@blamejs/core 0.4.25 → 0.4.27

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- **0.4.26** (2026-04-30) — primitive-drift sweep: middleware audit context + safeUrl
+- **0.4.25** (2026-04-30) — b.objectStore.bucketOps: bucket-level operations (SigV4)
 - **0.4.24** (2026-04-30) — b.objectStore: multipart upload + server-side encryption
 - **0.4.23** (2026-04-30) — b.mail.dkim signing + calendar invites
 - **0.4.22** (2026-04-30) — b.mail attachments + inline images + plain/HTML alternatives

package/lib/auth/oauth.js

@@ -216,15 +216,24 @@ function _validateUrl(url, allowHttp, label) {
   if (typeof url !== "string" || url.length === 0) {
     throw new OAuthError("auth-oauth/bad-url", label + ": URL is required");
   }
-  var parsed;
-  try { parsed = new URL(url); }
-  catch (_e) {
-    throw new OAuthError("auth-oauth/bad-url", label + ": invalid URL '" + url + "'");
+  // Operator-supplied OAuth issuer / endpoint URL — route through
+  // safeUrl so the scheme allowlist is consistent with the rest of the
+  // framework's outbound gates. Map safe-url's error codes to the
+  // domain-specific oauth codes operators already key alerts on.
+  try {
+    safeUrl.parse(url, {
+      allowedProtocols: allowHttp ? safeUrl.ALLOW_HTTP_ALL : safeUrl.ALLOW_HTTP_TLS,
+    });
+  } catch (e) {
+    if (e && e.code === "safe-url/protocol-disallowed") {
+      throw new OAuthError("auth-oauth/insecure-url",
+        label + ": must be https" + (allowHttp ? " or http" : "") +
+        " (got '" + url + "')");
+    }
+    throw new OAuthError("auth-oauth/bad-url",
+      label + ": invalid URL '" + url + "'");
   }
-  if (parsed.protocol === "https:") return url;
-  if (parsed.protocol === "http:" && allowHttp) return url;
-  throw new OAuthError("auth-oauth/insecure-url",
-    label + ": must be https (got '" + parsed.protocol + "//" + parsed.host + "')");
+  return url;
 }
 
 // ---- JOSE alg → node:crypto verify parameters ----

package/lib/error-page.js

@@ -39,8 +39,11 @@
  */
 
 var lazyRequire = require("./lazy-require");
+var template = require("./template");
 var audit = lazyRequire(function () { return require("./audit"); });
 
+var _esc = template.escapeHtml;
+
 // Status code → default short reason. Used when the error doesn't carry
 // its own message (e.g. a generic Error thrown from a route).
 var STATUS_REASONS = {
@@ -114,16 +117,6 @@ function _wantsJson(req, defaultFormat) {
   return req && req.method && req.method.toUpperCase() !== "GET";
 }
 
-function _esc(s) {
-  if (s === undefined || s === null) return "";
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
 function _redactHeaders(headers) {
   if (!headers || typeof headers !== "object") return {};
   var out = {};

package/lib/forms.js

@@ -36,6 +36,8 @@
  *   forms.escapeHtml = template.escapeHtml (re-export for convenience)
  */
 var nodeCrypto = require("crypto");
+var safeSchema = require("./safe-schema");
+var safeUrl = require("./safe-url");
 var template = require("./template");
 
 // ============================================================
@@ -318,17 +320,26 @@ function validate(spec, body) {
       }
     }
     if (f.type === "email" && typeof coerced === "string") {
-      // Pragmatic email check — RFC 5322 is impractical to regex
-      // correctly; this catches obvious nonsense ("foo", "foo@",
-      // "@bar") without over-engineering.
-      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(coerced)) {
+      // Same pragmatic check the rest of the framework uses
+      // (safeSchema.EMAIL_RE — shared so we don't carry parallel
+      // copies of the same /^[^\s@]+@[^\s@]+\.[^\s@]+$/ regex).
+      if (!safeSchema.EMAIL_RE.test(coerced)) {
         errors[f.name] = (f.label || f.name) + " must be a valid email address";
         continue;
       }
     }
     if (f.type === "url" && typeof coerced === "string") {
-      try { new URL(coerced); }
-      catch (_e) { errors[f.name] = (f.label || f.name) + " must be a valid URL"; continue; }
+      // Form `url` fields come from the request body — operator/external
+      // input. Route through safeUrl so the scheme allowlist is honored
+      // (https-only by default; operator opts in to http via field meta).
+      try {
+        safeUrl.parse(coerced, {
+          allowedProtocols: f.allowHttp ? safeUrl.ALLOW_HTTP_ALL : safeUrl.ALLOW_HTTP_TLS,
+        });
+      } catch (_e) {
+        errors[f.name] = (f.label || f.name) + " must be a valid URL";
+        continue;
+      }
     }
     if (typeof coerced === "string") {
       if (f.minlength !== undefined && coerced.length < Number(f.minlength)) {

package/lib/mail.js

@@ -67,6 +67,7 @@ var audit = lazyRequire(function () { return require("./audit"); });
 var httpClient = lazyRequire(function () { return require("./http-client"); });
 var net = lazyRequire(function () { return require("net"); });
 var tls = lazyRequire(function () { return require("tls"); });
+var safeSchema = require("./safe-schema");
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
 
@@ -80,10 +81,10 @@ class MailError extends FrameworkError {
   }
 }
 
-// Pragmatic email check — same shape as forms.validate. RFC 5322 in a
-// regex is a fool's errand; this catches obvious nonsense and lets
-// real-world addresses through.
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+// Pragmatic email regex — shared with forms.validate / safe-schema.
+// RFC 5322 in a regex is a fool's errand; this catches obvious nonsense
+// and lets real-world addresses through.
+var EMAIL_RE = safeSchema.EMAIL_RE;
 
 function _normalizeRecipientList(value, label) {
   if (value === undefined || value === null) return [];

package/lib/middleware/bot-guard.js

@@ -45,9 +45,19 @@ var DEFAULT_BLOCKED_AGENTS = [
 ];
 
 var lazyRequire = require("../lazy-require");
+var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var audit = lazyRequire(function () { return require("../audit"); });
 
+// Bot-guard's "trust the proxy header" semantics for actor.ip — the
+// audit event records the apparent source even when behind a CDN.
+// extractActorContext defaults to socket.remoteAddress; we override.
+function _xffIp(req) {
+  var xff = req.headers && req.headers["x-forwarded-for"];
+  if (xff) return String(xff).split(",")[0].trim();
+  return (req.socket && req.socket.remoteAddress) || null;
+}
+
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
@@ -105,10 +115,7 @@ function create(opts) {
       req.suspectedBot = hit;
       try {
         audit().emit({
-          actor: {
-            ip:        (req.headers && req.headers["x-forwarded-for"]) || (req.socket && req.socket.remoteAddress),
-            userAgent: req.headers && req.headers["user-agent"],
-          },
+          actor:    requestHelpers.extractActorContext(req, { ip: _xffIp(req) }),
           action:   "system.botguard.tag",
           outcome:  "denied",
           reason:   hit,
@@ -121,10 +128,7 @@ function create(opts) {
 
     try {
       audit().emit({
-        actor: {
-          ip:        (req.headers && req.headers["x-forwarded-for"]) || (req.socket && req.socket.remoteAddress),
-          userAgent: req.headers && req.headers["user-agent"],
-        },
+        actor:    requestHelpers.extractActorContext(req, { ip: _xffIp(req) }),
         action:   "system.botguard.block",
         outcome:  "denied",
         reason:   hit,

package/lib/middleware/csrf-protect.js

@@ -66,6 +66,7 @@
  */
 var lazyRequire = require("../lazy-require");
 var forms = require("../forms");
+var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -203,7 +204,7 @@ function create(opts) {
     audit().safeEmit({
       action:   "auth.csrf.denied",
       outcome:  "denied",
-      actor:    { ip: req.socket && req.socket.remoteAddress, userAgent: req.headers && req.headers["user-agent"] },
+      actor:    requestHelpers.extractActorContext(req),
       reason:   reason,
       metadata: { method: req.method, path: (req.url || "").split("?")[0] },
     });

package/lib/middleware/rate-limit.js

@@ -45,6 +45,7 @@
  */
 var C = require("../constants");
 var lazyRequire = require("../lazy-require");
+var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var clusterStorage = require("../cluster-storage");
 
@@ -252,8 +253,11 @@ function create(opts) {
       if (verdict.retryAfter > 0) res.setHeader("Retry-After", String(verdict.retryAfter));
     }
     try {
+      // Override `ip` with the x-forwarded-for-aware client IP so the
+      // audit event carries the proxied origin even when extractActorContext
+      // would have read the socket address.
       audit().emit({
-        actor:    { ip: _clientIp(req), userAgent: req.headers && req.headers["user-agent"] },
+        actor:    requestHelpers.extractActorContext(req, { ip: _clientIp(req) }),
         action:   "system.ratelimit.block",
         outcome:  "denied",
         reason:   "rate limit exceeded",

package/lib/middleware/require-auth.js

@@ -29,6 +29,7 @@
  *   }
  */
 var lazyRequire = require("../lazy-require");
+var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -61,7 +62,7 @@ function create(opts) {
         audit().emit({
           action:   "auth.required.denied",
           outcome:  "denied",
-          actor:    { ip: req.socket && req.socket.remoteAddress, userAgent: req.headers && req.headers["user-agent"] },
+          actor:    requestHelpers.extractActorContext(req),
           reason:   "no authenticated user on request",
           metadata: { method: req.method, path: req.pathname || (req.url || "").split("?")[0] },
         });

package/lib/object-store/sigv4-bucket-ops.js

@@ -54,6 +54,7 @@ var nodeCrypto = require("crypto");
 var sigv4 = require("./sigv4");
 var safeXml = require("../parsers/safe-xml");
 var safeUrl = require("../safe-url");
+var template = require("../template");
 var httpClient = require("../http-client");
 var { ObjectStoreError } = require("../framework-error");
 
@@ -83,15 +84,18 @@ function _validateBucketName(name) {
   }
 }
 
-function _xmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
-}
+// XML body strings flow through template.escapeHtml — `&#x27;` (which
+// it emits for the apostrophe) is a numeric character reference and
+// is valid in both XML and HTML, where `&apos;` is XML-only. AWS S3
+// accepts both; using the shared HTML escape keeps the framework
+// down to one canonical escape primitive.
+var _xmlEscape = template.escapeHtml;
 
+// AWS PutBucketLifecycle / PutBucketCors require a Content-MD5 header
+// for body integrity (legacy AWS API requirement; SigV4 already covers
+// integrity via x-amz-content-sha256 but the API still validates this).
+// MD5 here is NOT a credential or security primitive — it's an AWS API
+// shape. b.credentialHash is the wrong tool.
 function _md5Base64(buf) {
   return nodeCrypto.createHash("md5").update(buf).digest("base64");
 }

package/lib/safe-schema.js

@@ -109,6 +109,7 @@
  *   so the two stay distinct rather than one wrapping the other.
  */
 
+var safeJson = require("./safe-json");
 var { defineClass } = require("./framework-error");
 
 var SafeSchemaError = defineClass("SafeSchemaError", { alwaysPermanent: true });
@@ -143,10 +144,17 @@ var ULID_RE     = /^[0-9A-HJKMNP-TV-Z]{26}$/;
 // base64 (standard alphabet, with optional padding). Base64url variants
 // rejected — operators chain .regex(...) for that.
 var BASE64_RE   = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
-// IPv6 — covers full, compressed (::), and IPv4-mapped forms. Not
-// exhaustive on every legal corner, but rejects the common malformed
-// inputs operators actually see at HTTP boundaries.
-var IPV6_RE     = /^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|::(?:[0-9a-fA-F]{1,4}:){0,6}[0-9a-fA-F]{0,4}|(?:[0-9a-fA-F]{1,4}:){1,6}(?::[0-9a-fA-F]{1,4}){1,1}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5})$/;
+// IPv6 structural pattern — full 8-hextet, every `::`-compressed shape,
+// `::` and `::1` literals, IPv4-mapped (`::ffff:1.2.3.4`), and 6-prefix
+// + IPv4 tail. Adapted from validator.js (Apache-2.0); zone IDs
+// (`fe80::1%eth0`) are deliberately omitted — the framework rejects
+// them as non-portable, matching `safe-json.formats.ipv6`. Bounded
+// quantifiers, no nested-quantifier alternation, ReDoS-safe.
+//
+// `.ipv6()` schema method delegates to `safeJson.formats.ipv6` for
+// stricter algorithmic validation; this regex is exported as a
+// structural pattern for operators who want it directly.
+var IPV6_RE     = /^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/;
 
 // ---- helpers ----
 
@@ -424,22 +432,33 @@ function _stringMethods(schema, spec) {
         _fail(p, "string/datetime", "must be an ISO-8601 datetime with timezone");
     });
   };
+  // IP-address validators delegate to safe-json's algorithmic format
+  // checks rather than re-running regex matches. The algorithmic path
+  // handles edge cases that pure regex misses (compressed `::` shapes,
+  // IPv4-mapped `::ffff:1.2.3.4`, multi-`::` rejection, group-count
+  // bounds) and keeps the framework's IP-validation behavior in one
+  // tested place. IPV4_RE / IPV6_RE remain exported for operators who
+  // want the structural pattern, but `.ipv4()` / `.ipv6()` / `.ip()`
+  // are the canonical validation surface.
   schema.ipv4 = function () {
     return chain(function (v, p) {
-      return IPV4_RE.test(v) ? { ok: true } :
-        _fail(p, "string/ipv4", "must be a valid IPv4 address");
+      return (typeof v === "string" && safeJson.formats.ipv4(v))
+        ? { ok: true }
+        : _fail(p, "string/ipv4", "must be a valid IPv4 address");
     });
   };
   schema.ipv6 = function () {
     return chain(function (v, p) {
-      return IPV6_RE.test(v) ? { ok: true } :
-        _fail(p, "string/ipv6", "must be a valid IPv6 address");
+      return (typeof v === "string" && safeJson.formats.ipv6(v))
+        ? { ok: true }
+        : _fail(p, "string/ipv6", "must be a valid IPv6 address");
     });
   };
   schema.ip = function () {
     return chain(function (v, p) {
-      return (IPV4_RE.test(v) || IPV6_RE.test(v)) ? { ok: true } :
-        _fail(p, "string/ip", "must be a valid IP address (v4 or v6)");
+      return (typeof v === "string" && safeJson.formats.ip(v))
+        ? { ok: true }
+        : _fail(p, "string/ip", "must be a valid IP address (v4 or v6)");
     });
   };
   schema.cuid = function () {
@@ -1173,4 +1192,17 @@ module.exports = {
 
   // Errors
   SafeSchemaError:  SafeSchemaError,
+
+  // Validation regexes — exported so other modules don't re-declare
+  // their own copies. Pragmatic patterns; operators wanting RFC-strict
+  // behavior chain `.refine()` on top of the schema instead.
+  EMAIL_RE:         EMAIL_RE,
+  URL_RE:           URL_RE,
+  UUID_RE:          UUID_RE,
+  DATE_RE:          DATE_RE,
+  DATETIME_RE:      DATETIME_RE,
+  IPV4_RE:          IPV4_RE,
+  IPV6_RE:          IPV6_RE,
+  CUID_RE:          CUID_RE,
+  ULID_RE:          ULID_RE,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.4.25",
+  "version": "0.4.27",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",