACA,IAAIgB,MAAM,OAAO,CAAChB,QAAQ;YACtB,MAAMS,OAAOT,MAAM,KAAK,CAAC,GAAGK,OAAO,WAAW,EAAE,GAAG,CAACY,CAAAA,OACzCb,KAAKa,MAAMZ,QAAQC,MAAMC,QAAQ;YAE5C,IAAIP,MAAM,MAAM,GAAGK,OAAO,WAAW,EACjCI,KAAK,IAAI,CAAC,CAAC,EAAE,EAAET,MAAM,MAAM,GAAGK,OAAO,WAAW,CAAC,YAAY,CAAC;YAElE,OAAOI;QACX;QAEA,IAAIT,iBAAiBkB,KAAK;YACtB,MAAMC,UAAqB,EAAE;YAC7B,KAAK,MAAM,CAACC,KAAKH,KAAK,IAAIjB,MAAM,OAAO,GAAI;gBACvC,IAAImB,QAAQ,MAAM,IAAId,OAAO,WAAW,EAAE;oBACtCc,QAAQ,IAAI,CAAC,CAAC,EAAE,EAAEnB,MAAM,IAAI,GAAGK,OAAO,WAAW,CAAC,cAAc,CAAC;oBACjE;gBACJ;gBACAc,QAAQ,IAAI,CAAC;oBACTf,KAAKgB,KAAKf,QAAQC,MAAMC,QAAQ;oBAChCH,KAAKa,MAAMZ,QAAQC,MAAMC,QAAQ;iBACpC;YACL;YACA,OAAO;gBAAE,QAAQ;gBAAOY;YAAQ;QACpC;QAEA,IAAInB,iBAAiBqB,KAAK;YACtB,MAAMC,QAAmB,EAAE;YAC3B,KAAK,MAAML,QAAQjB,MAAM,MAAM,GAAI;gBAC/B,IAAIsB,MAAM,MAAM,IAAIjB,OAAO,WAAW,EAAE;oBACpCiB,MAAM,IAAI,CAAC,CAAC,EAAE,EAAEtB,MAAM,IAAI,GAAGK,OAAO,WAAW,CAAC,YAAY,CAAC;oBAC7D;gBACJ;gBACAiB,MAAM,IAAI,CAAClB,KAAKa,MAAMZ,QAAQC,MAAMC,QAAQ;YAChD;YACA,OAAO;gBAAE,QAAQ;gBAAOe;YAAM;QAClC;QAEA,MAAMC,SAAkC,CAAC;QACzC,KAAK,MAAMH,OAAOI,OAAO,IAAI,CAACxB,OAAQ;YAKlC,IAAIiB;YACJ,IAAI;gBACAA,OAAQjB,KAAiC,CAACoB,IAAI;YAClD,EAAE,OAAOK,IAAI;gBACTF,MAAM,CAACH,IAAI,GAAG,CAAC,UAAU,EAAEK,cAAcb,QAAQa,GAAG,OAAO,GAAGd,OAAOc,IAAI,CAAC,CAAC;gBAC3E;YACJ;YASA,IAAIR,AAAST,WAATS,MAIJM,MAAM,CAACH,IAAI,GAAGhB,KAAKa,MAAMZ,QAAQC,MAAMC,QAAQ;QACnD;QACA,OAAOgB;IACX,SAAU;QAKNjB,KAAK,MAAM,CAACN;IAChB;AACJ;AAKO,MAAM0B,YAAY,CAAC1B,OAAgBK;IACtC,IAAIsB;IAEJ,IAAI;QACA,MAAMC,SAASxB,KAAKJ,OAAOK,QAAQ,IAAIwB,WAAW;QAClDF,OAAOG,KAAK,SAAS,CAACF,WAAWE,KAAK,SAAS,CAAClC;IACpD,EAAE,OAAO6B,IAAI;QACT,MAAMM,UAAUN,cAAcb,QAAQa,GAAG,OAAO,GAAGd,OAAOc;QAC1DE,OAAOG,KAAK,SAAS,CAAC;YAAE,uBAAuB;YAAMC;QAAQ;IACjE;IAEA,IAAIC,QAAQC,OAAO,UAAU,CAACN,MAAM;IACpC,IAAIO,YAAY;IAEhB,IAAIF,QAAQ3B,OAAO,UAAU,EAAE;QAI3BsB,OAAOG,KAAK,SAAS,CAAC;YAAE,WAAW;YAAM,eAAeE;QAAM;QAC9DA,QAAQC,OAAO,UAAU,CAACN,MAAM;QAChCO,YAAY;IAChB;IAEA,OAAO;QAAEP;QAAMK;QAAOE;IAAU;AACpC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"legacy/security/plugins/secureHeaders.js","sources":["../../../../src/legacy/security/plugins/secureHeaders.ts"],"sourcesContent":["import { createHandlerOnRequest, ResponseHeaders } from \"@webiny/handler\";\n\nconst whitelistedHeaders = [\n \"accept\",\n \"authorization\",\n \"cache-control\",\n \"content-type\",\n \"x-tenant\",\n \"x-apollo-tracing\",\n \"apollo-query-plan-experimental\"\n];\n\nexport const setupSecureHeaders = () => {\n return createHandlerOnRequest(async (request, reply) => {\n const isOptions = request.method === \"OPTIONS\";\n\n const headers = ResponseHeaders.create();\n headers.set(\"access-control-allow-origin\", request.headers[\"origin\"]);\n headers.set(\"access-control-allow-credentials\", \"true\");\n\n if (isOptions) {\n headers.set(\"cache-control\", \"public, max-age=86400\");\n headers.set(\"content-type\", \"application/json; charset=utf-8\");\n headers.set(\"access-control-max-age\", \"86400\");\n headers.set(\"access-control-allow-methods\", \"OPTIONS,POST,GET,DELETE,PUT,PATCH\");\n headers.set(\"access-control-allow-headers\", whitelistedHeaders.join(\", \"));\n } else {\n headers.set(\"x-tenant\", request.headers[\"x-tenant\"] || \"root\");\n headers.set(\"vary\", \"origin\");\n }\n\n reply.headers(headers.getHeaders());\n });\n};\n"],"names":["whitelistedHeaders","setupSecureHeaders","createHandlerOnRequest","request","reply","isOptions","headers","ResponseHeaders"],"mappings":";AAEA,MAAMA,qBAAqB;IACvB;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAEM,MAAMC,qBAAqB,IACvBC,uBAAuB,OAAOC,SAASC;QAC1C,MAAMC,YAAYF,AAAmB,cAAnBA,QAAQ,MAAM;QAEhC,MAAMG,UAAUC,gBAAgB,MAAM;QACtCD,QAAQ,GAAG,CAAC,+BAA+BH,QAAQ,OAAO,CAAC,SAAS;QACpEG,QAAQ,GAAG,CAAC,oCAAoC;QAEhD,IAAID,WAAW;YACXC,QAAQ,GAAG,CAAC,iBAAiB;YAC7BA,QAAQ,GAAG,CAAC,gBAAgB;YAC5BA,QAAQ,GAAG,CAAC,0BAA0B;YACtCA,QAAQ,GAAG,CAAC,gCAAgC;YAC5CA,QAAQ,GAAG,CAAC,gCAAgCN,mBAAmB,IAAI,CAAC;QACxE,OAAO;YACHM,QAAQ,GAAG,CAAC,YAAYH,QAAQ,OAAO,CAAC,WAAW,IAAI;YACvDG,QAAQ,GAAG,CAAC,QAAQ;QACxB;QAEAF,MAAM,OAAO,CAACE,QAAQ,UAAU;IACpC"}
|
|
1
|
+
{"version":3,"file":"legacy/security/plugins/secureHeaders.js","sources":["../../../../src/legacy/security/plugins/secureHeaders.ts"],"sourcesContent":["import { createHandlerOnRequest, ResponseHeaders } from \"@webiny/handler\";\n\nconst whitelistedHeaders = [\n \"accept\",\n \"authorization\",\n \"cache-control\",\n \"content-type\",\n \"x-tenant\",\n \"x-apollo-tracing\",\n \"x-webiny-debug\",\n \"apollo-query-plan-experimental\"\n];\n\nexport const setupSecureHeaders = () => {\n return createHandlerOnRequest(async (request, reply) => {\n const isOptions = request.method === \"OPTIONS\";\n\n const headers = ResponseHeaders.create();\n headers.set(\"access-control-allow-origin\", request.headers[\"origin\"]);\n headers.set(\"access-control-allow-credentials\", \"true\");\n\n if (isOptions) {\n headers.set(\"cache-control\", \"public, max-age=86400\");\n headers.set(\"content-type\", \"application/json; charset=utf-8\");\n headers.set(\"access-control-max-age\", \"86400\");\n headers.set(\"access-control-allow-methods\", \"OPTIONS,POST,GET,DELETE,PUT,PATCH\");\n headers.set(\"access-control-allow-headers\", whitelistedHeaders.join(\", \"));\n } else {\n headers.set(\"x-tenant\", request.headers[\"x-tenant\"] || \"root\");\n headers.set(\"vary\", \"origin\");\n }\n\n reply.headers(headers.getHeaders());\n });\n};\n"],"names":["whitelistedHeaders","setupSecureHeaders","createHandlerOnRequest","request","reply","isOptions","headers","ResponseHeaders"],"mappings":";AAEA,MAAMA,qBAAqB;IACvB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACH;AAEM,MAAMC,qBAAqB,IACvBC,uBAAuB,OAAOC,SAASC;QAC1C,MAAMC,YAAYF,AAAmB,cAAnBA,QAAQ,MAAM;QAEhC,MAAMG,UAAUC,gBAAgB,MAAM;QACtCD,QAAQ,GAAG,CAAC,+BAA+BH,QAAQ,OAAO,CAAC,SAAS;QACpEG,QAAQ,GAAG,CAAC,oCAAoC;QAEhD,IAAID,WAAW;YACXC,QAAQ,GAAG,CAAC,iBAAiB;YAC7BA,QAAQ,GAAG,CAAC,gBAAgB;YAC5BA,QAAQ,GAAG,CAAC,0BAA0B;YACtCA,QAAQ,GAAG,CAAC,gCAAgC;YAC5CA,QAAQ,GAAG,CAAC,gCAAgCN,mBAAmB,IAAI,CAAC;QACxE,OAAO;YACHM,QAAQ,GAAG,CAAC,YAAYH,QAAQ,OAAO,CAAC,WAAW,IAAI;YACvDG,QAAQ,GAAG,CAAC,QAAQ;QACxB;QAEAF,MAAM,OAAO,CAACE,QAAQ,UAAU;IACpC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@webiny/api-core",
|
|
3
|
-
"version": "6.5.0-beta.
|
|
3
|
+
"version": "6.5.0-beta.2",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -17,17 +17,17 @@
|
|
|
17
17
|
"@ai-sdk/anthropic": "4.0.49",
|
|
18
18
|
"@ai-sdk/google": "4.0.64",
|
|
19
19
|
"@ai-sdk/openai": "4.0.60",
|
|
20
|
-
"@webiny/api": "6.5.0-beta.
|
|
20
|
+
"@webiny/api": "6.5.0-beta.2",
|
|
21
21
|
"@webiny/di": "1.0.2",
|
|
22
|
-
"@webiny/error": "6.5.0-beta.
|
|
23
|
-
"@webiny/feature": "6.5.0-beta.
|
|
24
|
-
"@webiny/feature-flags": "6.5.0-beta.
|
|
25
|
-
"@webiny/handler": "6.5.0-beta.
|
|
26
|
-
"@webiny/handler-db": "6.5.0-beta.
|
|
27
|
-
"@webiny/handler-graphql": "6.5.0-beta.
|
|
28
|
-
"@webiny/plugins": "6.5.0-beta.
|
|
29
|
-
"@webiny/utils": "6.5.0-beta.
|
|
30
|
-
"@webiny/wcp": "6.5.0-beta.
|
|
22
|
+
"@webiny/error": "6.5.0-beta.2",
|
|
23
|
+
"@webiny/feature": "6.5.0-beta.2",
|
|
24
|
+
"@webiny/feature-flags": "6.5.0-beta.2",
|
|
25
|
+
"@webiny/handler": "6.5.0-beta.2",
|
|
26
|
+
"@webiny/handler-db": "6.5.0-beta.2",
|
|
27
|
+
"@webiny/handler-graphql": "6.5.0-beta.2",
|
|
28
|
+
"@webiny/plugins": "6.5.0-beta.2",
|
|
29
|
+
"@webiny/utils": "6.5.0-beta.2",
|
|
30
|
+
"@webiny/wcp": "6.5.0-beta.2",
|
|
31
31
|
"ai": "7.0.34",
|
|
32
32
|
"dataloader": "2.2.3",
|
|
33
33
|
"jose": "6.2.3",
|
|
@@ -40,9 +40,9 @@
|
|
|
40
40
|
},
|
|
41
41
|
"devDependencies": {
|
|
42
42
|
"@types/jsonwebtoken": "9.0.10",
|
|
43
|
-
"@webiny/build-tools": "6.5.0-beta.
|
|
44
|
-
"@webiny/handler-aws": "6.5.0-beta.
|
|
45
|
-
"@webiny/project-utils": "6.5.0-beta.
|
|
43
|
+
"@webiny/build-tools": "6.5.0-beta.2",
|
|
44
|
+
"@webiny/handler-aws": "6.5.0-beta.2",
|
|
45
|
+
"@webiny/project-utils": "6.5.0-beta.2",
|
|
46
46
|
"rimraf": "6.1.3",
|
|
47
47
|
"typescript": "7.0.2",
|
|
48
48
|
"vitest": "4.1.10"
|