@powerhousedao/switchboard 6.2.3-dev.35 → 6.2.3-dev.37

package/dist/server.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.mts","names":[],"sources":["../src/privacy.mts","../src/workflow-runtime.mts","../src/types.ts","../src/builder-defaults.mts","../src/unsupported-stored-documents.mts","../src/server.mts"],"mappings":";;;;;;;;;;;;KAyBY;;EAEV;;EAEA;;EAEA,SAAS;;;;;;KCsBC;EACN;;EAEA;EACA;;;;;;;;;;YCpCM;;YAKA,wBAAwB;EAClC,eAAe;;YAGL;EACV;EACA;EACA;;YAGU;;EAEV;;;;;EAKA;;EAGA;;YAGU;;;;;;;;;;;;;;;;;;;;;EAqBV,UAAU;;;;;;;;EAQV;;;;;;;EAOA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;IAEM;IACA;;;;;;;EASN,WAAW;;EAEX;;;EAGA;;;EAGA;IACE;;;EAGF,UAAU;EACV,kBAAkB;EAClB;EACA;;;;;;EAMA;EACA,SAAS;;;;;;;;;;EAUT;;;;;;;;;;EAUA;;;;;;;;;EASA;IACE;IACA;IACA;;;;;;;;;;;EAWF;IACE;IACA;;;;;;;;;EASF,6BAA6B;;YAGnB;EACV;EACA,SAAS;;EAET,mBAAmB;;EAEnB,+BAA+B;;;EAG/B,mBAAmB;;EAEnB;;EAEA;IAAY,SAAS;;;EAErB;;EAEA,QAAQ;;;;;EAKR;;;;;;;;;;;;;EAaA,gBAAgB;;;;KC5MN;EAIV,iBAAiB;;EAEjB,mBAAmB;;EAEnB;;;;;;EAMA,gBAAgB;;EAEhB;;EAEA;IACE;IACA,eAAe,QAAQ;;;EAGzB,sBAAsB;EACtB,SAAS;;;;;;EAMT,SAAS;;;;;EAKT,cAAc,KAAK;;EAEnB,wBAAwB;;wBAsBV,gCACd,gBAAgB,gBAChB,eAAe,sBACf,UAAS;;;;wBC3EK,kCACd,OAAO,wCACP,KAAK,OAAO,aACX;;qBAaU,oCAAoC;WACtC;IAAqB;IAAkB;;WACvC;EAET,YAAY,OAAO;SAcZ,QAAQ,iBAAiB,SAAS;;;;;;;;;wBCyH3B,gBAAgB,eAAe;;wBAwI/B,8BACd,SAAS,KAAK,uDACd,oBACA,QAAQ;EACL;EAAmB,YAAY;;;;;;;;;;;;;;;;;;;qBA88BvB,mBAAgB,UAClB,uBACR,QAAQ"}
+{"version":3,"file":"server.d.mts","names":[],"sources":["../src/privacy.mts","../src/workflow-runtime.mts","../src/types.ts","../src/builder-defaults.mts","../src/unsupported-stored-documents.mts","../src/server.mts"],"mappings":";;;;;;;;;;;;KAyBY;;EAEV;;EAEA;;EAEA,SAAS;;;;;;KCsBC;EACN;;EAEA;EACA;;;;;;;;;;YCpCM;;YAKA,wBAAwB;EAClC,eAAe;;YAGL;EACV;EACA;EACA;;YAGU;;EAEV;;;;;EAKA;;EAGA;;YAGU;;;;;;;;;;;;;;;;;;;;;EAqBV,UAAU;;;;;;;;EAQV;;;;;;;EAOA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;IAEM;IACA;;;;;;;EASN,WAAW;;EAEX;;;EAGA;;;EAGA;IACE;;;EAGF,UAAU;EACV,kBAAkB;EAClB;EACA;;;;;;EAMA;EACA,SAAS;;;;;;;;;;EAUT;;;;;;;;;;EAUA;;;;;;;;;EASA;IACE;IACA;IACA;;;;;;;;;;;EAWF;IACE;IACA;;;;;;;;;EASF,6BAA6B;;YAGnB;EACV;EACA,SAAS;;EAET,mBAAmB;;EAEnB,+BAA+B;;;EAG/B,mBAAmB;;EAEnB;;EAEA;IAAY,SAAS;;;EAErB;;EAEA,QAAQ;;;;;EAKR;;;;;;;;;;;;;EAaA,gBAAgB;;;;KC5MN;EAIV,iBAAiB;;EAEjB,mBAAmB;;EAEnB;;;;;;EAMA,gBAAgB;;EAEhB;;EAEA;IACE;IACA,eAAe,QAAQ;;;EAGzB,sBAAsB;EACtB,SAAS;;;;;;EAMT,SAAS;;;;;EAKT,cAAc,KAAK;;EAEnB,wBAAwB;;wBAsBV,gCACd,gBAAgB,gBAChB,eAAe,sBACf,UAAS;;;;wBC3EK,kCACd,OAAO,wCACP,KAAK,OAAO,aACX;;qBAaU,oCAAoC;WACtC;IAAqB;IAAkB;;WACvC;EAET,YAAY,OAAO;SAcZ,QAAQ,iBAAiB,SAAS;;;;;;;;;wBCyH3B,gBAAgB,eAAe;;wBAwI/B,8BACd,SAAS,KAAK,uDACd,oBACA,QAAQ;EACL;EAAmB,YAAY;;;;;;;;;;;;;;;;;;;qBAg9BvB,mBAAgB,UAClB,uBACR,QAAQ"}

package/dist/server.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as resolveUnsupportedStoredDocuments, i as StoredDocumentsRefusedError, n as isPortAvailable, o as applySwitchboardReactorDefaults, r as startSwitchboard, t as deriveAttachmentServiceConfig } from "./server-CXAp5TOI.mjs";
+import { a as resolveUnsupportedStoredDocuments, i as StoredDocumentsRefusedError, n as isPortAvailable, o as applySwitchboardReactorDefaults, r as startSwitchboard, t as deriveAttachmentServiceConfig } from "./server-D3CYuEka.mjs";
 export { StoredDocumentsRefusedError, applySwitchboardReactorDefaults, deriveAttachmentServiceConfig, isPortAvailable, resolveUnsupportedStoredDocuments, startSwitchboard };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="91c41927-1b39-5750-b103-5886cde48ae6")}catch(e){}}();
-//# debugId=91c41927-1b39-5750-b103-5886cde48ae6
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="784a735c-87ca-55fa-bea5-af4fb82863ba")}catch(e){}}();
+//# debugId=784a735c-87ca-55fa-bea5-af4fb82863ba

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@powerhousedao/switchboard",
   "type": "module",
-  "version": "6.2.3-dev.35",
+  "version": "6.2.3-dev.37",
   "main": "dist/index.mjs",
   "exports": {
     ".": {
@@ -41,7 +41,7 @@
     "@openfeature/core": "1.9.1",
     "@openfeature/env-var-provider": "0.3.1",
     "@openfeature/server-sdk": "1.19.0",
-    "@powerhousedao/config": "6.2.3-dev.35",
+    "@powerhousedao/config": "6.2.3-dev.37",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
@@ -55,23 +55,23 @@
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.35",
-    "@powerhousedao/reactor": "6.2.3-dev.35",
-    "@powerhousedao/shared": "6.2.3-dev.35",
-    "@powerhousedao/vetra": "6.2.3-dev.35",
-    "@powerhousedao/reactor-api": "6.2.3-dev.35",
-    "@powerhousedao/reactor-attachments": "6.2.3-dev.35",
-    "@powerhousedao/reactor-drive": "6.2.3-dev.35",
-    "@powerhousedao/reactor-group": "6.2.3-dev.35",
-    "@powerhousedao/reactor-privacy": "6.2.3-dev.35",
-    "@powerhousedao/reactor-workflow": "6.2.3-dev.35",
-    "@powerhousedao/workflow": "6.2.3-dev.35",
-    "@powerhousedao/pglite-fs": "6.2.3-dev.35",
+    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.37",
+    "@powerhousedao/reactor": "6.2.3-dev.37",
+    "@powerhousedao/shared": "6.2.3-dev.37",
+    "@powerhousedao/vetra": "6.2.3-dev.37",
+    "@powerhousedao/reactor-api": "6.2.3-dev.37",
+    "@powerhousedao/reactor-attachments": "6.2.3-dev.37",
+    "@powerhousedao/reactor-drive": "6.2.3-dev.37",
+    "@powerhousedao/reactor-group": "6.2.3-dev.37",
+    "@powerhousedao/reactor-privacy": "6.2.3-dev.37",
+    "@powerhousedao/reactor-workflow": "6.2.3-dev.37",
+    "@powerhousedao/workflow": "6.2.3-dev.37",
+    "@powerhousedao/pglite-fs": "6.2.3-dev.37",
     "@pyroscope/nodejs": "^0.4.5",
-    "@renown/sdk": "6.2.3-dev.35",
+    "@renown/sdk": "6.2.3-dev.37",
     "@sentry/node": "^10.53.1",
     "@sentry/opentelemetry": "^10.53.1",
-    "document-model": "6.2.3-dev.35",
+    "document-model": "6.2.3-dev.37",
     "dotenv": "^16.4.7",
     "express": "^4.22.1",
     "graphql": "^16",

package/test/attachments/byte-grants.test.ts

@@ -94,7 +94,10 @@ function makeAccess(result: AttachmentAccessResult | Error) {
     result instanceof Error ? Promise.reject(result) : Promise.resolve(result),
   );
   return {
-    access: { canReadAttachment } as IAttachmentAccessService,
+    access: {
+      canReadAttachment,
+      admitCaller: () => Promise.resolve({ kind: "admitted" }),
+    } as IAttachmentAccessService,
     canReadAttachment,
   };
 }

package/test/attachments/download-target.test.ts

@@ -91,7 +91,13 @@ function makeAccess(result: AttachmentAccessResult): {
   spy: ReturnType<typeof vi.fn>;
 } {
   const spy = vi.fn().mockResolvedValue(result);
-  return { access: { canReadAttachment: spy }, spy };
+  return {
+    access: {
+      canReadAttachment: spy,
+      admitCaller: () => Promise.resolve({ kind: "admitted" }),
+    },
+    spy,
+  };
 }
 
 function makeAttachments(opts: {

package/test/attachments/reserve-metadata-parity.test.ts

@@ -0,0 +1,96 @@
+import {
+  InvalidAttachmentMetadata,
+  validateReserveMetadata,
+  type ReserveMetadata,
+} from "@powerhousedao/reactor-attachments";
+import { describe, expect, it } from "vitest";
+import { parseReserveOptions } from "../../src/attachments/routes.js";
+
+type Case = [name: string, meta: Record<string, unknown>];
+
+const base = { mimeType: "text/plain", fileName: "note.txt" };
+
+// The download route's setHeader throws on each of these.
+const headerBreaking: Case[] = [
+  ["CRLF before a parameter", { ...base, mimeType: "text/plain\r\n;a=b" }],
+  ["LF after a ;", { ...base, mimeType: "text/plain;\na=b" }],
+  ["a control char quoted", { ...base, mimeType: 'text/plain; a="\x01"' }],
+  ["a DEL quoted", { ...base, mimeType: 'text/plain; a="\x7f"' }],
+  ["a char above 0xFF quoted", { ...base, mimeType: 'text/plain;a="\u0100"' }],
+];
+
+const cases: Case[] = [
+  ["plain metadata", base],
+  ["an extension", { ...base, extension: "txt" }],
+  ["a null extension", { ...base, extension: null }],
+  ["a parameter", { ...base, mimeType: "text/plain; charset=utf-8" }],
+  ["a quoted parameter", { ...base, mimeType: 'text/plain; a="b c"' }],
+  ["a unicode file name", { ...base, fileName: "résumé.pdf" }],
+  ["a 255-char mimeType", { ...base, mimeType: `a/${"b".repeat(253)}` }],
+  ["a 256-char mimeType", { ...base, mimeType: `a/${"b".repeat(254)}` }],
+  ["a 255-char fileName", { ...base, fileName: "f".repeat(255) }],
+  ["a 256-char fileName", { ...base, fileName: "f".repeat(256) }],
+  ["an empty mimeType", { ...base, mimeType: "" }],
+  ["an empty fileName", { ...base, fileName: "" }],
+  ["an empty extension", { ...base, extension: "" }],
+  ["a mimeType with no slash", { ...base, mimeType: "text" }],
+  ["a mimeType with no subtype", { ...base, mimeType: "text/" }],
+  ["a mimeType with no type", { ...base, mimeType: "/plain" }],
+  ["a mimeType with two slashes", { ...base, mimeType: "text/plain/x" }],
+  ["a mimeType with a space", { ...base, mimeType: "text plain" }],
+  ["a mimeType with a dangling ;", { ...base, mimeType: "text/plain;" }],
+  ["a non-string mimeType", { ...base, mimeType: 5 }],
+  ["a trailing CRLF in mimeType", { ...base, mimeType: "text/plain\r\n" }],
+  [
+    "an injected header in mimeType",
+    { ...base, mimeType: "text/plain\nX-Injected: 1" },
+  ],
+  ["a NUL in mimeType", { ...base, mimeType: "text/pl\x00ain" }],
+  ...headerBreaking,
+  ["a NUL in fileName", { ...base, fileName: "a\x00b" }],
+  ["a LF in fileName", { ...base, fileName: "a\nb" }],
+  ["a CR in fileName", { ...base, fileName: "a\rb" }],
+  ["a tab in fileName", { ...base, fileName: "a\tb" }],
+  ["a DEL in fileName", { ...base, fileName: "a\x7fb" }],
+  ["a non-string fileName", { ...base, fileName: null }],
+  ["a slash in extension", { ...base, extension: "a/b" }],
+  ["a backslash in extension", { ...base, extension: "a\\b" }],
+  ["a bare slash extension", { ...base, extension: "/" }],
+  ["a non-string extension", { ...base, extension: 5 }],
+];
+
+function routeAccepts(meta: Record<string, unknown>): boolean {
+  return parseReserveOptions(meta) !== null;
+}
+
+function validatorAccepts(meta: Record<string, unknown>): boolean {
+  try {
+    validateReserveMetadata(meta as ReserveMetadata);
+    return true;
+  } catch (err) {
+    if (err instanceof InvalidAttachmentMetadata) return false;
+    throw err;
+  }
+}
+
+describe("reserve metadata parity between the route and validateReserveMetadata", () => {
+  it("covers both accepted and rejected metadata", () => {
+    const verdicts = cases.map(([, meta]) => routeAccepts(meta));
+    expect(verdicts).toContain(true);
+    expect(verdicts).toContain(false);
+  });
+
+  it.each(cases)("agrees on %s", (_name, meta) => {
+    expect(validatorAccepts(meta)).toBe(routeAccepts(meta));
+  });
+});
+
+describe("header-breaking mimeType values", () => {
+  it.each(headerBreaking)("the route rejects %s", (_name, meta) => {
+    expect(routeAccepts(meta)).toBe(false);
+  });
+
+  it.each(headerBreaking)("the validator rejects %s", (_name, meta) => {
+    expect(validatorAccepts(meta)).toBe(false);
+  });
+});

package/test/attachments/routes-integration.test.ts

@@ -31,6 +31,7 @@ const ALLOW_ALL: IAttachmentAccessService = {
       documentId: request.documentId as never,
       ref: request.attachmentRef as never,
     }),
+  admitCaller: () => Promise.resolve({ kind: "admitted" }),
 };
 
 describe("attachment routes through the real Express middleware stack", () => {

package/test/attachments/routes.test.ts

@@ -39,6 +39,7 @@ const ALLOW_ALL: IAttachmentAccessService = {
       documentId: request.documentId as never,
       ref: request.attachmentRef as never,
     }),
+  admitCaller: () => Promise.resolve({ kind: "admitted" }),
 };
 const grantedDownload = (attachments: AttachmentBuildResult) =>
   makeDownloadHandler(attachments, ALLOW_ALL, null);