kinetex 1.1.0 → 1.3.0

package/dist/cjs/aws-sigv4.js

@@ -156,7 +156,10 @@ export function imdsCredentials(options = {}) {
         if (!role)
             throw new NetworkError("No IAM role found in IMDS response");
         // Step 3: Get credentials for role
-        const credsRes = await fetchWithTimeout(`${endpoint}/latest/meta-data/iam/security-credentials/${role}`, { headers: { "x-aws-ec2-metadata-token": token } }, timeout);
+        // encodeURIComponent: the role name comes from the metadata response and
+        // was interpolated raw, so a `../` or `?` in it could redirect the
+        // credentials request to another path on the metadata endpoint.
+        const credsRes = await fetchWithTimeout(`${endpoint}/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`, { headers: { "x-aws-ec2-metadata-token": token } }, timeout);
         if (!credsRes.ok)
             throw new NetworkError(`IMDS credentials fetch failed: ${credsRes.status}`);
         const data = (await credsRes.json());

package/dist/cjs/cache.js

@@ -326,14 +326,17 @@ function buildVaryKey(varyHeader, requestHeaders) {
 /**
  * Normalize a string for use in a cache key to prevent injection attacks.
  * Removes control characters and normalizes whitespace.
+ *
+ * The control characters are the entire point of the match: they are what has
+ * to be stripped out of a URL before it is used as a cache-key component, so
+ * `no-control-regex` is suppressed here deliberately.
  */
+// deno-lint-ignore no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
 function normalizeCacheKeyPart(part) {
-    const controlRanges = [
-        String.fromCharCode(0x00) + "-" + String.fromCharCode(0x1f),
-        String.fromCharCode(0x7f) + "-" + String.fromCharCode(0x9f),
-    ].join("");
-    const controlRegex = new RegExp(`[${controlRanges}]`, "g");
-    return part.replaceAll(controlRegex, "").replaceAll(/\s+/g, " ").trim();
+    // The regex is module-level: rebuilding it from String.fromCharCode on every
+    // call (for every URL component, for every cache key) was pure overhead.
+    return part.replaceAll(CONTROL_CHARS, "").replaceAll(/\s+/g, " ").trim();
 }
 /**
  * Generate a cryptographic fingerprint of auth-sensitive headers using SHA-256.
@@ -341,10 +344,17 @@ function normalizeCacheKeyPart(part) {
  * Returns "" when no auth headers are present (shared/anonymous cache).
  */
 export async function getAuthFingerprint(headers) {
-    const authHeaders = ["authorization", "cookie", "x-api-key", "x-auth-token"];
+    // HTTP header names are case-insensitive, so a caller passing
+    // `Authorization` must fingerprint identically to `authorization` —
+    // otherwise a cache key or dedup key silently changes meaning with the
+    // casing of the caller's object literal.
+    const lowered = new Map();
+    for (const [name, value] of Object.entries(headers)) {
+        lowered.set(name.toLowerCase(), value);
+    }
     const parts = [];
-    for (const header of authHeaders) {
-        const value = headers[header.toLowerCase()];
+    for (const header of CREDENTIAL_HEADERS) {
+        const value = lowered.get(header);
         if (value)
             parts.push(`${header}=${value}`);
     }
@@ -358,6 +368,29 @@ export async function getAuthFingerprint(headers) {
         .slice(0, 32); // 128-bit prefix — ample for auth isolation
     return `auth:${hex}`;
 }
+/**
+ * Every header kinetex treats as credential-bearing. Shared by the cache-key
+ * fingerprint, the dedup key and the cross-origin redirect strip list so the
+ * three can never drift apart again: a header missing from the fingerprint list
+ * lets two different users share one cache entry or one coalesced response.
+ */
+export const CREDENTIAL_HEADERS = [
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "x-api-key",
+    "apikey",
+    "api-key",
+    "x-auth-token",
+    "x-access-token",
+    "x-refresh-token",
+    "x-session-id",
+    "x-session-token",
+    "x-secret",
+    "x-secret-key",
+    "x-private-key",
+    "x-csrf-token",
+];
 /**
  * Default cache key function.
  * Normalizes: method, URL (sorted query params, stripped hash), auth fingerprint.
@@ -583,8 +616,10 @@ export class HTTPCache {
             maxAbsoluteAgeMs: config.maxAbsoluteAgeMs ?? 7 * 24 * 60 * 60 * 1000, // 7 days
             honorCacheControl: config.honorCacheControl ?? true,
             cacheMethods: config.cacheMethods ?? ["GET", "HEAD"],
+            // 304 is intentionally absent: the client revalidates rather than
+            // storing a 304, so listing it only implied a guarantee that never held.
             cacheStatuses: config.cacheStatuses ?? [
-                200, 203, 204, 206, 300, 301, 304, 404, 405, 410, 414, 501,
+                200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501,
             ],
             cacheKey: config.cacheKey ?? defaultCacheKey,
             storage: config.storage ?? new MemoryStorageAdapter(),
@@ -999,10 +1034,13 @@ export class HTTPCache {
                 this.tagIndex.get(tag)?.delete(key);
             }
         }
-        /* NOTE: If entry is undefined (e.g., not found during LRU eviction),
-           the tag index entry for that key will not be cleaned up.
-           This is a minor leak on disk-based storage miss, acceptable trade-off
-           since the key is gone from LRU and storage anyway. */
+        else {
+            // Storage miss (already evicted / gone): the tag sets still referenced
+            // this key and those references used to be left behind forever, growing
+            // tagIndex on every eviction until invalidateByTag() walked stale keys.
+            for (const set of this.tagIndex.values())
+                set.delete(key);
+        }
     }
     async _ensureCapacity(newEntrySize) {
         // Entry count cap

package/dist/cjs/circuit-breaker.js

@@ -115,9 +115,18 @@ export class CircuitBreaker {
     }
     /** Snapshot of all counters — suitable for logging or dashboards. */
     get snapshot() {
+        // Counted with a loop: filter() allocated a new array on every snapshot,
+        // and snapshot is taken on every rejection and state transition.
+        let failureCount = this._consecutiveFails;
+        if (this.windowSize > 0) {
+            failureCount = 0;
+            for (const ok of this._window)
+                if (!ok)
+                    failureCount++;
+        }
         return {
             state: this._state,
-            failureCount: this.windowSize > 0 ? this._window.filter((v) => !v).length : this._consecutiveFails,
+            failureCount,
             successCount: this._consecutiveSucc,
             lastFailureAt: this._lastFailureAt,
             lastSuccessAt: this._lastSuccessAt,
@@ -143,6 +152,11 @@ export class CircuitBreaker {
             this.cfg.onRejected?.(snap);
             return Promise.reject(new CircuitOpenError(this.key, snap));
         }
+        // Remember whether THIS call holds a half-open probe. Decrementing based
+        // on the state at settle time was wrong: if a sibling probe failed first
+        // the state was already OPEN, the decrement was skipped, and the probe slot
+        // stayed occupied for the rest of the half-open window.
+        let heldProbe = false;
         if (this._state === "HALF_OPEN") {
             if (this._inFlightProbes >= this.halfOpenConcurrency) {
                 this._totalRejected++;
@@ -151,15 +165,21 @@ export class CircuitBreaker {
                 return Promise.reject(new CircuitOpenError(this.key, snap));
             }
             this._inFlightProbes++;
+            heldProbe = true;
         }
         this._totalRequests++;
-        return fn().then((result) => {
-            if (this._state === "HALF_OPEN")
+        // Promise.resolve().then(fn) so a synchronous throw inside `fn` becomes a
+        // rejection. execute() is an async API — callers destructure .catch() off
+        // the return value, and a sync throw would escape before they could.
+        return Promise.resolve()
+            .then(fn)
+            .then((result) => {
+            if (heldProbe)
                 this._inFlightProbes = Math.max(0, this._inFlightProbes - 1);
             this._recordSuccess();
             return result;
         }, (err) => {
-            if (this._state === "HALF_OPEN")
+            if (heldProbe)
                 this._inFlightProbes = Math.max(0, this._inFlightProbes - 1);
             if (this._isCountableFailure(err)) {
                 this._recordFailure();