@crvouga/mockingbird-service-dynamodb 3.10.6 → 3.10.8

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog — @crvouga/mockingbird-service-dynamodb
 
+## 3.10.8 (2026-11-02)
+
+### Fixes and improvements
+
+- compare the admin key in constant time ([2a43141](https://github.com/crvouga/mockingbird/commit/2a43141f50dab41e698c3bbce0c69bf65b40e24e))
+
+## 3.10.7 (2026-11-02)
+
+### Fixes and improvements
+
+- place key-order helpers away from the condition-expression code ([af51e56](https://github.com/crvouga/mockingbird/commit/af51e5649cf406c8b4f7a16a4eb80b5da1fabdcb))
+- order sort keys by DynamoDB's byte order ([7331cc1](https://github.com/crvouga/mockingbird/commit/7331cc1244fa256c82abeba9860589791b03d193))
+
 ## 3.10.6 (2026-11-02)
 
 ### Fixes and improvements

package/dist/{chunk-APTU4NSH.js → chunk-4LTVTO5I.js}

@@ -1778,8 +1778,8 @@ var requestBodyMap = (value) => {
   for (const [path, expected] of Object.entries(value)) {
     if (path === "" || path.split(".").includes(""))
       throw new ControlError(`fault.requestBody: ${JSON.stringify(path)} is not a dotted path`);
-    const scalar2 = expected === null || typeof expected === "string" || typeof expected === "boolean" || typeof expected === "number" && Number.isFinite(expected);
-    if (!scalar2)
+    const scalar = expected === null || typeof expected === "string" || typeof expected === "boolean" || typeof expected === "number" && Number.isFinite(expected);
+    if (!scalar)
       throw new ControlError(`fault.requestBody.${path}: expected a string, number, boolean or null`);
   }
   return value;
@@ -2507,6 +2507,17 @@ var createNamespaceControls = (options) => {
   };
 };
 
+// ../core/dist/signing.js
+var encoder = new TextEncoder();
+var timingSafeEqual = (a, b) => {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+};
+
 // ../core/dist/surface.js
 var defineMock = (runtime) => runtime;
 var ADMIN_ROUTE_REFERENCE = {
@@ -2625,6 +2636,10 @@ var assertAdminPrefixAvailable = (prefix, paths) => {
   }
 };
 var ADMIN_KEY_HEADER = CONTROL_HEADERS.adminKey;
+var hasAdminKey = (headers, adminKey) => {
+  const sent = headers.get(ADMIN_KEY_HEADER);
+  return sent !== null && timingSafeEqual(sent, adminKey);
+};
 var NAMESPACE_HEADER = CONTROL_HEADERS.namespace;
 var ADMIN_DOCS_URL = "https://mockingbird.chrisvouga.dev/docs/admin-controls";
 var ADMIN_CONTROL_PAGES = [
@@ -3098,7 +3113,7 @@ var createControlPlane = (context) => {
       }
       const path = url.pathname.slice(adminPrefix.length) || "/";
       const shell = request.method === "GET" && (path === "/ui" || path === "/ui/");
-      if (!shell && context.adminKey !== void 0 && request.headers.get(ADMIN_KEY_HEADER) !== context.adminKey) {
+      if (!shell && context.adminKey !== void 0 && !hasAdminKey(request.headers, context.adminKey)) {
         return adminError(401, `missing or wrong ${ADMIN_KEY_HEADER}`);
       }
       for (const route of routes) {
@@ -3861,7 +3876,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "3.10.6" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "3.10.8" : UNRELEASED_VERSION;
 
 // ../core/dist/webhooks.js
 var json4 = (status, body) => new Response(JSON.stringify(body), {
@@ -4032,21 +4047,21 @@ var realSleep = (ms, signal) => new Promise((resolve2, reject) => {
   signal?.addEventListener("abort", abort, { once: true });
 });
 var NULL_BODY_STATUS = /* @__PURE__ */ new Set([101, 204, 205, 304]);
-var truncateResponse = (response, bytes2) => {
+var truncateResponse = (response, bytes3) => {
   if (NULL_BODY_STATUS.has(response.status))
     return response;
   const reader = response.body?.getReader();
   let sent = 0;
   const body = new ReadableStream({
     async pull(controller) {
-      const chunk = sent < bytes2 && reader ? await reader.read() : void 0;
+      const chunk = sent < bytes3 && reader ? await reader.read() : void 0;
       if (!chunk || chunk.done) {
         await reader?.cancel().catch(() => {
         });
         controller.error(new DroppedConnectionError("truncate"));
         return;
       }
-      const part = chunk.value.subarray(0, bytes2 - sent);
+      const part = chunk.value.subarray(0, bytes3 - sent);
       sent += part.length;
       controller.enqueue(part);
     },
@@ -4840,7 +4855,7 @@ var createRuntime = (options) => {
         throw error;
       }
       const rewinds = at !== void 0 && selectedBranch === "main" && MUTATING_METHODS.has(request.method);
-      if ((requested || rewinds) && options.adminKey !== void 0 && request.headers.get(ADMIN_KEY_HEADER) !== options.adminKey)
+      if ((requested || rewinds) && options.adminKey !== void 0 && !hasAdminKey(request.headers, options.adminKey))
         return refuse(401, `control headers need ${ADMIN_KEY_HEADER}`);
       controls.ensure(namespace);
       if (requested?.restore !== void 0 && !snapshotStore.get(namespace, requested.restore))
@@ -5515,7 +5530,6 @@ var createRuntime2 = (options = {}) => createRuntime({
 var DYNAMODB_NAMESPACE = "dynamodb";
 var accessKeyCredential = sigV4AccessKeyId;
 var clone = (value) => structuredClone(value);
-var scalar = (value) => value?.S ?? (value?.N !== void 0 ? Number(value.N) : value?.BOOL ?? value?.B);
 var resolveName = (name2, names) => name2.split(".").map((part) => names[part] ?? part).join(".");
 var get = (item, path, names) => {
   const parts = resolveName(path.trim(), names).split(".");
@@ -5538,6 +5552,23 @@ var set = (item, path, value, names) => {
   }
   current[leaf] = clone(value);
 };
+var utf8 = new TextEncoder();
+var bytes2 = (value) => Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+var compareBytes = (left, right) => {
+  for (let i = 0; i < Math.min(left.length, right.length); i++)
+    if (left[i] !== right[i]) return left[i] - right[i];
+  return left.length - right.length;
+};
+var compareKeyValues = (left, right) => {
+  if (left === void 0 || right === void 0)
+    return left === right ? 0 : left === void 0 ? 1 : -1;
+  if (left.N !== void 0 && right.N !== void 0) return Number(left.N) - Number(right.N);
+  if (left.S !== void 0 && right.S !== void 0)
+    return compareBytes(utf8.encode(left.S), utf8.encode(right.S));
+  if (left.B !== void 0 && right.B !== void 0)
+    return compareBytes(bytes2(left.B), bytes2(right.B));
+  return 0;
+};
 var remove = (item, path, names) => {
   const parts = resolveName(path.trim(), names).split(".");
   const leaf = parts.pop();
@@ -5647,10 +5678,8 @@ var DynamoAPI = class {
   }
   compare(table, left, right, schema = table.keySchema) {
     for (const key of schema) {
-      const a = scalar(left[key.AttributeName]);
-      const b = scalar(right[key.AttributeName]);
-      if (a === b) continue;
-      return a !== void 0 && b !== void 0 && a < b ? -1 : 1;
+      const order2 = compareKeyValues(left[key.AttributeName], right[key.AttributeName]);
+      if (order2 !== 0) return order2 < 0 ? -1 : 1;
     }
     return 0;
   }
@@ -5999,4 +6028,4 @@ export {
   accessKeyCredential,
   DynamoAPI
 };
-//# sourceMappingURL=chunk-APTU4NSH.js.map
+//# sourceMappingURL=chunk-4LTVTO5I.js.map