@formancy/server-core 0.2.0 → 0.4.0

package/dist/index.mjs

@@ -3,9 +3,9 @@ import { hmac } from "@noble/hashes/hmac.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
 import { diffSchemas, modelDataPaths, schemaHash } from "@formancy/spec";
-import { validateSchema } from "@formancy/spec/validate";
-import { createFormEngine, expressionProblems } from "@formancy/core";
+import { createFormEngine, expressionProblems, unknownReferences } from "@formancy/core";
 import { check } from "recheck";
+import { validateSchema } from "@formancy/spec/validate";
 //#region src/options-membership.ts
 /**
 * Every sourced answer in a submission, as `path → { source, value }`.
@@ -29,12 +29,15 @@ function sourcedAnswers(schema, value) {
 				continue;
 			}
 			if (field.optionsSource === void 0) continue;
-			if (typeof held !== "string" || held === "") continue;
-			found.push({
-				path: at,
-				source: field.optionsSource,
-				value: held
-			});
+			const answers = Array.isArray(held) ? held : [held];
+			for (const answer of answers) {
+				if (typeof answer !== "string" || answer === "") continue;
+				found.push({
+					path: at,
+					source: field.optionsSource,
+					value: answer
+				});
+			}
 		}
 	};
 	walk(schema.model.fields, value, "");
@@ -492,6 +495,38 @@ async function offerUpload(deps, input) {
 	};
 }
 /**
+* Whether an upload's bytes may be kept.
+*
+* **Fail closed.** A scanner that cannot be asked refuses the file, the same as one that
+* found something: a deployment that configured a scanner did so to keep unscanned files
+* out, and its being down is not a reason to let one in. The person is told to try again,
+* and the field offers exactly that. Without a scanner every upload is kept, as it was
+* before there was one — a supported state, said in the documentation rather than here
+* ([0131](../../../docs/decisions/0131-an-upload-is-scanned-before-it-is-kept.md)).
+*/
+async function screenUpload(scanner, file, bytes) {
+	if (scanner === void 0) return { ok: true };
+	let verdict;
+	try {
+		verdict = await scanner.scan({
+			name: file.name,
+			contentType: file.contentType,
+			size: file.size
+		}, bytes);
+	} catch (error) {
+		return {
+			ok: false,
+			reason: "scanner_unavailable",
+			cause: error instanceof Error ? error.message : String(error)
+		};
+	}
+	return verdict.clean ? { ok: true } : {
+		ok: false,
+		reason: "refused",
+		finding: verdict.finding
+	};
+}
+/**
 * Which files a submission may claim, checked but not yet claimed.
 *
 * The claiming itself is `insertSubmission`'s job, in the same call that
@@ -623,187 +658,7 @@ function fileFieldPaths(schema) {
 	return modelDataPaths(schema.model).filter((path) => fileFieldAt(schema, path)?.type === "file");
 }
 //#endregion
-//#region src/redos.ts
-/** Every `pattern` in the model, with the data path of the field it sits on. */
-function patternsIn(fields, prefix) {
-	const found = [];
-	for (const field of fields) {
-		const path = field.type === "page" ? prefix : field.type === "repeater" ? `${prefix}${field.key}[].` : field.type === "group" ? `${prefix}${field.key}.` : `${prefix}${field.key}`;
-		if (typeof field.pattern === "string" && field.pattern !== "") found.push({
-			path,
-			pattern: field.pattern
-		});
-		if (field.fields !== void 0) found.push(...patternsIn(field.fields, path));
-	}
-	return found;
-}
-/**
-* The patterns in this schema that an attacker could exploit, or an empty array
-* when there are none.
-*
-* A pattern `recheck` cannot decide about is ACCEPTED. Refusing on `unknown`
-* would make publishing depend on an analysis timeout, which is a worse failure
-* than the one being prevented — an author whose legitimate form stops
-* publishing intermittently has no way to act on that.
-*/
-async function unsafePatterns(schema) {
-	const unsafe = [];
-	for (const { path, pattern } of patternsIn(schema.model.fields, "")) {
-		const diagnostics = await check(`^(?:${pattern})$`, "");
-		if (diagnostics.status !== "vulnerable") continue;
-		const complexity = diagnostics.complexity;
-		unsafe.push({
-			path,
-			pattern,
-			complexity: complexity === void 0 ? "unknown" : complexity.type === "polynomial" ? `polynomial degree ${String(complexity.degree)}` : complexity.type
-		});
-	}
-	return unsafe;
-}
-//#endregion
 //#region src/use-cases.ts
-/**
-* Publish a schema as a form's next version.
-*
-* This is the save gate: structural validation, then the ENGINE's own compile
-* — type-checked expressions, kind policies and the cycle graph — so a form
-* that can loop or read a ghost field is refused here and never persisted.
-* Republishing the identical document is idempotent, because "deploy again"
-* must never manufacture a version.
-*/
-async function publishForm(deps, input) {
-	const validated = validateSchema(input.schema);
-	if (!validated.valid) return {
-		ok: false,
-		kind: "invalid_schema",
-		errors: validated.errors
-	};
-	const schema = validated.schema;
-	try {
-		createFormEngine({
-			schema,
-			capabilities: deps.capabilities
-		});
-	} catch (error) {
-		return {
-			ok: false,
-			kind: "invalid_logic",
-			message: error instanceof Error ? error.message : String(error)
-		};
-	}
-	const problems = expressionProblems(schema);
-	if (problems.length > 0) return {
-		ok: false,
-		kind: "invalid_logic",
-		message: problems.map((problem) => problem.message).join("\n")
-	};
-	const unsafe = await unsafePatterns(schema);
-	if (unsafe.length > 0) return {
-		ok: false,
-		kind: "unsafe_pattern",
-		patterns: unsafe
-	};
-	if (deps.optionsSources !== void 0) {
-		const unknown = sourceNamesIn(schema).filter((name) => deps.optionsSources?.[name] === void 0);
-		if (unknown.length > 0) return {
-			ok: false,
-			kind: "unknown_options_source",
-			sources: unknown
-		};
-	}
-	const hash = schemaHash(schema);
-	const existing = await deps.storage.getFormByPath(input.path);
-	if (existing !== void 0) {
-		const current = existing.currentVersionId === null ? void 0 : await deps.storage.getVersionById(existing.currentVersionId);
-		if (current !== void 0 && current.schemaHash === hash) return {
-			ok: true,
-			formId: existing.id,
-			versionId: current.id,
-			version: current.version,
-			schemaHash: hash
-		};
-		const version = await deps.storage.latestVersionNumber(existing.id) + 1;
-		const versionId = deps.newId();
-		await deps.storage.publishVersion({
-			version: {
-				id: versionId,
-				formId: existing.id,
-				version,
-				schema,
-				schemaHash: hash
-			},
-			audit: publishAudit(deps, input, {
-				path: input.path,
-				version,
-				hash,
-				sources: sourceNamesIn(schema)
-			})
-		});
-		return {
-			ok: true,
-			formId: existing.id,
-			versionId,
-			version,
-			schemaHash: hash
-		};
-	}
-	const formId = deps.newId();
-	const versionId = deps.newId();
-	await deps.storage.publishVersion({
-		form: {
-			id: formId,
-			path: input.path,
-			currentVersionId: null,
-			accessSubmit: "authenticated",
-			allowedOrigins: null
-		},
-		version: {
-			id: versionId,
-			formId,
-			version: 1,
-			schema,
-			schemaHash: hash
-		},
-		audit: publishAudit(deps, input, {
-			path: input.path,
-			version: 1,
-			hash,
-			sources: sourceNamesIn(schema)
-		})
-	});
-	return {
-		ok: true,
-		formId,
-		versionId,
-		version: 1,
-		schemaHash: hash
-	};
-}
-/**
-* The audit row for a publish, built here so it can travel INSIDE the
-* transaction rather than being appended after it.
-*
-* Before this it was written by the route once all three storage calls had
-* returned, which meant a publish could half-apply and still be recorded as
-* having happened. Now it rolls back with everything else.
-*/
-function publishAudit(deps, input, about) {
-	return {
-		id: deps.newId(),
-		at: deps.nowIso(),
-		action: "form.published",
-		subject: about.path,
-		...input.actor === void 0 ? {} : {
-			actorKind: input.actor.kind,
-			actorId: input.actor.id
-		},
-		detail: {
-			version: about.version,
-			schemaHash: about.hash,
-			...about.sources.length === 0 ? {} : { optionsSources: [...about.sources].sort().join(", ") }
-		}
-	};
-}
 async function resolveForm(deps, path) {
 	const form = await deps.storage.getFormByPath(path);
 	if (form === void 0 || form.currentVersionId === null) return void 0;
@@ -865,8 +720,11 @@ async function createSubmission(deps, input) {
 	const engine = createFormEngine({
 		schema: current.schema,
 		initialValue: input.data,
-		capabilities: deps.capabilities
+		capabilities: deps.capabilities,
+		mode: "server",
+		...deps.checks === void 0 ? {} : { checks: deps.checks }
 	});
+	await engine.settle();
 	const outcome = engine.submit();
 	if (!outcome.ok) return {
 		ok: false,
@@ -1224,6 +1082,44 @@ async function listVersions(deps, path) {
 	}));
 }
 //#endregion
+//#region src/redos.ts
+/** Every `pattern` in the model, with the data path of the field it sits on. */
+function patternsIn(fields, prefix) {
+	const found = [];
+	for (const field of fields) {
+		const path = field.type === "page" ? prefix : field.type === "repeater" ? `${prefix}${field.key}[].` : field.type === "group" ? `${prefix}${field.key}.` : `${prefix}${field.key}`;
+		if (typeof field.pattern === "string" && field.pattern !== "") found.push({
+			path,
+			pattern: field.pattern
+		});
+		if (field.fields !== void 0) found.push(...patternsIn(field.fields, path));
+	}
+	return found;
+}
+/**
+* The patterns in this schema that an attacker could exploit, or an empty array
+* when there are none.
+*
+* A pattern `recheck` cannot decide about is ACCEPTED. Refusing on `unknown`
+* would make publishing depend on an analysis timeout, which is a worse failure
+* than the one being prevented — an author whose legitimate form stops
+* publishing intermittently has no way to act on that.
+*/
+async function unsafePatterns(schema) {
+	const unsafe = [];
+	for (const { path, pattern } of patternsIn(schema.model.fields, "")) {
+		const diagnostics = await check(`^(?:${pattern})$`, "");
+		if (diagnostics.status !== "vulnerable") continue;
+		const complexity = diagnostics.complexity;
+		unsafe.push({
+			path,
+			pattern,
+			complexity: complexity === void 0 ? "unknown" : complexity.type === "polynomial" ? `polynomial degree ${String(complexity.degree)}` : complexity.type
+		});
+	}
+	return unsafe;
+}
+//#endregion
 //#region src/testing/memory-storage.ts
 /**
 * The in-memory Storage — the second implementation that keeps the port
@@ -1543,6 +1439,175 @@ function isIpLiteral(host) {
 	return bare.includes(":");
 }
 //#endregion
-export { AUDIT_ACTIONS, BREAKER_COOLDOWN_MS, BREAKER_THRESHOLD, CHALLENGE_TTL_SECONDS, DEFAULT_MAX_NUMBER, EVENT_ID_HEADER, MAX_ATTEMPTS, SIGNATURE_HEADER, afterAttempt, afterWebhookAttempt, auditedBy, authenticateApiKey, authenticateLocal, breakerState, can, checkMembership, collectAbandonedFiles, createApiKey, createLocalUser, createMemoryStorage, createSubmission, decodeSolution, deliveryHeaders, drainOutbox, encodeSolution, exportCsv, fileFieldPaths, filesToClaim, hashOf, healthOf, isIpLiteral, isPrivateAddress, listForms, listSubmissions, listVersions, mayAttempt, mintChallenge, offerUpload, publishForm, replayDelivery, resolveForm, resumeDraft, retryDelayMs, saveDraft, setFormAccess, signBody, signedPayload, solveChallenge, sourceNamesIn, sourcedAnswers, startDraft, unsafePatterns, verifySignature, verifySolution };
+//#region src/publishing.ts
+/**
+* Publish a schema as a form's next version.
+*
+* This is the save gate: structural validation, then the ENGINE's own compile
+* — type-checked expressions, kind policies and the cycle graph — so a form
+* that can loop or read a ghost field is refused here and never persisted.
+* Republishing the identical document is idempotent, because "deploy again"
+* must never manufacture a version.
+*/
+async function publishForm(deps, input) {
+	const validated = validateSchema(input.schema);
+	if (!validated.valid) return {
+		ok: false,
+		kind: "invalid_schema",
+		errors: validated.errors
+	};
+	const schema = validated.schema;
+	try {
+		createFormEngine({
+			schema,
+			capabilities: deps.capabilities
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			kind: "invalid_logic",
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+	const problems = expressionProblems(schema);
+	if (problems.length > 0) return {
+		ok: false,
+		kind: "invalid_logic",
+		message: problems.map((problem) => problem.message).join("\n")
+	};
+	const warnings = unknownReferences(schema).map((found) => found.message);
+	const unsafe = await unsafePatterns(schema);
+	if (unsafe.length > 0) return {
+		ok: false,
+		kind: "unsafe_pattern",
+		patterns: unsafe
+	};
+	if (deps.optionsSources !== void 0) {
+		const unknown = sourceNamesIn(schema).filter((name) => deps.optionsSources?.[name] === void 0);
+		if (unknown.length > 0) return {
+			ok: false,
+			kind: "unknown_options_source",
+			sources: unknown
+		};
+	}
+	const hash = schemaHash(schema);
+	const existing = await deps.storage.getFormByPath(input.path);
+	if (existing !== void 0) {
+		const current = existing.currentVersionId === null ? void 0 : await deps.storage.getVersionById(existing.currentVersionId);
+		if (current !== void 0 && current.schemaHash === hash) return {
+			ok: true,
+			formId: existing.id,
+			versionId: current.id,
+			version: current.version,
+			schemaHash: hash,
+			warnings
+		};
+		if (input.basedOnSchemaHash !== void 0 && input.basedOnSchemaHash !== current?.schemaHash) return {
+			ok: false,
+			kind: "version_changed",
+			...current === void 0 ? {} : { current: {
+				formId: existing.id,
+				versionId: current.id,
+				version: current.version,
+				schema: current.schema,
+				schemaHash: current.schemaHash
+			} }
+		};
+		const already = (await deps.storage.listVersionsByForm(existing.id)).find((candidate) => candidate.schemaHash === hash);
+		if (already !== void 0) return {
+			ok: false,
+			kind: "already_published",
+			version: already.version
+		};
+		const version = await deps.storage.latestVersionNumber(existing.id) + 1;
+		const versionId = deps.newId();
+		await deps.storage.publishVersion({
+			version: {
+				id: versionId,
+				formId: existing.id,
+				version,
+				schema,
+				schemaHash: hash
+			},
+			audit: publishAudit(deps, input, {
+				path: input.path,
+				version,
+				hash,
+				sources: sourceNamesIn(schema)
+			})
+		});
+		return {
+			ok: true,
+			formId: existing.id,
+			versionId,
+			version,
+			schemaHash: hash,
+			warnings
+		};
+	}
+	if (input.basedOnSchemaHash !== void 0) return {
+		ok: false,
+		kind: "version_changed"
+	};
+	const formId = deps.newId();
+	const versionId = deps.newId();
+	await deps.storage.publishVersion({
+		form: {
+			id: formId,
+			path: input.path,
+			currentVersionId: null,
+			accessSubmit: "authenticated",
+			allowedOrigins: null
+		},
+		version: {
+			id: versionId,
+			formId,
+			version: 1,
+			schema,
+			schemaHash: hash
+		},
+		audit: publishAudit(deps, input, {
+			path: input.path,
+			version: 1,
+			hash,
+			sources: sourceNamesIn(schema)
+		})
+	});
+	return {
+		ok: true,
+		formId,
+		versionId,
+		version: 1,
+		schemaHash: hash,
+		warnings
+	};
+}
+/**
+* The audit row for a publish, built here so it can travel INSIDE the
+* transaction rather than being appended after it.
+*
+* Before this it was written by the route once all three storage calls had
+* returned, which meant a publish could half-apply and still be recorded as
+* having happened. Now it rolls back with everything else.
+*/
+function publishAudit(deps, input, about) {
+	return {
+		id: deps.newId(),
+		at: deps.nowIso(),
+		action: "form.published",
+		subject: about.path,
+		...input.actor === void 0 ? {} : {
+			actorKind: input.actor.kind,
+			actorId: input.actor.id
+		},
+		detail: {
+			version: about.version,
+			schemaHash: about.hash,
+			...about.sources.length === 0 ? {} : { optionsSources: [...about.sources].sort().join(", ") }
+		}
+	};
+}
+//#endregion
+export { AUDIT_ACTIONS, BREAKER_COOLDOWN_MS, BREAKER_THRESHOLD, CHALLENGE_TTL_SECONDS, DEFAULT_MAX_NUMBER, EVENT_ID_HEADER, MAX_ATTEMPTS, SIGNATURE_HEADER, afterAttempt, afterWebhookAttempt, auditedBy, authenticateApiKey, authenticateLocal, breakerState, can, checkMembership, collectAbandonedFiles, createApiKey, createLocalUser, createMemoryStorage, createSubmission, decodeSolution, deliveryHeaders, drainOutbox, encodeSolution, exportCsv, fileFieldPaths, filesToClaim, hashOf, healthOf, isIpLiteral, isPrivateAddress, listForms, listSubmissions, listVersions, mayAttempt, mintChallenge, offerUpload, publishForm, replayDelivery, resolveForm, resumeDraft, retryDelayMs, saveDraft, screenUpload, setFormAccess, signBody, signedPayload, solveChallenge, sourceNamesIn, sourcedAnswers, startDraft, unsafePatterns, verifySignature, verifySolution };
 
 //# sourceMappingURL=index.mjs.map