@doswiftly/cli 1.0.2 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 1.1.0
+
+### Minor Changes
+
+- e6c80ce: Auth route handlers (`createSetTokenHandler`, `createClearTokenHandler`, `createWhoamiHandler`) now accept an optional `isTrustedOrigin` predicate. This unblocks the BFF auth flow when the storefront runs behind a reverse proxy (DoSwiftly hosting, Vercel, custom edge proxy) that rewrites or strips the `Host` header — since 11.3.0 the strict `Origin host = Host` comparison returned 403 for every login, logout, and page-load hydration in that topology, leaving the auth cookie unset and every auth-gated route redirecting to login.
+
+  ### Fix
+
+  Each handler accepts a new `isTrustedOrigin` callback:
+
+  ```ts
+  type OriginValidator = (ctx: {
+    origin: string;
+    originHost: string;
+    request: Request;
+  }) => boolean | Promise<boolean>;
+  ```
+
+  When the predicate returns truthy the strict `Origin host = Host header` comparison is bypassed; when it returns falsy (or is not configured) the existing strict check applies. A thrown predicate fails closed — the error is logged and the strict check applies as if the predicate returned `false`.
+
+  Two pre-built predicates are exported:
+  - `trustedForwardedHostValidator` — passes when `Origin host` equals `X-Forwarded-Host` (falling back to `X-Original-Host`). Use this when a reverse proxy you control sets one of those headers per request. The DoSwiftly hosting platform and Vercel both qualify.
+  - `originAllowlistValidator(['https://shop.example.com', 'other-shop.example'])` — passes when `Origin` matches an entry in a static list. Useful when one storefront is hosted on multiple hostnames (custom apex + platform subdomain) and you do not want to depend on forwarded-host headers.
+
+  ### Upgrade impact
+  - New storefronts scaffolded via `doswiftly init` ship with `isTrustedOrigin: trustedForwardedHostValidator` configured by default.
+  - Existing storefronts using the SDK behind a reverse proxy need a 3-line change to each route handler under `app/api/auth/`:
+    ```ts
+    import {
+      createSetTokenHandler,
+      trustedForwardedHostValidator,
+    } from "@doswiftly/storefront-sdk";
+    export const POST = createSetTokenHandler({
+      isTrustedOrigin: trustedForwardedHostValidator,
+    });
+    ```
+  - Storefronts deployed without a reverse proxy (single-tier hosting where the Next.js process receives traffic directly) need no changes — the default strict check still works because the Host header arrives intact.
+
+  ### Security
+
+  The predicate is invoked AFTER the Origin header is parsed (rejecting malformed origins) and BEFORE the strict Host comparison. Forwarded-host validation is safe because the trusted intermediary overwrites those headers on every inbound request (`headers.set(...)`, not `append`), so an attacker cannot forge them via a browser `fetch()` — browsers cannot set `X-Forwarded-*` from JavaScript (they are forbidden request headers per the fetch spec).
+
+  Defense-in-depth layers continue to apply: CORS preflight at the backend, `SameSite=Lax` on the auth cookie, `HttpOnly` + `Secure` cookie attributes, and the strict Origin URL parse (still rejects malformed origin and the `?host=trusted` query-string bypass).
+
 ## 1.0.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doswiftly/cli",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "DoSwiftly CLI - Scaffold and deploy e-commerce storefronts",
   "homepage": "https://doswiftly.pl",
   "publishConfig": {

package/templates/storefront-nextjs-shadcn/app/api/auth/clear-token/route.ts

@@ -1,3 +1,5 @@
-import { createClearTokenHandler } from '@doswiftly/storefront-sdk';
+import { createClearTokenHandler, trustedForwardedHostValidator } from '@doswiftly/storefront-sdk';
 
-export const POST = createClearTokenHandler();
+export const POST = createClearTokenHandler({
+  isTrustedOrigin: trustedForwardedHostValidator,
+});

package/templates/storefront-nextjs-shadcn/app/api/auth/set-token/route.ts

@@ -1,3 +1,5 @@
-import { createSetTokenHandler } from '@doswiftly/storefront-sdk';
+import { createSetTokenHandler, trustedForwardedHostValidator } from '@doswiftly/storefront-sdk';
 
-export const POST = createSetTokenHandler();
+export const POST = createSetTokenHandler({
+  isTrustedOrigin: trustedForwardedHostValidator,
+});

package/templates/storefront-nextjs-shadcn/app/api/auth/whoami/route.ts

@@ -1,6 +1,7 @@
-import { createWhoamiHandler } from '@doswiftly/storefront-sdk';
+import { createWhoamiHandler, trustedForwardedHostValidator } from '@doswiftly/storefront-sdk';
 
 export const GET = createWhoamiHandler({
   apiUrl: process.env.NEXT_PUBLIC_API_URL,
   shopSlug: process.env.NEXT_PUBLIC_SHOP_SLUG,
+  isTrustedOrigin: trustedForwardedHostValidator,
 });