@cosmicdrift/kumiko-server-runtime 0.359.0 → 0.361.0

package/dist/pii-boot-gate.js

@@ -32,7 +32,7 @@ export function assertPiiBootInvariants(features, opts) {
     ].join(" and ");
     if (opts.mode === "dev") {
         // biome-ignore lint/suspicious/noConsole: boot-time security warning
-        console.warn(`[${tag}] ${carriers} carry pii/userOwned/tenantOwned/recordOwned annotations or a non-"none" defineEvent PII stance but no \`kms\` adapter is configured — fields are stored in PLAINTEXT locally. Pass { kms: new InMemoryKmsAdapter() } (ephemeral DB) or createPgKmsAdapter(...) to exercise crypto-shredding in dev.`);
+        console.warn(`[${tag}] ${carriers} carry pii/userOwned/tenantOwned/recordOwned annotations or a non-"none" defineEvent PII stance but no \`kms\` adapter is configured — fields are stored in PLAINTEXT locally. Plaintext PII means dev/e2e raw reads will not see the ciphertext prod stores. Pass { kms: new InMemoryKmsAdapter() } (ephemeral DB) or createPgKmsAdapter(...) (persistent dev DB) to exercise crypto-shredding in dev.`);
         // skip: dev mode, plaintext-PII warning already logged above
         return;
     }

package/dist/resolve-auth-public-origin.d.ts

@@ -0,0 +1,12 @@
+export declare const APP_BASE_URL_ENV = "APP_BASE_URL";
+type AuthOriginOptions = {
+    readonly allowedOrigins?: readonly string[];
+    readonly unsafeSkipOriginCheck?: boolean;
+    readonly cookieDomain?: string;
+    readonly publicOrigin?: string;
+    readonly mail?: {
+        readonly baseUrl: string;
+    };
+};
+export declare function resolveAuthPublicOrigin(auth: AuthOriginOptions, envSource: Record<string, string | undefined>, warn: (message: string) => void): string | undefined;
+export {};

package/dist/resolve-auth-public-origin.js

@@ -0,0 +1,23 @@
+import { publicOriginOf } from "@cosmicdrift/kumiko-framework/api";
+export const APP_BASE_URL_ENV = "APP_BASE_URL";
+// The mail link base is what users already open from auth mails, so it wins
+// over the infra-provided APP_BASE_URL. Missing or unparsable in production
+// is a loud warning, not a boot failure: the double-submit CSRF token still
+// protects, the Origin guard is defense in depth.
+export function resolveAuthPublicOrigin(auth, envSource, warn) {
+    if ((auth.allowedOrigins?.length ?? 0) > 0 || auth.unsafeSkipOriginCheck === true) {
+        return undefined;
+    }
+    const envBaseUrl = envSource[APP_BASE_URL_ENV] === "" ? undefined : envSource[APP_BASE_URL_ENV];
+    const baseUrl = auth.publicOrigin ?? auth.mail?.baseUrl ?? envBaseUrl;
+    const origin = baseUrl === undefined ? undefined : publicOriginOf(baseUrl);
+    if (origin === undefined &&
+        auth.cookieDomain === undefined &&
+        envSource["NODE_ENV"] === "production") {
+        warn("[runProdApp] WARNING: no valid public app URL is known (auth.publicOrigin, " +
+            `auth.mail.baseUrl or ${APP_BASE_URL_ENV}), so the server-side Origin guard is OFF. ` +
+            "Cookie-authenticated requests are protected by the CSRF token only. Set " +
+            `auth.mail.baseUrl or ${APP_BASE_URL_ENV} to the app's https URL.`);
+    }
+    return origin;
+}

package/dist/run-prod-app.d.ts

@@ -132,6 +132,10 @@ export type RunProdAppAuthOptions = {
      *  AuthRoutesConfig.cookieDomain). Set to the registrable parent
      *  domain when login and app live on different subdomains. */
     readonly cookieDomain?: string;
+    /** Secure flag for the session cookies (see AuthRoutesConfig.secureCookies).
+     *  Defaults to NODE_ENV === "production"; set it to true when TLS ends at a
+     *  proxy and NODE_ENV is not "production". */
+    readonly secureCookies?: boolean;
     /** Former cookie domains cleared on login/logout (see
      *  AuthRoutesConfig.retiredCookieDomains). */
     readonly retiredCookieDomains?: readonly string[];
@@ -144,6 +148,10 @@ export type RunProdAppAuthOptions = {
      *  — accept the wide-cookie CSRF risk explicitly instead of setting
      *  `allowedOrigins`. */
     readonly unsafeSkipOriginCheck?: boolean;
+    /** Canonical public origin for the default Origin guard (see
+     *  AuthRoutesConfig.publicOrigin). Defaults to the origin of
+     *  `mail.baseUrl`, then of the APP_BASE_URL env. */
+    readonly publicOrigin?: string;
     /** Number of trusted reverse-proxy hops between the client and this
      *  process for client-IP derivation (see AuthRoutesConfig.trustedProxyHops,
      *  kumiko-framework#1539) — closes the X-Forwarded-For spoofing hole on

package/dist/run-prod-app.js

@@ -71,6 +71,7 @@ import { buildBunServeOptions, resolveDerivedMaxRequestBodySize } from "./bun-se
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features.js";
 import { makeDispatchSystemWrite } from "./extra-routes-deps.js";
 import { assertPiiBootInvariants } from "./pii-boot-gate.js";
+import { resolveAuthPublicOrigin } from "./resolve-auth-public-origin.js";
 import { addConfigAccessorFactory, buildBootExtraContext, buildProdSessionAuth, loggerFromExtraContext, resolveAuthMail, wireProdPatAutoRevoke, } from "./run-prod-app-boot-context.js";
 import { buildStaticFallback } from "./run-prod-app-static-files.js";
 import { withSecurityHeaders } from "./security-headers.js";
@@ -279,6 +280,12 @@ export async function runProdApp(options) {
     const effectiveAuth = options.auth
         ? resolveAuthMail(options.auth, jwtSecret, envSource)
         : undefined;
+    const authPublicOrigin = effectiveAuth
+        ? resolveAuthPublicOrigin(effectiveAuth, envSource, (message) => {
+            // biome-ignore lint/suspicious/noConsole: boot-time warn, no logger configured this early
+            console.warn(message);
+        })
+        : undefined;
     // 3. Feature registry. Auth-mode auto-mixes config/user/tenant/auth-email-
     //    password via composeFeatures — same source-of-truth as runDevApp
     //    AND the per-app drizzle-Schema-Generator, so Migration und Runtime
@@ -532,6 +539,9 @@ export async function runProdApp(options) {
                 ...(effectiveAuth.cookieDomain !== undefined && {
                     cookieDomain: effectiveAuth.cookieDomain,
                 }),
+                ...(effectiveAuth.secureCookies !== undefined && {
+                    secureCookies: effectiveAuth.secureCookies,
+                }),
                 ...(effectiveAuth.retiredCookieDomains !== undefined && {
                     retiredCookieDomains: effectiveAuth.retiredCookieDomains,
                 }),
@@ -541,6 +551,7 @@ export async function runProdApp(options) {
                 ...(effectiveAuth.unsafeSkipOriginCheck !== undefined && {
                     unsafeSkipOriginCheck: effectiveAuth.unsafeSkipOriginCheck,
                 }),
+                ...(authPublicOrigin !== undefined && { publicOrigin: authPublicOrigin }),
                 ...(trustedProxyHops !== undefined && { trustedProxyHops }),
                 ...(effectiveAuth.postAuthLanding !== undefined && {
                     postAuthLanding: effectiveAuth.postAuthLanding,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.359.0",
+  "version": "0.361.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -84,11 +84,11 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.359.0",
-    "@cosmicdrift/kumiko-framework": "0.359.0",
-    "@cosmicdrift/kumiko-headless": "0.359.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.359.0",
-    "@cosmicdrift/kumiko-types": "0.359.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.361.0",
+    "@cosmicdrift/kumiko-framework": "0.361.0",
+    "@cosmicdrift/kumiko-headless": "0.361.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.361.0",
+    "@cosmicdrift/kumiko-types": "0.361.0",
     "bun-types": "^1.3.13",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2"