@bounded-sh/server 0.0.56 → 0.0.58

package/dist/index.js

@@ -810,17 +810,23 @@ class EvmKeypairProvider {
     }
 }
 
-var __rest = (undefined && undefined.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
+// #023: strip caller-supplied auth headers so an operation runs as the isolated wallet, not
+// as whatever headers were forwarded in. HTTP header names are case-insensitive on the wire,
+// so a fixed `Authorization`/`authorization` destructure let a mixed-case `AUTHORIZATION`
+// survive and ride along. Drop every header whose lowercased name is authorization (plus
+// proxy-authorization / cookie, which would likewise leak a caller identity into the session).
+const STRIP_HEADER_NAMES = new Set(["authorization", "proxy-authorization", "cookie"]);
+function stripCallerAuthHeaders(headers) {
+    if (!headers)
+        return undefined;
+    const rest = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (!STRIP_HEADER_NAMES.has(name.toLowerCase()))
+            rest[name] = value;
+    }
+    return Object.keys(rest).length > 0 ? rest : undefined;
+}
+
 /* ------------------------------------------------------------------ */
 /*  Keypair parsing                                                    */
 /* ------------------------------------------------------------------ */
@@ -868,7 +874,11 @@ class WalletClient {
         this.evmTransactionPolicy = evmTransactionPolicy;
         this.live = {
             intent: (roomPath, intent, opts = {}) => core.live.intent(roomPath, intent, this.mergeLiveIntentOptions(opts)),
-            status: (roomPath, opts = {}) => core.live.status(roomPath, Object.assign(Object.assign({}, opts), { headers: this.sanitizeHeaders(opts.headers) })),
+            // Route status through the SAME auth merge intent uses so a server-keypair
+            // agent's session token rides the request. Without it the agent sends the
+            // public app id only and the server returns the slim anonymous shape rather
+            // than the full diagnostics the authenticated agent is entitled to (#102).
+            status: (roomPath, opts = {}) => core.live.status(roomPath, this.mergeLiveStatusOptions(opts)),
             // Agent-as-player view stream: subscribe to THIS wallet's per-player view
             // under the wallet's own session (per-subscription overrides — no global
             // auth needed). The view id defaults to this wallet's @user.id (== its
@@ -908,12 +918,9 @@ class WalletClient {
                 this.sessionManager.clearSession();
             }, _walletAddress: this.address }, (this.evmTransactionPolicy ? { _evmTransactionPolicy: this.evmTransactionPolicy } : {}));
     }
-    /** Strip Authorization from caller headers to prevent overriding wallet token */
+    /** #023: strip caller Authorization (any casing) so operations run as the isolated wallet. */
     sanitizeHeaders(headers) {
-        if (!headers)
-            return undefined;
-        const _a = headers, { Authorization, authorization } = _a, rest = __rest(_a, ["Authorization", "authorization"]);
-        return Object.keys(rest).length > 0 ? rest : undefined;
+        return stripCallerAuthHeaders(headers);
     }
     mergeSetOverrides(opts) {
         var _a;
@@ -930,6 +937,12 @@ class WalletClient {
         const merged = Object.assign(Object.assign({}, opts), { headers: this.sanitizeHeaders(opts === null || opts === void 0 ? void 0 : opts.headers), _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress }) });
         return merged;
     }
+    mergeLiveStatusOptions(opts) {
+        var _a;
+        const ovr = this.buildOverrides();
+        const merged = Object.assign(Object.assign({}, opts), { headers: this.sanitizeHeaders(opts === null || opts === void 0 ? void 0 : opts.headers), _overrides: Object.assign(Object.assign({}, opts === null || opts === void 0 ? void 0 : opts._overrides), { headers: this.sanitizeHeaders((_a = opts === null || opts === void 0 ? void 0 : opts._overrides) === null || _a === void 0 ? void 0 : _a.headers), _getAuthHeaders: ovr._getAuthHeaders, _clearAuth: ovr._clearAuth, _walletAddress: ovr._walletAddress }) });
+        return merged;
+    }
     /* ---- Data operations ---- */
     async set(path, document, options) {
         return core.set(path, document, this.mergeSetOverrides(options));
@@ -1344,8 +1357,29 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
     if (Math.abs(nowSeconds - payload.timestamp) > maxSkew) {
         throw new WebhookVerificationError(`Webhook timestamp outside allowed skew of ${maxSkew}s (delta ${Math.abs(nowSeconds - payload.timestamp)}s).`);
     }
-    if (opts.expectedAppId !== undefined && payload.appId !== opts.expectedAppId) {
-        throw new WebhookVerificationError(`Webhook appId "${payload.appId}" does not match expected appId "${opts.expectedAppId}".`);
+    // #072: bind the delivery to an app by DEFAULT. The shared platform signing key means a
+    // valid signature proves "from Bounded", not "from your app"; payload.appId is the ONLY
+    // per-app separation. Previously the bind ran only when expectedAppId was passed, so the
+    // secure check was opt-in and a malicious app owner could point their app's webhook at a
+    // victim receiver. Now: an explicit expectedAppId is authoritative; otherwise bind to the
+    // init()-time app id; a multi-app receiver must set allowAnyAppId to accept any app; and
+    // when no app id is resolvable we FAIL CLOSED rather than silently trust any app.
+    if (opts.expectedAppId !== undefined) {
+        if (payload.appId !== opts.expectedAppId) {
+            throw new WebhookVerificationError(`Webhook appId "${payload.appId}" does not match expected appId "${opts.expectedAppId}".`);
+        }
+    }
+    else if (!opts.allowAnyAppId) {
+        const configuredAppId = core.getConfiguredAppId();
+        if (!configuredAppId) {
+            throw new WebhookVerificationError("verifyWebhook cannot determine which app this webhook is for: no expectedAppId was " +
+                "passed and the SDK has no init()-time app id. Pass expectedAppId, or set " +
+                "allowAnyAppId: true to intentionally accept webhooks from any app.");
+        }
+        if (payload.appId !== configuredAppId) {
+            throw new WebhookVerificationError(`Webhook appId "${payload.appId}" does not match the configured app id "${configuredAppId}". ` +
+                "Pass allowAnyAppId: true to accept webhooks from any app.");
+        }
     }
     // Replay cache: reject a previously-seen signed delivery within the skew
     // window. The worker's payload.id is the document id/path, so using it alone