@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/http-client.js

@@ -55,6 +55,7 @@ var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var ssrfGuard = require("./ssrf-guard");
+var net       = require("node:net");
 var networkProxy = require("./network-proxy");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
@@ -319,6 +320,14 @@ function _connectHttpsWithAlpn(u, ips) {
         _done(_makeH1Transport(u, ips));
         return;
       }
+      // A refused handshake arrives as a bare OpenSSL alert naming neither the
+      // peer nor the posture clause that caused it. Diagnose against the
+      // options this session actually used, not the shared posture.
+      networkTls().annotateOutboundFailure(err, {
+        host:    u.hostname,
+        port:    Number(u.port) || 443,
+        tlsOpts: connectOpts,
+      });
       _fail(err);
     });
   });
@@ -514,17 +523,18 @@ function _makeError(errorClass, code, message, permanent, statusCode) {
   return new Cls(code, message, permanent, statusCode);
 }
 
-// RFC 9110 §15.5 4xx codes that are NOT permanent (request-timeout,
-// too-early, too-many-requests — operator should retry).
-var STATUS_REQUEST_TIMEOUT   = C.BYTES.bytes(408);
-var STATUS_TOO_EARLY         = 425;
-var STATUS_TOO_MANY_REQUESTS = 429;
-
+// The three 4xx codes that are NOT permanent — the request timed out, arrived
+// too early, or arrived too often — so the caller should retry rather than give
+// up. RFC 9110 §15.5.
+//
+// These were local copies, and one of them was laundered through `C.BYTES.bytes`
+// to get a status past a detector that only knew about byte counts. Naming them
+// where they belong removes both the copies and the reason for the disguise.
 function _isPermanentStatus(statusCode) {
-  if (statusCode >= 400 && statusCode < 500) {
-    return statusCode !== STATUS_REQUEST_TIMEOUT &&
-           statusCode !== STATUS_TOO_EARLY &&
-           statusCode !== STATUS_TOO_MANY_REQUESTS;
+  if (C.HTTP.clientError(statusCode)) {
+    return statusCode !== C.HTTP.STATUS.REQUEST_TIMEOUT &&
+           statusCode !== C.HTTP.STATUS.TOO_EARLY &&
+           statusCode !== C.HTTP.STATUS.TOO_MANY_REQUESTS;
   }
   return false;
 }
@@ -599,6 +609,187 @@ function _fromH2Headers(h2Headers) {
   return out;
 }
 
+// hostAllowed — the allowedHosts membership test, extracted so anything
+// enforcing the same pin agrees with `request()` on what an entry means
+// rather than re-deriving suffix and method semantics.
+//
+// Entry forms (each entry is a string OR an object):
+//   "api.partner.com"   exact host match
+//   ".partner.com"      suffix match: "api.partner.com" yes, "evilpartner.com" no
+//   "*.partner.com"     same as ".partner.com" (the DNS-glob shape operators
+//                       expect from firewall configs)
+//   { host: "api.x.com", methods: ["GET","HEAD"] }
+//                       method-restricted; methods omitted = any method
+function hostAllowed(host, allowedHosts, method) {
+  if (!Array.isArray(allowedHosts) || allowedHosts.length === 0) return true;
+  var wanted = String(host || "").toLowerCase();
+  var verb = String(method || "GET").toUpperCase();
+  for (var ai = 0; ai < allowedHosts.length; ai++) {
+    var entry = allowedHosts[ai];
+    var allow, allowedMethods = null;
+    if (typeof entry === "object" && entry !== null) {
+      allow = String(entry.host || "").toLowerCase();
+      if (Array.isArray(entry.methods) && entry.methods.length > 0) {
+        allowedMethods = entry.methods.map(function (m) { return String(m).toUpperCase(); });
+      }
+    } else {
+      allow = String(entry || "").toLowerCase();
+    }
+    if (allow.length === 0) continue;
+    // Normalise "*.x.com" to ".x.com" for the suffix match path.
+    if (allow.charAt(0) === "*" && allow.charAt(1) === ".") allow = allow.slice(1);
+    var matched = false;
+    if (allow.charAt(0) === ".") {
+      if (wanted === allow.slice(1) || wanted.endsWith(allow)) matched = true;
+    } else if (wanted === allow) {
+      matched = true;
+    }
+    if (!matched) continue;
+    if (allowedMethods !== null && allowedMethods.indexOf(verb) === -1) continue;
+    return true;
+  }
+  return false;
+}
+
+// Does the caller's `allowInternal` waive this destination? The option is
+// documented and implemented as `true | CIDR[]`, so reading only the boolean
+// would silently drop the array form the moment a caller supplies their own
+// client — a documented waiver that stops working is as much a defect as a
+// gate that stops gating. Matched with the same cidrContains ssrfGuard uses,
+// so an entry means the same thing on either path. A name has no address to
+// match a CIDR against, so only the blanket form waives one.
+function _internalWaived(host, isLiteral, allowInternal) {
+  if (allowInternal === true) return true;
+  if (!isLiteral || !Array.isArray(allowInternal)) return false;
+  for (var i = 0; i < allowInternal.length; i += 1) {
+    try { if (ssrfGuard.cidrContains(allowInternal[i], host)) return true; }
+    catch (_e) { /* a malformed entry waives nothing */ }
+  }
+  return false;
+}
+
+/**
+ * @primitive  b.httpClient.pinnedClient
+ * @signature  b.httpClient.pinnedClient(client, allowedHosts)
+ * @since      0.18.18
+ * @status     stable
+ * @related    b.httpClient.request, b.ssrfGuard.checkUrl
+ *
+ * Wrap an HTTP client so an <code>allowedHosts</code> pin is ENFORCED rather
+ * than merely advertised, and return the wrapper.
+ *
+ * The contract for a caller-supplied client is a <code>request</code> method
+ * and nothing more, so it need not know what <code>allowedHosts</code> on a
+ * request object means. Passing the pin through as a request field therefore
+ * leaves it advisory: a client that ignores the field fetches a disallowed
+ * host while the operator believes the pin is in force. This wrapper checks
+ * the destination itself — using the same membership test
+ * <code>request()</code> applies, so an entry means the same thing either way
+ * — and refuses before delegating. A destination that cannot be parsed is
+ * refused rather than passed through unchecked.
+ *
+ * Redirects are the pin's blind spot: an allowed host can answer with a
+ * redirect to a disallowed or private one, and a client that follows it
+ * internally would fetch that without ever returning here. The framework's own
+ * client re-checks every hop. The wrapper therefore asks for redirect
+ * following to be OFF on each request it forwards — <code>maxRedirects: 0</code>,
+ * <code>followRedirects: false</code> and <code>redirect: "manual"</code>,
+ * covering the spellings in common use — and a redirect then comes back as an
+ * ordinary 3xx response for the caller to act on. A client that follows
+ * redirects regardless of all three is outside what this can enforce: it must
+ * apply the pin per hop itself, exactly as it must apply anything else its own
+ * transport decides.
+ *
+ * The pin is optional; the redirect control is not. Every caller that hands a
+ * client here validated ONE url — its scheme, its host, or both — so an absent
+ * pin still returns a wrapper, or a 307 from https to http would be free to
+ * resend the credentials that were checked onto the first hop.
+ *
+ * The framework primitives that accept an injected client
+ * (<code>b.auth.oauth.create</code>, <code>b.auth.ciba.client.create</code>,
+ * <code>b.auth.saml.fetchMdq</code>) route it through here.
+ *
+ * @example
+ *   var pinned = b.httpClient.pinnedClient(myClient, ["api.partner.com"]);
+ *   pinned.request({ url: "https://elsewhere.example/x" });
+ *   // → rejects HOST_DISALLOWED; myClient is never called
+ */
+function pinnedClient(client, allowedHosts) {
+  // The pin is optional; the redirect control is not. Every caller that hands
+  // this a client validated ONE url — the scheme, the host, or both — and a
+  // redirect the wrapper never sees is a hop none of that applied to. Returning
+  // the client untouched when no pin was named would leave a 307 from https to
+  // http free to resend the credentials that were checked onto the first hop.
+  var pin = (Array.isArray(allowedHosts) && allowedHosts.length > 0) ? allowedHosts : null;
+  return {
+    request: function (opts) {
+      var target = opts && opts.url;
+      // Through safeUrl so the destination is read the way the rest of the
+      // framework reads one — obfuscated host spellings collapse, credentials
+      // in the URL are refused, and a non-http scheme is refused outright.
+      // Both http schemes are permitted here because this is not the scheme
+      // policy: each caller has its own (b.auth.oauth's allowHttp, and so on)
+      // and applies it before handing the request over.
+      var parsed = null;
+      try { parsed = safeUrl.parse(String(target), { allowedProtocols: safeUrl.ALLOW_HTTP_ALL }); }
+      catch (_e) { parsed = null; }
+      if (parsed === null) {
+        return Promise.reject(_makeError(opts && opts.errorClass, "HOST_DISALLOWED",
+          "destination '" + String(target) + "' is not a usable http(s) URL", true));
+      }
+      if (pin !== null && !hostAllowed(parsed.hostname, pin, opts && opts.method)) {
+        return Promise.reject(_makeError(opts && opts.errorClass, "HOST_DISALLOWED",
+          "host '" + parsed.hostname + "' not in allowedHosts (method=" +
+          String((opts && opts.method) || "GET").toUpperCase() + ")", true));
+      }
+      // Redirect following is turned off on the way through, pin or no pin: a
+      // hop this wrapper never sees is a hop nothing checked. Set on a copy so
+      // a caller's own request object is not mutated.
+      var forwarded = Object.assign({}, opts, {
+        maxRedirects:    0,
+        followRedirects: false,
+        redirect:        "manual",
+      });
+      // The SSRF gate is the last guarantee that came free while b.httpClient
+      // was the only dialer, and a supplied client makes no such promise — a
+      // mangled or attacker-influenced endpoint would otherwise reach the
+      // metadata service straight through it.
+      //
+      // What is enforceable for a transport this does not own is the TEXTUAL
+      // half: a cloud-metadata address is refused unconditionally, and an
+      // IP-literal destination in a private, loopback, link-local or reserved
+      // range is refused unless the caller waived it with `allowInternal`. The
+      // resolve-and-pin half is deliberately not attempted: a name checked
+      // here would be resolved AGAIN by the client, so the rebinding window
+      // belongs to whichever transport actually connects and only that
+      // transport can close it. This is the same reasoning b.httpClient
+      // applies when a proxy resolves on its behalf.
+      try {
+        ssrfGuard.checkUrlTextual(parsed, { errorClass: opts && opts.errorClass });
+        // canonicalizeHost strips the IPv6 brackets and folds an IPv4-mapped
+        // address to its dotted form, so a non-canonical spelling classifies
+        // the same as the plain one.
+        var literal = ssrfGuard.canonicalizeHost(String(parsed.hostname));
+        var isLiteral = net.isIP(literal) !== 0;
+        // A loopback NAME is a loopback destination. Checking only IP literals
+        // let `localhost` — and anything under it, since the whole TLD resolves
+        // there — past a gate that refuses 127.0.0.1, which is the same
+        // destination spelled differently.
+        var internal = isLiteral
+          ? (ssrfGuard.isPrivate(literal) || ssrfGuard.isLoopback(literal) ||
+             ssrfGuard.isLinkLocal(literal) || ssrfGuard.isReserved(literal))
+          : ssrfGuard.isLoopbackHost(literal);
+        if (internal && !_internalWaived(literal, isLiteral, opts && opts.allowInternal)) {
+          return Promise.reject(_makeError(opts && opts.errorClass, "HOST_DISALLOWED",
+            "destination '" + literal + "' is an internal address — pass " +
+            "allowInternal to waive this deliberately", true));
+        }
+      } catch (e) { return Promise.reject(e); }
+      return client.request(forwarded);
+    },
+  };
+}
+
 // ---- request() ----
 
 var REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
@@ -1376,7 +1567,7 @@ function _revalidate(cache, method, opts, entry, requestHeaders) {
 
   return p.then(function (boxed) {
     var res = boxed.res;
-    if (res.statusCode === 304) {                                                            // HTTP 304 Not Modified status code, not bytes
+    if (res.statusCode === C.HTTP.STATUS.NOT_MODIFIED) {                                                            // HTTP 304 Not Modified status code, not bytes
       // Merge 304 headers into the stored entry.
       var refreshed;
       try { refreshed = cache._refreshFrom304(entry, res.headers); }
@@ -1464,8 +1655,8 @@ function _requestWithRedirects(opts, hopsLeft) {
       // → preserve method + body.
       var nextMethod = current.method || "GET";
       var nextBody = current.body;
-      if (res.statusCode === 303 ||
-          ((res.statusCode === 301 || res.statusCode === 302) &&
+      if (res.statusCode === C.HTTP.STATUS.SEE_OTHER ||
+          ((res.statusCode === C.HTTP.STATUS.MOVED_PERMANENTLY || res.statusCode === C.HTTP.STATUS.FOUND) &&
            nextMethod !== "GET" && nextMethod !== "HEAD")) {
         nextMethod = "GET";
         nextBody = undefined;
@@ -1559,32 +1750,7 @@ function _requestSingle(opts) {
   if (Array.isArray(opts.allowedHosts) && opts.allowedHosts.length > 0) {
     var host = u.hostname.toLowerCase();
     var method = (opts.method || "GET").toUpperCase();
-    var ok = false;
-    for (var ai = 0; ai < opts.allowedHosts.length; ai++) {
-      var entry = opts.allowedHosts[ai];
-      var allow, allowedMethods = null;
-      if (typeof entry === "object" && entry !== null) {
-        allow = String(entry.host || "").toLowerCase();
-        if (Array.isArray(entry.methods) && entry.methods.length > 0) {
-          allowedMethods = entry.methods.map(function (m) { return String(m).toUpperCase(); });
-        }
-      } else {
-        allow = String(entry || "").toLowerCase();
-      }
-      if (allow.length === 0) continue;
-      // Normalise "*.x.com" to ".x.com" for the suffix match path.
-      if (allow.charAt(0) === "*" && allow.charAt(1) === ".") allow = allow.slice(1);
-      var matched = false;
-      if (allow.charAt(0) === ".") {
-        if (host === allow.slice(1) || host.endsWith(allow)) matched = true;
-      } else if (host === allow) {
-        matched = true;
-      }
-      if (!matched) continue;
-      if (allowedMethods !== null && allowedMethods.indexOf(method) === -1) continue;
-      ok = true;
-      break;
-    }
+    var ok = hostAllowed(host, opts.allowedHosts, method);
     if (!ok) {
       if (opts.audit && typeof opts.audit.safeEmit === "function") {
         try {
@@ -1865,6 +2031,16 @@ function _requestH1(transport, u, opts) {
     });
 
     req.on("error", function (e) {
+      // The agent carrying this request owns its TLS settings, and it may be
+      // one the caller supplied via opts.agent rather than the framework's.
+      // Naming them explicitly means an agent that pins neither is diagnosed
+      // as pinning neither, instead of being blamed on the shared posture.
+      var agentTls = (reqOpts.agent && reqOpts.agent.options) || {};
+      networkTls().annotateOutboundFailure(e, {
+        host:    reqOpts.hostname,
+        port:    Number(reqOpts.port),
+        tlsOpts: agentTls,
+      });
       if (observer) observer("error", { phase: "request", message: e.message });
       _reject(_makeError(opts.errorClass, e.code || "REQ_ERROR", e.message, false));
     });
@@ -2054,7 +2230,7 @@ function _requestH2(transport, u, opts) {
           durationMs: Date.now() - startedAt,
           bytes:      buf.length,
         });
-        if (statusCode >= 200 && statusCode < 300) {
+        if (C.HTTP.success(statusCode)) {
           _resolve({ statusCode: statusCode, headers: responseHeaders, body: buf });
         } else if (responseMode === "always-resolve") {
           _resolve({ statusCode: statusCode, headers: responseHeaders, body: buf });
@@ -2525,6 +2701,7 @@ function _getCachedTransportKind(url) {
 
 module.exports = {
   request:                    request,
+  pinnedClient:               pinnedClient,
   downloadStream:             downloadStream,
   uploadMultipartStream:      uploadMultipartStream,
   configurePool:              configurePool,

package/lib/vendor/blamejs/lib/mail-bimi.js

@@ -676,7 +676,7 @@ async function fetchAndVerifyMark(opts) {
     throw new MailBimiError("bimi/vmc-fetch-failed",
       "bimi.fetchAndVerifyMark: GET " + url + " failed: " + ((e && e.message) || String(e)));
   }
-  if (rsp.statusCode !== 200) {
+  if (rsp.statusCode !== C.HTTP.STATUS.OK) {
     _emitAudit(opts, "mail.bimi.vmc.fetched", "failure",
       { url: url, domain: opts.domain, status: rsp.statusCode });
     throw new MailBimiError("bimi/vmc-fetch-failed",

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -114,6 +114,7 @@
  *   - CVE-2019-13050 (PGP keyserver flood — not in scope here; out-of-
  *     band fingerprint pinning is the operator's responsibility)
  */
+var C            = require("./constants");
 var lazyRequire  = require("./lazy-require");
 var safeBuffer   = require("./safe-buffer");
 var audit        = lazyRequire(function () { return require("./audit"); });
@@ -1217,7 +1218,7 @@ function wkdFetch(email, opts) {
   var maxBytes = typeof opts.maxKeyBytes === "number" ? opts.maxKeyBytes : (256 * 1024);            // allow:raw-byte-literal — 256 KiB default key cap
   var urls = wkdComputeUrl(email, { advancedHost: opts.advancedHost });
   return Promise.resolve(opts.httpsGet(urls.direct)).then(function (resp) {
-    if (resp && resp.status === 200 && Buffer.isBuffer(resp.body) && resp.body.length > 0) {          // HTTP 200
+    if (resp && resp.status === C.HTTP.STATUS.OK && Buffer.isBuffer(resp.body) && resp.body.length > 0) {          // HTTP 200
       if (safeBuffer.byteLengthOf(resp.body) > maxBytes) {
         throw new MailCryptoError("mail-crypto/pgp/wkd-too-large",
           "wkd.fetch: key bytes " + resp.body.length + " exceed maxKeyBytes=" + maxBytes);
@@ -1225,7 +1226,7 @@ function wkdFetch(email, opts) {
       return { keyBytes: resp.body, source: "direct", url: urls.direct };
     }
     return Promise.resolve(opts.httpsGet(urls.advanced)).then(function (resp2) {
-      if (resp2 && resp2.status === 200 && Buffer.isBuffer(resp2.body) && resp2.body.length > 0) {    // HTTP 200
+      if (resp2 && resp2.status === C.HTTP.STATUS.OK && Buffer.isBuffer(resp2.body) && resp2.body.length > 0) {    // HTTP 200
         if (safeBuffer.byteLengthOf(resp2.body) > maxBytes) {
           throw new MailCryptoError("mail-crypto/pgp/wkd-too-large",
             "wkd.fetch: key bytes " + resp2.body.length + " exceed maxKeyBytes=" + maxBytes);

package/lib/vendor/blamejs/lib/mail-dav.js

@@ -582,7 +582,7 @@ function create(opts) {
         responses.push({
           href: "/caldav/" + principalId + "/",
           propstat: [{
-            status: 200,
+            status: C.HTTP.STATUS.OK,
             propXml: _renderProps({
               displayName: principalId,
               resourcetype: "<D:collection/>",
@@ -593,7 +593,7 @@ function create(opts) {
         var cals = await calStorage.listCalendars(principalId);
         responses.push({
           href: "/caldav/" + principalId + "/",
-          propstat: [{ status: 200,
+          propstat: [{ status: C.HTTP.STATUS.OK,
             propXml: _renderProps({ displayName: principalId,
               resourcetype: "<D:collection/>" }, body.props) }],
         });
@@ -601,7 +601,7 @@ function create(opts) {
           var cal = cals[i];
           responses.push({
             href: "/caldav/" + principalId + "/" + cal.id + "/",
-            propstat: [{ status: 200,
+            propstat: [{ status: C.HTTP.STATUS.OK,
               propXml: _renderProps({
                 displayName:  cal.displayName || cal.id,
                 resourcetype: "<D:collection/><C:calendar/>",
@@ -615,7 +615,7 @@ function create(opts) {
       var components = await calStorage.listComponents(principalId, calendarId, null);
       responses.push({
         href: "/caldav/" + principalId + "/" + calendarId + "/",
-        propstat: [{ status: 200,
+        propstat: [{ status: C.HTTP.STATUS.OK,
           propXml: _renderProps({ displayName: calendarId,
             resourcetype: "<D:collection/><C:calendar/>" }, body.props) }],
       });
@@ -624,7 +624,7 @@ function create(opts) {
           var c = components[j];
           responses.push({
             href: "/caldav/" + principalId + "/" + calendarId + "/" + c.id,
-            propstat: [{ status: 200,
+            propstat: [{ status: C.HTTP.STATUS.OK,
               propXml: _renderProps({
                 displayName:  c.id,
                 resourcetype: "",
@@ -640,11 +640,11 @@ function create(opts) {
       // Single component.
       var comp = await calStorage.getComponent(principalId, calendarId, componentId);
       if (!comp) {
-        responses.push({ href: req.url, status: 404 });
+        responses.push({ href: req.url, status: C.HTTP.STATUS.NOT_FOUND });
       } else {
         responses.push({
           href: req.url,
-          propstat: [{ status: 200,
+          propstat: [{ status: C.HTTP.STATUS.OK,
             propXml: _renderProps({
               displayName:  comp.id,
               etag:         comp.etag,
@@ -673,18 +673,18 @@ function create(opts) {
         var href = report.hrefs[i];
         var hrefParsed = _parsePath(href);
         if (hrefParsed.rejected || hrefParsed.principalId !== principalId) {
-          responses.push({ href: href, status: 403 });
+          responses.push({ href: href, status: C.HTTP.STATUS.FORBIDDEN });
           continue;
         }
         var hrefCalId  = hrefParsed.parts[0];
         var hrefCompId = hrefParsed.parts[1];
         var comp = await calStorage.getComponent(principalId, hrefCalId, hrefCompId);
         if (!comp) {
-          responses.push({ href: href, status: 404 });
+          responses.push({ href: href, status: C.HTTP.STATUS.NOT_FOUND });
         } else {
           responses.push({
             href: href,
-            propstat: [{ status: 200,
+            propstat: [{ status: C.HTTP.STATUS.OK,
               propXml: _renderProps({
                 etag:        comp.etag,
                 contentType: "text/calendar; charset=utf-8",
@@ -700,7 +700,7 @@ function create(opts) {
         var r = rows[j];
         responses.push({
           href: "/caldav/" + principalId + "/" + calendarId + "/" + r.id,
-          propstat: [{ status: 200,
+          propstat: [{ status: C.HTTP.STATUS.OK,
             propXml: _renderProps({
               etag:        r.etag,
               contentType: "text/calendar; charset=utf-8",
@@ -761,7 +761,7 @@ function create(opts) {
       result = await calStorage.putComponent(principalId, calendarId, componentId,
         bodyBuf, { ifMatch: ifMatch, ifNoneMatch: ifNoneMatch });
     } catch (e) {
-      if (e && (e.code === "etag-mismatch" || e.statusCode === 412)) {
+      if (e && (e.code === "etag-mismatch" || e.statusCode === C.HTTP.STATUS.PRECONDITION_FAILED)) {
         return _refuseStatus(res, 412, "ETag precondition failed");
       }
       throw e;
@@ -784,7 +784,7 @@ function create(opts) {
         { ifMatch: ifMatch });
       if (!r || r.notFound) return _refuseStatus(res, 404, "Component not found");
     } catch (e) {
-      if (e && (e.code === "etag-mismatch" || e.statusCode === 412)) {
+      if (e && (e.code === "etag-mismatch" || e.statusCode === C.HTTP.STATUS.PRECONDITION_FAILED)) {
         return _refuseStatus(res, 412, "ETag precondition failed");
       }
       throw e;
@@ -922,7 +922,7 @@ function create(opts) {
       if (depth === "0") {
         responses.push({
           href: "/carddav/" + principalId + "/",
-          propstat: [{ status: 200,
+          propstat: [{ status: C.HTTP.STATUS.OK,
             propXml: _renderProps({ displayName: principalId,
               resourcetype: "<D:collection/>" }, body.props) }],
         });
@@ -930,7 +930,7 @@ function create(opts) {
         var books = await cardStorage.listAddressbooks(principalId);
         responses.push({
           href: "/carddav/" + principalId + "/",
-          propstat: [{ status: 200,
+          propstat: [{ status: C.HTTP.STATUS.OK,
             propXml: _renderProps({ displayName: principalId,
               resourcetype: "<D:collection/>" }, body.props) }],
         });
@@ -938,7 +938,7 @@ function create(opts) {
           var bk = books[i];
           responses.push({
             href: "/carddav/" + principalId + "/" + bk.id + "/",
-            propstat: [{ status: 200,
+            propstat: [{ status: C.HTTP.STATUS.OK,
               propXml: _renderProps({
                 displayName:  bk.displayName || bk.id,
                 resourcetype: "<D:collection/><A:addressbook/>",
@@ -951,7 +951,7 @@ function create(opts) {
       var cards = await cardStorage.listCards(principalId, addressbookId, null);
       responses.push({
         href: "/carddav/" + principalId + "/" + addressbookId + "/",
-        propstat: [{ status: 200,
+        propstat: [{ status: C.HTTP.STATUS.OK,
           propXml: _renderProps({ displayName: addressbookId,
             resourcetype: "<D:collection/><A:addressbook/>" }, body.props) }],
       });
@@ -960,7 +960,7 @@ function create(opts) {
           var card = cards[j];
           responses.push({
             href: "/carddav/" + principalId + "/" + addressbookId + "/" + card.id,
-            propstat: [{ status: 200,
+            propstat: [{ status: C.HTTP.STATUS.OK,
               propXml: _renderProps({
                 displayName:  card.id,
                 etag:         card.etag,
@@ -974,11 +974,11 @@ function create(opts) {
     } else {
       var single = await cardStorage.getCard(principalId, addressbookId, cardId);
       if (!single) {
-        responses.push({ href: req.url, status: 404 });
+        responses.push({ href: req.url, status: C.HTTP.STATUS.NOT_FOUND });
       } else {
         responses.push({
           href: req.url,
-          propstat: [{ status: 200,
+          propstat: [{ status: C.HTTP.STATUS.OK,
             propXml: _renderProps({
               displayName:  single.id,
               etag:         single.etag,
@@ -1008,18 +1008,18 @@ function create(opts) {
         var href = report.hrefs[i];
         var hp = _parsePath(href);
         if (hp.rejected || hp.principalId !== principalId) {
-          responses.push({ href: href, status: 403 });
+          responses.push({ href: href, status: C.HTTP.STATUS.FORBIDDEN });
           continue;
         }
         var hpBookId = hp.parts[0];
         var hpCardId = hp.parts[1];
         var card = await cardStorage.getCard(principalId, hpBookId, hpCardId);
         if (!card) {
-          responses.push({ href: href, status: 404 });
+          responses.push({ href: href, status: C.HTTP.STATUS.NOT_FOUND });
         } else {
           responses.push({
             href: href,
-            propstat: [{ status: 200,
+            propstat: [{ status: C.HTTP.STATUS.OK,
               propXml: _renderProps({
                 etag:        card.etag,
                 contentType: "text/vcard; charset=utf-8",
@@ -1035,7 +1035,7 @@ function create(opts) {
         var r = rows[j];
         responses.push({
           href: "/carddav/" + principalId + "/" + addressbookId + "/" + r.id,
-          propstat: [{ status: 200,
+          propstat: [{ status: C.HTTP.STATUS.OK,
             propXml: _renderProps({
               etag:        r.etag,
               contentType: "text/vcard; charset=utf-8",
@@ -1090,7 +1090,7 @@ function create(opts) {
       result = await cardStorage.putCard(principalId, addressbookId, cardId,
         bodyBuf, { ifMatch: ifMatch, ifNoneMatch: ifNoneMatch });
     } catch (e) {
-      if (e && (e.code === "etag-mismatch" || e.statusCode === 412)) {
+      if (e && (e.code === "etag-mismatch" || e.statusCode === C.HTTP.STATUS.PRECONDITION_FAILED)) {
         return _refuseStatus(res, 412, "ETag precondition failed");
       }
       throw e;
@@ -1112,7 +1112,7 @@ function create(opts) {
         { ifMatch: ifMatch });
       if (!r || r.notFound) return _refuseStatus(res, 404, "Card not found");
     } catch (e) {
-      if (e && (e.code === "etag-mismatch" || e.statusCode === 412)) {
+      if (e && (e.code === "etag-mismatch" || e.statusCode === C.HTTP.STATUS.PRECONDITION_FAILED)) {
         return _refuseStatus(res, 412, "ETag precondition failed");
       }
       throw e;

package/lib/vendor/blamejs/lib/mail-deploy.js

@@ -949,7 +949,7 @@ function tlsRptIngestHttp(opts) {
 
   return function tlsRptHandler(req, res) {
     if (req.method !== "POST") {
-      res.writeHead(405, { "Allow": "POST", "Content-Type": "text/plain" });                          // allow:raw-time-literal — RFC 8460 §5.4 status code
+      res.writeHead(C.HTTP.STATUS.METHOD_NOT_ALLOWED, { "Allow": "POST", "Content-Type": "text/plain" });                          // allow:raw-time-literal — RFC 8460 §5.4 status code
       res.end("RFC 8460 §5.4 requires POST\n");
       return;
     }
@@ -961,7 +961,7 @@ function tlsRptIngestHttp(opts) {
       });
       if (onRefuse) try { onRefuse("mail-tlsrpt/bad-content-type", "unexpected content-type " + ctRoot, req); }
       catch (_e) { /* drop-silent */ }
-      res.writeHead(415, { "Content-Type": "text/plain", "Accept": "application/tlsrpt+json, application/tlsrpt+gzip" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
+      res.writeHead(C.HTTP.STATUS.UNSUPPORTED_MEDIA_TYPE, { "Content-Type": "text/plain", "Accept": "application/tlsrpt+json, application/tlsrpt+gzip" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
       res.end("RFC 8460 §6.4-6.5 media types required\n");
       return;
     }
@@ -978,7 +978,7 @@ function tlsRptIngestHttp(opts) {
           _safeAuditEmit(opts.audit, "mail.tlsrpt.ingest_http", "denied", { reason: "unauthenticated" });
           if (onRefuse) try { onRefuse("mail-tlsrpt/unauthenticated", "authenticate(req) returned falsy", req); }
           catch (_e) { /* drop-silent */ }
-          res.writeHead(401, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/unauthenticated" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
+          res.writeHead(C.HTTP.STATUS.UNAUTHORIZED, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/unauthenticated" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
           res.end("authentication required\n");
           return;
         }
@@ -989,7 +989,7 @@ function tlsRptIngestHttp(opts) {
         });
         if (onRefuse) try { onRefuse("mail-tlsrpt/auth-error", (err && err.message) || String(err), req); }
         catch (_e) { /* drop-silent */ }
-        res.writeHead(500, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/auth-error" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
+        res.writeHead(C.HTTP.STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/auth-error" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
         res.end("authenticate hook threw\n");
       });
       return;
@@ -1015,7 +1015,7 @@ function tlsRptIngestHttp(opts) {
         if (onRefuse) try { onRefuse("mail-tlsrpt/oversize-compressed", "body exceeded " + maxCompressed + " bytes", req); }
         catch (_e) { /* drop-silent */ }
         if (!res.headersSent) {
-          res.writeHead(413, { "Content-Type": "text/plain" });                                       // allow:raw-time-literal — RFC 8460 §5.4 status code
+          res.writeHead(C.HTTP.STATUS.CONTENT_TOO_LARGE, { "Content-Type": "text/plain" });                                       // allow:raw-time-literal — RFC 8460 §5.4 status code
           res.end("RFC 8460 §5.4 — body exceeds " + maxCompressed + " bytes\n");
         }
         void e;   // _e shadowed by lower scope; mark intent
@@ -1051,7 +1051,7 @@ function tlsRptIngestHttp(opts) {
         if (onRefuse) try { onRefuse("mail-tlsrpt/untrusted-reporter",
           "reporter '" + report["organization-name"] + "' not in trustedReporters", req); }
         catch (_e) { /* drop-silent */ }
-        res.writeHead(403, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/untrusted-reporter" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
+        res.writeHead(C.HTTP.STATUS.FORBIDDEN, { "Content-Type": "text/plain", "Error-Type": "mail-tlsrpt/untrusted-reporter" });   // allow:raw-time-literal — RFC 8460 §5.4 status code
         res.end("RFC 8460 §5.3-class: untrusted reporter\n");
         return;
       }
@@ -1072,12 +1072,12 @@ function tlsRptIngestHttp(opts) {
           if (ret && typeof ret.then === "function") {
             ret.then(function () {
               if (!res.headersSent) {
-                res.writeHead(201, { "Content-Type": "text/plain" });                                 // allow:raw-time-literal — RFC 8460 §5.4 status code
+                res.writeHead(C.HTTP.STATUS.CREATED, { "Content-Type": "text/plain" });                                 // allow:raw-time-literal — RFC 8460 §5.4 status code
                 res.end("RFC 8460 §5.4 — accepted\n");
               }
             }, function (_e) {
               if (!res.headersSent) {
-                res.writeHead(500, { "Content-Type": "text/plain" });                                 // internal-error status
+                res.writeHead(C.HTTP.STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });                                 // internal-error status
                 res.end("internal error processing report\n");
               }
             });
@@ -1085,7 +1085,7 @@ function tlsRptIngestHttp(opts) {
           }
         } catch (_e) { /* fall through to 201 — operator hook is best-effort */ }
       }
-      res.writeHead(201, { "Content-Type": "text/plain" });                                           // allow:raw-time-literal — RFC 8460 §5.4 status code
+      res.writeHead(C.HTTP.STATUS.CREATED, { "Content-Type": "text/plain" });                                           // allow:raw-time-literal — RFC 8460 §5.4 status code
       res.end("RFC 8460 §5.4 — accepted\n");
     });
     req.on("error", function () {
@@ -1093,7 +1093,7 @@ function tlsRptIngestHttp(opts) {
       aborted = true;
       _safeAuditEmit(opts.audit, "mail.tlsrpt.ingest_http", "denied", { reason: "req-error" });
       if (!res.headersSent) {
-        res.writeHead(400, { "Content-Type": "text/plain" });                                         // allow:raw-time-literal — RFC 8460 §5.4 status code
+        res.writeHead(C.HTTP.STATUS.BAD_REQUEST, { "Content-Type": "text/plain" });                                         // allow:raw-time-literal — RFC 8460 §5.4 status code
         res.end("malformed request\n");
       }
     });