@blamejs/core 0.4.25 → 0.4.26

package/CHANGELOG.md

@@ -8,6 +8,7 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- **0.4.25** (2026-04-30) — b.objectStore.bucketOps: bucket-level operations (SigV4)
 - **0.4.24** (2026-04-30) — b.objectStore: multipart upload + server-side encryption
 - **0.4.23** (2026-04-30) — b.mail.dkim signing + calendar invites
 - **0.4.22** (2026-04-30) — b.mail attachments + inline images + plain/HTML alternatives

package/lib/auth/oauth.js

@@ -216,15 +216,24 @@ function _validateUrl(url, allowHttp, label) {
   if (typeof url !== "string" || url.length === 0) {
     throw new OAuthError("auth-oauth/bad-url", label + ": URL is required");
   }
-  var parsed;
-  try { parsed = new URL(url); }
-  catch (_e) {
-    throw new OAuthError("auth-oauth/bad-url", label + ": invalid URL '" + url + "'");
+  // Operator-supplied OAuth issuer / endpoint URL — route through
+  // safeUrl so the scheme allowlist is consistent with the rest of the
+  // framework's outbound gates. Map safe-url's error codes to the
+  // domain-specific oauth codes operators already key alerts on.
+  try {
+    safeUrl.parse(url, {
+      allowedProtocols: allowHttp ? safeUrl.ALLOW_HTTP_ALL : safeUrl.ALLOW_HTTP_TLS,
+    });
+  } catch (e) {
+    if (e && e.code === "safe-url/protocol-disallowed") {
+      throw new OAuthError("auth-oauth/insecure-url",
+        label + ": must be https" + (allowHttp ? " or http" : "") +
+        " (got '" + url + "')");
+    }
+    throw new OAuthError("auth-oauth/bad-url",
+      label + ": invalid URL '" + url + "'");
   }
-  if (parsed.protocol === "https:") return url;
-  if (parsed.protocol === "http:" && allowHttp) return url;
-  throw new OAuthError("auth-oauth/insecure-url",
-    label + ": must be https (got '" + parsed.protocol + "//" + parsed.host + "')");
+  return url;
 }
 
 // ---- JOSE alg → node:crypto verify parameters ----

package/lib/forms.js

@@ -36,6 +36,7 @@
  *   forms.escapeHtml = template.escapeHtml (re-export for convenience)
  */
 var nodeCrypto = require("crypto");
+var safeUrl = require("./safe-url");
 var template = require("./template");
 
 // ============================================================
@@ -327,8 +328,17 @@ function validate(spec, body) {
       }
     }
     if (f.type === "url" && typeof coerced === "string") {
-      try { new URL(coerced); }
-      catch (_e) { errors[f.name] = (f.label || f.name) + " must be a valid URL"; continue; }
+      // Form `url` fields come from the request body — operator/external
+      // input. Route through safeUrl so the scheme allowlist is honored
+      // (https-only by default; operator opts in to http via field meta).
+      try {
+        safeUrl.parse(coerced, {
+          allowedProtocols: f.allowHttp ? safeUrl.ALLOW_HTTP_ALL : safeUrl.ALLOW_HTTP_TLS,
+        });
+      } catch (_e) {
+        errors[f.name] = (f.label || f.name) + " must be a valid URL";
+        continue;
+      }
     }
     if (typeof coerced === "string") {
       if (f.minlength !== undefined && coerced.length < Number(f.minlength)) {

package/lib/middleware/bot-guard.js

@@ -45,9 +45,19 @@ var DEFAULT_BLOCKED_AGENTS = [
 ];
 
 var lazyRequire = require("../lazy-require");
+var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var audit = lazyRequire(function () { return require("../audit"); });
 
+// Bot-guard's "trust the proxy header" semantics for actor.ip — the
+// audit event records the apparent source even when behind a CDN.
+// extractActorContext defaults to socket.remoteAddress; we override.
+function _xffIp(req) {
+  var xff = req.headers && req.headers["x-forwarded-for"];
+  if (xff) return String(xff).split(",")[0].trim();
+  return (req.socket && req.socket.remoteAddress) || null;
+}
+
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
@@ -105,10 +115,7 @@ function create(opts) {
       req.suspectedBot = hit;
       try {
         audit().emit({
-          actor: {
-            ip:        (req.headers && req.headers["x-forwarded-for"]) || (req.socket && req.socket.remoteAddress),
-            userAgent: req.headers && req.headers["user-agent"],
-          },
+          actor:    requestHelpers.extractActorContext(req, { ip: _xffIp(req) }),
           action:   "system.botguard.tag",
           outcome:  "denied",
           reason:   hit,
@@ -121,10 +128,7 @@ function create(opts) {
 
     try {
       audit().emit({
-        actor: {
-          ip:        (req.headers && req.headers["x-forwarded-for"]) || (req.socket && req.socket.remoteAddress),
-          userAgent: req.headers && req.headers["user-agent"],
-        },
+        actor:    requestHelpers.extractActorContext(req, { ip: _xffIp(req) }),
         action:   "system.botguard.block",
         outcome:  "denied",
         reason:   hit,

package/lib/middleware/csrf-protect.js

@@ -66,6 +66,7 @@
  */
 var lazyRequire = require("../lazy-require");
 var forms = require("../forms");
+var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -203,7 +204,7 @@ function create(opts) {
     audit().safeEmit({
       action:   "auth.csrf.denied",
       outcome:  "denied",
-      actor:    { ip: req.socket && req.socket.remoteAddress, userAgent: req.headers && req.headers["user-agent"] },
+      actor:    requestHelpers.extractActorContext(req),
       reason:   reason,
       metadata: { method: req.method, path: (req.url || "").split("?")[0] },
     });

package/lib/middleware/rate-limit.js

@@ -45,6 +45,7 @@
  */
 var C = require("../constants");
 var lazyRequire = require("../lazy-require");
+var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var clusterStorage = require("../cluster-storage");
 
@@ -252,8 +253,11 @@ function create(opts) {
       if (verdict.retryAfter > 0) res.setHeader("Retry-After", String(verdict.retryAfter));
     }
     try {
+      // Override `ip` with the x-forwarded-for-aware client IP so the
+      // audit event carries the proxied origin even when extractActorContext
+      // would have read the socket address.
       audit().emit({
-        actor:    { ip: _clientIp(req), userAgent: req.headers && req.headers["user-agent"] },
+        actor:    requestHelpers.extractActorContext(req, { ip: _clientIp(req) }),
         action:   "system.ratelimit.block",
         outcome:  "denied",
         reason:   "rate limit exceeded",

package/lib/middleware/require-auth.js

@@ -29,6 +29,7 @@
  *   }
  */
 var lazyRequire = require("../lazy-require");
+var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -61,7 +62,7 @@ function create(opts) {
         audit().emit({
           action:   "auth.required.denied",
           outcome:  "denied",
-          actor:    { ip: req.socket && req.socket.remoteAddress, userAgent: req.headers && req.headers["user-agent"] },
+          actor:    requestHelpers.extractActorContext(req),
           reason:   "no authenticated user on request",
           metadata: { method: req.method, path: req.pathname || (req.url || "").split("?")[0] },
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.4.25",
+  "version": "0.4.26",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",