@blamejs/core 0.15.42 → 0.15.44

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.44 (2026-06-28) — **`b.fileUpload` now rejects the bare path tokens "." and ".." as upload IDs, closing a path traversal where a ".." id resolved to the staging directory's parent and a cancel or cleanup could recursively delete it.** b.fileUpload validated the uploadId with a character-class regex that permits the dot character, so the bare path tokens "." and ".." passed validation even though they are not ordinary identifiers. The uploadId is joined under the configured staging directory to locate an upload's files, so "." resolved to the staging directory itself and ".." to its parent: an operation keyed on a ".." uploadId acted OUTSIDE the staging directory. The most damaging path is cancelUpload (and finalize/expiry cleanup), which removes the upload directory with a recursive rmSync — keyed on ".." that would recursively delete the staging directory's parent; chunk writes for a ".." id also land outside staging. The validator now rejects "." and ".." before any filesystem operation. Every public method validates the uploadId there, so init, acceptChunk, finalize, status, and cancelUpload are all covered, and legitimate dotted IDs (for example "build.v2") are unaffected. **Security:** *Upload IDs of "." and ".." are refused (path-traversal / parent-directory deletion)* — fileUpload's uploadId regex allows the dot character, so the bare tokens "." and ".." passed validation and, joined under the staging directory, resolved to the staging directory or its parent. An operation keyed on a ".." id acted outside staging — most seriously cancelUpload / cleanup, whose recursive rmSync would have deleted the staging directory's parent, and chunk writes that would land outside staging. The validator now rejects "." and ".." up front; because every public method validates the id, init / acceptChunk / finalize / status / cancelUpload are all covered. Legitimate dotted IDs are unaffected. Operators who never pass caller-controlled upload IDs were not exposed.
+
+- v0.15.43 (2026-06-28) — **`b.auth.lockout`'s failed-attempt counter now accumulates with an atomic compare-and-set, so a brute-force attacker spreading failed logins across multiple nodes can no longer lose increments and stay under the lockout threshold.** b.auth.lockout tracked failed attempts with a cache read-modify-write: read the counter, increment it, write it back. On a multi-node deployment two concurrent failures for the same account on different nodes both read the same value, each added one, and one write clobbered the other — a lost update that let an attacker spreading attempts across nodes exceed maxAttempts without ever triggering the lockout, weakening brute-force protection on a cluster. The counter now runs the whole decision (window decay, increment, lockout-ladder) through the cache's atomic update() (compare-and-set, retried on the cluster backend under contention), so every failure is counted regardless of which node records it. The lockout's documented fail-open posture is preserved — a genuinely unreachable cache still allows the attempt and signals the error — but a cache backend that cannot perform an atomic update now surfaces loud at first use instead of silently disabling the lockout. **Security:** *Lockout failure counter is atomic across nodes (no lost increments)* — b.auth.lockout accumulated failed attempts with a non-atomic cache get -> increment -> set, so concurrent failures for one account across a multi-node deployment lost increments and an attacker could exceed maxAttempts without engaging the lockout. The counter now uses the cache's atomic compare-and-set update(), counting every failure across nodes, with the existing exponential lockout ladder and window-decay logic unchanged. The cache backing a lockout must support atomic update() (b.cache does; the create() check now requires it), and a backend that can't commit an atomic update surfaces loud at first use rather than silently disabling brute-force protection. A genuinely unreachable cache still fails open by design.
+
 - v0.15.42 (2026-06-28) — **The agent orchestrator and tenant registries serialize registration per name, so two concurrent register() calls for the same name can no longer both create a row (duplicate-create / lost registration), and a new b.safeAsync.keyedSerializer exposes that per-key serialization.** b.agent.orchestrator and b.agent.tenant registered a name with a check-then-create: read the backend row for the name, throw a duplicate error if it exists, otherwise write the new row. Because the read and the write are separated by an await, two concurrent register() calls for the same name both observed absence and both wrote — a duplicate-create where the second silently clobbered the first and both callers saw success, violating the one-row-per-name invariant. register() (and unregister()) now run through a per-name in-process serializer, so concurrent calls for the same name apply one at a time and the second is correctly refused as a duplicate; distinct names still run concurrently. The serializer is exposed as b.safeAsync.keyedSerializer() for any read-modify-write or check-then-create that must not interleave per key. It is in-process only: a registry backend shared across processes still needs its own atomic create or unique constraint to refuse a cross-process duplicate. **Added:** *b.safeAsync.keyedSerializer — serialize async work per key* — b.safeAsync.keyedSerializer() returns a { run(key, fn) } that queues fn behind any in-flight or queued work for the same key and runs it once they settle, so a read-modify-write or a check-then-create on a shared store cannot interleave with another call for the same key in the same process. Distinct keys run concurrently, and the per-key chain is dropped once it drains. It is the serialization the agent registries now use, and the same primitive backs the lockout and bot-challenge per-key failure counters. **Fixed:** *Agent orchestrator + tenant registries serialize registration per name (no duplicate-create race)* — b.agent.orchestrator.register and b.agent.tenant.register did a check-then-create (await backend.get -> throw-if-exists -> await backend.set) with an await between the read and the write, so two concurrent registrations of the same name both passed the duplicate check and both wrote — the second silently clobbering the first while both callers saw success. Registration now serializes per name in-process, so concurrent calls for one name apply sequentially and the second is refused with the duplicate error; distinct names are unaffected. A backend shared across processes still needs its own uniqueness constraint to refuse a cross-process duplicate. **Detectors:** *Build guard: a registry check-then-create must serialize per key* — A codebase guard now fails the build if a primitive does an async check-then-create on a pluggable backend (await backend.get -> throw a /duplicate error -> await backend.set) without serializing per key, so the duplicate-create race fixed here cannot reappear at a new registry.
 
 - v0.15.41 (2026-06-28) — **Counters kept on a shared cache — byte quotas and the static server's bandwidth/concurrency caps — now accumulate with an atomic compare-and-set, so concurrent requests can no longer lose each other's charges and slip under the limit.** Several caps maintained a counter on a cache with a non-atomic read-modify-write: read the current value, add to it in memory, write it back. On a cache shared across nodes, two concurrent requests both read the same value, each added only its own contribution, and one write clobbered the other — a lost update that under-counted the cap and let a peer slip under it. b.network.byteQuota (and the b.middleware.dailyByteQuota that composes it) and the static server's per-actor/global bandwidth and per-actor concurrency caps all did this. They now accumulate through the cache's atomic update() (compare-and-set, with retry on the cluster backend under contention), so every concurrent charge is counted. A cache backing these caps must support atomic update(); b.cache provides it, and both primitives refuse a get/set-only cache at construction. The single-node in-memory paths were already safe (they accumulate synchronously). **Fixed:** *Byte quota on a shared cache counts concurrent requests atomically (no lost updates)* — b.network.byteQuota's cache backend accumulated bytes with a get → add → set that is not atomic, so concurrent requests from one peer on a multi-node deployment lost each other's byte charges and the rolling daily byte budget was under-enforced. Accounting now uses the cache's atomic compare-and-set update(), counting every concurrent request, and retries the cluster CAS under a contention burst rather than dropping a charge. A cache wired to a byte quota must support update() — b.cache does; a plain get/set cache is refused at create() (byte-quota/cache-no-atomic-update), and a backend that can't actually commit an atomic update surfaces loud on first use instead of silently disabling the quota. b.middleware.dailyByteQuota, which composes byteQuota, inherits the fix. · *Static server bandwidth + concurrency caps count concurrent requests atomically* — b.staticServe's per-actor and global bandwidth caps and its per-actor concurrency cap kept their counters on the cache with a non-atomic get → add → set, so concurrent downloads from one actor on a multi-replica deployment lost each other's charges and the caps were under-enforced (a bandwidth/concurrency limit bypass). The counters now accumulate through the cache's atomic update() with the same contention retry, and the quota cache is required to support update() at create(). **Detectors:** *Build guard: a cache-backed counter must use atomic update(), not get → set* — A codebase guard now fails the build if a primitive accumulates a counter on a cache with a get → mutate → set read-modify-write instead of the atomic update(), so the lost-update class fixed here cannot reappear at a new cap. Caches used for lookups or cache-aside (the value is replaced wholesale, not incremented), or whose writes are serialized in-process, are allowlisted with the reason they cannot lose an increment.

package/lib/auth/lockout.js

@@ -84,7 +84,6 @@ var numericBounds = require("../numeric-bounds");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
-var safeAsync = require("../safe-async");
 var { LockoutError } = require("../framework-error");
 
 var observability = lazyRequire(function () { return require("../observability"); });
@@ -162,10 +161,11 @@ function create(opts) {
 
   if (!opts.cache || typeof opts.cache !== "object" ||
       typeof opts.cache.get !== "function" ||
-      typeof opts.cache.set !== "function" ||
-      typeof opts.cache.del !== "function") {
+      typeof opts.cache.del !== "function" ||
+      typeof opts.cache.update !== "function") {
     throw _err("BAD_OPT", "auth.lockout.create: opts.cache must be a b.cache " +
-               "instance (or shape with get/set/del). Pass b.cache.create({...}).");
+               "instance (or shape with get/del/update — the failure counter needs " +
+               "an atomic update). Pass b.cache.create({...}).");
   }
   _requireString("namespace", opts.namespace);
 
@@ -233,13 +233,6 @@ function create(opts) {
     }
   }
 
-  async function _writeState(key, state, ttlMs) {
-    try {
-      await cache.set(_scopedKey(key), state, { ttlMs: ttlMs });
-    } catch (_e) {
-      _signalCacheError("set");
-    }
-  }
 
   async function _deleteState(key) {
     try {
@@ -263,108 +256,125 @@ function create(opts) {
 
   // ---- Public surface ----
 
-  // Per-key serialization of the failure counter (read→increment→write on an
-  // async store): concurrent recordFailure calls for the same key would lose
-  // updates, letting parallel failures stay under the lockout threshold. The
-  // keyed serializer applies them sequentially in-process.
-  var _recordSerializer = safeAsync.keyedSerializer();
-  function recordFailure(key, callOpts) {
-    return _recordSerializer.run(key, function () { return _doRecordFailure(key, callOpts); });
-  }
-
-  async function _doRecordFailure(key, callOpts) {
+  // The failure counter is a read-modify-write on a shared cache. A plain
+  // get -> increment -> set is not atomic, so concurrent recordFailure calls
+  // across nodes lose increments and a brute-force attacker spread across nodes
+  // stays under the lockout threshold. cache.update runs the whole decision
+  // under a compare-and-set (with retry on the cluster backend), so every
+  // failure is counted. The mutator is PURE (it may re-run on a CAS retry): it
+  // computes the next state, records the outcome for the post-commit audit /
+  // observability emits below, and captures any error it raises so a
+  // configuration fault surfaces instead of being read as a cache failure.
+  async function recordFailure(key, callOpts) {
     _requireKey(key);
     callOpts = callOpts || {};
     var now = clock();
-    var state = await _readState(key);
+    var outcome = null;
+    var mutatorErr = null;
+    try {
+      await cache.update(_scopedKey(key), function (state) {
+        try {
+          state = state || null;
+          // Currently locked: the lockout itself counts — don't accumulate during
+          // the cooldown. Abort (no write); the verdict comes from the read state.
+          if (state && state.lockedUntil && state.lockedUntil > now) {
+            outcome = { kind: "during-lock", attempts: state.attempts || 0,
+              lockNumber: state.lockNumber || 0, lockedUntil: state.lockedUntil };
+            return { abort: true };
+          }
+          // Window decay: failures older than windowMs reset the counter.
+          // Lock-number persists so an attacker who sleeps off a lockout doesn't
+          // get a fresh ladder rung.
+          if (state && state.lastFailureAt && (now - state.lastFailureAt) > windowMs) {
+            state = { attempts: 0, lockNumber: state.lockNumber || 0,
+              firstFailureAt: null, lastFailureAt: null, lockedUntil: null };
+          }
+          var attempts = (state && state.attempts) || 0;
+          var lockNumber = (state && state.lockNumber) || 0;
+          attempts += 1;
+          var lockedUntil = null, newLock = false;
+          if (attempts >= maxAttempts) {
+            lockNumber += 1;
+            lockedUntil = now + _resolveDuration(lockoutDurations, lockNumber);
+            newLock = true;
+            attempts = 0;  // counter resets — the lockout window IS the punishment
+          }
+          var newState = {
+            attempts:       attempts,
+            lockNumber:     lockNumber,
+            firstFailureAt: (state && state.firstFailureAt) || now,
+            lastFailureAt:  now,
+            lockedUntil:    lockedUntil,
+          };
+          outcome = { kind: "recorded", attempts: attempts, lockNumber: lockNumber,
+            lockedUntil: lockedUntil, newLock: newLock };
+          // Keep the state only as long as it is meaningful: a non-locked counter
+          // expires after the decay window (so check()/attempts() read clean once
+          // it has elapsed), and a lock persists until lockedUntil plus a window
+          // so the lockNumber survives the cooldown — for the operator's actual
+          // configured duration, however long. A DURATION (the cache resolves it
+          // against its own clock) so an injectable lockout clock never desyncs
+          // the cache's expiry.
+          return { value: newState, ttlMs: lockedUntil ? (lockedUntil - now + windowMs) : windowMs };
+        } catch (me) {
+          mutatorErr = me;
+          throw me;
+        }
+      }, { ttlMs: windowMs });
+    } catch (e) {
+      // A configuration fault raised by the mutator (e.g. a lockoutDurations
+      // function returning an invalid value) must surface — not be swallowed as
+      // a backend failure and silently disable the lockout.
+      if (mutatorErr) throw mutatorErr;
+      // A backend that can't actually commit an atomic update (a get/set-only
+      // backend throws UNSUPPORTED at call time) must surface LOUD — failing
+      // open here would silently disable lockout. Any other cache error keeps
+      // the documented fail-OPEN posture (allow the attempt, signal it).
+      if (e && e.code === "UNSUPPORTED") {
+        throw _err("CACHE_NO_ATOMIC_UPDATE",
+          "auth.lockout: the cache backend does not support atomic update() — the " +
+          "failure counter cannot be enforced across nodes on a get/set-only backend; " +
+          "use a cache whose backend implements update (the memory or cluster backend).");
+      }
+      _signalCacheError("update");
+      return { locked: false, attempts: 0 };
+    }
 
-    // If currently locked, the lockout itself counts — don't accumulate
-    // additional attempts during the cooldown. The caller saw locked=true
-    // from check() OR from a prior failure; this branch handles a caller
-    // that calls recordFailure() on a locked account anyway (e.g. they
-    // skipped check()).
-    if (state && state.lockedUntil && state.lockedUntil > now) {
+    if (outcome.kind === "during-lock") {
       _emitObs("auth.lockout.failure_during_lock", { namespace: namespace });
       if (auditFailures) {
         _emitAudit("auth.lockout.failure", key, "denied",
-          { duringLock: true, attempts: state.attempts || 0,
-            lockNumber: state.lockNumber || 0,
-            lockedUntil: state.lockedUntil,
-            reason: callOpts.reason || null },
+          { duringLock: true, attempts: outcome.attempts, lockNumber: outcome.lockNumber,
+            lockedUntil: outcome.lockedUntil, reason: callOpts.reason || null },
           callOpts.req);
       }
-      return {
-        locked:      true,
-        attempts:    state.attempts || 0,
-        lockedUntil: state.lockedUntil,
-      };
+      return { locked: true, attempts: outcome.attempts, lockedUntil: outcome.lockedUntil };
     }
 
-    // Window decay: failures older than windowMs reset the counter.
-    // Lock-number persists across decay windows so an attacker who
-    // sleeps off a lockout doesn't get a fresh ladder rung.
-    if (state && state.lastFailureAt && (now - state.lastFailureAt) > windowMs) {
-      state = {
-        attempts:       0,
-        lockNumber:     state.lockNumber || 0,
-        firstFailureAt: null,
-        lastFailureAt:  null,
-        lockedUntil:    null,
-      };
-    }
-
-    var attempts   = (state && state.attempts) || 0;
-    var lockNumber = (state && state.lockNumber) || 0;
-    attempts += 1;
-
-    var lockedUntil = null;
-    var newLock = false;
-    if (attempts >= maxAttempts) {
-      lockNumber += 1;
-      var dur = _resolveDuration(lockoutDurations, lockNumber);
-      lockedUntil = now + dur;
-      newLock = true;
-      attempts = 0;  // counter resets — the lockout window IS the punishment
-    }
-
-    var newState = {
-      attempts:       attempts,
-      lockNumber:     lockNumber,
-      firstFailureAt: (state && state.firstFailureAt) || now,
-      lastFailureAt:  now,
-      lockedUntil:    lockedUntil,
-    };
-
-    // TTL: keep the state alive long enough that a follower-up failure
-    // after the window/lockout expires still finds the lockNumber. The
-    // longer of (windowMs after last failure) or (lockedUntil + windowMs).
-    var ttlMs = lockedUntil ? (lockedUntil - now + windowMs) : windowMs;
-    await _writeState(key, newState, ttlMs);
-
     _emitObs("auth.lockout.failure", { namespace: namespace });
     if (auditFailures) {
       _emitAudit("auth.lockout.failure", key, "failure",
-        { attempts: newState.attempts, lockNumber: lockNumber,
+        { attempts: outcome.attempts, lockNumber: outcome.lockNumber,
           reason: callOpts.reason || null },
         callOpts.req);
     }
 
-    if (newLock) {
+    if (outcome.newLock) {
       _emitObs("auth.lockout.engaged", {
         namespace:  namespace,
-        lockNumber: String(lockNumber),
+        lockNumber: String(outcome.lockNumber),
       });
       if (auditEngaged) {
         _emitAudit("auth.lockout.engaged", key, "denied",
-          { lockNumber: lockNumber, lockedUntil: lockedUntil,
-            durationMs: lockedUntil - now,
+          { lockNumber: outcome.lockNumber, lockedUntil: outcome.lockedUntil,
+            durationMs: outcome.lockedUntil - now,
             reason: callOpts.reason || null },
           callOpts.req);
       }
-      return { locked: true, attempts: 0, lockedUntil: lockedUntil };
+      return { locked: true, attempts: 0, lockedUntil: outcome.lockedUntil };
     }
 
-    return { locked: false, attempts: attempts };
+    return { locked: false, attempts: outcome.attempts };
   }
 
   async function recordSuccess(key, callOpts) {

package/lib/cache.js

@@ -360,7 +360,8 @@ function _memoryBackend(cfg) {
       if (entry) { _untrack(key, entry); entries.delete(key); }
       return { updated: true, deleted: true };
     }
-    var effExpires = (decision.expiresAt !== undefined) ? decision.expiresAt : expiresAt;
+    var effExpires = (decision.ttlMs !== undefined) ? now + decision.ttlMs
+      : (decision.expiresAt !== undefined ? decision.expiresAt : expiresAt);
     await set(key, decision.value, effExpires, meta);
     return { updated: true, value: decision.value };
   }
@@ -640,7 +641,8 @@ function _clusterBackend(cfg) {
         // The mutator may pin the entry's expiry to the value's own
         // lifetime (e.g. a grant whose expiresAt the mutator just read);
         // otherwise the caller-resolved ttl applies.
-        var effExpires = (decision.expiresAt !== undefined) ? decision.expiresAt : expiresAt;
+        var effExpires = (decision.ttlMs !== undefined) ? now + decision.ttlMs
+          : (decision.expiresAt !== undefined ? decision.expiresAt : expiresAt);
         var storedExpires = (effExpires === Infinity) ? Number.MAX_SAFE_INTEGER : effExpires;
         if (oldRaw === null) {
           // Row was absent/expired — insert, but lose the race if another
@@ -1186,9 +1188,13 @@ function create(opts) {
    *
    * `mutatorFn` returns one of: `{ value }` to commit the new value,
    * `{ abort: data }` to leave the entry untouched and surface `data` to
-   * the caller, or `{ delete: true }` to remove the entry. The call
-   * resolves to `{ updated: true, value }`, `{ updated: true, deleted: true }`,
-   * or `{ aborted: data }`.
+   * the caller, or `{ delete: true }` to remove the entry. A committing
+   * decision may also set the written value's lifetime — `{ value, ttlMs }`
+   * (a duration the backend resolves against its own clock) or
+   * `{ value, expiresAt }` (an absolute time) — when the new value's own
+   * state decides how long it should live; otherwise the call `ttlMs`
+   * applies. The call resolves to `{ updated: true, value }`,
+   * `{ updated: true, deleted: true }`, or `{ aborted: data }`.
    *
    * @opts
    *   ttlMs:  number | Infinity,   // lifetime of the written value; default the instance ttlMs

package/lib/file-upload.js

@@ -245,9 +245,16 @@ var UPLOAD_ID_RE = /^[A-Za-z0-9._-]+$/;
 var UPLOAD_ID_MAX_LENGTH = C.BYTES.bytes(128);
 
 function _validateUploadId(id) {
+  // The char-class allows '.', so the bare path tokens "." and ".." pass the
+  // regex; joined under stagingDir they resolve to the staging dir / its PARENT
+  // (path.join(stagingDir, "..") escapes), and a later rmSync would recurse into
+  // the parent. Reject them before any filesystem op — every public method
+  // validates the id here, so this guards init / acceptChunk / finalize /
+  // status / cancelUpload alike.
   if (typeof id !== "string" ||
       id.length === 0 ||
       id.length > UPLOAD_ID_MAX_LENGTH ||
+      id === "." || id === ".." ||
       !UPLOAD_ID_RE.test(id)) {
     var ID_PREVIEW_CHARS = C.BYTES.bytes(64);
     throw _err("BAD_UPLOAD_ID",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.42",
+  "version": "0.15.44",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:25fff8f4-b758-413d-b63d-fc1b5b5a19ad",
+  "serialNumber": "urn:uuid:bf9b0dcd-010c-4ef3-b922-fb94a9cb440b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-28T09:41:21.905Z",
+    "timestamp": "2026-06-28T12:15:14.692Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.42",
+      "bom-ref": "@blamejs/core@0.15.44",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.42",
+      "version": "0.15.44",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.42",
+      "purl": "pkg:npm/%40blamejs/core@0.15.44",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.42",
+      "ref": "@blamejs/core@0.15.44",
       "dependsOn": []
     }
   ]