gcp-metadata - npm Package Compare versions

Comparing version 5.2.0 to 5.3.0

build/src/index.d.ts

@@ -17,2 +17,13 @@ /**
 }>;
+/**
+ * Metadata server detection override options.
+ *
+ * Available via `process.env.METADATA_SERVER_DETECTION`.
+ */
+export declare const METADATA_SERVER_DETECTION: Readonly<{
+    'assume-present': "don't try to ping the metadata server, but assume it's present";
+    none: "don't try to ping the metadata server, but don't try to use it either";
+    'bios-only': "treat the result of a BIOS probe as canonical (don't fall back to pinging)";
+    'ping-only': "skip the BIOS probe, and go straight to pinging";
+}>;
 export interface Options {
@@ -46,2 +57,9 @@ params?: {
 /**
+ * Detects GCP Residency.
+ * Caches results to reduce costs for subsequent calls.
+ *
+ * @see setGCPResidency for setting
+ */
+export declare function getGCPResidency(): boolean;
+/**
  * Sets the detected GCP Residency.
@@ -51,2 +69,3 @@ * Useful for forcing metadata server detection behavior.
  * Set `null` to autodetect the environment (default behavior).
+ * @see getGCPResidency for getting
  */
@@ -53,0 +72,0 @@ export declare function setGCPResidency(value?: boolean | null): void;

build/src/index.js

@@ -23,3 +23,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requestTimeout = exports.setGCPResidency = exports.gcpResidencyCache = exports.resetIsAvailableCache = exports.isAvailable = exports.project = exports.instance = exports.HEADERS = exports.HEADER_VALUE = exports.HEADER_NAME = exports.SECONDARY_HOST_ADDRESS = exports.HOST_ADDRESS = exports.BASE_PATH = void 0;
+exports.requestTimeout = exports.setGCPResidency = exports.getGCPResidency = exports.gcpResidencyCache = exports.resetIsAvailableCache = exports.isAvailable = exports.project = exports.instance = exports.METADATA_SERVER_DETECTION = exports.HEADERS = exports.HEADER_VALUE = exports.HEADER_NAME = exports.SECONDARY_HOST_ADDRESS = exports.HOST_ADDRESS = exports.BASE_PATH = void 0;
 const gaxios_1 = require("gaxios");
@@ -35,2 +35,13 @@ const jsonBigint = require("json-bigint");
 /**
+ * Metadata server detection override options.
+ *
+ * Available via `process.env.METADATA_SERVER_DETECTION`.
+ */
+exports.METADATA_SERVER_DETECTION = Object.freeze({
+    'assume-present': "don't try to ping the metadata server, but assume it's present",
+    none: "don't try to ping the metadata server, but don't try to use it either",
+    'bios-only': "treat the result of a BIOS probe as canonical (don't fall back to pinging)",
+    'ping-only': 'skip the BIOS probe, and go straight to pinging',
+});
+/**
  * Returns the base URL while taking into account the GCE_METADATA_HOST
@@ -198,2 +209,18 @@ * environment variable if it exists.
 async function isAvailable() {
+    if (process.env.METADATA_SERVER_DETECTION) {
+        const value = process.env.METADATA_SERVER_DETECTION.trim().toLocaleLowerCase();
+        if (!(value in exports.METADATA_SERVER_DETECTION)) {
+            throw new RangeError(`Unknown \`METADATA_SERVER_DETECTION\` env variable. Got \`${value}\`, but it should be \`${Object.keys(exports.METADATA_SERVER_DETECTION).join('`, `')}\`, or unset`);
+        }
+        switch (value) {
+            case 'assume-present':
+                return true;
+            case 'none':
+                return false;
+            case 'bios-only':
+                return getGCPResidency();
+            case 'ping-only':
+            // continue, we want to ping the server
+        }
+    }
     try {
@@ -263,2 +290,15 @@ // If a user is instantiating several GCP libraries at the same time,
 /**
+ * Detects GCP Residency.
+ * Caches results to reduce costs for subsequent calls.
+ *
+ * @see setGCPResidency for setting
+ */
+function getGCPResidency() {
+    if (exports.gcpResidencyCache === null) {
+        setGCPResidency();
+    }
+    return exports.gcpResidencyCache;
+}
+exports.getGCPResidency = getGCPResidency;
+/**
  * Sets the detected GCP Residency.
@@ -268,2 +308,3 @@ * Useful for forcing metadata server detection behavior.
  * Set `null` to autodetect the environment (default behavior).
+ * @see getGCPResidency for getting
  */
@@ -284,7 +325,3 @@ function setGCPResidency(value = null) {
 function requestTimeout() {
-    // Detecting the residency can be resource-intensive. Let's cache the result.
-    if (exports.gcpResidencyCache === null) {
-        exports.gcpResidencyCache = (0, gcp_residency_1.detectGCPResidency)();
-    }
-    return exports.gcpResidencyCache ? 0 : 3000;
+    return getGCPResidency() ? 0 : 3000;
 }
@@ -291,0 +328,0 @@ exports.requestTimeout = requestTimeout;

CHANGELOG.md

@@ -7,2 +7,9 @@ # Changelog
 
+## [5.3.0](https://github.com/googleapis/gcp-metadata/compare/v5.2.0...v5.3.0) (2023-06-28)
+
+
+### Features
+
+* Metadata Server Detection Configuration ([#562](https://github.com/googleapis/gcp-metadata/issues/562)) ([8c7c715](https://github.com/googleapis/gcp-metadata/commit/8c7c715f1fc22ad65554a745a93915713ca6698f))
+
 ## [5.2.0](https://github.com/googleapis/gcp-metadata/compare/v5.1.0...v5.2.0) (2023-01-03)
@@ -9,0 +16,0 @@

package.json

 {
   "name": "gcp-metadata",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "description": "Get the metadata from a Google Cloud Platform environment",
@@ -44,2 +44,3 @@ "repository": "googleapis/gcp-metadata",
   "devDependencies": {
+    "@babel/plugin-proposal-private-methods": "^7.18.6",
     "@compodoc/compodoc": "^1.1.10",
@@ -54,3 +55,3 @@ "@google-cloud/functions": "^2.0.0",
     "@types/uuid": "^9.0.0",
-    "c8": "^7.0.0",
+    "c8": "^8.0.0",
     "cross-env": "^7.0.3",
@@ -57,0 +58,0 @@ "gcbuild": "^1.3.4",

README.md

@@ -140,12 +140,21 @@ [//]: # "This README.md file is auto-generated, all changes to this file will be lost."
 
-* GCE_METADATA_HOST: provide an alternate host or IP to perform lookup against (useful, for example, you're connecting through a custom proxy server).
+* `GCE_METADATA_HOST`: provide an alternate host or IP to perform lookup against (useful, for example, you're connecting through a custom proxy server).
 
-For example:
-```
-export GCE_METADATA_HOST = '169.254.169.254'
-```
+  For example:
+  ```
+  export GCE_METADATA_HOST = '169.254.169.254'
+  ```
 
-* DETECT_GCP_RETRIES: number representing number of retries that should be attempted on metadata lookup.
+* `DETECT_GCP_RETRIES`: number representing number of retries that should be attempted on metadata lookup.
 
+* `DEBUG_AUTH`: emit debugging logs
 
+* `METADATA_SERVER_DETECTION`: configure desired metadata server availability check behavior.
+
+  * `assume-present`: don't try to ping the metadata server, but assume it's present
+  * `none`: don't try to ping the metadata server, but don't try to use it either
+  * `bios-only`: treat the result of a BIOS probe as canonical (don't fall back to pinging)
+  * `ping-only`: skip the BIOS probe, and go straight to pinging
+
+
 ## Samples
@@ -152,0 +161,0 @@

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 8 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 7 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

75154

5.17%

Lines of code

574

10.81%

Number of lines in readme file

237

3.95%

Worsened metrics

Dev dependency count

23

4.55%

Number of low supply chain risk alerts

19

46.15%

No dependency changes