@jskit-ai/auth-core 0.1.244 → 0.1.245

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-core",
-  "version": "0.1.244",
+  "version": "0.1.245",
   "type": "module",
   "scripts": {
     "test": "node --test --test-concurrency=1"
@@ -135,6 +135,6 @@
     }
   },
   "peerDependencies": {
-    "@jskit-ai/kernel": "0.1.246"
+    "@jskit-ai/kernel": "0.1.247"
   }
 }

package/src/server/providers/AuthPolicyProvider.js

@@ -13,6 +13,7 @@ function defaultHasPermission({ permission, permissions = [] } = {}) {
 }
 
 function createPolicy({ authService, extensions, env }) {
+  const unsafeMethods = parseList(env.AUTH_CSRF_UNSAFE_METHODS);
   return Object.freeze({
     async resolveActor(request) {
       if (authService && typeof authService.authenticateRequest === "function") {
@@ -27,7 +28,8 @@ function createPolicy({ authService, extensions, env }) {
     options: Object.freeze({
       nodeEnv: String(env.NODE_ENV || "development").trim() || "development",
       apiPrefix: String(env.AUTH_API_PREFIX || "/api/").trim() || "/api/",
-      unsafeMethods: Object.freeze(parseList(env.AUTH_CSRF_UNSAFE_METHODS)),
+      // Unset AUTH_CSRF_UNSAFE_METHODS keeps the plugin default (POST, PUT, PATCH, DELETE).
+      unsafeMethods: unsafeMethods.length > 0 ? Object.freeze(unsafeMethods) : undefined,
       // Unset AUTH_CSRF_COOKIE_SECURE follows NODE_ENV (Secure in production).
       csrfCookieOpts: Object.freeze(
         String(env.AUTH_CSRF_COOKIE_SECURE ?? "").trim()

package/test/providerRuntime.test.js

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import Fastify from "fastify";
 import { createActionProvider } from "@jskit-ai/kernel/server/actions";
 import { createCapabilityRuntime, defineProvider } from "@jskit-ai/kernel/shared/capabilities";
 import { HttpProvider } from "@jskit-ai/kernel/server/http";
@@ -126,3 +127,23 @@ test("auth policy denies protected routes when no auth service is installed", as
     routeOptions: { config: { authPolicy: "required" } }
   }, {}), /Authentication required/);
 });
+
+test("AuthPolicyProvider checks CSRF on unsafe methods when AUTH_CSRF_UNSAFE_METHODS is unset", async (t) => {
+  const app = Fastify();
+  t.after(() => app.close());
+  const runtime = createCapabilityRuntime({
+    inputs: runtimeInputs(app),
+    providers: [
+      createActionProvider(),
+      HttpProvider,
+      AuthExtensionsProvider,
+      AuthFeature,
+      AuthPolicyProvider
+    ]
+  });
+  await runtime.start();
+  app.post("/api/write", { config: { authPolicy: "public" } }, () => ({ accepted: true }));
+
+  const missingToken = await app.inject({ method: "POST", url: "/api/write" });
+  assert.equal(missingToken.statusCode, 403);
+});