@moqtap/codec 0.10.0 → 0.12.0

package/src/drafts/draft13/index.ts

@@ -1,5 +1,7 @@
 export const DRAFT_VERSION = 0xff00000dn
 
+export type { AuthRedaction } from '../../core/auth-redaction.js'
+export { REDACTION_FILL } from '../../core/auth-redaction.js'
 export type { Draft13Codec } from './codec.js'
 export {
   createDraft13Codec,
@@ -13,7 +15,28 @@ export {
   encodeFetchStream,
   encodeMessage,
   encodeSubgroupStream,
+  redactAuthTokens,
 } from './codec.js'
+export type {
+  AnnounceErrorCodeValue,
+  FetchErrorCodeValue,
+  PublishErrorCodeValue,
+  SessionErrorCodeValue,
+  StreamResetErrorCodeValue,
+  SubscribeDoneStatusCodeValue,
+  SubscribeErrorCodeValue,
+  SubscribeNamespaceErrorCodeValue,
+} from './error-codes.js'
+export {
+  AnnounceErrorCode,
+  FetchErrorCode,
+  PublishErrorCode,
+  SessionErrorCode,
+  StreamResetErrorCode,
+  SubscribeDoneStatusCode,
+  SubscribeErrorCode,
+  SubscribeNamespaceErrorCode,
+} from './error-codes.js'
 export {
   MESSAGE_ID_MAP,
   MESSAGE_TYPE_MAP,

package/src/drafts/draft13/types.ts

@@ -181,7 +181,7 @@ export interface Draft13AnnounceCancel extends Draft13BaseMessage {
   readonly reason_phrase: string
 }
 
-// Subscribe Namespace (renamed from subscribe_announces in draft-12)
+// Subscribe Namespace — type 0x11; drafts 07-12 name the same codepoint SUBSCRIBE_ANNOUNCES
 export interface Draft13SubscribeNamespace extends Draft13BaseMessage {
   readonly type: 'subscribe_namespace'
   readonly request_id: bigint

package/src/drafts/draft14/codec.ts

@@ -1,3 +1,4 @@
+import { type AuthRedaction, recordAuthValueSpan, redactWith } from '../../core/auth-redaction.js'
 import { BufferReader } from '../../core/buffer-reader.js'
 import { BufferWriter } from '../../core/buffer-writer.js'
 import { bytesToHex, hexToBytes } from '../../core/hex.js'
@@ -183,8 +184,9 @@ function decodeSetupParams(reader: BufferReader): Draft14Params {
         if (tokenReader.remaining > 0) {
           tok.token_type = tokenReader.readVarInt()
           if (tokenReader.remaining > 0) {
-            const tokenValue = tokenReader.readBytesView(tokenReader.remaining)
-            tok.token_value = new Uint8Array(tokenValue)
+            const value = new Uint8Array(tokenReader.readBytesView(tokenReader.remaining))
+            tok.token_value = value
+            noteAuthTokenValue(reader.offset - length, length, value)
           }
         }
         result.authorization_token = [
@@ -289,8 +291,9 @@ function decodeMessageParams(reader: BufferReader): Draft14Params {
         if (tokenReader.remaining > 0) {
           tok.token_type = tokenReader.readVarInt()
           if (tokenReader.remaining > 0) {
-            const tokenValue = tokenReader.readBytesView(tokenReader.remaining)
-            tok.token_value = new Uint8Array(tokenValue)
+            const value = new Uint8Array(tokenReader.readBytesView(tokenReader.remaining))
+            tok.token_value = value
+            noteAuthTokenValue(reader.offset - length, length, value)
           }
         }
         result.authorization_token = [
@@ -1386,3 +1389,61 @@ export function createDraft14Codec(): Draft14Codec {
     createDataStreamDecoder,
   }
 }
+
+/**
+ * Record where a Token Value sits, so it can be overwritten before the frame
+ * reaches anything that keeps it.
+ *
+ * The span falls out of the decode with no second walk. The Token Value is the
+ * last field of the Token structure, so its start is the parameter value's end
+ * minus the value's own length. The fields before it are left alone
+ * deliberately: Alias Type, Token Alias and Token Type are structure rather
+ * than secret, and they are what distinguishes a session that failed to
+ * authenticate from one that never tried.
+ *
+ * A token carrying no value at all -- DELETE and USE_ALIAS -- records nothing,
+ * and its frame passes through untouched.
+ */
+function noteAuthTokenValue(
+  valueStart: number,
+  valueLength: number,
+  value: Uint8Array | undefined,
+): void {
+  if (value === undefined || value.byteLength === 0) return
+  recordAuthValueSpan(valueStart + valueLength - value.byteLength, value.byteLength)
+}
+
+/**
+ * Overwrite every Authorization Token value in a draft-14 control frame.
+ *
+ * One decode, whose *output is discarded*: the point is not to read the
+ * message, it is to learn where the credentials were so the caller never has to
+ * hold a frame that contains one. A caller that also wants the message should
+ * decode the **redacted** frame with {@link decodeMessage}, which then cannot
+ * produce a value because there is no longer one in the bytes.
+ *
+ * A frame that fails to decode is still redacted as far as the decode got. That
+ * is the useful direction to fail in: a value that was read is a value that was
+ * exposed, whatever went wrong after it.
+ *
+ * See {@link AuthRedaction.incomplete} for the one result a caller must not
+ * treat as clean, and {@link AuthRedaction.decoded} for the residual it cannot
+ * close.
+ */
+export function redactAuthTokens(bytes: Uint8Array): AuthRedaction {
+  let payloadStart: number
+  try {
+    const probe = new BufferReader(bytes)
+    probe.readVarInt()
+    probe.readUint8()
+    probe.readUint8()
+    payloadStart = probe.offset
+  } catch {
+    // Too short to carry a message header, and so too short for the parameters
+    // that carry a credential. Reported as not decoded rather than as clean: a
+    // framer only ever emits complete frames, so a caller that gets here is
+    // holding something this function did not check.
+    return { bytes, redacted: 0, incomplete: false, decoded: false }
+  }
+  return redactWith(bytes, payloadStart, () => decodeMessage(bytes).ok)
+}