@fuzdev/fuz_app 0.134.0 → 0.135.0

package/dist/testing/cross_backend/body_size_smuggling.js

@@ -10,36 +10,44 @@ import '../assert_dev_env.js';
  * body bytes would be parsed as the start of the next request — a classic
  * request-smuggling vector. This suite probes the boundary by **pipelining**:
  * it opens a raw TCP socket and sends, in one write, an oversized `POST`
- * immediately followed by a second `GET`. The assertion forks on the backend's
- * declared `oversized_reject_closes_connection` capability:
+ * immediately followed by a second `GET`. What it requires forks on the
+ * backend's declared `oversized_reject_closes_connection` capability:
  *
- * - **Closes (Node / Deno / hyper)** — the reject closes the socket with the
- *   GET bytes unconsumed, so **at most one** response comes back. `<= 1` rather
- *   than "exactly the 413" because the impls close differently at the TCP level
- *   (node-server graceful close delivers the 413 first; hyper's RST can drop the
- *   in-flight 413 before the client reads it), so demanding a cleanly-read 413
- *   would be flaky.
- * - **Drains + keepalives (Bun)** — `Bun.serve` reads the full declared
- *   `Content-Length` body and answers the *correctly-framed* pipelined GET, so
- *   **two** responses come back. This is **not** a smuggle: the GET is delimited
- *   by the body's `Content-Length`, not the unread body reinterpreted as a
- *   request — Bun answers it with a clean `400` (`missing method`), not the `x`
- *   body bytes reparsed. The security property asserted here is **no desync**
- *   (`<= 2`): a real desync would reframe the 1 MiB of `x` into bogus request
- *   lines and push the count past two.
+ * - **Closes (Node / Deno / hyper)** — the pipelined GET goes unanswered, so
+ *   **at most one** response comes back. `<= 1` rather than "exactly the 413"
+ *   because the impls close differently at the TCP level (a graceful close
+ *   delivers the 413 first; hyper's RST can drop the in-flight 413 before the
+ *   client reads it), so demanding a cleanly-read 413 would be flaky. Node
+ *   closes at once with the body unread — `create_app_server`'s body limit
+ *   (`http/body_limit.ts`) refuses on the header and answers
+ *   `Connection: close`, which is what makes `@hono/node-server` close. Deno
+ *   closes once the whole declared body has arrived, which this probe's
+ *   single write delivers; a client that withholds the body holds a Deno
+ *   connection open, and no request behind the body is served either way.
+ * - **Keeps the connection (Bun)** — `Bun.serve` sends that same 413, header
+ *   included, then keeps the socket open, skips the declared body, and serves
+ *   the GET. This is not a smuggle — the GET is delimited by the POST's
+ *   `Content-Length`, not carved out of the body — so the property held here
+ *   is **no desync**: the bytes read back are **exactly two** well-formed
+ *   responses, the first the 413 and the second the same status and body the
+ *   backend gives that GET on a connection of its own. Body bytes parsed as a
+ *   request would show up as a different second response or as extra ones.
+ *   Fewer than two fails too, with a message naming the capability: a backend
+ *   on this arm that closes after the 413 belongs on the other one.
  *
- * Either way the oversized body is rejected *with* a 413 — pinned reliably over
- * `fetch` by `describe_body_size_cross_tests`; this test owns only the
- * connection-handling half. A **positive control** (two pipelined requests →
- * `>= 2` responses) proves a second response *would* be seen if a trailing
- * request were processed — without it the close-posture `<= 1` would be vacuous
- * on a server that never reuses connections — and that the counter isn't
- * undercounting.
+ * The oversized body is rejected *with* a 413 on every backend — pinned
+ * reliably over `fetch` by `describe_body_size_cross_tests`; this test owns
+ * only the connection-handling half. A **positive control** (two pipelined
+ * requests → `>= 2` responses) proves a second response *would* be seen if a
+ * trailing request were processed — without it the close-posture `<= 1` would
+ * be vacuous on a server that never reuses connections — and that the counter
+ * isn't undercounting.
  *
  * Raw-socket by necessity (the `FetchTransport` can't pipeline two requests on
  * one connection), so — unlike `body_size.ts` — this is **cross-process only**
- * (no in-process leg; there is no socket in-process). The connection-close half
- * is capability-gated; the no-desync half holds on every spine.
+ * (no in-process leg; there is no socket in-process — the in-process pin is
+ * that the reject never reads the request body, in
+ * `server/create_app_server.db.test.ts`).
  *
  * Cited property: `docs/security.md` §"Body Size Limiting" (connection handling
  * on oversized reject).
@@ -51,6 +59,12 @@ import { describe, test, assert } from 'vitest';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** The shared 1 MiB cap (see `body_size.ts` for why it's a local constant). */
 const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
+/**
+ * How long each raw exchange waits for the server to finish answering. A
+ * backend that keeps the connection never closes it, so its exchange runs the
+ * whole window.
+ */
+const RAW_READ_TIMEOUT_MS = 2000;
 /**
  * Open a raw TCP socket to `base_url`, write `request_bytes` once, and collect
  * everything the server sends back until it closes the connection or
@@ -93,6 +107,39 @@ const send_raw = (base_url, request_bytes, read_timeout_ms) => new Promise((reso
  * server genuinely returns 2.
  */
 const count_responses = (raw) => (raw.match(/HTTP\/1\.[01] \d{3}/g) ?? []).length;
+/**
+ * Split a raw byte stream into the HTTP responses it holds, each framed on
+ * its own `Content-Length` (a response without one runs to the end of the
+ * stream). The stream is `latin1`-decoded, so a character is a byte.
+ *
+ * @returns the responses in order, or `null` when the bytes are not a
+ * sequence of whole responses — text where a status line belongs, a head
+ * with no end, a body shorter than its declared length
+ */
+const parse_responses = (raw) => {
+    const responses = [];
+    let offset = 0;
+    while (offset < raw.length) {
+        const head_end = raw.indexOf('\r\n\r\n', offset);
+        if (head_end === -1)
+            return null;
+        const [status_line, ...header_lines] = raw.slice(offset, head_end).split('\r\n');
+        const status_match = /^HTTP\/1\.[01] (\d{3})(?: |$)/.exec(status_line);
+        if (!status_match)
+            return null;
+        const body_start = head_end + 4;
+        const length_line = header_lines.find((line) => /^content-length:/i.test(line));
+        const body_end = length_line === undefined
+            ? raw.length
+            : body_start + Number.parseInt(length_line.slice(length_line.indexOf(':') + 1), 10);
+        // also false for a `NaN` length
+        if (!(body_end >= body_start && body_end <= raw.length))
+            return null;
+        responses.push({ status: Number(status_match[1]), body: raw.slice(body_start, body_end) });
+        offset = body_end;
+    }
+    return responses;
+};
 export const describe_body_size_smuggling_cross_tests = (options) => {
     const { base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -106,58 +153,61 @@ export const describe_body_size_smuggling_cross_tests = (options) => {
         test('control: two pipelined requests → ≥2 responses (connection reuse is real)', async () => {
             const two_requests = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n` +
                 `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
-            const response = await send_raw(base_url, two_requests, 2000);
+            const response = await send_raw(base_url, two_requests, RAW_READ_TIMEOUT_MS);
             const n = count_responses(response);
             assert.ok(n >= 2, `expected ≥2 responses on one keep-alive connection (got ${n}); without ` +
                 `connection reuse — or with an undercounting matcher — the smuggling ` +
                 `assertion below is not a real signal. Raw head: ${response.slice(0, 120)}`);
         });
-        test('oversized POST + pipelined GET → smuggled request not processed', async () => {
+        test('oversized POST + pipelined GET → no request smuggled', async () => {
             const oversized_len = BODY_LIMIT_DEFAULT_BYTES + 1024;
-            // One write: an over-cap POST (rejected on Content-Length, body never
-            // read) immediately followed by a GET. If the server wrongly drained
-            // the unread body it would reach + answer this GET — a smuggle.
+            const pipelined_get = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
+            // One write: an over-cap POST (rejected on Content-Length) immediately
+            // followed by a GET.
             const payload = `POST ${rpc_path} HTTP/1.1\r\n` +
                 `Host: ${host}\r\n` +
                 `Content-Type: application/json\r\n` +
                 `Content-Length: ${oversized_len}\r\n` +
                 `\r\n` +
                 'x'.repeat(oversized_len) +
-                `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
-            const response = await send_raw(base_url, payload, 2000);
+                pipelined_get;
+            const response = await send_raw(base_url, payload, RAW_READ_TIMEOUT_MS);
             const n = count_responses(response);
             if (closes_connection) {
-                // Strong posture (Node / Deno / hyper): the reject closes the
-                // connection *without reading the body*, so the pipelined GET is
-                // never reached — **at most one** response comes back (the 413, or
-                // none if the close raced the read). A *second* response would mean
-                // the body was drained and the GET processed. We assert `<= 1` rather
-                // than "exactly the 413" because the impls close differently at the
-                // TCP level — node-server closes gracefully (413 delivered first),
-                // hyper sends an RST that can drop the in-flight 413 before the client
-                // reads it — and demanding a cleanly-read 413 would be flaky. The
-                // 413-ness itself is pinned reliably (over `fetch`) by
-                // `describe_body_size_cross_tests`. The control above proves a second
-                // response *would* be seen if the GET were processed, so `<= 1` is a
-                // real signal, not vacuous.
+                // The reject closes the connection, so the pipelined GET is never
+                // reached — **at most one** response comes back (the 413, or none if
+                // the close raced the read). A *second* response means the connection
+                // was kept and the GET served. The control above proves a second
+                // response *would* be seen, so `<= 1` is a real signal.
                 assert.ok(n <= 1, `expected at most one response (oversized reject closes the connection; the ` +
                     `pipelined GET must not be reached). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
+                return;
             }
-            else {
-                // Drain-and-keepalive posture (Bun): `Bun.serve` reads the full
-                // declared `Content-Length` body and keeps the socket alive, so it
-                // answers the *correctly-framed* pipelined GET — **two** responses
-                // (the 413 + a well-formed reply to the GET). This is not a smuggle:
-                // the GET is delimited by the body's `Content-Length`, not the unread
-                // body reinterpreted as request bytes. The security property here is
-                // **no desync** — the body bytes are never reparsed as request(s). A
-                // real desync would reframe the 1 MiB of `x` into bogus request
-                // lines, pushing the count past two; `<= 2` is the no-desync bound,
-                // and the control above proves the counter isn't undercounting.
-                assert.ok(n <= 2, `expected at most two responses (the 413 + one framed reply to the ` +
-                    `pipelined GET); more means the oversized body was reparsed as requests ` +
-                    `(a desync). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
-            }
+            // The backend keeps the connection (Bun): the 413, then its answer to
+            // the GET, and nothing else. Hold it to **no desync** — the body bytes
+            // were skipped as a body, never parsed as a request.
+            assert.ok(n >= 2, `expected two responses (the 413 + the reply to the pipelined GET) from a ` +
+                `backend declared to keep the connection after an oversized-body 413. Saw ` +
+                `${n} within ${RAW_READ_TIMEOUT_MS}ms. If this backend closes the connection ` +
+                `after the 413, declare \`oversized_reject_closes_connection: true\` for it ` +
+                `(this suite's \`closes_connection\`). Raw head: ${response.slice(0, 120)}`);
+            assert.ok(n <= 2, `expected exactly two responses (the 413 + one reply to the pipelined GET); ` +
+                `more means the oversized body was parsed as requests (a desync). ` +
+                `Saw ${n}. Raw head: ${response.slice(0, 120)}`);
+            const responses = parse_responses(response);
+            assert.ok(responses !== null, `expected the bytes read back to be whole HTTP responses, each framed on its ` +
+                `Content-Length. Raw head: ${response.slice(0, 240)}`);
+            assert.strictEqual(responses.length, n, `expected one status line per framed response; a difference means a status ` +
+                `line sits inside another response's body. Raw head: ${response.slice(0, 240)}`);
+            const [first, second] = responses;
+            assert.strictEqual(first.status, 413, 'the first response is the oversized reject');
+            // A request carved out of the body would not be this GET, so the reply
+            // must be the one the same GET gets on its own connection.
+            const alone = parse_responses(await send_raw(base_url, `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`, RAW_READ_TIMEOUT_MS));
+            assert.ok(alone?.length === 1, 'expected one response to the GET sent alone');
+            assert.deepStrictEqual(second, alone[0], `expected the second response to be the backend's reply to the pipelined ` +
+                `GET (same status and body as that GET sent alone); anything else means ` +
+                `the bytes after the 413 were not framed as that request`);
         });
     });
 };

package/dist/testing/cross_backend/capabilities.d.ts

@@ -123,22 +123,25 @@ export interface BackendCapabilities {
      */
     readonly account_status: boolean;
     /**
-     * On an oversized-body `413` reject the backend **closes the connection
-     * without reading the body** (the defense-in-depth posture), rather than
-     * draining the declared `Content-Length` and keeping the socket alive.
-     * Gates the strong half of `describe_body_size_smuggling_cross_tests`: when
-     * `true`, the pipelined GET is never reached (at most one response); when
-     * `false`, the suite instead asserts the weaker but still-load-bearing
-     * no-desync property (the body is framed on `Content-Length`, not reparsed
-     * as request bytes).
+     * After an oversized-body `413` the backend **closes the connection**, so a
+     * request that follows on the same connection is never served. Read by
+     * `describe_body_size_smuggling_cross_tests`, which pipelines a `GET` behind
+     * an oversized `POST`: with it `true` the `GET` must go unanswered (at most
+     * one response); with it `false` the suite requires **exactly two**
+     * responses — the 413, then the backend's own answer to that `GET`, which
+     * shows the next request was framed on `Content-Length` and the body bytes
+     * were not parsed as a request. Fewer than two fails as well: a backend
+     * declared `false` that closes after the 413 fails the suite until the flag
+     * is flipped to `true`.
      *
-     * `true` for the Node / Deno (`@hono/node-server` graceful close) and Rust
-     * (hyper RST) backends; `false` for Bun — `Bun.serve` reads the full body
-     * and processes the correctly-framed pipelined request even when the `413`
-     * carries `Connection: close`. Bun is not insecure (no desync — it answers
-     * the cleanly-delimited GET with a proper `400`); the flag records the
-     * connection-handling divergence so the suite stays green without losing the
-     * smuggle detector. See `docs/security.md` §"Body Size Limiting".
+     * `true` for Node (closes at once, the body unread), Deno (closes once the
+     * declared body has arrived — observed on Deno 2.8.3) and the Rust spine
+     * (hyper closes at once); `false` for Bun. `Bun.serve` sends the 413
+     * with its `Connection: close` header and then keeps the connection open,
+     * skips the declared body, and serves the request after it — observed on
+     * Bun 1.3.11, whatever the handler does with the request body. Requests
+     * stay correctly framed there; what is missing is the close. See
+     * `docs/security.md` §"Body Size Limiting".
      */
     readonly oversized_reject_closes_connection: boolean;
     /**

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAuBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -61,6 +61,7 @@ export const in_process_capabilities = Object.freeze({
     fact_serving: true,
     ready: true,
     account_status: true,
+    // Nothing reads it in-process: the smuggling probe needs a real socket.
     oversized_reject_closes_connection: true,
     peer_request: false,
     // Cross-process-only, like `peer_request`: the case needs a real bound socket

package/dist/testing/cross_backend/default_backend_configs.js

@@ -32,9 +32,9 @@ export const ts_default_capabilities = Object.freeze({
     // `GET /api/account/status` is bundled into `create_account_route_specs`, so
     // every TS backend mounting account routes serves it.
     account_status: true,
-    // Node/Deno close the socket on an oversized-body reject (the default
-    // posture). A Bun-served consumer overrides to `false` (see the bun spine
-    // config) — fail-loud rather than silently skipping the smuggle detector.
+    // Node and Deno close the connection after an oversized-body `413`. A
+    // Bun-served consumer overrides to `false` (see the bun spine config) —
+    // `Bun.serve` keeps the connection and serves the next request.
     oversized_reject_closes_connection: true,
     // Off by default like `sse`/`ready`: the WS backend transport *can* initiate
     // server→client requests (`BackendWebsocketTransport.request_connection`),
@@ -76,8 +76,8 @@ export const rust_default_capabilities = Object.freeze({
     // The Rust `account_router` bundles `/status` into the account routes, so
     // every Rust spine serving the account surface serves it.
     account_status: true,
-    // hyper sends an RST on the oversized-body reject — the connection closes
-    // and the pipelined request is never reached.
+    // hyper closes the connection on the oversized-body reject, so a pipelined
+    // request is never reached.
     oversized_reject_closes_connection: true,
     // Server-initiated requests landed Rust-first canonical — the Rust spine
     // drives the `peer/ping` round-trip, so the family opts into the suite.

package/dist/testing/cross_backend/role_grant_role_grammar.d.ts

@@ -0,0 +1,6 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+/** Options for the role-grammar suite (the standard RPC-dispatched shape). */
+export type RoleGrantRoleGrammarCrossTestOptions = RpcPathCrossSuiteOptions;
+export declare const describe_role_grant_role_grammar_cross_tests: (options: RoleGrantRoleGrammarCrossTestOptions) => void;
+//# sourceMappingURL=role_grant_role_grammar.d.ts.map

package/dist/testing/cross_backend/role_grant_role_grammar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role_grant_role_grammar.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_role_grammar.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,8EAA8E;AAC9E,MAAM,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AAoC5E,eAAO,MAAM,4CAA4C,GACxD,SAAS,oCAAoC,KAC3C,IAoGF,CAAC"}

package/dist/testing/cross_backend/role_grant_role_grammar.js

@@ -0,0 +1,117 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for an **off-grammar `role`** on the grant verbs.
+ *
+ * `role_grant_assign` and `role_grant_offer_create` declare `role` as
+ * `RoleName` (lowercase letters and underscores, no leading or trailing
+ * underscore, at most 64 characters). A role string outside that grammar is refused at input
+ * validation — JSON-RPC `invalid_params`, with no `data.reason` — and writes
+ * no audit row: a role is caller-chosen text until it passes the grammar, and
+ * the grant verbs record the role they refuse in their failure rows.
+ *
+ * - **refused at validation** — each off-grammar role, on each verb, answers
+ *   `invalid_params` with no reason, so the refusal is the input schema's and
+ *   not a grant-path or authorizer one. One of them is all lowercase letters
+ *   and one character past the length cap: the cap is part of the grammar, so
+ *   a failure row never carries an arbitrarily long caller-chosen string.
+ * - **no audit row** — after the refusals, no grant audit row carries an
+ *   off-grammar role. The control keeps that read from being vacuous: an
+ *   on-grammar role no registry holds is refused past validation with
+ *   `role_not_web_grantable`, the refusal a failure row records — as is one
+ *   exactly at the length cap, which pins the boundary.
+ *
+ * Exists because the action-manifest parity gate captures no param schemas
+ * while the Rust spine parses params by hand — a spine that let an off-grammar
+ * role reach its grant path would answer with a different error and write the
+ * caller's text into the audit log. Both verbs are on every spine's standard
+ * surface, so the suite is ungated. Cross-process only: it reads the audit log
+ * through `_testing_drain_effects`, which the spine binaries mount.
+ *
+ * @module
+ */
+import { assert, describe, test } from 'vitest';
+import { ERROR_ROLE_NOT_WEB_GRANTABLE } from '../../http/error_schemas.js';
+import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
+import { cross_rpc_call, error_reason } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+const NIL_UUID = '00000000-0000-0000-0000-000000000000';
+/**
+ * The longest role name the grammar admits — an independent copy of the
+ * producers' `ROLE_NAME_LENGTH_MAX`, so a cap moved on one spine fails here.
+ */
+const ROLE_NAME_LENGTH_MAX = 64;
+/** All lowercase letters, so only its length is off the grammar. */
+const OVER_LENGTH_ROLE = 'a'.repeat(ROLE_NAME_LENGTH_MAX + 1);
+/** On the grammar at exactly the length cap, held by no registry. */
+const AT_LENGTH_ROLE = 'a'.repeat(ROLE_NAME_LENGTH_MAX);
+/** Each breaks one rule of the `RoleName` grammar. */
+const OFF_GRAMMAR_ROLES = [
+    'Admin', // uppercase
+    'role-name', // hyphen
+    'role1', // digit
+    '_role', // leading underscore
+    'role_', // trailing underscore
+    'role name', // space
+    '', // empty
+    OVER_LENGTH_ROLE // on the alphabet, one past the length cap
+];
+/** On the grammar, held by no registry. */
+const UNREGISTERED_ROLE = 'not_a_registered_role';
+const GRANT_METHODS = ['role_grant_assign', 'role_grant_offer_create'];
+/** The audit event types the grant verbs write. */
+const GRANT_EVENT_TYPES = ['role_grant_create', 'role_grant_offer_create'];
+export const describe_role_grant_role_grammar_cross_tests = (options) => {
+    const { setup_test } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    describe('grant verbs refuse an off-grammar role at validation', { timeout: 30_000 }, () => {
+        for (const method of GRANT_METHODS) {
+            test(`${method}: an off-grammar role is invalid_params with no reason`, async () => {
+                const fixture = await setup_test();
+                const t = fixture.fresh_transport();
+                for (const role of OFF_GRAMMAR_ROLES) {
+                    const res = await cross_rpc_call(t, rpc_path, method, { to_account_id: NIL_UUID, role }, fixture.create_session_headers());
+                    const label = `${method} role=${JSON.stringify(role)}`;
+                    assert.strictEqual(res.ok, false, `${label}: expected a refusal`);
+                    assert.strictEqual(res.error?.code, JSONRPC_ERROR_CODES.invalid_params, label);
+                    // a validation refusal, not a grant-path or authorizer one
+                    assert.strictEqual(error_reason(res), undefined, `${label}: no data.reason`);
+                }
+            });
+        }
+        test('an off-grammar role writes no audit row; an unregistered on-grammar one is refused past validation', async () => {
+            const fixture = await setup_test();
+            const t = fixture.fresh_transport();
+            const session = fixture.create_session_headers();
+            for (const method of GRANT_METHODS) {
+                for (const role of OFF_GRAMMAR_ROLES) {
+                    const res = await cross_rpc_call(t, rpc_path, method, { to_account_id: NIL_UUID, role }, session);
+                    assert.strictEqual(res.error?.code, JSONRPC_ERROR_CODES.invalid_params, `${method} ${JSON.stringify(role)}`);
+                }
+            }
+            // control: the same call with an on-grammar role reaches the grant-path gate
+            const control = await cross_rpc_call(t, rpc_path, 'role_grant_assign', { to_account_id: NIL_UUID, role: UNREGISTERED_ROLE }, session);
+            assert.strictEqual(error_reason(control), ERROR_ROLE_NOT_WEB_GRANTABLE);
+            // and the length cap is inclusive: a role exactly at it is on the grammar
+            const at_length = await cross_rpc_call(t, rpc_path, 'role_grant_assign', { to_account_id: NIL_UUID, role: AT_LENGTH_ROLE }, session);
+            assert.strictEqual(error_reason(at_length), ERROR_ROLE_NOT_WEB_GRANTABLE, 'a role at the length cap passes validation');
+            // a barrier before reading the log: both spines write audit rows off
+            // the request path
+            const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+            for (const event_type of GRANT_EVENT_TYPES) {
+                const listed = await cross_rpc_call(t, rpc_path, 'audit_log_list', { event_type }, session);
+                assert.ok(listed.ok, `audit_log_list failed: ${JSON.stringify(listed.error)}`);
+                const events = listed.result.events;
+                const roles = events.map((event) => event.metadata?.role);
+                for (const role of roles) {
+                    assert.ok(typeof role !== 'string' || !OFF_GRAMMAR_ROLES.includes(role), `${event_type}: an audit row records the off-grammar role ${JSON.stringify(role)}`);
+                }
+                if (event_type === 'role_grant_create') {
+                    // the controls' failure rows are in the same read, so it is not vacuous
+                    assert.ok(roles.includes(UNREGISTERED_ROLE), 'the control refusal wrote its failure row');
+                    assert.ok(roles.includes(AT_LENGTH_ROLE), 'the at-cap refusal wrote its failure row');
+                }
+            }
+        });
+    });
+};

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts

@@ -5,9 +5,8 @@ export declare const RUST_SPINE_STUB_BIN_ENV = "FUZ_TESTING_RUST_SPINE_STUB_BIN"
 /**
  * Env var overriding the stub's Postgres URL when `database_url` is omitted —
  * e.g. a scratch cluster on a spare port, keeping the run off the machine's
- * default server. Pair it with the libpq `PGHOST` / `PGPORT` the runner's
- * idempotent `createdb` reads, so the database it ensures is the one the URL
- * names.
+ * default server. A runner that creates the stub's database before the spawn
+ * must create the one this URL names, on the server it names.
  */
 export declare const RUST_SPINE_STUB_DATABASE_URL_ENV = "FUZ_TESTING_RUST_SPINE_STUB_DATABASE_URL";
 /**

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAmDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -45,9 +45,8 @@ export const RUST_SPINE_STUB_BIN_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_BIN';
 /**
  * Env var overriding the stub's Postgres URL when `database_url` is omitted —
  * e.g. a scratch cluster on a spare port, keeping the run off the machine's
- * default server. Pair it with the libpq `PGHOST` / `PGPORT` the runner's
- * idempotent `createdb` reads, so the database it ensures is the one the URL
- * names.
+ * default server. A runner that creates the stub's database before the spawn
+ * must create the one this URL names, on the server it names.
  */
 export const RUST_SPINE_STUB_DATABASE_URL_ENV = 'FUZ_TESTING_RUST_SPINE_STUB_DATABASE_URL';
 /**

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwE9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA0ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAyE9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AA6ExE,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAyEF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -4,10 +4,11 @@ import '../assert_dev_env.js';
  * actions.
  *
  * `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
- * `_testing_schema_snapshot` / `_testing_migration_tracker` /
- * `_testing_action_manifest` are privileged test-binary actions the production
- * wire never exposes — three direct DB writes (full auth wipe, forged session
- * row, raw fact insert) plus three introspection reads (the live schema, the
+ * `_testing_flood_notifications` / `_testing_schema_snapshot` /
+ * `_testing_migration_tracker` / `_testing_action_manifest` are privileged
+ * test-binary actions the production wire never exposes — direct DB writes
+ * (full auth wipe, forged session row, raw fact insert), a flood of the
+ * caller's own connection, and introspection reads (the live schema, the
  * `schema_version` migration tracker, and the live RPC registry — the highest
  * info-leak of the set were the gate to break). Their only structural fence
  * is the **daemon-token** credential gate on
@@ -78,6 +79,9 @@ const backdoor_methods = [
     { method: '_testing_reset', params: {} },
     { method: '_testing_mint_session', params: { account_id: NIL_UUID, expires_in_seconds: -60 } },
     { method: '_testing_put_fact', params: { content: 'backdoor-probe' } },
+    // An empty burst — valid input, so it clears the 400 phase; a refused
+    // caller never reaches the handler that would queue it.
+    { method: '_testing_flood_notifications', params: { count: 0, size: 0 } },
     // The schema-dump read — `exclude_tables` is optional, so `{}` is valid
     // and clears the 400 phase like the writes above.
     { method: '_testing_schema_snapshot', params: {} },

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -8,10 +8,12 @@ import '../assert_dev_env.js';
  * expired-by-construction server-side session for the expiry conformance
  * cases), **`_testing_put_fact`** (seed an embedded fact for the fact-serving
  * suite), **`_testing_schema_snapshot`** (introspect the live schema for
- * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot), and
+ * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot),
  * **`_testing_migration_tracker`** (dump the `schema_version` tracker rows for
  * cross-impl migration-identity parity — the provenance half the snapshot gate
- * excludes by design).
+ * excludes by design), and **`_testing_flood_notifications`** (queue a burst
+ * of notifications onto the caller's own WebSocket connection, to push its
+ * outbound queue past its byte budget).
  *
  * A further daemon-token action, **`_testing_action_manifest`** (dump the live
  * RPC registry for cross-impl method-set + auth-shape parity), lives here too
@@ -291,6 +293,84 @@ export declare const testing_put_fact_action_spec: {
     readonly async: true;
     readonly description: string;
 };
+/** The wire method of each notification `_testing_flood_notifications` queues. */
+export declare const TESTING_FLOOD_NOTIFICATION_METHOD = "_testing_flood";
+/**
+ * The most notifications one `_testing_flood_notifications` call queues.
+ * Empty ones at this count are charged more than
+ * `DEFAULT_WS_OUTBOUND_QUEUE_BYTES` between them — each frame's envelope and
+ * its overhead — so a burst of tiny frames can overflow a connection on a
+ * default transport too. Same value as the Rust spine's.
+ */
+export declare const TESTING_FLOOD_MAX_COUNT = 65536;
+/** The largest `payload` one `_testing_flood_notifications` call builds, in bytes. */
+export declare const TESTING_FLOOD_MAX_SIZE: number;
+/**
+ * The most payload bytes one `_testing_flood_notifications` call builds across
+ * all its notifications — the bound on `count` × `size`. The handler
+ * serializes each notification without yielding, so the product is how long
+ * one call holds the event loop.
+ */
+export declare const TESTING_FLOOD_MAX_TOTAL_BYTES: number;
+/** The `data.reason` of the refusal `_testing_flood_notifications` gives a call over HTTP. */
+export declare const ERROR_TESTING_FLOOD_NO_CONNECTION = "no_connection";
+/**
+ * `_testing_flood_notifications` — queue a burst of notifications onto the
+ * **caller's own WebSocket connection**, all in one synchronous run, so a suite
+ * driving the server from outside can push a connection's outbound queue past
+ * its byte budget deterministically — without a second producer, and whether
+ * or not its client is reading: the connection's write pump gets no turn while
+ * the handler runs, so the burst waits at once. Past the budget the server
+ * closes the socket with `WS_CLOSE_OUTBOUND_OVERFLOW`.
+ *
+ * Each notification is
+ * `{"jsonrpc":"2.0","method":"_testing_flood","params":{"index":<i>,"payload":"<size × 'x'>"}}`
+ * with `index` counting from 0, so every frame is a little longer than `size`
+ * bytes and a client can tell which frames reached it.
+ *
+ * The result is `{queued: count}` — the number asked for, not the number that
+ * fit: when the burst overflows the queue the connection is closed and this
+ * response is never written. A burst that fits arrives in order, ahead of the
+ * response.
+ *
+ * A call past `TESTING_FLOOD_MAX_COUNT`, `TESTING_FLOOD_MAX_SIZE`, or
+ * `TESTING_FLOOD_MAX_TOTAL_BYTES` (`count` × `size`) is refused with
+ * `invalid_params` and queues nothing. Over HTTP there is no connection to
+ * queue onto, so the call is refused with `invalid_params`, reason
+ * `ERROR_TESTING_FLOOD_NO_CONNECTION`, rather than answering as though it had
+ * flooded something.
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`. The
+ * Rust mirror is `fuz_testing::create_testing_flood_notifications_action_spec`.
+ */
+export declare const testing_flood_notifications_action_spec: {
+    readonly method: "_testing_flood_notifications";
+    readonly kind: "request_response";
+    readonly initiator: "frontend";
+    readonly auth: {
+        readonly account: "required";
+        readonly actor: "none";
+        readonly credential_types: readonly ["daemon_token"];
+    };
+    readonly side_effects: false;
+    readonly input: z.ZodObject<{
+        count: z.ZodNumber;
+        size: z.ZodNumber;
+    }, z.core.$strict>;
+    readonly output: z.ZodObject<{
+        queued: z.ZodNumber;
+    }, z.core.$strict>;
+    readonly async: true;
+    readonly error_reasons: readonly ["no_connection"];
+    readonly description: string;
+};
+/**
+ * Build the standalone `_testing_flood_notifications` action (see the spec
+ * doc). The spine binary bundles it via `create_testing_actions`; mount it
+ * directly on an in-process WS endpoint whose suite drives an outbound
+ * overflow.
+ */
+export declare const create_testing_flood_notifications_action: () => RpcAction;
 /**
  * `_testing_schema_snapshot` — introspect the live database into a normalized
  * `SchemaSnapshot` for cross-impl parity diffing. The cross-backend harness