sailkick-boat 0.23.8 → 0.23.9

package/README.md

@@ -52,6 +52,13 @@ files to send later — nothing is lost in the gap.
 
 - Network errors, `429` and `5xx` are retried with backoff (1 s → 60 s); the data stays
   on disk.
+- **Responses are decoded and checked for completeness.** Core `https` does neither, and
+  `fetch` did both silently: the upstream serves terrain tiles pre-compressed with
+  `Content-Encoding: gzip` whether asked to or not, so for one release the mirror cached
+  gzip bytes labelled as terrain and Cesium read the gzip header as a vertex count
+  ("Invalid typed array length: 11239580910"). A body shorter than its `Content-Length` is
+  now rejected too — tiles are pinned once written, so a truncated one would be served for
+  ever.
 - **All cloud traffic uses core `https`, not `fetch`** — telemetry sync, the offline
   mirror, the cache-manifest poller, the contract check, the backfill and the Sync page
   share one connection pool (`lib/net.js`), so one reset clears every subsystem. Twice in one afternoon this boat's

package/lib/net.js

@@ -33,8 +33,25 @@
 // sites read the same: { ok, status, headers.get(), headers.forEach(), headers
 // .getSetCookie(), buffer, text(), json() }. Transport failures THROW, as fetch does —
 // with `.code` set, which fetch never gave us.
+//
+// TWO THINGS fetch() DID FOR FREE that core http does NOT, both of which have to be done
+// here or the bytes are silently wrong:
+//
+//   1. CONTENT-ENCODING. The upstream serves terrain tiles pre-compressed and sets
+//      Content-Encoding: gzip whether or not it was asked to. fetch decompressed
+//      transparently; core http hands back the gzip stream. The mirror cached those bytes
+//      as terrain, and Cesium read the gzip header as a vertex count: "Invalid typed array
+//      length: 11239580910". Responses are decoded here, and the encoding header is
+//      dropped from the exposed set, exactly as fetch does — the body is no longer encoded,
+//      so advertising that it is would be a lie the cache then stores.
+//
+//   2. COMPLETENESS. fetch rejects a body shorter than its Content-Length. Core http emits
+//      'end' regardless and leaves `res.complete` false, so a connection dropped mid-body
+//      would look like a clean short response — and tiles are PINNED once written, so a
+//      truncated one would be served for ever. Checked explicitly.
 
 const http = require('http')
+const zlib = require('zlib')
 const https = require('https')
 const { URL } = require('url')
 
@@ -63,6 +80,17 @@ function resetTransport () {
   return ++generation
 }
 
+// Undo Content-Encoding, as fetch does. Anything unrecognised is passed through
+// untouched rather than guessed at.
+function decode (buf, encoding, cb) {
+  const enc = String(encoding || '').trim().toLowerCase()
+  if (!enc || enc === 'identity' || buf.length === 0) return cb(null, buf)
+  if (enc === 'gzip' || enc === 'x-gzip') return zlib.gunzip(buf, cb)
+  if (enc === 'deflate') return zlib.inflate(buf, (e, out) => (e ? zlib.inflateRaw(buf, cb) : cb(null, out)))
+  if (enc === 'br') return zlib.brotliDecompress(buf, cb)
+  cb(null, buf)
+}
+
 function headersView (raw) {
   const lower = {}
   for (const [k, v] of Object.entries(raw || {})) lower[k.toLowerCase()] = v
@@ -92,7 +120,7 @@ function request (url, { method = 'GET', headers = {}, body = null, timeoutMs =
     const lib = u.protocol === 'https:' ? https : http
     const agent = u.protocol === 'https:' ? pool().https : pool().http
 
-    const hdrs = { ...headers }
+    const hdrs = { 'Accept-Encoding': 'gzip, deflate, br', ...headers }
     if (body != null && hdrs['Content-Length'] == null && hdrs['content-length'] == null) {
       hdrs['Content-Length'] = Buffer.byteLength(body)
     }
@@ -116,15 +144,27 @@ function request (url, { method = 'GET', headers = {}, body = null, timeoutMs =
       res.on('error', (e) => { settled.forEach((f) => f()); reject(Object.assign(e, { code: e.code || 'ERR_STREAM' })) })
       res.on('end', () => {
         settled.forEach((f) => f())
-        const buffer = Buffer.concat(chunks)
-        resolve({
-          ok: res.statusCode >= 200 && res.statusCode < 300,
-          status: res.statusCode,
-          headers: headersView(res.headers),
-          buffer,
-          text: async () => buffer.toString('utf8'),
-          json: async () => JSON.parse(buffer.toString('utf8')),
-          arrayBuffer: async () => buffer
+        // A body cut short must never be mistaken for a short body — see note (2) above.
+        if (res.complete === false) {
+          return reject(Object.assign(new Error('response truncated'), { code: 'ECONNRESET' }))
+        }
+        const raw = Buffer.concat(chunks)
+        decode(raw, res.headers['content-encoding'], (err, buffer) => {
+          if (err) return reject(Object.assign(err, { code: err.code || 'ERR_CONTENT_DECODING' }))
+          // Drop the encoding header: the body is decoded now, and a cache that stored it
+          // would replay a false claim to every future reader.
+          const headers = { ...res.headers }
+          delete headers['content-encoding']
+          delete headers['content-length'] // no longer describes the body we return
+          resolve({
+            ok: res.statusCode >= 200 && res.statusCode < 300,
+            status: res.statusCode,
+            headers: headersView(headers),
+            buffer,
+            text: async () => buffer.toString('utf8'),
+            json: async () => JSON.parse(buffer.toString('utf8')),
+            arrayBuffer: async () => buffer
+          })
         })
       })
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sailkick-boat",
-  "version": "0.23.8",
+  "version": "0.23.9",
   "description": "Run the sailkick app on board with no internet: charts, weather, climatology, trends and AIS all served from the boat itself. With a sailkick account it also syncs your metrics to the cloud in real time. Alpha, invite-only \u2014 info@sailkick.io",
   "main": "index.js",
   "scripts": {