@fabrika/proxy-core 0.5.4 → 0.5.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/proxy-core",
-	"version": "0.5.4",
+	"version": "0.5.5",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -37,9 +37,9 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth-core": "0.5.4",
-		"@fabrika/jwks": "0.5.4",
+		"@fabrika/auth-core": "0.5.5",
+		"@fabrika/jwks": "0.5.5",
 		"jose": "^5.9.0",
-		"@fabrika/platform": "0.5.4"
+		"@fabrika/platform": "0.5.5"
 	}
 }

package/src/authorize.ts

@@ -26,6 +26,7 @@ import {
 	callerAdmittedAt,
 	callerOf,
 	type CompiledEndpointTable,
+	FORM_MULTIPART_TYPE,
 	formatEndpointHeader,
 	planEndpoint,
 	satisfies,
@@ -77,7 +78,10 @@ export type DenyReason =
 	| 'cross_site'
 	/** The request's `Content-Type` is not one the endpoint admits. */
 	| 'content_type'
-	/** A preflight for an endpoint the contract does not open to another origin, or from an origin it does not admit. */
+	/**
+	 * A preflight for an endpoint the contract does not open to another origin, or from an origin it does not admit; or a
+	 * multipart form's request from such an origin, which a browser sends without a preflight.
+	 */
 	| 'cross_origin'
 	/** IAM refused the delegation grant a membership or scope-creating endpoint needs. */
 	| 'delegation_refused'
@@ -301,7 +305,8 @@ export class Authorizer {
 	private async decideRow(app: ProxyApp, row: ManifestEndpointRow, request: ForwardedRequest, crossOrigin: string | null): Promise<Decision> {
 		const endpoint = formatEndpointHeader(row.id, row.digest)
 		if (row.requirement === null) {
-			return admitBody(row, request.headers) ?? { outcome: 'allow', token: null, subject: null, endpoint, delegation: null, crossOrigin }
+			return admitBody(row, request.headers) ?? admitFormOrigin(app, row, request, crossOrigin)
+				?? { outcome: 'allow', token: null, subject: null, endpoint, delegation: null, crossOrigin }
 		}
 		const oauth = oauthBindingOf(app, row)
 		if (oauth === 'unregistered') {
@@ -656,6 +661,20 @@ function withBearerChallenge(denial: Denial, oauth: OAuthBinding | null): Denial
 	return { ...denial, challenge: denial.status === 401 ? { ...challenge, error: 'invalid_token' } : challenge }
 }
 
+/**
+ * A multipart form admits a browser's request only from the application's own origin or one the row admits (ADR-0022
+ * "Cross-origin endpoints"). A page on any origin sends `multipart/form-data` without a preflight, so the proxy refuses
+ * at the request what it refuses at the preflight of a JSON form. A request without `Origin` is no browser's
+ * cross-origin request.
+ */
+function admitFormOrigin(app: ProxyApp, row: ManifestEndpointRow, request: ForwardedRequest, crossOrigin: string | null): Denial | null {
+	const origin = request.headers.get(ORIGIN_HEADER)
+	if (row.kind !== 'form' || origin === null || crossOrigin !== null || !(row.admission?.contentTypes.includes(FORM_MULTIPART_TYPE) ?? false)) {
+		return null
+	}
+	return origin === `${app.scheme}://${request.url.host}` ? null : { outcome: 'deny', status: 403, reason: 'cross_origin' }
+}
+
 /** An endpoint that admits a body admits only its declared media types (ADR-0022 rule 3, admission). */
 function admitBody(row: ManifestEndpointRow, headers: Headers): Denial | null {
 	if (row.admission === null) {