@appsemble/lang-sdk 0.40.7-node-brotli.0 → 0.40.8

package/BasicValidator.js

@@ -1,6 +1,7 @@
 import { Validator, } from 'jsonschema';
 import { isValidIconReference } from './icons.js';
 import { schemas as allSchemas } from './index.js';
+import { skipBaseResolutionForSchemasWithoutId } from './jsonschemaBaseResolution.js';
 import { escapeJsonPointer } from './jsonPointer.js';
 import { has } from './miscellaneous.js';
 export class BaseValidatorFactory {
@@ -9,6 +10,7 @@ export class BaseValidatorFactory {
         this.schemas = schemas;
     }
     build() {
+        skipBaseResolutionForSchemasWithoutId();
         const validator = new Validator();
         for (const [key, format] of Object.entries({
             ...BaseValidatorFactory.defaultCustomFormats,

package/blockUtils.js

@@ -49,6 +49,9 @@ export function getAppBlocks(definition) {
     const result = [];
     iterApp(definition, {
         onBlock({ type, version }) {
+            if (typeof type !== 'string' || typeof version !== 'string') {
+                return;
+            }
             const name = normalizeBlockName(type);
             const asString = `${name}@${version}`;
             if (!visited.has(asString)) {

package/iterApp.js

@@ -25,6 +25,9 @@ export function iterAction(action, callbacks, prefix = []) {
     if (action.type === 'each') {
         return iterAction(action.do, callbacks, [...prefix, 'do']);
     }
+    if (action.type === 'match') {
+        return action.match.some((matchCase, index) => iterAction(matchCase.action, callbacks, [...prefix, 'match', index, 'action']));
+    }
     if ('blocks' in action) {
         // eslint-disable-next-line @typescript-eslint/no-use-before-define
         return iterBlockList(action.blocks, callbacks, [...prefix, 'blocks']);
@@ -137,7 +140,10 @@ export function iterPage(page, callbacks, prefix = []) {
         }
         return result;
     }
-    const { blocks = [] } = page;
+    const { actions, blocks = [] } = page;
+    if (Object.entries(actions ?? {}).some(([key, action]) => iterAction(action, callbacks, [...prefix, 'actions', key]))) {
+        return true;
+    }
     return iterBlockList(blocks, callbacks, [...prefix, 'blocks']);
 }
 /**
@@ -162,6 +168,13 @@ export function iterApp(app, callbacks) {
             }
         }
     }
+    if (app.webhooks) {
+        for (const [name, webhook] of Object.entries(app.webhooks)) {
+            if (webhook?.action && iterAction(webhook.action, callbacks, ['webhooks', name, 'action'])) {
+                return true;
+            }
+        }
+    }
     return false;
 }
 //# sourceMappingURL=iterApp.js.map

package/jsonschema.d.ts

@@ -23,6 +23,7 @@ declare module 'jsonschema' {
     }
     interface SchemaContext {
         path: (number | string)[];
+        resolve: (target: string) => string;
     }
 }
 /**

package/jsonschemaBaseResolution.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Resolve a child schema's base URI only when that schema declares an id.
+ *
+ * `jsonschema` resolves a base URI for every schema node it visits, and that URL resolution is the
+ * single most expensive part of validating a large app definition. A schema without an `$id` or
+ * `id` always resolves to its parent's base, so the resolution only carries information when an id
+ * is present. Appsemble's schemas declare no ids, which makes the resolution pure overhead for
+ * every node in the document.
+ *
+ * Calling this more than once is harmless: it installs the same implementation each time rather
+ * than wrapping whatever is already there.
+ */
+export declare function skipBaseResolutionForSchemasWithoutId(): void;

package/jsonschemaBaseResolution.js

@@ -0,0 +1,30 @@
+// `jsonschema` ships no types for its internal helpers module, which is where the schema context
+// it builds while validating lives.
+// @ts-expect-error 7016 -- untyped module
+import { SchemaContext as UntypedSchemaContext } from 'jsonschema/lib/helpers.js';
+const SchemaContextConstructor = UntypedSchemaContext;
+/**
+ * Resolve a child schema's base URI only when that schema declares an id.
+ *
+ * `jsonschema` resolves a base URI for every schema node it visits, and that URL resolution is the
+ * single most expensive part of validating a large app definition. A schema without an `$id` or
+ * `id` always resolves to its parent's base, so the resolution only carries information when an id
+ * is present. Appsemble's schemas declare no ids, which makes the resolution pure overhead for
+ * every node in the document.
+ *
+ * Calling this more than once is harmless: it installs the same implementation each time rather
+ * than wrapping whatever is already there.
+ */
+export function skipBaseResolutionForSchemasWithoutId() {
+    SchemaContextConstructor.prototype.makeChild = function makeChild(schema, propertyName) {
+        const path = propertyName === undefined ? this.path : [...this.path, propertyName];
+        const id = schema.$id ?? schema.id;
+        const base = id ? this.resolve(id) : this.base;
+        const ctx = new SchemaContextConstructor(schema, this.options, path, base, Object.create(this.schemas));
+        if (id && !ctx.schemas[base]) {
+            ctx.schemas[base] = schema;
+        }
+        return ctx;
+    };
+}
+//# sourceMappingURL=jsonschemaBaseResolution.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/lang-sdk",
-  "version": "0.40.7-node-brotli.0",
+  "version": "0.40.8",
   "description": "Language SDK for Appsemble",
   "keywords": [
     "app",

package/validation.js

@@ -9,7 +9,7 @@ import { findPageByName } from './findPageByName.js';
 import { isAppLink } from './pageUtils.js';
 import { bottomNavigationGridArea, breadcrumbsGridArea, builtinPagesGridAreaOrder, getBuiltinPagesDefaultGridLayout, getCascadedGridTemplateAreas, getGridTemplateAreas, gridDeviceOrder, resendBannerGridArea, } from './gridUtils.js';
 import { isValidIconName, parseIconReference } from './icons.js';
-import { iterAction, iterApp } from './iterApp.js';
+import { iterApp } from './iterApp.js';
 import { has } from './miscellaneous.js';
 import { normalize } from './normalize.js';
 import { serverActions } from './serverActions.js';
@@ -1467,6 +1467,10 @@ function validateActions(definition, report) {
                 report(action.type, 'action type is not supported for cron jobs', [...path, 'type']);
                 return;
             }
+            if (path[0] === 'webhooks' && !serverActions.has(action.type)) {
+                report(action.type, 'action type is not supported for webhooks', [...path, 'type']);
+                return;
+            }
             if (validateUnsupportedServerOptimisticResourceWrite(action, path)) {
                 return;
             }
@@ -1502,7 +1506,8 @@ function validateActions(definition, report) {
                     report(action.type, 'refers to a resource that doesn’t exist', [...path, 'resource']);
                     return;
                 }
-                if (!action.type.startsWith('resource.subscription.')) {
+                // Webhook actions run on the server without checking resource permissions.
+                if (!action.type.startsWith('resource.subscription.') && path[0] !== 'webhooks') {
                     if (!definition.security) {
                         report(action.type, 'missing security definition', [...path, 'resource']);
                         return;
@@ -1637,16 +1642,6 @@ function validateActions(definition, report) {
             }
         },
     });
-    for (const [name, webhook] of Object.entries(definition.webhooks ?? {})) {
-        if (webhook.action &&
-            iterAction(webhook.action, {
-                onAction(action, path) {
-                    return validateUnsupportedServerOptimisticResourceWrite(action, path);
-                },
-            }, ['webhooks', name, 'action'])) {
-            return;
-        }
-    }
 }
 function validateEvents(definition, blockVersions, report) {
     const indexMap = new Map();