tina4-nodejs 3.13.141 → 3.13.143

package/packages/core/src/websocket.ts

@@ -321,6 +321,33 @@ export function parseFrame(
   return { fin: !!fin, opcode, payload: Buffer.from(payload), bytesConsumed: offset + payloadLen };
 }
 
+/**
+ * Reassembles fragmented messages (RFC 6455 section 5.4). A browser sends a large message - a pasted image in a chat,
+ * base64 inside JSON - as a TEXT or BINARY frame with FIN clear, then CONTINUATION frames; control frames may arrive
+ * between the pieces. Returns a complete message when one is done, a control frame as it comes, and null while a
+ * message is still arriving. A CONTINUATION with no message started is dropped. Mirrors the Python master
+ * (tina4_python.websocket _handle_frame). One per connection.
+ */
+export class MessageAssembler {
+  private parts: Buffer[] = [];
+  private opcode = 0;
+
+  push(frame: { fin: boolean; opcode: number; payload: Buffer }): { opcode: number; payload: Buffer } | null {
+    if (frame.opcode >= 0x8) return { opcode: frame.opcode, payload: frame.payload }; // control frames are never fragmented
+    if (frame.opcode === OP_CONTINUATION) {
+      if (!this.opcode) return null;
+      this.parts.push(frame.payload);
+      if (!frame.fin) return null;
+      const whole = { opcode: this.opcode, payload: Buffer.concat(this.parts) };
+      this.parts = []; this.opcode = 0;
+      return whole;
+    }
+    if (frame.fin) { this.parts = []; this.opcode = 0; return { opcode: frame.opcode, payload: frame.payload }; }
+    this.opcode = frame.opcode; this.parts = [frame.payload];
+    return null;
+  }
+}
+
 // ── WebSocket Server ─────────────────────────────────────────
 
 export class WebSocketServer {
@@ -854,6 +881,13 @@ export class WebSocketServer {
     });
   }
 
+  private readonly assemblers = new WeakMap<WebSocketClient, MessageAssembler>();
+  private assemblerFor(client: WebSocketClient): MessageAssembler {
+    let a = this.assemblers.get(client);
+    if (!a) { a = new MessageAssembler(); this.assemblers.set(client, a); }
+    return a;
+  }
+
   private processBuffer(
     client: WebSocketClient,
     buffer: Buffer,
@@ -868,17 +902,20 @@ export class WebSocketServer {
       remaining = remaining.subarray(frame.bytesConsumed);
       client.lastActivity = Date.now(); // mark activity for the idle reaper
 
-      switch (frame.opcode) {
+      // a fragmented message is delivered once, whole (MessageAssembler)
+      const whole = this.assemblerFor(client).push(frame);
+      if (!whole) continue;
+      switch (whole.opcode) {
         case OP_TEXT:
-          this.emit("message", client, frame.payload.toString("utf-8"));
+          this.emit("message", client, whole.payload.toString("utf-8"));
           break;
 
         case OP_BINARY:
-          this.emit("message", client, frame.payload);
+          this.emit("message", client, whole.payload);
           break;
 
         case OP_PING: {
-          const pongFrame = buildFrame(OP_PONG, frame.payload);
+          const pongFrame = buildFrame(OP_PONG, whole.payload);
           try {
             client.socket.write(pongFrame);
           } catch {
@@ -1243,15 +1280,19 @@ export function serveWebSocketRoute(req: IncomingMessage, socket: Socket, head:
       .finally(() => wsRouteManager.remove(conn.id));
   };
 
+  const assembler = new MessageAssembler();
   socket.on("data", (chunk: Buffer) => {
     buffer = Buffer.concat([buffer, chunk]);
     while (buffer.length > 0) {
       const frame = parseFrame(buffer);
       if (!frame) break;
       buffer = buffer.subarray(frame.bytesConsumed);
-      switch (frame.opcode) {
+      // a fragmented message is delivered once, whole (MessageAssembler)
+      const whole = assembler.push(frame);
+      if (!whole) continue;
+      switch (whole.opcode) {
         case OP_TEXT: {
-          const text = frame.payload.toString("utf-8");
+          const text = whole.payload.toString("utf-8");
           void Promise.resolve()
             .then(() => (conn._onMessage ? conn._onMessage(text) : handler(conn, "message", text)))
             .catch((e) => Log.error(`WebSocket message handler error: ${(e as Error).message}`));
@@ -1259,7 +1300,7 @@ export function serveWebSocketRoute(req: IncomingMessage, socket: Socket, head:
         }
         case OP_PING:
           try {
-            socket.write(buildFrame(OP_PONG, frame.payload));
+            socket.write(buildFrame(OP_PONG, whole.payload));
           } catch {
             /* client gone */
           }

package/packages/core/templates/errors/302.twig

@@ -17,6 +17,6 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
     <div class="spinner"></div>
     <div class="error-title">Redirecting…</div>
     <div class="error-msg">You are being redirected to a new location.</div>
-    <div class="error-path" style="color:var(--primary)">{{ redirect_url }}</div>
+    <div class="error-path c-primary">{{ redirect_url }}</div>
     <a href="{{ redirect_url }}" class="error-home">Click here if not redirected</a>
 {% endblock %}

package/packages/core/templates/errors/401.twig

@@ -9,9 +9,9 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 {% extends "errors/base.twig" %}
 {% block title %}401 — Unauthorized{% endblock %}
 {% block content %}
-    <div class="error-code" style="color:var(--danger)">401</div>
+    <div class="error-code c-danger">401</div>
     <div class="error-title">Unauthorized</div>
     <div class="error-msg">You need to sign in to access this resource.</div>
-    <div class="error-path" style="color:var(--danger)">{{ path }}</div>
+    <div class="error-path c-danger">{{ path }}</div>
     <a href="/" class="error-home">Go Home</a>
 {% endblock %}

package/packages/core/templates/errors/403.twig

@@ -12,7 +12,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>403 — Forbidden</title>
-<style>
+<style nonce="{{ csp_nonce() }}">
 * { box-sizing: border-box; margin: 0; padding: 0; }
 body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; color: #e2e8f0; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
 .error-card { background: #1e293b; border: 1px solid #334155; border-radius: 1rem; padding: 3rem; text-align: center; max-width: 520px; width: 90%; }

package/packages/core/templates/errors/404.twig

@@ -12,7 +12,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>404 — Not Found</title>
-<style>
+<style nonce="{{ csp_nonce() }}">
 * { box-sizing: border-box; margin: 0; padding: 0; }
 body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; color: #e2e8f0; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
 .error-card { background: #1e293b; border: 1px solid #334155; border-radius: 1rem; padding: 3rem; text-align: center; max-width: 520px; width: 90%; }

package/packages/core/templates/errors/500.twig

@@ -12,7 +12,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>500 — Server Error</title>
-<style>
+<style nonce="{{ csp_nonce() }}">
 * { box-sizing: border-box; margin: 0; padding: 0; }
 body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; color: #e2e8f0; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
 .error-card { background: #1e293b; border: 1px solid #334155; border-radius: 1rem; padding: 3rem; text-align: left; max-width: 700px; width: 90%; }

package/packages/core/templates/errors/502.twig

@@ -9,9 +9,9 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 {% extends "errors/base.twig" %}
 {% block title %}502 — Bad Gateway{% endblock %}
 {% block content %}
-    <div class="error-code" style="color:var(--danger)">502</div>
+    <div class="error-code c-danger">502</div>
     <div class="error-title">Bad Gateway</div>
     <div class="error-msg">The upstream server returned an invalid response.</div>
-    <div class="error-path" style="color:var(--danger)">{{ path }}</div>
+    <div class="error-path c-danger">{{ path }}</div>
     <a href="/" class="error-home">Go Home</a>
 {% endblock %}

package/packages/core/templates/errors/503.twig

@@ -12,9 +12,9 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 .error-code { color: var(--warn); }
 {% endblock %}
 {% block content %}
-    <div class="error-code" style="color:var(--warn)">503</div>
+    <div class="error-code c-warn">503</div>
     <div class="error-title">Service Unavailable</div>
     <div class="error-msg">The server is temporarily unavailable. Please try again shortly.</div>
-    <div class="error-path" style="color:var(--warn)">{{ path }}</div>
+    <div class="error-path c-warn">{{ path }}</div>
     <a href="/" class="error-home">Go Home</a>
 {% endblock %}

package/packages/core/templates/errors/base.twig

@@ -13,7 +13,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 {% block meta %}{% endblock %}
 <title>{% block title %}Error{% endblock %}</title>
-<style>
+<style nonce="{{ csp_nonce() }}">
 :root {
     --bg: #0f172a; --surface: #1e293b; --border: #334155;
     --text: #e2e8f0; --muted: #94a3b8; --primary: #3b82f6;
@@ -31,6 +31,9 @@ body { font-family: var(--font); background: var(--bg); color: var(--text); min-
 .error-home { display: inline-block; margin-top: 1.5rem; padding: 0.5rem 1.5rem; background: var(--primary); color: #fff; text-decoration: none; border-radius: 0.5rem; font-size: 0.85rem; }
 .error-home:hover { opacity: 0.9; }
 .logo { width: 3rem; height: 3rem; margin-bottom: 1rem; opacity: 0.5; }
+.c-danger { color: var(--danger); }
+.c-warn { color: var(--warn); }
+.c-primary { color: var(--primary); }
 {% block extra_styles %}{% endblock %}
 </style>
 </head>

package/packages/frond/dist/index.js

@@ -1413,6 +1413,7 @@ function _b64url(data) {
   return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 var _formTokenSessionId = "";
+var _cspNonceProvider = () => "";
 function _buildFormTokenJwt(descriptor = "") {
   const secret = process.env.TINA4_SECRET ?? "";
   const secretBytes = Buffer.byteLength(secret, "utf8");
@@ -1604,6 +1605,7 @@ var Frond = class _Frond {
     this.globals.formTokenValue = (descriptor) => _generateFormTokenValue(descriptor || "");
     this.globals.form_token_value = (descriptor) => _generateFormTokenValue(descriptor || "");
     this.globals.dump = (value) => renderDump(value);
+    this.globals.csp_nonce = () => _cspNonceProvider();
     for (const [k, v] of _Frond.classFilters) this.filters[k] = v;
     for (const [k, v] of _Frond.classGlobals) this.globals[k] = v;
     for (const [k, v] of _Frond.classTests) this.tests[k] = v;

package/packages/frond/src/engine.ts

@@ -1785,6 +1785,21 @@ export function setFormTokenSessionId(sessionId: string): void {
   _formTokenSessionId = sessionId || "";
 }
 
+// CSP nonce provider (ADR-0088). Frond never imports @tina4/core (that would be
+// circular — core depends on frond), so core injects the per-response nonce
+// source through this setter. Default returns "" for standalone Frond use.
+let _cspNonceProvider: () => string = () => "";
+
+/**
+ * Register the function that backs the `{{ csp_nonce() }}` template global.
+ * @tina4/core calls this once with its request-scoped nonce source so every
+ * Frond instance (framework templates AND the app's) resolves the same nonce
+ * the Content-Security-Policy header names.
+ */
+export function setCspNonceProvider(fn: () => string): void {
+  _cspNonceProvider = fn;
+}
+
 function _buildFormTokenJwt(descriptor: string = ""): string {
   // Fail-closed, IDENTICAL to the validator (auth.ts validToken:
   // `secret ?? process.env.TINA4_SECRET ?? ""`). With TINA4_SECRET unset the
@@ -2014,6 +2029,14 @@ export class Frond {
     //   {{ user|dump }}   and   {{ dump(user) }}
     this.globals.dump = (value: unknown) => renderDump(value);
 
+    // CSP nonce (ADR-0088): {{ csp_nonce() }} returns the current response's
+    // nonce so a template can serve an inline <style>/<script> under the strict
+    // default Content-Security-Policy — <style nonce="{{ csp_nonce() }}">. The
+    // value matches the 'nonce-X' the security middleware puts in the CSP header.
+    // Frond stays zero-dependency: @tina4/core injects the provider (it never
+    // imports core); standalone Frond returns "".
+    this.globals.csp_nonce = () => _cspNonceProvider();
+
     // Drain the class-level registry. This is the key to surviving
     // hot-reloads AND the static-facade pattern: app.ts calls
     // Frond.addFilter("money", fn) once, the class remembers it,