lunibee 0.3.0 → 0.3.1

package/dist/rest/errors.d.ts

@@ -26,6 +26,14 @@ export type RESTErrorKind =
  * credential.
  */
 export declare function redactPath(path: string): string;
+/** Hides webhook and interaction tokens in free text. */
+export declare function redactText(text: string): string;
+/**
+ * A copy of a lower-level error that is safe to attach as a `cause`: the same
+ * name and code, with tokens removed from the message and stack. Runtimes put
+ * the request URL in network error messages, and the URL holds webhook tokens.
+ */
+export declare function sanitizeCause(error: unknown): unknown;
 /** Error thrown when Discord rejects a REST request. */
 export declare class RESTError extends Error {
     /** Failure category. */

package/dist/rest/index.d.ts

@@ -107,6 +107,8 @@ export declare class REST {
         retries?: number;
         retryPolicy?: RetryPolicy;
         baseURL?: string;
+        /** Allow a cleartext `http://` base URL on a network you trust (a REST proxy). Default false. */
+        allowInsecureBaseURL?: boolean;
         hooks?: RESTHooks;
         store?: RateLimitStore;
         /** Replaces the HTTP stage, e.g. with a recording transport in tests. */

package/dist/rest/index.js

@@ -2,7 +2,7 @@
 // packages/rest/package.json
 var package_default = {
   name: "@lunibee/rest",
-  version: "0.3.0",
+  version: "0.3.1",
   type: "module",
   module: "./src/index.ts",
   types: "./src/index.ts",
@@ -85,6 +85,24 @@ function kindFromStatus(status) {
 function redactPath(path) {
   return path.replace(/^(\/webhooks\/[^/?]+\/)[^/?]+/i, "$1:token").replace(/^(\/interactions\/[^/?]+\/)[^/?]+/i, "$1:token");
 }
+var TOKEN_IN_TEXT = /(\/(?:webhooks|interactions)\/[^/\s?"'`]+\/)[^/\s?"'`]+/gi;
+function redactText(text) {
+  return text.replace(TOKEN_IN_TEXT, "$1:token");
+}
+function sanitizeCause(error) {
+  if (!(error instanceof Error))
+    return;
+  const copy = new Error(redactText(error.message));
+  copy.name = error.name;
+  if (error.stack)
+    copy.stack = redactText(error.stack);
+  for (const key of ["code", "errno", "syscall"]) {
+    const value = error[key];
+    if (typeof value === "string" || typeof value === "number")
+      copy[key] = value;
+  }
+  return copy;
+}
 var HINTS = {
   50001: "The bot cannot see this resource: check that it is in the guild and has View Channel there.",
   50013: "The bot lacks a permission for this action, or the target role or member is at or above the bot's highest role."
@@ -120,14 +138,19 @@ async function sleep(delay, signal, path) {
   if (delay <= 0)
     return;
   await new Promise((resolve, reject) => {
-    const timer = setTimeout(resolve, delay);
-    const abort = () => {
+    const finish = (error) => {
       clearTimeout(timer);
-      reject(abortError(path, signal?.reason));
+      signal?.removeEventListener("abort", onAbort);
+      if (error)
+        reject(error);
+      else
+        resolve();
     };
+    const onAbort = () => finish(abortError(path, signal?.reason));
+    const timer = setTimeout(finish, delay);
     if (signal?.aborted)
-      return abort();
-    signal?.addEventListener("abort", abort, { once: true });
+      return onAbort();
+    signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
 async function abortable(promise, signal, path) {
@@ -135,10 +158,17 @@ async function abortable(promise, signal, path) {
     return promise;
   if (signal.aborted)
     throw abortError(path, signal.reason);
-  return Promise.race([
-    promise,
-    new Promise((_, reject) => signal.addEventListener("abort", () => reject(abortError(path, signal.reason)), { once: true }))
-  ]);
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(abortError(path, signal.reason));
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, (error) => {
+      signal.removeEventListener("abort", onAbort);
+      reject(error);
+    });
+  });
 }
 
 // packages/rest/src/route.ts
@@ -312,6 +342,25 @@ class RateLimiter {
 }
 
 // packages/rest/src/transport.ts
+var LOOPBACK = /^(?:localhost|127(?:\.\d{1,3}){3}|\[::1\])$/i;
+function parseBaseURL(raw, allowInsecure = false) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new TypeError("baseURL must be an absolute http(s) URL.");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:")
+    throw new TypeError("baseURL must use https.");
+  if (url.username || url.password)
+    throw new TypeError("baseURL must not contain credentials.");
+  if (url.search || url.hash)
+    throw new TypeError("baseURL must not contain a query or fragment.");
+  if (url.protocol === "http:" && !allowInsecure && !LOOPBACK.test(url.hostname))
+    throw new TypeError("baseURL must use https: the bot token would travel in cleartext (allowInsecureBaseURL: true overrides this for a trusted network).");
+  return raw.replace(/\/$/, "");
+}
+
 class TransportError extends Error {
   timedOut;
   constructor(message, timedOut, cause) {
@@ -326,7 +375,7 @@ class HttpTransport {
   #timeout;
   #fetch;
   constructor(options = {}) {
-    this.#baseURL = (options.baseURL ?? "https://discord.com/api/v10").replace(/\/$/, "");
+    this.#baseURL = parseBaseURL(options.baseURL ?? "https://discord.com/api/v10", options.allowInsecureBaseURL);
     this.#timeout = Math.max(1, options.timeout ?? 15000);
     this.#fetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
   }
@@ -348,13 +397,14 @@ class HttpTransport {
         method: request.method,
         headers: request.headers,
         body: request.body,
-        signal: controller.signal
+        signal: controller.signal,
+        redirect: "error"
       });
     } catch (error) {
       if (error instanceof RESTError)
         throw error;
       const timedOut = error instanceof DOMException && (error.name === "TimeoutError" || error.name === "AbortError");
-      throw new TransportError(timedOut ? `Discord REST request timed out after ${this.#timeout}ms` : "Discord REST request failed", timedOut, error);
+      throw new TransportError(timedOut ? `Discord REST request timed out after ${this.#timeout}ms` : "Discord REST request failed", timedOut, sanitizeCause(error));
     } finally {
       clearTimeout(timer);
       request.signal?.removeEventListener("abort", onAbort);
@@ -793,6 +843,7 @@ class REST {
     this.#retryPolicy = options.retryPolicy ?? createRetryPolicy(options.retries ?? 2);
     this.#transport = options.transport ?? new HttpTransport({
       baseURL: options.baseURL,
+      allowInsecureBaseURL: options.allowInsecureBaseURL,
       timeout: options.timeout
     });
     const store = options.store ?? new MemoryRateLimitStore;
@@ -999,4 +1050,4 @@ export {
   serializeQuery
 };
 
-//# debugId=76878940534439C564756E2164756E21
+//# debugId=67C38AAB1AEA94A764756E2164756E21