
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@fp51/opaque-type
Advanced tools
Inspired from https://codemix.com/opaque-types-in-javascript/
npm add @fp51/opaque-type
The following naive code will compile properly, except that if you mix
createRoom
parameters you will introduce a nasty bug at runtime.
type RoomID = string;
type UserID = string;
function createRoom(roomId: RoomID, userId: UserID) {
// something
}
const roomId: RoomID = ...;
const userId: UserID = ...;
createRoom(userId, roomId);
Opaque at rescue !
This following code won't compile, because Opaque
add more specificty to
RoomId
and UserId
, so typescript wont think they are compatible because they
are built uppon a string
;
import { Opaque } from "@fp51/opaque-type";
type RoomID = Opaque<"RoomId">;
type UserID = Opaque<"UserId">;
function createRoom(roomId: RoomID, userId: UserID) {
// something
}
const roomId: RoomID = ...;
const userId: UserID = ...;
createRoom(userId, roomId); // TypeError
Here the error message you will get in your editor or when you will try to build your application
Argument of type 'Opaque<"UserId">' is not assignable to parameter of type 'Opaque<"RoomId">'.
...
Let say you built a nice piece of code:
// message.ts
type Message = {
userId: string,
text: string,
};
export function clearMessageText(message: Message) : Message {
return message.text = '';
}
export function getMessage():Message {
return ...
}
You user can endup writting the following code:
import { clearMessageText, getMessage } from './message';
const message = { userId: 'userId', text: 'mytext' };
clearMessageText(message);
or
import { getMessage } from '..'
const message2 = getMessage();
message2.userId = 'whatever';
Those two pieces of code are problematic, because in these the inner structure of your types are exposed and manipulated.
If you make any change to the Message
structure it will be a breaking change
for your code user. Meaning that he could find himself to edit dozen or hundreds
of line of code.
How can we avoid this protecting our user from creating a code strongly tied to your library internals ?
// message.ts
import { createOpaqueAPI } from '../index';
type $Message = {
userId: string,
text: string,
};
const { toOpaque, fromOpaque } = createOpaqueAPI<
'Message',
$Message,
>('Message');
type Message = ReturnType<typeof toOpaque>;
export function getMessage(): Message {
return toOpaque({ userId: 'userId', text: 'text' });
}
export function clearMessageText(message: Message): Message {
const $message = fromOpaque(message)
return toOpaque({
...$message,
text: '',
});
}
Your user won't be able to write code in same fashion, he will have to ignore the internals of your code.
import { getMessage, clearMessageText } from '../index';
const message = getMessage();
const messageCleared = clearMessageText(message);
This is especially usefull when creating a reusable a library:
[1.0.0]
FAQs
Functional opaque type api for Typescript and Javascript
We found that @fp51/opaque-type demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.