← back to Dw Signup Fulfillment

verification/tk11185-reconcile/retired-boundaries.cjs

36 lines

'use strict';
// Preload the real entrypoint; reject and count all app file/network attempts.
const fs = require('node:fs'), path = require('node:path');
const { fileURLToPath } = require('node:url');
const { syncBuiltinESMExports } = require('node:module');
const entry = path.resolve(process.env.TK_RETIRE_ALLOWED_ENTRY);
const audit = { entryLoads: 0, appFileAttempts: [], networkAttempts: [] };
function checkFile(value) {
  const filename = value instanceof URL ? fileURLToPath(value) : String(value);
  if (path.resolve(filename) === entry) { audit.entryLoads++; return; }
  audit.appFileAttempts.push(filename);
  throw new Error('Unexpected application file access');
}
for (const name of ['readFileSync', 'readFile', 'openSync', 'open', 'createReadStream']) {
  const original = fs[name];
  fs[name] = function (filename, ...args) { checkFile(filename); return original.call(this, filename, ...args); };
}
for (const name of ['readFile', 'open']) {
  const original = fs.promises[name];
  fs.promises[name] = function (filename, ...args) { checkFile(filename); return original.call(this, filename, ...args); };
}
function blockNetwork(name) {
  return function () { audit.networkAttempts.push(name); throw new Error('Network is forbidden in retirement proof'); };
}
globalThis.fetch = blockNetwork('fetch');
for (const [moduleName, methods] of Object.entries({
  'node:http': ['request', 'get'], 'node:https': ['request', 'get'],
  'node:net': ['connect', 'createConnection'], 'node:tls': ['connect'],
  'node:dns': ['lookup', 'resolve'],
})) {
  const target = require(moduleName);
  for (const name of methods) target[name] = blockNetwork(moduleName + '.' + name);
}
syncBuiltinESMExports();
process.on('exit', () => process.stderr.write('\nRETIREMENT_BOUNDARY_AUDIT=' + JSON.stringify(audit) + '\n'));