feat: Edge Runtime compatibility — drop axios and all node: imports#8
Open
cport1 wants to merge 1 commit into
Open
feat: Edge Runtime compatibility — drop axios and all node: imports#8cport1 wants to merge 1 commit into
cport1 wants to merge 1 commit into
Conversation
…ebDecoy/app#281) Make @webdecoy/node and @webdecoy/nextjs run in Vercel Edge Middleware (and other WinterCG runtimes) by removing every Node-only API from the bundled module graph: - client: axios + https.Agent -> Web-standard fetch with AbortController timeout; identical error messages preserved. tlsRejectUnauthorized is kept for API compatibility but ignored (use NODE_EXTRA_CA_CERTS). - captcha (token/pow/service/http): node:crypto -> Web Crypto (crypto.subtle); issue/verify/generate/score are now async. BREAKING — version bumped to 0.5.0. Framework adapters already awaited the async handle() so they are unaffected. - fingerprint detector: sha256 -> FNV-1a 64 (correlation key only; keeps DetectionEngine.score sync) - ip: net.isIPv4 -> strict local check; honeytoken: randomBytes -> crypto.getRandomValues - new src/webcrypto.ts: sha256/hmac/randomHex/timing-safe-compare/ base64url helpers, Web-standard only Verification, wired into CI (build + test + check:edge): - scripts/check-edge.mjs: esbuild browser-platform bundle gate — any node: import anywhere in the graph fails the build - edge-runtime.test.ts: executes the bundled SDK inside @edge-runtime/vm (Vercel's Edge Runtime): keyless rate limiting, tripwire/honeytoken, and async token issue/verify all pass in the VM Also: jest --passWithNoTests for adapter packages (pre-existing 'No tests found' failure made turbo test unusable as a gate).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the SDK half of WebDecoy/app#281 (Vercel Marketplace milestone, Phase 0).
Why
@webdecoy/nextjsmiddleware could not run in Vercel Edge Middleware: tsup bundles the whole package into one file, so theaxios/https/node:crypto/netimports poisoned the bundle and failed Next.js Edge builds. Middleware is where a security SDK gets installed — this blocked the entire Vercel story (and Cloudflare Workers/Deno/Bun along the way).What changed
https.Agentfetch+AbortControllertimeout (same error messages)node:cryptocrypto.subtle) — breaking, 0.5.0DetectionEngine.scoresyncisIPv4node:netnet.isIPv4semantics)randomBytescrypto.getRandomValuessrc/webcrypto.ts(sha256/hmac/randomHex/timing-safe/base64url, Web-standard only)tlsRejectUnauthorizedis kept for API compatibility but ignored by the fetch transport; docs point toNODE_EXTRA_CA_CERTSfor local self-signed certs. Framework adapters (Express/Fastify/Next.js) already awaited the asynchandle(), so they need no changes; theexamples/captcha-expresslogin route gained oneawait.Verification (both wired into CI alongside build + test)
scripts/check-edge.mjs— bundles each entry with esbuildplatform: browser, where Node built-ins don't resolve; anynode:import anywhere in the graph fails. Runs for@webdecoy/nodeand@webdecoy/nextjs.edge-runtime.test.ts— executes the bundled SDK inside@edge-runtime/vm(Vercel's actual Edge Runtime): keyless rate limiting (3rd request overmax: 2denied), honeytoken tripwire fires, async token issue → verify → replay-rejection all pass in the VM.turbo build test: 12/12 tasks, 110 tests passing. Pre-existing note: adapter packages hadjestexiting 1 on "No tests found", makingturbo testunusable as a gate — added--passWithNoTests.Breaking (0.5.0)
Captcha.issueChallenge/verify/score/verifyToken,PoWManager.generate/verify,TokenManager.issue/verifynow return Promises. Anyone using the HTTP handler or framework adapters is unaffected.