@beignet/devtools 0.0.23 → 0.0.24

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @beignet/devtools
 
+## 0.0.24
+
+### Patch Changes
+
+- 91bc9b5: Harden framework security defaults for generated tenancy, auth secrets, CORS,
+  body limits, uploads, devtools, OpenAPI, rate-limit IP sources, public storage,
+  and Meilisearch query fields.
+
 ## 0.0.23
 
 ## 0.0.22

package/README.md

@@ -385,7 +385,7 @@ path.
 The provider controls whether events are recorded. The HTTP route controls
 whether those events are exposed. Both default to development-only behavior.
 Route handlers return `404` when `NODE_ENV === "production"` unless explicitly
-enabled:
+enabled with an app-owned `authorize` callback:
 
 ```typescript
 export const { GET, POST } = createDevtoolsRoute(server.ports.devtools, {
@@ -519,8 +519,9 @@ type DevtoolsRequestOptions = {
 ## Production safety
 
 The HTTP handlers return `404` when `NODE_ENV === "production"` by default. The
-provider also installs a no-op devtools port in production by default so app
-code does not need null checks.
+Setting `enabled: true` in production still requires `authorize`; without it
+the route remains hidden. The provider also installs a no-op devtools port in
+production by default so app code does not need null checks.
 
 Devtools can contain sensitive request, error, and domain data. Keep it on local
 development routes unless you intentionally add authentication and redaction.

package/dist/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,OAAO,KACT,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,QAAQ,CAEnD;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAe/B"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,OAAO,KACT,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,QAAQ,CAEnD;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAkB/B"}

package/dist/access.js

@@ -20,6 +20,9 @@ export async function authorizeDevtoolsRequest(req, options = {}) {
         return devtoolsNotFoundResponse();
     }
     if (!options.authorize) {
+        if (process.env.NODE_ENV === "production" && options.enabled === true) {
+            return devtoolsNotFoundResponse();
+        }
         return undefined;
     }
     const result = await options.authorize(req);

package/dist/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAgCA;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAsC,EAAE;IAExC,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAY,EACZ,UAAsC,EAAE;IAExC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,wBAAwB,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,YAAY,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAgCA;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAsC,EAAE;IAExC,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAY,EACZ,UAAsC,EAAE;IAExC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,wBAAwB,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACtE,OAAO,wBAAwB,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,YAAY,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;AACzD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/devtools",
-  "version": "0.0.23",
+  "version": "0.0.24",
   "type": "module",
   "description": "Development-time devtools for Beignet - mini Telescope for the server runtime",
   "main": "./dist/index.js",

package/src/access.ts

@@ -60,6 +60,9 @@ export async function authorizeDevtoolsRequest(
   }
 
   if (!options.authorize) {
+    if (process.env.NODE_ENV === "production" && options.enabled === true) {
+      return devtoolsNotFoundResponse();
+    }
     return undefined;
   }