@luckystack/server 0.4.0 → 0.4.1

package/dist/index.d.ts

@@ -281,7 +281,12 @@ declare const getPreParamsCustomRoutes: () => readonly CustomRouteHandler[];
 declare const clearCustomRoutes: () => void;
 
 interface OriginExemptMatcher {
-    /** A route is exempt when its path starts with this prefix. */
+    /**
+     * A route is exempt when its path equals this prefix OR continues past it on a
+     * path-SEGMENT boundary (i.e. `<prefix>/...`). Matching is boundary-aware so a
+     * prefix can't bleed into a sibling route — `/webhooks` exempts `/webhooks` and
+     * `/webhooks/stripe` but NOT `/webhooksadmin`.
+     */
     pathPrefix: string;
 }
 declare const registerOriginExemptPath: (matcher: OriginExemptMatcher) => void;

package/dist/index.js

@@ -7,7 +7,7 @@ import {
 
 // src/createServer.ts
 import http from "http";
-import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig13, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey4 } from "@luckystack/core";
+import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig13, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey5 } from "@luckystack/core";
 
 // src/httpHandler.ts
 import { randomUUID } from "crypto";
@@ -138,7 +138,12 @@ var getOriginExemptPaths = () => exemptPaths;
 var clearOriginExemptPaths = () => {
   exemptPaths.length = 0;
 };
-var isOriginExemptPath = (routePath) => exemptPaths.some((matcher) => routePath.startsWith(matcher.pathPrefix));
+var isOriginExemptPath = (routePath) => exemptPaths.some(({ pathPrefix }) => {
+  if (!pathPrefix) return false;
+  if (routePath === pathPrefix) return true;
+  const boundary = pathPrefix.endsWith("/") ? pathPrefix : `${pathPrefix}/`;
+  return routePath.startsWith(boundary);
+});
 
 // src/httpRoutes/timingSafeEqual.ts
 import { timingSafeEqual as cryptoTimingSafeEqual } from "crypto";
@@ -427,7 +432,12 @@ import {
 } from "@luckystack/core";
 
 // src/httpRoutes/sessionCookie.ts
-var resolveCookieSecure = (sessionCookieSecure, secureEnv) => sessionCookieSecure ?? secureEnv === "true";
+import { resolveEnvKey as resolveEnvKey2 } from "@luckystack/core";
+var resolveCookieSecure = (sessionCookieSecure, secureEnv) => {
+  if (sessionCookieSecure !== void 0) return sessionCookieSecure;
+  if (secureEnv === "true") return true;
+  return resolveEnvKey2() === "production";
+};
 
 // src/httpRoutes/authApiRoute.ts
 var parseSessionBasedTokenHeader = (headerValue) => {
@@ -481,7 +491,7 @@ var handleAuthApiRoute = async ({
     });
     const oauthInitLimit = oauthRateLimiting.defaultApiLimit !== false && oauthRateLimiting.defaultApiLimit > 0 ? oauthRateLimiting.defaultApiLimit : oauthRateLimiting.auth.enabled && oauthRateLimiting.auth.maxAttempts > 0 ? oauthRateLimiting.auth.maxAttempts : null;
     if (oauthInitLimit !== null) {
-      const oauthInitWindowMs = oauthRateLimiting.defaultApiLimit === false ? oauthRateLimiting.auth.windowMs : oauthRateLimiting.windowMs;
+      const oauthInitWindowMs = oauthRateLimiting.defaultApiLimit !== false && oauthRateLimiting.defaultApiLimit > 0 ? oauthRateLimiting.windowMs : oauthRateLimiting.auth.windowMs;
       const { allowed, resetIn } = await checkRateLimit({
         key: `ip:${oauthRequesterIp}:auth:oauth-init`,
         limit: oauthInitLimit,
@@ -551,7 +561,7 @@ var handleAuthApiRoute = async ({
   });
   const ipLimitCount = rateLimiting.defaultApiLimit !== false && rateLimiting.defaultApiLimit > 0 ? rateLimiting.defaultApiLimit : rateLimiting.auth.enabled && rateLimiting.auth.maxAttempts > 0 ? rateLimiting.auth.maxAttempts : null;
   if (ipLimitCount !== null) {
-    const ipWindowMs = rateLimiting.defaultApiLimit === false ? rateLimiting.auth.windowMs : rateLimiting.windowMs;
+    const ipWindowMs = rateLimiting.defaultApiLimit !== false && rateLimiting.defaultApiLimit > 0 ? rateLimiting.windowMs : rateLimiting.auth.windowMs;
     const { allowed, resetIn } = await checkRateLimit({
       key: `ip:${requesterIp}:auth:credentials`,
       limit: ipLimitCount,
@@ -1197,7 +1207,7 @@ var enforceOriginPolicy = (req, res, routePath) => {
   });
   const isStateChangingMethod = req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS";
   if (isOriginExemptPath(routePath)) {
-    return { origin, rejected: false };
+    return { origin: "", rejected: false };
   }
   if (!origin) {
     if (isStateChangingMethod) {
@@ -1760,7 +1770,7 @@ import {
   isLocalizedNormalizerRegistered,
   isProjectConfigRegistered,
   isRuntimeMapsProviderRegistered,
-  resolveEnvKey as resolveEnvKey2
+  resolveEnvKey as resolveEnvKey3
 } from "@luckystack/core";
 var verifyBootstrap = async (requirements = {}) => {
   const missing = [];
@@ -1799,7 +1809,7 @@ var verifyBootstrap = async (requirements = {}) => {
     }
   }
   if (!isRuntimeMapsProviderRegistered()) {
-    if (resolveEnvKey2() === "production") {
+    if (resolveEnvKey3() === "production") {
       missing.push(
         "RuntimeMapsProvider \u2014 call `registerRuntimeMapsProvider({...})` from `server/prod/runtimeMaps.ts`. Without it, every api/sync request returns notFound."
       );
@@ -1810,7 +1820,7 @@ var verifyBootstrap = async (requirements = {}) => {
     }
   }
   if (!isLocalizedNormalizerRegistered()) {
-    if (resolveEnvKey2() === "production") {
+    if (resolveEnvKey3() === "production") {
       missing.push(
         "LocalizedNormalizer \u2014 call `registerLocalizedNormalizer({...})` from your bootstrap. Without it, error response messages will be the raw errorCode (no i18n)."
       );
@@ -1829,6 +1839,14 @@ var verifyBootstrap = async (requirements = {}) => {
       );
     }
   }
+  if (isProjectConfigRegistered()) {
+    const cfg = getProjectConfig12();
+    if (!cfg.session.basedToken && cfg.http.sessionCookieSameSite !== "Strict") {
+      getLogger9().warn(
+        `[LuckyStack] SECURITY: http.sessionCookieSameSite is '${cfg.http.sessionCookieSameSite}', not 'Strict', but the CSRF-exempt auth-bootstrap endpoints (/auth/api/credentials, /auth/callback/*) rely on SameSite=Strict to block cross-site login-CSRF. Use 'Strict', or add your own CSRF/origin check on those routes.`
+      );
+    }
+  }
   if (missing.length === 0) return;
   const detail = missing.map((line, idx) => `  ${idx + 1}. ${line}`).join("\n");
   throw new Error(
@@ -1845,7 +1863,7 @@ var verifyBootstrap = async (requirements = {}) => {
 import {
   getLogger as getLogger10,
   registerRuntimeMapsProvider,
-  resolveEnvKey as resolveEnvKey3
+  resolveEnvKey as resolveEnvKey4
 } from "@luckystack/core";
 var emptyRuntimeMaps = {
   apisObject: {},
@@ -1895,7 +1913,7 @@ var mergeInto = (target, source, kind, fromPreset, keyOrigin) => {
     target[key] = source[key];
   }
 };
-var isProduction = () => resolveEnvKey3() === "production";
+var isProduction = () => resolveEnvKey4() === "production";
 var createProdRuntimeMapsProvider = (options) => {
   let prodMapsPromise = null;
   let devkitModulePromise = null;
@@ -2137,7 +2155,7 @@ var createLuckyStackServer = async (options = {}) => {
   });
   const port = options.port ?? getParsedPort() ?? options.defaultPort ?? process.env.SERVER_PORT ?? 80;
   const ip = options.ip ?? process.env.SERVER_IP ?? "127.0.0.1";
-  const enableDevTools = options.enableDevTools ?? resolveEnvKey4() !== "production";
+  const enableDevTools = options.enableDevTools ?? resolveEnvKey5() !== "production";
   registerBindAddress({
     ip,
     port: typeof port === "string" ? Number.parseInt(port, 10) : port