@c9up/ream 0.2.28 → 0.2.29

package/src/Ignitor.ts

@@ -14,6 +14,7 @@
  */
 
 import { Application } from './Application.js'
+import type { BodyParserConfig } from './bodyparser/BodyParserMiddleware.js'
 import type { Console } from './console/Console.js'
 import type { CommandLoader, Kernel as ConsoleKernelInstance } from './console/Kernel.js'
 import { type CommandClass, isCommandClass } from './console/types.js'
@@ -51,13 +52,20 @@ import {
 import { Router } from './router/Router.js'
 import { CookieSigner } from './security/CookieSigner.js'
 import { SignedUrl } from './security/SignedUrl.js'
-import { type GrpcHandler, Server } from './server/Server.js'
+import { cancellableGrpc, type NativeGrpcHandler } from './server/nativeGrpc.js'
+import {
+  type NativeBodyLimits,
+  type NativeConnectionConfig,
+  nativeBodyLimits,
+  nativeConnectionConfig,
+} from './server/nativeLimits.js'
+import { type GrpcLimits, Server } from './server/Server.js'
 import { clearApp, setApp } from './services/app.js'
 import { clearEncryption, setEncryption } from './services/encryption.js'
 import { clearLogger, setLogger } from './services/logger.js'
 import { clearRouter, setRouter } from './services/router.js'
 import { clearServer, setServer } from './services/server.js'
-import { registerSessionTemplateTags } from './session/templateTags.js'
+import { installSessionTemplateTags } from './session/templateTags.js'
 
 /** Application environment. */
 /**
@@ -269,7 +277,9 @@ export function defineConfig(config: ReamrcConfig): ReamrcConfig {
 export interface HyperServerLike {
   onRequest(callback: (request: HttpKernelRequest) => Promise<HttpKernelResponse>): void
   /** Optional — present on the real `HyperServer`; required once `server.grpc()` is used. */
-  onGrpc?(callback: GrpcHandler): void
+  onGrpc?(callback: NativeGrpcHandler, limits?: GrpcLimits): void
+  /** Optional — reports the calls a client gave up on; without it no call's signal aborts. */
+  onGrpcCancel?(callback: (id: number) => void): void
   /**
    * Optional — present on the real `HyperServer` (Rust-backed), absent on
    * trivial test mocks. Ignitor only calls it when a shield config is set.
@@ -279,6 +289,10 @@ export interface HyperServerLike {
   configureTrustedProxies?(cidrs: string[]): void
   /** Optional — same lifecycle as `configureShield`. */
   configureRateLimit?(config: { max: number; windowSecs: number } | null): void
+  /** Optional — same lifecycle as `configureShield`. */
+  configureBodyLimits?(config: NativeBodyLimits): void
+  /** Optional — same lifecycle as `configureShield`. */
+  configureConnections?(config: NativeConnectionConfig): void
   listen(): Promise<void>
   port(): Promise<number>
   close(): Promise<void>
@@ -684,26 +698,12 @@ export class Ignitor {
 
   /**
    * Give the template engine `@error` / `@errors` / `@inputError` /
-   * `@flashMessage`, as AdonisJS's session plugin does.
-   *
-   * The engine is duck-typed out of the container so ream carries no dependency
-   * on it, and an app with no template layer simply skips this.
+   * `@flashMessage`, as AdonisJS's session plugin does — through the engine
+   * package's module singleton, guarded by `usingInker` (see
+   * `installSessionTemplateTags`). An app with no template layer skips this.
    */
   async #registerSessionTemplateTags(): Promise<void> {
-    for (const token of ['inker', 'view']) {
-      if (!this.#app.container.has(token)) continue
-      const binding: unknown = await this.#app.container.resolve(token)
-      for (const candidate of [binding, Reflect.get(Object(binding), '_templates')]) {
-        const register = Reflect.get(Object(candidate), 'registerTag')
-        if (typeof register !== 'function') continue
-        registerSessionTemplateTags({
-          registerTag: (tag) => {
-            register.call(candidate, tag)
-          },
-        })
-        return
-      }
-    }
+    await installSessionTemplateTags(this.#app.usingInker === true)
   }
 
   async #phaseRegister(): Promise<void> {
@@ -914,7 +914,9 @@ export class Ignitor {
             { hint: 'Use the native HyperServer, or a test server that implements onGrpc().' },
           )
         }
-        this.#_httpServer.onGrpc(grpc)
+        const calls = cancellableGrpc(grpc)
+        this.#_httpServer.onGrpcCancel?.(calls.onCancel)
+        this.#_httpServer.onGrpc(calls.onCall, this.#server.getGrpcLimits())
       }
       // Pre-resolve client IPs in Rust from the trusted-proxy CIDRs before
       // listen. Security filtering itself lives in @c9up/blackhole.
@@ -925,6 +927,19 @@ export class Ignitor {
       ) {
         this.#_httpServer.configureTrustedProxies([...trustedProxies])
       }
+      // Body limits from `config/bodyparser.ts`, enforced while the native
+      // server reads a body: nothing past them is ever buffered.
+      const bodyparser = this.#app.config.get<BodyParserConfig>('bodyparser')
+      if (bodyparser && typeof this.#_httpServer.configureBodyLimits === 'function') {
+        this.#_httpServer.configureBodyLimits(nativeBodyLimits(bodyparser))
+      }
+      // AdonisJS `config/app.ts` → `http: { headersTimeout, requestTimeout,
+      // keepAliveTimeout }`, plus `maxConnections`.
+      if (typeof this.#_httpServer.configureConnections === 'function') {
+        this.#_httpServer.configureConnections(
+          nativeConnectionConfig(this.#app.config.get<unknown>('app.http')),
+        )
+      }
       await this.#_httpServer.listen()
 
       // Whoever opened the socket closes it. `app.terminate()` runs the

package/src/bodyparser/BodyParserMiddleware.ts

@@ -136,6 +136,9 @@ export default class BodyParserMiddleware {
     }
 
     const contentType = ctx.request.header('content-type') ?? ''
+    // A body over its native limit (`bodyTooLarge`) was never kept: `raw()`
+    // throws the same 413 below instead of handing back an empty string. The
+    // route is already matched here, so an unknown URL answered 404 first.
     const rawBody = ctx.request.raw()
 
     // Size check. Thrown rather than written: the app's exception handler

package/src/bodyparser/qsParse.ts

@@ -11,7 +11,7 @@
  * dependency it can write in a screenful, and the limits below are easier to
  * defend when they are visible.
  *
- * Three guards, all of which `qs` also applies:
+ * Four guards, all of which `qs` also applies:
  *
  *  - **Prototype keys are dropped.** `__proto__[x]=1` in a form body is the
  *    classic prototype-pollution vector; the key never reaches an object.
@@ -19,11 +19,14 @@
  *    as a literal key rather than allocating unbounded nesting.
  *  - **Parameter count is capped** (`qs` defaults to 1000), so a body of a
  *    million `a[0]`, `a[1]`… cannot be turned into a million-entry object.
+ *  - **Explicit array indices are capped** (`qs` `arrayLimit`, default 20).
+ *    A larger index is an object key, so `ids[4294967294]=1` stays one entry.
  */
 
 /** `qs` defaults, reproduced so the behaviour is the same out of the box. */
 export const DEFAULT_DEPTH = 5
 export const DEFAULT_PARAMETER_LIMIT = 1000
+export const DEFAULT_ARRAY_LIMIT = 20
 
 export interface QsParseOptions {
   /**
@@ -34,6 +37,12 @@ export interface QsParseOptions {
   allowDots?: boolean
   depth?: number
   parameterLimit?: number
+  /**
+   * Highest explicit index + 1 that still builds an array (`qs` defaults to
+   * 20). `ids[25]=x` becomes `{ ids: { '25': 'x' } }`, so a 16-byte request
+   * cannot allocate a 100-million-slot array.
+   */
+  arrayLimit?: number
   /** Turn `''` into `null`, as AdonisJS' `convertEmptyStringsToNull` does. */
   convertEmptyStringsToNull?: boolean
   /** Trim surrounding whitespace, as AdonisJS' `trimWhitespaces` does. */
@@ -77,15 +86,53 @@ function isIndex(segment: string): boolean {
   return /^\d+$/.test(segment)
 }
 
-/** Assign `value` at `segments` inside `target`, creating containers as needed. */
-function assign(target: Record<string, unknown>, segments: string[], value: unknown): void {
-  let cursor: Record<string, unknown> | unknown[] = target
+type Container = Record<string, unknown> | unknown[]
+
+function isContainer(value: unknown): value is Container {
+  return typeof value === 'object' && value !== null
+}
+
+/** `{ '0': a, '1': b }` from `[a, b]`, holes left out — what `qs` produces on overflow. */
+function arrayToObject(array: unknown[]): Record<string, unknown> {
+  const object: Record<string, unknown> = {}
+  array.forEach((item, index) => {
+    object[String(index)] = item
+  })
+  return object
+}
+
+/**
+ * Assign `value` at `segments` inside `target`, creating containers as needed.
+ *
+ * An explicit index at or above `arrayLimit` never addresses an array: the
+ * container becomes (or is converted into) an object keyed by that index,
+ * as `qs` does. Without it, `ids[100000000]=1` allocates a sparse array whose
+ * iteration or serialisation blocks the event loop for seconds. Appends
+ * (`tags[]`, a repeated key) stay arrays — each one costs a parameter, so
+ * `parameterLimit` already bounds them, and a long checkbox group keeps the
+ * shape its handler expects (`qs` turns those into objects past the limit).
+ */
+function assign(
+  target: Record<string, unknown>,
+  segments: string[],
+  value: unknown,
+  arrayLimit: number,
+): void {
+  let cursor: Container = target
+  // Swaps `cursor` inside its parent when an array has to become an object.
+  let replace: (next: Container) => void = () => {}
   for (let i = 0; i < segments.length; i++) {
     const segment = segments[i] ?? ''
     const last = i === segments.length - 1
 
     if (FORBIDDEN_KEYS.has(segment)) return
 
+    if (Array.isArray(cursor) && isIndex(segment) && Number(segment) >= arrayLimit) {
+      const converted = arrayToObject(cursor)
+      replace(converted)
+      cursor = converted
+    }
+
     if (last) {
       if (segment === '') {
         // `tags[]` — append.
@@ -109,24 +156,31 @@ function assign(target: Record<string, unknown>, segments: string[], value: unkn
     }
 
     const nextSegment = segments[i + 1] ?? ''
-    const wantsArray = nextSegment === '' || isIndex(nextSegment)
+    const wantsArray =
+      nextSegment === '' || (isIndex(nextSegment) && Number(nextSegment) < arrayLimit)
 
     if (Array.isArray(cursor)) {
       if (!isIndex(segment)) return
+      const array: unknown[] = cursor
       const index = Number(segment)
-      const existing = cursor[index]
-      if (existing === undefined || typeof existing !== 'object' || existing === null) {
-        cursor[index] = wantsArray ? [] : {}
+      const existing: unknown = array[index]
+      const child: Container = isContainer(existing) ? existing : wantsArray ? [] : {}
+      array[index] = child
+      replace = (next) => {
+        array[index] = next
       }
-      cursor = cursor[index] as Record<string, unknown> | unknown[]
+      cursor = child
       continue
     }
 
-    const existing = cursor[segment]
-    if (existing === undefined || typeof existing !== 'object' || existing === null) {
-      cursor[segment] = wantsArray ? [] : {}
+    const object: Record<string, unknown> = cursor
+    const existing: unknown = object[segment]
+    const child: Container = isContainer(existing) ? existing : wantsArray ? [] : {}
+    object[segment] = child
+    replace = (next) => {
+      object[segment] = next
     }
-    cursor = cursor[segment] as Record<string, unknown> | unknown[]
+    cursor = child
   }
 }
 
@@ -155,6 +209,7 @@ export function parseQueryString(
 ): Record<string, unknown> {
   const depth = options.depth ?? DEFAULT_DEPTH
   const parameterLimit = options.parameterLimit ?? DEFAULT_PARAMETER_LIMIT
+  const arrayLimit = options.arrayLimit ?? DEFAULT_ARRAY_LIMIT
   const result: Record<string, unknown> = {}
   if (!body) return result
 
@@ -173,7 +228,7 @@ export function parseQueryString(
     if (options.trimWhitespaces && typeof value === 'string') value = value.trim()
     if (options.convertEmptyStringsToNull && value === '') value = null
 
-    assign(result, splitKey(key, depth, options.allowDots ?? true), value)
+    assign(result, splitKey(key, depth, options.allowDots ?? true), value, arrayLimit)
   }
   return result
 }

package/src/codemods/source.ts

@@ -0,0 +1,303 @@
+/**
+ * Just enough of a TypeScript scanner for the configure codemods: find a
+ * call or an object/array literal in CODE (never inside a string, a template
+ * or a comment), split a literal into its top-level entries, and append to
+ * one. Upstream does this with a full AST; ream ships no compiler, and the
+ * files these codemods edit (`start/env.ts`, `reamrc.ts`) are object and
+ * array literals.
+ *
+ * Not handled: regular-expression literals (a quote inside one reads as the
+ * start of a string). Neither file has a reason to contain one.
+ */
+
+const CLOSERS: Record<string, string> = { '{': '}', '[': ']', '(': ')' }
+
+function isIdentifierChar(char: string | undefined): boolean {
+  return char !== undefined && /[A-Za-z0-9_$]/.test(char)
+}
+
+/**
+ * The index just past the string, template or comment starting at `i`, or
+ * `i` itself when none starts there. An unterminated one runs to the end.
+ */
+function skipNonCode(src: string, i: number): number {
+  const char = src[i]
+  const next = src[i + 1]
+  if (char === '/' && next === '/') {
+    const end = src.indexOf('\n', i)
+    return end === -1 ? src.length : end
+  }
+  if (char === '/' && next === '*') {
+    const end = src.indexOf('*/', i + 2)
+    return end === -1 ? src.length : end + 2
+  }
+  if (char === "'" || char === '"') {
+    let j = i + 1
+    while (j < src.length && src[j] !== char && src[j] !== '\n') {
+      j += src[j] === '\\' ? 2 : 1
+    }
+    return j + 1
+  }
+  if (char === '`') {
+    let j = i + 1
+    while (j < src.length && src[j] !== '`') {
+      if (src[j] === '\\') {
+        j += 2
+      } else if (src[j] === '$' && src[j + 1] === '{') {
+        const close = matchClose(src, j + 1)
+        j = close === -1 ? src.length : close + 1
+      } else {
+        j += 1
+      }
+    }
+    return j + 1
+  }
+  return i
+}
+
+/** Whether the string, template or block comment starting at `i` is closed. */
+function isTerminated(src: string, i: number): boolean {
+  const char = src[i]
+  if (char === '/') return src.indexOf('*/', i + 2) !== -1
+  const end = skipNonCode(src, i)
+  return end <= src.length && end - 1 > i && src[end - 1] === char
+}
+
+/** Index of the bracket closing the one at `open`, or -1. */
+export function matchClose(src: string, open: number): number {
+  const first = CLOSERS[src[open] ?? '']
+  if (first === undefined) return -1
+  const stack = [first]
+  let i = open + 1
+  while (i < src.length) {
+    const skipped = skipNonCode(src, i)
+    if (skipped !== i) {
+      i = skipped
+      continue
+    }
+    const char = src[i] ?? ''
+    const closer = CLOSERS[char]
+    if (closer !== undefined) {
+      stack.push(closer)
+    } else if (char === stack[stack.length - 1]) {
+      stack.pop()
+      if (stack.length === 0) return i
+    } else if (char === '}' || char === ']' || char === ')') {
+      return -1
+    }
+    i += 1
+  }
+  return -1
+}
+
+/** First code character at or after `i` (before `end`), skipping whitespace and comments. */
+function firstCode(src: string, i: number, end: number): number {
+  let j = i
+  while (j < end) {
+    const char = src[j] ?? ''
+    if (/\s/.test(char)) {
+      j += 1
+      continue
+    }
+    if (char === '/' && (src[j + 1] === '/' || src[j + 1] === '*')) {
+      j = skipNonCode(src, j)
+      continue
+    }
+    return j
+  }
+  return end
+}
+
+/** One top-level entry of a literal: the text between two commas. */
+export interface Segment {
+  start: number
+  end: number
+  /** First code character, or `end` when the entry is only trivia. */
+  codeStart: number
+  /** Just past the last code character (comments and whitespace excluded). */
+  codeEnd: number
+}
+
+/** Split `src[start, end)` on its top-level commas. */
+export function segments(src: string, start: number, end: number): Segment[] {
+  const out: Segment[] = []
+  let segmentStart = start
+  let codeEnd = start
+  let depth = 0
+  let i = start
+  const close = (at: number) => {
+    const codeStart = firstCode(src, segmentStart, at)
+    out.push({ start: segmentStart, end: at, codeStart, codeEnd: Math.max(codeEnd, codeStart) })
+  }
+  while (i < end) {
+    const char = src[i] ?? ''
+    if (char === '/' && (src[i + 1] === '/' || src[i + 1] === '*')) {
+      i = skipNonCode(src, i)
+      continue
+    }
+    const skipped = skipNonCode(src, i)
+    if (skipped !== i) {
+      i = skipped
+      codeEnd = i
+      continue
+    }
+    if (char === ',' && depth === 0) {
+      close(i)
+      segmentStart = i + 1
+      codeEnd = i + 1
+      i += 1
+      continue
+    }
+    if (CLOSERS[char] !== undefined) depth += 1
+    else if (char === '}' || char === ']' || char === ')') depth -= 1
+    if (!/\s/.test(char)) codeEnd = i + 1
+    i += 1
+  }
+  close(end)
+  return out
+}
+
+/**
+ * Whether `code` is one complete expression that cannot reach outside the
+ * slot it is written into: brackets balanced and never closing past where
+ * they opened, strings and comments terminated, no top-level comma.
+ */
+export function isSingleExpression(code: string): boolean {
+  if (code.trim() === '') return false
+  let depth = 0
+  let i = 0
+  while (i < code.length) {
+    const skipped = skipNonCode(code, i)
+    if (skipped !== i) {
+      // A line comment would swallow the comma written after the value.
+      const lineComment = code[i] === '/' && code[i + 1] === '/'
+      if (lineComment || !isTerminated(code, i)) return false
+      i = skipped
+      continue
+    }
+    const char = code[i] ?? ''
+    if (CLOSERS[char] !== undefined) depth += 1
+    else if (char === '}' || char === ']' || char === ')') {
+      depth -= 1
+      if (depth < 0) return false
+    } else if (char === ',' && depth === 0) return false
+    i += 1
+  }
+  return depth === 0
+}
+
+/**
+ * Index of the `(` of the first call to `callee` in code, or -1. A mention
+ * inside a string or a comment, or as the tail of a longer name
+ * (`MyEnv.create`), does not count.
+ */
+export function findCall(src: string, callee: string): number {
+  let i = 0
+  while (i < src.length) {
+    const skipped = skipNonCode(src, i)
+    if (skipped !== i) {
+      i = skipped
+      continue
+    }
+    const before = src[i - 1]
+    if (src.startsWith(callee, i) && !isIdentifierChar(before) && before !== '.') {
+      const paren = firstCode(src, i + callee.length, src.length)
+      if (src[paren] === '(') return paren
+    }
+    i += 1
+  }
+  return -1
+}
+
+/** Index of the `{` after the first `export default` in code, or -1. */
+export function findExportDefaultObject(src: string): number {
+  let i = 0
+  while (i < src.length) {
+    const skipped = skipNonCode(src, i)
+    if (skipped !== i) {
+      i = skipped
+      continue
+    }
+    if (src.startsWith('export', i) && !isIdentifierChar(src[i - 1])) {
+      const word = firstCode(src, i + 'export'.length, src.length)
+      if (src.startsWith('default', word) && !isIdentifierChar(src[word + 'default'.length])) {
+        const brace = firstCode(src, word + 'default'.length, src.length)
+        return src[brace] === '{' ? brace : -1
+      }
+    }
+    i += 1
+  }
+  return -1
+}
+
+/** A `key: value` entry of an object literal. */
+export interface Property {
+  key: string
+  valueStart: number
+  valueEnd: number
+}
+
+/** The `key: value` entries of the object literal opening at `open`. */
+export function properties(src: string, open: number, close: number): Property[] {
+  const out: Property[] = []
+  for (const segment of segments(src, open + 1, close)) {
+    if (segment.codeStart >= segment.end) continue
+    const text = src.slice(segment.codeStart, segment.end)
+    const match = /^(?:([A-Za-z_$][\w$]*)|'([^'\\\n]*)'|"([^"\\\n]*)")\s*:/.exec(text)
+    if (match === null) continue
+    const key = match[1] ?? match[2] ?? match[3] ?? ''
+    const valueStart = firstCode(src, segment.codeStart + match[0].length, segment.end)
+    out.push({ key, valueStart, valueEnd: segment.codeEnd })
+  }
+  return out
+}
+
+/** Leading whitespace of the line holding `index`. */
+function lineIndent(src: string, index: number): string {
+  const lineStart = src.lastIndexOf('\n', index - 1) + 1
+  return /^[ \t]*/.exec(src.slice(lineStart))?.[0] ?? ''
+}
+
+/**
+ * Append entries to the literal `src[open..close]` and return the new text.
+ *
+ * `build` receives the indentation of the existing entries (or one level
+ * deeper than the closing bracket when there are none) and returns the lines
+ * to add, each already ending with its comma. `blankLine` separates the new
+ * entries from existing ones. A missing comma after the last existing entry
+ * is added.
+ */
+export function appendToLiteral(
+  src: string,
+  open: number,
+  close: number,
+  eol: string,
+  build: (indent: string) => string[],
+  blankLine = false,
+): string {
+  const all = segments(src, open + 1, close)
+  const entries = all.filter((s) => s.codeStart < s.end)
+  const first = entries[0]
+  const closeIndent = lineIndent(src, close)
+  const firstOnOwnLine =
+    first !== undefined &&
+    /^[ \t]*$/.test(src.slice(src.lastIndexOf('\n', first.codeStart - 1) + 1, first.codeStart))
+  const indent =
+    first !== undefined && firstOnOwnLine ? lineIndent(src, first.codeStart) : `${closeIndent}  `
+  const lines = build(indent)
+  const separator = blankLine && entries.length > 0 ? eol : ''
+
+  const closeLineStart = src.lastIndexOf('\n', close - 1) + 1
+  const closeOnOwnLine = /^[ \t]*$/.test(src.slice(closeLineStart, close))
+  let out = closeOnOwnLine
+    ? `${src.slice(0, closeLineStart)}${separator}${lines.join(eol)}${eol}${src.slice(closeLineStart)}`
+    : `${src.slice(0, close)}${eol}${separator}${lines.join(eol)}${eol}${closeIndent}${src.slice(close)}`
+
+  // The comma goes in last, as it sits before every insertion point above.
+  // No comma after the last entry when it is also the last segment.
+  const last = entries[entries.length - 1]
+  if (last !== undefined && all[all.length - 1] === last) {
+    out = `${out.slice(0, last.codeEnd)},${out.slice(last.codeEnd)}`
+  }
+  return out
+}

package/src/graphql/GraphQLEngine.ts

@@ -25,6 +25,7 @@ import * as fs from 'node:fs'
 import { currentNodeEnv } from '../env/nodeEnv.js'
 import { loadNapi } from '../helpers/napi-loader.js'
 import type { HttpContext } from '../http/HttpContext.js'
+import { holdsPermissions } from '../http/permissions.js'
 
 /** Rust parser output (the `ream-graphql` crate via the `index` NAPI binary). */
 interface RustParsedField {
@@ -455,9 +456,9 @@ export class GraphQLEngine {
       }
     }
 
+    // A token-authenticated request also needs the token to allow each one.
     if (permissions.length > 0) {
-      const userPerms = ctx.auth?.permissions ?? ctx.auth?.user?.permissions ?? []
-      if (!permissions.every((p) => userPerms.includes(p))) {
+      if (!holdsPermissions(ctx.auth, permissions)) {
         return 'Insufficient permissions'
       }
     }

package/src/http/Exception.ts

@@ -259,6 +259,12 @@ export type HttpError = {
   report?: (error: unknown, ctx: HttpContext) => Promise<void> | void
   /** A hint appended to the message, when the exception carries one. */
   help?: string
+  /**
+   * Set by a thrown value that is not an {@link Exception} but whose message is
+   * written for clients (the `http-errors` convention). Shown outside debug
+   * mode even on a 5xx.
+   */
+  expose?: boolean
 }
 
 /** Renders an HTML error page for a status (AdonisJS `StatusPageRenderer`). */
@@ -352,13 +358,22 @@ export class ExceptionHandler extends Macroable {
    * The message a client is allowed to see.
    *
    * DEVIATION (named): outside debug mode ream only echoes the message of a
-   * deliberate `Exception`; anything else collapses to a generic line. AdonisJS
+   * deliberate `Exception`, of a client error (status below 500, which a
+   * package raises on purpose: 401, 403, 413…), or of an error flagged
+   * `expose: true`; anything else collapses to a generic line. AdonisJS
    * echoes `error.message` whatever was thrown, which leaks the text of driver
    * and library errors to the client.
+   *
+   * A `code` is NOT a reason to show the message: Node system errors
+   * (`ECONNREFUSED`, `ENOENT`) and database drivers (`23505`) carry one, and
+   * their messages hold internal hosts, file paths, constraint names and
+   * stored values. The error itself is left untouched for reporting.
    */
   protected publicMessage(error: HttpError, ctx: HttpContext): string {
     if (this.isDebuggingEnabled(ctx)) return error.message
-    if (error.code !== 'E_UNKNOWN') return error.message
+    if (error instanceof Exception || error.status < 500 || error.expose === true) {
+      return error.message
+    }
     return 'An internal error occurred'
   }
 

package/src/http/HttpContext.ts

@@ -33,7 +33,14 @@ export interface AuthState {
     id: string
     email?: string
     roles?: string[]
+    /** The user's own permissions — never widened by a token's abilities. */
     permissions?: string[]
+    /**
+     * Set by a token guard (AdonisJS `user.currentAccessToken`): the token this
+     * request authenticated with. Its abilities restrict the user's
+     * permissions on every `.permission()` gate; they never add to them.
+     */
+    currentAccessToken?: AccessTokenAbilities
     [key: string]: unknown
   }
   roles?: string[]
@@ -65,6 +72,11 @@ export interface AuthState {
   readonly authenticatedViaGuard?: string
 }
 
+/** What a permission gate needs from an access token: whether it allows an ability. */
+export interface AccessTokenAbilities {
+  allows(ability: string): boolean
+}
+
 /**
  * Per-request authorization entry point — populated by an authorization
  * middleware (e.g. `@c9up/warden`'s Bouncer initializer). A structural
@@ -440,8 +452,9 @@ export class HttpContext extends Macroable {
     this.response.setRedirectFactory(
       () =>
         new RedirectBuilder(this.response, {
-          requestUrl: this.request.url(),
+          requestUrl: this.request.url(true),
           requestReferer: this.request.header('referer'),
+          requestAuthority: this.request.authority() ?? undefined,
           routeUrlResolver: this.#routeUrlResolver,
         }),
     )