@stage5/lumine 0.2.42 → 0.2.43

package/lib/admin-news.js

@@ -3,8 +3,10 @@ import {
   mkdirSync,
   readFileSync,
   renameSync,
+  unlinkSync,
   writeFileSync,
 } from "node:fs";
+import { randomUUID } from "node:crypto";
 import path from "node:path";
 
 const MAX_ADMIN_JSON_BYTES = 2 * 1024 * 1024;
@@ -17,9 +19,7 @@ function validationError(message) {
 
 function formatByteLimit(maxBytes) {
   const megabytes = maxBytes / (1024 * 1024);
-  return Number.isInteger(megabytes)
-    ? `${megabytes} MB`
-    : `${maxBytes} bytes`;
+  return Number.isInteger(megabytes) ? `${megabytes} MB` : `${maxBytes} bytes`;
 }
 
 export function readAdminJsonFile(
@@ -36,7 +36,9 @@ export function readAdminJsonFile(
     throw validationError(`Could not read ${normalizedPath}.`);
   }
   if (Buffer.byteLength(contents, "utf8") > maxBytes) {
-    throw validationError(`${label} must be under ${formatByteLimit(maxBytes)}.`);
+    throw validationError(
+      `${label} must be under ${formatByteLimit(maxBytes)}.`,
+    );
   }
   try {
     return JSON.parse(contents);
@@ -55,7 +57,10 @@ export function writeAdminJsonFile(
     throw validationError("An output file path is required.");
   }
   mkdirSync(path.dirname(resolved), { recursive: true });
-  const temporary = `${resolved}.tmp-${process.pid}`;
+  // Checkpoints can contain private management evidence and often live in a
+  // shared temporary directory. Use an unguessable, exclusive staging file so
+  // another local account cannot pre-place a symlink at the temporary path.
+  const temporary = `${resolved}.tmp-${process.pid}-${randomUUID()}`;
   const contents = `${JSON.stringify(value, null, 2)}\n`;
   if (
     Number.isSafeInteger(maxBytes) &&
@@ -66,11 +71,21 @@ export function writeAdminJsonFile(
       `The output exceeds the ${formatByteLimit(maxBytes)} safety limit. Narrow the request before retrying.`,
     );
   }
-  writeFileSync(temporary, contents, {
-    encoding: "utf8",
-    mode: privateFile ? 0o600 : 0o644,
-  });
-  renameSync(temporary, resolved);
+  try {
+    writeFileSync(temporary, contents, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: privateFile ? 0o600 : 0o644,
+    });
+    renameSync(temporary, resolved);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+      // The exclusive create or successful rename may leave nothing to clean.
+    }
+    throw error;
+  }
   if (privateFile) chmodSync(resolved, 0o600);
   return resolved;
 }
@@ -83,7 +98,12 @@ export function extractNewsClaim(value) {
   const editionId = Number(claim.editionId || 0);
   const leaseToken = String(claim.leaseToken || "").trim();
   const events = Array.isArray(claim.events) ? claim.events : null;
-  if (!Number.isSafeInteger(editionId) || editionId <= 0 || !leaseToken || !events) {
+  if (
+    !Number.isSafeInteger(editionId) ||
+    editionId <= 0 ||
+    !leaseToken ||
+    !events
+  ) {
     throw validationError(
       "The claim file is missing editionId, leaseToken, or canonical events.",
     );
@@ -114,7 +134,8 @@ export function createNewsEditorialScaffold(claimValue) {
   const frontIndex = claim.events.findIndex(
     (event) => String(event?.section || "") === "front",
   );
-  const lead = frontIndex >= 0 ? scaffoldStory(claim.events[frontIndex], maximum) : null;
+  const lead =
+    frontIndex >= 0 ? scaffoldStory(claim.events[frontIndex], maximum) : null;
   const stories = claim.events
     .filter((_event, index) => index !== frontIndex)
     .map((event) => scaffoldStory(event, maximum));
@@ -150,7 +171,9 @@ export function validateNewsEditorial({ claim: claimValue, editorial }) {
   const usedKeys = new Set();
   const maximum = Math.max(0, Number(claim.maxSourceQuoteLength || 360));
   const entries = [
-    ...(editorial.lead ? [{ label: "lead", story: editorial.lead, lead: true }] : []),
+    ...(editorial.lead
+      ? [{ label: "lead", story: editorial.lead, lead: true }]
+      : []),
     ...editorial.stories.map((story, index) => ({
       label: `stories[${index}]`,
       story,
@@ -164,7 +187,8 @@ export function validateNewsEditorial({ claim: claimValue, editorial }) {
     }
     const eventKey = String(story.eventKey || "").trim();
     const event = eventByKey.get(eventKey);
-    if (!event) throw validationError(`${entry.label}.eventKey is not in the claim.`);
+    if (!event)
+      throw validationError(`${entry.label}.eventKey is not in the claim.`);
     if (usedKeys.has(eventKey)) {
       throw validationError(`${eventKey} is cited or covered more than once.`);
     }
@@ -174,14 +198,15 @@ export function validateNewsEditorial({ claim: claimValue, editorial }) {
     }
     requireEditorialText(story.headline, `${entry.label}.headline`);
     requireEditorialText(story.summary, `${entry.label}.summary`);
-    const quote = typeof story.sourceQuote === "string" ? story.sourceQuote : "";
+    const quote =
+      typeof story.sourceQuote === "string" ? story.sourceQuote : "";
     if (String(event.section || "") === "front") {
       const canonicalSummary = String(event.summary || "");
       const quoteIsValid = canonicalSummary
         ? Boolean(
             quote &&
-              quote.length <= maximum &&
-              canonicalSummary.includes(quote),
+            quote.length <= maximum &&
+            canonicalSummary.includes(quote),
           )
         : quote === "";
       if (!quoteIsValid) {
@@ -190,19 +215,27 @@ export function validateNewsEditorial({ claim: claimValue, editorial }) {
         );
       }
     } else if (quote !== "") {
-      throw validationError(`${entry.label}.sourceQuote must be empty outside the front section.`);
+      throw validationError(
+        `${entry.label}.sourceQuote must be empty outside the front section.`,
+      );
     }
     const covered = story.coveredEventKeys ?? [];
     if (!Array.isArray(covered)) {
-      throw validationError(`${entry.label}.coveredEventKeys must be an array.`);
+      throw validationError(
+        `${entry.label}.coveredEventKeys must be an array.`,
+      );
     }
     for (const rawCoveredKey of covered) {
       const coveredKey = String(rawCoveredKey || "").trim();
       if (!eventByKey.has(coveredKey)) {
-        throw validationError(`${entry.label} covers an eventKey not in the claim.`);
+        throw validationError(
+          `${entry.label} covers an eventKey not in the claim.`,
+        );
       }
       if (coveredKey === eventKey || usedKeys.has(coveredKey)) {
-        throw validationError(`${coveredKey} is cited or covered more than once.`);
+        throw validationError(
+          `${coveredKey} is cited or covered more than once.`,
+        );
       }
       usedKeys.add(coveredKey);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage5/lumine",
-  "version": "0.2.42",
+  "version": "0.2.43",
   "description": "Command line tools for launching Lumine builds on Twinkle.",
   "type": "module",
   "bin": {