sdk

Radroots SDK and bindings
git clone https://radroots.dev/git/sdk.git
Log | Files | Refs | README

radroots_sdk_boundary_lib.mjs (2371B)

      1 import { lstatSync, readFileSync } from "node:fs";
      2 import { resolve } from "node:path";
      3 
      4 export const GENERATED_FILES = Object.freeze([
      5   "generated/kotlin/source.lock",
      6   "generated/kotlin/uniffi/radroots_sdk/radroots_sdk.kt",
      7   "generated/swift/radroots_sdk.swift",
      8   "generated/swift/radroots_sdkFFI.h",
      9   "generated/swift/radroots_sdkFFI.modulemap",
     10   "generated/swift/source.lock",
     11   "packages/core-bindings/src/generated/types.ts",
     12   "packages/event-bindings/src/generated/constants.ts",
     13   "packages/event-bindings/src/generated/kinds.ts",
     14   "packages/event-bindings/src/generated/types.ts",
     15   "packages/identity-bindings/src/generated/constants.ts",
     16   "packages/replica-schema-bindings/src/generated/types.ts",
     17   "packages/trade-bindings/src/generated/types.ts",
     18 ]);
     19 
     20 const SENSITIVE_PATH = /(^|\/)(\.env|id_rsa|id_ed25519|credentials|[^/]+\.(pem|key|p12|pfx|jks|keystore))$/i;
     21 const CREDENTIAL_MATERIAL = /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9_]{36,}|nsec1[023456789acdefghjklmnpqrstuvwxyz]{40,}/;
     22 const TEXT_SOURCE = /\.(?:h|js|json|kt|md|mjs|modulemap|rs|swift|toml|ts)$/;
     23 
     24 function fail(message) {
     25   throw new Error(`boundary_invalid: ${message}`);
     26 }
     27 
     28 function exactInventory(actual, expected, context) {
     29   const sorted = [...actual].sort();
     30   if (JSON.stringify(sorted) !== JSON.stringify(expected)) {
     31     fail(`${context} is not exact`);
     32   }
     33 }
     34 
     35 export function validateTrackedInventory(paths) {
     36   for (const path of paths) {
     37     if (SENSITIVE_PATH.test(path)) fail("sensitive credential path is tracked");
     38   }
     39   const generated = paths.filter(
     40     (path) => path.startsWith("generated/") || /\/src\/generated\//.test(path),
     41   );
     42   exactInventory(generated, GENERATED_FILES, "generated source inventory");
     43 }
     44 
     45 export function validateProductionSources(root, paths) {
     46   for (const path of paths) {
     47     if (
     48       !TEXT_SOURCE.test(path) ||
     49       !["crates/", "generated/", "packages/"].some((prefix) => path.startsWith(prefix))
     50     ) {
     51       continue;
     52     }
     53     const fullPath = resolve(root, path);
     54     const metadata = lstatSync(fullPath);
     55     if (!metadata.isFile() || metadata.isSymbolicLink()) {
     56       fail("production source must be a regular non-symlink file");
     57     }
     58     if (CREDENTIAL_MATERIAL.test(readFileSync(fullPath, "utf8"))) {
     59       fail("production source contains credential material");
     60     }
     61   }
     62 }