@colixsystems/widget-sdk 0.272.0 → 0.273.0

package/README.md

@@ -86,7 +86,11 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.272.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.273.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.273.0 (contract 1.223.0)
+
+**A widget never mints or sets its own permission header.** The host attaches each widget's `X-Widget-Scopes` header itself, from what that widget was granted. Source that calls `/widgets/scope-token` or sets `X-Widget-Scopes` (any casing) is now a blocking `no-scope-header-mint` finding, listed in the new `CONTRACT.scopeMintPatterns`. Comments are not scanned. Declare the scopes your hooks need in `manifest.requestedScopes`, as before; a widget that does that is unaffected.
 
 ### What's new in 0.272.0 (contract 1.222.0)
 

package/dist/contract.cjs

@@ -4956,6 +4956,12 @@ const TRANSLATION_API_HOSTS = [
   "lingvanex.com",
 ];
 
+// sc-12906: the host mints a widget's `X-Widget-Scopes` header, never the
+// widget. Bundles share the host's JS realm, so a widget calling the mint
+// itself, or forging the header, could borrow another widget's scopes. Matched
+// case-insensitively against code (comments are blanked before matching).
+const SCOPE_MINT_PATTERNS = ["/widgets/scope-token", "x-widget-scopes"];
+
 // sc-4686 — the currency a price renders in when the HOST does not supply the
 // workspace's own (a host predating the workspace.currency slice, or a caller
 // that forgot to wire it). A rendering fallback so a price is never blank or
@@ -6559,7 +6565,10 @@ const CONTRACT = deepFreeze({
   // 1.222.0: stricter (sc-14479) — `self`, `top`, `parent`, `frames`,
   //    `opener`, `frameElement` and `.constructor` join bannedApis; `eval` and
   //    `Function` are refused as any reference, not only as a call.
-  version: "1.222.0",
+  // 1.223.0: stricter (sc-12906) — `scopeMintPatterns`; a widget that calls
+  //    the scope-header mint or sets `X-Widget-Scopes` is refused
+  //    (`no-scope-header-mint`).
+  version: "1.223.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6604,6 +6613,7 @@ const CONTRACT = deepFreeze({
   currencyFormats: CURRENCY_FORMATS,
   currencyFormatFallback: CURRENCY_FORMAT_FALLBACK,
   translationApiHosts: TRANSLATION_API_HOSTS,
+  scopeMintPatterns: SCOPE_MINT_PATTERNS,
 });
 
 function isHookAllowed(name) {

package/dist/contract.js

@@ -4953,6 +4953,12 @@ const TRANSLATION_API_HOSTS = [
   "lingvanex.com",
 ];
 
+// sc-12906: the host mints a widget's `X-Widget-Scopes` header, never the
+// widget. Bundles share the host's JS realm, so a widget calling the mint
+// itself, or forging the header, could borrow another widget's scopes. Matched
+// case-insensitively against code (comments are blanked before matching).
+const SCOPE_MINT_PATTERNS = ["/widgets/scope-token", "x-widget-scopes"];
+
 // sc-4686 — the currency a price renders in when the HOST does not supply the
 // workspace's own (a host predating the workspace.currency slice, or a caller
 // that forgot to wire it). A rendering fallback so a price is never blank or
@@ -6556,7 +6562,10 @@ const CONTRACT = deepFreeze({
   // 1.222.0: stricter (sc-14479) — `self`, `top`, `parent`, `frames`,
   //    `opener`, `frameElement` and `.constructor` join bannedApis; `eval` and
   //    `Function` are refused as any reference, not only as a call.
-  version: "1.222.0",
+  // 1.223.0: stricter (sc-12906) — `scopeMintPatterns`; a widget that calls
+  //    the scope-header mint or sets `X-Widget-Scopes` is refused
+  //    (`no-scope-header-mint`).
+  version: "1.223.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6601,6 +6610,7 @@ const CONTRACT = deepFreeze({
   currencyFormats: CURRENCY_FORMATS,
   currencyFormatFallback: CURRENCY_FORMAT_FALLBACK,
   translationApiHosts: TRANSLATION_API_HOSTS,
+  scopeMintPatterns: SCOPE_MINT_PATTERNS,
 });
 
 function isHookAllowed(name) {

package/dist/linter.cjs

@@ -763,6 +763,36 @@ function _translationApiRules(source) {
   return findings;
 }
 
+// sc-12906 — no-scope-header-mint.
+//
+// The host mints each widget's `X-Widget-Scopes` header from the widget's own
+// installation. A bundle runs in the host's JS realm, so one that calls the
+// mint itself, or sets the header, could borrow another widget's scopes. The
+// server refuses a built-in nobody placed; this catches the attempt at publish.
+// An error with no opt-out: no correct widget touches either.
+function _scopeMintRules(source) {
+  const findings = [];
+  const needles = CONTRACT.scopeMintPatterns || [];
+  const lines = _stripNonCode(source, { keepStrings: true }).split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const lowered = lines[i].toLowerCase();
+    const needle = needles.find((n) => lowered.includes(n));
+    if (!needle) continue;
+    findings.push({
+      rule: "no-scope-header-mint",
+      severity: "error",
+      label:
+        `source references "${needle}" — the host attaches each widget's ` +
+        `permission header itself. Never call that endpoint or set that ` +
+        `header; declare the scopes your hooks need in ` +
+        `manifest.requestedScopes.`,
+      line: i + 1,
+      snippet: lines[i].trim().slice(0, 200),
+    });
+  }
+  return findings;
+}
+
 // REQ-USERMGMT / REQ-ACL-SYS M3 — scope-required-for-user-mutation. See
 // linter.js for the rationale comment. The two files must stay in
 // lockstep (the contract test asserts behaviour-equivalence).
@@ -2460,6 +2490,7 @@ function lintSource(source, options) {
   // sc-6970 — soft warning: HTML markup spliced into a content string.
   findings.push(..._htmlInContentRules(source));
   findings.push(..._translationApiRules(source));
+  findings.push(..._scopeMintRules(source));
   findings.push(..._handBuiltPageUrlRules(source));
   findings.push(..._lucideIconRules(source));
   findings.push(..._bundledAssetRules(source, options && options.assetFiles));

package/dist/linter.js

@@ -695,6 +695,36 @@ function _translationApiRules(source) {
   return findings;
 }
 
+// sc-12906 — no-scope-header-mint.
+//
+// The host mints each widget's `X-Widget-Scopes` header from the widget's own
+// installation. A bundle runs in the host's JS realm, so one that calls the
+// mint itself, or sets the header, could borrow another widget's scopes. The
+// server refuses a built-in nobody placed; this catches the attempt at publish.
+// An error with no opt-out: no correct widget touches either.
+function _scopeMintRules(source) {
+  const findings = [];
+  const needles = CONTRACT.scopeMintPatterns || [];
+  const lines = _stripNonCode(source, { keepStrings: true }).split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const lowered = lines[i].toLowerCase();
+    const needle = needles.find((n) => lowered.includes(n));
+    if (!needle) continue;
+    findings.push({
+      rule: "no-scope-header-mint",
+      severity: "error",
+      label:
+        `source references "${needle}" — the host attaches each widget's ` +
+        `permission header itself. Never call that endpoint or set that ` +
+        `header; declare the scopes your hooks need in ` +
+        `manifest.requestedScopes.`,
+      line: i + 1,
+      snippet: lines[i].trim().slice(0, 200),
+    });
+  }
+  return findings;
+}
+
 // REQ-USERMGMT / REQ-ACL-SYS M3 — scope-required-for-user-mutation.
 //
 // A widget that calls `useUsers().invite()` / `.deactivate()` /
@@ -2520,6 +2550,7 @@ export function lintSource(source, options) {
   // sc-6970 — soft warning: HTML markup spliced into a content string.
   findings.push(..._htmlInContentRules(source));
   findings.push(..._translationApiRules(source));
+  findings.push(..._scopeMintRules(source));
   findings.push(..._handBuiltPageUrlRules(source));
   findings.push(..._lucideIconRules(source));
   findings.push(..._bundledAssetRules(source, options && options.assetFiles));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.272.0",
+  "version": "0.273.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",

package/src/contract.js

@@ -4953,6 +4953,12 @@ const TRANSLATION_API_HOSTS = [
   "lingvanex.com",
 ];
 
+// sc-12906: the host mints a widget's `X-Widget-Scopes` header, never the
+// widget. Bundles share the host's JS realm, so a widget calling the mint
+// itself, or forging the header, could borrow another widget's scopes. Matched
+// case-insensitively against code (comments are blanked before matching).
+const SCOPE_MINT_PATTERNS = ["/widgets/scope-token", "x-widget-scopes"];
+
 // sc-4686 — the currency a price renders in when the HOST does not supply the
 // workspace's own (a host predating the workspace.currency slice, or a caller
 // that forgot to wire it). A rendering fallback so a price is never blank or
@@ -6556,7 +6562,10 @@ const CONTRACT = deepFreeze({
   // 1.222.0: stricter (sc-14479) — `self`, `top`, `parent`, `frames`,
   //    `opener`, `frameElement` and `.constructor` join bannedApis; `eval` and
   //    `Function` are refused as any reference, not only as a call.
-  version: "1.222.0",
+  // 1.223.0: stricter (sc-12906) — `scopeMintPatterns`; a widget that calls
+  //    the scope-header mint or sets `X-Widget-Scopes` is refused
+  //    (`no-scope-header-mint`).
+  version: "1.223.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,
@@ -6601,6 +6610,7 @@ const CONTRACT = deepFreeze({
   currencyFormats: CURRENCY_FORMATS,
   currencyFormatFallback: CURRENCY_FORMAT_FALLBACK,
   translationApiHosts: TRANSLATION_API_HOSTS,
+  scopeMintPatterns: SCOPE_MINT_PATTERNS,
 });
 
 function isHookAllowed(name) {