@bgord/bun 1.19.13 → 1.19.14

package/src/reactive-config-noop.adapter.ts

@@ -1,8 +1,5 @@
-import {
-  ReactiveConfigError,
-  type ReactiveConfigPort,
-  type ReactiveConfigSchema,
-} from "./reactive-config.port";
+import type { ReactiveConfigPort, ReactiveConfigSchema } from "./reactive-config.port";
+import { StandardSchemaValidator } from "./standard-schema-validator.service";
 
 export class ReactiveConfigNoopAdapter<T extends object> implements ReactiveConfigPort<T> {
   constructor(
@@ -11,9 +8,6 @@ export class ReactiveConfigNoopAdapter<T extends object> implements ReactiveConf
   ) {}
 
   async get(): Promise<Readonly<T>> {
-    const result = this.schema["~standard"].validate(this.value);
-    if (result instanceof Promise) throw new Error(ReactiveConfigError.NoAsyncSchema);
-    if (result.issues) throw new Error(result.issues[0]?.message);
-    return Object.freeze(result.value);
+    return Object.freeze(StandardSchemaValidator.validate(this.schema, this.value));
   }
 }

package/src/reactive-config-with-fallback.adapter.ts

@@ -1,8 +1,5 @@
-import {
-  ReactiveConfigError,
-  type ReactiveConfigPort,
-  type ReactiveConfigSchema,
-} from "./reactive-config.port";
+import type { ReactiveConfigPort, ReactiveConfigSchema } from "./reactive-config.port";
+import { StandardSchemaValidator } from "./standard-schema-validator.service";
 
 export class ReactiveConfigWithFallbackAdapter<T extends object> implements ReactiveConfigPort<T> {
   constructor(
@@ -15,10 +12,7 @@ export class ReactiveConfigWithFallbackAdapter<T extends object> implements Reac
     try {
       return await this.inner.get();
     } catch {
-      const result = this.schema["~standard"].validate(this.fallback);
-      if (result instanceof Promise) throw new Error(ReactiveConfigError.NoAsyncSchema);
-      if (result.issues) throw new Error(result.issues[0]?.message);
-      return Object.freeze(result.value);
+      return Object.freeze(StandardSchemaValidator.validate(this.schema, this.fallback));
     }
   }
 }

package/src/reactive-config.port.ts

@@ -1,7 +1,5 @@
 import type { StandardSchemaV1 } from "@standard-schema/spec";
 
-export const ReactiveConfigError = { NoAsyncSchema: "reactive.config.no.async.schema" };
-
 export type ReactiveConfigSchema<T extends object> = StandardSchemaV1<unknown, T>;
 
 export interface ReactiveConfigPort<T extends object> {

package/src/remote-file-storage-disk.adapter.ts

@@ -5,6 +5,7 @@ import type { FileCleanerPort } from "./file-cleaner.port";
 import type { FileCopierPort } from "./file-copier.port";
 import type { FileRenamerPort } from "./file-renamer.port";
 import type { HashFilePort } from "./hash-file.port";
+import type { NonceProviderPort } from "./nonce-provider.port";
 import type {
   RemoteFileStoragePort,
   RemoteHeadResult,
@@ -18,6 +19,7 @@ type Dependencies = {
   FileRenamer: FileRenamerPort;
   FileCopier: FileCopierPort;
   DirectoryEnsurer: DirectoryEnsurerPort;
+  NonceProvider: NonceProviderPort;
 };
 
 type Config = { root: tools.DirectoryPathAbsoluteType };
@@ -39,7 +41,9 @@ export class RemoteFileStorageDiskAdapter implements RemoteFileStoragePort {
 
   async putFromPath(input: RemotePutFromPathInput): Promise<RemotePutFromPathResult> {
     const final = this.resolveKeyToAbsoluteFilePath(input.key);
-    const temporary = final.withFilename(final.getFilename().withSuffix("-part"));
+    const temporary = final.withFilename(
+      final.getFilename().withSuffix(`-part-${this.deps.NonceProvider.generate()}`),
+    );
 
     await this.deps.DirectoryEnsurer.ensure(final.getDirectory());
     await this.deps.FileCopier.copy(input.path, temporary);

package/src/shield-api-key.strategy.ts

@@ -1,3 +1,4 @@
+import { timingSafeEqual } from "node:crypto";
 import type * as tools from "@bgord/tools";
 import type { HasRequestHeader } from "./request-context.port";
 
@@ -11,6 +12,11 @@ export class ShieldApiKeyStrategy {
   constructor(private readonly config: ApiKeyShieldConfig) {}
 
   evaluate(context: HasRequestHeader): boolean {
-    return context.request.header(ShieldApiKeyStrategy.HEADER_NAME) === this.config.API_KEY;
+    const header = context.request.header(ShieldApiKeyStrategy.HEADER_NAME);
+    const config = this.config.API_KEY;
+
+    if (header?.length !== config.length) return false;
+
+    return timingSafeEqual(Buffer.from(header), Buffer.from(config));
   }
 }

package/src/shield-basic-auth.strategy.ts

@@ -1,3 +1,4 @@
+import { timingSafeEqual } from "node:crypto";
 import type { BasicAuthPasswordType } from "./basic-auth-password.vo";
 import type { BasicAuthUsernameType } from "./basic-auth-username.vo";
 import type { HasRequestHeader } from "./request-context.port";
@@ -18,9 +19,10 @@ export class ShieldBasicAuthStrategy {
       const [username, password] = credentials.split(":");
 
       if (username !== this.config.username) return false;
-      if (password !== this.config.password) return false;
 
-      return true;
+      if (password?.length !== this.config.password.length) return false;
+
+      return timingSafeEqual(Buffer.from(password), Buffer.from(this.config.password));
     } catch {
       return false;
     }

package/src/shield-recaptcha.strategy.ts

@@ -25,7 +25,7 @@ export class ShieldRecaptchaStrategy {
     try {
       const header = context.request.header("x-recaptcha-token");
       const query = context.request.query()["recaptchaToken"];
-      const remoteip = context.request.header("x-forwarded-for") ?? "";
+      const remoteip = context.request.header("x-forwarded-for")?.split(",")[0] ?? "";
 
       const token = header ?? query ?? formToken;
 

package/src/sitemap-entry.vo.ts

@@ -1,3 +1,4 @@
+// cspell:ignore apos
 import type * as tools from "@bgord/tools";
 import type { SitemapChangefreqEnum } from "./sitemap-changefreq.vo";
 import type { SitemapPriorityType } from "./sitemap-priority.vo";
@@ -13,16 +14,22 @@ export type SitemapEntryType = {
 export class SitemapEntry {
   constructor(private readonly entry: SitemapEntryType) {}
 
+  private escapeXml(str: string): string {
+    return str
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&apos;");
+  }
+
   toXml(): string {
+    const loc = `<loc>${this.escapeXml(this.entry.loc)}</loc>`;
     const lastmod = this.entry.lastmod ? `<lastmod>${this.entry.lastmod}</lastmod>` : "";
-
     const changefreq = this.entry.changefreq ? `<changefreq>${this.entry.changefreq}</changefreq>` : "";
-
     const priority =
       this.entry.priority !== undefined ? `<priority>${this.entry.priority.toFixed(1)}</priority>` : "";
 
-    const loc = `<loc>${this.entry.loc}</loc>`;
-
     return ["<url>", loc, lastmod, changefreq, priority, "</url>"].join("");
   }
 }

package/src/standard-schema-validator.service.ts

@@ -0,0 +1,15 @@
+import type { StandardSchemaV1 } from "@standard-schema/spec";
+
+const StandardSchemaValidatorError = {
+  NoAsyncSchema: "standard.schema.validate.error.no.async.schema",
+};
+
+export class StandardSchemaValidator {
+  static validate<Output>(schema: StandardSchemaV1<unknown, Output>, raw: unknown): Output {
+    const result = schema["~standard"].validate(raw);
+
+    if (result instanceof Promise) throw new Error(StandardSchemaValidatorError.NoAsyncSchema);
+    if (result.issues) throw new Error(result.issues[0]?.message);
+    return result.value;
+  }
+}

package/src/subject-application-resolver.vo.ts

@@ -11,8 +11,6 @@ export const SubjectApplicationResolverError = {
 };
 
 export class SubjectApplicationResolver {
-  private readonly SEPARATOR = "|";
-
   constructor(
     private readonly segments: ReadonlyArray<SubjectSegmentApplicationStrategy>,
     private readonly deps: Dependencies,
@@ -22,10 +20,8 @@ export class SubjectApplicationResolver {
   }
 
   async resolve(): Promise<{ hex: Hash; raw: ReadonlyArray<SubjectSegmentType> }> {
-    const segments = this.segments.map((segment) =>
-      segment.create().replaceAll(this.SEPARATOR, encodeURIComponent(this.SEPARATOR)),
-    );
-    const subject = segments.join(this.SEPARATOR);
+    const segments = this.segments.map((segment) => segment.create());
+    const subject = JSON.stringify(segments);
 
     const hex = await this.deps.HashContent.hash(subject);
 

package/src/subject-request-resolver.vo.ts

@@ -11,8 +11,6 @@ export const SubjectRequestResolverError = {
 };
 
 export class SubjectRequestResolver {
-  private readonly SEPARATOR = "|";
-
   constructor(
     private readonly segments: ReadonlyArray<SubjectSegmentRequestStrategy>,
     private readonly deps: Dependencies,
@@ -22,10 +20,8 @@ export class SubjectRequestResolver {
   }
 
   async resolve(context: RequestContext): Promise<{ hex: Hash; raw: ReadonlyArray<SubjectSegmentType> }> {
-    const segments = this.segments.map((segment) =>
-      segment.create(context).replaceAll(this.SEPARATOR, encodeURIComponent(this.SEPARATOR)),
-    );
-    const subject = segments.join(this.SEPARATOR);
+    const segments = this.segments.map((segment) => segment.create(context));
+    const subject = JSON.stringify(segments);
 
     const hex = await this.deps.HashContent.hash(subject);
 

package/src/temporary-file-absolute.adapter.ts

@@ -2,12 +2,14 @@ import * as tools from "@bgord/tools";
 import type { FileCleanerPort } from "./file-cleaner.port";
 import type { FileRenamerPort } from "./file-renamer.port";
 import type { FileWriterPort } from "./file-writer.port";
+import type { NonceProviderPort } from "./nonce-provider.port";
 import type { TemporaryFilePort } from "./temporary-file.port";
 
 type Dependencies = {
   FileCleaner: FileCleanerPort;
   FileRenamer: FileRenamerPort;
   FileWriter: FileWriterPort;
+  NonceProvider: NonceProviderPort;
 };
 
 export class TemporaryFileAbsoluteAdapter implements TemporaryFilePort {
@@ -17,7 +19,10 @@ export class TemporaryFileAbsoluteAdapter implements TemporaryFilePort {
   ) {}
 
   async write(filename: tools.Filename, content: File): Promise<tools.FilePathAbsolute> {
-    const temporary = tools.FilePathAbsolute.fromPartsSafe(this.directory, filename.withSuffix("-part"));
+    const temporary = tools.FilePathAbsolute.fromPartsSafe(
+      this.directory,
+      filename.withSuffix(`-part-${this.deps.NonceProvider.generate()}`),
+    );
     const final = tools.FilePathAbsolute.fromPartsSafe(this.directory, filename);
 
     await this.deps.FileWriter.write(temporary.get(), content);

package/src/timing.middleware.ts

@@ -10,9 +10,7 @@ export class TimingMiddleware {
   constructor(private readonly deps: Dependencies) {}
 
   async measure(context: RequestContext, action: () => void | Promise<void>): Promise<string | null> {
-    const header = context.request.header("accept");
-
-    if (header === "text/event-stream") return null;
+    if (context.request.header("accept")?.toLowerCase().startsWith("text/event-stream")) return null;
 
     const stopwatch = new Stopwatch(this.deps);
 

package/src/woodchopper-sampling-every-nth.strategy.ts

@@ -14,7 +14,6 @@ export class WoodchopperSamplingEveryNth implements WoodchopperSamplingStrategy
     this.counter++;
     // Stryker restore all
 
-    if (this.counter % this.config.n !== 0) return false;
-    return true;
+    return this.counter % this.config.n === 0;
   }
 }