@webpieces/http-client-node 0.4.700 → 0.4.702

package/src/SsrfPolicy.js

@@ -1,52 +1,67 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SsrfPolicy = void 0;
+exports.SsrfTestingPolicy = exports.SsrfPolicy = void 0;
 /**
- * What a runtime-supplied destination has to satisfy before this client will send to it.
+ * What a destination supplied at RUNTIME has to satisfy before this client will send to it: HTTPS
+ * only, no internal addresses, at most one redirect — each hop re-judged.
  *
- * DATA ONLY — the enforcement is {@link SsrfGuardFilter}. It is constructed by a
- * {@link HostPolicy}, never by app code directly, because the CHOICE between the strict policy and
- * the internal-addresses one is made by naming a host-policy class at the `new ClientConfig(...)`
- * call site. That keeps the permissive answer a greppable noun rather than a boolean somebody
- * flipped.
+ * DATA ONLY — the enforcement is {@link SsrfGuardFilter}, and the trigger is
+ * `ClientRequest.destinationCameFromData`: a URL that came out of `ClientRegistry` is an address WE
+ * chose and is never judged, so an ordinary service-to-service client pays nothing for this class
+ * existing.
+ *
+ * THIS class is what a client gets by saying nothing, and it is the whole policy — there is no
+ * argument to soften, no scheme list to widen, no flag to flip. Relaxing it means naming a
+ * DIFFERENT class, {@link SsrfTestingPolicy}, which is why that one carries a required reason.
  */
 class SsrfPolicy {
-    allowedSchemes;
-    allowInternalAddresses;
-    maxRedirects;
-    allowInternalReason;
-    constructor(
     /**
-     * URL schemes that may be sent to, with their colons ('https:'). HTTPS-only by default: a
-     * partner-registered destination reached over plaintext http leaks the payload and its
-     * signature to anything on the path, and "the partner has not got TLS yet" is their bug to
-     * fix, not ours to accommodate silently.
+     * URL schemes that may be sent to, with their colons. HTTPS-only: a partner-registered
+     * destination reached over plaintext http leaks the payload and its signature to anything on the
+     * path, and "the partner has not got TLS yet" is their bug to fix, not ours to accommodate
+     * silently.
      */
-    allowedSchemes, 
-    /**
-     * TRUE only under {@link RuntimeHostFromContextAllowingInternalAddresses}. When true, the
-     * loopback / RFC1918 / link-local / metadata refusals are skipped — scheme checking and the
-     * redirect cap still apply.
-     */
-    allowInternalAddresses, 
+    allowedSchemes = new Set(['https:']);
+    /** When true, the loopback / RFC1918 / link-local / metadata refusals are skipped. */
+    allowInternalAddresses = false;
     /**
      * How many redirects may be followed, each one re-judged under this same policy. Small on
      * purpose: a legitimate webhook endpoint does not need a redirect chain, and every hop is
      * another chance for the destination to move somewhere we did not agree to.
      */
-    maxRedirects, 
+    maxRedirects = 1;
+    /** WHY internal addresses are allowed, in prose, when they are. See {@link SsrfTestingPolicy}. */
+    allowInternalReason = undefined;
+}
+exports.SsrfPolicy = SsrfPolicy;
+/**
+ * {@link SsrfPolicy} with plaintext http and internal addresses ALLOWED, for the one case that
+ * genuinely needs them: exercising the partner delivery path against a local fake, where the
+ * per-call URL is `http://127.0.0.1:9123`.
+ *
+ * This is NOT the way to reach a local emulator by service name. `ClientRegistry.addMapping` already
+ * covers that, and a registry-resolved URL is never SSRF-checked in the first place — so a localhost
+ * peer needs no opt-out at all, and anyone reaching for this class to get one is in the wrong place.
+ *
+ * THE LONG NAME IS THE FEATURE. This is the permissive branch, so it is a NOUN a reviewer can grep —
+ * `grep -rn SsrfTestingPolicy` lists every client in a codebase that can reach inside the network
+ * with a runtime-supplied URL — rather than a boolean, an omitted argument, or an empty allow-list. A
+ * widening that reads as an ABSENCE is invisible exactly where it matters most.
+ */
+class SsrfTestingPolicy extends SsrfPolicy {
+    allowedSchemes = new Set(['https:', 'http:']);
+    allowInternalAddresses = true;
+    allowInternalReason;
+    constructor(
     /**
-     * WHY internal addresses are allowed, in prose, when they are. Required by
-     * {@link RuntimeHostFromContextAllowingInternalAddresses} and quoted in the log line the
-     * guard writes, so the reason travels with the decision instead of living in a commit
-     * message nobody will find.
+     * WHY this client may reach internal addresses, in prose. REQUIRED, and quoted back in this
+     * client's refusals, so the justification travels with the decision instead of living in a
+     * commit message nobody will find.
      */
-    allowInternalReason) {
-        this.allowedSchemes = allowedSchemes;
-        this.allowInternalAddresses = allowInternalAddresses;
-        this.maxRedirects = maxRedirects;
-        this.allowInternalReason = allowInternalReason;
+    reason) {
+        super();
+        this.allowInternalReason = reason;
     }
 }
-exports.SsrfPolicy = SsrfPolicy;
+exports.SsrfTestingPolicy = SsrfTestingPolicy;
 //# sourceMappingURL=SsrfPolicy.js.map

package/src/SsrfPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"SsrfPolicy.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/SsrfPolicy.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,MAAa,UAAU;IAQC;IAMA;IAMA;IAOA;IA1BpB;IACI;;;;;OAKG;IACa,cAAmC;IACnD;;;;OAIG;IACa,sBAA+B;IAC/C;;;;OAIG;IACa,YAAoB;IACpC;;;;;OAKG;IACa,mBAAuC;QAnBvC,mBAAc,GAAd,cAAc,CAAqB;QAMnC,2BAAsB,GAAtB,sBAAsB,CAAS;QAM/B,iBAAY,GAAZ,YAAY,CAAQ;QAOpB,wBAAmB,GAAnB,mBAAmB,CAAoB;IACxD,CAAC;CACP;AA7BD,gCA6BC","sourcesContent":["/**\n * What a runtime-supplied destination has to satisfy before this client will send to it.\n *\n * DATA ONLY — the enforcement is {@link SsrfGuardFilter}. It is constructed by a\n * {@link HostPolicy}, never by app code directly, because the CHOICE between the strict policy and\n * the internal-addresses one is made by naming a host-policy class at the `new ClientConfig(...)`\n * call site. That keeps the permissive answer a greppable noun rather than a boolean somebody\n * flipped.\n */\nexport class SsrfPolicy {\n    constructor(\n        /**\n         * URL schemes that may be sent to, with their colons ('https:'). HTTPS-only by default: a\n         * partner-registered destination reached over plaintext http leaks the payload and its\n         * signature to anything on the path, and \"the partner has not got TLS yet\" is their bug to\n         * fix, not ours to accommodate silently.\n         */\n        public readonly allowedSchemes: ReadonlySet<string>,\n        /**\n         * TRUE only under {@link RuntimeHostFromContextAllowingInternalAddresses}. When true, the\n         * loopback / RFC1918 / link-local / metadata refusals are skipped — scheme checking and the\n         * redirect cap still apply.\n         */\n        public readonly allowInternalAddresses: boolean,\n        /**\n         * How many redirects may be followed, each one re-judged under this same policy. Small on\n         * purpose: a legitimate webhook endpoint does not need a redirect chain, and every hop is\n         * another chance for the destination to move somewhere we did not agree to.\n         */\n        public readonly maxRedirects: number,\n        /**\n         * WHY internal addresses are allowed, in prose, when they are. Required by\n         * {@link RuntimeHostFromContextAllowingInternalAddresses} and quoted in the log line the\n         * guard writes, so the reason travels with the decision instead of living in a commit\n         * message nobody will find.\n         */\n        public readonly allowInternalReason: string | undefined,\n    ) {}\n}\n"]}
+{"version":3,"file":"SsrfPolicy.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/SsrfPolicy.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;GAYG;AACH,MAAa,UAAU;IACnB;;;;;OAKG;IACM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,sFAAsF;IAC7E,sBAAsB,GAAY,KAAK,CAAC;IAEjD;;;;OAIG;IACM,YAAY,GAAW,CAAC,CAAC;IAElC,kGAAkG;IACzF,mBAAmB,GAAuB,SAAS,CAAC;CAChE;AArBD,gCAqBC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,iBAAkB,SAAQ,UAAU;IAC3B,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,sBAAsB,GAAY,IAAI,CAAC;IACvC,mBAAmB,CAAS;IAE9C;IACI;;;;OAIG;IACH,MAAc;QAEd,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC;IACtC,CAAC;CACJ;AAhBD,8CAgBC","sourcesContent":["/**\n * What a destination supplied at RUNTIME has to satisfy before this client will send to it: HTTPS\n * only, no internal addresses, at most one redirect — each hop re-judged.\n *\n * DATA ONLY — the enforcement is {@link SsrfGuardFilter}, and the trigger is\n * `ClientRequest.destinationCameFromData`: a URL that came out of `ClientRegistry` is an address WE\n * chose and is never judged, so an ordinary service-to-service client pays nothing for this class\n * existing.\n *\n * THIS class is what a client gets by saying nothing, and it is the whole policy — there is no\n * argument to soften, no scheme list to widen, no flag to flip. Relaxing it means naming a\n * DIFFERENT class, {@link SsrfTestingPolicy}, which is why that one carries a required reason.\n */\nexport class SsrfPolicy {\n    /**\n     * URL schemes that may be sent to, with their colons. HTTPS-only: a partner-registered\n     * destination reached over plaintext http leaks the payload and its signature to anything on the\n     * path, and \"the partner has not got TLS yet\" is their bug to fix, not ours to accommodate\n     * silently.\n     */\n    readonly allowedSchemes: ReadonlySet<string> = new Set(['https:']);\n\n    /** When true, the loopback / RFC1918 / link-local / metadata refusals are skipped. */\n    readonly allowInternalAddresses: boolean = false;\n\n    /**\n     * How many redirects may be followed, each one re-judged under this same policy. Small on\n     * purpose: a legitimate webhook endpoint does not need a redirect chain, and every hop is\n     * another chance for the destination to move somewhere we did not agree to.\n     */\n    readonly maxRedirects: number = 1;\n\n    /** WHY internal addresses are allowed, in prose, when they are. See {@link SsrfTestingPolicy}. */\n    readonly allowInternalReason: string | undefined = undefined;\n}\n\n/**\n * {@link SsrfPolicy} with plaintext http and internal addresses ALLOWED, for the one case that\n * genuinely needs them: exercising the partner delivery path against a local fake, where the\n * per-call URL is `http://127.0.0.1:9123`.\n *\n * This is NOT the way to reach a local emulator by service name. `ClientRegistry.addMapping` already\n * covers that, and a registry-resolved URL is never SSRF-checked in the first place — so a localhost\n * peer needs no opt-out at all, and anyone reaching for this class to get one is in the wrong place.\n *\n * THE LONG NAME IS THE FEATURE. This is the permissive branch, so it is a NOUN a reviewer can grep —\n * `grep -rn SsrfTestingPolicy` lists every client in a codebase that can reach inside the network\n * with a runtime-supplied URL — rather than a boolean, an omitted argument, or an empty allow-list. A\n * widening that reads as an ABSENCE is invisible exactly where it matters most.\n */\nexport class SsrfTestingPolicy extends SsrfPolicy {\n    override readonly allowedSchemes: ReadonlySet<string> = new Set(['https:', 'http:']);\n    override readonly allowInternalAddresses: boolean = true;\n    override readonly allowInternalReason: string;\n\n    constructor(\n        /**\n         * WHY this client may reach internal addresses, in prose. REQUIRED, and quoted back in this\n         * client's refusals, so the justification travels with the decision instead of living in a\n         * commit message nobody will find.\n         */\n        reason: string,\n    ) {\n        super();\n        this.allowInternalReason = reason;\n    }\n}\n"]}

package/src/WebhookSignerCallback.d.ts

@@ -0,0 +1,114 @@
+/**
+ * The OUTBOUND half of `@AuthWebhook(name)` — the exact mirror of `WebhookAuthCallback`, which is
+ * the INBOUND half.
+ *
+ * `@AuthWebhook('partner-hmac')` on a contract says: this hop is authenticated by a signature over
+ * the request, in a scheme the FRAMEWORK does not know. Which side of it you are on decides which
+ * hook runs, and nothing else changes:
+ *
+ * | | who signs | who verifies | the hook |
+ * |---|---|---|---|
+ * | a vendor posts to US | the vendor | us | `WebhookAuthCallback.verifyWebhook` (http-routing) |
+ * | WE post to a partner | us | the partner | `WebhookSignerCallback.sign` (here) |
+ *
+ * The symmetry is the point: ONE decorator on ONE contract describes the credential, and the same
+ * `name` selects the same vendor's scheme on both sides. A server that receives Twilio's callbacks
+ * and a client that delivers to a partner read identically.
+ *
+ * ## Why a hook and not an `@AuthHmac` decorator
+ *
+ * Because there is no such thing as "the" HMAC scheme. Twilio signs the full absolute URL with its
+ * sorted parameters; Slack signs `v0:{timestamp}:{body}`; Meta signs the raw body alone; GitHub and
+ * Stripe each differ again in prefix, header name and encoding. A decorator that took a secret
+ * would have to pick one of those and be wrong for everyone else, and a framework that shipped five
+ * vendors' crypto would be shipping five things to keep in step with five vendors. So the scheme
+ * lives in the app's hook, the VENDOR lives on the contract, and the framework carries neither.
+ *
+ * ## It FAILS CLOSED
+ *
+ * With no `WebhookSignerCallback` bound, every outbound `@AuthWebhook` call THROWS rather than
+ * going out unsigned — exactly as an unbound `WebhookAuthCallback` 401s every inbound
+ * `@AuthWebhook` endpoint. An unsigned delivery is not a degraded delivery; it is a request the
+ * partner is obliged to reject, and quietly sending one hides the missing binding until a partner
+ * complains.
+ *
+ * ```typescript
+ * // AppModule.ts
+ * options.bind(WEBHOOK_SIGNER_CALLBACK).to(PartnerHmacSigner);
+ * ```
+ *
+ * ONE hook serves EVERY partner, the way the inbound one serves every vendor: `name` selects which.
+ */
+export declare abstract class WebhookSignerCallback {
+    /**
+     * Produce the headers that authenticate ONE outbound request, or throw to refuse to send it.
+     *
+     * @param name    the string on the contract's `@AuthWebhook(name)` — which partner this is.
+     * @param request the FINAL request: the absolute url and the exact bytes that are about to go on
+     *                the wire. See {@link SignableRequest} for why both of those words matter.
+     * @returns header name -> value, merged onto the request. An empty map is legal and means "this
+     *          partner needs no header" — it is not a way to opt out of signing, because returning
+     *          it is a statement the hook made rather than a binding somebody forgot.
+     */
+    abstract sign(name: string, request: SignableRequest): Promise<Map<string, string>>;
+}
+/**
+ * ONE outbound request, as the thing being signed. Data only.
+ *
+ * Every field a real vendor scheme needs is here, and the two that make it correct are {@link url}
+ * and {@link body}:
+ *
+ * - {@link url} is the FINAL absolute URL, after every app filter has had its say. A signature
+ *   computed over the pre-filter URL authenticates a request nobody sent — and for a partner-webhook
+ *   client the pre-filter URL is the client's own service name, which is not a destination at all.
+ * - {@link body} is the EXACT serialized bytes the transport will send, not the DTO. Serialization
+ *   happens before the filter chain runs and the transport sends this same string verbatim, so the
+ *   bytes signed and the bytes sent cannot differ. That was impossible while the client owned
+ *   serialization internally with no seam, which is why outbound webhook senders were forced back
+ *   to hand-rolling `JSON.stringify` plus a raw HTTP library — a library that re-serializes
+ *   internally signs one byte sequence and sends another, and the failure is silent.
+ */
+export declare class SignableRequest {
+    /** The FINAL absolute URL this request is about to be sent to. */
+    readonly url: string;
+    /** The HTTP method, e.g. 'POST'. */
+    readonly httpMethod: string;
+    /** The EXACT serialized body, or undefined for a call with no argument. */
+    readonly body: string | undefined;
+    /**
+     * The headers as they stand. READ-ONLY here: a scheme that signs existing headers (a
+     * timestamp another filter set, a content-type) reads them, and the signature it returns is
+     * merged by the caller — so there is exactly one place headers are added and it is the
+     * return value.
+     */
+    readonly headers: ReadonlyMap<string, string>;
+    /** The API contract's class name, e.g. 'PartnerWebhookApi'. */
+    readonly contractName: string;
+    /** The contract method being called, e.g. 'deliver'. */
+    readonly methodName: string;
+    constructor(
+    /** The FINAL absolute URL this request is about to be sent to. */
+    url: string, 
+    /** The HTTP method, e.g. 'POST'. */
+    httpMethod: string, 
+    /** The EXACT serialized body, or undefined for a call with no argument. */
+    body: string | undefined, 
+    /**
+     * The headers as they stand. READ-ONLY here: a scheme that signs existing headers (a
+     * timestamp another filter set, a content-type) reads them, and the signature it returns is
+     * merged by the caller — so there is exactly one place headers are added and it is the
+     * return value.
+     */
+    headers: ReadonlyMap<string, string>, 
+    /** The API contract's class name, e.g. 'PartnerWebhookApi'. */
+    contractName: string, 
+    /** The contract method being called, e.g. 'deliver'. */
+    methodName: string);
+}
+/**
+ * DI identifier for the optional {@link WebhookSignerCallback} binding. It is a Symbol (not the
+ * class) so the app container's inversify autobind never auto-constructs this token, keeping
+ * `@optional() @inject(WEBHOOK_SIGNER_CALLBACK)` correct — undefined when unbound, which is what
+ * makes the fail-closed refusal reachable. Mirrors WEBHOOK_AUTH_CALLBACK exactly.
+ */
+export declare const WEBHOOK_SIGNER_CALLBACK: unique symbol;

package/src/WebhookSignerCallback.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WEBHOOK_SIGNER_CALLBACK = exports.SignableRequest = exports.WebhookSignerCallback = void 0;
+/**
+ * The OUTBOUND half of `@AuthWebhook(name)` — the exact mirror of `WebhookAuthCallback`, which is
+ * the INBOUND half.
+ *
+ * `@AuthWebhook('partner-hmac')` on a contract says: this hop is authenticated by a signature over
+ * the request, in a scheme the FRAMEWORK does not know. Which side of it you are on decides which
+ * hook runs, and nothing else changes:
+ *
+ * | | who signs | who verifies | the hook |
+ * |---|---|---|---|
+ * | a vendor posts to US | the vendor | us | `WebhookAuthCallback.verifyWebhook` (http-routing) |
+ * | WE post to a partner | us | the partner | `WebhookSignerCallback.sign` (here) |
+ *
+ * The symmetry is the point: ONE decorator on ONE contract describes the credential, and the same
+ * `name` selects the same vendor's scheme on both sides. A server that receives Twilio's callbacks
+ * and a client that delivers to a partner read identically.
+ *
+ * ## Why a hook and not an `@AuthHmac` decorator
+ *
+ * Because there is no such thing as "the" HMAC scheme. Twilio signs the full absolute URL with its
+ * sorted parameters; Slack signs `v0:{timestamp}:{body}`; Meta signs the raw body alone; GitHub and
+ * Stripe each differ again in prefix, header name and encoding. A decorator that took a secret
+ * would have to pick one of those and be wrong for everyone else, and a framework that shipped five
+ * vendors' crypto would be shipping five things to keep in step with five vendors. So the scheme
+ * lives in the app's hook, the VENDOR lives on the contract, and the framework carries neither.
+ *
+ * ## It FAILS CLOSED
+ *
+ * With no `WebhookSignerCallback` bound, every outbound `@AuthWebhook` call THROWS rather than
+ * going out unsigned — exactly as an unbound `WebhookAuthCallback` 401s every inbound
+ * `@AuthWebhook` endpoint. An unsigned delivery is not a degraded delivery; it is a request the
+ * partner is obliged to reject, and quietly sending one hides the missing binding until a partner
+ * complains.
+ *
+ * ```typescript
+ * // AppModule.ts
+ * options.bind(WEBHOOK_SIGNER_CALLBACK).to(PartnerHmacSigner);
+ * ```
+ *
+ * ONE hook serves EVERY partner, the way the inbound one serves every vendor: `name` selects which.
+ */
+class WebhookSignerCallback {
+}
+exports.WebhookSignerCallback = WebhookSignerCallback;
+/**
+ * ONE outbound request, as the thing being signed. Data only.
+ *
+ * Every field a real vendor scheme needs is here, and the two that make it correct are {@link url}
+ * and {@link body}:
+ *
+ * - {@link url} is the FINAL absolute URL, after every app filter has had its say. A signature
+ *   computed over the pre-filter URL authenticates a request nobody sent — and for a partner-webhook
+ *   client the pre-filter URL is the client's own service name, which is not a destination at all.
+ * - {@link body} is the EXACT serialized bytes the transport will send, not the DTO. Serialization
+ *   happens before the filter chain runs and the transport sends this same string verbatim, so the
+ *   bytes signed and the bytes sent cannot differ. That was impossible while the client owned
+ *   serialization internally with no seam, which is why outbound webhook senders were forced back
+ *   to hand-rolling `JSON.stringify` plus a raw HTTP library — a library that re-serializes
+ *   internally signs one byte sequence and sends another, and the failure is silent.
+ */
+class SignableRequest {
+    url;
+    httpMethod;
+    body;
+    headers;
+    contractName;
+    methodName;
+    constructor(
+    /** The FINAL absolute URL this request is about to be sent to. */
+    url, 
+    /** The HTTP method, e.g. 'POST'. */
+    httpMethod, 
+    /** The EXACT serialized body, or undefined for a call with no argument. */
+    body, 
+    /**
+     * The headers as they stand. READ-ONLY here: a scheme that signs existing headers (a
+     * timestamp another filter set, a content-type) reads them, and the signature it returns is
+     * merged by the caller — so there is exactly one place headers are added and it is the
+     * return value.
+     */
+    headers, 
+    /** The API contract's class name, e.g. 'PartnerWebhookApi'. */
+    contractName, 
+    /** The contract method being called, e.g. 'deliver'. */
+    methodName) {
+        this.url = url;
+        this.httpMethod = httpMethod;
+        this.body = body;
+        this.headers = headers;
+        this.contractName = contractName;
+        this.methodName = methodName;
+    }
+}
+exports.SignableRequest = SignableRequest;
+/**
+ * DI identifier for the optional {@link WebhookSignerCallback} binding. It is a Symbol (not the
+ * class) so the app container's inversify autobind never auto-constructs this token, keeping
+ * `@optional() @inject(WEBHOOK_SIGNER_CALLBACK)` correct — undefined when unbound, which is what
+ * makes the fail-closed refusal reachable. Mirrors WEBHOOK_AUTH_CALLBACK exactly.
+ */
+// webpieces-disable no-symbol-di-tokens -- optional DI token: must be a Symbol so the app container's autobind never auto-constructs this token, keeping @optional() @inject(...) correct (undefined when unbound)
+exports.WEBHOOK_SIGNER_CALLBACK = Symbol.for('WebhookSignerCallback');
+//# sourceMappingURL=WebhookSignerCallback.js.map

package/src/WebhookSignerCallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookSignerCallback.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/WebhookSignerCallback.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAsB,qBAAqB;CAY1C;AAZD,sDAYC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAa,eAAe;IAGJ;IAEA;IAEA;IAOA;IAEA;IAEA;IAjBpB;IACI,kEAAkE;IAClD,GAAW;IAC3B,oCAAoC;IACpB,UAAkB;IAClC,2EAA2E;IAC3D,IAAwB;IACxC;;;;;OAKG;IACa,OAAoC;IACpD,+DAA+D;IAC/C,YAAoB;IACpC,wDAAwD;IACxC,UAAkB;QAflB,QAAG,GAAH,GAAG,CAAQ;QAEX,eAAU,GAAV,UAAU,CAAQ;QAElB,SAAI,GAAJ,IAAI,CAAoB;QAOxB,YAAO,GAAP,OAAO,CAA6B;QAEpC,iBAAY,GAAZ,YAAY,CAAQ;QAEpB,eAAU,GAAV,UAAU,CAAQ;IACnC,CAAC;CACP;AApBD,0CAoBC;AAED;;;;;GAKG;AACH,mNAAmN;AACtM,QAAA,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC","sourcesContent":["/**\n * The OUTBOUND half of `@AuthWebhook(name)` — the exact mirror of `WebhookAuthCallback`, which is\n * the INBOUND half.\n *\n * `@AuthWebhook('partner-hmac')` on a contract says: this hop is authenticated by a signature over\n * the request, in a scheme the FRAMEWORK does not know. Which side of it you are on decides which\n * hook runs, and nothing else changes:\n *\n * | | who signs | who verifies | the hook |\n * |---|---|---|---|\n * | a vendor posts to US | the vendor | us | `WebhookAuthCallback.verifyWebhook` (http-routing) |\n * | WE post to a partner | us | the partner | `WebhookSignerCallback.sign` (here) |\n *\n * The symmetry is the point: ONE decorator on ONE contract describes the credential, and the same\n * `name` selects the same vendor's scheme on both sides. A server that receives Twilio's callbacks\n * and a client that delivers to a partner read identically.\n *\n * ## Why a hook and not an `@AuthHmac` decorator\n *\n * Because there is no such thing as \"the\" HMAC scheme. Twilio signs the full absolute URL with its\n * sorted parameters; Slack signs `v0:{timestamp}:{body}`; Meta signs the raw body alone; GitHub and\n * Stripe each differ again in prefix, header name and encoding. A decorator that took a secret\n * would have to pick one of those and be wrong for everyone else, and a framework that shipped five\n * vendors' crypto would be shipping five things to keep in step with five vendors. So the scheme\n * lives in the app's hook, the VENDOR lives on the contract, and the framework carries neither.\n *\n * ## It FAILS CLOSED\n *\n * With no `WebhookSignerCallback` bound, every outbound `@AuthWebhook` call THROWS rather than\n * going out unsigned — exactly as an unbound `WebhookAuthCallback` 401s every inbound\n * `@AuthWebhook` endpoint. An unsigned delivery is not a degraded delivery; it is a request the\n * partner is obliged to reject, and quietly sending one hides the missing binding until a partner\n * complains.\n *\n * ```typescript\n * // AppModule.ts\n * options.bind(WEBHOOK_SIGNER_CALLBACK).to(PartnerHmacSigner);\n * ```\n *\n * ONE hook serves EVERY partner, the way the inbound one serves every vendor: `name` selects which.\n */\nexport abstract class WebhookSignerCallback {\n    /**\n     * Produce the headers that authenticate ONE outbound request, or throw to refuse to send it.\n     *\n     * @param name    the string on the contract's `@AuthWebhook(name)` — which partner this is.\n     * @param request the FINAL request: the absolute url and the exact bytes that are about to go on\n     *                the wire. See {@link SignableRequest} for why both of those words matter.\n     * @returns header name -> value, merged onto the request. An empty map is legal and means \"this\n     *          partner needs no header\" — it is not a way to opt out of signing, because returning\n     *          it is a statement the hook made rather than a binding somebody forgot.\n     */\n    abstract sign(name: string, request: SignableRequest): Promise<Map<string, string>>;\n}\n\n/**\n * ONE outbound request, as the thing being signed. Data only.\n *\n * Every field a real vendor scheme needs is here, and the two that make it correct are {@link url}\n * and {@link body}:\n *\n * - {@link url} is the FINAL absolute URL, after every app filter has had its say. A signature\n *   computed over the pre-filter URL authenticates a request nobody sent — and for a partner-webhook\n *   client the pre-filter URL is the client's own service name, which is not a destination at all.\n * - {@link body} is the EXACT serialized bytes the transport will send, not the DTO. Serialization\n *   happens before the filter chain runs and the transport sends this same string verbatim, so the\n *   bytes signed and the bytes sent cannot differ. That was impossible while the client owned\n *   serialization internally with no seam, which is why outbound webhook senders were forced back\n *   to hand-rolling `JSON.stringify` plus a raw HTTP library — a library that re-serializes\n *   internally signs one byte sequence and sends another, and the failure is silent.\n */\nexport class SignableRequest {\n    constructor(\n        /** The FINAL absolute URL this request is about to be sent to. */\n        public readonly url: string,\n        /** The HTTP method, e.g. 'POST'. */\n        public readonly httpMethod: string,\n        /** The EXACT serialized body, or undefined for a call with no argument. */\n        public readonly body: string | undefined,\n        /**\n         * The headers as they stand. READ-ONLY here: a scheme that signs existing headers (a\n         * timestamp another filter set, a content-type) reads them, and the signature it returns is\n         * merged by the caller — so there is exactly one place headers are added and it is the\n         * return value.\n         */\n        public readonly headers: ReadonlyMap<string, string>,\n        /** The API contract's class name, e.g. 'PartnerWebhookApi'. */\n        public readonly contractName: string,\n        /** The contract method being called, e.g. 'deliver'. */\n        public readonly methodName: string,\n    ) {}\n}\n\n/**\n * DI identifier for the optional {@link WebhookSignerCallback} binding. It is a Symbol (not the\n * class) so the app container's inversify autobind never auto-constructs this token, keeping\n * `@optional() @inject(WEBHOOK_SIGNER_CALLBACK)` correct — undefined when unbound, which is what\n * makes the fail-closed refusal reachable. Mirrors WEBHOOK_AUTH_CALLBACK exactly.\n */\n// webpieces-disable no-symbol-di-tokens -- optional DI token: must be a Symbol so the app container's autobind never auto-constructs this token, keeping @optional() @inject(...) correct (undefined when unbound)\nexport const WEBHOOK_SIGNER_CALLBACK = Symbol.for('WebhookSignerCallback');\n"]}

package/src/index.d.ts

@@ -14,26 +14,29 @@
  * import { ClientHttpFactory, ClientConfig } from '@webpieces/http-client-node';
  *
  * // inject the factory, then one client per contract
- * const server2 = factory.createRpcClient(
- *     Server2Api,
- *     new ClientConfig('server2', new DeployedServiceHost()),
- *     [],   // this client's outbound filters
- * );
+ * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2'));
  * const response = await server2.fetchValue(req);
+ *
+ * // a client whose destination arrives per call: ONE filter, and nothing else changes
+ * const partner = factory.createRpcClient(PartnerWebhookApi, new ClientConfig('partner-webhooks'), [
+ *     new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),
+ * ]);
  * ```
  */
 export { ClientHttpFactory } from './ClientHttpFactory';
 export { NodeProxyClient, NODE_PROXY_CLIENT_PROVIDER } from './NodeProxyClient';
 export { ClientConfig } from './ClientConfig';
-export { HostPolicy, DeployedServiceHost, RuntimeHostFromContext, RuntimeHostFromContextAllowingInternalAddresses } from './HostPolicy';
-export { SsrfPolicy } from './SsrfPolicy';
+export { ContextBaseUrlFilter } from './ContextBaseUrlFilter';
+export { MissingRuntimeBaseUrlError } from './MissingRuntimeBaseUrlError';
+export { MissingSharedSecretError, MissingWebhookSignerError } from './OutboundAuthErrors';
+export { WebhookSignerCallback, SignableRequest, WEBHOOK_SIGNER_CALLBACK } from './WebhookSignerCallback';
+export { SsrfPolicy, SsrfTestingPolicy } from './SsrfPolicy';
 export { SsrfGuardFilter } from './SsrfGuardFilter';
 export { SsrfRefusedError } from './SsrfRefusedError';
-export { RuntimeHostEndpointUnsupportedError, MissingRuntimeBaseUrlError } from './RuntimeHostErrors';
+export { OutboundAuthFilter } from './OutboundAuthFilter';
 export { InternalAddressRules } from './InternalAddressRules';
 export { AddressResolver, DnsAddressResolver } from './AddressResolver';
-export { ContextBaseUrlOverrideFilter, BASE_URL_OVERRIDE_PRIORITY, SSRF_GUARD_PRIORITY } from './ContextBaseUrlOverrideFilter';
 export { ProxyClient, ClientErrorTranslator, TranslatedFailure } from '@webpieces/http-client-core';
 export { ClientRequest, ClientFilterDefinition } from '@webpieces/http-client-core';
-export type { ClientFilter } from '@webpieces/http-client-core';
+export type { ClientFilter, ClientFilters } from '@webpieces/http-client-core';
 export type { ApiPrototype } from '@webpieces/http-client-core';

package/src/index.js

@@ -15,16 +15,17 @@
  * import { ClientHttpFactory, ClientConfig } from '@webpieces/http-client-node';
  *
  * // inject the factory, then one client per contract
- * const server2 = factory.createRpcClient(
- *     Server2Api,
- *     new ClientConfig('server2', new DeployedServiceHost()),
- *     [],   // this client's outbound filters
- * );
+ * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2'));
  * const response = await server2.fetchValue(req);
+ *
+ * // a client whose destination arrives per call: ONE filter, and nothing else changes
+ * const partner = factory.createRpcClient(PartnerWebhookApi, new ClientConfig('partner-webhooks'), [
+ *     new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),
+ * ]);
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClientFilterDefinition = exports.ClientRequest = exports.TranslatedFailure = exports.ClientErrorTranslator = exports.ProxyClient = exports.SSRF_GUARD_PRIORITY = exports.BASE_URL_OVERRIDE_PRIORITY = exports.ContextBaseUrlOverrideFilter = exports.DnsAddressResolver = exports.AddressResolver = exports.InternalAddressRules = exports.MissingRuntimeBaseUrlError = exports.RuntimeHostEndpointUnsupportedError = exports.SsrfRefusedError = exports.SsrfGuardFilter = exports.SsrfPolicy = exports.RuntimeHostFromContextAllowingInternalAddresses = exports.RuntimeHostFromContext = exports.DeployedServiceHost = exports.HostPolicy = exports.ClientConfig = exports.NODE_PROXY_CLIENT_PROVIDER = exports.NodeProxyClient = exports.ClientHttpFactory = void 0;
+exports.ClientFilterDefinition = exports.ClientRequest = exports.TranslatedFailure = exports.ClientErrorTranslator = exports.ProxyClient = exports.DnsAddressResolver = exports.AddressResolver = exports.InternalAddressRules = exports.OutboundAuthFilter = exports.SsrfRefusedError = exports.SsrfGuardFilter = exports.SsrfTestingPolicy = exports.SsrfPolicy = exports.WEBHOOK_SIGNER_CALLBACK = exports.SignableRequest = exports.WebhookSignerCallback = exports.MissingWebhookSignerError = exports.MissingSharedSecretError = exports.MissingRuntimeBaseUrlError = exports.ContextBaseUrlFilter = exports.ClientConfig = exports.NODE_PROXY_CLIENT_PROVIDER = exports.NodeProxyClient = exports.ClientHttpFactory = void 0;
 var ClientHttpFactory_1 = require("./ClientHttpFactory");
 Object.defineProperty(exports, "ClientHttpFactory", { enumerable: true, get: function () { return ClientHttpFactory_1.ClientHttpFactory; } });
 var NodeProxyClient_1 = require("./NodeProxyClient");
@@ -32,35 +33,40 @@ Object.defineProperty(exports, "NodeProxyClient", { enumerable: true, get: funct
 Object.defineProperty(exports, "NODE_PROXY_CLIENT_PROVIDER", { enumerable: true, get: function () { return NodeProxyClient_1.NODE_PROXY_CLIENT_PROVIDER; } });
 var ClientConfig_1 = require("./ClientConfig");
 Object.defineProperty(exports, "ClientConfig", { enumerable: true, get: function () { return ClientConfig_1.ClientConfig; } });
-// WHERE a client's requests go. Naming one is required on every ClientConfig — see HostPolicy.
-var HostPolicy_1 = require("./HostPolicy");
-Object.defineProperty(exports, "HostPolicy", { enumerable: true, get: function () { return HostPolicy_1.HostPolicy; } });
-Object.defineProperty(exports, "DeployedServiceHost", { enumerable: true, get: function () { return HostPolicy_1.DeployedServiceHost; } });
-Object.defineProperty(exports, "RuntimeHostFromContext", { enumerable: true, get: function () { return HostPolicy_1.RuntimeHostFromContext; } });
-Object.defineProperty(exports, "RuntimeHostFromContextAllowingInternalAddresses", { enumerable: true, get: function () { return HostPolicy_1.RuntimeHostFromContextAllowingInternalAddresses; } });
-// The SSRF policy a runtime host is judged under, and the refusal it produces. On by default; the
-// ONLY way to relax it is naming RuntimeHostFromContextAllowingInternalAddresses at the call site.
+// Install this on the ONE client whose destination is data. Installing it IS the opt-in; a client
+// without it ignores an ambient OVERRIDE_BASE_URL entirely.
+var ContextBaseUrlFilter_1 = require("./ContextBaseUrlFilter");
+Object.defineProperty(exports, "ContextBaseUrlFilter", { enumerable: true, get: function () { return ContextBaseUrlFilter_1.ContextBaseUrlFilter; } });
+var MissingRuntimeBaseUrlError_1 = require("./MissingRuntimeBaseUrlError");
+Object.defineProperty(exports, "MissingRuntimeBaseUrlError", { enumerable: true, get: function () { return MissingRuntimeBaseUrlError_1.MissingRuntimeBaseUrlError; } });
+// The two ways outbound auth refuses to send: a binding a contract's auth mode requires is absent.
+// Typed, so a delivery worker tells 'we are misconfigured' from 'the partner registered something
+// hostile' (SsrfRefusedError) without matching message text.
+var OutboundAuthErrors_1 = require("./OutboundAuthErrors");
+Object.defineProperty(exports, "MissingSharedSecretError", { enumerable: true, get: function () { return OutboundAuthErrors_1.MissingSharedSecretError; } });
+Object.defineProperty(exports, "MissingWebhookSignerError", { enumerable: true, get: function () { return OutboundAuthErrors_1.MissingWebhookSignerError; } });
+// The OUTBOUND half of @AuthWebhook(name) — the mirror of http-routing's WebhookAuthCallback. Bind
+// one, or every outbound @AuthWebhook call throws rather than delivering unsigned.
+var WebhookSignerCallback_1 = require("./WebhookSignerCallback");
+Object.defineProperty(exports, "WebhookSignerCallback", { enumerable: true, get: function () { return WebhookSignerCallback_1.WebhookSignerCallback; } });
+Object.defineProperty(exports, "SignableRequest", { enumerable: true, get: function () { return WebhookSignerCallback_1.SignableRequest; } });
+Object.defineProperty(exports, "WEBHOOK_SIGNER_CALLBACK", { enumerable: true, get: function () { return WebhookSignerCallback_1.WEBHOOK_SIGNER_CALLBACK; } });
+// The SSRF policy a re-pointed URL is judged under, and the refusal it produces. Automatic, armed by
+// the ACT of re-pointing; the ONLY way to relax it is naming SsrfTestingPolicy at a call site.
 var SsrfPolicy_1 = require("./SsrfPolicy");
 Object.defineProperty(exports, "SsrfPolicy", { enumerable: true, get: function () { return SsrfPolicy_1.SsrfPolicy; } });
+Object.defineProperty(exports, "SsrfTestingPolicy", { enumerable: true, get: function () { return SsrfPolicy_1.SsrfTestingPolicy; } });
 var SsrfGuardFilter_1 = require("./SsrfGuardFilter");
 Object.defineProperty(exports, "SsrfGuardFilter", { enumerable: true, get: function () { return SsrfGuardFilter_1.SsrfGuardFilter; } });
 var SsrfRefusedError_1 = require("./SsrfRefusedError");
 Object.defineProperty(exports, "SsrfRefusedError", { enumerable: true, get: function () { return SsrfRefusedError_1.SsrfRefusedError; } });
-// The two refusals that happen BEFORE any bytes leave, and are not about the destination itself.
-var RuntimeHostErrors_1 = require("./RuntimeHostErrors");
-Object.defineProperty(exports, "RuntimeHostEndpointUnsupportedError", { enumerable: true, get: function () { return RuntimeHostErrors_1.RuntimeHostEndpointUnsupportedError; } });
-Object.defineProperty(exports, "MissingRuntimeBaseUrlError", { enumerable: true, get: function () { return RuntimeHostErrors_1.MissingRuntimeBaseUrlError; } });
+var OutboundAuthFilter_1 = require("./OutboundAuthFilter");
+Object.defineProperty(exports, "OutboundAuthFilter", { enumerable: true, get: function () { return OutboundAuthFilter_1.OutboundAuthFilter; } });
 var InternalAddressRules_1 = require("./InternalAddressRules");
 Object.defineProperty(exports, "InternalAddressRules", { enumerable: true, get: function () { return InternalAddressRules_1.InternalAddressRules; } });
 var AddressResolver_1 = require("./AddressResolver");
 Object.defineProperty(exports, "AddressResolver", { enumerable: true, get: function () { return AddressResolver_1.AddressResolver; } });
 Object.defineProperty(exports, "DnsAddressResolver", { enumerable: true, get: function () { return AddressResolver_1.DnsAddressResolver; } });
-// The built-in outbound filter that carries a per-call destination from the RequestContext into the
-// send path, and the two framework priorities an app orders its own filters against.
-var ContextBaseUrlOverrideFilter_1 = require("./ContextBaseUrlOverrideFilter");
-Object.defineProperty(exports, "ContextBaseUrlOverrideFilter", { enumerable: true, get: function () { return ContextBaseUrlOverrideFilter_1.ContextBaseUrlOverrideFilter; } });
-Object.defineProperty(exports, "BASE_URL_OVERRIDE_PRIORITY", { enumerable: true, get: function () { return ContextBaseUrlOverrideFilter_1.BASE_URL_OVERRIDE_PRIORITY; } });
-Object.defineProperty(exports, "SSRF_GUARD_PRIORITY", { enumerable: true, get: function () { return ContextBaseUrlOverrideFilter_1.SSRF_GUARD_PRIORITY; } });
 // The isomorphic engine, re-exported so a server app needs one import.
 var http_client_core_1 = require("@webpieces/http-client-core");
 Object.defineProperty(exports, "ProxyClient", { enumerable: true, get: function () { return http_client_core_1.ProxyClient; } });

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;AAEH,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAC1B,qDAAgF;AAAvE,kHAAA,eAAe,OAAA;AAAE,6HAAA,0BAA0B,OAAA;AACpD,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,+FAA+F;AAC/F,2CAAwI;AAA/H,wGAAA,UAAU,OAAA;AAAE,iHAAA,mBAAmB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,6IAAA,+CAA+C,OAAA;AAEjH,kGAAkG;AAClG,mGAAmG;AACnG,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AACzB,iGAAiG;AACjG,yDAAsG;AAA7F,wIAAA,mCAAmC,OAAA;AAAE,+HAAA,0BAA0B,OAAA;AACxE,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,qDAAwE;AAA/D,kHAAA,eAAe,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAE5C,oGAAoG;AACpG,qFAAqF;AACrF,+EAA+H;AAAtH,4IAAA,4BAA4B,OAAA;AAAE,0IAAA,0BAA0B,OAAA;AAAE,mIAAA,mBAAmB,OAAA;AAEtF,uEAAuE;AACvE,gEAAoG;AAA3F,+GAAA,WAAW,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAC9D,gEAAoF;AAA3E,iHAAA,aAAa,OAAA;AAAE,0HAAA,sBAAsB,OAAA","sourcesContent":["/**\n * @webpieces/http-client-node\n *\n * The SERVER-side HTTP client. Reads an API contract's decorators and generates type-safe HTTP\n * clients from it — the same contract the callee's controller implements.\n *\n * Node-only, so unlike @webpieces/http-client-browser it is fully inversify-wired and reads the\n * magic context straight out of the AsyncLocalStorage-backed RequestContext. There is no\n * ContextReader indirection, because a server has exactly one right answer, and a call made\n * OUTSIDE `RequestContext.run(...)` throws instead of silently dropping the trace.\n *\n * Usage:\n * ```typescript\n * import { ClientHttpFactory, ClientConfig } from '@webpieces/http-client-node';\n *\n * // inject the factory, then one client per contract\n * const server2 = factory.createRpcClient(\n *     Server2Api,\n *     new ClientConfig('server2', new DeployedServiceHost()),\n *     [],   // this client's outbound filters\n * );\n * const response = await server2.fetchValue(req);\n * ```\n */\n\nexport { ClientHttpFactory } from './ClientHttpFactory';\nexport { NodeProxyClient, NODE_PROXY_CLIENT_PROVIDER } from './NodeProxyClient';\nexport { ClientConfig } from './ClientConfig';\n\n// WHERE a client's requests go. Naming one is required on every ClientConfig — see HostPolicy.\nexport { HostPolicy, DeployedServiceHost, RuntimeHostFromContext, RuntimeHostFromContextAllowingInternalAddresses } from './HostPolicy';\n\n// The SSRF policy a runtime host is judged under, and the refusal it produces. On by default; the\n// ONLY way to relax it is naming RuntimeHostFromContextAllowingInternalAddresses at the call site.\nexport { SsrfPolicy } from './SsrfPolicy';\nexport { SsrfGuardFilter } from './SsrfGuardFilter';\nexport { SsrfRefusedError } from './SsrfRefusedError';\n// The two refusals that happen BEFORE any bytes leave, and are not about the destination itself.\nexport { RuntimeHostEndpointUnsupportedError, MissingRuntimeBaseUrlError } from './RuntimeHostErrors';\nexport { InternalAddressRules } from './InternalAddressRules';\nexport { AddressResolver, DnsAddressResolver } from './AddressResolver';\n\n// The built-in outbound filter that carries a per-call destination from the RequestContext into the\n// send path, and the two framework priorities an app orders its own filters against.\nexport { ContextBaseUrlOverrideFilter, BASE_URL_OVERRIDE_PRIORITY, SSRF_GUARD_PRIORITY } from './ContextBaseUrlOverrideFilter';\n\n// The isomorphic engine, re-exported so a server app needs one import.\nexport { ProxyClient, ClientErrorTranslator, TranslatedFailure } from '@webpieces/http-client-core';\nexport { ClientRequest, ClientFilterDefinition } from '@webpieces/http-client-core';\nexport type { ClientFilter } from '@webpieces/http-client-core';\nexport type { ApiPrototype } from '@webpieces/http-client-core';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AAEH,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAC1B,qDAAgF;AAAvE,kHAAA,eAAe,OAAA;AAAE,6HAAA,0BAA0B,OAAA;AACpD,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,kGAAkG;AAClG,4DAA4D;AAC5D,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,2EAA0E;AAAjE,wIAAA,0BAA0B,OAAA;AAEnC,mGAAmG;AACnG,kGAAkG;AAClG,6DAA6D;AAC7D,2DAA2F;AAAlF,8HAAA,wBAAwB,OAAA;AAAE,+HAAA,yBAAyB,OAAA;AAE5D,mGAAmG;AACnG,mFAAmF;AACnF,iEAA0G;AAAjG,8HAAA,qBAAqB,OAAA;AAAE,wHAAA,eAAe,OAAA;AAAE,gIAAA,uBAAuB,OAAA;AAExE,qGAAqG;AACrG,+FAA+F;AAC/F,2CAA6D;AAApD,wGAAA,UAAU,OAAA;AAAE,+GAAA,iBAAiB,OAAA;AACtC,qDAAoD;AAA3C,kHAAA,eAAe,OAAA;AACxB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AACzB,2DAA0D;AAAjD,wHAAA,kBAAkB,OAAA;AAC3B,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,qDAAwE;AAA/D,kHAAA,eAAe,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAE5C,uEAAuE;AACvE,gEAAoG;AAA3F,+GAAA,WAAW,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAC9D,gEAAoF;AAA3E,iHAAA,aAAa,OAAA;AAAE,0HAAA,sBAAsB,OAAA","sourcesContent":["/**\n * @webpieces/http-client-node\n *\n * The SERVER-side HTTP client. Reads an API contract's decorators and generates type-safe HTTP\n * clients from it — the same contract the callee's controller implements.\n *\n * Node-only, so unlike @webpieces/http-client-browser it is fully inversify-wired and reads the\n * magic context straight out of the AsyncLocalStorage-backed RequestContext. There is no\n * ContextReader indirection, because a server has exactly one right answer, and a call made\n * OUTSIDE `RequestContext.run(...)` throws instead of silently dropping the trace.\n *\n * Usage:\n * ```typescript\n * import { ClientHttpFactory, ClientConfig } from '@webpieces/http-client-node';\n *\n * // inject the factory, then one client per contract\n * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2'));\n * const response = await server2.fetchValue(req);\n *\n * // a client whose destination arrives per call: ONE filter, and nothing else changes\n * const partner = factory.createRpcClient(PartnerWebhookApi, new ClientConfig('partner-webhooks'), [\n *     new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),\n * ]);\n * ```\n */\n\nexport { ClientHttpFactory } from './ClientHttpFactory';\nexport { NodeProxyClient, NODE_PROXY_CLIENT_PROVIDER } from './NodeProxyClient';\nexport { ClientConfig } from './ClientConfig';\n\n// Install this on the ONE client whose destination is data. Installing it IS the opt-in; a client\n// without it ignores an ambient OVERRIDE_BASE_URL entirely.\nexport { ContextBaseUrlFilter } from './ContextBaseUrlFilter';\nexport { MissingRuntimeBaseUrlError } from './MissingRuntimeBaseUrlError';\n\n// The two ways outbound auth refuses to send: a binding a contract's auth mode requires is absent.\n// Typed, so a delivery worker tells 'we are misconfigured' from 'the partner registered something\n// hostile' (SsrfRefusedError) without matching message text.\nexport { MissingSharedSecretError, MissingWebhookSignerError } from './OutboundAuthErrors';\n\n// The OUTBOUND half of @AuthWebhook(name) — the mirror of http-routing's WebhookAuthCallback. Bind\n// one, or every outbound @AuthWebhook call throws rather than delivering unsigned.\nexport { WebhookSignerCallback, SignableRequest, WEBHOOK_SIGNER_CALLBACK } from './WebhookSignerCallback';\n\n// The SSRF policy a re-pointed URL is judged under, and the refusal it produces. Automatic, armed by\n// the ACT of re-pointing; the ONLY way to relax it is naming SsrfTestingPolicy at a call site.\nexport { SsrfPolicy, SsrfTestingPolicy } from './SsrfPolicy';\nexport { SsrfGuardFilter } from './SsrfGuardFilter';\nexport { SsrfRefusedError } from './SsrfRefusedError';\nexport { OutboundAuthFilter } from './OutboundAuthFilter';\nexport { InternalAddressRules } from './InternalAddressRules';\nexport { AddressResolver, DnsAddressResolver } from './AddressResolver';\n\n// The isomorphic engine, re-exported so a server app needs one import.\nexport { ProxyClient, ClientErrorTranslator, TranslatedFailure } from '@webpieces/http-client-core';\nexport { ClientRequest, ClientFilterDefinition } from '@webpieces/http-client-core';\nexport type { ClientFilter, ClientFilters } from '@webpieces/http-client-core';\nexport type { ApiPrototype } from '@webpieces/http-client-core';\n"]}

package/src/ContextBaseUrlOverrideFilter.d.ts

@@ -1,38 +0,0 @@
-import { Filter, Service } from '@webpieces/core-util';
-import { ClientRequest } from '@webpieces/http-client-core';
-/**
- * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points
- * THIS ONE CALL at it.
- *
- * This is the filter the whole runtime-base-URL feature is built out of, and expressing it as a
- * filter rather than as a special case inside the transport is the point: information from OUTSIDE
- * the call (a URL a partner registered, sitting in a database column) crosses into the send path
- * through the same seam an app's own signing filter uses, and everything below it in the chain —
- * the SSRF guard, the app's signature — sees the destination this filter chose rather than the one
- * `ClientConfig` bound at construction.
- *
- * ## Scope, and why it cannot leak
- *
- * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the
- * next call through the same client starts from its configured host again; and the context entry is
- * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets a
- * different URL per partner gets exactly the URL it set, per iteration.
- *
- * It is installed ONLY by the runtime host policies, so a client bound to a deployed service never
- * reads the key at all. That is what stops an ambient value set for a partner delivery from silently
- * re-pointing every other client in the same request at the partner's server.
- *
- * Priority {@link BASE_URL_OVERRIDE_PRIORITY} — the OUTERMOST framework filter, so the destination
- * is settled before anything else looks at it.
- */
-export declare class ContextBaseUrlOverrideFilter extends Filter<ClientRequest, Response> {
-    filter(request: ClientRequest, nextFilter: Service<ClientRequest, Response>): Promise<Response>;
-}
-/**
- * The priority the override filter runs at — OUTERMOST of everything, because every other filter's
- * job depends on knowing where the call is going. Exported so an app can see what it is ordering
- * against rather than guessing at a magic number.
- */
-export declare const BASE_URL_OVERRIDE_PRIORITY = 1000;
-/** The SSRF guard's priority: immediately inside the override, so it judges the URL that won. */
-export declare const SSRF_GUARD_PRIORITY = 900;

package/src/ContextBaseUrlOverrideFilter.js

@@ -1,57 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SSRF_GUARD_PRIORITY = exports.BASE_URL_OVERRIDE_PRIORITY = exports.ContextBaseUrlOverrideFilter = void 0;
-const core_util_1 = require("@webpieces/core-util");
-const core_context_1 = require("@webpieces/core-context");
-const RuntimeHostErrors_1 = require("./RuntimeHostErrors");
-/**
- * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points
- * THIS ONE CALL at it.
- *
- * This is the filter the whole runtime-base-URL feature is built out of, and expressing it as a
- * filter rather than as a special case inside the transport is the point: information from OUTSIDE
- * the call (a URL a partner registered, sitting in a database column) crosses into the send path
- * through the same seam an app's own signing filter uses, and everything below it in the chain —
- * the SSRF guard, the app's signature — sees the destination this filter chose rather than the one
- * `ClientConfig` bound at construction.
- *
- * ## Scope, and why it cannot leak
- *
- * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the
- * next call through the same client starts from its configured host again; and the context entry is
- * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets a
- * different URL per partner gets exactly the URL it set, per iteration.
- *
- * It is installed ONLY by the runtime host policies, so a client bound to a deployed service never
- * reads the key at all. That is what stops an ambient value set for a partner delivery from silently
- * re-pointing every other client in the same request at the partner's server.
- *
- * Priority {@link BASE_URL_OVERRIDE_PRIORITY} — the OUTERMOST framework filter, so the destination
- * is settled before anything else looks at it.
- */
-class ContextBaseUrlOverrideFilter extends core_util_1.Filter {
-    async filter(request, nextFilter) {
-        const override = core_context_1.RequestContext.getUntrusted(core_util_1.WebpiecesCoreHeaders.OVERRIDE_BASE_URL);
-        if (override === undefined || override === '') {
-            throw new RuntimeHostErrors_1.MissingRuntimeBaseUrlError(`${request.contractName}.${request.route.methodName} is a RUNTIME-HOST client, so its ` +
-                `destination must be supplied per call, but no ` +
-                `WebpiecesCoreHeaders.OVERRIDE_BASE_URL was found in the RequestContext. Set it around ` +
-                `the call:\n` +
-                `    RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);\n` +
-                `Refusing rather than falling back to a derived service URL is deliberate: a silent ` +
-                `fallback would send a partner's payload to one of our own services.`, `${request.contractName}.${request.route.methodName}`);
-        }
-        request.pointAtBaseUrl(override);
-        return nextFilter.invoke(request);
-    }
-}
-exports.ContextBaseUrlOverrideFilter = ContextBaseUrlOverrideFilter;
-/**
- * The priority the override filter runs at — OUTERMOST of everything, because every other filter's
- * job depends on knowing where the call is going. Exported so an app can see what it is ordering
- * against rather than guessing at a magic number.
- */
-exports.BASE_URL_OVERRIDE_PRIORITY = 1000;
-/** The SSRF guard's priority: immediately inside the override, so it judges the URL that won. */
-exports.SSRF_GUARD_PRIORITY = 900;
-//# sourceMappingURL=ContextBaseUrlOverrideFilter.js.map