Protect multiple RSA requesters from each other

[gigabo]

If two ReactServerAgent requests are made to a given endpoint only one upstream http request is actually issued, and the result is provided to both requesters. Previously this result was passed by reference, so mutations by one requester interfered with the data for others.

This patch provides a fresh deep copy to each requester.

This has the unfortunate side effect of introducing a deep copy in the browser where we previously thought we could get away without one. It's a minor perf hit, but it's important for data integrity.

[roblg]

This seems significant enough (and subtle enough) to warrant adding some tests too, I think? No better way to prevent future regressions than enforcing it in code!

[roblg]

I apparently can't leave comments willy-nilly in this file, but should we do the same thing for error responses (line ~209)

[gigabo]

Yeah, it's annoying that you can click to see those lines but can't comment on them. 👿

[gigabo]

Nice catch, didn't realize those were handled separately. 👍

[doug-wade]

Rather than pass a different mutable copy to each requester, why not pass a single immutable reference to each requester?

[gigabo]

@doug-wade How would that work?

[doug-wade]

If we were willing to add a library for immutability, it'd be really simple

const Immutable = import("immutable");
this.dfd.resolve(Immutable.map(res));

If instead we wanted to roll our own, we could do a recursive freeze:

this.dfd.resolve(deepFreeze(res));

function deepFreeze (o) {
  Object.freeze(o);

  Object.keys(o).forEach((prop) => {
    if (typeof o[prop] === "object") {
      deepFreeze(o[prop]);
    }
  });
  
  return o;
}

[gigabo]

@doug-wade I see. That would be a pretty big breaking change.

Worth discussing, but I'd still like to get a fix for the bug out in the meanwhile. 🐛

[drewpc]

don't we need to parse the JSON in both the if and else blocks?

[gigabo]

Oh, probably. 😁

Nice catch @drewpc!

[drewpc]

Seems like there's more work and it's failing the tests. Should I close the PR for now?

[gigabo]

It's not dead yet! It could pull through!

[gigabo]

don't we need to parse the JSON in both the if and else blocks?

Good call. Done.

should we do the same thing for error responses

I don't think so, actually. Error responses are less likely to be mutated, and their handling is out of band.

adding some tests

The coverage here was already pretty good (thanks @roblg), so I just modified existing tests to verify that values are deeply equal, but not references.

So... how about it? 😁