@nextsparkjs/core 0.1.0-beta.184 → 0.1.0-beta.186

package/templates/proxy.ts

@@ -64,9 +64,48 @@ function isPublicPath(pathname: string): boolean {
   )
 }
 
+/**
+ * Identity headers this proxy injects for downstream server code.
+ *
+ * SECURITY (#87): these headers are trusted by RSC layouts and permission
+ * checks, so an inbound value must NEVER reach the app. They are stripped from
+ * every request before any path branching and re-added only from the verified
+ * session. Gating the strip on protected prefixes is not enough: Next.js
+ * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
+ * action can be POSTed to a public path with a forged `x-user-id`.
+ */
+const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname'] as const
+
+/**
+ * Build the request headers forwarded to the app: inbound copy minus every
+ * trusted identity header, plus the real pathname.
+ */
+function sanitizeRequestHeaders(request: NextRequest): Headers {
+  const headers = new Headers(request.headers)
+  for (const name of TRUSTED_IDENTITY_HEADERS) {
+    headers.delete(name)
+  }
+  headers.set('x-pathname', request.nextUrl.pathname)
+  return headers
+}
+
+/**
+ * Continue to the app with the (sanitized) request headers.
+ * Every pass-through in this proxy MUST go through here so the strip applies
+ * to public paths, /api/v1 and unmatched routes alike.
+ */
+function passThrough(requestHeaders: Headers): NextResponse {
+  return NextResponse.next({
+    request: { headers: requestHeaders },
+  })
+}
+
 export async function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl
 
+  // 0. Strip forgeable identity headers before ANY branching (see #87)
+  const requestHeaders = sanitizeRequestHeaders(request)
+
   // 1. Check for theme middleware override
   const activeTheme = process.env.NEXT_PUBLIC_ACTIVE_THEME
   if (activeTheme && hasThemeMiddleware(activeTheme)) {
@@ -114,17 +153,17 @@ export async function proxy(request: NextRequest) {
         return NextResponse.redirect(loginUrl)
       }
     }
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 4. Allow public paths
   if (isPublicPath(pathname)) {
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 5. API v1 routes handle their own dual authentication
   if (pathname.startsWith('/api/v1')) {
-    return NextResponse.next()
+    return passThrough(requestHeaders)
   }
 
   // 6. Protected routes - require authentication and inject user headers
@@ -162,20 +201,17 @@ export async function proxy(request: NextRequest) {
         }
       }
 
-      // Inject user headers for downstream use
+      // Inject user headers for downstream use, ONLY from the verified session
+      // (requestHeaders already had any inbound values stripped).
       // IMPORTANT: EntityPermissionLayout depends on these headers
-      const requestHeaders = new Headers(request.headers)
       if (session.user?.id) {
         requestHeaders.set('x-user-id', session.user.id)
       }
       if (session.user?.email) {
         requestHeaders.set('x-user-email', session.user.email)
       }
-      requestHeaders.set('x-pathname', pathname)
 
-      return NextResponse.next({
-        request: { headers: requestHeaders },
-      })
+      return passThrough(requestHeaders)
     } catch (error) {
       console.error('Proxy error:', error)
       const loginUrl = new URL('/login', request.url)
@@ -184,7 +220,7 @@ export async function proxy(request: NextRequest) {
     }
   }
 
-  return NextResponse.next()
+  return passThrough(requestHeaders)
 }
 
 export const config = {

package/templates/tsconfig.json

@@ -56,6 +56,10 @@
   ],
   "exclude": [
     "node_modules",
+    // PPR template variants (layout.ppr.tsx) are copied over layout.tsx when a project
+    // enables cacheComponents; in place they import registry exports that only exist
+    // in PPR mode, so they are never type-checked as-is.
+    "**/*.ppr.tsx",
     "**/*.test.ts",
     "**/*.test.tsx",
     "**/*.spec.ts",

package/tests/jest/__mocks__/@nextsparkjs/registries/permissions-registry.ts

@@ -36,3 +36,26 @@ export const TEAM_PERMISSIONS_BY_ROLE: Record<string, string[]> = {
   member: ['team.view', 'team.members.view'],
   viewer: ['team.view'],
 }
+
+// Entity permissions used by service tests (mirrors the default theme's customers entity)
+const ENTITY_PERMISSIONS_BY_ROLE: Record<string, string[]> = {
+  owner: ['customers.create', 'customers.read', 'customers.list', 'customers.update', 'customers.delete'],
+  admin: ['customers.create', 'customers.read', 'customers.list', 'customers.update'],
+  editor: ['customers.read', 'customers.list'],
+  member: ['customers.read', 'customers.list'],
+  viewer: [],
+}
+
+export const ROLE_PERMISSIONS_ARRAY: Record<string, string[]> = Object.fromEntries(
+  AVAILABLE_ROLES.map((role) => [
+    role,
+    [...(TEAM_PERMISSIONS_BY_ROLE[role] ?? []), ...(ENTITY_PERMISSIONS_BY_ROLE[role] ?? [])],
+  ])
+)
+
+export const PERMISSIONS_BY_ROLE: Record<string, Set<string>> = Object.fromEntries(
+  Object.entries(ROLE_PERMISSIONS_ARRAY).map(([role, perms]) => [role, new Set(perms)])
+)
+
+export const ALL_PERMISSIONS: string[] = Array.from(new Set(Object.values(ROLE_PERMISSIONS_ARRAY).flat()))
+export const ALL_PERMISSIONS_SET: Set<string> = new Set(ALL_PERMISSIONS)

package/tests/jest/__mocks__/@nextsparkjs/registries/scope-registry.ts

@@ -1,15 +1,65 @@
 /**
  * Mock Scope Registry for Jest tests
+ *
+ * Shape MUST match the real generated `scope-registry.ts`
+ * (`ScopeConfig`/`ApiConfig`, see
+ * packages/core/scripts/build/registry/generators/scope-registry.mjs) — the
+ * previous version of this mock only exported an empty `SCOPE_REGISTRY` with
+ * unrelated `{name, description}`/`{basePath, version}` interfaces, which
+ * meant `scope.service.test.ts` failed on every assertion the moment it was
+ * force-run and had to be excluded from the suite.
+ *
+ * The role names below (superadmin/admin/manager/member) are an arbitrary
+ * fixture for exercising ScopeService's lookup/immutability/edge-case
+ * behavior — they are NOT meant to represent real `AVAILABLE_ROLES` (which
+ * are `owner/admin/member/viewer` + theme customs). ScopeService itself is
+ * agnostic to what role names exist; it's a pure Record lookup.
  */
 
-export const SCOPE_REGISTRY: Record<string, any> = {}
-
 export interface ScopeConfig {
-  name: string
-  description: string
+  base: string[]
+  roles: Record<string, string[]>
+  flags: Record<string, string[]>
+  restrictions: Record<string, { remove?: string[]; allow_only?: string[] }>
 }
 
 export interface ApiConfig {
-  basePath: string
-  version: string
+  filters: {
+    allowed: string[]
+  }
+  entityPaths: string[]
+}
+
+export const SCOPE_CONFIG: ScopeConfig = {
+  base: ['tasks:read'],
+  roles: {
+    superadmin: ['admin:users', 'admin:api-keys', 'tasks:delete'],
+    admin: ['admin:users', 'tasks:read', 'tasks:write', 'tasks:delete'],
+    manager: ['tasks:read', 'tasks:write'],
+    member: ['tasks:read'],
+  },
+  flags: {
+    beta_tester: ['beta:features'],
+    vip: ['vip:features', 'advanced:export'],
+    early_adopter: ['early:features'],
+    power_user: ['advanced:features', 'bulk:operations'],
+  },
+  restrictions: {
+    restricted: {
+      remove: ['delete', 'admin'],
+    },
+    limited_access: {
+      allow_only: ['read', 'tasks:write'],
+    },
+  },
 }
+
+export const API_CONFIG: ApiConfig = {
+  filters: {
+    allowed: ['status', 'role', 'completed', 'userId'],
+  },
+  entityPaths: ['/api/v1/tasks'],
+}
+
+// Kept for any legacy import still expecting SCOPE_REGISTRY to exist.
+export const SCOPE_REGISTRY: Record<string, unknown> = {}

package/tests/jest/__mocks__/next-server.js

@@ -9,6 +9,14 @@ class MockNextRequest {
     this.method = options.method || 'GET'
     this.headers = new Map(Object.entries(options.headers || {}))
     this._body = options.body
+    // Minimal nextUrl (pathname/origin/searchParams/clone) for proxy/middleware tests
+    try {
+      const parsed = new URL(url, 'http://localhost')
+      parsed.clone = () => new URL(parsed.toString())
+      this.nextUrl = parsed
+    } catch {
+      this.nextUrl = undefined
+    }
   }
 
   async json() {
@@ -48,6 +56,22 @@ class MockNextResponse {
       headers: { 'Content-Type': 'application/json', ...options.headers }
     })
   }
+
+  // Pass-through response. Keeps the forwarded request headers (if any) so
+  // middleware/proxy tests can assert what reaches the app.
+  static next(init = {}) {
+    const response = new MockNextResponse(null, { status: 200, headers: init.headers })
+    response.type = 'next'
+    response.requestHeaders = init.request && init.request.headers ? init.request.headers : null
+    return response
+  }
+
+  static redirect(url, status = 307) {
+    const response = new MockNextResponse(null, { status, headers: { Location: String(url) } })
+    response.type = 'redirect'
+    response.redirectUrl = String(url)
+    return response
+  }
 }
 
 module.exports = {