@antelopejs/dms 0.11.0 → 0.12.0

package/frontend-vue/layers/dms-auth/server/accounts.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { DmsServerEvent, DmsSession } from "#dms/server";
+import { isString } from "../../dms-core/app/utils/type-check";
 
 /**
  * The accounts this browser is signed in to: an index of their descriptors,
@@ -55,6 +56,7 @@ function accountCookieName(accountId: string): string {
 }
 
 function descriptor(session: DmsSession, accountId: string): AccountDescriptor {
+  // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- The session owner does not prove these optional legacy user fields are strings. This preserves the existing unchecked descriptor projection; parsing or coercing them would change stored account payloads.
   const user = (session.user ?? {}) as SessionUser;
   return {
     accountId,
@@ -79,9 +81,9 @@ function writeAccountIndex(event: DmsServerEvent, accounts: AccountIndex) {
 
 export function readAccount(
   event: DmsServerEvent,
-  accountId: unknown,
+  accountId: Parameters<typeof isString>[0],
 ): StoredAccount | undefined {
-  if (typeof accountId !== "string" || !UUID.test(accountId)) return undefined;
+  if (!isString(accountId) || !UUID.test(accountId)) return undefined;
   return event.cookies.readSealed<StoredAccount>(accountCookieName(accountId));
 }
 
@@ -125,10 +127,13 @@ export function persistAccountSession(
   return account;
 }
 
-export function removeAccount(event: DmsServerEvent, accountId: unknown) {
+export function removeAccount(
+  event: DmsServerEvent,
+  accountId: Parameters<typeof readAccount>[1],
+) {
   const accounts = { ...readAccounts(event) };
-  if (typeof accountId === "string") delete accounts[accountId];
+  if (isString(accountId)) delete accounts[accountId];
   writeAccountIndex(event, accounts);
-  if (typeof accountId === "string" && UUID.test(accountId))
+  if (isString(accountId) && UUID.test(accountId))
     event.cookies.clear(accountCookieName(accountId));
 }

package/frontend-vue/layers/dms-auth/server/actions.ts

@@ -1,4 +1,5 @@
-import type { DmsServerEvent } from "#dms/server";
+import { isString } from "../../dms-core/app/utils/type-check";
+import type { DmsBackendRequest, DmsServerEvent } from "#dms/server";
 import {
   isPersistent,
   persistAccountSession,
@@ -9,18 +10,14 @@ import {
 } from "./accounts";
 import { isRefusal, type SessionTokens, sessionFrom } from "./session";
 
-// Carries the "keep me signed in" choice of a login across its 2FA step, whose
-// request names only the challenge. Lives as long as the challenge token.
 const PENDING_LOGIN = "dms_pending_login";
 const PENDING_LOGIN_PATH = "/auth/verify-2fa";
 const PENDING_LOGIN_LIFETIME_S = 300;
 
-// Absolute backend API paths only: no scheme, no authority, no query string,
-// and no segment that could climb out of `/api/`.
 const BACKEND_API_PATH =
   /^\/api\/[A-Za-z0-9][A-Za-z0-9._~-]*(?:\/[A-Za-z0-9][A-Za-z0-9._~-]*)*$/;
 
-type Input = Record<string, unknown>;
+type Input = Record<string, DmsBackendRequest["body"]>;
 
 interface EstablishResult extends SessionTokens {
   requires_2fa?: boolean;
@@ -40,14 +37,14 @@ interface PendingLogin {
 async function establishWith(
   event: DmsServerEvent,
   endpoint: string,
-  payload: unknown,
+  payload: DmsBackendRequest["body"],
   persistent = true,
 ) {
   const result = await event.backend<EstablishResult>(endpoint, {
     method: "POST",
     body: payload,
   });
-  if (result.requires_2fa && typeof result.two_factor_token === "string")
+  if (result.requires_2fa && isString(result.two_factor_token))
     event.cookies.writeSealed(
       PENDING_LOGIN,
       { token: result.two_factor_token, persistent },
@@ -88,7 +85,7 @@ export async function verifyTwoFactor(event: DmsServerEvent) {
   const input = await event.readJson<Input>();
   const pending = event.cookies.readSealed<PendingLogin>(PENDING_LOGIN);
   const persistent =
-    typeof input.token === "string" && pending?.token === input.token
+    isString(input.token) && pending?.token === input.token
       ? isPersistent(pending)
       : true;
   return establishWith(event, "/api/auth/verify-2fa", input, persistent);
@@ -113,7 +110,7 @@ export function isAllowedEstablishEndpoint(
   allowed: readonly string[],
 ): endpoint is string {
   return (
-    typeof endpoint === "string" &&
+    isString(endpoint) &&
     BACKEND_API_PATH.test(endpoint) &&
     allowed.includes(endpoint)
   );
@@ -185,6 +182,7 @@ export async function switchAccount(event: DmsServerEvent) {
     const descriptor = persistAccountSession(
       event,
       session,
+      // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- readAccount gates a prior accountId read, not this later property access. Preserve unchecked forwarding and repeated getter calls without claiming the current value is validated.
       input.accountId as string,
     );
     return { success: true, user, account: descriptor };
@@ -241,6 +239,7 @@ export async function validateAccount(event: DmsServerEvent) {
       method: "POST",
       body: { token: account.refreshToken },
     });
+    // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- readAccount gates a prior accountId read, not this later property access. Preserve unchecked forwarding and repeated getter calls without claiming the current value is validated.
     storeValidatedAccount(event, account, input.accountId as string, tokens);
     return { valid: true };
   } catch (error) {

package/frontend-vue/layers/dms-auth/server/oauth.ts

@@ -3,10 +3,7 @@ import type { DmsServerEvent } from "#dms/server";
 import { privateSecret } from "../../../server/private-options";
 import { persistAccountSession } from "./accounts";
 import { type SessionTokens, sessionFrom } from "./session";
-
-// The provider sign-in, on the frontend's origin: the backend builds the
-// provider's URL and its callback (`relay.ts`, `config.ts`) and checks the
-// relay header this server sends, from the DMS module's private options.
+import { isNumber, isString } from "../../dms-core/app/utils/type-check";
 
 const FLOW = "dms_oauth_flow";
 const HANDOFF = "dms_oauth_handoff";
@@ -44,14 +41,13 @@ interface OAuthResult extends SessionTokens {
   methods?: unknown;
 }
 
-// Process-local, like the session refresh: one frontend process per sticky
-// client. A development reload of this file starts it over.
 const attempts = new Map<string, RateWindow>();
 
 function sweepAttempts(now: number) {
   for (const [key, window] of attempts)
     if (now - window.startedAt >= RATE_WINDOW_MS) attempts.delete(key);
   while (attempts.size >= MAX_RATE_LIMIT_CLIENTS)
+    // SAFETY: The synchronous loop requires at least 10,000 entries in this Map<string, RateWindow>, so next() has a string key.
     attempts.delete(attempts.keys().next().value as string);
 }
 
@@ -72,12 +68,12 @@ function rateLimited(event: DmsServerEvent, scope: string): boolean {
 }
 
 export function isValidOAuthProvider(provider: unknown): provider is string {
-  return typeof provider === "string" && PROVIDER.test(provider);
+  return isString(provider) && PROVIDER.test(provider);
 }
 
 function safePath(value: string | null): string {
   if (
-    typeof value !== "string" ||
+    !isString(value) ||
     !value.startsWith("/") ||
     value.startsWith("//") ||
     value.includes("\\")
@@ -99,19 +95,17 @@ function errorRedirect(key: string): Response {
   return redirect(`${SIGN_IN}?oauth_error=${encodeURIComponent(key)}`);
 }
 
-// The backend's own OAuth key says why a provider sign-in failed; any other
-// failure keeps the generic one.
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- Catch values have no shared owner schema; an Error-only parameter would exclude existing thrown payloads.
 function failureRedirect(error: unknown): Response {
   const message = error instanceof Error ? error.message : "";
+  // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- This unchecked status access preserves existing thrown-value handling, including a TypeError for nullish errors; no validated owner exists.
   const status = (error as { status?: unknown }).status;
   return errorRedirect(
-    typeof status === "number" && message.startsWith(OAUTH_ERROR)
-      ? message
-      : FAILED,
+    isNumber(status) && message.startsWith(OAUTH_ERROR) ? message : FAILED,
   );
 }
 
-function relayHeaders(event: DmsServerEvent): Record<string, string> {
+function relayHeaders(event: DmsServerEvent) {
   const secret = privateSecret(
     event,
     "oauth",
@@ -155,8 +149,11 @@ export async function oauthStart(event: DmsServerEvent): Promise<Response> {
   }
 }
 
-function sameState(left: unknown, right: unknown): boolean {
-  if (typeof left !== "string" || typeof right !== "string") return false;
+function sameState(
+  left: OAuthFlow["state"],
+  right: OAuthFlow["state"],
+): boolean {
+  if (!isString(left) || !isString(right)) return false;
   const a = Buffer.from(left);
   const b = Buffer.from(right);
   return a.length === b.length && timingSafeEqual(a, b);
@@ -168,9 +165,9 @@ function validCallback(flow: OAuthFlow | undefined, query: URLSearchParams) {
   return Boolean(
     flow &&
       flow.expiresAt >= Date.now() &&
-      typeof code === "string" &&
+      isString(code) &&
       code.length <= MAX_CALLBACK_PARAMETER_LENGTH &&
-      typeof state === "string" &&
+      isString(state) &&
       state.length <= MAX_CALLBACK_PARAMETER_LENGTH &&
       sameState(state, flow.state),
   );

package/frontend-vue/layers/dms-auth/server/session.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import type { DmsPublicSession, DmsServerEvent, DmsSession } from "#dms/server";
 import { isPersistent, persistAccountSession, removeAccount } from "./accounts";
+import { isNumber } from "../../dms-core/app/utils/type-check";
 
 const REFRESH_TTL_MS = 15_000;
 const REFUSED = [400, 401, 403];
@@ -19,9 +20,11 @@ interface RefreshFlight {
 
 const refreshes = new Map<string, RefreshFlight>();
 
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- This rejection boundary handles arbitrary thrown values; a backend error owner type would exclude primitive errors.
 export function isRefusal(error: unknown): boolean {
+  // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- Unchecked optional property access intentionally preserves primitive boxing and getter behavior; no owner contract validates thrown values.
   const status = (error as { status?: unknown } | undefined)?.status;
-  return typeof status === "number" && REFUSED.includes(status);
+  return isNumber(status) && REFUSED.includes(status);
 }
 
 /**
@@ -39,7 +42,7 @@ export function sessionFrom(
       result.access_token.split(".")[1] ?? "",
       "base64url",
     ).toString() || "{}",
-  ) as { tenantId?: string };
+  );
   return {
     user: result.user,
     accessToken: result.access_token,

package/frontend-vue/layers/dms-auth/shared/oauth.ts

@@ -1,3 +1,5 @@
+import { isString } from "../../dms-core/app/utils/type-check";
+
 export interface TwoFactorHandoff {
   kind: "2fa";
   token: string;
@@ -40,8 +42,10 @@ const ABSOLUTE_PATH_PATTERN = /^\/(?!\/)[^\\]*$/;
  * and must never turn the login flow into an open redirect. Shared so the
  * server routes and the completion page apply the exact same rule.
  */
-export function sanitizeRedirectPath(value: unknown): string {
-  if (typeof value !== "string" || !ABSOLUTE_PATH_PATTERN.test(value)) {
+export function sanitizeRedirectPath(
+  value: Parameters<typeof isString>[0],
+): string {
+  if (!isString(value) || !ABSOLUTE_PATH_PATTERN.test(value)) {
     return "";
   }
   return value;

package/frontend-vue/layers/dms-core/app/build/composables/auth/usePermissionPreview.ts

@@ -36,22 +36,25 @@ function readStorage(storage: Storage, key: string): string | null {
 }
 
 function writeStorage(storage: Storage, key: string, value: string): void {
+  // prettier-ignore
   try {
     storage.setItem(key, value);
   } catch {
-    /* storage unavailable (private mode, quota): the preview tab finds nothing */
+    // eslint-disable-line no-empty -- Failed storage writes lose preview session sharing or reload persistence, not the editor's state.
   }
 }
 
 function removeStorage(storage: Storage, key: string): void {
+  // prettier-ignore
   try {
     storage.removeItem(key);
   } catch {
-    /* noop */
+    // eslint-disable-line no-empty -- Unavailable storage does not interrupt preview cleanup.
   }
 }
 
 function removeSessions(isRemoved: (key: string) => boolean): void {
+  // prettier-ignore
   try {
     for (let index = localStorage.length - 1; index >= 0; index--) {
       const key = localStorage.key(index);
@@ -59,11 +62,10 @@ function removeSessions(isRemoved: (key: string) => boolean): void {
       if (isRemoved(key)) removeStorage(localStorage, key);
     }
   } catch {
-    /* noop */
+    // eslint-disable-line no-empty -- Unavailable storage does not interrupt preview cleanup.
   }
 }
 
-// Sessions left behind by tabs closed without "Exit preview".
 function pruneStaleSessions(now: number): void {
   removeSessions((key) => {
     const session = parsePreviewSession(readStorage(localStorage, key));
@@ -77,7 +79,6 @@ function newPreviewId(): string {
     : `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`;
 }
 
-// Only the latest preview request may land: the route and the edits both move.
 let refreshGeneration = 0;
 
 function usePreviewState() {
@@ -98,6 +99,50 @@ function usePreviewState() {
   };
 }
 
+function createPreviewSharing() {
+  function share(id: string, input: PermissionPreviewInput): void {
+    const session: PermissionPreviewSession = {
+      ...input,
+      id,
+      updatedAt: Date.now(),
+    };
+    writeStorage(localStorage, storageKey(id), JSON.stringify(session));
+  }
+
+  /** Open a preview tab on `path`; returns the id to keep it in sync. */
+  function start(input: PermissionPreviewInput, path: string): string {
+    pruneStaleSessions(Date.now());
+    const id = newPreviewId();
+    share(id, input);
+    window.open(buildPreviewUrl(path, id), "_blank");
+    return id;
+  }
+
+  /** Push the editor's latest edits to an open preview tab. */
+  function update(id: string, input: PermissionPreviewInput): void {
+    if (readStorage(localStorage, storageKey(id)) === null) return;
+    share(id, input);
+  }
+
+  function readSession(id: string): PermissionPreviewSession | null {
+    const session = parsePreviewSession(
+      readStorage(localStorage, storageKey(id)),
+    );
+    return session && session.id === id ? session : null;
+  }
+
+  function takeIdFromLocation(): string | null {
+    const url = new URL(window.location.href);
+    const id = url.searchParams.get(PERMISSION_PREVIEW_QUERY_KEY);
+    if (!id) return null;
+    url.searchParams.delete(PERMISSION_PREVIEW_QUERY_KEY);
+    window.history.replaceState(window.history.state, "", url.href);
+    return id;
+  }
+
+  return { start, update, readSession, takeIdFromLocation };
+}
+
 /**
  * "Preview as role": the roles editor opens a tab that browses the real
  * dashboard as a role would see it — its unsaved edits included. The server
@@ -162,45 +207,8 @@ export function usePermissionPreview() {
     return isPreviewEntryLocked(isActive.value, hiddenQuickActions.value, key);
   }
 
-  function share(id: string, input: PermissionPreviewInput): void {
-    const session: PermissionPreviewSession = {
-      ...input,
-      id,
-      updatedAt: Date.now(),
-    };
-    writeStorage(localStorage, storageKey(id), JSON.stringify(session));
-  }
-
-  /** Open a preview tab on `path`; returns the id to keep it in sync. */
-  function start(input: PermissionPreviewInput, path: string): string {
-    pruneStaleSessions(Date.now());
-    const id = newPreviewId();
-    share(id, input);
-    window.open(buildPreviewUrl(path, id), "_blank");
-    return id;
-  }
-
-  /** Push the editor's latest edits to an open preview tab. */
-  function update(id: string, input: PermissionPreviewInput): void {
-    if (readStorage(localStorage, storageKey(id)) === null) return;
-    share(id, input);
-  }
-
-  function readSession(id: string): PermissionPreviewSession | null {
-    const session = parsePreviewSession(
-      readStorage(localStorage, storageKey(id)),
-    );
-    return session && session.id === id ? session : null;
-  }
-
-  function takeIdFromLocation(): string | null {
-    const url = new URL(window.location.href);
-    const id = url.searchParams.get(PERMISSION_PREVIEW_QUERY_KEY);
-    if (!id) return null;
-    url.searchParams.delete(PERMISSION_PREVIEW_QUERY_KEY);
-    window.history.replaceState(window.history.state, "", url.href);
-    return id;
-  }
+  const { start, update, readSession, takeIdFromLocation } =
+    createPreviewSharing();
 
   /**
    * Turn this tab into a preview when it was opened as one (or reloaded while
@@ -258,8 +266,7 @@ export function usePermissionPreview() {
     if (!session) return;
     removeStorage(localStorage, storageKey(session.id));
     window.close();
-    // Still open: the tab was not opened by the editor (a reload in a new
-    // window, a copied URL), so it cannot close itself.
+
     setTimeout(() => {
       void navigateDms(session.returnTo);
     }, CLOSE_FALLBACK_DELAY_MS);

package/frontend-vue/layers/dms-core/app/build/composables/renderNow.ts

@@ -1,4 +1,5 @@
 import { getCurrentInstance } from "vue";
+import { isNumber } from "../../utils/type-check";
 
 /**
  * The instant a server render reads the clock at, handed to the browser with
@@ -29,5 +30,5 @@ export function serverRenderNow(): number | null {
     RENDER_NOW_STATE_KEY,
     () => null,
   ).value;
-  return typeof transferred === "number" ? transferred : null;
+  return isNumber(transferred) ? transferred : null;
 }

package/frontend-vue/layers/dms-core/app/build/composables/user/preferencesCookie.ts

@@ -1,6 +1,8 @@
+import { isObject } from "../../../utils/type-check";
+
 /** @internal */
 export interface PreferencesTree {
-  [key: string]: unknown;
+  [key: string]: ReturnType<typeof useDmsCookie>["value"];
 }
 
 /** @internal */
@@ -19,7 +21,7 @@ const BASE64_BLOCK = 4;
 
 /** @internal */
 export const isBranch = (value: unknown): value is PreferencesTree =>
-  !!value && typeof value === "object" && !Array.isArray(value);
+  !!value && isObject(value) && !Array.isArray(value);
 
 const toBase64Url = (text: string): string => {
   const binary = Array.from(new TextEncoder().encode(text), (byte) =>
@@ -71,7 +73,9 @@ export const decodePreferencesTree = (value: string): PreferencesTree => {
  * What the cookie weighs in a request header, name included: the cookie ref
  * writes the JSON of its value, URI-encoded.
  */
-export const preferencesCookieBytes = (value: unknown): number =>
+export const preferencesCookieBytes = (
+  value: ReturnType<typeof useDmsCookie>["value"],
+): number =>
   `${PREFERENCES_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(value))}`
     .length;
 
@@ -125,25 +129,29 @@ export const fitPreferencesBudget = (
 export const writeAt = (
   tree: PreferencesTree,
   keys: string[],
-  value: unknown,
+  value: PreferencesTree[string],
 ): void => {
   const lastKey = keys.at(-1)!;
   let current = tree;
   for (const key of keys.slice(0, -1)) {
     if (!isBranch(current[key])) current[key] = {};
+    // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- The branch check and assignment precede a separate property read. An accessor can return another value; preserve that unchecked second lookup instead of caching or validating it.
     current = current[key] as PreferencesTree;
   }
   current[lastKey] = value;
 };
 
 /** @internal Reads the value at `keys`, `undefined` when a branch is missing. */
-export const readAt = (tree: PreferencesTree, keys: string[]): unknown => {
+export const readAt = (
+  tree: PreferencesTree,
+  keys: string[],
+): PreferencesTree[string] => {
   let current: unknown = tree;
   for (const key of keys) {
-    if (!current || typeof current !== "object" || !(key in current)) {
+    if (!current || !isObject(current) || !(key in current)) {
       return undefined;
     }
-    current = (current as PreferencesTree)[key];
+    current = current[key];
   }
   return current;
 };