@zintrust/core 0.4.15 → 0.4.17

package/src/proxy/smtp/SmtpProxyServer.ts

@@ -0,0 +1,396 @@
+import { Env } from '@config/env';
+import { Logger } from '@config/logger';
+import { ErrorFactory } from '@exceptions/ZintrustError';
+import { isNonEmptyString, isObject } from '@helper/index';
+import {
+  SmtpDriver,
+  type MailAttachment,
+  type MailMessage,
+  type SmtpConfig,
+} from '@mail/drivers/Smtp';
+import { type IncomingMessage } from '@node-singletons/http';
+import { ErrorHandler } from '@proxy/ErrorHandler';
+import type { ProxyBackend, ProxyResponse } from '@proxy/ProxyBackend';
+import type { ProxySigningConfig } from '@proxy/ProxyConfig';
+import { createProxyServer } from '@proxy/ProxyServer';
+import { resolveProxySigningConfig } from '@proxy/ProxySigningConfigResolver';
+import { extractSigningHeaders, verifyProxySignatureIfNeeded } from '@proxy/ProxySigningRequest';
+import { RequestValidator } from '@proxy/RequestValidator';
+import { SigningService } from '@proxy/SigningService';
+
+type ProxyConfig = {
+  host: string;
+  port: number;
+  maxBodyBytes: number;
+  smtp: SmtpConfig;
+  signing: ProxySigningConfig;
+};
+
+type ProxyOverrides = Partial<{
+  host: string;
+  port: number;
+  maxBodyBytes: number;
+  smtpHost: string;
+  smtpPort: number;
+  smtpUsername: string;
+  smtpPassword: string;
+  smtpSecure: boolean | string;
+  requireSigning: boolean;
+  keyId: string;
+  secret: string;
+  signingWindowMs: number;
+}>;
+
+type ParseResult<T> =
+  | { ok: true; value: T }
+  | { ok: false; error: { code: string; message: string } };
+
+const normalizeSecure = (value: unknown): boolean | 'starttls' | undefined => {
+  if (value === true || value === false) return value;
+  if (typeof value === 'string') {
+    const raw = value.trim().toLowerCase();
+    if (raw === '') return undefined;
+    if (raw === 'starttls') return 'starttls';
+    if (['tls', 'ssl', 'smtps', 'implicit', 'true', '1', 'yes', 'y'].includes(raw)) return true;
+    if (['false', '0', 'no', 'n'].includes(raw)) return false;
+  }
+  return undefined;
+};
+
+const resolveProxyConfig = (
+  overrides: ProxyOverrides = {}
+): {
+  host: string;
+  port: number;
+  maxBodyBytes: number;
+} => {
+  const host = overrides.host ?? Env.get('SMTP_PROXY_HOST', Env.HOST ?? '127.0.0.1');
+  const port = overrides.port ?? Env.getInt('SMTP_PROXY_PORT', Env.PORT ?? 8794);
+  const maxBodyBytes =
+    overrides.maxBodyBytes ?? Env.getInt('SMTP_PROXY_MAX_BODY_BYTES', Env.MAX_BODY_SIZE ?? 131072);
+
+  return { host, port, maxBodyBytes };
+};
+
+const resolveSmtpConfig = (overrides: ProxyOverrides = {}): SmtpConfig => {
+  const host = overrides.smtpHost ?? Env.get('MAIL_HOST', '');
+  const port = overrides.smtpPort ?? Env.getInt('MAIL_PORT', 587);
+  const username = overrides.smtpUsername ?? Env.get('MAIL_USERNAME', '');
+  const password = overrides.smtpPassword ?? Env.get('MAIL_PASSWORD', '');
+  const secureRaw = overrides.smtpSecure ?? Env.get('MAIL_SECURE', '');
+  const secure = normalizeSecure(secureRaw) ?? false;
+
+  return { host, port, username, password, secure };
+};
+
+const resolveSigningConfig = (
+  overrides: ProxyOverrides = {}
+): {
+  keyId: string;
+  secret: string;
+  requireSigning: boolean;
+  signingWindowMs: number;
+} =>
+  resolveProxySigningConfig(overrides, {
+    keyIdEnvVar: 'SMTP_PROXY_KEY_ID',
+    secretEnvVar: 'SMTP_PROXY_SECRET',
+    requireEnvVar: 'SMTP_PROXY_REQUIRE_SIGNING',
+    windowEnvVar: 'SMTP_PROXY_SIGNING_WINDOW_MS',
+  });
+
+const resolveConfig = (overrides: ProxyOverrides = {}): ProxyConfig => {
+  const proxyConfig = resolveProxyConfig(overrides);
+  const smtpConfig = resolveSmtpConfig(overrides);
+  const signingConfig = resolveSigningConfig(overrides);
+
+  return {
+    host: proxyConfig.host,
+    port: proxyConfig.port,
+    maxBodyBytes: proxyConfig.maxBodyBytes,
+    smtp: smtpConfig,
+    signing: {
+      keyId: signingConfig.keyId,
+      secret: signingConfig.secret,
+      require: signingConfig.requireSigning,
+      windowMs: signingConfig.signingWindowMs,
+    },
+  };
+};
+
+const validateSmtpConfig = (config: SmtpConfig): void => {
+  if (config.host.trim() === '') {
+    throw ErrorFactory.createConfigError('SMTP proxy missing MAIL_HOST');
+  }
+
+  if (!Number.isFinite(config.port) || config.port <= 0) {
+    throw ErrorFactory.createConfigError('SMTP proxy MAIL_PORT must be a positive integer');
+  }
+
+  const username = config.username ?? '';
+  const password = config.password ?? '';
+  if (
+    (username.trim() !== '' && password.trim() === '') ||
+    (username.trim() === '' && password.trim() !== '')
+  ) {
+    throw ErrorFactory.createConfigError(
+      'SMTP proxy requires both MAIL_USERNAME and MAIL_PASSWORD'
+    );
+  }
+};
+
+const verifySignatureIfNeeded = async (
+  req: IncomingMessage,
+  body: string,
+  config: ProxyConfig
+): Promise<{ ok: boolean; error?: { status: number; message: string } }> => {
+  const headers = extractSigningHeaders(req);
+
+  if (SigningService.shouldVerify(config.signing, headers)) {
+    const verified = await verifyProxySignatureIfNeeded(req, body, config.signing);
+    if (!verified.ok) {
+      const normalizedSigning =
+        typeof SigningService['normalizeConfig'] === 'function'
+          ? (SigningService['normalizeConfig'] as (c: ProxySigningConfig) => ProxySigningConfig)(
+              config.signing
+            )
+          : config.signing;
+      Logger.warn('[SmtpProxy] Signing verification failed', {
+        code: 'INVALID_SIGNATURE',
+        message: verified.error?.message ?? 'Invalid signature',
+        keyId: headers['x-zt-key-id'],
+        expectedKeyId: normalizedSigning.keyId,
+        requireSigning: normalizedSigning.require,
+      });
+      return {
+        ok: false,
+        error: {
+          status: verified.error?.status ?? 401,
+          message: verified.error?.message ?? 'Unauthorized',
+        },
+      };
+    }
+  }
+
+  return { ok: true };
+};
+
+const isRecord = (value: unknown): value is Record<string, unknown> => isObject(value);
+
+const parseAttachment = (value: unknown): ParseResult<MailAttachment> => {
+  if (!isRecord(value)) {
+    return {
+      ok: false,
+      error: { code: 'VALIDATION_ERROR', message: 'attachments must be objects' },
+    };
+  }
+
+  const filename = value['filename'];
+  const contentBase64 = value['contentBase64'];
+
+  if (!isNonEmptyString(filename)) {
+    return {
+      ok: false,
+      error: { code: 'VALIDATION_ERROR', message: 'attachment filename is required' },
+    };
+  }
+
+  if (!isNonEmptyString(contentBase64)) {
+    return {
+      ok: false,
+      error: { code: 'VALIDATION_ERROR', message: 'attachment contentBase64 is required' },
+    };
+  }
+
+  const content = Buffer.from(contentBase64, 'base64');
+  return { ok: true, value: { filename, content } };
+};
+
+const parseTo = (value: unknown): ParseResult<MailMessage['to']> => {
+  if (typeof value === 'string' || Array.isArray(value)) {
+    return { ok: true, value: value as MailMessage['to'] };
+  }
+  return {
+    ok: false,
+    error: { code: 'VALIDATION_ERROR', message: 'to must be a string or array' },
+  };
+};
+
+const parseFrom = (value: unknown): ParseResult<MailMessage['from']> => {
+  if (!isRecord(value)) {
+    return { ok: false, error: { code: 'VALIDATION_ERROR', message: 'from is required' } };
+  }
+
+  const email = value['email'];
+  const name = value['name'];
+  if (!isNonEmptyString(email)) {
+    return { ok: false, error: { code: 'VALIDATION_ERROR', message: 'from.email is required' } };
+  }
+
+  return {
+    ok: true,
+    value: {
+      email,
+      name: isNonEmptyString(name) ? name : undefined,
+    },
+  };
+};
+
+const parseHtml = (value: unknown): ParseResult<string | undefined> => {
+  if (value === undefined) return { ok: true, value: undefined };
+  if (typeof value === 'string') return { ok: true, value };
+  return { ok: false, error: { code: 'VALIDATION_ERROR', message: 'html must be a string' } };
+};
+
+const parseAttachments = (value: unknown): ParseResult<MailAttachment[] | undefined> => {
+  if (value === undefined) return { ok: true, value: undefined };
+  if (!Array.isArray(value)) {
+    return {
+      ok: false,
+      error: { code: 'VALIDATION_ERROR', message: 'attachments must be an array' },
+    };
+  }
+
+  const attachments: MailAttachment[] = [];
+  for (const entry of value) {
+    const parsed = parseAttachment(entry);
+    if (!parsed.ok) return parsed;
+    attachments.push(parsed.value);
+  }
+
+  return { ok: true, value: attachments };
+};
+
+const parseMessagePayload = (payload: Record<string, unknown>): ParseResult<MailMessage> => {
+  const messageRaw = payload['message'];
+  if (!isRecord(messageRaw)) {
+    return { ok: false, error: { code: 'VALIDATION_ERROR', message: 'message is required' } };
+  }
+
+  const toParsed = parseTo(messageRaw['to']);
+  if (!toParsed.ok) return toParsed;
+
+  const fromParsed = parseFrom(messageRaw['from']);
+  if (!fromParsed.ok) return fromParsed;
+
+  const subject = messageRaw['subject'];
+  if (typeof subject !== 'string' || subject.trim() === '') {
+    return { ok: false, error: { code: 'VALIDATION_ERROR', message: 'subject is required' } };
+  }
+
+  const text = messageRaw['text'];
+  if (typeof text !== 'string' || text.trim() === '') {
+    return { ok: false, error: { code: 'VALIDATION_ERROR', message: 'text is required' } };
+  }
+
+  const htmlParsed = parseHtml(messageRaw['html']);
+  if (!htmlParsed.ok) return htmlParsed;
+
+  const attachmentsParsed = parseAttachments(messageRaw['attachments']);
+  if (!attachmentsParsed.ok) return attachmentsParsed;
+
+  return {
+    ok: true,
+    value: {
+      to: toParsed.value,
+      from: fromParsed.value,
+      subject,
+      text,
+      html: htmlParsed.value,
+      attachments: attachmentsParsed.value,
+    },
+  };
+};
+
+const createBackend = (config: ProxyConfig): ProxyBackend => ({
+  name: 'smtp',
+  handle: async (request) => {
+    const methodError = RequestValidator.requirePost(request.method);
+    Logger.info('[SmtpProxy] Received request', { path: request.path, method: request.method });
+    if (methodError) {
+      return ErrorHandler.toProxyError(405, methodError.code, methodError.message);
+    }
+
+    if (request.path !== '/zin/smtp/send') {
+      Logger.warn('[SmtpProxy] 404 Not Found', { path: request.path });
+      return ErrorHandler.toProxyError(404, 'NOT_FOUND', 'Unknown endpoint');
+    }
+
+    const parsed = RequestValidator.parseJson(request.body);
+    if (!parsed.ok) {
+      return ErrorHandler.toProxyError(400, parsed.error.code, parsed.error.message);
+    }
+
+    const messageValidation = parseMessagePayload(parsed.value);
+    if (!messageValidation.ok) {
+      return ErrorHandler.toProxyError(
+        400,
+        messageValidation.error.code,
+        messageValidation.error.message
+      );
+    }
+
+    try {
+      Logger.info('[SmtpProxy] Sending email via SmtpDriver', { to: messageValidation.value.to });
+      await SmtpDriver.send(config.smtp, messageValidation.value);
+      Logger.info('[SmtpProxy] Email sent successfully');
+      return { status: 200, body: { ok: true } };
+    } catch (error) {
+      Logger.error('[SmtpProxy] Failed to send email', error);
+      return ErrorHandler.toProxyError(500, 'SMTP_PROXY_ERROR', String(error));
+    }
+  },
+  async health(): Promise<ProxyResponse> {
+    try {
+      validateSmtpConfig(config.smtp);
+      await Promise.resolve();
+      return { status: 200, body: { status: 'healthy' } };
+    } catch (error) {
+      return ErrorHandler.toProxyError(503, 'UNHEALTHY', String(error));
+    }
+  },
+});
+
+const createVerifier =
+  (config: ProxyConfig) =>
+  async (
+    req: IncomingMessage,
+    body: string
+  ): Promise<{ ok: true } | { ok: false; status: number; message: string }> => {
+    const verified = await verifySignatureIfNeeded(req, body, config);
+    if (!verified.ok && verified.error) {
+      return { ok: false, status: verified.error.status, message: verified.error.message };
+    }
+    return { ok: true };
+  };
+
+export const SmtpProxyServer = Object.freeze({
+  async start(overrides: ProxyOverrides = {}): Promise<void> {
+    const config = resolveConfig(overrides);
+    validateSmtpConfig(config.smtp);
+
+    try {
+      Logger.info(
+        `SMTP proxy config: proxyHost=${config.host} proxyPort=${config.port} smtpHost=${String(
+          config.smtp.host
+        )} smtpPort=${String(config.smtp.port)} smtpUser=${String(config.smtp.username ?? '')}`
+      );
+    } catch {
+      // noop
+    }
+
+    const backend = createBackend(config);
+
+    const server = createProxyServer({
+      host: config.host,
+      port: config.port,
+      maxBodyBytes: config.maxBodyBytes,
+      backend,
+      verify: createVerifier(config),
+    });
+
+    await server.start();
+    Logger.info(`SMTP proxy listening on http://${config.host}:${config.port}`);
+  },
+});
+
+export default SmtpProxyServer;

package/src/proxy/smtp/register.ts

@@ -0,0 +1,6 @@
+import { ProxyRegistry } from '@proxy/ProxyRegistry';
+
+ProxyRegistry.register({
+  name: 'smtp',
+  description: 'SMTP HTTP proxy server',
+});

package/src/proxy/sqlserver/SqlServerProxyServer.ts

@@ -0,0 +1,287 @@
+import type { ProxyBackend, ProxyResponse } from '@proxy/ProxyBackend';
+import type { ProxySigningConfig } from '@proxy/ProxyConfig';
+import { type BaseProxyOverrides } from '@proxy/ProxyServerUtils';
+import type { SqlProxyDatabaseConfig, SqlProxyDatabaseOverrides } from '@proxy/SqlProxyDbOverrides';
+import * as Deps from '@proxy/SqlProxyServerDeps';
+
+type SqlServerPool = Record<string, unknown>;
+type SqlServerResult = { recordset: unknown[]; rowsAffected: number[] };
+
+type ProxyConfig = {
+  host: string;
+  port: number;
+  maxBodyBytes: number;
+  poolConfig: Record<string, unknown>;
+  signing: ProxySigningConfig;
+  statements?: Record<string, string>;
+};
+
+type ProxyOverrides = BaseProxyOverrides & SqlProxyDatabaseOverrides;
+
+const resolveDatabaseConfig = (overrides: ProxyOverrides = {}): SqlProxyDatabaseConfig => {
+  const dbHost =
+    overrides.dbHost ?? Deps.Env.get('DB_HOST_MSSQL', Deps.Env.get('DB_HOST', '127.0.0.1'));
+  const dbPort = overrides.dbPort ?? Deps.Env.getInt('DB_PORT_MSSQL', 1433);
+  const dbName = overrides.dbName ?? Deps.Env.get('DB_DATABASE_MSSQL', 'zintrust');
+  const dbUser = overrides.dbUser ?? Deps.Env.get('DB_USERNAME_MSSQL', 'sa');
+  const dbPass = overrides.dbPass ?? Deps.Env.get('DB_PASSWORD_MSSQL', '');
+  const connectionLimit =
+    overrides.connectionLimit ?? Deps.Env.getInt('SQLSERVER_PROXY_POOL_LIMIT', 10);
+
+  return { dbHost, dbPort, dbName, dbUser, dbPass, connectionLimit };
+};
+
+const resolveConfig = (overrides: ProxyOverrides = {}): ProxyConfig => {
+  const proxyConfig = Deps.resolveBaseConfig(overrides, 'SQLSERVER');
+  const dbConfig = resolveDatabaseConfig(overrides);
+  const signingConfig = Deps.resolveBaseSigningConfig(overrides, 'SQLSERVER');
+
+  const poolConfig = {
+    server: dbConfig.dbHost,
+    port: dbConfig.dbPort,
+    database: dbConfig.dbName,
+    user: dbConfig.dbUser,
+    password: dbConfig.dbPass,
+    pool: {
+      max: dbConfig.connectionLimit,
+      min: 0,
+      idleTimeoutMillis: 30000,
+    },
+    options: {
+      encrypt: false,
+      trustServerCertificate: true,
+    },
+  };
+
+  return {
+    host: proxyConfig.host,
+    port: proxyConfig.port,
+    maxBodyBytes: proxyConfig.maxBodyBytes,
+    poolConfig,
+    signing: {
+      keyId: signingConfig.keyId,
+      secret: signingConfig.secret,
+      require: signingConfig.requireSigning,
+      windowMs: signingConfig.signingWindowMs,
+    },
+    statements: Deps.loadStatementRegistry('SQLSERVER'),
+  };
+};
+
+const validateQueryPayload = (
+  payload: Record<string, unknown>
+): {
+  valid: boolean;
+  sql?: string;
+  params?: unknown[];
+  error?: { code: string; message: string };
+} => {
+  const base = Deps.validateSqlPayload(payload);
+  if (!base.valid) {
+    return { valid: false, error: base.error };
+  }
+
+  if (base.sql.trim() === '') {
+    return { valid: false, error: { code: 'VALIDATION_ERROR', message: 'sql is required' } };
+  }
+
+  return { valid: true, sql: base.sql, params: base.params };
+};
+
+const getSqlModule = async (): Promise<Record<string, unknown>> => {
+  const mod = await import('mssql');
+  return mod as unknown as Record<string, unknown>;
+};
+
+const createPool = async (config: Record<string, unknown>): Promise<SqlServerPool> => {
+  const mod = await getSqlModule();
+  const connect = mod['connect'] as (config: Record<string, unknown>) => Promise<SqlServerPool>;
+  return connect(config);
+};
+
+const executeQuery = async (
+  pool: SqlServerPool,
+  sqlQuery: string,
+  params: unknown[]
+): Promise<SqlServerResult> => {
+  const requestFunc = pool['request'] as () => Record<string, unknown>;
+  const request = requestFunc();
+
+  params.forEach((param, index) => {
+    const inputFunc = request['input'] as (name: string, value: unknown) => void;
+    inputFunc(`param${index}`, param);
+  });
+
+  const queryFunc = request['query'] as (sql: string) => Promise<SqlServerResult>;
+  return queryFunc(sqlQuery);
+};
+
+const handleEndpoint = (path: string, result: SqlServerResult): ProxyResponse => {
+  const rows = result['recordset'];
+  const rowsAffected = result['rowsAffected'];
+
+  if (path === '/zin/sqlserver/query') {
+    return { status: 200, body: { rows, rowCount: rowsAffected[0] ?? 0 } };
+  }
+
+  if (path === '/zin/sqlserver/queryOne') {
+    const firstRow = Array.isArray(rows) ? rows[0] : null;
+    return { status: 200, body: { row: firstRow ?? null } };
+  }
+
+  if (path === '/zin/sqlserver/exec') {
+    return {
+      status: 200,
+      body: {
+        ok: true,
+        meta: { changes: rowsAffected[0] ?? 0 },
+      },
+    };
+  }
+
+  if (path === '/zin/sqlserver/statement') {
+    // Statement endpoint returns query-shaped response for non-mutating SQL.
+    return { status: 200, body: { rows, rowCount: rowsAffected[0] ?? 0 } };
+  }
+
+  return Deps.ErrorHandler.toProxyError(404, 'NOT_FOUND', 'Unknown endpoint');
+};
+
+const toMutatingStatementResponse = (result: SqlServerResult): ProxyResponse => {
+  const rowsAffected = result['rowsAffected'];
+  return {
+    status: 200,
+    body: {
+      ok: true,
+      meta: { changes: rowsAffected[0] ?? 0 },
+    },
+  };
+};
+
+const handleStatementRequest = async (
+  pool: SqlServerPool,
+  statements: Record<string, string> | undefined,
+  requestPath: string,
+  payload: Record<string, unknown>
+): Promise<ProxyResponse> => {
+  const resolved = Deps.resolveStatementOrError(statements, payload);
+  if (!resolved.ok) return resolved.response;
+
+  try {
+    const result = await executeQuery(pool, resolved.value.sql, resolved.value.params);
+    if (!resolved.value.mutating) return handleEndpoint('/zin/sqlserver/statement', result);
+    return toMutatingStatementResponse(result);
+  } catch (error) {
+    Deps.Logger.error('[SqlServerProxyServer] Statement execution failed', {
+      path: requestPath,
+      statementId: resolved.value.statementId,
+      mutating: resolved.value.mutating,
+      paramsCount: resolved.value.params.length,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return Deps.ErrorHandler.toProxyError(500, 'SQLSERVER_ERROR', String(error));
+  }
+};
+
+const handleSqlRequest = async (
+  pool: SqlServerPool,
+  requestPath: string,
+  payload: Record<string, unknown>
+): Promise<ProxyResponse> => {
+  const sqlValidation = validateQueryPayload(payload);
+  if (!sqlValidation.valid) {
+    const error = sqlValidation.error ?? {
+      code: 'VALIDATION_ERROR',
+      message: 'Invalid SQL payload',
+    };
+    return Deps.ErrorHandler.toProxyError(400, error.code, error.message);
+  }
+
+  try {
+    const result = await executeQuery(pool, sqlValidation.sql ?? '', sqlValidation.params ?? []);
+    return handleEndpoint(requestPath, result);
+  } catch (error) {
+    return Deps.ErrorHandler.toProxyError(500, 'SQLSERVER_ERROR', String(error));
+  }
+};
+
+const handleProxyRequest = async (
+  pool: SqlServerPool,
+  statements: Record<string, string> | undefined,
+  request: { method: string; path: string; body: string }
+): Promise<ProxyResponse> => {
+  const validationError = Deps.validateProxyRequest(request);
+  if (validationError !== null) return validationError;
+
+  const parsed = Deps.parseJsonBody(request.body);
+  if ('status' in parsed) return parsed;
+
+  if (request.path === '/zin/sqlserver/statement') {
+    return handleStatementRequest(pool, statements, request.path, parsed.value);
+  }
+
+  return handleSqlRequest(pool, request.path, parsed.value);
+};
+
+const createBackend = (
+  pool: SqlServerPool,
+  statements: Record<string, string> | undefined
+): ProxyBackend => ({
+  name: 'sqlserver',
+  handle: async (request): Promise<ProxyResponse> => handleProxyRequest(pool, statements, request),
+  health: async (): Promise<ProxyResponse> => {
+    try {
+      await executeQuery(pool, 'SELECT 1', []);
+      return { status: 200, body: { status: 'healthy' } };
+    } catch (error) {
+      return Deps.ErrorHandler.toProxyError(503, 'UNHEALTHY', String(error));
+    }
+  },
+  shutdown: async (): Promise<void> => {
+    const closeFunc = pool['close'] as () => Promise<void>;
+    await closeFunc();
+  },
+});
+
+export const SqlServerProxyServer = Object.freeze({
+  async start(overrides: ProxyOverrides = {}): Promise<void> {
+    const config = resolveConfig(overrides);
+
+    try {
+      Deps.Logger.info(
+        `SQL Server proxy config: proxyHost=${config.host} proxyPort=${config.port} dbHost=${String(
+          config.poolConfig['server']
+        )} dbPort=${String(config.poolConfig['port'])} dbName=${String(
+          config.poolConfig['database']
+        )} dbUser=${String(config.poolConfig['user'])}`
+      );
+    } catch {
+      // noop - logging must not block startup
+    }
+
+    const pool = await createPool(config.poolConfig);
+    const backend = createBackend(pool, config.statements);
+
+    const proxy = Deps.createProxyServer({
+      host: config.host,
+      port: config.port,
+      maxBodyBytes: config.maxBodyBytes,
+      backend,
+      verify: async (req, body) => {
+        const verified = await Deps.verifyRequestSignature(
+          req,
+          body,
+          config,
+          'SqlServerProxyServer'
+        );
+        if (!verified.ok && verified.error) {
+          return { ok: false, status: verified.error.status, message: verified.error.message };
+        }
+        return { ok: true };
+      },
+    });
+
+    await proxy.start();
+    Deps.Logger.info(`✓ SQL Server proxy listening on ${config.host}:${config.port}`);
+  },
+});

package/src/proxy/sqlserver/register.ts

@@ -0,0 +1,5 @@
+import { ProxyRegistry } from '@proxy/ProxyRegistry';
+ProxyRegistry.register({
+  name: 'sqlserver',
+  description: 'SQL Server HTTP proxy',
+});

package/src/proxy.ts

@@ -0,0 +1,3 @@
+export { ErrorHandler } from '@proxy/ErrorHandler';
+export { RequestValidator } from '@proxy/RequestValidator';
+export { SigningService } from '@proxy/SigningService';