@sockethub/platform-carddav 1.0.0-beta.0 → 1.0.0-beta.2

package/README.md

@@ -5,8 +5,25 @@ creating, updating, and deleting vCard contacts.
 
 The platform accepts public HTTPS services by default. Administrators may opt
 in to HTTP or private-network services with `allowInsecureHttp` and
-`allowPrivateAddresses`. Authentication supports Basic, Digest, or a
-caller-provided Bearer token through the standard Sockethub credentials flow.
+`allowPrivateAddresses`. Address checks use the shared outbound URL guard,
+including IPv6 embeddings of private ranges and the local-use NAT64 prefix
+`64:ff9b:1::/48`. See
+[Outbound URL guard](../../docs/configuration.md#outbound-url-guard).
+Authentication supports Basic, Digest, or a caller-provided Bearer token
+through the standard Sockethub credentials flow.
+
+## Discovery cache
+
+Each `query`, `create`, `update`, and `delete` needs the account's address book list to
+check the target. The platform caches that discovery result in memory for
+`packageConfig.discoveryCacheTtlMs` (default `300000`, 5 minutes; `0`
+disables the cache). Entries are keyed by an HMAC of the protocol, service URL,
+and credentials. The HMAC uses a per-process random secret, and only
+collection metadata is stored. A `fetch` always discovers fresh. Within the TTL,
+an address book added on the server is not visible to targeted actions, and a removed
+one is still accepted as a target (the server then rejects the request). An
+authentication, not-found, or unknown-address-book error drops the entry, so the next
+request rediscovers. The cache is lost when the platform process restarts.
 
 ## Authentication
 

package/dist/index.d.ts

@@ -2,7 +2,10 @@ import type { ActivityStream, PlatformCallback, PlatformInterface, PlatformSchem
 import type { CardDavCredentials } from "./types.js";
 export default class CardDav implements PlatformInterface {
     private readonly log;
-    config: StatelessPlatformConfig;
+    private readonly discovery;
+    config: StatelessPlatformConfig & {
+        discoveryCacheTtlMs: number;
+    };
     constructor(session: PlatformSession);
     get schema(): PlatformSchemaStruct;
     isInitialized(): boolean;
@@ -13,6 +16,7 @@ export default class CardDav implements PlatformInterface {
     update(job: ActivityStream, credentials: CardDavCredentials, done: PlatformCallback): void;
     delete(job: ActivityStream, credentials: CardDavCredentials, done: PlatformCallback): void;
     private client;
+    private discoveryKey;
     private book;
     private mutation;
     private fail;

package/dist/index.js

@@ -15762,7 +15762,7 @@ var require_ajv_formats_draft2019 = __commonJS(function(exports, module) {
 
 // ../dav/dist/index.js
 import { createRequire as createRequire2 } from "node:module";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes } from "node:crypto";
 import { lookup as dnsLookup } from "node:dns";
 import { isIP } from "node:net";
 var __commonJS2 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
@@ -39185,7 +39185,7 @@ function createGuardedLookup(allowPrivateAddresses) {
       if (!allowPrivateAddresses) {
         for (const { address } of addresses) {
           if (isBlockedAddress(address)) {
-            callback(new Error(`blocked non-public address ${address} for ${hostname}`));
+            callback(new Error(`blocked non-public address for ${hostname}`));
             return;
           }
         }
@@ -42746,6 +42746,82 @@ function isDavCollectionChild(collectionId, resourceId) {
     return false;
   }
 }
+
+class DiscoveryCache {
+  maxEntries;
+  secret = randomBytes(32);
+  entries = new Map;
+  pending = new Map;
+  timer;
+  timerAt = Number.POSITIVE_INFINITY;
+  constructor(maxEntries = 1000) {
+    this.maxEntries = maxEntries;
+  }
+  key(...identity) {
+    return createHmac("sha256", this.secret).update(JSON.stringify(identity)).digest("hex");
+  }
+  async get(key, ttlMs, discover) {
+    if (!(ttlMs > 0))
+      return discover();
+    const hit = this.entries.get(key);
+    if (hit && hit.expires > Date.now())
+      return hit.value;
+    const inFlight = this.pending.get(key);
+    if (inFlight)
+      return inFlight;
+    const promise = discover();
+    this.pending.set(key, promise);
+    try {
+      const value = await promise;
+      if (this.pending.get(key) === promise)
+        this.store(key, value, Date.now() + ttlMs);
+      return value;
+    } finally {
+      if (this.pending.get(key) === promise)
+        this.pending.delete(key);
+    }
+  }
+  delete(key) {
+    this.entries.delete(key);
+    this.pending.delete(key);
+  }
+  get size() {
+    return this.entries.size;
+  }
+  store(key, value, expires) {
+    this.entries.delete(key);
+    if (this.entries.size >= this.maxEntries) {
+      this.sweep();
+      if (this.entries.size >= this.maxEntries)
+        this.entries.delete(this.entries.keys().next().value);
+    }
+    this.entries.set(key, { expires, value });
+    this.schedule(expires);
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [key, entry] of this.entries)
+      if (entry.expires <= now)
+        this.entries.delete(key);
+  }
+  schedule(at) {
+    if (this.timer && at >= this.timerAt)
+      return;
+    clearTimeout(this.timer);
+    this.timerAt = at;
+    this.timer = setTimeout(() => {
+      this.timer = undefined;
+      this.timerAt = Number.POSITIVE_INFINITY;
+      this.sweep();
+      let next = Number.POSITIVE_INFINITY;
+      for (const entry of this.entries.values())
+        next = Math.min(next, entry.expires);
+      if (next !== Number.POSITIVE_INFINITY)
+        this.schedule(next);
+    }, Math.min(Math.max(0, at - Date.now()), 2147483647));
+    this.timer.unref?.();
+  }
+}
 function unquote(value) {
   return value.startsWith('"') ? value.slice(1, -1).replace(/\\(.)/g, "$1") : value;
 }
@@ -43199,7 +43275,7 @@ var ActivityStreamSchema = {
 var package_default = {
   name: "@sockethub/schemas",
   description: "JSON schema files for validating Sockethub Activity Streams",
-  version: "3.0.0-beta.0",
+  version: "3.0.0-beta.2",
   type: "module",
   private: false,
   author: "Nick Jennings <nick@silverbucket.net>",
@@ -43269,7 +43345,7 @@ var package_default = {
     "ajv-formats": "^2.1.1",
     "ajv-formats-draft2019": "^1.6.1"
   },
-  gitHead: "75002ae8f15d7679bd58a9327f5a1d7eeaffa237",
+  gitHead: "1f74d4e07311496f0acc021855137bc197d79eab",
   types: "./dist/index.d.ts"
 };
 
@@ -43374,8 +43450,11 @@ var SockethubConfigSchema = {
         "@sockethub/platform-caldav",
         "@sockethub/platform-dummy",
         "@sockethub/platform-feeds",
+        "@sockethub/platform-email",
         "@sockethub/platform-irc",
         "@sockethub/platform-metadata",
+        "@sockethub/platform-messenger",
+        "@sockethub/platform-instagram",
         "@sockethub/platform-xmpp"
       ]
     },
@@ -43391,7 +43470,8 @@ var SockethubConfigSchema = {
             connectTimeoutMs: { type: "integer", minimum: 1 },
             allowPrivateAddresses: { type: "boolean" },
             allowInsecureHttp: { type: "boolean" },
-            concurrency: { type: "integer", minimum: 1 }
+            concurrency: { type: "integer", minimum: 1 },
+            discoveryCacheTtlMs: { type: "integer", minimum: 0 }
           }
         },
         "@sockethub/platform-caldav": {
@@ -43401,7 +43481,20 @@ var SockethubConfigSchema = {
             connectTimeoutMs: { type: "integer", minimum: 1 },
             allowPrivateAddresses: { type: "boolean" },
             allowInsecureHttp: { type: "boolean" },
-            concurrency: { type: "integer", minimum: 1 }
+            concurrency: { type: "integer", minimum: 1 },
+            discoveryCacheTtlMs: { type: "integer", minimum: 0 }
+          }
+        },
+        "@sockethub/platform-email": {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            connectTimeoutMs: {
+              type: "integer",
+              minimum: 5000,
+              maximum: 120000
+            },
+            allowPrivateAddresses: { type: "boolean" }
           }
         },
         "@sockethub/platform-dummy": {
@@ -43424,14 +43517,16 @@ var SockethubConfigSchema = {
           type: "object",
           additionalProperties: false,
           properties: {
-            connectTimeoutMs: { type: "number" }
+            connectTimeoutMs: { type: "number" },
+            allowPrivateAddresses: { type: "boolean" }
           }
         },
         "@sockethub/platform-xmpp": {
           type: "object",
           additionalProperties: false,
           properties: {
-            connectTimeoutMs: { type: "number" }
+            connectTimeoutMs: { type: "number" },
+            allowPrivateAddresses: { type: "boolean" }
           }
         },
         "@sockethub/platform-metadata": {
@@ -43521,11 +43616,29 @@ var SockethubConfigSchema = {
       type: "object",
       additionalProperties: false,
       properties: {
+        maxInstancesPerSession: {
+          type: "integer",
+          minimum: 0,
+          default: 10,
+          description: "Maximum persistent instances per socket session. 0 disables the cap."
+        },
+        maxInstancesPerIp: {
+          type: "integer",
+          minimum: 0,
+          default: 20,
+          description: "Maximum persistent instances per client IP, including HTTP actions. 0 disables the cap."
+        },
+        maxStartsPerIpPerMinute: {
+          type: "integer",
+          minimum: 0,
+          default: 60,
+          description: "Maximum new persistent instances a client IP may start per minute, " + "including HTTP actions. Bounds fork/teardown churn that the " + "concurrent caps allow. Reusing a running instance does not count. " + "0 disables the cap."
+        },
         maxPlatformInstances: {
           type: "number",
           minimum: 0,
           default: 100,
-          description: "Upper bound on concurrently running platform instances " + "(child processes). Each persistent-platform actor forks " + "its own process, so an unbounded count is a resource " + "exhaustion risk on public instances. 0 disables the cap."
+          description: "Upper bound on concurrently running persistent platform instances " + "(child processes). Each persistent-platform actor forks " + "its own process, so an unbounded count is a resource " + "exhaustion risk on public instances. 0 disables the cap."
         }
       }
     },
@@ -43706,33 +43819,66 @@ var SockethubConfigSchema = {
 };
 var SockethubConfigSchemaId = versionedSchemaId(SockethubConfigSchema.$id, package_default.version);
 
-// ../schemas/src/service-descriptor.ts
-var import_ajv = __toESM(require_ajv(), 1);
-var ajv = new import_ajv.default({ strictTypes: false, allErrors: true });
+// ../schemas/src/helpers/codegen.ts
+var available;
+var warned = false;
+function isCodegenAvailable() {
+  if (available === undefined) {
+    try {
+      new Function("return true");
+      available = true;
+    } catch {
+      available = false;
+    }
+  }
+  return available;
+}
+function warnCodegenUnavailable() {
+  if (warned) {
+    return;
+  }
+  warned = true;
+  console.warn("[@sockethub/schemas] Schema validation is disabled: this environment's Content Security Policy blocks `new Function`, which Ajv needs to compile schemas. The Sockethub server still validates every message.");
+}
 
 // ../schemas/src/validator.ts
-var import_ajv2 = __toESM(require_ajv(), 1);
+var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 var import_ajv_formats_draft2019 = __toESM(require_ajv_formats_draft2019(), 1);
-var ajv2 = new import_ajv2.default({ strictTypes: false, allErrors: true });
-import_ajv_formats.default(ajv2);
-import_ajv_formats_draft2019.default(ajv2);
 var schemaURL = "https://sockethub.org/schemas/v0";
 var schemas = {};
 var systemContextsRegistered = false;
 schemas[`${schemaURL}/activity-stream`] = ActivityStreamSchema;
-for (const uri in schemas) {
-  ajv2.addSchema(schemas[uri], uri);
+var ajv;
+function getAjv() {
+  if (!isCodegenAvailable()) {
+    warnCodegenUnavailable();
+    return;
+  }
+  if (!ajv) {
+    const instance = new import_ajv.default({ strictTypes: false, allErrors: true });
+    import_ajv_formats.default(instance);
+    import_ajv_formats_draft2019.default(instance);
+    for (const uri in schemas) {
+      instance.addSchema(schemas[uri], uri);
+    }
+    ajv = instance;
+  }
+  return ajv;
 }
 function registerSystemContext(platformId, contextUrl) {
   registerPlatformContext(platformId, contextUrl, `${schemaURL}/context/${platformId}/messages`, `${schemaURL}/context/${platformId}/credentials`);
+  const instance = getAjv();
+  if (!instance) {
+    return;
+  }
   const messageSchemaRef = `${schemaURL}/context/${platformId}/messages`;
-  if (!ajv2.getSchema(messageSchemaRef)) {
-    ajv2.addSchema({}, messageSchemaRef);
+  if (!instance.getSchema(messageSchemaRef)) {
+    instance.addSchema({}, messageSchemaRef);
   }
   const credentialsSchemaRef = `${schemaURL}/context/${platformId}/credentials`;
-  if (!ajv2.getSchema(credentialsSchemaRef)) {
-    ajv2.addSchema({}, credentialsSchemaRef);
+  if (!instance.getSchema(credentialsSchemaRef)) {
+    instance.addSchema({}, credentialsSchemaRef);
   }
 }
 function registerSystemPlatformContexts() {
@@ -43796,8 +43942,10 @@ function splitEscaped(value, separator) {
   result.push(current);
   return result;
 }
-var unescapeText = (value) => value.replace(/\\n/gi, `
-`).replace(/\\,/g, ",").replace(/\\;/g, ";").replace(/\\\\/g, "\\");
+function unescapeText(value) {
+  return value.replaceAll(/\\([nN,;\\])/g, (_match, character) => character === "n" || character === "N" ? `
+` : character);
+}
 var escapeText = (value) => value.replace(/\r\n?/g, `
 `).replaceAll("\\", "\\\\").replaceAll(`
 `, "\\n").replaceAll(";", "\\;").replaceAll(",", "\\,");
@@ -44033,20 +44181,20 @@ function params(value) {
 }
 function fold(line) {
   const chunks = [];
-  let rest = line;
-  while (Buffer.byteLength(rest, "utf8") > 75) {
-    let end = Math.min(75, rest.length);
-    while (Buffer.byteLength(rest.slice(0, end), "utf8") > 75)
-      end -= 1;
-    const preceding = rest.charCodeAt(end - 1);
-    if (preceding >= 55296 && preceding <= 56319)
-      end -= 1;
-    if (end <= 0)
-      throw new Error("unable to fold vCard content line");
-    chunks.push(rest.slice(0, end));
-    rest = rest.slice(end);
-  }
-  chunks.push(rest);
+  let start = 0;
+  let end = 0;
+  let octets = 0;
+  for (const char of line) {
+    const size = Buffer.byteLength(char, "utf8");
+    if (octets + size > (chunks.length ? 74 : 75)) {
+      chunks.push(line.slice(start, end));
+      start = end;
+      octets = 0;
+    }
+    octets += size;
+    end += char.length;
+  }
+  chunks.push(line.slice(start));
   return chunks.join(`\r
  `);
 }
@@ -44337,7 +44485,7 @@ class CardDavClient extends DavClient {
 var package_default2 = {
   name: "@sockethub/platform-carddav",
   description: "A Sockethub platform for CardDAV address books and contacts",
-  version: "1.0.0-beta.0",
+  version: "1.0.0-beta.2",
   type: "module",
   private: false,
   license: "LGPL-3.0+",
@@ -44366,21 +44514,21 @@ var package_default2 = {
     test: "bun test src/"
   },
   dependencies: {
-    "@sockethub/dav": "^1.0.0-beta.0",
-    "@sockethub/schemas": "^3.0.0-beta.0"
+    "@sockethub/dav": "^1.0.0-beta.2",
+    "@sockethub/schemas": "^3.0.0-beta.2"
   },
   devDependencies: {
     "@types/bun": "latest"
   },
   peerDependencies: {
-    "@sockethub/server": "^5.0.0-beta.0"
+    "@sockethub/server": "^5.0.0-beta.2"
   },
   peerDependenciesMeta: {
     "@sockethub/server": {
       optional: true
     }
   },
-  gitHead: "75002ae8f15d7679bd58a9327f5a1d7eeaffa237"
+  gitHead: "1f74d4e07311496f0acc021855137bc197d79eab"
 };
 
 // src/schema.ts
@@ -44673,13 +44821,15 @@ var CONTEXT = buildCanonicalContext(PlatformCardDavSchema.contextUrl);
 
 class CardDav {
   log;
+  discovery = new DiscoveryCache;
   config = {
     persist: false,
     requireCredentials: ["fetch", "query", "create", "update", "delete"],
     connectTimeoutMs: 15000,
     allowPrivateAddresses: false,
     allowInsecureHttp: false,
-    concurrency: 10
+    concurrency: 10,
+    discoveryCacheTtlMs: 300000
   };
   constructor(session) {
     this.log = session.log;
@@ -44702,40 +44852,40 @@ class CardDav {
       summary: "CardDAV address books",
       totalItems: items.length,
       items
-    })).catch((error) => this.fail(job, error, done)).finally(() => client.close().catch(() => {}));
+    })).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
   }
   query(job, credentials, done) {
     const client = this.client(credentials);
-    this.book(client, job.target?.id ?? "").then((book) => client.query(book, job.object ?? {})).then((items) => done(null, {
+    this.book(client, credentials, job.target?.id ?? "").then((book) => client.query(book, job.object ?? {})).then((items) => done(null, {
       "@context": CONTEXT,
       ...job.id ? { id: job.id } : {},
       type: "collection",
       summary: "CardDAV contacts",
       totalItems: items.length,
       items
-    })).catch((error) => this.fail(job, error, done)).finally(() => client.close().catch(() => {}));
+    })).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
   }
   create(job, credentials, done) {
     const client = this.client(credentials);
-    this.book(client, job.target?.id ?? "").then((book) => client.create(book, job.object)).then((result) => done(null, this.mutation(job, "create", result))).catch((error) => this.fail(job, error, done)).finally(() => client.close().catch(() => {}));
+    this.book(client, credentials, job.target?.id ?? "").then((book) => client.create(book, job.object)).then((result) => done(null, this.mutation(job, "create", result))).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
   }
   update(job, credentials, done) {
     const client = this.client(credentials);
     const input = job.object;
-    this.book(client, job.target?.id ?? "").then((book) => {
+    this.book(client, credentials, job.target?.id ?? "").then((book) => {
       if (!isDavCollectionChild(book.id, input.id))
         throw new DavFailure("carddav:invalid-resource");
       return client.update(input);
-    }).then((result) => done(null, this.mutation(job, "update", result))).catch((error) => this.fail(job, error, done)).finally(() => client.close().catch(() => {}));
+    }).then((result) => done(null, this.mutation(job, "update", result))).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
   }
   delete(job, credentials, done) {
     const client = this.client(credentials);
     const input = job.object;
-    this.book(client, job.target?.id ?? "").then((book) => {
+    this.book(client, credentials, job.target?.id ?? "").then((book) => {
       if (!isDavCollectionChild(book.id, input.id))
         throw new DavFailure("carddav:invalid-resource");
       return client.delete(input.id, input.etag);
-    }).then(() => done(null, this.mutation(job, "delete", { id: input.id }))).catch((error) => this.fail(job, error, done)).finally(() => client.close().catch(() => {}));
+    }).then(() => done(null, this.mutation(job, "delete", { id: input.id }))).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
   }
   client(credentials) {
     const { url, ...authentication } = credentials.object;
@@ -44744,14 +44894,18 @@ class CardDav {
       allowInsecureHttp: this.config.allowInsecureHttp
     });
   }
-  async book(client, id) {
+  discoveryKey(credentials) {
+    return this.discovery.key("carddav", credentials.object);
+  }
+  async book(client, credentials, id) {
     let normalized;
     try {
       normalized = new URL(id).href;
     } catch {
       throw new DavFailure("carddav:invalid-address-book");
     }
-    const book = (await client.discoverAddressBooks()).find((item) => item.id === normalized);
+    const books = await this.discovery.get(this.discoveryKey(credentials), this.config.discoveryCacheTtlMs, () => client.discoverAddressBooks());
+    const book = books.find((item) => item.id === normalized);
     if (!book)
       throw new DavFailure("carddav:invalid-address-book");
     return book;
@@ -44771,7 +44925,9 @@ class CardDav {
       }
     };
   }
-  fail(job, error, done) {
+  fail(job, error, done, credentials) {
+    if (credentials && error instanceof DavFailure && /:(authentication-failed|not-found|invalid-address-book)$/.test(error.code))
+      this.discovery.delete(this.discoveryKey(credentials));
     const code = error instanceof DavFailure ? error.code : `carddav:invalid-${job.type}`;
     this.log.error(`CardDAV ${job.type} failed for actor ${job.actor.id}`, {
       code,
@@ -44789,4 +44945,4 @@ export {
   parseVCard
 };
 
-//# debugId=9B429FF2EF86262D64756E2164756E21
+//# debugId=DCD67AD60F21618364756E2164756E21