@nocobase/plugin-flow-engine 2.0.0-alpha.2

package/dist/node_modules/ses/src/intrinsics.js

@@ -0,0 +1,192 @@
+import { cauterizeProperty } from './cauterize-property.js';
+import {
+  TypeError,
+  WeakSet,
+  arrayFilter,
+  create,
+  defineProperty,
+  entries,
+  freeze,
+  getOwnPropertyDescriptor,
+  getOwnPropertyDescriptors,
+  globalThis,
+  is,
+  isPrimitive,
+  hasOwn,
+  values,
+  weaksetHas,
+} from './commons.js';
+
+import {
+  constantProperties,
+  sharedGlobalPropertyNames,
+  universalPropertyNames,
+  permitted,
+} from './permits.js';
+
+/**
+ * @import {Reporter} from './reporting-types.js'
+ */
+
+const isFunction = obj => typeof obj === 'function';
+
+// Like defineProperty, but throws if it would modify an existing property.
+// We use this to ensure that two conflicting attempts to define the same
+// property throws, causing SES initialization to fail. Otherwise, a
+// conflict between, for example, two of SES's internal permits might
+// get masked as one overwrites the other. Accordingly, the thrown error
+// complains of a "Conflicting definition".
+function initProperty(obj, name, desc) {
+  if (hasOwn(obj, name)) {
+    const preDesc = getOwnPropertyDescriptor(obj, name);
+    if (
+      !preDesc ||
+      !is(preDesc.value, desc.value) ||
+      preDesc.get !== desc.get ||
+      preDesc.set !== desc.set ||
+      preDesc.writable !== desc.writable ||
+      preDesc.enumerable !== desc.enumerable ||
+      preDesc.configurable !== desc.configurable
+    ) {
+      throw TypeError(`Conflicting definitions of ${name}`);
+    }
+  }
+  defineProperty(obj, name, desc);
+}
+
+// Like defineProperties, but throws if it would modify an existing property.
+// This ensures that the intrinsics added to the intrinsics collector object
+// graph do not overlap.
+function initProperties(obj, descs) {
+  for (const [name, desc] of entries(descs)) {
+    initProperty(obj, name, desc);
+  }
+}
+
+// sampleGlobals creates an intrinsics object, suitable for
+// interinsicsCollector.addIntrinsics, from the named properties of a global
+// object.
+function sampleGlobals(globalObject, newPropertyNames) {
+  const newIntrinsics = { __proto__: null };
+  for (const [globalName, intrinsicName] of entries(newPropertyNames)) {
+    if (hasOwn(globalObject, globalName)) {
+      newIntrinsics[intrinsicName] = globalObject[globalName];
+    }
+  }
+  return newIntrinsics;
+}
+
+/**
+ * @param {Reporter} reporter
+ */
+export const makeIntrinsicsCollector = reporter => {
+  /** @type {Record<any, any>} */
+  const intrinsics = create(null);
+  let pseudoNatives;
+
+  const addIntrinsics = newIntrinsics => {
+    initProperties(intrinsics, getOwnPropertyDescriptors(newIntrinsics));
+  };
+  freeze(addIntrinsics);
+
+  // For each intrinsic, if it has a `.prototype` property, use the
+  // permits to find out the intrinsic name for that prototype and add it
+  // to the intrinsics.
+  const completePrototypes = () => {
+    for (const [name, intrinsic] of entries(intrinsics)) {
+      if (isPrimitive(intrinsic)) {
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      if (!hasOwn(intrinsic, 'prototype')) {
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      const permit = permitted[name];
+      if (typeof permit !== 'object') {
+        throw TypeError(`Expected permit object at permits.${name}`);
+      }
+      const namePrototype = permit.prototype;
+      if (!namePrototype) {
+        cauterizeProperty(
+          intrinsic,
+          'prototype',
+          false,
+          `${name}.prototype`,
+          reporter,
+        );
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      if (
+        typeof namePrototype !== 'string' ||
+        !hasOwn(permitted, namePrototype)
+      ) {
+        throw TypeError(`Unrecognized ${name}.prototype permits entry`);
+      }
+      const intrinsicPrototype = intrinsic.prototype;
+      if (hasOwn(intrinsics, namePrototype)) {
+        if (intrinsics[namePrototype] !== intrinsicPrototype) {
+          throw TypeError(`Conflicting bindings of ${namePrototype}`);
+        }
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      intrinsics[namePrototype] = intrinsicPrototype;
+    }
+  };
+  freeze(completePrototypes);
+
+  const finalIntrinsics = () => {
+    freeze(intrinsics);
+    pseudoNatives = new WeakSet(arrayFilter(values(intrinsics), isFunction));
+    return intrinsics;
+  };
+  freeze(finalIntrinsics);
+
+  const isPseudoNative = obj => {
+    if (!pseudoNatives) {
+      throw TypeError(
+        'isPseudoNative can only be called after finalIntrinsics',
+      );
+    }
+    return weaksetHas(pseudoNatives, obj);
+  };
+  freeze(isPseudoNative);
+
+  const intrinsicsCollector = {
+    addIntrinsics,
+    completePrototypes,
+    finalIntrinsics,
+    isPseudoNative,
+  };
+  freeze(intrinsicsCollector);
+
+  addIntrinsics(constantProperties);
+  addIntrinsics(sampleGlobals(globalThis, universalPropertyNames));
+
+  return intrinsicsCollector;
+};
+
+/**
+ * getGlobalIntrinsics()
+ * Doesn't tame, delete, or modify anything. Samples globalObject to create an
+ * intrinsics record containing only the permitted global variables, listed
+ * by the intrinsic names appropriate for new globals, i.e., the globals of
+ * newly constructed compartments.
+ *
+ * WARNING:
+ * If run before lockdown, the returned intrinsics record will carry the
+ * *original* unsafe (feral, untamed) bindings of these global variables.
+ *
+ * @param {object} globalObject
+ * @param {Reporter} reporter
+ */
+export const getGlobalIntrinsics = (globalObject, reporter) => {
+  // TODO pass a proper reporter to `makeIntrinsicsCollector`
+  const { addIntrinsics, finalIntrinsics } = makeIntrinsicsCollector(reporter);
+
+  addIntrinsics(sampleGlobals(globalObject, sharedGlobalPropertyNames));
+
+  return finalIntrinsics();
+};

package/dist/node_modules/ses/src/lockdown-shim.js

@@ -0,0 +1,37 @@
+// @ts-check
+
+// We import this first to fail as fast as possible if the shim has been
+// transformed or embedded in a way that causes it to run in sloppy mode.
+// See https://github.com/endojs/endo/blob/master/packages/ses/error-codes/SES_NO_SLOPPY.md
+import './assert-sloppy-mode.js';
+import { globalThis } from './commons.js';
+import { repairIntrinsics } from './lockdown.js';
+
+/** @import {LockdownOptions} from '../types.js' */
+
+/**
+ * @param {LockdownOptions} [options]
+ */
+globalThis.lockdown = options => {
+  const hardenIntrinsics = repairIntrinsics(options);
+  globalThis.harden = hardenIntrinsics();
+};
+
+/**
+ * @param {LockdownOptions} [options]
+ */
+globalThis.repairIntrinsics = options => {
+  const hardenIntrinsics = repairIntrinsics(options);
+  // Reveal hardenIntrinsics after repairs.
+  globalThis.hardenIntrinsics = () => {
+    // Reveal harden after hardenIntrinsics.
+    // Harden is dangerous before hardenIntrinsics because hardening just
+    // about anything will inadvertently render intrinsics irreparable.
+    // Also, for modules that must work both before or after lockdown (code
+    // that is portable between JS and SES), the existence of harden in global
+    // scope signals whether such code should attempt to use harden in the
+    // defense of its own API.
+    // @ts-ignore harden not yet recognized on globalThis.
+    globalThis.harden = hardenIntrinsics();
+  };
+};