@anteros/core 0.0.19 → 0.0.20

package/database/decorator.ts

@@ -10,7 +10,7 @@ export function CheckIfCollectionExists(): any {
             return descriptor;
         }
         const originalMethod = descriptor.value;
-        descriptor.value = async function (...args: any[]) {
+        descriptor.value = async function (this: any, ...args: any[]) {
             let collection = args[0];
             let col = getCollection(collection, this.tenant_id)
             if (!col) {

package/database/mongodbadapter.ts

@@ -42,18 +42,22 @@ class MongoRest {
         if (options.session) {
             this.session = options.session;
         }
-        let tenant = getTenant(options?.tenant_id ?? '-')
-        if (options.tenant_id && tenant) {
+        // Resolve tenant: explicit tenant_id, else from request context
+        let tenantId = options.tenant_id;
+        if (!tenantId) {
+            tenantId = requestCtxStorage.get<string>('tenant_id');
+        }
+        let tenant = getTenant(tenantId ?? '-')
+        if (tenant) {
             this.#tenant = tenant;
             this.tenant_id = tenant.id;
             this.db = tenant.database.db as Db;
             this.client = tenant.database.client as MongoClient;
         }
-
     }
 
 
-    private _validate(options: { collection: string, action?: ActionsApiList, data?: any, update?: UpdateFilter<any> }) {
+    private _validate(options: { collection: string, action?: ActionsApiList, data?: any, update?: UpdateFilter<any> }): any {
         let col = getCollection(options.collection, this.#tenant.id)
         let schema = col?._schema_
         let partialSchema = col?._schemaPartial_
@@ -77,6 +81,7 @@ class MongoRest {
 
             if (options?.data) {
                 if (options.action == 'insertMany') {
+                    const sanitized: any[] = [];
                     for (let i = 0; i < options.data.length; i++) {
                         validationResult = schema.validate(options.data[i], { allowUnknown: false })
                         if (validationResult?.error) {
@@ -85,9 +90,9 @@ class MongoRest {
                                 status: 400
                             })
                         }
-                        // Apply Joi defaults (e.g., .default() values) back to data
-                        options.data[i] = validationResult.value
+                        sanitized.push(validationResult.value)
                     }
+                    return sanitized;
                 }
 
                 if (options.action == 'insertOne') {
@@ -98,8 +103,8 @@ class MongoRest {
                             status: 400
                         })
                     }
-                    // Persist Joi defaults back to data
-                    if (validationResult.value) options.data = validationResult.value
+                    // Return sanitized value (Joi defaults applied, unknown keys handled)
+                    return validationResult.value;
                 }
             }
 
@@ -117,22 +122,35 @@ class MongoRest {
                     validationResult = partialSchema.validate(options.update.$setOnInsert, { allowUnknown: false })
                 }
 
+                // Faille 9: updateOne/updateMany — unflatten dot-notation ("address.zip") before Joi validation
+                if ((options.action == 'updateOne' || options.action == 'updateMany') && options.update?.$set) {
+                    const unflattened = func.unflattenKeys(options.update.$set)
+                    validationResult = partialSchema.validate(unflattened, { allowUnknown: false })
+                    if (validationResult?.error) {
+                        throw new AppError(validationResult.error.message, {
+                            code: 'VALIDATION_ERROR',
+                            status: 400
+                        })
+                    }
+                    // Write sanitized (nested) value back — MongoDB accepts nested objects
+                    if (validationResult.value) {
+                        options.update.$set = validationResult.value
+                    }
+                }
+
                 if (validationResult?.error) {
                     throw new AppError(validationResult.error.message, {
                         code: 'VALIDATION_ERROR',
                         status: 400
                     })
                 }
+                return validationResult?.value;
             }
 
         }
     }
 
-
-
-    }
-
-    private async #logActivity(data: {
+    async #logActivity(data: {
         action: string,
         collection: string,
         input?: any,
@@ -189,7 +207,7 @@ class MongoRest {
         await this.audit.addActivities([activity])
     }
 
-    private async #executeWithAudit<T>(
+    async #executeWithAudit<T>(
         action: string,
         collection: string,
         input: any,
@@ -254,7 +272,17 @@ class MongoRest {
         try {
 
             const col = getCollection(collection, this.#tenant.id) as Collection
-            const isSafe = func.isSafeAggregatePipeline(pipeline);
+            // Faille 12: restrict $lookup targets to this tenant's declared collections
+            const allowedCollections = [
+                ...(cfg.collections ?? [])
+                    .filter(c => c._tenant_ === this.tenant_id)
+                    .map(c => c.slug),
+                ...(cfg.fileCollections ?? [])
+                    .filter(fc => fc._tenant_ === this.tenant_id)
+                    .map(fc => fc.slug),
+                '_activities_', '_locks_', '_workflows_',
+            ];
+            const isSafe = func.isSafeAggregatePipeline(pipeline, allowedCollections);
             if (!isSafe.isSafe) {
                 throw isSafe.error;
             }
@@ -362,7 +390,7 @@ class MongoRest {
                 await col.hooks.beforeOperation({ rest: this, io, action, meta })
             }
             // Validate AFTER hooks (they may fill required fields or apply Joi defaults)
-            this._validate({ collection, action: action, data: meta.data })
+            meta.data = this._validate({ collection, action: action, data: meta.data })
 
             await this.db.collection(collection).insertOne(func.toBson(meta.data, { col }) as any, {
                 session: this.session,
@@ -400,7 +428,7 @@ class MongoRest {
                 await col.hooks.beforeOperation({ rest: this, io, action, meta })
             }
             // Validate AFTER hooks (they may fill required fields or apply Joi defaults)
-            this._validate({ collection, action: action, data: meta.data })
+            meta.data = this._validate({ collection, action: action, data: meta.data })
 
             await this.db.collection(collection).insertMany(func.toBson(meta.data, { col }) as any, {
                 session: this.session,
@@ -429,15 +457,13 @@ class MongoRest {
             }
 
             update = await func.buildInput(update)
+            this._validate({ collection, action: action, update: update })
+            update = func.toBson(update, { col })
 
             const meta: any = { action, collection, update, id: _id }
             if (col.hooks?.beforeOperation) {
                 await col.hooks.beforeOperation({ rest: this, io, action, meta })
             }
-            // Validate and toBson AFTER hooks
-            update = meta.update;
-            this._validate({ collection, action: action, update: update })
-            update = func.toBson(update, { col })
 
             const data = await this.db.collection(collection).findOneAndUpdate(
                 { _id: new ObjectId(_id) },
@@ -493,18 +519,16 @@ class MongoRest {
             }
 
 
-            const meta: any = { action, collection, filter, update }
-            if (col.hooks?.beforeOperation) {
-                await col.hooks.beforeOperation({ rest: this, io, action, meta })
-            }
-            // Validate and toBson AFTER hooks
-            update = meta.update;
-            filter = meta.filter;
             this._validate({ collection, action: action, update: update.$set })
             this._validate({ collection, action: action, update: update.$setOnInsert })
             update = func.toBson(update, { col })
             filter = func.toBson(filter, { col })
 
+            const meta: any = { action, collection, filter, update }
+            if (col.hooks?.beforeOperation) {
+                await col.hooks.beforeOperation({ rest: this, io, action, meta })
+            }
+
             const data = await this.db.collection(collection).findOneAndUpdate(
                 filter,
                 {
@@ -536,15 +560,13 @@ class MongoRest {
                 update.$set = await func.buildInput(update.$set, { action: action, col: col })
             }
             update = await func.buildInput(update)
+            this._validate({ collection, action: action, update: update })
+            update = func.toBson(update, { col })
 
             const meta: any = { action, collection, update, ids: _ids }
             if (col.hooks?.beforeOperation) {
                 await col.hooks.beforeOperation({ rest: this, io, action, meta })
             }
-            // Validate and toBson AFTER hooks
-            update = meta.update;
-            this._validate({ collection, action: action, update: update })
-            update = func.toBson(update, { col })
 
             const result = await this.db.collection(collection).updateMany(
                 { _id: { $in: _ids.map(id => new ObjectId(id)) } },
@@ -761,14 +783,14 @@ class MongoRest {
 
         const token = requestCtxStorage.get<{ value: string | null, decoded: Record<string, unknown> | null, provided: boolean, expired: boolean }>('token')
 
-        return await col.actions?.[action]({
+        return await col.actions?.[action]?.({
             rest: this,
-                    io,
+            io,
             data,
             error: fn.error,
             jwt: func.jwt,
-            token: token ?? { value: null, decoded: null },
-        })
+            token: token ?? { value: null, decoded: null, provided: false, expired: false },
+        } as any)
     }
 
     async runService<T = any>(service: string, action: string, data?: any): Promise<T> {
@@ -785,15 +807,14 @@ class MongoRest {
 
         const token = requestCtxStorage.get<{ value: string | null, decoded: Record<string, unknown> | null, provided: boolean, expired: boolean }>('token')
 
-        return await serviceInstance.actions?.[action]({
+        return await serviceInstance.actions?.[action]?.({
             data,
             error: fn.error,
             io,
             jwt: func.jwt,
             token: token ?? { value: null, decoded: null, provided: false, expired: false },
             rest: this,
-                    io,
-        })
+        } as any)
     }
 
     async stats() {
@@ -910,8 +931,8 @@ class MongoRest {
 
         try {
             const result = await this.db.collection('_locks_').findOneAndUpdate(
-                { _id: id, expiresAt: { $lt: now } },
-                { $set: { _id: id, tid: this.tenant_id, name, acquiredAt: now, expiresAt } },
+                { _id: id as any, expiresAt: { $lt: now } },
+                { $set: { tid: this.tenant_id, name, acquiredAt: now, expiresAt } },
                 { upsert: true, returnDocument: 'after' }
             );
             if (!result) {

package/lib/files.ts

@@ -53,7 +53,8 @@ export function createDiskStorage(baseDir?: string): FileStorage {
       const filename = `${meta.id}${ext}`;
       const filepath = path.join(dir, filename);
       const buffer = await file.arrayBuffer();
-      await fs.writeFile(filepath, new Uint8Array(buffer));
+      // Faille 17: 'wx' — fail if file already exists (no silent overwrite)
+      await fs.writeFile(filepath, new Uint8Array(buffer), { flag: 'wx' });
       const outPath = subpath ? `${subpath}/${filename}` : `${tenant_id}/${collection}/${filename}`;
       return { path: outPath, size: buffer.byteLength };
     },
@@ -146,6 +147,15 @@ async function transformImage(
   const format = options.format || 'webp';
   const quality = options.quality ?? 80;
 
+  // Faille 20: validate params (reject NaN / out-of-range)
+  if (!Number.isFinite(quality) || quality < 1 || quality > 100) {
+    throw new AppError('Invalid quality parameter', { code: 'INVALID_TRANSFORM', status: 400 });
+  }
+  if ((options.width != null && (!Number.isFinite(options.width) || options.width <= 0))
+    || (options.height != null && (!Number.isFinite(options.height) || options.height <= 0))) {
+    throw new AppError('Invalid width/height parameter', { code: 'INVALID_TRANSFORM', status: 400 });
+  }
+
   // Convertir ReadableStream en Uint8Array si nécessaire
   let buffer: Uint8Array;
   if (input instanceof Uint8Array) {
@@ -167,6 +177,12 @@ async function transformImage(
     }
   }
 
+  // Faille 20: only transform real images (magic bytes check)
+  const detected = detectMimeFromBuffer(buffer);
+  if (!detected || !detected.startsWith('image/')) {
+    throw new AppError('Not an image file', { code: 'NOT_AN_IMAGE', status: 400 });
+  }
+
   // Utiliser Bun.Image (natif, zéro dépendance)
   const img = new Bun.Image(buffer);
 
@@ -249,6 +265,28 @@ export async function handleUpload(options: UploadOptions): Promise<FileResult>
     });
   }
 
+  // Faille 4: validate magic bytes — don't trust client-declared Content-Type
+  const fullBuffer = new Uint8Array(await file.arrayBuffer());
+  const probe = fullBuffer.subarray(0, 4096);
+  const detected = detectMimeFromBuffer(probe);
+  const declaredMime = mimetype.toLowerCase();
+  const isImageDeclared = declaredMime.startsWith('image/');
+  const isImageDetected = detected?.startsWith('image/') ?? false;
+
+  // Reject content that lies about being an image (e.g. HTML/JS uploaded as image/png)
+  if (isImageDeclared && !isImageDetected) {
+    throw new AppError(`File content does not match declared MIME type '${mimetype}'`, {
+      code: 'MIMETYPE_MISMATCH', status: 400,
+    });
+  }
+
+  // Hardening: block SVG with embedded script (stored XSS)
+  if (detected === 'image/svg+xml' && svgContainsScript(probe)) {
+    throw new AppError('SVG with executable content is not allowed', {
+      code: 'SVG_SCRIPT_NOT_ALLOWED', status: 400,
+    });
+  }
+
   // Validate file size
   const maxSize = col.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
   if (file.size > maxSize) {
@@ -358,20 +396,39 @@ export async function handleServe(
   fileId: string,
   filename: string,
   transform?: TransformOptions,
-): Promise<{ stream: ReadableStream; mimetype: string; size?: number } | null> {
+): Promise<{ stream: ReadableStream; mimetype: string; size?: number; attachment?: boolean } | null> {
   const storage = getStorageForCollection(collection, tenant_id);
   const col = getFileCollection(collection, tenant_id);
   const subpath = col?.storage?.path || undefined;
   const stream = await storage.getStream(tenant_id, collection, fileId, filename, subpath);
   if (!stream) return null;
 
-  let mimetype = getMimeType(filename);
+  // Faille 10: serve the MIME validated at upload time (content-checked),
+  // not re-derived from the extension.
+  let mimetype: string | undefined;
+  try {
+    const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
+    const doc = await rest.db.collection(collection).findOne(
+      { _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any },
+      { projection: { '_file.mimetype': 1 } },
+    );
+    mimetype = (doc as any)?._file?.mimetype;
+  } catch {}
+
+  // Fallback: extension-derived MIME only when nothing stored
+  mimetype = mimetype || getMimeType(filename);
+  const isSvg = mimetype === 'image/svg+xml';
 
   if (transform && (transform.width || transform.height || transform.format)) {
     const { data, mimetype: newMime } = await transformImage(stream, transform);
     return { stream: new ReadableStream({ start(controller) { controller.enqueue(data); controller.close(); } }), mimetype: newMime, size: data.length };
   }
 
+  // Faille 4: SVG is served as an attachment (never inline) to prevent stored XSS
+  if (isSvg) {
+    return { stream, mimetype, attachment: true };
+  }
+
   return { stream, mimetype };
 }
 
@@ -389,6 +446,44 @@ function getMimeType(filename: string): string {
   return map[ext] || 'application/octet-stream';
 }
 
+/**
+ * Detect a file's real type from its magic bytes.
+ * Returns null when unknown. Used to prevent content spoofing (XSS via SVG etc).
+ */
+export function detectMimeFromBuffer(buf: Uint8Array): string | null {
+  const head = (offset: number, len: number) =>
+    String.fromCharCode(...buf.slice(offset, offset + len));
+  const hex = (offset: number, len: number) =>
+    Array.from(buf.slice(offset, offset + len)).map(b => b.toString(16).padStart(2, '0')).join('');
+
+  // JPEG: FF D8 FF
+  if (hex(0, 3) === 'ffd8ff') return 'image/jpeg';
+  // PNG: 89 50 4E 47
+  if (hex(0, 4) === '89504e47') return 'image/png';
+  // GIF: GIF87a / GIF89a
+  if (head(0, 4) === 'GIF8') return 'image/gif';
+  // WebP: RIFF....WEBP
+  if (head(0, 4) === 'RIFF' && head(8, 4) === 'WEBP') return 'image/webp';
+  // AVIF: ftypavif / ftypavis at offset 4
+  if (hex(4, 4) === '66747970' && (head(8, 4) === 'avif' || head(8, 4) === 'avis')) return 'image/avif';
+  // BMP: BM
+  if (head(0, 2) === 'BM') return 'image/bmp';
+  // PDF: %PDF
+  if (head(0, 4) === '%PDF') return 'application/pdf';
+  // ZIP (docx/xlsx/etc): PK\x03\x04
+  if (hex(0, 4) === '504b0304') return 'application/zip';
+  // SVG: XML declaration or <svg — MUST be served as attachment
+  const text = new TextDecoder().decode(buf.subarray(0, 2048));
+  if (/^\s*(<\?xml|<!DOCTYPE|<svg)/i.test(text)) return 'image/svg+xml';
+  return null;
+}
+
+/** True if the file content contains executable script (used for SVG hardening) */
+function svgContainsScript(buf: Uint8Array): boolean {
+  const text = new TextDecoder().decode(buf.subarray(0, 65536)); // first 64KB is enough
+  return /<script|onload\s*=|onerror\s*=|javascript:/i.test(text);
+}
+
 export async function handleDelete(
   tenant_id: string,
   collection: string,
@@ -403,7 +498,7 @@ export async function handleDelete(
   try {
     const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
     const doc = await rest.db.collection(collection).findOne(
-      { _id: ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId },
+      { _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any },
       { projection: { '_file.filename': 1 } },
     );
     filename = doc?._file?.filename;
@@ -426,7 +521,7 @@ export async function handleDelete(
   try {
     const rest = new useRest({ tenant_id, internal: true, useHook: false, useCustomApi: false });
     await rest.db.collection(collection).deleteOne({
-      _id: ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId,
+      _id: (ObjectId.isValid(fileId) ? new ObjectId(fileId) : fileId) as any,
     });
   } catch (err: any) {
     console.error('Failed to delete file metadata:', err?.message || err);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "type": "module",
   "description": "Anteros Core",
   "private": false,
@@ -21,7 +21,7 @@
     "bentocache": "1.6.1",
     "boxen": "^8.0.1",
     "dayjs": "1.11.21",
-    "hono": "4.13.0",
+    "hono": "^4.13.1",
     "ioredis": "6.0.0",
     "joi": "18.2.3",
     "jose": "6.2.8",

package/server/api.ts

@@ -1,4 +1,4 @@
-import type { Hono } from "hono"
+import type { Hono, Context } from "hono"
 import { cfg, safePublicConfig } from "./config";
 import type { ApiOptions } from "../types/api";
 import { getCollection } from "../database/collection";
@@ -244,11 +244,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
     }
 
     // ─── Collection API ─────────────────────────────────────────────────
-    app.post(API_PREFIX, async (c) => {
+    app.post(API_PREFIX, async (c: Context<{ Variables: HonoVariables }>) => {
         let response: any;
         let body: any;
         let rest: InstanceType<typeof useRest>;
-        let canAccessToAction: boolean | undefined;
 
         try {
             const ContentType = c.req.header('Content-Type');
@@ -274,6 +273,9 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
 
+            // Store tenant in request context so nested useRest() calls (hooks, actions) resolve it
+            requestCtxStorage.set('tenant_id', tenant_id);
+
             const col = getCollection(collection, tenant_id)
             if (!col) {
                 throw new AppError('Collection `' + collection + '` not found', { status: 400, code: 'COLLECTION_NOT_FOUND' });
@@ -344,27 +346,8 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
 
             // ── Access control ──
-            const access = col?.api?.access as Record<string, boolean | Function> | undefined;
-
-            if (access?.['*'] !== undefined && access?.[action] === undefined) {
-                if (typeof access['*'] === 'function') {
-                    canAccessToAction = await access['*']({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-                } else {
-                    canAccessToAction = access['*'] as boolean;
-                }
-                if (canAccessToAction !== true) throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-            }
-
-            if (access?.[action] !== undefined) {
-                canAccessToAction = typeof access[action] === 'function'
-                    ? await (access[action] as Function)({ rest, error: fn.error, jwt: func.jwt, token: accessToken })
-                    : access[action] as boolean;
-                if (canAccessToAction !== true) throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-            }
-
-            if (canAccessToAction !== true) {
-                throw new AppError('Unauthorized', { status: 401, code: 'ACCESS_DENIED_TO_PERFORM_THIS_ACTION' });
-            }
+            // Faille 7: single implementation via evaluateAccess (checks expired/forged tokens)
+            await evaluateAccess(col?.api?.access as any, action, rest, 'Action', c);
 
             // ── Execute action ──
             if (col.actions?.[action]) {
@@ -415,6 +398,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             const { service, tenant_id } = c.req.param() as { service: string, tenant_id: string };
             if (!tenant_id) throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
             if (!service) throw new AppError('Service is required', { status: 400, code: 'SERVICE_REQUIRED' });
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const serviceInstance = cfg.services?.find(s => s.name === service && s._tenant_ === tenant_id) as Service;
             const { action } = c.req.param() as { action: string };
@@ -457,6 +441,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colUpload = getFileCollection(collection, tenant_id);
             if (!colUpload) {
@@ -469,6 +454,16 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Content-Type must be multipart/form-data', { code: 'INVALID_CONTENT_TYPE', status: 400 });
             }
 
+            // Faille 11: reject oversized bodies BEFORE parseBody buffers them in memory
+            const contentLength = Number(c.req.header('Content-Length') ?? 0);
+            const maxUploadSize = colUpload.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
+            // multipart overhead (boundaries/headers) ≈ 64KB max
+            if (Number.isFinite(contentLength) && contentLength > 0 && contentLength > maxUploadSize + 64 * 1024) {
+                throw new AppError(`Request too large (max ${Math.round(maxUploadSize / 1024 / 1024)}MB)`, {
+                    code: 'FILE_TOO_LARGE', status: 413,
+                });
+            }
+
             const formData = await c.req.parseBody();
             const fileField = formData['file'] || formData['upload'];
             if (!fileField || !(fileField instanceof File)) {
@@ -498,6 +493,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colServe = getFileCollection(collection, tenant_id);
             if (!colServe) {
@@ -505,10 +501,12 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
             await checkFileAccess(colServe?.api?.access as any, 'read', tenant_id, c);
 
-            const filename = basename(c.req.param('file') as string);
-            if (!filename || filename.startsWith('.') || filename.includes('..') || filename.includes('/')) {
+            // Faille 18: validate the RAW path before basename (checks were dead code)
+            const rawFile = c.req.param('file') as string;
+            if (!rawFile || rawFile.startsWith('.') || rawFile.includes('..') || rawFile.includes('/') || rawFile.includes('\\')) {
                 throw new AppError('Invalid filename', { status: 400, code: 'INVALID_FILENAME' });
             }
+            const filename = basename(rawFile);
             const fileId = filename.replace(/\.[^.]+$/, '');
 
             const query = c.req.query();
@@ -529,6 +527,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             c.header('Content-Type', result.mimetype);
             if (result.size) c.header('Content-Length', String(result.size));
             c.header('Cache-Control', 'public, max-age=31536000, immutable');
+            // Faille 4: SVG served as attachment (no inline execution)
+            if (result.attachment) {
+                c.header('Content-Disposition', `attachment; filename="${filename}"`);
+            }
             return c.newResponse(result.stream);
         } catch (err: any) {
             if (cfg?.debug) console.error(err)
@@ -544,6 +546,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colDelete = getFileCollection(collection, tenant_id);
             if (!colDelete) {
@@ -567,7 +570,8 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
     // ─── Public config ──────────────────────────────────────────────────
     app.get('/_dnax/config/:tenant_id', (c) => {
         const t = c.get('token');
-        if (!t?.value) {
+        // Faille 6: require a VERIFIED, non-expired token (not just any provided value)
+        if (!t?.decoded || t?.expired || !t?.provided) {
             return c.json({ message: 'Authentication required', code: 'AUTH_REQUIRED' }, 401);
         }
         const { tenant_id } = c.req.param() as { tenant_id: string };

package/server/boot.ts

@@ -17,6 +17,7 @@ import { loadServices } from '../lib/services'
 import { loadSockets } from '../lib/sockets'
 import { syncWorkflows } from '../lib/workflow'
 import { loadTenantsMiddlewares } from '../lib/middleware'
+import crypto from 'node:crypto';
 
 /** Check if a TCP port is already bound */
 async function isPortInUse(port: number): Promise<boolean> {
@@ -55,9 +56,8 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
         const hasAuth = cfg.collections?.some((c: any) => c.api?.auth?.enabled);
         let jwtSecret = cfg.server.jwt?.secret || Bun.env.JWT_SECRET;
         if (hasAuth && !jwtSecret) {
-            jwtSecret = Array.from({ length: 64 }, () =>
-                'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_'[Math.floor(Math.random() * 64)]
-            ).join('');
+            // CSPRNG: crypto.randomBytes (not Math.random — predictable)
+            jwtSecret = crypto.randomBytes(48).toString('base64url');
             try {
                 const envPath = '.env';
                 const exists = await Bun.file(envPath).exists();

package/server/hono.ts

@@ -114,11 +114,15 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
 
 
 
+            const requestCtx: Record<string, string> = c.req.header();
+            // Faille 1: never log sensitive headers (JWT, cookies)
+            delete requestCtx.authorization;
+            delete requestCtx.cookie;
             requestCtxStorage.set('meta', {
                 request: {
                     ip: connInfo.remote.address ?? c.req.header('CF-Connecting-IP') ?? c.req.header('True-Client-IP') ?? c.req.header('X-Forwarded-For') ?? 'unknown',
                     user_agent: c.req.header('User-Agent') ?? '',
-                    headers: c.req.header(),
+                    headers: requestCtx,
                     method: c.req.method,
                     path: c.req.path,
                     query: c.req.query(),
@@ -129,15 +133,14 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
             })
             const bearer = c.req.header('Authorization')?.replace('Bearer ', '');
             if (bearer) {
-                const { value, error } = await jwt.verify(bearer);
+                const { value, error, expired } = await jwt.verify(bearer);
                 const isValid = !error && value != null;
-                const isExpired = !!error && error.toLowerCase().includes('exp');
 
                 const tokenData = {
-                    value: bearer,
+                    value: isValid ? bearer : null,
                     decoded: isValid ? (value as Record<string, unknown>) : null,
                     provided: true,
-                    expired: isExpired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
+                    expired: expired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
                 };
 
                 requestCtxStorage.set('token', tokenData);

package/tests/api.test.ts

@@ -11,6 +11,7 @@ let rest: InstanceType<typeof useRest>;
 
 beforeAll(async () => {
     formatConfig({
+        server: { port: 4000 },
         tenants: [{ id: TEST_TENANT, dir: "src", database: { uri: TEST_DB } }],
     });
     await syncTenants();
@@ -45,7 +46,7 @@ describe("insertOne", () => {
         expect(doc._id.length).toBe(24);
     });
     it("sets createdAt and updatedAt", async () => {
-        const doc = await rest.insertOne("items", { title: "ts" });
+        const doc: any = await rest.insertOne("items", { title: "ts" });
         expect(doc.createdAt).toBeString();
         expect(doc.updatedAt).toBeString();
     });
@@ -84,8 +85,8 @@ describe("findOne", () => {
 
 describe("updateOne", () => {
     it("$set title and changes updatedAt", async () => {
-        const doc = await rest.insertOne("items", { title: "old" });
-        const upd = await rest.updateOne("items", doc._id, { $set: { title: "new" } });
+        const doc: any = await rest.insertOne("items", { title: "old" });
+        const upd: any = await rest.updateOne("items", doc._id, { $set: { title: "new" } });
         expect(upd.title).toBe("new");
         expect(upd.updatedAt).not.toBe(doc.updatedAt);
     });
@@ -93,17 +94,18 @@ describe("updateOne", () => {
 
 describe("deleteOne", () => {
     it("deletes and returns _id", async () => {
-        const doc = await rest.insertOne("items", { title: "del-me" });
-        expect((await rest.deleteOne("items", doc._id))._id).toBe(doc._id);
+        const doc: any = await rest.insertOne("items", { title: "del-me" });
+        const deleted: any = await rest.deleteOne("items", doc._id);
+        expect(deleted?._id).toBe(doc._id);
     });
 });
 
 describe("insertMany", () => {
     it("inserts and returns array with _id", async () => {
-        const docs = await rest.insertMany("items", [{ title: "m1" }, { title: "m2" }]);
+        const docs: any[] = await rest.insertMany("items", [{ title: "m1" }, { title: "m2" }]);
         expect(docs.length).toBe(2);
-        expect(docs[0]._id).toBeString();
-        expect(docs[1]._id).toBeString();
+        expect(docs[0]!._id).toBeString();
+        expect(docs[1]!._id).toBeString();
     });
 });
 
@@ -173,7 +175,7 @@ describe("bulkUpdate", () => {
 
 describe("stats", () => {
     it("returns collection stats", async () => {
-        const s = await rest.stats("items");
+        const s: any = await rest.stats();
         expect(s).toBeDefined();
         expect(typeof s).toBe("object");
     });
@@ -184,7 +186,7 @@ describe("audit", () => {
         await rest.audit.addActivities([{
             internal: false,
             trace: { id: crypto.randomUUID() },
-            request: null,
+            request: undefined,
             meta: {},
             operation: {
                 tenant: TEST_TENANT,
@@ -199,7 +201,7 @@ describe("audit", () => {
             },
             ts: new Date(),
         }]);
-        const activities = await rest.audit.getActivities({ $limit: 10 });
+        const activities = await rest.audit.getActivities({ $match: {}, $limit: 10 });
         expect(Array.isArray(activities)).toBe(true);
         expect(activities.length).toBeGreaterThanOrEqual(1);
     });
@@ -266,7 +268,7 @@ describe("transactions", () => {
 
 describe("watch", () => {
     it("returns a change stream", async () => {
-        const stream = await rest.watch("items", [{ $match: { operationType: "insert" } }]);
+        const stream = await rest.watch("items", [{ $match: { operationType: "insert" } }], {} as any);
         expect(stream).toBeDefined();
         await stream.close();
     });

package/tests/ts1011-test.ts

@@ -0,0 +1,15 @@
+import type { Document, ChangeStreamOptions, ChangeStream } from "mongodb";
+
+export class Test {
+  #tenant!: { id: string };
+  @Check()
+  async watch(collection: string, pipeline: any[], options: ChangeStreamOptions): Promise<ChangeStream> {
+    return undefined as any;
+  }
+  @Check()
+  async find(collection: string, params: any = {}, options = {}): Promise<Document[]> {
+    return [];
+  }
+}
+
+function Check() { return (target: any, key: string) => {} }

package/types/api.d.ts

@@ -32,6 +32,17 @@ export type ActionsApiList =
     | "login"
     | "logout"
     | "aggregate"
+    | "watch"
+    | "countDocuments"
+    | "bulkWrite"
+    | "bulkUpdate"
+    | "replaceOne"
+    | "findOneAndUpdate"
+    | "dropCollection"
+    | "dropIndex"
+    | "dropIndexes"
+    | "stats"
+    | "workflows"
     | "*"
 
 

package/utils/func.ts

@@ -36,7 +36,7 @@ const jwt = {
         const token = await signer.sign(secret);
         return token;
     },
-    verify: async (token: string): Promise<{ value: Record<string, unknown> | null, error: string | null }> => {
+    verify: async (token: string): Promise<{ value: Record<string, unknown> | null, error: string | null, expired: boolean }> => {
         try {
             if (!token) throw new Error('Token is required');
             let SECRET_ = cfg.server.jwt?.secret || Bun.env.JWT_SECRET
@@ -45,12 +45,17 @@ const jwt = {
             const { payload, protectedHeader } = await Jose.jwtVerify(token, secret);
             return {
                 value: payload,
-                error: null
+                error: null,
+                expired: false,
             }
-        } catch (error) {
+        } catch (error: any) {
+            // Reliable expiry detection via jose error code (not string matching)
+            const isExpired = error?.code === 'ERR_JWT_EXPIRED'
+                || /expired|expiration/i.test(error?.message ?? '');
             return {
                 value: null,
-                error: error instanceof Error ? error.message : 'Invalid token'
+                error: error instanceof Error ? error.message : 'Invalid token',
+                expired: isExpired,
             }
         }
     }
@@ -152,6 +157,48 @@ function pick<T extends DeepRecord>(data: T | T[], keys: string[]): Partial<T> |
     return result as Partial<T>;
 }
 
+/**
+ * Convertit la dot-notation MongoDB en structure imbriquée pour la validation Joi.
+ * Ex: { "address.zip": "BP28", "items.0.name": "x" } → { address: { zip }, items: [{ name }] }
+ * Les clés opérateurs ($inc, $push…) sont laissées telles quelles.
+ */
+function unflattenKeys(input: Record<string, unknown>): Record<string, unknown> {
+    const result: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(input)) {
+        // Opérateurs Mongo → laisser tel quel (interdits dans $set de toute façon)
+        if (key.startsWith('$')) {
+            result[key] = value;
+            continue;
+        }
+        const parts = key.split('.');
+        let target: any = result;
+        for (let i = 0; i < parts.length - 1; i++) {
+            const part = parts[i]!;
+            const nextPart = parts[i + 1]!;
+            const isArrayIndex = /^\d+$/.test(nextPart);
+            if (typeof target[part] !== 'object' || target[part] === null) {
+                target[part] = isArrayIndex ? [] : {};
+            }
+            target = target[part];
+        }
+        const last = parts[parts.length - 1]!;
+        // Fusion si les deux côtés sont des objets (ex. "a.b" + a: { c })
+        if (
+            target[last] &&
+            typeof target[last] === 'object' &&
+            !Array.isArray(target[last]) &&
+            typeof value === 'object' &&
+            value !== null &&
+            !Array.isArray(value)
+        ) {
+            target[last] = { ...(target[last] as object), ...(value as object) };
+        } else {
+            target[last] = value;
+        }
+    }
+    return result;
+}
+
 function toJson<T>(data: any): T {
     if (data === null || data === undefined) return data;
     try {
@@ -645,12 +692,34 @@ function buildPipeline(p: FindOptions, options?: {
                 status: 400
             });
         }
+        // Faille 13: bound $regex (ReDoS) and $in/$nin (memory DoS)
+        boundMatchOperators(p.$match);
         pipeline.push({
             $match: p.$match
         })
     }
 
-    // $sort
+    // $sort — Faille 14: values must be 1 or -1
+    if (p?.$sort) {
+        for (const [key, dir] of Object.entries(p.$sort)) {
+            if (dir !== 1 && dir !== -1) {
+                throw new AppError(`Invalid $sort direction for '${key}' (expected 1 or -1)`, {
+                    code: 'INVALID_SORT_DIRECTION',
+                    status: 400
+                });
+            }
+        }
+    }
+
+    // $skip — Faille 14: must be a safe non-negative integer
+    if (p?.$skip !== undefined && p?.$skip !== null) {
+        if (!Number.isSafeInteger(p.$skip) || p.$skip < 0) {
+            throw new AppError('Invalid $skip (expected a non-negative integer)', {
+                code: 'INVALID_SKIP',
+                status: 400
+            });
+        }
+    }
     if (!p?.$sort?.createdAt) {
         pipeline.push({
             $sort: {
@@ -664,20 +733,25 @@ function buildPipeline(p: FindOptions, options?: {
         })
     }
 
-    // $skip
+    // $skip (validated above)
     if (p?.$skip) {
         pipeline.push({
             $skip: p.$skip
         })
     }
 
-    // $limit
+    // $limit — Faille 14: must be a safe integer in (0, MAX_LIMIT]; 0 would mean "no limit"
+    const MAX_LIMIT = 1000;
     p.$limit = p?.$limit ?? 100
-    if (p?.$limit > 0) {
-        pipeline.push({
-            $limit: p.$limit
-        })
+    if (!Number.isSafeInteger(p.$limit) || p.$limit <= 0 || p.$limit > MAX_LIMIT) {
+        throw new AppError(`Invalid $limit (expected an integer between 1 and ${MAX_LIMIT})`, {
+            code: 'INVALID_LIMIT',
+            status: 400
+        });
     }
+    pipeline.push({
+        $limit: p.$limit
+    })
 
     // $include
     if (p?.$include && Array.isArray(p?.$include)) {
@@ -742,6 +816,17 @@ function buildPipeline(p: FindOptions, options?: {
 
                 let as = include.as || include.localField
 
+                // Faille 3: never trust client-supplied $lookup sub-pipeline — scan it
+                if (include.pipeline && Array.isArray(include.pipeline)) {
+                    const check = isSafeAggregatePipeline(include.pipeline as Array<Record<string, unknown>>)
+                    if (!check.isSafe) {
+                        throw check.error ?? new AppError('Unauthorized $include pipeline', {
+                            code: 'UNAUTHORIZED_PIPELINE_KEYS',
+                            status: 400
+                        })
+                    }
+                }
+
                 pipeline.push({
                     $lookup: {
                         from: include.from,
@@ -807,6 +892,46 @@ function clone<T>(data: T): T {
     return data_
 }
 
+/**
+ * Faille 13: bounds dangerous $match operators to prevent ReDoS ($regex) and memory DoS ($in).
+ * Walks nested objects/arrays ($and, $or, $nor, dotted fields).
+ */
+const MAX_REGEX_LENGTH = 1000;
+const MAX_IN_ARRAY_SIZE = 10000;
+
+function boundMatchOperators(node: unknown): void {
+    if (node === null || node === undefined) return;
+
+    if (Array.isArray(node)) {
+        for (const item of node) {
+            boundMatchOperators(item);
+        }
+        return;
+    }
+
+    if (typeof node === 'object') {
+        const obj = node as Record<string, unknown>;
+        for (const [key, value] of Object.entries(obj)) {
+            if (key === '$regex' && typeof value === 'string') {
+                if (value.length > MAX_REGEX_LENGTH) {
+                    throw new AppError(`$regex pattern too long (max ${MAX_REGEX_LENGTH} chars)`, {
+                        code: 'REGEX_TOO_LONG',
+                        status: 400
+                    });
+                }
+            } else if ((key === '$in' || key === '$nin') && Array.isArray(value)) {
+                if (value.length > MAX_IN_ARRAY_SIZE) {
+                    throw new AppError(`$in/$nin too large (max ${MAX_IN_ARRAY_SIZE} items)`, {
+                        code: 'ARRAY_OPERATOR_TOO_LARGE',
+                        status: 400
+                    });
+                }
+            }
+            boundMatchOperators(value);
+        }
+    }
+}
+
 
 
 
@@ -1007,14 +1132,18 @@ function countAggregatePipelineStages(pipeline: unknown): number {
 }
 
 
-function isSafeAggregatePipeline(pipeline: Array<Record<string, unknown>>): {
+function isSafeAggregatePipeline(pipeline: Array<Record<string, unknown>>, allowedCollections?: string[]): {
     isSafe: boolean;
     forbiddenKeys: string[];
     error: AppError | null;
 } {
 
-    // Unauthorized pipeline keys
-    const UNAUTHORIZED_PIPELINE_KEYS = ['$out', '$merge', '$function', '$where', '$accumulator'];
+    // Unauthorized pipeline keys — Faille 12: include cross-collection exfiltration stages
+    const UNAUTHORIZED_PIPELINE_KEYS = [
+        '$out', '$merge', '$function', '$where', '$accumulator',
+        '$unionWith', '$collStats', '$indexStats', '$planCacheStats',
+        '$currentOp', '$listLocalSessions', '$listSessions', '$changeStream',
+    ];
     const forbiddenFound = hasUnauthorizedKeys(pipeline, UNAUTHORIZED_PIPELINE_KEYS);
     if (forbiddenFound.length > 0) {
         return {
@@ -1024,6 +1153,28 @@ function isSafeAggregatePipeline(pipeline: Array<Record<string, unknown>>): {
         }
     }
 
+    // Faille 12: restrict $lookup / $graphLookup targets to declared tenant collections
+    if (allowedCollections && allowedCollections.length > 0) {
+        const badTargets: string[] = [];
+        walkAggregatePipeline(pipeline, (stage) => {
+            const lookup = (stage as any).$lookup;
+            if (lookup?.from && !allowedCollections.includes(lookup.from)) {
+                badTargets.push(lookup.from);
+            }
+            const graph = (stage as any).$graphLookup;
+            if (graph?.from && !allowedCollections.includes(graph.from)) {
+                badTargets.push(graph.from);
+            }
+        });
+        if (badTargets.length > 0) {
+            return {
+                isSafe: false,
+                forbiddenKeys: badTargets,
+                error: new AppError('Unauthorized $lookup target collection: ' + [...new Set(badTargets)].join(', '), { code: 'UNAUTHORIZED_LOOKUP_TARGET', status: 400 })
+            };
+        }
+    }
+
     // $project avec renommage : racine + imbriqué ($facet, $lookup.pipeline, …)
     let renameForbiddenKeys: string[] = [];
     let renameError: AppError | null = null;
@@ -1066,6 +1217,7 @@ export {
     reorder,
     omit,
     pick,
+    unflattenKeys,
     toJson,
     stringToBoolean,
     cleanDeep,