@cosmicdrift/kumiko-framework 0.200.1 → 0.202.0

package/src/engine/feature-ast/render.ts

@@ -9,6 +9,11 @@
 //   - Mixed patterns (writeHandler, hook, screen) embed the original
 //     source-text of opaque bodies (handler/fn/closure) verbatim via
 //     SourceLocation.raw — the renderer doesn't re-print closure code.
+//   - Patterns carrying a RawRefSentinel value (e.g. entity/metric/secret
+//     `definition`/`options`) or a `*NameRaw` identifier reference
+//     (useExtension/defineEvent/extendsRegistrar) fall back to positional-arg
+//     form instead of Object-Form, since the raw source text can't be spread
+//     into a merged object literal without losing its verbatim-ness.
 //   - Comments inside an existing pattern are NOT preserved (Designer
 //     edits via forms; for AI generation the output is fresh anyway).
 //
@@ -306,8 +311,16 @@ function renderReferenceData(p: ReferenceDataPattern): string {
 }
 
 function renderUseExtension(p: UseExtensionPattern): string {
+  const nameLiteral = p.extensionNameRaw ?? JSON.stringify(p.extensionName);
   if (isRawRefSentinel(p.options)) {
-    return `r.useExtension(${JSON.stringify(p.extensionName)}, ${JSON.stringify(p.entityName)}, ${p.options.__raw});`;
+    return `r.useExtension(${nameLiteral}, ${JSON.stringify(p.entityName)}, ${p.options.__raw});`;
+  }
+  if (p.extensionNameRaw !== undefined) {
+    // A raw-ref name can't be spread into the merged Object-Form without
+    // losing it to renderValue's plain-string serialization — fall back
+    // to positional form, which keeps the reference verbatim (#2111).
+    const optionsArg = p.options !== undefined ? `, ${renderValue(p.options)}` : "";
+    return `r.useExtension(${nameLiteral}, ${JSON.stringify(p.entityName)}${optionsArg});`;
   }
   const merged: Record<string, unknown> = {
     name: p.extensionName,
@@ -506,14 +519,13 @@ function renderMultiStreamProjection(p: MultiStreamProjectionPattern): string {
 }
 
 function renderDefineEvent(p: DefineEventPattern): string {
+  const nameLiteral = p.eventNameRaw ?? JSON.stringify(p.eventName);
   const migrationEntries = p.migrations !== undefined ? Object.entries(p.migrations) : [];
   const hasOptions = p.version !== undefined || migrationEntries.length > 0;
   if (!hasOptions) {
-    return `r.defineEvent(${JSON.stringify(p.eventName)}, ${p.schemaSource.raw});`;
+    return `r.defineEvent(${nameLiteral}, ${p.schemaSource.raw});`;
   }
-  const lines: string[] = [
-    `r.defineEvent(${JSON.stringify(p.eventName)}, ${p.schemaSource.raw}, {`,
-  ];
+  const lines: string[] = [`r.defineEvent(${nameLiteral}, ${p.schemaSource.raw}, {`];
   if (p.version !== undefined) lines.push(`  version: ${p.version},`);
   if (migrationEntries.length > 0) {
     lines.push("  migrations: [");
@@ -530,7 +542,8 @@ function renderDefineEvent(p: DefineEventPattern): string {
 }
 
 function renderExtendsRegistrar(p: ExtendsRegistrarPattern): string {
-  return `r.extendsRegistrar(${JSON.stringify(p.extensionName)}, ${p.defBody.raw});`;
+  const nameLiteral = p.extensionNameRaw ?? JSON.stringify(p.extensionName);
+  return `r.extendsRegistrar(${nameLiteral}, ${p.defBody.raw});`;
 }
 
 function renderEnvSchema(p: EnvSchemaPattern): string {

package/src/engine/index.ts

@@ -70,6 +70,7 @@ export {
   defineProjectionQueryHandler,
   type EntityCrudRegistrar,
   entityListSchema,
+  MAX_LIST_LIMIT,
   type RegisterEntityCrudOptions,
   registerEntityCrud,
 } from "./entity-handlers";

package/src/files/__tests__/files.integration.test.ts

@@ -33,7 +33,7 @@ import type { FileRoutesOptions } from "../file-routes";
 import { createInMemoryFileProvider } from "../in-memory-provider";
 import { createLocalProvider } from "../local-provider";
 import type { FileStorageProvider } from "../types";
-import { parseMaxSize, validateFile } from "../types";
+import { parseMaxSize, sniffMimeType, validateFile } from "../types";
 
 // UUID for "this row doesn't exist" assertions. Valid v4 format so PG accepts
 // the query — the row just isn't there. Pre-v1 files-feature tests used
@@ -199,6 +199,28 @@ describe("file validation", () => {
       validateFile({ fileName: "a.jpg", mimeType: "image/jpg", size: 100 }, { accept: ["jpg"] }),
     ).toBeNull();
   });
+
+  test("sniffMimeType recognizes gif, webp and pdf signatures", () => {
+    expect(sniffMimeType(new TextEncoder().encode(`GIF89a${"x".repeat(20)}`))).toBe("image/gif");
+    const webp = new Uint8Array([
+      ...new TextEncoder().encode("RIFF"),
+      0,
+      0,
+      0,
+      0,
+      ...new TextEncoder().encode("WEBP"),
+      ...Array(20).fill(0),
+    ]);
+    expect(sniffMimeType(webp)).toBe("image/webp");
+    expect(sniffMimeType(new TextEncoder().encode(`%PDF-1.4${"x".repeat(20)}`))).toBe(
+      "application/pdf",
+    );
+  });
+
+  test("sniffMimeType returns null for unrecognized or too-short byte sequences", () => {
+    expect(sniffMimeType(new Uint8Array([0x00, 0x01, 0x02]))).toBeNull();
+    expect(sniffMimeType(new TextEncoder().encode("hello world"))).toBeNull();
+  });
 });
 
 // --- Integration: Upload → Download → Delete via real HTTP API ---
@@ -312,6 +334,80 @@ describe("file upload flow via API", () => {
   });
 });
 
+// --- Serving hardens Content-Type against a spoofed/mismatched declared MIME ---
+
+describe("download Content-Type is sniffed from bytes, not trusted from the declared MIME", () => {
+  const testPngContent = new Uint8Array([
+    0x89,
+    0x50,
+    0x4e,
+    0x47,
+    0x0d,
+    0x0a,
+    0x1a,
+    0x0a,
+    ...Array(50).fill(0),
+  ]);
+  const testJpegContent = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, ...Array(50).fill(0)]);
+
+  test("real PNG bytes declared as text/html are served as octet-stream, never text/html", async () => {
+    // Bun's own Request#formData() derives File#type from the *filename*
+    // extension, not from the multipart part's declared Content-Type header
+    // — so the fileName here (.html) is what actually lands as the stored
+    // mimeType; the mismatch this test needs is against the real PNG bytes.
+    const uploadRes = await uploadFile(adminUser, "sneaky.html", testPngContent, "text/html");
+    // Upload itself is not rejected — mismatch enforcement stays at the
+    // serving side, existing uploads with an off mimeType keep working.
+    expect(uploadRes.status).toBe(201);
+    const { id } = await uploadRes.json();
+
+    const res = await getFile(adminUser, id);
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).toBe("application/octet-stream");
+    expect(res.headers.get("Content-Disposition")).toContain("attachment");
+  });
+
+  test("actual HTML bytes are never served as text/html or image/svg+xml", async () => {
+    const htmlBytes = new TextEncoder().encode(
+      "<html><body><script>alert(document.domain)</script></body></html>",
+    );
+    const uploadRes = await uploadFile(adminUser, "evil.html", htmlBytes, "text/html");
+    expect(uploadRes.status).toBe(201);
+    const { id } = await uploadRes.json();
+
+    const res = await getFile(adminUser, id);
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).not.toBe("text/html");
+    expect(res.headers.get("Content-Type")).not.toBe("image/svg+xml");
+    expect(res.headers.get("Content-Type")).toBe("application/octet-stream");
+    expect(res.headers.get("Content-Disposition")).toContain("attachment");
+  });
+
+  test("an SVG upload — bytes and declared MIME both image/svg+xml — is still downgraded to octet-stream, never served inline", async () => {
+    const svgBytes = new TextEncoder().encode(
+      '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>',
+    );
+    const uploadRes = await uploadFile(adminUser, "logo.svg", svgBytes, "image/svg+xml");
+    expect(uploadRes.status).toBe(201);
+    const { id } = await uploadRes.json();
+
+    const res = await getFile(adminUser, id);
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).not.toBe("image/svg+xml");
+    expect(res.headers.get("Content-Type")).toBe("application/octet-stream");
+  });
+
+  test("regression: a real allowed image type with a correctly declared MIME still serves with the matching sniffed Content-Type", async () => {
+    const uploadRes = await uploadFile(adminUser, "photo.jpg", testJpegContent, "image/jpeg");
+    expect(uploadRes.status).toBe(201);
+    const { id } = await uploadRes.json();
+
+    const res = await getFile(adminUser, id);
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).toBe("image/jpeg");
+  });
+});
+
 // --- Cross-user access within a tenant (attached file owner-scope) ---
 
 describe("attached file owner-scope", () => {

package/src/files/file-routes.ts

@@ -18,7 +18,7 @@ import { createFileContext } from "./file-handle";
 import { fileRefEntity } from "./file-ref-entity";
 import { fileRefsTable } from "./file-ref-table";
 import type { FileProviderResolver } from "./provider-resolver";
-import { buildStorageKey, validateFile } from "./types";
+import { buildStorageKey, resolveServedContentType, validateFile } from "./types";
 
 // Decision returned by a FileAccessGuard — distinct from boolean so callers
 // can't accidentally negate or default it.
@@ -234,11 +234,19 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
 
     const storageProvider = await options.resolveProvider(user.tenantId);
     const data = await storageProvider.read(fileRef.storageKey);
+    // The stored mimeType is client-declared (file.type off the upload) and
+    // never verified against the bytes — serving it as-is would let a
+    // client label real HTML/SVG as e.g. image/png to slip active content
+    // out under a trusted-looking Content-Type. Sniff the actual bytes
+    // instead; anything that isn't a known-safe binary signature (including
+    // svg/html, which have none) goes out as application/octet-stream.
+    const contentType = resolveServedContentType(data, fileRef.mimeType);
     return new Response(Buffer.from(data), {
       headers: {
-        "Content-Type": fileRef.mimeType,
+        "Content-Type": contentType,
         "Content-Disposition": buildContentDispositionHeader(fileRef.fileName),
         "Content-Length": String(fileRef.size),
+        "X-Content-Type-Options": "nosniff",
       },
     });
   });

package/src/files/types.ts

@@ -52,6 +52,78 @@ const EXTENSION_MIME_WHITELIST: Record<string, readonly string[]> = {
   md: ["text/markdown", "text/plain"],
 } satisfies Record<string, readonly string[]>;
 
+// Magic-byte signatures for the subset of EXTENSION_MIME_WHITELIST that has
+// a reliable binary signature. Used at SERVE time — never trust the stored/
+// client-declared mimeType for Content-Type on its own, sniff the actual
+// bytes instead. Types without a stable signature (svg, txt, csv, json, md)
+// and anything that matches none of these fall back to
+// application/octet-stream in resolveServedContentType below — this also
+// guarantees text/html and image/svg+xml are never served inline, even for
+// an honestly-declared upload.
+const MAGIC_BYTE_SIGNATURES: ReadonlyArray<{
+  readonly mimeType: string;
+  readonly matches: (bytes: Uint8Array) => boolean;
+}> = [
+  {
+    mimeType: "image/png",
+    matches: (bytes) => startsWithBytes(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+  },
+  { mimeType: "image/jpeg", matches: (bytes) => startsWithBytes(bytes, [0xff, 0xd8, 0xff]) },
+  {
+    mimeType: "image/gif",
+    matches: (bytes) => startsWithAscii(bytes, "GIF87a") || startsWithAscii(bytes, "GIF89a"),
+  },
+  {
+    mimeType: "image/webp",
+    matches: (bytes) => startsWithAscii(bytes, "RIFF") && startsWithAscii(bytes, "WEBP", 8),
+  },
+  { mimeType: "application/pdf", matches: (bytes) => startsWithAscii(bytes, "%PDF-") },
+];
+
+function startsWithBytes(bytes: Uint8Array, signature: readonly number[]): boolean {
+  if (bytes.length < signature.length) return false;
+  return signature.every((byte, i) => bytes[i] === byte);
+}
+
+function startsWithAscii(bytes: Uint8Array, ascii: string, offset = 0): boolean {
+  if (bytes.length < offset + ascii.length) return false;
+  for (let i = 0; i < ascii.length; i++) {
+    if (bytes[offset + i] !== ascii.charCodeAt(i)) return false;
+  }
+  return true;
+}
+
+export function sniffMimeType(bytes: Uint8Array): string | null {
+  for (const signature of MAGIC_BYTE_SIGNATURES) {
+    if (signature.matches(bytes)) return signature.mimeType;
+  }
+  return null;
+}
+
+// image/jpg is not a registered IANA type but EXTENSION_MIME_WHITELIST above
+// accepts it as a jpg alias — sniffMimeType only ever returns the canonical
+// image/jpeg, so without this a legitimately-declared "image/jpg" upload
+// would mismatch its own sniffed type and get needlessly downgraded.
+const DECLARED_MIME_ALIASES: Readonly<Record<string, string>> = {
+  "image/jpg": "image/jpeg",
+};
+
+// The Content-Type a served file's bytes are safe to go out with. Bytes that
+// don't sniff as one of the known-safe binary signatures (including
+// svg/html/text formats, which have no reliable magic bytes) always
+// downgrade to application/octet-stream. Bytes that DO sniff safely still
+// downgrade unless the sniffed type matches what was declared at upload —
+// a mismatch (e.g. real PNG bytes uploaded as "text/html") is itself a
+// spoofing signal and is never trusted enough to pick a Content-Type from,
+// even one that would otherwise be harmless.
+export function resolveServedContentType(bytes: Uint8Array, declaredMimeType: string): string {
+  const sniffed = sniffMimeType(bytes);
+  if (!sniffed) return "application/octet-stream";
+  const normalizedDeclared = declaredMimeType.toLowerCase().split(";")[0]?.trim() ?? "";
+  const declared = DECLARED_MIME_ALIASES[normalizedDeclared] ?? normalizedDeclared;
+  return sniffed === declared ? sniffed : "application/octet-stream";
+}
+
 export function validateFile(
   metadata: FileMetadata,
   options: FileValidationOptions,

package/src/http/__tests__/egress-real-endpoint.integration.test.ts

@@ -0,0 +1,37 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import { lookup } from "node:dns/promises";
+import { egress } from "../egress";
+
+// fw#2149 DoD requires proving TLS/SNI validation stays intact against a
+// real HTTPS endpoint, not just a mock — the self-signed-cert tests in
+// egress.test.ts pin the fetch-by-pinned-IP mechanism, this test pins it
+// against a certificate chain issued by a real, publicly trusted CA.
+// example.com is IANA-reserved and kept up for exactly this kind of use.
+const REAL_HOST = "example.com";
+
+let networkAvailable = true;
+
+beforeAll(async () => {
+  try {
+    await lookup(REAL_HOST);
+  } catch {
+    networkAvailable = false;
+  }
+});
+
+describe("egress external: real HTTPS endpoint", () => {
+  test("connects through the pinned IP and validates the real certificate chain", async () => {
+    if (!networkAvailable) {
+      console.warn(
+        `egress real-endpoint test skipped: DNS resolution for ${REAL_HOST} failed (no network in this environment)`,
+      );
+      return;
+    }
+
+    const fetchIt = egress({ kind: "external" });
+    const res = await fetchIt(`https://${REAL_HOST}/`);
+
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain("Example Domain");
+  });
+});