chore: import upstream snapshot with attribution

apps/sim/lib/data-drains/destinations/webhook.ts

@@ -0,0 +1,246 @@
+import { createHmac } from 'node:crypto'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { backoffWithJitter, parseRetryAfter } from '@sim/utils/retry'
+import { z } from 'zod'
+import { validateExternalUrl } from '@/lib/core/security/input-validation'
+import {
+  secureFetchWithPinnedIP,
+  validateUrlWithDNS,
+} from '@/lib/core/security/input-validation.server'
+import { sleepUntilAborted } from '@/lib/data-drains/destinations/utils'
+import type { DeliveryMetadata, DrainDestination } from '@/lib/data-drains/types'
+
+const logger = createLogger('DataDrainWebhookDestination')
+
+/** Initial attempt + 3 retries — 500ms/1s/2s backoff sequence. */
+const MAX_ATTEMPTS = 4
+const PER_ATTEMPT_TIMEOUT_MS = 30_000
+/** Cap responder reply so a misbehaving receiver can't OOM the runner. */
+const MAX_RESPONSE_BYTES = 256 * 1024
+const SIGNATURE_VERSION = 'v1'
+const USER_AGENT = 'Sim-DataDrain/1.0'
+
+/**
+ * Headers `buildHeaders` emits. Callers cannot override these via
+ * `signatureHeader`. Keep in sync with `buildHeaders` — the drift-guard test
+ * enforces this by parsing the schema against every key the function writes.
+ */
+const RESERVED_SIGNATURE_HEADER_NAMES = new Set([
+  'authorization',
+  'content-type',
+  'user-agent',
+  'idempotency-key',
+  'x-sim-timestamp',
+  'x-sim-signature-version',
+  'x-sim-drain-id',
+  'x-sim-run-id',
+  'x-sim-source',
+  'x-sim-sequence',
+  'x-sim-row-count',
+  'x-sim-probe',
+  'x-sim-signature',
+])
+
+/** CR/LF/NUL would let a bearer token smuggle additional response headers. */
+const HEADER_INJECTION_PATTERN = /[\r\n\0]/
+
+async function resolvePublicTarget(url: string): Promise<string> {
+  const result = await validateUrlWithDNS(url, 'url')
+  if (!result.isValid || !result.resolvedIP) {
+    throw new Error(result.error ?? 'Webhook URL failed SSRF validation')
+  }
+  return result.resolvedIP
+}
+
+const webhookConfigSchema = z.object({
+  url: z
+    .string()
+    .url('url must be a valid URL')
+    .max(2048, 'url must be at most 2048 characters')
+    .refine((value) => validateExternalUrl(value, 'url').isValid, {
+      message: 'url must be HTTPS and not point at a private, loopback, or metadata address',
+    }),
+  signatureHeader: z
+    .string()
+    .min(1)
+    .max(128)
+    .refine((value) => !RESERVED_SIGNATURE_HEADER_NAMES.has(value.toLowerCase()), {
+      message: 'signatureHeader cannot reuse a reserved Sim header name',
+    })
+    .refine((value) => !HEADER_INJECTION_PATTERN.test(value) && /^[A-Za-z0-9\-_]+$/.test(value), {
+      message: 'signatureHeader must contain only letters, digits, hyphens, and underscores',
+    })
+    .optional(),
+})
+
+const webhookCredentialsSchema = z.object({
+  signingSecret: z
+    .string()
+    .min(32, 'signingSecret must be at least 32 characters')
+    .max(512, 'signingSecret must be at most 512 characters'),
+  bearerToken: z
+    .string()
+    .min(1)
+    .max(4096, 'bearerToken must be at most 4096 characters')
+    .refine((value) => !HEADER_INJECTION_PATTERN.test(value), {
+      message: 'bearerToken cannot contain CR, LF, or NUL characters',
+    })
+    .optional(),
+})
+
+export type WebhookDestinationConfig = z.infer<typeof webhookConfigSchema>
+export type WebhookDestinationCredentials = z.infer<typeof webhookCredentialsSchema>
+
+/**
+ * Stripe-style signature: HMAC-SHA256 over `${unixSeconds}.${body}` rendered as
+ * `t=<unixSeconds>,v1=<hex>`. Verifiers reject stale timestamps (~5 min skew)
+ * to block replay; we re-sign per attempt so long backoffs don't fall outside
+ * that window.
+ */
+function sign(body: Buffer, secret: string, timestamp: number): string {
+  const hmac = createHmac('sha256', secret).update(`${timestamp}.`).update(body).digest('hex')
+  return `t=${timestamp},${SIGNATURE_VERSION}=${hmac}`
+}
+
+function isRetryableStatus(status: number): boolean {
+  return status === 408 || status === 429 || status >= 500
+}
+
+function buildHeaders(input: {
+  config: WebhookDestinationConfig
+  credentials: WebhookDestinationCredentials
+  body: Buffer
+  contentType: string
+  metadata?: DeliveryMetadata
+  isProbe?: boolean
+}): Record<string, string> {
+  const timestamp = Math.floor(Date.now() / 1000)
+  const headers: Record<string, string> = {
+    'Content-Type': input.contentType,
+    'User-Agent': USER_AGENT,
+    'X-Sim-Timestamp': timestamp.toString(),
+    'X-Sim-Signature-Version': SIGNATURE_VERSION,
+    [input.config.signatureHeader ?? 'X-Sim-Signature']: sign(
+      input.body,
+      input.credentials.signingSecret,
+      timestamp
+    ),
+  }
+  if (input.metadata) {
+    headers['X-Sim-Drain-Id'] = input.metadata.drainId
+    headers['X-Sim-Run-Id'] = input.metadata.runId
+    headers['X-Sim-Source'] = input.metadata.source
+    headers['X-Sim-Sequence'] = input.metadata.sequence.toString()
+    headers['X-Sim-Row-Count'] = input.metadata.rowCount.toString()
+    // Stable across retries of the same chunk so receivers can dedupe.
+    headers['Idempotency-Key'] = `${input.metadata.runId}-${input.metadata.sequence}`
+  }
+  if (input.isProbe) {
+    headers['X-Sim-Probe'] = '1'
+  }
+  if (input.credentials.bearerToken) {
+    headers.Authorization = `Bearer ${input.credentials.bearerToken}`
+  }
+  return headers
+}
+
+export const webhookDestination: DrainDestination<
+  WebhookDestinationConfig,
+  WebhookDestinationCredentials
+> = {
+  type: 'webhook',
+  displayName: 'HTTPS Webhook',
+  configSchema: webhookConfigSchema,
+  credentialsSchema: webhookCredentialsSchema,
+
+  async test({ config, credentials, signal }) {
+    const resolvedIP = await resolvePublicTarget(config.url)
+    const probe = Buffer.from('{"sim":"connection-test"}\n', 'utf8')
+    const headers = buildHeaders({
+      config,
+      credentials,
+      body: probe,
+      contentType: 'application/x-ndjson',
+      isProbe: true,
+    })
+    const response = await secureFetchWithPinnedIP(config.url, resolvedIP, {
+      method: 'POST',
+      body: new Uint8Array(probe),
+      headers,
+      signal,
+      timeout: PER_ATTEMPT_TIMEOUT_MS,
+      maxResponseBytes: MAX_RESPONSE_BYTES,
+    })
+    if (!response.ok) {
+      throw new Error(`Webhook probe failed: HTTP ${response.status}`)
+    }
+  },
+
+  openSession({ config, credentials }) {
+    let resolvedIP: string | null = null
+    return {
+      async deliver({ body, contentType, metadata, signal }) {
+        // Resolve once per session and pin across retries to defeat DNS rebinding (TOCTOU).
+        if (resolvedIP === null) {
+          resolvedIP = await resolvePublicTarget(config.url)
+        }
+        let lastError: unknown
+        for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+          if (signal.aborted) throw signal.reason ?? new Error('Aborted')
+          const headers = buildHeaders({ config, credentials, body, contentType, metadata })
+          let retryAfterMs: number | null = null
+          let response: Awaited<ReturnType<typeof secureFetchWithPinnedIP>> | undefined
+          try {
+            response = await secureFetchWithPinnedIP(config.url, resolvedIP, {
+              method: 'POST',
+              body: new Uint8Array(body),
+              headers,
+              signal,
+              timeout: PER_ATTEMPT_TIMEOUT_MS,
+              maxResponseBytes: MAX_RESPONSE_BYTES,
+            })
+          } catch (error) {
+            lastError = error
+            logger.debug('Webhook delivery attempt failed', {
+              url: config.url,
+              attempt,
+              error: toError(error).message,
+            })
+          }
+          if (response) {
+            if (response.ok) {
+              const requestId =
+                response.headers.get('x-request-id') ??
+                response.headers.get('x-amzn-trace-id') ??
+                null
+              logger.debug('Webhook chunk delivered', {
+                url: config.url,
+                attempt,
+                status: response.status,
+                bytes: body.byteLength,
+              })
+              return {
+                locator: requestId
+                  ? `${config.url}#${metadata.runId}-${metadata.sequence}@${requestId}`
+                  : `${config.url}#${metadata.runId}-${metadata.sequence}`,
+              }
+            }
+            if (!isRetryableStatus(response.status)) {
+              throw new Error(`Webhook responded with HTTP ${response.status}`)
+            }
+            lastError = new Error(`Webhook responded with HTTP ${response.status}`)
+            retryAfterMs = parseRetryAfter(response.headers.get('retry-after'))
+          }
+          if (attempt < MAX_ATTEMPTS) {
+            await sleepUntilAborted(backoffWithJitter(attempt, retryAfterMs), signal)
+          }
+        }
+        throw lastError instanceof Error
+          ? lastError
+          : new Error('Webhook delivery failed after retries')
+      },
+      async close() {},
+    }
+  },
+}