@c9up/transit 0.1.1 → 0.1.3

package/src/vendor/quasarConnection.ts

@@ -0,0 +1,129 @@
+// Generated from scripts/vendor/quasarConnection.ts — do not edit.
+//
+// This package is published and built from its own repository, so the file
+// has to exist here rather than be imported. `pnpm vendor:sync` rewrites it,
+// and `pnpm vendor:check` fails if this copy has drifted from the original.
+
+/**
+ * Resolving a Redis connection by name, from `@c9up/quasar`.
+ *
+ * No package here depends on quasar: it is an optional peer, and this module
+ * never imports it statically — the specifier is built at runtime so the
+ * TypeScript build stays free of it too. A host that never names a connection
+ * neither installs it nor pays for it.
+ *
+ * What varies between callers is passed in rather than copied: which commands
+ * they will issue, and what they are doing with them. Both end up in the
+ * message, because "the connection is missing lpop" is only useful next to
+ * "which the queue's atomic pop issues".
+ */
+
+/** The slice of quasar's manager this needs: a connection, by name. */
+interface ConnectionSource {
+	connection(name?: string): unknown;
+}
+
+/**
+ * Read a member without assuming how the object answers.
+ *
+ * Two shapes have to work, and they disagree about `in`. Quasar's accessor is
+ * a Proxy over an empty null-prototype object with only a `get` trap, so
+ * `"connection" in manager` is FALSE while reading it returns the function —
+ * gating on `in` rejected the real manager. And a module namespace under a
+ * test double RAISES for an export it does not have, rather than answering
+ * undefined, so a bare read fails on the mock. Reading through a catch is what
+ * satisfies both.
+ */
+function readMember(value: unknown, name: string): unknown {
+	if (typeof value !== "object" || value === null) return undefined;
+	try {
+		return Reflect.get(value, name);
+	} catch {
+		return undefined;
+	}
+}
+
+function isConnectionSource(value: unknown): value is ConnectionSource {
+	return typeof readMember(value, "connection") === "function";
+}
+
+export interface QuasarConnectionRequest {
+	/** The package asking. It prefixes every message this can raise. */
+	pkg: string;
+	/**
+	 * How this package builds an error.
+	 *
+	 * Not optional, and not `new Error` by default: a package with its own
+	 * error type carries codes (`E_<PKG>_<REASON>`) that a caller catches on,
+	 * and a shared helper throwing a bare Error would silently drop them. The
+	 * two reasons are distinguished so the codes can be too.
+	 */
+	raise: (
+		reason: "quasar-missing" | "incomplete-connection",
+		message: string,
+		cause?: unknown,
+	) => Error;
+	/** Connection name, or `undefined` for quasar's default. */
+	name?: string;
+	/** The commands the caller will actually issue. */
+	required: readonly string[];
+	/** What the caller does with them, for the message that names a gap. */
+	what: string;
+	/**
+	 * A second way out, when this package has one.
+	 *
+	 * Several of them accept a client object directly, so "pass a client
+	 * instead of a connection name" is actionable — and it was in each
+	 * package's own message before this was shared. Dropping it to unify the
+	 * wording would have made the error strictly less useful.
+	 */
+	alternative?: string;
+}
+
+/**
+ * The named connection, checked for the commands the caller needs BEFORE it is
+ * handed over — a connection missing one would otherwise fail on the first
+ * command, far from the line that asked for it.
+ */
+export async function quasarConnection<T>(
+	request: QuasarConnectionRequest,
+): Promise<T> {
+	const { pkg, name, required, what, raise, alternative } = request;
+	const specifier = "@c9up/quasar/services/main";
+	let loaded: unknown;
+	try {
+		loaded = await import(/* @vite-ignore */ specifier);
+	} catch (cause) {
+		throw raise(
+			"quasar-missing",
+			`[${pkg}] ${what} asks for the quasar connection "${name ?? "default"}", but @c9up/quasar is not installed.\n` +
+				`  pnpm add @c9up/quasar${alternative ? `, ${alternative}` : ""}`,
+			cause,
+		);
+	}
+
+	const manager = isConnectionSource(loaded)
+		? loaded
+		: Reflect.get(Object(loaded), "default");
+	if (!isConnectionSource(manager)) {
+		throw raise(
+			"quasar-missing",
+			`[${pkg}] @c9up/quasar/services/main did not expose a connection() manager`,
+		);
+	}
+
+	const connection = manager.connection(name);
+	const missing = required.filter(
+		(command) => typeof readMember(connection, command) !== "function",
+	);
+	if (missing.length > 0) {
+		throw raise(
+			"incomplete-connection",
+			`[${pkg}] the quasar connection${name ? ` '${name}'` : ""} is missing ${missing.join(", ")}, which ${what} issues`,
+		);
+	}
+	// Load-bearing: every member of `required` has just been checked to be a
+	// function on this object. The caller names the type it needs because only
+	// the caller knows which commands it asked for.
+	return connection as T;
+}

package/src/xml.ts

@@ -74,13 +74,48 @@ class XmlError extends Error {
 	}
 }
 
+/**
+ * What a document is allowed to cost.
+ *
+ * A SAML response is parsed BEFORE its signature is checked — it has to be,
+ * since the signature is inside it — so every one of these bounds applies to
+ * bytes an unauthenticated caller chose. Without them a single POST could
+ * exhaust the heap, or nest deeply enough to overflow the stack in `#element`,
+ * which recurses once per level.
+ */
+export interface XmlLimits {
+	/** Characters in the document. Default 1 MiB — a large SAML response is tens of KiB. */
+	maxLength?: number;
+	/** Nesting levels. Default 100; the recursion is one frame per level. */
+	maxDepth?: number;
+	/** Elements, text runs, comments and instructions, together. Default 50 000. */
+	maxNodes?: number;
+	/** Attributes on one element. Default 256. */
+	maxAttributes?: number;
+}
+
+const DEFAULT_LIMITS: Required<XmlLimits> = {
+	maxLength: 1024 * 1024,
+	maxDepth: 100,
+	maxNodes: 50_000,
+	maxAttributes: 256,
+};
+
 /** Parse a document and return its root element. */
-export function parseXml(source: string): XmlElement {
+export function parseXml(source: string, limits?: XmlLimits): XmlElement {
+	const resolved = { ...DEFAULT_LIMITS, ...limits };
+	// Checked before the copy below, not after: normalising duplicates the whole
+	// string, so a 300 MB body cost 600 MB before anything looked at its size.
+	if (source.length > resolved.maxLength) {
+		throw new XmlError(
+			`the document is ${source.length} characters, over the ${resolved.maxLength} allowed`,
+		);
+	}
 	// Line endings are normalised before parsing, as the canonicalization
 	// specification requires — otherwise the same document signed on one
 	// platform digests differently on another.
 	const input = source.replace(/\r\n?/g, "\n");
-	const parser = new Parser(input);
+	const parser = new Parser(input, resolved);
 	return parser.document();
 }
 
@@ -151,7 +186,22 @@ export function textOf(element: XmlElement): string {
 
 class Parser {
 	#at = 0;
-	constructor(private readonly source: string) {}
+	/** Nodes built so far, across the whole document. */
+	#nodes = 0;
+	constructor(
+		private readonly source: string,
+		private readonly limits: Required<XmlLimits>,
+	) {}
+
+	/** Count one node, and refuse a document that keeps producing them. */
+	#node(): void {
+		this.#nodes += 1;
+		if (this.#nodes > this.limits.maxNodes) {
+			throw new XmlError(
+				`the document has more than ${this.limits.maxNodes} nodes`,
+			);
+		}
+	}
 
 	document(): XmlElement {
 		let root: XmlElement | undefined;
@@ -184,7 +234,17 @@ class Parser {
 		return root;
 	}
 
-	#element(parent: XmlElement | undefined): XmlElement {
+	#element(parent: XmlElement | undefined, depth = 0): XmlElement {
+		// Checked on the way IN: `#element` recurses once per level, so a
+		// document nested deeply enough overflowed the stack before any of this
+		// ran — and the stack it overflows is the one holding the signature check
+		// that has not happened yet.
+		if (depth > this.limits.maxDepth) {
+			throw new XmlError(
+				`the document nests deeper than ${this.limits.maxDepth}`,
+			);
+		}
+		this.#node();
 		this.#expect("<");
 		const qname = this.#name();
 		const element: XmlElement = {
@@ -210,6 +270,11 @@ class Parser {
 			this.#expect("=");
 			this.#skipSpace();
 			raw.push({ qname: name, value: this.#attributeValue() });
+			if (raw.length > this.limits.maxAttributes) {
+				throw new XmlError(
+					`element <${qname}> carries more than ${this.limits.maxAttributes} attributes`,
+				);
+			}
 		}
 
 		for (const { qname: name, value } of raw) {
@@ -289,6 +354,7 @@ class Parser {
 			if (this.#peek("<!--")) {
 				const end = this.source.indexOf("-->", this.#at);
 				if (end === -1) throw new XmlError("a comment is never closed");
+				this.#node();
 				element.children.push({
 					type: "comment",
 					value: this.source.slice(this.#at + 4, end),
@@ -299,6 +365,7 @@ class Parser {
 			if (this.#peek("<![CDATA[")) {
 				const end = this.source.indexOf("]]>", this.#at);
 				if (end === -1) throw new XmlError("a CDATA section is never closed");
+				this.#node();
 				element.children.push({
 					type: "text",
 					value: this.source.slice(this.#at + 9, end),
@@ -315,6 +382,7 @@ class Parser {
 					throw new XmlError("a processing instruction is never closed");
 				const body = this.source.slice(this.#at + 2, end);
 				const space = body.search(/\s/);
+				this.#node();
 				element.children.push({
 					type: "instruction",
 					target: space === -1 ? body : body.slice(0, space),
@@ -324,11 +392,12 @@ class Parser {
 				continue;
 			}
 			if (this.#peek("<")) {
-				element.children.push(this.#element(element));
+				element.children.push(this.#element(element, depth + 1));
 				continue;
 			}
 			const next = this.source.indexOf("<", this.#at);
 			const end = next === -1 ? this.source.length : next;
+			this.#node();
 			element.children.push({
 				type: "text",
 				value: resolveEntities(this.source.slice(this.#at, end)),

package/dist/nodeEnv.d.ts

@@ -1,17 +0,0 @@
-/**
- * Reading `NODE_ENV`, with the aliases people actually set.
- *
- * `NODE_ENV=prod` is ordinary in a Dockerfile or a platform dashboard. Read
- * verbatim it answers "not production" — and here that means the in-process
- * SAML replay store is accepted on a production deployment, where it bounds
- * replay within one replica and not beyond it.
- *
- * Duplicated rather than imported: transit depends on no other package in this
- * workspace, and a security decision that only holds when an optional peer is
- * installed is not a decision.
- */
-/** The canonical name for whatever `NODE_ENV` holds. */
-export declare function normalizeNodeEnv(value: string | undefined): string;
-/** Whether this process is running in production, under any spelling. */
-export declare function inProduction(): boolean;
-//# sourceMappingURL=nodeEnv.d.ts.map

package/dist/nodeEnv.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"nodeEnv.d.ts","sourceRoot":"","sources":["../src/nodeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAOlE;AAED,yEAAyE;AACzE,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}

package/dist/nodeEnv.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"nodeEnv.js","sourceRoot":"","sources":["../src/nodeEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACzC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAEtC,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACjD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY;IAC3B,OAAO,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC;AAChE,CAAC"}