dunglas / mercure / 29654396286

86%

master: 93%

Pull #1301

github

fix!: spec conformance and hardening from the 1.0.0-alpha.1 review

Conformance fixes against draft-dunglas-mercure-08:

- Ignore unrecognized authorization_details actions instead of rejecting
  the token: an unknown action grants nothing, per the registry design.
- Refuse to start with more than one trusted issuer in modern mode: keys
  are configured per role, not per issuer, so several issuers would share
  key material and allow cross-issuer token replay. A per-issuer key map
  can lift this restriction later.
- Bound publish and QUERY subscribe request bodies in-hub and reject
  larger requests with 413 (WithMaxRequestBodySize, max_request_body_size
  Caddy directive, 1 MiB default). Also fixes the unbounded QUERY body
  read for library users.
- Default the authorization cookie to __Secure-mercure_access_token; the
  dev Caddyfile keeps a prefix-less name for plain-HTTP development.
- Emit Mercure-Last-Event-ID whenever the request carried a Last-Event-ID
  header or last_event_id parameter, including with an empty value.
- Encode the subscriber id in subscription URLs with the same encoder as
  the matcher segments.

Spec: recommend random per-connection subscriber identifiers; an
issuer+sub derivation collides when one token is used on several
connections and would emit misleading termination events.

59 of 61 new or added lines in 7 files covered. (96.72%)

2776 of 3240 relevant lines covered (85.68%)

103.4 hits per line