fix(jwks): enforce maxResponseSize while reading the response (#32)

The size limit was applied to the `Content-Length` header and then re-checked
after `res.text()` had resolved. A response without that header — any chunked
reply, which the server chooses — skipped the first check, and by the time the
second one ran the whole body was already in memory. The limit described a
response we had finished buffering rather than one we refused to buffer.

`readCapped` reads the body stream with a running byte count and stops at the
first chunk that crosses the limit, cancelling the remainder so the connection
is not left draining. Falls back to `text()` when the response exposes no
stream.

Measured against a server streaming 40 MiB with a 64 KiB limit configured:
heap growth drops from ~42 MiB to ~1 MiB, and the client disconnects instead
of reading to completion.

Author: ExorTek

.changeset/jwks-response-limit.md

@@ -0,0 +1,11 @@
+---
+'@exortek/jwks': patch
+---
+
+Enforce `maxResponseSize` while the JWKS response is read, rather than after.
+
+The limit was checked against the `Content-Length` header and then again once
+the body had been read in full. A response that omits the header — any chunked
+reply — skipped the first check, so the entire body was already buffered by the
+time the second one ran and the limit had no effect on what was allocated. The
+body is now read incrementally and abandoned as soon as it crosses the limit.

packages/jwks/src/remote.js

@@ -132,13 +132,7 @@ export function createRemoteJWKS(uri, options = {}) {
         );
       }
 
-      const text = await res.text();
-      if (text.length > maxResponseSize) {
-        throw new JwksError(
-          ErrorCode.FETCH_FAILED,
-          `JWKS response from ${uri} exceeds maxResponseSize (${text.length} > ${maxResponseSize})`,
-        );
-      }
+      const text = await readCapped(res, maxResponseSize, uri);
 
       /** @type {unknown} */
       let body;
@@ -312,3 +306,52 @@ export function createRemoteJWKS(uri, options = {}) {
 
   return resolver;
 }
+
+/**
+ * Read a response body as text, refusing to buffer more than `limit`
+ * bytes.
+ *
+ * `Content-Length` is only a hint — it is absent on a chunked response,
+ * and a server chooses whether to send it. Checking it and then calling
+ * `res.text()` therefore enforces nothing: the whole body is already in
+ * memory by the time the size is known. Read the stream instead and stop
+ * at the first chunk that crosses the limit, cancelling the rest so the
+ * connection is not left draining.
+ *
+ * @param {Response} res
+ * @param {number} limit  maximum bytes to buffer
+ * @param {string} uri    for the error message
+ * @returns {Promise<string>}
+ */
+async function readCapped(res, limit, uri) {
+  if (!res.body) {
+    // No stream (an empty body, or a fetch implementation without one) —
+    // `text()` is bounded by whatever is already buffered.
+    return res.text();
+  }
+
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      total += value.byteLength;
+      if (total > limit) {
+        throw new JwksError(
+          ErrorCode.FETCH_FAILED,
+          `JWKS response from ${uri} exceeds maxResponseSize (> ${limit} bytes)`,
+        );
+      }
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel().catch(() => {});
+  }
+
+  return Buffer.concat(chunks).toString('utf8');
+}

packages/jwks/tests/remote.test.js

@@ -181,6 +181,44 @@ describe('resolver — error handling', () => {
     assert.match(err.message, /maxResponseSize/i);
   });
 
+  test('stops reading a response with no content-length once the cap is crossed', async () => {
+    // A chunked reply advertises no length, so the header gate cannot see it.
+    // The body must be capped while it streams, not after it is buffered.
+    const CHUNK = new Uint8Array(32 * 1024);
+    let chunksDelivered = 0;
+    let cancelled = false;
+
+    mockFetch(async () => ({
+      ok: true,
+      status: 200,
+      headers: new Map(),
+      body: {
+        getReader: () => ({
+          read: async () => {
+            chunksDelivered++;
+            return { done: false, value: CHUNK };
+          },
+          cancel: async () => {
+            cancelled = true;
+          },
+        }),
+      },
+      text: async () => {
+        throw new Error('text() must not be used — it would buffer the whole body');
+      },
+    }));
+
+    const resolver = createRemoteJWKS('https://example.com/jwks', { maxResponseSize: 64 * 1024 });
+    const err = await resolver({ kid: 'k1' }).catch(e => e);
+
+    assert.ok(err instanceof JwksError);
+    assert.equal(err.code, ErrorCode.FETCH_FAILED);
+    assert.match(err.message, /maxResponseSize/i);
+    // 64 KiB cap over 32 KiB chunks: two fit, the third crosses it and stops.
+    assert.equal(chunksDelivered, 3, 'must stop at the first chunk past the cap');
+    assert.ok(cancelled, 'the remainder of the stream must be cancelled');
+  });
+
   test('throws FETCH_FAILED on invalid response body', async () => {
     mockFetch(async () => okResponse({ notKeys: [] }));
     const resolver = createRemoteJWKS('https://example.com/jwks');