@zudojs/rpc 1.2.0 → 1.3.0

package/README.md

@@ -74,7 +74,11 @@ const server = new RPCServer();
 server.register(sum);
 
 const response = await server.handle(
-  createRPCRequest({ id: "req-1", procedure: "math.sum", payload: { a: 1, b: 2 } }),
+  createRPCRequest({
+    id: "req-1",
+    procedure: "math.sum",
+    payload: { a: 1, b: 2 },
+  }),
 );
 // { id: "req-1", success: true, result: 3 }
 ```
@@ -98,7 +102,10 @@ import { RPCClient, type RPCTransport } from "@zudojs/rpc";
 const transport: RPCTransport = { send: (request) => server.handle(request) };
 const client = new RPCClient(transport, { timeout: 5_000 });
 
-const total = await client.call<{ a: number; b: number }, number>("math.sum", { a: 1, b: 2 });
+const total = await client.call<{ a: number; b: number }, number>("math.sum", {
+  a: 1,
+  b: 2,
+});
 // 3
 ```
 
@@ -158,12 +165,19 @@ caller's.
 
 ```typescript
 const server = new RPCServer(undefined, undefined, {
-  limits: { maxPayloadBytes: 256 * 1024 },
+  limits: { maxPayloadBytes: 256 * 1024, maxRequestIdLength: 128 },
   dispatch: { defaultTimeout: 10_000 },
   onInternalError: (error, requestId) => logger.error({ requestId, error }),
 });
 ```
 
+`maxPayloadBytes` bounds `payload` and `metadata` together, because both are
+caller-controlled and both reach the handler. `maxRequestIdLength` bounds
+`request.id`, which every response echoes back; an id over the limit is
+refused before a response is built, so it is never reflected. Both default to
+`MAX_RPC_PAYLOAD_SIZE` (1 MiB) and `MAX_RPC_REQUEST_ID_LENGTH` (128), and
+either can be set to `0` when the transport already enforces the limit.
+
 ## License
 
 MIT

package/dist/index.d.ts

@@ -21,7 +21,7 @@
  */
 export type { RPCProcedureName, RPCMetadata, RPCMetadataOptions, RPCRequest, RPCRequestOptions, RPCErrorPayload, RPCResponse, } from "./rpc/types/index.js";
 export { createRPCMetadata, createRPCRequest, createRPCResponse, createRPCErrorResponse, } from "./rpc/types/index.js";
-export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpc/constants/index.js";
+export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpc/constants/index.js";
 export type { RPCRequestLimits, RPCSchema } from "./rpc/validation/index.js";
 export { assertValidProcedureName, assertValidRequest, measurePayloadBytes, toValidationIssues, parseInput, parseOutput, } from "./rpc/validation/index.js";
 export type { RPCErrorOptions } from "./rpc/errors/index.js";

package/dist/index.js

@@ -21,7 +21,7 @@
  */
 export { createRPCMetadata, createRPCRequest, createRPCResponse, createRPCErrorResponse, } from "./rpc/types/index.js";
 // Constants
-export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpc/constants/index.js";
+export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpc/constants/index.js";
 export { assertValidProcedureName, assertValidRequest, measurePayloadBytes, toValidationIssues, parseInput, parseOutput, } from "./rpc/validation/index.js";
 export { RPCError, RPCProcedureNotFoundError, RPCInvalidRequestError, RPCValidationError, RPCAuthenticationError, RPCForbiddenError, RPCTimeoutError, RPCCancelledError, RPCInternalError, RPCTransportError, RPCSerializationError, RPCDeserializationError, RPCUnavailableError, RPCRateLimitedError, RPCDeadlineExceededError, RPCDuplicateProcedureError, createRPCError, isRPCError, } from "./rpc/errors/index.js";
 export { createRPCProcedure } from "./rpc/procedure/index.js";

package/dist/rpc/constants/index.d.ts

@@ -1,2 +1,2 @@
-export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpcConstants.core.js";
+export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpcConstants.core.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/rpc/constants/index.js

@@ -1,2 +1,2 @@
-export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpcConstants.core.js";
+export { DEFAULT_RPC_TIMEOUT, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, MAX_PENDING_REQUESTS, MAX_MIDDLEWARE, MAX_PROCEDURES, MAX_PROCEDURE_NAME_LENGTH, MAX_TIMER_DELAY, PROCEDURE_NAME_PATTERN, INTERNAL_ERROR_MESSAGE, } from "./rpcConstants.core.js";
 //# sourceMappingURL=index.js.map

package/dist/rpc/constants/rpcConstants.core.d.ts

@@ -11,6 +11,15 @@ export declare const DEFAULT_RPC_TIMEOUT = 30000;
  * Maximum payload size for RPC messages (1MB).
  */
 export declare const MAX_RPC_PAYLOAD_SIZE: number;
+/**
+ * Maximum length of a request id accepted from a peer.
+ *
+ * The id is echoed verbatim into every success and error response, so an
+ * unbounded id is a reflection amplifier: the server writes back whatever
+ * the caller sent, on both paths. 128 characters holds a UUID, a ULID or a
+ * W3C trace id with room to spare.
+ */
+export declare const MAX_RPC_REQUEST_ID_LENGTH = 128;
 /**
  * Maximum number of pending requests allowed in the client.
  */

package/dist/rpc/constants/rpcConstants.core.js

@@ -11,6 +11,15 @@ export const DEFAULT_RPC_TIMEOUT = 30_000;
  * Maximum payload size for RPC messages (1MB).
  */
 export const MAX_RPC_PAYLOAD_SIZE = 1024 * 1024;
+/**
+ * Maximum length of a request id accepted from a peer.
+ *
+ * The id is echoed verbatim into every success and error response, so an
+ * unbounded id is a reflection amplifier: the server writes back whatever
+ * the caller sent, on both paths. 128 characters holds a UUID, a ULID or a
+ * W3C trace id with room to spare.
+ */
+export const MAX_RPC_REQUEST_ID_LENGTH = 128;
 /**
  * Maximum number of pending requests allowed in the client.
  */

package/dist/rpc/server/rpcServer.core.js

@@ -3,7 +3,7 @@ import { RPCMiddlewareStack } from "../middleware/rpcMiddleware.core.js";
 import { RPCDispatcher } from "../dispatcher/rpcDispatcher.core.js";
 import { createRPCErrorResponse } from "../types/rpcResponse.type.js";
 import { isRPCError, RPCAuthenticationError, RPCCancelledError, RPCDeadlineExceededError, RPCDeserializationError, RPCForbiddenError, RPCInternalError, RPCInvalidRequestError, RPCProcedureNotFoundError, RPCRateLimitedError, RPCSerializationError, RPCTimeoutError, RPCUnavailableError, RPCValidationError, } from "../errors/rpc.errors.js";
-import { INTERNAL_ERROR_MESSAGE } from "../constants/rpcConstants.core.js";
+import { INTERNAL_ERROR_MESSAGE, MAX_RPC_REQUEST_ID_LENGTH, } from "../constants/rpcConstants.core.js";
 import { assertValidRequest } from "../validation/rpcValidation.core.js";
 /**
  * Wire codes for the error types the server maps.
@@ -72,8 +72,14 @@ export class RPCServer {
      * `context.auth`; authorise on that, never on frame metadata.
      */
     async handle(request, trusted = {}) {
-        const requestId = typeof request?.id === "string"
-            ? request.id
+        // An id the validator would refuse is never reflected: the error
+        // response below echoes this value, so accepting an over-long id here
+        // would amplify it straight back to the peer that sent it.
+        const rawId = request?.id;
+        const maxIdLength = this.options.limits?.maxRequestIdLength ?? MAX_RPC_REQUEST_ID_LENGTH;
+        const requestId = typeof rawId === "string" &&
+            (maxIdLength <= 0 || rawId.length <= maxIdLength)
+            ? rawId
             : "";
         try {
             assertValidRequest(request, this.options.limits);

package/dist/rpc/validation/rpcValidation.core.d.ts

@@ -13,11 +13,21 @@ import type { RPCRequest } from "../types/rpcRequest.type.js";
  */
 export interface RPCRequestLimits {
     /**
-     * Maximum encoded payload size in bytes. Defaults to
+     * Maximum combined encoded size, in bytes, of the caller-controlled
+     * parts of the frame — `payload` and `metadata`. Defaults to
      * {@link MAX_RPC_PAYLOAD_SIZE}. Set to `0` to skip the check when the
      * transport already enforces a frame limit.
+     *
+     * `metadata` counts because it is caller-controlled and is handed to
+     * middleware and handlers as `context.metadata`; measuring `payload`
+     * alone left an unbounded second channel into the same handler.
      */
     readonly maxPayloadBytes?: number;
+    /**
+     * Maximum length of `request.id`. Defaults to
+     * {@link MAX_RPC_REQUEST_ID_LENGTH}. Set to `0` to skip the check.
+     */
+    readonly maxRequestIdLength?: number;
     /**
      * Whether procedure names must match {@link PROCEDURE_NAME_PATTERN}.
      * Defaults to `true`.
@@ -41,8 +51,12 @@ export declare function measurePayloadBytes(payload: unknown): number | undefine
 /**
  * Validates the shape and size of an incoming request.
  *
- * @throws {RPCInvalidRequestError} when the frame is malformed or the
- * payload exceeds the configured limit.
+ * Every caller-controlled part of the frame is bounded: the id by
+ * length, the procedure name by length and pattern, and `payload` plus
+ * `metadata` by their combined encoded size.
+ *
+ * @throws {RPCInvalidRequestError} when the frame is malformed, the id is
+ * over-long, or payload and metadata together exceed the configured limit.
  */
 export declare function assertValidRequest(request: unknown, limits?: RPCRequestLimits): asserts request is RPCRequest;
 /**

package/dist/rpc/validation/rpcValidation.core.js

@@ -7,7 +7,7 @@
  * the first checks the server runs, not the last.
  */
 import { RPCInternalError, RPCInvalidRequestError, RPCValidationError, } from "../errors/rpc.errors.js";
-import { MAX_PROCEDURE_NAME_LENGTH, MAX_RPC_PAYLOAD_SIZE, PROCEDURE_NAME_PATTERN, } from "../constants/rpcConstants.core.js";
+import { MAX_PROCEDURE_NAME_LENGTH, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, PROCEDURE_NAME_PATTERN, } from "../constants/rpcConstants.core.js";
 /**
  * Validates a procedure name.
  *
@@ -49,8 +49,12 @@ export function measurePayloadBytes(payload) {
 /**
  * Validates the shape and size of an incoming request.
  *
- * @throws {RPCInvalidRequestError} when the frame is malformed or the
- * payload exceeds the configured limit.
+ * Every caller-controlled part of the frame is bounded: the id by
+ * length, the procedure name by length and pattern, and `payload` plus
+ * `metadata` by their combined encoded size.
+ *
+ * @throws {RPCInvalidRequestError} when the frame is malformed, the id is
+ * over-long, or payload and metadata together exceed the configured limit.
  */
 export function assertValidRequest(request, limits = {}) {
     if (typeof request !== "object" || request === null) {
@@ -60,6 +64,13 @@ export function assertValidRequest(request, limits = {}) {
     if (typeof candidate.id !== "string" || candidate.id.length === 0) {
         throw new RPCInvalidRequestError("Request id must be a non-empty string.");
     }
+    // Checked before anything else touches the frame: the id is reflected
+    // into every response the server builds, so an oversized one must be
+    // refused before a response exists to carry it.
+    const maxIdLength = limits.maxRequestIdLength ?? MAX_RPC_REQUEST_ID_LENGTH;
+    if (maxIdLength > 0 && candidate.id.length > maxIdLength) {
+        throw new RPCInvalidRequestError(`Request id exceeds ${maxIdLength} characters.`);
+    }
     if (limits.enforceProcedureNamePattern ?? true) {
         assertValidProcedureName(candidate.procedure);
     }
@@ -73,10 +84,12 @@ export function assertValidRequest(request, limits = {}) {
     }
     const maxBytes = limits.maxPayloadBytes ?? MAX_RPC_PAYLOAD_SIZE;
     if (maxBytes > 0) {
-        const size = measurePayloadBytes(candidate.payload);
-        if (size === undefined) {
+        const payloadSize = measurePayloadBytes(candidate.payload);
+        const metadataSize = measurePayloadBytes(candidate.metadata);
+        if (payloadSize === undefined || metadataSize === undefined) {
             throw new RPCInvalidRequestError("Request payload could not be encoded.", candidate.procedure);
         }
+        const size = payloadSize + metadataSize;
         if (size > maxBytes) {
             throw new RPCInvalidRequestError(`Request payload of ${size} bytes exceeds the ${maxBytes} byte limit.`, candidate.procedure);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/rpc",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Remote procedure call infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -27,10 +27,10 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/errors": "1.1.0",
-    "@zudojs/constants": "1.1.0",
-    "@zudojs/types": "1.1.0",
-    "@zudojs/schema": "1.1.0"
+    "@zudojs/errors": "1.2.0",
+    "@zudojs/constants": "1.1.1",
+    "@zudojs/types": "1.1.1",
+    "@zudojs/schema": "1.1.1"
   },
   "devDependencies": {
     "typescript": "7.0.2",