@1agh/maude 0.45.2 → 0.47.0

package/apps/studio/bin/_pdf-playwright.mjs

@@ -5,13 +5,26 @@
 // Per DDR-041 (PDF via page.pdf()): print-media emulation, font readiness
 // wait, explicit page size matching the artboard rect.
 //
+// feature-2-print-artboards T5 (dogfood follow-up) — a "vector PDF" is only
+// vector for TEXT and drawn shapes; any raster <img>/<canvas> content on the
+// artboard (a photo dropped onto a flyer, a large-format billboard authored
+// at a small on-screen scale) still embeds as a bitmap, and that bitmap's
+// pixel density is set by the CAPTURING context's deviceScaleFactor — 1× by
+// default, which looks fine on screen but is visibly soft once printed large
+// (e.g. a design authored at 1:10 scale for a billboard). `--scale` sets the
+// context's deviceScaleFactor before `page.pdf()` runs, exactly like
+// _png-playwright.mjs, so embedded raster content captures at print density
+// while vector text/shapes stay crisp regardless (they're never rasterized).
+// Page SIZE (in pt) is unaffected — it always comes from the artboard's own
+// rect, not from this scale.
+//
 // Invocation (Bun.spawn from exporters/pdf.ts — not invoked directly):
 //   node _pdf-playwright.mjs --url <url> --selector <css> --out <path>
-//     [--multi] [--out-dir <dir>] [--timeout 12]
+//     [--multi] [--out-dir <dir>] [--timeout 12] [--scale 3.125]
 
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { launchChromium } from './_pw-launch.mjs';
+import { assertRenderOutputSizeOk, launchChromium, safeArtboardFilename } from './_pw-launch.mjs';
 
 const args = Object.fromEntries(
   process.argv.slice(2).reduce((acc, cur, i, all) => {
@@ -28,6 +41,7 @@ const {
   'widen-to-artboard': widenFlag,
   multi: multiFlag,
   timeout = '12',
+  scale = '1',
 } = args;
 
 if (!url) {
@@ -38,10 +52,21 @@ if (!url) {
 const widen = widenFlag !== undefined;
 const multi = multiFlag !== undefined;
 const timeoutMs = Number(timeout) * 1000;
+// Same ceiling as _png-playwright.mjs's raised T4 ceiling (600dpi = 6.25×).
+// The PDF *page* stays vector-sized regardless of this factor (only raster
+// CONTENT density scales with it — see the file header) — but Chromium's
+// rendering/rasterization surface for `page.pdf()` scales with
+// deviceScaleFactor exactly like a screenshot buffer does, so the same
+// output-size guard as PNG's DOES apply here (see assertRenderOutputSizeOk
+// call below); a huge artboard + high DPI is just as costly to render.
+const deviceScaleFactor = Math.max(1, Math.min(8, Number(scale) || 1));
 
 const browser = await launchChromium();
 try {
-  const ctx = await browser.newContext({ viewport: { width: 1440, height: 900 } });
+  const ctx = await browser.newContext({
+    viewport: { width: 1440, height: 900 },
+    deviceScaleFactor,
+  });
   const page = await ctx.newPage();
   await page.goto(url, { waitUntil: 'load', timeout: timeoutMs });
   // Wait for web fonts so `@font-face` glyphs land in the PDF instead of
@@ -102,9 +127,15 @@ try {
       const r = el.getBoundingClientRect();
       return { w: r.width, h: r.height, x: r.left, y: r.top };
     });
+    assertRenderOutputSizeOk(rect.w, rect.h, deviceScaleFactor, '_pdf-playwright');
+    // feature-2-print-artboards T5 — name multi output by the artboard's
+    // OWN id (mirrors _png-playwright.mjs's multi-write scheme) rather than
+    // a positional index, so the PDF post-pass can correlate each written
+    // file back to its artboard's `print` prop via the filename alone.
+    const screenId = multi ? await screens[i].getAttribute('data-dc-screen') : null;
     // Set the page size to the artboard's pixel dimensions so the resulting
     // PDF is exactly one artboard per page with no margin.
-    const targetPath = multi ? join(outDir, `artboard-${i + 1}.pdf`) : out;
+    const targetPath = multi ? join(outDir, safeArtboardFilename(screenId, i, 'pdf')) : out;
     // Crop trick: set the viewport to the artboard rect, scroll it into the
     // top-left corner, then page.pdf() with matching width/height.
     await page.setViewportSize({

package/apps/studio/bin/_png-playwright.mjs

@@ -7,7 +7,7 @@
 
 import { mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { launchChromium } from './_pw-launch.mjs';
+import { launchChromium, safeArtboardFilename } from './_pw-launch.mjs';
 
 const args = Object.fromEntries(
   process.argv.slice(2).reduce((acc, cur, i, all) => {
@@ -35,7 +35,38 @@ if (!url) {
 const widen = widenFlag !== undefined;
 const multi = multiFlag !== undefined;
 const timeoutMs = Number(timeout) * 1000;
-const deviceScaleFactor = Math.max(1, Math.min(4, Number(scale) || 1));
+// feature-2-print-artboards T4 — ceiling raised 4→8 so a 300dpi export
+// (3.125×) AND 600dpi (6.25×) both fit; exporters/png.ts resolveDeviceScale
+// is the only caller that can reach beyond 3, via the `dpi` option.
+const deviceScaleFactor = Math.max(1, Math.min(8, Number(scale) || 1));
+// feature-2-print-artboards T4 — a raster export's actual pixel dimensions
+// are only known once the target element's DOM rect is measured below (the
+// adapter can't pre-compute them — see png.ts's own comment), so the "too
+// big to render" guard lives here rather than in the Node-side adapter.
+// 16,000px matches common canvas/texture limits across browser engines;
+// ~600MB is a generous RGBA-buffer ceiling (width × height × 4 bytes) well
+// under typical CI/desktop RAM, chosen so a legitimate 600dpi A0 poster still
+// fits (9933×14043px × 4B ≈ 558MB) while a runaway value fails loud instead
+// of OOM-killing the render process.
+const MAX_OUTPUT_SIDE_PX = 16000;
+const MAX_OUTPUT_BYTES = 600 * 1024 * 1024;
+function assertOutputSizeOk(widthCss, heightCss) {
+  const outW = Math.ceil(widthCss * deviceScaleFactor);
+  const outH = Math.ceil(heightCss * deviceScaleFactor);
+  const estBytes = outW * outH * 4;
+  if (outW > MAX_OUTPUT_SIDE_PX || outH > MAX_OUTPUT_SIDE_PX || estBytes > MAX_OUTPUT_BYTES) {
+    const maxScaleForSide = MAX_OUTPUT_SIDE_PX / Math.max(widthCss, heightCss);
+    const maxScaleForBytes = Math.sqrt(MAX_OUTPUT_BYTES / 4 / (widthCss * heightCss));
+    const maxScale = Math.min(maxScaleForSide, maxScaleForBytes);
+    const maxDpi = Math.floor(maxScale * 96);
+    console.error(
+      `_png-playwright: requested output ${outW}×${outH}px at ${deviceScaleFactor}× exceeds the ` +
+        `render guard (max side ${MAX_OUTPUT_SIDE_PX}px / max ~${Math.round(MAX_OUTPUT_BYTES / 1024 / 1024)}MB). ` +
+        `For this artboard size (${Math.round(widthCss)}×${Math.round(heightCss)}px), the max supported DPI is ~${maxDpi}.`
+    );
+    process.exit(1);
+  }
+}
 
 const browser = await launchChromium();
 try {
@@ -97,6 +128,9 @@ try {
       const r = el.getBoundingClientRect();
       return { x: r.left, y: r.top, width: r.width, height: r.height };
     });
+    // feature-2-print-artboards T4 — fail loud BEFORE resizing the viewport
+    // to a pathological size, not after.
+    assertOutputSizeOk(rect.width, rect.height);
     // Resize the viewport to fit the artboard so the screenshot doesn't
     // include the world plane's pan/zoom margin. The artboard then sits at
     // (0,0) with its native dimensions.
@@ -141,8 +175,8 @@ try {
     const screens = await page.locator(selector ?? '[data-dc-screen]').all();
     for (let i = 0; i < screens.length; i += 1) {
       const handle = screens[i];
-      const id = (await handle.getAttribute('data-dc-screen')) ?? `artboard-${i + 1}`;
-      await captureHandle(handle, join(outDir, `${id}.png`));
+      const id = await handle.getAttribute('data-dc-screen');
+      await captureHandle(handle, join(outDir, safeArtboardFilename(id, i, 'png')));
       console.log(`MAUDE_PROGRESS {"current":${i + 1},"total":${screens.length}}`);
     }
   } else {

package/apps/studio/bin/_pw-launch.mjs

@@ -113,3 +113,55 @@ export async function launchChromium(opts) {
     throw err;
   }
 }
+
+// Shared by every multi-artboard export shim (_png/_pdf-playwright.mjs) that
+// names its output file after an artboard's `data-dc-screen` id for T5's
+// filename-correlation convenience. That id comes straight off a live DOM
+// attribute — i.e. from canvas-authored JSX, DDR-054 untrusted content — and
+// feeds directly into `path.join(outDir, ...)`, which does NOT sandbox `..`
+// segments. Re-validates against the SAME shape api.ts's write-side artboard-id
+// ops already enforce (`/^[A-Za-z][\w-]{0,63}$/`) before it's ever used as a
+// path segment; anything else (or a `false`y id) falls back to the safe
+// positional name so a malformed/malicious id can never escape `outDir`.
+const SAFE_ARTBOARD_ID_RE = /^[A-Za-z][\w-]{0,63}$/;
+export function safeArtboardFilename(id, index, ext) {
+  const safe =
+    typeof id === 'string' && SAFE_ARTBOARD_ID_RE.test(id) ? id : `artboard-${index + 1}`;
+  return `${safe}.${ext}`;
+}
+
+// Shared by every raster-capture export shim (_png/_pdf-playwright.mjs) that
+// scales its render surface by `deviceScaleFactor` (feature-2-print-artboards
+// T4's DPI support). The requested pixel output is only knowable once the
+// target element's DOM rect is measured (the Node-side adapter can't
+// pre-compute it), so this guard lives here rather than in exporters/*.ts.
+// Applies EQUALLY to the PDF shim: `deviceScaleFactor` scales Chromium's
+// whole rendering/rasterization surface for `page.pdf()` too, not just PNG's
+// screenshot buffer — the PDF *page* stays vector-sized regardless, but the
+// backing store Chromium allocates to paint it does not, so a huge
+// artboard + high DPI is exactly as costly to render as it is for PNG, even
+// though the resulting PDF bytes are typically far smaller than a raw PNG
+// buffer. 16,000px matches common canvas/texture limits across browser
+// engines; ~600MB is a generous RGBA-buffer ceiling (width × height × 4
+// bytes) chosen so a legitimate 600dpi A0 poster still fits (9933×14043px ×
+// 4B ≈ 558MB) while a runaway value fails loud instead of OOM-killing the
+// render process.
+const MAX_OUTPUT_SIDE_PX = 16000;
+const MAX_OUTPUT_BYTES = 600 * 1024 * 1024;
+export function assertRenderOutputSizeOk(widthCss, heightCss, deviceScaleFactor, label) {
+  const outW = Math.ceil(widthCss * deviceScaleFactor);
+  const outH = Math.ceil(heightCss * deviceScaleFactor);
+  const estBytes = outW * outH * 4;
+  if (outW > MAX_OUTPUT_SIDE_PX || outH > MAX_OUTPUT_SIDE_PX || estBytes > MAX_OUTPUT_BYTES) {
+    const maxScaleForSide = MAX_OUTPUT_SIDE_PX / Math.max(widthCss, heightCss);
+    const maxScaleForBytes = Math.sqrt(MAX_OUTPUT_BYTES / 4 / (widthCss * heightCss));
+    const maxScale = Math.min(maxScaleForSide, maxScaleForBytes);
+    const maxDpi = Math.floor(maxScale * 96);
+    console.error(
+      `${label}: requested output ${outW}×${outH}px at ${deviceScaleFactor}× exceeds the ` +
+        `render guard (max side ${MAX_OUTPUT_SIDE_PX}px / max ~${Math.round(MAX_OUTPUT_BYTES / 1024 / 1024)}MB). ` +
+        `For this artboard size (${Math.round(widthCss)}×${Math.round(heightCss)}px), the max supported DPI is ~${maxDpi}.`
+    );
+    process.exit(1);
+  }
+}

package/apps/studio/bin/_pw-launch.test.mjs

@@ -0,0 +1,90 @@
+// _pw-launch.test.mjs — the pure, security-relevant helpers shared by the
+// multi-artboard export shims (_png/_pdf-playwright.mjs). Regression coverage
+// for the arbitrary-file-write finding fixed in the print-artboards dogfood
+// pass (DDR-182 addendum): a `data-dc-screen` id is DDR-054 untrusted canvas
+// content, and used to be trusted verbatim as a `path.join` segment.
+
+import { describe, expect, test } from 'bun:test';
+import { assertRenderOutputSizeOk, safeArtboardFilename } from './_pw-launch.mjs';
+
+describe('safeArtboardFilename', () => {
+  test('passes a well-formed id through unchanged', () => {
+    expect(safeArtboardFilename('ak-alpha', 0, 'pdf')).toBe('ak-alpha.pdf');
+    expect(safeArtboardFilename('Beta_2', 3, 'png')).toBe('Beta_2.png');
+  });
+
+  test('falls back to the positional name for a path-traversal id', () => {
+    expect(safeArtboardFilename('../../../../tmp/pwned', 2, 'pdf')).toBe('artboard-3.pdf');
+    expect(safeArtboardFilename('/etc/passwd', 0, 'png')).toBe('artboard-1.png');
+    expect(safeArtboardFilename('..', 1, 'pdf')).toBe('artboard-2.pdf');
+  });
+
+  test('falls back for null/undefined/empty/non-string ids', () => {
+    expect(safeArtboardFilename(null, 0, 'pdf')).toBe('artboard-1.pdf');
+    expect(safeArtboardFilename(undefined, 4, 'png')).toBe('artboard-5.png');
+    expect(safeArtboardFilename('', 1, 'pdf')).toBe('artboard-2.pdf');
+  });
+
+  test('falls back for an id starting with a digit or containing unsafe chars', () => {
+    expect(safeArtboardFilename('1abc', 0, 'pdf')).toBe('artboard-1.pdf');
+    expect(safeArtboardFilename('a/b', 0, 'pdf')).toBe('artboard-1.pdf');
+    expect(safeArtboardFilename('a b', 0, 'pdf')).toBe('artboard-1.pdf');
+  });
+
+  test('falls back for an id over the 64-char cap', () => {
+    expect(safeArtboardFilename(`a${'x'.repeat(64)}`, 0, 'pdf')).toBe('artboard-1.pdf');
+  });
+});
+
+describe('assertRenderOutputSizeOk', () => {
+  test('does not exit for a reasonable A4-at-300dpi request', () => {
+    const origExit = process.exit;
+    let exited = false;
+    process.exit = () => {
+      exited = true;
+    };
+    try {
+      assertRenderOutputSizeOk(818, 1146, 3.125, '_test');
+    } finally {
+      process.exit = origExit;
+    }
+    expect(exited).toBe(false);
+  });
+
+  test('exits when the requested output exceeds the max side guard', () => {
+    const origExit = process.exit;
+    const origError = console.error;
+    let exitCode;
+    process.exit = (code) => {
+      exitCode = code;
+      throw new Error('exit'); // stop the (test-only) function from continuing past exit
+    };
+    console.error = () => {};
+    try {
+      expect(() => assertRenderOutputSizeOk(20000, 20000, 1, '_test')).toThrow();
+    } finally {
+      process.exit = origExit;
+      console.error = origError;
+    }
+    expect(exitCode).toBe(1);
+  });
+
+  test('exits when the requested output exceeds the byte-size guard even under the side cap', () => {
+    const origExit = process.exit;
+    const origError = console.error;
+    let exitCode;
+    process.exit = (code) => {
+      exitCode = code;
+      throw new Error('exit');
+    };
+    console.error = () => {};
+    try {
+      // 15000×15000 stays under the 16000px side cap but blows the ~600MB estimate.
+      expect(() => assertRenderOutputSizeOk(15000, 15000, 1, '_test')).toThrow();
+    } finally {
+      process.exit = origExit;
+      console.error = origError;
+    }
+    expect(exitCode).toBe(1);
+  });
+});