devpush 0.0.0-stage → 1.0.0-beta.4

package/src/server/http/request-body.ts

@@ -0,0 +1,54 @@
+export class RequestBodyTooLargeError extends Error {
+  constructor(readonly maxBytes: number) {
+    super(`Request body exceeds the ${maxBytes} byte limit.`)
+    this.name = 'RequestBodyTooLargeError'
+  }
+}
+
+export async function readRequestText(
+  request: Pick<Request, 'headers' | 'body'>,
+  maxBytes: number,
+) {
+  const declaredLength = request.headers.get('content-length')
+
+  if (
+    declaredLength &&
+    /^\d+$/.test(declaredLength) &&
+    Number(declaredLength) > maxBytes
+  ) {
+    await request.body?.cancel().catch(() => undefined)
+    throw new RequestBodyTooLargeError(maxBytes)
+  }
+
+  if (!request.body) {
+    return ''
+  }
+
+  const reader = request.body.getReader()
+  const decoder = new TextDecoder()
+  const chunks: Array<string> = []
+  let totalBytes = 0
+
+  try {
+    for (
+      let result = await reader.read();
+      !result.done;
+      result = await reader.read()
+    ) {
+      const { value } = result
+      totalBytes += value.byteLength
+      if (totalBytes > maxBytes) {
+        await reader.cancel().catch(() => undefined)
+        throw new RequestBodyTooLargeError(maxBytes)
+      }
+
+      chunks.push(decoder.decode(value, { stream: true }))
+    }
+
+    chunks.push(decoder.decode())
+  } finally {
+    reader.releaseLock()
+  }
+
+  return chunks.join('')
+}

package/src/server/http/request-ip.ts

@@ -0,0 +1,54 @@
+import { config } from '#devpush/server/config'
+import { isCloudflareRuntime } from '#devpush/server/runtime/platform-env'
+
+type AddressTrust = {
+  cloudflare: boolean
+  proxy: boolean
+  header?: 'x-forwarded-for' | 'x-real-ip'
+}
+
+export function getRequestPublicAddress(
+  request: Request,
+  trust: AddressTrust = {
+    cloudflare: isCloudflareRuntime(),
+    proxy: config.DEVPUSH_TRUST_PROXY,
+  },
+) {
+  if (trust.cloudflare) {
+    const cloudflareAddress = request.headers.get('cf-connecting-ip')?.trim()
+
+    return cloudflareAddress ? stripPort(cloudflareAddress) : null
+  }
+
+  if (!trust.proxy) {
+    const runtimeAddress = (request as Request & { readonly ip?: unknown }).ip
+
+    return typeof runtimeAddress === 'string' && runtimeAddress.trim()
+      ? stripPort(runtimeAddress.trim())
+      : null
+  }
+
+  // Trust one configured header only. Never fall back to another header the
+  // proxy may have passed through unchanged from an untrusted client.
+  const header = trust.header ?? config.DEVPUSH_CLIENT_IP_HEADER
+  const value = request.headers.get(header)?.trim()
+  const address =
+    header === 'x-forwarded-for' ? value?.split(',').at(-1)?.trim() : value
+  return address ? stripPort(address) : null
+}
+
+function stripPort(value: string) {
+  if (value.startsWith('[')) {
+    const closingBracket = value.indexOf(']')
+
+    return closingBracket > 0 ? value.slice(1, closingBracket) : value
+  }
+
+  const parts = value.split(':')
+
+  if (parts.length === 2 && /^\d+$/.test(parts[1] ?? '')) {
+    return parts[0] ?? value
+  }
+
+  return value
+}

package/src/server/http/security-headers.ts

@@ -0,0 +1,36 @@
+const contentSecurityPolicy = [
+  "default-src 'self'",
+  "base-uri 'self'",
+  "connect-src 'self' https: wss:",
+  "font-src 'self' data:",
+  "form-action 'self' https://github.com https://accounts.google.com",
+  "frame-ancestors 'none'",
+  "img-src 'self' data: blob: https:",
+  "object-src 'none'",
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  'upgrade-insecure-requests',
+].join('; ')
+
+export function withSecurityHeaders(response: Response, request: Request) {
+  const headers = new Headers(response.headers)
+  headers.set('Content-Security-Policy', contentSecurityPolicy)
+  headers.set('Cross-Origin-Opener-Policy', 'same-origin')
+  headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
+  headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
+  headers.set('X-Content-Type-Options', 'nosniff')
+  headers.set('X-Frame-Options', 'DENY')
+
+  if (new URL(request.url).protocol === 'https:') {
+    headers.set(
+      'Strict-Transport-Security',
+      'max-age=31536000; includeSubDomains',
+    )
+  }
+
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  })
+}

package/src/server/install/agent-binary.ts

@@ -0,0 +1,230 @@
+import manifest from '../../../agent-release.json'
+import {
+  validateAgentRelease,
+  agentReleasePlatforms,
+} from '#devpush/lib/agent-release.mjs'
+import {
+  currentAgentCapabilities,
+  currentAgentProtocolVersion,
+} from '#devpush/server/agents/compatibility'
+import {
+  readReleasedAgentBinary,
+  releasedAgentIsAvailable,
+} from './release-binary'
+import { constants } from 'node:fs'
+import { access, readFile, stat } from 'node:fs/promises'
+import { createHash } from 'node:crypto'
+import { join } from 'node:path'
+
+import { config } from '#devpush/server/config'
+
+export class AgentBinaryNotConfiguredError extends Error {}
+export class AgentBinaryUnsupportedPlatformError extends Error {}
+
+const requiredDirectoryPlatforms = agentReleasePlatforms
+const supportedOperatingSystems: ReadonlyArray<string> = [
+  ...new Set(agentReleasePlatforms.map((platform) => platform.os)),
+]
+const supportedArchitectures: ReadonlyArray<string> = [
+  ...new Set(agentReleasePlatforms.map((platform) => platform.arch)),
+]
+const release = validateAgentRelease(manifest)
+if (
+  release.protocolVersion !== currentAgentProtocolVersion ||
+  currentAgentCapabilities.some(
+    (capability) => !release.capabilities.includes(capability),
+  )
+)
+  throw new Error('Pinned agent release does not support this control plane.')
+let remoteAvailability: { expiresAt: number; ready: boolean } | undefined
+
+export type AgentBinaryPlatform = {
+  arch?: string | null
+  os?: string | null
+}
+
+export type AgentBinary = {
+  body: Buffer
+  filename: string
+  size: number
+}
+
+export type AgentBinaryStatus =
+  | {
+      ready: true
+      message: null
+    }
+  | {
+      ready: false
+      message: string
+    }
+
+export async function getAgentBinary(
+  platform: AgentBinaryPlatform = {},
+): Promise<AgentBinary> {
+  const normalizedPlatform = normalizePlatform(platform)
+  const filename = binaryFilename(normalizedPlatform)
+
+  const path = getAgentBinaryPath(normalizedPlatform)
+  if (!path) {
+    const asset = release.assets.find(
+      (candidate) =>
+        candidate.os === normalizedPlatform.os &&
+        candidate.arch === normalizedPlatform.arch,
+    )!
+    const body = await readReleasedAgentBinary({
+      release,
+      asset,
+    })
+    return { body, filename, size: body.length }
+  }
+
+  const file = await stat(path)
+
+  if (!file.isFile()) {
+    throw new Error('Configured agent binary path is not a file.')
+  }
+
+  await access(path, constants.R_OK)
+
+  const body = await readFile(path)
+  return { body, filename, size: body.byteLength }
+}
+
+export async function getAgentBinaryMetadata(
+  platform: AgentBinaryPlatform = {},
+) {
+  const normalized = normalizePlatform(platform)
+  const filename = binaryFilename(normalized)
+  const path = getAgentBinaryPath(normalized)
+  if (path) {
+    const file = await stat(path)
+    if (!file.isFile())
+      throw new Error('Configured agent binary path is not a file.')
+    await access(path, constants.R_OK)
+    return { filename, size: file.size }
+  }
+  const asset = release.assets.find(
+    (candidate) =>
+      candidate.os === normalized.os && candidate.arch === normalized.arch,
+  )!
+  if (
+    !(await releasedAgentIsAvailable({
+      release,
+      asset,
+    }))
+  )
+    throw new AgentBinaryNotConfiguredError(
+      `Pinned agent release ${release.version} is unavailable.`,
+    )
+  return { filename, size: asset.size }
+}
+
+export async function getAgentBinaryStatus(): Promise<AgentBinaryStatus> {
+  try {
+    if (config.DEVPUSH_AGENT_BINARY_DIR) {
+      await Promise.all(requiredDirectoryPlatforms.map(assertLocalBinary))
+    } else {
+      if (!remoteAvailability || remoteAvailability.expiresAt <= Date.now()) {
+        const available = await Promise.all(
+          release.assets.map((asset) =>
+            releasedAgentIsAvailable({ release, asset }),
+          ),
+        )
+        remoteAvailability = {
+          expiresAt: Date.now() + 30_000,
+          ready: available.every(Boolean),
+        }
+      }
+      if (!remoteAvailability.ready)
+        throw new AgentBinaryNotConfiguredError(
+          `Pinned agent release ${release.version} is unavailable. Configure DEVPUSH_AGENT_BINARY_DIR for a local/offline build.`,
+        )
+    }
+
+    return {
+      ready: true,
+      message: null,
+    }
+  } catch (error) {
+    return {
+      ready: false,
+      message:
+        error instanceof Error
+          ? error.message
+          : 'Unable to read configured agent binary.',
+    }
+  }
+}
+
+async function assertLocalBinary(platform: Required<AgentBinaryPlatform>) {
+  const path = getAgentBinaryPath(platform)
+  if (!path) throw new AgentBinaryNotConfiguredError()
+  const file = await stat(path)
+  if (!file.isFile()) {
+    throw new Error('Configured agent binary path is not a file.')
+  }
+  await access(path, constants.R_OK)
+}
+
+export async function getAgentBinaryChecksum(
+  platform: AgentBinaryPlatform = {},
+) {
+  const normalized = normalizePlatform(platform)
+  if (!config.DEVPUSH_AGENT_BINARY_DIR) {
+    const asset = release.assets.find(
+      (candidate) =>
+        candidate.os === normalized.os && candidate.arch === normalized.arch,
+    )!
+    return { filename: asset.filename, size: asset.size, digest: asset.sha256 }
+  }
+  const binary = await getAgentBinary(platform)
+  const digest = createHash('sha256').update(binary.body).digest('hex')
+
+  return { ...binary, digest }
+}
+
+function getAgentBinaryPath(platform: Required<AgentBinaryPlatform>) {
+  if (config.DEVPUSH_AGENT_BINARY_DIR) {
+    return join(config.DEVPUSH_AGENT_BINARY_DIR, binaryFilename(platform))
+  }
+
+  return undefined
+}
+
+function normalizePlatform({
+  arch,
+  os,
+}: AgentBinaryPlatform): Required<AgentBinaryPlatform> {
+  const normalizedOs = os ?? 'linux'
+  const normalizedArch = arch ?? 'amd64'
+
+  if (!supportedOperatingSystems.includes(normalizedOs)) {
+    throw new AgentBinaryUnsupportedPlatformError(
+      `Unsupported agent binary OS: ${normalizedOs}.`,
+    )
+  }
+
+  if (!supportedArchitectures.includes(normalizedArch)) {
+    throw new AgentBinaryUnsupportedPlatformError(
+      `Unsupported agent binary architecture: ${normalizedArch}.`,
+    )
+  }
+
+  return {
+    arch: normalizedArch,
+    os: normalizedOs,
+  }
+}
+
+function binaryFilename({ arch, os }: Required<AgentBinaryPlatform>) {
+  return `devpush-agent-${os}-${arch}`
+}
+
+export function getAgentReleaseDownloadUrl(platform: AgentBinaryPlatform = {}) {
+  const normalized = normalizePlatform(platform)
+  if (getAgentBinaryPath(normalized)) return null
+  return release.assets.find(
+    (asset) => asset.os === normalized.os && asset.arch === normalized.arch,
+  )!.url
+}