@sockethub/server 5.0.0-beta.0 → 5.0.0-beta.1

package/dist/message-handlers.d.ts

@@ -30,7 +30,5 @@ export interface MessageHandlersOptions {
  * Normalize middleware errors into payload-safe error responses.
  * Removes internal-only properties that must never be sent to clients.
  */
-export declare function attachError<T extends ActivityStream>(err: unknown, msg?: T): Error | (T & {
-    sessionSecret?: string;
-});
+export declare function attachError<T extends ActivityStream>(err: unknown, msg?: T): T | Error;
 export declare function createMessageHandlers(options: MessageHandlersOptions): MessageHandlers;

package/dist/middleware/normalize-activity-stream.d.ts

@@ -1,3 +1,16 @@
 import type { ActivityStream } from "@sockethub/schemas";
 import type { MiddlewareChainInterface } from "../middleware.js";
+/**
+ * Maximum nesting depth accepted for client-supplied messages. Validation
+ * error formatting and the socket.io encoder both recurse over the message, so
+ * an unbounded depth lets a single payload overflow the stack and crash the
+ * server.
+ */
+export declare const MAX_MESSAGE_DEPTH = 64;
+/**
+ * Iteratively check whether a value nests deeper than `max` levels. Must not
+ * recurse itself, since it guards the recursive code paths.
+ */
+export declare function exceedsDepth(root: unknown, max?: number): boolean;
+/** Reject malformed or over-deep input before normalizing an activity. */
 export default function normalizeActivityStreamMiddleware<T extends ActivityStream>(msg: T, done: MiddlewareChainInterface<T>): void;

package/dist/payload-debug.d.ts

@@ -0,0 +1,2 @@
+/** Disable namespaces that log raw payloads or session IDs, or recurse over client input. */
+export default function disablePayloadDebug(): void;

package/dist/platform-instance.d.ts

@@ -55,6 +55,7 @@ export default class PlatformInstance {
     readonly parentId: string;
     private readonly parentSecret1?;
     readonly sessions: Set<string>;
+    readonly ownerIps: Set<string>;
     readonly sessionIps: Map<string, string>;
     private readonly sessionSecrets;
     private processMessageListener?;

package/dist/platform.js

@@ -20497,7 +20497,7 @@ var init_package = __esm(() => {
   package_default = {
     name: "@sockethub/schemas",
     description: "JSON schema files for validating Sockethub Activity Streams",
-    version: "3.0.0-beta.0",
+    version: "3.0.0-beta.1",
     type: "module",
     private: false,
     author: "Nick Jennings <nick@silverbucket.net>",
@@ -20567,7 +20567,7 @@ var init_package = __esm(() => {
       "ajv-formats": "^2.1.1",
       "ajv-formats-draft2019": "^1.6.1"
     },
-    gitHead: "75002ae8f15d7679bd58a9327f5a1d7eeaffa237",
+    gitHead: "06c9062f1cb5f0c0599fd979e6e91da79f08eda0",
     types: "./dist/index.d.ts"
   };
 });
@@ -20733,7 +20733,8 @@ var init_sockethub_config = __esm(() => {
             type: "object",
             additionalProperties: false,
             properties: {
-              connectTimeoutMs: { type: "number" }
+              connectTimeoutMs: { type: "number" },
+              allowPrivateAddresses: { type: "boolean" }
             }
           },
           "@sockethub/platform-metadata": {
@@ -20823,11 +20824,23 @@ var init_sockethub_config = __esm(() => {
         type: "object",
         additionalProperties: false,
         properties: {
+          maxInstancesPerSession: {
+            type: "integer",
+            minimum: 0,
+            default: 10,
+            description: "Maximum persistent instances per socket session. 0 disables the cap."
+          },
+          maxInstancesPerIp: {
+            type: "integer",
+            minimum: 0,
+            default: 20,
+            description: "Maximum persistent instances per client IP, including HTTP actions. 0 disables the cap."
+          },
           maxPlatformInstances: {
             type: "number",
             minimum: 0,
             default: 100,
-            description: "Upper bound on concurrently running platform instances " + "(child processes). Each persistent-platform actor forks " + "its own process, so an unbounded count is a resource " + "exhaustion risk on public instances. 0 disables the cap."
+            description: "Upper bound on concurrently running persistent platform instances " + "(child processes). Each persistent-platform actor forks " + "its own process, so an unbounded count is a resource " + "exhaustion risk on public instances. 0 disables the cap."
           }
         }
       },
@@ -27196,15 +27209,33 @@ var require_ajv = __commonJS(function(exports, module) {
   } });
 });
 
+// ../schemas/src/helpers/codegen.ts
+function isCodegenAvailable() {
+  if (available === undefined) {
+    try {
+      new Function("return true");
+      available = true;
+    } catch {
+      available = false;
+    }
+  }
+  return available;
+}
+function warnCodegenUnavailable() {
+  if (warned) {
+    return;
+  }
+  warned = true;
+  console.warn("[@sockethub/schemas] Schema validation is disabled: this environment's Content Security Policy blocks `new Function`, which Ajv needs to compile schemas. The Sockethub server still validates every message.");
+}
+var available, warned = false;
+
 // ../schemas/src/schemas/service-descriptor.ts
 var init_service_descriptor = () => {};
 
 // ../schemas/src/service-descriptor.ts
-var import_ajv, ajv;
 var init_service_descriptor2 = __esm(() => {
   init_service_descriptor();
-  import_ajv = __toESM(require_ajv(), 1);
-  ajv = new import_ajv.default({ strictTypes: false, allErrors: true });
 });
 
 // ../../node_modules/ajv-formats/dist/formats.js
@@ -36752,15 +36783,35 @@ var init_error_parser = __esm(() => {
 });
 
 // ../schemas/src/validator.ts
+function getAjv() {
+  if (!isCodegenAvailable()) {
+    warnCodegenUnavailable();
+    return;
+  }
+  if (!ajv) {
+    const instance = new import_ajv.default({ strictTypes: false, allErrors: true });
+    import_ajv_formats.default(instance);
+    import_ajv_formats_draft2019.default(instance);
+    for (const uri in schemas) {
+      instance.addSchema(schemas[uri], uri);
+    }
+    ajv = instance;
+  }
+  return ajv;
+}
 function registerSystemContext(platformId, contextUrl) {
   registerPlatformContext(platformId, contextUrl, `${schemaURL}/context/${platformId}/messages`, `${schemaURL}/context/${platformId}/credentials`);
+  const instance = getAjv();
+  if (!instance) {
+    return;
+  }
   const messageSchemaRef = `${schemaURL}/context/${platformId}/messages`;
-  if (!ajv2.getSchema(messageSchemaRef)) {
-    ajv2.addSchema({}, messageSchemaRef);
+  if (!instance.getSchema(messageSchemaRef)) {
+    instance.addSchema({}, messageSchemaRef);
   }
   const credentialsSchemaRef = `${schemaURL}/context/${platformId}/credentials`;
-  if (!ajv2.getSchema(credentialsSchemaRef)) {
-    ajv2.addSchema({}, credentialsSchemaRef);
+  if (!instance.getSchema(credentialsSchemaRef)) {
+    instance.addSchema({}, credentialsSchemaRef);
   }
 }
 function registerSystemPlatformContexts() {
@@ -36772,17 +36823,21 @@ function registerSystemPlatformContexts() {
   systemContextsRegistered = true;
 }
 function validateSockethubConfig(config) {
+  const instance = getAjv();
+  if (!instance) {
+    return "";
+  }
   if (!sockethubConfigValidator) {
-    sockethubConfigValidator = ajv2.compile(SockethubConfigSchema);
+    sockethubConfigValidator = instance.compile(SockethubConfigSchema);
   }
   if (sockethubConfigValidator(config)) {
     return "";
   }
-  return ajv2.errorsText(sockethubConfigValidator.errors, {
+  return instance.errorsText(sockethubConfigValidator.errors, {
     dataVar: "config"
   });
 }
-var import_ajv2, import_ajv_formats, import_ajv_formats_draft2019, ajv2, schemaURL = "https://sockethub.org/schemas/v0", schemas, systemContextsRegistered = false, sockethubConfigValidator;
+var import_ajv, import_ajv_formats, import_ajv_formats_draft2019, schemaURL = "https://sockethub.org/schemas/v0", schemas, systemContextsRegistered = false, ajv, sockethubConfigValidator;
 var init_validator = __esm(() => {
   init_context();
   init_error_parser();
@@ -36790,17 +36845,11 @@ var init_validator = __esm(() => {
   init_activity_stream();
   init_platform();
   init_sockethub_config();
-  import_ajv2 = __toESM(require_ajv(), 1);
+  import_ajv = __toESM(require_ajv(), 1);
   import_ajv_formats = __toESM(require_dist(), 1);
   import_ajv_formats_draft2019 = __toESM(require_ajv_formats_draft2019(), 1);
-  ajv2 = new import_ajv2.default({ strictTypes: false, allErrors: true });
-  import_ajv_formats.default(ajv2);
-  import_ajv_formats_draft2019.default(ajv2);
   schemas = {};
   schemas[`${schemaURL}/activity-stream`] = ActivityStreamSchema;
-  for (const uri in schemas) {
-    ajv2.addSchema(schemas[uri], uri);
-  }
   registerSystemPlatformContexts();
 });
 
@@ -73881,6 +73930,8 @@ var init_config_schema = __esm(() => {
     "rateLimiter.maxRequests": { format: "nat" },
     "rateLimiter.blockDurationMs": { format: "nat" },
     "rateLimiter.maxConnectionsPerIp": { format: "nat" },
+    "limits.maxInstancesPerSession": { format: "nat" },
+    "limits.maxInstancesPerIp": { format: "nat" },
     "limits.maxPlatformInstances": { format: "nat" },
     "credentials.ttlMs": {
       format: "nat",

package/dist/process-manager.d.ts

@@ -24,16 +24,8 @@ declare class ProcessManager {
      */
     private ensureProcess;
     private ensureProcessNow;
-    /**
-     * Each platform instance forks a full child process; without an upper
-     * bound, a public instance can be driven into resource exhaustion.
-     * Throws when the configured cap (`limits.maxPlatformInstances`, 0 =
-     * disabled) has been reached and a new instance would be created.
-     *
-     * `identifier`'s existing (dead) slot, if any, is excluded from the
-     * count: replacing a crashed instance for the same actor doesn't
-     * increase the total instance count, so it shouldn't be blocked by
-     * the cap.
+    /** Stateless workers are bounded by the enabled platform count, independently
+     * of client occupancy. Check owners even when attaching to a shared worker.
      */
     private assertInstanceCapacity;
     private isProcessAlive;

package/dist/trust-proxy.d.ts

@@ -1,3 +1,22 @@
+import type { IncomingMessage } from "node:http";
+import type { Express } from "express";
+/** Resolve socket admission using the same compiled proxy policy as Express req.ip. */
+export declare function getRequestClientIp(request: IncomingMessage, app: Express): string;
+/**
+ * Client address for socket admission, per-IP quotas, and anonymous reconnect.
+ *
+ * `x-forwarded-for` is a chain. The nearest proxy appends the address it
+ * actually accepted, and anything to the left of that may have been set by
+ * the client. Reading the first entry treats that prefix as the client, so
+ * an attacker can present a victim's address and, during janitor grace,
+ * take over that victim's anonymous connection (the reconnect key is the
+ * actor plus this address). Hop count is already what HTTP uses: one trusted
+ * hop yields the address the proxy appended, not the spoofed prefix.
+ *
+ * A custom `proxyHeader` is not a chain Express understands. The operator
+ * vouched for that header, and its first address is the value.
+ */
+export declare function resolveSocketClientIp(request: IncomingMessage, app: Express | undefined, reconnectIpSource: unknown, proxyHeader: unknown, fallbackAddress: string | undefined): string;
 /**
  * Resolution of Express's `trust proxy` setting.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sockethub/server",
   "description": "A polyglot messaging service, server libraries",
-  "version": "5.0.0-beta.0",
+  "version": "5.0.0-beta.1",
   "type": "module",
   "private": false,
   "author": "Nick Jennings <nick@silverbucket.net>",
@@ -53,17 +53,19 @@
   "dependencies": {
     "@sentry/node": "^10.36.0",
     "@sentry/profiling-node": "10.36.0",
-    "@sockethub/client": "^5.0.0-beta.0",
-    "@sockethub/data-layer": "^1.0.0-beta.0",
-    "@sockethub/logger": "^1.0.0-beta.0",
-    "@sockethub/schemas": "^3.0.0-beta.0",
-    "@sockethub/util": "^1.0.0-beta.0",
+    "@sockethub/client": "^5.0.0-beta.1",
+    "@sockethub/data-layer": "^1.0.0-beta.1",
+    "@sockethub/logger": "^1.0.0-beta.1",
+    "@sockethub/schemas": "^3.0.0-beta.1",
+    "@sockethub/util": "^1.0.0-beta.1",
     "chalk": "^5.6.2",
     "convict": "^6.2.5",
+    "debug": "^4.4.3",
     "ejs": "^3.1.10",
     "express": "^5.1.0",
     "express-rate-limit": "^8.2.1",
     "jquery": "^3.7.1",
+    "proxy-addr": "^2.0.7",
     "rate-limit-redis": "^4.2.0",
     "socket.io": "^4.8.3"
   },
@@ -82,21 +84,22 @@
     "@types/debug": "^4.1.12",
     "@types/express": "^5.0.0",
     "@types/jquery": "^3.5.33",
+    "@types/proxy-addr": "^2.0.3",
     "@types/sinon": "^17.0.4",
     "jaribu": "^2.2.3",
     "sinon": "^17.0.2",
     "web-streams-polyfill": "^3.3.3"
   },
   "optionalDependencies": {
-    "@sockethub/examples": "^1.0.0-beta.0",
-    "@sockethub/platform-caldav": "^1.0.0-beta.0",
-    "@sockethub/platform-carddav": "^1.0.0-beta.0",
-    "@sockethub/platform-dummy": "^3.0.0-beta.0",
-    "@sockethub/platform-feeds": "^4.0.0-beta.0",
-    "@sockethub/platform-irc": "^4.0.0-beta.0",
-    "@sockethub/platform-metadata": "^1.0.1-beta.0",
-    "@sockethub/platform-xmpp": "^5.0.0-beta.0"
+    "@sockethub/examples": "^1.0.0-beta.1",
+    "@sockethub/platform-caldav": "^1.0.0-beta.1",
+    "@sockethub/platform-carddav": "^1.0.0-beta.1",
+    "@sockethub/platform-dummy": "^3.0.0-beta.1",
+    "@sockethub/platform-feeds": "^4.0.0-beta.1",
+    "@sockethub/platform-irc": "^4.0.0-beta.1",
+    "@sockethub/platform-metadata": "^1.0.1-beta.1",
+    "@sockethub/platform-xmpp": "^5.0.0-beta.1"
   },
-  "gitHead": "a17e337ee7d2dd496d225c0d6e8ae48f4f4ce73c",
+  "gitHead": "928f0c480e4828f492fb29a97712474a8f1bcaef",
   "types": "./dist/index.d.ts"
 }