@holo-js/security 0.3.19 → 0.3.21

package/dist/{chunk-G3HBF4Q5.mjs → chunk-5SCCUNBO.mjs}

@@ -293,28 +293,6 @@ function getHeaderToken(request) {
   const { header } = getSecurityRuntime().config.csrf;
   return request.headers.get(header)?.trim() || void 0;
 }
-function getRequestOrigin(request) {
-  const origin = request.headers.get("origin")?.trim();
-  if (origin) {
-    return origin;
-  }
-  const referer = request.headers.get("referer")?.trim();
-  if (!referer) {
-    return void 0;
-  }
-  try {
-    return new URL(referer).origin;
-  } catch {
-    return void 0;
-  }
-}
-function isSameOriginRequest(request) {
-  const requestOrigin = getRequestOrigin(request);
-  if (!requestOrigin) {
-    return false;
-  }
-  return requestOrigin === new URL(request.url).origin;
-}
 async function readFormToken(request) {
   const { field: field2 } = getSecurityRuntime().config.csrf;
   try {
@@ -343,9 +321,6 @@ async function verifyRequest(request, options) {
     }
     return;
   }
-  if (isSameOriginRequest(request)) {
-    return;
-  }
   const requestToken = await readFormToken(request);
   if (requestToken !== cookieToken) {
     throw new SecurityCsrfError();
@@ -432,7 +407,6 @@ var csrfInternals = {
   getCookieToken,
   getHeaderToken,
   isSecureRequest,
-  isSameOriginRequest,
   readFormToken,
   isExcludedPath,
   isSafeMethod,

package/dist/{chunk-5M3RHQIG.mjs → chunk-F32JK536.mjs}

@@ -3,12 +3,12 @@ import {
   getSecurityRuntime,
   isSecureRequest,
   token
-} from "./chunk-G3HBF4Q5.mjs";
+} from "./chunk-5SCCUNBO.mjs";
 import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,
   serializeSecurityClientConfig
-} from "./chunk-FUOZWKHK.mjs";
+} from "./chunk-PC2YCWDH.mjs";
 
 // src/cookie-issuance.ts
 async function prepareCsrfCookies(request, getCookie) {

package/dist/{chunk-FUOZWKHK.mjs → chunk-PC2YCWDH.mjs}

@@ -38,15 +38,15 @@ function createSecurityClientConfig(config) {
   return Object.freeze({
     csrf: Object.freeze({
       field: config.csrf.field,
-      cookie: config.csrf.cookie
+      cookie: config.csrf.cookie,
+      header: config.csrf.header
     })
   });
 }
 function serializeSecurityClientConfig(config) {
   return JSON.stringify(config);
 }
-function readSecurityClientConfigFromCookies(cookieHeader) {
-  const raw = parseCookieHeader(cookieHeader)[SECURITY_CLIENT_CONFIG_COOKIE];
+function parseSecurityClientConfig(raw) {
   if (!raw) {
     return void 0;
   }
@@ -55,18 +55,31 @@ function readSecurityClientConfigFromCookies(cookieHeader) {
     if (!isSecurityClientConfig(parsed)) {
       return void 0;
     }
-    return Object.freeze({
-      csrf: Object.freeze({
-        field: parsed.csrf.field,
-        cookie: parsed.csrf.cookie
-      })
-    });
+    return parsed;
   } catch {
     return void 0;
   }
 }
+function readSecurityClientConfigFromCookies(cookieHeader) {
+  const parsed = parseSecurityClientConfig(parseCookieHeader(cookieHeader)[SECURITY_CLIENT_CONFIG_COOKIE]);
+  return parsed ? Object.freeze({
+    csrf: Object.freeze({
+      field: parsed.csrf.field,
+      cookie: parsed.csrf.cookie,
+      ..."header" in parsed.csrf && typeof parsed.csrf.header === "string" ? { header: parsed.csrf.header } : {}
+    })
+  }) : void 0;
+}
+function getCsrfRequestHeaders(cookieHeader) {
+  const cookies = parseCookieHeader(cookieHeader);
+  const config = parseSecurityClientConfig(cookies[SECURITY_CLIENT_CONFIG_COOKIE]) ?? DEFAULT_SECURITY_CLIENT_CONFIG;
+  const token = cookies[config.csrf.cookie];
+  const header = "header" in config.csrf && typeof config.csrf.header === "string" ? config.csrf.header : "X-CSRF-TOKEN";
+  return token ? { [header]: token } : {};
+}
 var securityClientConfigInternals = {
-  parseCookieHeader
+  parseCookieHeader,
+  getCsrfRequestHeaders
 };
 
 export {

package/dist/client.d.ts

@@ -8,6 +8,7 @@ declare function readSecurityClientConfigFromCookies(cookieHeader: string | null
 declare function getSecurityClientConfig(): SecurityClientConfig;
 declare const securityClientInternals: {
     parseCookieHeader: (header: string | null | undefined) => Readonly<Record<string, string>>;
+    getCsrfRequestHeaders: (cookieHeader: string | undefined) => Readonly<Record<string, string>>;
     getDefaultSecurityClientConfig: typeof getDefaultSecurityClientConfig;
     readSecurityClientConfigFromCookies: typeof readSecurityClientConfigFromCookies;
 };

package/dist/client.mjs

@@ -2,12 +2,13 @@ import {
   getDefaultSecurityClientConfig,
   readSecurityClientConfigFromCookies,
   securityClientConfigInternals
-} from "./chunk-FUOZWKHK.mjs";
+} from "./chunk-PC2YCWDH.mjs";
 
 // src/client.ts
 function getSecurityClientConfig() {
   const runtime = globalThis;
-  return readSecurityClientConfigFromCookies(runtime.document?.cookie) ?? getDefaultSecurityClientConfig();
+  const config = readSecurityClientConfigFromCookies(runtime.document?.cookie) ?? getDefaultSecurityClientConfig();
+  return Object.freeze({ csrf: Object.freeze({ field: config.csrf.field, cookie: config.csrf.cookie }) });
 }
 var securityClientInternals = {
   getDefaultSecurityClientConfig,

package/dist/index.d.ts

@@ -23,7 +23,6 @@ declare function decodeCsrfToken(token: string): {
 declare function isValidSignedCsrfToken(token: string): boolean;
 declare function getCookieToken(request: Request): string | undefined;
 declare function getHeaderToken(request: Request): string | undefined;
-declare function isSameOriginRequest(request: Request): boolean;
 declare function readFormToken(request: Request): Promise<string | undefined>;
 declare function token(request: Request): Promise<string>;
 declare function field(request: Request): Promise<SecurityCsrfField>;
@@ -45,7 +44,6 @@ declare const csrfInternals: {
     getCookieToken: typeof getCookieToken;
     getHeaderToken: typeof getHeaderToken;
     isSecureRequest: typeof isSecureRequest;
-    isSameOriginRequest: typeof isSameOriginRequest;
     readFormToken: typeof readFormToken;
     isExcludedPath: typeof isExcludedPath;
     isSafeMethod: typeof isSafeMethod;

package/dist/index.mjs

@@ -34,7 +34,7 @@ import {
   token,
   verify,
   verifySignedToken
-} from "./chunk-G3HBF4Q5.mjs";
+} from "./chunk-5SCCUNBO.mjs";
 import {
   SecurityCsrfError,
   SecurityRateLimitError,

package/dist/next/server.mjs

@@ -1,10 +1,12 @@
 import {
   prepareCsrfCookies
-} from "../chunk-5M3RHQIG.mjs";
+} from "../chunk-F32JK536.mjs";
 import {
+  cors,
+  getSecurityRuntime,
   protect
-} from "../chunk-G3HBF4Q5.mjs";
-import "../chunk-FUOZWKHK.mjs";
+} from "../chunk-5SCCUNBO.mjs";
+import "../chunk-PC2YCWDH.mjs";
 import {
   SecurityCsrfError
 } from "../chunk-FQ4X7X6L.mjs";
@@ -38,8 +40,34 @@ async function issueCsrfCookie(request) {
   }
   return response;
 }
+async function actionRequest(request) {
+  const { field, header } = getSecurityRuntime().config.csrf;
+  if (!request.headers.has("next-action") || request.headers.get(header)?.trim() || !request.headers.get("content-type")?.startsWith("multipart/form-data")) return request;
+  try {
+    const data = await request.clone().formData();
+    const root = data.get("0");
+    if (typeof root !== "string") return request;
+    const args = JSON.parse(root);
+    if (!Array.isArray(args)) return request;
+    for (const argument of args) {
+      if (typeof argument !== "string") continue;
+      const part = /^\$K([0-9a-f]+)$/.exec(argument)?.[1];
+      if (!part) continue;
+      const token = data.get(`_${Number.parseInt(part, 16)}_${field}`);
+      if (typeof token !== "string") continue;
+      const headers = new Headers(request.headers);
+      headers.set(header, token);
+      return new Request(request.clone(), { headers });
+    }
+  } catch {
+    return request;
+  }
+  return request;
+}
 function csrfProtection() {
   return async (request) => {
+    const preflight = cors.preflight(request);
+    if (preflight) return preflight;
     if (request.method.trim().toUpperCase() === "TRACE") {
       return new Response("Method Not Allowed", {
         status: 405,
@@ -47,14 +75,18 @@ function csrfProtection() {
       });
     }
     try {
-      await protect(request);
+      await protect(await actionRequest(request));
     } catch (error) {
       if (error instanceof SecurityCsrfError) {
-        return createCsrfErrorResponse(error);
+        return cors.apply(request, createCsrfErrorResponse(error));
       }
       throw error;
     }
-    return await issueCsrfCookie(request);
+    const response = await issueCsrfCookie(request);
+    if (response) return cors.apply(request, response);
+    if ([...cors.headers(request)].length === 0) return void 0;
+    const { NextResponse } = await import("next/server.js");
+    return cors.apply(request, NextResponse.next());
   };
 }
 var nextSecurityInternals = {

package/dist/nuxt/server.mjs

@@ -1,10 +1,11 @@
 import {
   prepareCsrfCookies
-} from "../chunk-5M3RHQIG.mjs";
+} from "../chunk-F32JK536.mjs";
 import {
+  cors,
   protect
-} from "../chunk-G3HBF4Q5.mjs";
-import "../chunk-FUOZWKHK.mjs";
+} from "../chunk-5SCCUNBO.mjs";
+import "../chunk-PC2YCWDH.mjs";
 import {
   SecurityCsrfError
 } from "../chunk-FQ4X7X6L.mjs";
@@ -19,11 +20,12 @@ import {
   getRequestHeaders,
   getRequestURL,
   readRawBody,
-  setCookie
+  setCookie,
+  setResponseHeader
 } from "h3";
 function isSafeMethod(method) {
   const normalized = method.trim().toUpperCase();
-  return normalized === "GET" || normalized === "HEAD";
+  return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
 }
 function createHeaders(event) {
   const headers = new Headers();
@@ -67,6 +69,9 @@ function csrfProtection() {
       });
     }
     const request = await createRequest(event);
+    const preflight = cors.preflight(request);
+    if (preflight) return preflight;
+    cors.headers(request).forEach((value, name) => setResponseHeader(event, name, value));
     try {
       await protect(request);
     } catch (error) {

package/dist/sveltekit/server.mjs

@@ -1,10 +1,11 @@
 import {
   prepareCsrfCookies
-} from "../chunk-5M3RHQIG.mjs";
+} from "../chunk-F32JK536.mjs";
 import {
+  cors,
   protect
-} from "../chunk-G3HBF4Q5.mjs";
-import "../chunk-FUOZWKHK.mjs";
+} from "../chunk-5SCCUNBO.mjs";
+import "../chunk-PC2YCWDH.mjs";
 import {
   SecurityCsrfError
 } from "../chunk-FQ4X7X6L.mjs";
@@ -27,6 +28,8 @@ function createCsrfErrorResponse(error) {
 }
 function csrfProtection() {
   return async ({ event, resolve }) => {
+    const preflight = cors.preflight(event.request);
+    if (preflight) return preflight;
     if (event.request.method.trim().toUpperCase() === "TRACE") {
       return new Response("Method Not Allowed", {
         status: 405,
@@ -37,12 +40,12 @@ function csrfProtection() {
       await protect(event.request);
     } catch (error) {
       if (error instanceof SecurityCsrfError) {
-        return createCsrfErrorResponse(error);
+        return cors.apply(event.request, createCsrfErrorResponse(error));
       }
       throw error;
     }
     await issueCsrfCookie(event);
-    return resolve(event);
+    return cors.apply(event.request, await resolve(event));
   };
 }
 var svelteKitSecurityInternals = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/security",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
@@ -58,8 +58,8 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.3.19",
-    "@holo-js/kernel": "^0.3.19"
+    "@holo-js/config": "^0.3.21",
+    "@holo-js/kernel": "^0.3.21"
   },
   "peerDependencies": {
     "h3": "^1.15.11",