okengine 0.21.1 → 0.23.0

package/src/kernel/http-frame.ts

@@ -0,0 +1,203 @@
+/**
+ * HTTP wire frame stored on a wide event — query, headers, status.
+ *
+ * Credential headers are replaced before the row is written. The body stays
+ * on `input` / `output`; this frame is the rest of the message.
+ */
+
+import type { RunHttpFrame } from "../runs/types.ts";
+
+/** Replacement for credential header and query values. */
+export const HTTP_FRAME_REDACTED = "[redacted]";
+
+const EXACT_HEADERS = new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "dpop",
+]);
+
+/**
+ * Build the Request a Console invoke would have sent for an HTTP flow.
+ *
+ * Call API runs `execute` directly, so there is no socket request. The frame
+ * still needs a method, path, query, and the headers the invoke actually
+ * uses (`accept`, `x-oke-client: console`, and `content-type` when there is a body).
+ * The operator's browser user-agent is not copied onto the flow.
+ *
+ * @param trigger - HTTP method and path template
+ * @param options - Path params and the assembled flow input
+ */
+export function requestForHttpInvoke(
+  trigger: { readonly method: string; readonly path: string },
+  options: {
+    readonly pathParams?: Readonly<Record<string, string>>;
+    readonly input?: unknown;
+  } = {},
+): Request {
+  let path = trigger.path;
+  const params = options.pathParams ?? {};
+  for (const [key, value] of Object.entries(params)) {
+    path = path.replaceAll(`:${key}`, encodeURIComponent(value));
+  }
+  const url = new URL(path, "http://127.0.0.1");
+  const method = trigger.method.toUpperCase();
+  const headers = new Headers({ accept: "application/json", "x-oke-client": "console" });
+  if (!methodCarriesBody(method)) {
+    appendScalarQuery(url, options.input, new Set(Object.keys(params)));
+    return new Request(url.href, { method, headers });
+  }
+  headers.set("content-type", "application/json");
+  const body = options.input === undefined ? undefined : JSON.stringify(options.input);
+  return new Request(url.href, {
+    method,
+    headers,
+    ...(body !== undefined ? { body } : {}),
+  });
+}
+
+/**
+ * Build the wire frame for an HTTP run.
+ *
+ * Does not read the body. Safe to call after the handler has consumed it,
+ * including streamed responses.
+ *
+ * @param request - Incoming request
+ * @param response - Final response after `onResponse`, when one exists
+ */
+export function captureHttpFrame(request: Request, response: Response | undefined): RunHttpFrame {
+  const url = new URL(request.url);
+  const query: Record<string, string> = {};
+  for (const [key, value] of url.searchParams) {
+    query[key] = sensitiveQuery(key) ? HTTP_FRAME_REDACTED : value;
+  }
+  return redactHttpFrame({
+    request: {
+      method: request.method,
+      path: url.pathname,
+      query,
+      headers: headerMap(request.headers),
+    },
+    ...(response !== undefined
+      ? { response: { status: response.status, headers: headerMap(response.headers) } }
+      : {}),
+  });
+}
+
+/**
+ * Mask credential headers and query values on a stored frame.
+ *
+ * Applied again at Console projection so a row that skipped capture still
+ * does not show secrets.
+ *
+ * @param frame - Stored HTTP frame
+ */
+export function redactHttpFrame(frame: RunHttpFrame): RunHttpFrame {
+  return {
+    request: {
+      method: frame.request.method,
+      path: frame.request.path,
+      query: redactQuery(frame.request.query),
+      headers: redactHeaders(frame.request.headers),
+    },
+    ...(frame.response !== undefined
+      ? {
+          response: {
+            status: frame.response.status,
+            headers: redactHeaders(frame.response.headers),
+          },
+        }
+      : {}),
+  };
+}
+
+/**
+ * True when a header name carries a credential.
+ *
+ * @param name - Lower-case header name
+ */
+export function sensitiveHeader(name: string): boolean {
+  const key = name.toLowerCase();
+  if (EXACT_HEADERS.has(key)) return true;
+  if (key === "idempotency-key") return false;
+  return (
+    key.includes("token") ||
+    key.includes("secret") ||
+    key.includes("api-key") ||
+    key.endsWith("-key") ||
+    key.endsWith("_key")
+  );
+}
+
+function methodCarriesBody(method: string): boolean {
+  switch (method) {
+    case "GET":
+    case "HEAD":
+    case "DELETE":
+      return false;
+    default:
+      return true;
+  }
+}
+
+function appendScalarQuery(url: URL, input: unknown, skip: ReadonlySet<string>): void {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) return;
+  for (const [key, value] of Object.entries(input as Record<string, unknown>)) {
+    if (skip.has(key)) continue;
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      url.searchParams.set(key, String(value));
+    }
+  }
+}
+
+function sensitiveQuery(name: string): boolean {
+  const key = name.toLowerCase();
+  return (
+    key === "token" ||
+    key.endsWith("_token") ||
+    key.endsWith("-token") ||
+    key === "api_key" ||
+    key === "apikey" ||
+    key === "api-key" ||
+    key === "secret" ||
+    key === "password" ||
+    key === "access_token" ||
+    key === "refresh_token"
+  );
+}
+
+function headerMap(headers: Headers): Record<string, string> {
+  const out: Record<string, string> = {};
+  headers.forEach((value, key) => {
+    const name = key.toLowerCase();
+    if (sensitiveHeader(name)) {
+      out[name] = HTTP_FRAME_REDACTED;
+      return;
+    }
+    const prev = out[name];
+    out[name] = prev === undefined ? value : `${prev}, ${value}`;
+  });
+  return sortRecord(out);
+}
+
+function redactHeaders(headers: Readonly<Record<string, string>>): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key.toLowerCase()] = sensitiveHeader(key) ? HTTP_FRAME_REDACTED : value;
+  }
+  return sortRecord(out);
+}
+
+function redactQuery(query: Readonly<Record<string, string>>): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(query)) {
+    out[key] = sensitiveQuery(key) ? HTTP_FRAME_REDACTED : value;
+  }
+  return sortRecord(out);
+}
+
+function sortRecord(record: Record<string, string>): Record<string, string> {
+  return Object.fromEntries(Object.entries(record).sort(([a], [b]) => a.localeCompare(b)));
+}