@vzn/vx-cache 0.0.651 → 0.0.652

package/README.md

@@ -31,7 +31,8 @@ export default {
 
 - `url` is the server's base URL (`https://cache.example.com`, without `/v1`), or `VX_CACHE_URL`.
   It must be `https://`: every request carries the CI token, so `http://`
-  is taken only to this machine (`127.0.0.1`, `::1`, `localhost`). The
+  is taken only to this machine (`127.0.0.1`, `::1`, `localhost`). It
+  takes no `?query` or `#fragment`: each route is appended to it. The
   option is checked when the config loads, `VX_CACHE_URL` when a run
   opens the cache.
 - `issuer` (the CI issuer's URL, as its tokens name it) and `repository`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-cache",
-  "version": "0.0.651",
+  "version": "0.0.652",
   "license": "MIT",
   "description": "vxCache(): a vx cache plugin for a server that speaks the vx-cache protocol, such as @vzn/vx-cache-server.",
   "keywords": [
@@ -32,7 +32,7 @@
     "jose: the tests sign the CI tokens the server checks."
   ],
   "peerDependencies": {
-    "@vzn/vx": "^0.0.651"
+    "@vzn/vx": "^0.0.652"
   },
   "repository": {
     "type": "git",

package/src/index.ts

@@ -148,8 +148,12 @@ async function jsonUpTo(res: Response, max: number, what: string): Promise<unkno
 
 /** Capabilities and a CI token are a few hundred bytes: room to spare. */
 const SMALL_ANSWER_BYTES = 64 * 1024
-/** A check's answer per hash asked: a hash, a size and a scope in JSON are under 150 bytes. */
-const CHECK_BYTES_PER_HASH = 512
+/**
+ * A check's answer per hash asked: a hash (up to 128), a size and a scope
+ * (up to 512, a long branch's) in JSON are under 700 bytes. At 512 an
+ * answer under the longest scopes was refused as too long.
+ */
+const CHECK_BYTES_PER_HASH = 1024
 
 /**
  * `s` with each C0/C1 control and DEL written as `\xNN`: a server's words
@@ -865,10 +869,12 @@ function shown(url: string): string {
  * http:// to another host sent it in clear.
  */
 function secure(url: string): boolean {
-  if (/^https:\/\/\S/.test(url)) return true
-  if (!/^http:\/\/\S/.test(url)) return false
-  const host = URL.parse(url)?.hostname
-  return host === '127.0.0.1' || host === '[::1]' || host === 'localhost'
+  // Parsed as the request will be: a scheme in any case, no url it cannot carry.
+  const u = URL.parse(url)
+  if (u === null || u.host === '') return false
+  if (u.protocol === 'https:') return true
+  if (u.protocol !== 'http:') return false
+  return u.hostname === '127.0.0.1' || u.hostname === '[::1]' || u.hostname === 'localhost'
 }
 
 /** Options over `VX_CACHE_URL`; `undefined`: no server named. */
@@ -885,6 +891,12 @@ export function resolveVxCacheConfig(
     throw new UserError(
       `vxCache(): ${from} must be https (http only to 127.0.0.1, ::1 or localhost), got ${shown(url)}`,
     )
+  // Each route is appended to the url: past a `?` or `#` it was query or
+  // fragment, and every request asked the server's root.
+  if (/[?#]/.test(url))
+    throw new UserError(
+      `vxCache(): ${from} takes no ?query or #fragment: each route is appended to it, got ${shown(url)}`,
+    )
   // Each route is the url's /v1/…: one that names /v1 asked /v1/v1/…, and every answer was a 404.
   if (url.endsWith('/v1'))
     throw new UserError(