@becklyn/deployment-protection 0.4.0 → 0.4.2

package/README.md

@@ -26,9 +26,9 @@ npm i @becklyn/deployment-protection
 
 ### Storybook (static on Vercel)
 
-Built Storybook is static (`storybook-static`), so protection is **Vercel Edge Middleware** — not a Storybook addon.
+Built Storybook is static (`storybook-static`), so protection is **Vercel Routing Middleware** — not a Storybook addon.
 
-1. Install the package in the project that deploys Storybook.
+1. Install the package in the project that deploys Storybook (published build, or workspace package after `npm run build`).
 2. Add `middleware.ts` at the **Vercel project root** (same level Vercel uses for `vercel.json` / output):
 
 ```ts
@@ -42,7 +42,7 @@ export const config = {
 ```
 
 3. Set the same environment variables as for Next.js (below).
-4. Optional `vercel.json` for a Storybook-only project:
+4. `vercel.json` for a Storybook-only project — **`framework` must be `null`** (Other). Do **not** use the Vercel “Storybook” framework preset; it sets `disableRootMiddleware` and skips middleware entirely:
 
 ```json
 {
@@ -54,6 +54,8 @@ export const config = {
 
 `withStorybookDeploymentProtection` does **not** require the `next` package. The matcher must stay a **string literal** in `middleware.ts` (same static-analysis rule as Next.js).
 
+Prefer the default **edge** runtime. `runtime: "nodejs"` is supported as well — both resolve to a self-contained ESM bundle (`dist/storybook.mjs` / `dist/edge.mjs`) so Vercel does not need to trace the multi-file tsc graph.
+
 Framework-agnostic alias (same implementation):
 
 ```ts
@@ -212,10 +214,20 @@ x-vercel-protection-bypass: <VERCEL_AUTOMATION_BYPASS_SECRET>
 
 Or query:
 
+```text
+https://app.example/?x-vercel-protection-bypass=<secret>
+```
+
+A valid bypass query param redirects to the same path without the secret and sets the signed `__becklyn_dp_session` cookie, so later requests stay authenticated. You do not need `x-vercel-set-bypass-cookie` for that.
+
+Optional Vercel-compatible helper — also persist the raw bypass secret as `__becklyn_dp_bypass`:
+
 ```text
 https://app.example/?x-vercel-protection-bypass=<secret>&x-vercel-set-bypass-cookie=true
 ```
 
+The header form stays one-shot (no cookies) so CI/Playwright can send it on each request.
+
 When platform Deployment Protection is disabled, **this package** enforces the bypass secret so CI/Playwright keep working the same way.
 
 ## Behaviour
@@ -223,9 +235,10 @@ When platform Deployment Protection is disabled, **this package** enforces the b
 1. Disabled / misconfigured → pass through
 2. Internal Vercel OAuth routes → handled by the package (proxy start or direct OAuth / handoff)
 3. Login form `POST` → validate username/password, set signed HttpOnly session cookie
-4. Valid bypass header/query/cookie → allow (optionally set cookies)
-5. Valid session cookie → allow
-6. Else → HTML login page (password and/or Sign in with Vercel)
+4. Valid bypass header → allow this request
+5. Valid bypass query param → set `__becklyn_dp_session`, redirect to the cleaned URL
+6. Valid session or bypass cookie → allow
+7. Else → HTML login page (password and/or Sign in with Vercel)
 
 Session cookie: `__becklyn_dp_session` (HMAC-SHA256, 14 days by default).
 

package/dist/cjs/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA4RvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAqSvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoD1B"}

package/dist/cjs/handler.js

@@ -37,11 +37,20 @@ function redirect(request, location, status = 302) {
         },
     });
 }
+/**
+ * Prefer the dedicated session secret; fall back to the automation bypass secret
+ * so a query-param bypass can still persist `__becklyn_dp_session` when no
+ * username/password or explicit HMAC secret is configured.
+ */
+function signingSecret(config) {
+    return config.secret ?? config.bypassSecret;
+}
 async function attachSession(response, config, method, subject, secure) {
-    if (!config.secret) {
+    const secret = signingSecret(config);
+    if (!secret) {
         return response;
     }
-    const token = await (0, session_1.createSessionToken)(config.secret, method, subject, config.sessionTtlSeconds);
+    const token = await (0, session_1.createSessionToken)(secret, method, subject, config.sessionTtlSeconds);
     const opts = (0, session_1.sessionCookieOptions)(config.sessionTtlSeconds, secure);
     (0, vercel_oauth_1.appendSetCookie)(response, constants_1.SESSION_COOKIE_NAME, token, opts);
     return response;
@@ -57,10 +66,12 @@ async function handleBypass(request, config) {
     const setCookieMode = (0, bypass_1.shouldSetBypassCookie)(request);
     const url = new URL(request.url);
     const hadQueryBypass = url.searchParams.has(constants_1.BYPASS_HEADER);
-    const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+    const hadSetCookieQuery = url.searchParams.has(constants_1.SET_BYPASS_COOKIE_HEADER);
+    // Query-param bypass (and the Vercel set-cookie helper) persist auth, then
+    // strip secrets from the URL. Header-only automation stays one-shot.
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(constants_1.BYPASS_HEADER);
-        url.searchParams.delete("x-vercel-set-bypass-cookie");
+        url.searchParams.delete(constants_1.SET_BYPASS_COOKIE_HEADER);
         const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
@@ -72,6 +83,7 @@ async function handleBypass(request, config) {
                 sameSite: setCookieMode === "samesitenone" ? "none" : "lax",
             });
         }
+        // Always persist a signed session when the bypass secret arrived via query.
         await attachSession(response, config, "bypass", "automation", secure);
         return { kind: "respond", response };
     }
@@ -233,8 +245,9 @@ async function handleDeploymentProtection(request, options = {}) {
     if (bypass.kind === "allow") {
         return null;
     }
-    if (config.secret) {
-        const session = await (0, session_1.verifySessionToken)(config.secret, (0, vercel_oauth_1.readCookie)(request, constants_1.SESSION_COOKIE_NAME));
+    const secret = signingSecret(config);
+    if (secret) {
+        const session = await (0, session_1.verifySessionToken)(secret, (0, vercel_oauth_1.readCookie)(request, constants_1.SESSION_COOKIE_NAME));
         if (session) {
             return null;
         }

package/dist/cjs/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8JpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}

package/dist/cjs/middleware.js

@@ -9,12 +9,95 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function decodeCookieValue(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function parseSetCookie(header) {
+    const parts = header
+        .split(";")
+        .map(part => part.trim())
+        .filter(Boolean);
+    const first = parts.shift();
+    if (!first) {
+        return null;
+    }
+    const separator = first.indexOf("=");
+    if (separator <= 0) {
+        return null;
+    }
+    const parsed = {
+        name: first.slice(0, separator),
+        value: decodeCookieValue(first.slice(separator + 1)),
+    };
+    for (const part of parts) {
+        const [rawKey, ...rest] = part.split("=");
+        const key = rawKey?.toLowerCase();
+        const attrValue = rest.join("=");
+        if (key === "httponly") {
+            parsed.httpOnly = true;
+        }
+        else if (key === "secure") {
+            parsed.secure = true;
+        }
+        else if (key === "path") {
+            parsed.path = attrValue;
+        }
+        else if (key === "max-age") {
+            const maxAge = Number(attrValue);
+            if (!Number.isNaN(maxAge)) {
+                parsed.maxAge = maxAge;
+            }
+        }
+        else if (key === "samesite") {
+            const sameSite = attrValue.toLowerCase();
+            if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") {
+                parsed.sameSite = sameSite;
+            }
+        }
+    }
+    return parsed;
+}
+function readSetCookieHeaders(headers) {
+    if (typeof headers.getSetCookie === "function") {
+        const cookies = headers.getSetCookie();
+        if (cookies.length > 0) {
+            return cookies;
+        }
+    }
+    const single = headers.get("set-cookie");
+    return single ? [single] : [];
+}
+/**
+ * Next.js middleware only reliably applies cookies set via `NextResponse.cookies`.
+ * Copying raw `Set-Cookie` headers onto a redirect is ignored by the runtime.
+ */
+function applyCookies(from, to) {
+    for (const header of readSetCookieHeaders(from.headers)) {
+        const cookie = parseSetCookie(header);
+        if (!cookie) {
+            continue;
+        }
+        to.cookies.set(cookie.name, cookie.value, {
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            path: cookie.path,
+            maxAge: cookie.maxAge,
+            sameSite: cookie.sameSite,
+        });
+    }
+}
 function toNextResponse(request, response) {
     const location = response.headers.get("Location");
     if (location && response.status >= 300 && response.status < 400) {
         // Always resolve against the incoming request so relative Locations never reach Next.
         const redirectResponse = server_1.NextResponse.redirect(new URL(location, request.url), response.status);
         copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        applyCookies(response, redirectResponse);
         return redirectResponse;
     }
     const nextResponse = new server_1.NextResponse(response.body, {
@@ -22,22 +105,14 @@ function toNextResponse(request, response) {
         statusText: response.statusText,
     });
     copyHeaders(response, nextResponse, false);
+    applyCookies(response, nextResponse);
     return nextResponse;
 }
 function copyHeaders(from, to, skipLocation) {
-    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
-    if (setCookies.length > 0) {
-        for (const cookie of setCookies) {
-            to.headers.append("Set-Cookie", cookie);
-        }
-    }
     from.headers.forEach((value, key) => {
         const lower = key.toLowerCase();
         if (lower === "set-cookie") {
-            // Already copied via getSetCookie when available; fall back otherwise.
-            if (setCookies.length === 0) {
-                to.headers.append("Set-Cookie", value);
-            }
+            // Applied via NextResponse.cookies so the middleware runtime honors them.
             return;
         }
         if (skipLocation && lower === "location") {

package/dist/cjs/storybook.d.ts

@@ -1,10 +1,14 @@
 /**
  * Storybook deployment protection for Vercel.
  *
- * Built Storybooks are static sites, so protection runs as **Vercel Edge Middleware**
+ * Built Storybooks are static sites, so protection runs as **Vercel Routing Middleware**
  * (not Storybook config). Drop a `middleware.ts` next to the Vercel project root that
  * serves `storybook-static` and set the same env vars as the Next.js integration.
  *
+ * The published `./storybook` and `./edge` entry points resolve to self-contained ESM
+ * bundles so Vercel edge/nodejs middleware can load them without tracing multi-file
+ * package internals.
+ *
  * @example middleware.ts
  * ```ts
  * import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
@@ -19,7 +23,7 @@
  * };
  * ```
  *
- * Optional `vercel.json` for a Storybook-only project:
+ * Optional `vercel.json` for a Storybook-only project (`framework` must be `null`):
  * ```json
  * {
  *   "buildCommand": "npm run build-storybook",

package/dist/cjs/storybook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storybook.d.ts","sourceRoot":"","sources":["../../src/storybook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACH,qBAAqB,EACrB,4BAA4B,IAAI,iCAAiC,GACpE,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"storybook.d.ts","sourceRoot":"","sources":["../../src/storybook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACH,qBAAqB,EACrB,4BAA4B,IAAI,iCAAiC,GACpE,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC"}

package/dist/cjs/storybook.js

@@ -4,10 +4,14 @@ exports.withStorybookDeploymentProtection = exports.middlewarePassThrough = void
 /**
  * Storybook deployment protection for Vercel.
  *
- * Built Storybooks are static sites, so protection runs as **Vercel Edge Middleware**
+ * Built Storybooks are static sites, so protection runs as **Vercel Routing Middleware**
  * (not Storybook config). Drop a `middleware.ts` next to the Vercel project root that
  * serves `storybook-static` and set the same env vars as the Next.js integration.
  *
+ * The published `./storybook` and `./edge` entry points resolve to self-contained ESM
+ * bundles so Vercel edge/nodejs middleware can load them without tracing multi-file
+ * package internals.
+ *
  * @example middleware.ts
  * ```ts
  * import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
@@ -22,7 +26,7 @@ exports.withStorybookDeploymentProtection = exports.middlewarePassThrough = void
  * };
  * ```
  *
- * Optional `vercel.json` for a Storybook-only project:
+ * Optional `vercel.json` for a Storybook-only project (`framework` must be `null`):
  * ```json
  * {
  *   "buildCommand": "npm run build-storybook",

package/dist/edge-bundles.json

@@ -0,0 +1,7 @@
+{
+    "format": "esm",
+    "entries": [
+        "dist/edge.mjs",
+        "dist/storybook.mjs"
+    ]
+}