@cosmicdrift/kumiko-framework 0.326.0 → 0.327.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.326.0",
+  "version": "0.327.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -202,8 +202,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.326.0",
-    "@cosmicdrift/kumiko-types": "0.326.0",
+    "@cosmicdrift/kumiko-http": "0.327.0",
+    "@cosmicdrift/kumiko-types": "0.327.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -219,7 +219,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.326.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.327.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/auth-middleware-transport.test.ts

@@ -5,7 +5,13 @@
 import { describe, expect, test } from "bun:test";
 import { Hono } from "hono";
 import { TestUsers } from "../../stack";
-import { AUTH_COOKIE_NAME, authMiddleware, getAuthTransport, getUser } from "../auth-middleware";
+import {
+  AUTH_COOKIE_NAME,
+  authMiddleware,
+  getAuthTokenExpiry,
+  getAuthTransport,
+  getUser,
+} from "../auth-middleware";
 import { createJwtHelper } from "../jwt";
 
 const JWT_SECRET = "auth-middleware-transport-test-secret-min-32-chars";
@@ -78,3 +84,19 @@ describe("auth-middleware transport selection", () => {
     expect(body.error.code).toBe("invalid_token");
   });
 });
+
+describe("auth-middleware token expiry", () => {
+  test("exposes the JWT exp (epoch seconds) to downstream handlers", async () => {
+    const ttlSeconds = 600;
+    const jwt = createJwtHelper(JWT_SECRET, "kumiko", ttlSeconds);
+    const token = await jwt.sign(TestUsers.user);
+    const app = new Hono();
+    app.use("/api/*", authMiddleware(jwt));
+    app.get("/api/exp", (c) => c.json({ exp: getAuthTokenExpiry(c) }));
+    const beforeSec = Math.floor(Date.now() / 1000);
+    const res = await app.request("/api/exp", { headers: { Authorization: `Bearer ${token}` } });
+    const { exp } = (await res.json()) as { exp: number };
+    expect(exp).toBeGreaterThanOrEqual(beforeSec + ttlSeconds - 5);
+    expect(exp).toBeLessThanOrEqual(beforeSec + ttlSeconds + 5);
+  });
+});

package/src/api/__tests__/client-ip.test.ts

@@ -9,9 +9,29 @@ import {
   assertValidTrustedProxyHops,
   type ClientIpHeaderSource,
   createClientIpResolver,
+  extractSocketAddress,
   parseTrustedProxyHopsEnv,
 } from "../client-ip";
 
+describe("extractSocketAddress", () => {
+  test("accepts the bare string shape", () => {
+    expect(extractSocketAddress("10.0.0.1")).toBe("10.0.0.1");
+  });
+
+  test("accepts the object shape used by WebSocket-upgrade requests", () => {
+    expect(extractSocketAddress({ socketAddress: "10.0.0.2", server: {} })).toBe("10.0.0.2");
+  });
+
+  test("returns undefined for empty, missing or wrongly typed values", () => {
+    expect(extractSocketAddress("")).toBeUndefined();
+    expect(extractSocketAddress({ socketAddress: "" })).toBeUndefined();
+    expect(extractSocketAddress({ socketAddress: 42 })).toBeUndefined();
+    expect(extractSocketAddress({})).toBeUndefined();
+    expect(extractSocketAddress(undefined)).toBeUndefined();
+    expect(extractSocketAddress(null)).toBeUndefined();
+  });
+});
+
 function sourceOf(headers: Record<string, string>, socketAddress?: string): ClientIpHeaderSource {
   return {
     header: (name) => headers[name],

package/src/api/__tests__/origin-middleware.test.ts

@@ -12,6 +12,7 @@ import { createJwtHelper } from "../jwt";
 import {
   assertOriginGuardConfig,
   isOriginAllowed,
+  isWebSocketOriginAllowed,
   normalizeOrigin,
   originMiddleware,
 } from "../origin-middleware";
@@ -212,3 +213,67 @@ describe("originMiddleware", () => {
     expect(await readErrorCode(res)).toBe("origin_not_allowed");
   });
 });
+
+describe("isWebSocketOriginAllowed", () => {
+  const HOST = "app.example.eu";
+  const SAME_HOST_ORIGIN = `https://${HOST}`;
+  const allowlist: ReadonlySet<string> = new Set([normalizeOrigin(ALLOWED)]);
+
+  // Probe route: reports the predicate's verdict for the request it received.
+  async function verdict(
+    headers: Record<string, string>,
+    list: ReadonlySet<string> | undefined,
+    transport: "cookie" | "bearer" = "cookie",
+  ): Promise<boolean> {
+    const jwt = createJwtHelper(JWT_SECRET);
+    const token = await jwt.sign(TestUsers.user);
+    const app = new Hono();
+    app.use("/api/*", authMiddleware(jwt));
+    app.get("/api/ws/probe", (c) => c.json({ allowed: isWebSocketOriginAllowed(c, list) }));
+    const auth: Record<string, string> =
+      transport === "cookie"
+        ? { Cookie: `${AUTH_COOKIE_NAME}=${token}` }
+        : { Authorization: `Bearer ${token}` };
+    const res = await app.request("/api/ws/probe", {
+      headers: { Host: HOST, ...auth, ...headers },
+    });
+    const body: unknown = await res.json();
+    if (typeof body !== "object" || body === null || !("allowed" in body)) {
+      throw new Error(`unexpected probe body ${JSON.stringify(body)}`);
+    }
+    return body.allowed === true;
+  }
+
+  test("bearer transport is always allowed, even with a foreign Origin", async () => {
+    expect(await verdict({ Origin: DISALLOWED }, allowlist, "bearer")).toBe(true);
+    expect(await verdict({}, undefined, "bearer")).toBe(true);
+  });
+
+  test("cookie without Origin header is rejected", async () => {
+    expect(await verdict({}, undefined)).toBe(false);
+    expect(await verdict({}, allowlist)).toBe(false);
+  });
+
+  test("Origin 'null' and unparsable origins are rejected", async () => {
+    expect(await verdict({ Origin: "null" }, undefined)).toBe(false);
+    expect(await verdict({ Origin: "not a url" }, undefined)).toBe(false);
+  });
+
+  test("non-empty allowlist: listed origin passes, case/trailing slash normalized", async () => {
+    expect(await verdict({ Origin: ALLOWED }, allowlist)).toBe(true);
+    expect(await verdict({ Origin: `${ALLOWED.toUpperCase()}/` }, allowlist)).toBe(true);
+    expect(await verdict({ Origin: DISALLOWED }, allowlist)).toBe(false);
+  });
+
+  test("non-empty allowlist has no same-host fallback", async () => {
+    expect(await verdict({ Origin: SAME_HOST_ORIGIN }, allowlist)).toBe(false);
+  });
+
+  test("empty or absent allowlist: same host passes (case-insensitive), other host fails", async () => {
+    expect(await verdict({ Origin: SAME_HOST_ORIGIN }, undefined)).toBe(true);
+    expect(await verdict({ Origin: SAME_HOST_ORIGIN }, new Set())).toBe(true);
+    expect(await verdict({ Origin: `https://${HOST.toUpperCase()}` }, undefined)).toBe(true);
+    expect(await verdict({ Origin: DISALLOWED }, undefined)).toBe(false);
+    expect(await verdict({ Origin: `https://${HOST}:8443` }, undefined)).toBe(false);
+  });
+});