bdy 1.22.84 → 1.22.85-beta

package/distTs/src/utils.js

@@ -48,6 +48,7 @@ exports.openApiPrepareUrl = openApiPrepareUrl;
 exports.getOpenApiEndpointByApiBaseUrl = getOpenApiEndpointByApiBaseUrl;
 exports.isValidDomain = isValidDomain;
 exports.isInSandbox = isInSandbox;
+exports.isLocalHost = isLocalHost;
 exports.isValidSubdomain = isValidSubdomain;
 exports.isValidEmail = isValidEmail;
 exports.isValidName = isValidName;
@@ -56,6 +57,8 @@ exports.getSubdomain = getSubdomain;
 exports.getDomainTld = getDomainTld;
 exports.getPopularTlds = getPopularTlds;
 exports.getAppHostByApiBaseUrl = getAppHostByApiBaseUrl;
+exports.getOidcIssuerByAppHost = getOidcIssuerByAppHost;
+exports.isKnownOidcIssuer = isKnownOidcIssuer;
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = require("node:fs");
 const texts_1 = require("./texts");
@@ -711,6 +714,13 @@ function isValidDomain(prompt) {
 function isInSandbox() {
     return !!process.env.BUDDY_SANDBOX && !!process.env.BUDDY_SANDBOX_ID;
 }
+// Verify TLS certs for real hosts; only local/IP dev hosts (self-signed)
+// may skip verification. Accepts a full URL or a bare hostname.
+function isLocalHost(host) {
+    return (/^(https?:\/\/)?\d+\.\d+\.\d+\.\d+/.test(host) ||
+        /\.local\.io/.test(host) ||
+        /\.tsd\.com/.test(host));
+}
 function isValidSubdomain(prompt) {
     return /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/i.test(prompt);
 }
@@ -877,3 +887,42 @@ function getAppHostByApiBaseUrl(baseUrl) {
         return baseUrl.hostname;
     }
 }
+// Pins each (platform-set, trusted) app host to its environment's OIDC issuer,
+// so a token minted by one environment can't authenticate against another.
+// Mirrors getAppHostByApiBaseUrl; matched as ordered hostname substrings.
+const APP_HOST_OIDC_ISSUERS = [
+    ['app.buddy.works', 'https://oidc.buddyusercontent.com'],
+    ['eu.buddy.works', 'https://eu-oidc.buddyusercontent.com'],
+    ['asia.buddy.works', 'https://asia-oidc.buddyusercontent.com'],
+    ['app.awsdev.net', 'https://dev-oidc.buddyusercontent.com'],
+    ['eu.awsstage.net', 'https://stageeu-oidc.buddyusercontent.com'],
+    ['app.awsstage.net', 'https://stage-oidc.buddyusercontent.com'],
+    ['app.awsmaster.net', 'https://master-oidc.buddyusercontent.com'],
+    ['app.buddy.mom', 'https://sls-oidc.buddyusercontent.com'],
+    ['app.sd1.com', 'https://sd1-oidc.buddyusercontent.com'],
+    ['app.sd2.com', 'https://sd2-oidc.buddyusercontent.com'],
+    ['app.sd3.com', 'https://sd3-oidc.buddyusercontent.com'],
+    ['app.sd4.com', 'https://sd4-oidc.buddyusercontent.com'],
+    ['app.sd5.com', 'https://sd5-oidc.buddyusercontent.com'],
+    ['app.sd6.com', 'https://sd6-oidc.buddyusercontent.com'],
+    ['app.sd7.com', 'https://sd7-oidc.buddyusercontent.com'],
+    ['app.sd8.com', 'https://sd8-oidc.buddyusercontent.com'],
+    ['app.sd9.com', 'https://sd9-oidc.buddyusercontent.com'],
+];
+// Returns the pinned issuer for a host, or null for unmapped hosts (e.g. local dev IPs).
+function getOidcIssuerByAppHost(host) {
+    let hostname = host;
+    try {
+        hostname = new URL(host).hostname;
+    }
+    catch {
+        // host may already be a bare hostname
+    }
+    const found = APP_HOST_OIDC_ISSUERS.find(([fragment]) => hostname.includes(fragment));
+    return found ? found[1] : null;
+}
+const OIDC_ISSUERS = new Set(APP_HOST_OIDC_ISSUERS.map(([, issuer]) => issuer));
+// Bounds the JWKS fetch to trusted issuers (SSRF guard) for unmapped hosts.
+function isKnownOidcIssuer(issuer) {
+    return OIDC_ISSUERS.has(issuer);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.22.84",
+  "version": "1.22.85-beta",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",