feat: Create Bun.sh adapter

[blaine-arcjet]

This creates an Arcjet SDK adapter for bun.sh. This was much the same as the Node.js adapter, but I needed to introduce a new API to the adapter: aj.handler(). This API is used to wrap the request handler (called fetch() in Bun) to do some preprocessing on the request—in this case looking up the IP with server.requestIP(request) before storing it in a WeakMap.

Users could use this without using the aj.handler() function, but they'd need to have a proper IP existing in the headers, such as the Fly-Client-IP on fly.io; however, those won't exist when running locally and the protect() call will error without using aj.handler().

TODO:

• [x] Add to CI and dependabot
• [x] SDK Stack in protobuf
• [x] Examples

Closes #475

[trunk-io[bot]]

😎 Merged successfully - details.

[socket-security[bot]]

New dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@types/[email protected]	None	0	3.62 kB	types
npm/[email protected]	None	+1	374 kB	robobun

View full report↗︎

[socket-security[bot]]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/@types/[email protected]

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

[blaine-arcjet]

@SocketSecurity ignore npm/@types/[email protected]

[blaine-arcjet]

The bun examples fall into similar camp to our nodejs examples in that we'd need to run the servers to test them so I'm not going to add them to CI.

[blaine-arcjet]

Examples are done so I think this is good for a full review.

[blaine-arcjet]

Oh, and I chose handler instead of wrap for the API to wrap the fetch handler.

[davidmytton]

I push a change to the README to run the server in hot reload mode because that makes it easier for the developer to make changes. I also added some log lines to the server to show the result so it's clearer what is happening.

However, when I run the bun-rl example, I get 2 calls to Arcjet. Are you also seeing this?

bun run --hot index.ts
Started server http://localhost:3000
Arcjet Request ID req_01hy04aq4ge9yaamr9pg4e29t1
Arcjet decision DENY
Arcjet Request ID lreq_01hy04aq53fn18k0dvvfr6dh1r
Arcjet decision DENY

[blaine-arcjet]

Just realized that this needs readme and stuff

[bendechrai]

Looks good to me 👍 I pushed a minor consistency/comment change to reflect the change of wrap() to handler().

[notion-workspace[bot]]

🔌 Additional JS adapters