
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
contracts-js
Advanced tools
Contracts.js is a contract library for JavaScript that allows you to specify invariants between parts of your code and have them checked at runtime for violations.
It is used in the CoffeeScript dialect contracts.coffee but can also be used directly in normal JavaScript programs if you don't want to or can't use CoffeeScript.
This library is possible because of and requires Proxies which is a new feature of JavaScript that is currently only implemented in Firefox 4+ and chrome/V8 with the experimental javascript flag enabled
(in about:flags or use the --harmony
flag on the command line).
To use include these files:
This adds a Contracts
object to the global scope that has two properties Contracts.contracts
(which contains some prebuilt contracts to use) and Contracts.combinators
(which contains utility functions to build new contracts).
We can now wrap a function in a contract like so:
var C = contracts,
id = C.guard(
C.fun(C.Num, C.Num),
function(x) { return x; });
id("foo"); // contract violation!
If you would like to load all of the combinators into the global scope, just run contracts.autoload()
.
More documentation and rational can be found at the sister project contracts.coffee.
Guards a value with a contract
Contracts.guard :: (Contract, Any, Str?, Str?) -> { use: () -> Any }
Contracts.guard(contract, value [, server[, client]])
Creates a contract that checks first-order values (i.e. not functions or objects).
Contracts.check :: ((Any) -> Bool, Str) -> Contract
Contracts.check(predicate, name)
This is used to build contracts that get applied to values via the guard
function. The guard
function handles calling the predicate supplied to check
at the appropriate time.
An example of a contract to check for numbers:
Contracts.check(function(x) {
return typeof(x) === 'number';
}, 'Number')
Contracts.fun :: (Contract or [...Contract],
((Any) -> Contract) or Contract,
{
callOnly: Bool
newOnly: Bool
pre: (Any) -> Bool
post: (Any) -> Bool
this: {...}
}) -> Contract
Contracts.fun(domain, range, options)
new
is used with the functionnew
is not used with the functionthis
objectDependent function contracts (where the result depends on the argument values) are handled by using a function as the range
. When the function returns its argument values are first passed to the range
function which should return a contract. This contract is then used to check the original function's result.
As a contrived example:
Contracts.fun(Str, function(x) {
if(x === 42) {
return Contracts.Num;
} else {
return Contracts.Str;
}
})
If the function contracted is called with 42
then its result must be a Num
otherwise it must be a Str
.
Note that arguments are potentially mutable (they might be one value at the beginning of the function and different when the function returns) so keep that in mind when using dependent contracts.
Contracts.object :: ({ ... },
{
extensible: Bool
sealed: Bool
frozen: Bool
invariant: (Any) -> Bool
}) -> Contract
Contracts.object(object, options)
Object contracts are built with an object that maps properties to objects. Example:
Contracts.object({
foo: Str,
bar: Num
})
In this case the contracted object must have both the foo
and bar
properties (if missing, a contract violation is thrown at contract application time) and these properties must abide by their respective contracts (which are checked each time the property is changed).
Object invariants can be checked with the invariant option. Whenever any property is changed the invariant function is called with a reference to the object. If the invariant returns false a contract violation is thrown.
FAQs
A contract library for JavaScript
The npm package contracts-js receives a total of 2 weekly downloads. As such, contracts-js popularity was classified as not popular.
We found that contracts-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.