@luckystack/server 0.3.1 → 0.4.1

package/dist/index.d.ts

@@ -281,7 +281,12 @@ declare const getPreParamsCustomRoutes: () => readonly CustomRouteHandler[];
 declare const clearCustomRoutes: () => void;
 
 interface OriginExemptMatcher {
-    /** A route is exempt when its path starts with this prefix. */
+    /**
+     * A route is exempt when its path equals this prefix OR continues past it on a
+     * path-SEGMENT boundary (i.e. `<prefix>/...`). Matching is boundary-aware so a
+     * prefix can't bleed into a sibling route — `/webhooks` exempts `/webhooks` and
+     * `/webhooks/stripe` but NOT `/webhooksadmin`.
+     */
     pathPrefix: string;
 }
 declare const registerOriginExemptPath: (matcher: OriginExemptMatcher) => void;

package/dist/index.js

@@ -7,7 +7,7 @@ import {
 
 // src/createServer.ts
 import http from "http";
-import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig13, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey4 } from "@luckystack/core";
+import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig13, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey5 } from "@luckystack/core";
 
 // src/httpHandler.ts
 import { randomUUID } from "crypto";
@@ -138,7 +138,12 @@ var getOriginExemptPaths = () => exemptPaths;
 var clearOriginExemptPaths = () => {
   exemptPaths.length = 0;
 };
-var isOriginExemptPath = (routePath) => exemptPaths.some((matcher) => routePath.startsWith(matcher.pathPrefix));
+var isOriginExemptPath = (routePath) => exemptPaths.some(({ pathPrefix }) => {
+  if (!pathPrefix) return false;
+  if (routePath === pathPrefix) return true;
+  const boundary = pathPrefix.endsWith("/") ? pathPrefix : `${pathPrefix}/`;
+  return routePath.startsWith(boundary);
+});
 
 // src/httpRoutes/timingSafeEqual.ts
 import { timingSafeEqual as cryptoTimingSafeEqual } from "crypto";
@@ -427,7 +432,12 @@ import {
 } from "@luckystack/core";
 
 // src/httpRoutes/sessionCookie.ts
-var resolveCookieSecure = (sessionCookieSecure, secureEnv) => sessionCookieSecure ?? secureEnv === "true";
+import { resolveEnvKey as resolveEnvKey2 } from "@luckystack/core";
+var resolveCookieSecure = (sessionCookieSecure, secureEnv) => {
+  if (sessionCookieSecure !== void 0) return sessionCookieSecure;
+  if (secureEnv === "true") return true;
+  return resolveEnvKey2() === "production";
+};
 
 // src/httpRoutes/authApiRoute.ts
 var parseSessionBasedTokenHeader = (headerValue) => {
@@ -472,6 +482,40 @@ var handleAuthApiRoute = async ({
     return true;
   }
   if (login.isFullOAuthProvider(provider)) {
+    const oauthRateLimiting = config.rateLimiting;
+    const oauthRequesterIp = resolveClientIp({
+      rawAddress: req.socket.remoteAddress,
+      headers: req.headers,
+      trustProxy: config.http.trustProxy,
+      trustedProxyHopCount: config.http.trustedProxyHopCount
+    });
+    const oauthInitLimit = oauthRateLimiting.defaultApiLimit !== false && oauthRateLimiting.defaultApiLimit > 0 ? oauthRateLimiting.defaultApiLimit : oauthRateLimiting.auth.enabled && oauthRateLimiting.auth.maxAttempts > 0 ? oauthRateLimiting.auth.maxAttempts : null;
+    if (oauthInitLimit !== null) {
+      const oauthInitWindowMs = oauthRateLimiting.defaultApiLimit !== false && oauthRateLimiting.defaultApiLimit > 0 ? oauthRateLimiting.windowMs : oauthRateLimiting.auth.windowMs;
+      const { allowed, resetIn } = await checkRateLimit({
+        key: `ip:${oauthRequesterIp}:auth:oauth-init`,
+        limit: oauthInitLimit,
+        windowMs: oauthInitWindowMs
+      });
+      if (!allowed) {
+        void dispatchHook2("rateLimitExceeded", {
+          scope: "auth",
+          key: `ip:${oauthRequesterIp}:auth:oauth-init`,
+          limit: oauthInitLimit,
+          windowMs: oauthInitWindowMs,
+          count: oauthInitLimit + 1,
+          route: routePath,
+          ip: oauthRequesterIp
+        });
+        res.writeHead(429, { "content-type": "application/json; charset=utf-8" });
+        res.end(JSON.stringify({
+          status: false,
+          reason: "api.rateLimitExceeded",
+          errorParams: [{ key: "seconds", value: resetIn }]
+        }));
+        return true;
+      }
+    }
     const reqUrl = new URL(req.url ?? "/", "http://placeholder");
     const returnUrl = reqUrl.searchParams.get("return_url") ?? void 0;
     const oauthState = await login.createOAuthState(provider.name, { usePkce: provider.usePkce, returnUrl });
@@ -517,7 +561,7 @@ var handleAuthApiRoute = async ({
   });
   const ipLimitCount = rateLimiting.defaultApiLimit !== false && rateLimiting.defaultApiLimit > 0 ? rateLimiting.defaultApiLimit : rateLimiting.auth.enabled && rateLimiting.auth.maxAttempts > 0 ? rateLimiting.auth.maxAttempts : null;
   if (ipLimitCount !== null) {
-    const ipWindowMs = rateLimiting.defaultApiLimit === false ? rateLimiting.auth.windowMs : rateLimiting.windowMs;
+    const ipWindowMs = rateLimiting.defaultApiLimit !== false && rateLimiting.defaultApiLimit > 0 ? rateLimiting.windowMs : rateLimiting.auth.windowMs;
     const { allowed, resetIn } = await checkRateLimit({
       key: `ip:${requesterIp}:auth:credentials`,
       limit: ipLimitCount,
@@ -1163,7 +1207,7 @@ var enforceOriginPolicy = (req, res, routePath) => {
   });
   const isStateChangingMethod = req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS";
   if (isOriginExemptPath(routePath)) {
-    return { origin, rejected: false };
+    return { origin: "", rejected: false };
   }
   if (!origin) {
     if (isStateChangingMethod) {
@@ -1419,8 +1463,7 @@ var executeRoomMutation = async (opts) => {
     return;
   }
   const existingRoomCodes = getSessionRoomCodes(session);
-  const roomPurpose = preHook === "preRoomJoin" ? "join" : "leave";
-  const physicalRoom = formatRoomName(group, { purpose: roomPurpose, userId: session.id });
+  const physicalRoom = formatRoomName(group, { purpose: "broadcast", userId: session.id });
   const nextRoomCodes = await mutate(socket, physicalRoom, group, existingRoomCodes, session.id);
   const sanitizedSession = sanitizeSessionRoomKeys(session);
   await writeSession(token, { ...sanitizedSession, roomCodes: nextRoomCodes });
@@ -1486,7 +1529,7 @@ var registerRoomEvents = (ctx) => {
               const oldest = kept[0];
               if (oldest === void 0) break;
               kept = kept.slice(1);
-              await sock.leave(formatRoomName(oldest, { purpose: "join", userId }));
+              await sock.leave(formatRoomName(oldest, { purpose: "broadcast", userId }));
             }
           }
           await sock.join(physicalRoom);
@@ -1637,7 +1680,7 @@ var rejoinPersistedRooms = (ctx) => {
       const roomCodes = session ? getSessionRoomCodes(session) : [];
       const userId = session?.id ?? null;
       for (const roomCode of roomCodes) {
-        await socket.join(formatRoomName(roomCode, { purpose: "join", userId }));
+        await socket.join(formatRoomName(roomCode, { purpose: "broadcast", userId }));
       }
       return roomCodes;
     });
@@ -1727,7 +1770,7 @@ import {
   isLocalizedNormalizerRegistered,
   isProjectConfigRegistered,
   isRuntimeMapsProviderRegistered,
-  resolveEnvKey as resolveEnvKey2
+  resolveEnvKey as resolveEnvKey3
 } from "@luckystack/core";
 var verifyBootstrap = async (requirements = {}) => {
   const missing = [];
@@ -1766,7 +1809,7 @@ var verifyBootstrap = async (requirements = {}) => {
     }
   }
   if (!isRuntimeMapsProviderRegistered()) {
-    if (resolveEnvKey2() === "production") {
+    if (resolveEnvKey3() === "production") {
       missing.push(
         "RuntimeMapsProvider \u2014 call `registerRuntimeMapsProvider({...})` from `server/prod/runtimeMaps.ts`. Without it, every api/sync request returns notFound."
       );
@@ -1777,7 +1820,7 @@ var verifyBootstrap = async (requirements = {}) => {
     }
   }
   if (!isLocalizedNormalizerRegistered()) {
-    if (resolveEnvKey2() === "production") {
+    if (resolveEnvKey3() === "production") {
       missing.push(
         "LocalizedNormalizer \u2014 call `registerLocalizedNormalizer({...})` from your bootstrap. Without it, error response messages will be the raw errorCode (no i18n)."
       );
@@ -1796,6 +1839,14 @@ var verifyBootstrap = async (requirements = {}) => {
       );
     }
   }
+  if (isProjectConfigRegistered()) {
+    const cfg = getProjectConfig12();
+    if (!cfg.session.basedToken && cfg.http.sessionCookieSameSite !== "Strict") {
+      getLogger9().warn(
+        `[LuckyStack] SECURITY: http.sessionCookieSameSite is '${cfg.http.sessionCookieSameSite}', not 'Strict', but the CSRF-exempt auth-bootstrap endpoints (/auth/api/credentials, /auth/callback/*) rely on SameSite=Strict to block cross-site login-CSRF. Use 'Strict', or add your own CSRF/origin check on those routes.`
+      );
+    }
+  }
   if (missing.length === 0) return;
   const detail = missing.map((line, idx) => `  ${idx + 1}. ${line}`).join("\n");
   throw new Error(
@@ -1812,7 +1863,7 @@ var verifyBootstrap = async (requirements = {}) => {
 import {
   getLogger as getLogger10,
   registerRuntimeMapsProvider,
-  resolveEnvKey as resolveEnvKey3
+  resolveEnvKey as resolveEnvKey4
 } from "@luckystack/core";
 var emptyRuntimeMaps = {
   apisObject: {},
@@ -1862,7 +1913,7 @@ var mergeInto = (target, source, kind, fromPreset, keyOrigin) => {
     target[key] = source[key];
   }
 };
-var isProduction = () => resolveEnvKey3() === "production";
+var isProduction = () => resolveEnvKey4() === "production";
 var createProdRuntimeMapsProvider = (options) => {
   let prodMapsPromise = null;
   let devkitModulePromise = null;
@@ -2104,7 +2155,7 @@ var createLuckyStackServer = async (options = {}) => {
   });
   const port = options.port ?? getParsedPort() ?? options.defaultPort ?? process.env.SERVER_PORT ?? 80;
   const ip = options.ip ?? process.env.SERVER_IP ?? "127.0.0.1";
-  const enableDevTools = options.enableDevTools ?? resolveEnvKey4() !== "production";
+  const enableDevTools = options.enableDevTools ?? resolveEnvKey5() !== "production";
   registerBindAddress({
     ip,
     port: typeof port === "string" ? Number.parseInt(port, 10) : port