mirror of
https://github.com/mvschwarz/openrig-studio.git
synced 2026-11-07 05:56:21 -10:00
mvschwarz
5d4846877a
sdk-qa re-round on cb6dfac — two MUST-FIX, both reproduced on that tip first.
MF1 — the request confinement leaked through the response object. Removing req
from ctx was real, but handlers still received Node's res, whose res.req
back-references the request: an ordinary handler read the url via res.req.url
(reproduced: it returned "/api/qa-leak?secret=xyz"). The design note overstated
"cannot reach in any spelling" — false while res.req was reachable. Handlers now
receive a RESPONSE FACADE exposing only writeHead/setHeader/write/end/pipeFrom,
closing over res in a scope they cannot reach; every method returns the facade,
a primitive, or undefined — never res. No object in handler scope retains the
request. files/raw streams via res.pipeFrom instead of piping to the raw res.
Control plants the back-reference read (res.req.url, the socket parser, the
connection) into a real handler, boots, and asserts every path yields nothing.
The note is corrected to state the facade is the mechanism and to stop
overstating. The req-confinement guard and adapter count are unchanged (the
facade uses res, not req).
MF2 — monotonic+bounded is not membership. Bounding the ack by the surface's
own latest gen still admitted a foreign one: with A=1, B=2, A=3 recorded, A's
latest is 3 and 2 <= 3, so acking 2 (recorded for B) on A passed. Each surface
now tracks the set of generations recorded FOR IT; an ack must be a MEMBER of
that set and forward of the watermark, so a future gen (never recorded) and a
foreign gen (recorded for another surface) are both refused. Generations at or
below the watermark are pruned. The interleaved discriminator (A=1,B=2,A=3, ack
2 on A) is added to the bounded-ack control and refused; A's own gen 3 accepted.
367 -> 368 tests, 368/368 green.