@acms-subir/core 0.3.48 → 0.3.49

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @acms-subir/core
 
+## 0.3.49
+
+### Patch Changes
+
+- a25078e: Amazon SES delivery webhooks and the apps now reach the site. Astro's cross-site form check (`security.checkOrigin`, on by default) refused them on every built site with `403 Cross-site POST form submissions are forbidden`, before ACMS saw the request. It doesn't run in `astro dev`, which is why nobody noticed:
+
+  - **SES:** Amazon SNS posts to `/api/email/webhooks/ses` as `text/plain` without an Origin header. SES deliveries, bounces and complaints were never recorded, bounced addresses weren't suppressed, and the SNS subscription could never be confirmed. Resend and Mailgun send JSON and weren't affected.
+  - **Apps:** apps send no Origin either, so every app request with no body, or a form body, was refused. With the published `@acms-subir/client`, that's turning notifications off (`unregisterDevice`, so the phone stayed registered and kept getting pushes), unlinking a staff phone, cancelling or confirming a booking, and guest sign-out. Editor apps couldn't sign in, refresh or sign out, upload media, or delete a resource, booking link, time block or calendar.
+
+  ACMS now runs the check itself, first thing in its middleware, and turns Astro's copy off. Anything a page on another site can post with a visitor's cookies gets exactly Astro's answer, as before. That covers a POST whose Origin isn't the site's, or that has none, when its body is a form, `text/plain` or missing, to admin pages, Actions, public forms, member pages and the APIs. A unit test compares the two rules on every combination of method, Origin, Content-Type, headers and route that such a page can send. What goes through now:
+
+  - requests a browser only sends to another site after asking it first (PUT, PATCH and DELETE, and requests with `Authorization: Bearer …` or `Booking-Token`). ACMS's CORS answers never let cookies ride along. Basic auth doesn't count, since browsers add it to form posts on their own.
+  - `/api/email/webhooks/[provider]`, which checks the provider's signature.
+  - the editor apps' OAuth form posts to `/api/v1/auth/token` and `/api/v1/auth/revoke`, which carry their own code or token and never use cookies.
+
+  The check now also runs in `astro dev`, so local work and the e2e suites see what a built site does. A site that set `security: { checkOrigin: false }` in `astro.config` keeps it off everywhere. If a dev server behind a proxy starts refusing your own admin forms, the proxy's Host doesn't match the browser's Origin.
+
+  Sites with their own signature-checked webhooks (an SMS or payment provider that posts form data) can list those route patterns in `acms({ signedRoutes: ['/api/sms/[event]'] })`. Admin pages, Astro's own routes and ACMS's routes can't be listed.
+
+  After updating, nothing needs to change, and apps work again without an update. On a site that uses SES, check the SNS topic's subscription to `https://<site>/api/email/webhooks/ses`. If it isn't "Confirmed", choose **Request confirmation**, or create it again if SNS has removed it. The site now confirms it.
+
 ## 0.3.48
 
 ### Patch Changes

package/integration.mjs

@@ -465,6 +465,22 @@ function resolveAnnouncements(announcements, reserved) {
   if (announcements.pages !== undefined && typeof announcements.pages !== 'boolean') throw new Error('acms: announcements.pages must be true or false');
   return { enabled: true, base, pages: announcements.pages ?? true, topics: { ...topics } };
 }
+// acms({ signedRoutes }): the site's own routes that take posts from other
+// servers and check the sender's signature themselves, so the cross-site
+// form check skips them (lib/origin-check.ts). Route patterns as Astro writes
+// them. Admin pages, Astro's own routes (/_actions…) and core's routes can't
+// be listed (acms() checks the last against its route table).
+function resolveSignedRoutes(routes) {
+  if (routes === undefined) return [];
+  if (!Array.isArray(routes) || routes.length > 20) throw new Error('acms: signedRoutes must be a list of at most 20 route patterns, e.g. [\'/api/sms/[event]\']');
+  return routes.map((r, i) => {
+    if (!isSitePath(r) || /[?#*]/.test(r) || r.endsWith('/')) {
+      throw new Error(`acms: signedRoutes[${i}] must be a route pattern such as "/api/sms/[event]" (no query, wildcard or trailing slash) — got "${r}"`);
+    }
+    if (/^\/(admin|_)/.test(r)) throw new Error(`acms: signedRoutes[${i}] "${r}" is an admin or Astro route — those always keep the cross-site check`);
+    return r;
+  });
+}
 function resolveRoles(roles, members) {
   if (roles === undefined) return [];
   if (!Array.isArray(roles)) throw new Error('acms: roles must be an array of { key, label } objects');
@@ -691,6 +707,15 @@ function acmsVitePlugin(userConfig) {
  *   `topics` picks the push topic each kind starts with in the composer, e.g.
  *   `{ registration: 'registrations', help: 'help' }` (otherwise a topic named
  *   after the kind, such as `events` or `help`, else everyone).
+ * @param {string[]} [options.signedRoutes]
+ *   The site's own routes that receive posts from another server and check
+ *   its signature themselves (an SMS or payment provider's webhook), as route
+ *   patterns, e.g. `['/api/sms/[event]']`. ACMS refuses cross-site form posts
+ *   the way Astro's `security.checkOrigin` does (it takes that check over);
+ *   these routes skip it, since such senders send no Origin header and often
+ *   post form data or text/plain. List only routes that verify a signature.
+ *   Admin pages, Actions and ACMS's own routes can't be listed; ACMS's email
+ *   webhooks already skip it.
  * @returns {import('astro').AstroIntegration}
  */
 export default function acms(options = {}) {
@@ -713,6 +738,7 @@ export default function acms(options = {}) {
   const roles = resolveRoles(options.roles, members);
   const permissions = resolvePermissions(options.permissions, roles);
   const maps = resolveMaps(options.maps);
+  const signedRoutes = resolveSignedRoutes(options.signedRoutes);
   const legal = { enabled: true, operatorName: '', contactEmail: '', address: '', country: '', updatedAt: '', ...(options.legal === false ? { enabled: false } : options.legal ?? {}) };
   if (typeof legal.enabled !== 'boolean' || ['operatorName','contactEmail','address','country','updatedAt'].some(k => typeof legal[k] !== 'string')) throw new Error('acms: invalid legal configuration');
   legal.country = legal.country.trim().toUpperCase();
@@ -909,6 +935,9 @@ export default function acms(options = {}) {
       [`${members.base}/events/[id]`, 'members/events/[id].astro'],
     );
   }
+  // core's own routes keep the check (its signed webhooks are listed in lib/origin-check.ts)
+  const builtIn = signedRoutes.find((r) => routes.some(([pattern]) => pattern === r));
+  if (builtIn) throw new Error(`acms: signedRoutes "${builtIn}" is an ACMS route — list only the site's own routes`);
   let cacheDir = '';
   return {
     name: 'acms',
@@ -920,6 +949,14 @@ export default function acms(options = {}) {
           mkdirSync(discoveryDir, {recursive:true});
           writeFileSync(join(discoveryDir,'acms-project.json'), JSON.stringify({ themeApiVersion:1, collections:userConfig.content.collections, calendar:userConfig.calendar, mobile:userConfig.mobile ?? {}, roles:userConfig.roles, permissions:userConfig.permissions, members:userConfig.members }));
         }
+        // Astro's CSRF origin check (security.checkOrigin, on by default) runs
+        // before any middleware and no route can opt out, so signed webhooks
+        // from other servers and the apps got its 403. Core's middleware runs
+        // the same rule for what a browser can send instead (lib/origin-check.ts).
+        // A site that turned the check off in astro.config keeps it off.
+        const originCheck = config.security?.checkOrigin !== false;
+        userConfig.originCheck = { enabled: originCheck, signedRoutes };
+        if (originCheck) updateConfig({ security: { checkOrigin: false } });
         updateConfig({ vite: { plugins: [acmsVitePlugin(userConfig)] } });
 
         // Installed from npm, core's admin islands are source files inside

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.48",
+  "version": "0.3.49",
   "publishConfig": {
     "access": "public"
   },

package/src/lib/origin-check.ts

@@ -0,0 +1,54 @@
+import { userConfig } from 'virtual:acms-config';
+
+// Astro's CSRF origin check (security.checkOrigin), taken over by core.
+// Astro's own copy runs before any middleware and no route can opt out of it,
+// so requests that never come from a browser on another site were refused
+// too: Amazon SNS posts SES bounces as text/plain with no Origin header, and
+// the apps send none either. integration.mjs turns Astro's copy off and the
+// middleware runs this one first instead, in dev as well as on built sites.
+//
+// The rule is Astro 5's for anything a page on another site can send: a POST
+// whose Origin isn't this site's (or that has none) is refused when its body
+// is form-like (form-urlencoded, multipart, text/plain) or it has no
+// Content-Type. JSON and other types need a CORS preflight and pass. What
+// passes besides: the routes below, and requests a browser only sends to
+// another site after a preflight (preflighted()).
+
+const SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+const FORM_TYPES = ['application/x-www-form-urlencoded', 'multipart/form-data', 'text/plain'];
+
+// Routes whose senders are servers that send no Origin and prove who they are
+// with a signature the route checks itself (lib/email/webhooks.ts), keyed by
+// route pattern as Astro matched it, so a lookalike path never qualifies. A
+// site adds its own with acms({ signedRoutes }).
+export const SIGNED_ROUTES = new Set([
+  '/api/email/webhooks/[provider]',
+  ...(userConfig.originCheck?.signedRoutes ?? []),
+]);
+
+// The editor apps' OAuth endpoints (RFC 6749): form posts that carry their
+// own code, refresh token or token to revoke, and never use cookies.
+export const TOKEN_ROUTES = new Set(['/api/v1/auth/token', '/api/v1/auth/revoke']);
+
+// A request no browser sends to another site without asking it first (a CORS
+// preflight; ACMS never allows credentials in one, so no cookie rides along):
+// any method but POST, or one carrying an app's own credential, a bearer
+// token or a booking token. Basic auth doesn't count: a browser adds that to
+// a form post by itself.
+export function preflighted(request: Request): boolean {
+  return request.method !== 'POST' || /^bearer\s/i.test(request.headers.get('authorization') ?? '') || request.headers.has('booking-token');
+}
+
+// a site that set security.checkOrigin: false itself keeps the check off
+export const ORIGIN_CHECK = { enabled: userConfig.originCheck?.enabled !== false };
+
+type CheckedContext = { request: Request; url: URL; routePattern: string; isPrerendered: boolean };
+
+/** Astro's 403 for a cross-site form submission, or null when the request may go on. */
+export function crossSiteRefusal({ request, url, routePattern, isPrerendered }: CheckedContext): Response | null {
+  if (!ORIGIN_CHECK.enabled || isPrerendered || SAFE_METHODS.includes(request.method)) return null;
+  if (request.headers.get('origin') === url.origin || SIGNED_ROUTES.has(routePattern) || TOKEN_ROUTES.has(routePattern) || preflighted(request)) return null;
+  const type = request.headers.get('content-type');
+  if (type !== null && !FORM_TYPES.some((form) => type.toLowerCase().includes(form))) return null;
+  return new Response(`Cross-site ${request.method} form submissions are forbidden`, { status: 403 });
+}

package/src/middleware.ts

@@ -15,6 +15,7 @@ import { processPushQueue, runPushJobs } from './lib/push/service';
 import { previewParamRedirect, hasPreviewCookie } from './lib/designPreview';
 import { applyCachePolicy } from './lib/cache/policy';
 import { bindExecutionContext, syncCachePurge } from './lib/cache/purge';
+import { crossSiteRefusal } from './lib/origin-check';
 
 // Legacy content-URL redirects, checked only on would-be 404s (below) so they
 // can never shadow real content. Tags moved from `${base}/tag/` to a
@@ -81,6 +82,10 @@ export const onRequest = defineMiddleware(async (context, next) =>
 
 async function handle(context: APIContext, next: MiddlewareNext): Promise<Response> {
   const { pathname } = context.url;
+  // cross-site form submissions, before anything else runs (Astro's own
+  // check, which signed webhooks and the apps couldn't pass: lib/origin-check.ts)
+  const refused = crossSiteRefusal(context);
+  if (refused) return refused;
   bindAuthEnvironment(context.request, context.locals);
   bindExecutionContext(context.request, context.locals);
 

package/src/virtual.d.ts

@@ -24,6 +24,8 @@ declare module 'virtual:acms-config' {
     permissions?: { key: string; label: string; description: string; defaults: string[]; sensitive: boolean }[];
     members?: { enabled: boolean; base: string; notify: string[] };
     announcements?: { enabled: boolean; base: string; pages: boolean; topics: Partial<Record<'event' | 'registration' | 'help' | 'info', string>> };
+    // set in astro:config:setup (lib/origin-check.ts): off only when the site turned security.checkOrigin off
+    originCheck?: { enabled: boolean; signedRoutes: string[] };
     // resolved by integration.mjs (lib/calendar/config.ts documents the shape)
     calendar?: {
       enabled: boolean;