@friggframework/core 2.0.0-next.125 → 2.0.0-next.126

package/handlers/app-handler-helpers.js

@@ -9,6 +9,17 @@ const serverlessHttp = require('serverless-http');
 
 const log = getLogger('frigg.http');
 
+const isHttpErrorStatus = (statusCode) =>
+    Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599;
+
+const toBoom = (err) => {
+    if (err.isBoom) return err;
+    if (err.isClientSafe === true && isHttpErrorStatus(err.statusCode)) {
+        return Boom.boomify(err, { statusCode: err.statusCode });
+    }
+    return Boom.boomify(err);
+};
+
 const createApp = (applyMiddleware) => {
     const app = express();
 
@@ -27,7 +38,7 @@ const createApp = (applyMiddleware) => {
 
     // The express boundary: send the error response and log it one time.
     app.use((err, req, res, next) => {
-        const boomError = err.isBoom ? err : Boom.boomify(err);
+        const boomError = toBoom(err);
         const {
             output: { statusCode = 500 },
         } = boomError;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0-next.125",
+    "version": "2.0.0-next.126",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -11,7 +11,7 @@
         "@aws-sdk/client-sqs": "^3.588.0",
         "@aws-sdk/client-ssm": "^3.588.0",
         "@aws-sdk/s3-request-presigner": "^3.588.0",
-        "@friggframework/schemas": "2.0.0-next.125",
+        "@friggframework/schemas": "2.0.0-next.126",
         "@hapi/boom": "^10.0.1",
         "@opentelemetry/api": "^1.9.1",
         "@opentelemetry/context-async-hooks": "^2.9.0",
@@ -49,9 +49,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0-next.125",
-        "@friggframework/prettier-config": "2.0.0-next.125",
-        "@friggframework/test": "2.0.0-next.125",
+        "@friggframework/eslint-config": "2.0.0-next.126",
+        "@friggframework/prettier-config": "2.0.0-next.126",
+        "@friggframework/test": "2.0.0-next.126",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -92,5 +92,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "a64e5964dd1a945ce6439df062d79d637d861caf"
+    "gitHead": "be8690d56e4e772fc744f414a7e3bed7363ad9b5"
 }

package/token/repositories/token-repository-documentdb.js

@@ -119,7 +119,19 @@ class TokenRepositoryDocumentDB extends TokenRepositoryInterface {
 
     getJSONTokenFromBase64BufferToken(buffer) {
         const tokenStr = Buffer.from(buffer.trim(), 'base64').toString('ascii');
-        return JSON.parse(tokenStr);
+        let jsonToken;
+        try {
+            jsonToken = JSON.parse(tokenStr);
+        } catch {
+            jsonToken = null;
+        }
+        if (
+            !['string', 'number'].includes(typeof jsonToken?.id) ||
+            typeof jsonToken?.token !== 'string'
+        ) {
+            throw new ClientSafeError('Invalid Token: Token is malformed', 401);
+        }
+        return jsonToken;
     }
 
     _mapToken(record) {

package/token/repositories/token-repository-mongo.js

@@ -212,7 +212,19 @@ class TokenRepositoryMongo extends TokenRepositoryInterface {
      */
     getJSONTokenFromBase64BufferToken(buffer) {
         const tokenStr = Buffer.from(buffer.trim(), 'base64').toString('ascii');
-        return JSON.parse(tokenStr);
+        let jsonToken;
+        try {
+            jsonToken = JSON.parse(tokenStr);
+        } catch {
+            jsonToken = null;
+        }
+        if (
+            !['string', 'number'].includes(typeof jsonToken?.id) ||
+            typeof jsonToken?.token !== 'string'
+        ) {
+            throw new ClientSafeError('Invalid Token: Token is malformed', 401);
+        }
+        return jsonToken;
     }
 }
 

package/token/repositories/token-repository-postgres.js

@@ -257,7 +257,19 @@ class TokenRepositoryPostgres extends TokenRepositoryInterface {
      */
     getJSONTokenFromBase64BufferToken(buffer) {
         const tokenStr = Buffer.from(buffer.trim(), 'base64').toString('ascii');
-        return JSON.parse(tokenStr);
+        let jsonToken;
+        try {
+            jsonToken = JSON.parse(tokenStr);
+        } catch {
+            jsonToken = null;
+        }
+        if (
+            !['string', 'number'].includes(typeof jsonToken?.id) ||
+            typeof jsonToken?.token !== 'string'
+        ) {
+            throw new ClientSafeError('Invalid Token: Token is malformed', 401);
+        }
+        return jsonToken;
     }
 }