@vzn/vx-dte-server 0.0.652 → 0.0.653

package/PROTOCOL.md

@@ -102,7 +102,12 @@ A participant sends:
   fails, `n` then `null`.
 - A frame that fails is answered `{ "n", "status", "error" }`; one that is
   no JSON object, or none of the above, `400`; one over 1 MiB `413`,
-  answered by its `n` when the frame starts `{"n":`.
+  answered by its `n` when the frame starts `{"n":`. One past its
+  runtime's own limit (16 MiB on Bun, 32 MiB on Workers) never reaches
+  the relay: the runtime closes the socket `1009`.
+- A send whose `body` the relay cannot pass (nested deeper than its
+  runtime serializes) is `400` in its result; its receiver keeps its
+  socket.
 - A removed peer's socket is closed `4404` after what waited for it; the
   host is not told it left.
 
@@ -113,7 +118,8 @@ socket, or a push that failed) is dropped. Delivery is the clients': a
 sender numbers each send, the receiver acknowledges it end to end, and
 the sender sends again what is not acknowledged, at once on a new socket.
 How they number and acknowledge is inside `body`, their own protocol;
-`@vzn/vx-dte` puts `{ "n" }` and `{ "acked" }` beside its payload.
+`@vzn/vx-dte` sends `{ "n", "b", "a"? }`: its number, its payload and
+its ack.
 
 Only the relay's notices wait, in memory, for the participant's next
 socket.

package/README.md

@@ -163,4 +163,5 @@ The same relay as a `fetch` handler, to mount in a server of your own
   repository: `repository` for GitHub Actions, `project_path` otherwise.
 - `workflowClaimOf(iss)` names the claim that names the workflow a
   token's job is defined in: `job_workflow_ref` for GitHub Actions,
-  `ci_config_ref_uri` otherwise.
+  `ci_config_ref_uri` otherwise. The relay matches it up to its last `@`,
+  before the ref or SHA.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-dte-server",
-  "version": "0.0.652",
+  "version": "0.0.653",
   "license": "MIT",
   "description": "The reference relay for @vzn/vx-dte: carries messages between a vx run's orchestrator and its CI agents, admitting only CI OIDC tokens of the same repository.",
   "keywords": [

package/src/oidc.ts

@@ -127,7 +127,7 @@ export function parseAllow(list: string): Allowed[] {
     })
 }
 
-/** What `workflowClaimOf(iss)` says, up to its `@`, for a job of `workflow` in `repository`. */
+/** What `workflowClaimOf(iss)` says, up to its last `@`, for a job of `workflow` in `repository`. */
 function workflowPath(iss: string, repository: string, workflow: string): string {
   return iss === GITHUB
     ? `${repository}/.github/workflows/${workflow}`
@@ -232,17 +232,15 @@ export function createVerifier(opts: OidcOptions): (token: string) => Promise<Ve
       const ref = claims[claim]
       if (typeof ref !== 'string') throw new TokenError(`no ${claim} claim`, 403)
       const repo = String(claims[repositoryClaimOf(iss)])
-      // The path is the claim up to an `@` that a ref follows: a file name may hold `@` too.
-      const named = ofRepo.some((a) => {
-        const p = `${workflowPath(iss, a.repository ?? repo, a.workflow!)}@`
-        return same(ref.slice(0, p.length), p)
-      })
-      if (!named) {
-        throw new TokenError(
-          `workflow ${ref.replace(/@.*$/, '')} is not in this relay's ALLOW`,
-          403,
-        )
-      }
+      // Cut at the last `@`, as vx-devtools does: the ref after it is
+      // `refs/…` or a SHA (a reusable workflow pinned by one), and GitLab's
+      // CI file may itself hold one (`.gitlab-ci.yml@group/project`, a file
+      // kept in another project, which a match by the prefix `<path>@` took
+      // as this project's own). A ref holding an `@` is refused, never widened.
+      const at = ref.lastIndexOf('@')
+      const workflow = at < 0 ? ref : ref.slice(0, at)
+      if (!ofRepo.some((a) => same(workflow, workflowPath(iss, a.repository ?? repo, a.workflow!))))
+        throw new TokenError(`workflow ${workflow} is not in this relay's ALLOW`, 403)
     }
     const run = (opts.runClaims?.[iss] ?? runClaimsOf(iss)).map((c) => {
       const v = claims[c]

package/src/relay.ts

@@ -198,10 +198,16 @@ export function createRelay(opts: RelayOptions): Relay {
    * relay's own notices (`notice`: joined, lost, closed) have no sender to
    * resend them, so they wait for the next socket.
    */
-  const deliver = (session: Session, p: Participant, m: Message, notice = false): void => {
+  const deliver = (
+    session: Session,
+    p: Participant,
+    m: Message,
+    notice = false,
+    text?: string,
+  ): void => {
     if (p.socket !== undefined && p.queue.length === 0) {
       try {
-        p.socket.send(JSON.stringify({ messages: [m] }))
+        p.socket.send(text ?? JSON.stringify({ messages: [m] }))
         return
       } catch {
         // quiet: a socket that cannot send is unplugged; the participant rejoins
@@ -443,10 +449,16 @@ export function createRelay(opts: RelayOptions): Relay {
           ? session.byId.get(body.to)
           : undefined
     if (to === undefined || to === from) throw new HttpError(404, 'unknown to')
-    deliver(session, to, {
-      from: from.role === 'host' ? 'host' : from.id,
-      body: body.body,
-    })
+    const m = { from: from.role === 'host' ? 'host' : from.id, body: body.body }
+    // Serialized before the push: a body parsed but nested past what the
+    // runtime serializes threw in it, and that unplugged the receiver.
+    let text: string
+    try {
+      text = JSON.stringify({ messages: [m] })
+    } catch {
+      throw new HttpError(400, 'body nests too deep to pass')
+    }
+    deliver(session, to, m, false, text)
   }
 
   const live = (key: string): Session => {

package/src/serve.ts

@@ -39,6 +39,11 @@ export function serveRelay(opts: ServeOptions): RelayServer {
     idleTimeout: 60,
     fetch: (req) => relay.fetch(req),
     websocket: {
+      // Bun's default, said here because PROTOCOL.md names it: past it Bun
+      // closes the socket 1009 before the relay sees the frame (Workers
+      // does so past 32 MiB). Under it a frame over 1 MiB is a 413; more
+      // would only hold more of a sender's bytes per socket.
+      maxPayloadLength: 16 << 20,
       // A socket with no frame in three heartbeats has no peer listening
       // either (each probes a quiet one within two): closed, it loses its
       // participant, as a half-open one on no other host would be.