@blamejs/core 0.15.60 → 0.15.61

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.61 (2026-06-29) — **The local and Redis job queues fence completion, failure, and lease extension on the lease the caller actually holds, so a worker finishing after its lease expired can no longer disturb a job another worker has since taken over.** On the local and Redis queue backends, complete(), fail(), and extendLease() identified a job only by its id. When a worker's lease expired, the sweep returned the job to the ready set and another worker leased and began running it; if the original worker then finished late, its complete() could mark the new worker's in-progress job done (and double-fire a cron repeat or re-release flow children), and its fail() could re-queue or dead-letter a job the new worker was still executing. Each lease now carries the job's attempts value (incremented once per lease), and complete(), fail(), and extendLease() act only when that value still matches — so a call from a worker that no longer holds the lease changes nothing. The generic consumer threads this automatically; the SQS backend already bound these actions to the message's receipt handle and is unchanged. **Fixed:** *Local and Redis queues bind complete/fail/extendLease to the held lease* — A long-running handler whose lease expired and was swept could have its job re-leased to a second worker; when the first worker finished, complete() marked the second worker's in-progress job done — double-firing a cron-recurring job's next enqueue and re-releasing its flow dependents — while fail() re-queued or dead-lettered the job the second worker was still running (re-executing or discarding in-flight work). The backends now fence each of these calls on the leased attempts value, which is bumped once per lease; only the worker that holds the current lease can complete, fail, or extend it. A stale call returns without mutating the queue. This brings the local and Redis backends to parity with the SQS backend, which already bound these actions to the message receipt handle.
+
 - v0.15.60 (2026-06-29) — **`requireStepUp` binds the elevation grant to the authenticated principal, refusing a grant minted for a different user (cross-user step-up replay).** The b.middleware.requireStepUp gate accepts an operator-issued step-up elevation grant from the X-Step-Up-Grant header and verifies it with b.auth.stepUp.grant.verify. An elevation grant carries the subject it was minted for (payload.sub), but the middleware verified only the grant's signature, expiry, and scope — never that the grant's subject matched the request's authenticated principal. A grant minted for one user (and then leaked through a shared cache, a log line, a referrer, or a shared device) therefore satisfied the step-up requirement for ANY other authenticated user who presented it, elevating their session to the granted assurance level without ever completing a step-up ceremony. requireStepUp now passes the resolved principal as the grant's required subject, so the grant satisfies step-up only for the user it was issued to. The principal is resolved from whichever shape the authenticator populated — a session's req.user.id / req.user.userId, or the JWT subject (req.user.claims.sub / req.user.sub) set by bearerAuth with an external verifier — so a grant legitimately minted for a JWT subject still binds. A request with no resolvable principal cannot bind the grant and falls through to the claims-based challenge. **Security:** *Step-up elevation grants are bound to the authenticated principal* — requireStepUp's grant path called b.auth.stepUp.grant.verify with only the grant scope, not the subject, so any holder of a valid, unexpired, scope-matching elevation grant passed the step-up gate regardless of which user the request was authenticated as — a leaked or shared grant elevated a different user's session (cross-user step-up replay). The grant already binds a subject at mint time and the verifier supports a subject check; the middleware now supplies the request's principal as the required subject, refusing a grant whose subject does not match. The principal is read from whichever field the authenticator set — a session's id/userId or the JWT subject (claims.sub / sub) from bearerAuth's external verifier — so a grant minted for any of those binds correctly. A request with no authenticated principal cannot bind a grant and is handled by the normal claims-based step-up challenge. The grant verifier's signature/expiry/scope/jti-revocation checks are unchanged.
 
 - v0.15.59 (2026-06-29) — **OCSP response validation binds the response to the certificate's issuer (issuerNameHash + issuerKeyHash), not the serial number alone, refusing a wrong-issuer "good".** An OCSP SingleResponse identifies the certificate it covers by a CertID of (hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber) — RFC 6960 §4.1.1. b.network.tls.ocsp.evaluate matched a response to the certificate under validation by the serial number alone and never compared the CertID's issuer hashes. Because a serial number is unique only within one issuer, a responder key that serves more than one issuer identity — a delegated OCSP responder, or a CA key spanning issuers — could have a signed "good" response for serial-S under issuer-Y accepted as proof for the serial-S certificate under issuer-X. The evaluator now recomputes the expected issuerNameHash and issuerKeyHash from the issuer certificate and refuses a response whose CertID issuer hashes do not match. b.network.tls.ocsp.fetch supplies the issuer certificate automatically (its issuerPem is the leaf's issuer); ocsp.requireGood and direct ocsp.evaluate callers pass the issuer cert explicitly as the new issuerCertDer (requireGood's issuerPem may be a delegated OCSP responder rather than the issuer, so it is not used as the issuer), and a response with no issuer certificate available stays bound on serial plus signature as before. **Security:** *OCSP evaluate binds the response CertID to the issuer, not the serial alone (RFC 6960 §4.1.1)* — b.network.tls.ocsp.evaluate selected the matching SingleResponse by normalized serial number only, ignoring the CertID's issuerNameHash and issuerKeyHash. Since serials are unique only per issuer, a "good" response signed by a key that also serves a different issuer (a delegated id-kp-OCSPSigning responder, or a shared CA key) could be replayed as proof for a same-serial certificate under another issuer. evaluate now recomputes the expected issuerNameHash = Hash(issuer DN) and issuerKeyHash = Hash(issuer public key) under the CertID's own hash algorithm and refuses the response if either differs ("wrong-issuer response"). b.network.tls.ocsp.fetch forwards the issuer certificate automatically (its issuerPem is the leaf's issuer); ocsp.requireGood and a direct ocsp.evaluate caller enable the binding by passing issuerCertDer (the issuer cert DER) — requireGood's issuerPem may be a delegated OCSP responder, so the issuer cert is taken explicitly rather than derived from it — and a call without an issuer certificate retains the prior serial-plus-signature binding.

package/lib/queue-local.js

@@ -436,23 +436,27 @@ function create(config) {
   // Handler context exposes this as `ctx.extendLease(ms)`. The job must
   // still be in 'inflight' status (i.e. not yet swept by sweepExpired);
   // otherwise the call no-ops and returns false.
-  async function extendLease(jobId, additionalMs) {
+  async function extendLease(jobId, additionalMs, opts) {
     cluster.requireLeader();
     if (typeof additionalMs !== "number" || additionalMs <= 0) {
       throw _err("INVALID_LEASE_EXTENSION",
         "extendLease: additionalMs must be a positive number", true);
     }
     var newExpiry = Date.now() + additionalMs;
-    var built = _update()
+    var extUpd = _update()
       .set("leaseExpiresAt", newExpiry)
       .where("_id", jobId)
-      .where("status", "inflight")
-      .toSql();
+      .where("status", "inflight");
+    // Lease fencing: only the current lease holder (matching attempts) may
+    // extend. attempts is unchanged by an extend, so a worker can extend
+    // repeatedly (mirrors the redis EXTEND_LUA fence).
+    if (opts && opts.attempt != null) extUpd = extUpd.where("attempts", opts.attempt);
+    var built = extUpd.toSql();
     var result = await store.execute(built.sql, built.params);
     return (result.rowCount || 0) > 0;
   }
 
-  async function complete(jobId) {
+  async function complete(jobId, opts) {
     cluster.requireLeader();
     var nowMs = Date.now();
     // Read the row first so we can act on repeat / flow metadata after
@@ -467,13 +471,20 @@ function create(config) {
     var rowRes = await store.execute(rowBuilt.sql, rowBuilt.params);
     var row = (rowRes && rowRes.rows && rowRes.rows[0]) || null;
 
-    var doneBuilt = _update()
+    // Lease fencing: when the caller supplies the `attempts` value it
+    // leased at, gate the status flip on it. `attempts` is bumped once per
+    // lease, so a stale completer whose lease expired and whose job was
+    // re-leased to another worker (a higher attempts) matches 0 rows and
+    // does not mark the new worker's in-progress job done. Matches the
+    // redis backend's COMPLETE_LUA fence and SQS's receiptHandle binding.
+    var doneUpd = _update()
       .set("status", "done")
       .set("finishedAt", nowMs)
       .set("leaseExpiresAt", null)
       .where("_id", jobId)
-      .where("status", "inflight")
-      .toSql();
+      .where("status", "inflight");
+    if (opts && opts.attempt != null) doneUpd = doneUpd.where("attempts", opts.attempt);
+    var doneBuilt = doneUpd.toSql();
     var doneRes = await store.execute(doneBuilt.sql, doneBuilt.params);
     // Only run the post-completion side effects if THIS call actually flipped
     // the row inflight→done. If the status guard matched 0 rows the job was
@@ -579,7 +590,7 @@ function create(config) {
     // prior 'pending'/'failed' SQL literals now bind, which keeps the raw
     // fragment literal-free).
     var attemptsLt = _qc("attempts") + " < " + _qc("maxAttempts");
-    var failBuilt = _update()
+    var failUpd = _update()
       .setRaw("status", "CASE WHEN " + attemptsLt + " THEN ? ELSE ? END", ["pending", "failed"])
       .set("lastError", sealedErr)
       .set("leaseExpiresAt", null)
@@ -587,8 +598,12 @@ function create(config) {
               [nowMs + retryDelayMs])
       .setRaw("finishedAt", "CASE WHEN " + attemptsLt + " THEN NULL ELSE ? END", [nowMs])
       .where("_id", jobId)
-      .where("status", "inflight")          // lease-ownership guard — a stale fail() must not clobber a job re-leased to another worker after this one's lease expired (mirrors complete()/extendLease)
-      .toSql();
+      .where("status", "inflight");         // lease-ownership guard — a stale fail() must not clobber a job re-leased to another worker after this one's lease expired (mirrors complete()/extendLease)
+    // Lease fencing: when the caller leased at a specific attempts value,
+    // gate on it too, so a stale fail() whose job was re-leased (higher
+    // attempts) matches 0 rows (mirrors the redis FAIL_LUA fence).
+    if (opts.attempt != null) failUpd = failUpd.where("attempts", opts.attempt);
+    var failBuilt = failUpd.toSql();
     var failRes = await store.execute(failBuilt.sql, failBuilt.params);
     return (failRes.rowCount || 0) > 0;
   }

package/lib/queue-redis.js

@@ -144,15 +144,31 @@ var SWEEP_LUA = [
 // COMPLETE_LUA — atomically remove from inflight zset, flip status to
 // done, set finishedAt. Returns 1 if the job was inflight, 0 otherwise.
 //
+// Lease fencing: ARGV[3] is the caller's leased `attempts` value (the
+// inflight `attempts` at the time it leased), or "" to skip the check.
+// `attempts` is HINCRBY'd once per lease, so it uniquely identifies a
+// lease generation. If the stored attempts no longer matches, the caller
+// no longer owns the lease — its lease expired, was swept, and the job was
+// re-leased to another worker (whose lease incremented attempts) — so a
+// late completion from the stale holder returns 0 without marking the
+// in-progress job done. (The ZREM-removed gate alone can't catch this: the
+// inflight member is just the jobId, present again under the new lease.)
+//
 // KEYS[1] = inflight zset
 // KEYS[2] = job hash key
 // ARGV[1] = jobId (member to ZREM)
 // ARGV[2] = nowMs
+// ARGV[3] = expected leased attempts ("" = no fence)
 var COMPLETE_LUA = [
   'local inflightKey = KEYS[1]',
   'local jobKey = KEYS[2]',
   'local jobId = ARGV[1]',
   'local nowMs = tonumber(ARGV[2])',
+  'local fenceAttempt = ARGV[3]',
+  'if fenceAttempt ~= "" then',
+  '  local cur = redis.call("HGET", jobKey, "attempts")',
+  '  if cur == false or tostring(cur) ~= fenceAttempt then return 0 end',
+  'end',
   'local removed = redis.call("ZREM", inflightKey, jobId)',
   'if removed == 1 then',
   '  redis.call("HSET", jobKey, "status", "done", "finishedAt", nowMs, "leaseExpiresAt", "")',
@@ -161,9 +177,11 @@ var COMPLETE_LUA = [
 ].join("\n");
 
 // FAIL_LUA — decide retry vs DLQ based on the row's current attempts
-// vs maxAttempts (read from HASH for race-freedom). Retry: ZADD ready
-// at score=nextAvailableAt, status=pending. DLQ: ZADD dlq at
-// score=nowMs, status=failed.
+// vs maxAttempts (read from HASH for race-freedom). Gated on the job
+// still being inflight (ZREM removed == 1): a stale fail() on a job that
+// is no longer inflight returns -1 and mutates nothing. Retry: ZADD ready
+// at score=nextAvailableAt, status=pending, return 0. DLQ: ZADD dlq at
+// score=nowMs, status=failed, return 1.
 //
 // KEYS[1] = inflight zset
 // KEYS[2] = ready zset
@@ -173,6 +191,7 @@ var COMPLETE_LUA = [
 // ARGV[2] = nowMs
 // ARGV[3] = sealedErr (string; "" if no error)
 // ARGV[4] = nextAvailableAt
+// ARGV[5] = expected leased attempts ("" = no fence) — see COMPLETE_LUA
 var FAIL_LUA = [
   'local inflightKey = KEYS[1]',
   'local readyKey = KEYS[2]',
@@ -182,9 +201,23 @@ var FAIL_LUA = [
   'local nowMs = tonumber(ARGV[2])',
   'local sealedErr = ARGV[3]',
   'local nextAvailableAt = tonumber(ARGV[4])',
+  'local fenceAttempt = ARGV[5]',
   'local attempts = tonumber(redis.call("HGET", jobKey, "attempts")) or 0',
   'local maxAttempts = tonumber(redis.call("HGET", jobKey, "maxAttempts")) or 5',
-  'redis.call("ZREM", inflightKey, jobId)',
+  // Lease fencing: a stale fail() from a worker whose lease expired and whose
+  // job was re-leased to another worker (which incremented attempts) must not
+  // re-queue or DLQ the job the new worker is still running. If the stored
+  // attempts no longer matches the caller's leased attempts, return -1 and
+  // mutate nothing — same fence as COMPLETE_LUA.
+  'if fenceAttempt ~= "" and tostring(attempts) ~= fenceAttempt then return -1 end',
+  // Lease-ownership guard: only act if THIS call removed the job from inflight.
+  // A stale fail() — the worker's lease expired, sweepExpired re-queued the job,
+  // and another worker completed it — must not re-queue a job that is no longer
+  // inflight (it would resurrect a completed job for re-execution). Mirrors
+  // queue-local fail()'s `WHERE status='inflight'` guard. Returns -1 so the
+  // caller can report "did not act" rather than a retry/dlq outcome.
+  'local removed = redis.call("ZREM", inflightKey, jobId)',
+  'if removed ~= 1 then return -1 end',
   'if sealedErr ~= "" then redis.call("HSET", jobKey, "lastError", sealedErr) end',
   'redis.call("HSET", jobKey, "leaseExpiresAt", "")',
   'if attempts < maxAttempts then',
@@ -198,19 +231,30 @@ var FAIL_LUA = [
   'end',
 ].join("\n");
 
-// EXTEND_LUA — push leaseExpiresAt forward iff the job is still inflight.
+// EXTEND_LUA — push leaseExpiresAt forward iff the job is still inflight
+// AND the caller still owns the lease. ARGV[3] is the caller's leased
+// attempts ("" = no fence); a stale extend from a worker whose job was
+// re-leased (attempts moved on) returns 0 without touching the new
+// holder's lease — same fence as COMPLETE_LUA. Note `attempts` is not
+// changed by an extend, so a worker can extend its own lease repeatedly.
 //
 // KEYS[1] = inflight zset
 // KEYS[2] = job hash key
 // ARGV[1] = jobId
 // ARGV[2] = newExpiry
+// ARGV[3] = expected leased attempts ("" = no fence)
 var EXTEND_LUA = [
   'local inflightKey = KEYS[1]',
   'local jobKey = KEYS[2]',
   'local jobId = ARGV[1]',
   'local newExpiry = tonumber(ARGV[2])',
+  'local fenceAttempt = ARGV[3]',
   'local score = redis.call("ZSCORE", inflightKey, jobId)',
   'if score == false then return 0 end',
+  'if fenceAttempt ~= "" then',
+  '  local cur = redis.call("HGET", jobKey, "attempts")',
+  '  if cur == false or tostring(cur) ~= fenceAttempt then return 0 end',
+  'end',
   'redis.call("ZADD", inflightKey, newExpiry, jobId)',
   'redis.call("HSET", jobKey, "leaseExpiresAt", newExpiry)',
   'return 1',
@@ -432,12 +476,13 @@ function create(opts) {
     return leased;
   }
 
-  async function extendLease(jobId, additionalMs) {
+  async function extendLease(jobId, additionalMs, opts) {
     await _ensureConnected();
     if (typeof additionalMs !== "number" || additionalMs <= 0) {
       throw _err("INVALID_LEASE_EXTENSION",
         "extendLease: additionalMs must be a positive number", true);
     }
+    var fence = (opts && opts.attempt != null) ? String(opts.attempt) : "";
     var newExpiry = Date.now() + additionalMs;
     // We don't know which queue the job belongs to without a HGET, so
     // fetch queueName first (avoids storing inflight by queue, which
@@ -448,14 +493,15 @@ function create(opts) {
     var rv = await client.runScript(
       EXTEND_LUA, 2,
       _inflightKey(queueName), _jobKey(jobId),
-      jobId, String(newExpiry)
+      jobId, String(newExpiry), fence
     );
     return rv === 1;
   }
 
-  async function complete(jobId) {
+  async function complete(jobId, opts) {
     await _ensureConnected();
     var nowMs = Date.now();
+    var fence = (opts && opts.attempt != null) ? String(opts.attempt) : "";
     // Read row first to act on cron-repeat metadata. Same shape as
     // queue-local: SELECT row → flip status → if repeatCron, enqueue
     // next firing.
@@ -464,11 +510,18 @@ function create(opts) {
     if (!raw) return false;
     var queueName = raw.queueName || "unknown";
 
-    await client.runScript(
+    var removed = await client.runScript(
       COMPLETE_LUA, 2,
       _inflightKey(queueName), _jobKey(jobId),
-      jobId, String(nowMs)
+      jobId, String(nowMs), fence
     );
+    // Only the completer that won the inflight->done transition (removed === 1)
+    // runs the post-completion side effects. If the ZREM matched nothing the
+    // job was already completed, or its lease expired and sweepExpired re-queued
+    // it (possibly re-leased to another worker) — a stale completer must NOT
+    // re-enqueue the cron repeat (duplicate firing) or release flow children
+    // twice. Mirrors queue-local's `WHERE status='inflight'` rowcount guard.
+    if (Number(removed) !== 1) return false;
 
     if (raw.repeatCron) {
       try {
@@ -589,13 +642,17 @@ function create(opts) {
   async function fail(jobId, errorMessage, retryDelayMs) {
     await _ensureConnected();
     var nowMs = Date.now();
-    // b.queue.consume passes the object form `{ retryDelayMs }` (matching
-    // the queue-local backend); accept it as well as a bare-number third
-    // arg. Without this the object failed the `typeof === "number"` test
+    // b.queue.consume passes the object form `{ retryDelayMs, attempt }`
+    // (matching the queue-local backend); accept it as well as a bare-number
+    // third arg. Without this the object failed the `typeof === "number"` test
     // below and the delay was forced to 0, so the documented exponential
     // backoff was silently discarded and a failing job re-leased
-    // immediately on the redis backend (retry storm).
+    // immediately on the redis backend (retry storm). `attempt` is the
+    // caller's leased attempts value, used to fence a stale fail() (see
+    // FAIL_LUA).
+    var fence = "";
     if (retryDelayMs && typeof retryDelayMs === "object") {
+      if (retryDelayMs.attempt != null) fence = String(retryDelayMs.attempt);
       retryDelayMs = retryDelayMs.retryDelayMs;
     }
     if (typeof retryDelayMs !== "number" || !isFinite(retryDelayMs) || retryDelayMs < 0) {
@@ -609,12 +666,15 @@ function create(opts) {
 
     var sealedErr = errorMessage ? vault().seal(String(errorMessage)) : "";
 
-    await client.runScript(
+    var rv = await client.runScript(
       FAIL_LUA, 4,
       _inflightKey(queueName), _readyKey(queueName), _dlqKey(queueName), _jobKey(jobId),
-      jobId, String(nowMs), sealedErr, String(nextAvailableAt)
+      jobId, String(nowMs), sealedErr, String(nextAvailableAt), fence
     );
-    return true;
+    // -1 = stale fail() on a job no longer inflight (already completed or
+    // re-leased) — it did not retry or DLQ. 0 = retried, 1 = landed in dlq.
+    // Mirrors queue-local fail()'s `rowCount > 0`.
+    return Number(rv) !== -1;
   }
 
   async function sweepExpired() {

package/lib/queue.js

@@ -479,7 +479,7 @@ function consume(queueName, handler, opts) {
                   "queue backend '" + b.name + "' does not support extendLease",
                   true);
               }
-              return b.extendLease(job.jobId, additionalMs).then(function (ok) {
+              return b.extendLease(job.jobId, additionalMs, { attempt: job.attempts }).then(function (ok) {
                 if (ok) {
                   _emit("system.queue.lease.extended", {
                     metadata: { queue: queueName, backend: b.name, jobId: job.jobId, additionalMs: additionalMs },
@@ -514,7 +514,7 @@ function consume(queueName, handler, opts) {
               return Promise.resolve()
                 .then(function () { return handler(job, ctx); })
                 .then(function () {
-                  return b.complete(job.jobId).then(function () {
+                  return b.complete(job.jobId, { attempt: job.attempts }).then(function () {
                     _emit("system.queue.consume.success", {
                       metadata: { queue: queueName, backend: b.name, jobId: job.jobId, attempt: job.attempts, traceId: job.traceId },
                     });
@@ -523,7 +523,7 @@ function consume(queueName, handler, opts) {
                 }, function (err) {
               var msg = (err && err.message) || String(err);
               var willRetry = job.attempts < job.maxAttempts;
-              return b.fail(job.jobId, msg, { retryDelayMs: _backoffDelay(job.attempts) })
+              return b.fail(job.jobId, msg, { retryDelayMs: _backoffDelay(job.attempts), attempt: job.attempts })
                 .then(function () {
                   observability.event("queue.fail", 1, { queueName: queueName, willRetry: willRetry });
                   _emit("system.queue.consume.failure", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.60",
+  "version": "0.15.61",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9f023375-6f18-4c24-a12a-74b1fc204f53",
+  "serialNumber": "urn:uuid:6303169a-86d7-4e03-92ca-da9cee671ab1",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-29T15:45:36.020Z",
+    "timestamp": "2026-06-29T17:23:08.793Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.60",
+      "bom-ref": "@blamejs/core@0.15.61",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.60",
+      "version": "0.15.61",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.60",
+      "purl": "pkg:npm/%40blamejs/core@0.15.61",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.60",
+      "ref": "@blamejs/core@0.15.61",
       "dependsOn": []
     }
   ]