@helyx/bot 0.4.23 → 0.4.24

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.4.24
+
+### Patch Changes
+
+- Reuse active Verification links when available, report their expiry, and allow members to replace them while atomically invalidating the old request.---
+  "@helyx/bot": patch
+  "@helyx/database": patch
+  "@helyx/sdk": patch
+  "@helyx/verification-contracts": patch
+  ---
+
+  Reuse active Verification links when available, report their expiry, and allow members to replace them while atomically invalidating the old request.
+
+- Accept compatible internal Helyx releases within explicit minor-safe pre-1.0 or major-safe stable ranges, preventing dependency-only patch cascades.---
+  "@helyx/bot": patch
+  "@helyx/cli": patch
+  "@helyx/core": patch
+  "@helyx/framework": patch
+  "@helyx/platform": patch
+  "@helyx/sdk": patch
+  "@helyx/module-account-gate": patch
+  "@helyx/module-feedback": patch
+  "@helyx/module-giveaways": patch
+  "@helyx/module-levels": patch
+  "@helyx/module-logging": patch
+  "@helyx/module-polls": patch
+  "@helyx/module-reactionroles": patch
+  "@helyx/module-suggestions": patch
+  "@helyx/module-welcome": patch
+  ---
+
+  Accept compatible internal Helyx releases within explicit minor-safe pre-1.0 or major-safe stable ranges, preventing dependency-only patch cascades.
+
 ## 0.4.23
 
 ### Patch Changes

package/dist/verification-service.js

@@ -1,4 +1,5 @@
 import { actionReceiptSchema, challengeCreateRequestSchema, challengeCreateResponseSchema, dashboardAttemptPageSchema, dashboardAttemptQuerySchema, dashboardSafeAttemptDetailSchema, signedAssessmentEnvelopeSchema, } from "@helyx/verification-contracts";
+import { VerificationChallengeActiveError } from "@helyx/sdk";
 import { createPublicKey, verify } from "node:crypto";
 import { z } from "zod";
 const healthSchema = z
@@ -8,12 +9,19 @@ const healthSchema = z
     allowanceRemaining: z.number().int().min(0).optional(),
 })
     .strict();
+const activeChallengeSchema = z
+    .object({
+    message: z.literal("A verification link is already active."),
+    expiresAt: z.iso.datetime(),
+})
+    .strict();
 export class HttpVerificationService {
     #baseUrl;
     #internalSecret;
     #publicSigningKeys;
     #fetch;
     #installationId;
+    #challengeCache = new Map();
     #handler;
     constructor(options) {
         this.#baseUrl = options.baseUrl.replace(/\/$/u, "");
@@ -40,19 +48,36 @@ export class HttpVerificationService {
         });
     }
     async createChallenge(input) {
-        return challengeCreateResponseSchema.parse(await this.#request("/internal/v1/challenges", {
+        const cacheKey = challengeCacheKey(input.installation.installationId, input.guildId, input.userId);
+        this.#pruneChallengeCache();
+        const cached = this.#challengeCache.get(cacheKey);
+        if (input.replaceActive !== true &&
+            cached &&
+            Date.parse(cached.expiresAt) > Date.now()) {
+            return challengeCreateResponseSchema.parse({ ...cached, reused: true });
+        }
+        const created = challengeCreateResponseSchema.parse(await this.#request("/internal/v1/challenges", {
             method: "POST",
             body: challengeCreateRequestSchema.parse(input),
         }));
+        this.#challengeCache.set(cacheKey, created);
+        return created;
     }
     async cancelChallenges(input) {
-        return z
+        const cancelled = z
             .object({ cancelled: z.number().int().min(0) })
             .strict()
             .parse(await this.#request("/internal/v1/challenges/cancel", {
             method: "POST",
             body: input,
         }));
+        const prefix = `${input.installationId}:${input.guildId}:`;
+        for (const key of this.#challengeCache.keys()) {
+            if (key.startsWith(prefix) &&
+                (input.userId === undefined || key === `${prefix}${input.userId}`))
+                this.#challengeCache.delete(key);
+        }
+        return cancelled;
     }
     async listAttempts(input) {
         const { installationId, guildId, ...query } = input;
@@ -99,10 +124,12 @@ export class HttpVerificationService {
             throw new Error("Verification assessment is outside its valid lifetime");
         if (!this.#handler)
             throw new Error("Verification result handler is unavailable");
-        return actionReceiptSchema.parse(await this.#handler({
+        const receipt = actionReceiptSchema.parse(await this.#handler({
             envelope,
             correlationId: envelope.payload.attemptId,
         }));
+        this.#challengeCache.delete(challengeCacheKey(envelope.payload.installationId, envelope.payload.guildId, envelope.payload.userId));
+        return receipt;
     }
     async health() {
         const health = healthSchema.parse(await this.#request("/internal/v1/health", { method: "GET" }));
@@ -138,8 +165,12 @@ export class HttpVerificationService {
         if (allowNotFound && response.status === 404)
             return null;
         if (!response.ok)
-            if (response.status === 409)
-                throw new Error("A verification link is already active. Wait for it to expire before requesting another.");
+            if (response.status === 409) {
+                const active = activeChallengeSchema.safeParse(await response.json());
+                if (active.success)
+                    throw new VerificationChallengeActiveError(active.data.expiresAt);
+                throw new Error("Verification request was rejected");
+            }
             else if (response.status === 429)
                 throw new Error("Verification requests are temporarily limited. Try again shortly.");
             else
@@ -153,6 +184,22 @@ export class HttpVerificationService {
             throw new Error("Verification service returned an invalid response");
         }
     }
+    #pruneChallengeCache() {
+        const now = Date.now();
+        for (const [key, challenge] of this.#challengeCache) {
+            if (Date.parse(challenge.expiresAt) <= now)
+                this.#challengeCache.delete(key);
+        }
+        while (this.#challengeCache.size >= 10_000) {
+            const oldestKey = this.#challengeCache.keys().next().value;
+            if (oldestKey === undefined)
+                break;
+            this.#challengeCache.delete(oldestKey);
+        }
+    }
+}
+function challengeCacheKey(installationId, guildId, userId) {
+    return `${installationId}:${guildId}:${userId}`;
 }
 function verifyEnvelope(envelope, publicKeySpkiBase64) {
     let key;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helyx/bot",
-  "version": "0.4.23",
+  "version": "0.4.24",
   "description": "Production Discord runtime for the modular Helyx platform.",
   "keywords": [
     "helyx",
@@ -48,15 +48,15 @@
     "start": "node --env-file-if-exists=../../.env dist/index.js"
   },
   "dependencies": {
-    "@helyx/config": "0.5.0",
-    "@helyx/control-protocol": "0.3.2",
-    "@helyx/core": "0.1.16",
-    "@helyx/database": "0.7.5",
-    "@helyx/framework": "0.1.16",
-    "@helyx/module-manifest": "0.6.0",
-    "@helyx/platform": "0.4.7",
-    "@helyx/sdk": "0.6.3",
-    "@helyx/verification-contracts": "0.3.1",
+    "@helyx/config": ">=0.5.0 <0.6.0",
+    "@helyx/control-protocol": ">=0.3.0 <0.4.0",
+    "@helyx/core": ">=0.1.0 <0.2.0",
+    "@helyx/database": ">=0.7.0 <0.8.0",
+    "@helyx/framework": ">=0.1.0 <0.2.0",
+    "@helyx/module-manifest": ">=0.6.0 <0.7.0",
+    "@helyx/platform": ">=0.4.0 <0.5.0",
+    "@helyx/sdk": ">=0.6.0 <0.7.0",
+    "@helyx/verification-contracts": ">=0.3.0 <0.4.0",
     "discord.js": "14.27.0",
     "fastify": "5.10.0",
     "pino": "10.3.1",