@calimero-network/mero-js 19.24.0 → 19.25.0

package/dist/sealed/sealed.d.ts

@@ -52,8 +52,12 @@ export declare class StaleTransportKeyError extends Error {
 export declare class SealedTransportError extends Error {
     status: number;
     code: string | undefined;
+    /** How long the node asked to wait before retrying (`Retry-After`), if it did. */
+    retryAfterMs?: number;
     name: string;
-    constructor(status: number, code: string | undefined, message: string);
+    constructor(status: number, code: string | undefined, message: string, 
+    /** How long the node asked to wait before retrying (`Retry-After`), if it did. */
+    retryAfterMs?: number);
 }
 /**
  * What the attest endpoint puts in report data bytes `32..64` when asked to

package/dist/sealed/sealed.js

@@ -50,6 +50,14 @@ const HEADER_LEN = 1 + SESSION_ID_LEN + 8;
 const FRAME_HEAD = 0;
 const FRAME_DATA = 1;
 const FRAME_END = 2;
+/**
+ * The largest frame the node sends: a kind byte, at most 64 KiB of data, a tag.
+ * Anything larger is refused before it is buffered, so a proxy cannot make the
+ * client hold an unbounded frame it has yet to authenticate.
+ */
+const MAX_FRAME_LEN = 1 + 64 * 1024 + 16;
+/** Far more than a handshake reply (69 bytes) ever is. */
+const MAX_HANDSHAKE_REPLY = 1024;
 /** Open a new session this long before the node would drop the current one. */
 const RENEW_BEFORE_MS = 60000;
 const TRANSPORT_BINDING_DOMAIN = 'calimero.tee-attest.transport-key.v1';
@@ -64,10 +72,13 @@ export class StaleTransportKeyError extends Error {
 }
 /** The node refused the envelope itself, before anything inside it ran. */
 export class SealedTransportError extends Error {
-    constructor(status, code, message) {
+    constructor(status, code, message, 
+    /** How long the node asked to wait before retrying (`Retry-After`), if it did. */
+    retryAfterMs) {
         super(message);
         this.status = status;
         this.code = code;
+        this.retryAfterMs = retryAfterMs;
         this.name = 'SealedTransportError';
     }
 }
@@ -205,6 +216,19 @@ async function checkedKey(key) {
     return bytes;
 }
 async function handshake(baseFetch, nodeUrl, transportKey) {
+    try {
+        return await handshakeOnce(baseFetch, nodeUrl, transportKey);
+    }
+    catch (error) {
+        // The node limits how fast sessions open. A refused handshake opened
+        // nothing, so trying once more after the pause it asks for is safe.
+        if (!(error instanceof SealedTransportError) || error.code !== 'busy')
+            throw error;
+        await new Promise((resolve) => setTimeout(resolve, error.retryAfterMs ?? 1000));
+        return handshakeOnce(baseFetch, nodeUrl, transportKey);
+    }
+}
+async function handshakeOnce(baseFetch, nodeUrl, transportKey) {
     const noise = await initiate(transportKey, PROLOGUE);
     const response = await baseFetch(`${nodeUrl}${HANDSHAKE_PATH}`, {
         method: 'POST',
@@ -214,7 +238,7 @@ async function handshake(baseFetch, nodeUrl, transportKey) {
     if (response.headers.get('content-type') !== SEALED_CONTENT_TYPE) {
         throw await envelopeRefusal(response);
     }
-    const reply = new Uint8Array(await response.arrayBuffer());
+    const reply = await readAtMost(response, MAX_HANDSHAKE_REPLY);
     return sessionFrom(noise, reply);
 }
 /** Finish the handshake with the node's reply. Exported for the published vectors. */
@@ -353,6 +377,10 @@ function frameReader(reader) {
             if (!(await fill(4)))
                 return null;
             const length = new DataView(buffer.buffer, buffer.byteOffset).getUint32(0, false);
+            if (length > MAX_FRAME_LEN) {
+                await reader.cancel();
+                throw new Error('The sealed response is malformed: a frame is larger than the node sends');
+            }
             if (!(await fill(4 + length)))
                 return null;
             const frame = buffer.slice(4, 4 + length);
@@ -362,6 +390,23 @@ function frameReader(reader) {
         cancel: () => reader.cancel(),
     };
 }
+/** Read a body, refusing one longer than `limit` rather than buffering it. */
+async function readAtMost(response, limit) {
+    if (!response.body)
+        return new Uint8Array();
+    const reader = response.body.getReader();
+    let bytes = new Uint8Array();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            return bytes;
+        bytes = concat(bytes, value);
+        if (bytes.length > limit) {
+            await reader.cancel();
+            throw new Error('The handshake reply is malformed: it is too long');
+        }
+    }
+}
 async function envelopeRefusal(response) {
     let code;
     let message = `Sealed request refused: HTTP ${response.status}`;
@@ -377,5 +422,7 @@ async function envelopeRefusal(response) {
     }
     if (code === 'stale_transport_key')
         return new StaleTransportKeyError();
-    return new SealedTransportError(response.status, code, message);
+    const retryAfter = Number(response.headers.get('retry-after'));
+    const retryAfterMs = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter, 5) * 1000 : undefined;
+    return new SealedTransportError(response.status, code, message, retryAfterMs);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "19.24.0",
+  "version": "19.25.0",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {