@zudojs/rpc 1.2.0 → 1.4.0

package/dist/rpc/transport/memory/rpcMemoryTransport.core.js

@@ -0,0 +1,73 @@
+import { createRPCJsonSerializer } from "../codec/rpcCodec.helper.js";
+import { createRPCErrorResponse } from "../../types/rpcResponse.type.js";
+import { RPCSerializationError, RPCUnavailableError, } from "../../errors/rpc.errors.js";
+import { INTERNAL_ERROR_MESSAGE } from "../../constants/rpcConstants.core.js";
+import { raceAbort } from "../../reliability/cancellation/rpcAbort.helper.js";
+/**
+ * Creates a transport that delivers frames to a server in the same
+ * process — for tests, and for modular monoliths that may later split a
+ * module into its own service without touching callers.
+ *
+ * Honours `options.signal`: an aborted call stops waiting at once and the
+ * server's dispatch is cancelled with it. After `close()` every send fails
+ * with `RPCUnavailableError`.
+ */
+export function createRPCMemoryTransport(server, options = {}) {
+    const serializer = options.serializer === false
+        ? undefined
+        : (options.serializer ?? createRPCJsonSerializer());
+    let closed = false;
+    const resolveAuth = async (request) => typeof options.auth === "function" ? options.auth(request) : options.auth;
+    return {
+        async send(request, sendOptions = {}) {
+            if (closed) {
+                throw new RPCUnavailableError("RPC memory transport has been closed.", request.procedure);
+            }
+            const frame = copy(serializer, request, request.procedure);
+            const exchange = async () => {
+                const auth = await resolveAuth(request);
+                const signal = sendOptions.signal;
+                const response = await server.handle(frame, {
+                    ...(auth === undefined ? {} : { auth }),
+                    ...(signal === undefined ? {} : { signal }),
+                });
+                return copyResponse(serializer, response);
+            };
+            return raceAbort(exchange(), sendOptions.signal, request.procedure);
+        },
+        async close() {
+            closed = true;
+        },
+    };
+}
+function copy(serializer, value, procedure) {
+    if (serializer === undefined) {
+        return value;
+    }
+    try {
+        return serializer.deserialize(serializer.serialize(value));
+    }
+    catch {
+        throw new RPCSerializationError("RPC request could not be serialized.", procedure);
+    }
+}
+/**
+ * A response the server produced but that cannot cross the boundary (a
+ * `BigInt` result under plain JSON, a cycle) is answered the way a
+ * network transport would: a generic internal error frame.
+ */
+function copyResponse(serializer, response) {
+    if (serializer === undefined) {
+        return response;
+    }
+    try {
+        return serializer.deserialize(serializer.serialize(response));
+    }
+    catch {
+        return createRPCErrorResponse(response.id, {
+            code: "RPC_SERIALIZATION_ERROR",
+            message: INTERNAL_ERROR_MESSAGE,
+        });
+    }
+}
+//# sourceMappingURL=rpcMemoryTransport.core.js.map

package/dist/rpc/validation/rpcUnsafeKey.helper.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Detection of prototype-polluting keys in decoded, untrusted data.
+ */
+/**
+ * Returns the first `__proto__`, `constructor` or `prototype` key found
+ * anywhere in `value`, or `undefined` when there is none.
+ *
+ * `JSON.parse` keeps such a key as an ordinary own property, so it reaches
+ * handlers intact; the moment one is copied with `Object.assign`, a
+ * `for…in` merge or a bracket assignment, it replaces the target's
+ * prototype. Transports refuse a frame that carries one rather than
+ * silently dropping it.
+ *
+ * Walks plain objects and arrays only, iteratively (no recursion limit)
+ * and cycle-safe, so it is safe on any decoded or in-process value.
+ */
+export declare function findUnsafeKey(value: unknown): string | undefined;
+//# sourceMappingURL=rpcUnsafeKey.helper.d.ts.map

package/dist/rpc/validation/rpcUnsafeKey.helper.js

@@ -0,0 +1,60 @@
+/**
+ * Detection of prototype-polluting keys in decoded, untrusted data.
+ */
+import { SCHEMA_FORBIDDEN_KEYS } from "@zudojs/constants";
+function isTraversable(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    if (Array.isArray(value)) {
+        return true;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+/**
+ * Returns the first `__proto__`, `constructor` or `prototype` key found
+ * anywhere in `value`, or `undefined` when there is none.
+ *
+ * `JSON.parse` keeps such a key as an ordinary own property, so it reaches
+ * handlers intact; the moment one is copied with `Object.assign`, a
+ * `for…in` merge or a bracket assignment, it replaces the target's
+ * prototype. Transports refuse a frame that carries one rather than
+ * silently dropping it.
+ *
+ * Walks plain objects and arrays only, iteratively (no recursion limit)
+ * and cycle-safe, so it is safe on any decoded or in-process value.
+ */
+export function findUnsafeKey(value) {
+    if (!isTraversable(value)) {
+        return undefined;
+    }
+    const seen = new WeakSet();
+    const pending = [value];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        if (seen.has(node)) {
+            continue;
+        }
+        seen.add(node);
+        if (Array.isArray(node)) {
+            for (const child of node) {
+                if (isTraversable(child)) {
+                    pending.push(child);
+                }
+            }
+            continue;
+        }
+        for (const key of Object.keys(node)) {
+            if (SCHEMA_FORBIDDEN_KEYS.has(key)) {
+                return key;
+            }
+            const child = node[key];
+            if (isTraversable(child)) {
+                pending.push(child);
+            }
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=rpcUnsafeKey.helper.js.map

package/dist/rpc/validation/rpcValidation.core.d.ts

@@ -13,16 +13,33 @@ import type { RPCRequest } from "../types/rpcRequest.type.js";
  */
 export interface RPCRequestLimits {
     /**
-     * Maximum encoded payload size in bytes. Defaults to
+     * Maximum combined encoded size, in bytes, of the caller-controlled
+     * parts of the frame — `payload` and `metadata`. Defaults to
      * {@link MAX_RPC_PAYLOAD_SIZE}. Set to `0` to skip the check when the
      * transport already enforces a frame limit.
+     *
+     * `metadata` counts because it is caller-controlled and is handed to
+     * middleware and handlers as `context.metadata`; measuring `payload`
+     * alone left an unbounded second channel into the same handler.
      */
     readonly maxPayloadBytes?: number;
+    /**
+     * Maximum length of `request.id`. Defaults to
+     * {@link MAX_RPC_REQUEST_ID_LENGTH}. Set to `0` to skip the check.
+     */
+    readonly maxRequestIdLength?: number;
     /**
      * Whether procedure names must match {@link PROCEDURE_NAME_PATTERN}.
      * Defaults to `true`.
      */
     readonly enforceProcedureNamePattern?: boolean;
+    /**
+     * Accept `__proto__`, `constructor` and `prototype` as keys inside
+     * `payload` and `metadata`. Defaults to `false`: a frame carrying one is
+     * refused, because a handler that merges its input into another object
+     * would have that object's prototype replaced.
+     */
+    readonly allowUnsafeKeys?: boolean;
 }
 /**
  * Validates a procedure name.
@@ -41,8 +58,14 @@ export declare function measurePayloadBytes(payload: unknown): number | undefine
 /**
  * Validates the shape and size of an incoming request.
  *
- * @throws {RPCInvalidRequestError} when the frame is malformed or the
- * payload exceeds the configured limit.
+ * Every caller-controlled part of the frame is bounded: the id by
+ * length, the procedure name by length and pattern, and `payload` plus
+ * `metadata` by their combined encoded size. Neither may carry a
+ * prototype-polluting key unless `limits.allowUnsafeKeys` is set.
+ *
+ * @throws {RPCInvalidRequestError} when the frame is malformed, the id is
+ * over-long, payload and metadata together exceed the configured limit, or
+ * either carries a `__proto__`, `constructor` or `prototype` key.
  */
 export declare function assertValidRequest(request: unknown, limits?: RPCRequestLimits): asserts request is RPCRequest;
 /**

package/dist/rpc/validation/rpcValidation.core.js

@@ -6,8 +6,9 @@
  * Requests arrive from an untrusted peer over a transport, so these are
  * the first checks the server runs, not the last.
  */
+import { findUnsafeKey } from "@zudojs/security";
 import { RPCInternalError, RPCInvalidRequestError, RPCValidationError, } from "../errors/rpc.errors.js";
-import { MAX_PROCEDURE_NAME_LENGTH, MAX_RPC_PAYLOAD_SIZE, PROCEDURE_NAME_PATTERN, } from "../constants/rpcConstants.core.js";
+import { MAX_PROCEDURE_NAME_LENGTH, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, PROCEDURE_NAME_PATTERN, } from "../constants/rpcConstants.core.js";
 /**
  * Validates a procedure name.
  *
@@ -49,8 +50,14 @@ export function measurePayloadBytes(payload) {
 /**
  * Validates the shape and size of an incoming request.
  *
- * @throws {RPCInvalidRequestError} when the frame is malformed or the
- * payload exceeds the configured limit.
+ * Every caller-controlled part of the frame is bounded: the id by
+ * length, the procedure name by length and pattern, and `payload` plus
+ * `metadata` by their combined encoded size. Neither may carry a
+ * prototype-polluting key unless `limits.allowUnsafeKeys` is set.
+ *
+ * @throws {RPCInvalidRequestError} when the frame is malformed, the id is
+ * over-long, payload and metadata together exceed the configured limit, or
+ * either carries a `__proto__`, `constructor` or `prototype` key.
  */
 export function assertValidRequest(request, limits = {}) {
     if (typeof request !== "object" || request === null) {
@@ -60,6 +67,13 @@ export function assertValidRequest(request, limits = {}) {
     if (typeof candidate.id !== "string" || candidate.id.length === 0) {
         throw new RPCInvalidRequestError("Request id must be a non-empty string.");
     }
+    // Checked before anything else touches the frame: the id is reflected
+    // into every response the server builds, so an oversized one must be
+    // refused before a response exists to carry it.
+    const maxIdLength = limits.maxRequestIdLength ?? MAX_RPC_REQUEST_ID_LENGTH;
+    if (maxIdLength > 0 && candidate.id.length > maxIdLength) {
+        throw new RPCInvalidRequestError(`Request id exceeds ${maxIdLength} characters.`);
+    }
     if (limits.enforceProcedureNamePattern ?? true) {
         assertValidProcedureName(candidate.procedure);
     }
@@ -73,14 +87,22 @@ export function assertValidRequest(request, limits = {}) {
     }
     const maxBytes = limits.maxPayloadBytes ?? MAX_RPC_PAYLOAD_SIZE;
     if (maxBytes > 0) {
-        const size = measurePayloadBytes(candidate.payload);
-        if (size === undefined) {
+        const payloadSize = measurePayloadBytes(candidate.payload);
+        const metadataSize = measurePayloadBytes(candidate.metadata);
+        if (payloadSize === undefined || metadataSize === undefined) {
             throw new RPCInvalidRequestError("Request payload could not be encoded.", candidate.procedure);
         }
+        const size = payloadSize + metadataSize;
         if (size > maxBytes) {
             throw new RPCInvalidRequestError(`Request payload of ${size} bytes exceeds the ${maxBytes} byte limit.`, candidate.procedure);
         }
     }
+    if (limits.allowUnsafeKeys !== true) {
+        const unsafe = findUnsafeKey(candidate.payload) ?? findUnsafeKey(candidate.metadata);
+        if (unsafe !== undefined) {
+            throw new RPCInvalidRequestError(`Request contains the forbidden key "${unsafe}".`, candidate.procedure);
+        }
+    }
 }
 /**
  * Converts schema issues into metadata safe to return to a caller.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/rpc",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "Remote procedure call infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -27,14 +27,16 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/errors": "1.1.0",
-    "@zudojs/constants": "1.1.0",
-    "@zudojs/types": "1.1.0",
-    "@zudojs/schema": "1.1.0"
+    "@zudojs/constants": "1.1.2",
+    "@zudojs/errors": "1.3.0",
+    "@zudojs/schema": "1.2.0",
+    "@zudojs/security": "1.3.0",
+    "@zudojs/serialization": "1.2.0",
+    "@zudojs/types": "1.2.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.1"
   },
   "publishConfig": {
     "access": "public"
@@ -45,7 +47,7 @@
     "remote",
     "procedure"
   ],
-  "homepage": "https://github.com/oyinlola-tech/zudo#readme",
+  "homepage": "https://zudojs.oyinlola.site/docs/packages-rpc",
   "bugs": {
     "url": "https://github.com/oyinlola-tech/zudo/issues"
   },