Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
absync is a highly opinionated framework to synchronize data pools in MEAN applications.
It consists of:
One of the key concepts of absync is that model properties can be decorated with permission requirements that affect the data during transaction, which allows you to hide or change properties when the model is transferred between the server and the client (and vice versa).
Construct domain model and decorate it.
var mongoose = require( "mongoose-q" )();
var Person = require( "./person.js" );
var Schema = mongoose.Schema;
var uuid = require( "node-uuid" );
var TypeDecorator = require( "absync" ).TypeDecorator;
var typeFactory = require( "absync" ).typeFactory;
var TypeInfo = require( "absync" ).TypeInfo;
var typeDescription = {
__v : { type : Number, select : false },
guid : { type : String, default : uuid.v4 },
owner : { type : Schema.Types.ObjectId, ref : "Person" },
added : { type : Date, default : Date.now }
};
new TypeDecorator( typeDescription )
.decorate( "__v", TypeInfo.USERCLASS_USER, TypeInfo.HIDDEN )
.decorate( "guid", TypeInfo.USERCLASS_USER, TypeInfo.READ_ONLY )
.decorate( "added", TypeInfo.USERCLASS_USER, TypeInfo.HIDDEN )
;
var type = typeFactory.assemble( "Device", "devices", typeDescription );
// Extend schema
type.schema.pre( "remove", function( next ) {
// …
} );
absync support model inheritance, through mongoose-schema-extend:
var extendedTypeDescription = {
identifierForVendor : { type : String },
deviceToken : { type : String }
};
new TypeDecorator( extendedTypeDescription )
.decorate( "identifierForVendor", TypeInfo.USERCLASS_USER, [ TypeInfo.HIDDEN, TypeInfo.READ_ONLY ] )
.decorate( "deviceToken", TypeInfo.USERCLASS_USER, [ TypeInfo.CONCEALED, TypeInfo.READ_ONLY ] )
;
var extended = typeFactory.extend( "IosDevice", "Device", extendedTypeDescription );
When data changes, use typehelper to sanitize inputs and conductor to synchronize updates with clients:
module.exports.updateDevice = function( request, response ) {
var device = request.body.device;
var id = request.params.id;
return Device.model.findByIdQ( id )
.then( function( existingDevice ) {
// Update the model with the sent data and persist it to the database.
var updatedDeviceData = Device.typehelper.omitReadOnly( device, Device.typeinfo.USERCLASS_USER );
_.extend( existingDevice, updatedDeviceData );
// Persist the device record.
return existingDevice.saveQ()
.then( function( updatedDevice, numberAffected ) {
// Send HTTP response
conductor.respondToUser( updatedDevice, Device, response );
// Push websocket update
conductor.sendToUsers( updatedDevice, Device );
} );
} );
};
Construct caching services in Angular to hold the data:
var deviceService = absync.CacheServiceFactory( "device", "device", "/api/devices", "/api/device", Device.fromJson );
deviceService.assemble();
Device.fromJson
is supposed to be a function that transforms incoming entities before they are put into the cache.
Services emit entityNew
and entityUpdated
events. The data is contained in their entityCache
member.
FAQs
absync
The npm package absync receives a total of 15 weekly downloads. As such, absync popularity was classified as not popular.
We found that absync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.