@jxsuite/connector 0.8.8 → 0.8.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxsuite/connector",
-  "version": "0.8.8",
+  "version": "0.8.9",
   "description": "Jx database connections and dynamic data tables served over /_jx/data",
   "license": "MIT",
   "repository": {
@@ -57,7 +57,7 @@
     "upgrade": "bun update --latest && bun install"
   },
   "dependencies": {
-    "@jxsuite/schema": "^5.6.0",
+    "@jxsuite/schema": "^6.0.0",
     "kysely": "^0.29.8",
     "kysely-d1": "^0.4.0",
     "kysely-postgres-js": "^5.0.1",

package/src/worker.ts

@@ -162,8 +162,10 @@ export async function handleDataRequest(
   try {
     ({ db, kind } = await getDb(state, options, env, tableDef.connection));
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return fail(500, `Connection error: ${message}`);
+    /* The cause names an env var, a host or a driver: the owner's to read in the log, and nothing
+       a visitor should be handed. */
+    console.error(`jx data: connection "${tableDef.connection}" failed:`, error);
+    return fail(500, "Connection error");
   }
 
   const plan = planTable(tableName, tableDef, tables, kind);
@@ -190,8 +192,10 @@ export async function handleDataRequest(
       }
     }
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return fail(500, message);
+    /* A driver's message quotes the statement, the table and the constraint that refused it. That
+       is the schema, so it goes to the log and the caller is told only that the request failed. */
+    console.error(`jx data: ${action} on "${tableName}" failed:`, error);
+    return fail(500, "Server error");
   }
 }
 
@@ -622,11 +626,22 @@ async function expandIncludes(
   return expanded.map(({ payload }) => payload);
 }
 
+/** `application/json` or a `+json` structured-syntax type (RFC 6839), parameters allowed. */
+const JSON_MEDIA_TYPE = /^application\/(?:[\w.-]+\+)?json\b/iu;
+
 /**
  * Read a request body as JSON. `Body.json()` is `JSON.parse` of the body text, so the result is a
  * JSON value; an absent or malformed body reads as null, the same as a literal `null` body.
+ *
+ * A body that does not declare itself JSON reads as null too, whatever it holds. An HTML form can
+ * post JSON-shaped text as `text/plain` from any site, with the visitor's cookies and no preflight;
+ * it cannot set `application/json`, so requiring the type is what keeps a write a same-origin
+ * script's to make (specs/extensions.md §13).
  */
 function readJsonBody(request: Request): Promise<JsonValue> {
+  if (!JSON_MEDIA_TYPE.test(request.headers.get("content-type") ?? "")) {
+    return Promise.resolve(null);
+  }
   return request.json().catch(() => null);
 }