callman-core 1.16.0 → 1.17.0

package/dist-cjs/soap/transport.js

@@ -0,0 +1,62 @@
+"use strict";
+// SOAP transport application: Content-Type / SOAPAction header rules and
+// the WS-Security injection, applied to the ALREADY-normalized runtime
+// request right before the HTTP driver. User-set headers always win —
+// the same rule the raw-body auto Content-Type follows.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applySoapRequestTransforms = void 0;
+const wsSecurity_js_1 = require("./wsSecurity.js");
+const findHeaderKey = (headers, name) => Object.keys(headers).find((key) => key.toLowerCase() === name.toLowerCase());
+// Mutates headers/body per SOAP semantics. Returns an error message when the
+// config demands work the body cannot support (non-string body with
+// WS-Security enabled, or no Envelope to inject into).
+const applySoapRequestTransforms = (request, soap, resolveValue, options) => {
+    if (!soap.enabled) {
+        return null;
+    }
+    const action = soap.action?.trim() ? resolveValue(soap.action).trim() : "";
+    const userProvidedContentType = options?.userProvidedContentType ?? Boolean(findHeaderKey(request.headers, "content-type"));
+    const setContentType = (value) => {
+        for (const key of Object.keys(request.headers)) {
+            if (key.toLowerCase() === "content-type") {
+                delete request.headers[key];
+            }
+        }
+        request.headers["Content-Type"] = value;
+    };
+    if (soap.version === "1.2") {
+        if (!userProvidedContentType) {
+            setContentType(action
+                ? `application/soap+xml; charset=utf-8; action="${action}"`
+                : "application/soap+xml; charset=utf-8");
+        }
+    }
+    else {
+        if (!userProvidedContentType) {
+            setContentType("text/xml; charset=utf-8");
+        }
+        if (action && !findHeaderKey(request.headers, "soapaction")) {
+            // SOAP 1.1 requires the value quoted.
+            request.headers.SOAPAction = `"${action}"`;
+        }
+    }
+    if (soap.wsSecurity?.enabled) {
+        if (typeof request.body !== "string" || !request.body.trim()) {
+            return "WS-Security requires a raw XML body with a SOAP Envelope.";
+        }
+        const resolvedSecurity = {
+            enabled: true,
+            username: resolveValue(soap.wsSecurity.username ?? ""),
+            password: resolveValue(soap.wsSecurity.password ?? ""),
+            passwordType: soap.wsSecurity.passwordType === "digest" ? "digest" : "text",
+        };
+        const injection = (0, wsSecurity_js_1.injectWsSecurityHeader)(request.body, resolvedSecurity);
+        if (!injection.injected) {
+            return "WS-Security could not find a SOAP Envelope in the request body.";
+        }
+        request.body = injection.xml;
+    }
+    return null;
+};
+exports.applySoapRequestTransforms = applySoapRequestTransforms;
+//# sourceMappingURL=transport.js.map

package/dist-cjs/soap/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/soap/transport.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,wDAAwD;;;AAExD,mDAAgF;AAehF,MAAM,aAAa,GAAG,CAAC,OAA+B,EAAE,IAAY,EAAsB,EAAE,CAC1F,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAE/E,6EAA6E;AAC7E,oEAAoE;AACpE,uDAAuD;AAChD,MAAM,0BAA0B,GAAG,CACxC,OAA+B,EAC/B,IAAuB,EACvB,YAAuC,EACvC,OAQC,EACc,EAAE;IACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,uBAAuB,GAC3B,OAAO,EAAE,uBAAuB,IAAI,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAE9F,MAAM,cAAc,GAAG,CAAC,KAAa,EAAQ,EAAE;QAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;gBACzC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;IAC1C,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,cAAc,CACZ,MAAM;gBACJ,CAAC,CAAC,gDAAgD,MAAM,GAAG;gBAC3D,CAAC,CAAC,qCAAqC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5D,sCAAsC;YACtC,OAAO,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,MAAM,GAAG,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,OAAO,2DAA2D,CAAC;QACrE,CAAC;QACD,MAAM,gBAAgB,GAAqB;YACzC,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;YACtD,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;YACtD,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;SAC5E,CAAC;QACF,MAAM,SAAS,GAAG,IAAA,sCAAsB,EAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,iEAAiE,CAAC;QAC3E,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAnEW,QAAA,0BAA0B,8BAmErC"}

package/dist-cjs/soap/wsSecurity.js

@@ -0,0 +1,74 @@
+"use strict";
+// WS-Security UsernameToken header injection — runtime string insertion
+// into the user's raw XML envelope. Deliberately NOT parse-and-rebuild:
+// re-serializing would reformat the document and can lose CDATA fidelity.
+// Nonce/Created are freshly generated per call (per attempt), which is why
+// this runs at send time, never in the editor.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.injectWsSecurityHeader = exports.buildWsSecurityHeader = void 0;
+const crypto_js_1 = __importDefault(require("crypto-js"));
+const WSSE_NS = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
+const WSU_NS = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd";
+const PASSWORD_TEXT_TYPE = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText";
+const PASSWORD_DIGEST_TYPE = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest";
+const BASE64_ENCODING = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary";
+const escapeXml = (value) => value
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+// Password_Digest = Base64(SHA-1(nonce-bytes + created + password)) per the
+// UsernameToken profile. `nonce` is the RAW bytes, base64 only on the wire.
+const buildWsSecurityHeader = (config, now = new Date()) => {
+    const nonce = crypto_js_1.default.lib.WordArray.random(16);
+    const created = now.toISOString();
+    const isDigest = config.passwordType === "digest";
+    const passwordValue = isDigest
+        ? crypto_js_1.default.SHA1(nonce.clone().concat(crypto_js_1.default.enc.Utf8.parse(created + config.password))).toString(crypto_js_1.default.enc.Base64)
+        : config.password;
+    const headerXml = `<wsse:Security xmlns:wsse="${WSSE_NS}" xmlns:wsu="${WSU_NS}">` +
+        `<wsse:UsernameToken>` +
+        `<wsse:Username>${escapeXml(config.username)}</wsse:Username>` +
+        `<wsse:Password Type="${isDigest ? PASSWORD_DIGEST_TYPE : PASSWORD_TEXT_TYPE}">${escapeXml(passwordValue)}</wsse:Password>` +
+        `<wsse:Nonce EncodingType="${BASE64_ENCODING}">${nonce.toString(crypto_js_1.default.enc.Base64)}</wsse:Nonce>` +
+        `<wsu:Created>${created}</wsu:Created>` +
+        `</wsse:UsernameToken>` +
+        `</wsse:Security>`;
+    return {
+        nonceBase64: nonce.toString(crypto_js_1.default.enc.Base64),
+        created,
+        passwordValue,
+        passwordTypeUri: isDigest ? PASSWORD_DIGEST_TYPE : PASSWORD_TEXT_TYPE,
+        headerXml,
+    };
+};
+exports.buildWsSecurityHeader = buildWsSecurityHeader;
+const HEADER_OPEN = /<((?:[A-Za-z_][\w.-]*:)?)Header(\s[^>]*)?>/;
+const ENVELOPE_OPEN = /<((?:[A-Za-z_][\w.-]*:)?)Envelope(\s[^>]*)?>/;
+// Insert the wsse:Security block into the envelope: right after an existing
+// <*:Header> open tag, else a synthesized Header (matching the Envelope's
+// prefix) right after the Envelope open tag. Returns the input unchanged
+// (with `injected: false`) when no Envelope is present — callers surface
+// that as a node failure.
+const injectWsSecurityHeader = (xml, config, now) => {
+    const parts = (0, exports.buildWsSecurityHeader)(config, now);
+    const headerMatch = HEADER_OPEN.exec(xml);
+    if (headerMatch && headerMatch.index >= 0) {
+        const insertAt = headerMatch.index + headerMatch[0].length;
+        return { xml: xml.slice(0, insertAt) + parts.headerXml + xml.slice(insertAt), injected: true };
+    }
+    const envelopeMatch = ENVELOPE_OPEN.exec(xml);
+    if (!envelopeMatch) {
+        return { xml, injected: false };
+    }
+    const prefix = envelopeMatch[1] ?? "";
+    const insertAt = envelopeMatch.index + envelopeMatch[0].length;
+    const header = `<${prefix}Header>${parts.headerXml}</${prefix}Header>`;
+    return { xml: xml.slice(0, insertAt) + header + xml.slice(insertAt), injected: true };
+};
+exports.injectWsSecurityHeader = injectWsSecurityHeader;
+//# sourceMappingURL=wsSecurity.js.map

package/dist-cjs/soap/wsSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wsSecurity.js","sourceRoot":"","sources":["../../src/soap/wsSecurity.ts"],"names":[],"mappings":";AAAA,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,+CAA+C;;;;;;AAE/C,0DAAiC;AASjC,MAAM,OAAO,GACX,mFAAmF,CAAC;AACtF,MAAM,MAAM,GACV,oFAAoF,CAAC;AACvF,MAAM,kBAAkB,GACtB,iGAAiG,CAAC;AACpG,MAAM,oBAAoB,GACxB,mGAAmG,CAAC;AACtG,MAAM,eAAe,GACnB,gGAAgG,CAAC;AAEnG,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAC1C,KAAK;KACF,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;KACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;KACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAU7B,4EAA4E;AAC5E,4EAA4E;AACrE,MAAM,qBAAqB,GAAG,CACnC,MAAwB,EACxB,MAAY,IAAI,IAAI,EAAE,EACC,EAAE;IACzB,MAAM,KAAK,GAAG,mBAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC;IAClD,MAAM,aAAa,GAAG,QAAQ;QAC5B,CAAC,CAAC,mBAAQ,CAAC,IAAI,CACX,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,mBAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CACzE,CAAC,QAAQ,CAAC,mBAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IAEpB,MAAM,SAAS,GACb,8BAA8B,OAAO,gBAAgB,MAAM,IAAI;QAC/D,sBAAsB;QACtB,kBAAkB,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;QAC9D,wBAAwB,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,KAAK,SAAS,CAAC,aAAa,CAAC,kBAAkB;QAC3H,6BAA6B,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,mBAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe;QACnG,gBAAgB,OAAO,gBAAgB;QACvC,uBAAuB;QACvB,kBAAkB,CAAC;IAErB,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAChD,OAAO;QACP,aAAa;QACb,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB;QACrE,SAAS;KACV,CAAC;AACJ,CAAC,CAAC;AA9BW,QAAA,qBAAqB,yBA8BhC;AAEF,MAAM,WAAW,GAAG,4CAA4C,CAAC;AACjE,MAAM,aAAa,GAAG,8CAA8C,CAAC;AAErE,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,0BAA0B;AACnB,MAAM,sBAAsB,GAAG,CACpC,GAAW,EACX,MAAwB,EACxB,GAAU,EAC0B,EAAE;IACtC,MAAM,KAAK,GAAG,IAAA,6BAAqB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEjD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,WAAW,IAAI,WAAW,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,UAAU,KAAK,CAAC,SAAS,KAAK,MAAM,SAAS,CAAC;IACvE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACxF,CAAC,CAAC;AAtBW,QAAA,sBAAsB,0BAsBjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "callman-core",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "main": "dist-cjs/index.js",
   "module": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -30,13 +30,15 @@
     "test": "npm run build && node --test tests/*.test.mjs"
   },
   "dependencies": {
+    "@xmldom/xmldom": "^0.9.12",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "axios": "^1.6.0",
     "crypto-js": "^4.2.0",
     "fast-xml-parser": "^4.5.1",
     "jsonpath-plus": "^10.4.0",
-    "lodash": "^4.18.1"
+    "lodash": "^4.18.1",
+    "xpath": "^0.0.34"
   },
   "optionalDependencies": {
     "ioredis": "^5.4.1",