@fireemu/win32-x64 0.7.0 → 0.8.0

package/README.md

@@ -1,7 +1,7 @@
 # @fireemu/win32-x64
 
 The [fireemu](https://www.npmjs.com/package/fireemu) daemon built for `win32-x64`
-(Rust target `x86_64-pc-windows-msvc`), version 0.7.0.
+(Rust target `x86_64-pc-windows-msvc`), version 0.8.0.
 
 Windows 10 or newer, x64. The process-census integration suites are POSIX-only; the unit tests run here.
 

package/bin/runner-node/blocking-error.mjs

@@ -29,18 +29,33 @@ const safeMessage = (value) =>
   !/\p{Cc}|[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u.test(value);
 
 export function blockingFailure(error, HttpsErrors) {
-  const code = typeof error?.code === "string" ? functionErrorCodes.get(error.code) : undefined;
-  if (
-    !Array.isArray(HttpsErrors) ||
-    !HttpsErrors.some((HttpsError) =>
-      typeof HttpsError === "function" && error instanceof HttpsError
-    ) ||
-    !code ||
-    error?.httpErrorCode?.canonicalName !== code.canonicalName ||
-    error?.httpErrorCode?.status !== code.status ||
-    !safeMessage(error?.message)
-  ) {
+  try {
+    if (
+      !Array.isArray(HttpsErrors) ||
+      !HttpsErrors.some((HttpsError) =>
+        typeof HttpsError === "function" && error instanceof HttpsError
+      )
+    ) {
+      return unavailable;
+    }
+    // Read each potentially user-defined accessor once. In particular, validating
+    // one message and returning a second getter result can leak an unsafe message.
+    const rawCode = error.code;
+    const metadata = error.httpErrorCode;
+    const message = error.message;
+    const code = typeof rawCode === "string" ? functionErrorCodes.get(rawCode) : undefined;
+    if (
+      !code ||
+      metadata?.canonicalName !== code.canonicalName ||
+      metadata?.status !== code.status ||
+      !safeMessage(message)
+    ) {
+      return unavailable;
+    }
+    return { ...code, message };
+  } catch {
+    // Error objects, proxies and even instanceof hooks can throw. Their details
+    // must not replace the fixed public fallback or break the HTTP error path.
     return unavailable;
   }
-  return { ...code, message: error.message };
 }

package/bin/runner-node/blocking-response.mjs

@@ -19,7 +19,10 @@ const disallowedClaims = [
 const claimsMaxPayloadSize = 1000;
 
 function validateClaims(name, claims, HttpsError) {
-  if (!claims) return;
+  if (claims === undefined || claims === null) return;
+  if (typeof claims !== "object" || Array.isArray(claims)) {
+    throw new HttpsError("invalid-argument", `The ${name} response must be an object or null.`);
+  }
   const invalid = disallowedClaims.filter((claim) =>
     Object.prototype.hasOwnProperty.call(claims, claim),
   );
@@ -49,8 +52,9 @@ function validateBlockingResult(value, eventType, HttpsError) {
     throw new HttpsError("invalid-argument", "The userRecord response must be an object.");
   }
   validateClaims("customClaims", authRequest.customClaims, HttpsError);
-  if (!String(eventType).includes("beforeSignIn") || !authRequest.sessionClaims) return;
+  if (!String(eventType).includes("beforeSignIn")) return;
   validateClaims("sessionClaims", authRequest.sessionClaims, HttpsError);
+  if (authRequest.sessionClaims === undefined || authRequest.sessionClaims === null) return;
   const combined = { ...authRequest.customClaims, ...authRequest.sessionClaims };
   if (JSON.stringify(combined).length > claimsMaxPayloadSize) {
     throw new HttpsError(
@@ -60,26 +64,83 @@ function validateBlockingResult(value, eventType, HttpsError) {
   }
 }
 
+// Validate the representation that will actually cross the HTTP boundary. Callback
+// objects can contain getters/toJSON and can remain aliased to user code. Evaluating
+// those objects again after validation can change claims, sizes, or the update mask.
+// JSON materialization is deliberately before claim checks; the returned value has
+// no user getters or callable toJSON hooks and shares no objects with the callback.
+function snapshotResponse(candidate, HttpsError) {
+  let snapshot;
+  try {
+    snapshot = JSON.parse(JSON.stringify(candidate));
+  } catch {
+    // Do not include a thrown value, circular-object path, or credential in the error.
+    throw new HttpsError("invalid-argument", "The blocking response must be JSON serializable.");
+  }
+  if (
+    !snapshot ||
+    typeof snapshot !== "object" ||
+    Array.isArray(snapshot) ||
+    !Object.prototype.hasOwnProperty.call(snapshot, "userRecord") ||
+    !snapshot.userRecord ||
+    typeof snapshot.userRecord !== "object" ||
+    Array.isArray(snapshot.userRecord)
+  ) {
+    throw new HttpsError("invalid-argument", "The userRecord response must be an object.");
+  }
+  return snapshot;
+}
+
+function freezeResponse(snapshot) {
+  const pending = [snapshot];
+  while (pending.length > 0) {
+    const value = pending.pop();
+    if (value && typeof value === "object") {
+      for (const child of Object.values(value)) pending.push(child);
+      Object.freeze(value);
+    }
+  }
+  return snapshot;
+}
+
 export function blockingResult(value, eventType, HttpsError) {
+  // Preserve the runner's established no-result behaviour.
   if (!value || typeof value !== "object") return {};
-  validateBlockingResult(value, eventType, HttpsError);
-  if (Object.prototype.hasOwnProperty.call(value, "userRecord")) return value;
-  const userRecord = {};
-  const updateMask = [];
-  for (const [publicName, wireName] of [
-    ["displayName", "displayName"],
-    ["photoURL", "photoUrl"],
-    ["disabled", "disabled"],
-    ["emailVerified", "emailVerified"],
-    ["customClaims", "customClaims"],
-    ["sessionClaims", "sessionClaims"],
-  ]) {
-    if (Object.prototype.hasOwnProperty.call(value, publicName)) {
-      userRecord[wireName] = value[publicName];
-      updateMask.push(wireName);
+  if (Array.isArray(value)) {
+    throw new HttpsError("invalid-argument", "The userRecord response must be an object.");
+  }
+  let candidate;
+  try {
+    if (Object.prototype.hasOwnProperty.call(value, "userRecord")) {
+      // Preserve SDK wire-envelope extensions, but never return the caller's object.
+      candidate = value;
+    } else {
+      const userRecord = {};
+      const updateMask = [];
+      for (const [publicName, wireName] of [
+        ["displayName", "displayName"],
+        ["photoURL", "photoUrl"],
+        ["disabled", "disabled"],
+        ["emailVerified", "emailVerified"],
+        ["customClaims", "customClaims"],
+        ["sessionClaims", "sessionClaims"],
+      ]) {
+        if (Object.prototype.hasOwnProperty.call(value, publicName)) {
+          const field = value[publicName];
+          // Like the Functions SDK's getUpdateMask, undefined means no update;
+          // null, false, and an empty string are still explicit updates.
+          if (field === undefined) continue;
+          userRecord[wireName] = field;
+          updateMask.push(wireName);
+        }
+      }
+      if (updateMask.length === 0) return {};
+      candidate = { userRecord: { ...userRecord, updateMask: updateMask.join(",") } };
     }
+  } catch {
+    throw new HttpsError("invalid-argument", "The blocking response could not be read.");
   }
-  return updateMask.length > 0
-    ? { userRecord: { ...userRecord, updateMask: updateMask.join(",") } }
-    : {};
+  const snapshot = snapshotResponse(candidate, HttpsError);
+  validateBlockingResult(snapshot, eventType, HttpsError);
+  return freezeResponse(snapshot);
 }

package/bin/runner-node/diagnostic-output.mjs

@@ -0,0 +1,259 @@
+// Bounded admission for direct stderr (and redirected user stdout) writes.
+// The native Writable owns byte ordering and corking. Callback accounting adds
+// backpressure even when a native write completes synchronously.
+// This is not a process-wide sandbox: direct fd writes and replaced methods bypass it.
+import { performance } from 'node:perf_hooks';
+import { types } from 'node:util';
+
+const typedPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+const viewGetters = Object.fromEntries(['buffer', 'byteOffset', 'byteLength'].map(key =>
+  [key, Object.getOwnPropertyDescriptor(typedPrototype, key).get]));
+const dataViewGetters = Object.fromEntries(['buffer', 'byteOffset', 'byteLength'].map(key =>
+  [key, Object.getOwnPropertyDescriptor(DataView.prototype, key).get]));
+function viewData(chunk) {
+  const getters = types.isDataView(chunk) ? dataViewGetters : viewGetters;
+  return { buffer: getters.buffer.call(chunk), offset: getters.byteOffset.call(chunk),
+    length: getters.byteLength.call(chunk) };
+}
+
+export const MAX_DIAGNOSTIC_BYTES = 8 * 1024 * 1024;
+export const MAX_DIAGNOSTIC_WRITES = 1024;
+export const MAX_DIAGNOSTIC_WAIT_MS = 30_000;
+export const DIAGNOSTIC_FINISH_MS = 1_000;
+
+export class DiagnosticOutputError extends Error {
+  constructor(reason) {
+    super(`runner diagnostic output failed (${reason})`);
+    this.name = 'DiagnosticOutputError';
+    this.code = 'ERR_FIREEMU_DIAGNOSTIC_OUTPUT';
+  }
+}
+
+function limit(value, maximum, name) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+    throw new TypeError(`invalid diagnostic ${name}`);
+  }
+  return value;
+}
+
+export class DiagnosticWriter {
+  #stream;
+  #write;
+  #emit;
+  #highWaterMark;
+  #needsDrain = false;
+  #nativeBackpressure = false;
+  #drainScheduled = false;
+  #onError;
+  #maxBytes;
+  #maxWrites;
+  #waitMs;
+  #finishMs;
+  #defaultEncoding = 'utf8';
+  #pending = new Set();
+  #bytes = 0;
+  #failed = null;
+  #closing = false;
+  #closeAt = Infinity;
+  #timer = null;
+  #finishPromise;
+  #finishResolve;
+
+  constructor(stream, {
+    onError,
+    maxBytes = MAX_DIAGNOSTIC_BYTES,
+    maxWrites = MAX_DIAGNOSTIC_WRITES,
+    waitMs = MAX_DIAGNOSTIC_WAIT_MS,
+    finishMs = DIAGNOSTIC_FINISH_MS,
+  } = {}) {
+    if (typeof stream?.write !== 'function' || typeof stream?.on !== 'function' ||
+        typeof stream?.emit !== 'function' ||
+        typeof onError !== 'function') throw new TypeError('diagnostic stream and onError required');
+    this.#stream = stream;
+    this.#write = stream.write.bind(stream);
+    this.#emit = stream.emit.bind(stream);
+    this.#onError = onError;
+    this.#maxBytes = limit(maxBytes, MAX_DIAGNOSTIC_BYTES, 'bytes');
+    this.#maxWrites = limit(maxWrites, MAX_DIAGNOSTIC_WRITES, 'writes');
+    this.#waitMs = limit(waitMs, MAX_DIAGNOSTIC_WAIT_MS, 'wait');
+    this.#finishMs = limit(finishMs, DIAGNOSTIC_FINISH_MS, 'finish wait');
+    const nativeHighWaterMark = stream.writableHighWaterMark;
+    this.#highWaterMark = Math.min(this.#maxBytes,
+      Number.isSafeInteger(nativeHighWaterMark) && nativeHighWaterMark > 0
+        ? nativeHighWaterMark : 64 * 1024);
+    // Native drain can fire before write callbacks. Do not tell a producer to
+    // resume while our callback reservations still fill the budget. Coalesce
+    // it with logical backpressure and emit only after BOTH have cleared.
+    stream.emit = (event, ...args) => {
+      if (event !== 'drain') return this.#emit(event, ...args);
+      this.#nativeBackpressure = false;
+      this.#requestDrain();
+      return (stream.listenerCount?.('drain') ?? 0) > 0;
+    };
+    // Retain the error listener after failure: an error event may follow its callback.
+    stream.on('error', () => this.#fail('stream error'));
+    stream.on('close', () => this.#fail('stream closed'));
+    stream.on('finish', () => this.#fail('stream ended'));
+  }
+
+  get state() {
+    return Object.freeze({ pendingBytes: this.#bytes, pendingWrites: this.#pending.size,
+      failed: this.#failed !== null, closing: this.#closing });
+  }
+
+  setDefaultEncoding(encoding) {
+    if (typeof encoding !== 'string' || !Buffer.isEncoding(encoding)) {
+      throw new TypeError('invalid diagnostic encoding');
+    }
+    this.#defaultEncoding = encoding;
+    return this;
+  }
+
+  write(chunk, encoding, callback) {
+    if (typeof encoding === 'function') { callback = encoding; encoding = undefined; }
+    if (callback !== undefined && callback !== null && typeof callback !== 'function') {
+      throw new TypeError('diagnostic write callback must be a function');
+    }
+    if (this.#failed || this.#closing) {
+      if (callback) process.nextTick(callback, this.#failed ?? new DiagnosticOutputError('closing'));
+      return false;
+    }
+    if (this.#expired()) { this.#fail('deadline'); return this.write(chunk, encoding, callback); }
+    let size, selectedEncoding, view;
+    if (typeof chunk === 'string') {
+      selectedEncoding = encoding || this.#defaultEncoding;
+      if (typeof selectedEncoding !== 'string' || !Buffer.isEncoding(selectedEncoding)) {
+        throw new TypeError('invalid diagnostic encoding');
+      }
+      size = Buffer.byteLength(chunk, selectedEncoding);
+    } else if (ArrayBuffer.isView(chunk)) {
+      view = viewData(chunk);
+      size = view.length;
+    } else {
+      throw new TypeError('diagnostic chunk must be a string or ArrayBuffer view');
+    }
+    // Include zero-length writes in the count: callbacks also retain memory.
+    if (this.#pending.size >= this.#maxWrites || this.#bytes + size > this.#maxBytes) {
+      this.#fail('pending limit');
+      return this.write(chunk, encoding, callback);
+    }
+    if (this.#stream.destroyed || this.#stream.writableEnded) {
+      this.#fail('stream unavailable');
+      return this.write(chunk, encoding, callback);
+    }
+    // Copy views before native queuing; later caller mutation cannot change admitted bytes.
+    // Strings are immutable. Encoding once also fixes accounting for hex/base64 inputs.
+    const payload = typeof chunk === 'string' ? Buffer.from(chunk, selectedEncoding) :
+      Buffer.from(new Uint8Array(view.buffer, view.offset, view.length));
+    // Buffer.byteLength(base64/hex) can be conservative for malformed input. Charge
+    // the bytes actually queued, after rejecting oversized allocation candidates above.
+    size = payload.length;
+    const entry = { size, at: performance.now(), callback };
+    this.#pending.add(entry);
+    this.#bytes += size;
+    let accepted;
+    try {
+      accepted = this.#write(payload, error => {
+        if (!this.#pending.has(entry)) return;
+        if (error) { this.#fail('write callback'); return; }
+        if (this.#expired()) { this.#fail('deadline'); return; }
+        this.#settle(entry);
+        this.#arm();
+      });
+    } catch {
+      this.#fail('write');
+      return false;
+    }
+    if (accepted !== true && accepted !== false) {
+      this.#fail('write return');
+      return false;
+    }
+    if (accepted === false) this.#nativeBackpressure = true;
+    const pressured = accepted === false || this.#bytes >= this.#highWaterMark ||
+      this.#pending.size >= this.#maxWrites;
+    if (pressured) this.#needsDrain = true;
+    this.#arm();
+    this.#requestDrain();
+    // Native false remains false. Native true may become false while completed
+    // writes still have deferred callbacks; otherwise a cooperative producer
+    // can exceed our limits before Node gets a turn to run those callbacks.
+    // In either case the write was accepted and must not be resent.
+    return this.#failed ? false : !pressured;
+  }
+
+  #settle(entry, error) {
+    if (!this.#pending.delete(entry)) return;
+    this.#bytes -= entry.size;
+    // User callbacks cannot reenter or corrupt admission bookkeeping. Like Writable,
+    // completion is asynchronous even with an inline write implementation in a test.
+    if (entry.callback) process.nextTick(entry.callback, error);
+    this.#requestDrain();
+  }
+
+  #requestDrain() {
+    if (this.#failed || this.#closing || !this.#needsDrain || this.#nativeBackpressure ||
+        this.#pending.size !== 0 || this.#drainScheduled) return;
+    this.#drainScheduled = true;
+    process.nextTick(() => {
+      this.#drainScheduled = false;
+      // A user write callback can enqueue new data before this notification.
+      if (this.#failed || this.#closing || !this.#needsDrain || this.#nativeBackpressure ||
+          this.#pending.size !== 0) return;
+      this.#needsDrain = false;
+      this.#emit('drain');
+    });
+  }
+
+  #expired() {
+    const oldest = this.#pending.values().next().value;
+    if (!oldest) return false;
+    const now = performance.now();
+    return now >= oldest.at + this.#waitMs || now >= this.#closeAt;
+  }
+
+  #fail(reason) {
+    if (this.#failed) return;
+    this.#failed = new DiagnosticOutputError(reason);
+    clearTimeout(this.#timer); this.#timer = null;
+    for (const entry of this.#pending) this.#settle(entry, this.#failed);
+    this.#finishResolve?.(false);
+    // Never write a diagnostic about this failure back into the failed stderr.
+    try { this.#onError(this.#failed); } catch { /* failure is already permanent */ }
+  }
+
+  #arm() {
+    clearTimeout(this.#timer); this.#timer = null;
+    if (this.#failed) return;
+    const oldest = this.#pending.values().next().value;
+    if (!oldest) { if (this.#closing) this.#finishResolve?.(true); return; }
+    const remaining = Math.min(oldest.at + this.#waitMs, this.#closeAt) - performance.now();
+    if (remaining <= 0) { this.#fail('deadline'); return; }
+    this.#timer = setTimeout(() => this.#arm(), Math.max(1, Math.ceil(remaining)));
+  }
+
+  // Flush already-admitted writes only; do not close fd2 or wait for user callbacks/tasks.
+  finish() {
+    if (this.#finishPromise) return this.#finishPromise;
+    this.#closing = true;
+    this.#closeAt = performance.now() + this.#finishMs;
+    this.#finishPromise = new Promise(resolve => { this.#finishResolve = resolve; });
+    if (this.#failed) this.#finishResolve(false); else this.#arm();
+    return this.#finishPromise;
+  }
+}
+
+// Install before loading a user codebase. Keep the original stream object, fd,
+// event listeners, cork/uncork and false-then-drain producer contract intact.
+// Own pending callbacks can add backpressure; native true is not always returned.
+export function installDiagnosticOutput(stream, options) {
+  const writer = new DiagnosticWriter(stream, options);
+  const setEncoding = stream.setDefaultEncoding?.bind(stream);
+  stream.write = writer.write.bind(writer);
+  if (setEncoding) stream.setDefaultEncoding = encoding => {
+    // Validate with the native API too; preserve its chaining return value.
+    const result = setEncoding(encoding);
+    writer.setDefaultEncoding(encoding);
+    return result;
+  };
+  return writer;
+}

package/bin/runner-node/discovery.mjs

@@ -0,0 +1,135 @@
+// Discover only own enumerable exports. This is codebase inspection, not a
+// sandbox: user getters can still execute arbitrary code in this process.
+import { invocationFailure } from './invocation-error.mjs';
+
+// Local resource limits, not Firebase quotas. Exceeding one aborts discovery;
+// never publish a seemingly complete inventory after truncating the graph.
+export const DISCOVERY_LIMITS = Object.freeze({
+  maxDepth: 128,
+  maxEntries: 10_000,
+  maxNameBytes: 1024,
+});
+
+export class DiscoveryError extends Error {
+  constructor(reason) {
+    super(`function export discovery failed (${reason})`);
+    this.name = 'DiscoveryError';
+  }
+}
+
+const namespaceRoots = new WeakMap();
+const interopAliases = new Set(['default', 'module.exports']);
+const hasOwn = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+
+function keysOf(object) {
+  const keys = Object.keys(object);
+  if (keys.length > DISCOVERY_LIMITS.maxEntries) throw new DiscoveryError('entry limit');
+  return keys;
+}
+
+// Preserve CommonJS insertion order, then fill missing named ES exports. Keep
+// root accessors lazy so one throwing export is diagnosed by name without
+// preventing inspection of its siblings. A null prototype makes __proto__,
+// constructor and toString ordinary export names. Never execute setters while
+// merging or consult inherited keys when deciding which source takes priority.
+export function exportNamespace(moduleNamespace) {
+  const namespace = Object.create(null);
+  let count = 0;
+  function add(source) {
+    for (const key of keysOf(source)) {
+      if (interopAliases.has(key) || hasOwn(namespace, key)) continue;
+      if (++count > DISCOVERY_LIMITS.maxEntries) throw new DiscoveryError('entry limit');
+      Object.defineProperty(namespace, key, {
+        enumerable: true,
+        get: () => {
+          // An earlier export getter may remove/hide another own property.
+          // Do not fall through to an inherited callback at the stale key.
+          if (!Object.getOwnPropertyDescriptor(source, key)?.enumerable) return undefined;
+          return Reflect.get(source, key);
+        },
+      });
+    }
+  }
+  const primary = hasOwn(moduleNamespace, 'default') ? Reflect.get(moduleNamespace, 'default') : undefined;
+  if (primary !== null && typeof primary === 'object') add(primary);
+  add(moduleNamespace);
+  namespaceRoots.set(namespace, [moduleNamespace, ...(primary !== null && typeof primary === 'object' ? [primary] : [])]);
+  return namespace;
+}
+
+function exportFailure(error) {
+  // Thrown values may themselves have throwing message/stack/toString hooks.
+  return `the export could not be read: ${invocationFailure(error).message.split('\n')[0]}`;
+}
+
+export function collectFunctions(namespace) {
+  const functions = new Map();
+  const broken = new Map();
+  const claimed = new Map();
+  const ancestors = new Set(namespaceRoots.get(namespace) ?? []);
+  const stack = [];
+  let entries = 0;
+
+  function record(name, path, fn, reason) {
+    const origin = JSON.stringify(path);
+    if (claimed.has(name)) {
+      functions.delete(name);
+      broken.set(name, `ambiguous flattened export name: ${claimed.get(name)} and ${origin}`);
+      return;
+    }
+    claimed.set(name, origin);
+    if (reason !== undefined) broken.set(name, reason);
+    else functions.set(name, fn);
+  }
+
+  function enter(group, path, name) {
+    if (ancestors.has(group)) {
+      record(name, path, undefined, 'cyclic export group');
+      return;
+    }
+    if (path.length > DISCOVERY_LIMITS.maxDepth) throw new DiscoveryError('depth limit');
+    let keys;
+    try {
+      keys = Object.keys(group);
+    } catch (error) {
+      if (path.length === 0) throw new DiscoveryError('root enumeration');
+      record(name, path, undefined, exportFailure(error));
+      return;
+    }
+    if (keys.length > DISCOVERY_LIMITS.maxEntries) throw new DiscoveryError('entry limit');
+    ancestors.add(group);
+    stack.push({ group, path, keys, next: 0 });
+  }
+
+  enter(namespace, [], '');
+  while (stack.length > 0) {
+    const current = stack[stack.length - 1];
+    if (current.next === current.keys.length) {
+      ancestors.delete(current.group);
+      stack.pop();
+      continue;
+    }
+    if (++entries > DISCOVERY_LIMITS.maxEntries) throw new DiscoveryError('entry limit');
+    const key = current.keys[current.next++];
+    const path = [...current.path, key];
+    const name = path.join('-');
+    if (Buffer.byteLength(name, 'utf8') > DISCOVERY_LIMITS.maxNameBytes) {
+      throw new DiscoveryError('name limit');
+    }
+    let value;
+    let isGroup;
+    let marked;
+    try {
+      if (!Object.getOwnPropertyDescriptor(current.group, key)?.enumerable) continue;
+      value = Reflect.get(current.group, key);
+      if (typeof value === 'function') marked = Boolean(value.__endpoint || value.__trigger);
+      else isGroup = value !== null && typeof value === 'object' && !Array.isArray(value);
+    } catch (error) {
+      record(name, path, undefined, exportFailure(error));
+      continue;
+    }
+    if (marked) record(name, path, value);
+    else if (isGroup) enter(value, path, name);
+  }
+  return { functions, broken };
+}