cabloy 5.1.216 → 5.1.218

package/vona/src/suite-vendor/a-vona/modules/a-logger/src/lib/redactIsolatedReadyHeader.test.ts

@@ -3,6 +3,22 @@ import { test } from 'node:test';
 
 import { redactIsolatedReadyHeader } from './redactIsolatedReadyHeader.ts';
 
+test('redacts isolated shutdown authorization and proof case-insensitively', () => {
+  const headers = {
+    'X-Vona-Test-Stop-Authorization': 'authorization-value',
+    'x-vona-test-stop-nonce': 'nonce-value',
+    'X-VONA-TEST-STOP-PROOF': 'proof-value',
+    'content-type': 'application/json',
+  };
+  const logged = redactIsolatedReadyHeader(headers, '/health/test-stop', 'managed-run', [
+    'x-vona-test-stop-authorization',
+    'x-vona-test-stop-nonce',
+    'x-vona-test-stop-proof',
+  ]);
+  assert.deepEqual(logged, { 'content-type': 'application/json' });
+  assert.equal(headers['X-Vona-Test-Stop-Authorization'], 'authorization-value');
+});
+
 test('redacts isolated readiness challenge and proof without changing live headers', () => {
   const runId = '20261014010203-a1b2c3d4';
   const req = { 'x-vona-test-challenge': 'challenge-value', 'accept': 'application/json' };

package/vona/src/suite-vendor/a-vona/modules/a-logger/src/lib/redactIsolatedReadyHeader.ts

@@ -2,10 +2,13 @@ export function redactIsolatedReadyHeader<HEADERS extends Record<string, unknown
   headers: HEADERS,
   path: string,
   runId: string | undefined,
-  header: string,
+  header: string | string[],
 ): HEADERS {
-  if (path !== '/health/ready' || !runId) return headers;
+  if (!['/health/ready', '/health/test-stop'].includes(path) || !runId) return headers;
   const redacted = { ...headers };
-  delete redacted[header];
+  const names = (Array.isArray(header) ? header : [header]).map(name => name.toLowerCase());
+  for (const name of Object.keys(redacted)) {
+    if (names.includes(name.toLowerCase())) delete redacted[name];
+  }
   return redacted;
 }

package/vona/src/suite-vendor/a-vona/modules/a-logger/test/middlewareSystem.httpLog.test.ts

@@ -0,0 +1,80 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { registerHooks } from 'node:module';
+import { test } from 'node:test';
+import ts from 'typescript';
+
+const middlewareUrl = new URL(
+  '../src/bean/middlewareSystem.httpLog.ts?fixture=httpLog',
+  import.meta.url,
+).href;
+const hooks = registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (context.parentURL === middlewareUrl) {
+      const source = {
+        'vona': 'export class BeanBase {}',
+        'vona-module-a-aspect': 'export function MiddlewareSystem() { return () => {}; }',
+        'pino-std-serializers':
+          'export default { req: req => ({ headers: req.headers, url: req.url }) };',
+      }[specifier];
+      if (source)
+        return { url: `data:text/javascript,${encodeURIComponent(source)}`, shortCircuit: true };
+    }
+    return nextResolve(specifier, context);
+  },
+  load(url, context, nextLoad) {
+    if (url === middlewareUrl) {
+      return {
+        format: 'module',
+        source: ts.transpileModule(readFileSync(new URL(url), 'utf8'), {
+          compilerOptions: {
+            experimentalDecorators: true,
+            target: ts.ScriptTarget.ESNext,
+            module: ts.ModuleKind.ESNext,
+          },
+        }).outputText,
+        shortCircuit: true,
+      };
+    }
+    return nextLoad(url, context);
+  },
+});
+const { MiddlewareSystemHttpLog } = await import(middlewareUrl);
+hooks.deregister();
+
+for (const path of ['/health/ready', '/health/test-stop']) {
+  test(`HTTP logger redacts request authorization and response proof at ${path} without mutating headers`, async () => {
+    const headers = {
+      'x-vona-test-challenge': 'secret-challenge',
+      'X-Vona-Test-Stop-Authorization': 'secret-authorization',
+      'x-vona-test-stop-nonce': 'secret-nonce',
+      'accept': 'application/json',
+    };
+    const responseHeaders = {
+      'x-vona-test-proof': 'secret-readiness',
+      'X-Vona-Test-Stop-Proof': 'secret-ack',
+      'content-type': 'application/json',
+    };
+    const logs: string[] = [];
+    const middleware = Object.create(MiddlewareSystemHttpLog.prototype);
+    Object.assign(middleware, {
+      app: { meta: { env: { VONA_TEST_RUN_ID: '20261014010203-a1b2c3d4' } } },
+      ctx: {
+        path,
+        req: { url: path, headers },
+        res: { statusCode: 200, getHeaders: () => responseHeaders },
+      },
+      $loggerChild: () => ({
+        http: (message: () => string) => logs.push(message()),
+        startTimer: () => ({ done: ({ message }: { message: string }) => logs.push(message) }),
+      }),
+    });
+    await middleware.execute({}, async () => {});
+    assert.equal(logs.length, 2);
+    assert.equal(logs.join('\n').includes('secret-'), false);
+    assert.match(logs[0], /application\/json/);
+    assert.match(logs[1], /application\/json/);
+    assert.equal(headers['X-Vona-Test-Stop-Authorization'], 'secret-authorization');
+    assert.equal(responseHeaders['X-Vona-Test-Stop-Proof'], 'secret-ack');
+  });
+}

package/vona/src/suite-vendor/a-vona/modules/a-metrics/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-metrics",
-  "version": "5.0.4",
+  "version": "5.0.5",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-vona/modules/a-metrics/src/bean/middlewareSystem.health.ts

@@ -4,10 +4,15 @@ import type {
   IMiddlewareSystemExecute,
 } from 'vona-module-a-aspect';
 
-import { createHmac } from 'node:crypto';
-import { BeanBase } from 'vona';
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { assertTestAppIdentity, BeanBase, closeProcessWorker } from 'vona';
 import { MiddlewareSystem } from 'vona-module-a-aspect';
 
+// An accepted shutdown consumes this app's authorization before yielding. This also
+// rejects concurrent/replayed requests across request-scoped middleware instances.
+const stoppingApps = new WeakSet<object>();
+const STOP_PATH = '/health/test-stop';
+
 export interface IMiddlewareSystemOptionsHealth extends IDecoratorMiddlewareSystemOptions {}
 
 @MiddlewareSystem<IMiddlewareSystemOptionsHealth>({
@@ -16,6 +21,10 @@ export interface IMiddlewareSystemOptionsHealth extends IDecoratorMiddlewareSyst
 export class MiddlewareSystemHealth extends BeanBase implements IMiddlewareSystemExecute {
   async execute(_options: IMiddlewareSystemOptionsHealth, next: Next) {
     const path = this.ctx.path;
+    if (path === STOP_PATH) {
+      this._testStop();
+      return;
+    }
     if (!['/health/live', '/health/ready', '/health/startup'].includes(path)) return next();
     const health = await this.$scope.metrics.service.health.status(path);
     this.ctx.status = health.code;
@@ -36,4 +45,66 @@ export class MiddlewareSystemHealth extends BeanBase implements IMiddlewareSyste
     }
     this.ctx.body = { status: health.status };
   }
+
+  private _testStop() {
+    const ctx = this.ctx;
+    // Never trust forwarded IP headers, even when the app trusts a proxy.
+    const address = ctx.req.socket.remoteAddress;
+    const env = this.app.meta.env;
+    const key = process.env.VONA_TEST_READY_KEY;
+    let runId: string | undefined;
+    try {
+      runId = assertTestAppIdentity(env.META_MODE, env.VONA_TEST_RUN_ID ?? '', this.app.name);
+    } catch {
+      // Invalid or ordinary app identities must not expose this operation.
+    }
+    if (
+      !runId ||
+      process.env.META_MODE !== 'test' ||
+      process.env.VONA_TEST_RUN_ID !== runId ||
+      this.app.config.server.workers !== 1 ||
+      !key ||
+      !/^[a-f0-9]{64}$/.test(key) ||
+      !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address ?? '')
+    ) {
+      ctx.status = 404;
+      return;
+    }
+    const nonce = ctx.get('x-vona-test-stop-nonce');
+    const authorization = ctx.get('x-vona-test-stop-authorization');
+    if (
+      ctx.method !== 'POST' ||
+      ctx.req.url !== STOP_PATH ||
+      !/^[a-f0-9]{32}$/.test(nonce) ||
+      !/^[a-f0-9]{64}$/.test(authorization)
+    ) {
+      ctx.status = 403;
+      return;
+    }
+    // Readiness signs only a hex challenge. Neither that signing oracle nor the
+    // acknowledgment domain can produce a shutdown request authorization.
+    const payload = `${runId}\nPOST\n${STOP_PATH}\n${nonce}`;
+    const expected = createHmac('sha256', key)
+      .update(`vona-test-stop-request-v1\n${payload}`)
+      .digest();
+    if (!timingSafeEqual(expected, Buffer.from(authorization, 'hex'))) {
+      ctx.status = 403;
+      return;
+    }
+    if (stoppingApps.has(this.app)) {
+      ctx.status = 409;
+      return;
+    }
+    stoppingApps.add(this.app);
+    ctx.status = 200;
+    ctx.type = 'application/json';
+    ctx.set(
+      'x-vona-test-stop-proof',
+      createHmac('sha256', key).update(`vona-test-stop-ack-v1\n${payload}`).digest('hex'),
+    );
+    ctx.body = { status: 'stopping' };
+    // closeApp may close this listener, so flush the authenticated acknowledgment
+    // first. A disconnected response is not permission to start closing.
+    ctx.res.once('finish', () => void closeProcessWorker());
+  }
 }

package/vona/src/suite-vendor/a-vona/modules/a-metrics/test/middlewareSystem.health.test.ts

@@ -0,0 +1,309 @@
+import assert from 'node:assert/strict';
+import { createHmac } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import { readFileSync } from 'node:fs';
+import { registerHooks } from 'node:module';
+import { describe, test } from 'node:test';
+import ts from 'typescript';
+
+const healthUrl = new URL('../src/bean/middlewareSystem.health.ts?fixture=health', import.meta.url)
+  .href;
+const identityUrl = new URL(
+  '../../../../../../packages-vona/vona-core/src/lib/core/testIsolation.ts',
+  import.meta.url,
+).href;
+let closes = 0;
+const closeKey = Symbol.for('vona.health.test.close');
+(globalThis as Record<symbol, unknown>)[closeKey] = () => closes++;
+const hooks = registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (context.parentURL === healthUrl) {
+      const source = {
+        'vona': `export class BeanBase {} export { assertTestAppIdentity } from ${JSON.stringify(identityUrl)}; export function closeProcessWorker() { globalThis[Symbol.for('vona.health.test.close')](); }`,
+        'vona-module-a-aspect': 'export function MiddlewareSystem() { return () => {}; }',
+      }[specifier];
+      if (source)
+        return { url: `data:text/javascript,${encodeURIComponent(source)}`, shortCircuit: true };
+    }
+    return nextResolve(specifier, context);
+  },
+  load(url, context, nextLoad) {
+    if (url === healthUrl) {
+      return {
+        format: 'module',
+        source: ts.transpileModule(readFileSync(new URL(url), 'utf8'), {
+          compilerOptions: {
+            experimentalDecorators: true,
+            target: ts.ScriptTarget.ESNext,
+            module: ts.ModuleKind.ESNext,
+          },
+        }).outputText,
+        shortCircuit: true,
+      };
+    }
+    return nextLoad(url, context);
+  },
+});
+const { MiddlewareSystemHealth } = await import(healthUrl);
+hooks.deregister();
+
+const runId = '20261014010203-a1b2c3d4';
+const key = 'a'.repeat(64);
+const nonce = 'b'.repeat(32);
+const payload = `${runId}\nPOST\n/health/test-stop\n${nonce}`;
+const sign = (value: string) => createHmac('sha256', key).update(value).digest('hex');
+
+function fixture() {
+  const req = { socket: { remoteAddress: '127.0.0.1' }, url: '/health/test-stop' };
+  const headers: Record<string, string> = {
+    'x-vona-test-stop-nonce': nonce,
+    'x-vona-test-stop-authorization': sign(`vona-test-stop-request-v1\n${payload}`),
+  };
+  const responseHeaders: Record<string, string> = {};
+  const ctx = {
+    path: '/health/test-stop',
+    method: 'POST',
+    req,
+    res: new EventEmitter(),
+    status: 0,
+    type: '',
+    body: undefined as unknown,
+    get: (name: string) => headers[name] ?? '',
+    set: (name: string, value: string) => (responseHeaders[name] = value),
+  };
+  const app = {
+    name: `cabtest${runId}`,
+    meta: { env: { META_MODE: 'test', VONA_TEST_RUN_ID: runId } },
+    config: { server: { workers: 1 } },
+  };
+  let nexts = 0;
+  const healthCalls: string[] = [];
+  const middleware = Object.create(MiddlewareSystemHealth.prototype);
+  Object.assign(middleware, {
+    app,
+    ctx,
+    $scope: {
+      metrics: {
+        service: {
+          health: {
+            async status(path: string) {
+              healthCalls.push(path);
+              return { code: 200, status: 'ok' };
+            },
+          },
+        },
+      },
+    },
+  });
+  return {
+    app,
+    ctx,
+    headers,
+    responseHeaders,
+    healthCalls,
+    execute: () =>
+      middleware.execute({}, async () => {
+        nexts++;
+      }),
+    nexts: () => nexts,
+  };
+}
+
+function withServerEnv(callback: () => Promise<void>) {
+  const names = ['META_MODE', 'VONA_TEST_RUN_ID', 'VONA_TEST_READY_KEY'] as const;
+  const old = names.map(name => process.env[name]);
+  process.env.META_MODE = 'test';
+  process.env.VONA_TEST_RUN_ID = runId;
+  process.env.VONA_TEST_READY_KEY = key;
+  return callback().finally(() => {
+    for (const [index, name] of names.entries()) {
+      if (old[index] === undefined) delete process.env[name];
+      else process.env[name] = old[index];
+    }
+  });
+}
+
+describe('authenticated managed shutdown', { concurrency: false }, () => {
+  test('shutdown acknowledges its distinct domain before close and rejects replay across middleware instances', async () => {
+    await withServerEnv(async () => {
+      const f = fixture();
+      const before = closes;
+      await f.execute();
+      assert.equal(f.ctx.status, 200);
+      assert.deepEqual(f.ctx.body, { status: 'stopping' });
+      assert.equal(
+        f.responseHeaders['x-vona-test-stop-proof'],
+        sign(`vona-test-stop-ack-v1\n${payload}`),
+      );
+      assert.equal(closes, before);
+      const replay = fixture();
+      replay.app = f.app;
+      // A separate request-scoped middleware with the same application must reject.
+      const middleware = Object.create(MiddlewareSystemHealth.prototype);
+      Object.assign(middleware, { app: f.app, ctx: replay.ctx });
+      await middleware.execute({}, async () => assert.fail('not next'));
+      assert.equal(replay.ctx.status, 409);
+      f.ctx.res.emit('finish');
+      f.ctx.res.emit('finish');
+      assert.equal(closes, before + 1);
+      assert.deepEqual(f.healthCalls, []);
+    });
+  });
+
+  const invalidCases: [string, (f: ReturnType<typeof fixture>) => void, number][] = [
+    [
+      'ordinary mode',
+      f => {
+        f.app.meta.env.META_MODE = 'dev';
+      },
+      404,
+    ],
+    [
+      'missing identity',
+      f => {
+        f.app.meta.env.VONA_TEST_RUN_ID = '';
+      },
+      404,
+    ],
+    [
+      'invalid date',
+      f => {
+        f.app.meta.env.VONA_TEST_RUN_ID = '20269999010203-a1b2c3d4';
+      },
+      404,
+    ],
+    [
+      'wrong app identity',
+      f => {
+        f.app.name = 'ordinary-app';
+      },
+      404,
+    ],
+    [
+      'multiple workers',
+      f => {
+        f.app.config.server.workers = 2;
+      },
+      404,
+    ],
+    [
+      'non-loopback socket ignoring forwarded IP',
+      f => {
+        f.ctx.req.socket.remoteAddress = '192.0.2.1';
+        f.headers['x-forwarded-for'] = '127.0.0.1';
+      },
+      404,
+    ],
+    [
+      'wrong method',
+      f => {
+        f.ctx.method = 'GET';
+      },
+      403,
+    ],
+    [
+      'query path',
+      f => {
+        f.ctx.req.url += '?ignored=yes';
+      },
+      403,
+    ],
+    [
+      'missing nonce',
+      f => {
+        delete f.headers['x-vona-test-stop-nonce'];
+      },
+      403,
+    ],
+    [
+      'malformed authorization',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = 'short';
+      },
+      403,
+    ],
+    [
+      'bad signature',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = 'f'.repeat(64);
+      },
+      403,
+    ],
+    [
+      'readiness signature cannot stop',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = sign(nonce);
+      },
+      403,
+    ],
+    [
+      'ack signature cannot stop',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = sign(`vona-test-stop-ack-v1\n${payload}`);
+      },
+      403,
+    ],
+    [
+      'wrong run signature',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = sign(
+          `vona-test-stop-request-v1\n${payload.replace(runId, '20261014010203-d4e5f6a7')}`,
+        );
+      },
+      403,
+    ],
+    [
+      'different nonce',
+      f => {
+        f.headers['x-vona-test-stop-nonce'] = 'c'.repeat(32);
+      },
+      403,
+    ],
+  ];
+  for (const [name, change, status] of invalidCases) {
+    test(`shutdown rejects ${name} without initiating close`, async () => {
+      await withServerEnv(async () => {
+        const f = fixture();
+        const before = closes;
+        change(f);
+        await f.execute();
+        assert.equal(f.ctx.status, status);
+        assert.equal(f.ctx.res.listenerCount('finish'), 0);
+        f.ctx.res.emit('finish');
+        assert.equal(closes, before);
+        assert.deepEqual(f.responseHeaders, {});
+      });
+    });
+  }
+
+  for (const [name, value] of [
+    ['META_MODE', 'dev'],
+    ['VONA_TEST_RUN_ID', '20261014010203-d4e5f6a7'],
+    ['VONA_TEST_READY_KEY', 'not-a-key'],
+  ] as const) {
+    test(`shutdown requires matching server-only ${name}`, async () => {
+      await withServerEnv(async () => {
+        const f = fixture();
+        process.env[name] = value;
+        await f.execute();
+        assert.equal(f.ctx.status, 404);
+        assert.equal(f.ctx.res.listenerCount('finish'), 0);
+      });
+    });
+  }
+
+  test('existing readiness signing and unrelated health routes remain unchanged', async () => {
+    await withServerEnv(async () => {
+      const f = fixture();
+      f.ctx.path = '/health/ready';
+      f.headers['x-vona-test-challenge'] = nonce;
+      await f.execute();
+      assert.equal(f.responseHeaders['x-vona-test-proof'], sign(nonce));
+      assert.deepEqual(f.healthCalls, ['/health/ready']);
+      assert.equal(f.ctx.res.listenerCount('finish'), 0);
+      f.ctx.path = '/unrelated';
+      await f.execute();
+      assert.equal(f.nexts(), 1);
+    });
+  });
+});

package/vona/src/suite-vendor/a-vona/modules/a-orm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-orm",
-  "version": "5.1.34",
+  "version": "5.1.35",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "db",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-orm/src/service/transactionAsyncLocalStorage_.ts

@@ -18,9 +18,9 @@ export class ServiceTransactionAsyncLocalStorage extends BeanBase {
     return this.transactionStorage.getStore()!;
   }
 
-  async run<RESULT>(fn: FunctionAsync<RESULT>): Promise<RESULT> {
-    // only once
-    if (this.transactionState) {
+  async run<RESULT>(fn: FunctionAsync<RESULT>, isolate = false): Promise<RESULT> {
+    // Delegated calls and datasource switches share state; independent contexts do not.
+    if (!isolate && this.transactionState) {
       return fn();
     }
     const transactionState = this.bean._newBean(ServiceTransactionState);

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.27",
+  "version": "5.1.28",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-static/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-static",
-  "version": "5.1.15",
+  "version": "5.1.16",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-static/src/bean/middlewareSystem.static.ts

@@ -161,7 +161,7 @@ async function _getFullPathInner(
 ): Promise<string | undefined> {
   // trim prefix
   if (options.apiStaticPrefix !== '/') {
-    const filePrefix = path.normalize(options.apiStaticPrefix.replace(/^\//, ''));
+    const filePrefix = path.posix.normalize(options.apiStaticPrefix.replace(/^\//, ''));
     if (filename.indexOf(filePrefix) !== 0) {
       return;
       // cannot throw error
@@ -170,7 +170,7 @@ async function _getFullPathInner(
     filename = filename.slice(filePrefix.length);
   }
   // check
-  const parts = filename.split(path.sep);
+  const parts = filename.split('/');
   const wordFirst = parts.shift();
   // public
   if (wordFirst === 'public') {