Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
@appliedblockchain/assert-combinators
Advanced tools
Functional assertion combinators.
Name | Type | Runtime |
---|---|---|
Primitive | string | $.string |
Primitive | number | $.number |
Primitive | boolean | $.boolean |
Primitive | undefined | $.undefined |
Primitive | null | $.null |
Undefined or null | undefined | null | $.nil |
Undefined or A | undefined | A | $.undefinedOr(a) |
Nullable A | null | A | $.nullOr(a) |
Nillable A | undefined | null | A | $.nilOr(a) |
Unknown | unknown | $.unknown |
Array | A[] | $.array(a) |
Object | { a: A, b: B } | $.object({ a, b }) |
Exact object | { a: A, b: B } | $.exact({ a, b }) |
Record | Record<K, V> | $.record(k, v) |
Keyed object | Record<string, undefined | V> | $.keyed(v) |
Intersection | A & B | $.and(a, b) |
Primitive type union | 'A' | 'B' | $.oneOf('A', 'B') |
Union | A | B | $.or(a, b) |
Date string YYYY-MM-DD | string weaker | $.dateString |
Defined | Exclude<A, undefined> | $.defined(a) |
Literal primitive | "foo" , 42 | $.eq('foo') , $.eq(42) |
Tuple | [number, string] | $.tuple($.number, $.string) |
Finite number | number weaker | $.finite |
Positive number | number weaker | $.positive |
Safe integer | number weaker | $.safeInteger |
Greater than | number weaker | $.gt(42) |
Greater than | number weaker | $.gt(42) |
Greater or equal than | number weaker | $.gte(42) |
Non blank string | string weaker | $.nonBlankString |
Regexp | string weaker | $.regexp(/^[a-z]+$/i) |
Strftime formatted string | string weaker | $.strftime('%Y-%m-%d') |
import * as $ from '@appliedblockchain/assert-combinators'
ws.on('message', _ => {
const { method, agree } = $.object({
method: $.string,
agree: $.boolean
})(JSON.parse(_))
// Types are correct:
// method: string
// agree: boolean
})
In some cases runtime type assertions provide stronger guarantees than static types.
For example $.finite
asserts that the value is not only a number
but also that is not NaN
, Infinity
or -Infinity
.
Opaque types section provides solution for some cases.
Unlike Flow, TypeScript doesn't directly support opaque types.
However, they can be emulated by intersecting with object containing unique property type which exists in static type system only. It does not exist in runtime value.
type Finite = number & { readonly _tag: 'Finite' }
Opaque types allow to design code in such a way that value of the type can be created in one place – as result of runtime type assertion – only. The only possible way of creating values of this type is to create valid values. Those assertions have to happen at construction and I/O boundaries only. Once value is validated, it enters static type system. It doesn't have to be re-validated anywhere else in the code. Usage of the value is safe, guaranteed to conform to this assertion.
Good examples of opaque type candidates are NonEmptyArray<T>
, Positive
, Email
.
ValidatedEmail
– ie. an email that passed some async validation can be used to annotate function parameter for functions that should be used only for validated emails – without the need for re-validating email in each function's body.
When tail of tuple accepts undefined values, resulting tuple may have shorter length than arity of assertion function.
const assertMyTuple = $.tuple($.string, $.undefinedOr($.number))
assertMyTuple([ 'foo' ]) // ok
assertMyTuple([ 'foo', 1 ]) // ok
A good rule of thumb is to destructure tuple elements if it accepts undefined at tail position to make sure the code doesn't rely on the length, ie:
const [ myString, maybeNumber ] = assertMyTuple(input)
Use never
assertion to force exhaustiveness on switch statements:
import * as $ from '@appliedblockchain/assert-combinators'
type X = 'a' | 'b' | 'c'
const assertX: $.Assert<X> =
$.oneOf('a', 'b', 'c')
const x: X = assertX(JSON.parse('"c"'))
switch (x) {
case 'a':
case 'b':
console.log(x)
break
default:
// Argument of type 'string' is not assignable to parameter of type 'never'.ts(2345)
// const x: "c"
$.never(x)
}
MIT License
Copyright 2019 Applied Blockchain
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
Assertion combinators.
The npm package @appliedblockchain/assert-combinators receives a total of 3,930 weekly downloads. As such, @appliedblockchain/assert-combinators popularity was classified as popular.
We found that @appliedblockchain/assert-combinators demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 38 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.