feat: integrate XSLT Tools with toolbox portal

src/transform/transformService.ts

@@ -7,6 +7,21 @@ import type {
   TransformRequest,
   TransformResult,
 } from './transformTypes';
+import {
+  assertTransformInputWithinLimits,
+  assertTransformOutputWithinLimits,
+  withTransformationTimeout,
+} from './transformLimits';
+import { createSha256Hash } from './hash';
+import {
+  isStylesheetExecutionTrusted,
+  type TrustedStylesheet,
+} from './stylesheetTrust';
+
+export interface TransformationAuthorization {
+  trustedStylesheet: TrustedStylesheet;
+  currentRevision: number;
+}
 
 const engines: Record<TransformEngineId, TransformEngine> = {
   'saxon-js-dynamic': saxonJsDynamicEngine,
@@ -18,10 +33,30 @@ export function getTransformEngine(id: TransformEngineId): TransformEngine {
 }
 
 export async function runTransformation(
-  request: TransformRequest
+  request: TransformRequest,
+  authorization: TransformationAuthorization
 ): Promise<TransformResult> {
+  const stylesheetHash = await createSha256Hash(request.xsltText);
+  if (
+    !authorization ||
+    !isStylesheetExecutionTrusted(
+      authorization.trustedStylesheet,
+      stylesheetHash,
+      authorization.currentRevision
+    )
+  ) {
+    throw new Error(
+      'Transformation refused: review and trust this exact stylesheet first.'
+    );
+  }
+
+  assertTransformInputWithinLimits(request);
   const engine = getTransformEngine(request.engine);
-  return engine.transform(request);
+  const result = await withTransformationTimeout(() =>
+    engine.transform(request)
+  );
+  assertTransformOutputWithinLimits(result);
+  return result;
 }
 
 export const availableTransformEngines = Object.values(engines);