deepline 0.1.119 → 0.1.121

package/dist/bundling-sources/shared_libs/security/safe-outbound-fetch.ts

@@ -0,0 +1,274 @@
+import dns from 'node:dns';
+import http from 'node:http';
+import https from 'node:https';
+import type { LookupFunction } from 'node:net';
+import {
+  assertPublicHttpUrl,
+  isBlockedIpAddress,
+  isRedirectStatus,
+  normalizeUrlHostname,
+  resolveRedirectUrl,
+  UnsafeOutboundUrlError,
+} from '@shared_libs/security/outbound-url-policy';
+
+type NodeSafeFetchOptions = {
+  maxRedirects?: number;
+  sensitiveHeaders?: Iterable<string>;
+};
+
+type PreparedBody = {
+  body: Buffer | string | undefined;
+  headers: Headers;
+};
+
+export { UnsafeOutboundUrlError };
+
+function cloneHeaders(headers: RequestInit['headers']): Headers {
+  return new Headers(headers);
+}
+
+function deleteHeader(headers: Headers, name: string) {
+  if (headers.has(name)) headers.delete(name);
+}
+
+async function prepareBody(init: RequestInit): Promise<PreparedBody> {
+  const headers = cloneHeaders(init.headers);
+  const body = init.body;
+  if (body === undefined || body === null) {
+    return { body: undefined, headers };
+  }
+  if (typeof body === 'string') {
+    return { body, headers };
+  }
+  if (body instanceof URLSearchParams) {
+    if (!headers.has('content-type')) {
+      headers.set(
+        'content-type',
+        'application/x-www-form-urlencoded;charset=UTF-8',
+      );
+    }
+    return { body: body.toString(), headers };
+  }
+  if (body instanceof ArrayBuffer) {
+    return { body: Buffer.from(body), headers };
+  }
+  if (ArrayBuffer.isView(body)) {
+    return {
+      body: Buffer.from(body.buffer, body.byteOffset, body.byteLength),
+      headers,
+    };
+  }
+  if (typeof Blob !== 'undefined' && body instanceof Blob) {
+    return { body: Buffer.from(await body.arrayBuffer()), headers };
+  }
+
+  throw new TypeError(
+    'safeOutboundFetch does not support streaming or multipart request bodies.',
+  );
+}
+
+function headersToRecord(headers: Headers): Record<string, string> {
+  return Object.fromEntries(headers.entries());
+}
+
+function validateResolvedAddress(address: string) {
+  if (isBlockedIpAddress(address)) {
+    throw new UnsafeOutboundUrlError(
+      `Resolved address "${address}" is not allowed.`,
+    );
+  }
+}
+
+const safeLookup: LookupFunction = (hostname, options, callback) => {
+  const lookupOptions: dns.LookupAllOptions = {
+    all: true,
+    verbatim: true,
+    ...(typeof options.family === 'number' ? { family: options.family } : {}),
+    ...(typeof options.hints === 'number' ? { hints: options.hints } : {}),
+  };
+  dns.lookup(hostname, lookupOptions, (error, records) => {
+    if (error) {
+      callback(error, '', 0);
+      return;
+    }
+    if (!records.length) {
+      callback(
+        Object.assign(new Error(`Could not resolve host "${hostname}".`), {
+          code: 'ENOTFOUND',
+        }) as NodeJS.ErrnoException,
+        '',
+        0,
+      );
+      return;
+    }
+
+    try {
+      for (const record of records) {
+        validateResolvedAddress(record.address);
+      }
+    } catch (validationError) {
+      callback(validationError as NodeJS.ErrnoException, '', 0);
+      return;
+    }
+
+    if (options.all) {
+      callback(null, records);
+      return;
+    }
+
+    callback(null, records[0]!.address, records[0]!.family);
+  });
+};
+
+function createRequest(
+  url: URL,
+  init: RequestInit,
+  prepared: PreparedBody,
+): Promise<Response> {
+  return new Promise((resolve, reject) => {
+    const transport = url.protocol === 'https:' ? https : http;
+    const request = transport.request(
+      url,
+      {
+        method: init.method ?? 'GET',
+        headers: headersToRecord(prepared.headers),
+        agent: false,
+        lookup: safeLookup,
+        signal: init.signal ?? undefined,
+      },
+      (response) => {
+        const chunks: Buffer[] = [];
+        response.on('data', (chunk) => {
+          chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        });
+        response.on('error', reject);
+        response.on('end', () => {
+          resolve(
+            new Response(Buffer.concat(chunks), {
+              status: response.statusCode ?? 0,
+              statusText: response.statusMessage,
+              headers: response.headers as HeadersInit,
+            }),
+          );
+        });
+      },
+    );
+
+    request.on('error', reject);
+    if (prepared.body !== undefined) {
+      request.write(prepared.body);
+    }
+    request.end();
+  });
+}
+
+function initForRedirect(
+  init: RequestInit,
+  from: URL,
+  to: URL,
+  status: number,
+  sensitiveHeaders: Iterable<string>,
+): RequestInit {
+  const headers = cloneHeaders(init.headers);
+  let method = String(init.method ?? 'GET').toUpperCase();
+  let body = init.body;
+
+  if (
+    status === 303 ||
+    ((status === 301 || status === 302) && method === 'POST')
+  ) {
+    method = 'GET';
+    body = undefined;
+    deleteHeader(headers, 'content-length');
+    deleteHeader(headers, 'content-type');
+  }
+
+  if (from.origin !== to.origin) {
+    deleteHeader(headers, 'authorization');
+    deleteHeader(headers, 'cookie');
+    deleteHeader(headers, 'proxy-authorization');
+    for (const header of sensitiveHeaders) {
+      deleteHeader(headers, header);
+    }
+  }
+
+  return {
+    ...init,
+    method,
+    body,
+    headers,
+    redirect: 'manual',
+  };
+}
+
+export async function safeOutboundFetch(
+  input: string | URL,
+  init: RequestInit = {},
+  options: NodeSafeFetchOptions = {},
+): Promise<Response> {
+  const redirectMode = init.redirect ?? 'follow';
+  const maxRedirects = options.maxRedirects ?? 10;
+  const sensitiveHeaders = options.sensitiveHeaders ?? [];
+  let currentUrl = assertPublicHttpUrl(input);
+  let currentInit: RequestInit = { ...init, redirect: 'manual' };
+
+  for (
+    let redirectCount = 0;
+    redirectCount <= maxRedirects;
+    redirectCount += 1
+  ) {
+    const hostname = normalizeUrlHostname(currentUrl.hostname);
+    if (isBlockedIpAddress(hostname)) {
+      throw new UnsafeOutboundUrlError(
+        `Target host "${hostname}" is not allowed.`,
+      );
+    }
+
+    const response = await createRequest(
+      currentUrl,
+      currentInit,
+      await prepareBody(currentInit),
+    );
+
+    Object.defineProperty(response, 'url', {
+      configurable: true,
+      value: currentUrl.toString(),
+    });
+
+    if (!isRedirectStatus(response.status)) {
+      return response;
+    }
+    if (redirectMode === 'error') {
+      throw new Error(
+        `Redirect blocked while fetching ${currentUrl.toString()}.`,
+      );
+    }
+    if (redirectMode !== 'follow') {
+      return response;
+    }
+
+    const location = response.headers.get('location');
+    if (!location) {
+      return response;
+    }
+    if (redirectCount === maxRedirects) {
+      throw new Error(
+        `Too many redirects while fetching ${currentUrl.toString()}.`,
+      );
+    }
+
+    const nextUrl = resolveRedirectUrl(location, currentUrl);
+    currentInit = initForRedirect(
+      currentInit,
+      currentUrl,
+      nextUrl,
+      response.status,
+      sensitiveHeaders,
+    );
+    currentUrl = nextUrl;
+  }
+
+  throw new Error(
+    `Too many redirects while fetching ${currentUrl.toString()}.`,
+  );
+}

package/dist/bundling-sources/shared_libs/temporal/preview-config.ts

@@ -0,0 +1,150 @@
+import { existsSync } from 'node:fs';
+import * as path from 'node:path';
+import * as dotenv from 'dotenv';
+import { LOCAL_TEMPORAL_ADDRESS, LOCAL_TEMPORAL_NAMESPACE } from './constants';
+
+export const PLAY_TASK_QUEUE = 'deepline-plays';
+// Internal process flag set by `bun run dev:v2 --preview`. Do not put this in
+// .env.local; the dev command owns the mode selection so local/preview runs are
+// obvious at the call site.
+export const DEEPLINE_V2_INFRA_MODE_ENV = 'DEEPLINE_V2_INFRA_MODE';
+export const PREVIEW_PLAYS_ENV_FILE = '.env.plays.preview';
+
+type TemporalTlsConfig = {
+  clientCertPair: {
+    crt: Uint8Array;
+    key: Uint8Array;
+  };
+};
+
+export type DeeplineTemporalConfig = {
+  address: string;
+  namespace: string;
+  taskQueue: string;
+  tls?: TemporalTlsConfig;
+  deployment: 'local' | 'preview';
+};
+
+let loadedPreviewEnv = false;
+
+function decodePemEnv(value: string): Uint8Array {
+  return Buffer.from(value.replace(/\\n/g, '\n'), 'utf-8');
+}
+
+export function isPreviewPlaysDeployment(): boolean {
+  const mode = process.env[DEEPLINE_V2_INFRA_MODE_ENV]?.trim().toLowerCase();
+  return mode === 'external' || mode === 'preview';
+}
+
+export function isCloudflarePlaysDeployment(): boolean {
+  const mode = process.env[DEEPLINE_V2_INFRA_MODE_ENV]?.trim().toLowerCase();
+  return mode === 'cloudflare';
+}
+
+/**
+ * True when the play runtime callback baseUrl must be a public URL — i.e. when
+ * the plays runner runs outside the local app process and can't reach
+ * 127.0.0.1. Both `external` (Daytona) and `cloudflare` (Workers/DOs) need
+ * this; only fully-local mode can keep baseUrl on localhost.
+ */
+export function requiresPublicCallbackBaseUrl(): boolean {
+  return isPreviewPlaysDeployment() || isCloudflarePlaysDeployment();
+}
+
+export function loadPreviewPlaysEnv(cwd = process.cwd()): void {
+  if (loadedPreviewEnv || !isPreviewPlaysDeployment()) {
+    return;
+  }
+
+  const envPath = path.join(cwd, PREVIEW_PLAYS_ENV_FILE);
+  if (existsSync(envPath)) {
+    dotenv.config({ path: envPath, override: true });
+  }
+
+  loadedPreviewEnv = true;
+}
+
+function temporalTlsFromEnv(): TemporalTlsConfig | undefined {
+  const cert =
+    process.env.TEMPORAL_TLS_CERT_DATA ?? process.env.FAS_TEMPORAL_CERT_DATA;
+  const key =
+    process.env.TEMPORAL_TLS_KEY_DATA ?? process.env.FAS_TEMPORAL_KEY_DATA;
+
+  if (!cert && !key) {
+    return undefined;
+  }
+  if (!cert || !key) {
+    throw new Error(
+      'Temporal Cloud mTLS requires both TEMPORAL_TLS_CERT_DATA and TEMPORAL_TLS_KEY_DATA.',
+    );
+  }
+
+  return {
+    clientCertPair: {
+      crt: decodePemEnv(cert),
+      key: decodePemEnv(key),
+    },
+  };
+}
+
+function temporalAddressFromEnv(): string | undefined {
+  return (
+    process.env.TEMPORAL_ADDRESS?.trim() ||
+    process.env.FAS_TEMPORAL_ADDRESS?.trim() ||
+    undefined
+  );
+}
+
+function temporalNamespaceFromEnv(address: string): string | undefined {
+  const previewConfigured = process.env.FAS_TEMPORAL_NAMESPACE?.trim();
+  if (previewConfigured) {
+    return previewConfigured;
+  }
+
+  const host = address.split(':')[0] ?? '';
+  const temporalCloudNamespace = /^([^.]+\.[^.]+)\.tmprl\.cloud$/i.exec(host);
+  if (temporalCloudNamespace?.[1]) {
+    return temporalCloudNamespace[1];
+  }
+
+  const configured = process.env.TEMPORAL_NAMESPACE?.trim();
+  return configured || undefined;
+}
+
+export function getDeeplineTemporalConfig(options?: {
+  loadPreviewEnv?: boolean;
+}): DeeplineTemporalConfig {
+  if (options?.loadPreviewEnv !== false) {
+    loadPreviewPlaysEnv();
+  }
+
+  if (isPreviewPlaysDeployment()) {
+    const address = temporalAddressFromEnv();
+    const namespace = address ? temporalNamespaceFromEnv(address) : undefined;
+    if (!address) {
+      throw new Error(
+        'dev:v2 preview mode requires TEMPORAL_ADDRESS or FAS_TEMPORAL_ADDRESS.',
+      );
+    }
+    if (!namespace) {
+      throw new Error(
+        'dev:v2 preview mode requires TEMPORAL_NAMESPACE or FAS_TEMPORAL_NAMESPACE.',
+      );
+    }
+    return {
+      address,
+      namespace,
+      taskQueue: process.env.TEMPORAL_TASK_QUEUE?.trim() || PLAY_TASK_QUEUE,
+      tls: temporalTlsFromEnv(),
+      deployment: 'preview',
+    };
+  }
+
+  return {
+    address: process.env.TEMPORAL_ADDRESS ?? LOCAL_TEMPORAL_ADDRESS,
+    namespace: process.env.TEMPORAL_NAMESPACE ?? LOCAL_TEMPORAL_NAMESPACE,
+    taskQueue: process.env.TEMPORAL_TASK_QUEUE?.trim() || PLAY_TASK_QUEUE,
+    tls: temporalTlsFromEnv(),
+    deployment: 'local',
+  };
+}