@cosmicdrift/kumiko-framework 0.358.0 → 0.360.0

package/dist/api/anonymous-cookie.js

@@ -8,24 +8,18 @@
 // middleware on the next request — no client-side JS needs to read it,
 // and not exposing it to JS keeps it out of XSS reach.
 import { deleteCookie, setCookie } from "hono/cookie";
-import { TENANT_COOKIE_NAME } from "./api-constants.js";
+import { getSessionCookies, hostOnlyDeleteOptions, isHostPrefixedCookieName, TENANT_COOKIE_BASE, } from "./session-cookies.js";
 // 30 days. The tenant assignment is stable for the lifetime of the
 // visitor's relationship with the deployment — re-running the resolver
 // on every visit would just hit the DB for no new information.
 const DEFAULT_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
-// Cookies marked Secure are dropped by browsers on http:// — locked off in
-// dev/test so localhost works without TLS, on in prod where http would be
-// a deployment bug we want to fail loud about (no cookie ⇒ resolver runs
-// every request and the misconfiguration is visible in latency dashboards).
-function cookieSecure() {
-    return process.env["NODE_ENV"] === "production";
-}
 // Stamps the kumiko_tenant cookie on the response. Idempotent — calling it
 // twice in the same request just overwrites with the latest value.
 export function setTenantCookie(c, tenantId, options = {}) {
-    setCookie(c, TENANT_COOKIE_NAME, tenantId, {
+    const { secure, names } = getSessionCookies(c);
+    setCookie(c, names.tenant, tenantId, {
         httpOnly: true,
-        secure: cookieSecure(),
+        secure,
         sameSite: options.sameSite ?? "Lax",
         path: "/",
         maxAge: options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS,
@@ -34,7 +28,10 @@ export function setTenantCookie(c, tenantId, options = {}) {
 // Removes the kumiko_tenant cookie. Use on switch-tenant flows or when
 // the resolver no longer recognises the visitor's tenant — leaving a
 // stale cookie behind would keep them pointed at a deleted tenant.
-// @wrapper-known semantic-alias
 export function deleteTenantCookie(c) {
-    deleteCookie(c, TENANT_COOKIE_NAME, { path: "/" });
+    const { names } = getSessionCookies(c);
+    deleteCookie(c, names.tenant, hostOnlyDeleteOptions(names.tenant));
+    if (isHostPrefixedCookieName(names.tenant)) {
+        deleteCookie(c, TENANT_COOKIE_BASE, { path: "/" });
+    }
 }

package/dist/api/api-constants.d.ts

@@ -42,7 +42,6 @@ export declare const AUTH_RATE_LIMIT_EXEMPT_ROUTES: ReadonlyArray<{
 export declare function isAuthRateLimitExempt(method: string, path: string): boolean;
 export declare const STATE_CHANGING_METHODS: ReadonlySet<string>;
 export declare const TENANT_HEADER_NAME = "X-Tenant";
-export declare const TENANT_COOKIE_NAME = "kumiko_tenant";
 export declare const LOCALE_HEADER_NAME = "X-Locale";
 export declare const NO_ROUTE_MATCH_HEADER_NAME = "X-Kumiko-No-Route-Match";
 export type Route = (typeof Routes)[keyof typeof Routes];

package/dist/api/api-constants.js

@@ -127,7 +127,6 @@ export const STATE_CHANGING_METHODS = new Set([
 // access. The middleware reads header first, then cookie, then falls back to
 // `anonymousAccess.tenantResolver` and finally `anonymousAccess.defaultTenantId`.
 export const TENANT_HEADER_NAME = "X-Tenant";
-export const TENANT_COOKIE_NAME = "kumiko_tenant";
 // Client-declared active UI locale (BCP-47). Read once per request in
 // request-id-middleware.ts, before auth, so it reaches public routes
 // (e.g. signup-request) too. Falls back to Accept-Language, then the app's

package/dist/api/auth-middleware.d.ts

@@ -1,8 +1,6 @@
 import type { Context, Next } from "hono";
 import type { SessionUser, TenantId } from "../engine/types/index.js";
 import type { JwtHelper } from "./jwt.js";
-export declare const AUTH_COOKIE_NAME = "kumiko_auth";
-export declare const CSRF_COOKIE_NAME = "kumiko_csrf";
 export declare const CSRF_HEADER_NAME = "X-CSRF-Token";
 export declare const PAT_TOKEN_PREFIX = "kpat_";
 export type AuthTransport = "cookie" | "bearer";

package/dist/api/auth-middleware.js

@@ -2,16 +2,12 @@ import { getCookie } from "hono/cookie";
 import { TENANT_TEARDOWN_STATUSES } from "../engine/active-membership.js";
 import { createAnonymousUser } from "../engine/system-user.js";
 import { parseTenantId, SYSTEM_TENANT_ID } from "../engine/types/identifiers.js";
-import { isSessionRequiredApiPath, TENANT_COOKIE_NAME, TENANT_HEADER_NAME, } from "./api-constants.js";
+import { isSessionRequiredApiPath, TENANT_HEADER_NAME } from "./api-constants.js";
 import { isForeignCookieOrigin } from "./origin-middleware.js";
+import { clearSessionCookies, getSessionCookies, hasDuplicateSessionCookie, } from "./session-cookies.js";
 const USER_KEY = "pipelineUser";
 const AUTH_TRANSPORT_KEY = "authTransport";
 const AUTH_TOKEN_EXPIRY_KEY = "authTokenExpiry";
-// Names used across middleware and auth-routes. Kept here so csrf-middleware
-// and auth-routes import them from a single source of truth — renaming a
-// cookie is a coordinated change across issuer, reader and deleter.
-export const AUTH_COOKIE_NAME = "kumiko_auth";
-export const CSRF_COOKIE_NAME = "kumiko_csrf";
 export const CSRF_HEADER_NAME = "X-CSRF-Token";
 // Prefix that marks a bearer token as a long-lived Personal Access Token
 // rather than a JWT session. The personal-access-tokens feature mints tokens
@@ -57,7 +53,7 @@ const INVALID_TOKEN_REJECTION = {
 function isStaleCookieDowngradable(c, transport, anonymousAccess) {
     return (transport === "cookie" && anonymousAccess !== undefined && !c.req.path.startsWith("/api/auth/"));
 }
-// Extract the JWT from either the kumiko_auth cookie (web) or the
+// Extract the JWT from either the auth cookie (web) or the
 // Authorization Bearer header (native / server-to-server). The two paths
 // are mutually exclusive: if both are present the request is rejected with
 // `ambiguous_auth` to prevent a confused-deputy bug where a server-bug
@@ -65,8 +61,19 @@ function isStaleCookieDowngradable(c, transport, anonymousAccess) {
 // Note: this is NOT a CSRF control — Bearer-only clients are already safe
 // because browsers can't set Authorization headers cross-origin. The reject
 // exists so future middleware authors can't accidentally mix transports.
+//
+// Duplicate auth/csrf cookie names make the cookie transport untrustworthy:
+// the request is treated as carrying no cookie and every variant is expired,
+// so the browser recovers with a fresh login instead of staying stuck.
 function extractToken(c) {
-    const cookieToken = getCookie(c, AUTH_COOKIE_NAME);
+    const sessionCookies = getSessionCookies(c);
+    let cookieToken;
+    if (hasDuplicateSessionCookie(c, sessionCookies.names)) {
+        clearSessionCookies(c, sessionCookies);
+    }
+    else {
+        cookieToken = getCookie(c, sessionCookies.names.auth);
+    }
     const header = c.req.header("Authorization");
     const bearerToken = header?.startsWith("Bearer ") ? header.slice(7) : undefined;
     if (cookieToken && bearerToken)
@@ -281,7 +288,7 @@ async function handleAnonymous(c, config, next, resolveTenantLifecycleStatus, ex
     // Step 1+2: parse client-supplied tenant. Reject malformed values before
     // they touch any downstream consumer (DB, cache, audit row).
     const headerRaw = c.req.header(TENANT_HEADER_NAME);
-    const cookieRaw = getCookie(c, TENANT_COOKIE_NAME);
+    const cookieRaw = getCookie(c, getSessionCookies(c).names.tenant);
     const headerCheck = parseClientTenant(headerRaw, "X-Tenant header");
     if (headerCheck.error)
         return rejectTenant(headerCheck.error);

package/dist/api/auth-routes.d.ts

@@ -50,8 +50,10 @@ export type AuthRoutesConfig = {
     invite?: InviteConfig;
     cookieSameSite?: "lax" | "strict";
     cookieDomain?: string;
+    secureCookies?: boolean;
     retiredCookieDomains?: readonly string[];
     allowedOrigins?: readonly string[];
+    publicOrigin?: string;
     unsafeSkipOriginCheck?: boolean;
     trustedProxyHops?: number;
     postAuthLanding?: PostAuthLandingResolver;

package/dist/api/auth-routes.js

@@ -9,67 +9,49 @@ import { NotFoundError, toKumikoError, toWriteErrorInfo } from "../errors/index.
 import { assertUnreachable } from "../utils/index.js";
 import { parseRoles } from "../utils/serialization.js";
 import { Routes } from "./api-constants.js";
-import { AUTH_COOKIE_NAME, CSRF_COOKIE_NAME, getUser, } from "./auth-middleware.js";
+import { getUser, } from "./auth-middleware.js";
 import { clientIpSourceFromHonoContext, createClientIpResolver, } from "./client-ip.js";
 import { resolvePostAuthLandingPath } from "./post-auth-landing.js";
+import { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, clearSessionCookies, getSessionCookies, isHostPrefixedCookieName, resolveSessionCookies, } from "./session-cookies.js";
 import { generateToken } from "./tokens.js";
-// Resolves the Secure cookie flag. Locked off in dev/test so Playwright
-// against http://localhost:… can actually receive the cookie. Production
-// flips it on — browsers drop Secure cookies on http, so a misconfigured
-// prod deploy would silently break login rather than fail loud.
-function cookieSecure() {
-    return process.env["NODE_ENV"] === "production";
-}
-// Double-entry cookie write used at login and switch-tenant. kumiko_auth is
-// the HttpOnly carrier of the JWT; kumiko_csrf is the JS-readable token the
+// Double-entry cookie write used at login and switch-tenant. The auth cookie is
+// the HttpOnly carrier of the JWT; the csrf cookie is the JS-readable token the
 // web client echoes in X-CSRF-Token on every state-changing request. Both
 // cookies share lifetime and SameSite so a stale auth-cookie can't outlive
 // its csrf partner (or vice versa) and leave the client in a half-logged-in
 // state that would trip the csrf-middleware on every retry.
 function setAuthCookies(c, opts) {
+    const { secure, names } = opts.cookies;
     const sameSite = opts.sameSite === "strict" ? "Strict" : "Lax";
     const common = {
-        secure: cookieSecure(),
+        secure,
         sameSite,
         path: "/",
         maxAge: opts.ttlSeconds,
         ...(opts.domain !== undefined && { domain: opts.domain }),
     };
-    // Bei gesetzter Domain zuerst die host-only-Variante invalidieren (analog
-    // clearAuthCookies): sonst koexistiert nach einem Deploy mit neuem
-    // cookieDomain das alte host-only-Cookie mit dem neuen Domain-Cookie
-    // (RFC 6265: name+domain ist distinct) und der Server bindet
-    // umgebungsabhängig potenziell ans veraltete host-only-Token.
-    if (opts.domain !== undefined) {
-        deleteCookie(c, AUTH_COOKIE_NAME, { path: "/" });
-        deleteCookie(c, CSRF_COOKIE_NAME, { path: "/" });
+    // With a Domain, expire the host-only variant first (as clearSessionCookies
+    // does): after a deploy that sets cookieDomain, the old host-only cookie
+    // would coexist with the new Domain cookie (RFC 6265 treats name+domain as
+    // distinct) and the server could bind to the stale host-only token. With
+    // __Host- names the unprefixed host-only cookie is a leftover from before
+    // the prefix and is expired too.
+    if (opts.domain !== undefined || isHostPrefixedCookieName(names.auth)) {
+        deleteCookie(c, AUTH_COOKIE_BASE, { path: "/" });
+        deleteCookie(c, CSRF_COOKIE_BASE, { path: "/" });
     }
     // Must precede the setCookie calls: browsers apply Set-Cookie in order and
     // a retired domain equal to the new one is rejected at config time.
+    // Retired domains only ever carried unprefixed names (a __Host- cookie has no
+    // Domain), and a __Host- delete with a Domain would be ignored.
     for (const retiredDomain of opts.retiredDomains) {
-        deleteCookie(c, AUTH_COOKIE_NAME, { path: "/", domain: retiredDomain });
-        deleteCookie(c, CSRF_COOKIE_NAME, { path: "/", domain: retiredDomain });
+        deleteCookie(c, AUTH_COOKIE_BASE, { path: "/", domain: retiredDomain });
+        deleteCookie(c, CSRF_COOKIE_BASE, { path: "/", domain: retiredDomain });
     }
-    setCookie(c, AUTH_COOKIE_NAME, opts.token, { ...common, httpOnly: true });
+    setCookie(c, names.auth, opts.token, { ...common, httpOnly: true });
     // Intentionally NOT HttpOnly — the web client has to read this from
     // document.cookie to include it in the X-CSRF-Token request header.
-    setCookie(c, CSRF_COOKIE_NAME, opts.csrfToken, { ...common, httpOnly: false });
-}
-function clearAuthCookies(c, domain, retiredDomains) {
-    // Beide Varianten löschen: mit Domain (aktuelle Cookies) UND host-only
-    // (Bestand aus der Zeit vor cookieDomain) — sonst bleibt nach einem
-    // Deploy mit neu gesetztem cookieDomain der alte Cookie liegen und der
-    // Logout wirkt nur scheinbar.
-    deleteCookie(c, AUTH_COOKIE_NAME, { path: "/" });
-    deleteCookie(c, CSRF_COOKIE_NAME, { path: "/" });
-    if (domain !== undefined) {
-        deleteCookie(c, AUTH_COOKIE_NAME, { path: "/", domain });
-        deleteCookie(c, CSRF_COOKIE_NAME, { path: "/", domain });
-    }
-    for (const retiredDomain of retiredDomains) {
-        deleteCookie(c, AUTH_COOKIE_NAME, { path: "/", domain: retiredDomain });
-        deleteCookie(c, CSRF_COOKIE_NAME, { path: "/", domain: retiredDomain });
-    }
+    setCookie(c, names.csrf, opts.csrfToken, { ...common, httpOnly: false });
 }
 const INVALID_COOKIE_DOMAIN_CHARS = /[;,\s]/;
 function normalizeCookieDomain(domain) {
@@ -332,6 +314,11 @@ export function createAuthRoutes(dispatcher, jwt, config) {
     // working. High-security apps can opt into "strict" — see AuthRoutesConfig.
     const cookieSameSite = config.cookieSameSite ?? "lax";
     const cookieDomain = config.cookieDomain;
+    const sessionCookies = resolveSessionCookies({
+        secureCookies: config.secureCookies,
+        cookieDomain,
+        retiredCookieDomains: config.retiredCookieDomains,
+    });
     assertRetiredCookieDomains(config.retiredCookieDomains, cookieDomain);
     const retiredCookieDomains = config.retiredCookieDomains ?? [];
     // Single hop-count-aware IP getter for every rate-limit call site below —
@@ -369,6 +356,7 @@ export function createAuthRoutes(dispatcher, jwt, config) {
         const token = await jwt.sign(sessionForJwt);
         const csrfToken = generateToken();
         setAuthCookies(c, {
+            cookies: getSessionCookies(c, sessionCookies),
             token,
             csrfToken,
             sameSite: cookieSameSite,
@@ -908,7 +896,7 @@ export function createAuthRoutes(dispatcher, jwt, config) {
         }
         // Clear cookies on the cookie-transport path. Idempotent — clearing a
         // missing cookie is a no-op, so bearer-only clients aren't affected.
-        clearAuthCookies(c, cookieDomain, retiredCookieDomains);
+        clearSessionCookies(c, getSessionCookies(c, sessionCookies));
         return c.json({ isSuccess: true });
     });
     // GET /auth/tenants — list tenants the current user belongs to

package/dist/api/csrf-middleware.js

@@ -1,7 +1,8 @@
 import { timingSafeEqual } from "node:crypto";
 import { getCookie } from "hono/cookie";
 import { STATE_CHANGING_METHODS } from "./api-constants.js";
-import { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, getAuthTransport } from "./auth-middleware.js";
+import { CSRF_HEADER_NAME, getAuthTransport } from "./auth-middleware.js";
+import { getSessionCookies } from "./session-cookies.js";
 // Constant-time byte compare. `a !== b` short-circuits at the first
 // differing byte and leaks the common prefix length to anyone who can
 // time requests — in principle exploitable against sufficiently small
@@ -46,7 +47,7 @@ export function csrfMiddleware() {
         // CSRF-via-GET vector.
         if (!STATE_CHANGING_METHODS.has(c.req.method))
             return next();
-        const cookieToken = getCookie(c, CSRF_COOKIE_NAME);
+        const cookieToken = getCookie(c, getSessionCookies(c).names.csrf);
         const headerToken = c.req.header(CSRF_HEADER_NAME);
         // Both must exist and match byte-for-byte. A missing cookie means the
         // token was never issued (stale session or cross-origin attempt);

package/dist/api/index.d.ts

@@ -3,7 +3,7 @@ export { deleteTenantCookie, setTenantCookie } from "./anonymous-cookie.js";
 export { collectAnonymousLiveEntities } from "./anonymous-live-entities.js";
 export { LOCALE_HEADER_NAME, NO_ROUTE_MATCH_HEADER_NAME } from "./api-constants.js";
 export type { AnonymousAccessConfig, AnonymousAccessResolved, AuthMiddlewareOptions, AuthSessionChecker, AuthSessionCheckResult, AuthSessionStatus, TenantExists, TenantLifecycleStatusResolver, TenantResolver, TokenVerifier, } from "./auth-middleware.js";
-export { AUTH_COOKIE_NAME, authMiddleware, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
+export { authMiddleware, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
 export type { AuthRoutesConfig, LoginRateLimiter, SessionChecker, SessionCreator, SessionMassRevoker, SessionMetadata, SessionRevoker, } from "./auth-routes.js";
 export { createAuthRoutes, createInMemoryLoginRateLimiter, createRedisLoginRateLimiter, } from "./auth-routes.js";
 export type { ClientIpHeaderSource, ClientIpResolver } from "./client-ip.js";
@@ -14,6 +14,7 @@ export type { CachedResponseInit, CachePolicy } from "./http-cache.js";
 export { cacheControlHeader, cachedResponse, computeRevisionEtag, computeStrongEtag, computeWeakEtag, etagMatches, parseIfNoneMatch, } from "./http-cache.js";
 export type { JwtHelper, JwtKeyring, JwtPayload } from "./jwt.js";
 export { createJwtHelper, loadJwtSecretOrKeyring } from "./jwt.js";
+export { publicOriginOf } from "./origin-middleware.js";
 export { patAllows, qnMatches } from "./pat-scope.js";
 export type { PostAuthLandingArgs, PostAuthLandingFlow, PostAuthLandingResolver, } from "./post-auth-landing.js";
 export { isSafeLandingPath } from "./post-auth-landing.js";
@@ -26,6 +27,8 @@ export { createMetricsApp, DEFAULT_MAX_REQUEST_BYTES, isPrometheusMeter, } from
 export { createApiRoutes } from "./routes.js";
 export type { KumikoServer, ServerOptions } from "./server.js";
 export { buildServer, makeDispatchSystemQuery, makeDispatchSystemWrite } from "./server.js";
+export type { ResolvedSessionCookies, SessionCookieBase, SessionCookieNames, } from "./session-cookies.js";
+export { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, getSessionCookies, HOST_COOKIE_PREFIX, isHostPrefixedCookieName, resolveSessionCookieNames, resolveSessionCookies, sessionCookieName, sessionCookiesMiddleware, TENANT_COOKIE_BASE, } from "./session-cookies.js";
 export type { SseBroker, SseClient, SseEvent } from "./sse-broker.js";
 export { createSseBroker } from "./sse-broker.js";
 export { createSseRoute, SSE_HEARTBEAT_INTERVAL_MS, type SseRouteOptions } from "./sse-route.js";

package/dist/api/index.js

@@ -1,12 +1,13 @@
 export { deleteTenantCookie, setTenantCookie } from "./anonymous-cookie.js";
 export { collectAnonymousLiveEntities } from "./anonymous-live-entities.js";
 export { LOCALE_HEADER_NAME, NO_ROUTE_MATCH_HEADER_NAME } from "./api-constants.js";
-export { AUTH_COOKIE_NAME, authMiddleware, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
+export { authMiddleware, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
 export { createAuthRoutes, createInMemoryLoginRateLimiter, createRedisLoginRateLimiter, } from "./auth-routes.js";
 export { assertValidTrustedProxyHops, clientIpSourceFromHonoContext, createClientIpResolver, extractSocketAddress, parseTrustedProxyHopsEnv, TRUSTED_PROXY_HOPS_ENV, UNKNOWN_CLIENT_IP, } from "./client-ip.js";
 export { ExtraRouteEntries, ExtraRouteRejection, signatureRoute } from "./extra-route.js";
 export { cacheControlHeader, cachedResponse, computeRevisionEtag, computeStrongEtag, computeWeakEtag, etagMatches, parseIfNoneMatch, } from "./http-cache.js";
 export { createJwtHelper, loadJwtSecretOrKeyring } from "./jwt.js";
+export { publicOriginOf } from "./origin-middleware.js";
 export { patAllows, qnMatches } from "./pat-scope.js";
 export { isSafeLandingPath } from "./post-auth-landing.js";
 export { createDefaultSseBroker, createRedisSseBroker, isRedisSseBroker, } from "./redis-sse-broker.js";
@@ -15,6 +16,7 @@ export { buildRequestContextDataFromRequest, requestIdMiddleware, } from "./requ
 export { createMetricsApp, DEFAULT_MAX_REQUEST_BYTES, isPrometheusMeter, } from "./route-registrars.js";
 export { createApiRoutes } from "./routes.js";
 export { buildServer, makeDispatchSystemQuery, makeDispatchSystemWrite } from "./server.js";
+export { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, getSessionCookies, HOST_COOKIE_PREFIX, isHostPrefixedCookieName, resolveSessionCookieNames, resolveSessionCookies, sessionCookieName, sessionCookiesMiddleware, TENANT_COOKIE_BASE, } from "./session-cookies.js";
 export { createSseBroker } from "./sse-broker.js";
 export { createSseRoute, SSE_HEARTBEAT_INTERVAL_MS } from "./sse-route.js";
 export { generateToken } from "./tokens.js";

package/dist/api/origin-middleware.d.ts

@@ -4,9 +4,19 @@ export declare function isOriginAllowed(origin: string, normalizedAllowlist: Rea
 export declare function isForeignCookieOrigin(c: Context, allowlist: ReadonlySet<string>): boolean;
 export declare function rejectOrigin(c: Context): Response;
 export declare function isWebSocketOriginAllowed(c: Context, normalizedAllowlist: ReadonlySet<string> | undefined): boolean;
-export declare function originMiddleware(allowedOrigins: readonly string[]): (c: Context, next: Next) => Promise<void | Response>;
+export declare function isSameHostOrigin(c: Context): boolean;
+export declare function publicOriginOf(baseUrl: string): string | undefined;
+export declare function originMiddleware(allowedOrigins: readonly string[], options?: {
+    readonly allowRequestHost?: boolean;
+}): (c: Context, next: Next) => Promise<void | Response>;
 export declare function assertOriginGuardConfig(auth: {
     cookieDomain?: string;
     allowedOrigins?: readonly string[];
     unsafeSkipOriginCheck?: boolean;
 } | undefined): void;
+export declare function resolveOriginGuard(auth: {
+    cookieDomain?: string;
+    allowedOrigins?: readonly string[];
+    publicOrigin?: string;
+    unsafeSkipOriginCheck?: boolean;
+} | undefined): ReturnType<typeof originMiddleware> | undefined;

package/dist/api/origin-middleware.js

@@ -44,6 +44,19 @@ export function isWebSocketOriginAllowed(c, normalizedAllowlist) {
     if (getAuthTransport(c) !== "cookie")
         return true;
     const origin = c.req.header("origin");
+    if (origin === undefined || origin === "null")
+        return false;
+    // With an allowlist there is deliberately no same-host fallback: wide
+    // cookieDomain setups are exactly where a sibling subdomain is the attacker.
+    if (normalizedAllowlist !== undefined && normalizedAllowlist.size > 0) {
+        return isOriginAllowed(origin, normalizedAllowlist);
+    }
+    return isSameHostOrigin(c);
+}
+// The request's own host is a safe extra origin only with host-only session
+// cookies: no sibling host ever receives them.
+export function isSameHostOrigin(c) {
+    const origin = c.req.header("origin");
     if (origin === undefined || origin === "null")
         return false;
     let originHost;
@@ -53,14 +66,18 @@ export function isWebSocketOriginAllowed(c, normalizedAllowlist) {
     catch {
         return false;
     }
-    // With an allowlist there is deliberately no same-host fallback: wide
-    // cookieDomain setups are exactly where a sibling subdomain is the attacker.
-    if (normalizedAllowlist !== undefined && normalizedAllowlist.size > 0) {
-        return isOriginAllowed(origin, normalizedAllowlist);
-    }
     const requestHost = c.req.header("host")?.toLowerCase();
     return requestHost !== undefined && originHost === requestHost;
 }
+export function publicOriginOf(baseUrl) {
+    try {
+        const origin = new URL(baseUrl).origin;
+        return origin === "null" ? undefined : normalizeOrigin(origin);
+    }
+    catch {
+        return undefined;
+    }
+}
 // Server-side Origin-allowlist guard — an additional CSRF-hardening layer on
 // top of the double-submit token (csrf-middleware) for deployments that widen
 // the auth cookie across subdomains via AuthRoutesConfig.cookieDomain. A wide
@@ -75,7 +92,7 @@ export function isWebSocketOriginAllowed(c, normalizedAllowlist) {
 // Bearer-auth requests skip — browsers cannot set Authorization cross-origin,
 // and native clients send no/foreign Origin, so guarding them would be a
 // false-positive with no CSRF vector to defend.
-export function originMiddleware(allowedOrigins) {
+export function originMiddleware(allowedOrigins, options = {}) {
     const allowlist = new Set(allowedOrigins.map(normalizeOrigin));
     return async (c, next) => {
         const transport = getAuthTransport(c);
@@ -88,8 +105,11 @@ export function originMiddleware(allowedOrigins) {
         // by the allowlist branch inside isForeignCookieOrigin. The residual is
         // only the no-Origin-yet-Sec-Fetch-Site combo, which no current browser
         // emits for state-changing requests.
-        if (isForeignCookieOrigin(c, allowlist))
+        if (isForeignCookieOrigin(c, allowlist)) {
+            if (options.allowRequestHost === true && isSameHostOrigin(c))
+                return next();
             return rejectOrigin(c);
+        }
         return next();
     };
 }
@@ -118,3 +138,16 @@ export function assertOriginGuardConfig(auth) {
             "auth.unsafeSkipOriginCheck: true to accept the risk explicitly.");
     }
 }
+// An explicit allowlist always wins and is strict. Without one, a known public
+// origin still enables the guard, but only for host-only cookies (no
+// cookieDomain) and never against an explicit opt-out.
+export function resolveOriginGuard(auth) {
+    if (auth?.allowedOrigins && auth.allowedOrigins.length > 0) {
+        return originMiddleware(auth.allowedOrigins);
+    }
+    if (auth?.publicOrigin === undefined || auth.unsafeSkipOriginCheck === true)
+        return undefined;
+    if (auth.cookieDomain)
+        return undefined;
+    return originMiddleware([auth.publicOrigin], { allowRequestHost: true });
+}

package/dist/api/server.js

@@ -11,6 +11,7 @@ import { assertSeedModeNotInProduction } from "../event-store/seed-clock.js";
 import { createFileContext } from "../files/file-handle.js";
 import { createFileRoutes, readFilesRouteOptions } from "../files/file-routes.js";
 import { makeFileProviderResolver } from "../files/provider-resolver.js";
+import { createRecordReadCheck } from "../files/record-read-check.js";
 import { createFallbackLogger } from "../logging/index.js";
 import { createNoopProvider, DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, registerStandardMetrics, wrapRedisClient, } from "../observability/index.js";
 import { resolveTenantLifecyclePlugin } from "../pipeline/active-membership.js";
@@ -34,7 +35,7 @@ import { ExtraRouteEntries, ExtraRouteRejection, } from "./extra-route.js";
 import { computeStrongEtag, etagMatches } from "./http-cache.js";
 import { createJwtHelper } from "./jwt.js";
 import { observabilityMiddleware } from "./observability-middleware.js";
-import { assertOriginGuardConfig, isWebSocketOriginAllowed, normalizeOrigin, originMiddleware, rejectOrigin, } from "./origin-middleware.js";
+import { assertOriginGuardConfig, isWebSocketOriginAllowed, normalizeOrigin, rejectOrigin, resolveOriginGuard, } from "./origin-middleware.js";
 import { patRouteGuard } from "./pat-route-guard.js";
 import { piiCiphertextResponseGuard } from "./pii-leak-guard.js";
 import { createDefaultSseBroker } from "./redis-sse-broker.js";
@@ -42,6 +43,7 @@ import { requestContext } from "./request-context.js";
 import { buildRequestContextData, requestIdMiddleware } from "./request-id-middleware.js";
 import { bodyLimitForRoutePath, DEFAULT_MAX_REQUEST_BYTES, registerBodyLimit, registerHealthRoutes, registerMetricsRoute, registerVersionRoute, } from "./route-registrars.js";
 import { createApiRoutes, handleUncaughtRouteError } from "./routes.js";
+import { resolveSessionCookies, sessionCookiesMiddleware } from "./session-cookies.js";
 import { createSseRoute } from "./sse-route.js";
 import { buildWebSocketSessionRevalidator, createWebSocketConnectionLimiter, hasWebSocketUpgradeServer, isWebSocketUpgradeRequest, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, } from "./websocket-route.js";
 // The per-tenant file-provider resolver, built once for a registry+context so
@@ -424,6 +426,14 @@ export function buildServer(options) {
     const app = new Hono();
     // Sub-apps mounted via app.route() without their own handler inherit this one.
     app.onError(handleUncaughtRouteError);
+    // Resolved once; auth routes, auth/csrf middleware and the tenant-cookie
+    // helpers read the cookie names from the request context.
+    const sessionCookies = resolveSessionCookies({
+        secureCookies: options.auth?.secureCookies,
+        cookieDomain: options.auth?.cookieDomain,
+        retiredCookieDomains: options.auth?.retiredCookieDomains,
+    });
+    app.use("*", sessionCookiesMiddleware(sessionCookies));
     // Only entry:"signature" bypasses jwtGuard (verify() authenticates
     // itself); entry:"anonymous" still needs the anonymousAccess fallthrough
     // (tenant-by-host), entry:"user" needs c.get("user") populated.
@@ -553,7 +563,8 @@ export function buildServer(options) {
     }
     // Origin-allowlist guard — additional CSRF-hardening for deployments that
     // widen the auth cookie across subdomains (auth.cookieDomain). Registered
-    // only when allowedOrigins is non-empty, with the same /api/* + public-skip
+    // when allowedOrigins is non-empty, or with host-only cookies when
+    // auth.publicOrigin is known (see resolveOriginGuard), with the same /api/* + public-skip
     // scope as the CSRF guard and BEFORE it, so a disallowed cross-site POST
     // surfaces as `origin_not_allowed` rather than `csrf_token_mismatch`. Fails
     // closed (assertOriginGuardConfig throws) when a wide cookieDomain is set
@@ -562,7 +573,7 @@ export function buildServer(options) {
     assertOriginGuardConfig(options.auth);
     assertSessionCallbacksPaired(options.auth);
     const allowedOrigins = options.auth?.allowedOrigins;
-    const originGuard = allowedOrigins && allowedOrigins.length > 0 ? originMiddleware(allowedOrigins) : undefined;
+    const originGuard = resolveOriginGuard(options.auth);
     if (originGuard) {
         app.use("/api/*", async (c, next) => {
             if (PUBLIC_API_PATHS.has(c.req.path) || isExtraRoutePublicPath(c))
@@ -613,7 +624,11 @@ export function buildServer(options) {
                     "is expected (the bundled user feature already provides it).");
             }
         }
-        app.route("/api", createAuthRoutes(dispatcher, jwt, { ...options.auth, resolver: clientIpResolver }));
+        app.route("/api", createAuthRoutes(dispatcher, jwt, {
+            ...options.auth,
+            secureCookies: sessionCookies.secure,
+            resolver: clientIpResolver,
+        }));
     }
     app.route("/api", createApiRoutes(dispatcher, {
         ...(options.sseHeartbeatMs !== undefined ? { sseHeartbeatMs: options.sseHeartbeatMs } : {}),
@@ -676,6 +691,7 @@ export function buildServer(options) {
             db: fileDb,
             registry: options.registry,
             resolveProvider: fileProviderResolver,
+            canReadRecord: createRecordReadCheck(options.registry, dispatcher.query),
             ...(routeOptions.accessGuard ? { accessGuard: routeOptions.accessGuard } : {}),
             ...(routeOptions.privilegedRoles ? { privilegedRoles: routeOptions.privilegedRoles } : {}),
             ...(routeOptions.maxUploadSize ? { maxUploadSize: routeOptions.maxUploadSize } : {}),

package/dist/api/session-cookies.d.ts

@@ -0,0 +1,23 @@
+import { type SessionCookieNames } from "@cosmicdrift/kumiko-types/session-cookies";
+import type { Context, MiddlewareHandler } from "hono";
+export { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, HOST_COOKIE_PREFIX, isHostPrefixedCookieName, resolveSessionCookieNames, type SessionCookieBase, type SessionCookieNames, sessionCookieName, TENANT_COOKIE_BASE, } from "@cosmicdrift/kumiko-types/session-cookies";
+export type ResolvedSessionCookies = {
+    readonly secure: boolean;
+    readonly names: SessionCookieNames;
+    readonly domain?: string | undefined;
+    readonly retiredDomains?: readonly string[] | undefined;
+};
+export declare function resolveSecureCookies(configured?: boolean): boolean;
+export declare function resolveSessionCookies(options: {
+    readonly secureCookies?: boolean | undefined;
+    readonly cookieDomain?: string | undefined;
+    readonly retiredCookieDomains?: readonly string[] | undefined;
+}): ResolvedSessionCookies;
+export declare function sessionCookiesMiddleware(resolved: ResolvedSessionCookies): MiddlewareHandler;
+export declare function getSessionCookies(c: Context, fallback?: ResolvedSessionCookies): ResolvedSessionCookies;
+export declare function hostOnlyDeleteOptions(name: string): {
+    path: "/";
+    secure?: true;
+};
+export declare function clearSessionCookies(c: Context, cookies: ResolvedSessionCookies): void;
+export declare function hasDuplicateSessionCookie(c: Context, names: SessionCookieNames): boolean;

package/dist/api/session-cookies.js

@@ -0,0 +1,85 @@
+import { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, isHostPrefixedCookieName, resolveSessionCookieNames, } from "@cosmicdrift/kumiko-types/session-cookies";
+import { deleteCookie } from "hono/cookie";
+export { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, HOST_COOKIE_PREFIX, isHostPrefixedCookieName, resolveSessionCookieNames, sessionCookieName, TENANT_COOKIE_BASE, } from "@cosmicdrift/kumiko-types/session-cookies";
+const SESSION_COOKIES_KEY = "sessionCookies";
+// Browsers drop Secure cookies on http, so Secure is off outside production
+// (Playwright against http://localhost) and on in production, where a
+// misconfigured http deploy breaks login loudly instead of silently.
+export function resolveSecureCookies(configured) {
+    return configured ?? process.env["NODE_ENV"] === "production";
+}
+export function resolveSessionCookies(options) {
+    const secure = resolveSecureCookies(options.secureCookies);
+    return {
+        secure,
+        names: resolveSessionCookieNames({ secure, domain: options.cookieDomain }),
+        domain: options.cookieDomain,
+        retiredDomains: options.retiredCookieDomains,
+    };
+}
+export function sessionCookiesMiddleware(resolved) {
+    return async (c, next) => {
+        c.set(SESSION_COOKIES_KEY, resolved);
+        await next();
+    };
+}
+function isResolvedSessionCookies(value) {
+    return typeof value === "object" && value !== null && "names" in value && "secure" in value;
+}
+// buildServer resolves the names once and stores them per request, so writer
+// (auth routes) and readers (auth/csrf/tenant) cannot diverge. The fallback
+// only applies to contexts that never ran through buildServer, e.g. a bare
+// Hono app in a unit test or a standalone createAuthRoutes mount.
+export function getSessionCookies(c, fallback) {
+    const stored = c.get(SESSION_COOKIES_KEY);
+    if (isResolvedSessionCookies(stored))
+        return stored;
+    return fallback ?? resolveSessionCookies({});
+}
+// A deletion of a `__Host-` cookie is ignored by the browser unless it is
+// itself Secure, Path=/ and Domain-less.
+export function hostOnlyDeleteOptions(name) {
+    return isHostPrefixedCookieName(name) ? { path: "/", secure: true } : { path: "/" };
+}
+// Expire every variant: the Domain cookie (current) and the host-only one
+// (from before cookieDomain), otherwise a cookie left over from an earlier
+// config keeps the session alive after logout. With __Host- names the
+// unprefixed leftovers from before the prefix are expired as well. Retired
+// domains only ever carried unprefixed names.
+export function clearSessionCookies(c, cookies) {
+    const { names, domain } = cookies;
+    deleteCookie(c, names.auth, hostOnlyDeleteOptions(names.auth));
+    deleteCookie(c, names.csrf, hostOnlyDeleteOptions(names.csrf));
+    if (isHostPrefixedCookieName(names.auth)) {
+        deleteCookie(c, AUTH_COOKIE_BASE, { path: "/" });
+        deleteCookie(c, CSRF_COOKIE_BASE, { path: "/" });
+    }
+    if (domain !== undefined) {
+        deleteCookie(c, AUTH_COOKIE_BASE, { path: "/", domain });
+        deleteCookie(c, CSRF_COOKIE_BASE, { path: "/", domain });
+    }
+    for (const retiredDomain of cookies.retiredDomains ?? []) {
+        deleteCookie(c, AUTH_COOKIE_BASE, { path: "/", domain: retiredDomain });
+        deleteCookie(c, CSRF_COOKIE_BASE, { path: "/", domain: retiredDomain });
+    }
+}
+function cookieNameOccurrences(cookieHeader, name) {
+    let count = 0;
+    for (const pair of cookieHeader.split(";")) {
+        const separator = pair.indexOf("=");
+        const pairName = (separator === -1 ? pair : pair.slice(0, separator)).trim();
+        if (pairName === name)
+            count++;
+    }
+    return count;
+}
+// Two cookies with the same name (e.g. a host-only and a Domain variant, or one
+// planted by a sibling subdomain) are indistinguishable server-side; Hono's
+// getCookie would silently bind to whichever the browser sent first.
+export function hasDuplicateSessionCookie(c, names) {
+    const cookieHeader = c.req.header("cookie");
+    if (cookieHeader === undefined)
+        return false;
+    return (cookieNameOccurrences(cookieHeader, names.auth) > 1 ||
+        cookieNameOccurrences(cookieHeader, names.csrf) > 1);
+}