fix(runtime): keep caller security precheck authoritative

Author: unadlib

packages/runtime/src/embed.ts

@@ -1,13 +1,11 @@
-import {
-  collectRuntimeSourceImports,
-  type RuntimeEvent,
-  type RuntimePlan,
-  type RuntimeStateSnapshot,
+import type {
+  RuntimeEvent,
+  RuntimePlan,
+  RuntimeStateSnapshot,
 } from "@renderify/ir";
 import {
   DefaultSecurityChecker,
   type RuntimeSecurityProfile,
-  type SecurityCheckResult,
   type SecurityInitializationOptions,
 } from "@renderify/security";
 import { JspmModuleLoader } from "./jspm-module-loader";
@@ -352,21 +350,6 @@ async function precheckPlanBeforeAutoPin(
   }
 
   const policy = security.getPolicy();
-  if (callerProvidedSecurity) {
-    const callerPrecheckResult = await filterAutoPinnablePrecheckIssues(
-      await security.checkPlan(plan),
-      plan,
-      policy,
-    );
-    if (!callerPrecheckResult.safe) {
-      return callerPrecheckResult;
-    }
-
-    if (!policy.requireModuleManifestForBareSpecifiers) {
-      return callerPrecheckResult;
-    }
-  }
-
   if (!policy.requireModuleManifestForBareSpecifiers) {
     return security.checkPlan(plan);
   }
@@ -380,157 +363,27 @@ async function precheckPlanBeforeAutoPin(
     },
   });
 
-  return precheckSecurity.checkPlan(plan);
-}
-
-async function filterAutoPinnablePrecheckIssues(
-  result: SecurityCheckResult,
-  plan: RuntimePlan,
-  policy: ReturnType<
-    NonNullable<RuntimeEmbedRenderOptions["security"]>["getPolicy"]
-  >,
-): Promise<SecurityCheckResult> {
-  if (result.safe || !policy.requireModuleManifestForBareSpecifiers) {
-    return result;
-  }
-
-  const autoPinnableSpecifiers = await collectAutoPinnableBareSpecifiers(plan);
-  if (autoPinnableSpecifiers.size === 0) {
-    return result;
-  }
-
-  const removedIssues = new Set<string>();
-  const remainingIssues = result.issues.filter((issue) => {
-    const shouldRemove = isAutoPinnablePrecheckIssue(
-      issue,
-      autoPinnableSpecifiers,
-    );
-    if (shouldRemove) {
-      removedIssues.add(issue);
-    }
-    return !shouldRemove;
-  });
-
-  if (removedIssues.size === 0) {
-    return result;
-  }
-
-  return {
-    safe: remainingIssues.length === 0,
-    issues: remainingIssues,
-    diagnostics: result.diagnostics.filter(
-      (diagnostic) => !removedIssues.has(diagnostic.message),
-    ),
-  };
-}
-
-async function collectAutoPinnableBareSpecifiers(
-  plan: RuntimePlan,
-): Promise<Set<string>> {
-  const specifiers = new Set<string>();
-
-  for (const specifier of plan.imports ?? []) {
-    addAutoPinnableBareSpecifier(specifiers, specifier);
-  }
-
-  for (const specifier of plan.capabilities?.allowedModules ?? []) {
-    addAutoPinnableBareSpecifier(specifiers, specifier);
-  }
-
-  walkPlanNodes(plan.root, (node) => {
-    if (node.type === "component") {
-      addAutoPinnableBareSpecifier(specifiers, node.module);
-    }
-  });
-
-  for (const specifier of await collectRuntimeSourceImports(
-    plan.source?.code ?? "",
-  )) {
-    addAutoPinnableBareSpecifier(specifiers, specifier);
-  }
-
-  return specifiers;
-}
-
-function walkPlanNodes(
-  node: RuntimePlan["root"],
-  visitor: (node: RuntimePlan["root"]) => void,
-): void {
-  visitor(node);
-  if (node.type === "text") {
-    return;
-  }
-
-  for (const child of node.children ?? []) {
-    walkPlanNodes(child, visitor);
+  const policyPrecheckResult = await precheckSecurity.checkPlan(plan);
+  if (!policyPrecheckResult.safe) {
+    return policyPrecheckResult;
   }
-}
 
-function addAutoPinnableBareSpecifier(
-  target: Set<string>,
-  specifier: string,
-): void {
-  if (isAutoPinnableBareSpecifier(specifier)) {
-    target.add(specifier);
-  }
-}
-
-function isAutoPinnableBareSpecifier(specifier: string): boolean {
-  const normalized = specifier.trim();
-  if (normalized.length === 0) {
-    return false;
+  if (callerProvidedSecurity && !isPlainDefaultSecurityChecker(security)) {
+    return security.checkPlan(plan);
   }
 
-  const lowered = normalized.toLowerCase();
-  return (
-    !normalized.startsWith("./") &&
-    !normalized.startsWith("../") &&
-    !normalized.startsWith("/") &&
-    !lowered.startsWith("http://") &&
-    !lowered.startsWith("https://") &&
-    !lowered.startsWith("data:") &&
-    !lowered.startsWith("blob:") &&
-    !lowered.startsWith("inline://") &&
-    lowered !== "this-plan-source"
-  );
+  return policyPrecheckResult;
 }
 
-function isAutoPinnablePrecheckIssue(
-  issue: string,
-  autoPinnableSpecifiers: ReadonlySet<string>,
-): boolean {
+function isPlainDefaultSecurityChecker(
+  security: NonNullable<RuntimeEmbedRenderOptions["security"]>,
+): security is DefaultSecurityChecker {
   return (
-    matchesAutoPinnableSpecifierIssue(
-      issue,
-      "Missing moduleManifest entry for bare specifier: ",
-      autoPinnableSpecifiers,
-    ) ||
-    matchesAutoPinnableSpecifierIssue(
-      issue,
-      "Runtime source bare import requires manifest entry: ",
-      autoPinnableSpecifiers,
-    ) ||
-    matchesAutoPinnableSpecifierIssue(
-      issue,
-      "Module specifier is not in allowlist: ",
-      autoPinnableSpecifiers,
-    )
+    security instanceof DefaultSecurityChecker &&
+    security.constructor === DefaultSecurityChecker
   );
 }
 
-function matchesAutoPinnableSpecifierIssue(
-  issue: string,
-  prefix: string,
-  autoPinnableSpecifiers: ReadonlySet<string>,
-): boolean {
-  if (!issue.startsWith(prefix)) {
-    return false;
-  }
-
-  const specifier = issue.slice(prefix.length).trim();
-  return autoPinnableSpecifiers.has(specifier);
-}
-
 function mergeSecurityInitializationProfile(
   input: RuntimeEmbedRenderOptions["securityInitialization"],
   profile: RuntimeSecurityProfile,

tests/module-manifest-autopin.test.ts

@@ -368,6 +368,110 @@ test("renderPlanInBrowser honors custom security rejection before auto-pin fetch
   }
 });
 
+test("renderPlanInBrowser preserves caller checker rejections that match auto-pin issue text", async () => {
+  const baseChecker = new DefaultSecurityChecker();
+  baseChecker.initialize({ profile: "balanced" });
+
+  const customChecker = {
+    initialize(): void {},
+    getPolicy() {
+      return baseChecker.getPolicy();
+    },
+    getProfile() {
+      return baseChecker.getProfile();
+    },
+    checkCapabilities(
+      ...args: Parameters<DefaultSecurityChecker["checkCapabilities"]>
+    ) {
+      return baseChecker.checkCapabilities(...args);
+    },
+    checkModuleSpecifier(specifier: string) {
+      return baseChecker.checkModuleSpecifier(specifier);
+    },
+    async checkPlan() {
+      return {
+        safe: false,
+        issues: ["Module specifier is not in allowlist: date-fns"],
+        diagnostics: [
+          {
+            level: "error" as const,
+            code: "CUSTOM_CHECKER_REJECTED",
+            message: "Module specifier is not in allowlist: date-fns",
+          },
+        ],
+      };
+    },
+  };
+
+  const plan: RuntimePlan = {
+    specVersion: DEFAULT_RUNTIME_PLAN_SPEC_VERSION,
+    id: "autopin_embed_custom_checker_issue_collision_plan",
+    version: 1,
+    root: createElementNode("section", undefined, [createTextNode("fallback")]),
+    capabilities: {
+      domWrite: true,
+    },
+    source: {
+      language: "js",
+      runtime: "renderify",
+      code: [
+        'import { format } from "date-fns";',
+        "export default function App(){",
+        "  return { type: 'text', value: format(new Date(0), 'yyyy-MM-dd') };",
+        "}",
+      ].join("\n"),
+    },
+  };
+
+  let fetchCount = 0;
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () => {
+    fetchCount += 1;
+    return new Response("unexpected network", { status: 500 });
+  }) as typeof fetch;
+
+  try {
+    await assert.rejects(
+      () =>
+        renderPlanInBrowser(plan, {
+          security: customChecker,
+          runtime: {
+            async initialize(): Promise<void> {},
+            async terminate(): Promise<void> {},
+            async probePlan(): Promise<never> {
+              throw new Error("not implemented");
+            },
+            async executePlan(): Promise<never> {
+              throw new Error("not implemented");
+            },
+            async execute(): Promise<never> {
+              throw new Error("runtime should not execute");
+            },
+            async compile(): Promise<string> {
+              return "";
+            },
+            getPlanState() {
+              return undefined;
+            },
+            setPlanState(): void {},
+            clearPlanState(): void {},
+          } as unknown as RuntimeManager,
+          autoPinModuleLoader: new ResolveOnlyJspmLoader(),
+          autoInitializeRuntime: false,
+          autoTerminateRuntime: false,
+        }),
+      (error: unknown) =>
+        error instanceof RuntimeSecurityViolationError &&
+        error.result.issues.includes(
+          "Module specifier is not in allowlist: date-fns",
+        ),
+    );
+    assert.equal(fetchCount, 0);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
 test("renderPlanInBrowser auto-pins bare imports after security precheck", async () => {
   const plan: RuntimePlan = {
     specVersion: DEFAULT_RUNTIME_PLAN_SPEC_VERSION,