@cosmicdrift/kumiko-server-runtime 0.165.2 → 0.165.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +3 -3
- package/src/run-prod-app.ts +7 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cosmicdrift/kumiko-server-runtime",
|
|
3
|
-
"version": "0.165.
|
|
3
|
+
"version": "0.165.4",
|
|
4
4
|
"description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
|
|
5
5
|
"license": "BUSL-1.1",
|
|
6
6
|
"author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
|
|
@@ -72,8 +72,8 @@
|
|
|
72
72
|
}
|
|
73
73
|
},
|
|
74
74
|
"dependencies": {
|
|
75
|
-
"@cosmicdrift/kumiko-bundled-features": "0.165.
|
|
76
|
-
"@cosmicdrift/kumiko-framework": "0.165.
|
|
75
|
+
"@cosmicdrift/kumiko-bundled-features": "0.165.4",
|
|
76
|
+
"@cosmicdrift/kumiko-framework": "0.165.4",
|
|
77
77
|
"temporal-polyfill": "^0.3.2"
|
|
78
78
|
},
|
|
79
79
|
"publishConfig": {
|
package/src/run-prod-app.ts
CHANGED
|
@@ -733,6 +733,13 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
|
|
|
733
733
|
const trustedProxyHops = ((): number | undefined => {
|
|
734
734
|
if (options.auth?.trustedProxyHops !== undefined) return options.auth.trustedProxyHops;
|
|
735
735
|
if (trustedProxyHopsFromEnv === undefined) return undefined;
|
|
736
|
+
// Digits-only — parseInt("0x10")/("1e3")/("2x") would silently coerce
|
|
737
|
+
// and land on the spoofable hops=0 path for values like "0x10".
|
|
738
|
+
if (!/^\d+$/.test(trustedProxyHopsFromEnv)) {
|
|
739
|
+
throw new Error(
|
|
740
|
+
`runProdApp: KUMIKO_TRUSTED_PROXY_HOPS must be a non-negative integer, got "${trustedProxyHopsFromEnv}".`,
|
|
741
|
+
);
|
|
742
|
+
}
|
|
736
743
|
const parsed = Number.parseInt(trustedProxyHopsFromEnv, 10);
|
|
737
744
|
if (!Number.isInteger(parsed) || parsed < 0) {
|
|
738
745
|
throw new Error(
|