[GH-ISSUE #193] refactor(application): share bounded JSON traversal logic for workspace and evidence bundle readers #141

New issue

Closed

opened 2026-10-15 18:21:34 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:21:34 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/193

Problem

InvestigationWorkspaceStore and BoundedJsonFiles both enforce EvidenceFilePolicy limits through their own stack-based JSON traversal. The logic is currently duplicated across two modules and has already been the source of a real enforcement bug in one path in this codebase.

Evidence

src/application/BoundedJsonFiles.ts (readBoundedJson)
src/application/InvestigationWorkspaceStore.ts (withinJsonLimits)

Both implementations are separate and easy to drift, so a policy bug can reappear in one consumer without test coverage in the other.

Impact

Risk of inconsistent enforcement of maxDepth / maxNodes / maxStringLength between evidence bundle reads and investigation workspace reads.
Increased maintenance burden as constraints evolve.

Suggested fix

Extract a shared bounded-json validator utility and use it from both modules.
Add regression tests in both read paths to cover nested object/array traversal and depth/node limits.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/193 ## Problem `InvestigationWorkspaceStore` and `BoundedJsonFiles` both enforce `EvidenceFilePolicy` limits through their own stack-based JSON traversal. The logic is currently duplicated across two modules and has already been the source of a real enforcement bug in one path in this codebase. ## Evidence - `src/application/BoundedJsonFiles.ts` (`readBoundedJson`) - `src/application/InvestigationWorkspaceStore.ts` (`withinJsonLimits`) Both implementations are separate and easy to drift, so a policy bug can reappear in one consumer without test coverage in the other. ## Impact - Risk of inconsistent enforcement of `maxDepth` / `maxNodes` / `maxStringLength` between evidence bundle reads and investigation workspace reads. - Increased maintenance burden as constraints evolve. ## Suggested fix - Extract a shared bounded-json validator utility and use it from both modules. - Add regression tests in both read paths to cover nested object/array traversal and depth/node limits.

bsakaguchi

2026-10-15 18:21:34 +00:00