95 lines
4.7 KiB
JavaScript
95 lines
4.7 KiB
JavaScript
import { ConfigValidationError } from './errors.js'
|
|
import { isIP } from 'node:net'
|
|
|
|
export function normalizeBaseUrl(rawUrl) {
|
|
let url
|
|
try { url = new URL(rawUrl) } catch { throw new ConfigValidationError('instance URL is invalid') }
|
|
if (!['http:', 'https:'].includes(url.protocol)) throw new ConfigValidationError('instance URL must use http or https')
|
|
if (url.username || url.password) throw new ConfigValidationError('instance URL must not contain credentials')
|
|
const hostname = url.hostname.replace(/^\[|\]$/g, '').toLowerCase()
|
|
const ipv4 = hostname.split('.').map(Number)
|
|
const isIpv4 = ipv4.length === 4 && ipv4.every(part => Number.isInteger(part) && part >= 0 && part <= 255)
|
|
const prohibitedIpv4 = isIpv4 && (
|
|
ipv4[0] === 127 || ipv4[0] === 0 ||
|
|
(ipv4[0] === 169 && ipv4[1] === 254) ||
|
|
(ipv4[0] >= 224)
|
|
)
|
|
const prohibitedIpv6 = hostname === '::' || hostname === '::1' || /^fe[89ab][0-9a-f]:/.test(hostname) || hostname.startsWith('ff') || hostname.startsWith('::ffff:') || hostname.startsWith('64:ff9b:')
|
|
const prohibitedMetadata = hostname === '100.100.100.200' || hostname === '168.63.129.16'
|
|
const prohibitedTransition = hostname.startsWith('2002:')
|
|
const isIpLiteral = isIP(hostname) !== 0
|
|
if (!isIpLiteral || prohibitedIpv4 || prohibitedIpv6 || prohibitedMetadata || prohibitedTransition) {
|
|
throw new ConfigValidationError('instance target must be a permitted IP literal; hostnames and local/metadata addresses are prohibited')
|
|
}
|
|
url.hash = ''
|
|
url.search = ''
|
|
return url.toString().replace(/\/$/, '')
|
|
}
|
|
|
|
export function normalizeInstance(instance, index = 0) {
|
|
if (!instance || typeof instance !== 'object') throw new ConfigValidationError(`instances[${index}] must be an object`)
|
|
const id = String(instance.id || '').trim()
|
|
const name = String(instance.name || id || `SimAdmin ${index + 1}`).trim()
|
|
const rawUrl = String(instance.url || '').trim()
|
|
if (!id || !/^[a-zA-Z0-9_.-]+$/.test(id)) throw new ConfigValidationError(`instances[${index}].id is required and may only contain letters, numbers, _, -, .`)
|
|
if (!rawUrl) throw new ConfigValidationError(`instances[${index}].url is required`)
|
|
const password = instance.auth?.password ?? instance.password ?? ''
|
|
const mode = password ? 'password' : String(instance.auth?.mode || 'none')
|
|
if (!['none', 'password'].includes(mode)) throw new ConfigValidationError(`instances[${index}].auth.mode must be none or password`)
|
|
return {
|
|
id, name, url: normalizeBaseUrl(rawUrl),
|
|
description: String(instance.description || '').trim(),
|
|
tags: Array.isArray(instance.tags) ? instance.tags.map(String) : [],
|
|
auth: { mode, password: password ? String(password) : '' },
|
|
capabilities: Array.isArray(instance.capabilities) ? instance.capabilities.map(String) : [],
|
|
}
|
|
}
|
|
|
|
export function normalizeConfig(raw = {}, env = process.env) {
|
|
const instances = Array.isArray(raw.instances) ? raw.instances.map(normalizeInstance) : []
|
|
const ids = new Set()
|
|
for (const item of instances) {
|
|
if (ids.has(item.id)) throw new ConfigValidationError(`duplicate instance id: ${item.id}`)
|
|
ids.add(item.id)
|
|
}
|
|
const port = Number(env.PORT ?? raw.server?.port ?? 8788)
|
|
if (!Number.isInteger(port) || port < 1 || port > 65535) throw new ConfigValidationError('server.port must be an integer from 1 to 65535')
|
|
const host = String(env.HOST ?? raw.server?.host ?? '127.0.0.1').trim()
|
|
const bareHost = host.replace(/^\[|\]$/g, '').toLowerCase()
|
|
const octets = bareHost.split('.')
|
|
const ipv4Loopback = octets.length === 4 && octets[0] === '127' && octets.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
|
|
if (!(bareHost === 'localhost' || bareHost === '::1' || bareHost === '0:0:0:0:0:0:0:1' || ipv4Loopback)) {
|
|
throw new ConfigValidationError('server.host must be a loopback host (127/8, ::1, or localhost)')
|
|
}
|
|
return {
|
|
server: { host, port },
|
|
instances,
|
|
raw: { ...raw, instances },
|
|
}
|
|
}
|
|
|
|
export function serializeConfig(snapshot) {
|
|
return {
|
|
...(snapshot.raw || {}),
|
|
server: snapshot.raw?.server || snapshot.server,
|
|
instances: snapshot.instances.map(instance => ({
|
|
id: instance.id, name: instance.name, url: instance.url,
|
|
description: instance.description || '', tags: instance.tags || [],
|
|
auth: instance.auth?.password ? { mode: 'password', password: instance.auth.password } : { mode: 'none' },
|
|
capabilities: instance.capabilities || [],
|
|
})),
|
|
}
|
|
}
|
|
|
|
export function immutableSnapshot(value) {
|
|
const clone = structuredClone(value)
|
|
const freeze = object => {
|
|
if (object && typeof object === 'object' && !Object.isFrozen(object)) {
|
|
Object.freeze(object)
|
|
for (const item of Object.values(object)) freeze(item)
|
|
}
|
|
return object
|
|
}
|
|
return freeze(clone)
|
|
}
|