bsuir-iis-api 0.9.1 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.10.0] - 2026-05-13
+
+### Added
+
+- `createBsuirClient` options: `allowedBaseUrlHosts`, `allowInsecureHttp`, and `maxResponseBytes`.
+- HTTP internals split into focused modules under `src/client/http/*` (`requestJson`, `response`, `cache`, `retry`, `url`).
+- Schedule internals split into `scheduleApi`, `scheduleFilter`, and `scheduleNormalize`.
+- Shared `createListModule` used by catalog modules to remove duplicated list/read logic.
+- CI/release workflows now generate CycloneDX SBOM (`sbom.cdx.json`) on Node 24.
+
+### Changed
+
+- `createBsuirClient` now validates and normalizes `baseUrl` strictly (absolute URL, no credentials/query/hash, host allowlist, HTTPS by default).
+- `validateResponses` is now enabled by default.
+- Example scripts now fail with non-zero exit code on unhandled errors.
+- GitHub Actions in CI/release workflows are pinned to commit SHAs.
+- Dev dependencies in `package.json` are now pinned to exact versions.
+
+### Fixed
+
+- Response parser now enforces `maxResponseBytes` for both `Content-Length` pre-checks and streamed body reads.
+- `BsuirTimeoutError` now preserves upstream abort timeout cause.
+- Public API report updates for schedule typings (`FlattenedLessonsByDay` and `lessonTypeAbbrev`) and utility export documentation.
+
 ## [0.9.1] - 2026-05-10
 
 ### Fixed

package/README.md

@@ -33,6 +33,8 @@ console.log(schedule.lessons.length);
 ```ts
 const client = createBsuirClient({
   baseUrl: "https://iis.bsuir.by/api/v1",
+  allowedBaseUrlHosts: ["iis.bsuir.by"],
+  allowInsecureHttp: false,
   timeoutMs: 10000,
   retries: 2,
   retryDelayMs: 300,
@@ -40,7 +42,8 @@ const client = createBsuirClient({
   retryJitter: true,
   cache: { ttlMs: 60_000, maxEntries: 200 },
   dedupeInFlight: true,
-  validateResponses: false,
+  maxResponseBytes: 5_000_000,
+  validateResponses: true,
   hooks: {
     onRetry: ({ endpoint, delayMs, reason }) => {
       console.log("retry", endpoint, delayMs, reason);
@@ -51,10 +54,14 @@ const client = createBsuirClient({
 ```
 
 - `fetch` can be passed for custom runtime/testing.
+- `baseUrl` is normalized and validated (absolute URL, no credentials/query/hash, host allowlist).
+- `allowedBaseUrlHosts` controls which hosts are allowed for `baseUrl` (defaults to `["iis.bsuir.by"]`).
+- `allowInsecureHttp` enables `http://` only for trusted local/test endpoints.
 - `signal` in `createBsuirClient({ signal })` acts as a global cancellation signal for all requests made by that client.
 - `cache` stores successful GET responses in-memory for the configured TTL.
 - `dedupeInFlight` reuses the same in-flight GET request for concurrent callers (when no per-request signal is passed).
-- `validateResponses` enables runtime payload-shape checks for key endpoints.
+- `maxResponseBytes` limits body size per response to protect against memory spikes.
+- `validateResponses` enables runtime payload-shape checks for key endpoints (enabled by default).
 - `hooks` provides lifecycle callbacks (`onRequest`, `onRetry`, `onResponse`, `onError`) for observability.
 - `AbortSignal` is supported by all read methods.
 

package/dist/_tsup-dts-rollup.d.ts

@@ -94,6 +94,22 @@ declare interface BsuirClientOptions {
      * @defaultValue "https://iis.bsuir.by/api/v1"
      */
     baseUrl?: string;
+    /**
+     * Allows using `http://` for `baseUrl`.
+     *
+     * Keep disabled unless you explicitly need local/non-TLS endpoints in tests.
+     *
+     * @defaultValue false
+     */
+    allowInsecureHttp?: boolean;
+    /**
+     * Allowed hostnames for `baseUrl`.
+     *
+     * Requests are rejected if `baseUrl` hostname is not in this list.
+     *
+     * @defaultValue ["iis.bsuir.by"]
+     */
+    allowedBaseUrlHosts?: string[];
     /**
      * Custom `fetch` implementation. Useful for environments where the global
      * `fetch` is unavailable (older Node.js versions) or when you want to wrap
@@ -196,6 +212,14 @@ declare interface BsuirClientOptions {
      * @defaultValue true
      */
     dedupeInFlight?: boolean;
+    /**
+     * Maximum allowed response body size (in bytes) for a single request.
+     *
+     * Helps prevent excessive memory usage on unexpectedly large payloads.
+     *
+     * @defaultValue 5_000_000 (5 MB)
+     */
+    maxResponseBytes?: number;
     /**
      * Enables runtime shape validation of API responses.
      *
@@ -207,7 +231,7 @@ declare interface BsuirClientOptions {
      * **Recommended to enable during development and in test environments.**
      * Can be left `false` in production for a small performance gain.
      *
-     * @defaultValue false
+     * @defaultValue true
      *
      * @example
      * ```ts
@@ -348,6 +372,11 @@ export { BuildingNumber }
 export { BuildingNumber as BuildingNumber_alias_1 }
 export { BuildingNumber as BuildingNumber_alias_2 }
 
+/**
+ * Builds absolute endpoint URL from base URL, path and query params.
+ */
+export declare function buildUrl(baseUrl: string, path: string, query?: QueryParams): string;
+
 declare interface CacheOptions {
     /**
      * Cache TTL for successful GET responses, in milliseconds.
@@ -397,15 +426,10 @@ declare function createAnnouncementsModule(config: Readonly<InternalClientConfig
 export { createAnnouncementsModule }
 export { createAnnouncementsModule as createAnnouncementsModule_alias_1 }
 
+/**
+ * Creates API module for `/auditories`.
+ */
 declare function createAuditoriesModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of auditories from `/auditories`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<Auditory[]>;
 };
 export { createAuditoriesModule }
@@ -440,57 +464,37 @@ declare function createBsuirClient(options?: BsuirClientOptions & {
 export { createBsuirClient }
 export { createBsuirClient as createBsuirClient_alias_1 }
 
+/**
+ * Creates API module for `/departments`.
+ */
 declare function createDepartmentsModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of departments from `/departments`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<Department[]>;
 };
 export { createDepartmentsModule }
 export { createDepartmentsModule as createDepartmentsModule_alias_1 }
 
+/**
+ * Creates API module for `/employees/all`.
+ */
 declare function createEmployeesModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of employees from `/employees/all`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<EmployeeCatalogItem[]>;
 };
 export { createEmployeesModule }
 export { createEmployeesModule as createEmployeesModule_alias_1 }
 
+/**
+ * Creates API module for `/faculties`.
+ */
 declare function createFacultiesModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of faculties from `/faculties`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<Faculty[]>;
 };
 export { createFacultiesModule }
 export { createFacultiesModule as createFacultiesModule_alias_1 }
 
+/**
+ * Creates API module for `/student-groups`.
+ */
 declare function createGroupsModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of student groups from `/student-groups`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<StudentGroupCatalogItem[]>;
 };
 export { createGroupsModule }
@@ -498,6 +502,19 @@ export { createGroupsModule as createGroupsModule_alias_1 }
 
 export declare function createJsonResponse({ status, headers, body }: MockResponseInit): Response;
 
+/**
+ * Creates a simple catalog-like module exposing `listAll()` for a fixed endpoint.
+ */
+export declare function createListModule<T>(config: Readonly<InternalClientConfig>, endpoint: string): {
+    /**
+     * Returns all items from the configured endpoint.
+     */
+    listAll(options?: ReadOptions): Promise<T[]>;
+};
+
+/**
+ * Creates schedule API module with raw/normalized response support.
+ */
 declare function createScheduleModule<TRawDefault extends boolean>(config: Readonly<InternalClientConfig<TRawDefault>>): {
     getGroup: <TRaw extends boolean | undefined = undefined>(groupNumber: string, options?: ReadOptions & {
         raw?: TRaw;
@@ -507,14 +524,25 @@ declare function createScheduleModule<TRawDefault extends boolean>(config: Reado
     }) => Promise<ScheduleResponseByRawOption<TRaw, TRawDefault>>;
     getGroupFiltered: (groupNumber: string, filter: ScheduleFilterOptions, options?: ReadOptions) => Promise<FlattenedScheduleItem[]>;
     getEmployeeFiltered: (urlId: string, filter: ScheduleFilterOptions, options?: ReadOptions) => Promise<FlattenedScheduleItem[]>;
+    /**
+     * Returns exams for a group.
+     */
     getGroupExams(groupNumber: string, options?: ReadOptions): Promise<FlattenedScheduleItem[]>;
+    /**
+     * Returns exams for an employee.
+     */
     getEmployeeExams(urlId: string, options?: ReadOptions): Promise<FlattenedScheduleItem[]>;
+    /**
+     * Returns regular schedule lessons of a specific subgroup for a group.
+     */
     getGroupBySubgroup(groupNumber: string, subgroup: number, options?: ReadOptions): Promise<FlattenedScheduleItem[]>;
+    /**
+     * Returns regular schedule lessons of a specific subgroup for an employee.
+     */
     getEmployeeBySubgroup(urlId: string, subgroup: number, options?: ReadOptions): Promise<FlattenedScheduleItem[]>;
     getCurrentWeek: (options?: ReadOptions) => Promise<number>;
     /**
-     * Calls IIS `/last-update-date/student-group`. That route is legacy and unsupported on the server;
-     * it may return an error for newer group numbers (e.g. six-digit `524404`).
+     * Calls IIS `/last-update-date/student-group`.
      */
     getLastUpdateByGroup(params: {
         groupNumber: string;
@@ -522,8 +550,7 @@ declare function createScheduleModule<TRawDefault extends boolean>(config: Reado
         id: number;
     }, options?: ReadOptions): Promise<ApiDateResponse>;
     /**
-     * Calls IIS `/last-update-date/employee`. That route is legacy and unsupported on the server; prefer
-     * not relying on it for critical cache logic.
+     * Calls IIS `/last-update-date/employee`.
      */
     getLastUpdateByEmployee(params: {
         urlId: string;
@@ -533,16 +560,12 @@ declare function createScheduleModule<TRawDefault extends boolean>(config: Reado
 };
 export { createScheduleModule }
 export { createScheduleModule as createScheduleModule_alias_1 }
+export { createScheduleModule as createScheduleModule_alias_2 }
 
+/**
+ * Creates API module for `/specialities`.
+ */
 declare function createSpecialitiesModule(config: Readonly<InternalClientConfig>): {
-    /**
-     * Returns the full list of specialities from `/specialities`.
-     * If the caller aborts `options.signal`, the platform propagates `AbortError` (not wrapped by the SDK).
-     *
-     * @throws {BsuirApiError} When the API returns a non-success HTTP status
-     * @throws {BsuirNetworkError} On transport failures after retries
-     * @throws {BsuirTimeoutError} When the request exceeds `timeoutMs`
-     */
     listAll(options?: ReadOptions): Promise<Speciality[]>;
 };
 export { createSpecialitiesModule }
@@ -621,24 +644,12 @@ export { Faculty as Faculty_alias_1 }
 export { Faculty as Faculty_alias_2 }
 
 /**
- * Filters normalized schedule lessons by specified criteria.
- *
- * @param response - Normalized schedule response containing lessons
- * @param filter - Filter options with optional fields: source, weekday, weekNumber, subgroup,
- *                 lessonTypeAbbrev, subjectQuery, employeeUrlId, auditory
- * @returns Array of lessons matching all provided filter criteria
- *
- * @example
- * ```ts
- * const schedule = await client.schedule.getGroup("053503");
- * const mondayLessons = filterLessons(schedule, { weekday: "Понедельник" });
- * const practiceLessons = filterLessons(schedule, { lessonTypeAbbrev: "пр" });
- * const lectureLessons = filterLessons(schedule, { lessonTypeAbbrev: ["лк", "лекция"] });
- * ```
+ * Filters normalized schedule lessons by criteria.
  */
 declare function filterLessons(response: NormalizedScheduleResponse, filter: ScheduleFilterOptions): FlattenedScheduleItem[];
 export { filterLessons }
 export { filterLessons as filterLessons_alias_1 }
+export { filterLessons as filterLessons_alias_2 }
 
 declare type FlattenedLessonsByDay = Record<Weekday, FlattenedScheduleItem[]>;
 export { FlattenedLessonsByDay }
@@ -653,6 +664,11 @@ export { FlattenedScheduleItem }
 export { FlattenedScheduleItem as FlattenedScheduleItem_alias_1 }
 export { FlattenedScheduleItem as FlattenedScheduleItem_alias_2 }
 
+/**
+ * Calculates retry delay using `Retry-After` when present, otherwise exponential backoff.
+ */
+export declare function getRetryDelayMs(config: Readonly<InternalClientConfig>, attempt: number, retryAfterHeader?: string | null): number;
+
 export declare interface InternalClientConfig<TRawDefault extends boolean = boolean> {
     baseUrl: string;
     fetchImpl: typeof globalThis.fetch;
@@ -666,6 +682,7 @@ export declare interface InternalClientConfig<TRawDefault extends boolean = bool
     cacheTtlMs: number | undefined;
     cacheMaxEntries: number;
     dedupeInFlight: boolean;
+    maxResponseBytes: number;
     validateResponses: boolean;
     hooks: ClientHooks;
     responseCache: Map<string, {
@@ -733,29 +750,18 @@ export { NormalizedScheduleResponse as NormalizedScheduleResponse_alias_1 }
 export { NormalizedScheduleResponse as NormalizedScheduleResponse_alias_2 }
 
 /**
- * Transforms raw API schedule response into a normalized structure with flattened lessons.
- *
- * Raw API response contains lessons grouped by weekday (`schedules` object with day keys)
- * and exams in a separate array. This function flattens them into a single `lessons` array
- * for easier filtering and iteration, while preserving day-grouped view in `lessonsByDay`.
- *
- * @param response - Raw schedule response from API
- * @returns Normalized schedule with additional computed fields: `lessons` (flattened array),
- *          `lessonsByDay` (grouped by weekday), `scheduleLessons`, and `examLessons`
- *
- * @example
- * ```ts
- * const rawSchedule = await client.schedule.getGroup("053503", { raw: true });
- * const normalized = normalizeSchedule(rawSchedule);
- * console.log(normalized.lessons.length); // All lessons + exams flattened
- * console.log(normalized.lessonsByDay["Понедельник"]); // Monday-only lessons
- * console.log(normalized.scheduleLessons.length); // Only regular schedule
- * console.log(normalized.examLessons.length); // Only exams
- * ```
+ * Transforms raw schedule response into normalized structure with flattened lessons.
  */
 declare function normalizeSchedule(response: ScheduleResponse): NormalizedScheduleResponse;
 export { normalizeSchedule }
 export { normalizeSchedule as normalizeSchedule_alias_1 }
+export { normalizeSchedule as normalizeSchedule_alias_2 }
+
+/**
+ * Parses response body as JSON when possible, otherwise returns text.
+ * Throws `BsuirApiError` for declared JSON payloads that are empty/invalid.
+ */
+export declare function parseBody(response: Response, maxResponseBytes: number): Promise<unknown>;
 
 /**
  * Normalizes current week payload from API to a positive integer.
@@ -796,7 +802,12 @@ declare interface RequestHookContext {
 export { RequestHookContext }
 export { RequestHookContext as RequestHookContext_alias_1 }
 
-export declare function requestJson<T>(config: Readonly<InternalClientConfig>, path: string, options?: RequestOptions): Promise<T>;
+/**
+ * Executes JSON HTTP request with timeout, retry/backoff, deduplication and cache support.
+ */
+declare function requestJson<T>(config: Readonly<InternalClientConfig>, path: string, options?: RequestOptions): Promise<T>;
+export { requestJson }
+export { requestJson as requestJson_alias_1 }
 
 export declare type RequestMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 
@@ -836,6 +847,9 @@ declare interface ResponseHookContext extends RequestHookContext {
 export { ResponseHookContext }
 export { ResponseHookContext as ResponseHookContext_alias_1 }
 
+/** HTTP status codes retriable by the request pipeline. */
+export declare const RETRIABLE_STATUS_CODES: Set<number>;
+
 declare interface RetryHookContext extends RequestHookContext {
     delayMs: number;
     reason: "http_status" | "network_error";
@@ -896,6 +910,14 @@ export { ScheduleResponse as ScheduleResponse_alias_2 }
 
 declare type ScheduleResponseByRawOption<TRaw extends boolean | undefined, TRawDefault extends boolean> = TRaw extends true ? ScheduleResponse : TRaw extends false ? NormalizedScheduleResponse : TRawDefault extends true ? ScheduleResponse : NormalizedScheduleResponse;
 
+/**
+ * Writes response value to cache and performs eviction when size approaches capacity.
+ */
+export declare function setCache(config: Readonly<InternalClientConfig>, key: string, value: unknown): void;
+
+/** Delays execution for a specified number of milliseconds. */
+export declare function sleep(ms: number): Promise<void>;
+
 declare interface Speciality {
     id: number;
     name: string;
@@ -933,6 +955,11 @@ export { StudentGroupShort }
 export { StudentGroupShort as StudentGroupShort_alias_1 }
 export { StudentGroupShort as StudentGroupShort_alias_2 }
 
+/**
+ * Reads a cached response value by key, applying TTL validation and LRU touch update.
+ */
+export declare function tryReadCache(config: Readonly<InternalClientConfig>, key: string): unknown;
+
 declare type Weekday = "Понедельник" | "Вторник" | "Среда" | "Четверг" | "Пятница" | "Суббота";
 export { Weekday }
 export { Weekday as Weekday_alias_1 }