@blamejs/blamejs-shop 0.5.11 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/pubsub.test.js

@@ -16,6 +16,9 @@ var check = helpers.check;
 var b = helpers.b;
 var { setupTestDb, teardownTestDb } = require("../helpers/db");
 
+// pubsub caps channel names at 1 KiB (lib/pubsub.js _MAX_CHANNEL_LEN).
+var C_KIB = 1024;
+
 async function testSurface() {
   check("b.pubsub exposed",        typeof b.pubsub === "object");
   check("b.pubsub.create is fn",   typeof b.pubsub.create === "function");
@@ -260,6 +263,285 @@ async function testCacheInvalidationFanOut() {
   await ps.close();
 }
 
+// A minimal in-process custom backend implementing the documented
+// { publishRemote, start, stop } contract (plus optional subscribeRemote
+// / unsubscribeRemote). It captures the remote-message callback so the
+// test can inject cross-node deliveries, and records every remote call so
+// ref-counting and scoping are observable. No external broker involved.
+function makeCaptureBackend(cfg) {
+  cfg = cfg || {};
+  var state = {
+    started: false, stopped: false, onRemote: null,
+    published: [], subscribed: [], unsubscribed: [],
+  };
+  var backend = {
+    start: function (onRemote) { state.started = true; state.onRemote = onRemote; },
+    stop:  function () { state.stopped = true; },
+    publishRemote: async function (scopedChannel, payload) {
+      if (cfg.throwOnPublish) throw new Error("publishRemote boom");
+      state.published.push({ channel: scopedChannel, payload: payload });
+      return cfg.publishRemoteReturn;
+    },
+    subscribeRemote: async function (scopedChannel, isPattern) {
+      if (cfg.throwOnSubscribe) throw new Error("subscribeRemote boom");
+      state.subscribed.push({ channel: scopedChannel, isPattern: isPattern });
+    },
+    unsubscribeRemote: async function (scopedChannel, isPattern) {
+      state.unsubscribed.push({ channel: scopedChannel, isPattern: isPattern });
+    },
+  };
+  return { backend: backend, state: state };
+}
+
+async function testSingleSegmentPatternMatchesDottedChannel() {
+  // The flagship documented pattern: '*' matches ONE '.'-delimited
+  // segment inside a dotted channel. Driven through the real
+  // subscribePattern → publish consumer path, not just the matcher.
+  var ps = b.pubsub.create();
+  var hits = [];
+  ps.subscribePattern("orders.*.created", function (_p, ev) { hits.push(ev.channel); });
+  ps.subscribePattern("a.*.b.*.c",        function (_p, ev) { hits.push(ev.channel); });
+
+  await ps.publish("orders.eu.created", null);       // must match (one segment)
+  await ps.publish("orders.eu.us.created", null);    // must NOT (two segments)
+  await ps.publish("a.X.b.Y.c", null);               // two single-segment wildcards
+  check("single-* pattern matches dotted channel",  hits.indexOf("orders.eu.created") !== -1);
+  check("single-* pattern rejects two-segment span", hits.indexOf("orders.eu.us.created") === -1);
+  check("multi single-* pattern matches",            hits.indexOf("a.X.b.Y.c") !== -1);
+  await ps.close();
+}
+
+async function testMatcherEdgeBranches() {
+  var ps = b.pubsub.create();
+  var m = ps._matchPatternForTest;
+  check("exact equality without wildcard matches", m("a.b.c", "a.b.c") === true);
+  check("no-wildcard non-equal pattern rejects",   m("a.b.c", "a.b.d") === false);
+  check("'**' suffix matches any tail",            m("audit.**", "audit.x.y.z") === true);
+  check("empty middle segment matches '*'",        m("x.*.y", "x..y") === true);
+  check("non-string channel rejected",             m("a.*", 12345) === false);
+
+  // Channel/pattern length bound (1 KiB) short-circuits to false.
+  var huge = "a".repeat(C_KIB + 8);
+  check("over-length channel rejected", m("a*", huge) === false);
+  check("over-length pattern rejected", m(huge + "*", "short") === false);
+  await ps.close();
+}
+
+async function testInputValidation() {
+  var ps = b.pubsub.create();
+  function threw(fn) { try { fn(); return null; } catch (e) { return e; } }
+
+  check("subscribe non-string channel throws BAD_OPT",
+        (threw(function () { ps.subscribe(42, function () {}); }) || {}).code === "BAD_OPT");
+  check("subscribe empty channel throws BAD_OPT",
+        (threw(function () { ps.subscribe("", function () {}); }) || {}).code === "BAD_OPT");
+  check("subscribe non-function handler throws BAD_OPT",
+        (threw(function () { ps.subscribe("c", "nope"); }) || {}).code === "BAD_OPT");
+  check("subscribePattern empty pattern throws BAD_OPT",
+        (threw(function () { ps.subscribePattern("", function () {}); }) || {}).code === "BAD_OPT");
+  check("subscribePattern non-function handler throws BAD_OPT",
+        (threw(function () { ps.subscribePattern("a.*", 7); }) || {}).code === "BAD_OPT");
+
+  var pubErr = null;
+  try { await ps.publish(null, {}); } catch (e) { pubErr = e; }
+  check("publish non-string channel throws BAD_OPT", pubErr && pubErr.code === "BAD_OPT");
+  var pubErr2 = null;
+  try { await ps.publish("", {}); } catch (e) { pubErr2 = e; }
+  check("publish empty channel throws BAD_OPT", pubErr2 && pubErr2.code === "BAD_OPT");
+  await ps.close();
+}
+
+async function testPatternHandlerErrorIsolation() {
+  // A throwing PATTERN handler must not abort dispatch to sibling
+  // handlers (exact or pattern) for the same channel.
+  var ps = b.pubsub.create();
+  var exactSeen = 0, patternSeen = 0;
+  ps.subscribePattern("c.*", function () { throw new Error("pattern boom"); });
+  ps.subscribePattern("c.*", function () { patternSeen++; });
+  ps.subscribe("c.x", function () { exactSeen++; });
+
+  await ps.publish("c.x", null);
+  check("throwing pattern handler did not block sibling pattern", patternSeen === 1);
+  check("throwing pattern handler did not block exact handler",   exactSeen === 1);
+  await ps.close();
+}
+
+async function testUnsubscribeEdgeCases() {
+  var ps = b.pubsub.create();
+  // No-op branches: falsy / non-object / unknown token.
+  ps.unsubscribe(null);
+  ps.unsubscribe(undefined);
+  ps.unsubscribe("not-an-object");
+  ps.unsubscribe({ channel: "ghost", isPattern: false });   // never subscribed
+  check("unsubscribe garbage tokens are safe no-ops", ps._state().exactChannels === 0);
+
+  var seen = 0;
+  var pat = ps.subscribePattern("p.*", function () { seen++; });
+  check("pattern subscribe reflected in _state", ps._state().patternCount === 1);
+  ps.unsubscribe(pat);
+  ps.unsubscribe(pat);   // double-unsubscribe: second is a no-op
+  await ps.publish("p.x", null);
+  check("pattern unsubscribe stops dispatch", seen === 0);
+  check("pattern unsubscribe clears _state",  ps._state().patternCount === 0);
+
+  var seen2 = 0;
+  var ex = ps.subscribe("e1", function () { seen2++; });
+  check("exact channel present in _state", ps._state().exactChannels === 1);
+  ps.unsubscribe(ex);
+  check("last-handler unsubscribe drops the channel map entry", ps._state().exactChannels === 0);
+  await ps.publish("e1", null);
+  check("exact unsubscribe stops dispatch", seen2 === 0);
+  await ps.close();
+}
+
+async function testBackendResolution() {
+  function threw(fn) { try { fn(); return null; } catch (e) { return e; } }
+  check("unknown backend string throws UNKNOWN_BACKEND",
+        (threw(function () { b.pubsub.create({ backend: "bogus" }); }) || {}).code === "UNKNOWN_BACKEND");
+  check("custom backend missing methods throws BAD_BACKEND",
+        (threw(function () { b.pubsub.create({ backend: { publishRemote: function () {} } }); }) || {}).code === "BAD_BACKEND");
+
+  var cap = makeCaptureBackend();
+  var ps = b.pubsub.create({ backend: cap.backend });
+  check("custom backend name is 'custom'", ps.backend() === "custom");
+  check("custom backend start() invoked with remote callback",
+        cap.state.started === true && typeof cap.state.onRemote === "function");
+  await ps.close();
+  check("custom backend stop() invoked on close", cap.state.stopped === true);
+}
+
+async function testCustomBackendPublishRemote() {
+  // remote count derives from publishRemote's return: {remote:N} → N;
+  // anything non-{remote:finite} → 1.
+  async function remoteCountFor(ret) {
+    var cap = makeCaptureBackend({ publishRemoteReturn: ret });
+    var ps = b.pubsub.create({ backend: cap.backend });
+    var seenLocal = 0;
+    ps.subscribe("c1", function () { seenLocal++; });
+    var rv = await ps.publish("c1", { k: 1 });
+    check("local dispatch happens regardless of backend", seenLocal === 1 && rv.local === 1);
+    check("publishRemote received the (scoped) channel + payload",
+          cap.state.published.length === 1 &&
+          cap.state.published[0].channel === "c1" &&
+          cap.state.published[0].payload.k === 1);
+    await ps.close();
+    return rv.remote;
+  }
+  check("remote count from {remote:3}", (await remoteCountFor({ remote: 3 })) === 3);
+  check("remote count defaults to 1 on undefined return", (await remoteCountFor(undefined)) === 1);
+  check("remote count defaults to 1 on non-object return", (await remoteCountFor("nope")) === 1);
+  check("remote count defaults to 1 on {remote:NaN}", (await remoteCountFor({ remote: NaN })) === 1);
+}
+
+async function testCustomBackendPublishRemoteThrows() {
+  var cap = makeCaptureBackend({ throwOnPublish: true });
+  var ps = b.pubsub.create({ backend: cap.backend, audit: true });
+  var seen = 0;
+  ps.subscribe("c1", function () { seen++; });
+  var err = null;
+  try { await ps.publish("c1", { k: 1 }); } catch (e) { err = e; }
+  check("publish rejects when publishRemote throws", err && /publishRemote boom/.test(err.message));
+  check("local dispatch still ran before the remote failure", seen === 1);
+  await ps.close();
+}
+
+async function testTopicPrefixScopingAndRemoteInbound() {
+  var cap = makeCaptureBackend({ publishRemoteReturn: { remote: 1 } });
+  var ps = b.pubsub.create({ backend: cap.backend, topicPrefix: "svc" });
+  var seen = [];
+  ps.subscribe("orders", function (payload, ev) { seen.push({ p: payload, ev: ev }); });
+
+  await ps.publish("orders", { id: 1 });
+  check("publishRemote gets the topic-prefixed channel",
+        cap.state.published.length === 1 && cap.state.published[0].channel === "svc:orders");
+
+  // Inbound remote deliveries via the captured callback (scoped channel).
+  cap.state.onRemote("svc:orders", JSON.stringify({ id: 2 }), {});
+  cap.state.onRemote("svc:orders", Buffer.from(JSON.stringify({ id: 3 }), "utf8"), {});
+  cap.state.onRemote("svc:orders", { id: 4 }, {});         // object passthrough
+  check("remote string payload parsed + unscoped + dispatched",
+        seen.length === 4 && seen[1].p.id === 2 && seen[1].ev.channel === "orders");
+  check("remote source tagged 'remote'", seen[1].ev.source === "remote");
+  check("remote Buffer payload parsed", seen[2].p.id === 3);
+  check("remote object payload passed through", seen[3].p.id === 4);
+
+  // Malformed remote JSON drops silently — no dispatch, no throw.
+  cap.state.onRemote("svc:orders", "{not-valid-json", {});
+  check("malformed remote payload dropped silently", seen.length === 4);
+  await ps.close();
+}
+
+async function testRemotePatternDelivery() {
+  var cap = makeCaptureBackend();
+  var ps = b.pubsub.create({ backend: cap.backend });
+  var hits = [];
+  ps.subscribePattern("orders.*.created", function (_p, ev) { hits.push(ev.channel); });
+  cap.state.onRemote("orders.eu.created", JSON.stringify({ id: 1 }), {});
+  check("remote message dispatches to matching pattern handler",
+        hits.length === 1 && hits[0] === "orders.eu.created");
+  await ps.close();
+}
+
+async function testRemoteRefCounting() {
+  var cap = makeCaptureBackend();
+  var ps = b.pubsub.create({ backend: cap.backend });
+  var t1 = ps.subscribe("c1", function () {});
+  var t2 = ps.subscribe("c1", function () {});
+  // subscribeRemote is fire-and-forget; only the FIRST local handler for a
+  // scoped channel triggers a single remote subscribe.
+  await helpers.waitUntil(function () { return cap.state.subscribed.length >= 1; },
+    { label: "pubsub: first subscribe triggers one remote subscribeRemote" });
+  check("only one remote subscribe for two local handlers",
+        cap.state.subscribed.length === 1 && cap.state.subscribed[0].channel === "c1");
+
+  ps.unsubscribe(t1);
+  check("remote unsubscribe not yet called while a handler remains",
+        cap.state.unsubscribed.length === 0);
+  ps.unsubscribe(t2);
+  await helpers.waitUntil(function () { return cap.state.unsubscribed.length >= 1; },
+    { label: "pubsub: last unsubscribe triggers one remote unsubscribeRemote" });
+  check("remote unsubscribe fires when last local handler goes away",
+        cap.state.unsubscribed.length === 1 && cap.state.unsubscribed[0].channel === "c1");
+  await ps.close();
+}
+
+async function testSubscribeRemoteFailureSwallowed() {
+  // A rejecting subscribeRemote must not surface synchronously from
+  // subscribe(); local dispatch keeps working.
+  var cap = makeCaptureBackend({ throwOnSubscribe: true });
+  var ps = b.pubsub.create({ backend: cap.backend });
+  var seen = 0;
+  var err = null;
+  try { ps.subscribe("c1", function () { seen++; }); } catch (e) { err = e; }
+  check("subscribe does not throw when subscribeRemote rejects", err === null);
+  await ps.publish("c1", null);
+  check("local dispatch still works after remote-subscribe failure", seen === 1);
+  await ps.close();
+}
+
+async function testCloseIdempotentAndState() {
+  var cap = makeCaptureBackend();
+  var ps = b.pubsub.create({ backend: cap.backend });
+  ps.subscribe("c1", function () {});
+  ps.subscribePattern("p.*", function () {});
+  var st = ps._state();
+  check("_state reports backend name", st.backend === "custom");
+  check("_state reports exact + pattern counts", st.exactChannels === 1 && st.patternCount === 1);
+  check("_state reports not-closed", st.closed === false);
+
+  await ps.close();
+  await ps.close();   // idempotent — second close is a no-op, no throw
+  check("_state reports closed after close", ps._state().closed === true);
+  check("close cleared subscription maps", ps._state().exactChannels === 0 && ps._state().patternCount === 0);
+
+  var perr = null;
+  try { await ps.publish("c1", null); } catch (e) { perr = e; }
+  check("publish after close throws CLOSED", perr && perr.code === "CLOSED");
+  var serr = null;
+  try { ps.subscribePattern("x.*", function () {}); } catch (e) { serr = e; }
+  check("subscribePattern after close throws CLOSED", serr && serr.code === "CLOSED");
+}
+
 async function run() {
   await testSurface();
   await testLocalSubscribePublish();
@@ -267,6 +549,19 @@ async function run() {
   await testHandlerErrorIsolation();
   await testTopicPrefixIsolation();
   await testPatternSubscribe();
+  await testSingleSegmentPatternMatchesDottedChannel();
+  await testMatcherEdgeBranches();
+  await testInputValidation();
+  await testPatternHandlerErrorIsolation();
+  await testUnsubscribeEdgeCases();
+  await testBackendResolution();
+  await testCustomBackendPublishRemote();
+  await testCustomBackendPublishRemoteThrows();
+  await testTopicPrefixScopingAndRemoteInbound();
+  await testRemotePatternDelivery();
+  await testRemoteRefCounting();
+  await testSubscribeRemoteFailureSwallowed();
+  await testCloseIdempotentAndState();
   await testClosedRejectsPublishSubscribe();
   await testClusterNumericConfigValidation();
   await testClusterFanOut();

package/lib/vendor/blamejs/test/layer-0-primitives/queue-flow-repeat.test.js

@@ -69,6 +69,41 @@ async function testRepeatCronReEnqueuesAfterComplete() {
   }
 }
 
+// A cron-repeat re-enqueue must preserve the operator's maxAttempts. The
+// re-enqueue already carries priority / classification / traceId forward;
+// dropping maxAttempts silently resets a fail-fast cron job (maxAttempts: 2)
+// to the queue default (5) on every occurrence, so the operator's retry
+// budget quietly stops holding after the first firing.
+async function testRepeatPreservesMaxAttempts() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+
+    await b.queue.enqueue("cron-max", { tag: "loop" },
+      { repeat: { cron: "* * * * *" }, maxAttempts: 3 });
+
+    var seen = 0;
+    var consumer = b.queue.consume("cron-max",
+      async function () { seen++; },
+      { concurrency: 1, pollIntervalMs: 25, fastPollMs: 5 });
+    await helpers.waitUntil(function () { return seen >= 1; }, {
+      timeoutMs: 3000, label: "queue cron-max: consumer saw the job",
+    });
+
+    var pending = await b.db.from("_blamejs_jobs")
+      .where({ queueName: "cron-max", status: "pending" }).all();
+    check("repeat: a follow-up pending row was scheduled", pending.length === 1);
+    check("repeat: follow-up preserves the operator's maxAttempts (not the default 5)",
+          Number(pending[0].maxAttempts) === 3);
+
+    consumer.cancel();
+  } finally {
+    try { await b.queue.shutdown({ timeoutMs: 500 }); } catch (_e) {}
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function testRepeatStopsOnFinalFailure() {
   var tmpDir = _tmp();
   await setupTestDb(tmpDir);
@@ -388,6 +423,7 @@ async function run() {
   await testPatchFlowDepsDoesNotReparkReleasedChild();
   await testFlowSurface();
   await testRepeatCronReEnqueuesAfterComplete();
+  await testRepeatPreservesMaxAttempts();
   await testRepeatStopsOnFinalFailure();
   await testEnqueueRoundTripsAvailableAt();
   await testFlowLinearChain();

package/lib/vendor/blamejs/test/layer-0-primitives/queue.test.js

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * queue.bootFromEnv — env-driven queue init mirroring
+ * network.bootFromEnv. Reads BLAMEJS_QUEUE_* from a supplied fixture env
+ * and wires a single `default` backend; idempotent; throws INVALID_CONFIG
+ * on an unknown protocol or a redis selection with no URL.
+ *
+ * Run standalone: `node test/layer-0-primitives/queue.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function testBootFromEnvRejectsUnknownProtocol() {
+  b.queue._resetForTest();
+  var threw = null;
+  try { b.queue.bootFromEnv({ env: { BLAMEJS_QUEUE_PROTOCOL: "wibble" } }); } catch (e) { threw = e; }
+  check("queue.bootFromEnv rejects an unknown protocol", threw && threw.code === "INVALID_CONFIG");
+  // The failed boot left the queue uninitialized (the throw was pre-init).
+  var listThrew = null;
+  try { b.queue.listBackends(); } catch (e) { listThrew = e; }
+  check("queue stays uninitialized after a rejected boot",
+        listThrew && listThrew.code === "NOT_INITIALIZED");
+}
+
+function testBootFromEnvRedisRequiresUrl() {
+  b.queue._resetForTest();
+  var threw = null;
+  try { b.queue.bootFromEnv({ env: { BLAMEJS_QUEUE_PROTOCOL: "redis" } }); } catch (e) { threw = e; }
+  check("queue.bootFromEnv redis without URL throws INVALID_CONFIG",
+        threw && threw.code === "INVALID_CONFIG");
+}
+
+function testBootFromEnvLocalDefault() {
+  b.queue._resetForTest();
+  try {
+    b.queue.bootFromEnv({ env: { BLAMEJS_QUEUE_PROTOCOL: "local" } });
+    var backends = b.queue.listBackends();
+    check("queue.bootFromEnv local wires exactly one backend", backends.length === 1);
+    check("queue.bootFromEnv local backend is named 'default' with protocol 'local'",
+          backends[0].name === "default" && backends[0].protocol === "local");
+
+    // Idempotent — a second boot after init is a no-op.
+    b.queue.bootFromEnv({ env: { BLAMEJS_QUEUE_PROTOCOL: "local" } });
+    check("queue.bootFromEnv is idempotent after init",
+          b.queue.listBackends().length === 1);
+  } finally {
+    b.queue._resetForTest();
+  }
+}
+
+function testBootFromEnvDefaultsToLocal() {
+  b.queue._resetForTest();
+  try {
+    // No BLAMEJS_QUEUE_PROTOCOL → defaults to the local protocol.
+    b.queue.bootFromEnv({ env: {} });
+    var backends = b.queue.listBackends();
+    check("queue.bootFromEnv defaults to the local protocol when unset",
+          backends.length === 1 && backends[0].protocol === "local");
+  } finally {
+    b.queue._resetForTest();
+  }
+}
+
+async function run() {
+  testBootFromEnvRejectsUnknownProtocol();
+  testBootFromEnvRedisRequiresUrl();
+  testBootFromEnvLocalDefault();
+  testBootFromEnvDefaultsToLocal();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[queue] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-xff-spoofing.test.js

@@ -104,6 +104,40 @@ async function run() {
   catch (e) { threwMode = e; }
   check("create: bad ipKeyMode refused", threwMode !== null && /ipKeyMode/.test(threwMode.message));
 
+  // scope:"per-route" must key on the route PATH only — never the query
+  // string. When req.pathname is absent (a raw http.IncomingMessage handed
+  // to the middleware directly, before b.router populates pathname) the key
+  // used req.url verbatim, so rotating a throwaway query param minted a fresh
+  // per-route bucket per request and defeated the limit — the same bucket-
+  // rotation evasion class as the XFF / low-64 cases above. Every sibling
+  // guard (request-log / require-auth / network-allowlist) already strips the
+  // query with `(req.url||"").split("?")[0]`; rate-limit must too.
+  function _rawReq(url) {
+    // No pathname — the shape a bare Node req has before the router runs.
+    return { url: url, method: "POST",
+      socket: { remoteAddress: "198.51.100.7" }, headers: {}, requestId: "r" };
+  }
+  var routeMw = b.middleware.rateLimit({
+    backend: "memory", algorithm: "fixed-window", max: 1,
+    windowMs: b.constants.TIME.hours(1), scope: "per-route",
+  });
+  var q1 = await _runMw(routeMw, _rawReq("/api/pay?nonce=1"));
+  var q2 = await _runMw(routeMw, _rawReq("/api/pay?nonce=2"));
+  var q3 = await _runMw(routeMw, _rawReq("/api/pay?nonce=3"));
+  check("per-route: first request to the route allowed", q1.next === true);
+  check("per-route: query-string rotation hits the SAME route bucket (blocked)",
+        q2.next === false && q3.next === false);
+
+  // The fix strips the query, not the path: distinct route paths stay distinct.
+  var routeMw2 = b.middleware.rateLimit({
+    backend: "memory", algorithm: "fixed-window", max: 1,
+    windowMs: b.constants.TIME.hours(1), scope: "per-route",
+  });
+  var r1 = await _runMw(routeMw2, _rawReq("/api/pay"));
+  var r2 = await _runMw(routeMw2, _rawReq("/api/refund"));
+  check("per-route: distinct route paths keep distinct buckets",
+        r1.next === true && r2.next === true);
+
   console.log("[rate-limit-xff-spoofing] OK — " + helpers.getChecks() + " checks passed");
 }