caracms 0.7.0 → 0.8.1

package/src/live/sweep.ts

@@ -25,6 +25,10 @@
  *   → `ancestorFor`), a "gone" one as a removed file (git.ts → `commitDrafts`). A newer
  *   write that came in while a new document was being committed is no longer a new
  *   document: its `created` mark is dropped (retried if a write beats the swap), so its ancestor is that commit.
+ * - **`exclusively`** runs other work under the sweep's own locks (this process's queue and
+ *   the Redis lock): Discard changes, so no tick commits the edit being thrown away while
+ *   it's being thrown away. It waits a few seconds for another server's tick, then gives
+ *   up (`SweepBusyError`) rather than go ahead without the lock.
  */
 import { randomBytes } from 'node:crypto';
 import type { DraftEntry, LiveGit } from './git.ts';
@@ -64,6 +68,14 @@ export interface SweepResult {
 
 type Select = 'ready' | 'all' | { files: string[] };
 
+/** `exclusively` couldn't get the sweep's Redis lock: another server's tick held it throughout. */
+export class SweepBusyError extends Error {
+	constructor() {
+		super('the sweep is busy on another server');
+		this.name = 'SweepBusyError';
+	}
+}
+
 /** Is an autosave ready for a tick: marked to go at once, idle long enough, or past the cap? */
 export function ready(a: Autosave, now: number, timings: Pick<LiveTimings, 'sweepIdleMs' | 'sweepCapMs'>): boolean {
 	return a.sweepAtOnce === true || now - a.updatedAt >= timings.sweepIdleMs || now - a.firstAt >= timings.sweepCapMs;
@@ -90,11 +102,16 @@ export class Sweep {
 		this.lockKey = `${options.prefix ?? 'caracms:'}sweep:lock`;
 	}
 
-	/** The startup check: anything a previous server left behind starts the ticking. */
+	/**
+	 * The startup check: anything a previous server left behind starts the ticking. An
+	 * autosave that still carries the week's expiry older versions gave it loses it
+	 * (caracms-cloud adversarial review, finding 4: an uncommitted edit never expires).
+	 */
 	async start(): Promise<void> {
 		const pending = await this.o.autosaves.all();
 		if (pending.length) {
 			this.log(`sweep: ${pending.length} autosave(s) waiting from before this server started`);
+			for (const a of pending) await this.o.autosaves.keepForever(a);
 			this.poke();
 		}
 	}
@@ -151,6 +168,32 @@ export class Sweep {
 		return (await this.run({ files })).result;
 	}
 
+	/**
+	 * Run `fn` holding the sweep's locks: after any run of this process's in flight, and with
+	 * the Redis lock (waiting up to about 5 s for another server's tick, else SweepBusyError).
+	 */
+	exclusively<T>(fn: () => Promise<T>): Promise<T> {
+		const work = async (): Promise<T> => {
+			const { redis, timings } = this.o;
+			const token = randomBytes(9).toString('base64url');
+			const lockMs = Math.max(30_000, timings.sweepTickMs);
+			let locked = await redis.set(this.lockKey, token, { nx: true, px: lockMs });
+			for (let i = 0; i < 20 && !locked; i++) {
+				await this.sleep(250);
+				locked = await redis.set(this.lockKey, token, { nx: true, px: lockMs });
+			}
+			if (!locked) throw new SweepBusyError();
+			try {
+				return await fn();
+			} finally {
+				await redis.compareAndDelete(this.lockKey, token).catch(() => false);
+			}
+		};
+		const next = this.running.then(work, work);
+		this.running = next.catch(() => {});
+		return next;
+	}
+
 	/** Runs one at a time in this process; the Redis lock keeps two servers apart. */
 	private run(select: Select): Promise<{ result: SweepResult; left: boolean }> {
 		const next = this.running.then(

package/src/live/webhook.ts

@@ -8,8 +8,11 @@
  *   compared in constant time, or it's 401 and nothing happens.
  * - **Nothing in the body is trusted or even read**: a good signature only prompts
  *   Decision 8's check, which asks GitHub itself what moved.
+ * - **At most 25 MB is read**, counted as it comes (body.ts): a chunked body with no
+ *   `Content-Length`, or one that lies, is refused at the cap, not after (finding 10).
  */
 import { createHmac, timingSafeEqual } from 'node:crypto';
+import { readCapped } from '../body.ts';
 
 /** Largest body read. GitHub caps payloads at 25 MB; a push is far smaller, and it's never parsed. */
 const MAX_BODY_BYTES = 25 * 1024 * 1024;
@@ -30,9 +33,11 @@ const text = (status: number, body: string) => new Response(body, { status, head
 export async function handleGithubWebhook(request: Request, options: { secret: string | null; trigger: () => Promise<unknown> }): Promise<Response> {
 	if (!options.secret) return text(404, 'Not found');
 	if (request.method !== 'POST') return new Response('The webhook only takes POST.', { status: 405, headers: { Allow: 'POST' } });
-	if (Number(request.headers.get('content-length') ?? 0) > MAX_BODY_BYTES) return text(413, 'Too large.');
-	const body = Buffer.from(await request.arrayBuffer());
-	if (body.length > MAX_BODY_BYTES) return text(413, 'Too large.');
+	// caracms-cloud adversarial review, finding 10: the bytes are counted as they're read and the read
+	// stops at the cap, with or without a Content-Length, before the signature is checked.
+	const read = await readCapped(request, MAX_BODY_BYTES);
+	if (!read.ok) return text(413, 'Too large.');
+	const body = Buffer.from(read.bytes.buffer, read.bytes.byteOffset, read.bytes.byteLength);
 	if (!signatureMatches(options.secret, body, request.headers.get('x-hub-signature-256'))) return text(401, 'Bad signature.');
 	void options.trigger().catch((error: unknown) => console.error('[caracms] the check after a webhook failed:', error));
 	return text(202, 'Checking.');

package/src/media.ts

@@ -35,6 +35,7 @@ import { createHmac } from 'node:crypto';
 import type { ImageFormat } from './fields.ts';
 import { CLOUD_NO_MEDIA, heldCloudSettings, type CloudConnection } from './live/cloud.ts';
 import { CLOUD_AND_MEDIA_PROBLEM, OWN_MEDIA_VARIABLES, readCloudUrl } from './live/mode.ts';
+import { bakedServices, CLOUD_KEY_MISSING_PROBLEM, servicesEnv, type Services } from './live/services.ts';
 import { renderMedia, type RenderImage } from './media-value.ts';
 
 /** The srcset width ladder every fluid image draws from (Decision 2). 1920 at the top: imgproxy doesn't upscale. */
@@ -92,8 +93,10 @@ export const CLOUD_MEDIA_UNREACHABLE = "CaraCMS Cloud couldn't be reached, so im
  * The cloud as the media credential: the connection when `CARACMS_CLOUD_KEY` is set and
  * `CARACMS_MEDIA` isn't `memory` (which wins over everything), with any problems (the
  * site's own media variables beside it, a bad `CARACMS_CLOUD_URL`). Null: not a cloud site's media.
+ * With the config's `services` (caracms-cloud M5), the other mode's variables aren't read.
  */
-export function cloudMedia(env: Env = process.env): { connection: Pick<CloudConnection, 'key' | 'url'>; problems: string[] } | null {
+export function cloudMedia(env: Env = process.env, services: Services | null = bakedServices()): { connection: Pick<CloudConnection, 'key' | 'url'>; problems: string[] } | null {
+	env = servicesEnv(env, services);
 	const get = (name: string) => env[name]?.trim() || null;
 	const key = get('CARACMS_CLOUD_KEY');
 	if (!key || get('CARACMS_MEDIA') === 'memory') return null;
@@ -117,7 +120,8 @@ function cloudMediaConfig(cloud: NonNullable<ReturnType<typeof cloudMedia>>, pro
 }
 
 /** The media variables (Decision 5). Read on each call (cheap), so tests can change them. */
-export function readMediaConfig(env: Env = process.env, production = isProductionBuild()): MediaConfig {
+export function readMediaConfig(env: Env = process.env, production = isProductionBuild(), services: Services | null = bakedServices()): MediaConfig {
+	env = servicesEnv(env, services);
 	const get = (name: string) => {
 		const v = env[name]?.trim();
 		return v ? v : null;
@@ -129,7 +133,9 @@ export function readMediaConfig(env: Env = process.env, production = isProductio
 		return { kind: 'ready', settings: { ...MEMORY_MEDIA, memory: true } };
 	}
 	if (mode) problems.push(`CARACMS_MEDIA must be "memory" or unset (got "${mode}").`);
-	const cloud = cloudMedia(env);
+	// M5 Decision 4: a cloud site without its key has no media, never the site's own instead.
+	if (services === 'cloud' && !get('CARACMS_CLOUD_KEY')) return { kind: 'unset', missing: [], problems: [...problems, CLOUD_KEY_MISSING_PROBLEM] };
+	const cloud = cloudMedia(env, services);
 	if (cloud) return cloudMediaConfig(cloud, problems);
 	const missing: string[] = [];
 	const need = (name: string) => {