@fabrika/app 0.6.0 → 0.8.0

package/src/implement/anonymous.ts

@@ -1,21 +1,34 @@
 // What the anonymous kinds need beyond the request pipeline: a body read under its limit (the proxy never sees a
-// body, so the framework enforces it), the share SPA's fragment bootstrap and GitHub's delivery signature. A form's
-// admission is `form-admission.ts`.
+// body, so the framework enforces it) and the share SPA's fragment bootstrap. A form's admission is
+// `form-admission.ts`, a webhook's signature `verifiers.ts`.
 
 import { LINK_BOOTSTRAP_FILE, SHARE_KEY_GLOBAL } from '../contract/defaults'
 import { HttpError } from '../errors'
 import { readBoundedBytes } from './bounded'
 
+/** The slowest body a procedure waits for, in bytes per second: its deadline is `maxBytes` at this rate, 30 s at least. */
+export const BODY_RATE_FLOOR = 16 * 1024
+const MIN_BODY_DEADLINE_MS = 30_000
+
+/** How long a body of at most `maxBytes` may take to arrive. */
+export function bodyDeadlineMs(maxBytes: number): number {
+	return Math.max(MIN_BODY_DEADLINE_MS, Math.ceil((maxBytes / BODY_RATE_FLOOR) * 1000))
+}
+
 /**
  * The body as bytes, read until `maxBytes`; a longer one stops the read and is a 413. A body whose stream fails before
  * its end (the client closed the connection) is the sender's 400 `aborted`, never a failure of the application.
  */
-export async function readBoundedBody(request: Request, maxBytes: number): Promise<Uint8Array<ArrayBuffer>> {
+export async function readBoundedBody(request: Request, maxBytes: number, deadline?: AbortSignal): Promise<Uint8Array<ArrayBuffer>> {
 	let body: Uint8Array<ArrayBuffer> | null
 	try {
-		body = await readBoundedBytes(request.body, { maxBytes, declaredLength: request.headers.get('Content-Length') })
+		body = await readBoundedBytes(request.body, {
+			maxBytes,
+			declaredLength: request.headers.get('Content-Length'),
+			...(deadline === undefined ? {} : { signal: deadline }),
+		})
 	} catch {
-		throw abortedBody()
+		throw deadline?.aborted === true ? new HttpError(408, 'body_timeout', 'The body did not arrive within its deadline') : abortedBody()
 	}
 	if (body === null) {
 		throw new HttpError(413, 'too_large', `The body is larger than ${maxBytes} bytes`)
@@ -76,40 +89,3 @@ export async function withBootstrap(response: Response, prefix: string): Promise
 	headers.delete('Content-Length')
 	return new Response(injected, { status: response.status, statusText: response.statusText, headers })
 }
-
-const SIGNATURE_PREFIX = 'sha256='
-const HEX = /^[0-9a-f]{64}$/
-
-/** Whether `X-Hub-Signature-256` is GitHub's HMAC-SHA256 of the raw body under `secret`, compared in constant time. */
-export async function verifyGithubSignature(header: string | null, secret: string, body: Uint8Array<ArrayBuffer>): Promise<boolean> {
-	if (header === null || !header.startsWith(SIGNATURE_PREFIX)) {
-		return false
-	}
-	const hex = header.slice(SIGNATURE_PREFIX.length).toLowerCase()
-	if (!HEX.test(hex)) {
-		return false
-	}
-	const signature = new Uint8Array(32)
-	for (let index = 0; index < 32; index++) {
-		signature[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16)
-	}
-	const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify'])
-	return crypto.subtle.verify('HMAC', key, signature, body)
-}
-
-/** The GitHub account a payload names, as a binding records it: `installation:<id>` or `repository:<id>`. */
-export function githubAccounts(payload: unknown): readonly string[] {
-	const accounts: string[] = []
-	for (const kind of ['installation', 'repository'] as const) {
-		const holder = ownField(payload, kind)
-		const id = ownField(holder, 'id')
-		if (typeof id === 'number' && Number.isSafeInteger(id) && id > 0) {
-			accounts.push(`${kind}:${id}`)
-		}
-	}
-	return accounts
-}
-
-function ownField(value: unknown, name: string): unknown {
-	return typeof value === 'object' && value !== null && Object.hasOwn(value, name) ? Reflect.get(value, name) : undefined
-}