@odla-ai/chapter 0.48.1 → 0.48.3

package/dist/worker/index.d.cts

@@ -287,7 +287,7 @@ interface LeaderFormationConfig {
     maxLen?: Record<string, number>;
     /** Per-string cap when `maxLen` has no field override. Default 4000. */
     defaultMaxLen?: number;
-    /** Maximum JSON request size in characters. Default 32768. */
+    /** Maximum JSON request size in UTF-8 bytes, enforced while streaming. Default 32768. */
     bodyCap?: number;
 }
 /** Fully resolved formation intake policy. */
@@ -590,7 +590,7 @@ interface ChapterApplication {
     /** Per-field character cap. Fields not listed use `defaultMaxLen`. */
     maxLen?: Record<string, number>;
     defaultMaxLen?: number;
-    /** Max JSON request body in bytes. Default 32768. */
+    /** Max JSON request body in UTF-8 bytes, enforced while streaming. Default 32768. */
     bodyCap?: number;
     /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
      *  writing a row with no consent record. Default `true`. Set `false`

package/dist/worker/index.d.ts

@@ -287,7 +287,7 @@ interface LeaderFormationConfig {
     maxLen?: Record<string, number>;
     /** Per-string cap when `maxLen` has no field override. Default 4000. */
     defaultMaxLen?: number;
-    /** Maximum JSON request size in characters. Default 32768. */
+    /** Maximum JSON request size in UTF-8 bytes, enforced while streaming. Default 32768. */
     bodyCap?: number;
 }
 /** Fully resolved formation intake policy. */
@@ -590,7 +590,7 @@ interface ChapterApplication {
     /** Per-field character cap. Fields not listed use `defaultMaxLen`. */
     maxLen?: Record<string, number>;
     defaultMaxLen?: number;
-    /** Max JSON request body in bytes. Default 32768. */
+    /** Max JSON request body in UTF-8 bytes, enforced while streaming. Default 32768. */
     bodyCap?: number;
     /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
      *  writing a row with no consent record. Default `true`. Set `false`

package/dist/worker/index.js

@@ -3637,6 +3637,47 @@ async function memberSessionApplication(db, chapterId, runtime, identity) {
   ) };
 }
 
+// src/bounded-request-text.ts
+async function readBoundedRequestText(req, maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) throw new TypeError("invalid request body cap");
+  const reader = req.body?.getReader();
+  const cancel = () => {
+    void reader?.cancel().catch(() => {
+    });
+  };
+  const invalid2 = () => json({ error: "invalid JSON body" }, 400);
+  let complete = false;
+  req.signal.addEventListener("abort", cancel, { once: true });
+  try {
+    if (req.signal.aborted) return invalid2();
+    const declared = req.headers.get("content-length");
+    if (declared && /^\d+$/.test(declared) && Number(declared) > maxBytes) {
+      return json({ error: "request body too large" }, 413);
+    }
+    if (!reader) return "";
+    const decoder = new TextDecoder();
+    let bytes = 0;
+    let text6 = "";
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (req.signal.aborted) return invalid2();
+      if (done) {
+        complete = true;
+        return text6 + decoder.decode();
+      }
+      bytes += value.byteLength;
+      if (bytes > maxBytes) return json({ error: "request body too large" }, 413);
+      text6 += decoder.decode(value, { stream: true });
+    }
+  } catch {
+    return invalid2();
+  } finally {
+    req.signal.removeEventListener("abort", cancel);
+    if (!complete) cancel();
+    reader?.releaseLock();
+  }
+}
+
 // src/clerk.ts
 async function rejectedCreate(res) {
   const body = typeof res.json === "function" ? await res.json().catch(() => null) : null;
@@ -4055,8 +4096,8 @@ var handleMember = async (req, url, env, ctx) => {
     return resumeJoin(url, env, ctx);
   }
   if (req.method === "POST" && url.pathname === "/api/applications") {
-    const raw2 = await req.text();
-    if (raw2.length > chapter.application.bodyCap) return json({ error: "request body too large" }, 413);
+    const raw2 = await readBoundedRequestText(req, chapter.application.bodyCap);
+    if (raw2 instanceof Response) return raw2;
     let parsed;
     try {
       parsed = JSON.parse(raw2);
@@ -6951,8 +6992,8 @@ async function firstRow2(db, ns, q) {
 async function startSubscription(req, env, ctx) {
   let body;
   try {
-    const raw2 = await req.text();
-    if (raw2.length > ctx.chapter.application.bodyCap) return json({ error: "request body too large" }, 413);
+    const raw2 = await readBoundedRequestText(req, ctx.chapter.application.bodyCap);
+    if (raw2 instanceof Response) return raw2;
     body = JSON.parse(raw2);
     if (!body || typeof body !== "object" || Array.isArray(body)) throw new TypeError("body");
   } catch {
@@ -9292,6 +9333,9 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/network/push") return null;
   const got = await gate6(req, env, ctx);
   if ("response" in got) return got.response;
+  if (!await networkWriteAllowed(req, got.db, got.user, ctx)) {
+    return json({ error: "super-admin required", code: "super_admin_required" }, 403);
+  }
   let body;
   try {
     body = await req.json();
@@ -11823,8 +11867,8 @@ var handleFormation = async (req, url, env, ctx) => {
     });
   }
   if (req.method !== "POST" || url.pathname !== "/api/formation/applications") return null;
-  const raw2 = await req.text();
-  if (raw2.length > formation.bodyCap) return json({ error: "request body too large" }, 413);
+  const raw2 = await readBoundedRequestText(req, formation.bodyCap);
+  if (raw2 instanceof Response) return raw2;
   let body;
   try {
     body = JSON.parse(raw2);