@cosmicdrift/kumiko-server-runtime 0.157.1 → 0.158.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.157.1",
+  "version": "0.158.2",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -72,8 +72,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.157.1",
-    "@cosmicdrift/kumiko-framework": "0.157.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.158.2",
+    "@cosmicdrift/kumiko-framework": "0.158.2",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/security-headers.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, it } from "bun:test";
+import { resolveSecurityHeaders, withSecurityHeaders } from "../security-headers";
+
+const okHandler = (_req: Request) => new Response("ok");
+const req = new Request("http://localhost/");
+
+describe("resolveSecurityHeaders", () => {
+  it("returns the four defaults without csp when unconfigured", () => {
+    const headers = new Map(resolveSecurityHeaders(undefined));
+    expect(headers.get("strict-transport-security")).toBe("max-age=31536000; includeSubDomains");
+    expect(headers.get("x-frame-options")).toBe("DENY");
+    expect(headers.get("x-content-type-options")).toBe("nosniff");
+    expect(headers.get("referrer-policy")).toBe("strict-origin-when-cross-origin");
+    expect(headers.has("content-security-policy")).toBe(false);
+  });
+
+  it("returns nothing when disabled", () => {
+    expect(resolveSecurityHeaders(false)).toEqual([]);
+  });
+
+  it("applies per-header overrides and opt-outs", () => {
+    const headers = new Map(
+      resolveSecurityHeaders({
+        hsts: "max-age=60",
+        frameOptions: false,
+        referrerPolicy: "no-referrer",
+        csp: "default-src 'self'",
+      }),
+    );
+    expect(headers.get("strict-transport-security")).toBe("max-age=60");
+    expect(headers.has("x-frame-options")).toBe(false);
+    expect(headers.get("x-content-type-options")).toBe("nosniff");
+    expect(headers.get("referrer-policy")).toBe("no-referrer");
+    expect(headers.get("content-security-policy")).toBe("default-src 'self'");
+  });
+});
+
+describe("withSecurityHeaders", () => {
+  it("sets defaults on every response", async () => {
+    const res = await withSecurityHeaders(okHandler, undefined)(req);
+    expect(res.headers.get("strict-transport-security")).toBe(
+      "max-age=31536000; includeSubDomains",
+    );
+    expect(res.headers.get("x-frame-options")).toBe("DENY");
+    expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+    expect(res.headers.get("referrer-policy")).toBe("strict-origin-when-cross-origin");
+    expect(await res.text()).toBe("ok");
+  });
+
+  it("returns the handler unwrapped when disabled", () => {
+    expect(withSecurityHeaders(okHandler, false)).toBe(okHandler);
+  });
+
+  it("never overrides a header the response already set", async () => {
+    const handler = (_req: Request) =>
+      new Response("ok", {
+        headers: {
+          "content-security-policy": "default-src 'none'",
+          "x-frame-options": "SAMEORIGIN",
+        },
+      });
+    const res = await withSecurityHeaders(handler, { csp: "default-src 'self'" })(req);
+    expect(res.headers.get("content-security-policy")).toBe("default-src 'none'");
+    expect(res.headers.get("x-frame-options")).toBe("SAMEORIGIN");
+    expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+  });
+
+  it("re-wraps responses with immutable headers", async () => {
+    const immutable = new Response("ok", { status: 201, statusText: "Created" });
+    Object.defineProperty(immutable, "headers", {
+      value: new Proxy(immutable.headers, {
+        get(target, prop) {
+          if (prop === "set") {
+            return () => {
+              throw new TypeError("immutable");
+            };
+          }
+          const value = Reflect.get(target, prop);
+          return typeof value === "function" ? value.bind(target) : value;
+        },
+      }),
+    });
+    const res = await withSecurityHeaders(() => immutable, undefined)(req);
+    expect(res.status).toBe(201);
+    expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+    expect(await res.text()).toBe("ok");
+  });
+});

package/src/index.ts

@@ -14,3 +14,4 @@ export type {
   SignupSetup,
 } from "./run-prod-app";
 export { runProdApp } from "./run-prod-app";
+export type { SecurityHeadersOption } from "./security-headers";

package/src/run-prod-app.ts

@@ -53,8 +53,9 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
 import { UserQueries } from "@cosmicdrift/kumiko-bundled-features/user";
 import {
-  createInMemoryLoginRateLimiter,
+  createRedisLoginRateLimiter,
   createSseBroker,
+  type LoginRateLimiter,
   type SseBroker,
 } from "@cosmicdrift/kumiko-framework/api";
 import {
@@ -126,6 +127,7 @@ import {
   resolveAuthMail,
 } from "./run-prod-app-boot-context";
 import { buildStaticFallback } from "./run-prod-app-static-files";
+import { type SecurityHeadersOption, withSecurityHeaders } from "./security-headers";
 import {
   type ProdSessionsOption,
   resolveProdSessionsConfig,
@@ -569,6 +571,12 @@ export type RunProdAppOptions = {
    *  dieses Feld wird kein L1/L2 verdrahtet (L3 Handler-`rateLimit:`
    *  funktioniert unabhängig davon bereits). */
   readonly rateLimit?: import("@cosmicdrift/kumiko-framework/api").ServerOptions["rateLimit"];
+  /** Default security headers on every response (HSTS, X-Frame-Options,
+   *  X-Content-Type-Options, Referrer-Policy; CSP opt-in). Headers already
+   *  set by a response (e.g. hostDispatch's per-host CSP) are never
+   *  overridden. `false` disables the whole block; per-header overrides
+   *  via the object form — see SecurityHeadersOption. */
+  readonly securityHeaders?: SecurityHeadersOption;
 };
 
 export type ProdAppHandle = {
@@ -856,14 +864,14 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   let patAuthFragment:
     | {
         patResolver: ReturnType<typeof createPatResolver>;
-        patRateLimiter: ReturnType<typeof createInMemoryLoginRateLimiter>;
+        patRateLimiter: LoginRateLimiter;
       }
     | undefined;
   if (effectiveAuth && patFeature) {
     const rl = patRateLimitFromFeature(patFeature);
     patAuthFragment = {
       patResolver: createPatResolver({ db, scopes: patScopesFromFeature(patFeature) }),
-      patRateLimiter: createInMemoryLoginRateLimiter(rl.maxRequests, rl.windowMs),
+      patRateLimiter: createRedisLoginRateLimiter(redis, rl.maxRequests, rl.windowMs, "pat"),
     };
   }
 
@@ -908,6 +916,12 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
           [AuthErrors.invalidCredentials]: 401,
           [AuthErrors.noMembership]: 403,
         },
+        // Redis-backed, not the in-memory default createAuthRoutes falls
+        // back to — an in-process limiter only rate-limits within a single
+        // replica, so a multi-instance prod deployment would silently give
+        // each replica its own bucket (#1262/#1274). Redis is required infra
+        // here already (REDIS_URL), so this is free.
+        loginRateLimit: createRedisLoginRateLimiter(redis),
         ...(effectiveAuth.cookieDomain !== undefined && {
           cookieDomain: effectiveAuth.cookieDomain,
         }),
@@ -920,7 +934,15 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
         ...sessionAuthFragment,
         ...patAuthFragment,
         ...tenantLifecycleAuthFragment,
-        ...(mfaFeature && { mfaVerifyHandler: AuthMfaHandlers.verify }),
+        ...(mfaFeature && {
+          mfaVerifyHandler: AuthMfaHandlers.verify,
+          mfaVerifyRateLimit: createRedisLoginRateLimiter(
+            redis,
+            undefined,
+            undefined,
+            "mfa-verify",
+          ),
+        }),
         ...(effectiveAuth.passwordReset && {
           passwordReset: {
             requestHandler: AuthHandlers.requestPasswordReset,
@@ -1066,14 +1088,17 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   //     wired via a wrapper so Hono owns /api/* + extraRoutes and disk
   //     owns the rest. Tests use this directly; listen() wraps it in
   //     Bun.serve.
-  const fetchHandler = options.staticDir
-    ? buildStaticFallback(
-        entrypoint.app.fetch.bind(entrypoint.app),
-        options.staticDir,
-        appSchemaJson,
-        options.hostDispatch,
-      )
-    : entrypoint.app.fetch.bind(entrypoint.app);
+  const fetchHandler = withSecurityHeaders(
+    options.staticDir
+      ? buildStaticFallback(
+          entrypoint.app.fetch.bind(entrypoint.app),
+          options.staticDir,
+          appSchemaJson,
+          options.hostDispatch,
+        )
+      : entrypoint.app.fetch.bind(entrypoint.app),
+    options.securityHeaders,
+  );
 
   // 11. Mark lifecycle ready — health/ready flips to 200 after this.
   entrypoint.lifecycle.markReady();

package/src/security-headers.ts

@@ -0,0 +1,67 @@
+export type SecurityHeadersOption =
+  | false
+  | {
+      /** `Strict-Transport-Security` value, or `false` to omit.
+       *  Default: `max-age=31536000; includeSubDomains`. */
+      readonly hsts?: string | false;
+      /** `X-Frame-Options` value, or `false` to omit. Default: `DENY`.
+       *  Apps that must be embeddable (iframe widgets) set `false` and
+       *  scope framing via a `csp` frame-ancestors directive instead. */
+      readonly frameOptions?: string | false;
+      /** `false` omits `X-Content-Type-Options: nosniff`. */
+      readonly contentTypeOptions?: false;
+      /** `Referrer-Policy` value, or `false` to omit.
+       *  Default: `strict-origin-when-cross-origin`. */
+      readonly referrerPolicy?: string | false;
+      /** `Content-Security-Policy` default for ALL responses. No built-in
+       *  default — a wrong CSP breaks app assets, so it stays opt-in.
+       *  A per-host CSP from `hostDispatch` wins over this value. */
+      readonly csp?: string;
+    };
+
+const DEFAULT_HSTS = "max-age=31536000; includeSubDomains";
+const DEFAULT_FRAME_OPTIONS = "DENY";
+const DEFAULT_REFERRER_POLICY = "strict-origin-when-cross-origin";
+
+export function resolveSecurityHeaders(
+  option: SecurityHeadersOption | undefined,
+): ReadonlyArray<readonly [string, string]> {
+  if (option === false) return [];
+  const opt = option ?? {};
+  const headers: Array<readonly [string, string]> = [];
+  const hsts = opt.hsts ?? DEFAULT_HSTS;
+  if (hsts !== false) headers.push(["strict-transport-security", hsts]);
+  const frameOptions = opt.frameOptions ?? DEFAULT_FRAME_OPTIONS;
+  if (frameOptions !== false) headers.push(["x-frame-options", frameOptions]);
+  if (opt.contentTypeOptions !== false) headers.push(["x-content-type-options", "nosniff"]);
+  const referrerPolicy = opt.referrerPolicy ?? DEFAULT_REFERRER_POLICY;
+  if (referrerPolicy !== false) headers.push(["referrer-policy", referrerPolicy]);
+  if (opt.csp) headers.push(["content-security-policy", opt.csp]);
+  return headers;
+}
+
+// Sets each header only when absent so per-response values (e.g. the
+// per-host CSP from hostDispatch) always win over the runtime default.
+export function withSecurityHeaders(
+  handler: (req: Request) => Response | Promise<Response>,
+  option: SecurityHeadersOption | undefined,
+): (req: Request) => Response | Promise<Response> {
+  const defaults = resolveSecurityHeaders(option);
+  if (defaults.length === 0) return handler;
+  return async (req: Request): Promise<Response> => {
+    const res = await handler(req);
+    try {
+      for (const [name, value] of defaults) {
+        if (!res.headers.has(name)) res.headers.set(name, value);
+      }
+      return res;
+    } catch {
+      // Immutable-headers Response (e.g. proxied fetch) — re-wrap.
+      const headers = new Headers(res.headers);
+      for (const [name, value] of defaults) {
+        if (!headers.has(name)) headers.set(name, value);
+      }
+      return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+    }
+  };
+}