@blamejs/core 0.7.85 → 0.7.86

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.86** (2026-05-06) — `b.middleware.csrfProtect({ requireJsonContentType: true })` — strict-fetch mode for JSON-only API surfaces. State-changing requests (POST/PUT/PATCH/DELETE) without `Content-Type: application/json` are refused before the token check with `CSRF: state-changing requests require Content-Type: application/json.` and audit emission `csrf.denied` with `reason: "non-JSON content-type: ..."`. The browser's form-encoded POST shape is the canonical CSRF vector — a malicious page can `<form action="/transfer" method=POST>` a victim into a state-changing request without a preflight. An `application/json` body forces a CORS preflight (the browser refuses to skip it for non-simple Content-Type values), so an attacker without an operator-allowlisted CORS origin can't reach the route at all. Default `false` — operators with HTML form submissions on the same routes (mixed SPA + classic form pages) keep current behavior; pure-fetch API operators opt in.
+
 - **0.7.85** (2026-05-06) — `b.auth.statusList` — OAuth Token Status List (draft-ietf-oauth-status-list-20). The canonical credential-revocation mechanism for SD-JWT VC and OpenID for Verifiable Credentials. An issuer publishes a JWT-wrapped bitstring at a URL; relying parties fetch + check the bit at index N to determine if the credential whose `status_list` claim points at that URL+index is valid / invalid / suspended / application-specific. **`b.auth.statusList.create({ size, bits?, fill? })`** allocates a bit-packed buffer (`bits` ∈ {1, 2, 4, 8} per draft §6.1.1, default 1). The returned object exposes `.set(idx, status)` / `.get(idx)` / `.snapshot()` / `.toJwt({ issuer, subject, privateKey, algorithm, expiresInSec?, ... })`. **`b.auth.statusList.fromJwt(token, { publicKey | keyResolver, algorithms?, expectedIssuer?, ... })`** verifies the JWT through `b.auth.jwt.verify` and returns `{ list, claims }` — the list exposes `.get(idx)` to check status of an individual credential without decompressing into a separate Buffer. The bitstring is zlib-deflated (RFC 1951 raw deflate per draft §6.1.4) before base64url encoding so a million-entry list collapses to ~125 KB on the wire when most bits are zero. Caps the compressed payload at 1 MiB; operators publishing larger lists shard. Status constants exported as `b.auth.statusList.STATUS_{VALID,INVALID,SUSPENDED,APPLICATION_SPECIFIC}`. Foundational for the v0.7.58 EU AI Act + eIDAS 2.0 wallet slice.
 
 - **0.7.84** (2026-05-06) — `b.crypto.sri(content, { algorithm? })` — Subresource Integrity hash builder per W3C SRI 1.0. Operators emit `<script integrity="sha384-...">` and `<link integrity="sha384-...">` to defend against CDN compromise + ISP MITM injection — the browser refuses to load a resource whose actual hash diverges from the integrity attribute. Default algorithm is `sha384` (W3C §3.2 — collision margin without sha512's 64-byte overhead); `sha256` and `sha512` also accepted, anything else refused. Accepts `Buffer` / `Uint8Array` / `string` / array of those — array inputs emit multiple space-separated integrity tokens per W3C §3.3 multi-integrity (browser picks the strongest it recognizes). Returns the standard `sha###-<base64>` format ready to paste into the `integrity=""` attribute.

package/lib/middleware/csrf-protect.js

@@ -228,7 +228,7 @@ function create(opts) {
 
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
-    "trustProxy", "checkOrigin", "allowedOrigins",
+    "trustProxy", "checkOrigin", "allowedOrigins", "requireJsonContentType",
   ], "middleware.csrfProtect");
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;
@@ -264,6 +264,19 @@ function create(opts) {
   var allowedOrigins = Array.isArray(opts.allowedOrigins)
     ? opts.allowedOrigins.slice() : null;
 
+  // requireJsonContentType — strict-fetch mode for JSON-only API
+  // surfaces. State-changing requests without `Content-Type:
+  // application/json` are refused before the token check. The browser's
+  // form-encoded POST shape is the canonical CSRF vector — a malicious
+  // page can <form action="/transfer" method=POST> a victim into a
+  // state-changing request without a preflight; an `application/json`
+  // body forces a CORS preflight (the browser refuses to skip it for
+  // non-simple Content-Type values), so an attacker without an
+  // operator-allowlisted CORS origin can't reach the route at all.
+  // Operators with HTML form submissions on the same routes (mixed
+  // SPA + classic form pages) leave this opt-out (default).
+  var requireJsonCt = opts.requireJsonContentType === true;
+
   // Cookie issuance config (only when opts.cookie is set).
   var cookieCfg = null;
   if (hasCookie) {
@@ -353,6 +366,16 @@ function create(opts) {
 
     if (methods.indexOf(req.method) === -1) return next();
 
+    // requireJsonContentType — refuse before the token check.
+    if (requireJsonCt) {
+      var ct = req.headers && req.headers["content-type"];
+      var bare = (typeof ct === "string" ? ct.split(";")[0].trim().toLowerCase() : "");
+      if (bare !== "application/json") {
+        _emitDenied(req, "non-JSON content-type: " + (bare || "<absent>"));
+        return _writeReject(res, "CSRF: state-changing requests require Content-Type: application/json.");
+      }
+    }
+
     // Origin / Referer cross-check (defense-in-depth alongside the
     // double-submit token). Refuses cross-origin state-changing
     // requests even when the token is valid (e.g. operator-mistaken

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.85",
+  "version": "0.7.86",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c3167b3e-7af4-4368-b131-46f9d9c44ccc",
+  "serialNumber": "urn:uuid:256e94d1-19a3-4626-8930-d068f5ff939f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-06T06:22:16.402Z",
+    "timestamp": "2026-05-06T06:31:01.232Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.85",
+      "bom-ref": "@blamejs/core@0.7.86",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.85",
+      "version": "0.7.86",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.85",
+      "purl": "pkg:npm/%40blamejs/core@0.7.86",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.85",
+      "ref": "@blamejs/core@0.7.86",
       "dependsOn": []
     }
   ]