typekro 0.44.0 → 0.45.0

package/dist/factories/traefik/utils/proxy-trust.js

@@ -0,0 +1,514 @@
+/**
+ * Which upstream sources a Traefik entrypoint believes.
+ */
+// Traefik trusts two things from an upstream: a PROXY protocol header
+// (`entryPoints.<name>.proxyProtocol`) and `X-Forwarded-*` headers
+// (`entryPoints.<name>.forwardedHeaders`). Both are scoped by `trustedIPs`, and
+// both have an `insecure` switch that trusts every source.
+//
+// Behind a load balancer the client address Traefik logs, rate-limits on and
+// passes upstream comes from whichever of these it trusts. A range with a `/0`
+// prefix (`0.0.0.0/0`, `::/0`) or `insecure: true` lets ANY client that reaches
+// the entrypoint write that address itself: send a forged PROXY header or
+// `X-Forwarded-For`, and the edge believes it. So both are refused unless the
+// caller opts in with the clearly named `dangerouslyTrustAnySource`.
+//
+// The check has two halves because the values may not be concrete:
+// - Direct mode runs the composition with concrete values, so
+//   `assertTraefikProxyTrust` inspects the final chart values in JavaScript.
+// - KRO mode sees schema references there, which carry no value to inspect.
+//   `traefikProxyTrustSchemaFieldValidations` turns the same rule into
+//   `x-kubernetes-validations` on the generated CRD, so the API server refuses
+//   an instance that asks for it.
+// Raw `values` and `additionalArguments` are build-time and concrete in both
+// modes, so the `insecure` half is always checked in JavaScript.
+//
+// Environment variables are a third route (`TRAEFIK_ENTRYPOINTS_<NAME>_...`).
+// Traefik reads them only when it has no CLI flags, and the chart always passes
+// flags, so today they are inert. The guard does not rely on that. It refuses
+// what it can see (a literal `insecure` or `/0` value) and also what it cannot:
+// a non-empty `envFrom`, which can load any variable from a Secret or
+// ConfigMap, and a trust variable whose value comes from `valueFrom` or a
+// schema reference. The chart reads `env` and `envFrom` only at the top level
+// of its values, for the Traefik container.
+//
+// A static configuration file is a fourth route, and it outranks the flags:
+// when Traefik finds one it loads the file and ignores every flag
+// (`pkg/cli/loader_file.go`). It looks at `--configFile`, then
+// `/etc/traefik/traefik`, `$XDG_CONFIG_HOME/traefik`, `$HOME/.config/traefik`
+// and `./traefik`, each with `.toml`, `.yaml` or `.yml`. The official image has
+// no WORKDIR and the pinned UID 65532 has no passwd entry, so the working
+// directory and HOME are `/` and XDG_CONFIG_HOME is unset (it expands to an
+// empty string). The guard refuses `--configFile` and any raw-values mount at,
+// or above, one of those files, since it cannot see what the file says.
+//
+// Raw `values` are trusted input. The guard catches misconfiguration, not
+// deliberate YAML injection through raw values.
+import { TypeKroError } from '../../../core/errors.js';
+import { Cel } from '../../../core/references/cel.js';
+import { KUBERNETES_REF_MARKER_SOURCE } from '../../../shared/brands.js';
+import { isCelExpression, isKubernetesRef } from '../../../utils/type-guards.js';
+import { parseTraefikTrustedRange, traefikEffectiveTrustedPrefix, traefikTrustedRangeCel, } from './trusted-range.js';
+/**
+ * Admission rule on each KRO-mode `trustedIPs` list: every entry in the strict
+ * format and not `/0`.
+ *
+ * The API server estimates a CEL rule's cost from the schema, so the list
+ * carries `maxItems=64` and its items `maxLength=43` (through a SimpleSchema
+ * custom type); without those bounds `matches()` would exceed the CRD budget.
+ * The rendered values also keep only entries in the strict format (see
+ * `traefikStrictTrustedIPs`), as a second line of defence.
+ */
+export const TRAEFIK_TRUSTED_IPS_VALIDATION_RULE = `self.all(range, ${traefikTrustedRangeCel('range')})`;
+// Runtime spec paths that carry a `trustedIPs` list, for the KRO-mode rule.
+const TRUSTED_IP_SPEC_PATHS = [
+    'entrypoints.web.proxyProtocol.trustedIPs',
+    'entrypoints.web.forwardedHeaders.trustedIPs',
+    'entrypoints.websecure.proxyProtocol.trustedIPs',
+    'entrypoints.websecure.forwardedHeaders.trustedIPs',
+];
+// A flag argument: one or two dashes, the name, and an optional `=value`.
+// `[\s\S]` so a newline in the value can't end the match early.
+const FLAG_ARGUMENT = /^--?([^=]+)(?:=([\s\S]*))?$/;
+// Flag names, matched lowercase (Traefik's flag parser is case-insensitive).
+const INSECURE_FLAG = /^entrypoints\.[^.]+\.(proxyprotocol|forwardedheaders)\.insecure$/;
+const TRUSTED_IPS_FLAG = /^entrypoints\.[^.]+\.(proxyprotocol|forwardedheaders)\.trustedips(\[[0-9]+\])?$/;
+// Any flag under an entrypoint's proxyProtocol or forwardedHeaders.
+const TRUST_FLAG = /^entrypoints\.[^.]+\.(proxyprotocol|forwardedheaders)\./;
+// The values Go's `strconv.ParseBool` reads as false. Anything else on an
+// `insecure` flag or variable either turns it on or makes it unreadable.
+const FALSE_VALUE = /^(0|f|F|false|FALSE|False)$/;
+// Control characters, newlines included. Traefik trims list items, so
+// `'0.0.0.0/0\n'` is `/0`; values carrying one are refused outright.
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code < 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+// The same settings through Traefik's environment-variable configuration.
+// Traefik matches variable names case-insensitively.
+const INSECURE_ENV = /^TRAEFIK_ENTRYPOINTS_.+_(PROXYPROTOCOL|FORWARDEDHEADERS)_INSECURE$/i;
+const TRUSTED_IPS_ENV = /^TRAEFIK_ENTRYPOINTS_.+_(PROXYPROTOCOL|FORWARDEDHEADERS)_TRUSTEDIPS(_[0-9]+)?$/i;
+// Any variable under an entrypoint's proxyProtocol or forwardedHeaders: the
+// names whose value must be visible for the guard to vouch for it.
+const TRUST_ENV = /^TRAEFIK_ENTRYPOINTS_.+_(PROXYPROTOCOL|FORWARDEDHEADERS)_/i;
+const CONFIG_FILE_EXTENSIONS = ['toml', 'yaml', 'yml'];
+const CONFIG_FILE_FIX = 'Traefik would load its static configuration from that file in place of its flags, and ' +
+    'TypeKro cannot see what the file says. Mount files elsewhere.';
+const HIDDEN_VALUE_FIX = 'TypeKro cannot see that value, so it cannot rule out trusting every source.';
+/**
+ * The problem with one `trustedIPs` entry, or `undefined` when it is a valid,
+ * non-`/0` range. `where` names the setting in the message.
+ */
+function rangeIssue(where, range) {
+    const parsed = parseTraefikTrustedRange(range);
+    if (parsed && parsed.prefix > 0)
+        return undefined;
+    // Name trust-all first: `/00`, an IPv4-mapped `/96` and a `/0` hidden in a
+    // comma-joined entry all end up trusting every source.
+    const trustsAll = range
+        .split(',')
+        .some((piece) => traefikEffectiveTrustedPrefix(piece)?.prefix === 0);
+    if (parsed || trustsAll)
+        return `${where} contains ${JSON.stringify(range)}, which trusts every source.`;
+    return (`${where} contains ${JSON.stringify(range)}, which is not one IP address or CIDR range ` +
+        'in the strict format: no spaces, commas, leading zeros or IPv4-mapped addresses, and a ' +
+        'prefix of at most 32 (IPv4) or 128 (IPv6).');
+}
+/** Issues for a comma-separated list of ranges, as env values and flags carry them. */
+function rangeListIssues(where, list) {
+    if (hasControlCharacter(list)) {
+        return [
+            `${where} contains a control character such as a newline. Traefik trims list items, ` +
+                'so it would read the value differently from what the guard checks.',
+        ];
+    }
+    if (list.includes('$(')) {
+        return [`${where} uses a $(VAR) reference, which Kubernetes expands. ${HIDDEN_VALUE_FIX}`];
+    }
+    // Traefik splits the list on "," and trims each item.
+    return list
+        .split(',')
+        .map((piece) => rangeIssue(where, piece.trim()))
+        .filter((issue) => issue !== undefined);
+}
+function isConcrete(value) {
+    return !isKubernetesRef(value) && !isCelExpression(value);
+}
+const REF_MARKER = new RegExp(KUBERNETES_REF_MARKER_SOURCE);
+/** A plain string, not one carrying a serialized reference marker. */
+function isLiteralString(value) {
+    return typeof value === 'string' && !REF_MARKER.test(value);
+}
+/**
+ * Problems with the proxy trust in final chart values; empty when there are none.
+ *
+ * Schema references under `ports` are skipped: KRO mode checks those on the
+ * CRD. In `env` and `envFrom` nothing on the CRD checks them, so a value the
+ * guard cannot see counts as a problem.
+ */
+export function traefikProxyTrustIssues(values) {
+    const issues = [];
+    const ports = values.ports;
+    if (ports && isConcrete(ports)) {
+        for (const [name, port] of Object.entries(ports)) {
+            if (!port || !isConcrete(port))
+                continue;
+            for (const field of ['proxyProtocol', 'forwardedHeaders']) {
+                issues.push(...portTrustIssues(`ports.${name}.${field}`, port[field]));
+            }
+        }
+    }
+    issues.push(...envIssues(values));
+    issues.push(...argumentIssues(values.additionalArguments));
+    issues.push(...staticConfigIssues(values));
+    return issues;
+}
+/** Proxy-trust problems in one raw `ports.<name>.proxyProtocol` / `forwardedHeaders` block. */
+function portTrustIssues(where, trust) {
+    if (trust === undefined || trust === null || !isConcrete(trust))
+        return [];
+    if (!isLiteralRecord(trust)) {
+        return [`${where} is not an object, so the guard cannot read its trust settings.`];
+    }
+    const issues = [];
+    // The chart tests `insecure` with Go template truthiness, so 'false', 1 or
+    // 'yes' all switch it on. Only an absent value or boolean false is safe.
+    const insecure = trust.insecure;
+    if (insecure !== undefined && insecure !== null && insecure !== false && isConcrete(insecure)) {
+        issues.push(`${where}.insecure is ${JSON.stringify(insecure)}, which trusts every source.`);
+    }
+    const ranges = trust.trustedIPs;
+    if (ranges === undefined || ranges === null || !isConcrete(ranges))
+        return issues;
+    // The chart joins the list with ","; a string is joined as one element.
+    const entries = Array.isArray(ranges) ? ranges : [ranges];
+    for (const range of entries) {
+        if (!isConcrete(range))
+            continue;
+        // Each entry must be one range on its own, so an entry carrying a comma
+        // (which the join would split into more ranges) is refused too.
+        const issue = typeof range === 'string'
+            ? rangeIssue(`${where}.trustedIPs`, range)
+            : `${where}.trustedIPs contains ${JSON.stringify(range)}, which is not a range.`;
+        if (issue)
+            issues.push(issue);
+    }
+    return issues;
+}
+/** Proxy-trust problems in `additionalArguments`. */
+function argumentIssues(args) {
+    const issues = [];
+    if (args === undefined || args === null)
+        return issues;
+    if (!Array.isArray(args) || !isConcrete(args)) {
+        issues.push(`additionalArguments is not a literal list. ${HIDDEN_VALUE_FIX}`);
+        return issues;
+    }
+    args.forEach((arg, index) => {
+        if (!isConcrete(arg) || (typeof arg === 'string' && !isLiteralString(arg))) {
+            issues.push(`additionalArguments[${index}] is not a literal string. ${HIDDEN_VALUE_FIX}`);
+            return;
+        }
+        if (typeof arg !== 'string')
+            return;
+        // Traefik trims list values, and a newline would end a single-line match.
+        if (hasControlCharacter(arg)) {
+            issues.push(`additionalArguments[${index}] contains a control character such as a newline. ` +
+                'Traefik would read it differently from what the guard checks.');
+            return;
+        }
+        const flagMatch = FLAG_ARGUMENT.exec(arg);
+        // Kubernetes expands $(VAR) in container arguments, so an argument that
+        // uses one outside a flag's value could become any flag.
+        if (!flagMatch || flagMatch[1]?.includes('$(')) {
+            if (arg.includes('$(')) {
+                issues.push(`additionalArguments[${index}] uses a $(VAR) reference, which Kubernetes expands. ${HIDDEN_VALUE_FIX}`);
+            }
+            return;
+        }
+        const flag = `--${flagMatch[1] ?? ''}`;
+        const name = (flagMatch[1] ?? '').toLowerCase();
+        const value = flagMatch[2];
+        if (TRUST_FLAG.test(name) && arg.includes('$(')) {
+            issues.push(`additionalArguments sets ${flag} from a $(VAR) reference, which Kubernetes expands. ${HIDDEN_VALUE_FIX}`);
+            return;
+        }
+        if (INSECURE_FLAG.test(name)) {
+            // Bare, true, or anything Go would not read as false.
+            if (value === undefined || !FALSE_VALUE.test(value)) {
+                issues.push(`additionalArguments contains ${arg}, which trusts every source.`);
+            }
+            return;
+        }
+        if (name === 'configfile') {
+            issues.push(`additionalArguments contains ${flag}. ${CONFIG_FILE_FIX}`);
+            return;
+        }
+        if (!TRUSTED_IPS_FLAG.test(name))
+            return;
+        const next = args[index + 1];
+        const ranges = value ?? (typeof next === 'string' ? next : '');
+        issues.push(...rangeListIssues(`additionalArguments ${flag}`, ranges));
+    });
+    return issues;
+}
+/** An absolute path with `.`, `..` and repeated slashes resolved; relative paths start at `/`. */
+function normalizePath(path) {
+    const parts = [];
+    for (const part of path.trim().split('/')) {
+        if (part === '' || part === '.')
+            continue;
+        if (part === '..')
+            parts.pop();
+        else
+            parts.push(part);
+    }
+    return `/${parts.join('/')}`;
+}
+/** Whether a mount at `mountPath` would cover `file`: the same path or a parent of it. */
+function covers(mountPath, file) {
+    return file === mountPath || file.startsWith(mountPath === '/' ? '/' : `${mountPath}/`);
+}
+/**
+ * The files Traefik would read its static configuration from, given the
+ * container's HOME and XDG_CONFIG_HOME (see the module comment for the defaults).
+ */
+function staticConfigFiles(home, xdgConfigHome) {
+    const bases = [
+        '/etc/traefik/traefik',
+        `${xdgConfigHome}/traefik`,
+        `${home}/.config/traefik`,
+        '/traefik',
+    ];
+    return bases.flatMap((base) => CONFIG_FILE_EXTENSIONS.map((extension) => normalizePath(`${base}.${extension}`)));
+}
+/** Static-configuration-file problems: raw mounts over the files Traefik searches. */
+function staticConfigIssues(values) {
+    const issues = [];
+    // A literal HOME or XDG_CONFIG_HOME moves the search; one from a reference
+    // hides it. A non-literal `env` list is already reported by `envIssues`.
+    const location = { HOME: '/', XDG_CONFIG_HOME: '' };
+    const env = values.env;
+    if (Array.isArray(env) && isConcrete(env)) {
+        for (const entry of env) {
+            if (!isLiteralRecord(entry))
+                continue;
+            const name = entry.name;
+            if (name !== 'HOME' && name !== 'XDG_CONFIG_HOME')
+                continue;
+            // Kubernetes expands $(VAR) in env values, so one would hide the path.
+            if (isLiteralString(entry.value) &&
+                entry.valueFrom === undefined &&
+                !entry.value.includes('$(') &&
+                !hasControlCharacter(entry.value)) {
+                location[name] = entry.value;
+            }
+            else {
+                issues.push(`env ${name} takes its value from a reference or a $(VAR) expansion, so TypeKro ` +
+                    'cannot see where Traefik ' +
+                    'looks for a static configuration file.');
+            }
+        }
+    }
+    const files = staticConfigFiles(location.HOME, location.XDG_CONFIG_HOME);
+    const checkPath = (where, path) => {
+        if (path === undefined || path === null)
+            return;
+        // The chart runs `additionalVolumeMounts` through `tpl`, so `{{ }}` is
+        // evaluated at render time.
+        if (!isLiteralString(path) || path.includes('{{')) {
+            issues.push(`${where} is not a literal path. ${CONFIG_FILE_FIX}`);
+            return;
+        }
+        const mountPath = normalizePath(path);
+        const file = files.find((candidate) => covers(mountPath, candidate));
+        if (file)
+            issues.push(`${where} mounts ${path} over ${file}. ${CONFIG_FILE_FIX}`);
+    };
+    const checkList = (where, list) => {
+        if (list === undefined || list === null)
+            return;
+        if (!Array.isArray(list) || !isConcrete(list)) {
+            issues.push(`${where} is not a literal list. ${CONFIG_FILE_FIX}`);
+            return;
+        }
+        list.forEach((entry, index) => {
+            if (entry === undefined || entry === null)
+                return;
+            checkPath(`${where}[${index}].mountPath`, isLiteralRecord(entry) ? entry.mountPath : entry);
+        });
+    };
+    const checkSection = (where, section, field) => {
+        if (section === undefined || section === null)
+            return;
+        if (!isLiteralRecord(section)) {
+            issues.push(`${where} is not a literal object. ${CONFIG_FILE_FIX}`);
+            return;
+        }
+        checkPath(`${where}.${field}`, section[field]);
+    };
+    // Every raw-values mount the chart adds to the Traefik container.
+    // `deployment.additionalVolumes` only declares volumes; they are mounted
+    // through `additionalVolumeMounts` or a `localPath` local plugin.
+    checkList('additionalVolumeMounts', values.additionalVolumeMounts);
+    checkList('volumes', values.volumes);
+    checkSection('persistence', values.persistence, 'path');
+    checkSection('hub', values.hub, 'tokenMountPath');
+    const experimental = values.experimental;
+    if (experimental !== undefined && experimental !== null) {
+        if (!isLiteralRecord(experimental)) {
+            issues.push(`experimental is not a literal object. ${CONFIG_FILE_FIX}`);
+        }
+        else {
+            const localPlugins = experimental.localPlugins;
+            if (localPlugins !== undefined && localPlugins !== null && !isLiteralRecord(localPlugins)) {
+                issues.push(`experimental.localPlugins is not a literal object. ${CONFIG_FILE_FIX}`);
+            }
+            else if (localPlugins) {
+                for (const [name, plugin] of Object.entries(localPlugins)) {
+                    if (plugin === undefined || plugin === null)
+                        continue;
+                    checkPath(`experimental.localPlugins.${name}.mountPath`, isLiteralRecord(plugin) ? plugin.mountPath : plugin);
+                }
+            }
+        }
+    }
+    return issues;
+}
+/** A concrete object, as opposed to a schema reference or CEL expression. */
+function isLiteralRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) && isConcrete(value);
+}
+/** Proxy-trust problems in the Traefik container's `env` and `envFrom`. */
+function envIssues(values) {
+    const issues = [];
+    const envFrom = values.envFrom;
+    if (envFrom !== undefined &&
+        envFrom !== null &&
+        !(Array.isArray(envFrom) && envFrom.length === 0)) {
+        issues.push('envFrom can load TRAEFIK_ENTRYPOINTS_* variables from a Secret or ConfigMap. ' +
+            `${HIDDEN_VALUE_FIX} Pass other variables as individual \`env\` entries, where \`valueFrom\` is fine.`);
+    }
+    const env = values.env;
+    if (env === undefined || env === null)
+        return issues;
+    if (!Array.isArray(env) || !isConcrete(env)) {
+        issues.push(`env is not a literal list, so its variable names are unknown. ${HIDDEN_VALUE_FIX}`);
+        return issues;
+    }
+    for (const entry of env) {
+        if (entry === undefined || entry === null)
+            continue;
+        const name = isLiteralRecord(entry) ? entry.name : undefined;
+        if (!isLiteralRecord(entry) || typeof name !== 'string') {
+            issues.push(`env has an entry whose name is not a literal string. ${HIDDEN_VALUE_FIX}`);
+            continue;
+        }
+        if (!TRUST_ENV.test(name))
+            continue;
+        const { value, valueFrom } = entry;
+        if (valueFrom !== undefined || (value !== undefined && !isLiteralString(value))) {
+            issues.push(`env ${name} takes its value from a reference. ${HIDDEN_VALUE_FIX}`);
+            continue;
+        }
+        if (typeof value !== 'string')
+            continue;
+        if (hasControlCharacter(value)) {
+            issues.push(`env ${name} contains a control character such as a newline. ${HIDDEN_VALUE_FIX}`);
+        }
+        else if (value.includes('$(')) {
+            issues.push(`env ${name} uses a $(VAR) reference, which Kubernetes expands. ${HIDDEN_VALUE_FIX}`);
+        }
+        else if (INSECURE_ENV.test(name) && !FALSE_VALUE.test(value)) {
+            issues.push(`env ${name}=${value} trusts every source.`);
+        }
+        else if (TRUSTED_IPS_ENV.test(name)) {
+            issues.push(...rangeListIssues(`env ${name}`, value));
+        }
+    }
+    return issues;
+}
+/**
+ * Throw when final chart values trust every source for PROXY protocol or forwarded headers,
+ * or carry trust settings whose value TypeKro cannot see.
+ *
+ * @throws {TypeKroError} With code `TRAEFIK_UNTRUSTED_PROXY_SOURCE`.
+ */
+export function assertTraefikProxyTrust(values) {
+    const issues = traefikProxyTrustIssues(values);
+    if (issues.length === 0)
+        return;
+    throw new TypeKroError(`Traefik could trust any client to set its own source address: ${issues.join(' ')} ` +
+        'Set the trust through the typed `entrypoints.<name>.proxyProtocol` / `forwardedHeaders` ' +
+        'options instead, listing the load balancer or proxy ranges (for an AWS NLB with IP ' +
+        "targets, the NLB's subnet CIDRs). If trusting any source is intended, pass " +
+        '`dangerouslyTrustAnySource: true` to makeTraefikBootstrap, and only for a Traefik that no ' +
+        'client can reach directly.', 'TRAEFIK_UNTRUSTED_PROXY_SOURCE', { issues });
+}
+/**
+ * Warnings for trusted ranges that are legal but very broad: an IPv4 prefix
+ * shorter than /8 or an IPv6 prefix shorter than /16.
+ */
+export function traefikBroadTrustWarnings(values) {
+    const warnings = [];
+    const ports = values.ports;
+    if (!ports || !isConcrete(ports))
+        return warnings;
+    for (const [name, port] of Object.entries(ports)) {
+        if (!port || !isConcrete(port))
+            continue;
+        for (const field of ['proxyProtocol', 'forwardedHeaders']) {
+            const trustedIPs = port[field]?.trustedIPs;
+            if (trustedIPs === undefined || trustedIPs === null || !isConcrete(trustedIPs))
+                continue;
+            const ranges = Array.isArray(trustedIPs) ? trustedIPs : [trustedIPs];
+            for (const entry of ranges) {
+                if (typeof entry !== 'string')
+                    continue;
+                // Read the way Go does: an IPv4-mapped `/96` is IPv4 `/0`.
+                for (const range of entry.split(',')) {
+                    const effective = traefikEffectiveTrustedPrefix(range);
+                    if (!effective)
+                        continue;
+                    const where = `ports.${name}.${field}.trustedIPs contains ${range.trim()}`;
+                    if (effective.prefix === 0) {
+                        warnings.push(`${where}, which trusts every source.`);
+                    }
+                    else if (effective.prefix < (effective.family === 6 ? 16 : 8)) {
+                        warnings.push(`${where}, which trusts a very large address range. List the load balancer or proxy ranges instead.`);
+                    }
+                }
+            }
+        }
+    }
+    return warnings;
+}
+/** `schemaFieldValidations` refusing `/0` trusted ranges on a KRO instance. */
+export function traefikProxyTrustSchemaFieldValidations() {
+    return Object.fromEntries(TRUSTED_IP_SPEC_PATHS.map((path) => [path, TRAEFIK_TRUSTED_IPS_VALIDATION_RULE]));
+}
+/**
+ * A `trustedIPs` value for the chart, holding a KRO schema reference to the
+ * entries that pass the strict format.
+ *
+ * Direct mode sees concrete lists, which the guard checks whole. In KRO mode
+ * the CRD refuses the same entries at admission; this filter is the second
+ * line of defence, keeping only entries that are one valid range (and, unless
+ * `allowAnySource`, not `/0`). A dropped entry narrows trust; it never widens it.
+ */
+export function traefikStrictTrustedIPs(ranges, allowAnySource) {
+    if (!isKubernetesRef(ranges) || ranges.resourceId !== '__schema__')
+        return ranges;
+    const path = `schema.${ranges.fieldPath}`;
+    const segments = path.split('.');
+    // `has()` on every optional level, as serialization does for a bare reference.
+    const guards = segments
+        .slice(2)
+        .map((_, index) => `has(${segments.slice(0, index + 3).join('.')})`);
+    return Cel.expr(`${guards.join(' && ')} ? `, ranges, `.filter(range, ${traefikTrustedRangeCel('range', allowAnySource)}) : omit()`);
+}
+//# sourceMappingURL=proxy-trust.js.map

package/dist/factories/traefik/utils/proxy-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-trust.js","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/proxy-trust.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,sEAAsE;AACtE,mEAAmE;AACnE,gFAAgF;AAChF,2DAA2D;AAC3D,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,mEAAmE;AACnE,8DAA8D;AAC9D,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,+EAA+E;AAC/E,kCAAkC;AAClC,6EAA6E;AAC7E,iEAAiE;AACjE,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,sEAAsE;AACtE,0EAA0E;AAC1E,8EAA8E;AAC9E,4CAA4C;AAC5C,EAAE;AACF,4EAA4E;AAC5E,kEAAkE;AAClE,+DAA+D;AAC/D,8EAA8E;AAC9E,gFAAgF;AAChF,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,gDAAgD;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEjF,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,mBAAmB,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC;AAEzG,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG;IAC5B,0CAA0C;IAC1C,6CAA6C;IAC7C,gDAAgD;IAChD,mDAAmD;CAC3C,CAAC;AAEX,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,6EAA6E;AAC7E,MAAM,aAAa,GAAG,kEAAkE,CAAC;AACzF,MAAM,gBAAgB,GACpB,iFAAiF,CAAC;AACpF,oEAAoE;AACpE,MAAM,UAAU,GAAG,yDAAyD,CAAC;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,sEAAsE;AACtE,qEAAqE;AACrE,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,0EAA0E;AAC1E,qDAAqD;AACrD,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAC3F,MAAM,eAAe,GACnB,iFAAiF,CAAC;AACpF,4EAA4E;AAC5E,mEAAmE;AACnE,MAAM,SAAS,GAAG,4DAA4D,CAAC;AAE/E,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAChE,MAAM,eAAe,GACnB,wFAAwF;IACxF,+DAA+D,CAAC;AAElE,MAAM,gBAAgB,GACpB,6EAA6E,CAAC;AAEhF;;;GAGG;AACH,SAAS,UAAU,CAAC,KAAa,EAAE,KAAa;IAC9C,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,SAAS,GAAG,KAAK;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,IAAI,SAAS;QACrB,OAAO,GAAG,KAAK,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,8BAA8B,CAAC;IAClF,OAAO,CACL,GAAG,KAAK,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,8CAA8C;QACxF,yFAAyF;QACzF,4CAA4C,CAC7C,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,GAAG,KAAK,6EAA6E;gBACnF,oEAAoE;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,KAAK,uDAAuD,gBAAgB,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,sDAAsD;IACtD,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/C,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE5D,sEAAsE;AACtE,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB;IAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YACzC,KAAK,MAAM,KAAK,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAU,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+FAA+F;AAC/F,SAAS,eAAe,CAAC,KAAa,EAAE,KAAc;IACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,KAAK,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,gBAAgB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAClF,wEAAwE;IACxE,MAAM,OAAO,GAAc,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACjC,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,KAAK,GACT,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,aAAa,EAAE,KAAK,CAAC;YAC1C,CAAC,CAAC,GAAG,KAAK,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,yBAAyB,CAAC;QACrF,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qDAAqD;AACrD,SAAS,cAAc,CAAC,IAAa;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,8CAA8C,gBAAgB,EAAE,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,CAAC,GAAY,EAAE,KAAK,EAAE,EAAE;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,8BAA8B,gBAAgB,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QACpC,0EAA0E;QAC1E,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CACT,uBAAuB,KAAK,oDAAoD;gBAC9E,+DAA+D,CAClE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,wEAAwE;QACxE,yDAAyD;QACzD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CACT,uBAAuB,KAAK,wDAAwD,gBAAgB,EAAE,CACvG,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CACT,4BAA4B,IAAI,uDAAuD,gBAAgB,EAAE,CAC1G,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,sDAAsD;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,8BAA8B,CAAC,CAAC;YACjF,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,gCAAgC,IAAI,KAAK,eAAe,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QACzC,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,uBAAuB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC1C,IAAI,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,EAAE,CAAC;;YAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,0FAA0F;AAC1F,SAAS,MAAM,CAAC,SAAiB,EAAE,IAAY;IAC7C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,aAAqB;IAC5D,MAAM,KAAK,GAAG;QACZ,sBAAsB;QACtB,GAAG,aAAa,UAAU;QAC1B,GAAG,IAAI,kBAAkB;QACzB,UAAU;KACX,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5B,sBAAsB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,kBAAkB,CAAC,MAAyB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACpD,MAAM,GAAG,GAAY,MAAM,CAAC,GAAG,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,iBAAiB;gBAAE,SAAS;YAC5D,uEAAuE;YACvE,IACE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC5B,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC3B,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,OAAO,IAAI,sEAAsE;oBAC/E,2BAA2B;oBAC3B,wCAAwC,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAEzE,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,IAAa,EAAQ,EAAE;QACvD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QAChD,uEAAuE;QACvE,4BAA4B;QAC5B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,2BAA2B,eAAe,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACrE,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,IAAI,SAAS,IAAI,KAAK,eAAe,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,IAAa,EAAQ,EAAE;QACvD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,2BAA2B,eAAe,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,CAAC,KAAc,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO;YAClD,SAAS,CAAC,GAAG,KAAK,IAAI,KAAK,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,OAAgB,EAAE,KAAa,EAAQ,EAAE;QAC5E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO;QACtD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,6BAA6B,eAAe,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,SAAS,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC;IAEF,kEAAkE;IAClE,yEAAyE;IACzE,kEAAkE;IAClE,SAAS,CAAC,wBAAwB,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACnE,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACxD,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAClD,MAAM,YAAY,GAAY,MAAM,CAAC,YAAY,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,yCAAyC,eAAe,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;YAC/C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC,sDAAsD,eAAe,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,IAAI,YAAY,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC1D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;wBAAE,SAAS;oBACtD,SAAS,CACP,6BAA6B,IAAI,YAAY,EAC7C,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CACpD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,MAAyB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAY,MAAM,CAAC,OAAO,CAAC;IACxC,IACE,OAAO,KAAK,SAAS;QACrB,OAAO,KAAK,IAAI;QAChB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EACjD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,+EAA+E;YAC7E,GAAG,gBAAgB,mFAAmF,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAY,MAAM,CAAC,GAAG,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,iEAAiE,gBAAgB,EAAE,CACpF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,wDAAwD,gBAAgB,EAAE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,sCAAsC,gBAAgB,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CACT,OAAO,IAAI,oDAAoD,gBAAgB,EAAE,CAClF,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACT,OAAO,IAAI,uDAAuD,gBAAgB,EAAE,CACrF,CAAC;QACJ,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,uBAAuB,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB;IAC/D,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,IAAI,YAAY,CACpB,iEAAiE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAClF,0FAA0F;QAC1F,qFAAqF;QACrF,6EAA6E;QAC7E,4FAA4F;QAC5F,4BAA4B,EAC9B,gCAAgC,EAChC,EAAE,MAAM,EAAE,CACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAyB;IACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACzC,KAAK,MAAM,KAAK,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAU,EAAE,CAAC;YACnE,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;YACpD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,SAAS;YACzF,MAAM,MAAM,GAAc,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAChF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACxC,2DAA2D;gBAC3D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrC,MAAM,SAAS,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;oBACvD,IAAI,CAAC,SAAS;wBAAE,SAAS;oBACzB,MAAM,KAAK,GAAG,SAAS,IAAI,IAAI,KAAK,wBAAwB,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;oBACxD,CAAC;yBAAM,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAChE,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,4FAA4F,CACrG,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uCAAuC;IACrD,OAAO,MAAM,CAAC,WAAW,CACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC,CACjF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAI,MAAS,EAAE,cAAuB;IAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IAClF,MAAM,IAAI,GAAG,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,+EAA+E;IAC/E,MAAM,MAAM,GAAG,QAAQ;SACpB,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC,IAAI,CACb,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAC3B,MAAM,EACN,kBAAkB,sBAAsB,CAAC,OAAO,EAAE,cAAc,CAAC,YAAY,CAC9E,CAAC;AACJ,CAAC"}

package/dist/factories/traefik/utils/trusted-range.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The strict format TypeKro accepts for a Traefik `trustedIPs` entry.
+ */
+/** One IPv4 or IPv6 address or CIDR range, with a prefix of 0-32 or 0-128 and no leading zeros. */
+export declare const TRAEFIK_TRUSTED_RANGE_PATTERN: string;
+/** An IPv4-mapped IPv6 address (`::ffff:a.b.c.d`, `::ffff:0:0`, ...), which is refused outright. */
+export declare const TRAEFIK_IPV4_MAPPED_PATTERN = "^[0:]*:[fF]{4}:";
+/** Longest valid entry: a full IPv6 address and `/128`. */
+export declare const TRAEFIK_TRUSTED_RANGE_MAX_LENGTH = 43;
+/** A trusted range in the strict format. */
+export interface TraefikTrustedRange {
+    readonly family: 4 | 6;
+    /** The prefix length; a bare address counts as `/32` or `/128`. */
+    readonly prefix: number;
+}
+/** Parse one `trustedIPs` entry, or `undefined` when it is not in the strict format. */
+export declare function parseTraefikTrustedRange(value: string): TraefikTrustedRange | undefined;
+/**
+ * The prefix Go would effectively apply to an entry, read leniently: leading
+ * zeros allowed, and an IPv4-mapped `/n` counted as IPv4 `/(n-96)` (or `/0`
+ * below 96). For warnings about entries the strict format may not cover.
+ */
+export declare function traefikEffectiveTrustedPrefix(value: string): TraefikTrustedRange | undefined;
+/**
+ * A CEL predicate over the string variable `name` that holds when it is in the
+ * strict format and, unless `allowAnySource`, is not a `/0` range.
+ */
+export declare function traefikTrustedRangeCel(name: string, allowAnySource?: boolean): string;
+//# sourceMappingURL=trusted-range.d.ts.map

package/dist/factories/traefik/utils/trusted-range.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-range.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/utils/trusted-range.ts"],"names":[],"mappings":"AAAA;;GAEG;AAkCH,mGAAmG;AACnG,eAAO,MAAM,6BAA6B,QAA8D,CAAC;AACzG,oGAAoG;AACpG,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAC7D,2DAA2D;AAC3D,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAKnD,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAKvF;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAW5F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,UAAQ,GAAG,MAAM,CAMnF"}

package/dist/factories/traefik/utils/trusted-range.js

@@ -0,0 +1,80 @@
+/**
+ * The strict format TypeKro accepts for a Traefik `trustedIPs` entry.
+ */
+// Traefik parses each entry with Go's `net.ParseCIDR`, falling back to
+// `net.ParseIP`. Go is more lenient than its output suggests:
+// - `0.0.0.0/00` and `::/00` parse, with leading zeros, as `/0`.
+// - `::ffff:0.0.0.0/96` (and `::ffff:0:0/96`) is an IPv4-mapped network. Go
+//   matches IPv4 clients against its last 32 bits, so `/96` is IPv4 `/0`.
+// - The chart joins a list with "," and Traefik splits and trims it again, so
+//   `'0.0.0.0/0,10.0.0.0/8'` or `'0.0.0.0/0 '` in one entry still trusts all.
+// So a suffix test on the text is not enough. An entry must be exactly one
+// IPv4 or IPv6 address, optionally with a decimal prefix without leading
+// zeros (0-32 or 0-128), with no spaces, commas, zone or embedded IPv4, and no
+// IPv4-mapped address at all. A `/0` prefix passes the format; refusing it is
+// the proxy-trust guard's job, which `dangerouslyTrustAnySource` turns off.
+//
+// The patterns use only RE2 syntax (no lookaround, no backslashes), so the same
+// strings work in JavaScript, in CEL `matches()` and in a Kubernetes `pattern`.
+const HEX = '[0-9a-fA-F]{1,4}';
+const OCTET = '(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])';
+const IPV4 = `${OCTET}([.]${OCTET}){3}`;
+const IPV6 = [
+    `(${HEX}:){7}${HEX}`,
+    `(${HEX}:){1,7}:`,
+    `(${HEX}:){1,6}:${HEX}`,
+    `(${HEX}:){1,5}(:${HEX}){1,2}`,
+    `(${HEX}:){1,4}(:${HEX}){1,3}`,
+    `(${HEX}:){1,3}(:${HEX}){1,4}`,
+    `(${HEX}:){1,2}(:${HEX}){1,5}`,
+    `${HEX}:(:${HEX}){1,6}`,
+    `:((:${HEX}){1,7}|:)`,
+].join('|');
+const IPV4_PREFIX = '(3[0-2]|[12][0-9]|[0-9])';
+const IPV6_PREFIX = '(12[0-8]|1[01][0-9]|[1-9][0-9]|[0-9])';
+/** One IPv4 or IPv6 address or CIDR range, with a prefix of 0-32 or 0-128 and no leading zeros. */
+export const TRAEFIK_TRUSTED_RANGE_PATTERN = `^(${IPV4}(/${IPV4_PREFIX})?|(${IPV6})(/${IPV6_PREFIX})?)$`;
+/** An IPv4-mapped IPv6 address (`::ffff:a.b.c.d`, `::ffff:0:0`, ...), which is refused outright. */
+export const TRAEFIK_IPV4_MAPPED_PATTERN = '^[0:]*:[fF]{4}:';
+/** Longest valid entry: a full IPv6 address and `/128`. */
+export const TRAEFIK_TRUSTED_RANGE_MAX_LENGTH = 43;
+const RANGE = new RegExp(TRAEFIK_TRUSTED_RANGE_PATTERN);
+const IPV4_MAPPED = new RegExp(TRAEFIK_IPV4_MAPPED_PATTERN);
+/** Parse one `trustedIPs` entry, or `undefined` when it is not in the strict format. */
+export function parseTraefikTrustedRange(value) {
+    if (!RANGE.test(value) || IPV4_MAPPED.test(value))
+        return undefined;
+    const [address = '', prefix] = value.split('/');
+    const family = address.includes(':') ? 6 : 4;
+    return { family, prefix: prefix === undefined ? (family === 4 ? 32 : 128) : Number(prefix) };
+}
+/**
+ * The prefix Go would effectively apply to an entry, read leniently: leading
+ * zeros allowed, and an IPv4-mapped `/n` counted as IPv4 `/(n-96)` (or `/0`
+ * below 96). For warnings about entries the strict format may not cover.
+ */
+export function traefikEffectiveTrustedPrefix(value) {
+    const match = /^([^/]*)(?:\/([0-9]+))?$/.exec(value.trim());
+    if (!match)
+        return undefined;
+    const address = match[1] ?? '';
+    const family = address.includes(':') ? 6 : 4;
+    const full = family === 4 ? 32 : 128;
+    const prefix = match[2] === undefined ? full : Number(match[2]);
+    if (family === 6 && IPV4_MAPPED.test(address)) {
+        return { family: 4, prefix: prefix >= 96 ? prefix - 96 : 0 };
+    }
+    return { family, prefix };
+}
+/**
+ * A CEL predicate over the string variable `name` that holds when it is in the
+ * strict format and, unless `allowAnySource`, is not a `/0` range.
+ */
+export function traefikTrustedRangeCel(name, allowAnySource = false) {
+    return [
+        `${name}.matches('${TRAEFIK_TRUSTED_RANGE_PATTERN}')`,
+        `!${name}.matches('${TRAEFIK_IPV4_MAPPED_PATTERN}')`,
+        ...(allowAnySource ? [] : [`!${name}.endsWith('/0')`]),
+    ].join(' && ');
+}
+//# sourceMappingURL=trusted-range.js.map