[martijnwalraven]

capnweb-validate tags every error it throws when it refuses a value, or a call to a method that a validated surface does not list, but exports nothing that reads the tag. A server that wants to treat a refused call apart from its own failures, to log it as a refusal and redact everything else, has to match the message prefix capnweb-validate: , which any error can carry, including one a peer sends on purpose.

This exports isValidationError(error) from capnweb-validate and capnweb-validate/capnweb. It reads the tag the validator already sets. The tag stays on the error object in the process that refused, so it is readable where Cap'n Web hands a server the error it is about to send, in a session's onSendError, and not on the caller's side, which receives a plain TypeError with the message and enumerable properties only. The tag is now a Symbol.for symbol, as the wrapped-method marker already is, so a second bundled copy of the package recognizes it too; it is not a security boundary, since it never crosses the wire.

Tested in validation-error.test.ts: a refusal and a missing method are told from a TypeError with the same message prefix, and a real MessageChannel session's onSendError sees the tag while the caller does not. Documented under Validation errors in guides/validation.mdx.

Changeset: minor for capnweb-validate.

Context: we hold the untrusted side of a Cap'n Web session in a browser page and log its refusals as refused calls. We met this gap while telling those refusals by the message prefix; our code has since moved to marking the refusals it raises itself, so nothing of ours waits on this, but anyone who uses the package's own class wrapping still has only the prefix to go on.

[changeset-bot]

🦋 Changeset detected

Latest commit: e161971

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
capnweb-validate	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[martijnwalraven]

I have read the CLA Document and I hereby sign the CLA.