@blamejs/core 0.17.23 → 0.18.0

package/lib/outbox.js

@@ -102,6 +102,28 @@ function _validateTableName(name) {
   return safeSql.quoteIdentifier(name, undefined, { allowReserved: true }); // parity with b.db.from()
 }
 
+// The outbox is always operator-supplied `table` executed against a concrete
+// externalDb handle (never b.clusterStorage — nothing here rewrites bare table
+// names), so every b.sql builder quotes the table name by construction
+// (quoteName: true). A quoted identifier is what makes a reserved-word or
+// case-sensitive operator table (a table literally named "from") emit valid
+// SQL — parity with b.db.from()'s allowReserved. Same posture as b.mailStore
+// against its concrete sqlite handle.
+function _tableOpts(dialect) { return { dialect: dialect, quoteName: true }; }
+
+// PostgreSQL folds UNQUOTED identifiers to lowercase, so every pre-0.18 deployment
+// (whose DDL and queries emitted the table name unquoted) already has a
+// lowercase-folded table. Now that the name is always quoted (quoteName above), a
+// mixed-case config like table: "MyOutbox" would target a NEW case-sensitive
+// "MyOutbox" table and strand the rows in the original folded "myoutbox". Fold to
+// lowercase on postgres BEFORE quoting so a legacy config keeps resolving to its
+// existing table; reserved words (already lowercase) still quote correctly. sqlite
+// is case-insensitive (no fold); MySQL's folding is server-configured
+// (lower_case_table_names) and applied equally to the pre-quote name, so leave it.
+function _foldTableForDialect(name, dialect) {
+  return dialect === "postgres" ? String(name).toLowerCase() : name;
+}
+
 // Map the operator backend's dialect tag to the b.sql dialect vocabulary.
 // b.sql's terminal toExternalSql() then emits $1..$N for postgres and `?`
 // for sqlite / mysql, matching what the operator-supplied driver expects.
@@ -182,6 +204,8 @@ function _toDebeziumEnvelope(rawEvent, opts) {
       before: (payload && payload.before) || null,
       after:  (payload && payload.after !== undefined) ? payload.after : payload,
       source: {
+        // connectorName/connectorVersion are defaulted to non-empty strings in create(), so these || fallbacks are unreachable.
+        /* c8 ignore next 2 */
         connector: opts.connectorName || "blamejs",
         version:   opts.connectorVersion || DEFAULT_DEBEZIUM_CONNECTOR_VERSION,
         db:        opts.dbName || null,
@@ -300,6 +324,10 @@ function create(opts) {
 
   var auditOn        = opts.audit !== false;
   var externalDb     = opts.externalDb;
+  // Fold the operator table name for the backend's identifier rules BEFORE it is
+  // quoted downstream, so a legacy mixed-case config still targets its existing
+  // (folded) table on postgres. Reassign a clone so the caller's opts is untouched.
+  opts = Object.assign({}, opts, { table: _foldTableForDialect(opts.table, _sqlDialect(externalDb)) });
   var publisher      = opts.publisher;
   var envelope       = opts.envelope || "raw";
   if (envelope !== "raw" && envelope !== "debezium") {
@@ -365,7 +393,7 @@ function create(opts) {
     // enqueued_at and next_attempt_at both take the same publisher-clock
     // moment; b.sql binds it as two separate `?` so the placeholder/param
     // parity gate holds (no $5-reused-twice shorthand).
-    var stmt = sql.insert(opts.table, { dialect: _sqlDialect(externalDb) })
+    var stmt = sql.insert(opts.table, _tableOpts(_sqlDialect(externalDb)))
       .values({
         topic:           event.topic,
         payload:         payloadJson,
@@ -405,7 +433,7 @@ function create(opts) {
       { name: "attempts",        type: "INTEGER",      notNull: true, default: 0 },
       { name: "last_error",      type: "TEXT" },
       { name: "status",          type: "VARCHAR(16)",  notNull: true, default: "pending" },
-    ], { dialect: dialect }), dialect);
+    ], _tableOpts(dialect)), dialect);
     // Index for the publisher's claim path (scans status='pending' ORDER BY
     // next_attempt_at). sqlite/postgres support a partial index (WHERE on
     // CREATE INDEX) on next_attempt_at; MySQL does NOT — a WHERE there is a
@@ -414,7 +442,7 @@ function create(opts) {
     // equality+range scan. The 'pending' literal is a builder-emitted static
     // predicate, opted in via allowLiterals.
     var idxCols = dialect === "mysql" ? ["status", "next_attempt_at"] : ["next_attempt_at"];
-    var idxOpts = { dialect: dialect };
+    var idxOpts = _tableOpts(dialect);
     if (dialect !== "mysql") idxOpts.where = "status = 'pending'";
     var idx = sql.toExternalSql(sql.createIndex(opts.table + "_pending_idx", opts.table,
       idxCols, idxOpts), dialect);
@@ -428,7 +456,7 @@ function create(opts) {
     // claimed_at the reaper can't tell a stranded claim from a live one.
     try {
       var alter = sql.toExternalSql(sql.alterTable(opts.table,
-        { addColumn: { name: "claimed_at", type: tsType } }, { dialect: dialect }), dialect);
+        { addColumn: { name: "claimed_at", type: tsType } }, _tableOpts(dialect)), dialect);
       await target.query(alter.sql, alter.params);
     } catch (_e) { /* column already present — idempotent add */ }
   }
@@ -466,7 +494,7 @@ function create(opts) {
       var nowExpr = _utcNowExpr(externalDb);
       // status='pending' is a builder-emitted static predicate (opted in
       // via allowLiterals); next_attempt_at <= ? + the LIMIT both bind.
-      var selectBuilder = sql.select(opts.table, { dialect: dialect })
+      var selectBuilder = sql.select(opts.table, _tableOpts(dialect))
         .columns(CLAIM_COLS)
         .whereRaw("status = 'pending'", [], { allowLiterals: true })
         .whereRaw("next_attempt_at <= ?", [nowExpr])
@@ -492,7 +520,7 @@ function create(opts) {
         // Postgres/MySQL: row lock held; whereInArray emits `id = ANY(?)`
         // on postgres (the whole id set as one bound array) / expanded
         // `IN (?, ?, ...)` on mysql.
-        var claimUpdate = sql.update(opts.table, { dialect: dialect })
+        var claimUpdate = sql.update(opts.table, _tableOpts(dialect))
           .set({ status: "in-flight", claimed_at: _utcNowExpr(externalDb) })
           .whereInArray("id", ids)
           .toExternalSql(dialect);
@@ -504,13 +532,13 @@ function create(opts) {
         // update we re-read the in-flight rows we own; rows that
         // another publisher beat us to are skipped. whereInArray expands
         // to an `IN (?, ?, ...)` placeholder list on sqlite.
-        var markUpdate = sql.update(opts.table, { dialect: dialect })
+        var markUpdate = sql.update(opts.table, _tableOpts(dialect))
           .set({ status: "in-flight", claimed_at: _utcNowExpr(externalDb) })
           .whereRaw("status = 'pending'", [], { allowLiterals: true })
           .whereInArray("id", ids)
           .toExternalSql(dialect);
         await xdb.query(markUpdate.sql, markUpdate.params);
-        var afterSelect = sql.select(opts.table, { dialect: dialect })
+        var afterSelect = sql.select(opts.table, _tableOpts(dialect))
           .columns(CLAIM_COLS)
           .whereRaw("status = 'in-flight'", [], { allowLiterals: true })
           .whereInArray("id", ids)
@@ -544,7 +572,7 @@ function create(opts) {
   async function _reapStaleInflight() {
     var dialect = _sqlDialect(externalDb);
     var cutoff = new Date(Date.now() - claimReclaimMs);
-    var stmt = sql.update(opts.table, { dialect: dialect })
+    var stmt = sql.update(opts.table, _tableOpts(dialect))
       .set({ status: "pending", claimed_at: null })
       .whereRaw("status = 'in-flight'", [], { allowLiterals: true })
       .whereRaw("(claimed_at IS NULL OR claimed_at <= ?)", [cutoff])
@@ -555,7 +583,7 @@ function create(opts) {
 
   async function _markPublished(id) {
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.update(opts.table, { dialect: dialect })
+    var stmt = sql.update(opts.table, _tableOpts(dialect))
       .set({ status: "published", published_at: _utcNowExpr(externalDb) })
       .where("id", id)
       .toExternalSql(dialect);
@@ -565,7 +593,7 @@ function create(opts) {
   async function _markRetry(id, attempts, errMsg) {
     var dialect = _sqlDialect(externalDb);
     var nextAt = new Date(Date.now() + _backoffMs(attempts + 1));
-    var stmt = sql.update(opts.table, { dialect: dialect })
+    var stmt = sql.update(opts.table, _tableOpts(dialect))
       .set({
         status:          "pending",
         attempts:        attempts + 1,
@@ -579,7 +607,7 @@ function create(opts) {
 
   async function _markDead(id, attempts, errMsg) {
     var dialect = _sqlDialect(externalDb);
-    var stmt = sql.update(opts.table, { dialect: dialect })
+    var stmt = sql.update(opts.table, _tableOpts(dialect))
       .set({
         status:     "dead",
         attempts:   attempts + 1,
@@ -654,6 +682,8 @@ function create(opts) {
       workerHandle = null;
     }
     if (inFlight) {
+      // inFlight is _processOnce().catch(...).finally(...), which never rejects, so this drop-silent catch cannot fire.
+      /* c8 ignore next */
       try { await inFlight; } catch (_e) { /* drop-silent */ }
     }
     _emitAudit("system.outbox.stopped", "success", { name: name });
@@ -664,7 +694,7 @@ function create(opts) {
     // status is a fixed builder-internal literal ('pending' / 'dead'),
     // never operator input; opted in via allowLiterals. COUNT(*) AS n is
     // the count aggregate with an alias.
-    var stmt = sql.select(opts.table, { dialect: dialect })
+    var stmt = sql.select(opts.table, _tableOpts(dialect))
       .count("*", "n")
       .whereRaw("status = '" + status + "'", [], { allowLiterals: true })
       .toExternalSql(dialect);

package/lib/redact.js

@@ -74,6 +74,8 @@ var SENSITIVE_FIELDS = [
 // matches the pattern. Used as a fallback when field-name redaction misses.
 function _luhnCheck(num) {
   var digits = num.replace(/\D/g, "");
+  // unreachable: every _luhnCheck caller pre-gates digit length to 13-19
+  /* c8 ignore next */
   if (digits.length < 13 || digits.length > 19) return false;
   var sum = 0;
   var alt = false;
@@ -90,6 +92,8 @@ var VALUE_DETECTORS = [
   {
     name:        "credit-card",
     test:        function (v) {
+      // unreachable: _redactValue only invokes value detectors on strings
+      /* c8 ignore next */
       if (typeof v !== "string") return false;
       var digits = v.replace(/\s|-/g, "");
       if (!/^\d{13,19}$/.test(digits)) return false;
@@ -231,6 +235,8 @@ function _isSensitiveFieldName(key) {
 }
 
 function _redactValue(value) {
+  // unreachable: _redact only calls _redactValue inside its string branch
+  /* c8 ignore next */
   if (typeof value !== "string") return value;
   var allDetectors = VALUE_DETECTORS.concat(customDetectors);
   for (var i = 0; i < allDetectors.length; i++) {
@@ -396,7 +402,9 @@ var CLASSIFIER_PATTERNS = Object.freeze({
         var c = rearranged.charCodeAt(i);
         if (c >= 48 && c <= 57) num += rearranged.charAt(i); // ASCII '0'..'9' codepoint range
         else if (c >= 65 && c <= 90) num += String(c - 55);
+        /* c8 ignore start */ // unreachable: the regex gate above admits only [A-Z0-9]
         else return false;
+        /* c8 ignore stop */
       }
       // Long-integer mod 97 in chunks
       var rem = 0;
@@ -600,6 +608,8 @@ function classifyDefaults(opts) {
     if (Buffer.isBuffer(bodyVal) || bodyVal instanceof Uint8Array) {
       var asText;
       try { asText = Buffer.from(bodyVal).toString("utf8"); }
+      // unreachable drop-silent: Buffer.toString only throws on >512MiB payloads
+      /* c8 ignore next */
       catch (_e) { asText = ""; }
       var scannedText = _scanString(asText, "body");
       redactedBody = scannedText === asText ? bodyVal : Buffer.from(scannedText, "utf8");
@@ -646,6 +656,8 @@ function _emitDlp(action, outcome, metadata) {
     audit().safeEmit({
       action:   action,
       outcome:  outcome,
+      // unreachable: every _emitDlp caller passes a metadata object literal
+      /* c8 ignore next */
       metadata: metadata || {},
     });
   } catch (_e) { /* drop-silent */ }
@@ -658,6 +670,8 @@ function _wrapClassifier(fn, where) {
   }
   return function safeClassify(input) {
     var v;
+    // unreachable: the wrapped classifier is only invoked internally with an object
+    /* c8 ignore next */
     try { v = fn(input || {}); }
     catch (e) {
       // Classifier threw — treat as refuse (fail-closed, since the
@@ -1069,8 +1083,9 @@ var TEXT_REDACT_MARKER = "[redacted]";
  * secret may be interpolated mid-sentence. Unlike `redact` (structured,
  * whole-value, anchored), this uses word-boundary fragment replacement so
  * "login failed: &lt;jwt&gt; for bob" keeps everything but the jwt. Detects PEM
- * blocks, JWTs, AWS access keys, URL-userinfo passwords, bearer tokens,
- * `key=secret` assignments, SSN/EIN, and Luhn-valid PANs. The high-entropy
+ * blocks, JWTs, AWS access keys, vault-sealed ciphertext, URL-userinfo passwords
+ * (including empty-username forms), bearer tokens, `key=secret` assignments,
+ * SSN/EIN, and Luhn-valid PANs. The high-entropy
  * api-key-shape detector is deliberately excluded (on free text it eats
  * ordinary IDs / hashes / base64). Drop-safe: never throws (it runs on the
  * hot-path log-emit sink); on any error it returns a fully-masked marker rather
@@ -1089,12 +1104,28 @@ function redactText(str) {
       .replace(/\beyJ[A-Za-z0-9_-]{1,4096}\.[A-Za-z0-9_-]{1,8192}\.[A-Za-z0-9_-]{1,4096}\b/g, TEXT_REDACT_MARKER)
       // AWS access-key IDs.
       .replace(/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[A-Z0-9]{16}\b/g, TEXT_REDACT_MARKER)
-      // Credentials in a URL userinfo: scheme://user:secret@host.
-      .replace(/([a-z][a-z0-9+.-]{0,32}:\/\/[^\s:@/]{1,256}:)[^\s@/]{1,256}(@)/gi, "$1" + TEXT_REDACT_MARKER + "$2")
+      // Vault-sealed ciphertext (vault:v1:…) — the structured meta path strips
+      // these via the vault-sealed value detector (anchored to startsWith), so
+      // an embedded one in a free-text message must not survive either.
+      .replace(/\bvault:[A-Za-z0-9+/=_.:-]{3,8192}/g, TEXT_REDACT_MARKER)
+      // Credentials in a URL userinfo: scheme://user:secret@host. The username
+      // segment is optional ({0,…}) so an empty-username form (redis://:pw@host)
+      // — which the meta path's connection-string detector catches — is scrubbed
+      // too; a password segment before the '@' is what flags the credential.
+      .replace(/([a-z][a-z0-9+.-]{0,32}:\/\/[^\s:@/]{0,256}:)[^\s@/]{1,256}(@)/gi, "$1" + TEXT_REDACT_MARKER + "$2")
       // Bearer tokens.
       .replace(/\b([Bb]earer\s{1,4})[A-Za-z0-9._~+/-]{8,4096}=*/g, "$1" + TEXT_REDACT_MARKER)
-      // key=secret / password: secret style assignments.
-      .replace(/\b((?:api[_-]?key|access[_-]?token|secret|password|passwd|pwd|token)\s{0,4}[=:]\s{0,4})[^\s&;"']{6,4096}/gi, "$1" + TEXT_REDACT_MARKER)
+      // key=secret / password: secret style assignments. The specific
+      // *_token forms precede bare `token` so an underscore-joined name
+      // (id_token, refresh_token — where \btoken cannot match across the
+      // underscore) is still redacted, matching the meta path's coverage.
+      // The optional ["'] on BOTH sides of the delimiter lets the JSON / quoted
+      // form ({"refresh_token":"opaque…"}) match: the key's closing quote sits
+      // before the delimiter and the value's opening quote after it, and the value
+      // class excludes quotes so it could otherwise neither reach the delimiter nor
+      // begin at the value. The value still stops at the closing quote, leaving the
+      // surrounding structure intact.
+      .replace(/\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token|secret|password|passwd|pwd|token)["']?\s{0,4}[=:]\s{0,4}["']?)[^\s&;"']{6,4096}/gi, "$1" + TEXT_REDACT_MARKER)
       // SSN / EIN.
       .replace(/\b\d{3}-\d{2}-\d{4}\b/g, TEXT_REDACT_MARKER)
       .replace(/\b\d{2}-\d{7}\b/g, TEXT_REDACT_MARKER)
@@ -1103,6 +1134,8 @@ function redactText(str) {
         var inner = m.replace(/[\s-]/g, "");
         return (inner.length >= 13 && inner.length <= 19 && _luhnCheck(inner)) ? TEXT_REDACT_MARKER : m;
       });
+  // unreachable drop-silent: the replace chain runs on a guaranteed string with static regexes
+  /* c8 ignore next 3 */
   } catch (_e) {
     return TEXT_REDACT_MARKER;
   }

package/lib/safe-json.js

@@ -170,7 +170,14 @@ function parse(input, opts) {
   try {
     parsed = JSON.parse(input, allowProto ? undefined : _stripProtoKeys);
   } catch (e) {
-    throw new SafeJsonError("invalid JSON: " + e.message, "json/syntax");
+    // V8's SyntaxError.message echoes a window of the offending input
+    // ("Unexpected token 'M', \"{...secret...\"... is not valid JSON").
+    // At a trust boundary that snippet can carry secret-bearing bytes
+    // (a decrypted key, a token) straight into any log that records the
+    // thrown error (CWE-532). Keep only the non-secret facts: the stable
+    // code and, when V8 provides it, the numeric character offset.
+    var pos = (/position (\d+)/.exec(e && e.message) || [])[1];
+    throw new SafeJsonError("invalid JSON syntax" + (pos ? " at position " + pos : ""), "json/syntax");
   }
 
   _walkAndCheck(parsed, 0, maxDepth, allowProto, maxKeys);
@@ -313,6 +320,7 @@ function _walkAndCheck(value, depth, maxDepth, allowProto, maxKeys) {
   }
   if (!allowProto) {
     pick.POISONED_KEYS.forEach(function (k) {
+      /* c8 ignore next -- defensive second layer: when !allowProto the parse reviver already stripped every poisoned key before this walk, so the own-key delete is never reached from the public API */
       if (Object.prototype.hasOwnProperty.call(value, k)) delete value[k];
     });
   }