fix(security): Architecture hardening - input validation & DoS protection

[Sceat]

Summary

Implements critical security fixes identified in the architecture audit:

CRITICAL Fixes (Priority 1)

• Lambda adapter: Added try-catch for JSON.parse() to prevent unhandled exceptions (DoS vector)
• All adapters: Request body validation with 100KB query size limit (prevents memory exhaustion attacks)
• Base handler: build_context timeout wrapper (5s default) prevents hanging requests

Implementation Details

New validation module (src/validation.js):

• validate_request_body(): Validates request structure, type checks, size limits
• with_timeout(): Wrapper function for Promise timeout protection

Updated adapters:

• All 4 adapters (Koa, Fastify, Lambda, TinyHttp) now validate input at entry point
• Early return pattern with null values prevents further processing after validation errors
• Consistent error handling across all adapters

Test-Driven Development:

• Added 6 new tests covering all validation scenarios
• Tests for: JSON parse errors, size limits, timeouts, malformed input
• All tests follow TDD RED → GREEN → REFACTOR cycle

Test Results

✓ 33/33 tests passing
✓ Coverage: 86.68% stmts, 80% branch, 73.68% funcs
✓ All coverage thresholds met (75%+ lines, 70%+ branches/functions)

Security Impact

Addresses the following vulnerabilities:

1. DoS via malformed JSON (Lambda) - CRITICAL
2. Memory exhaustion via large queries - CRITICAL
3. Request hanging via slow context builders - HIGH
4. Type confusion attacks - HIGH

Breaking Changes

None. All changes are backward compatible.

---

🤖 Generated with Claude Code