@blamejs/core 0.15.12 → 0.15.14

package/lib/vex.js

@@ -475,18 +475,39 @@ function document(opts) {
     throw new VexError("vex/bad-opts",
       "document: opts must be a non-null object");
   }
-  validateOpts.requireNonEmptyString(opts.documentId,  "documentId",  VexError, "vex/missing-documentId");
-  validateOpts.requireNonEmptyString(opts.title,       "title",       VexError, "vex/missing-title");
-  validateOpts.requireNonEmptyString(opts.trackingId,  "trackingId",  VexError, "vex/missing-trackingId");
-  validateOpts.requireNonEmptyString(opts.trackingVersion, "trackingVersion", VexError, "vex/missing-trackingVersion");
-  validateOpts.requireNonEmptyString(opts.currentReleaseDate, "currentReleaseDate", VexError, "vex/missing-currentReleaseDate");
-  validateOpts.requireNonEmptyString(opts.initialReleaseDate, "initialReleaseDate", VexError, "vex/missing-initialReleaseDate");
-  if (!opts.publisher || typeof opts.publisher !== "object") {
-    throw new VexError("vex/missing-publisher",
-      "document: publisher object is required ({ name, namespace })");
-  }
-  validateOpts.requireNonEmptyString(opts.publisher.name,      "publisher.name",      VexError, "vex/missing-publisher-name");
-  validateOpts.requireNonEmptyString(opts.publisher.namespace, "publisher.namespace", VexError, "vex/missing-publisher-namespace");
+  validateOpts.shape(opts, {
+    documentId:         { rule: "required-string", code: "vex/missing-documentId",         label: "documentId" },
+    title:              { rule: "required-string", code: "vex/missing-title",              label: "title" },
+    trackingId:         { rule: "required-string", code: "vex/missing-trackingId",         label: "trackingId" },
+    trackingVersion:    { rule: "required-string", code: "vex/missing-trackingVersion",    label: "trackingVersion" },
+    currentReleaseDate: { rule: "required-string", code: "vex/missing-currentReleaseDate", label: "currentReleaseDate" },
+    initialReleaseDate: { rule: "required-string", code: "vex/missing-initialReleaseDate", label: "initialReleaseDate" },
+    // publisher is required; the missing/sub-field checks own their own
+    // codes (vex/missing-publisher{,-name,-namespace}) the test asserts
+    // on. A truthy non-plain-object (array / string) is rejected with
+    // vex/bad-opts (optional-plain-object semantics) BEFORE the absent
+    // check, then a null/undefined publisher throws vex/missing-publisher,
+    // then name/namespace are required non-empty strings.
+    publisher:          function (v, label, e, c) {
+      validateOpts.optionalPlainObject(v, label, e, c);
+      if (!v || typeof v !== "object") {
+        throw new VexError("vex/missing-publisher",
+          "document: publisher object is required ({ name, namespace })");
+      }
+      validateOpts.requireNonEmptyString(v.name,      "publisher.name",      VexError, "vex/missing-publisher-name");
+      validateOpts.requireNonEmptyString(v.namespace, "publisher.namespace", VexError, "vex/missing-publisher-namespace");
+    },
+    // The body's Array.isArray check throws vex/bad-statements; the shape
+    // only needs to accept the key (an array is not a plain object).
+    statements:         function () {},
+    tlp:                "optional-string",
+    lang:               "optional-string",
+    trackingStatus:     "optional-string",
+    productTreeNames:   "optional-plain-object",
+    distributionText:   { rule: "optional-string", code: "vex/bad-distribution-text", label: "document.distributionText" },
+    // distributor is copied onto distribution as-is when truthy.
+    distributor:        function () {},
+  }, "document", VexError, "vex/bad-opts");
   if (!Array.isArray(opts.statements)) {
     throw new VexError("vex/bad-statements",
       "document: statements must be an array of b.vex.statement objects");
@@ -530,7 +551,8 @@ function document(opts) {
     throw new VexError("vex/bad-product-tree-names",
       "document: productTreeNames must be a { <productId>: <displayName> } object");
   }
-  validateOpts.optionalNonEmptyString(opts.distributionText, "document.distributionText", VexError, "vex/bad-distribution-text");
+  // distributionText is validated by the shape's optional-string rule
+  // above (label "document.distributionText", code vex/bad-distribution-text).
   // FIRST TLP 2.0 + CSAF §3.2.1.12.1.1.1 — distribution.text is
   // REQUIRED when TLP label is RED or AMBER+STRICT (the
   // recipient-restricted tiers carry mandatory boilerplate prose).

package/lib/web-push-vapid.js

@@ -109,22 +109,25 @@ function buildVapidAuthHeader(opts) {
   validateOpts(opts, ["subscription", "contact", "privateKeyPem",
                        "publicKeyB64Url", "ttlSec"],
     "webPush.buildVapidAuthHeader");
-  if (!opts.subscription || typeof opts.subscription.endpoint !== "string") {
-    throw new WebPushError("web-push/bad-subscription",
-      "buildVapidAuthHeader: opts.subscription must include a string endpoint");
-  }
-  validateOpts.requireNonEmptyString(opts.contact, "contact",
-    WebPushError, "web-push/bad-contact");
-  if (!/^(mailto:|https:)/i.test(opts.contact)) {
-    throw new WebPushError("web-push/bad-contact",
-      "buildVapidAuthHeader: contact must start with 'mailto:' or 'https:' per RFC 8292 §2");
-  }
-  validateOpts.requireNonEmptyString(opts.privateKeyPem, "privateKeyPem",
-    WebPushError, "web-push/bad-key");
-  validateOpts.requireNonEmptyString(opts.publicKeyB64Url, "publicKeyB64Url",
-    WebPushError, "web-push/bad-key");
-  validateOpts.optionalPositiveFinite(opts.ttlSec, "webPush.buildVapidAuthHeader: ttlSec",
-    WebPushError, "web-push/bad-ttl");
+  validateOpts.shape(opts, {
+    subscription: function (value) {
+      if (!value || typeof value.endpoint !== "string") {
+        throw new WebPushError("web-push/bad-subscription",
+          "buildVapidAuthHeader: opts.subscription must include a string endpoint");
+      }
+    },
+    contact: function (value) {
+      validateOpts.requireNonEmptyString(value, "contact",
+        WebPushError, "web-push/bad-contact");
+      if (!/^(mailto:|https:)/i.test(value)) {
+        throw new WebPushError("web-push/bad-contact",
+          "buildVapidAuthHeader: contact must start with 'mailto:' or 'https:' per RFC 8292 §2");
+      }
+    },
+    privateKeyPem:   { rule: "required-string",          code: "web-push/bad-key", label: "privateKeyPem" },
+    publicKeyB64Url: { rule: "required-string",          code: "web-push/bad-key", label: "publicKeyB64Url" },
+    ttlSec:          { rule: "optional-positive-finite", code: "web-push/bad-ttl" },
+  }, "webPush.buildVapidAuthHeader", WebPushError, "web-push/bad-opts");
   var ttlSec = opts.ttlSec || C.TIME.hours(12);
   // Audience: origin of the subscription endpoint per RFC 8292 §2.
   var endpointUrl;
@@ -232,10 +235,10 @@ function encrypt(opts) {
     throw new WebPushError("web-push/bad-subscription",
       "encrypt: subscription must have a keys: { p256dh, auth } object");
   }
-  validateOpts.requireNonEmptyString(opts.subscription.keys.p256dh, "p256dh",
-    WebPushError, "web-push/bad-p256dh");
-  validateOpts.requireNonEmptyString(opts.subscription.keys.auth, "auth",
-    WebPushError, "web-push/bad-auth");
+  validateOpts.shape(opts.subscription.keys, {
+    p256dh: { rule: "required-string", code: "web-push/bad-p256dh", label: "p256dh" },
+    auth:   { rule: "required-string", code: "web-push/bad-auth",   label: "auth" },
+  }, "webPush.encrypt.keys", WebPushError, "web-push/bad-opts");
   var plaintext = Buffer.isBuffer(opts.payload) ? opts.payload
                 : typeof opts.payload === "string" ? Buffer.from(opts.payload, "utf8")
                 : null;