@freqhole/haruspex 0.3.5 → 0.3.7

package/dist/share/codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/share/codec.ts"],"names":[],"mappings":"AAiBA,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AA2IxF,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAInE;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAEhE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAcvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CA0CxE"}
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/share/codec.ts"],"names":[],"mappings":"AAiBA,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AA2IxF,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAInE;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAEhE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA0BvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CA0CxE"}

package/dist/share/codec.js

@@ -158,16 +158,28 @@ export function shareFragment(payload) {
  */
 export function extractShareToken(input) {
     let raw = input.trim();
+    let matchedPrefix = false;
     const hashIdx = raw.indexOf("#share/");
     if (hashIdx !== -1) {
         raw = raw.slice(hashIdx + "#share/".length);
+        matchedPrefix = true;
     }
     else if (raw.startsWith("share/")) {
         raw = raw.slice("share/".length);
+        matchedPrefix = true;
+    }
+    // the trailing-query truncation only makes sense once we know `raw` is
+    // actually sitting right after a real `#share/`/`share/` prefix - doing
+    // it unconditionally previously mangled any input that merely CONTAINS
+    // an unrelated "&" (e.g. a host app's own `?foo=1&bar=2` route in the
+    // same hash), which then silently masqueraded as "a share token was
+    // found here" purely because truncation made the output differ from
+    // the input - see callers that infer "found a token" from that.
+    if (matchedPrefix) {
+        const ampIdx = raw.indexOf("&");
+        if (ampIdx !== -1)
+            raw = raw.slice(0, ampIdx);
     }
-    const ampIdx = raw.indexOf("&");
-    if (ampIdx !== -1)
-        raw = raw.slice(0, ampIdx);
     return raw;
 }
 /**

package/dist/share/codec.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { decodeShareToken, encodeShareToken, extractShareToken, shareFragment, } from "./codec.js";
+import { decodeShareToken, encodeShareToken, extractShareToken, shareFragment } from "./codec.js";
 const NODE_ID = "ab".repeat(32);
 const OTHER_NODE_ID = "cd".repeat(32);
 describe("encodeShareToken / decodeShareToken (current wire)", () => {
@@ -61,6 +61,22 @@ describe("encodeShareToken / decodeShareToken (current wire)", () => {
         expect(decodeShareToken(url)).toEqual(payload);
         expect(extractShareToken(url)).toBe(token);
     });
+    it("truncates a trailing '&'-joined query only when a real #share/ prefix precedes it", () => {
+        const payload = { kind: "node", nodeId: NODE_ID };
+        const token = encodeShareToken(payload);
+        expect(extractShareToken(`#share/${token}&foo=bar`)).toBe(token);
+        expect(extractShareToken(`share/${token}&foo=bar`)).toBe(token);
+    });
+    it("does NOT truncate at '&' when no #share/ or share/ prefix is present", () => {
+        // a host app's own unrelated route can contain "&" without ever being
+        // a share link at all (e.g. spume's `/radio?node_id=...&station_id=
+        // ...`) - truncating here anyway used to make the output differ from
+        // the input, which callers (see spume's extractShareTokenFromHash)
+        // relied on as "a token was found", wrongly treating the truncated
+        // leftovers as a real share token.
+        const input = "/radio?node_id=deadbeef&station_id=abc123";
+        expect(extractShareToken(input)).toBe(input);
+    });
 });
 describe("decodeShareToken (legacy shapes)", () => {
     it("decodes the legacy versioned doc shape {v:1,n,d,t,m}", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@freqhole/haruspex",
-    "version": "0.3.5",
+    "version": "0.3.7",
     "private": false,
     "type": "module",
     "description": "freqhole auth domain: identity, webauthn, knock + friendz protocols, permissions",