@olane/o-server 0.8.4 → 0.8.6

package/dist/src/o-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"o-server.d.ts","sourceRoot":"","sources":["../../src/o-server.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,YAAY,EACZ,cAAc,EACf,MAAM,yCAAyC,CAAC;AAiBjD,wBAAgB,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAgR5D"}
+{"version":3,"file":"o-server.d.ts","sourceRoot":"","sources":["../../src/o-server.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,YAAY,EACZ,cAAc,EACf,MAAM,yCAAyC,CAAC;AAiBjD,wBAAgB,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAoW5D"}

package/dist/src/o-server.js

@@ -4,13 +4,57 @@ import { errorHandler } from './middleware/error-handler.js';
 import { authMiddleware } from './middleware/auth.js';
 import { createJwtMiddleware } from './middleware/jwt-auth.js';
 import { ServerLogger } from './utils/logger.js';
-import { oAddress } from '@olane/o-core';
+import { oAddress, oRequestContext } from '@olane/o-core';
 import { validateAddress, validateMethod, sanitizeParams, validateRequest, useRequestSchema, streamRequestSchema, } from './validation/index.js';
 export function oServer(config) {
     const { node, port = 3000, basePath = '/api/v1', cors: corsConfig, authenticate, jwtAuth, debug = false, } = config;
     const app = express();
     const logger = new ServerLogger(debug);
     let server = null;
+    /**
+     * Build auth context from a JWT-verified Express request.
+     * Returns undefined if no JWT is present (e.g. JWT auth is disabled).
+     */
+    function buildAuthFromRequest(req) {
+        if (!req.jwt)
+            return undefined;
+        // Extract raw token from Authorization header
+        const authHeader = req.headers.authorization;
+        const token = authHeader?.startsWith('Bearer ')
+            ? authHeader.slice(7)
+            : '';
+        return {
+            token,
+            claims: req.jwt,
+        };
+    }
+    /**
+     * Remove any client-injected _auth from params (anti-spoofing).
+     * Server-verified auth is injected separately.
+     */
+    function stripClientAuth(params) {
+        if (!params || typeof params !== 'object')
+            return params;
+        const { _auth, ...rest } = params;
+        return rest;
+    }
+    /**
+     * Deep-strip _auth from response data before sending to HTTP client.
+     * Prevents leaking tokens in response payloads.
+     */
+    function stripAuthFromResponse(obj) {
+        if (obj === null || obj === undefined || typeof obj !== 'object')
+            return obj;
+        if (Array.isArray(obj))
+            return obj.map(stripAuthFromResponse);
+        const result = {};
+        for (const key of Object.keys(obj)) {
+            if (key === '_auth')
+                continue;
+            result[key] = stripAuthFromResponse(obj[key]);
+        }
+        return result;
+    }
     // Middleware
     app.use(express.json());
     if (corsConfig) {
@@ -53,18 +97,25 @@ export function oServer(config) {
             validateAddress(addressStr);
             // Validate method
             validateMethod(method);
+            // Strip client-injected _auth before sanitization (anti-spoofing)
+            const strippedParams = stripClientAuth(params);
             // Sanitize params
-            const sanitizedParams = sanitizeParams(params);
+            const sanitizedParams = sanitizeParams(strippedParams);
+            // Build server-verified auth from JWT
+            const auth = buildAuthFromRequest(req);
+            // Inject _auth into params if JWT is present
+            const finalParams = auth
+                ? { ...sanitizedParams, _auth: auth }
+                : sanitizedParams;
             logger.debugLog(`Calling use with address ${addressStr}, method: ${method}`);
             const address = new oAddress(addressStr);
-            const result = await node.use(address, {
-                method,
-                params: sanitizedParams,
-                id,
-            });
+            // Wrap in request context for AsyncLocalStorage propagation
+            const result = await (auth
+                ? oRequestContext.run({ auth }, () => node.use(address, { method, params: finalParams, id }))
+                : node.use(address, { method, params: finalParams, id }));
             const response = {
                 success: true,
-                data: result.result,
+                data: stripAuthFromResponse(result.result),
             };
             res.json(response);
         }
@@ -84,17 +135,25 @@ export function oServer(config) {
             validateAddress(addressStr);
             // Validate method
             validateMethod(method);
+            // Strip client-injected _auth before sanitization (anti-spoofing)
+            const strippedParams = stripClientAuth(params);
             // Sanitize params
-            const sanitizedParams = sanitizeParams(params);
+            const sanitizedParams = sanitizeParams(strippedParams);
+            // Build server-verified auth from JWT
+            const auth = buildAuthFromRequest(req);
+            // Inject _auth into params if JWT is present
+            const finalParams = auth
+                ? { ...sanitizedParams, _auth: auth }
+                : sanitizedParams;
             logger.debugLog(`Calling method ${method} on ${addressParam} with params:`, sanitizedParams);
             const address = new oAddress(addressStr);
-            const result = await node.use(address, {
-                method,
-                params: sanitizedParams,
-            });
+            // Wrap in request context for AsyncLocalStorage propagation
+            const result = await (auth
+                ? oRequestContext.run({ auth }, () => node.use(address, { method, params: finalParams }))
+                : node.use(address, { method, params: finalParams }));
             const response = {
                 success: true,
-                data: result.result,
+                data: stripAuthFromResponse(result.result),
             };
             res.json(response);
         }
@@ -112,8 +171,16 @@ export function oServer(config) {
             validateAddress(addressStr);
             // Validate method
             validateMethod(method);
+            // Strip client-injected _auth before sanitization (anti-spoofing)
+            const strippedParams = stripClientAuth(params);
             // Sanitize params
-            const sanitizedParams = sanitizeParams(params);
+            const sanitizedParams = sanitizeParams(strippedParams);
+            // Build server-verified auth from JWT
+            const auth = buildAuthFromRequest(req);
+            // Inject _auth into params if JWT is present
+            const finalParams = auth
+                ? { ...sanitizedParams, _auth: auth }
+                : sanitizedParams;
             logger.debugLog(`Streaming use call to ${addressStr}, method: ${method}`);
             // Set headers for Server-Sent Events
             res.setHeader('Content-Type', 'text/event-stream');
@@ -123,13 +190,12 @@ export function oServer(config) {
             try {
                 // TODO: Implement actual streaming support when available
                 // For now, execute and return result
-                const result = await node.use(address, {
-                    method,
-                    params: sanitizedParams,
-                });
+                const result = await (auth
+                    ? oRequestContext.run({ auth }, () => node.use(address, { method, params: finalParams }))
+                    : node.use(address, { method, params: finalParams }));
                 res.write(`data: ${JSON.stringify({
                     type: 'complete',
-                    result: result.result,
+                    result: stripAuthFromResponse(result.result),
                 })}\n\n`);
                 res.end();
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olane/o-server",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -61,7 +61,7 @@
     "typescript": "5.4.5"
   },
   "dependencies": {
-    "@olane/o-core": "0.8.4",
+    "@olane/o-core": "0.8.6",
     "cors": "^2.8.5",
     "debug": "^4.4.1",
     "dotenv": "^16.5.0",
@@ -69,5 +69,5 @@
     "jsonwebtoken": "^9.0.3",
     "zod": "^3.25.76"
   },
-  "gitHead": "b53623b1ad4365133911722f80d5597a72b65bf2"
+  "gitHead": "530f7e3c8576d9427f4181b91bdfb6ae1843cffa"
 }