@blamejs/blamejs-shop 0.2.31 → 0.3.1

package/lib/vendor/blamejs/test/50-integration.js

@@ -287,6 +287,200 @@ async function testCreateAppMiddlewareDisableable() {
   }
 }
 
+// Extract a 64-hex csrf token for `name` from a response's Set-Cookie(s).
+function _csrfCookieFrom(resp, name) {
+  var sc = resp.headers["set-cookie"];
+  if (!sc) return null;
+  var arr = Array.isArray(sc) ? sc : [sc];
+  var re = new RegExp("(?:^|;\\s*)" + name + "=([a-f0-9]{64})");
+  for (var i = 0; i < arr.length; i++) {
+    var m = re.exec(arr[i]);
+    if (m) return m[1];
+  }
+  return null;
+}
+
+async function testCreateAppSecurityDefaultsWired() {
+  // createApp wires cookies + cspNonce + fetchMetadata + bodyParser + csrf
+  // ON by default (Core Rule §3). Verify cspNonce patches the CSP, csrf
+  // issues a double-submit cookie + enforces it, and the stateless-skip
+  // lets token-API / cookieless callers through.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-sec-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false },   // bot-guard refuses non-browser-y test clients
+    routes:  function (r) {
+      r.get("/", function (req, res) { b.render.text(res, "OK"); });
+      r.post("/act", function (req, res) { b.render.text(res, "DID"); });
+    },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var g = await _appGet(addr.port, "/");
+    check("security defaults: cspNonce patched the CSP header",
+          typeof g.headers["content-security-policy"] === "string" &&
+          g.headers["content-security-policy"].indexOf("nonce-") !== -1);
+    var token = _csrfCookieFrom(g, "csrf");
+    check("security defaults: csrf double-submit cookie issued",
+          typeof token === "string" && token.length === 64);
+
+    // Cookie-bearing POST without a token → enforced (403).
+    var noTok = await b.httpClient.request({
+      method: "POST", url: "http://127.0.0.1:" + addr.port + "/act",
+      headers: { "Cookie": "csrf=" + token }, body: Buffer.from(""),
+      responseMode: "always-resolve",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    check("security defaults: cookie'd POST without token → 403", noTok.statusCode === 403);
+
+    // Cookie + matching header token → validates (200).
+    var withTok = await b.httpClient.request({
+      method: "POST", url: "http://127.0.0.1:" + addr.port + "/act",
+      headers: { "Cookie": "csrf=" + token, "X-CSRF-Token": token }, body: Buffer.from(""),
+      responseMode: "always-resolve",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    check("security defaults: cookie'd POST with valid token → 200", withTok.statusCode === 200);
+
+    // Cookieless POST → not CSRF-able → skipStateless skip (200).
+    var cookieless = await b.httpClient.request({
+      method: "POST", url: "http://127.0.0.1:" + addr.port + "/act",
+      body: Buffer.from(""), responseMode: "always-resolve",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    check("security defaults: cookieless POST skipped → 200", cookieless.statusCode === 200);
+
+    // Bearer-authenticated POST (even WITH a cookie) → token-auth, not
+    // CSRF-able → skipStateless skip (200).
+    var bearer = await b.httpClient.request({
+      method: "POST", url: "http://127.0.0.1:" + addr.port + "/act",
+      headers: { "Cookie": "csrf=" + token, "Authorization": "Bearer test.token.value" },
+      body: Buffer.from(""), responseMode: "always-resolve",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    check("security defaults: bearer-auth POST skipped → 200", bearer.statusCode === 200);
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppCsrfCustomNaming() {
+  // The default csrf wiring is configurable — operator cookie/field names
+  // flow straight through opts.middleware.csrf, nothing static is baked in.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-csrfname-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false, csrf: { cookie: { name: "app_csrf" }, fieldName: "tok" } },
+    routes:  function (r) { r.get("/", function (req, res) { b.render.text(res, "OK"); }); },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var g = await _appGet(addr.port, "/");
+    check("csrf custom naming: operator cookie name issued through the default wiring",
+          typeof _csrfCookieFrom(g, "app_csrf") === "string");
+    check("csrf custom naming: default 'csrf' cookie name not used",
+          _csrfCookieFrom(g, "csrf") === null);
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppSecurityDisableAudits() {
+  // Disabling a security default leaves an audit trace (app.middleware.
+  // disabled) and actually drops the middleware.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-disable-"));
+  var emitted = [];
+  var realSafeEmit = b.audit.safeEmit;
+  b.audit.safeEmit = function (ev) { emitted.push(ev); return realSafeEmit.call(b.audit, ev); };
+  var app;
+  try {
+    app = await b.createApp({
+      dataDir: dataDir,
+      vault:   { mode: "plaintext" },
+      db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+      schema:  [],
+      middleware: { botGuard: false, csrf: false },
+      routes:  function (r) { r.get("/", function (req, res) { b.render.text(res, "OK"); }); },
+    });
+    var disabled = emitted
+      .filter(function (e) { return e && e.action === "app.middleware.disabled"; })
+      .map(function (e) { return e.metadata && e.metadata.middleware; });
+    check("disable audit: csrf disable emits app.middleware.disabled",
+          disabled.indexOf("csrf") !== -1);
+    check("disable audit: botGuard disable emits app.middleware.disabled",
+          disabled.indexOf("botGuard") !== -1);
+    var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+    var g = await _appGet(addr.port, "/");
+    check("disable audit: csrf off → no csrf cookie issued",
+          _csrfCookieFrom(g, "csrf") === null);
+  } finally {
+    b.audit.safeEmit = realSafeEmit;
+    if (app) await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppCsrfIdempotent() {
+  // An operator who ALSO mounts csrf inside opts.routes must not double-
+  // apply — the second mount is a no-op (single cookie issued).
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-idem-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false },
+    routes:  function (r) {
+      r.use(b.middleware.csrfProtect({ cookie: true }));   // redundant — createApp already wired csrf
+      r.get("/", function (req, res) { b.render.text(res, "OK"); });
+    },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var g = await _appGet(addr.port, "/");
+    var sc = g.headers["set-cookie"];
+    var arr = Array.isArray(sc) ? sc : (sc ? [sc] : []);
+    var csrfCookies = arr.filter(function (c) { return /^csrf=/.test(c); });
+    check("csrf idempotent: redundant route-level mount issues a single csrf cookie",
+          csrfCookies.length === 1);
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
 async function testCreateAppRoutesCallback() {
   process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
   process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
@@ -462,6 +656,10 @@ async function run() {
   await testCreateAppMinimalBoot();
   await testCreateAppDefaultMiddleware();
   await testCreateAppMiddlewareDisableable();
+  await testCreateAppSecurityDefaultsWired();
+  await testCreateAppCsrfCustomNaming();
+  await testCreateAppSecurityDisableAudits();
+  await testCreateAppCsrfIdempotent();
   await testCreateAppRoutesCallback();
   await testCreateAppWithJobs();
   await testCreateAppShutdown();
@@ -480,6 +678,10 @@ module.exports = {
   testCreateAppMinimalBoot:           testCreateAppMinimalBoot,
   testCreateAppDefaultMiddleware:     testCreateAppDefaultMiddleware,
   testCreateAppMiddlewareDisableable: testCreateAppMiddlewareDisableable,
+  testCreateAppSecurityDefaultsWired: testCreateAppSecurityDefaultsWired,
+  testCreateAppCsrfCustomNaming:      testCreateAppCsrfCustomNaming,
+  testCreateAppSecurityDisableAudits: testCreateAppSecurityDisableAudits,
+  testCreateAppCsrfIdempotent:        testCreateAppCsrfIdempotent,
   testCreateAppRoutesCallback:        testCreateAppRoutesCallback,
   testCreateAppWithJobs:              testCreateAppWithJobs,
   testCreateAppShutdown:              testCreateAppShutdown,

package/lib/vendor/blamejs/test/layer-0-primitives/cert.test.js

@@ -245,6 +245,49 @@ function testFactoryRefusesBadOpts() {
     });
     check("cert name '" + JSON.stringify(badName) + "' refused as path-segment", e && e.code === "cert/bad-cert-name");
   });
+
+  // ---- compliance posture validation ----
+  // opts.compliance names are validated against b.compliance.KNOWN_POSTURES
+  // at create() so a typo is caught at boot rather than silently recorded.
+  var goodChallenge = { type: "http-01", provision: function () {}, cleanup: function () {} };
+  var eBadPosture = threw(function () {
+    b.cert.create({
+      storage:    { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:       { directory: "https://example/", accountKey: "auto" },
+      certs:      [{ name: "m", domains: ["a.com"], challenge: goodChallenge }],
+      compliance: ["not-a-real-posture"],
+      audit:      false,
+    });
+  });
+  check("unknown compliance posture → cert/unknown-compliance-posture",
+    eBadPosture && eBadPosture.code === "cert/unknown-compliance-posture");
+
+  var eGoodPosture = threw(function () {
+    b.cert.create({
+      storage:    { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:       { directory: "https://example/", accountKey: "auto" },
+      certs:      [{ name: "m", domains: ["a.com"], challenge: goodChallenge }],
+      compliance: ["hipaa", "pci-dss"],
+      audit:      false,
+    });
+  });
+  check("known compliance postures accepted", !eGoodPosture);
+
+  // ---- b.network.tls.ocsp.fetch composition surface ----
+  check("b.network.tls.ocsp.fetch is a function",
+    typeof b.network.tls.ocsp.fetch === "function");
+}
+
+// b.network.tls.ocsp.fetch rejects on missing leafPem/issuerPem rather than
+// issuing an outbound request with undefined inputs.
+async function testOcspFetchRejectsBadInput() {
+  var rejected = false;
+  try {
+    await b.network.tls.ocsp.fetch({});
+  } catch (_e) {
+    rejected = true;
+  }
+  check("ocsp.fetch({}) rejects (no leafPem/issuerPem)", rejected);
 }
 
 // ---- Sealed-disk storage roundtrip ----
@@ -699,6 +742,7 @@ async function testCorruptAccountKeyClearError() {
 async function run() {
   testSurface();
   testFactoryRefusesBadOpts();
+  await testOcspFetchRejectsBadInput();
   await testStorageRoundtrip();
   await testSniCallback();
   await testSniWildcardSingleLabel();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.31",
+  "version": "0.3.1",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {