@blamejs/blamejs-shop 0.4.31 → 0.4.32

package/lib/vendor/blamejs/test/layer-0-primitives/redis-client.test.js

@@ -5,12 +5,26 @@
  * coverage lives in queue-redis.test.js (which skips cleanly when
  * BLAMEJS_TEST_REDIS_URL is not set).
  */
+var net = require("node:net");
 var helpers = require("../helpers");
 var check = helpers.check;
 var redis = require("../../lib/redis-client");
 
 function _bytes(s) { return Buffer.from(s, "utf8"); }
 
+function _listen(onConn) {
+  return new Promise(function (resolve) {
+    var server = net.createServer(function (sock) {
+      sock.on("error", function () { /* absorb server-side socket errors */ });
+      if (onConn) onConn(sock);
+    });
+    server.listen(0, "127.0.0.1", function () {
+      resolve({ port: server.address().port, server: server,
+                close: function () { return new Promise(function (r) { server.close(r); }); } });
+    });
+  });
+}
+
 async function run() {
   // ---- _parseRedisUrl ----
   var u1 = redis._parseRedisUrl("redis://localhost:6379/0");
@@ -192,6 +206,105 @@ async function run() {
   try { await client.connect(); } catch (_e) { /* closing guard should prevent any connect attempt */ }
   check("redis: connect() after close is a no-op (closing guard — no socket opened)",
         client._state().connected === false);
+
+  // ---- connect-failure does not wedge subsequent callers ----
+  // A connect that errors before the connection is fully ready (the socket
+  // drops mid-AUTH) must (a) reject the connect promise, (b) clear the
+  // shared connect promise so the next connect() starts fresh, and (c)
+  // NOT leave connected=true on a torn-down socket. A command issued after
+  // the give-up must settle (reject) rather than wedge in the backlog
+  // forever.
+  {
+    var dropMidAuth = await _listen(function (sock) {
+      sock.once("data", function () { sock.destroy(); });  // got AUTH → drop
+    });
+    var c2 = redis.create({
+      url: "redis://127.0.0.1:" + dropMidAuth.port + "/0",
+      password: "secret", connectTimeoutMs: 1000, commandTimeoutMs: 500,
+      maxReconnectAttempts: 0,   // give up immediately on disconnect
+    });
+    var connErr = null;
+    try { await c2.connect(); } catch (e) { connErr = e; }
+    check("redis: failed connect (drop mid-AUTH) rejects", connErr !== null);
+    var st2 = c2._state();
+    check("redis: failed connect leaves connected=false", st2.connected === false);
+    check("redis: failed connect clears the shared connect promise (connecting=false)",
+          st2.connecting === false);
+
+    // A command after give-up must settle, not hang. Bound the await so a
+    // regression surfaces as a timeout instead of a stuck test.
+    var cmdSettled = false;
+    var cmdErr = null;
+    await helpers.withTestTimeout("redis: post-give-up command settles", async function () {
+      try { await c2.command("PING"); } catch (e) { cmdErr = e; }
+      cmdSettled = true;
+    }, { timeoutMs: 4000 });
+    check("redis: command after give-up settles (does not wedge)", cmdSettled === true);
+    check("redis: command after give-up rejects with RECONNECT_GAVE_UP",
+          cmdErr !== null && cmdErr.code === "RECONNECT_GAVE_UP");
+    await c2.close();
+    await dropMidAuth.close();
+  }
+
+  // ---- a backlogged command times out if connect never completes ----
+  // Queued-while-disconnected commands must NOT outlive commandTimeoutMs —
+  // a backend that never comes up settles the caller with a clear error.
+  {
+    var c3 = redis.create({
+      url: "redis://127.0.0.1:1/0",   // nothing listens; reconnect stays pending
+      connectTimeoutMs: 200, commandTimeoutMs: 150, maxReconnectAttempts: 5,
+    });
+    c3.connect().catch(function () { /* will keep retrying in the background */ });
+    var c3Err = null, c3Settled = false;
+    await helpers.withTestTimeout("redis: backlogged command times out", async function () {
+      try { await c3.command("GET", "k"); } catch (e) { c3Err = e; }
+      c3Settled = true;
+    }, { timeoutMs: 4000 });
+    check("redis: backlogged command settles (does not wedge)", c3Settled === true);
+    check("redis: backlogged command rejects with COMMAND_TIMEOUT",
+          c3Err !== null && c3Err.code === "COMMAND_TIMEOUT");
+    await c3.close();
+  }
+
+  // ---- single-flight reconnect: error+close schedule ONE reconnect ----
+  // A lost socket surfaces as both an `error` and a `close` event (and the
+  // error handler destroys the socket, re-firing close). Each must NOT
+  // schedule its own reconnect timer — that doubles the backoff rate and
+  // opens redundant sockets. We count distinct inbound connections: after
+  // one induced drop, the first reconnect lands as connection #2 (not #3).
+  {
+    var conns = 0;
+    var firstSock = null;
+    var reconnectSrv = await _listen(function (sock) {
+      conns += 1;
+      if (conns === 1) {
+        firstSock = sock;
+        // Reset the first connection so the client sees error AND close.
+        if (sock.resetAndDestroy) sock.resetAndDestroy(); else sock.destroy();
+      }
+      // Reconnect (conns >= 2): hold open — no further failures.
+    });
+    var c4 = redis.create({
+      url: "redis://127.0.0.1:" + reconnectSrv.port + "/0",
+      connectTimeoutMs: 1000, commandTimeoutMs: 500, maxReconnectAttempts: 10,
+    });
+    await c4.connect().catch(function () {});
+    // The first backoff is 100ms; wait until exactly one reconnect lands
+    // (connection #2). If error AND close had each scheduled, the budget
+    // would have produced a SECOND reconnect (#3) at the bumped delay.
+    await helpers.waitUntil(function () { return conns >= 2; },
+      { timeoutMs: 3000, label: "redis single-flight: first reconnect connects" });
+    var stallObserved = await helpers.passiveObserve(350,
+      "redis single-flight: no second reconnect from the same failure")
+      .then(function () { return conns; });
+    check("redis: single failure schedules exactly one reconnect (no double-schedule)",
+          stallObserved === 2);
+    check("redis: reconnect count reset toward stable after one successful reconnect",
+          c4._state().reconnectPending === false);
+    void firstSock;
+    await c4.close();
+    await reconnectSrv.close();
+  }
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/retention-dryrun-no-vacuum.test.js

@@ -0,0 +1,99 @@
+"use strict";
+// #120: a retention dry-run / preview must NOT touch the database. Under a
+// regulated posture (gdpr / hipaa / …) whose POSTURE_DEFAULTS sets
+// requireVacuumAfterErase, cryptoField.eraseRow schedules a FULL VACUUM and
+// emits db.vacuum_after_erase. retention._erase called eraseRow at the top of
+// the function — BEFORE the `if (dryRun) return` gate — so previewing an
+// erase rule ran a full-table VACUUM per candidate row: a preview that locks
+// the database and rewrites the whole file, the opposite of "preview".
+//
+// RED on the buggy tree: a dryRun run() fires vacuumAfterErase (spy count >= 1).
+// GREEN after the fix: dryRun fires it 0 times; a real (committing) run still
+// vacuums under the regulated posture.
+
+var fs = require("fs");
+var path = require("path");
+var os = require("os");
+var helpers  = require("../helpers");
+var dbHelper = require("../helpers/db");
+var b     = helpers.b;
+var check = helpers.check;
+
+async function run() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-retention-dryrun-"));
+  await dbHelper.setupTestDb(tmpDir);
+
+  // An operator app table with a sealed column, so retention routes the
+  // candidate through _erase (sealed-column NULL-out) rather than the
+  // _hardDelete fallback. The actual value need not be sealed at rest for
+  // the bug to fire — _erase keys off getSealedFields(table) being non-empty.
+  b.cryptoField.registerTable("retention_pii", {
+    sealedFields: ["payload"],
+    rowIdField:   "_id",
+  });
+  b.db.prepare(
+    "CREATE TABLE \"retention_pii\" (" +
+    "\"_id\" TEXT PRIMARY KEY, \"createdAt\" INTEGER, " +
+    "\"payload\" TEXT, \"__erasedAt\" INTEGER)"
+  ).run();
+  var longAgo = Date.now() - b.constants.TIME.days(400);
+  b.db.prepare(
+    "INSERT INTO \"retention_pii\" (\"_id\", \"createdAt\", \"payload\", \"__erasedAt\") " +
+    "VALUES (?, ?, ?, NULL)"
+  ).run("row-1", longAgo, "subject-secret-payload");
+
+  // Spy on the VACUUM seam. cryptoField.eraseRow resolves the db module via
+  // lazyRequire and reads .vacuumAfterErase at call time, so replacing the
+  // export observes (and still drives) the real call.
+  var realVacuum = b.db.vacuumAfterErase;
+  var vacuumCalls = 0;
+  b.db.vacuumAfterErase = function (opts) {
+    vacuumCalls++;
+    return realVacuum.call(b.db, opts);
+  };
+
+  // gdpr → requireVacuumAfterErase: true, so eraseRow auto-vacuums.
+  b.compliance.set("gdpr");
+
+  try {
+    var retention = b.retention.create({ db: b.db, audit: false });
+    retention.declare({
+      name:     "pii-ttl",
+      table:    "retention_pii",
+      ageField: "createdAt",
+      ttlMs:    b.constants.TIME.days(90),
+      action:   "erase",
+    });
+
+    // ---- the bug: a dry-run must not VACUUM ----
+    vacuumCalls = 0;
+    var preview = await retention.run("pii-ttl", { dryRun: true });
+    check("#120 dry-run scans the past-TTL row",
+          preview && preview.scanned >= 1);
+    check("#120 dry-run reports it WOULD erase (no real work)",
+          preview && preview.processed >= 1);
+    check("#120 dry-run performs NO database VACUUM",
+          vacuumCalls === 0);
+    // The row must still be present + un-erased after a preview.
+    var afterPreview = b.db.prepare(
+      "SELECT \"payload\" FROM \"retention_pii\" WHERE \"_id\" = ?").get("row-1");
+    check("#120 dry-run leaves the row's sealed column intact",
+          afterPreview && afterPreview.payload === "subject-secret-payload");
+
+    // ---- the real path still vacuums under the regulated posture ----
+    vacuumCalls = 0;
+    var real = await retention.run("pii-ttl", { dryRun: false });
+    check("#120 real run erases the row", real && real.processed >= 1);
+    check("#120 real run DOES vacuum under gdpr", vacuumCalls >= 1);
+    var afterErase = b.db.prepare(
+      "SELECT \"payload\" FROM \"retention_pii\" WHERE \"_id\" = ?").get("row-1");
+    check("#120 real run NULLs the sealed column",
+          afterErase && afterErase.payload === null);
+  } finally {
+    b.db.vacuumAfterErase = realVacuum;
+    b.compliance.clear();
+    await dbHelper.teardownTestDb(tmpDir);
+  }
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/router-use-path-scope.test.js

@@ -0,0 +1,255 @@
+"use strict";
+/**
+ * b.router — path-scoped middleware: `use(prefix, mw)`.
+ *
+ * The router supports both `use(mw)` (global, runs on every request)
+ * and `use(prefix, mw)` (runs only when the request path is at or
+ * beneath `prefix`, matched on segment boundaries). The path-scoped
+ * form is the documented mounting shape for the framework's access-
+ * refusal middleware (`csrf`, `bearerAuth`, `requireAal`,
+ * `requireStepUp`, `requireMtls`, …): an operator writes
+ * `router.use("/admin", stepUpGate)` to gate everything under /admin.
+ *
+ * Validates, driving requests end-to-end through router.handle:
+ *   - a path-scoped gate runs for a matching path and NOT for a
+ *     non-matching one (no silent security-control bypass, no 500)
+ *   - segment-boundary matching: "/admin" does not match "/administrator"
+ *   - registration order: a gate registered before a route runs first
+ *   - global `use(mw)` still runs on every request (back-compat)
+ *   - multi-middleware scoped mounts preserve order
+ *   - array-of-prefixes scopes a gate to several path roots
+ *   - trailing-slash normalization ("/admin" == "/admin/")
+ *   - config-time throws on a bad prefix / missing or non-function
+ *     middleware (entry-point validation tier)
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _req(url) {
+  // router.handle parses req.url against the Host header to derive
+  // req.pathname; a minimal request shape is enough to drive dispatch.
+  return { method: "GET", url: url, headers: { host: "localhost" } };
+}
+
+function _res() {
+  var res = {
+    statusCode:    0,
+    headersSent:   false,
+    writableEnded: false,
+    _body:         "",
+    writeHead: function (status, headers) {
+      res.statusCode = status;
+      res._headers = headers || {};
+      res.headersSent = true;
+    },
+    end: function (chunk) {
+      if (chunk !== undefined) res._body += chunk;
+      res.writableEnded = true;
+    },
+  };
+  return res;
+}
+
+async function testScopedGateRunsOnlyUnderPrefix() {
+  var r = b.router.create();
+  var gateRanFor = [];
+  r.use("/admin", function gate(req, res, next) {
+    gateRanFor.push(req.pathname);
+    next();
+  });
+  r.get("/admin/secret", function (req, res) { res.statusCode = 200; res.end("admin"); });
+  r.get("/public",       function (req, res) { res.statusCode = 200; res.end("public"); });
+
+  var resPublic = _res();
+  await r.handle(_req("/public"), resPublic);
+  check("use('/admin', gate): gate does NOT run for /public",
+        gateRanFor.length === 0 && resPublic.statusCode === 200 &&
+        resPublic._body === "public");
+
+  var resAdmin = _res();
+  await r.handle(_req("/admin/secret"), resAdmin);
+  check("use('/admin', gate): gate runs for /admin/secret",
+        gateRanFor.length === 1 && gateRanFor[0] === "/admin/secret" &&
+        resAdmin.statusCode === 200 && resAdmin._body === "admin");
+}
+
+async function testGateCanRefuseUnderPrefix() {
+  // A scoped gate that does NOT call next() halts the chain (a refusal)
+  // — and only for the scoped path. The route handler under the prefix
+  // never runs; an unrelated path is untouched.
+  var r = b.router.create();
+  r.use("/admin", function deny(req, res /*, next */) {
+    res.writeHead(403, { "Content-Type": "text/plain" });
+    res.end("forbidden");
+    // no next() — chain stops
+  });
+  var adminHandlerRan = false;
+  r.get("/admin/secret", function (req, res) { adminHandlerRan = true; res.statusCode = 200; res.end("admin"); });
+  r.get("/public",       function (req, res) { res.statusCode = 200; res.end("public"); });
+
+  var resAdmin = _res();
+  await r.handle(_req("/admin/secret"), resAdmin);
+  check("use('/admin', deny): refusal halts the chain under /admin",
+        resAdmin.statusCode === 403 && resAdmin._body === "forbidden" &&
+        adminHandlerRan === false);
+
+  var resPublic = _res();
+  await r.handle(_req("/public"), resPublic);
+  check("use('/admin', deny): /public unaffected by the /admin refusal",
+        resPublic.statusCode === 200 && resPublic._body === "public");
+}
+
+async function testSegmentBoundaryNotPrefixSubstring() {
+  var r = b.router.create();
+  var gateRan = false;
+  r.use("/admin", function (req, res, next) { gateRan = true; next(); });
+  r.get("/administrator", function (req, res) { res.statusCode = 200; res.end("ator"); });
+
+  var res1 = _res();
+  await r.handle(_req("/administrator"), res1);
+  check("use('/admin', gate): '/admin' does NOT match '/administrator' (segment boundary)",
+        gateRan === false && res1.statusCode === 200 && res1._body === "ator");
+}
+
+async function testExactPrefixMatch() {
+  var r = b.router.create();
+  var gateRan = false;
+  r.use("/admin", function (req, res, next) { gateRan = true; next(); });
+  r.get("/admin", function (req, res) { res.statusCode = 200; res.end("exact"); });
+
+  var res1 = _res();
+  await r.handle(_req("/admin"), res1);
+  check("use('/admin', gate): gate runs for the exact path '/admin'",
+        gateRan === true && res1.statusCode === 200 && res1._body === "exact");
+}
+
+async function testRegistrationOrderPreserved() {
+  // A gate registered before a route must run before the route handler;
+  // a global middleware registered after the scoped gate runs after it.
+  var r = b.router.create();
+  var order = [];
+  r.use(function global1(req, res, next) { order.push("global1"); next(); });
+  r.use("/admin", function adminGate(req, res, next) { order.push("adminGate"); next(); });
+  r.use(function global2(req, res, next) { order.push("global2"); next(); });
+  r.get("/admin/x", function (req, res) { order.push("route"); res.statusCode = 200; res.end("x"); });
+
+  var res1 = _res();
+  await r.handle(_req("/admin/x"), res1);
+  check("registration order: global1 → adminGate → global2 → route",
+        order.join(",") === "global1,adminGate,global2,route");
+}
+
+async function testGlobalUseStillRunsEverywhere() {
+  var r = b.router.create();
+  var seen = [];
+  r.use(function (req, res, next) { seen.push(req.pathname); next(); });
+  r.get("/a", function (req, res) { res.statusCode = 200; res.end("a"); });
+  r.get("/b", function (req, res) { res.statusCode = 200; res.end("b"); });
+
+  await r.handle(_req("/a"), _res());
+  await r.handle(_req("/b"), _res());
+  check("global use(mw) runs on every request (back-compat)",
+        seen.length === 2 && seen[0] === "/a" && seen[1] === "/b");
+}
+
+async function testMultiMiddlewareScopedOrder() {
+  var r = b.router.create();
+  var order = [];
+  r.use("/api",
+    function (req, res, next) { order.push("first"); next(); },
+    function (req, res, next) { order.push("second"); next(); });
+  r.get("/api/users", function (req, res) { order.push("route"); res.statusCode = 200; res.end("u"); });
+
+  var res1 = _res();
+  await r.handle(_req("/api/users"), res1);
+  check("use(prefix, mw1, mw2): both run in order before the route",
+        order.join(",") === "first,second,route");
+
+  // And they do NOT run off-prefix.
+  var offOrder = order.length;
+  r.get("/other", function (req, res) { res.statusCode = 200; res.end("o"); });
+  await r.handle(_req("/other"), _res());
+  check("use(prefix, mw1, mw2): neither runs off-prefix",
+        order.length === offOrder);
+}
+
+async function testArrayOfPrefixes() {
+  var r = b.router.create();
+  var hits = [];
+  r.use(["/caldav", "/carddav"], function (req, res, next) { hits.push(req.pathname); next(); });
+  r.get("/caldav/cal",   function (req, res) { res.statusCode = 200; res.end("cal"); });
+  r.get("/carddav/card", function (req, res) { res.statusCode = 200; res.end("card"); });
+  r.get("/jmap",         function (req, res) { res.statusCode = 200; res.end("jmap"); });
+
+  await r.handle(_req("/caldav/cal"), _res());
+  await r.handle(_req("/carddav/card"), _res());
+  await r.handle(_req("/jmap"), _res());
+  check("use([prefixA, prefixB], mw): runs under either prefix, not elsewhere",
+        hits.length === 2 &&
+        hits.indexOf("/caldav/cal") !== -1 &&
+        hits.indexOf("/carddav/card") !== -1);
+}
+
+async function testTrailingSlashNormalized() {
+  var r = b.router.create();
+  var gateRan = [];
+  r.use("/admin/", function (req, res, next) { gateRan.push(req.pathname); next(); });
+  r.get("/admin",   function (req, res) { res.statusCode = 200; res.end("a"); });
+  r.get("/admin/x", function (req, res) { res.statusCode = 200; res.end("x"); });
+
+  await r.handle(_req("/admin"), _res());
+  await r.handle(_req("/admin/x"), _res());
+  check("use('/admin/', gate): trailing slash normalized — matches /admin and /admin/x",
+        gateRan.length === 2 &&
+        gateRan.indexOf("/admin") !== -1 &&
+        gateRan.indexOf("/admin/x") !== -1);
+}
+
+function _throwCode(fn) {
+  try { fn(); return null; }
+  catch (e) { return (e && e.code) || (e && e.constructor && e.constructor.name) || "threw"; }
+}
+
+function testConfigTimeThrows() {
+  var r = b.router.create();
+  check("use(123, mw) throws (non-string prefix)",
+        _throwCode(function () { r.use(123, function () {}); }) === "router/use-bad-first-arg");
+  check("use('/x', 'notafn') throws (non-function middleware)",
+        _throwCode(function () { r.use("/x", "notafn"); }) === "router/use-middleware-not-function");
+  check("use('noslash', mw) throws (prefix must begin with '/')",
+        _throwCode(function () { r.use("noslash", function () {}); }) === "router/use-prefix-not-absolute");
+  check("use() throws (no arguments)",
+        _throwCode(function () { r.use(); }) === "router/use-no-args");
+  check("use('/x') throws (no middleware after prefix)",
+        _throwCode(function () { r.use("/x"); }) === "router/use-no-middleware");
+  check("use([], mw) throws (empty prefix array)",
+        _throwCode(function () { r.use([], function () {}); }) === "router/use-empty-prefix-array");
+  check("use(['/x', 123], mw) throws (non-string entry in prefix array)",
+        _throwCode(function () { r.use(["/x", 123], function () {}); }) === "router/use-prefix-not-string");
+  check("use(null, mw) throws (null first arg)",
+        _throwCode(function () { r.use(null, function () {}); }) === "router/use-bad-first-arg");
+}
+
+async function run() {
+  await testScopedGateRunsOnlyUnderPrefix();
+  await testGateCanRefuseUnderPrefix();
+  await testSegmentBoundaryNotPrefixSubstring();
+  await testExactPrefixMatch();
+  await testRegistrationOrderPreserved();
+  await testGlobalUseStillRunsEverywhere();
+  await testMultiMiddlewareScopedOrder();
+  await testArrayOfPrefixes();
+  await testTrailingSlashNormalized();
+  testConfigTimeThrows();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("router path-scoped use tests passed"); process.exit(0); },
+    function (e) { console.error(e); process.exit(1); }
+  );
+}