fix: add allow provider parameter option to have provider query parameter as experimental

Author: vasco-santos

packages/verified-fetch/src/index.ts

@@ -1034,6 +1034,18 @@ export interface VerifiedFetchInit extends RequestInit, ProgressOptions<BubbledP
    */
   allowInsecure?: boolean
 
+  /**
+   * By default we will not parse provider query parameters, and will not
+   * connect to any hosts over their multiaddresses. Instead, we will use the
+   * default discovery mechanism to find providers for the content.
+   * This is an experimental feature, and may become the default in the future.
+   * If you pass `true` here, we will parse the `provider` query parameter and
+   * connect to the provider specified in the query parameter to retrieve the content.
+   *
+   * @default false
+   */
+  allowProviderParameter?: boolean
+
   /**
    * Whether to include server-timing headers in the response for an individual request.
    *

packages/verified-fetch/src/verified-fetch.ts

@@ -376,7 +376,7 @@ export class VerifiedFetch {
       accept,
       options: {
         ...options,
-        providers: parsedResult.providers
+        providers: options?.allowProviderParameter ? parsedResult.providers : undefined
       },
       withServerTiming,
       onProgress: options?.onProgress,

packages/verified-fetch/test/verified-fetch.spec.ts

@@ -811,15 +811,14 @@ describe('@helia/verified-fetch', () => {
       blockBrokerRetrieveCalledWithProviders = pDefer()
       blockRetriever = stubInterface<Required<Pick<BlockBroker, 'retrieve' | 'createSession'>>>({
         retrieve: sandbox.stub().callsFake(async (cid, options) => {
-          blockBrokerRetrieveCalledWithProviders.resolve(options.providers)
+          blockBrokerRetrieveCalledWithProviders.resolve(options.providers || [])
 
           // attempt to read from the provider
           // eslint-disable-next-line
           const stringProviders = options.providers.map((p: import('@multiformats/multiaddr').Multiaddr) => p.toString())
           if (stringProviders.includes(provider)) {
             return helia.blockstore.get(cid, options)
           }
-          throw new Error('not found')
         }),
         createSession: () => {
           return blockRetriever
@@ -848,7 +847,9 @@ describe('@helia/verified-fetch', () => {
       // broker retriever
       await helia.blockstore.put(cid, rawData)
 
-      const resp = await stubbedVerifiedFetch.fetch(`ipfs://${cid}?provider=${provider}`)
+      const resp = await stubbedVerifiedFetch.fetch(`ipfs://${cid}?provider=${provider}`, {
+        allowProviderParameter: true
+      })
       expect(resp).to.be.ok()
       expect(resp.status).to.equal(200)
       expect(resp.statusText).to.equal('OK')
@@ -880,7 +881,9 @@ describe('@helia/verified-fetch', () => {
       const url = `ipfs://${cid}?${query}`
 
       // Verify response expectations
-      const resp = await stubbedVerifiedFetch.fetch(url)
+      const resp = await stubbedVerifiedFetch.fetch(url, {
+        allowProviderParameter: true
+      })
 
       expect(resp).to.be.ok()
       expect(resp.status).to.equal(200)
@@ -896,6 +899,37 @@ describe('@helia/verified-fetch', () => {
         expect(received).to.include(p)
       }
     })
+
+    it('should not pass providers unless allowProviderParameter option is set', async () => {
+      const rawData = new Uint8Array([0x01, 0x02, 0x03])
+      const cid = CID.createV1(raw.code, await sha256.digest(rawData))
+      // Add raw data to helia (provider instance), which will be called by
+      // broker retriever
+      await helia.blockstore.put(cid, rawData)
+
+      // prepare URL
+      const providers = [
+        provider,
+        '/dns4/provider2.io/tcp/8000/ws'
+      ]
+      const query = providers
+        .map(p => `provider=${p}`)
+        .join('&')
+
+      const url = `ipfs://${cid}?${query}`
+
+      // Verify response expectations
+      // Default behaviour with disabled passing providers from query parameter
+      const resp = await stubbedVerifiedFetch.fetch(url)
+
+      expect(resp).to.be.ok()
+      expect(resp.status).to.not.equal(200)
+      expect(resp.statusText).to.not.equal('OK')
+
+      // Verify block broker is called without providers
+      const providerParams = await blockBrokerRetrieveCalledWithProviders.promise
+      expect(providerParams.length).to.equal(0)
+    })
   })
 
   describe('?format', () => {