@cosmicdrift/kumiko-dev-server 0.51.0 → 0.53.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.51.0",
+  "version": "0.53.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/__tests__/run-prod-app.integration.test.ts

@@ -706,3 +706,44 @@ describe("runProdApp: lokaler Event-Dispatcher (MSP-Anwendung im Single-Containe
     expect(handle.entrypoint.eventDispatcher).toBeUndefined();
   });
 });
+
+// Origin-guard config (framework #340) flows from runProdApp's auth options
+// through to buildServer. Before the forwarding fix, RunProdAppAuthOptions had
+// no `allowedOrigins`, so a cookieDomain app could not satisfy the fail-closed
+// guard — it could only CrashLoop.
+describe("runProdApp — auth allowedOrigins forwarding", () => {
+  const ADMIN = {
+    email: "origin-guard@example.eu",
+    password: "test-pw-strong-1234",
+    displayName: "Admin",
+    memberships: [],
+  };
+
+  test("cookieDomain without allowedOrigins fails closed — guard is wired through runProdApp", async () => {
+    await expect(
+      boot(undefined, { auth: { admin: ADMIN, cookieDomain: "example.eu" } }),
+    ).rejects.toThrow(/allowedOrigins is empty/);
+  });
+
+  test("cookieDomain + allowedOrigins clears the guard — allowlist reaches buildServer", async () => {
+    // Without the forwarding fix this would ALSO throw /allowedOrigins is empty/.
+    // It may still fail later on the minimal harness (no auth tables migrated),
+    // but never on the origin guard — that is the forwarding proof.
+    let bootError: unknown;
+    try {
+      const handle = await boot(undefined, {
+        auth: {
+          admin: ADMIN,
+          cookieDomain: "example.eu",
+          allowedOrigins: ["https://app.example.eu"],
+        },
+      });
+      expect(handle).toBeDefined();
+    } catch (error) {
+      bootError = error;
+    }
+    if (bootError !== undefined) {
+      expect(String(bootError)).not.toMatch(/allowedOrigins is empty/);
+    }
+  });
+});

package/src/run-dev-app.ts

@@ -99,6 +99,12 @@ export type RunDevAppAuthOptions = {
   /** Domain attribute for both auth cookies (see
    *  AuthRoutesConfig.cookieDomain). Symmetric zu RunProdAppAuthOptions. */
   readonly cookieDomain?: string;
+  /** Server-side Origin allowlist for the CSRF guard (see
+   *  AuthRoutesConfig.allowedOrigins). Symmetric zu RunProdAppAuthOptions —
+   *  required once `cookieDomain` is set. */
+  readonly allowedOrigins?: readonly string[];
+  /** Opt out of the Origin guard. Symmetric zu RunProdAppAuthOptions. */
+  readonly unsafeSkipOriginCheck?: boolean;
 };
 
 /** Hook for app-specific seeding (demo data, fixtures). Runs after the
@@ -300,6 +306,12 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
         ...(options.auth.cookieDomain !== undefined && {
           cookieDomain: options.auth.cookieDomain,
         }),
+        ...(options.auth.allowedOrigins !== undefined && {
+          allowedOrigins: options.auth.allowedOrigins,
+        }),
+        ...(options.auth.unsafeSkipOriginCheck !== undefined && {
+          unsafeSkipOriginCheck: options.auth.unsafeSkipOriginCheck,
+        }),
         ...sessionAuthFragment,
         ...(options.auth.passwordReset && {
           passwordReset: {

package/src/run-prod-app.ts

@@ -280,6 +280,15 @@ export type RunProdAppAuthOptions = {
    *  AuthRoutesConfig.cookieDomain). Set to the registrable parent
    *  domain when login and app live on different subdomains. */
   readonly cookieDomain?: string;
+  /** Server-side Origin allowlist for the CSRF guard (see
+   *  AuthRoutesConfig.allowedOrigins). REQUIRED once `cookieDomain` is set —
+   *  buildServer fails closed otherwise. Apex + admin host, never tenant
+   *  subdomains. */
+  readonly allowedOrigins?: readonly string[];
+  /** Opt out of the Origin guard (see AuthRoutesConfig.unsafeSkipOriginCheck)
+   *  — accept the wide-cookie CSRF risk explicitly instead of setting
+   *  `allowedOrigins`. */
+  readonly unsafeSkipOriginCheck?: boolean;
 };
 
 /** Hook for app-specific seeding — runs after the admin (when auth is
@@ -725,6 +734,12 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
         ...(options.auth.cookieDomain !== undefined && {
           cookieDomain: options.auth.cookieDomain,
         }),
+        ...(options.auth.allowedOrigins !== undefined && {
+          allowedOrigins: options.auth.allowedOrigins,
+        }),
+        ...(options.auth.unsafeSkipOriginCheck !== undefined && {
+          unsafeSkipOriginCheck: options.auth.unsafeSkipOriginCheck,
+        }),
         ...sessionAuthFragment,
         ...(options.auth.passwordReset && {
           passwordReset: {