fiftyone.pipeline.did 4.5.25 → 4.5.26

package/fodId.js

@@ -53,15 +53,17 @@ class FodId {
 
   /**
    * Promotes an already-parsed owid instance into a 51Did by unpacking its
-   * payload.
+   * payload. The owid is **copied** (re-parsed from its base64), not aliased,
+   * so a FodId can never desync from its envelope if the caller later mutates
+   * the owid they passed in.
    * @param {object} owidInstance an owid instance (from `new owid(base64)`)
    */
   constructor (owidInstance) {
     if (owidInstance === null || owidInstance === undefined) {
       throw new TypeError('owid must not be null or undefined');
     }
-    this._owid = owidInstance;
-    const payload = owidInstance.owid.payload;
+    this._owid = new owid(owidInstance.data);
+    const payload = this._owid.owid.payload;
     const length = payload ? payload.length : 0;
     if (!payload || length < FodId.HEADER_LENGTH) {
       throw new RangeError(
@@ -121,10 +123,10 @@ class FodId {
   }
 
   /**
-   * Promotes an already-parsed owid instance into a 51Did. The owid is
-   * **copied** (re-parsed from its base64), not aliased, so a FodId can never
-   * desync from its envelope if the caller later mutates the owid it passed
-   * in.
+   * Promotes an already-parsed owid instance into a 51Did. The constructor
+   * **copies** the owid (re-parsed from its base64), not aliases it, so a
+   * FodId can never desync from its envelope if the caller later mutates the
+   * owid it passed in.
    * @param {object} owidInstance
    * @returns {FodId}
    */
@@ -132,7 +134,7 @@ class FodId {
     if (owidInstance === null || owidInstance === undefined) {
       throw new TypeError('owid must not be null or undefined');
     }
-    return new FodId(new owid(owidInstance.data));
+    return new FodId(owidInstance);
   }
 
   /** @returns {number} the 1-byte usage flags bit-mask (0-255). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fiftyone.pipeline.did",
-  "version": "4.5.25",
+  "version": "4.5.26",
   "description": "Strongly typed reader for the 51Did (51Degrees Identifier) value returned by the 51Degrees Cloud service. Parses the OWID envelope and exposes the Flags, License Id and value (Hash) plus the identifier type. Compare values, never envelopes.",
   "keywords": [
     "51degrees",

package/tests/fodId.test.js

@@ -354,6 +354,17 @@ describe('FodId', () => {
     expect(fod.payload[FodId.HASH_OFFSET]).toBe(0x20);
   });
 
+  test('constructor is decoupled from the source owid', () => {
+    // The constructor must copy the owid too, not just fromOwid - mutating the
+    // source afterwards must not affect the FodId.
+    const o = new owid(envelopeBase64(canonicalPayload()));
+    const fod = new FodId(o);
+    o.owid.payload = new Uint8Array(FodId.PAYLOAD_LENGTH); // mutate the source
+    expect(fod.hash).toEqual(canonicalHash());
+    expect(fod.flags).toBe(CANONICAL_FLAGS);
+    expect(fod.payload[FodId.HASH_OFFSET]).toBe(0x20);
+  });
+
   test('verify with the wrong key returns false', async () => {
     const { base64 } = await signedVerifiable(canonicalPayload());
     const otherPublicPem = await randomPublicPem();