reqon-dsl 0.3.0 → 0.4.0

package/dist/webhook/server.js

@@ -7,6 +7,7 @@
 import { createServer } from 'node:http';
 import { parse as parseUrl } from 'node:url';
 import { randomUUID } from 'node:crypto';
+import { setLongTimeout } from '../utils/long-timeout.js';
 import { MemoryWebhookStore } from './store.js';
 import { WEBHOOK_DEFAULTS } from '../config/index.js';
 /**
@@ -19,6 +20,8 @@ export class WebhookServer {
     store;
     callbacks;
     server;
+    // Multiple concurrent waiters may await the same registration; each gets its
+    // own entry so a second waiter can't clobber the first's timer/promise.
     pendingWaits = new Map();
     cleanupInterval;
     running = false;
@@ -29,6 +32,8 @@ export class WebhookServer {
             baseUrl: config.baseUrl ?? `http://localhost:${config.port ?? WEBHOOK_DEFAULTS.PORT}`,
             defaultTimeout: config.defaultTimeout ?? WEBHOOK_DEFAULTS.DEFAULT_TIMEOUT_MS,
             verbose: config.verbose ?? false,
+            secret: config.secret ?? '',
+            maxBodyBytes: config.maxBodyBytes ?? WEBHOOK_DEFAULTS.MAX_BODY_BYTES,
         };
         this.store = store ?? new MemoryWebhookStore();
         this.callbacks = callbacks;
@@ -39,8 +44,14 @@ export class WebhookServer {
     async start() {
         if (this.running)
             return;
+        // Warn loudly if exposing an unauthenticated webhook server off-host.
+        if (!this.isLoopback(this.config.host) && !this.config.secret) {
+            console.warn(`[Webhook] WARNING: binding to ${this.config.host} with no secret — ` +
+                `anyone who can reach the port can inject events.`);
+        }
         return new Promise((resolve, reject) => {
             this.server = createServer((req, res) => this.handleRequest(req, res));
+            this.server.setTimeout(WEBHOOK_DEFAULTS.SOCKET_TIMEOUT_MS);
             this.server.on('error', (error) => {
                 reject(error);
             });
@@ -65,13 +76,15 @@ export class WebhookServer {
             this.cleanupInterval = undefined;
         }
         // Cancel all pending waits
-        for (const [id, pending] of this.pendingWaits) {
-            clearTimeout(pending.timeoutId);
-            pending.resolve({
-                success: false,
-                events: [],
-                error: 'Server shutting down',
-            });
+        for (const [, waiters] of this.pendingWaits) {
+            for (const pending of waiters) {
+                pending.timer.clear();
+                pending.resolve({
+                    success: false,
+                    events: [],
+                    error: 'Server shutting down',
+                });
+            }
         }
         this.pendingWaits.clear();
         // Close server
@@ -134,10 +147,11 @@ export class WebhookServer {
             return { success: true, events };
         }
         // Wait for more events
-        const waitTimeout = timeout ?? (registration.expiresAt.getTime() - Date.now());
+        const waitTimeout = timeout ?? registration.expiresAt.getTime() - Date.now();
         return new Promise((resolve) => {
-            const timeoutId = setTimeout(() => {
-                this.pendingWaits.delete(registrationId);
+            const pending = { registrationId, resolve, timer: undefined };
+            pending.timer = setLongTimeout(() => {
+                this.removePendingWait(registrationId, pending);
                 this.store.getEvents(registrationId).then((events) => {
                     resolve({
                         success: events.length >= registration.expectedEvents,
@@ -146,23 +160,36 @@ export class WebhookServer {
                     });
                 });
             }, waitTimeout);
-            this.pendingWaits.set(registrationId, {
-                registrationId,
-                resolve,
-                timeoutId,
-            });
+            let waiters = this.pendingWaits.get(registrationId);
+            if (!waiters) {
+                waiters = new Set();
+                this.pendingWaits.set(registrationId, waiters);
+            }
+            waiters.add(pending);
         });
     }
+    /** Remove a single waiter, dropping the registration's set when empty. */
+    removePendingWait(registrationId, pending) {
+        const waiters = this.pendingWaits.get(registrationId);
+        if (!waiters)
+            return;
+        waiters.delete(pending);
+        if (waiters.size === 0) {
+            this.pendingWaits.delete(registrationId);
+        }
+    }
     /**
      * Unregister a webhook endpoint
      */
     async unregister(registrationId) {
         await this.store.deleteRegistration(registrationId);
         await this.store.deleteEvents(registrationId);
-        // Cancel pending wait if any
-        const pending = this.pendingWaits.get(registrationId);
-        if (pending) {
-            clearTimeout(pending.timeoutId);
+        // Cancel any pending waits for this registration.
+        const waiters = this.pendingWaits.get(registrationId);
+        if (waiters) {
+            for (const pending of waiters) {
+                pending.timer.clear();
+            }
             this.pendingWaits.delete(registrationId);
         }
         this.log(`Unregistered webhook: ${registrationId}`);
@@ -211,11 +238,31 @@ export class WebhookServer {
             await this.store.deleteRegistration(registration.id);
             return;
         }
-        // Parse request body
+        // Require the shared secret if one is configured.
+        if (this.config.secret && !this.authorized(req, url.query)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Unauthorized' }));
+            return;
+        }
+        // Read the request body with a hard size cap to prevent an OOM from a
+        // large or slow-drip POST.
         let rawBody = '';
-        let body = null;
         try {
             rawBody = await this.readBody(req);
+        }
+        catch (error) {
+            if (error.code === 'BODY_TOO_LARGE') {
+                res.writeHead(413, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Request body too large' }));
+                return;
+            }
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Failed to read request body' }));
+            return;
+        }
+        // Parse request body
+        let body = null;
+        try {
             if (rawBody) {
                 const contentType = req.headers['content-type'] ?? '';
                 if (contentType.includes('application/json')) {
@@ -229,7 +276,7 @@ export class WebhookServer {
                 }
             }
         }
-        catch (error) {
+        catch {
             body = rawBody;
         }
         // Create event
@@ -253,12 +300,14 @@ export class WebhookServer {
         if (registration.receivedEvents >= registration.expectedEvents) {
             const events = await this.store.getEvents(registration.id);
             this.callbacks.onRegistrationComplete?.(registration, events);
-            // Resolve pending wait
-            const pending = this.pendingWaits.get(registration.id);
-            if (pending) {
-                clearTimeout(pending.timeoutId);
+            // Resolve every pending waiter for this registration.
+            const waiters = this.pendingWaits.get(registration.id);
+            if (waiters) {
                 this.pendingWaits.delete(registration.id);
-                pending.resolve({ success: true, events });
+                for (const pending of waiters) {
+                    pending.timer.clear();
+                    pending.resolve({ success: true, events });
+                }
             }
         }
         // Send response
@@ -274,17 +323,53 @@ export class WebhookServer {
      * Read request body
      */
     readBody(req) {
+        const limit = this.config.maxBodyBytes;
         return new Promise((resolve, reject) => {
-            let data = '';
+            const chunks = [];
+            let size = 0;
+            let aborted = false;
             req.on('data', (chunk) => {
-                data += chunk;
+                if (aborted)
+                    return;
+                size += chunk.length;
+                if (size > limit) {
+                    // Stop accumulating (memory stays bounded) and reject; the handler
+                    // responds 413. We don't destroy the socket here so the response
+                    // can flush first.
+                    aborted = true;
+                    const err = new Error('Request body too large');
+                    err.code = 'BODY_TOO_LARGE';
+                    reject(err);
+                    return;
+                }
+                chunks.push(chunk);
             });
             req.on('end', () => {
-                resolve(data);
+                resolve(Buffer.concat(chunks).toString('utf-8'));
             });
             req.on('error', reject);
         });
     }
+    /** True if a host string is a loopback address. */
+    isLoopback(host) {
+        return host === 'localhost' || host === '127.0.0.1' || host === '::1';
+    }
+    /**
+     * Validate the shared secret from Authorization bearer, X-Webhook-Token
+     * header, or a `token` query param.
+     */
+    authorized(req, query) {
+        const secret = this.config.secret;
+        const auth = req.headers.authorization;
+        if (auth === `Bearer ${secret}`)
+            return true;
+        const tokenHeader = req.headers['x-webhook-token'];
+        if (tokenHeader === secret)
+            return true;
+        if (typeof query.token === 'string' && query.token === secret)
+            return true;
+        return false;
+    }
     /**
      * Extract headers from request
      */

package/dist/webhook/types.d.ts

@@ -51,7 +51,7 @@ export interface WebhookEvent {
 export interface WebhookServerConfig {
     /** Port to listen on (default: 3000) */
     port?: number;
-    /** Host to bind to (default: '0.0.0.0') */
+    /** Host to bind to (default: '127.0.0.1' — loopback only) */
     host?: string;
     /** Base URL for webhook endpoints (e.g., 'https://example.com/webhooks') */
     baseUrl?: string;
@@ -59,6 +59,14 @@ export interface WebhookServerConfig {
     defaultTimeout?: number;
     /** Enable verbose logging */
     verbose?: boolean;
+    /**
+     * Shared secret required on inbound webhook requests. When set, a request
+     * must present it via `Authorization: Bearer <secret>`, `X-Webhook-Token`,
+     * or a `token` query param, or it is rejected with 401.
+     */
+    secret?: string;
+    /** Maximum accepted request body size in bytes (default 1 MiB) */
+    maxBodyBytes?: number;
 }
 /**
  * Callbacks for webhook server events

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reqon-dsl",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "A DSL framework for fetch, map, validate pipelines - built on Vague",
   "type": "module",
   "main": "dist/index.js",
@@ -10,11 +10,15 @@
     "reqon-mcp": "dist/mcp/server.js"
   },
   "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsc -p tsconfig.build.json --watch",
+    "typecheck": "tsc --noEmit",
     "test": "vitest",
     "test:run": "vitest run",
     "test:coverage": "vitest run --coverage",
+    "test:integration": "RUN_NETWORK_TESTS=1 vitest run src/api-integration.test.ts",
+    "test:crash": "vitest run src/durability/",
+    "test:pg": "vitest run src/execution-log/postgres-store.test.ts",
     "lint": "eslint src/",
     "lint:fix": "eslint src/ --fix",
     "format": "prettier --write src/",
@@ -40,7 +44,7 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "repository": {
     "type": "git",
@@ -68,6 +72,18 @@
     "vague-lang": "^3.3.0",
     "zod": "^4.2.1"
   },
+  "peerDependencies": {
+    "better-sqlite3": ">=11",
+    "pg": ">=8"
+  },
+  "peerDependenciesMeta": {
+    "better-sqlite3": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    }
+  },
   "lint-staged": {
     "src/**/*.{ts,tsx}": [
       "eslint --fix",
@@ -78,9 +94,11 @@
     "@eslint/js": "^9.17.0",
     "@types/node": "^25.0.3",
     "@vitest/coverage-v8": "^4.0.16",
+    "better-sqlite3": "^12.11.1",
     "eslint": "^9.17.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",
+    "pg": "^8.22.0",
     "prettier": "^3.4.2",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.18.2",