@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/db-declare-view.js

@@ -297,8 +297,14 @@ function declareView(opts) {
   // resolves the backend at apply time (operator may set spec.backend
   // explicitly OR rely on the migrate runner's default backend).
   var description = "declareView " + spec.schema + "." + spec.name;
-  var qView   = safeSql.quoteQualified([spec.schema, spec.name], "postgres");
-  var qSource = safeSql.quoteQualified([spec.source.schema, spec.source.name], "postgres");
+  // The schema and view names are the operator's, and the column list two
+  // hunks down already quotes reserved words the way `b.db.from()` does. These
+  // were the stricter half of the same statement: a view in a schema named
+  // after a keyword was accepted at the front door and refused here.
+  var qView   = safeSql.quoteQualified([spec.schema, spec.name], "postgres",
+                                       { allowReserved: true });
+  var qSource = safeSql.quoteQualified([spec.source.schema, spec.source.name], "postgres",
+                                       { allowReserved: true });
 
   async function up(xdb, ctx) {
     // Boundary throw: confirm we're on Postgres before any DDL leaves the process.

package/lib/vendor/blamejs/lib/error-page.js

@@ -259,6 +259,13 @@ function _renderDevHtml(info, opts, ctx) {
 
 function _writeResponse(res, status, contentType, body) {
   if (res.writableEnded) return;
+  // Once the status line is on the wire it cannot be replaced, and pretending
+  // otherwise produces the worst of both: writeHead throws
+  // ERR_HTTP_HEADERS_SENT, the catch below falls through to a plain-text end,
+  // and the client receives a 200 whose last bytes are the words "Internal
+  // Server Error" appended to a partial body. failAfterHeaders owns what to do
+  // instead, per protocol and per response shape.
+  if (requestHelpers.failAfterHeaders(res)) return;
   try {
     var headers = { "Content-Type": contentType, "Cache-Control": "no-store" };
     // Prefer writeHead so the status survives under both real Node
@@ -462,8 +469,20 @@ function create(opts) {
           code:   info.code || (info.status >= 500 ? "internal_error" : "error"),
         });
         if (res && res.writableEnded) return;
+        // The same wire truth as the envelope below: a response whose headers
+        // are already sent cannot be given a problem+json body. Left to
+        // itself, respond() would call setHeader, throw ERR_HTTP_HEADERS_SENT,
+        // and the catch would swallow it without ending OR destroying — a
+        // pinned socket and a client that waits forever, which is worse than
+        // the truncation this branch was meant to avoid.
+        if (requestHelpers.failAfterHeaders(res)) return;
         try { problemDetails.respond(res, problem, req); }
-        catch (_e) { /* response already torn down */ }
+        catch (_e) {
+          // It still failed to write: end the response rather than leave the
+          // client hanging on a request nothing will ever answer.
+          try { if (!res.writableEnded && typeof res.end === "function") res.end(); }
+          catch (_e2) { /* socket already gone */ }
+        }
         return;
       }
 

package/lib/vendor/blamejs/lib/external-db.js

@@ -1636,7 +1636,11 @@ function _buildSessionGucsStatements(sessionGucs) {
     // and the dot-quoted rendering.
     var qName;
     try {
-      qName = safeSql.quoteQualified(name, "postgres");
+      // The GUC name is the operator's, so it is quoted rather than refused for
+      // being a keyword — the same rule every other operator-supplied
+      // identifier answers to. The shape is still enforced: a quote, a
+      // semicolon or a null byte in a GUC name fails here as it always did.
+      qName = safeSql.quoteQualified(name, "postgres", { allowReserved: true });
     } catch (e) {
       throw _err("INVALID_SESSION_GUCS",
         "sessionGucs: name '" + name + "' is not a valid identifier: " +

package/lib/vendor/blamejs/lib/flag-evaluation-context.js

@@ -26,6 +26,7 @@ var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
 var bCrypto = lazyRequire(function () { return require("./crypto"); });
+var requestHelpers = lazyRequire(function () { return require("./request-helpers"); });
 
 function _normalize(input, label) {
   if (input == null) return {};
@@ -65,7 +66,9 @@ function merge(base, overlay) {
 
 function fromRequest(req, opts) {
   opts = opts || {};
-  validateOpts(opts, ["userKey", "tenantKey", "extra"], "flag.context.fromRequest");
+  validateOpts(opts, ["userKey", "tenantKey", "extra",
+                      "trustedProxies", "forwardedHeaders", "clientIpResolver"],
+               "flag.context.fromRequest");
   if (!req || typeof req !== "object") {
     return create({});
   }
@@ -98,11 +101,26 @@ function fromRequest(req, opts) {
   } else if (req.user && typeof req.user.id === "string") {
     tk = req.user.id;
   } else {
-    var ip = (typeof headers["x-forwarded-for"] === "string" &&
-              headers["x-forwarded-for"].split(",")[0].trim()) ||
-             (req.connection && req.connection.remoteAddress) || "";
-    var ua = headers["user-agent"] || "";
-    tk = "anon:" + bCrypto().sha3Hash(ip + ":" + ua).slice(0, 16);   // base16 prefix len
+    // The anonymous targeting key decides which bucket an unauthenticated
+    // caller lands in, so whoever controls it controls their own rollout
+    // assignment. Reading X-Forwarded-For directly let any client set it:
+    // resending with a different value moved them to a different bucket until
+    // one served the variant they wanted. Resolution goes through the same
+    // peer-gated helper every other client-address decision uses, so forwarded
+    // headers are honored only from a proxy the operator has declared.
+    var ip = requestHelpers().trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      forwardedHeaders: opts.forwardedHeaders,
+      clientIpResolver: opts.clientIpResolver,
+    }).resolve(req) || "";
+    // Derived from the address alone. The User-Agent was mixed in for spread,
+    // but a client sets it outright, so it gave the caller the same free hand
+    // over their own bucket that the unguarded forwarded header did — and
+    // closing one while leaving the other open closes nothing. The cost is
+    // coarser distribution: anonymous callers sharing an address now share a
+    // bucket, which is the honest resolution when nothing else about them can
+    // be trusted. Identify callers whose spread matters and pass `userKey`.
+    tk = "anon:" + bCrypto().sha3Hash(ip).slice(0, 16);              // base16 prefix len
   }
   ctx.targetingKey = tk;
 

package/lib/vendor/blamejs/lib/flag.js

@@ -43,6 +43,7 @@ var validateOpts   = require("./validate-opts");
 var lazyRequire    = require("./lazy-require");
 var providersMod   = require("./flag-providers");
 var contextMod     = require("./flag-evaluation-context");
+var requestHelpers = lazyRequire(function () { return require("./request-helpers"); });
 var targeting      = require("./flag-targeting");
 var cacheMod       = require("./flag-cache");
 var { defineClass } = require("./framework-error");
@@ -88,6 +89,19 @@ function _validateHooks(rawHooks) {
  * `getDetailsAll`), provider mutation (`addProvider` / `removeProvider`),
  * and `middleware({ userKey })` for per-request binding.
  *
+ * A request with no identified user gets an anonymous targeting key derived
+ * from its client address ALONE. That key decides which bucket the caller
+ * lands in, so it is built only from what the caller cannot choose: the
+ * User-Agent does not contribute, and the address is resolved peer-gated —
+ * forwarded headers are ignored unless `middleware` is given `trustedProxies`
+ * (CIDRs of your reverse proxies), optionally with `forwardedHeaders` when the
+ * address arrives as something other than `X-Forwarded-For`, or
+ * `clientIpResolver` to own resolution outright.
+ *
+ * Anonymous callers sharing an address therefore share a bucket. Behind a NAT,
+ * or behind a proxy with no `trustedProxies` configured, that can be all of
+ * them — pass `userKey` for callers whose distribution has to be per-user.
+ *
  * Throws `FlagError` at config time on a missing provider, hooks not
  * shaped as `{ before?, after?, error?, finally? }` functions, or a
  * provider lacking `.evaluate(flagKey, ctx)`.
@@ -317,11 +331,23 @@ function create(opts) {
     },
     middleware: function (mwOpts) {
       mwOpts = mwOpts || {};
-      validateOpts(mwOpts, ["userKey"], "flag.middleware");
+      validateOpts(mwOpts, ["userKey", "trustedProxies", "forwardedHeaders", "clientIpResolver"],
+                   "flag.middleware");
+      // One peer-gated resolver built here rather than per request: a
+      // malformed CIDR then fails at boot instead of on the first request,
+      // and the list is validated once. Without any trust configured this
+      // reads the socket address and ignores forwarded headers, so an
+      // anonymous caller cannot pick their own rollout bucket.
+      var trustedIp = requestHelpers().trustedClientIp({
+        trustedProxies:   mwOpts.trustedProxies,
+        forwardedHeaders: mwOpts.forwardedHeaders,
+        clientIpResolver: mwOpts.clientIpResolver,
+      });
       var self = this;
       return function flagMiddleware(req, res, next) {
         var reqCtx = contextMod.fromRequest(req, {
-          userKey: mwOpts.userKey,
+          userKey:          mwOpts.userKey,
+          clientIpResolver: trustedIp.resolve,
         });
         req.flag = {
           getBoolean: function (k, def)         { return self.getBoolean(k, reqCtx, def); },

package/lib/vendor/blamejs/lib/framework-schema.js

@@ -357,13 +357,22 @@ function _qd(dialect) {
 
 function _buildCreate(name, dialect, columns) {
   var qd = _qd(dialect);
+  // Quoted the way `b.db.from()` quotes: a name in identifier POSITION is safe
+  // once quoted, keyword or not, so a column called `order` is a name rather
+  // than a refusal. These names are the framework's own literals and none of
+  // them is a keyword today — the point is that every identifier the framework
+  // quotes answers to one rule, so a path cannot end up stricter than the query
+  // builder without anybody noticing. `allowReserved` still enforces the SHAPE
+  // of an identifier: a quote, a semicolon or a null byte is refused either way.
   var parts = columns.map(function (c) {
     if (c.raw) return "  " + c.raw;
     if (c.pk) {
       return "  PRIMARY KEY (" +
-        c.pk.map(function (k) { return safeSql.quoteIdentifier(k, qd); }).join(", ") + ")";
+        c.pk.map(function (k) {
+          return safeSql.quoteIdentifier(k, qd, { allowReserved: true });
+        }).join(", ") + ")";
     }
-    return "  " + safeSql.quoteIdentifier(c.col, qd) + " " + c.def;
+    return "  " + safeSql.quoteIdentifier(c.col, qd, { allowReserved: true }) + " " + c.def;
   });
   return "CREATE TABLE IF NOT EXISTS " + name + " (" + parts.join(",") + ")";
 }
@@ -398,7 +407,9 @@ function _buildIndexes(name, dialect, indexes) {
   return (indexes || []).map(function (ix) {
     var idxName = _capIndexName("idx_" + name + "_" + ix.suffix);
     return (ix.unique ? createUnique : createIndex) + idxName + " ON " + name +
-      " (" + ix.cols.map(function (col) { return safeSql.quoteIdentifier(col, qd); }).join(", ") + ")";
+      " (" + ix.cols.map(function (col) {
+        return safeSql.quoteIdentifier(col, qd, { allowReserved: true });
+      }).join(", ") + ")";
   });
 }