@blamejs/blamejs-shop 0.5.9 → 0.5.11

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- v0.5.11 (2026-07-03) — **A second customer or product import started while one is already running is refused instead of clobbering the first run's cancel handle.** Fixes a small concurrency defect in the customer and product CSV/row import runners. Each runner tracks a single in-flight run so the operator console's cancel action knows which run to stop. The run opener set that handle after writing the run row, so two runs started at nearly the same moment — an operator double-submitting the form or opening two tabs — could both open, and the second would overwrite the first's in-flight handle. A subsequent cancel would then target the wrong run, leaving the other running. The opener now reserves the single in-flight slot synchronously, before any await, so a second run is refused with a clear "an import is already in progress" error while the first proceeds; the reservation is released if the run fails to open, and the console can start a fresh import as soon as the running one finishes. **Fixed:** *Overlapping import runs no longer clobber the in-flight run handle* — The customer and product import runners keep one in-flight run handle so cancel targets the right run. Because the opener set that handle only after inserting the run row, two imports started concurrently could both open and the second would overwrite the first's handle, so a later cancel stopped the wrong run. The opener now claims the in-flight slot synchronously (before the first await, so the check-and-set can't interleave) and refuses a second concurrent run with an "import already in progress" error; the slot is released if the open fails, and a new import can start once the running one completes.
+
+- v0.5.10 (2026-07-03) — **Redirect rules with a regex source are screened for nested-quantifier catastrophic backtracking before they run on the request path.** Closes the last catastrophic-backtracking (ReDoS) gap in operator-authored redirect rules. A site-redirect of kind "regex" compiles the operator's source into a pattern that resolveForPath runs against the request path on every request. The define-time screen already refused backreferences and lookahead/lookbehind, but not a nested unbounded quantifier — a group whose body carries an unbounded quantifier that is itself repeated by one, such as (a+)+, (a*)*, (?:a+)+ or (.+)+ — so an operator could register a rule whose match time is super-linear in the path length, turning every matching request into a denial of service. The screen now also refuses that shape at define time, at any group depth, while continuing to accept linear patterns that merely use a quantified non-capturing group ((?:/page/[0-9]+)?, (?:section)*) or an optional quantified group. The match is exact — only a nested UNBOUNDED quantifier is refused; a single quantifier, an optional group, and bounded repetition are all allowed — so no well-formed redirect regex that worked before is rejected. **Security:** *Redirect regex sources refuse nested unbounded quantifiers at define time* — A redirect rule of kind "regex" runs its compiled pattern against the request path in resolveForPath. The define-time screen rejected backreferences and lookaround but not a nested unbounded quantifier ((a+)+, (a*)*, (?:a+)+, (.+)+, ((ab)+)+ at any depth) — the canonical ReDoS shape — so an operator could land a rule whose match is super-linear in the path length, letting a crafted request path stall the redirect resolver. The screen now refuses that shape when the rule is defined, with an error pointing the operator at a prefix/exact rule or splitting into multiple rows. Linear patterns are unaffected: a quantified non-capturing group, an optional quantified group, a single quantifier, and bounded repetition are all still accepted, so no redirect regex that worked before is rejected.
+
 - v0.5.9 (2026-07-03) — **A federated sign-in no longer auto-merges into a pre-existing account whose email was never proven, closing an account pre-hijacking path.** Closes an account pre-hijacking weakness in federated (Google / Apple) sign-in. When a verified OIDC sign-in found a pre-existing account with the same email, it linked the federated identity into that account on the strength of the incoming email being verified alone — without requiring the pre-existing account to have ever proven control of that email. Because a passkey (or otherwise passwordless) account is created with whatever email address was typed at registration and no ownership check, an attacker could register an account under a victim's email before the victim's first federated sign-in, and the victim's later Google/Apple sign-in would then be folded into the attacker's account — pulling the victim's guest orders in and leaving the attacker's credential enrolled. The merge now requires the pre-existing account to already carry a verified federated identity (the only account-creation path that proves the email); an account whose email was never proven falls through to the existing duplicate-email refusal, so the customer signs in with their existing method and links the provider from account settings. A first federated sign-in still creates a fresh account, and a second provider still links to an account whose email is already proven, so legitimate multi-provider sign-in is unchanged. **Security:** *Federated sign-in refuses to merge into an unverified pre-existing account* — A verified Google/Apple sign-in that matched a pre-existing account by email hash previously linked the federated identity into that account whenever the incoming identity-provider email was verified — even if the pre-existing account had never proven control of the email. A passkey/passwordless account stores the email typed at registration with no verification, so an attacker could pre-seed an account under a victim's email and capture the victim's later federated sign-in (account pre-hijacking, CWE-287). The merge now proceeds only when the pre-existing account already holds a verified federated identity — the one account-creation path that proves the email. An unverified match is refused with the existing duplicate-email conflict, directing the customer to sign in with their existing method and link the provider from account settings. First-time federated sign-in (new account) and second-provider linking into an already-proven account are unchanged.
 
 - v0.5.8 (2026-07-03) — **Inventory cost-layer consumption and subscription plan-change execution are now correct under concurrent requests; vendored framework refreshed to 0.16.3.** Two ledger-atomicity fixes for concurrent requests, plus a vendored framework security refresh. Cost-layer (COGS) consumption debited each inventory layer with an unguarded read-modify-write against a snapshot, so two overlapping sales or write-offs of the same SKU could both draw from the same layer — driving a layer's remaining quantity negative, stranding a later layer, and understating cost of goods sold. Each layer debit is now an atomic guarded claim (the decrement only applies while the layer still holds the planned quantity); a losing claim reverts its own partial work and re-plans against a fresh snapshot, and the cost attribution rows are written only after every layer in the plan is claimed, so the combined consumption is exact regardless of interleaving. Separately, an immediate subscription plan change wrote its history row as executed before claiming the plan transition, so a double-submitted or retried change that lost the transition claim left a phantom executed row — carrying charge and credit amounts even though no plan moved, no invoice was recorded, and no credit was issued. The losing change now voids that row, so subscription history and any revenue rollup over executed changes reflect only changes that actually happened. The vendored framework is refreshed to 0.16.3, which redacts credential-shaped values in the rendered /metrics exposition (they were masked only in the internal cardinality key), closes a SQL-guard fragment-mode bypass for PostgreSQL dollar-quoted strings, and fails closed on MCP tool input whose JSON Schema omits an explicit object type — all inherited without shop code changes. **Changed:** *Vendored framework refreshed to 0.16.3* — Refreshes the framework the shop builds on from 0.16.2 to 0.16.3, a security and robustness patch across the observability, SQL-guard, MCP, YAML-parser, content-credentials, and resumable-upload primitives. Most consequential: a credential-shaped metric label value was redacted only in the internal cardinality key, not in the rendered exposition, so a raw token on a label leaked to every /metrics scrape — redaction now covers the rendered labels; and the SQL guard's raw-fragment escape hatch now rejects a PostgreSQL dollar-quoted string and a lone statement terminator, closing a bypass of the placeholder-binding floor. The minimum Node.js engine is unchanged at 24.18.0. **Fixed:** *Concurrent cost-layer consumption no longer double-debits a layer* — FIFO, LIFO, and weighted-average COGS consumption planned each layer debit from a snapshot and then applied an unconditional decrement, so two concurrent consumptions of the same SKU could both debit the same front layer — driving its remaining quantity negative and understating COGS while a later layer was left stranded. Each debit is now an atomic guarded claim that only applies while the layer still holds the planned quantity; a losing claim reverts the attempt's earlier claims and re-plans against a re-read of the active layers, within a bounded retry. Cost attribution rows are persisted only after every layer in the plan is claimed, so a mid-plan contention loss leaves no orphaned rows and the summed consumption and attributed cost are exact. · *A lost immediate plan-change claim voids its row instead of leaving a phantom executed change* — An immediate subscription plan change inserted its history row as executed and then claimed the plan transition with a conditional update. A double-submit or retry could have two changes both insert an executed row while only one wins the transition; the loser previously returned leaving a phantom executed change with a charge and credit amount even though no plan moved, no proration invoice was recorded, and no store credit was issued. The losing change now voids its row (cancelled, reason recorded), matching how the same path already handles a failed processor push, so history and any rollup over executed changes count only changes that actually settled.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.5.9",
+  "version": "0.5.11",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/customer-import.js

@@ -182,16 +182,32 @@ function _addError(errors, maxErrors, rowIndex, message) {
 // ---- run-row persistence -----------------------------------------------
 
 async function _openRun(query, state, source, inputByteCount) {
+  // Reserve the single in-flight slot SYNCHRONOUSLY — before the first await —
+  // so two concurrent runs (an operator double-submitting) can't both open. A
+  // second run is refused rather than silently overwriting the first's inflight
+  // handle, which would leave `cancelInflight` targeting the wrong run. The
+  // check + set have no await between them, so the reservation is race-free in
+  // the single-threaded event loop.
+  if (state.inflight) {
+    var busy = new Error("customer-import: an import is already in progress");
+    busy.code = "IMPORT_IN_PROGRESS";
+    throw busy;
+  }
   var runId = b.uuid.v7();
   var startedAt = Date.now();
-  await query(
-    "INSERT INTO customer_imports " +
-    "(id, started_at, completed_at, status, source, input_byte_count, " +
-    " rows_processed, rows_created, rows_updated, rows_skipped, rows_errored, errors_json) " +
-    "VALUES (?1, ?2, NULL, 'running', ?3, ?4, 0, 0, 0, 0, 0, '[]')",
-    [runId, startedAt, source, inputByteCount],
-  );
   state.inflight = { runId: runId, cancelled: false };
+  try {
+    await query(
+      "INSERT INTO customer_imports " +
+      "(id, started_at, completed_at, status, source, input_byte_count, " +
+      " rows_processed, rows_created, rows_updated, rows_skipped, rows_errored, errors_json) " +
+      "VALUES (?1, ?2, NULL, 'running', ?3, ?4, 0, 0, 0, 0, 0, '[]')",
+      [runId, startedAt, source, inputByteCount],
+    );
+  } catch (e) {
+    state.inflight = null;   // release the reservation if the open failed
+    throw e;
+  }
   return { runId: runId, startedAt: startedAt };
 }
 
@@ -205,7 +221,14 @@ async function _closeRun(query, state, runId, status, counters, errors) {
     "SELECT status FROM customer_imports WHERE id = ?1",
     [runId],
   )).rows[0];
-  var finalStatus = (current && current.status === "cancelled") ? "cancelled" : status;
+  // Treat the run as cancelled if EITHER the row already says so OR the
+  // in-memory flag for THIS run is set. The flag path covers a cancel that
+  // landed in the reservation→INSERT window: `cancelInflight` flipped the flag
+  // and ran an UPDATE that matched no row yet (the run row wasn't inserted), so
+  // reading the DB status alone would finalize a cancelled run as complete.
+  var cancelled = (current && current.status === "cancelled") ||
+    !!(state.inflight && state.inflight.runId === runId && state.inflight.cancelled);
+  var finalStatus = cancelled ? "cancelled" : status;
   var errorsJson = b.safeJson.stringify(errors, { canonical: true });
   await query(
     "UPDATE customer_imports SET " +

package/lib/product-import.js

@@ -327,20 +327,35 @@ async function _drive(query, catalog, state, input, driveOpts) {
   // Per-row normalization errors land in the error list at the
   // matching row_index; the row is skipped for catalog writes but
   // still counted in `rows_processed`.
+  // Reserve the single in-flight slot SYNCHRONOUSLY — before the INSERT await —
+  // so two concurrent runs (an operator double-submitting) can't both open. A
+  // second run is refused rather than overwriting the first's inflight id,
+  // which would leave `cancelInflight` targeting the wrong import. The check +
+  // set have no await between them, so the reservation is race-free.
+  if (state.inflightId) {
+    var busy = new Error("product-import: an import is already in progress");
+    busy.code = "IMPORT_IN_PROGRESS";
+    throw busy;
+  }
   var importId = b.uuid.v7();
   var startedAt = Date.now();
   var inputByteCount = driveOpts.inputByteCount == null ? 0 : driveOpts.inputByteCount;
+  state.inflightId = importId;
+  state.cancelFlag = false;
 
   // Run row goes in at `running`. The driver updates the counters +
   // status at the end. The error rows go in as they're encountered
   // — operators tailing `errorsForImport` see progress mid-run.
-  await query(
-    "INSERT INTO product_imports (id, format, on_conflict, started_at, status, input_byte_count) " +
-    "VALUES (?1, ?2, ?3, ?4, 'running', ?5)",
-    [importId, format, onConflict, startedAt, inputByteCount],
-  );
-  state.inflightId = importId;
-  state.cancelFlag = false;
+  try {
+    await query(
+      "INSERT INTO product_imports (id, format, on_conflict, started_at, status, input_byte_count) " +
+      "VALUES (?1, ?2, ?3, ?4, 'running', ?5)",
+      [importId, format, onConflict, startedAt, inputByteCount],
+    );
+  } catch (e) {
+    state.inflightId = null;   // release the reservation if the open failed
+    throw e;
+  }
 
   var counters = {
     rows_processed:   0,

package/lib/referrals.js

@@ -161,6 +161,12 @@ function _alphabetRe(alphabet) {
   // default alphabet has none, but an operator-supplied 32-char set
   // could legally include `]` or `-`.
   var escaped = alphabet.replace(/[\\\]^-]/g, "\\$&");
+  // A single anchored character class (`^[…]+$`) is structurally incapable of
+  // catastrophic backtracking — one unbounded quantifier over a class, no
+  // grouped repetition — so it needs no ReDoS screen. (The framework's
+  // b.guardRegex screen is deliberately not composed here: it accepts this
+  // shape, but its text scan false-positives on `(?:…)?` group forms, so
+  // relying on it is avoided until the upstream fix lands.)
   return new RegExp("^[" + escaped + "]+$");
 }
 

package/lib/site-redirects.js

@@ -298,14 +298,90 @@ function _compileRegex(source) {
   // malformed source — re-shape that into the primitive's TypeError
   // envelope so callers can match on the consistent error shape.
   var anchored = "^(?:" + source + ")$";
+  var compiled;
   try {
-    return new RegExp(anchored);
+    compiled = new RegExp(anchored);
   } catch (e) {
     throw new TypeError(
       "siteRedirects: regex source did not compile — " +
       (e && e.message ? e.message : "invalid pattern")
     );
   }
+  // Extend the backreference / lookaround screen above with the last
+  // catastrophic-backtracking class it doesn't cover: a nested unbounded
+  // quantifier ((a+)+, (a*)*, (?:a+)+, (.+)+ …). This regex runs against the
+  // request path in `resolveForPath`, so a super-linear pattern is a DoS on
+  // every matching request. (The framework's b.guardRegex screen is not used
+  // here because its text scan misreads the `?` in a `(?:…)` group prefix and
+  // a bounded trailing `?` as quantifiers, rejecting linear patterns like
+  // `/blog(?:/page/\d+)?` — filed upstream; this walker allows them.)
+  if (_hasNestedUnboundedQuantifier(source)) {
+    throw new TypeError(
+      "siteRedirects: regex source rejected — nested unbounded quantifier " +
+      "(catastrophic-backtracking / ReDoS) surface; rewrite as `prefix` / " +
+      "`exact`, or split into multiple rows"
+    );
+  }
+  return compiled;
+}
+
+// Detect the nested-unbounded-quantifier ReDoS class: a group whose body
+// contains an unbounded quantifier (`+`, `*`, `{n,}`) and is itself repeated
+// by an unbounded quantifier — `(a+)+`, `(a*)*`, `(?:a+)+`, `(.+)+`,
+// `((ab)+)+` at any depth. A single optional / linearly-repeated group
+// (`(?:foo)?`, `(?:bar)*`, `/products/.+`) is safe and MUST be allowed. The
+// walk mirrors the backreference/lookaround walk: char-by-char, honoring
+// escapes, character classes, and the `(?:` / `(?<name>` group prefixes whose
+// `?` is group syntax, not a quantifier. Lookaround is already refused before
+// this runs, so only `(?:` reaches here.
+function _hasNestedUnboundedQuantifier(source) {
+  var stack = [];            // open groups: { bodyUnbounded: bool }
+  var inClass = false;
+  var i = 0;
+  var n = source.length;
+  function outerUnboundedAt(idx) {
+    var c = source.charAt(idx);
+    if (c === "*" || c === "+") return true;
+    if (c === "{") { return /^\{\d*,\}/.test(source.slice(idx)); }   // {n,} — no upper bound
+    return false;
+  }
+  while (i < n) {
+    var ch = source.charAt(i);
+    if (ch === "\\") { i += 2; continue; }                            // escaped atom
+    if (inClass) { if (ch === "]") { inClass = false; } i += 1; continue; }
+    if (ch === "[") { inClass = true; i += 1; continue; }
+    if (ch === "(") {
+      if (source.charAt(i + 1) === "?") {                             // group prefix — not a quantifier
+        i += 2;
+        if (source.charAt(i) === ":") { i += 1; }
+        else if (source.charAt(i) === "<") { while (i < n && source.charAt(i) !== ">") { i += 1; } if (i < n) { i += 1; } }
+      } else { i += 1; }
+      stack.push({ bodyUnbounded: false });
+      continue;
+    }
+    if (ch === ")") {
+      var g = stack.pop() || { bodyUnbounded: false };
+      var outer = outerUnboundedAt(i + 1);
+      if (g.bodyUnbounded && outer) { return true; }                 // nested unbounded quantifier
+      // A group repeated by an unbounded quantifier is itself an unbounded
+      // atom for its parent.
+      if (outer && stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
+      i += 1;
+      continue;
+    }
+    if (ch === "*" || ch === "+") {
+      if (stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
+      i += 1;
+      continue;
+    }
+    if (ch === "{" && /^\{\d*,\}/.test(source.slice(i))) {
+      if (stack.length) { stack[stack.length - 1].bodyUnbounded = true; }
+      i += 1;
+      continue;
+    }
+    i += 1;
+  }
+  return false;
 }
 
 // ---- row hydration ------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.9",
+  "version": "0.5.11",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {