@aikidosec/firewall/agent/Context.d.ts

Zen by Aikido is an embedded Web Application Firewall that autonomously protects Node.js apps against common and critical attacks

import type { ParsedQs } from "qs";
import { extractStringsFromUserInput } from "../helpers/extractStringsFromUserInput";
import { Source } from "./Source";
import type { Endpoint } from "./Config";
export type User = {
    id: string;
    name?: string;
};
export type Context = {
    url: string | undefined;
    method: string | undefined;
    query: ParsedQs;
    headers: Record<string, string | string[] | undefined>;
    routeParams: Record<string, string> | undefined;
    remoteAddress: string | undefined;
    body: unknown;
    cookies: Record<string, string>;
    attackDetected?: boolean;
    consumedRateLimit?: boolean;
    user?: User;
    source: string;
    route: string | undefined;
    graphql?: string[];
    xml?: unknown[];
    subdomains?: string[];
    markUnsafe?: unknown[];
    cache?: Map<Source, ReturnType<typeof extractStringsFromUserInput>>;
    /**
     * Used to store redirects in outgoing http(s) requests that are started by a user-supplied input (hostname and port / url) to prevent SSRF redirect attacks.
     */
    outgoingRequestRedirects?: {
        source: URL;
        destination: URL;
    }[];
    executedMiddleware?: boolean;
    rateLimitGroup?: string;
    rateLimitedEndpoint?: Endpoint;
};
/**
 * Get the current request context that is being handled
 *
 * We don't want to allow the user to modify the context directly, so we use `Readonly<Context>`
 */
export declare function getContext(): Readonly<Context> | undefined;
export declare function updateContext<K extends keyof Context>(context: Context, key: K, value: Context[K]): void;
/**
 * Executes a function with a given request context
 *
 * The code executed inside the function will have access to the context using {@link getContext}
 *
 * This is needed because Node.js is single-threaded, so we can't use a global variable to store the context.
 */
export declare function runWithContext<T>(context: Context, fn: () => T): T;
/**
 * Binds the given function to the current execution context.
 * This fixes the issue that context is not available in event handlers that are called outside of runWithContext
 * Static method AsyncLocalStorage.bind(fn) was added in Node.js v19.8.0 and v18.16.0, so we can't use it yet, but it does the same thing.
 * Also done by OpenTelemetry: https://github.com/open-telemetry/opentelemetry-js/blob/a6020fb113a60ae6abc1aa925fa6744880e7fa15/api/src/api/context.ts#L86
 */
export declare function bindContext<T>(fn: () => T): () => T;