server-devtools 0.1.6 → 0.1.8

package/dist/src/core/repeated-database-queries/postgres.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.postgresDatabaseGroupKey = postgresDatabaseGroupKey;
+const sql_template_1 = require("./sql-template");
+function postgresDatabaseGroupKey(attributes) {
+    if (attributes["db.system.name"] !== "postgresql") {
+        return undefined;
+    }
+    const query = attributes["db.query.text"];
+    if (typeof query !== "string" || query.trim() === "") {
+        return undefined;
+    }
+    return `postgresql:${(0, sql_template_1.normalizeSqlTemplate)(query)}`;
+}
+//# sourceMappingURL=postgres.js.map

package/dist/src/core/repeated-database-queries/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../../src/core/repeated-database-queries/postgres.ts"],"names":[],"mappings":";;;AAAA,iDAAsD;AAEtD,kCACI,UAAmC;IAEnC,IAAI,UAAU,CAAC,gBAAgB,CAAC,KAAK,YAAY,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,OAAO,cAAc,IAAA,mCAAoB,EAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/src/core/repeated-database-queries/redis.d.ts

@@ -0,0 +1,8 @@
+export declare function parseRedisCommandText(queryText: string): {
+    command: string;
+    args: string[];
+} | undefined;
+export declare function normalizeRedisCommandPattern(command: string, args: string[]): string;
+export declare function redisDatabaseGroupKey(attributes: Record<string, unknown>): string | undefined;
+export declare function formatRedisCommandPattern(groupKey: string): string;
+//# sourceMappingURL=redis.d.ts.map

package/dist/src/core/repeated-database-queries/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../../src/core/repeated-database-queries/redis.ts"],"names":[],"mappings":"AAwDA,wBAAgB,qBAAqB,CACjC,SAAS,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAgBjD;AAED,wBAAgB,4BAA4B,CACxC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,GACf,MAAM,CAMR;AAED,wBAAgB,qBAAqB,CACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,MAAM,GAAG,SAAS,CAoBpB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/dist/src/core/repeated-database-queries/redis.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRedisCommandText = parseRedisCommandText;
+exports.normalizeRedisCommandPattern = normalizeRedisCommandPattern;
+exports.redisDatabaseGroupKey = redisDatabaseGroupKey;
+exports.formatRedisCommandPattern = formatRedisCommandPattern;
+const REDIS_COMMANDS_MASKING_ALL_ARGS = new Set([
+    "SET",
+    "SETEX",
+    "SETNX",
+    "PSETEX",
+    "GETSET",
+    "MSET",
+    "LPUSH",
+    "RPUSH",
+]);
+const REDIS_COMMANDS_WITH_FIELD_ARG = new Set([
+    "HGET",
+    "HDEL",
+    "HEXISTS",
+    "HSET",
+]);
+function normalizeRedisArgument(command, argIndex, arg) {
+    const cmd = command.toUpperCase();
+    if (REDIS_COMMANDS_MASKING_ALL_ARGS.has(cmd)) {
+        return "?";
+    }
+    if (cmd === "HSET") {
+        if (argIndex === 0) {
+            return "?";
+        }
+        if (argIndex === 1) {
+            return arg.toLowerCase();
+        }
+        return "?";
+    }
+    if (REDIS_COMMANDS_WITH_FIELD_ARG.has(cmd)) {
+        if (argIndex === 0) {
+            return "?";
+        }
+        if (argIndex === 1) {
+            return arg.toLowerCase();
+        }
+        return "?";
+    }
+    if (argIndex === 0) {
+        return "?";
+    }
+    return "?";
+}
+function parseRedisCommandText(queryText) {
+    const trimmed = queryText.trim();
+    if (trimmed === "") {
+        return undefined;
+    }
+    const parts = trimmed.split(/\s+/);
+    const command = parts[0]?.toUpperCase();
+    if (!command) {
+        return undefined;
+    }
+    return {
+        command,
+        args: parts.slice(1),
+    };
+}
+function normalizeRedisCommandPattern(command, args) {
+    const normalizedArgs = args.map((arg, index) => normalizeRedisArgument(command, index, arg));
+    return [command.toUpperCase(), ...normalizedArgs].join(" ").trim();
+}
+function redisDatabaseGroupKey(attributes) {
+    if (attributes["db.system.name"] !== "redis") {
+        return undefined;
+    }
+    const queryText = attributes["db.query.text"];
+    if (typeof queryText === "string" && queryText.trim() !== "") {
+        const parsed = parseRedisCommandText(queryText);
+        if (parsed) {
+            const pattern = normalizeRedisCommandPattern(parsed.command, parsed.args);
+            return `redis:${pattern}`;
+        }
+    }
+    const operation = attributes["db.operation.name"];
+    if (typeof operation === "string" && operation.trim() !== "") {
+        return `redis:${operation.trim().toUpperCase()}`;
+    }
+    return undefined;
+}
+function formatRedisCommandPattern(groupKey) {
+    return groupKey.startsWith("redis:") ? groupKey.slice("redis:".length) : groupKey;
+}
+//# sourceMappingURL=redis.js.map

package/dist/src/core/repeated-database-queries/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../../../src/core/repeated-database-queries/redis.ts"],"names":[],"mappings":";;;;;;AAAA,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC5C,KAAK;IACL,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;CACV,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC1C,MAAM;IACN,MAAM;IACN,SAAS;IACT,MAAM;CACT,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAAC,OAAe,EAAE,QAAgB,EAAE,GAAW;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAElC,IAAI,+BAA+B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC;IACf,CAAC;IAED,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACjB,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC;QACf,CAAC;QAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,CAAC;IACf,CAAC;IAED,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC;QACf,CAAC;QAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,CAAC;IACf,CAAC;IAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC;IACf,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC;AAED,+BACI,SAAiB;IAEjB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,OAAO;QACH,OAAO;QACP,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;KACvB,CAAC;AACN,CAAC;AAED,sCACI,OAAe,EACf,IAAc;IAEd,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAC3C,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAC9C,CAAC;IAEF,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,+BACI,UAAmC;IAEnC,IAAI,UAAU,CAAC,gBAAgB,CAAC,KAAK,OAAO,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1E,OAAO,SAAS,OAAO,EAAE,CAAC;QAC9B,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3D,OAAO,SAAS,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,mCAA0C,QAAgB;IACtD,OAAO,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtF,CAAC"}

package/dist/src/core/repeated-database-queries/sql-template.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizeSqlTemplate(query: string): string;
+//# sourceMappingURL=sql-template.d.ts.map

package/dist/src/core/repeated-database-queries/sql-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-template.d.ts","sourceRoot":"","sources":["../../../../src/core/repeated-database-queries/sql-template.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO1D"}

package/dist/src/core/repeated-database-queries/sql-template.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeSqlTemplate = normalizeSqlTemplate;
+function normalizeSqlTemplate(query) {
+    let normalized = query.trim().replace(/\s+/g, " ");
+    normalized = normalized.replace(/\$\d+/g, "?");
+    normalized = normalized.replace(/'(?:''|[^'])*'/g, "?");
+    normalized = normalized.replace(/=\s*-?\d+(?:\.\d+)?/g, "= ?");
+    normalized = normalized.replace(/,\s*-?\d+(?:\.\d+)?(?=\s*[),])/g, ", ?");
+    return normalized.toLowerCase();
+}
+//# sourceMappingURL=sql-template.js.map

package/dist/src/core/repeated-database-queries/sql-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-template.js","sourceRoot":"","sources":["../../../../src/core/repeated-database-queries/sql-template.ts"],"names":[],"mappings":";;;AAAA,8BAAqC,KAAa;IAC9C,IAAI,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnD,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/C,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACxD,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC/D,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC"}

package/dist/src/core/slow-span.d.ts

@@ -0,0 +1,5 @@
+export declare const DEFAULT_SLOW_SPAN_THRESHOLD_MS: number;
+export declare function parseSlowSpanThresholdMs(value: unknown, fallback?: number): number;
+export declare function resolveSlowSpanThresholdMs(option?: number): number;
+export declare function isSlowSpan(durationMs: unknown, thresholdMs?: number): boolean;
+//# sourceMappingURL=slow-span.d.ts.map

package/dist/src/core/slow-span.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slow-span.d.ts","sourceRoot":"","sources":["../../../src/core/slow-span.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,8BAA8B,QAAwC,CAAC;AAEpF,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,OAAO,EACd,QAAQ,SAAiC,GAC1C,MAAM,CAaR;AAED,wBAAgB,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAQlE;AAED,wBAAgB,UAAU,CACtB,UAAU,EAAE,OAAO,EACnB,WAAW,SAAiC,GAC7C,OAAO,CAOT"}

package/dist/src/core/slow-span.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SLOW_SPAN_THRESHOLD_MS = void 0;
+exports.parseSlowSpanThresholdMs = parseSlowSpanThresholdMs;
+exports.resolveSlowSpanThresholdMs = resolveSlowSpanThresholdMs;
+exports.isSlowSpan = isSlowSpan;
+const config_1 = __importDefault(require("../config"));
+exports.DEFAULT_SLOW_SPAN_THRESHOLD_MS = config_1.default.DEFAULT_SLOW_SPAN_THRESHOLD_MS;
+function parseSlowSpanThresholdMs(value, fallback = exports.DEFAULT_SLOW_SPAN_THRESHOLD_MS) {
+    if (typeof value === "number" && Number.isFinite(value) && value >= 0) {
+        return value;
+    }
+    if (typeof value === "string" && value.trim() !== "") {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed) && parsed >= 0) {
+            return parsed;
+        }
+    }
+    return fallback;
+}
+function resolveSlowSpanThresholdMs(option) {
+    if (option !== undefined) {
+        return parseSlowSpanThresholdMs(option);
+    }
+    return parseSlowSpanThresholdMs(process.env.SERVER_DEVTOOLS_SLOW_SPAN_THRESHOLD_MS);
+}
+function isSlowSpan(durationMs, thresholdMs = exports.DEFAULT_SLOW_SPAN_THRESHOLD_MS) {
+    if (typeof durationMs !== "number" || !Number.isFinite(durationMs) || durationMs < 0) {
+        return false;
+    }
+    const threshold = parseSlowSpanThresholdMs(thresholdMs);
+    return durationMs >= threshold;
+}
+//# sourceMappingURL=slow-span.js.map

package/dist/src/core/slow-span.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slow-span.js","sourceRoot":"","sources":["../../../src/core/slow-span.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uDAA+B;AAElB,QAAA,8BAA8B,GAAG,gBAAM,CAAC,8BAA8B,CAAC;AAEpF,kCACI,KAAc,EACd,QAAQ,GAAG,QAAA,8BAA8B;IAEzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACzC,OAAO,MAAM,CAAC;QAClB,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,oCAA2C,MAAe;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,wBAAwB,CAC3B,OAAO,CAAC,GAAG,CAAC,sCAAsC,CACrD,CAAC;AACN,CAAC;AAED,oBACI,UAAmB,EACnB,WAAW,GAAG,QAAA,8BAA8B;IAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACxD,OAAO,UAAU,IAAI,SAAS,CAAC;AACnC,CAAC"}

package/dist/src/dashboard/dashboard-server.d.ts

@@ -4,15 +4,26 @@ import AuthService from "../security/auth.service";
 export default class DashboardServer {
     private readonly storage;
     private readonly authService;
+    private readonly slowSpanThresholdMs;
+    private readonly allowedIPs?;
     private readonly executionTreeBuilder;
     private readonly requestDetailMapper;
     private readonly responseDetailMapper;
     private readonly errorMapper;
-    constructor(storage: SQLiteStorage, authService: AuthService);
+    private readonly loginRateLimiter;
+    private readonly trackedLoginRateLimitKeys;
+    private maxTrackedLoginRateLimitKeys;
+    private loginBodyReadTimeoutMs;
+    constructor(storage: SQLiteStorage, authService: AuthService, slowSpanThresholdMs?: number, allowedIPs?: Set<string> | undefined);
+    private sendIpForbidden;
     private readJsonBody;
     private getCookie;
     private authenticateRequest;
     private sendUnauthorized;
+    private reclaimExpiredLoginRateLimitKeys;
+    private getLoginRateLimitCapacityRetryAfterMs;
+    private trackLoginRateLimitKey;
+    private sendLoginRateLimitResponse;
     private handleLogin;
     private handleLogout;
     private handleProfile;

package/dist/src/dashboard/dashboard-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-server.d.ts","sourceRoot":"","sources":["../../../src/dashboard/dashboard-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAK5D,OAAO,aAGN,MAAM,2BAA2B,CAAC;AAInC,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAkBnD,MAAM,CAAC,OAAO,OAAO,eAAe;IAS5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAThC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA8B;IACnE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsC;IAC1E,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAsC;IAC3E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAIzD,YACqB,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,EAE5C;IAED,OAAO,CAAC,YAAY;IAsBpB,OAAO,CAAC,SAAS;IAqBjB,OAAO,CAAC,mBAAmB;IAqB3B,OAAO,CAAC,gBAAgB;YAWV,WAAW;IA0DzB,OAAO,CAAC,YAAY;IAuBpB,OAAO,CAAC,aAAa;IAmCrB,MAAM,CAAC,GAAG,EAAE,eAAe,EACvB,GAAG,EAAE,cAAc,wBA8rBtB;CAGJ"}
+{"version":3,"file":"dashboard-server.d.ts","sourceRoot":"","sources":["../../../src/dashboard/dashboard-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAK5D,OAAO,aAGN,MAAM,2BAA2B,CAAC;AAInC,OAAO,WAAW,MAAM,0BAA0B,CAAC;AA2CnD,MAAM,CAAC,OAAO,OAAO,eAAe;IAkB5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IApBhC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA8B;IACnE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsC;IAC1E,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAsC;IAC3E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAK9B;IACH,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA6B;IACvE,OAAO,CAAC,4BAA4B,CAAsD;IAC1F,OAAO,CAAC,sBAAsB,CAA+C;IAI7E,YACqB,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,EACxB,mBAAmB,SAAwC,EAC3D,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,YAAA,EAE5C;IAED,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,YAAY;IA8FpB,OAAO,CAAC,SAAS;IAyBjB,OAAO,CAAC,mBAAmB;IAqB3B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,gCAAgC;IAQxC,OAAO,CAAC,qCAAqC;IAc7C,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,0BAA0B;YAgBpB,WAAW;IA+KzB,OAAO,CAAC,YAAY;IAuBpB,OAAO,CAAC,aAAa;IAmCrB,MAAM,CAAC,GAAG,EAAE,eAAe,EACvB,GAAG,EAAE,cAAc,wBAgtBtB;CAGJ"}

package/dist/src/dashboard/dashboard-server.js

@@ -11,45 +11,149 @@ const dashboard_errors_mapper_1 = __importDefault(require("./dashboard-errors-ma
 const dashboard_request_detail_mapper_1 = __importDefault(require("./dashboard-request-detail-mapper"));
 const dashboard_response_detail_mapper_1 = __importDefault(require("./dashboard-response-detail-mapper"));
 const logger_1 = require("../utils/logger");
+const allowed_ips_1 = require("../utils/allowed-ips");
+const helpers_1 = require("../utils/helpers");
+const rate_limiter_flexible_1 = require("rate-limiter-flexible");
 const sourceBuildDashboardDirectory = node_path_1.default.resolve(__dirname, "../../dist/dashboard");
 const dashboardDirectory = (0, node_fs_1.existsSync)(node_path_1.default.join(sourceBuildDashboardDirectory, "index.html"))
     ? sourceBuildDashboardDirectory
     : node_path_1.default.resolve(__dirname, "../../dashboard");
-const contentTypes = {
-    ".html": "text/html; charset=utf-8",
-    ".js": "text/javascript; charset=utf-8",
-    ".css": "text/css; charset=utf-8",
-    ".svg": "image/svg+xml",
-    ".woff2": "font/woff2",
-    ".json": "application/json; charset=utf-8",
-};
+class LoginBodyTooLargeError extends Error {
+    constructor() {
+        super("Dashboard login body exceeds the configured limit");
+        this.name = "LoginBodyTooLargeError";
+    }
+}
+class LoginBodyReadTimeoutError extends Error {
+    constructor() {
+        super("Dashboard login body read timed out");
+        this.name = "LoginBodyReadTimeoutError";
+    }
+}
+class LoginBodyClientDisconnectedError extends Error {
+    constructor() {
+        super("Dashboard login client disconnected");
+        this.name = "LoginBodyClientDisconnectedError";
+    }
+}
+class LoginBodyInvalidJsonError extends Error {
+    constructor() {
+        super("Dashboard login body is not valid JSON");
+        this.name = "LoginBodyInvalidJsonError";
+    }
+}
 class DashboardServer {
     storage;
     authService;
+    slowSpanThresholdMs;
+    allowedIPs;
     executionTreeBuilder = new execution_tree_builder_1.default();
     requestDetailMapper = new dashboard_request_detail_mapper_1.default();
     responseDetailMapper = new dashboard_response_detail_mapper_1.default();
     errorMapper = new dashboard_errors_mapper_1.default();
+    loginRateLimiter = new rate_limiter_flexible_1.RateLimiterMemory({
+        keyPrefix: "server-devtools-dashboard-login",
+        points: config_1.default.DASHBOARD_LOGIN_RATE_LIMIT.POINTS,
+        duration: config_1.default.DASHBOARD_LOGIN_RATE_LIMIT.DURATION_SECONDS,
+        blockDuration: config_1.default.DASHBOARD_LOGIN_RATE_LIMIT.BLOCK_SECONDS,
+    });
+    trackedLoginRateLimitKeys = new Map();
+    maxTrackedLoginRateLimitKeys = config_1.default.DASHBOARD_LOGIN_RATE_LIMIT.MAX_TRACKED_KEYS;
+    loginBodyReadTimeoutMs = config_1.default.DASHBOARD_LOGIN_BODY_READ_TIMEOUT_MS;
     // private server?: Server;
-    constructor(storage, authService) {
+    constructor(storage, authService, slowSpanThresholdMs = config_1.default.DEFAULT_SLOW_SPAN_THRESHOLD_MS, allowedIPs) {
         this.storage = storage;
         this.authService = authService;
+        this.slowSpanThresholdMs = slowSpanThresholdMs;
+        this.allowedIPs = allowedIPs;
+    }
+    sendIpForbidden(res) {
+        res.statusCode = 403;
+        res.setHeader("Content-Type", "application/json");
+        res.setHeader("Cache-Control", "no-store");
+        res.end(JSON.stringify({
+            message: "Forbidden",
+        }));
     }
-    readJsonBody(req) {
+    readJsonBody(req, maxBytes, timeoutMs) {
         return new Promise((resolve, reject) => {
-            let body = "";
-            req.on("data", (chunk) => {
-                body += chunk.toString();
-            });
-            req.on("end", () => {
+            const contentLengthHeader = req.headers["content-length"];
+            const contentLengthValue = Array.isArray(contentLengthHeader)
+                ? contentLengthHeader[0]
+                : contentLengthHeader;
+            const contentLength = contentLengthValue === undefined
+                ? undefined
+                : Number(contentLengthValue);
+            if (contentLength !== undefined &&
+                Number.isFinite(contentLength) &&
+                contentLength > maxBytes) {
+                req.resume();
+                reject(new LoginBodyTooLargeError());
+                return;
+            }
+            const chunks = [];
+            let bytes = 0;
+            let settled = false;
+            let timeout;
+            const cleanup = () => {
+                if (timeout) {
+                    clearTimeout(timeout);
+                    timeout = undefined;
+                }
+                req.off("data", onData);
+                req.off("end", onEnd);
+                req.off("error", onError);
+                req.off("aborted", onAborted);
+                req.off("close", onClose);
+            };
+            const fail = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                reject(error);
+            };
+            const onData = (chunk) => {
+                const buffer = Buffer.isBuffer(chunk)
+                    ? chunk
+                    : Buffer.from(chunk);
+                bytes += buffer.byteLength;
+                if (bytes > maxBytes) {
+                    fail(new LoginBodyTooLargeError());
+                    req.resume();
+                    return;
+                }
+                chunks.push(buffer);
+            };
+            const onEnd = () => {
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
                 try {
+                    const body = Buffer.concat(chunks).toString("utf8");
                     resolve(body ? JSON.parse(body) : {});
                 }
-                catch (error) {
-                    reject(error);
+                catch {
+                    reject(new LoginBodyInvalidJsonError());
                 }
-            });
-            req.on("error", reject);
+            };
+            const onError = () => fail(new LoginBodyClientDisconnectedError());
+            const onAborted = () => fail(new LoginBodyClientDisconnectedError());
+            const onClose = () => {
+                if (!settled) {
+                    fail(new LoginBodyClientDisconnectedError());
+                }
+            };
+            req.on("data", onData);
+            req.on("end", onEnd);
+            req.on("error", onError);
+            req.on("aborted", onAborted);
+            req.on("close", onClose);
+            timeout = setTimeout(() => {
+                fail(new LoginBodyReadTimeoutError());
+                req.resume();
+            }, timeoutMs);
         });
     }
     getCookie(req, name) {
@@ -60,7 +164,12 @@ class DashboardServer {
         for (const cookie of cookies) {
             const [key, ...valueParts] = cookie.trim().split("=");
             if (key === name) {
-                return decodeURIComponent(valueParts.join("="));
+                try {
+                    return decodeURIComponent(valueParts.join("="));
+                }
+                catch {
+                    return undefined;
+                }
             }
         }
         return undefined;
@@ -87,10 +196,114 @@ class DashboardServer {
         }));
         return;
     }
+    reclaimExpiredLoginRateLimitKeys(now) {
+        for (const [key, expiresAt] of this.trackedLoginRateLimitKeys) {
+            if (expiresAt <= now) {
+                this.trackedLoginRateLimitKeys.delete(key);
+            }
+        }
+    }
+    getLoginRateLimitCapacityRetryAfterMs(now) {
+        let earliestExpiry = Number.POSITIVE_INFINITY;
+        for (const expiresAt of this.trackedLoginRateLimitKeys.values()) {
+            earliestExpiry = Math.min(earliestExpiry, expiresAt);
+        }
+        if (!Number.isFinite(earliestExpiry)) {
+            return config_1.default.DASHBOARD_LOGIN_RATE_LIMIT.DURATION_SECONDS * 1000;
+        }
+        return Math.max(1, earliestExpiry - now);
+    }
+    trackLoginRateLimitKey(key, msBeforeNext, now = Date.now()) {
+        this.trackedLoginRateLimitKeys.set(key, now + Math.max(1, msBeforeNext));
+    }
+    sendLoginRateLimitResponse(res, msBeforeNext) {
+        res.statusCode = 429;
+        res.setHeader("Retry-After", Math.max(1, Math.ceil(msBeforeNext / 1000)));
+        res.setHeader("Content-Type", "application/json");
+        res.setHeader("Cache-Control", "no-store");
+        res.end(JSON.stringify({
+            message: "Too many login attempts",
+        }));
+    }
     async handleLogin(req, res) {
-        const body = await this.readJsonBody(req);
-        const username = body?.username || null;
-        const password = body?.password || null;
+        const rateLimitKey = (0, helpers_1.normalizeRemoteAddress)(req.socket.remoteAddress);
+        const now = Date.now();
+        this.reclaimExpiredLoginRateLimitKeys(now);
+        const wasTracked = this.trackedLoginRateLimitKeys.has(rateLimitKey);
+        if (!wasTracked) {
+            if (this.trackedLoginRateLimitKeys.size >= this.maxTrackedLoginRateLimitKeys) {
+                this.sendLoginRateLimitResponse(res, this.getLoginRateLimitCapacityRetryAfterMs(now));
+                return;
+            }
+            this.trackLoginRateLimitKey(rateLimitKey, config_1.default.DASHBOARD_LOGIN_RATE_LIMIT.DURATION_SECONDS * 1000, now);
+        }
+        try {
+            const consumeResult = await this.loginRateLimiter.consume(rateLimitKey);
+            this.trackLoginRateLimitKey(rateLimitKey, consumeResult.msBeforeNext);
+        }
+        catch (error) {
+            if (error instanceof rate_limiter_flexible_1.RateLimiterRes) {
+                this.trackLoginRateLimitKey(rateLimitKey, error.msBeforeNext);
+                this.sendLoginRateLimitResponse(res, error.msBeforeNext);
+                return;
+            }
+            if (!wasTracked) {
+                this.trackedLoginRateLimitKeys.delete(rateLimitKey);
+            }
+            (0, logger_1.debugLog)("Dashboard login rate-limit failed", {
+                errorName: error instanceof Error ? error.name : typeof error,
+            });
+            res.statusCode = 503;
+            res.setHeader("Content-Type", "application/json");
+            res.setHeader("Cache-Control", "no-store");
+            res.end(JSON.stringify({
+                message: "Unable to process login request",
+            }));
+            return;
+        }
+        let body;
+        try {
+            body = await this.readJsonBody(req, config_1.default.DASHBOARD_LOGIN_BODY_LIMIT_BYTES, this.loginBodyReadTimeoutMs);
+        }
+        catch (error) {
+            if (error instanceof LoginBodyTooLargeError) {
+                res.statusCode = 413;
+                res.setHeader("Content-Type", "application/json");
+                res.setHeader("Cache-Control", "no-store");
+                res.end(JSON.stringify({
+                    message: "Login request body is too large",
+                }));
+                return;
+            }
+            if (error instanceof LoginBodyReadTimeoutError) {
+                res.statusCode = 408;
+                res.setHeader("Content-Type", "application/json");
+                res.setHeader("Cache-Control", "no-store");
+                res.setHeader("Connection", "close");
+                res.end(JSON.stringify({
+                    message: "Login request timed out",
+                }), () => {
+                    req.destroy();
+                    res.socket?.destroy();
+                });
+                return;
+            }
+            if (error instanceof LoginBodyClientDisconnectedError) {
+                return;
+            }
+            if (error instanceof LoginBodyInvalidJsonError) {
+                res.statusCode = 400;
+                res.setHeader("Content-Type", "application/json");
+                res.setHeader("Cache-Control", "no-store");
+                res.end(JSON.stringify({
+                    message: "Login request body must be valid JSON",
+                }));
+                return;
+            }
+            throw error;
+        }
+        const username = typeof body?.username === "string" ? body.username : null;
+        const password = typeof body?.password === "string" ? body.password : null;
         if (!username || !password) {
             res.statusCode = 400;
             res.setHeader("Content-Type", "application/json");
@@ -121,6 +334,15 @@ class DashboardServer {
             res.end(JSON.stringify({ message: "Unable to create session" }));
             return;
         }
+        try {
+            const rewardResult = await this.loginRateLimiter.reward(rateLimitKey, 1);
+            this.trackLoginRateLimitKey(rateLimitKey, rewardResult.msBeforeNext);
+        }
+        catch (error) {
+            (0, logger_1.debugLog)("Dashboard login rate-limit refund failed", {
+                errorName: error instanceof Error ? error.name : typeof error,
+            });
+        }
         res.statusCode = 200;
         res.setHeader("Content-Type", "application/json");
         res.setHeader("Set-Cookie", `sdt_session=${token}; HttpOnly; SameSite=Strict; Path=/_devtools`);
@@ -172,6 +394,10 @@ class DashboardServer {
     handle(req, res) {
         const requestUrl = req.url ?? '';
         const pathname = requestUrl.split('?')[0];
+        if (!(0, allowed_ips_1.isRequestIpAllowed)(req.socket.remoteAddress, this.allowedIPs)) {
+            this.sendIpForbidden(res);
+            return;
+        }
         if (req.method === "POST" &&
             pathname === `${config_1.default.DASHBOARD_API_ROUTES.AUTH}/login`) {
             return this.handleLogin(req, res);
@@ -191,6 +417,16 @@ class DashboardServer {
             pathname === `${config_1.default.DASHBOARD_API_ROUTES.AUTH}/profile`) {
             return this.handleProfile(req, res);
         }
+        if (req.method === config_1.default.REQUEST_METHOD.GET &&
+            pathname === config_1.default.DASHBOARD_API_ROUTES.CONFIG) {
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "application/json");
+            res.setHeader("Cache-Control", "no-store");
+            res.end(JSON.stringify({
+                slowSpanThresholdMs: this.slowSpanThresholdMs,
+            }));
+            return;
+        }
         if (req.method === config_1.default.REQUEST_METHOD.DELETE &&
             pathname === config_1.default.DASHBOARD_API_ROUTES.TRACES) {
             try {
@@ -739,7 +975,7 @@ class DashboardServer {
                 }
                 const content = (0, node_fs_1.readFileSync)(filePath);
                 res.statusCode = 200;
-                res.setHeader("Content-Type", contentTypes[node_path_1.default.extname(filePath)] ?? "application/octet-stream");
+                res.setHeader("Content-Type", config_1.default.DASHBOARD_CONTENT_TYPES[node_path_1.default.extname(filePath)] ?? "application/octet-stream");
                 res.end(content);
                 return;
             }
@@ -748,7 +984,7 @@ class DashboardServer {
                     try {
                         const content = (0, node_fs_1.readFileSync)(node_path_1.default.join(dashboardDirectory, "index.html"));
                         res.statusCode = 200;
-                        res.setHeader("Content-Type", contentTypes[".html"]);
+                        res.setHeader("Content-Type", config_1.default.DASHBOARD_CONTENT_TYPES[".html"]);
                         res.end(content);
                         return;
                     }