@westbayberry/dg 2.3.2 → 2.3.4

package/dist/gate/verdict-core.js

@@ -0,0 +1,101 @@
+import { sanitize } from "../security/sanitize.js";
+import { artifactDisplayName, safeDecodeUriComponent } from "../proxy/metadata-map.js";
+export function normalizeVerdict(value, target, identity, streamedSha256) {
+    if (!isRecord(value)) {
+        throw new Error("Dependency Guardian API returned a malformed verdict");
+    }
+    const verdict = value.verdict;
+    if (verdict !== "pass" && verdict !== "warn" && verdict !== "block") {
+        throw new Error("Dependency Guardian API returned a malformed verdict");
+    }
+    const scannedSha256 = typeof value.scannedSha256 === "string" ? value.scannedSha256.toLowerCase() : "";
+    if (scannedSha256.length > 0 && scannedSha256 !== streamedSha256) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "hash-mismatch",
+            reason: `server scanned SHA-256 ${scannedSha256} did not match streamed artifact SHA-256 ${streamedSha256}`
+        };
+    }
+    const cause = typeof value.cause === "string" ? value.cause : undefined;
+    const cooldown = parseCooldownInfo(value.cooldown);
+    const provenance = parseProvenance(value.provenance);
+    const dashboardUrl = safeDashboardUrl(value.dashboardUrl);
+    return {
+        verdict,
+        packageName: typeof value.packageName === "string" ? sanitize(value.packageName) : artifactDisplayName(identity) || packageNameFromUrl(target),
+        ...(isProxyCause(cause) ? { cause } : {}),
+        reason: typeof value.reason === "string" ? sanitize(value.reason) : `API verdict ${verdict}`,
+        ...(dashboardUrl ? { dashboardUrl } : {}),
+        ...(value.unauthenticated === true ? { unauthenticated: true } : {}),
+        ...(cooldown ? { cooldown } : {}),
+        ...(provenance ? { provenance } : {})
+    };
+}
+export function safeDashboardUrl(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    try {
+        const url = new URL(sanitize(value));
+        return url.protocol === "https:" ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function parseCooldownInfo(value) {
+    if (!isRecord(value) || typeof value.requiredDays !== "number" || !Number.isFinite(value.requiredDays)) {
+        return undefined;
+    }
+    return {
+        requiredDays: value.requiredDays,
+        ...(typeof value.ageDays === "number" && Number.isFinite(value.ageDays) ? { ageDays: value.ageDays } : {}),
+        ...(typeof value.publishedAt === "string" ? { publishedAt: sanitize(value.publishedAt) } : {}),
+        ...(typeof value.eligibleAt === "string" ? { eligibleAt: sanitize(value.eligibleAt) } : {})
+    };
+}
+function parseProvenance(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const status = value.status;
+    if (status !== "attested" && status !== "none" && status !== "unknown") {
+        return undefined;
+    }
+    const downgrade = isRecord(value.downgrade) && typeof value.downgrade.fromVersion === "string"
+        ? { fromVersion: sanitize(value.downgrade.fromVersion) }
+        : undefined;
+    return {
+        status,
+        ...(typeof value.predicateType === "string" ? { predicateType: sanitize(value.predicateType) } : {}),
+        ...(downgrade ? { downgrade } : {})
+    };
+}
+export function packageNameFromUrl(url) {
+    const name = url.pathname.split("/").filter(Boolean).pop();
+    return name ? safeDecodeUriComponent(name) : url.hostname;
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+export function isProxyCause(value) {
+    return [
+        "pass",
+        "warn",
+        "malware",
+        "policy",
+        "license",
+        "hash-mismatch",
+        "private-upload-disabled",
+        "needs-login",
+        "api-unavailable",
+        "quota-exceeded",
+        "api-timeout",
+        "registry-timeout",
+        "analysis-incomplete",
+        "cooldown",
+        "unsupported-manager",
+        "proxy-setup-failure"
+    ].includes(value ?? "");
+}

package/dist/gate/verdict-fetch.js

@@ -0,0 +1,214 @@
+import { isRecord, normalizeVerdict } from "./verdict-core.js";
+import { resolveCooldownRequest } from "./cooldown-request.js";
+import { hostMatchesList } from "./host-match.js";
+import { artifactDisplayName, artifactUrlHash } from "../proxy/metadata-map.js";
+import { loadPreverifiedMap, preverifiedKey } from "../proxy/preverified.js";
+import { sanitize } from "../security/sanitize.js";
+import { identityHeaders } from "../api/analyze.js";
+import { dgVersion } from "../commands/version.js";
+import { redactSecrets } from "../launcher/output-redaction.js";
+import { envAuthToken } from "../auth/env-token.js";
+export async function lookupVerdict(options, target, sha256, upstream, identity) {
+    if (shouldUseScanTarball(options, target, identity)) {
+        return lookupScanTarballVerdict(options, target, sha256, upstream, identity);
+    }
+    const preverified = preverifiedVerdict(options, target, sha256, identity);
+    if (preverified) {
+        return preverified;
+    }
+    const cooldown = resolveCooldownRequest(options, identity);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), options.verdictTimeoutMs ?? installVerdictTimeoutMs(options.env));
+    try {
+        const response = await fetch(`${options.apiBaseUrl}/v1/install-verdict`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-Dg-Version": dgVersion(),
+                ...identityHeaders(options.env)
+            },
+            body: JSON.stringify({
+                manager: options.classification.manager,
+                action: options.classification.action,
+                url: redactSecrets(target.toString()),
+                artifactUrlHash: artifactUrlHash(target),
+                ecosystem: identity.ecosystem,
+                name: identity.name,
+                version: identity.version,
+                registryHost: identity.registryHost,
+                sourceKind: identity.sourceKind,
+                sha256,
+                statusCode: upstream.statusCode,
+                contentType: headerValue(upstream.headers["content-type"]),
+                ...(cooldown ? { cooldown } : {})
+            }),
+            signal: controller.signal
+        });
+        if (response.status === 402 || response.status === 429) {
+            const body = (await response.json().catch(() => ({})));
+            return {
+                verdict: "block",
+                packageName: artifactDisplayName(identity),
+                cause: "quota-exceeded",
+                reason: "You've reached your monthly scan limit. Upgrade at westbayberry.com/pricing or wait for it to reset.",
+                ...(typeof body.resetsAt === "string" ? { resetsAt: sanitize(body.resetsAt) } : {}),
+                quotaBehavior: body.quotaBehavior === "pass" ? "pass" : "block"
+            };
+        }
+        if (response.status === 401) {
+            return {
+                verdict: "block",
+                packageName: artifactDisplayName(identity),
+                cause: "needs-login",
+                unauthenticated: true,
+                reason: "Checking a package from the registry before it installs requires sign-in."
+            };
+        }
+        if (!response.ok) {
+            return {
+                verdict: "block",
+                packageName: artifactDisplayName(identity),
+                cause: "api-unavailable",
+                reason: `Dependency Guardian API returned ${response.status}. Run 'dg doctor' and 'dg login' to verify API access.`
+            };
+        }
+        return normalizeVerdict(await response.json(), target, identity, sha256);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function lookupScanTarballVerdict(options, target, sha256, upstream, identity) {
+    const body = upstream.body ?? Buffer.alloc(0);
+    const uploadPolicy = scanTarballUploadPolicy(options.env);
+    if (!uploadPolicy.enabled) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: `private artifact scan upload is disabled for ${target.hostname}`
+        };
+    }
+    if (!uploadPolicy.token) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: "private artifact scan upload requires DG_API_TOKEN"
+        };
+    }
+    if (body.length > uploadPolicy.maxBytes) {
+        return {
+            verdict: "block",
+            packageName: artifactDisplayName(identity),
+            cause: "private-upload-disabled",
+            reason: `private artifact is ${body.length} bytes, above the ${uploadPolicy.maxBytes} byte scan-tarball upload limit`
+        };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), uploadPolicy.timeoutMs);
+    try {
+        const response = await fetch(`${options.apiBaseUrl}/v1/scan-tarball`, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${uploadPolicy.token}`,
+                "Content-Type": "application/octet-stream",
+                "X-DG-Action": options.classification.action,
+                "X-DG-Artifact-SHA256": sha256,
+                "X-DG-Artifact-URL-Hash": artifactUrlHash(target),
+                "X-DG-Cache-Key": `sha256:${sha256}`,
+                "X-DG-Ecosystem": identity.ecosystem,
+                "X-DG-Manager": options.classification.manager,
+                "X-DG-Package-Name": identity.name,
+                "X-DG-Package-Version": identity.version,
+                "X-DG-Privacy": "private-artifact",
+                "X-DG-Registry-Host": identity.registryHost,
+                "X-DG-Source-Kind": identity.sourceKind
+            },
+            body,
+            signal: controller.signal
+        });
+        if (!response.ok) {
+            throw new Error(`Dependency Guardian scan-tarball API returned ${response.status}`);
+        }
+        return normalizeScanTarballVerdict(await response.json(), target, identity, sha256);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+// A preflight batch-analyze already verdicted this exact name@version (and the
+// user accepted any warns), so a per-artifact API round-trip would re-answer
+// the same question. Trust it only when the identity came from registry
+// metadata and the preflight applied the same cooldown gate the proxy would;
+// the synthesized verdict goes through normalizeVerdict so the scanned-SHA
+// cross-check blocks tampered bytes exactly like a server response would.
+function preverifiedVerdict(options, target, streamedSha256, identity) {
+    if (identity.sourceKind !== "registry-metadata") {
+        return null;
+    }
+    const entry = loadPreverifiedMap(options.session.dir).get(preverifiedKey(identity.ecosystem, identity.name, identity.version));
+    if (!entry) {
+        return null;
+    }
+    if (!entry.cooldownEvaluated && resolveCooldownRequest(options, identity) !== undefined) {
+        return null;
+    }
+    if (!entry.scannedSha256) {
+        // No byte-level fingerprint to cross-check against the streamed artifact, so
+        // a preverified pass/warn can't prove the downloaded bytes match what was
+        // screened (a metadata-only preflight, or a registry swap between preflight
+        // and fetch). Fall through to a real scan of the streamed bytes — TOCTOU
+        // defense — rather than honoring the verdict for whatever now arrives.
+        return null;
+    }
+    return normalizeVerdict({
+        verdict: entry.action,
+        cause: entry.action,
+        packageName: `${identity.name}@${identity.version}`,
+        reason: entry.reason ?? (entry.action === "pass" ? "verified before install" : "flagged for review"),
+        ...(entry.scannedSha256 ? { scannedSha256: entry.scannedSha256 } : {})
+    }, target, identity, streamedSha256);
+}
+function normalizeScanTarballVerdict(value, target, identity, streamedSha256) {
+    if (!isRecord(value) || typeof value.scannedSha256 !== "string" || value.scannedSha256.length === 0) {
+        throw new Error("Dependency Guardian scan-tarball API did not return scannedSha256");
+    }
+    return normalizeVerdict(value, target, identity, streamedSha256);
+}
+function shouldUseScanTarball(options, target, identity) {
+    if (identity.sourceKind !== "url-fallback") {
+        return false;
+    }
+    return hostMatchesList(target.hostname, options.env.DG_PRIVATE_REGISTRY_HOSTS ?? "");
+}
+function scanTarballUploadPolicy(env) {
+    return {
+        enabled: env.DG_SCAN_TARBALL_UPLOAD === "1" || env.DG_SCAN_TARBALL_UPLOAD === "true",
+        maxBytes: parsePositiveInteger(env.DG_SCAN_TARBALL_MAX_BYTES, 50 * 1024 * 1024),
+        timeoutMs: parsePositiveInteger(env.DG_SCAN_TARBALL_TIMEOUT_MS, 5_000),
+        token: envAuthToken(env) ?? ""
+    };
+}
+function installVerdictTimeoutMs(env) {
+    return parsePositiveInteger(env.DG_INSTALL_VERDICT_TIMEOUT_MS, 240_000);
+}
+function parsePositiveInteger(value, fallback) {
+    if (!value) {
+        return fallback;
+    }
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function headerValue(value) {
+    if (Array.isArray(value)) {
+        return value.join(",");
+    }
+    if (typeof value === "number") {
+        return String(value);
+    }
+    if (typeof value === "string") {
+        return value;
+    }
+    return "";
+}