cursedbelt-core 2.13.1 → 2.13.2

package/dist/ctgrClient/convertRequest.js

@@ -33,7 +33,7 @@ export async function convertIfOnlyGETRequests(url, init = { method: 'GET' }, fo
     if (!METHOD_TO_ABBREV[upper]) {
         throw new Error(`ctgr: "${method}" is not a tunnelable method`);
     }
-    const body = form ? await formDataToBody(form) : bodyFromInit(init.body);
+    const body = form ? await formDataToBody(form) : bodyFromInit(init.body, upper, url);
     const getInit = toGetInit(init);
     const { chunks } = await encodeRequest(upper, url, body);
     return { requests: chunks.map((chunk) => ({ url: chunk.url, init: getInit })) };
@@ -62,10 +62,26 @@ async function formDataToBody(formData) {
     }
     return { __files: files, ...fields };
 }
-/** The request body as a JS value: a JSON string is parsed; anything else passes through. */
-function bodyFromInit(body) {
-    if (typeof body !== 'string')
-        return body ?? undefined;
+/**
+ * The request body as a JS value: a JSON string is parsed, a plain string rides as itself.
+ *
+ * 🔴 Anything else is REFUSED. The tunnel carries a JSON value or a form's files; a `File`, a
+ * `Blob`, bytes, a stream or `URLSearchParams` handed through here was JSON-serialised as `{}` —
+ * desk's import preview posted a 3.4 MB workbook and the server described "a JSON file" with `{}`
+ * as its sample (forge task 3443). A loud error at the call is the bug; a silent `{}` is data loss.
+ * Send an upload as `FormData`, which is carried whole.
+ */
+function bodyFromInit(body, method, url) {
+    if (body === null || body === undefined)
+        return undefined;
+    if (typeof body !== 'string') {
+        // A plain object or array a caller cast to `BodyInit` serialises as itself — carried as before.
+        const proto = Object.getPrototypeOf(body);
+        if (Array.isArray(body) || proto === Object.prototype || proto === null)
+            return body;
+        const shape = Object.prototype.toString.call(body).slice(8, -1);
+        throw new Error(`ctgr: a ${shape} body cannot ride the GET-only tunnel (${method} ${url}) — send it as FormData or a JSON string`);
+    }
     try {
         return JSON.parse(body);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "2.13.1",
+	"version": "2.13.2",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split — isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",

package/src/ctgrClient/convertRequest.ts

@@ -57,7 +57,7 @@ export async function convertIfOnlyGETRequests(
     throw new Error(`ctgr: "${method}" is not a tunnelable method`);
   }
 
-  const body: unknown = form ? await formDataToBody(form) : bodyFromInit(init.body);
+  const body: unknown = form ? await formDataToBody(form) : bodyFromInit(init.body, upper, url);
   const getInit = toGetInit(init);
   const { chunks } = await encodeRequest(upper, url, body);
   return { requests: chunks.map((chunk) => ({ url: chunk.url, init: getInit })) };
@@ -89,9 +89,26 @@ async function formDataToBody(formData: FormData): Promise<Record<string, unknow
   return { __files: files, ...fields };
 }
 
-/** The request body as a JS value: a JSON string is parsed; anything else passes through. */
-function bodyFromInit(body: BodyInit | null | undefined): unknown {
-  if (typeof body !== 'string') return body ?? undefined;
+/**
+ * The request body as a JS value: a JSON string is parsed, a plain string rides as itself.
+ *
+ * 🔴 Anything else is REFUSED. The tunnel carries a JSON value or a form's files; a `File`, a
+ * `Blob`, bytes, a stream or `URLSearchParams` handed through here was JSON-serialised as `{}` —
+ * desk's import preview posted a 3.4 MB workbook and the server described "a JSON file" with `{}`
+ * as its sample (forge task 3443). A loud error at the call is the bug; a silent `{}` is data loss.
+ * Send an upload as `FormData`, which is carried whole.
+ */
+function bodyFromInit(body: BodyInit | null | undefined, method: string, url: string): unknown {
+  if (body === null || body === undefined) return undefined;
+  if (typeof body !== 'string') {
+    // A plain object or array a caller cast to `BodyInit` serialises as itself — carried as before.
+    const proto = Object.getPrototypeOf(body);
+    if (Array.isArray(body) || proto === Object.prototype || proto === null) return body;
+    const shape = Object.prototype.toString.call(body).slice(8, -1);
+    throw new Error(
+      `ctgr: a ${shape} body cannot ride the GET-only tunnel (${method} ${url}) — send it as FormData or a JSON string`,
+    );
+  }
   try {
     return JSON.parse(body);
   } catch {

package/src/ctgrClient/ctgrClient.spec.ts

@@ -132,4 +132,36 @@ describe('convertIfOnlyGETRequests', () => {
     expect(decoded.files?.[0]).toMatchObject({ originalname: 'p.bin', mimetype: 'image/png' });
     expect(decoded.body).toEqual({ name: 'pic' });
   });
+
+  // forge task 3443: desk posted a workbook as a raw `File`, and it arrived as `{}`.
+  test('mode ON: a body the tunnel cannot carry is refused, never sent as {}', async () => {
+    setCtgrMode(true);
+    const bodies: BodyInit[] = [
+      new File([new Uint8Array([0x50, 0x4b, 3, 4])], 'budget.xlsx'),
+      new Blob(['x']),
+      new Uint8Array([1, 2, 3]),
+      new Uint8Array([1, 2, 3]).buffer,
+      new URLSearchParams({ a: '1' }),
+    ];
+    for (const body of bodies) {
+      await expect(convertIfOnlyGETRequests('/api/v1/files/preview', { method: 'POST', body })).rejects.toThrow(
+        /cannot ride the GET-only tunnel \(POST \/api\/v1\/files\/preview\) — send it as FormData/,
+      );
+    }
+  });
+
+  test('mode ON: a plain object a caller cast to BodyInit still rides as JSON', async () => {
+    setCtgrMode(true);
+    const body = { name: 'Budget' } as unknown as BodyInit;
+    const { requests } = await convertIfOnlyGETRequests('/api/v1/files', { method: 'POST', body });
+    const decoded = await decodeRequest(new URL(requests[0].url, 'http://x').searchParams);
+    if (decoded === 'partial') throw new Error('unreachable');
+    expect(decoded.body).toEqual({ name: 'Budget' });
+  });
+
+  test('mode OFF: any body passes through untouched — only the tunnel is particular', async () => {
+    const body = new Blob(['x']);
+    const { requests } = await convertIfOnlyGETRequests('/api/v1/files/preview', { method: 'POST', body });
+    expect(requests[0].init.body).toBe(body);
+  });
 });