@oomol-lab/open-flow 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/common/scheduler.js

@@ -158,15 +158,15 @@ function p(e) {
 	return e.reason instanceof Error ? e.reason : /* @__PURE__ */ Error("Run canceled.");
 }
 function m(e, t) {
-	return t.aborted ? Promise.reject(p(t)) : new Promise((n, r) => {
+	return new Promise((n, r) => {
 		let i = () => {
 			t.removeEventListener("abort", i), r(p(t));
 		};
-		t.addEventListener("abort", i, { once: !0 }), e.then((e) => {
+		e.then((e) => {
 			t.removeEventListener("abort", i), n(e);
 		}, (e) => {
 			t.removeEventListener("abort", i), r(e);
-		});
+		}), t.aborted ? i() : t.addEventListener("abort", i, { once: !0 });
 	});
 }
 async function h(t, n, u, p, g, v, y = {}, b, x) {

package/dist/common/webhook-trigger.js

@@ -144,6 +144,40 @@ var u = [], d = [{
 			}, "Disallowed origin");
 		}
 	},
+	{
+		fixture: {
+			inputsDef: u,
+			options: {
+				responseData: "<script>globalThis.compromised = true<\/script>",
+				responseHeaders: {
+					"access-control-allow-credentials": "true",
+					"content-security-policy": "default-src * 'unsafe-inline'",
+					"content-type": "text/html",
+					location: "https://attacker.example",
+					"set-cookie": "open_flow_operator_session=forged",
+					"x-accel-redirect": "/auth/session"
+				}
+			}
+		},
+		name: "prevents Project responses from becoming executable or controlling deployment headers",
+		async verify(e) {
+			await c(await l(e), {
+				body: "<script>globalThis.compromised = true<\/script>",
+				headers: {
+					"access-control-allow-credentials": null,
+					"content-security-policy": "default-src 'none'; frame-ancestors 'none'; sandbox",
+					"content-type": "text/plain;charset=UTF-8",
+					location: null,
+					"referrer-policy": "no-referrer",
+					"set-cookie": null,
+					"x-accel-redirect": null,
+					"x-content-type-options": "nosniff",
+					"x-frame-options": "DENY"
+				},
+				status: 200
+			}, "Safe configured response");
+		}
+	},
 	{
 		fixture: { inputsDef: d },
 		name: "rejects invalid JSON, invalid payloads, invalid idempotency keys, and oversized bodies",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oomol-lab/open-flow",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.4",
   "description": "TypeScript contracts and Browser runtime for Open Flow.",
   "license": "Apache-2.0",
   "repository": {
@@ -45,6 +45,10 @@
       "types": "./dist/common/provider-triggers.d.ts",
       "import": "./dist/common/provider-triggers.js"
     },
+    "./project-authoring": {
+      "types": "./dist/browser/project-authoring.d.ts",
+      "import": "./dist/browser/project-authoring.js"
+    },
     "./project-change": {
       "types": "./dist/browser/project-change.d.ts",
       "import": "./dist/browser/project-change.js"