npm - @convex-dev/ai-budget - Versions diffs - 0.0.2-alpha.6 → 0.0.2-alpha.8 - Mend

@convex-dev/ai-budget 0.0.2-alpha.6 → 0.0.2-alpha.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/client/dashboard.js CHANGED Viewed

@@ -54,8 +54,16 @@ export const DASHBOARD_HTML = String.raw `<!doctype html>
 </nav>
 <main id="main"></main>
 <script>
-const API = "__API_BASE__";
-const TOKEN = "__TOKEN__";
+// Injected as JSON literals by registerRoutes (no surrounding quotes here).
+const API = __API_BASE__;
+const TOKEN = __TOKEN__;
+// If we were opened with ?token=… (needed for the initial navigation, which
+// can't set headers), drop it from the address bar so it doesn't linger in
+// history; API calls below use the Authorization header instead.
+try {
+  const u = new URL(location.href);
+  if (u.searchParams.has("token")) { u.searchParams.delete("token"); history.replaceState(null, "", u.toString()); }
+} catch (e) {}
 const H = TOKEN ? { Authorization: "Bearer " + TOKEN } : {};
 const NANOS = 1e9;
 const usd = (n) => n == null ? "—" : "$" + (n / NANOS).toFixed(n && n < NANOS/100 ? 6 : 2);

package/dist/client/index.js CHANGED Viewed

@@ -96,6 +96,17 @@ function extractText(result) {
     }
     return "";
 }
+// ---------- client ----------
+// Length-independent-branch string compare, so the dashboard token check
+// doesn't leak the token via response timing. (Length itself is not secret.)
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let r = 0;
+    for (let i = 0; i < a.length; i++)
+        r |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return r === 0;
+}
 export class AIBudget {
     component;
     defaultModel;
@@ -485,8 +496,11 @@ export class AIBudget {
                 return { ok: false, token: "" };
             const url = new URL(request.url);
             const bearer = (request.headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
+            // `?token=` is accepted only for the initial page navigation (a browser
+            // GET can't set headers); the page strips it from the URL on load and the
+            // JSON API is called with the bearer header. Compared in constant time.
             const provided = bearer || url.searchParams.get("token") || "";
-            return { ok: provided === token, token };
+            return { ok: timingSafeEqual(provided, token), token };
         };
         const json = (data, status = 200) => new Response(JSON.stringify(data ?? null), {
             status,
@@ -548,7 +562,10 @@ export class AIBudget {
                         return json({ error: "not found" }, 404);
                 }
             }
-            const html = DASHBOARD_HTML.replace(/__API_BASE__/g, `${prefix}/api`).replace(/__TOKEN__/g, token);
+            // Inject as JSON literals (function replacers so `$` in the value isn't
+            // treated as a replacement pattern). This keeps a token/prefix containing
+            // quotes, backslashes, or `</script>` from breaking out of the JS string.
+            const html = DASHBOARD_HTML.replace(/__API_BASE__/g, () => JSON.stringify(`${prefix}/api`)).replace(/__TOKEN__/g, () => JSON.stringify(token));
             return new Response(html, {
                 headers: { "content-type": "text/html; charset=utf-8" },
             });

package/package.json CHANGED Viewed

@@ -7,7 +7,7 @@
     "email": "support@convex.dev",
     "url": "https://github.com/get-convex/ai-budget/issues"
   },
-  "version": "0.0.2-alpha.6",
+  "version": "0.0.2-alpha.8",
   "license": "Apache-2.0",
   "type": "module",
   "keywords": [

package/src/client/dashboard.ts CHANGED Viewed

@@ -54,8 +54,16 @@ export const DASHBOARD_HTML = String.raw`<!doctype html>
 </nav>
 <main id="main"></main>
 <script>
-const API = "__API_BASE__";
-const TOKEN = "__TOKEN__";
+// Injected as JSON literals by registerRoutes (no surrounding quotes here).
+const API = __API_BASE__;
+const TOKEN = __TOKEN__;
+// If we were opened with ?token=… (needed for the initial navigation, which
+// can't set headers), drop it from the address bar so it doesn't linger in
+// history; API calls below use the Authorization header instead.
+try {
+  const u = new URL(location.href);
+  if (u.searchParams.has("token")) { u.searchParams.delete("token"); history.replaceState(null, "", u.toString()); }
+} catch (e) {}
 const H = TOKEN ? { Authorization: "Bearer " + TOKEN } : {};
 const NANOS = 1e9;
 const usd = (n) => n == null ? "—" : "$" + (n / NANOS).toFixed(n && n < NANOS/100 ? 6 : 2);

package/src/client/index.ts CHANGED Viewed

@@ -221,6 +221,15 @@ function extractText(result: any): string {
 // ---------- client ----------
+// Length-independent-branch string compare, so the dashboard token check
+// doesn't leak the token via response timing. (Length itself is not secret.)
+function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let r = 0;
+  for (let i = 0; i < a.length; i++) r |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return r === 0;
+}
 /** Limits/controls settable on any budget bucket (user, action, or tag). */
 export type BucketLimits = {
   requestsPerMinute?: number;
@@ -756,8 +765,11 @@ export class AIBudget {
       if (!token) return { ok: false, token: "" };
       const url = new URL(request.url);
       const bearer = (request.headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
+      // `?token=` is accepted only for the initial page navigation (a browser
+      // GET can't set headers); the page strips it from the URL on load and the
+      // JSON API is called with the bearer header. Compared in constant time.
       const provided = bearer || url.searchParams.get("token") || "";
-      return { ok: provided === token, token };
+      return { ok: timingSafeEqual(provided, token), token };
     };
     const json = (data: unknown, status = 200) =>
       new Response(JSON.stringify(data ?? null), {
@@ -827,10 +839,13 @@ export class AIBudget {
         }
       }
-      const html = DASHBOARD_HTML.replace(/__API_BASE__/g, `${prefix}/api`).replace(
-        /__TOKEN__/g,
-        token
-      );
+      // Inject as JSON literals (function replacers so `$` in the value isn't
+      // treated as a replacement pattern). This keeps a token/prefix containing
+      // quotes, backslashes, or `</script>` from breaking out of the JS string.
+      const html = DASHBOARD_HTML.replace(
+        /__API_BASE__/g,
+        () => JSON.stringify(`${prefix}/api`)
+      ).replace(/__TOKEN__/g, () => JSON.stringify(token));
       return new Response(html, {
         headers: { "content-type": "text/html; charset=utf-8" },
       });