@c9up/ream 0.2.28 → 0.2.30

package/src/http-client/index.ts

@@ -0,0 +1,21 @@
+/**
+ * `@c9up/ream/http-client` — outbound HTTP with an SSRF guard, and its test fake.
+ */
+
+export { isPublicAddress } from './addresses.js'
+export {
+  FakeHttpClient,
+  type FakeMatcher,
+  type FakeResponse,
+  fakeHttp,
+  type RecordedRequest,
+} from './fake.js'
+export {
+  HttpClient,
+  HttpClientError,
+  type HttpClientFailure,
+  type HttpClientOptions,
+  type HttpRequestOptions,
+  HttpResponse,
+  type OutgoingRequest,
+} from './HttpClient.js'

package/src/index.ts

@@ -219,10 +219,12 @@ export { createHttpKernel } from './HttpKernel.js'
 
 // ─── Server ─────────────────────────────────────────────────
 
+export type { NativeGrpcCall, NativeGrpcHandler } from './server/nativeGrpc.js'
 export type {
   ErrorHandlerClass,
   GrpcCall,
   GrpcHandler,
+  GrpcLimits,
   GrpcReply,
   LazyImport,
   MiddlewareClass,
@@ -285,7 +287,10 @@ export type {
 export {
   type Codemods,
   createCodemods,
+  type EnvValidationNode,
   type GeneratedStub,
+  type MiddlewarePosition,
+  type PreloadEnvironment,
   type StubState,
 } from './Codemods.js'
 export {
@@ -409,4 +414,4 @@ export {
   StatsTracker,
 } from './scheduler/index.js'
 
-export const VERSION = '0.2.28'
+export const VERSION = '0.2.30'

package/src/middleware/Pipeline.ts

@@ -15,6 +15,7 @@ import { debugHttp } from '../debug.js'
 import { ReamError } from '../errors/ReamError.js'
 import { E_FORBIDDEN, E_UNAUTHORIZED, E_VALIDATION_ERROR } from '../http/Exception.js'
 import type { HttpContext } from '../http/HttpContext.js'
+import { holdsPermissions } from '../http/permissions.js'
 
 export type MiddlewareFunction = (
   ctx: HttpContext,
@@ -96,7 +97,10 @@ export async function runValidator(
     }
   }
 
-  throw new TypeError(
+  // A dedicated code, not a TypeError: callers tell this configuration
+  // mistake apart from a TypeError raised by a bug inside a rule.
+  throw new ReamError(
+    'E_VALIDATOR_UNUSABLE',
     'Route validator exposes none of validateResultAsync(), validateResult() or validate().',
   )
 }
@@ -239,9 +243,9 @@ function createGuardMiddleware(
       }
     }
 
+    // A token-authenticated request also needs the token to allow each one.
     if (permissions && permissions.length > 0) {
-      const userPerms = ctx.auth.permissions ?? ctx.auth.user?.permissions ?? []
-      if (!permissions.every((p) => userPerms.includes(p))) {
+      if (!(await holdsPermissions(ctx.auth, permissions))) {
         throw new E_FORBIDDEN('Insufficient permissions', permissions)
       }
     }

package/src/native/generated.ts

@@ -31,10 +31,18 @@ export interface NapiResponse {
  */
 
 export interface NapiGrpcCall {
+  /**
+   * This call, in the ids `onGrpcCancel` reports. Increasing, in the order
+   * the calls reach JavaScript.
+   */
+  id: number
   /** `/package.Service/Method`. */
   path: string
-  /** Request metadata, header names lowercased. */
-  metadata: Record<string, string>
+  /**
+   * Request metadata: the request headers, every value of a repeated one
+   * in order, names lowercased.
+   */
+  metadata: Record<string, Array<string>>
   /** The request message, still encoded. */
   message: Uint8Array
   /** Resolved client IP, by the same trusted-proxy rules as `request.ip`. */
@@ -52,6 +60,16 @@ export interface NapiGrpcReply {
   details?: string
 }
 
+/**
+ * Message size bounds of the gRPC calls, in bytes; `-1` for none. Omitted:
+ * 4 MiB received, no bound sent.
+ */
+
+export interface NapiGrpcLimits {
+  maxReceiveMessageLength?: number
+  maxSendMessageLength?: number
+}
+
 /**
  * Configuration for the wire-level shield filter. Mirrors the Rust
  * `ShieldConfig` shape; the JS layer constructs it from `ShieldMiddleware`
@@ -74,6 +92,58 @@ export interface NapiRateLimitConfig {
   windowSecs: number
 }
 
+/**
+ * The limit of one body parser and the content types it claims. `limit` is
+ * in bytes; an omitted field keeps the default.
+ */
+
+export interface NapiBodyLimit {
+  limit?: number
+  types?: Array<string>
+}
+
+/**
+ * Request-body limits per content type, the body parser's sections. Each
+ * omitted section keeps the `@adonisjs/bodyparser` default: json, form and
+ * raw (`text/*`) 1 MB, multipart 20 MB. A content type no section claims
+ * gets the raw limit.
+ */
+
+export interface NapiBodyLimits {
+  json?: NapiBodyLimit
+  form?: NapiBodyLimit
+  raw?: NapiBodyLimit
+  multipart?: NapiMultipartLimit
+}
+
+/**
+ * The multipart section: its size limit and types, and how many fields
+ * and files a body may carry (default 1000 each), enforced while the body
+ * is parsed.
+ */
+
+export interface NapiMultipartLimit {
+  limit?: number
+  types?: Array<string>
+  maxFields?: number
+  maxFiles?: number
+}
+
+/**
+ * Timeouts (milliseconds) and the connection cap, named after the Node
+ * `http.Server` settings an Adonis app configures. `0` disables a bound;
+ * an omitted field keeps the default: `headersTimeout` 60 000,
+ * `requestTimeout` 300 000, `keepAliveTimeout` 5 000, `maxConnections`
+ * 10 000.
+ */
+
+export interface NapiConnectionConfig {
+  headersTimeout?: number
+  requestTimeout?: number
+  keepAliveTimeout?: number
+  maxConnections?: number
+}
+
 /**
  * NAPI-exposed event bus.
  * Uses shared Tokio runtime (no per-instance runtime).
@@ -111,9 +181,10 @@ export declare class EventBus {
 
 export declare class HyperServer {
   /**
-   * `host` is the bind address: an IPv4 literal (`0.0.0.0` to accept from
-   * every interface) or the `localhost` alias. Omitted → loopback only,
-   * the safe default for a dev machine.
+   * `host` is the bind address: an IPv4 or IPv6 literal (`0.0.0.0` or `::`
+   * to accept from every interface, a bracketed `[::1]` too) or the
+   * `localhost` alias. Omitted → loopback only, the safe default for a dev
+   * machine.
    */
   constructor(port?: number | undefined | null, host?: string | undefined | null)
   /**
@@ -130,15 +201,40 @@ export declare class HyperServer {
    * HTTP requests. Must be called BEFORE `listen()`.
    *
    * A rejected promise is answered `INTERNAL`, with nothing of the error
-   * sent to the client.
+   * sent to the client. `limits` bounds the request and reply messages;
+   * a request is read, and refused, before the handler is called.
+   */
+  onGrpc(
+    callback: (arg: NapiGrpcCall) => Promise<NapiGrpcReply>,
+    limits?: NapiGrpcLimits | undefined | null,
+  ): void
+  /**
+   * Register the function told, with its `id`, about a gRPC call the
+   * client gave up on — a reset stream or a closed connection — before the
+   * handler answered. A cancel can reach JavaScript before its call does.
    */
-  onGrpc(callback: (arg: NapiGrpcCall) => Promise<NapiGrpcReply>): void
+  onGrpcCancel(callback: (arg: number) => void): void
   /**
-   * Configure the trusted-proxy CIDR list used by `request.ip` resolution.
-   * Must be called BEFORE `listen()`. Empty list = legacy permissive mode
-   * (any peer can populate `X-Forwarded-For`).
+   * Configure the trusted proxies used by `request.ip` / `request.ips`
+   * resolution. Must be called BEFORE `listen()`. Entries are addresses,
+   * CIDR ranges (IPv4 or IPv6), IPv4 netmask ranges, the named ranges
+   * `loopback` / `linklocal` / `uniquelocal`, or `"*"` (trust every hop).
+   * Empty list (the default) = `X-Forwarded-For` ignored, the socket peer
+   * is the client. Throws on an entry that is none of these.
    */
   configureTrustedProxies(cidrs: Array<string>): void
+  /**
+   * Configure the request-body limits, applied while the body is read:
+   * nothing past a limit is kept, and the request reaches JS without its
+   * body and with `bodyTooLarge` set, for the body parser to answer 413
+   * once the route is known. Must be called BEFORE `listen()`.
+   */
+  configureBodyLimits(config: NapiBodyLimits): void
+  /**
+   * Configure the header / body / keep-alive timeouts and the connection
+   * cap. Must be called BEFORE `listen()`.
+   */
+  configureConnections(config: NapiConnectionConfig): void
   /**
    * Install (or replace) the wire-level rate limiter. Pass `None` to
    * disable. Must be called BEFORE `listen()`.
@@ -254,44 +350,6 @@ export declare class RustScheduler {
   nextRun(name: string): number | null
 }
 
-/**
- * Sign a JWT payload with HMAC-SHA256 (Rust-native).
- * Returns the complete JWT token string.
- */
-
-export declare function jwtSign(payload: string, secret: string): string
-
-/**
- * Verify a JWT token and return the decoded payload JSON string.
- * Validates signature (constant-time), exp, and nbf claims.
- */
-
-export declare function jwtVerify(token: string, secret: string): string
-
-/**
- * Hash a password with Argon2id (Rust-native).
- * Returns the PHC-formatted hash string.
- */
-
-export declare function argon2Hash(password: string): string
-
-/** Verify a password against an Argon2id hash. */
-
-export declare function argon2Verify(password: string, hash: string): boolean
-
-/**
- * Hash a password with bcrypt (Rust-native).
- * `rounds` defaults to 12 when not supplied — matches the previous
- * warden-engine default and the OWASP-recommended cost floor enforced
- * by `sigil-engine`.
- */
-
-export declare function bcryptHash(password: string, rounds?: number | undefined | null): string
-
-/** Verify a password against a bcrypt hash. */
-
-export declare function bcryptVerify(password: string, hash: string): boolean
-
 /** Constant-time string comparison. */
 
 export declare function constantTimeEq(a: string, b: string): boolean

package/src/profiler/Profiler.ts

@@ -68,7 +68,10 @@ export class Profiler {
     const token = newToken()
     const startedAt = Date.now()
     const started = performance.now()
-    const active: ActiveProfile = { scope: { token, startedAt }, bags: new Map() }
+    const active: ActiveProfile = {
+      scope: { token, startedAt, elapsed: () => performance.now() - started },
+      bags: new Map(),
+    }
 
     for (const collector of this.#collectors) {
       // A collector that throws while starting must not fail the request it was