create-safest-tools 0.6.0 → 0.7.0

package/template/src/report-turnstile.ts

@@ -1,5 +1,5 @@
 import { sha256 } from "./report-crypto";
-import { ApiError } from "./report-http";
+import { ApiError, readBoundedBytes } from "./report-http";
 
 const SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
 const TEST_SITE_KEY = "1x00000000000000000000AA";
@@ -44,8 +44,12 @@ async function boundedJson(response: Response): Promise<Record<string, unknown>
     await response.body?.cancel().catch(() => {});
     return null;
   }
-  const bytes = new Uint8Array(await response.arrayBuffer());
-  if (bytes.byteLength > MAX_RESPONSE_BYTES) return null;
+  let bytes: Uint8Array;
+  try {
+    bytes = await readBoundedBytes(response.body, MAX_RESPONSE_BYTES, () => new Error("turnstile_response_too_large"));
+  } catch {
+    return null;
+  }
   try {
     const value: unknown = JSON.parse(new TextDecoder().decode(bytes));
     return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : null;

package/template/src/report-types.ts

@@ -199,6 +199,7 @@ export interface DeliveryJob {
 }
 
 export interface InboxReport {
+  assignment: InboxReport["claim"];
   id: string;
   reference: string;
   state: ReportState;