@antelopejs/dms-frontend 0.1.5 → 0.1.7

package/dist/workspace-setup.js

@@ -9,6 +9,7 @@ exports.setupWorkspace = setupWorkspace;
 const node_child_process_1 = require("node:child_process");
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const layers_1 = require("./layers");
 const manifest_1 = require("./manifest");
@@ -50,15 +51,77 @@ function installDeps(workspaceDir) {
         stdio: "inherit",
     });
 }
+const FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+const CHILD_SHUTDOWN_TIMEOUT_MS = 5000;
+function exitCodeForSignal(signal) {
+    const number = node_os_1.constants.signals[signal];
+    return 128 + (typeof number === "number" ? number : 15);
+}
 function runCommand(command, args, options) {
+    const isWindows = process.platform === "win32";
     return new Promise((resolve, reject) => {
         const child = (0, node_child_process_1.spawn)(command, args, {
             stdio: "inherit",
-            shell: true,
+            shell: isWindows,
             ...options,
         });
-        child.on("error", (error) => reject(error));
-        child.on("exit", (code) => resolve(code || 0));
+        let escalation;
+        let forwarded;
+        const alive = () => child.exitCode === null && child.signalCode === null;
+        const stopChild = (signal) => {
+            if (!alive())
+                return;
+            try {
+                child.kill(isWindows ? "SIGTERM" : signal);
+            }
+            catch {
+            }
+            if (escalation || isWindows)
+                return;
+            escalation = setTimeout(() => {
+                if (alive()) {
+                    try {
+                        child.kill("SIGKILL");
+                    }
+                    catch {
+                    }
+                }
+            }, CHILD_SHUTDOWN_TIMEOUT_MS);
+            escalation.unref();
+        };
+        const onSignal = (signal) => {
+            forwarded = signal;
+            stopChild(signal);
+        };
+        const onParentExit = () => {
+            if (alive()) {
+                try {
+                    child.kill("SIGKILL");
+                }
+                catch {
+                }
+            }
+        };
+        for (const signal of FORWARDED_SIGNALS)
+            process.on(signal, onSignal);
+        process.on("exit", onParentExit);
+        const cleanup = () => {
+            if (escalation)
+                clearTimeout(escalation);
+            for (const signal of FORWARDED_SIGNALS)
+                process.off(signal, onSignal);
+            process.off("exit", onParentExit);
+        };
+        child.on("error", (error) => {
+            cleanup();
+            reject(error);
+        });
+        child.on("exit", (code, signal) => {
+            cleanup();
+            if (code !== null)
+                return resolve(code);
+            resolve(exitCodeForSignal(signal ?? forwarded ?? "SIGTERM"));
+        });
     });
 }
 async function setupWorkspace(opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",
@@ -82,7 +82,7 @@
     "vue-i18n": "^11.2.7"
   },
   "peerDependencies": {
-    "@antelopejs/core": ">=1.6.0 <3"
+    "@antelopejs/core": ">=1.7.0 <2"
   },
   "peerDependenciesMeta": {
     "@antelopejs/core": {

package/templates/vue/server/auth/client-ip.mjs

@@ -50,3 +50,17 @@ export function clientIp(request) {
   const chain = [...forwarded, socketIp];
   return chain[Math.max(0, chain.length - hops - 1)] ?? socketIp;
 }
+
+/**
+ * Body answered with the 403 of the CSRF origin check.
+ *
+ * The check itself is unchanged: a state-changing request must carry an
+ * `Origin` matching the frontend's own. The `reason` only makes the refusal
+ * diagnosable, since a bare `{"error":"Forbidden"}` on `POST /auth/login`
+ * looks exactly like bad credentials to an API client that simply forgot
+ * the header (curl, a server-side integration, a test harness).
+ */
+export const CROSS_ORIGIN_ERROR = Object.freeze({
+  error: "Forbidden",
+  reason: "missing or untrusted Origin header",
+});

package/templates/vue/server/auth/routes.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { backend, body, json, UpstreamError } from "./backend.mjs";
-import { isSameOrigin } from "./client-ip.mjs";
+import { CROSS_ORIGIN_ERROR, isSameOrigin } from "./client-ip.mjs";
 import {
   oauthCallback,
   oauthHandoff,
@@ -288,8 +288,7 @@ export async function handleAuth(request, response, url) {
       response.setHeader("allow", "GET, POST, DELETE");
       return json(response, 405, { error: "Method Not Allowed" });
     }
-    if (!isSameOrigin(request))
-      return json(response, 403, { error: "Forbidden" });
+    if (!isSameOrigin(request)) return json(response, 403, CROSS_ORIGIN_ERROR);
     return request.method === "DELETE"
       ? logout(request, response)
       : refresh(request, response);
@@ -301,8 +300,9 @@ export async function handleAuth(request, response, url) {
     return match[2] === "start"
       ? oauthStart(request, response, match[1], url)
       : oauthCallback(request, response, match[1], url);
-  if (request.method !== "POST" || !isSameOrigin(request))
-    return json(response, 403, { error: "Forbidden" });
+  if (request.method !== "POST")
+    return json(response, 403, { error: "Forbidden", reason: "POST required" });
+  if (!isSameOrigin(request)) return json(response, 403, CROSS_ORIGIN_ERROR);
   if (url.pathname === "/auth/oauth/handoff")
     return oauthHandoff(request, response);
   const endpoint = PASSTHROUGH.get(url.pathname);

package/templates/vue/server/tester.mjs

@@ -1,5 +1,5 @@
 import { body, json, RequestBodyError } from "./auth/backend.mjs";
-import { isSameOrigin } from "./auth/client-ip.mjs";
+import { CROSS_ORIGIN_ERROR, isSameOrigin } from "./auth/client-ip.mjs";
 import { readSession } from "./auth/session.mjs";
 
 const RESPONSE_LIMIT = 64 * 1024;
@@ -206,8 +206,7 @@ export async function handleTester(request, response) {
     response.setHeader("allow", "POST");
     return json(response, 405, { error: "Method Not Allowed" });
   }
-  if (!isSameOrigin(request))
-    return json(response, 403, { error: "Forbidden" });
+  if (!isSameOrigin(request)) return json(response, 403, CROSS_ORIGIN_ERROR);
   try {
     const session = readSession(request);
     if (!session?.accessToken)

package/templates/vue/server.mjs

@@ -11,7 +11,7 @@ import {
 } from "node:zlib";
 import { ofetch } from "ofetch";
 import { RequestBodyError, UpstreamError } from "./server/auth/backend.mjs";
-import { isSameOrigin } from "./server/auth/client-ip.mjs";
+import { CROSS_ORIGIN_ERROR, isSameOrigin } from "./server/auth/client-ip.mjs";
 import {
   handleAuth,
   publicSession,
@@ -242,7 +242,7 @@ export function requestOwnership(method, pathname) {
 async function proxy(request, response, fallbackOnNotFound = false) {
   if (!SAFE_METHODS.has(request.method) && !isSameOrigin(request)) {
     response.writeHead(403, { "content-type": JSON_TYPE });
-    response.end(JSON.stringify({ error: "Forbidden" }));
+    response.end(JSON.stringify(CROSS_ORIGIN_ERROR));
     return true;
   }
   const target = new URL(request.url, process.env.DMS_API_BASE_URL);