@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/gdpr-ropa.test.js

@@ -36,6 +36,36 @@ function run() {
   ropa.update("crm", { retentionPeriod: "5y" });
   check("ropa.update merges patch", ropa.get("crm").retentionPeriod === "5y");
 
+  // update() must validate legalBasis with the SAME rigor as register().
+  // register() rejects a falsy-but-invalid legalBasis (""/0/false/undefined);
+  // update() must too — otherwise a required Article 30 field can be silently
+  // corrupted to a value the VALID_LEGAL_BASES enum would reject. A truthiness
+  // guard (`if (patch.legalBasis && ...)`) skipped validation whenever the
+  // incoming value was falsy, so an empty string sailed through where the enum
+  // check would have caught "made-up".
+  var basisRopa = b.gdpr.ropa.create({
+    audit: false, controller: { name: "Acme", contact: "dpo@acme.example" },
+  });
+  basisRopa.register({ id: "a1", name: "A1", purposes: ["p"], legalBasis: "consent", dataCategories: ["c"] });
+
+  var updEmptyRejected = false;
+  try { basisRopa.update("a1", { legalBasis: "" }); }
+  catch (e) { updEmptyRejected = e.code === "gdpr-ropa/bad-legal-basis"; }
+  check("ropa.update rejects empty-string legalBasis (parity with register)", updEmptyRejected);
+  check("ropa.update leaves legalBasis intact after rejecting empty",
+        basisRopa.get("a1").legalBasis === "consent");
+
+  var updZeroRejected = false;
+  try { basisRopa.update("a1", { legalBasis: 0 }); }
+  catch (e) { updZeroRejected = e.code === "gdpr-ropa/bad-legal-basis"; }
+  check("ropa.update rejects falsy numeric legalBasis", updZeroRejected);
+  check("ropa.update leaves legalBasis intact after rejecting 0",
+        basisRopa.get("a1").legalBasis === "consent");
+
+  // A valid legalBasis update still succeeds (fix must not over-reject).
+  basisRopa.update("a1", { legalBasis: "contract" });
+  check("ropa.update accepts a valid legalBasis change", basisRopa.get("a1").legalBasis === "contract");
+
   ropa.remove("crm", { reason: "deprecated", actor: "dpo" });
   check("ropa.remove deletes",       ropa.list().length === 0);
 

package/lib/vendor/blamejs/test/layer-0-primitives/guard-archive.test.js

@@ -313,6 +313,90 @@ function testGuardArchiveBadProfile() {
         threw && /unknown profile/i.test(threw.message));
 }
 
+// ---- buildProfile — resolve a named profile to its merged caps ----
+// The gate-contract ABI (makeProfileBuilder → buildProfile) reads the
+// base profile name from `baseProfile` OR `extends` (string or array),
+// plus `overrides` / `removes`.
+function testGuardArchiveBuildProfile() {
+  var strict = b.guardArchive.buildProfile({ baseProfile: "strict" });
+  check("buildProfile(strict): maxEntries === 100",       strict.maxEntries === 100);
+  check("buildProfile(strict): symlinkPolicy === reject", strict.symlinkPolicy === "reject");
+  check("buildProfile(strict): maxCompressionRatio === 100",
+        strict.maxCompressionRatio === 100);
+
+  // The documented @example form `{ extends: "strict" }` — a single base
+  // as a bare string — resolves the same caps as baseProfile (buildProfile
+  // normalizes a string `extends` to a one-element list).
+  var strictExt = b.guardArchive.buildProfile({ extends: "strict" });
+  check("buildProfile({extends:'strict'}): maxEntries === 100", strictExt.maxEntries === 100);
+  check("buildProfile({extends:'strict'}): symlinkPolicy === reject",
+        strictExt.symlinkPolicy === "reject");
+  var strictExtArr = b.guardArchive.buildProfile({ extends: ["strict"] });
+  check("buildProfile({extends:['strict']}): array form resolves the same",
+        strictExtArr.maxEntries === 100);
+
+  var perm = b.guardArchive.buildProfile({ baseProfile: "permissive" });
+  check("buildProfile(permissive): maxEntries === 100000", perm.maxEntries === 100000);
+  check("buildProfile(permissive): symlinkPolicy === audit", perm.symlinkPolicy === "audit");
+  check("buildProfile(permissive): maxNestedDepth === 4",  perm.maxNestedDepth === 4);
+
+  // Inline overrides win over the resolved base.
+  var custom = b.guardArchive.buildProfile({
+    baseProfile: "strict",
+    overrides:   { maxEntries: 7 },
+  });
+  check("buildProfile: overrides win (maxEntries)", custom.maxEntries === 7);
+  check("buildProfile: base survives under override (symlinkPolicy)",
+        custom.symlinkPolicy === "reject");
+
+  // Unknown profile name throws.
+  var threw = null;
+  try { b.guardArchive.buildProfile({ baseProfile: "nope" }); }
+  catch (e) { threw = e; }
+  check("buildProfile: unknown baseProfile throws",
+        threw && /unknown profile/i.test(threw.message));
+
+  // An unrecognized key (`profile` — the shape gate() takes, not buildProfile)
+  // resolves no base and yields no caps, rather than silently resolving one.
+  var byProfileKey = b.guardArchive.buildProfile({ profile: "strict" });
+  check("buildProfile: unrecognized `profile` key resolves no caps",
+        byProfileKey.maxEntries === undefined);
+}
+
+// ---- loadRulePack — register an operator rule pack, id-validated ----
+function testGuardArchiveLoadRulePack() {
+  var pack = {
+    id: "kb-2026-archive",
+    extraReservedNames: ["system32"],
+    rules: [{ id: "no-windows-system", severity: "critical",
+              reason: "entry name targets Windows system directory" }],
+  };
+  var returned = b.guardArchive.loadRulePack(pack);
+  check("loadRulePack: returns the pack unchanged", returned === pack);
+  check("loadRulePack: pack.id preserved", returned.id === "kb-2026-archive");
+
+  // Missing pack.id → archive.bad-opt.
+  var noId = null;
+  try { b.guardArchive.loadRulePack({ rules: [] }); }
+  catch (e) { noId = e; }
+  check("loadRulePack: missing id throws archive.bad-opt",
+        noId && noId.code === "archive.bad-opt");
+
+  // Empty-string id is likewise rejected.
+  var emptyId = null;
+  try { b.guardArchive.loadRulePack({ id: "" }); }
+  catch (e) { emptyId = e; }
+  check("loadRulePack: empty id throws archive.bad-opt",
+        emptyId && emptyId.code === "archive.bad-opt");
+
+  // Non-object pack throws a GuardArchiveError (proto-safe requireObject).
+  var notObj = null;
+  try { b.guardArchive.loadRulePack(null); }
+  catch (e) { notObj = e; }
+  check("loadRulePack: null pack throws GuardArchiveError",
+        notObj instanceof b.guardArchive.GuardArchiveError);
+}
+
 async function run() {
   testGuardArchiveSurface();
   testGuardArchiveRegistryParity();
@@ -335,6 +419,8 @@ async function run() {
   testGuardArchiveCleanArchive();
   testGuardArchiveCompliancePosture();
   testGuardArchiveBadProfile();
+  testGuardArchiveBuildProfile();
+  testGuardArchiveLoadRulePack();
   await testGuardArchiveGate();
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/guard-auth.test.js

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+// A well-formed structural JWT (ES256 header, future exp/iat/iss) — passes
+// guardJwt's structural validation. Not a real signature; validate is a
+// pure inspection of shape, not a cryptographic verify.
+var BENIGN_JWT =
+  "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9." +
+  "eyJpc3MiOiJleGFtcGxlIiwiZXhwIjo5OTk5OTk5OTk5LCJpYXQiOjE3MDAwMDAwMDB9.sig";
+
+// alg=none JWT — RFC 7518 §3.6 explicit-no-signature, the canonical
+// bearer-token forgery class guardAuth advertises routing through guardJwt.
+var ALG_NONE_JWT = "eyJhbGciOiJub25lIn0.eyJzdWIiOiJ4In0.";
+
+function expectThrows(label, fn, codeMatch) {
+  var threw = null;
+  try { fn(); } catch (e) { threw = e; }
+  check(label, !!threw && (threw.code || "") === codeMatch);
+  return threw;
+}
+
+function testValidate() {
+  // Benign bundle (bearer token + cookie header) is clean under balanced.
+  var okRv = b.guardAuth.validate(
+    { jwtToken: BENIGN_JWT, cookieHeader: "sid=abc123; theme=dark" },
+    { profile: "balanced" });
+  check("guardAuth.validate benign ok",             okRv.ok === true);
+  check("guardAuth.validate benign no issues",      okRv.issues.length === 0);
+
+  // Hostile: alg=none token routed to guardJwt, tagged source="jwt".
+  var jwtRv = b.guardAuth.validate({ jwtToken: ALG_NONE_JWT }, { profile: "strict" });
+  check("guardAuth.validate alg=none refused",      jwtRv.ok === false);
+  check("guardAuth.validate alg=none source=jwt",
+    jwtRv.issues.some(function (i) { return i.source === "jwt"; }));
+  check("guardAuth.validate alg=none alg-none rule",
+    jwtRv.issues.some(function (i) { return i.ruleId === "jwt.alg-none"; }));
+
+  // Strict requireAtLeastOne — an empty bundle is refused so an operator
+  // can't wire a gate onto a credential-less request.
+  var emptyRv = b.guardAuth.validate({}, { profile: "strict" });
+  check("guardAuth.validate empty strict refused",  emptyRv.ok === false);
+  check("guardAuth.validate empty no-auth-input",
+    emptyRv.issues.some(function (i) { return i.ruleId === "auth.no-auth-input"; }));
+
+  // CL+TE request-header smuggling (RFC 9112 §6.1), source="headers".
+  var smugRv = b.guardAuth.validate(
+    { requestHeaders: { "content-length": "10", "transfer-encoding": "chunked" } },
+    { profile: "strict" });
+  check("guardAuth.validate smuggling refused",     smugRv.ok === false);
+  check("guardAuth.validate smuggling source=headers",
+    smugRv.issues.some(function (i) {
+      return i.source === "headers" && i.ruleId === "auth.header-smuggling-cl-te";
+    }));
+}
+
+function testSanitize() {
+  // Clean bundle passes through unchanged (identity transform), and the
+  // returned bundle re-validates clean.
+  var input = { jwtToken: BENIGN_JWT, cookieHeader: "sid=abc123; theme=dark" };
+  var clean = b.guardAuth.sanitize(input, { profile: "balanced" });
+  check("guardAuth.sanitize benign returns bundle", clean === input);
+  check("guardAuth.sanitize benign revalidates ok",
+    b.guardAuth.validate(clean, { profile: "balanced" }).ok === true);
+
+  // Hostile: a CL+TE smuggling bundle is REFUSED (thrown), never returned —
+  // the auth bundle can't be repaired in transit, so neutralization is
+  // refusal, not a silently-mutated pass-through.
+  var attack = { requestHeaders: { "content-length": "10", "transfer-encoding": "chunked" } };
+  var err = expectThrows("guardAuth.sanitize smuggling throws",
+    function () { b.guardAuth.sanitize(attack, { profile: "strict" }); },
+    "auth.header-smuggling-cl-te");
+  check("guardAuth.sanitize smuggling GuardAuthError",
+    err instanceof b.guardAuth.GuardAuthError);
+
+  // Hostile: alg=none bearer token refuses at sanitize too.
+  expectThrows("guardAuth.sanitize alg=none throws",
+    function () { b.guardAuth.sanitize({ jwtToken: ALG_NONE_JWT }, { profile: "strict" }); },
+    "jwt.alg-none");
+}
+
+async function testGate() {
+  var authGate = b.guardAuth.gate({ profile: "strict" });
+
+  // Hostile alg=none bundle → refuse.
+  var refuse = await authGate.check({ authBundle: { jwtToken: ALG_NONE_JWT } });
+  check("guardAuth.gate alg=none action=refuse",    refuse.action === "refuse");
+  check("guardAuth.gate alg=none ok=false",         refuse.ok === false);
+  check("guardAuth.gate alg=none issue source=jwt",
+    refuse.issues.some(function (i) { return i.source === "jwt"; }));
+
+  // Benign bearer token → serve.
+  var serve = await authGate.check({ authBundle: { jwtToken: BENIGN_JWT } });
+  check("guardAuth.gate benign action=serve",       serve.action === "serve");
+  check("guardAuth.gate benign ok=true",            serve.ok === true);
+
+  // No bundle on ctx → serve (nothing to gate; other middleware owns the
+  // absent-credential decision).
+  var none = await authGate.check({});
+  check("guardAuth.gate no-bundle action=serve",    none.action === "serve");
+}
+
+async function run() {
+  testValidate();
+  testSanitize();
+  await testGate();
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/guard-cidr.test.js

@@ -0,0 +1,151 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function expectThrows(label, fn, codeMatch) {
+  var threw = null;
+  try { fn(); } catch (e) { threw = e; }
+  check(label, !!threw && (threw.code || "") === codeMatch);
+  return threw;
+}
+
+function _kinds(rv) {
+  return rv.issues.map(function (i) { return i.kind; });
+}
+
+function testValidate() {
+  // Benign: a public /24 with zero host bits is clean under strict.
+  var okRv = b.guardCidr.validate("8.8.8.0/24", { profile: "strict" });
+  check("guardCidr.validate benign ok",             okRv.ok === true);
+  check("guardCidr.validate benign no issues",      okRv.issues.length === 0);
+
+  // Hostile: RFC 1918 private range — refused as reserved-range under strict.
+  var reserved = b.guardCidr.validate("10.0.0.0/8", { profile: "strict" });
+  check("guardCidr.validate reserved refused",      reserved.ok === false);
+  check("guardCidr.validate reserved-range kind",
+    _kinds(reserved).indexOf("reserved-range") !== -1);
+
+  // Mask out of range for IPv4 (>32) — mask-cap high.
+  var maskCap = b.guardCidr.validate("8.8.8.0/40", { profile: "strict" });
+  check("guardCidr.validate mask-cap refused",      maskCap.ok === false);
+  check("guardCidr.validate mask-cap kind",
+    _kinds(maskCap).indexOf("mask-cap") !== -1);
+
+  // Not a valid IPv4 dotted-decimal or IPv6 hex-group form — address-shape.
+  var badShape = b.guardCidr.validate("not.an.ip/24", { profile: "strict" });
+  check("guardCidr.validate address-shape refused", badShape.ok === false);
+  check("guardCidr.validate address-shape kind",
+    _kinds(badShape).indexOf("address-shape") !== -1);
+
+  // RFC 4291 §2.2 — a "::" adjacent to a full 8 explicit groups compresses zero
+  // groups and is malformed IPv6 (net.isIP rejects it). The parser must not
+  // admit the non-canonical spelling into CIDR matching as a valid address.
+  ["1:2:3:4:5:6:7:8::/64", "::1:2:3:4:5:6:7:8/64", "1:2:3:4:5:6:7::8/64"]
+    .forEach(function (c) {
+      var zc = b.guardCidr.validate(c, { profile: "strict" });
+      check("guardCidr.validate rejects zero-group '::' " + c, zc.ok === false);
+      check("guardCidr.validate zero-group '::' is address-shape " + c,
+        _kinds(zc).indexOf("address-shape") !== -1);
+    });
+
+  // Host bits set under the mask — network-misaligned (common typo class).
+  var misaligned = b.guardCidr.validate("10.0.0.1/24", { profile: "strict" });
+  check("guardCidr.validate misaligned refused",    misaligned.ok === false);
+  check("guardCidr.validate network-misaligned kind",
+    _kinds(misaligned).indexOf("network-misaligned") !== -1);
+
+  // IPv4-mapped IPv6 — dual-stack allowlist confusion (CVE-2021-22931 class).
+  var mapped = b.guardCidr.validate("::ffff:0:0/96", { profile: "strict" });
+  check("guardCidr.validate ipv4-mapped refused",   mapped.ok === false);
+  check("guardCidr.validate ipv4-mapped-ipv6 kind",
+    _kinds(mapped).indexOf("ipv4-mapped-ipv6") !== -1);
+
+  // Bare IP with no /mask — refused under strict (reject-bare-ip).
+  var bare = b.guardCidr.validate("8.8.8.8", { profile: "strict" });
+  check("guardCidr.validate bare-ip refused",       bare.ok === false);
+  check("guardCidr.validate bare-ip kind",
+    _kinds(bare).indexOf("bare-ip") !== -1);
+}
+
+function testSanitize() {
+  // Benign IPv6 with uppercase hex groups — permissive allows the
+  // documentation range; sanitize lowercases the hex so a case-varying
+  // allowlist key can't slip a duplicate past a case-sensitive matcher.
+  var lowered = b.guardCidr.sanitize("2001:DB8::/32", { profile: "permissive" });
+  check("guardCidr.sanitize lowercases IPv6",       lowered === "2001:db8::/32");
+  check("guardCidr.sanitize output neutralized",    lowered !== "2001:DB8::/32");
+  check("guardCidr.sanitize output revalidates ok",
+    b.guardCidr.validate(lowered, { profile: "permissive" }).ok === true);
+
+  // IPv4 has no canonical casing — returned unchanged when clean.
+  var v4 = b.guardCidr.sanitize("8.8.8.0/24", { profile: "strict" });
+  check("guardCidr.sanitize IPv4 unchanged",        v4 === "8.8.8.0/24");
+
+  // Hostile: reserved private range REFUSED (thrown), never returned — an
+  // allowlist gate must not silently normalize a reserved range into place.
+  var err = expectThrows("guardCidr.sanitize reserved throws",
+    function () { b.guardCidr.sanitize("10.0.0.0/8", { profile: "strict" }); },
+    "cidr.reserved-range");
+  check("guardCidr.sanitize reserved GuardCidrError",
+    err instanceof b.guardCidr.GuardCidrError);
+}
+
+function testIpv6ReservedNibbleMisaligned() {
+  // IPv6 reserved-range membership is a bit-prefix relation, not a hex-nibble
+  // one. ULA fc00::/7 (7 bits) and link-local fe80::/10 (10 bits) do not fall
+  // on a 4-bit nibble boundary, so a hex-string startsWith("fc") / ("fe8")
+  // match silently misses every reserved address whose partial nibble differs
+  // — most importantly fd00::/8, the HALF of fc00::/7 that real deployments
+  // actually assign (RFC 4193 L=1). Under strict, reservedRangesPolicy is
+  // "reject", so a missed reserved range fails OPEN: a private/link-local
+  // range validates as clean and can be added to an allowlist as if public.
+  var strict = { profile: "strict" };
+
+  // fc00::/7 ULA — BOTH halves must be caught. fd00::/8 is the assigned one.
+  ["fc00::/8", "fd00::/8", "fdab:cd12::/32"].forEach(function (c) {
+    var rv = b.guardCidr.validate(c, strict);
+    check("guardCidr ULA " + c + " refused", rv.ok === false);
+    check("guardCidr ULA " + c + " reserved-range kind",
+      _kinds(rv).indexOf("reserved-range") !== -1);
+  });
+
+  // fe80::/10 link-local — the whole /10 must be caught, not just fe8x.
+  ["fe80::/16", "fe90::/16", "fea0::/16", "feb0::/16"].forEach(function (c) {
+    var rv = b.guardCidr.validate(c, strict);
+    check("guardCidr link-local " + c + " refused", rv.ok === false);
+    check("guardCidr link-local " + c + " reserved-range kind",
+      _kinds(rv).indexOf("reserved-range") !== -1);
+  });
+
+  // Regression — the fix must not OVER-match. fec0::/10 (deprecated site-local)
+  // is NOT in the reserved table and shares only the fe8x visual prefix's
+  // sibling nibble; it must stay clean, as must genuine public space.
+  ["fec0::/16", "2606:4700::/32", "2001:4860::/32"].forEach(function (c) {
+    var rv = b.guardCidr.validate(c, strict);
+    check("guardCidr public/site-local " + c + " clean", rv.ok === true);
+  });
+
+  // Regression — nibble-aligned reserved prefixes stay caught.
+  ["ff02::1/128", "2001:db8::/32", "::1/128"].forEach(function (c) {
+    var rv = b.guardCidr.validate(c, strict);
+    check("guardCidr aligned-reserved " + c + " refused", rv.ok === false);
+    check("guardCidr aligned-reserved " + c + " reserved-range kind",
+      _kinds(rv).indexOf("reserved-range") !== -1);
+  });
+}
+
+async function run() {
+  testValidate();
+  testSanitize();
+  testIpv6ReservedNibbleMisaligned();
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}