feat: precompile cloudevent schema (#471)

* feat: precompile cloudevent schema

This commit modifies the build pipleline so that the cloudevent schema is
precompiled for runtime validation. This eliminates the need to compile the
schema at runtime, improving both performance and security.

Fixes: #423

Signed-off-by: Lance Ball <lball@redhat.com>

.eslintrc

@@ -15,6 +15,7 @@
   "plugins": [
     "header"
   ],
+  "ignorePatterns": ["**/schema/*"],
   "rules": {
     "no-var": "error",
     "standard/no-callback-literal": "off",

.gitignore

@@ -13,6 +13,7 @@ index.js
 /bundles
 /dist
 /docs
+src/schema/v1.js
 
 # Runtime data
 pids

package.json

@@ -5,7 +5,10 @@
   "main": "dist/index.js",
   "scripts": {
     "watch": "tsc --project tsconfig.json --watch",
-    "build": "tsc --project tsconfig.json && tsc --project tsconfig.browser.json && webpack",
+    "build:src": "tsc --project tsconfig.json",
+    "build:browser": "tsc --project tsconfig.browser.json && webpack",
+    "build:schema": "ajv compile -c ./src/schema/formats.js -s src/schema/cloudevent.json --strict-types false -o src/schema/v1.js",
+    "build": "npm run build:schema && npm run build:src && npm run build:browser",
     "lint": "npm run lint:md && npm run lint:js",
     "lint:js": "eslint 'src/**/*.{js,ts}' 'test/**/*.{js,ts}' cucumber.js",
     "lint:md": "remark .",
@@ -106,13 +109,12 @@
   },
   "homepage": "https://github.com/cloudevents/sdk-javascript#readme",
   "dependencies": {
-    "ajv": "~6.12.3",
+    "ajv": "^8.6.3",
     "util": "^0.12.4",
     "uuid": "~8.3.0"
   },
   "devDependencies": {
     "@cucumber/cucumber": "^8.0.0-rc.1",
-    "@types/ajv": "^1.0.0",
     "@types/chai": "^4.2.11",
     "@types/cucumber": "^6.0.1",
     "@types/got": "^9.6.11",
@@ -122,6 +124,8 @@
     "@types/uuid": "^8.0.0",
     "@typescript-eslint/eslint-plugin": "^4.29.0",
     "@typescript-eslint/parser": "^4.29.0",
+    "ajv-cli": "^5.0.0",
+    "ajv-formats": "^2.1.1",
     "axios": "^0.21.3",
     "chai": "~4.2.0",
     "eslint": "^7.32.0",

src/event/spec.ts

@@ -3,28 +3,17 @@
  SPDX-License-Identifier: Apache-2.0
 */
 
-import Ajv, { Options } from "ajv";
 import { ValidationError } from "./validation";
 
 import { CloudEventV1 } from "./interfaces";
-import { schemaV1 } from "./schemas";
 import { Version } from "./cloudevent";
+import validate from "../schema/v1";
 
-const ajv = new Ajv({ extendRefs: true } as Options);
-
-// handle date-time format specially because a user could pass
-// Date().toString(), which is not spec compliant date-time format
-ajv.addFormat("js-date-time", function (dateTimeString) {
-  const date = new Date(Date.parse(dateTimeString));
-  return date.toString() !== "Invalid Date";
-});
-
-const isValidAgainstSchemaV1 = ajv.compile(schemaV1);
 
 export function validateCloudEvent<T>(event: CloudEventV1<T>): boolean {
   if (event.specversion === Version.V1) {
-    if (!isValidAgainstSchemaV1(event)) {
-      throw new ValidationError("invalid payload", isValidAgainstSchemaV1.errors);
+    if (!validate(event)) {
+      throw new ValidationError("invalid payload", (validate as any).errors);
     }
   } else {
     return false;