cabloy 5.1.241 → 5.1.243

package/vona/src/suite-vendor/a-captcha/modules/a-captcha/src/bean/cacheRedis.captcha.ts

@@ -1,12 +1,209 @@
+import { createHash } from 'node:crypto';
 import { ServiceCacheRedisBase, CacheRedis } from 'vona-module-a-cache';
 
 import type { ICaptchaDataCache } from '../types/captcha.ts';
+import type { ICaptchaAuthorization } from '../types/captchaProvider.ts';
+
+import {
+  captchaCasLua,
+  captchaConsumeLua,
+  captchaFinalizeLua,
+  captchaReserveLua,
+} from '../lib/captchaLua.ts';
 
 export type TCacheRedisCaptchaKey = string;
 export type TCacheRedisCaptchaData = ICaptchaDataCache;
 
-@CacheRedis({ disableTransactionCompensate: true })
+export interface ICaptchaSnapshot {
+  raw: string;
+  data: ICaptchaDataCache;
+}
+
+@CacheRedis({ disableTransactionCompensate: true, updateAgeOnGet: false })
 export class CacheRedisCaptcha extends ServiceCacheRedisBase<
   TCacheRedisCaptchaKey,
   TCacheRedisCaptchaData
-> {}
+> {
+  async snapshot(id: string): Promise<ICaptchaSnapshot | undefined> {
+    const { redis, keys } = this._redisKeys([id]);
+    const raw = await redis.get(keys[0]);
+    return raw ? { raw, data: JSON.parse(raw) } : undefined;
+  }
+
+  async createImage(id: string, data: ICaptchaDataCache, ttl: number) {
+    this._validateTtl(ttl);
+    const { redis, keys } = this._redisKeys([id]);
+    return (await redis.set(keys[0], JSON.stringify(data), 'PX', ttl, 'NX')) === 'OK';
+  }
+
+  async compareAndSet(
+    id: string,
+    snapshot: ICaptchaSnapshot,
+    data?: ICaptchaDataCache,
+    ttl?: number,
+  ) {
+    if (ttl !== undefined) this._validateTtl(ttl);
+    const result = await this._eval(
+      captchaCasLua,
+      [id],
+      [snapshot.raw, data === undefined ? '' : JSON.stringify(data), ttl ?? 0],
+    );
+    return result === 1;
+  }
+
+  boundPrefix() {
+    const instance = createHash('sha256').update(String(this.__getInstanceIdScope())).digest('hex');
+    return `{captcha:${instance}}:`;
+  }
+
+  /** Opaque, instance-local cache keys, also available for precise test cleanup. */
+  boundKeys(
+    authorization: Pick<ICaptchaAuthorization, 'scope' | 'ip' | 'recipientLimits' | 'ipLimits'>,
+  ) {
+    const prefix = this.boundPrefix();
+    return {
+      pointer: `${prefix}current:${authorization.scope}`,
+      cooldown: `${prefix}cooldown:${authorization.scope}`,
+      budgets: [
+        ...authorization.recipientLimits.map(
+          limit => `${prefix}recipient:${authorization.scope}:${limit.windowMs}`,
+        ),
+        ...authorization.ipLimits.map(limit => `${prefix}ip:${authorization.ip}:${limit.windowMs}`),
+      ],
+    };
+  }
+
+  async reserveBound(id: string, data: ICaptchaDataCache, authorization: ICaptchaAuthorization) {
+    this._validateAuthorization(authorization);
+    this._validateBoundId(id);
+    const keys = this.boundKeys(authorization);
+    const policy = {
+      ttl: authorization.ttl,
+      cooldown: authorization.cooldown,
+      budgets: [...authorization.recipientLimits, ...authorization.ipLimits],
+    };
+    const result = (await this._eval(
+      captchaReserveLua,
+      [id, keys.pointer, keys.cooldown, ...keys.budgets],
+      [id, JSON.stringify(policy), JSON.stringify(data)],
+    )) as [number, string, number, number];
+    if (result[0] === -1) throw new Error('captcha identity collision');
+    if (result[0] === 0) {
+      return { reserved: false as const, retryAt: result[2], resendAt: result[3] };
+    }
+    if (result[0] !== 1 || !result[1]) throw new Error('invalid captcha reservation');
+    return {
+      reserved: true as const,
+      snapshot: { raw: result[1], data: JSON.parse(result[1]) as ICaptchaDataCache },
+    };
+  }
+
+  async finalizeBound(id: string, snapshot: ICaptchaSnapshot, data?: ICaptchaDataCache) {
+    this._validateBoundId(id);
+    const scope = snapshot.data.bound!.scope;
+    const pointer = `${this.boundPrefix()}current:${scope}`;
+    return (
+      (await this._eval(
+        captchaFinalizeLua,
+        [id, pointer],
+        [snapshot.raw, id, data === undefined ? '' : JSON.stringify(data)],
+      )) === 1
+    );
+  }
+
+  /** -1 asks the verifier to reread a competing wrong-attempt update. */
+  async consumeBound(id: string, snapshot: ICaptchaSnapshot, verified: boolean) {
+    this._validateBoundId(id);
+    const bound = snapshot.data.bound!;
+    const pointer = `${this.boundPrefix()}current:${bound.scope}`;
+    const next = {
+      ...snapshot.data,
+      bound: {
+        ...bound,
+        attemptsRemaining: bound.attemptsRemaining - 1,
+        version: bound.version + 1,
+      },
+    };
+    return (await this._eval(
+      captchaConsumeLua,
+      [id, pointer],
+      [snapshot.raw, id, verified ? '1' : '0', JSON.stringify(next)],
+    )) as number;
+  }
+
+  validateAuthorization(authorization: ICaptchaAuthorization) {
+    this._validateAuthorization(authorization);
+  }
+
+  private _validateAuthorization(authorization: ICaptchaAuthorization) {
+    if (!authorization || typeof authorization !== 'object')
+      throw new Error('invalid captcha authorization');
+    const { binding, scope, ip, ttl, cooldown, maxAttempts, recipientLimits, ipLimits } =
+      authorization;
+    const text = (value: unknown) =>
+      typeof value === 'string' && value.length > 0 && value.length <= 512;
+    const hash = (value: unknown) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+    if (
+      !binding ||
+      !text(binding.recipient) ||
+      !text(binding.purpose) ||
+      (binding.subject !== undefined && !text(binding.subject)) ||
+      !hash(scope) ||
+      !hash(ip)
+    ) {
+      throw new Error('invalid captcha binding');
+    }
+    this._validateTtl(ttl);
+    if (
+      !Number.isSafeInteger(cooldown) ||
+      cooldown < 0 ||
+      cooldown > Number.MAX_SAFE_INTEGER - Date.now() ||
+      maxAttempts !== 5
+    ) {
+      throw new Error('invalid captcha policy');
+    }
+    for (const limits of [recipientLimits, ipLimits]) {
+      if (!Array.isArray(limits) || limits.length === 0 || limits.length > 16)
+        throw new Error('invalid captcha limits');
+      const windows = new Set<number>();
+      for (const limit of limits) {
+        if (
+          !limit ||
+          !Number.isSafeInteger(limit.limit) ||
+          limit.limit <= 0 ||
+          windows.has(limit.windowMs)
+        ) {
+          throw new Error('invalid captcha limit');
+        }
+        this._validateTtl(limit.windowMs);
+        windows.add(limit.windowMs);
+      }
+    }
+  }
+
+  private _validateTtl(ttl: number) {
+    if (!Number.isSafeInteger(ttl) || ttl <= 0 || ttl > Number.MAX_SAFE_INTEGER - Date.now()) {
+      throw new Error('invalid captcha ttl');
+    }
+  }
+
+  private _validateBoundId(id: string) {
+    if (
+      !id.startsWith(this.boundPrefix()) ||
+      !/^[a-f0-9-]{36}$/.test(id.slice(this.boundPrefix().length))
+    ) {
+      throw new Error('invalid bound captcha identity');
+    }
+  }
+
+  private _redisKeys(ids: string[]) {
+    const redis = this.__cacheInstance;
+    if (!redis) throw new Error('captcha cache not enabled');
+    return { redis, keys: ids.map(id => this.getRedisKey(id)!) };
+  }
+
+  private async _eval(lua: string, ids: string[], args: Array<string | number>) {
+    const { redis, keys } = this._redisKeys(ids);
+    return await redis.eval(lua, keys.length, ...keys, ...args);
+  }
+}

package/vona/src/suite-vendor/a-captcha/modules/a-captcha/src/lib/captchaLua.ts

@@ -0,0 +1,90 @@
+// All keys are supplied through the existing captcha cache owner. Bound keys share
+// one instance hash tag; image transitions use their original single key.
+export const captchaCasLua = `
+local current = redis.call('GET', KEYS[1])
+if current ~= ARGV[1] then return 0 end
+if ARGV[2] == '' then
+  redis.call('DEL', KEYS[1])
+else
+  local ttl = tonumber(ARGV[3])
+  if ttl > 0 then
+    redis.call('SET', KEYS[1], ARGV[2], 'PX', ttl)
+  else
+    redis.call('SET', KEYS[1], ARGV[2], 'KEEPTTL')
+  end
+end
+return 1
+`;
+
+export const captchaReserveLua = `
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+local policy = cjson.decode(ARGV[2])
+local cooldown = tonumber(redis.call('GET', KEYS[3]) or '0')
+local retryAt = cooldown
+local counters = {}
+for i, budget in ipairs(policy.budgets) do
+  local value = tonumber(redis.call('GET', KEYS[i + 3]) or '0')
+  local deadline = (math.floor(now / budget.windowMs) + 1) * budget.windowMs
+  local remaining = redis.call('PTTL', KEYS[i + 3])
+  if remaining <= 0 then value = 0 end
+  counters[i] = { value = value, deadline = deadline }
+  if value >= budget.limit and deadline > retryAt then retryAt = deadline end
+end
+if retryAt > now then return { 0, '', retryAt, cooldown } end
+if redis.call('EXISTS', KEYS[1]) == 1 then return { -1 } end
+local data = cjson.decode(ARGV[3])
+data.bound.expiresAt = now + policy.ttl
+data.bound.resendAt = now + policy.cooldown
+local raw = cjson.encode(data)
+for i, counter in ipairs(counters) do
+  redis.call('SET', KEYS[i + 3], tostring(counter.value + 1))
+  redis.call('PEXPIREAT', KEYS[i + 3], counter.deadline)
+end
+redis.call('SET', KEYS[1], raw)
+redis.call('PEXPIREAT', KEYS[1], data.bound.expiresAt)
+redis.call('SET', KEYS[2], ARGV[1])
+redis.call('PEXPIREAT', KEYS[2], math.max(data.bound.expiresAt, data.bound.resendAt))
+if policy.cooldown > 0 then
+  redis.call('SET', KEYS[3], tostring(data.bound.resendAt))
+  redis.call('PEXPIREAT', KEYS[3], data.bound.resendAt)
+end
+return { 1, raw, data.bound.expiresAt, data.bound.resendAt }
+`;
+
+export const captchaFinalizeLua = `
+local current = redis.call('GET', KEYS[1])
+if current ~= ARGV[1] or redis.call('GET', KEYS[2]) ~= ARGV[2] then return 0 end
+local data = cjson.decode(current)
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+if data.bound.state ~= 'pending' or data.bound.expiresAt <= now then return 0 end
+if ARGV[3] == '' then
+  redis.call('DEL', KEYS[1])
+else
+  redis.call('SET', KEYS[1], ARGV[3])
+  redis.call('PEXPIREAT', KEYS[1], data.bound.expiresAt)
+end
+return 1
+`;
+
+// Verification happens in the provider. Only the caller holding this exact active
+// snapshot can commit its verdict, so success cannot race refresh or another use.
+export const captchaConsumeLua = `
+local current = redis.call('GET', KEYS[1])
+if current ~= ARGV[1] then return -1 end
+if redis.call('GET', KEYS[2]) ~= ARGV[2] then return 0 end
+local data = cjson.decode(current)
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+if data.bound.state ~= 'active' or data.bound.expiresAt <= now or data.bound.attemptsRemaining <= 0 then
+  return 0
+end
+if ARGV[3] == '1' or data.bound.attemptsRemaining == 1 then
+  redis.call('DEL', KEYS[1])
+else
+  redis.call('SET', KEYS[1], ARGV[4])
+  redis.call('PEXPIREAT', KEYS[1], data.bound.expiresAt)
+end
+return 1
+`;

package/vona/src/suite-vendor/a-captcha/modules/a-captcha/src/types/captcha.ts

@@ -1,4 +1,4 @@
-import type { ICaptchaProviderRecord } from './captchaProvider.ts';
+import type { ICaptchaBinding, ICaptchaProviderRecord } from './captchaProvider.ts';
 import type { ICaptchaSceneRecord } from './captchaScene.ts';
 import 'vona';
 
@@ -7,6 +7,16 @@ export interface ICaptchaDataCache {
   provider: keyof ICaptchaProviderRecord;
   token?: unknown;
   token2?: string;
+  revision?: string;
+  bound?: {
+    binding: ICaptchaBinding;
+    scope: string;
+    state: 'pending' | 'active';
+    expiresAt: number;
+    resendAt: number;
+    attemptsRemaining: number;
+    version: number;
+  };
 }
 
 export interface ICaptchaData {
@@ -14,6 +24,10 @@ export interface ICaptchaData {
   provider: keyof ICaptchaProviderRecord;
   token?: unknown;
   payload: unknown;
+  status?: 'accepted' | 'rejected' | 'unknown' | 'limited';
+  expiresAt?: number;
+  resendAt?: number;
+  retryAt?: number;
 }
 
 declare module 'vona' {

package/vona/src/suite-vendor/a-captcha/modules/a-captcha/src/types/captchaProvider.ts

@@ -1,10 +1,44 @@
 import type { OmitNever } from 'vona';
 import type { ServiceOnion, TypeOnionOptionsEnableSimple } from 'vona-module-a-onion';
 
+import type { ICaptchaSceneRecord } from './captchaScene.ts';
+
 export interface ICaptchaProviderRecord {}
 
+export interface ICaptchaBinding {
+  recipient: string;
+  purpose: string;
+  subject?: string;
+}
+
+export interface ICaptchaLimit {
+  limit: number;
+  windowMs: number;
+}
+
+/** Server-authorized policy, never populated from generic captcha request JSON. */
+export interface ICaptchaAuthorization {
+  binding: ICaptchaBinding;
+  scope: string;
+  ip: string;
+  ttl: number;
+  cooldown: number;
+  maxAttempts: number;
+  recipientLimits: ICaptchaLimit[];
+  ipLimits: ICaptchaLimit[];
+}
+
 export interface ICaptchaProviderExecute<TOKEN = unknown, PAYLOAD = unknown> {
-  create(options: IDecoratorCaptchaProviderOptions): Promise<ICaptchaProviderData<TOKEN, PAYLOAD>>;
+  readonly bound?: boolean;
+  authorize?(
+    context: unknown,
+    operation: 'issue' | 'consume',
+    sceneName: keyof ICaptchaSceneRecord,
+  ): ICaptchaAuthorization | undefined | Promise<ICaptchaAuthorization | undefined>;
+  create(
+    options: IDecoratorCaptchaProviderOptions,
+    context?: unknown,
+  ): Promise<ICaptchaProviderData<TOKEN, PAYLOAD>>;
   verify(
     token: TOKEN,
     tokenInput: TOKEN,
@@ -15,6 +49,9 @@ export interface ICaptchaProviderExecute<TOKEN = unknown, PAYLOAD = unknown> {
 export interface ICaptchaProviderData<TOKEN = unknown, PAYLOAD = unknown> {
   token: TOKEN;
   payload: PAYLOAD;
+  outcome?: 'accepted' | 'rejected' | 'unknown';
+  /** Bound providers alone decide whether their actual transport may expose the token. */
+  exposeToken?: boolean;
 }
 
 export interface IDecoratorCaptchaProviderOptions extends TypeOnionOptionsEnableSimple {

package/vona/src/suite-vendor/a-captcha/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-captcha",
-  "version": "5.1.19",
+  "version": "5.1.20",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.68",
+  "version": "5.1.69",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.34",
+  "version": "5.1.35",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-permission/test/permission.test.ts

@@ -1,14 +1,10 @@
-import type { VonaContext } from 'vona';
 import type { ICachingActionKeyInfo } from 'vona-module-a-caching';
 import type { IRbacPolicyDecision } from 'vona-module-a-rbac';
-import type { ContextRoute } from 'vona-module-a-web';
 
 import assert from 'node:assert';
 import { describe, it } from 'node:test';
-import { appResource, beanFullNameFromOnionName } from 'vona';
-import { app } from 'vona-mock';
+import { beanFullNameFromOnionName } from 'vona';
 import { getRbacDecision, setRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
-import { getCacheControllerRoutes, recordResourceNameToRoutePath } from 'vona-module-a-web';
 
 import { BeanPermission } from '../src/bean/bean.permission.ts';
 
@@ -55,64 +51,6 @@ function createCachePermission(clearedCacheNames: string[]) {
   return permission;
 }
 
-const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
-const GuardResource = 'test-rest:product';
-
-async function withGuardPermission(
-  guard: (ctx: VonaContext) => Promise<boolean | void>,
-  callback: (fixture: {
-    permission: BeanPermission;
-    ctx: VonaContext;
-    passport: { isAuthenticated: boolean; isAccountActive: boolean; isActivated: boolean };
-    action: IRbacPolicyDecision['action'];
-  }) => Promise<void>,
-  rbac = false,
-) {
-  await app.bean.executor.mockCtx(async () => {
-    const controller = recordResourceNameToRoutePath[GuardResource].controller;
-    const controllerBeanFullName = appResource.getBean(controller)!.beanFullName;
-    const route = {
-      controller,
-      controllerBeanFullName,
-      action: 'create',
-      route: { meta: rbac ? { [BeanFullNameGuardRbac]: {} } : {} },
-    } as ContextRoute;
-    const action: IRbacPolicyDecision['action'] = {
-      actionKey: `${controllerBeanFullName}#create`,
-      actionInheritKey: `${controllerBeanFullName}#update`,
-      controllerBeanFullName,
-      action: 'create',
-      route,
-      options: {},
-    };
-    const unexpected = () =>
-      assert.fail('guard-only checks must not use permission retrieval or scope projection');
-    const fixtureApp = {
-      meta: {},
-      bean: { onion: { guard: { compose: () => guard } } },
-    };
-    getCacheControllerRoutes(fixtureApp as never)[controllerBeanFullName] = [route];
-    const passport = { isAuthenticated: true, isAccountActive: true, isActivated: true };
-    const permission = Object.create(BeanPermission.prototype) as BeanPermission;
-    Object.defineProperties(permission, {
-      app: { value: fixtureApp },
-      ctx: { value: app.ctx },
-      bean: {
-        value: {
-          passport,
-          rbacCatalog: { getAction: () => action },
-          rbacScope: { current: unexpected },
-        },
-      },
-      scope: { value: { event: { retrievePermissionAction: { emit: unexpected } } } },
-      retrievePermissionAction: { value: unexpected },
-      retrievePermissionActionByRoles: { value: unexpected },
-      retrievePermissionActionByUser: { value: unexpected },
-    });
-    await callback({ permission, ctx: app.ctx, passport, action });
-  });
-}
-
 describe('permission.test.ts', { concurrency: false }, () => {
   it('normalizes role cache keys by role identity', () => {
     const first = createPermission({
@@ -366,159 +304,6 @@ describe('permission.test.ts', { concurrency: false }, () => {
     assert.equal(ctx.innerAccess, true);
   });
 
-  it('checks current guards without permission events, result caches, or projection', async () => {
-    let allowed = true;
-    let calls = 0;
-    await withGuardPermission(
-      async () => {
-        calls++;
-        return allowed;
-      },
-      async ({ permission }) => {
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
-        allowed = false;
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), false);
-        assert.equal(calls, 2);
-      },
-    );
-  });
-
-  it('fails closed before guards for unknown routes and Passport admission failures', async () => {
-    await withGuardPermission(
-      async () => assert.fail('guards must not run before admission'),
-      async ({ permission, passport }) => {
-        assert.equal(
-          await permission.checkPermissionActionGuards('test:missing' as never, 'create'),
-          false,
-        );
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'missing'), false);
-        passport.isAuthenticated = false;
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), false);
-      },
-    );
-  });
-
-  it('converts guard authorization errors to false and propagates unexpected errors', async () => {
-    let failure: Error;
-    await withGuardPermission(
-      async () => {
-        throw failure;
-      },
-      async ({ permission }) => {
-        for (const code of [401, 403]) {
-          failure = Object.assign(new Error('authorization failure'), { code });
-          assert.equal(
-            await permission.checkPermissionActionGuards(GuardResource, 'create'),
-            false,
-          );
-        }
-        failure = new Error('unexpected guard failure');
-        await assert.rejects(
-          () => permission.checkPermissionActionGuards(GuardResource, 'create'),
-          failure,
-        );
-      },
-    );
-  });
-
-  it('requires a fresh allowed RBAC decision matching the full catalog action identity', async () => {
-    let decision: IRbacPolicyDecision | undefined;
-    await withGuardPermission(
-      async ctx => {
-        assert.equal(getRbacDecision(ctx), undefined);
-        if (decision) setRbacDecision(ctx, decision);
-        return true;
-      },
-      async ({ permission, ctx, action }) => {
-        const valid: IRbacPolicyDecision = {
-          allowed: true,
-          actionKey: action.actionKey,
-          action: { ...action },
-          terms: [{ dataScope: 'all' }],
-        };
-        setRbacDecision(ctx, valid);
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), false);
-        assert.equal(getRbacDecision(ctx), valid);
-        for (const invalid of [
-          { ...valid, allowed: false },
-          { ...valid, actionKey: 'other#action' },
-          ...[
-            { actionKey: 'other#action' },
-            { actionInheritKey: undefined },
-            { controllerBeanFullName: 'other.controller' },
-            { action: 'other' },
-          ].map(mismatch => ({ ...valid, action: { ...action, ...mismatch } })),
-        ]) {
-          decision = invalid;
-          assert.equal(
-            await permission.checkPermissionActionGuards(GuardResource, 'create'),
-            false,
-          );
-          assert.equal(getRbacDecision(ctx), valid);
-        }
-        decision = valid;
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
-        assert.equal(getRbacDecision(ctx), valid);
-        delete ctx[SymbolRbacDecision];
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
-        assert.equal(Object.hasOwn(ctx, SymbolRbacDecision), false);
-      },
-      true,
-    );
-  });
-
-  it('restores property descriptors and inherited innerAccess after success and failure', async () => {
-    let failure: Error | undefined;
-    await withGuardPermission(
-      async ctx => {
-        assert.equal(ctx.route.action, 'create');
-        assert.equal(ctx.innerAccess, false);
-        assert.equal(getRbacDecision(ctx), undefined);
-        if (failure) throw failure;
-        return true;
-      },
-      async ({ permission, ctx, action }) => {
-        assert.equal(Object.hasOwn(ctx, 'innerAccess'), false);
-        ctx.innerAccess = true;
-        Object.defineProperty(ctx, 'route', {
-          value: { action: 'previous' },
-          writable: true,
-          configurable: true,
-          enumerable: false,
-        });
-        Object.defineProperty(ctx, SymbolRbacDecision, {
-          value: {
-            allowed: true,
-            actionKey: action.actionKey,
-            action,
-            terms: [{ dataScope: 'all' }],
-          },
-          writable: true,
-          configurable: true,
-          enumerable: false,
-        });
-        const descriptors = Object.getOwnPropertyDescriptors(ctx);
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
-        assert.deepEqual(Object.getOwnPropertyDescriptors(ctx), descriptors);
-        assert.equal(ctx.innerAccess, true);
-        failure = new Error('guard failure');
-        await assert.rejects(
-          () => permission.checkPermissionActionGuards(GuardResource, 'create'),
-          failure,
-        );
-        assert.deepEqual(Object.getOwnPropertyDescriptors(ctx), descriptors);
-        assert.equal(ctx.innerAccess, true);
-
-        delete (ctx as any).route;
-        delete ctx[SymbolRbacDecision];
-        const absentDescriptors = Object.getOwnPropertyDescriptors(ctx);
-        failure = undefined;
-        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
-        assert.deepEqual(Object.getOwnPropertyDescriptors(ctx), absentDescriptors);
-      },
-    );
-  });
-
   it('reduces an RBAC action projection to its final boolean result', async () => {
     const allowed = createPermission({});
     const denied = createPermission({});

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ratelimit",
-  "version": "5.1.4",
+  "version": "5.1.5",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.111",
+  "version": "5.1.113",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",