@bonsae/nrg 0.5.2 → 0.5.3

package/build/server/index.cjs

@@ -33,6 +33,7 @@ __export(index_exports, {
   ConfigNode: () => ConfigNode,
   IONode: () => IONode,
   Node: () => Node,
+  NrgError: () => NrgError,
   SchemaType: () => SchemaType,
   defineSchema: () => defineSchema,
   registerType: () => registerType,
@@ -231,6 +232,15 @@ function initValidator(RED) {
   validator2 = new NodeRedValidator(RED);
 }
 
+// src/core/errors.ts
+var NrgError = class _NrgError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NrgError";
+    Object.setPrototypeOf(this, _NrgError.prototype);
+  }
+};
+
 // src/core/server/nodes/utils.ts
 function setupContext(context, store) {
   return {
@@ -254,40 +264,51 @@ function setupContext(context, store) {
     )
   };
 }
-function setupConfigProxy(RED, config) {
+function setupConfigProxy(RED, config, schema) {
   const SKIP_PROPS = /* @__PURE__ */ new Set(["id", "_id", "_users"]);
+  const nodeRefProps = /* @__PURE__ */ new Set();
+  if (schema?.properties) {
+    for (const [key, propSchema] of Object.entries(schema.properties)) {
+      if (propSchema?.["x-nrg-node-type"]) {
+        nodeRefProps.add(key);
+      }
+    }
+  }
+  const cache = /* @__PURE__ */ new WeakMap();
   const createProxy = (obj) => {
-    return new Proxy(obj, {
-      get(target, prop) {
-        if (typeof prop === "symbol") {
-          return target[prop];
-        }
-        if (SKIP_PROPS.has(prop)) {
-          return target[prop];
+    const cached = cache.get(obj);
+    if (cached) return cached;
+    if (Array.isArray(obj)) {
+      const mapped = obj.map((item) => {
+        if (item && typeof item === "object") {
+          return createProxy(item);
         }
+        return item;
+      });
+      cache.set(obj, mapped);
+      return mapped;
+    }
+    const proxy = new Proxy(obj, {
+      get(target, prop) {
+        if (typeof prop === "symbol") return target[prop];
+        if (SKIP_PROPS.has(prop)) return target[prop];
         const value = target[prop];
-        if (typeof value === "string" && value.length > 0) {
-          const node = RED.nodes.getNode(value)?._node;
-          return node || value;
-        }
-        if (Array.isArray(value)) {
-          return value.map((item) => {
-            if (typeof item === "string") {
-              const node = RED.nodes.getNode(item)?._node;
-              return node || item;
-            }
-            if (item && typeof item === "object") {
-              return createProxy(item);
-            }
-            return item;
-          });
+        if (typeof value === "string" && value.length > 0 && nodeRefProps.has(prop)) {
+          return RED.nodes.getNode(value)?._node ?? value;
         }
         if (value && typeof value === "object") {
           return createProxy(value);
         }
         return value;
+      },
+      set(_target, prop) {
+        throw new NrgError(
+          `Cannot set property '${String(prop)}' on read-only node config`
+        );
       }
     });
+    cache.set(obj, proxy);
+    return proxy;
   };
   return createProxy(config);
 }
@@ -369,7 +390,11 @@ var Node = class {
         );
       }
     }
-    this.config = setupConfigProxy(RED, config);
+    this.config = setupConfigProxy(
+      RED,
+      config,
+      constructor.configSchema
+    );
     if (constructor.credentialsSchema && credentials) {
       this.log("Validating credentials");
       const credResult = validator2.validate(
@@ -785,7 +810,7 @@ function serveNrgResources(RED) {
   httpAdmin.use(function(req, res, next) {
     const prefix = "/nrg/assets/";
     if (!req.path.startsWith(prefix)) return next();
-    let reqPath = req.path.slice(prefix.length).replace(/\.\./g, "");
+    let reqPath = req.path.slice(prefix.length);
     if (reqPath === "vue.esm-browser.prod.js" && process.env.NODE_ENV !== "production") {
       const devPath = import_path.default.resolve(clientDir, "vue.esm-browser.js");
       if (import_fs.default.existsSync(devPath)) {
@@ -793,7 +818,8 @@ function serveNrgResources(RED) {
       }
     }
     const filePath = import_path.default.resolve(clientDir, reqPath);
-    if (!filePath.startsWith(clientDir)) return next();
+    const rel = import_path.default.relative(clientDir, filePath);
+    if (rel.startsWith("..") || import_path.default.isAbsolute(rel)) return next();
     if (!import_fs.default.existsSync(filePath) || !import_fs.default.statSync(filePath).isFile())
       return next();
     const ext = import_path.default.extname(filePath);
@@ -805,23 +831,23 @@ async function registerType(RED, NodeClass) {
   const NC = NodeClass;
   RED.log.debug(`Registering Type: ${NC.type}`);
   if (!(NC.prototype instanceof Node)) {
-    throw new Error(`${NC.name} must extend IONode or ConfigNode classes`);
+    throw new NrgError(`${NC.name} must extend IONode or ConfigNode classes`);
   }
   if (!NC.type) {
-    throw new Error("type must be provided when registering the node");
+    throw new NrgError("type must be provided when registering the node");
   }
   if (NC.color && !/^#[0-9A-Fa-f]{6}$/.test(NC.color)) {
-    throw new Error(
+    throw new NrgError(
       `Invalid color for ${NodeClass.type}: ${NC.color} color must be in hex format`
     );
   }
-  if (NC.inputs !== void 0 && (!Number.isInteger(NC.inputs) || NC.inputs != 0 && NC.inputs != 1)) {
-    throw new Error(
+  if (NC.inputs !== void 0 && (!Number.isInteger(NC.inputs) || NC.inputs !== 0 && NC.inputs !== 1)) {
+    throw new NrgError(
       `Invalid number of inputs for ${NodeClass.type}: inputs must be 0 or 1`
     );
   }
   if (NC.outputs !== void 0 && (!Number.isInteger(NC.outputs) || NC.outputs < 0)) {
-    throw new Error(
+    throw new NrgError(
       `Invalid number of outputs for ${NodeClass.type}: outputs must be a positive integer`
     );
   }
@@ -830,7 +856,12 @@ async function registerType(RED, NodeClass) {
     function(config) {
       RED.nodes.createNode(this, config);
       const node = new NC(RED, this, config, this.credentials);
-      this._node = node;
+      Object.defineProperty(this, "_node", {
+        value: node,
+        writable: false,
+        configurable: false,
+        enumerable: false
+      });
       const createdPromise = Promise.resolve(node.created?.()).catch(
         (error) => {
           this.error("Error during created hook: " + error.message);
@@ -913,6 +944,7 @@ function registerTypes(nodes) {
   ConfigNode,
   IONode,
   Node,
+  NrgError,
   SchemaType,
   defineSchema,
   registerType,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bonsae/nrg",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "NRG framework — build Node-RED nodes with Vue 3, TypeScript, and JSON Schema",
   "author": "Allan Oricil <allanoricil@duck.com>",
   "license": "MIT",

package/src/core/errors.ts

@@ -0,0 +1,9 @@
+class NrgError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "NrgError";
+    Object.setPrototypeOf(this, NrgError.prototype);
+  }
+}
+
+export { NrgError };

package/src/core/server/index.ts

@@ -4,6 +4,7 @@ import { getCredentialsFromSchema } from "./utils";
 import { Node } from "./nodes";
 import { type RED } from "./types";
 import { initValidator } from "./validator";
+import { NrgError } from "../errors";
 
 const MIME: Record<string, string> = {
   ".js": "application/javascript",
@@ -32,9 +33,7 @@ function serveNrgResources(RED: RED): void {
   httpAdmin.use(function (req: any, res: any, next: any) {
     const prefix = "/nrg/assets/";
     if (!(req.path as string).startsWith(prefix)) return next();
-    let reqPath = (req.path as string)
-      .slice(prefix.length)
-      .replace(/\.\./g, "");
+    let reqPath = (req.path as string).slice(prefix.length);
     // Serve the Vue dev build in development for devtools support
     if (
       reqPath === "vue.esm-browser.prod.js" &&
@@ -46,7 +45,8 @@ function serveNrgResources(RED: RED): void {
       }
     }
     const filePath = path.resolve(clientDir, reqPath);
-    if (!filePath.startsWith(clientDir)) return next();
+    const rel = path.relative(clientDir, filePath);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) return next();
     if (!fs.existsSync(filePath) || !fs.statSync(filePath).isFile())
       return next();
     const ext = path.extname(filePath);
@@ -70,24 +70,24 @@ async function registerType(RED: RED, NodeClass: AnyNodeClass) {
   const NC = NodeClass as any;
   RED.log.debug(`Registering Type: ${NC.type}`);
   if (!(NC.prototype instanceof Node)) {
-    throw new Error(`${NC.name} must extend IONode or ConfigNode classes`);
+    throw new NrgError(`${NC.name} must extend IONode or ConfigNode classes`);
   }
 
   if (!NC.type) {
-    throw new Error("type must be provided when registering the node");
+    throw new NrgError("type must be provided when registering the node");
   }
 
   if (NC.color && !/^#[0-9A-Fa-f]{6}$/.test(NC.color)) {
-    throw new Error(
+    throw new NrgError(
       `Invalid color for ${NodeClass.type}: ${NC.color} color must be in hex format`,
     );
   }
 
   if (
     NC.inputs !== undefined &&
-    (!Number.isInteger(NC.inputs) || (NC.inputs != 0 && NC.inputs != 1))
+    (!Number.isInteger(NC.inputs) || (NC.inputs !== 0 && NC.inputs !== 1))
   ) {
-    throw new Error(
+    throw new NrgError(
       `Invalid number of inputs for ${NodeClass.type}: inputs must be 0 or 1`,
     );
   }
@@ -96,7 +96,7 @@ async function registerType(RED: RED, NodeClass: AnyNodeClass) {
     NC.outputs !== undefined &&
     (!Number.isInteger(NC.outputs) || NC.outputs < 0)
   ) {
-    throw new Error(
+    throw new NrgError(
       `Invalid number of outputs for ${NodeClass.type}: outputs must be a positive integer`,
     );
   }
@@ -106,8 +106,14 @@ async function registerType(RED: RED, NodeClass: AnyNodeClass) {
     function (this: any, config: any) {
       RED.nodes.createNode(this, config);
       const node = new NC(RED, this, config, this.credentials);
-      // NOTE: save node intance inside node-red's node so that the proxy can resolve it lazyly
-      this._node = node;
+      // NOTE: save node instance inside node-red's node so that the proxy can resolve it lazily.
+      // Non-writable to prevent accidental clobbering by other code in the process.
+      Object.defineProperty(this, "_node", {
+        value: node,
+        writable: false,
+        configurable: false,
+        enumerable: false,
+      });
 
       // NOTE: created promise must be here because we only want it to start after the whole object creation chain has been completed: child -> IONode -> Node -> IONode -> child -> done
       const createdPromise = Promise.resolve(node.created?.()).catch(
@@ -214,6 +220,7 @@ function registerTypes(nodes: AnyNodeClass[]): NodeRedPackageFunction {
 
 export { registerType, registerTypes };
 export { Node, IONode, ConfigNode } from "./nodes";
+export { NrgError } from "../errors";
 export type { RED } from "./types";
 export { SchemaType, defineSchema } from "./schemas";
 export type { Schema, Infer } from "./schemas/types";

package/src/core/server/nodes/node.ts

@@ -115,7 +115,11 @@ abstract class Node<TConfig = any, TCredentials = any, TSettings = any> {
         );
       }
     }
-    (this as any).config = setupConfigProxy(RED, config);
+    (this as any).config = setupConfigProxy(
+      RED,
+      config,
+      constructor.configSchema,
+    );
 
     if (constructor.credentialsSchema && credentials) {
       this.log("Validating credentials");

package/src/core/server/nodes/utils.ts

@@ -1,6 +1,7 @@
 import type { ResolveNodeRefs } from "../schemas/types";
 import type { RED, NodeRedContextStore } from "../types";
 import type { NodeContextStore } from "./types";
+import { NrgError } from "../../errors";
 
 function setupContext(
   context: NodeRedContextStore,
@@ -31,50 +32,72 @@ function setupContext(
 function setupConfigProxy<T extends object>(
   RED: RED,
   config: T,
+  schema?: any,
 ): ResolveNodeRefs<T> {
-  // NOTE: must not proxy its own id or parents ids
   const SKIP_PROPS = new Set(["id", "_id", "_users"]);
 
+  // Build a set of property names that are node references based on the schema.
+  // Only these properties will have their string values resolved via RED.nodes.getNode().
+  const nodeRefProps = new Set<string>();
+  if (schema?.properties) {
+    for (const [key, propSchema] of Object.entries(schema.properties)) {
+      if ((propSchema as any)?.["x-nrg-node-type"]) {
+        nodeRefProps.add(key);
+      }
+    }
+  }
+
+  // Per-node-instance cache: original object/array -> proxy or mapped array.
+  // This preserves reference equality: config.server === config.server
+  const cache = new WeakMap<object, any>();
+
   const createProxy = <O extends object>(obj: O): any => {
-    return new Proxy(obj, {
-      get(target: any, prop: string | symbol): any {
-        if (typeof prop === "symbol") {
-          return target[prop];
-        }
+    const cached = cache.get(obj);
+    if (cached) return cached;
 
-        if (SKIP_PROPS.has(prop)) {
-          return target[prop];
+    if (Array.isArray(obj)) {
+      // Map once, cache the result array so identity is stable across reads
+      const mapped = obj.map((item) => {
+        if (item && typeof item === "object") {
+          return createProxy(item);
         }
+        return item;
+      });
+      cache.set(obj, mapped);
+      return mapped;
+    }
 
-        const value = target[prop];
+    const proxy = new Proxy(obj, {
+      get(target: any, prop: string | symbol): any {
+        if (typeof prop === "symbol") return target[prop];
+        if (SKIP_PROPS.has(prop)) return target[prop];
 
-        if (typeof value === "string" && value.length > 0) {
-          // NOTE: using the instance provided by the user instead of node-red's internal one
-          const node = RED.nodes.getNode(value)?._node;
-          return node || value;
-        }
+        const value = target[prop];
 
-        if (Array.isArray(value)) {
-          return value.map((item) => {
-            if (typeof item === "string") {
-              // NOTE: using the instance provided by the user instead of node-red's internal one
-              const node = RED.nodes.getNode(item)?._node;
-              return node || item;
-            }
-            if (item && typeof item === "object") {
-              return createProxy(item);
-            }
-            return item;
-          });
+        // Only resolve strings as node references if the schema marks the property
+        if (
+          typeof value === "string" &&
+          value.length > 0 &&
+          nodeRefProps.has(prop)
+        ) {
+          return RED.nodes.getNode(value)?._node ?? value;
         }
 
         if (value && typeof value === "object") {
-          return createProxy(value);
+          return createProxy(value); // hits the cache on repeat access
         }
 
         return value;
       },
+      set(_target: any, prop: string | symbol): boolean {
+        throw new NrgError(
+          `Cannot set property '${String(prop)}' on read-only node config`,
+        );
+      },
     });
+
+    cache.set(obj, proxy);
+    return proxy;
   };
 
   return createProxy(config) as ResolveNodeRefs<T>;