gina 0.6.30 → 0.6.31

package/framework/{v0.6.30 → v0.6.31}/core/connectors/couchbase/lib/connector.v4.js

@@ -10,6 +10,9 @@ var lib             = gina.lib;
 var console         = lib.logger;
 var merge           = lib.merge;
 var modelUtil       = new lib.Model();
+// #B432 — per-call at-most-once settle guard for a connector outcome
+// (core/connectors/settle-once.js).
+var settleOnce      = require('./../../settle-once');
 
 
 
@@ -25,6 +28,10 @@ var modelUtil       = new lib.Model();
  *      `1m` will set the ping interval to 1 minute
  *      `1h` will set the ping interval to 1 hour
  *      `1d` will set the ping interval to 1 day
+ *  - readyTimeout (default: 50000)
+ *      milliseconds to wait for the connector to become ready at boot before
+ *      failing loudly. Values at or above the CLI's ~64s bundle-start budget
+ *      (`lib/cmd/bundle/start.js`) cannot take effect.
  *
  * @class
  * */
@@ -40,6 +47,8 @@ function Connector(dbString) {
                 collection: '_default', // by default
                 keepAlive: true,
                 pingInterval: "2m",
+                // #B541 — boot readiness deadline, in milliseconds.
+                readyTimeout: 50000,
                 // https://docs.couchbase.com/sdk-api/couchbase-node-client/interfaces/TimeoutConfig.html
                 // timeouts:  {
                 //     kvTimeout: 10000, // milliseconds
@@ -51,6 +60,38 @@ function Connector(dbString) {
         }
     ;
 
+    // #B541 — boot readiness state. `_markSettled()` records that `ready` has
+    // been settled and disarms the boot deadline armed in init(); it does NOT
+    // gate `self.emit('ready', …)`. Repeat emits are load-bearing:
+    // `core/model/index.js` attaches a persistent `.on('ready')` that surfaces
+    // reconnect churn on the Inspector event signal, and both `onReady`
+    // consumers register `once`, which already drops a late delivery.
+    var _settled        = false
+        , _deadlineId   = null
+    ;
+
+    /**
+     * Record that `ready` has been settled and disarm the boot deadline.
+     *
+     * Idempotent — a reconnect calls it again, by which point the timer is
+     * already `null`.
+     *
+     * @memberof Connector
+     * @inner
+     * @returns {void}
+     *
+     * @example
+     * _markSettled();
+     * self.emit('ready', false, self.instance);
+     */
+    var _markSettled = function() {
+        _settled = true;
+        if (_deadlineId) {
+            clearTimeout(_deadlineId);
+            _deadlineId = null;
+        }
+    };
+
     /**
      * arrayToValues
      * Eg.: array like: ['a', 0.5, 'b', false]
@@ -86,7 +127,25 @@ function Connector(dbString) {
         // Attention: the connection is lost 5 minutes once the bucket is opened.
         var conn = null, defaultCollection = null;
 
-        var onError = function (err, next) {
+        // #B541 — one outcome per connect attempt.
+        //
+        // On failure the couchbase SDK settles BOTH of its channels: it invokes
+        // the onBucketOpened callback AND rejects the awaited promise. So a
+        // single failed attempt called onError twice, arming TWO retry chains —
+        // and each of those, failing in turn, armed two more (2 -> 4 -> 8 ...) —
+        // while double-counting _reconnectAttempts, so the backoff escalated at
+        // twice the intended rate and reached its 60s cap after five real
+        // attempts instead of ten. The guard is minted PER connect() invocation,
+        // never at module scope, so a later reconnect's own attempt stays
+        // independently reportable.
+        var onError = settleOnce('couchbase-v' + sdk.version + ':connector#connect', function onErrorImpl(err, next) {
+            // The promise channel can run WITHOUT the callback channel having
+            // run first (a rejection that never calls back), and only the
+            // callback channel assigns self.instance — which is not initialised
+            // at construction. Without this guard that ordering throws here,
+            // before any retry is armed, and the throw surfaces only as an
+            // unhandled rejection of the bare self.connect(dbString) call.
+            if (!self.instance) self.instance = {};
             delete self.instance.reconnecting;
             self.instance.reconnected = self.instance.connected = false;
             console.debug('[CONNECTOR][' + local.bundle +'] Scope is: '+ process.env.NODE_SCOPE );
@@ -112,7 +171,7 @@ function Connector(dbString) {
                 }
             }, _backoffDelay)
 
-        };
+        }, console);
 
         // once
         var onConnect = function onConnect(cb){
@@ -253,6 +312,8 @@ function Connector(dbString) {
             // setTimeout(() => {
             //     self.emit('ready', false, self.instance);
             // }, 300);
+            // #B541 — disarm the boot deadline; the emit itself stays ungated.
+            _markSettled();
             self.emit('ready', false, self.instance);
 
         };
@@ -406,6 +467,40 @@ function Connector(dbString) {
             dbString        = merge(dbString, local.options);
             local.options   = dbString;
 
+            // #B541 — arm the boot readiness deadline.
+            //
+            // Every failure path in connect() routes to onError(), which only
+            // re-arms a retry — it never emits. Without this, a connector that
+            // cannot reach couchbase at boot NEVER settles: lib/model.js's
+            // all-or-nothing ready gate never closes, the bundle never prints
+            // the flags bundle:start watches for, and the CLI SIGKILLs it at
+            // ~64s (lib/cmd/bundle/start.js: maxRetry 15 x maxTimeout 4000ms)
+            // with no terminal error logged anywhere.
+            //
+            // lib/model.js's onModelReady ALREADY handles an error correctly —
+            // console.error + process.exit(1) — and that is how every other
+            // connector reports a dead database. It was simply unreachable
+            // here. So if nothing has settled by the deadline, emit the error
+            // ourselves and let that existing path run.
+            //
+            // NOT a retry cap: onError's uncapped reconnect is untouched, so a
+            // connector that HAS settled still recovers from a later blip.
+            // Deliberately NOT unref'd — were this the only handle holding the
+            // event loop, unref would let node exit 0 silently instead of
+            // reporting, and onError's retry timer already holds the loop.
+            var _readyTimeout = ( typeof(local.options.readyTimeout) == 'number' && local.options.readyTimeout > 0 )
+                ? local.options.readyTimeout
+                : 50000;
+
+            if ( !_settled && !_deadlineId ) {
+                _deadlineId = setTimeout(function onReadyDeadline() {
+                    _deadlineId = null;
+                    if (_settled) return;
+
+                    _markSettled();
+                    self.emit('ready', new Error('[CONNECTOR][' + local.bundle +'][' + dbString.connector +'][' + dbString.database +'] Couchbase did not become ready within '+ (_readyTimeout/1000) +'s @`'+ dbString.protocol + dbString.host +'`\nCheck:\n - if couchbase is running and reachable from this host\n - if bucket `'+ dbString.database +'` exists\n - if the credentials are valid\nRaise `readyTimeout` on this connector entry to wait longer; it must stay under the ~64s bundle-start budget to take effect.'), null);
+                }, _readyTimeout);
+            }
 
             console.info('[CONNECTOR][' + local.bundle +'][' + dbString.connector +'][' + dbString.database +'] authenticating to couchbase cluster @'+ dbString.protocol + dbString.host);
 
@@ -424,6 +519,8 @@ function Connector(dbString) {
 
         } catch (err) {
             console.error(err.stack);
+            // #B541 — a synchronous throw already settles; disarm the deadline.
+            _markSettled();
             self.emit('ready', err, null)
         }
     }

package/framework/{v0.6.30 → v0.6.31}/core/controller/controller.js

@@ -17,6 +17,33 @@ var crypto          = require('crypto'); // #ERRREF incident-ref mint
 var promisify       = util.promisify;
 var EventEmitter    = require('events').EventEmitter;
 
+/**
+ * Own-property count, reached WITHOUT the shadowable `<container>.count()` lookup (#B546).
+ *
+ * gina installs a `count()` helper on `Object.prototype` (`utils/prototypes.js`), so the
+ * shorthand is an ordinary property lookup that an OWN property of the same name shadows.
+ * Every container counted through this function is keyed by the CLIENT — a request body, a
+ * query bag, route params, uploaded files, caller-supplied query data — so one field named
+ * `count` made the framework call a string instead of the helper: a 500 on the guarded body
+ * branches, and an uncaughtException that exited the process on the unguarded query ones.
+ *
+ * `ownCount()` reaches the helper itself, which no own property can
+ * shadow, and is the same function body, so every receiver shape counts exactly as before.
+ * The null/undefined branch is deliberate rather than defensive: `.call(null)` would bind
+ * `this` to the global object and return ITS key count, while the shorthand threw — and the
+ * empty-object seeding in the body-parse branches is built on that throw.
+ *
+ * @param   {*} container - Any value the shorthand would have been called on.
+ * @returns {number} Own enumerable property count.
+ * @inner
+ */
+function ownCount(container) {
+    if (container === null || typeof container === 'undefined') {
+        return container.count(); // preserve the exact TypeError the shorthand raised
+    }
+    return Object.prototype.count.call(container);
+}
+
 const { Resolver } = require('node:dns').promises;
 
 var lib             = require('./../../lib') || require.cache[require.resolve('./../../lib')];
@@ -1353,7 +1380,15 @@ function SuperController(options) {
             delete parameters.control;
             delete parameters.title;
 
-            if (parameters.count() > 0)
+            // #B546 — own-property counts in this file go through `Object.prototype.count`
+            // rather than `<container>.count()`. The helper gina installs on
+            // `Object.prototype` is reached by a normal property lookup, which an OWN
+            // property of the same name shadows; the containers counted here descend from
+            // `req.params` / `req[method]` / `req.files` / caller-supplied query data, whose
+            // keys the client chooses. A field named `count` therefore made the framework
+            // call a string. `.call()` is the same function body reached without the
+            // shadowable lookup, so no other receiver shape changes.
+            if (ownCount(parameters) > 0)
                 set('page.view.params', parameters); // view parameters passed through URI or route params
 
             set('page.view.route', rule);
@@ -2502,6 +2537,49 @@ function SuperController(options) {
 
 
 
+    /**
+     * Emit an RFC 9218 `Priority` RESPONSE header (#H12).
+     *
+     * An origin uses the response header to state its own view of how the
+     * response should be prioritized (RFC 9218 §5); an intermediary that
+     * honours it merges it with the client's request header (§8). An explicit
+     * `urgency` is always emitted — including `3` — because only an explicit
+     * member overrides the client's value; `incremental` is emitted as `i` when
+     * true. Browsers do not act on a response `Priority`, and the framework
+     * cannot reorder its own writes (no Node API for it): this is signalling
+     * for the path between origin and client, never a scheduling promise.
+     *
+     * Silently no-ops when there is nothing to say, when the response has been
+     * released (#B31) or when headers were already sent. Returns `self` for
+     * chaining.
+     *
+     * @param   {{urgency?: number, incremental?: boolean}} spec
+     * @returns {object} self
+     *
+     * @example
+     *   this.export = function(req, res, next) {
+     *       // a long background export may yield to the page's other fetches
+     *       self.setPriority({ urgency: 6, incremental: true });
+     *       self.renderStream(source);
+     *   };
+     */
+    this.setPriority = function(spec) {
+        var _value = lib.priority.serialize(spec);
+        if ( !_value ) return self;
+
+        var _res = local.res;
+        if ( !_res || typeof(_res.setHeader) != 'function' ) return self;
+        if ( headersSent(_res) ) return self;
+
+        try {
+            _res.setHeader('priority', _value);
+        } catch(e) {
+            // best-effort — a header that cannot be set must never affect the response
+        }
+        return self;
+    };
+
+
     /**
      * Send a 103 Early Hints informational response (#EH1).
      *
@@ -3504,7 +3582,8 @@ function SuperController(options) {
                 if ( typeof(requestParams.session) != 'undefined' ) {
                     delete requestParams.session;
                 }
-                if ( typeof(requestParams) != 'undefined' && requestParams.count() > 0 ) {
+                // #B546 — shadow-proof own-property count; see the note in setOptions().
+                if ( typeof(requestParams) != 'undefined' && ownCount(requestParams) > 0 ) {
                     //if ( typeof(requestParams.error) != 'undefined' )
 
                     // #B75 — a session-less bundle (no Session plugin mounted) must
@@ -3544,7 +3623,7 @@ function SuperController(options) {
                         } else {
                             redirectObj.location = path;
                         }
-                        if (requestParams.count() > 0)  {
+                        if (ownCount(requestParams) > 0)  {
                             if ( userSession ) {
                                 // consumed by router.js's route dispatch on the next
                                 // routed GET (one-shot merge into `req.get`, then deleted)
@@ -4529,7 +4608,8 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
             var uploadedFiles = [];
 
-            if ( typeof(files) == 'undefined' || files.count() == 0 ) {
+            // #B546 — shadow-proof own-property count; see the note in setOptions().
+            if ( typeof(files) == 'undefined' || ownCount(files) == 0 ) {
                 cb(new Error('No file to upload'))
             } else {
                 // saving files
@@ -5022,6 +5102,15 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
         var isCritical = typeof options.critical === 'boolean' ? options.critical : true;
         delete options.critical; // not an HTTP option — remove before merge/clean
 
+        // #H12 — outbound priority OPTION, extracted BEFORE the merge/clone below for
+        // the same reason as `critical`: on HTTP/2 every non-pseudo key left on
+        // `options` is folded into the wire headers unless denylisted, so a `priority`
+        // option would ship as a header named `priority` carrying an object. It is
+        // resolved further down — after gina's own header injections — by
+        // lib.priority.resolveOutbound().
+        var _prioOption = options.priority;
+        delete options.priority;
+
         // #B489 — raw-body pass-through: a Buffer or string sent as-is under the caller's
         // own content-type. Extracted HERE, before the clone/merge below, for the same
         // reason `critical` is: JSON.clone() recurses into any object, so a Buffer left on
@@ -5147,7 +5236,8 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             // read by the HTTP/2 request prep (skips the incoming content-type relabel);
             // listed in _NON_HTTP_OPTS so it never becomes a header
             options._rawBody = true;
-        } else if ( typeof(data) != 'undefined' &&  data.count() > 0) {
+        // #B546 — shadow-proof own-property count; see the note in setOptions().
+        } else if ( typeof(data) != 'undefined' &&  ownCount(data) > 0) {
 
             queryData = '?';
             // TODO - if 'application/json' && method == (put|post)
@@ -5297,6 +5387,25 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             options.headers['x-forwarded-proto'] = process.gina.PROXY_SCHEME;
         }
 
+        // #H12 — RFC 9218 Priority on the outbound call. ONE site covers both
+        // transports and every retry (options.headers travels into browser.request()
+        // on HTTP/1 and into the HTTP/2 header fold alike) and self.forward(), which
+        // delegates here. Four rungs, first hit wins: a caller-set header (any casing)
+        // is left alone; `priority: false` sends nothing; an explicit `priority` option
+        // is normalized and never falls through; a PRESENT inbound header propagates —
+        // RFC 9218 is end-to-end, so a sub-request made on behalf of a `u=0` page is
+        // itself `u=0`. local.req is null-guarded like every forward in this function
+        // (a released response, #B31).
+        var _prioHeader = lib.priority.resolveOutbound({
+            headers : options.headers,
+            option  : _prioOption,
+            inbound : ( local.req != null ) ? local.req.priority : null
+        });
+        if ( _prioHeader ) {
+            if ( !options.headers ) { options.headers = {}; }
+            options.headers['priority'] = _prioHeader;
+        }
+
         // #QI — propagate Inspector profiling to the target bundle so it
         // captures queries and timeline entries for cross-bundle propagation.
         // #INS10 — also propagate to the target bundle during a prod instrumentation window.
@@ -7866,7 +7975,8 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             }
             ++i;
         }
-        if (requestParams.count() > 0) {
+        // #B546 — shadow-proof own-property count; see the note in setOptions().
+        if (ownCount(requestParams) > 0) {
             haltedRequest.params = requestParams;
         }
 
@@ -7954,7 +8064,8 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
 
         var dataAsParams    = {};
-        if (data.count() > 0) {
+        // #B546 — shadow-proof own-property count; see the note in setOptions().
+        if (ownCount(data) > 0) {
             dataAsParams = JSON.clone(haltedRequest.data);
         }
         // #B215 — replay the byte-exact halted URL (query string included) whenever a
@@ -8004,7 +8115,7 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
             // redirect(), carried it). Consumed by router.js on the replayed GET
             // (one-shot merge into `req.get`). A custom `requestStorage` with no live
             // session degrades exactly as before (data dropped).
-            if ( data.count() > 0 ) {
+            if ( ownCount(data) > 0 ) {
                 if ( typeof(data.session) != 'undefined' ) {
                     delete data.session;
                 }

package/framework/{v0.6.30 → v0.6.31}/core/plugins/lib/security-headers/x-permitted-cross-domain-policies/README.md

@@ -116,7 +116,7 @@ explicitly.
 
 ## Reference
 
-[Adobe — Cross-Domain Policy File Specification](https://docs.adobe.com/content/dam/acom/en/devnet/articles/crossdomain_policy_file_spec/crossdomain_policy_file_specification.pdf)
+[Adobe — Cross-Domain Policy File Specification](https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/CrossDomain_PolicyFile_Specification.pdf)
 
 ## Failure modes
 

package/framework/{v0.6.30 → v0.6.31}/core/plugins/lib/security-headers/x-permitted-cross-domain-policies/src/main.js

@@ -51,7 +51,7 @@
  * at factory call time to fail fast.
  *
  * Reference:
- * https://docs.adobe.com/content/dam/acom/en/devnet/articles/crossdomain_policy_file_spec/crossdomain_policy_file_specification.pdf
+ * https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/CrossDomain_PolicyFile_Specification.pdf
  *
  * @module plugins/security-headers/x-permitted-cross-domain-policies
  */

package/framework/{v0.6.30 → v0.6.31}/core/plugins/lib/validator/src/form-validator.js

@@ -16,6 +16,33 @@
  *      `_validator.<rule>` namespace (catalog wins per key, English defaults fill).
  *      A non-string (e.g. the routing-mode rule object) is ignored by the overlay guard.
  * */
+/**
+ * Own-property count, reached WITHOUT the shadowable `<container>.count()` lookup (#B546).
+ *
+ * gina installs a `count()` helper on `Object.prototype` (`utils/prototypes.js`), so the
+ * shorthand is an ordinary property lookup that an OWN property of the same name shadows.
+ * Every container counted through this function is keyed by the CLIENT — a request body, a
+ * query bag, route params, uploaded files, caller-supplied query data — so one field named
+ * `count` made the framework call a string instead of the helper: a 500 on the guarded body
+ * branches, and an uncaughtException that exited the process on the unguarded query ones.
+ *
+ * `ownCount()` reaches the helper itself, which no own property can
+ * shadow, and is the same function body, so every receiver shape counts exactly as before.
+ * The null/undefined branch is deliberate rather than defensive: `.call(null)` would bind
+ * `this` to the global object and return ITS key count, while the shorthand threw — and the
+ * empty-object seeding in the body-parse branches is built on that throw.
+ *
+ * @param   {*} container - Any value the shorthand would have been called on.
+ * @returns {number} Own enumerable property count.
+ * @inner
+ */
+function ownCount(container) {
+    if (container === null || typeof container === 'undefined') {
+        return container.count(); // preserve the exact TypeError the shorthand raised
+    }
+    return Object.prototype.count.call(container);
+}
+
 function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
     var isGFFCtx        = ( ( typeof(module) !== 'undefined' ) && module.exports ) ? false : true;
@@ -1229,7 +1256,10 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             : serverInstance;
         controller.setOptions(request, response, next, controllerOptions);
 
-        var data = ( typeof(options.data) == 'object' && options.data.count() > 0 )
+        // #B546 — `options.data` carries the rule's declared data merged with the request's
+        // own body/query bag (lib/routing), so its keys are client-chosen; counted through
+        // `Object.prototype.count` so a field named `count` cannot shadow the helper.
+        var data = ( typeof(options.data) == 'object' && ownCount(options.data) > 0 )
                 ? options.data
                 : {};
         // inherited data from current query asking for validation

package/framework/{v0.6.30 → v0.6.31}/core/server.isaac.js

@@ -1083,6 +1083,21 @@ function ServerEngineClass(options) {
             if (((process.gina && process.gina._inspectorWindowUntil > Date.now()) || (isCacheless && process.gina._inspectorActive)) && !request._devTimeline) {
                 request._devTimeline = { requestStart: Date.now(), entries: [] };
             }
+            // #H12 — RFC 9218 request priority. Parsed ONCE per request into
+            // request.priority ({urgency 0-7, incremental, present} — RFC defaults
+            // when the header is absent or malformed) by lib/priority, which never
+            // throws. Parsed at the top of BOTH engine tops so every traffic class
+            // carries it: isaac's statics, /_gina/* and render-cache hits answer
+            // inside the isaac listener and never reach onInstance, while on Express
+            // all of those run inside onInstance — a parse in onInstance alone would
+            // leave the two engines asymmetric on exactly the traffic RFC 9218
+            // targets (measured). Fill-when-absent (the #B65 typeof shape): under
+            // isaac this same init runs again in onInstance (the listener's cb) and
+            // must not re-parse. Client-supplied and ADVISORY — a consumer reads it
+            // to yield, never to grant more. Keep the two tops in sync.
+            if ( typeof(request.priority) == 'undefined' ) {
+                request.priority = lib.priority.parse(request.headers['priority']);
+            }
             // #OBS1 slice 3 — HTTP request lifecycle hook for Prometheus metrics.
             // Gated on lib.metrics.isEnabled() so the listener is only wired when
             // app.json metrics.enabled is true. Records on response 'finish' (fires