braid-text 0.2.51 → 0.2.53

package/index.js

@@ -114,7 +114,7 @@ braid_text.serve = async (req, res, options = {}) => {
                     res.setHeader("Current-Version", get_current_version())
                 res.setHeader("Version", ascii_ify(x.version.map((x) => JSON.stringify(x)).join(", ")))
                 var buffer = Buffer.from(x.body, "utf8")
-                res.setHeader("Repr-Digest", `sha-256=:${require('crypto').createHash('sha256').update(buffer).digest('base64')}:`)
+                res.setHeader("Repr-Digest", get_digest(buffer))
                 res.setHeader("Content-Length", buffer.length)
                 return my_end(200, req.method === "HEAD" ? null : buffer)
             }
@@ -136,10 +136,8 @@ braid_text.serve = async (req, res, options = {}) => {
 
                     // this is a sanity/rhobustness check..
                     // ..this digest is checked on the client..
-                    // ..it is not strictly necessary
-                    if (x.version && v_eq(x.version, resource.version)) {
-                        x["Repr-Digest"] = `sha-256=:${require('crypto').createHash('sha256').update(Buffer.from(resource.val, "utf8")).digest('base64')}:`
-                    }
+                    if (x.version && v_eq(x.version, resource.version))
+                        x["Repr-Digest"] = get_digest(resource.val)
 
                     res.sendVersion(x)
                 },
@@ -211,6 +209,19 @@ braid_text.serve = async (req, res, options = {}) => {
 
             var {change_count} = await braid_text.put(resource, { peer, version: req.version, parents: req.parents, patches, body, merge_type })
 
+            // if Repr-Digest is set,
+            // and the request version is also our new current version,
+            // then verify the digest..
+            if (req.headers['repr-digest'] &&
+                v_eq(req.version, resource.version) &&
+                req.headers['repr-digest'] !== get_digest(resource.val)) {
+                console.log(`repr-digest mismatch!`)
+
+                // we return a special 550 error code,
+                // which simpleton will pick up on to stop retrying
+                return done_my_turn(550, "repr-digest mismatch!")
+            }
+
             if (req.version) got_event(options.key, req.version[0], change_count)
            
             res.setHeader("Version", get_current_version())
@@ -2098,6 +2109,11 @@ function sorted_set_delete(arr, val) {
     if (arr[i] === val) arr.splice(i, 1)
 }
 
+function get_digest(s) {
+    if (typeof s === 'string') s = Buffer.from(s, "utf8")
+    return `sha-256=:${require('crypto').createHash('sha256').update(s).digest('base64')}:`
+}
+
 braid_text.get_resource = get_resource
 
 braid_text.encode_filename = encode_filename

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "braid-text",
-  "version": "0.2.51",
+  "version": "0.2.53",
   "description": "Library for collaborative text over http using braid.",
   "author": "Braid Working Group",
   "repository": "braid-org/braid-text",

package/simpleton-client.js

@@ -65,7 +65,7 @@ function simpleton_client(url, {
         signal: ac.signal
     }).then(res => {
         if (on_res) on_res(res)
-        res.subscribe(update => {
+        res.subscribe(async update => {
             // Only accept the update if its parents == our current version
             update.parents.sort()
             if (current_version.length === update.parents.length
@@ -110,6 +110,14 @@ function simpleton_client(url, {
                     } else prev_state = apply_patches(prev_state, patches)
                 }
 
+                // if the server gave us a digest,
+                // go ahead and check it against our new state..
+                if (update.extra_headers &&
+                    update.extra_headers["repr-digest"] &&
+                    update.extra_headers["repr-digest"].startsWith('sha-256=') &&
+                    update.extra_headers["repr-digest"] !== await get_digest(prev_state))
+                    throw new Error('repr-digest mismatch')
+
                 if (on_state) on_state(prev_state)
             }
         }, on_error)
@@ -166,10 +174,13 @@ function simpleton_client(url, {
             outstanding_changes++
             try {
                 var r = await braid_fetch(url, {
-                    headers: { "Merge-Type": "simpleton",
-                        ...(content_type ? {"Content-Type": content_type} : {}) },
+                    headers: {
+                        "Merge-Type": "simpleton",
+                        "Repr-Digest": await get_digest(prev_state),
+                        ...(content_type ? {"Content-Type": content_type} : {})
+                    },
                     method: "PUT",
-                    retry: () => true,
+                    retry: (res) => res.status !== 550,
                     version, parents, patches,
                     peer
                 })
@@ -220,4 +231,9 @@ function simpleton_client(url, {
         }
         return state
     }
+
+    async function get_digest(s) {
+        var bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s))
+        return `sha-256=:${btoa(String.fromCharCode(...new Uint8Array(bytes)))}:`
+    }
 }

package/test/test.html

@@ -96,6 +96,56 @@ async function runTest(testName, testFunction, expectedResult) {
     }
 }
 
+runTest(
+    "test PUT digest (good)",
+    async () => {
+        let key = 'test-' + Math.random().toString(36).slice(2)
+
+        async function get_digest(s) {
+            var bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s))
+            return `sha-256=:${btoa(String.fromCharCode(...new Uint8Array(bytes)))}:`
+        }
+
+        let r = await braid_fetch(`/${key}`, {
+            method: 'PUT',
+            version: ['hi-1'],
+            parents: [],
+            body: 'xx',
+            headers: {
+                'Repr-Digest': await get_digest('xx')
+            }
+        })
+        if (!r.ok) return 'got: ' + r.status
+        return 'ok'
+    },
+    'ok'
+)
+
+runTest(
+    "test PUT digest (bad)",
+    async () => {
+        let key = 'test-' + Math.random().toString(36).slice(2)
+
+        async function get_digest(s) {
+            var bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s))
+            return `sha-256=:${btoa(String.fromCharCode(...new Uint8Array(bytes)))}:`
+        }
+
+        let r = await braid_fetch(`/${key}`, {
+            method: 'PUT',
+            version: ['hi-1'],
+            parents: [],
+            body: 'xx',
+            headers: {
+                'Repr-Digest': await get_digest('yy')
+            }
+        })
+        if (!r.ok) return 'got: ' + r.status
+        return 'ok'
+    },
+    'got: 550'
+)
+
 runTest(
     "test subscribing and verifying digests [simpleton]",
     async () => {
@@ -157,9 +207,6 @@ runTest(
         var parts = []
         var p = new Promise(async (done, fail) => {
             r2.subscribe(update => {
-
-                console.log(`update: ${JSON.stringify(update, null, 4)}`)
-
                 parts.push(update.extra_headers['repr-digest'])
                 if (parts.length > 1) done()
             }, fail)