@blamejs/core 0.5.5 → 0.5.6

package/CHANGELOG.md

@@ -8,6 +8,7 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- **0.5.5** (2026-04-30) — strict default CSP + IPv6 special-range expansion
 - **0.5.4** (2026-04-30) — close SSRF DNS-rebinding window with pinned outbound DNS
 - **0.5.3** (2026-04-30) — security cleanup: trustProxy primitive + Vary merge + HSTS gate
 - **0.5.2** (2026-04-30) — b.breakGlass: passkey factor + service-account bypass + admin tools

package/lib/break-glass.js

@@ -39,6 +39,7 @@
  */
 var audit = require("./audit");
 var C = require("./constants");
+var cache = require("./cache");
 var clusterStorage = require("./cluster-storage");
 var { generateBytes, generateToken, kdf, sha3Hash, encryptPacked, decryptPacked } = require("./crypto");
 var cryptoField = require("./crypto-field");
@@ -76,6 +77,10 @@ var ALLOWED_REASON_STORAGE  = ["cleartext", "hmac", "both"];
 // Populated on first access per-table; invalidated on policy.set/delete.
 var policyCache = new Map();    // table -> policy
 var initialized = false;
+// Framework-wide trustProxy setting (set at init). When true, the
+// break-glass primitive consults X-Forwarded-For to populate the
+// grant row's `ip` field — same trust boundary as middleware.
+var _trustProxy = false;
 
 // Factor lockout — wrap auth.lockout so a hostile actor brute-forcing
 // TOTP codes against break-glass gets shut out after a few failures.
@@ -85,7 +90,6 @@ var _factorLockout = null;
 var _factorLockoutCache = null;
 function _ensureFactorLockout() {
   if (_factorLockout) return _factorLockout;
-  var cache = require("./cache");
   _factorLockoutCache = cache.create({
     namespace: "breakglass.factor",
     backend:   "memory",
@@ -305,10 +309,12 @@ async function migrate(table, opts) {
 
 function init(opts) {
   opts = opts || {};
-  validateOpts(opts, ["now"], "breakGlass.init");
+  validateOpts(opts, ["now", "trustProxy"], "breakGlass.init");
   initialized = true;
   policyCache.clear();
   _factorLockout = null;
+  _trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
+    ? opts.trustProxy : false;
 }
 
 function _resetForTest() {
@@ -320,6 +326,7 @@ function _resetForTest() {
   }
   _factorLockout = null;
   _factorLockoutCache = null;
+  _trustProxy = false;
 }
 
 function _requireInit() {
@@ -695,7 +702,11 @@ async function grant(opts) {
   var nowMs    = Date.now();
   var grantId  = "bg-" + generateToken(16);
   var sessionId = (opts.req && opts.req.session && opts.req.session.id) || null;
-  var ipFromReq = (opts.req && opts.req.socket && opts.req.socket.remoteAddress) || null;
+  // Honor the framework-wide trustProxy setting from init() — same
+  // boundary as middleware. Without trustProxy, X-Forwarded-For is
+  // ignored as attacker-forgeable, and the grant pins to the socket
+  // remoteAddress only.
+  var ipFromReq = requestHelpers.clientIp(opts.req, { trustProxy: _trustProxy });
 
   var grantRow = {
     _id:                grantId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",