addons-scanner-utils 9.15.0 → 10.1.0

package/dist/functions.d.ts

@@ -11,8 +11,9 @@ type CreateApiErrorParams = {
     status?: number;
 };
 export declare const createApiError: ({ message, extraInfo, status, }: CreateApiErrorParams) => ApiError;
-export type RequestWithFiles = Request & {
+export type RequestWithExtraProps = Request & {
     xpiFilepath?: string;
+    rawBody?: Buffer;
 };
 export type FunctionConfig = {
     _console?: typeof console;
@@ -20,10 +21,9 @@ export type FunctionConfig = {
     _process?: typeof process;
     _unlinkFile?: typeof fs.promises.unlink;
     apiKeyEnvVarName?: string;
-    requiredApiKeyParam?: string;
     requiredDownloadUrlParam?: string;
     tmpDir?: string;
     xpiFilename?: string;
 };
-export declare const createExpressApp: ({ _console, _fetch, _process, _unlinkFile, apiKeyEnvVarName, requiredApiKeyParam, requiredDownloadUrlParam, tmpDir, xpiFilename, }?: FunctionConfig) => (handler: RequestHandler) => import("express-serve-static-core").Express;
+export declare const createExpressApp: ({ _console, _fetch, _process, _unlinkFile, apiKeyEnvVarName, requiredDownloadUrlParam, tmpDir, xpiFilename, }?: FunctionConfig) => (handler: RequestHandler) => import("express-serve-static-core").Express;
 export {};

package/dist/functions.js

@@ -13,6 +13,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createExpressApp = exports.createApiError = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -29,7 +30,7 @@ const createApiError = ({ message, extraInfo, status = 500, }) => {
     return error;
 };
 exports.createApiError = createApiError;
-const createExpressApp = ({ _console = console, _fetch = node_fetch_1.default, _process = process, _unlinkFile = fs_1.default.promises.unlink, apiKeyEnvVarName = 'LAMBDA_API_KEY', requiredApiKeyParam = 'api_key', requiredDownloadUrlParam = 'download_url', tmpDir = os_1.default.tmpdir(), xpiFilename = 'input.xpi', } = {}) => (handler) => {
+const createExpressApp = ({ _console = console, _fetch = node_fetch_1.default, _process = process, _unlinkFile = fs_1.default.promises.unlink, apiKeyEnvVarName = 'LAMBDA_API_KEY', requiredDownloadUrlParam = 'download_url', tmpDir = os_1.default.tmpdir(), xpiFilename = 'input.xpi', } = {}) => (handler) => {
     const app = (0, express_1.default)();
     const allowedOrigin = _process.env.ALLOWED_ORIGIN || null;
     if (!allowedOrigin) {
@@ -41,8 +42,16 @@ const createExpressApp = ({ _console = console, _fetch = node_fetch_1.default, _
         // eslint-disable-next-line no-param-reassign
         delete _process.env[apiKeyEnvVarName];
     }
+    // This is the options we pass to the `json()` middleware.
+    const jsonOptions = {
+        // This is a hack to retain the raw body on the request object. We need
+        // this to verify the signature of the request.
+        verify(req, res, buf) {
+            req.rawBody = buf;
+        },
+    };
     // Parse JSON body requests.
-    app.use(body_parser_1.default.json());
+    app.use(body_parser_1.default.json(jsonOptions));
     // This middleware handles the common logic needed to expose our tools. It
     // adds a new `xpiFilepath` attribute to the Express request or returns an
     // error that will be converted to an API error by the error handler
@@ -59,17 +68,47 @@ const createExpressApp = ({ _console = console, _fetch = node_fetch_1.default, _
             }));
             return;
         }
-        if (typeof req.body[requiredApiKeyParam] === 'undefined') {
+        if (!apiKey) {
             next((0, exports.createApiError)({
-                message: `missing "${requiredApiKeyParam}" parameter`,
+                message: `api key must be set`,
+                status: 500,
+            }));
+            return;
+        }
+        if (!req.get('authorization')) {
+            next((0, exports.createApiError)({
+                message: `missing authorization header`,
                 status: 400,
             }));
             return;
         }
-        if (!apiKey || !(0, safe_compare_1.default)(apiKey, req.body[requiredApiKeyParam])) {
+        const authorization = String(req.get('authorization'));
+        if (authorization.startsWith('HMAC-SHA256 ') && req.rawBody) {
+            const digest = node_crypto_1.default
+                .createHmac('sha256', apiKey)
+                .update(req.rawBody)
+                .digest('hex');
+            if (!(0, safe_compare_1.default)(`HMAC-SHA256 ${digest}`, authorization)) {
+                next((0, exports.createApiError)({
+                    message: 'authentication has failed',
+                    status: 401,
+                }));
+                return;
+            }
+        }
+        else if (authorization.startsWith('Bearer ')) {
+            if (!(0, safe_compare_1.default)(`Bearer ${apiKey}`, authorization)) {
+                next((0, exports.createApiError)({
+                    message: 'authentication has failed',
+                    status: 401,
+                }));
+                return;
+            }
+        }
+        else {
             next((0, exports.createApiError)({
-                message: 'authentication has failed',
-                status: 401,
+                message: 'unsupported authorization scheme',
+                status: 400,
             }));
             return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "addons-scanner-utils",
-  "version": "9.15.0",
+  "version": "10.1.0",
   "description": "Various addons related helpers to build CLIs.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -18,8 +18,8 @@
     "yauzl": "2.10.0"
   },
   "peerDependencies": {
-    "body-parser": "1.20.3",
-    "express": "4.21.2",
+    "body-parser": "2.2.2",
+    "express": "5.2.1",
     "node-fetch": "2.6.11",
     "safe-compare": "1.1.4"
   },
@@ -39,7 +39,7 @@
   },
   "devDependencies": {
     "@types/common-tags": "^1.8.0",
-    "@types/express": "4.17.21",
+    "@types/express": "5.0.6",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.0.1",
     "@types/node-fetch": "^2.6.4",
@@ -48,15 +48,15 @@
     "@types/supertest": "^6.0.2",
     "@typescript-eslint/eslint-plugin": "^8.46.2",
     "@typescript-eslint/parser": "^8.46.2",
-    "body-parser": "1.20.3",
+    "body-parser": "2.2.2",
     "eslint": "^8.1.0",
     "eslint-config-amo": "^6.1.0",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-amo": "^2.0.0",
-    "express": "4.21.2",
+    "express": "5.2.1",
     "jest": "^30.2.0",
     "node-fetch": "2.6.11",
-    "prettier": "3.7.4",
+    "prettier": "3.8.0",
     "pretty-quick": "4.2.2",
     "rimraf": "^6.1.0",
     "safe-compare": "1.1.4",