@fabrika/app 0.5.5 → 0.7.0

package/src/implement/bounded.ts

@@ -70,3 +70,26 @@ export async function readBoundedBytes(stream: ReadableStream<Uint8Array> | null
 		signal?.removeEventListener('abort', cancel)
 	}
 }
+
+/** `body` passed on as it streams, failed once more than `maxBytes` went through; `exceeded` tells that failure apart. */
+export function boundedStream(body: ReadableStream<Uint8Array>, maxBytes: number): {
+	readonly stream: ReadableStream<Uint8Array>
+	exceeded(): boolean
+} {
+	let size = 0
+	let over = false
+	const stream = body.pipeThrough(
+		new TransformStream<Uint8Array, Uint8Array>({
+			transform(chunk, controller) {
+				size += chunk.byteLength
+				if (size > maxBytes) {
+					over = true
+					controller.error(new Error(`the body is longer than ${maxBytes} bytes`))
+					return
+				}
+				controller.enqueue(chunk)
+			},
+		}),
+	)
+	return { stream, exceeded: () => over }
+}

package/src/implement/browser-config.ts

@@ -11,7 +11,7 @@ export interface BrowserConfig {
 	/** `FABRIKA_ENVIRONMENT`, which the page's error reports carry, or `null` when unset. */
 	readonly environment: string | null
 	/**
-	 * Every form challenge's site key, and the variables the mount lists in `public`, by variable name. Absent when
+	 * Every public procedure challenge's site key, and the variables the mount lists in `public`, by variable name. Absent when
 	 * there is none, so the file of an application without them holds the three Operations values only.
 	 */
 	readonly public?: Readonly<Record<string, string>>
@@ -33,11 +33,11 @@ export function browserConfigs(
 		return typeof value === 'string' && value.trim() !== '' ? value : null
 	}
 	const siteKeys: Record<string, string> = {}
-	for (const [form, mount] of Object.entries(artifact.mounts)) {
-		const challenge = mount.kind === 'form' ? mount.challenge : undefined
+	for (const [id, procedure] of Object.entries(artifact.procedures ?? {})) {
+		const challenge = procedure.challenge
 		if (challenge?.siteKey === undefined) continue
 		const value = valueOf(challenge.siteKey)
-		if (value === null) problems.push(`form '${form}' names its ${challenge.provider} site key in ${challenge.siteKey}, which is not set`)
+		if (value === null) problems.push(`procedure '${id}' names its ${challenge.provider} site key in ${challenge.siteKey}, which is not set`)
 		else siteKeys[challenge.siteKey] = value
 	}
 	const configs = new Map<string, BrowserConfig>()

package/src/implement/capability.ts

@@ -15,6 +15,8 @@ import {
 	MAX_WITHIN_VALUES,
 	type Ref as RefCapability,
 	type RefGrant,
+	type RowGrant,
+	type RowRef as RowRefCapability,
 	type Within as WithinCapability,
 	type WithinGrant,
 } from '@fabrika/db/capability'
@@ -28,8 +30,13 @@ export const CAPABILITY_REFUSALS = {
 	wrong_target: "an IAM request was not passed this request's ctx.target",
 	undeclared_action: "the job's declaration or its token does not carry the action",
 	undeclared_dimension: 'the job named a dimension the contract does not declare',
+	undeclared_kick: 'the site kicked a job it does not declare in kicks',
+	undeclared_binding: 'the site named a webhook it does not declare in binds',
+	undeclared_signs: 'the site signed a token of a purpose it does not declare in signs, or for longer than the purpose allows',
+	undeclared_egress: 'the site called an origin it does not declare in egress',
+	wrong_binding: 'a webhook binding was handed a capability of another kind or dimension than the webhook is bound to',
 	missing_id: 'the job named an object without an id',
-	wrong_capability: 'a file collection was handed a capability of another dimension or action than the operation needs',
+	wrong_capability: 'an operation was handed a capability of another dimension or action than it needs',
 } as const
 
 export type CapabilityRefusal = keyof typeof CAPABILITY_REFUSALS
@@ -173,6 +180,7 @@ interface Bound {
 let readRef: (value: unknown) => Bound | undefined = () => undefined
 let readWithin: (value: unknown) => Bound | undefined = () => undefined
 let readApp: (value: unknown) => Bound | undefined = () => undefined
+let readRow: (value: unknown) => Bound | undefined = () => undefined
 
 /** One authorized object for one action, in one request. `chain` holds the containers the object lies in. */
 export class Ref<D extends string, A extends string> implements RefCapability<D, A> {
@@ -344,10 +352,70 @@ export class AppCapability<A extends string> implements AppCapabilityType<A> {
 	}
 }
 
+interface RowFacts {
+	readonly table: string
+	readonly action: string
+	readonly principal: string
+	readonly id: string
+	readonly chain: Chain
+}
+
+/**
+ * One row a claim leased, for one action, in one job attempt: `row.ref`, which `tx.db.on(row.ref)` finishes the row
+ * through. `chain` holds the row's containment columns as it was claimed.
+ */
+export class RowRef<T extends string, A extends string> implements RowRefCapability<T, A> {
+	declare readonly '~capability': { readonly kind: 'row'; readonly table: T; readonly action: A }
+	readonly #facts: RowFacts
+	readonly #frame: RequestFrame
+	readonly #issuer: object
+
+	constructor(token: typeof MINT, issuer: object, frame: RequestFrame, grant: Omit<RowGrant, 'kind'>) {
+		if (token !== MINT) {
+			throw new CapabilityRefusedError('not_minted', 'a row capability is minted by the framework only: claim the row')
+		}
+		this.#facts = freeze({ table: grant.table, action: grant.action, principal: grant.principal, id: grant.id, chain: chainOf(grant.chain) })
+		this.#frame = frame
+		this.#issuer = issuer
+	}
+
+	get table(): string {
+		return this.#facts.table
+	}
+
+	get action(): string {
+		return this.#facts.action
+	}
+
+	/** The row's key. */
+	get value(): string {
+		return this.#facts.id
+	}
+
+	static {
+		readRow = (value) => {
+			if (typeof value !== 'object' || value === null || !(#facts in value)) {
+				return undefined
+			}
+			const facts = value.#facts
+			const grant: RowGrant = freeze({
+				kind: 'row',
+				table: facts.table,
+				action: facts.action,
+				principal: facts.principal,
+				id: facts.id,
+				chain: mapOf(facts.chain),
+			})
+			return { grant, frame: value.#frame, issuer: value.#issuer }
+		}
+	}
+}
+
 // Application code could otherwise redefine a getter that the framework or a handler reads.
 freeze(Ref.prototype)
 freeze(Within.prototype)
 freeze(AppCapability.prototype)
+freeze(RowRef.prototype)
 
 /** Makes the capabilities one authority accepts; a runtime's is held by the `boot` call that made it alone. */
 export interface CapabilityMint {
@@ -410,7 +478,7 @@ export function createCapabilityIssuer(): CapabilityIssuer {
 	})
 	const authority: CapabilityAuthority = freeze({
 		resolve(capability: unknown): CapabilityGrant {
-			const bound = readRef(capability) ?? readWithin(capability) ?? readApp(capability)
+			const bound = readRef(capability) ?? readWithin(capability) ?? readApp(capability) ?? readRow(capability)
 			if (bound === undefined || bound.issuer !== issuer) {
 				throw new CapabilityRefusedError('not_minted', 'not a capability the framework minted: pass the ctx.target or ctx.within of this request')
 			}
@@ -431,6 +499,14 @@ export function createCapabilityIssuer(): CapabilityIssuer {
 			return grant
 		},
 
+		row(grant: Omit<RowGrant, 'kind'>): RowRef<string, string> {
+			const frame = currentRequest.getStore()
+			if (frame === undefined || frame.ended) {
+				throw new CapabilityRefusedError('ended', 'a claimed row is minted only inside the job attempt that claims it')
+			}
+			return new RowRef(MINT, issuer, frame, grant)
+		},
+
 		fence(): LeaseFence | null {
 			return currentRequest.getStore()?.fence ?? null
 		},

package/src/implement/{form-admission.ts → client-address.ts}

@@ -1,13 +1,9 @@
-// A form's admission: which bucket a request takes from, and what a submission carries beside its row. The buckets
-// live in the application's database (`@fabrika/db`'s `FormAdmissions`), so every instance shares them. Admission is
-// not authorization: a form is anonymous, and this only bounds how much one client and all clients together submit.
+// The client a per-client bucket counts. The buckets live in the application's database (`@fabrika/db`'s
+// `Admissions`), so every instance shares them. Admission is not authorization: it only bounds how much one client
+// calls a public procedure.
 
 import { CLIENT_ADDRESS_HEADER } from '@fabrika/auth-core'
 import { createHash } from 'node:crypto'
-import { FORM_CHALLENGE_FIELD } from '../contract/defaults'
-
-/** The bucket of a form's accepted submissions; a client's bucket is `client:<digest>`, so the two never meet. */
-export const ACCEPTED_BUCKET = 'accepted'
 
 /** Longest header value read; an IPv6 address with a zone id fits with room to spare. */
 const MAX_ADDRESS_LENGTH = 64
@@ -87,34 +83,3 @@ export function clientKey(header: string | null): string {
 export function clientBucket(request: Request): string {
 	return `client:${createHash('sha256').update(clientKey(request.headers.get(CLIENT_ADDRESS_HEADER))).digest('hex')}`
 }
-
-/** What the form declared beside its row: its honeypot field and whether a challenge token travels in the input. */
-export interface SubmissionFields {
-	readonly honeypot: string | null
-	readonly challenge: boolean
-}
-
-export interface Submission {
-	/** The honeypot was filled: the answer is the constant one, and nothing is written. */
-	readonly trapped: boolean
-	/** The challenge token, when the form declares a challenge. */
-	readonly token: string | null
-	/** The columns the inbox row gets: the input without the honeypot and the token. */
-	readonly row: Readonly<Record<string, unknown>>
-}
-
-export function submissionOf(input: Readonly<Record<string, unknown>>, fields: SubmissionFields): Submission {
-	const row: Record<string, unknown> = {}
-	for (const [name, value] of Object.entries(input)) {
-		if (name !== fields.honeypot && !(fields.challenge && name === FORM_CHALLENGE_FIELD)) {
-			row[name] = value
-		}
-	}
-	const trap = fields.honeypot === null ? undefined : input[fields.honeypot]
-	const token = fields.challenge ? input[FORM_CHALLENGE_FIELD] : undefined
-	return {
-		trapped: typeof trap === 'string' && trap !== '',
-		token: typeof token === 'string' ? token : null,
-		row,
-	}
-}