@mccaskie-labs/workbench-config 0.1.24 → 0.1.26

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.26
+
+### Patch Changes
+
+- The database manifest gains the sign-in bot check: Control's `cf_turnstile_widget_create` and `cf_turnstile_widget_delete`, the `TURNSTILE_SITE_KEY` and `TURNSTILE_SECRET_KEY` config (written by `cf_worker_secret_put` sources `turnstile_sitekey` and `turnstile_secret`), the rule `database.sign-in-checks-for-bots` and its drill probe `database.sign-in-bot-check`.
+
+## 0.1.25
+
+### Patch Changes
+
+- Vendor settings baseline: two new Supabase Auth rows. `supabase.auth.signup_skips_email_confirm` keeps "Confirm email" on (`mailer_autoconfirm` false), and `supabase.auth.anonymous_sign_ins` keeps anonymous sign-ins off (`external_anonymous_users_enabled` false). An app that trusts the email in a session is only safe while both hold.
+
 ## 0.1.24
 
 ### Patch Changes

package/capabilities/database.json

@@ -24,7 +24,9 @@
       "sb_query",
       "sb_project_delete",
       "cf_worker_secret_put",
-      "vendor_settings_apply"
+      "vendor_settings_apply",
+      "cf_turnstile_widget_create",
+      "cf_turnstile_widget_delete"
     ]
   },
   "config": [
@@ -70,6 +72,28 @@
         "production"
       ],
       "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+    },
+    {
+      "name": "TURNSTILE_SITE_KEY",
+      "required": false,
+      "secret": false,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+    },
+    {
+      "name": "TURNSTILE_SECRET_KEY",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
     }
   ],
   "actions": [
@@ -104,7 +128,7 @@
     {
       "tool": "cf_worker_secret_put",
       "gate": "two_step_when",
-      "when": "source supabase_secret, or replacing a secret that exists",
+      "when": "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)",
       "ships": "4"
     },
     {
@@ -112,6 +136,16 @@
       "gate": "two_step_when",
       "when": "production, after the first successful apply on that database; staging and check_only are free",
       "ships": "5"
+    },
+    {
+      "tool": "cf_turnstile_widget_create",
+      "gate": "free",
+      "ships": "5"
+    },
+    {
+      "tool": "cf_turnstile_widget_delete",
+      "gate": "two_step",
+      "ships": "5"
     }
   ],
   "rules": [
@@ -170,6 +204,13 @@
       "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
       "enforced_by": "review",
       "probe": "database.session-cookie"
+    },
+    {
+      "id": "database.sign-in-checks-for-bots",
+      "kind": "must",
+      "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+      "enforced_by": "review",
+      "probe": "database.sign-in-bot-check"
     }
   ],
   "examples": [
@@ -252,6 +293,13 @@
       "expect": "pass",
       "cost_hint_usd": 0,
       "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
+    },
+    {
+      "id": "database.sign-in-bot-check",
+      "half": "drill",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does"
     }
   ]
 }

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "ecc54c728515";
+export declare const MANIFEST_VERSION: "7d046814165b";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -421,7 +421,7 @@ export declare const capabilities: {
         readonly summary: "Each project has its own Supabase projects, <id>-staging and <id>-production. Apps use them natively through workbench-supabase; Control creates them, writes their URL and keys onto the Workers, and applies migrations read from the repo.";
         readonly status: "built";
         readonly surfaces: {
-            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply"];
+            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply", "cf_turnstile_widget_create", "cf_turnstile_widget_delete"];
             readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError", "createSessions", "safeReturnPath", "sameOrigin"];
         };
         readonly config: readonly [{
@@ -448,6 +448,18 @@ export declare const capabilities: {
             readonly secret: true;
             readonly environments: readonly ["development", "staging", "production"];
             readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
+        }, {
+            readonly name: "TURNSTILE_SITE_KEY";
+            readonly required: false;
+            readonly secret: false;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it";
+        }, {
+            readonly name: "TURNSTILE_SECRET_KEY";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it";
         }];
         readonly actions: readonly [{
             readonly tool: "sb_project_create";
@@ -475,13 +487,21 @@ export declare const capabilities: {
         }, {
             readonly tool: "cf_worker_secret_put";
             readonly gate: "two_step_when";
-            readonly when: "source supabase_secret, or replacing a secret that exists";
+            readonly when: "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)";
             readonly ships: "4";
         }, {
             readonly tool: "vendor_settings_apply";
             readonly gate: "two_step_when";
             readonly when: "production, after the first successful apply on that database; staging and check_only are free";
             readonly ships: "5";
+        }, {
+            readonly tool: "cf_turnstile_widget_create";
+            readonly gate: "free";
+            readonly ships: "5";
+        }, {
+            readonly tool: "cf_turnstile_widget_delete";
+            readonly gate: "two_step";
+            readonly ships: "5";
         }];
         readonly rules: readonly [{
             readonly id: "database.rls-isolates-users";
@@ -531,6 +551,12 @@ export declare const capabilities: {
             readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
             readonly enforced_by: "review";
             readonly probe: "database.session-cookie";
+        }, {
+            readonly id: "database.sign-in-checks-for-bots";
+            readonly kind: "must";
+            readonly text: "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in-bot-check";
         }];
         readonly examples: readonly [{
             readonly id: "database.example.user-client";
@@ -600,6 +626,12 @@ export declare const capabilities: {
             readonly expect: "pass";
             readonly cost_hint_usd: 0;
             readonly note: "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute";
+        }, {
+            readonly id: "database.sign-in-bot-check";
+            readonly half: "drill";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does";
         }];
     };
     readonly email: {

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "ecc54c728515";
+export const MANIFEST_VERSION = "7d046814165b";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -621,7 +621,9 @@ export const capabilities = {
                 "sb_query",
                 "sb_project_delete",
                 "cf_worker_secret_put",
-                "vendor_settings_apply"
+                "vendor_settings_apply",
+                "cf_turnstile_widget_create",
+                "cf_turnstile_widget_delete"
             ],
             "package": [
                 "supabaseConfig",
@@ -678,6 +680,28 @@ export const capabilities = {
                     "production"
                 ],
                 "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+            },
+            {
+                "name": "TURNSTILE_SITE_KEY",
+                "required": false,
+                "secret": false,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+            },
+            {
+                "name": "TURNSTILE_SECRET_KEY",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
             }
         ],
         "actions": [
@@ -712,7 +736,7 @@ export const capabilities = {
             {
                 "tool": "cf_worker_secret_put",
                 "gate": "two_step_when",
-                "when": "source supabase_secret, or replacing a secret that exists",
+                "when": "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)",
                 "ships": "4"
             },
             {
@@ -720,6 +744,16 @@ export const capabilities = {
                 "gate": "two_step_when",
                 "when": "production, after the first successful apply on that database; staging and check_only are free",
                 "ships": "5"
+            },
+            {
+                "tool": "cf_turnstile_widget_create",
+                "gate": "free",
+                "ships": "5"
+            },
+            {
+                "tool": "cf_turnstile_widget_delete",
+                "gate": "two_step",
+                "ships": "5"
             }
         ],
         "rules": [
@@ -778,6 +812,13 @@ export const capabilities = {
                 "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
                 "enforced_by": "review",
                 "probe": "database.session-cookie"
+            },
+            {
+                "id": "database.sign-in-checks-for-bots",
+                "kind": "must",
+                "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+                "enforced_by": "review",
+                "probe": "database.sign-in-bot-check"
             }
         ],
         "examples": [
@@ -860,6 +901,13 @@ export const capabilities = {
                 "expect": "pass",
                 "cost_hint_usd": 0,
                 "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
+            },
+            {
+                "id": "database.sign-in-bot-check",
+                "half": "drill",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does"
             }
         ]
     },

package/dist/vendor-settings.js

@@ -87,6 +87,26 @@ export const VENDOR_SETTINGS = Object.freeze([
         where: "Supabase: Authentication, Sign In / Providers, Email, Secure email change",
         breaks: "Off: an address change is confirmed from the new address only, so the owner of the old one never hears of it.",
     },
+    {
+        id: "supabase.auth.signup_skips_email_confirm",
+        vendor: "supabase",
+        area: "auth",
+        field: "mailer_autoconfirm",
+        type: "boolean",
+        value: false,
+        where: "Supabase: Authentication, Sign In / Providers, Email, Confirm email (on means this row is false)",
+        breaks: "On: anyone with the publishable key can sign up as any address without owning it. An app that trusts the email in the session (the template's admin claim, invitations) then hands that address's rights to a stranger.",
+    },
+    {
+        id: "supabase.auth.anonymous_sign_ins",
+        vendor: "supabase",
+        area: "auth",
+        field: "external_anonymous_users_enabled",
+        type: "boolean",
+        value: false,
+        where: "Supabase: Authentication, Sign In / Providers, Allow anonymous sign-ins",
+        breaks: "On: anyone with the publishable key gets a signed-in session with no address at all, and can then attach an address it doesn't own. Every \"signed in\" check in the app lets them through.",
+    },
 ]);
 const override = z.strictObject({
     id: z.string().min(1).max(100),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",