@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/test/30-chain.js

@@ -1887,6 +1887,45 @@ async function testCheckpointVerify() {
   }
 }
 
+// Regression: a fire-and-forget checkpoint launched by db.close() reads the
+// chain tip from the open database, then its deferred insert resolves the live
+// db handle at resume time. If a fresh database opened in between, the old
+// tip's checkpoint must NOT be anchored into that different/absent database
+// (it would forge a checkpoint signed under the prior keypair into another db).
+// Reproduce deterministically: tear the db down (bumping the db generation)
+// between the tip read and the insert — auditSign.sign() sits exactly there in
+// checkpoint(). The checkpoint must fail closed (return null, never throw, never
+// write) instead of inserting against the torn-down/replaced database.
+async function testCheckpointCrossGenerationRefused() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-ckptgen-"));
+  var realGen = b.db._dbGeneration;
+  try {
+    await setupTestDb(tmpDir);
+    b.audit.registerNamespace("test");
+    await b.audit.record({ action: "test.event", outcome: "success" });
+
+    // Simulate the db handle being closed/replaced between the tip read and
+    // the insert: dbGeneration() returns one value when checkpoint() binds at
+    // entry, and a changed value at the pre-insert re-check. The checkpoint
+    // must fail closed — return null and write nothing.
+    var n = 0;
+    b.db._dbGeneration = function () { n += 1; return n <= 1 ? 1000 : 1001; };
+    var result = await b.audit.checkpoint();
+    b.db._dbGeneration = realGen;
+
+    check("cross-generation checkpoint returns null", result === null);
+    var after = await b.audit.verifyCheckpoints();
+    check("cross-generation checkpoint wrote nothing", after.ok === true && after.checkpointsVerified === 0);
+
+    // Control: a stable-generation checkpoint still anchors normally.
+    var ok = await b.audit.checkpoint();
+    check("stable-generation checkpoint still anchors", ok && typeof ok._id === "string");
+  } finally {
+    b.db._dbGeneration = realGen;
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function testCheckpointTamperDetect() {
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cdetect-"));
   try {
@@ -2062,6 +2101,7 @@ async function run() {
   // checkpoint sign / verify / tamper / rollback
   await testCheckpointSign();
   await testCheckpointVerify();
+  await testCheckpointCrossGenerationRefused();
   await testCheckpointTamperDetect();
   await testRollbackDetection();
 }

package/lib/vendor/blamejs/test/helpers/check.js

@@ -28,9 +28,27 @@ function addExternalChecks(n) {
   if (typeof n === "number" && isFinite(n) && n >= 0) _checks += n;
 }
 
+// formatErr — render a thrown error as a single-line, bounded diagnostic for a
+// test runner's failure catch. A thrown error's message/stack can carry a test
+// fixture's bytes verbatim; replacing CR/LF (a recognized log-injection
+// barrier) keeps the "FAIL:" line on one row so a fixture value can't forge
+// extra log lines. The newline .replace() is what breaks the log-injection
+// data flow; the tab/run-collapse + length bound are cosmetic.
+function formatErr(e) {
+  var raw = (e && typeof e.stack === "string" && e.stack) ||
+            (e && typeof e.message === "string" && e.message) ||
+            String(e);
+  var oneLine = raw
+    .replace(/[\r\n]+/g, " ")
+    .replace(/\t+/g, " ")
+    .replace(/ {2,}/g, " ");
+  return oneLine.length > 2000 ? oneLine.slice(0, 2000) + "..." : oneLine;
+}
+
 module.exports = {
   check:              check,
   getChecks:          getChecks,
   resetChecksForTest: resetChecksForTest,
   addExternalChecks:  addExternalChecks,
+  formatErr:          formatErr,
 };

package/lib/vendor/blamejs/test/helpers/db.js

@@ -68,6 +68,10 @@ async function teardownTestDb(tmpDir) {
   // Drain audit handler buffered emissions BEFORE close so pending
   // rows land in audit_log rather than leaking into the next test's DB.
   try { await b.audit.flush(); } catch (_e) {}
+  // Anchor the final checkpoint synchronously while this db is still open, so
+  // close()'s own fire-and-forget checkpoint no-ops (skipIfUnchanged) and no
+  // detached checkpoint promise straddles the db boundary into the next test.
+  try { await b.audit.checkpoint({ skipIfUnchanged: true }); } catch (_e) {}
   try { b.db.close(); } catch (_e) {}
   b.audit._resetForTest();
   b.db._resetForTest();

package/lib/vendor/blamejs/test/helpers/index.js

@@ -43,6 +43,7 @@ module.exports = {
   getChecks:          _check.getChecks,
   resetChecksForTest: _check.resetChecksForTest,
   addExternalChecks:  _check.addExternalChecks,
+  formatErr:          _check.formatErr,
 
   // DB fixtures
   setupTestDb:           _db.setupTestDb,

package/lib/vendor/blamejs/test/integration/audit-chain-external-db.test.js

@@ -323,7 +323,8 @@ async function run() {
     "_blamejs_audit_tip", "_blamejs_consent_tip", "_blamejs_audit_purge_anchor",
     "_blamejs_scheduler_ticks", "_blamejs_rate_limit_counters",
     "_blamejs_pubsub_messages", "_blamejs_api_encrypt_nonces", "_blamejs_api_keys",
-    "_blamejs_sessions", "_blamejs_jobs", "_blamejs_cache", "_blamejs_cache_tags",
+    "_blamejs_sessions", "_blamejs_session_valid_from", "_blamejs_jobs",
+    "_blamejs_cache", "_blamejs_cache_tags",
     "_blamejs_seeders", "_blamejs_seeders_lock", "_blamejs_break_glass_policies",
     "_blamejs_break_glass_grants", "_blamejs_leader", "_blamejs_cluster_state",
   ].map(function (t) { return "DROP TABLE IF EXISTS " + t + " CASCADE;"; }).join("\n");

package/lib/vendor/blamejs/test/integration/audit-stack-postgres.test.js

@@ -254,7 +254,8 @@ var FRAMEWORK_TABLES = [
   "_blamejs_audit_tip", "_blamejs_consent_tip", "_blamejs_audit_purge_anchor",
   "_blamejs_scheduler_ticks", "_blamejs_rate_limit_counters",
   "_blamejs_pubsub_messages", "_blamejs_api_encrypt_nonces", "_blamejs_api_keys",
-  "_blamejs_sessions", "_blamejs_jobs", "_blamejs_cache", "_blamejs_cache_tags",
+  "_blamejs_sessions", "_blamejs_session_valid_from", "_blamejs_jobs",
+  "_blamejs_cache", "_blamejs_cache_tags",
   "_blamejs_seeders", "_blamejs_seeders_lock", "_blamejs_break_glass_policies",
   "_blamejs_break_glass_grants", "_blamejs_leader", "_blamejs_cluster_state",
   // app-side table for break-glass + K_row storage round-trips

package/lib/vendor/blamejs/test/integration/data-layer-mysql.test.js

@@ -209,6 +209,13 @@ var MYSQL_DDL = [
     "`createdAt` BIGINT NOT NULL, " +
     "`expiresAt` BIGINT NOT NULL, " +
     "`lastActivity` BIGINT NOT NULL)",
+  // _blamejs_session_valid_from — per-subject not-before invalidation. Mirrors
+  // framework-schema._sessionValidFromDDL("mysql"): VARCHAR key, BIGINT epochs.
+  "DROP TABLE IF EXISTS `_blamejs_session_valid_from`",
+  "CREATE TABLE `_blamejs_session_valid_from` (" +
+    "`subjectHash` VARCHAR(191) PRIMARY KEY, " +
+    "`validFromEpoch` BIGINT NOT NULL, " +
+    "`updatedAt` BIGINT NOT NULL)",
   // _blamejs_api_encrypt_nonces — replay-protection store. nonceHash is the
   // PRIMARY KEY, so the ON DUPLICATE KEY UPDATE no-op fold makes the first
   // insert win (affectedRows=1) and a replay no-op (affectedRows=0).
@@ -241,7 +248,7 @@ var MYSQL_DDL = [
 var DROP_ALL = [
   "_blamejs_cache", "_blamejs_cache_tags", "_blamejs_audit_tip",
   "_blamejs_consent_tip", "_blamejs_audit_log", "_blamejs_consent_log",
-  "_blamejs_sessions", "_blamejs_api_encrypt_nonces",
+  "_blamejs_sessions", "_blamejs_session_valid_from", "_blamejs_api_encrypt_nonces",
   "_blamejs_rate_limit_counters", "_blamejs_cluster_state",
 ].map(function (t) { return "DROP TABLE IF EXISTS `" + t + "`"; });
 

package/lib/vendor/blamejs/test/integration/data-layer-pg.test.js

@@ -245,7 +245,7 @@ function _parseBlock(block) {
 // cache_tags / nonces / rate-limit counters, but ensureSchema materializes
 // the whole framework surface, so all of it is swept.
 var FRAMEWORK_TABLES = [
-  "_blamejs_sessions", "_blamejs_cache", "_blamejs_cache_tags",
+  "_blamejs_sessions", "_blamejs_session_valid_from", "_blamejs_cache", "_blamejs_cache_tags",
   "_blamejs_api_encrypt_nonces", "_blamejs_rate_limit_counters",
   "_blamejs_audit_log", "_blamejs_consent_log", "_blamejs_audit_checkpoints",
   "_blamejs_audit_tip", "_blamejs_consent_tip", "_blamejs_audit_purge_anchor",

package/lib/vendor/blamejs/test/integration/framework-schema-mysql.test.js

@@ -138,7 +138,8 @@ var FRAMEWORK_TABLES = [
   "_blamejs_audit_tip", "_blamejs_consent_tip", "_blamejs_audit_purge_anchor",
   "_blamejs_scheduler_ticks", "_blamejs_rate_limit_counters",
   "_blamejs_pubsub_messages", "_blamejs_api_encrypt_nonces", "_blamejs_api_keys",
-  "_blamejs_sessions", "_blamejs_jobs", "_blamejs_cache", "_blamejs_cache_tags",
+  "_blamejs_sessions", "_blamejs_session_valid_from", "_blamejs_jobs",
+  "_blamejs_cache", "_blamejs_cache_tags",
   "_blamejs_seeders", "_blamejs_seeders_lock", "_blamejs_break_glass_policies",
   "_blamejs_break_glass_grants",
 ];

package/lib/vendor/blamejs/test/integration/webhook-dispatcher-pg.test.js

@@ -0,0 +1,269 @@
+"use strict";
+/**
+ * Live webhook-dispatcher test against the docker Postgres container. The
+ * dispatcher's durable store composes b.sql -> b.externalDb, so smoke only
+ * ever exercises it on SQLite; this proves the real Postgres dialect path:
+ *
+ *   - declareSchema renders valid Postgres DDL (serial -> BIGSERIAL, the
+ *     TIMESTAMPTZ columns, the partial pending index) on a real server.
+ *   - registerEndpoint INSERTs with the secret SEALED at rest (vault: prefix
+ *     in the actual Postgres row, never the plaintext secret).
+ *   - dispatch fans out one event into one delivery row per endpoint and the
+ *     $1..$N-bound INSERT/UPDATE round-trips.
+ *   - the retry claim TRANSACTION (mark-then-reselect) + the BIGINT `attempts`
+ *     column coercing back through frameworkSchema for the count comparison.
+ *   - maxAttempts -> dead-letter and dlq.replay on real Postgres.
+ *
+ * Delivery HTTP is a stubbed transport (no network); the storage path is real.
+ *
+ * RUN: node scripts/test-integration.js --skip-service-check webhook-dispatcher-pg
+ */
+var spawn        = require("node:child_process").spawn;
+var execFileSync = require("node:child_process").execFileSync;
+var fs   = require("node:fs");
+var os   = require("node:os");
+var path = require("node:path");
+var helpers  = require("../helpers");
+var check    = helpers.check;
+var services = require("../helpers/services");
+var b = require("../../");
+
+var CONTAINER     = "blamejs-test-postgres";
+var NULL_SENTINEL = "__BJNULL__";
+var PSQL_ARGS = "psql -U blamejs -d blamejs_test -A -v ON_ERROR_STOP=0 -P null=__BJNULL__ 2>&1";
+
+var ENDPOINTS_TABLE  = b.frameworkSchema.tableName("webhook_endpoints");
+var DELIVERIES_TABLE = b.frameworkSchema.tableName("webhook_deliveries");
+
+// ---- one-shot psql (setup / teardown / out-of-band assertions) ----
+function _psql(sql) {
+  var out = execFileSync(
+    "docker",
+    ["exec", "-i", CONTAINER, "sh", "-c", "psql -U blamejs -d blamejs_test -qtA -P null=__BJNULL__ 2>&1"],
+    { input: sql + "\n", stdio: ["pipe", "pipe", "pipe"] }
+  ).toString("utf8");
+  if (/^ERROR:/m.test(out)) throw new Error("psql failed for [" + sql + "]:\n" + out);
+  return out;
+}
+
+// ---- persistent-session docker-exec psql driver (faithful to node-postgres:
+// BIGINT comes back as a string; quoted DDL preserves column case) ----
+var _seq = 0;
+function _makeDockerPgDriver() {
+  return {
+    connect: function () {
+      return new Promise(function (resolve, reject) {
+        var child = spawn("docker",
+          ["exec", "-i", CONTAINER, "sh", "-c", PSQL_ARGS + " ; echo __BLAMEJS_PSQL_EXIT__"],
+          { stdio: ["pipe", "pipe", "pipe"] });
+        var client = { child: child, buf: "", pending: null, closed: false };
+        child.on("error", function (e) { if (client.pending) { var p = client.pending; client.pending = null; p.reject(e); } });
+        child.on("close", function () {
+          client.closed = true;
+          if (client.pending) { var p = client.pending; client.pending = null; p.reject(new Error("psql session closed mid-statement")); }
+        });
+        child.stdout.on("data", function (chunk) { client.buf += chunk.toString("utf8"); _drain(client); });
+        var prime = "__BJ_PRIME__";
+        client.pending = { sentinel: prime, resolve: function () { resolve(client); }, reject: reject };
+        client.child.stdin.write("\\pset fieldsep '\\t'\n\\pset footer off\n\\echo " + prime + "\n");
+      });
+    },
+    query: function (client, sql, params) {
+      var bound = _bindParams(sql, params || []);
+      var sentinel = "__BJ_EOR_" + (++_seq) + "__";
+      return new Promise(function (resolve, reject) {
+        if (client.closed) { reject(new Error("psql session is closed")); return; }
+        client.pending = { sentinel: sentinel, resolve: resolve, reject: reject };
+        client.child.stdin.write(bound + "\n;\n\\echo " + sentinel + "\n");
+      });
+    },
+    close: function (client) {
+      return new Promise(function (resolve) {
+        if (client.closed) { resolve(); return; }
+        try { client.child.stdin.end("\\q\n"); } catch (_e) {}
+        var done = false;
+        client.child.on("close", function () { if (!done) { done = true; resolve(); } });
+        setTimeout(function () { if (done) return; done = true; try { client.child.kill("SIGKILL"); } catch (_e) {} resolve(); }, 2000);
+      });
+    },
+  };
+}
+
+function _drain(client) {
+  if (!client.pending) return;
+  var sentinel = client.pending.sentinel;
+  var marker = "\n" + sentinel + "\n";
+  var idx = client.buf.indexOf(marker);
+  var startAtZero = client.buf.indexOf(sentinel + "\n") === 0;
+  var block;
+  if (idx !== -1) { block = client.buf.slice(0, idx); client.buf = client.buf.slice(idx + marker.length); }
+  else if (startAtZero) { block = ""; client.buf = client.buf.slice((sentinel + "\n").length); }
+  else return;
+  var p = client.pending; client.pending = null;
+  var parsed;
+  try { parsed = _parseBlock(block); } catch (e) { return p.reject(e); }
+  if (parsed.error) return p.reject(parsed.error);
+  p.resolve({ rows: parsed.rows, rowCount: parsed.rowCount });
+}
+
+function _bindOne(v) {
+  if (v === null || v === undefined) return "NULL";
+  if (typeof v === "number") return String(v);
+  if (typeof v === "boolean") return v ? "TRUE" : "FALSE";
+  return "'" + String(v).replace(/'/g, "''") + "'";
+}
+function _bindParams(sql, params) {
+  return sql.replace(/\$(\d+)/g, function (_m, n) {
+    var i = Number(n) - 1;
+    if (i < 0 || i >= params.length) throw new Error("placeholder $" + n + " has no matching param");
+    var v = params[i];
+    // whereInArray emits `col = ANY($k)` for postgres with a JS array param;
+    // a real node-postgres driver binds it as a postgres array. Replicate
+    // that as an ARRAY[...] literal so the text-shim is faithful.
+    if (Array.isArray(v)) return "ARRAY[" + v.map(_bindOne).join(",") + "]";
+    return _bindOne(v);
+  });
+}
+
+var _CMD_TAG_RE = /^(INSERT|UPDATE|DELETE|MERGE|SELECT|COPY|MOVE)\b(?:\s+\d+)*\s*$/;
+var _CTRL_TAG_RE = /^(BEGIN|COMMIT|ROLLBACK|SET|RESET|SAVEPOINT|RELEASE|START|CREATE|DROP|ALTER|GRANT|REVOKE|TRUNCATE|COMMENT|DO|CALL|VACUUM|ANALYZE|EXPLAIN|TABLE|SHOW|DISCARD)\b/;
+
+function _parseBlock(block) {
+  var lines = block.split(/\r?\n/);
+  while (lines.length && lines[lines.length - 1] === "") lines.pop();
+  for (var i = 0; i < lines.length; i++) {
+    var em = /^ERROR:\s+([0-9A-Za-z]{5}):\s*(.*)$/.exec(lines[i]);
+    if (em) { var err = new Error("Postgres " + em[1] + ": " + em[2]); err.code = em[1]; return { error: err }; }
+  }
+  var affected = null, dataLines = [];
+  for (var j = 0; j < lines.length; j++) {
+    var ln = lines[j];
+    if (/^(NOTICE|WARNING|DETAIL|HINT|LINE|LOCATION|CONTEXT|STATEMENT):/.test(ln)) continue;
+    var tm = _CMD_TAG_RE.exec(ln);
+    if (tm) { var nums = ln.trim().split(/\s+/).slice(1).map(Number); if (nums.length) affected = nums[nums.length - 1]; continue; }
+    if (_CTRL_TAG_RE.test(ln) && ln.indexOf("\t") === -1) continue;
+    dataLines.push(ln);
+  }
+  var rows = [];
+  if (dataLines.length >= 1) {
+    var headers = dataLines[0].split("\t");
+    for (var k = 1; k < dataLines.length; k++) {
+      var cells = dataLines[k].split("\t"), row = {};
+      for (var c = 0; c < headers.length; c++) {
+        var cell = cells[c];
+        row[headers[c]] = (cell === NULL_SENTINEL || cell === undefined) ? null : cell;
+      }
+      rows.push(row);
+    }
+  }
+  return { rows: rows, rowCount: (affected !== null) ? affected : rows.length, error: null };
+}
+
+// Thin externalDb over the persistent psql session: exactly the query /
+// transaction / dialect surface the dispatcher consumes. transaction runs
+// BEGIN/COMMIT on the same session (the dispatcher's claim path is the only
+// transactional one).
+function _pgExternalDb(client, driver) {
+  var xdb = {
+    dialect: "postgres",
+    query: function (s, p) {
+      // The dispatcher binds JS Date params for the timestamp columns; the
+      // psql shim inlines params textually, so Dates must become ISO strings
+      // (a JS Date.toString() is not a portable TIMESTAMPTZ literal).
+      var bound = (p || []).map(function (v) { return v instanceof Date ? v.toISOString() : v; });
+      return driver.query(client, s, bound);
+    },
+    transaction: async function (fn) {
+      await driver.query(client, "BEGIN", []);
+      try { var r = await fn(xdb); await driver.query(client, "COMMIT", []); return r; }
+      catch (e) { try { await driver.query(client, "ROLLBACK", []); } catch (_e) {} throw e; }
+    },
+  };
+  return xdb;
+}
+
+function _stubTransport() {
+  var calls = []; var nextStatus = 200;
+  var fn = function (url, body, headers) { calls.push({ url: url, headers: headers }); return Promise.resolve({ status: nextStatus }); };
+  fn.calls = calls; fn.setStatus = function (s) { nextStatus = s; };
+  return fn;
+}
+
+function _dropTables() {
+  _psql("DROP TABLE IF EXISTS " + DELIVERIES_TABLE + " CASCADE; DROP TABLE IF EXISTS " + ENDPOINTS_TABLE + " CASCADE;");
+}
+
+async function run() {
+  var pg = await services.requireService("postgres");
+  if (!pg.ok) throw new Error("postgres unreachable: " + pg.reason);
+  _dropTables();
+
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-wd-pg-"));
+  await helpers.setupVaultOnly(tmpDir);   // for vault.seal of the per-endpoint secret
+
+  var driver = _makeDockerPgDriver();
+  var client = await driver.connect();
+  var xdb = _pgExternalDb(client, driver);
+
+  try {
+    var now = 1700000000000;
+    var clock = function () { return now; };
+    var transport = _stubTransport();
+    var wd = b.webhook.dispatcher({
+      externalDb: xdb, httpRequest: transport, maxAttempts: 3,
+      retryBackoff: { initialMs: 1000, maxMs: 5000, factor: 2 }, now: clock,
+    });
+
+    await wd.declareSchema();
+    check("declareSchema renders valid Postgres DDL", true);
+
+    var secret = "whsec_pg_secret_value";
+    await wd.registerEndpoint({ endpointId: "ep_pg", url: "https://1.1.1.1/hooks", eventTypes: ["invoice.paid"], secret: secret });
+    // Secret sealed at rest IN REAL POSTGRES.
+    var sealedRow = _psql("SELECT secret_sealed FROM " + ENDPOINTS_TABLE + " WHERE endpoint_id = 'ep_pg';").trim();
+    check("secret sealed at rest in Postgres (vault: prefix)", sealedRow.indexOf("vault:") === 0);
+    check("plaintext secret NOT in Postgres row", sealedRow.indexOf("whsec_pg_secret_value") === -1);
+
+    // dispatch → one delivery row, delivered (stub 200).
+    var res = await wd.dispatch("invoice.paid", { id: "inv_pg_1", amount: 4200 });
+    check("dispatch delivered on Postgres", res.delivered === 1 && res.failed === 0);
+    var delivered = await wd.deliveries.list({ status: "delivered" });
+    check("delivered row persisted in Postgres", delivered.length === 1);
+    check("BIGINT attempts coerced to number 1", delivered[0].attempts === 1);
+    check("responseStatus 200 round-trips", delivered[0].responseStatus === 200);
+
+    // transient failure → stays pending with attempts incremented.
+    transport.setStatus(503);
+    await wd.dispatch("invoice.paid", { id: "inv_pg_2" });
+    var pendingRows = _psql("SELECT count(*) FROM " + DELIVERIES_TABLE + " WHERE status = 'pending';").trim();
+    check("transient failure pending in Postgres", pendingRows === "1");
+
+    // processRetries claim transaction + dead-letter after maxAttempts.
+    transport.setStatus(500);
+    now += 10000; await wd.processRetries();   // attempt 2
+    now += 10000; var r3 = await wd.processRetries();   // attempt 3 → dead
+    check("processRetries dead-letters on Postgres", r3.dead === 1);
+    var dlq = await wd.dlq.list();
+    check("DLQ holds dead delivery on Postgres", dlq.length === 1 && dlq[0].attempts === 3);
+
+    // dlq.replay recovers.
+    transport.setStatus(200);
+    var replay = await wd.dlq.replay(dlq[0].deliveryId);
+    check("dlq.replay delivers on Postgres", replay.ok === true);
+    var dlqAfter = await wd.dlq.list();
+    check("DLQ empty after replay on Postgres", dlqAfter.length === 0);
+  } finally {
+    try { await driver.close(client); } catch (_e) {}
+    try { helpers.teardownVaultOnly(tmpDir); } catch (_e) {}
+    _dropTables();
+  }
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[webhook-dispatcher-pg] OK — " + helpers.getChecks() + " checks passed"); process.exit(0); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/atomic-file-fd-read.test.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * b.atomicFile.fdSafeReadSync — TOCTOU-safe fd read (CWE-367 /
+ * js/file-system-race). The single owner of the open-fd → fstat →
+ * read-fully loop that atomic-file / network-tls / vault-seal-pem / backup
+ * all route through, with the security guards exposed as opts:
+ *
+ *   - maxBytes        — refuse a file larger than the cap (post-fstat)
+ *   - refuseSymlink   — lstat + refuse a symlink source (no follow)
+ *   - inodeCheck      — refuse if the fd inode != the lstat inode (TOCTOU)
+ *   - expectedHash    — SHA3-512 the content must match
+ *   - encoding        — return a decoded string instead of a Buffer
+ *   - allowShortRead  — slice to the bytes read instead of throwing
+ *   - errorFor        — map a failure KIND to the caller's typed error
+ */
+
+var fs   = require("fs");
+var path = require("path");
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _dir() { return b.testing.tempDir("fdsaferead"); }
+
+function _throws(fn) {
+  try { fn(); return null; } catch (e) { return e; }
+}
+
+function testReadsBufferAndString() {
+  var dir = _dir();
+  try {
+    var p = path.join(dir.path, "data.bin");
+    var payload = Buffer.from("fd-safe payload ✓", "utf8");
+    fs.writeFileSync(p, payload, { mode: 0o600 });
+    var buf = b.atomicFile.fdSafeReadSync(p);
+    check("fdSafeReadSync: returns a Buffer by default", Buffer.isBuffer(buf) && buf.equals(payload));
+    var str = b.atomicFile.fdSafeReadSync(p, { encoding: "utf8" });
+    check("fdSafeReadSync: encoding returns a string", str === payload.toString("utf8"));
+  } finally { dir.cleanup(); }
+}
+
+function testMaxBytesCap() {
+  var dir = _dir();
+  try {
+    var p = path.join(dir.path, "big.bin");
+    fs.writeFileSync(p, Buffer.alloc(2048), { mode: 0o600 });
+    var e = _throws(function () { b.atomicFile.fdSafeReadSync(p, { maxBytes: 1024 }); });
+    check("fdSafeReadSync: maxBytes refuses an over-cap file",
+          e !== null && /too-large|maxBytes/i.test(e.code + " " + e.message));
+    // Under the cap reads fine.
+    var ok = b.atomicFile.fdSafeReadSync(p, { maxBytes: 4096 });
+    check("fdSafeReadSync: under the cap reads fine", ok.length === 2048);
+  } finally { dir.cleanup(); }
+}
+
+function testExpectedHash() {
+  var dir = _dir();
+  try {
+    var p = path.join(dir.path, "hashed.bin");
+    fs.writeFileSync(p, Buffer.from("integrity"), { mode: 0o600 });
+    var e = _throws(function () {
+      b.atomicFile.fdSafeReadSync(p, { expectedHash: "0".repeat(128) });
+    });
+    check("fdSafeReadSync: wrong expectedHash refuses (integrity)",
+          e !== null && /integrity/i.test(e.code + " " + e.message));
+  } finally { dir.cleanup(); }
+}
+
+function testEnoent() {
+  var dir = _dir();
+  try {
+    var missing = path.join(dir.path, "nope.bin");
+    // Default errorFor → AtomicFileError; an errorFor returning undefined
+    // rethrows the raw ENOENT (the network-tls / vault / backup posture).
+    var eDefault = _throws(function () { b.atomicFile.fdSafeReadSync(missing); });
+    check("fdSafeReadSync: missing file (default errorFor) throws a typed atomic-file error",
+          eDefault !== null && eDefault.code === "atomic-file/enoent");
+    var eRaw = _throws(function () {
+      b.atomicFile.fdSafeReadSync(missing, { errorFor: function () { return undefined; } });
+    });
+    check("fdSafeReadSync: errorFor undefined rethrows raw ENOENT",
+          eRaw !== null && eRaw.code === "ENOENT");
+  } finally { dir.cleanup(); }
+}
+
+function testErrorForCustomError() {
+  var dir = _dir();
+  try {
+    var p = path.join(dir.path, "big2.bin");
+    fs.writeFileSync(p, Buffer.alloc(4096), { mode: 0o600 });
+    function Tagged(msg) { this.message = msg; this.tag = "custom-too-large"; }
+    var e = _throws(function () {
+      b.atomicFile.fdSafeReadSync(p, {
+        maxBytes: 16,
+        errorFor: function (kind) { return kind === "too-large" ? new Tagged("over cap") : undefined; },
+      });
+    });
+    check("fdSafeReadSync: errorFor maps a kind to the caller's typed error",
+          e !== null && e.tag === "custom-too-large");
+  } finally { dir.cleanup(); }
+}
+
+function testRefuseSymlinkAndInodeHappyPath() {
+  var dir = _dir();
+  try {
+    var p = path.join(dir.path, "real.pem");
+    fs.writeFileSync(p, Buffer.from("PEM"), { mode: 0o600 });
+    // refuseSymlink + inodeCheck on a regular file reads fine (the vault posture).
+    var buf = b.atomicFile.fdSafeReadSync(p, { refuseSymlink: true, inodeCheck: true });
+    check("fdSafeReadSync: refuseSymlink+inodeCheck reads a regular file", buf.toString() === "PEM");
+
+    // A symlink source is refused (no follow). Platform-conditional: Windows
+    // without SeCreateSymbolicLink can't create symlinks — skip the assertion.
+    var victim = path.join(dir.path, "victim.pem");
+    fs.writeFileSync(victim, "SECRET", { mode: 0o600 });
+    var link = path.join(dir.path, "link.pem");
+    var symlinkOk = true;
+    try { fs.symlinkSync(victim, link); } catch (_e) { symlinkOk = false; }
+    if (symlinkOk) {
+      var e = _throws(function () {
+        b.atomicFile.fdSafeReadSync(link, {
+          refuseSymlink: true,
+          errorFor: function (kind) { return kind === "symlink" ? Object.assign(new Error("symlink"), { kind: "symlink" }) : undefined; },
+        });
+      });
+      check("fdSafeReadSync: refuseSymlink refuses a symlink source",
+            e !== null && e.kind === "symlink");
+    } else {
+      check("fdSafeReadSync: symlink case skipped (platform lacks symlink privilege)", true);
+    }
+  } finally { dir.cleanup(); }
+}
+
+async function run() {
+  testReadsBufferAndString();
+  testMaxBytesCap();
+  testExpectedHash();
+  testEnoent();
+  testErrorForCustomError();
+  testRefuseSymlinkAndInodeHappyPath();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/audit-framework-namespaces.test.js

@@ -35,6 +35,11 @@ var LIB_ROOT = path.resolve(__dirname, "..", "..", "lib");
 // `[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+`.
 var EMIT_PATTERNS = [
   /(?:_emit|_emitAudit|_auditEmit|emitAudit)\(\s*["']([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+)["']/g,
+  // audit().namespaced("ns.scope"[, auditFlag]) — the audit namespace lives in
+  // the factory call now, not in each safeEmit/_emitAudit invocation. Scoped to
+  // `audit().namespaced` so `observability().namespaced` metric prefixes (a
+  // separate vocabulary, not FRAMEWORK_NAMESPACES) are NOT pulled in.
+  /audit\(\)\.namespaced\(\s*["']([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+)["']/g,
   /action\s*:\s*["']([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+)["']/g,
 ];
 
@@ -126,9 +131,55 @@ function testFrameworkNamespacesShape() {
   }
 }
 
+// auditEmit.gatedReasonEmitter — the gated, reason-hoisting emitter shared by
+// backup / restore / scheduler / config-drift / legal-hold.
+function testGatedReasonEmitter() {
+  var auditEmit = require("../../lib/audit-emit");
+  var audit = require("../../lib/audit");
+  var captured = [];
+  var realSafe = audit.safeEmit;
+  audit.safeEmit = function (e) { captured.push(e); };   // late-bound default sink
+  try {
+    var emit = auditEmit.gatedReasonEmitter({ audit: true });
+    emit("backup.started", { jobId: 7 }, "success");
+    emit("backup.failed", { jobId: 7, reason: "disk-full" }, "failure");
+    check("gatedReasonEmitter: reason null when info.reason absent",
+      captured[0] && captured[0].action === "backup.started" && captured[0].reason === null);
+    check("gatedReasonEmitter: reason hoisted from info.reason",
+      captured[1] && captured[1].reason === "disk-full" && captured[1].outcome === "failure");
+    check("gatedReasonEmitter: metadata is the info object",
+      captured[1] && captured[1].metadata && captured[1].metadata.jobId === 7);
+
+    // gate OFF — drop-silent, no emit
+    var n = captured.length;
+    auditEmit.gatedReasonEmitter({ audit: false })("x", { reason: "y" }, "success");
+    check("gatedReasonEmitter: gate off suppresses emit", captured.length === n);
+
+    // extra(info) adds top-level fields (legal-hold's resource)
+    auditEmit.gatedReasonEmitter({
+      audit: true,
+      extra: function (info) { return { resource: { kind: "legal-hold", id: info && info.subjectId } }; },
+    })("legalhold.placed", { subjectId: "abc", reason: "litigation" }, "success");
+    var last = captured[captured.length - 1];
+    check("gatedReasonEmitter: extra() merges top-level fields",
+      last && last.resource && last.resource.id === "abc" && last.reason === "litigation");
+
+    // operator sink routing — goes to the supplied sink, not the framework default
+    var sinkEvents = [];
+    var m = captured.length;
+    auditEmit.gatedReasonEmitter({ audit: true, sink: { safeEmit: function (e) { sinkEvents.push(e); } } })
+      ("ns.act", { reason: "r" }, "success");
+    check("gatedReasonEmitter: routes to the operator sink",
+      sinkEvents.length === 1 && sinkEvents[0].reason === "r" && captured.length === m);
+  } finally {
+    audit.safeEmit = realSafe;
+  }
+}
+
 async function run() {
   testFrameworkNamespacesShape();
   testEveryEmittedNamespaceIsRegistered();
+  testGatedReasonEmitter();
 }
 
 module.exports = { run: run };