@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/middleware-require-content-type.test.js

@@ -0,0 +1,127 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.middleware.requireContentType — MIME-confusion refusal.
+ *
+ * Drives the RFC 9110 §15.5.16 415 gate: body-bearing verbs whose
+ * Content-Type is off the allowlist are refused with an Accept header;
+ * idempotent verbs bypass; parameters (charset) are ignored on the
+ * bare type; the methods override + onDeny hook + create-time
+ * validation are exercised.
+ *
+ * Run standalone: `node test/layer-0-primitives/middleware-require-content-type.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _drive(mw, method, contentType) {
+  var headers = contentType ? { "content-type": contentType } : {};
+  var req = { method: method, url: "/api/echo", headers: headers };
+  var res = b.testing.mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  var cap = res._captured();
+  cap.nextCalled = nextCalled;
+  return cap;
+}
+
+function testAllowedTypePasses() {
+  var mw = b.middleware.requireContentType(["application/json"]);
+  var cap = _drive(mw, "POST", "application/json");
+  check("requireContentType: allowed Content-Type passes through", cap.nextCalled === true);
+  check("requireContentType: allowed request writes no refusal", cap.status === null);
+}
+
+function testCharsetParameterIgnored() {
+  var mw = b.middleware.requireContentType(["application/json"]);
+  var cap = _drive(mw, "POST", "application/json; charset=utf-8");
+  check("requireContentType: charset parameter ignored on the bare type",
+    cap.nextCalled === true);
+}
+
+function testWrongTypeRefused() {
+  var mw = b.middleware.requireContentType(["application/json"]);
+  var cap = _drive(mw, "POST", "application/x-www-form-urlencoded");
+  check("requireContentType: off-allowlist type refused with 415", cap.status === 415);
+  check("requireContentType: refusal does not delegate", cap.nextCalled === false);
+  check("requireContentType: 415 advertises the accepted types via Accept",
+    cap.headers["accept"] === "application/json");
+}
+
+function testAbsentTypeRefused() {
+  var mw = b.middleware.requireContentType(["application/json"]);
+  var cap = _drive(mw, "PUT", null);
+  check("requireContentType: absent Content-Type on a body verb refused with 415",
+    cap.status === 415 && cap.nextCalled === false);
+}
+
+function testIdempotentVerbsBypass() {
+  var mw = b.middleware.requireContentType(["application/json"]);
+  var get = _drive(mw, "GET", null);
+  check("requireContentType: GET bypasses the check", get.nextCalled === true);
+  var del = _drive(mw, "DELETE", "text/plain");
+  check("requireContentType: DELETE bypasses by default (no body verb)",
+    del.nextCalled === true);
+}
+
+function testMethodsOverride() {
+  // Operators enforcing content-type on a rare DELETE-with-body shape.
+  var mw = b.middleware.requireContentType(["application/json"], { methods: ["DELETE"] });
+  var refused = _drive(mw, "DELETE", "text/plain");
+  check("requireContentType: methods override enforces on DELETE", refused.status === 415);
+  var passed = _drive(mw, "POST", "text/plain");
+  check("requireContentType: methods override removes the default POST enforcement",
+    passed.nextCalled === true);
+}
+
+function testOnDenyHookOwnsRefusal() {
+  var seen = null;
+  var mw = b.middleware.requireContentType(["application/json"], {
+    onDeny: function (req, res, info) {
+      seen = info;
+      res.writeHead(400, { "Content-Type": "text/plain" });
+      res.end("bad-type");
+    },
+  });
+  var cap = _drive(mw, "POST", "text/xml");
+  check("requireContentType: onDeny hook owns the refusal",
+    cap.status === 400 && cap.body === "bad-type");
+  check("requireContentType: onDeny info carries the offending + accepted types",
+    seen && seen.contentType === "text/xml" && seen.accepted.indexOf("application/json") !== -1);
+}
+
+function testCreateValidationThrows() {
+  function code(fn) {
+    try { fn(); return null; } catch (e) { return e.code || e.message; }
+  }
+  check("requireContentType: empty allowlist throws",
+    /no-allowlist/.test(code(function () { b.middleware.requireContentType([]); })));
+  check("requireContentType: non-array allowlist throws",
+    /no-allowlist/.test(code(function () { b.middleware.requireContentType("application/json"); })));
+  check("requireContentType: non-string entry throws",
+    /no-allowlist/.test(code(function () { b.middleware.requireContentType([42]); })));
+}
+
+function run() {
+  testAllowedTypePasses();
+  testCharsetParameterIgnored();
+  testWrongTypeRefused();
+  testAbsentTypeRefused();
+  testIdempotentVerbsBypass();
+  testMethodsOverride();
+  testOnDenyHookOwnsRefusal();
+  testCreateValidationThrows();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  Promise.resolve().then(run).then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/{middleware-tus-upload-coverage.test.js → middleware-tus-upload.test.js}

@@ -273,6 +273,20 @@ async function run() {
   check("HEAD: deferred upload advertises Upload-Defer-Length:1",
     defHead.status === 200 && defHead.headers["upload-defer-length"] === "1");
 
+  // creation-with-upload: the RFC 7231 media type is case-insensitive and may
+  // carry parameters. An exact-string compare skipped the append path for a
+  // compliant `Application/Offset+Octet-Stream` (or `...; charset` variant),
+  // creating the upload but silently ignoring the body. Both variants must
+  // append in the same request (Upload-Offset advances to the body length).
+  var cwUpper = await _drive(tus, _sreq("POST", "/uploads",
+    { "tus-resumable": VER, "upload-length": "5", "content-type": "Application/Offset+Octet-Stream" }, "hello"));
+  check("POST creation-with-upload: mixed-case Content-Type appends the body",
+    cwUpper.status === 201 && cwUpper.headers["upload-offset"] === "5");
+  var cwParam = await _drive(tus, _sreq("POST", "/uploads",
+    { "tus-resumable": VER, "upload-length": "5", "content-type": "application/offset+octet-stream; charset=binary" }, "world"));
+  check("POST creation-with-upload: Content-Type with a parameter appends the body",
+    cwParam.status === 201 && cwParam.headers["upload-offset"] === "5");
+
   // ---------------------------------------------------------------
   // F. HEAD refusals
   // ---------------------------------------------------------------
@@ -390,6 +404,37 @@ async function run() {
   var postRes = await _drive(tus, _req("POST", "/uploads/abcdef", { "tus-resumable": VER }));
   check("405: POST on resource → Allow includes DELETE",
     postRes.status === 405 && /DELETE/.test(postRes.headers.allow));
+
+  // ---------------------------------------------------------------
+  // J. tusUpload.close — graceful-shutdown resource release
+  // ---------------------------------------------------------------
+  // The close helper is a public primitive (advertised in the
+  // @primitive block) that operators call on shutdown; it must be
+  // reachable on the b.middleware.tusUpload surface, invoke a wired
+  // `.close` hook, and tolerate values that don't expose one.
+  check("tusUpload.close: exposed on the b.middleware.tusUpload surface",
+    typeof b.middleware.tusUpload.close === "function");
+
+  var hookCalls = 0;
+  b.middleware.tusUpload.close({ close: function () { hookCalls += 1; } });
+  check("tusUpload.close: invokes a wired close hook once", hookCalls === 1);
+
+  // A real middleware instance (no `.close` method today) — the helper
+  // is a tolerant no-op, not a throw.
+  var closableTus = _mkTus();
+  var threwOnRealMw = false;
+  try { b.middleware.tusUpload.close(closableTus); } catch (_e) { threwOnRealMw = true; }
+  check("tusUpload.close: tolerant no-op on a middleware without a close hook",
+    threwOnRealMw === false);
+
+  var threwOnNullish = false;
+  try {
+    b.middleware.tusUpload.close(null);
+    b.middleware.tusUpload.close(undefined);
+    b.middleware.tusUpload.close(function () {});
+  } catch (_e) { threwOnNullish = true; }
+  check("tusUpload.close: tolerant of null / undefined / bare function",
+    threwOnNullish === false);
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/middleware-web-app-manifest.test.js

@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.middleware.webAppManifest — W3C Web App Manifest server.
+ *
+ * Drives the served-path, the optional /manifest.json alias, the
+ * method gate, and the create-time validation of the W3C-required
+ * fields (name / start_url / icons) plus the field allowlist.
+ *
+ * Run standalone: `node test/layer-0-primitives/middleware-web-app-manifest.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers   = require("../helpers");
+var b         = helpers.b;
+var check     = helpers.check;
+var _mockReq  = helpers._mockReq;
+var _mockRes  = helpers._mockRes;
+
+var BASE = {
+  name:      "Example App",
+  start_url: "/",
+  display:   "standalone",
+  icons: [
+    { src: "/icons/192.png", sizes: "192x192", type: "image/png" },
+    { src: "/icons/512.png", sizes: "512x512", type: "image/png" },
+  ],
+};
+
+function _drive(mw, method, url) {
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(_mockReq({ method: method, url: url }), res, function () { nextCalled = true; });
+  var cap = res._captured();
+  cap.nextCalled = nextCalled;
+  return cap;
+}
+
+function testServesWebmanifest() {
+  var mw = b.middleware.webAppManifest(BASE);
+  var cap = _drive(mw, "GET", "/manifest.webmanifest");
+  check("webAppManifest: served with HTTP 200", cap.status === 200);
+  check("webAppManifest: Content-Type is application/manifest+json",
+    cap.headers["content-type"] === "application/manifest+json");
+  check("webAppManifest: nosniff header present",
+    cap.headers["x-content-type-options"] === "nosniff");
+  var parsed = JSON.parse(cap.body);
+  check("webAppManifest: body carries the manifest fields",
+    parsed.name === "Example App" && parsed.start_url === "/" && parsed.icons.length === 2);
+  check("webAppManifest: internal opts (audit) are not leaked into the body",
+    parsed.audit === undefined && parsed.alsoAtJsonPath === undefined);
+}
+
+function testJsonAliasOptIn() {
+  var without = b.middleware.webAppManifest(BASE);
+  var capOff = _drive(without, "GET", "/manifest.json");
+  check("webAppManifest: /manifest.json NOT served by default", capOff.nextCalled === true);
+
+  var withAlias = b.middleware.webAppManifest(Object.assign({ alsoAtJsonPath: true }, BASE));
+  var capOn = _drive(withAlias, "GET", "/manifest.json");
+  check("webAppManifest: /manifest.json served when alsoAtJsonPath:true", capOn.status === 200);
+  // The canonical path still serves regardless.
+  var capCanonical = _drive(withAlias, "GET", "/manifest.webmanifest");
+  check("webAppManifest: canonical path still served alongside the alias",
+    capCanonical.status === 200);
+}
+
+function testNonMatchingPathPassesThrough() {
+  var mw = b.middleware.webAppManifest(BASE);
+  var cap = _drive(mw, "GET", "/index.html");
+  check("webAppManifest: unrelated path delegates via next()", cap.nextCalled === true);
+}
+
+function testHeadServesNoBody() {
+  var mw = b.middleware.webAppManifest(BASE);
+  var cap = _drive(mw, "HEAD", "/manifest.webmanifest");
+  check("webAppManifest: HEAD returns 200 with no body",
+    cap.status === 200 && cap.body === "");
+}
+
+function testMethodGate() {
+  var mw = b.middleware.webAppManifest(BASE);
+  var cap = _drive(mw, "POST", "/manifest.webmanifest");
+  check("webAppManifest: POST refused with 405", cap.status === 405);
+  check("webAppManifest: 405 advertises Allow: GET, HEAD",
+    cap.headers["allow"] === "GET, HEAD");
+}
+
+function testCreateValidationThrows() {
+  function code(fn) {
+    try { fn(); return null; } catch (e) { return e.code || e.message; }
+  }
+  check("webAppManifest: missing name throws",
+    /no-name/.test(code(function () {
+      b.middleware.webAppManifest({ start_url: "/", icons: BASE.icons });
+    })));
+  check("webAppManifest: missing start_url throws",
+    /no-start-url/.test(code(function () {
+      b.middleware.webAppManifest({ name: "X", icons: BASE.icons });
+    })));
+  check("webAppManifest: missing icons throws",
+    /no-icons/.test(code(function () {
+      b.middleware.webAppManifest({ name: "X", start_url: "/" });
+    })));
+  check("webAppManifest: empty icons array throws",
+    /no-icons/.test(code(function () {
+      b.middleware.webAppManifest({ name: "X", start_url: "/", icons: [] });
+    })));
+  check("webAppManifest: field outside the W3C allowlist throws (typo surfacing)",
+    code(function () {
+      b.middleware.webAppManifest(Object.assign({ nam: "typo" }, BASE));
+    }) !== null);
+}
+
+function run() {
+  testServesWebmanifest();
+  testJsonAliasOptIn();
+  testNonMatchingPathPassesThrough();
+  testHeadServesNoBody();
+  testMethodGate();
+  testCreateValidationThrows();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  Promise.resolve().then(run).then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/mtls-ca-crl-fingerprint-only.test.js

@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.mtlsCa.generateCrl must tolerate a registry that holds fingerprint-only
+ * revocations.
+ *
+ * revoke({ fingerprint }) is a first-class revocation mode — it is the value
+ * the require-mtls gate pins on, and generateClientCert surfaces a fingerprint
+ * for exactly this use. Such an entry carries no certificate serial number. A
+ * standard X.509 CRL (RFC 5280 §5.1) is keyed by serial, so a fingerprint-only
+ * entry cannot be represented in the CRL and must be projected out.
+ *
+ * Before the fix, generateCrl handed the null serial straight to the CRL
+ * encoder, which threw ("Cannot read properties of null"). That broke CRL
+ * generation for the WHOLE registry — including the serial-keyed certs that
+ * CAN be published — so a single (correct) fingerprint-based revocation stalled
+ * the entire published-revocation path: a fail-open for every OTHER revoked
+ * cert whose serial should have appeared in a fresh CRL.
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+var fs   = require("fs");
+var os   = require("os");
+var path = require("path");
+var pki  = require("../../lib/vendor/pki.cjs");
+
+function _normHex(s) { return String(s || "").replace(/^0x/i, "").replace(/[:\-\s]/g, "").toLowerCase(); }
+
+function _crlSerials(crlPem) {
+  var crl = new pki.x509.X509Crl(crlPem);
+  return (crl.entries || []).map(function (e) { return _normHex(e.serialNumber); });
+}
+
+async function run() {
+  // ---- Scenario 1: a serial-revoked cert AND a fingerprint-only revocation
+  // coexist. The CRL must still publish the serial-revoked cert. ----
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-mtls-crl-fp-"));
+  var ca = b.mtlsCa.create({ dataDir: dir, caKeySealedMode: "disabled", generation: 1 });
+
+  var a = await ca.generateClientCert({ cn: "serial-revoked" });
+  var bCert = await ca.generateClientCert({ cn: "fingerprint-revoked" });
+
+  ca.revoke(a.serialNumber, { reason: "superseded" });                 // serial-keyed
+  ca.revoke({ fingerprint: bCert.fingerprint, reason: "keyCompromise" }); // fingerprint-only (null serial)
+
+  // RED before the fix: this throws inside the CRL encoder on the null serial.
+  var res = await ca.generateCrl();
+
+  check("generateCrl succeeds with a mixed serial + fingerprint-only registry",
+        res && typeof res.crlPem === "string" && res.crlPem.indexOf("BEGIN CRL") !== -1);
+  check("generateCrl entryCount counts only the serial-bearing (CRL-able) revocations",
+        res.entryCount === 1);
+  check("generateCrl surfaces the count of fingerprint-only revocations it could not represent",
+        res.fingerprintOnlyOmitted === 1);
+
+  var serials = _crlSerials(res.crlPem);
+  check("the serial-revoked cert IS published in the CRL (not lost to the null-serial crash)",
+        serials.indexOf(_normHex(a.serialNumber)) !== -1);
+  check("the CRL carries exactly the one serial-keyed entry",
+        serials.length === 1);
+
+  // ---- Scenario 2: a registry with ONLY fingerprint-only revocations still
+  // produces a valid (empty) CRL rather than throwing. ----
+  var dir2 = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-mtls-crl-fponly-"));
+  var ca2 = b.mtlsCa.create({ dataDir: dir2, caKeySealedMode: "disabled" });
+  var c = await ca2.generateClientCert({ cn: "only-fp" });
+  ca2.revoke({ fingerprint: c.fingerprint });
+
+  var res2 = await ca2.generateCrl();
+  check("generateCrl with only fingerprint-only revocations produces a valid CRL",
+        res2 && typeof res2.crlPem === "string" && res2.crlPem.indexOf("BEGIN CRL") !== -1);
+  check("that CRL has zero serial entries", _crlSerials(res2.crlPem).length === 0);
+  check("entryCount is 0 and fingerprintOnlyOmitted is 1",
+        res2.entryCount === 0 && res2.fingerprintOnlyOmitted === 1);
+
+  try {
+    fs.rmSync(dir, { recursive: true, force: true });
+    fs.rmSync(dir2, { recursive: true, force: true });
+  } catch (_e) { /* best-effort */ }
+
+  console.log("OK — mtls-ca CRL fingerprint-only tolerance (" + helpers.getChecks() + " checks)");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.exitCode = 1; throw err; });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/network-dns-resolver.test.js

@@ -258,6 +258,69 @@ async function testServeStaleOnUpstreamFailure() {
   check("serve-stale marks fromCache=true", r2.fromCache === true);
 }
 
+async function testServeStaleDoesNotBypassValidate() {
+  // The `validate: true` gate (RFC 4035 §3.2.3 AD bit) must hold on the
+  // serve-stale path too: a stale entry that was cached AD=0 must be
+  // REFUSED for a validating caller, not returned as a silent success.
+  // Otherwise an attacker who can force an upstream outage downgrades a
+  // DNSSEC-strict lookup (DANE TLSA / DS) to unauthenticated stale data.
+  var callCount = 0;
+  var transport = {
+    lookup: function (name, qtype) {
+      callCount += 1;
+      if (callCount === 1) {
+        return Promise.resolve(_aRecordResponse("example.com", "192.0.2.1", 1, false));  // AD=0
+      }
+      return Promise.reject(new Error("upstream-down"));
+    },
+  };
+  var r = b.network.dns.resolver.create({
+    transport:  transport,
+    minTtlMs:   1,
+    maxTtlMs:   20,
+    serveStale: 60000,
+  });
+  await r.queryA("example.com");                         // warm cache (no validate), AD=0
+  await helpers.passiveObserve(80, "dns-resolver: cache TTL elapsed for stale-validate test");
+
+  var threw = null;
+  var got = null;
+  try { got = await r.queryA("example.com", { validate: true }); }
+  catch (e) { threw = e; }
+  check("stale-serve does not bypass validate (AD=0 refused)",
+    threw && threw.code === "resolver/validate-failed");
+  check("stale-serve never returns an unvalidated response to a validating caller",
+    got === null);
+}
+
+async function testServeStaleValidateAcceptsAdOne() {
+  // Complement: a stale entry that WAS AD=1 stays acceptable to a
+  // validating caller — the gate refuses AD=0, not serve-stale itself.
+  var callCount = 0;
+  var transport = {
+    lookup: function (name, qtype) {
+      callCount += 1;
+      if (callCount === 1) {
+        return Promise.resolve(_aRecordResponse("example.com", "192.0.2.1", 1, true));   // AD=1
+      }
+      return Promise.reject(new Error("upstream-down"));
+    },
+  };
+  var r = b.network.dns.resolver.create({
+    transport:  transport,
+    minTtlMs:   1,
+    maxTtlMs:   20,
+    serveStale: 60000,
+  });
+  await r.queryA("example.com", { validate: true });     // warm cache, AD=1
+  await helpers.passiveObserve(80, "dns-resolver: cache TTL elapsed for stale-validate-ad1 test");
+
+  var got = await r.queryA("example.com", { validate: true });
+  check("stale-serve AD=1 accepted by validating caller", got.rrs[0].decoded === "192.0.2.1");
+  check("stale-serve AD=1 marks stale=true", got.stale === true);
+  check("stale-serve AD=1 keeps validated=true", got.validated === true);
+}
+
 async function testServeStaleDisabled() {
   // With serveStale: false, upstream failure throws even with cache.
   var callCount = 0;
@@ -381,6 +444,8 @@ async function run() {
   await testFollowsCnameChain();
   await testCnameChainCap();
   await testServeStaleOnUpstreamFailure();
+  await testServeStaleDoesNotBypassValidate();
+  await testServeStaleValidateAcceptsAdOne();
   await testServeStaleDisabled();
   await testNxdomainRefused();
   await testBadInput();