@astrale-os/kernel-server 0.5.0-beta.70 → 0.5.0-beta.71

package/dist/routes/routes.js

@@ -139,6 +139,15 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
             const invocation = snapshot.kind === 'release'
                 ? routes.decode(route, native, snapshot.domain, snapshot.references)
                 : routes.legacy.decode(route, native, snapshot.domain, snapshot.table.publication);
+            if (invocation.credentialIn === 'cookie' &&
+                isStateChanging(request) &&
+                isClearlyCrossSite(request, externalOrigin ?? new URL(request.url).origin)) {
+                const refusal = {
+                    code: errors.CODES.ACCESS_DENIED,
+                    message: 'Cross-site cookie-authenticated request to a native route is refused.',
+                };
+                return nativeError(refusal, errors.httpStatusOf(refusal), corsFor);
+            }
             const idempotencyHeader = request.headers.get(protocol.HTTP_IDEMPOTENCY_KEY);
             const idempotencyKey = idempotencyHeader === null
                 ? undefined
@@ -160,8 +169,12 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
             }
             if (result.kind === 'binary') {
                 if (isStreamingBinary(result.value)) {
+                    // Hand the operation off only once the streaming response is built. A refused render
+                    // (reserved header or a body-forbidding status) throws before this point, so the
+                    // `finally` below still settles the operation instead of leaking its slot.
+                    const streaming = streamingBinaryResponse(result.value, operation, cors, request);
                     handedOff = true;
-                    return streamingBinaryResponse(result.value, operation, cors, request);
+                    return streaming;
                 }
                 const applicationHeaders = applicationBinaryHeaders(result.value.headers);
                 return new Response(toBody(result.value.body), {
@@ -215,8 +228,10 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
     });
 }
 function streamingBinaryResponse(binary, operation, cors, request) {
-    const iterator = binary.body[Symbol.asyncIterator]();
+    // Admit the reserved/invalid headers before acquiring the producer, so a refused render never
+    // captures the stream it would then have to abandon.
     const applicationHeaders = applicationBinaryHeaders(binary.headers);
+    const iterator = binary.body[Symbol.asyncIterator]();
     let terminal = false;
     let controller;
     let stopping;
@@ -269,14 +284,22 @@ function streamingBinaryResponse(binary, operation, cors, request) {
         },
     });
     operation.onCancel(stop);
-    return new Response(body, {
-        status: binary.status ?? 200,
-        headers: {
-            ...cors.response(request, Object.keys(applicationHeaders)),
-            ...applicationHeaders,
-            'content-type': binary.mediaType,
-        },
-    });
+    try {
+        return new Response(body, {
+            status: binary.status ?? 200,
+            headers: {
+                ...cors.response(request, Object.keys(applicationHeaders)),
+                ...applicationHeaders,
+                'content-type': binary.mediaType,
+            },
+        });
+    }
+    catch (cause) {
+        // A body-forbidding status (e.g. 204) rejects the Response after the producer was wired:
+        // close it and let the caller settle the operation rather than leaking its slot.
+        void stop('Binary response was refused.');
+        throw cause;
+    }
 }
 function isStreamingBinary(input) {
     return !(input.body instanceof Uint8Array);
@@ -542,6 +565,41 @@ function sameRoute(left, right, externalOrigin) {
     const b = new URL(right);
     return ((externalOrigin ?? a.origin) === b.origin && a.pathname === b.pathname && a.search === b.search);
 }
+/**
+ * A request that mutates state or navigates to an effectful target. Non-safe HTTP methods always
+ * qualify; a GET or HEAD qualifies only as a top-level browser navigation (`Sec-Fetch-Mode:
+ * navigate`), the one GET shape that carries SameSite=Lax cookies cross-site. Programmatic GETs
+ * (`cors`/`no-cors`) are left untouched so read clients are never broken.
+ */
+function isStateChanging(request) {
+    switch (request.method.toUpperCase()) {
+        case 'POST':
+        case 'PUT':
+        case 'PATCH':
+        case 'DELETE':
+            return true;
+        case 'GET':
+        case 'HEAD':
+            return request.headers.get('sec-fetch-mode') === 'navigate';
+        default:
+            return false;
+    }
+}
+/**
+ * Positive evidence that a request originates from another site. `Sec-Fetch-Site` is set by the
+ * browser and cannot be forged by page script, so when present it is authoritative: only
+ * `cross-site` is refused, and `same-origin`/`same-site`/`none` are trusted (a shared-domain
+ * subdomain deployment keeps working). When it is absent, a differing `Origin` is the next-best
+ * signal. Absence of both is treated as not-cross-site, so same-origin browsers and non-browser
+ * clients that omit these headers are never refused.
+ */
+function isClearlyCrossSite(request, serviceOrigin) {
+    const site = request.headers.get('sec-fetch-site');
+    if (site !== null)
+        return site === 'cross-site';
+    const origin = request.headers.get('origin');
+    return origin !== null && origin !== serviceOrigin;
+}
 function applicationBinaryHeaders(input) {
     const output = {};
     for (const [name, value] of Object.entries(input ?? {})) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-server",
-  "version": "0.5.0-beta.70",
+  "version": "0.5.0-beta.71",
   "description": "Portable HTTP and WebSocket boundary for Astrale invocation, publication, installation, and issuer protocols",
   "license": "Apache-2.0",
   "repository": {
@@ -33,9 +33,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.62",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.44",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.68",
+    "@astrale-os/kernel-core": "0.9.0-beta.63",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.45",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.69",
     "hono": "^4.6.20"
   },
   "devDependencies": {