{"version":3,"sources":["/Users/grichardson/Documents/dev/supabase/pg-gateway/packages/pg-gateway/dist/platforms/node/index.cjs","../../../src/platforms/node/index.ts","../../../src/platforms/node/tls.ts"],"names":["validateCredentials","credentials","cert","X509Certificate","subjectKeyValues","entry","upgradeTls","duplex","options","requestCert","tlsInfo","tlsSocketOptions","createTlsSocketOptions","secureSocket","TLSSocket","Duplex","serverName","callback","updatedTlsSocketOptions","createSecureContext","once","onServerSocketSecure","peerCertificate","optionsOrCallback","key","ca","passphrase","verifyError","fromNodeSocket","socket","fromDuplexStream","opts","adapters","PostgresConnection"],"mappings":"AAAA,yoBAA4C,gCCCrB,gCCDS,gCACX,0BAEiD,MAKtE,SAAsBA,CAAAA,CAAoBC,CAAAA,CAGvC,CACD,IAAMC,CAAAA,CAAO,IAAIC,4BAAAA,CAAgB,MAAA,CAAO,IAAA,CAAKF,CAAAA,CAAY,WAAW,CAAC,CAAA,CAE/DG,CAAAA,CAA2C,MAAA,CAAO,WAAA,CACtDF,CAAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,CAAE,GAAA,CAAKG,CAAAA,EAAUA,CAAAA,CAAM,KAAA,CAAM,GAAG,CAAC,CAC3D,CAAA,CAEA,MAAO,IAAA,GAAQD,CAAAA,EAAoBA,CAAAA,CAAiB,EAAA,GAAOH,CAAAA,CAAY,QACzE,CAEA,MAAA,SAAsBK,CAAAA,CACpBC,CAAAA,CACAC,CAAAA,CACAC,CAAAA,CAAc,CAAA,CAAA,CAIb,CACD,IAAMC,CAAAA,CAAmB,CAAC,CAAA,CACpBC,CAAAA,CAAmB,MAAMC,CAAAA,CAAuBJ,CAAAA,CAASC,CAAW,CAAA,CAEpEI,CAAAA,CAAe,IAAIC,mBAAAA,CAAUC,cAAAA,CAAO,OAAA,CAAQR,CAAM,CAAA,CAAG,CACzD,GAAGI,CAAAA,CACH,QAAA,CAAU,CAAA,CAAA,CACV,WAAA,CAAa,KAAA,CAAOK,CAAAA,CAAYC,CAAAA,CAAAA,EAAa,CAC3CP,CAAAA,CAAQ,UAAA,CAAaM,CAAAA,CACrB,IAAME,CAAAA,CAA0B,MAAMN,CAAAA,CACpCJ,CAAAA,CACAC,CAAAA,CACAO,CACF,CAAA,CACAC,CAAAA,CAAS,IAAA,CAAME,sCAAAA,CAA2C,CAAC,CAC7D,CACF,CAAC,CAAA,CAED,MAAMC,0BAAAA,CAAKP,CAAc,QAAQ,CAAA,CACjCQ,CAAAA,CAAqBR,CAAY,CAAA,CAEjC,IAAMS,CAAAA,CAAkBT,CAAAA,CAAa,kBAAA,CAAmB,CAAA,CAExD,OAAIS,CAAAA,EAAmB,KAAA,GAASA,CAAAA,EAAAA,CAC9BZ,CAAAA,CAAQ,iBAAA,CAAoB,IAAI,UAAA,CAAWY,CAAAA,CAAgB,GAAG,CAAA,CAAA,CAGzD,CACL,MAAA,CAAQP,cAAAA,CAAO,KAAA,CAAMF,CAAY,CAAA,CACjC,OAAA,CAAAH,CACF,CACF,CAEA,MAAA,SAAeE,CAAAA,CACbW,CAAAA,CACAd,CAAAA,CACAO,CAAAA,CAC2B,CAC3B,GAAM,CAAE,GAAA,CAAAQ,CAAAA,CAAK,IAAA,CAAAtB,CAAAA,CAAM,EAAA,CAAAuB,CAAAA,CAAI,UAAA,CAAAC,CAAW,CAAA,CAChC,OAAOH,CAAAA,EAAsB,UAAA,CACzB,MAAMA,CAAAA,CAAkBP,CAAU,CAAA,CAClCO,CAAAA,CAEN,MAAO,CACL,GAAA,CAAK,MAAA,CAAO,IAAA,CAAKC,CAAG,CAAA,CACpB,IAAA,CAAM,MAAA,CAAO,IAAA,CAAKtB,CAAI,CAAA,CACtB,EAAA,CAAIuB,CAAAA,CAAK,MAAA,CAAO,IAAA,CAAKA,CAAE,CAAA,CAAI,KAAA,CAAA,CAC3B,UAAA,CAAAC,CAAAA,CACA,WAAA,CAAAjB,CACF,CACF,CASA,SAASY,CAAAA,CAAqBR,CAAAA,CAA+B,CAC3D,EAAA,CAAIA,CAAAA,CAAa,YAAA,CAAc,CAC7B,IAAMc,CAAAA,CAAcd,CAAAA,CAAa,OAAA,CAAQ,WAAA,CAAY,CAAA,CACjDc,CAAAA,CACFd,CAAAA,CAAa,kBAAA,CAAqBc,CAAAA,CAAY,IAAA,CAE9Cd,CAAAA,CAAa,UAAA,CAAa,CAAA,CAE9B,CACF,CD9EA,MAAA,SAAsBe,CAAAA,CAAeC,CAAAA,CAAgBrB,CAAAA,CAAqC,CACxF,OAAOsB,CAAAA,CAAiBf,cAAAA,CAAO,KAAA,CAAMc,CAAM,CAAA,CAAGrB,CAAO,CACvD,CASA,MAAA,SAAsBsB,CAAAA,CACpBvB,CAAAA,CACAC,CAAAA,CACA,CACA,IAAMuB,CAAAA,CAAkC,CACtC,GAAGvB,CACL,CAAA,iBAEIuB,CAAAA,2BAAM,IAAA,6BAAM,QAAA,GAAW,MAAA,EAAA,CACzBA,CAAAA,CAAK,IAAA,CAAK,mBAAA,CAAsB/B,CAAAA,CAAAA,CAGlC,IAAMgC,CAAAA,CAAuC,CAC3C,UAAA,CAAA1B,CACF,CAAA,CAEA,OAAO,IAAI2B,wBAAAA,CAAmB1B,CAAAA,CAAQC,CAAAA,CAASwB,CAAQ,CACzD,CAAA,yDAAA","file":"/Users/grichardson/Documents/dev/supabase/pg-gateway/packages/pg-gateway/dist/platforms/node/index.cjs","sourcesContent":[null,"import type { Socket } from 'node:net';\nimport { Duplex } from 'node:stream';\nimport PostgresConnection, {\n type PostgresConnectionAdapters,\n type PostgresConnectionOptions,\n} from '../../connection.js';\nimport { upgradeTls, validateCredentials } from './tls.js';\nimport type { DuplexStream } from '../../streams.js';\n\n/**\n * Creates a `PostgresConnection` from a Node.js TCP/Unix `Socket`.\n *\n * `PostgresConnection` operates on web streams, so this helper\n * converts a `Socket` to/from the respective web streams.\n *\n * Also implements `upgradeTls()`, which makes Postgres `SSLRequest`\n * upgrades available in Node.js environments.\n */\nexport async function fromNodeSocket(socket: Socket, options?: PostgresConnectionOptions) {\n return fromDuplexStream(Duplex.toWeb(socket), options);\n}\n\n/**\n * Creates a `PostgresConnection` from a `DuplexStream` with\n * Node.js adapters like `upgradeTls()` included.\n *\n * Useful in Node.js environments when you start from a\n * non-Socket stream but want Node.js TLS adapters.\n */\nexport async function fromDuplexStream(\n duplex: DuplexStream,\n options?: PostgresConnectionOptions,\n) {\n const opts: PostgresConnectionOptions = {\n ...options,\n };\n\n if (opts?.auth?.method === 'cert') {\n opts.auth.validateCredentials = validateCredentials;\n }\n\n const adapters: PostgresConnectionAdapters = {\n upgradeTls,\n };\n\n return new PostgresConnection(duplex, options, adapters);\n}\n","import { X509Certificate } from 'node:crypto';\nimport { once } from 'node:events';\nimport { Duplex } from 'node:stream';\nimport { TLSSocket, type TLSSocketOptions, createSecureContext } from 'node:tls';\nimport type { TlsOptions, TlsOptionsCallback } from '../../connection.js';\nimport type { TlsInfo } from '../../connection.types.js';\nimport type { DuplexStream } from '../../streams.js';\n\nexport async function validateCredentials(credentials: {\n username: string;\n certificate: Uint8Array;\n}) {\n const cert = new X509Certificate(Buffer.from(credentials.certificate));\n\n const subjectKeyValues: Record = Object.fromEntries(\n cert.subject.split(/, ?/).map((entry) => entry.split('=')),\n );\n\n return 'CN' in subjectKeyValues && subjectKeyValues.CN === credentials.username;\n}\n\nexport async function upgradeTls(\n duplex: DuplexStream,\n options: TlsOptions | TlsOptionsCallback,\n requestCert = false,\n): Promise<{\n duplex: DuplexStream;\n tlsInfo: TlsInfo;\n}> {\n const tlsInfo: TlsInfo = {};\n const tlsSocketOptions = await createTlsSocketOptions(options, requestCert);\n\n const secureSocket = new TLSSocket(Duplex.fromWeb(duplex), {\n ...tlsSocketOptions,\n isServer: true,\n SNICallback: async (serverName, callback) => {\n tlsInfo.serverName = serverName;\n const updatedTlsSocketOptions = await createTlsSocketOptions(\n options,\n requestCert,\n serverName,\n );\n callback(null, createSecureContext(updatedTlsSocketOptions));\n },\n });\n\n await once(secureSocket, 'secure');\n onServerSocketSecure(secureSocket);\n\n const peerCertificate = secureSocket.getPeerCertificate();\n\n if (peerCertificate && 'raw' in peerCertificate) {\n tlsInfo.clientCertificate = new Uint8Array(peerCertificate.raw);\n }\n\n return {\n duplex: Duplex.toWeb(secureSocket),\n tlsInfo,\n };\n}\n\nasync function createTlsSocketOptions(\n optionsOrCallback: TlsOptions | TlsOptionsCallback,\n requestCert: boolean,\n serverName?: string,\n): Promise {\n const { key, cert, ca, passphrase } =\n typeof optionsOrCallback === 'function'\n ? await optionsOrCallback(serverName)\n : optionsOrCallback;\n\n return {\n key: Buffer.from(key),\n cert: Buffer.from(cert),\n ca: ca ? Buffer.from(ca) : undefined,\n passphrase,\n requestCert,\n };\n}\n\n/**\n * Internal Node.js handler copied and modified from source to validate client certs.\n * https://github.com/nodejs/node/blob/aeaffbb385c9fc756247e6deaa70be8eb8f59496/lib/_tls_wrap.js#L1185-L1203\n *\n * Without this, `authorized` is always `false` on the TLSSocket and we never know if the client cert is valid.\n */\n// biome-ignore lint/suspicious/noExplicitAny: \nfunction onServerSocketSecure(secureSocket: TLSSocket & any) {\n if (secureSocket._requestCert) {\n const verifyError = secureSocket._handle.verifyError();\n if (verifyError) {\n secureSocket.authorizationError = verifyError.code;\n } else {\n secureSocket.authorized = true;\n }\n }\n}\n"]}