@blamejs/blamejs-shop 0.3.70 → 0.3.72

package/lib/vendor/blamejs/test/layer-0-primitives/security-txt.test.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * b.middleware.securityTxt — RFC 9116 /.well-known/security.txt emitter.
+ *
+ * Covers: required-field enforcement (Contact / Expires), future-expiry
+ * check, the served body shape, root-path opt, method gating, and the
+ * de-advertised `audit` opt (the middleware serves a static public file
+ * on a hot path — no audit-worthy event, so the knob was removed).
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _mkRes() {
+  return {
+    statusCode: null,
+    headers:    null,
+    bodyChunks: [],
+    ended:      false,
+    writeHead:  function (code, headers) { this.statusCode = code; this.headers = headers; return this; },
+    end:        function (chunk) { if (chunk !== undefined) this.bodyChunks.push(chunk); this.ended = true; return this; },
+  };
+}
+
+function testServesWellKnown() {
+  var mw = b.middleware.securityTxt({
+    contact: ["mailto:security@example.com"],
+    expires: "2099-01-01T00:00:00Z",
+    policy:  "https://example.com/security/policy",
+  });
+  var res = _mkRes();
+  var nexted = false;
+  mw({ method: "GET", url: "/.well-known/security.txt" }, res, function () { nexted = true; });
+  check("securityTxt: serves at /.well-known/security.txt", res.statusCode === 200 && res.ended && !nexted);
+  var body = Buffer.concat(res.bodyChunks.map(function (c) { return Buffer.isBuffer(c) ? c : Buffer.from(String(c)); })).toString("utf8");
+  check("securityTxt: body carries Contact line", body.indexOf("Contact: mailto:security@example.com") !== -1);
+  check("securityTxt: body carries Expires line", body.indexOf("Expires: 2099-01-01T00:00:00Z") !== -1);
+  check("securityTxt: content-type text/plain", /text\/plain/.test(res.headers["Content-Type"]));
+}
+
+function testPassthroughOnOtherPaths() {
+  var mw = b.middleware.securityTxt({
+    contact: ["mailto:security@example.com"],
+    expires: "2099-01-01T00:00:00Z",
+  });
+  var res = _mkRes();
+  var nexted = false;
+  mw({ method: "GET", url: "/something-else" }, res, function () { nexted = true; });
+  check("securityTxt: non-matching path falls through to next", nexted && res.statusCode === null);
+}
+
+function testRequiredFieldEnforcement() {
+  var threwNoContact = false;
+  try { b.middleware.securityTxt({ expires: "2099-01-01T00:00:00Z" }); }
+  catch (_e) { threwNoContact = true; }
+  check("securityTxt: missing contact throws", threwNoContact);
+
+  var threwNoExpires = false;
+  try { b.middleware.securityTxt({ contact: ["mailto:s@example.com"] }); }
+  catch (_e) { threwNoExpires = true; }
+  check("securityTxt: missing expires throws", threwNoExpires);
+
+  var threwPastExpiry = false;
+  try {
+    b.middleware.securityTxt({
+      contact: ["mailto:s@example.com"],
+      expires: "2000-01-01T00:00:00Z",
+    });
+  } catch (_e) { threwPastExpiry = true; }
+  check("securityTxt: past expires throws", threwPastExpiry);
+}
+
+function testRejectsAuditOpt() {
+  // `audit` was accepted-but-unread (no audit-worthy event — the
+  // middleware serves a static public file and already uses the
+  // observability sink for the served counter). De-advertised: passing
+  // it now throws at config time.
+  var threw = false;
+  try {
+    b.middleware.securityTxt({
+      contact: ["mailto:security@example.com"],
+      expires: "2099-01-01T00:00:00Z",
+      audit:   true,
+    });
+  } catch (_e) { threw = true; }
+  check("securityTxt: unknown 'audit' opt rejected", threw);
+
+  // The same opts WITHOUT audit construct fine.
+  var mw = b.middleware.securityTxt({
+    contact: ["mailto:security@example.com"],
+    expires: "2099-01-01T00:00:00Z",
+  });
+  check("securityTxt: constructs without audit opt", typeof mw === "function");
+}
+
+async function run() {
+  testServesWellKnown();
+  testPassthroughOnOtherPaths();
+  testRequiredFieldEnforcement();
+  testRejectsAuditOpt();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/sigv4-bucket-ops.test.js

@@ -198,6 +198,18 @@ function testFactoryValidation() {
   shouldThrow("rejects unsupported protocol",
     { protocol: "gcs", region: "us-east-1", accessKeyId: "x", secretAccessKey: "y" },
     /INVALID_CONFIG/);
+
+  // `ca` was an accepted-but-dead config knob — nothing in the request
+  // path (reqOpts → http-request → httpClient.request) threads a custom
+  // CA cert (the framework's PQC-only TLS posture lives solely in
+  // lib/pqc-agent.js; operators use NODE_EXTRA_CA_CERTS / opts.agent).
+  // De-advertised: passing it must now throw as an unknown option.
+  var threwCa = null;
+  try {
+    bucketOps.create(Object.assign({}, _baseConfig(9999), { ca: "-----BEGIN CERTIFICATE-----" }));
+  } catch (e) { threwCa = e; }
+  check("factory: de-advertised `ca` knob rejected as unknown option",
+        threwCa && /unknown option 'ca'/.test(threwCa.message || ""));
 }
 
 // ---- Bucket name validation ----
@@ -908,6 +920,55 @@ async function testAuditSuccessFalseDisablesSuccessAudit() {
   }
 }
 
+async function testPerCallActorOverrideHonored() {
+  // Per-method opts accept `req` (resolves IP / user-agent / userId from a
+  // live request) and `actor` (an explicit identity override for callers
+  // performing a compliance-sensitive change on behalf of an operator).
+  // Both must land on the emitted audit row's `actor` field; `actor`-set
+  // keys win over the request-derived ones.
+  var auditCap = _captureAudit();
+  var fake = _fakeS3();
+  var port = await listenOnRandomPort(fake.server);
+  try {
+    var ops = bucketOps.create(Object.assign({}, _baseConfig(port), {
+      audit: auditCap,
+    }));
+
+    var fakeReq = {
+      ip:      "203.0.113.9",
+      method:  "PUT",
+      headers: { "user-agent": "ops-cli/1.0" },
+    };
+    await ops.create("actor-bucket", {
+      req:   fakeReq,
+      actor: { userId: "ops-admin" },
+    });
+
+    var rows = auditCap.byAction("objectstore.bucket.create");
+    check("actor override: audit row emitted", rows.length === 1);
+    var actor = rows.length === 1 ? rows[0].actor : {};
+    check("actor override: explicit actor.userId lands on the audit row",
+          actor.userId === "ops-admin");
+    check("actor override: request-derived ip lands on the audit row",
+          actor.ip === "203.0.113.9");
+    check("actor override: request-derived userAgent lands on the audit row",
+          actor.userAgent === "ops-cli/1.0");
+
+    // Without actor/req, the resolved actor has the resolver's null
+    // defaults (no override) — default behavior unchanged.
+    var auditCap2 = _captureAudit();
+    var ops2 = bucketOps.create(Object.assign({}, _baseConfig(port), {
+      audit: auditCap2,
+    }));
+    await ops2.create("plain-bucket");
+    var rows2 = auditCap2.byAction("objectstore.bucket.create");
+    check("actor override: default behavior unchanged when actor/req absent",
+          rows2.length === 1 && rows2[0].actor && rows2[0].actor.userId === null);
+  } finally {
+    await new Promise(function (r) { fake.server.close(function () { r(); }); });
+  }
+}
+
 async function run() {
   testSurface();
   testFactoryValidation();
@@ -940,6 +1001,7 @@ async function run() {
   // v0.6.53 — audit + observability emissions
   await testAuditObservabilityWiring();
   await testAuditSuccessFalseDisablesSuccessAudit();
+  await testPerCallActorOverrideHonored();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/smtp-policy.test.js

@@ -206,6 +206,43 @@ async function testTlsRptSubmitRejectsEmptyRua() {
   check("submit rejects empty rua", threw && /tls-rpt-bad-rua/.test(threw.code || ""));
 }
 
+function testTlsRptRecordShapeRejectsReportingMta() {
+  // `reportingMta` was documented in the namespace example + accepted by
+  // recordShape's allowlist but never read (RFC 8460 §4.4 has no such
+  // top-level field). De-advertised: passing it throws at config time.
+  var threw = false;
+  try {
+    b.network.smtp.tlsRpt.recordShape({
+      organization: "example.com",
+      reportingMta: "mx1.example.com",
+      policies:     [{ type: "sts", domain: "example.com" }],
+    });
+  } catch (_e) { threw = true; }
+  check("tlsRpt.recordShape: unknown 'reportingMta' opt rejected", threw);
+
+  // `reportId` IS read (report-id field) and is now in the allowlist —
+  // it must be accepted and flow through to the output.
+  var rpt = b.network.smtp.tlsRpt.recordShape({
+    organization: "example.com",
+    reportId:     "rpt-fixed-1234",
+    policies:     [{ type: "sts", domain: "example.com" }],
+  });
+  check("tlsRpt.recordShape: operator reportId flows to report-id",
+        rpt["report-id"] === "rpt-fixed-1234");
+}
+
+async function testTlsRptSubmitRejectsAuditOpt() {
+  // `audit` was accepted by submit's allowlist but never read — the
+  // function emits no audit row. De-advertised.
+  var threw = false;
+  try {
+    await b.network.smtp.tlsRpt.submit(
+      { "organization-name": "example.com" },
+      { rua: ["https://reports.example.com/submit"], audit: true });
+  } catch (_e) { threw = true; }
+  check("tlsRpt.submit: unknown 'audit' opt rejected", threw);
+}
+
 async function run() {
   testSurface();
   testMtaStsParse();
@@ -223,6 +260,8 @@ async function run() {
   await testTlsRptFetchPolicyMissing();
   await testTlsRptSubmitMixedRua();
   await testTlsRptSubmitRejectsEmptyRua();
+  testTlsRptRecordShapeRejectsReportingMta();
+  await testTlsRptSubmitRejectsAuditOpt();
 }
 
 module.exports = { run: run };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.70",
+  "version": "0.3.72",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {