dineway 0.1.9 → 0.1.12

package/dist/site-url-BP7k7OCe.mjs

@@ -0,0 +1,12 @@
+import { t as OptionsRepository } from "./options-z8VVg1Ll.mjs";
+
+//#region src/api/site-url.ts
+async function getSiteBaseUrl(db, request) {
+	const storedUrl = await new OptionsRepository(db).get("dineway:site_url");
+	if (storedUrl) return `${storedUrl}/_dineway`;
+	const url = new URL(request.url);
+	return `${url.protocol}//${url.host}/_dineway`;
+}
+
+//#endregion
+export { getSiteBaseUrl as t };

package/dist/slugify-PDTDtMXp.mjs

@@ -0,0 +1,30 @@
+//#region src/utils/slugify.ts
+const DIACRITICS_PATTERN = /[\u0300-\u036f]/g;
+const WHITESPACE_UNDERSCORE_PATTERN = /[\s_]+/g;
+const NON_ALPHANUMERIC_HYPHEN_PATTERN = /[^a-z0-9-]/g;
+const MULTIPLE_HYPHENS_PATTERN = /-+/g;
+const LEADING_TRAILING_HYPHEN_PATTERN = /^-|-$/g;
+const TRAILING_HYPHEN_PATTERN = /-$/;
+/**
+* Decode a URI-encoded slug route parameter before database lookup.
+*/
+function decodeSlug(raw) {
+	if (!raw) return void 0;
+	try {
+		return decodeURIComponent(raw);
+	} catch {
+		return raw;
+	}
+}
+/**
+* Convert a string to a URL-friendly slug.
+*
+* Handles unicode by normalizing to NFD and stripping diacritics,
+* so "café" becomes "cafe", "naïve" becomes "naive", etc.
+*/
+function slugify(text, maxLength = 80) {
+	return text.toLowerCase().normalize("NFD").replace(DIACRITICS_PATTERN, "").replace(WHITESPACE_UNDERSCORE_PATTERN, "-").replace(NON_ALPHANUMERIC_HYPHEN_PATTERN, "").replace(MULTIPLE_HYPHENS_PATTERN, "-").replace(LEADING_TRAILING_HYPHEN_PATTERN, "").slice(0, maxLength).replace(TRAILING_HYPHEN_PATTERN, "");
+}
+
+//#endregion
+export { slugify as n, decodeSlug as t };

package/dist/ssrf-DDwRxF6B.mjs

@@ -0,0 +1,248 @@
+import { lookup } from "node:dns/promises";
+
+//#region src/import/ssrf.ts
+/**
+* SSRF protection for import URLs.
+*
+* Validates that URLs don't target internal/private network addresses.
+* Applied before any fetch() call in the import pipeline.
+*/
+const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i;
+const IPV4_MAPPED_IPV6_HEX_PATTERN = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+const IPV4_TRANSLATED_HEX_PATTERN = /^::ffff:0:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+const IPV6_EXPANDED_MAPPED_PATTERN = /^0{0,4}:0{0,4}:0{0,4}:0{0,4}:0{0,4}:ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+const IPV6_ULA_FC_PATTERN = /^fc[0-9a-f]{2}:/;
+const IPV6_ULA_FD_PATTERN = /^fd[0-9a-f]{2}:/;
+const TRAILING_DOT_PATTERN = /\.+$/;
+/**
+* IPv4-compatible (deprecated) addresses: ::XXXX:XXXX
+*
+* The WHATWG URL parser normalizes [::127.0.0.1] to [::7f00:1] (no ffff prefix).
+* These are deprecated but still parsed, and bypass the ffff-based checks.
+*/
+const IPV4_COMPATIBLE_HEX_PATTERN = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+/**
+* NAT64 prefix (RFC 6052): 64:ff9b::XXXX:XXXX
+*
+* Used by NAT64 gateways to embed IPv4 addresses in IPv6.
+* [64:ff9b::127.0.0.1] normalizes to [64:ff9b::7f00:1].
+*/
+const NAT64_HEX_PATTERN = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+const IPV6_BRACKET_PATTERN = /^\[|\]$/g;
+/**
+* Private and reserved IP ranges that should never be fetched.
+*
+* Includes:
+* - Loopback (127.0.0.0/8)
+* - Private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
+* - Link-local (169.254.0.0/16)
+* - Cloud metadata (169.254.169.254 — AWS/GCP/Azure)
+* - IPv6 loopback and link-local
+*/
+const BLOCKED_PATTERNS = [
+	{
+		start: ip4ToNum(127, 0, 0, 0),
+		end: ip4ToNum(127, 255, 255, 255)
+	},
+	{
+		start: ip4ToNum(10, 0, 0, 0),
+		end: ip4ToNum(10, 255, 255, 255)
+	},
+	{
+		start: ip4ToNum(172, 16, 0, 0),
+		end: ip4ToNum(172, 31, 255, 255)
+	},
+	{
+		start: ip4ToNum(192, 168, 0, 0),
+		end: ip4ToNum(192, 168, 255, 255)
+	},
+	{
+		start: ip4ToNum(169, 254, 0, 0),
+		end: ip4ToNum(169, 254, 255, 255)
+	},
+	{
+		start: ip4ToNum(0, 0, 0, 0),
+		end: ip4ToNum(0, 255, 255, 255)
+	}
+];
+const BLOCKED_HOSTNAMES = new Set([
+	"localhost",
+	"metadata.google.internal",
+	"metadata.google",
+	"::1"
+]);
+const BLOCKED_HOSTNAME_SUFFIXES = [
+	"nip.io",
+	"sslip.io",
+	"xip.io",
+	"traefik.me",
+	"lvh.me",
+	"localtest.me"
+];
+/** Blocked URL schemes */
+const ALLOWED_SCHEMES = new Set(["http:", "https:"]);
+let defaultDnsResolver = null;
+function ip4ToNum(a, b, c, d) {
+	return (a << 24 | b << 16 | c << 8 | d) >>> 0;
+}
+function parseIpv4(ip) {
+	const parts = ip.split(".");
+	if (parts.length !== 4) return null;
+	const nums = parts.map(Number);
+	if (nums.some((n) => isNaN(n) || n < 0 || n > 255)) return null;
+	return ip4ToNum(nums[0], nums[1], nums[2], nums[3]);
+}
+function getNormalizedHostname(parsed) {
+	return parsed.hostname.replace(IPV6_BRACKET_PATTERN, "").toLowerCase().replace(TRAILING_DOT_PATTERN, "");
+}
+/**
+* Convert IPv4-mapped/translated IPv6 addresses from hex form back to IPv4.
+*
+* The WHATWG URL parser normalizes dotted-decimal to hex:
+*   [::ffff:127.0.0.1] -> [::ffff:7f00:1]
+*   [::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]
+*
+* Without this conversion, the hex forms bypass isPrivateIp() regex checks.
+*/
+function normalizeIPv6MappedToIPv4(ip) {
+	let match = ip.match(IPV4_MAPPED_IPV6_HEX_PATTERN);
+	if (!match) match = ip.match(IPV4_TRANSLATED_HEX_PATTERN);
+	if (!match) match = ip.match(IPV6_EXPANDED_MAPPED_PATTERN);
+	if (!match) match = ip.match(IPV4_COMPATIBLE_HEX_PATTERN);
+	if (!match) match = ip.match(NAT64_HEX_PATTERN);
+	if (match) {
+		const high = parseInt(match[1] ?? "", 16);
+		const low = parseInt(match[2] ?? "", 16);
+		return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+	}
+	return null;
+}
+function isPrivateIp(ip) {
+	const normalized = ip.toLowerCase();
+	if (normalized === "::1" || normalized === "::ffff:127.0.0.1") return true;
+	const hexIpv4 = normalizeIPv6MappedToIPv4(normalized);
+	if (hexIpv4) return isPrivateIp(hexIpv4);
+	const v4Match = normalized.match(IPV4_MAPPED_IPV6_DOTTED_PATTERN);
+	const num = parseIpv4(v4Match ? v4Match[1] : normalized);
+	if (num === null) return normalized.startsWith("fe80:") || IPV6_ULA_FC_PATTERN.test(normalized) || IPV6_ULA_FD_PATTERN.test(normalized);
+	return BLOCKED_PATTERNS.some((range) => num >= range.start && num <= range.end);
+}
+function isIpLiteral(hostname) {
+	return parseIpv4(hostname) !== null || hostname.includes(":");
+}
+/**
+* Error thrown when SSRF protection blocks a URL.
+*/
+var SsrfError = class extends Error {
+	code = "SSRF_BLOCKED";
+	constructor(message) {
+		super(message);
+		this.name = "SsrfError";
+	}
+};
+/**
+* Validate that a URL is safe to fetch (not targeting internal networks).
+*
+* Checks:
+* 1. URL is well-formed with http/https scheme
+* 2. Hostname is not a known internal name (localhost, metadata endpoints)
+* 3. If hostname is an IP literal, it's not in a private range
+*
+* Use resolveAndValidateExternalUrl() or ssrfSafeFetch() before network I/O so
+* hostnames are also checked after DNS resolution.
+*
+* @throws SsrfError if the URL targets an internal address
+*/
+/** Maximum number of redirects to follow in ssrfSafeFetch */
+const MAX_REDIRECTS = 5;
+function validateExternalUrl(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new SsrfError("Invalid URL");
+	}
+	if (!ALLOWED_SCHEMES.has(parsed.protocol)) throw new SsrfError(`Scheme '${parsed.protocol}' is not allowed`);
+	const hostname = getNormalizedHostname(parsed);
+	if (BLOCKED_HOSTNAMES.has(hostname)) throw new SsrfError("URLs targeting internal hosts are not allowed");
+	for (const suffix of BLOCKED_HOSTNAME_SUFFIXES) if (hostname === suffix || hostname.endsWith(`.${suffix}`)) throw new SsrfError("URLs targeting wildcard DNS services are not allowed");
+	if (isPrivateIp(hostname)) throw new SsrfError("URLs targeting private IP addresses are not allowed");
+	return parsed;
+}
+const nodeDnsResolver = async (hostname) => {
+	return (await lookup(hostname, { all: true })).map((entry) => entry.address);
+};
+/**
+* Validate a URL and resolve hostnames before network I/O.
+*
+* Fails closed if DNS resolution fails, returns no addresses, or any resolved
+* address targets a private/internal range.
+*/
+async function resolveAndValidateExternalUrl(url, options = {}) {
+	const parsed = validateExternalUrl(url);
+	const hostname = getNormalizedHostname(parsed);
+	if (isIpLiteral(hostname)) return parsed;
+	const resolver = options.resolver ?? defaultDnsResolver ?? nodeDnsResolver;
+	let addresses;
+	try {
+		addresses = await resolver(hostname);
+	} catch {
+		throw new SsrfError(`Could not resolve hostname: ${hostname}`);
+	}
+	if (addresses.length === 0) throw new SsrfError("Hostname resolved to no addresses");
+	for (const address of addresses) {
+		const normalizedAddress = address.replace(IPV6_BRACKET_PATTERN, "").toLowerCase();
+		if (!isIpLiteral(normalizedAddress)) throw new SsrfError("Hostname resolved to an invalid address");
+		if (isPrivateIp(normalizedAddress)) throw new SsrfError("Hostname resolves to a private IP address");
+	}
+	return parsed;
+}
+/**
+* Fetch a URL with SSRF protection on redirects.
+*
+* Uses `redirect: "manual"` to intercept redirects and re-validate each
+* redirect target against SSRF rules before following it. This prevents
+* an attacker from setting up an allowed external URL that redirects to
+* an internal IP (e.g. 169.254.169.254 for cloud metadata).
+*
+* @throws SsrfError if the initial URL or any redirect target is internal
+*/
+/** Headers that must be stripped when a redirect crosses origins */
+const CREDENTIAL_HEADERS = [
+	"authorization",
+	"cookie",
+	"proxy-authorization"
+];
+async function ssrfSafeFetch(url, init, options = {}) {
+	let currentUrl = url;
+	let currentInit = init;
+	for (let i = 0; i <= MAX_REDIRECTS; i++) {
+		await resolveAndValidateExternalUrl(currentUrl, options);
+		const response = await globalThis.fetch(currentUrl, {
+			...currentInit,
+			redirect: "manual"
+		});
+		if (response.status < 300 || response.status >= 400) return response;
+		const location = response.headers.get("Location");
+		if (!location) return response;
+		const previousOrigin = new URL(currentUrl).origin;
+		currentUrl = new URL(location, currentUrl).href;
+		if (previousOrigin !== new URL(currentUrl).origin && currentInit) currentInit = stripCredentialHeaders(currentInit);
+	}
+	throw new SsrfError(`Too many redirects (max ${MAX_REDIRECTS})`);
+}
+/**
+* Return a copy of init with credential headers removed.
+*/
+function stripCredentialHeaders(init) {
+	if (!init.headers) return init;
+	const headers = new Headers(init.headers);
+	for (const name of CREDENTIAL_HEADERS) headers.delete(name);
+	return {
+		...init,
+		headers
+	};
+}
+
+//#endregion
+export { validateExternalUrl as a, stripCredentialHeaders as i, resolveAndValidateExternalUrl as n, ssrfSafeFetch as r, SsrfError as t };

package/dist/storage/local.d.mts

@@ -1,4 +1,4 @@
-import { a as ListOptions, d as Storage, l as SignedUploadOptions, o as ListResult, p as UploadResult, r as DownloadResult, s as LocalStorageConfig, u as SignedUploadUrl } from "../types-CWbdtiux.mjs";
+import { a as ListOptions, d as Storage, l as SignedUploadOptions, o as ListResult, p as UploadResult, r as DownloadResult, s as LocalStorageConfig, u as SignedUploadUrl } from "../types-B7kpsMJ3.mjs";
 
 //#region src/storage/local.d.ts
 /**

package/dist/storage/local.mjs

@@ -1,4 +1,4 @@
-import { t as DinewayStorageError } from "../types-griIBQOQ.mjs";
+import { t as DinewayStorageError } from "../types-fAInWQDO.mjs";
 import { createReadStream, existsSync } from "node:fs";
 import * as path from "node:path";
 import mime from "mime/lite";

package/dist/storage/s3.d.mts

@@ -1,4 +1,4 @@
-import { a as ListOptions, c as S3StorageConfig, d as Storage, l as SignedUploadOptions, o as ListResult, p as UploadResult, r as DownloadResult, u as SignedUploadUrl } from "../types-CWbdtiux.mjs";
+import { a as ListOptions, c as S3StorageConfig, d as Storage, l as SignedUploadOptions, o as ListResult, p as UploadResult, r as DownloadResult, u as SignedUploadUrl } from "../types-B7kpsMJ3.mjs";
 
 //#region src/storage/s3.d.ts
 /**

package/dist/storage/s3.mjs

@@ -1,4 +1,4 @@
-import { t as DinewayStorageError } from "../types-griIBQOQ.mjs";
+import { t as DinewayStorageError } from "../types-fAInWQDO.mjs";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 
@@ -222,7 +222,7 @@ var S3Storage = class {
 	}
 	getPublicUrl(key) {
 		if (this.publicUrl) return `${this.publicUrl.replace(TRAILING_SLASH_PATTERN, "")}/${key}`;
-		return `${this.endpoint.replace(TRAILING_SLASH_PATTERN, "")}/${this.bucket}/${key}`;
+		return `/_dineway/api/media/file/${key}`;
 	}
 };
 /**

package/dist/{taxonomies-1s5PaS_8.mjs → taxonomies-D2aZGuns.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./chunk-ClPoSABd.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks--4F8ddV4.mjs";
-import { n as getDb } from "./loader-sMG4TZ-u.mjs";
-import { n as requestCached, r as setRequestCacheEntry } from "./request-cache-Dk5qPSOx.mjs";
-import { t as isMissingTableError } from "./db-errors-CEqD7qH9.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-D_jVet6z.mjs";
+import { r as getDb } from "./loader-PZnPxFLc.mjs";
+import { n as requestCached, r as setRequestCacheEntry, t as peekRequestCache } from "./request-cache-DHMRr2Lf.mjs";
+import { t as isMissingTableError } from "./db-errors-DyZkswzF.mjs";
 
 //#region src/taxonomies/index.ts
 /**
@@ -18,8 +18,10 @@ var taxonomies_exports = /* @__PURE__ */ __exportAll({
 	getTaxonomyDefs: () => getTaxonomyDefs,
 	getTaxonomyTerms: () => getTaxonomyTerms,
 	getTerm: () => getTerm,
-	getTermsForEntries: () => getTermsForEntries
+	getTermsForEntries: () => getTermsForEntries,
+	invalidateTermCache: () => invalidateTermCache
 });
+function invalidateTermCache() {}
 /**
 * Get all taxonomy definitions
 */
@@ -39,6 +41,8 @@ async function getTaxonomyDefs() {
 * Get a single taxonomy definition by name
 */
 async function getTaxonomyDef(name) {
+	const allDefs = peekRequestCache("taxonomy-defs:all");
+	if (allDefs) return (await allDefs).find((def) => def.name === name) ?? null;
 	return requestCached(`taxonomy-def:${name}`, async () => {
 		const row = await (await getDb()).selectFrom("_dineway_taxonomy_defs").selectAll().where("name", "=", name).executeTakeFirst();
 		if (!row) return null;
@@ -237,7 +241,7 @@ function primeEntryTermsCache(collection, entryId, byTaxonomy, applicableTaxonom
 * Get entries by term (wraps getDinewayCollection)
 */
 async function getEntriesByTerm(collection, taxonomyName, termSlug) {
-	const { getDinewayCollection } = await import("./query-kDmwCsHh.mjs").then((n) => n.o);
+	const { getDinewayCollection } = await import("./query-B9BO5goQ.mjs").then((n) => n.o);
 	const { entries } = await getDinewayCollection(collection, { where: { [taxonomyName]: termSlug } });
 	return entries;
 }
@@ -263,4 +267,4 @@ function buildTree(flatTerms, counts) {
 }
 
 //#endregion
-export { getTaxonomyTerms as a, taxonomies_exports as c, getTaxonomyDefs as i, getEntryTerms as n, getTerm as o, getTaxonomyDef as r, getTermsForEntries as s, getEntriesByTerm as t };
+export { getTaxonomyTerms as a, invalidateTermCache as c, getTaxonomyDefs as i, taxonomies_exports as l, getEntryTerms as n, getTerm as o, getTaxonomyDef as r, getTermsForEntries as s, getEntriesByTerm as t };