baff.js 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to baff.js are listed here. The project follows [semantic versioning](https://semver.org); before 1.0, minor versions may include breaking changes.
 
+## 0.1.1
+
+- `ActionRowBuilder` now rejects anything but buttons or one select menu. Before, a text display, separator, container or thumbnail passed `toJSON()`. Thank you to the bug bounty reporter.
+- `PermissionsBitField.has()` and `.any()` now throw `INVALID_PERMISSION` for an unknown permission name even when the bitfield has Administrator. Before, administrators got `true` for a misspelled name.
+
 ## 0.1.0
 
 First release.

package/dist/cjs/builders/components/ActionRowBuilder.js

@@ -4,6 +4,14 @@ exports.ActionRowBuilder = void 0;
 const constants_js_1 = require("../../util/constants.js");
 const validate_js_1 = require("../validate.js");
 const shared_js_1 = require("./shared.js");
+// The only things an action row can hold besides buttons: one select menu.
+const SELECTS = new Set([
+    constants_js_1.ComponentType.StringSelect,
+    constants_js_1.ComponentType.UserSelect,
+    constants_js_1.ComponentType.RoleSelect,
+    constants_js_1.ComponentType.MentionableSelect,
+    constants_js_1.ComponentType.ChannelSelect
+]);
 class ActionRowBuilder extends shared_js_1.ComponentBuilder {
     components;
     constructor(data = {}) {
@@ -36,7 +44,7 @@ class ActionRowBuilder extends shared_js_1.ComponentBuilder {
             if (kinds.length > 5 || kinds.some((k) => k !== constants_js_1.ComponentType.Button))
                 (0, validate_js_1.fail)(code, 'action row', 'can hold up to 5 buttons, all buttons.');
         }
-        else if (kinds.length !== 1 || kinds[0] === constants_js_1.ComponentType.TextInput || kinds[0] === undefined) {
+        else if (kinds.length !== 1 || !SELECTS.has(kinds[0])) {
             (0, validate_js_1.fail)(code, 'action row', 'needs 1-5 buttons, or exactly one select menu.');
         }
         return { ...this.base(constants_js_1.ComponentType.ActionRow), components: children };

package/dist/cjs/util/Permissions.js

@@ -66,15 +66,17 @@ class PermissionsBitField {
         throw new BaffError_js_1.BaffError('INVALID_PERMISSION', `Cannot read ${String(bits)} as a permission.`);
     }
     has(permission, checkAdmin = true) {
+        // Resolve first, so a misspelled name throws for administrators too.
+        const bit = PermissionsBitField.resolve(permission);
         if (checkAdmin && (this.bitfield & exports.PermissionFlagsBits.Administrator) !== 0n)
             return true;
-        const bit = PermissionsBitField.resolve(permission);
         return (this.bitfield & bit) === bit;
     }
     any(permission, checkAdmin = true) {
+        const bit = PermissionsBitField.resolve(permission);
         if (checkAdmin && (this.bitfield & exports.PermissionFlagsBits.Administrator) !== 0n)
             return true;
-        return (this.bitfield & PermissionsBitField.resolve(permission)) !== 0n;
+        return (this.bitfield & bit) !== 0n;
     }
     missing(permission, checkAdmin = true) {
         return PermissionsBitField.names(PermissionsBitField.resolve(permission)).filter((name) => !this.has(name, checkAdmin));

package/dist/cjs/util/constants.d.ts

@@ -75,4 +75,4 @@ export declare const PresenceStatus: {
 };
 export declare const DEFAULT_API_URL = "https://baff.gg/api";
 export declare const DEFAULT_GATEWAY_URL = "wss://baff.gg/api/gateway";
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.1.1";

package/dist/cjs/util/constants.js

@@ -78,4 +78,4 @@ exports.PresenceStatus = {
 };
 exports.DEFAULT_API_URL = 'https://baff.gg/api';
 exports.DEFAULT_GATEWAY_URL = 'wss://baff.gg/api/gateway';
-exports.VERSION = '0.1.0';
+exports.VERSION = '0.1.1';

package/dist/esm/builders/components/ActionRowBuilder.js

@@ -1,6 +1,14 @@
 import { ComponentType } from '../../util/constants.js';
 import { fail, resolveJSON } from '../validate.js';
 import { ComponentBuilder } from './shared.js';
+// The only things an action row can hold besides buttons: one select menu.
+const SELECTS = new Set([
+    ComponentType.StringSelect,
+    ComponentType.UserSelect,
+    ComponentType.RoleSelect,
+    ComponentType.MentionableSelect,
+    ComponentType.ChannelSelect
+]);
 export class ActionRowBuilder extends ComponentBuilder {
     components;
     constructor(data = {}) {
@@ -33,7 +41,7 @@ export class ActionRowBuilder extends ComponentBuilder {
             if (kinds.length > 5 || kinds.some((k) => k !== ComponentType.Button))
                 fail(code, 'action row', 'can hold up to 5 buttons, all buttons.');
         }
-        else if (kinds.length !== 1 || kinds[0] === ComponentType.TextInput || kinds[0] === undefined) {
+        else if (kinds.length !== 1 || !SELECTS.has(kinds[0])) {
             fail(code, 'action row', 'needs 1-5 buttons, or exactly one select menu.');
         }
         return { ...this.base(ComponentType.ActionRow), components: children };

package/dist/esm/util/Permissions.js

@@ -63,15 +63,17 @@ export class PermissionsBitField {
         throw new BaffError('INVALID_PERMISSION', `Cannot read ${String(bits)} as a permission.`);
     }
     has(permission, checkAdmin = true) {
+        // Resolve first, so a misspelled name throws for administrators too.
+        const bit = PermissionsBitField.resolve(permission);
         if (checkAdmin && (this.bitfield & PermissionFlagsBits.Administrator) !== 0n)
             return true;
-        const bit = PermissionsBitField.resolve(permission);
         return (this.bitfield & bit) === bit;
     }
     any(permission, checkAdmin = true) {
+        const bit = PermissionsBitField.resolve(permission);
         if (checkAdmin && (this.bitfield & PermissionFlagsBits.Administrator) !== 0n)
             return true;
-        return (this.bitfield & PermissionsBitField.resolve(permission)) !== 0n;
+        return (this.bitfield & bit) !== 0n;
     }
     missing(permission, checkAdmin = true) {
         return PermissionsBitField.names(PermissionsBitField.resolve(permission)).filter((name) => !this.has(name, checkAdmin));

package/dist/esm/util/constants.d.ts

@@ -75,4 +75,4 @@ export declare const PresenceStatus: {
 };
 export declare const DEFAULT_API_URL = "https://baff.gg/api";
 export declare const DEFAULT_GATEWAY_URL = "wss://baff.gg/api/gateway";
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.1.1";

package/dist/esm/util/constants.js

@@ -75,4 +75,4 @@ export const PresenceStatus = {
 };
 export const DEFAULT_API_URL = 'https://baff.gg/api';
 export const DEFAULT_GATEWAY_URL = 'wss://baff.gg/api/gateway';
-export const VERSION = '0.1.0';
+export const VERSION = '0.1.1';

package/package.json

@@ -1,58 +1,58 @@
-{
-	"name": "baff.js",
-	"version": "0.1.0",
-	"description": "The library for building bots on baff.gg: gateway client, REST, slash commands, components and embeds, with no runtime dependencies.",
-	"license": "SEE LICENSE IN LICENSE",
-	"type": "module",
-	"main": "./dist/cjs/index.js",
-	"module": "./dist/esm/index.js",
-	"types": "./dist/esm/index.d.ts",
-	"exports": {
-		".": {
-			"import": {
-				"types": "./dist/esm/index.d.ts",
-				"default": "./dist/esm/index.js"
-			},
-			"require": {
-				"types": "./dist/cjs/index.d.ts",
-				"default": "./dist/cjs/index.js"
-			}
-		},
-		"./package.json": "./package.json"
-	},
-	"sideEffects": false,
-	"files": [
-		"dist",
-		"README.md",
-		"LICENSE",
-		"CHANGELOG.md"
-	],
-	"engines": {
-		"node": ">=20"
-	},
-	"homepage": "https://docs.baff.gg",
-	"bugs": {
-		"url": "https://support.baff.gg/requests/new?topic=bug"
-	},
-	"keywords": [
-		"baff.gg",
-		"baff",
-		"bot",
-		"chat",
-		"gateway",
-		"slash-commands",
-		"api"
-	],
-	"scripts": {
-		"build": "node scripts/clean.mjs dist && tsc -p tsconfig.esm.json && tsc -p tsconfig.cjs.json && node scripts/package-markers.mjs",
-		"typecheck": "tsc --noEmit -p tsconfig.json",
-		"test": "node scripts/clean.mjs .build-test && tsc -p tsconfig.test.json && node scripts/run-tests.mjs",
-		"check": "npm run typecheck && npm test",
-		"smoke": "node scripts/smoke.mjs",
-		"prepublishOnly": "npm run build && npm test && npm run smoke"
-	},
-	"devDependencies": {
-		"@types/node": "^22.10.0",
-		"typescript": "^5.7.0"
-	}
-}
+{
+	"name": "baff.js",
+	"version": "0.1.1",
+	"description": "The library for building bots on baff.gg: gateway client, REST, slash commands, components and embeds, with no runtime dependencies.",
+	"license": "SEE LICENSE IN LICENSE",
+	"type": "module",
+	"main": "./dist/cjs/index.js",
+	"module": "./dist/esm/index.js",
+	"types": "./dist/esm/index.d.ts",
+	"exports": {
+		".": {
+			"import": {
+				"types": "./dist/esm/index.d.ts",
+				"default": "./dist/esm/index.js"
+			},
+			"require": {
+				"types": "./dist/cjs/index.d.ts",
+				"default": "./dist/cjs/index.js"
+			}
+		},
+		"./package.json": "./package.json"
+	},
+	"sideEffects": false,
+	"files": [
+		"dist",
+		"README.md",
+		"LICENSE",
+		"CHANGELOG.md"
+	],
+	"engines": {
+		"node": ">=20"
+	},
+	"homepage": "https://docs.baff.gg",
+	"bugs": {
+		"url": "https://support.baff.gg/requests/new?topic=bug"
+	},
+	"keywords": [
+		"baff.gg",
+		"baff",
+		"bot",
+		"chat",
+		"gateway",
+		"slash-commands",
+		"api"
+	],
+	"scripts": {
+		"build": "node scripts/clean.mjs dist && tsc -p tsconfig.esm.json && tsc -p tsconfig.cjs.json && node scripts/package-markers.mjs",
+		"typecheck": "tsc --noEmit -p tsconfig.json",
+		"test": "node scripts/clean.mjs .build-test && tsc -p tsconfig.test.json && node scripts/run-tests.mjs",
+		"check": "npm run typecheck && npm test",
+		"smoke": "node scripts/smoke.mjs",
+		"prepublishOnly": "npm run build && npm test && npm run smoke"
+	},
+	"devDependencies": {
+		"@types/node": "^22.10.0",
+		"typescript": "^5.7.0"
+	}
+}