@meith/web 0.29.0 → 0.29.1

package/app/api/v1/[...path]/route.ts

@@ -16,6 +16,7 @@ import type { Actor } from '@meith/authorization'
 import { isAppError, metrics, statusForError, toPublicError, withSpan } from '@meith/core'
 import { currentRequestId } from '@meith/core/logger'
 
+import { readJsonBody } from '@/server/api/body'
 import { JSON_MEDIA_TYPE } from '@/server/api/http'
 import { handlerFor } from '@/server/api/registry'
 import {
@@ -161,13 +162,30 @@ async function respondTo(
     )
   }
 
+  let body: Record<string, unknown> | null = null
+  if (matched.route.request !== undefined) {
+    const outcome = await readJsonBody(request)
+    if (outcome.kind === 'too-large') {
+      return fail(
+        413,
+        'payload_too_large',
+        'The request body is larger than the API allows.',
+        headers,
+      )
+    }
+    if (outcome.kind === 'invalid') {
+      return fail(400, 'invalid_body', 'The request body is not valid JSON.', headers)
+    }
+    body = outcome.body
+  }
+
   try {
     const result = await handler({
       actor: caller.actor,
       token: caller.authenticated?.token ?? null,
       params: matched.params,
       url,
-      body: matched.route.request === undefined ? null : await readJsonBody(request),
+      body,
     })
 
     return json(result.body, result.status, headers)
@@ -180,17 +198,6 @@ async function respondTo(
   }
 }
 
-async function readJsonBody(request: NextRequest): Promise<Record<string, unknown> | null> {
-  try {
-    const parsed: unknown = await request.json()
-    return typeof parsed === 'object' && parsed !== null
-      ? (parsed as Record<string, unknown>)
-      : null
-  } catch {
-    return null
-  }
-}
-
 export async function GET(request: NextRequest): Promise<Response> {
   return handle(request, 'GET')
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/web",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "The board itself: the Next.js app, and the forum-web bin that materializes it into an external board workspace.",
   "license": "MIT",
   "repository": {
@@ -43,53 +43,53 @@
     "react-dom": "19.2.8",
     "tailwindcss": "^4.3.3",
     "typescript": "7.0.2",
-    "@meith/accounts": "0.29.0",
-    "@meith/admin": "0.29.0",
-    "@meith/antispam": "0.29.0",
-    "@meith/api": "0.29.0",
-    "@meith/attachments": "0.29.0",
-    "@meith/authorization": "0.29.0",
-    "@meith/avatars": "0.29.0",
-    "@meith/core": "0.29.0",
-    "@meith/db": "0.29.0",
-    "@meith/demo": "0.29.0",
-    "@meith/drafts": "0.29.0",
-    "@meith/drivers": "0.29.0",
-    "@meith/events": "0.29.0",
-    "@meith/forums": "0.29.0",
-    "@meith/groups": "0.29.0",
-    "@meith/i18n": "0.29.0",
-    "@meith/import": "0.29.0",
-    "@meith/install": "0.29.0",
-    "@meith/mail": "0.29.0",
-    "@meith/markdown": "0.29.0",
-    "@meith/marketplace": "0.29.0",
-    "@meith/messages": "0.29.0",
-    "@meith/moderation": "0.29.0",
-    "@meith/notifications": "0.29.0",
-    "@meith/plugin-calendar": "0.29.0",
-    "@meith/plugin-dues": "0.29.0",
-    "@meith/plugin-kit": "0.29.0",
-    "@meith/polls": "0.29.0",
-    "@meith/posts": "0.29.0",
-    "@meith/profile-fields": "0.29.0",
-    "@meith/relations": "0.29.0",
-    "@meith/reputation": "0.29.0",
-    "@meith/runtime": "0.29.0",
-    "@meith/search": "0.29.0",
-    "@meith/settings": "0.29.0",
-    "@meith/signatures": "0.29.0",
-    "@meith/subscriptions": "0.29.0",
-    "@meith/tasks": "0.29.0",
-    "@meith/theme-clubhouse": "0.29.0",
-    "@meith/theme-default": "0.29.0",
-    "@meith/theme-kit": "0.29.0",
-    "@meith/theme-midnight": "0.29.0",
-    "@meith/theme-phasebook": "0.29.0",
-    "@meith/theme-raidframe": "0.29.0",
-    "@meith/threads": "0.29.0",
-    "@meith/ui": "0.29.0",
-    "@meith/upgrade": "0.29.0"
+    "@meith/accounts": "0.29.1",
+    "@meith/admin": "0.29.1",
+    "@meith/antispam": "0.29.1",
+    "@meith/api": "0.29.1",
+    "@meith/attachments": "0.29.1",
+    "@meith/authorization": "0.29.1",
+    "@meith/avatars": "0.29.1",
+    "@meith/core": "0.29.1",
+    "@meith/db": "0.29.1",
+    "@meith/demo": "0.29.1",
+    "@meith/drafts": "0.29.1",
+    "@meith/drivers": "0.29.1",
+    "@meith/events": "0.29.1",
+    "@meith/forums": "0.29.1",
+    "@meith/groups": "0.29.1",
+    "@meith/i18n": "0.29.1",
+    "@meith/import": "0.29.1",
+    "@meith/install": "0.29.1",
+    "@meith/mail": "0.29.1",
+    "@meith/markdown": "0.29.1",
+    "@meith/marketplace": "0.29.1",
+    "@meith/messages": "0.29.1",
+    "@meith/moderation": "0.29.1",
+    "@meith/notifications": "0.29.1",
+    "@meith/plugin-calendar": "0.29.1",
+    "@meith/plugin-dues": "0.29.1",
+    "@meith/plugin-kit": "0.29.1",
+    "@meith/polls": "0.29.1",
+    "@meith/posts": "0.29.1",
+    "@meith/profile-fields": "0.29.1",
+    "@meith/relations": "0.29.1",
+    "@meith/reputation": "0.29.1",
+    "@meith/runtime": "0.29.1",
+    "@meith/search": "0.29.1",
+    "@meith/settings": "0.29.1",
+    "@meith/signatures": "0.29.1",
+    "@meith/subscriptions": "0.29.1",
+    "@meith/tasks": "0.29.1",
+    "@meith/theme-clubhouse": "0.29.1",
+    "@meith/theme-default": "0.29.1",
+    "@meith/theme-kit": "0.29.1",
+    "@meith/theme-midnight": "0.29.1",
+    "@meith/theme-phasebook": "0.29.1",
+    "@meith/theme-raidframe": "0.29.1",
+    "@meith/threads": "0.29.1",
+    "@meith/ui": "0.29.1",
+    "@meith/upgrade": "0.29.1"
   },
   "scripts": {
     "dev": "next dev",

package/src/server/api/body.ts

@@ -0,0 +1,79 @@
+import 'server-only'
+
+export const MAX_API_BODY_BYTES = 256 * 1024
+
+export type JsonBodyOutcome =
+  | { readonly kind: 'ok'; readonly body: Record<string, unknown> | null }
+  | { readonly kind: 'too-large' }
+  | { readonly kind: 'invalid' }
+
+async function readBounded(
+  request: Request,
+  limit: number,
+): Promise<Uint8Array | 'too-large' | 'unreadable'> {
+  const stream = request.body
+  if (stream === null) {
+    try {
+      const whole = new Uint8Array(await request.arrayBuffer())
+      return whole.byteLength > limit ? 'too-large' : whole
+    } catch {
+      return 'unreadable'
+    }
+  }
+
+  const reader = stream.getReader()
+  const chunks: Uint8Array[] = []
+  let total = 0
+
+  try {
+    let step = await reader.read()
+    while (!step.done) {
+      const chunk = step.value
+      if (chunk !== undefined) {
+        total += chunk.byteLength
+        if (total > limit) {
+          await reader.cancel().catch(() => {})
+          return 'too-large'
+        }
+        chunks.push(chunk)
+      }
+      step = await reader.read()
+    }
+  } catch {
+    return 'unreadable'
+  }
+
+  const body = new Uint8Array(total)
+  let offset = 0
+  for (const chunk of chunks) {
+    body.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return body
+}
+
+export async function readJsonBody(
+  request: Request,
+  limit: number = MAX_API_BODY_BYTES,
+): Promise<JsonBodyOutcome> {
+  const declared = Number(request.headers.get('content-length') ?? '')
+  if (Number.isFinite(declared) && declared > limit) return { kind: 'too-large' }
+
+  const bytes = await readBounded(request, limit)
+  if (bytes === 'too-large') return { kind: 'too-large' }
+  if (bytes === 'unreadable') return { kind: 'invalid' }
+  if (bytes.byteLength === 0) return { kind: 'ok', body: null }
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(bytes))
+  } catch {
+    return { kind: 'invalid' }
+  }
+
+  return {
+    kind: 'ok',
+    body:
+      typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : null,
+  }
+}

package/src/server/same-origin.ts

@@ -1,7 +1,21 @@
 import 'server-only'
 
-function boardHost(request: Request): string | null {
-  const host = request.headers.get('x-forwarded-host') ?? request.headers.get('host')
+import { env } from '@meith/core'
+
+function canonicalOrigin(): URL | null {
+  const configured = env.APP_URL
+  if (configured === undefined || configured === '') return null
+
+  try {
+    return new URL(configured)
+  } catch {
+    return null
+  }
+}
+
+function requestHost(request: Request): string | null {
+  const forwarded = env.TRUSTED_PROXY_HOPS > 0 ? request.headers.get('x-forwarded-host') : null
+  const host = forwarded ?? request.headers.get('host')
   if (host === null) return null
 
   const trimmed = host.trim().toLowerCase()
@@ -12,14 +26,23 @@ export function isSameOrigin(request: Request): boolean {
   const origin = request.headers.get('origin')?.trim()
 
   if (origin !== undefined && origin !== '' && origin !== 'null') {
-    const host = boardHost(request)
-    if (host === null) return false
-
+    let presented: URL
     try {
-      return new URL(origin).host.toLowerCase() === host
+      presented = new URL(origin)
     } catch {
       return false
     }
+
+    const canonical = canonicalOrigin()
+    if (canonical !== null) {
+      return (
+        presented.host.toLowerCase() === canonical.host.toLowerCase() &&
+        presented.protocol === canonical.protocol
+      )
+    }
+
+    const host = requestHost(request)
+    return host !== null && presented.host.toLowerCase() === host
   }
 
   const site = request.headers.get('sec-fetch-site')

package/src/server/upgrade-notice.ts

@@ -16,7 +16,7 @@ import { planUpgrade, type UpgradeState, upgradeNotice } from '@meith/upgrade'
 
 import { activeDefinitions } from './plugin-host'
 
-export const CODE_VERSION = '0.29.0'
+export const CODE_VERSION = '0.29.1'
 
 export interface UpgradeApplied {
   readonly plugins: readonly string[]