@nerdsystem/sdk 0.0.5 → 0.0.6

package/dist/app.d.ts

@@ -7,6 +7,8 @@ export interface CreateNerdAppOptions {
     authPath?: string;
     /** Security headers on every response. Pass false to disable, or options to tune the CSP. */
     securityHeaders?: SecurityHeadersOptions | false;
+    /** Reject cookie-authenticated writes that a browser sent from another site. Pass false only if you handle CSRF yourself. */
+    crossSiteGuard?: false;
 }
 /**
  * A Hono app with nerdsystem auth wired in: session routes at /api/auth and `c.var.user`

package/dist/app.js

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import { attachUser } from "./auth/middleware";
+import { crossSiteGuard } from "./auth/csrf";
 import { authRoutes } from "./auth/routes";
 import { securityHeaders } from "./security";
 /**
@@ -10,6 +11,8 @@ export function createNerdApp(options = {}) {
     const app = new Hono();
     if (options.securityHeaders !== false)
         app.use("*", securityHeaders(options.securityHeaders ?? {}));
+    if (options.crossSiteGuard !== false)
+        app.use("*", crossSiteGuard());
     app.use("*", attachUser());
     app.route(options.authPath ?? "/api/auth", authRoutes());
     app.notFound((c) => c.json({ error: { code: "not_found", message: `No route for ${c.req.method} ${c.req.path}` } }, 404));

package/dist/auth/client.d.ts

@@ -41,6 +41,7 @@ export declare class AuthServiceClient {
     me(accessToken: string): Promise<{
         user: EndUser;
     }>;
+    /** Server-side only: the platform requires the tenant secret so nobody can turn the reset email into a phishing relay. */
     forgotPassword(input: {
         email: string;
         resetUrl: string;

package/dist/auth/client.js

@@ -56,8 +56,9 @@ export class AuthServiceClient {
     me(accessToken) {
         return this.call("GET", "/me", undefined, accessToken);
     }
+    /** Server-side only: the platform requires the tenant secret so nobody can turn the reset email into a phishing relay. */
     forgotPassword(input) {
-        return this.call("POST", "/password/forgot", input);
+        return this.call("POST", "/password/forgot", input, this.env.NERD_AUTH_SECRET);
     }
     resetPassword(input) {
         return this.call("POST", "/password/reset", input);

package/dist/auth/csrf.d.ts

@@ -0,0 +1,9 @@
+import type { MiddlewareHandler } from "hono";
+/**
+ * Rejects state-changing requests that a browser sent from another site. Every app on the shared
+ * app domain is "same-site" with every other until the domain is on the Public Suffix List, and
+ * the auth cookies are SameSite=Lax, so without this a page on one app could POST to another with
+ * the visitor's cookies attached. Requests with a bearer token (mobile and server clients) and
+ * requests without browser fetch metadata are allowed through.
+ */
+export declare function crossSiteGuard(): MiddlewareHandler;

package/dist/auth/csrf.js

@@ -0,0 +1,26 @@
+/**
+ * Rejects state-changing requests that a browser sent from another site. Every app on the shared
+ * app domain is "same-site" with every other until the domain is on the Public Suffix List, and
+ * the auth cookies are SameSite=Lax, so without this a page on one app could POST to another with
+ * the visitor's cookies attached. Requests with a bearer token (mobile and server clients) and
+ * requests without browser fetch metadata are allowed through.
+ */
+export function crossSiteGuard() {
+    return async (c, next) => {
+        const method = c.req.method;
+        if (method === "GET" || method === "HEAD" || method === "OPTIONS")
+            return next();
+        if (c.req.header("authorization")?.toLowerCase().startsWith("bearer "))
+            return next();
+        const site = c.req.header("sec-fetch-site");
+        if (site && site !== "same-origin" && site !== "none")
+            return reject(c);
+        const origin = c.req.header("origin");
+        if (origin && origin !== new URL(c.req.url).origin)
+            return reject(c);
+        return next();
+    };
+}
+function reject(c) {
+    return c.json({ error: { code: "forbidden", message: "Cross-site request rejected. Call this API from the app's own pages, or send a bearer token." } }, 403);
+}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { createNerdApp, type CreateNerdAppOptions } from "./app";
 export type { NerdEnv, NerdUser, NerdVariables } from "./env";
 export { attachUser, requireAuth, requireRole, resolveUser, type NerdHonoEnv } from "./auth/middleware";
+export { crossSiteGuard } from "./auth/csrf";
 export { AuthServiceClient, AuthServiceError, type EndUser, type Session } from "./auth/client";
 export { verifyAccessToken, type VerifiedToken } from "./auth/jwks";
 export { authRoutes } from "./auth/routes";

package/dist/index.js

@@ -1,5 +1,6 @@
 export { createNerdApp } from "./app";
 export { attachUser, requireAuth, requireRole, resolveUser } from "./auth/middleware";
+export { crossSiteGuard } from "./auth/csrf";
 export { AuthServiceClient, AuthServiceError } from "./auth/client";
 export { verifyAccessToken } from "./auth/jwks";
 export { authRoutes } from "./auth/routes";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nerdsystem/sdk",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "Runtime for apps deployed on nerdsystem: auth, authorization, and platform bindings.",
   "type": "module",
   "main": "./dist/index.js",