@getstrata/core 0.5.60 → 0.5.62

package/dist/entries/http/safeInternalPath.js

@@ -0,0 +1,38 @@
+// @bun
+// ../../src/core/http/safeInternalPath.ts
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function sanitizeInternalPath(raw, fallback = "/") {
+  if (looksLikeExternalTarget(raw)) {
+    return fallback;
+  }
+  return raw;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+export {
+  loginRedirectLocation,
+  safeInternalRedirectPath,
+  sanitizeInternalPath
+};

package/dist/entries/http/securedRouteModelBinding.js

@@ -1,7 +1,7 @@
 // @bun
 // ../../src/core/http/securedRouteModelBinding.ts
 import { currentAuthUser as currentAuthUser2 } from "@getstrata/core/auth/authContext";
-import { BadRequestError as BadRequestError2 } from "@getstrata/core/errors/http";
+import { BadRequestError as BadRequestError2, NotFoundError } from "@getstrata/core/errors/http";
 import {
   resolveApplicationAuth,
   resolveApplicationPolicyGate
@@ -238,10 +238,32 @@ function parsePositiveIntParam(value, name = "id") {
 function isMutatingPolicyAction(action) {
   return action === "update" || action === "delete";
 }
+function modelHasIdentity(model) {
+  return !!model && typeof model === "object" && "id" in model && model.id !== undefined && model.id !== null;
+}
+function shouldApplyViewEtag(response, model, authorization) {
+  if (authorization.etag === false) {
+    return false;
+  }
+  if (authorization.etag === true) {
+    return true;
+  }
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("text/html")) {
+    return false;
+  }
+  return modelHasIdentity(model);
+}
+function requireResolvedModel(model) {
+  if (model == null) {
+    throw new NotFoundError;
+  }
+  return model;
+}
 function securedBindRouteModel(param, resolver, authorization, handler) {
   return async (request) => {
     const id = parsePositiveIntParam(String(request.params[param]), String(param));
-    const model = await resolver(id, request);
+    const model = requireResolvedModel(await resolver(id, request));
     const gate = resolveApplicationPolicyGate();
     const auth = resolveApplicationAuth();
     const user = currentAuthUser2() ?? await auth.resolve(request);
@@ -252,7 +274,7 @@ function securedBindRouteModel(param, resolver, authorization, handler) {
       });
     }
     const response = await handler(request, model);
-    if (isEtagEnabled() && authorization.action === "view") {
+    if (isEtagEnabled() && authorization.action === "view" && shouldApplyViewEtag(response, model, authorization)) {
       return applyConditionalGet(request, response, etagFromResource(model));
     }
     return response;
@@ -264,7 +286,7 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
     if (!key) {
       throw new BadRequestError2(`Missing route parameter "${String(param)}".`);
     }
-    const model = await resolver(key, request);
+    const model = requireResolvedModel(await resolver(key, request));
     const gate = resolveApplicationPolicyGate();
     const auth = resolveApplicationAuth();
     const user = currentAuthUser2() ?? await auth.resolve(request);
@@ -275,7 +297,7 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
       });
     }
     const response = await handler(request, model);
-    if (isEtagEnabled() && authorization.action === "view") {
+    if (isEtagEnabled() && authorization.action === "view" && shouldApplyViewEtag(response, model, authorization)) {
       return applyConditionalGet(request, response, etagFromResource(model));
     }
     return response;

package/dist/entries/http/securityHeadersMiddleware.js

@@ -1,77 +1,50 @@
 // @bun
+// ../../src/core/http/securityHeadersMiddleware.ts
+import {
+  configureContentSecurityPolicy,
+  generateCspNonce,
+  resolveContentSecurityPolicy
+} from "@getstrata/core/http/contentSecurityPolicy";
+import { currentRequestMeta, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
+
 // ../../src/config/app.ts
 var appConfig = {
-  name: "WorkHub",
+  name: process.env.APP_NAME?.trim() || "WorkHub",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
 
-// ../../src/config/contentSecurityPolicy.ts
-function strictApiContentSecurityPolicy() {
-  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
-}
-function serverHtmxContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self' https://unpkg.com",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "form-action 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function spaContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self'",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function resolveContentSecurityPolicy(response) {
-  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("text/html")) {
-    return strictApiContentSecurityPolicy();
-  }
-  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx") {
-    return serverHtmxContentSecurityPolicy();
-  }
-  if (frontendMode === "spa-react") {
-    return spaContentSecurityPolicy();
-  }
-  return strictApiContentSecurityPolicy();
-}
-
 // ../../src/core/http/securityHeadersMiddleware.ts
-function createSecurityHeadersMiddleware() {
-  return async (_request, next) => {
-    const response = await next();
-    const headers = new Headers(response.headers);
-    headers.set("X-Content-Type-Options", "nosniff");
-    headers.set("X-Frame-Options", "DENY");
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-    headers.set("X-XSS-Protection", "0");
-    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
-    if (appConfig.env === "production") {
-      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
+function createSecurityHeadersMiddleware(options = {}) {
+  return async (request, next) => {
+    const nonce = generateCspNonce();
+    const existing = currentRequestMeta();
+    return await runWithRequestMeta({
+      ...existing,
+      request: existing.request ?? request,
+      cspNonce: nonce
+    }, async () => {
+      const response = await next();
+      const headers = new Headers(response.headers);
+      headers.set("X-Content-Type-Options", "nosniff");
+      headers.set("X-Frame-Options", "DENY");
+      headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+      headers.set("X-XSS-Protection", "0");
+      headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response, { ...options, nonce }));
+      if (appConfig.env === "production") {
+        headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+      }
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
     });
   };
 }
 export {
+  configureContentSecurityPolicy,
   createSecurityHeadersMiddleware
 };

package/dist/entries/http/signedUrl.js

@@ -0,0 +1,97 @@
+// @bun
+// ../../src/core/http/signedUrl.ts
+import { createHmac } from "crypto";
+import { ForbiddenError } from "@getstrata/core/errors/http";
+import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
+function resolveSignedUrlSecret() {
+  return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-signed-url-secret";
+}
+function resolveSignedUrlOrigin() {
+  return (process.env.APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
+}
+function normalizeSignedPath(path) {
+  const trimmed = path.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    throw new Error("Signed URLs must use a same-origin absolute path.");
+  }
+  if (trimmed.includes("://")) {
+    throw new Error("Signed URLs must use a same-origin absolute path.");
+  }
+  return trimmed;
+}
+function sortedQueryString(params) {
+  const entries = [...params.entries()].filter(([key]) => key !== "signature").sort(([left], [right]) => left.localeCompare(right));
+  return new URLSearchParams(entries).toString();
+}
+function signCanonicalPayload(path, query) {
+  return createHmac("sha256", resolveSignedUrlSecret()).update(`${path}
+${query}`).digest("hex");
+}
+function buildSignedSearchParams(path, query = {}, expiresAt) {
+  const params = new URLSearchParams;
+  for (const [key, value] of Object.entries(query)) {
+    if (key === "signature" || key === "expires") {
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  if (expiresAt !== undefined) {
+    params.set("expires", String(expiresAt));
+  }
+  params.set("signature", signCanonicalPayload(path, sortedQueryString(params)));
+  return params;
+}
+function signedUrl(path, query = {}) {
+  const normalizedPath = normalizeSignedPath(path);
+  const params = buildSignedSearchParams(normalizedPath, query);
+  return `${normalizedPath}?${params.toString()}`;
+}
+function temporarySignedUrl(path, expiresInSeconds, query = {}) {
+  if (!Number.isInteger(expiresInSeconds) || expiresInSeconds <= 0) {
+    throw new Error("Signed URL expiry must be a positive integer number of seconds.");
+  }
+  const normalizedPath = normalizeSignedPath(path);
+  const expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;
+  const params = buildSignedSearchParams(normalizedPath, query, expiresAt);
+  return `${normalizedPath}?${params.toString()}`;
+}
+function absoluteTemporarySignedUrl(path, expiresInSeconds, query = {}, origin = resolveSignedUrlOrigin()) {
+  return `${origin.replace(/\/$/, "")}${temporarySignedUrl(path, expiresInSeconds, query)}`;
+}
+function readSignedRequestUrl(input) {
+  if (input instanceof URL) {
+    return input;
+  }
+  if (typeof input === "string") {
+    return new URL(input, resolveSignedUrlOrigin());
+  }
+  return new URL(input.url);
+}
+function hasValidSignature(input) {
+  const url = readSignedRequestUrl(input);
+  const signature = url.searchParams.get("signature");
+  if (!signature) {
+    return false;
+  }
+  const expires = url.searchParams.get("expires");
+  if (expires) {
+    const expiresAt = Number.parseInt(expires, 10);
+    if (!Number.isInteger(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000)) {
+      return false;
+    }
+  }
+  const expected = signCanonicalPayload(url.pathname, sortedQueryString(url.searchParams));
+  return timingSafeCompareString(signature, expected);
+}
+function assertValidSignature(input) {
+  if (!hasValidSignature(input)) {
+    throw new ForbiddenError("Invalid or expired signed URL.");
+  }
+}
+export {
+  absoluteTemporarySignedUrl,
+  assertValidSignature,
+  hasValidSignature,
+  signedUrl,
+  temporarySignedUrl
+};