index.ts

import crypto from 'crypto';
import URL from 'url';
import got from 'got';
import { ExternalHostError } from '../../types/errors/external-host-error';
import * as memCache from '../cache/memory';
import { clone } from '../clone';
import { applyAuthorization } from './auth';
import { applyHostRules } from './host-rules';

interface OutgoingHttpHeaders {
  [header: string]: number | string | string[] | undefined;
}

export interface HttpOptions {
  body?: any;
  auth?: string;
  baseUrl?: string;
  headers?: OutgoingHttpHeaders;
  throwHttpErrors?: boolean;
  useCache?: boolean;
}

export interface HttpPostOptions extends HttpOptions {
  body: unknown;
}

export interface InternalHttpOptions extends HttpOptions {
  json?: boolean;
  method?: 'get' | 'post' | 'put' | 'patch' | 'delete' | 'head';
}

export interface HttpResponse<T = string> {
  body: T;
  headers: any;
}

function cloneResponse<T>(response: any): HttpResponse<T> {
  // clone body and headers so that the cached result doesn't get accidentally mutated
  return {
    body: clone<T>(response.body),
    headers: clone(response.headers),
  };
}

async function resolveResponse<T>(
  promisedRes: Promise<HttpResponse<T>>,
  { abortOnError, abortIgnoreStatusCodes }
): Promise<HttpResponse<T>> {
  try {
    const res = await promisedRes;
    return cloneResponse(res);
  } catch (err) {
    if (abortOnError && !abortIgnoreStatusCodes?.includes(err.statusCode)) {
      throw new ExternalHostError(err);
    }
    throw err;
  }
}

// isAmazon return true if request options contains Amazon related headers
function isAmazon(opts: any): boolean {
  return opts.search?.includes('X-Amz-Algorithm');
}

// isAzureBlob return true if request options contains Azure container registry related data
function isAzureBlob(opts: any): boolean {
  return (
    opts.hostname?.endsWith('blob.core.windows.net') &&
    opts.href?.includes('/docker/registry')
  ); // lgtm [js/incomplete-url-substring-sanitization]
}

// removeAuthorizationHeaders from the redirect options
export function removeAuthorizationHeaders(opts: any): any {
  // Check if request has been redirected to Amazon or an Azure blob (ACR)
  if (isAmazon(opts) || isAzureBlob(opts)) {
    // if there is no port in the redirect URL string, then delete it from the redirect options.
    // This can be evaluated for removal after upgrading to Got v10
    const portInUrl = opts.href.split('/')[2].split(':')[1];
    if (!portInUrl) {
      // eslint-disable-next-line no-param-reassign
      delete opts.port; // Redirect will instead use 80 or 443 for HTTP or HTTPS respectively
    }

    // registry is hosted on Amazon or Azure blob, redirect url includes
    // authentication which is not required and should be removed
    delete opts.headers.authorization; // eslint-disable-line no-param-reassign
    delete opts.auth; // eslint-disable-line no-param-reassign
  }

  return opts;
}

export class Http<GetOptions = HttpOptions, PostOptions = HttpPostOptions> {
  constructor(private hostType: string, private options?: HttpOptions) {}

  protected async request<T>(
    requestUrl: string | URL,
    httpOptions?: InternalHttpOptions
  ): Promise<HttpResponse<T> | null> {
    let url = requestUrl.toString();
    if (httpOptions?.baseUrl) {
      url = URL.resolve(httpOptions.baseUrl, url);
    }
    // TODO: deep merge in order to merge headers
    let options: any = {
      method: 'get',
      ...this.options,
      hostType: this.hostType,
      ...httpOptions,
    };
    if (process.env.NODE_ENV === 'test') {
      options.retry = 0;
    }
    options.hooks = {
      beforeRedirect: [removeAuthorizationHeaders],
    };
    options.headers = {
      ...options.headers,
      'user-agent':
        process.env.RENOVATE_USER_AGENT ||
        'https://github.com/renovatebot/renovate',
    };

    options = applyHostRules(url, options);
    options = applyAuthorization(options);

    // Cache GET requests unless useCache=false
    const cacheKey = crypto
      .createHash('md5')
      .update('got-' + JSON.stringify({ url, headers: options.headers }))
      .digest('hex');
    if (options.method === 'get' && options.useCache !== false) {
      // return from cache if present
      const cachedRes = memCache.get(cacheKey);
      // istanbul ignore if
      if (cachedRes) {
        return resolveResponse<T>(cachedRes, options);
      }
    }
    const startTime = Date.now();
    const promisedRes = got(url, options);
    if (options.method === 'get') {
      memCache.set(cacheKey, promisedRes); // always set if it's a get
    }
    const res = await resolveResponse<T>(promisedRes, options);
    const httpRequests = memCache.get('http-requests') || [];
    httpRequests.push({
      method: options.method,
      url,
      duration: Date.now() - startTime,
    });
    memCache.set('http-requests', httpRequests);
    return res;
  }

  get(url: string, options: HttpOptions = {}): Promise<HttpResponse> {
    return this.request<string>(url, options);
  }

  head(url: string, options: HttpOptions = {}): Promise<HttpResponse> {
    return this.request<string>(url, { ...options, method: 'head' });
  }

  private async requestJson<T = unknown>(
    url: string,
    options: InternalHttpOptions
  ): Promise<HttpResponse<T>> {
    const res = await this.request<T>(url, { ...options, json: true });
    const body = res.body;
    return { ...res, body };
  }

  async getJson<T = unknown>(
    url: string,
    options?: GetOptions
  ): Promise<HttpResponse<T>> {
    return this.requestJson<T>(url, { ...options });
  }

  async headJson<T = unknown>(
    url: string,
    options?: GetOptions
  ): Promise<HttpResponse<T>> {
    return this.requestJson<T>(url, { ...options, method: 'head' });
  }

  async postJson<T = unknown>(
    url: string,
    options?: PostOptions
  ): Promise<HttpResponse<T>> {
    return this.requestJson<T>(url, { ...options, method: 'post' });
  }

  async putJson<T = unknown>(
    url: string,
    options?: PostOptions
  ): Promise<HttpResponse<T>> {
    return this.requestJson<T>(url, { ...options, method: 'put' });
  }

  async patchJson<T = unknown>(
    url: string,
    options?: PostOptions
  ): Promise<HttpResponse<T>> {
    return this.requestJson<T>(url, { ...options, method: 'patch' });
  }

  async deleteJson<T = unknown>(
    url: string,
    options?: PostOptions
  ): Promise<HttpResponse<T>> {
    return this.requestJson<T>(url, { ...options, method: 'delete' });
  }

  stream(url: string, options?: HttpOptions): NodeJS.ReadableStream {
    const combinedOptions: any = {
      method: 'get',
      ...this.options,
      hostType: this.hostType,
      ...options,
    };
    return got.stream(url, combinedOptions);
  }
}