@elytracms/studio 0.0.71 → 0.0.72

package/convex/cms.ts

@@ -3,6 +3,7 @@ import { foldDocument, unfoldDocument } from '@elytracms/core/cms-core'
 import type { CmsDocument } from '@elytracms/core/cms-core'
 import { mutation, query } from './functions'
 import { requireCapability } from './guard'
+import { assertWithinWriteLimits } from './write-limits'
 
 /**
  * CMS document persistence (EC-043). The backend stores **documents only**
@@ -44,6 +45,11 @@ export const upsertDocument = mutation({
   },
   handler: async (ctx, args) => {
     await requireCapability(ctx, 'content.write') // EC-150
+    // EC-304 B-4: defensive server-side depth/byte clamp at the `v.any()` chokepoint,
+    // BEFORE fold/write. Rejects abusive structurally-deep / oversized payloads that a
+    // direct Convex call (bypassing the client-side lens) could otherwise land. Limits
+    // are generous — legitimate content never trips them (see write-limits.ts).
+    assertWithinWriteLimits(args.document, 'document')
     // EC-260: fold for storage. `args.document` arrives UNFOLDED over the 64-level
     // arg wire; the trigger unfolds before extracting references, so folding here
     // (strictly before the `ctx.db` write) never hides a reference from the walker.
@@ -134,6 +140,8 @@ export const saveDocumentVersion = mutation({
   },
   handler: async (ctx, args) => {
     await requireCapability(ctx, 'content.write') // EC-150
+    // EC-304 B-4: same defensive depth/byte clamp on the version snapshot chokepoint.
+    assertWithinWriteLimits(args.snapshot, 'snapshot')
     // EC-302: versions are appended monotonically, so the latest-created row holds
     // the highest version. Read just that one (index-ordered, newest first) instead
     // of collecting the whole — unbounded — history to compute `max+1`.

package/convex/delivery.ts

@@ -1,6 +1,7 @@
 import { v } from 'convex/values'
 import { unfoldValue } from '@elytracms/core/cms-core'
 import { dataSourceSchema } from '@elytracms/core/data-binding'
+import { safeParseTotal } from '@elytracms/core/project-graph'
 import { query } from './functions'
 import type { QueryCtx } from './functions'
 import { requireCapability } from './guard'
@@ -95,8 +96,17 @@ const PROVIDER_FUNCTION_PREFIX = 'provider:'
  * - `rest`-kind sources never leave the deployment (their headers could hold
  *   credentials), and the captured sample/schema envelope (builder preview
  *   state, not delivery config) is stripped for every kind.
+ *
+ * EC-304 B-1: this runs on the PUBLIC `delivery:snapshot` read path, so it must
+ * NEVER throw — a hostile `cms-data-sources` row whose `values.config` decodes to a
+ * multi-thousand-deep JSON payload would overflow the recursive `dataSourceSchema`
+ * and make a plain `.safeParse` THROW a `RangeError`, escaping `loadSnapshot` and
+ * 500-ing the public query for every page of the live site. Both parses here degrade
+ * instead: `JSON.parse` is already `try`/`catch`-guarded, and `safeParseTotal`
+ * turns the schema-side stack overflow into the ordinary `!success` skip below.
+ * (Exported for the EC-304 regression pin.)
  */
-function dataSourcesFromSystemCollection(documents: unknown[]): unknown[] {
+export function dataSourcesFromSystemCollection(documents: unknown[]): unknown[] {
   const sources: unknown[] = []
   for (const document of documents) {
     if (typeof document !== 'object' || document === null) continue
@@ -112,7 +122,7 @@ function dataSourcesFromSystemCollection(documents: unknown[]): unknown[] {
     } catch {
       continue
     }
-    const parsed = dataSourceSchema.safeParse(raw)
+    const parsed = safeParseTotal(dataSourceSchema, raw)
     if (!parsed.success) continue
     const source = parsed.data
     if (source.kind === 'rest') continue

package/convex/write-limits.ts

@@ -0,0 +1,62 @@
+import { MAX_UNFOLDED_DOCUMENT_DEPTH, measureMaxDepth } from '@elytracms/core/cms-core'
+
+/**
+ * EC-304 B-4 — a defensive server-side shape/size clamp at the `v.any()` write
+ * chokepoint (`cms:upsertDocument` / `saveDocumentVersion`).
+ *
+ * The canonical Zod write-time lens runs CLIENT-side (the operations layer); a direct
+ * Convex call bypasses it and lands `document`/`snapshot` as `v.any()`. This clamp
+ * re-checks depth + byte size at the Convex trust boundary before `foldDocument`/write.
+ * It is a defensive bound at the EXISTING boundary — NOT a new write path or authority
+ * (the write still requires `content.write`; this only rejects abusive payloads).
+ *
+ * IMPORTANT — this does NOT close EC-304 B-1. B-1's payload hides a deep JSON string
+ * INSIDE a single field-value STRING leaf, so the document is structurally shallow at
+ * this chokepoint and a document-structure depth clamp never sees it. B-1's guard is
+ * the read-side `safeParseTotal` wrap in `delivery.ts` + the rich-text parses. This
+ * clamp only bounds structurally-deep and oversized documents (belt-and-suspenders).
+ *
+ * The limits are deliberately generous — they must NEVER reject legitimate content:
+ *
+ * - DEPTH: `MAX_UNFOLDED_DOCUMENT_DEPTH` (62), the ceiling an unfolded document can
+ *   even cross the Convex mutation-arg wire at (the EC-260 codec folds deep field
+ *   values only for STORAGE; the arg wire is the hard limit). Real content's deepest
+ *   measured nesting is ≈ 29, and the client lens already errors at 63, so this fires
+ *   only on pathological nesting — and converts the otherwise-opaque Convex wire
+ *   rejection into a clear, actionable error. `measureMaxDepth` is safe to run here:
+ *   Convex bounds arg depth at 64, so the received value is never deep enough to
+ *   overflow the measure itself.
+ * - BYTES: 1 MiB, Convex's own per-document value cap. A legitimate document body is
+ *   ≈ 20 KB, so this has ~50× head-room; it only pre-empts the storage-abuse case
+ *   with a clear error instead of an opaque backend failure. `JSON.stringify` is safe
+ *   because the depth check runs first (≤ 62 deep cannot overflow the serializer).
+ */
+export const MAX_WRITE_DOCUMENT_DEPTH = MAX_UNFOLDED_DOCUMENT_DEPTH
+
+/** Convex's documented per-document value size cap (1 MiB). */
+export const MAX_WRITE_DOCUMENT_BYTES = 1_048_576
+
+/**
+ * Throw when `value` exceeds the depth or byte clamp. `label` names the offending
+ * field for the error message (e.g. `"document"` / `"snapshot"`). Runs BEFORE
+ * `foldDocument` and the `ctx.db` write, so an abusive payload never reaches storage.
+ */
+export function assertWithinWriteLimits(value: unknown, label: string): void {
+  const { depth } = measureMaxDepth(value)
+  if (depth > MAX_WRITE_DOCUMENT_DEPTH) {
+    throw new Error(
+      `${label} nests ${depth} levels deep, past the ${MAX_WRITE_DOCUMENT_DEPTH}-level write limit — split it into smaller linked documents.`,
+    )
+  }
+  const bytes = byteLength(JSON.stringify(value))
+  if (bytes > MAX_WRITE_DOCUMENT_BYTES) {
+    throw new Error(
+      `${label} is ${bytes} bytes, past the ${MAX_WRITE_DOCUMENT_BYTES}-byte (1 MiB) write limit.`,
+    )
+  }
+}
+
+/** UTF-8 byte length of a string, using the web-standard `TextEncoder` (available in Convex). */
+function byteLength(text: string): number {
+  return new TextEncoder().encode(text).length
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@elytracms/studio",
   "author": "finaldream <hi@finaldream.de>",
-  "version": "0.0.71",
+  "version": "0.0.72",
   "private": false,
   "description": "The Elytra studio engine (UI + lib + routes + data-only Convex schema) as an importable package. Extraction staged in EXTRACTION.md (EC-223); Stages 1-2 = UI primitives + router-free lib leaves.",
   "license": "MIT",
@@ -150,7 +150,7 @@
     "lucide-react": "^1.23.0",
     "tailwind-merge": "^3.6.0",
     "zod": "^4.4.3",
-    "@elytracms/core": "^0.0.71"
+    "@elytracms/core": "^0.0.72"
   },
   "peerDependencies": {
     "@tanstack/react-router": "^1.170.0",