@open-mercato/shared 0.5.1-develop.2855.9b058b7483 → 0.5.1-develop.2860.07af3a6a9d

package/dist/lib/ratelimit/config.js

@@ -6,8 +6,10 @@ function readRateLimitConfig() {
     throw new Error(`Invalid RATE_LIMIT_STRATEGY "${strategy}". Must be one of: ${VALID_STRATEGIES.join(", ")}`);
   }
   const trustProxyDepth = parsePositiveInt(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH) ?? 1;
+  const integrationTest = parseBooleanWithDefault(process.env.OM_INTEGRATION_TEST, false);
+  const enabled = integrationTest ? false : parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true);
   return {
-    enabled: parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true),
+    enabled,
     strategy,
     keyPrefix: process.env.RATE_LIMIT_KEY_PREFIX ?? "rl",
     redisUrl: process.env.REDIS_URL,

package/dist/lib/ratelimit/config.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/ratelimit/config.ts"],
-  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport type { RateLimitConfig, RateLimitGlobalConfig, RateLimitStrategy } from './types'\n\nconst VALID_STRATEGIES: RateLimitStrategy[] = ['memory', 'redis']\n\nexport function readRateLimitConfig(): RateLimitGlobalConfig {\n  const strategy = (process.env.RATE_LIMIT_STRATEGY ?? 'memory') as RateLimitStrategy\n  if (!VALID_STRATEGIES.includes(strategy)) {\n    throw new Error(`Invalid RATE_LIMIT_STRATEGY \"${strategy}\". Must be one of: ${VALID_STRATEGIES.join(', ')}`)\n  }\n\n  const trustProxyDepth = parsePositiveInt(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH) ?? 1\n\n  return {\n    enabled: parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true),\n    strategy,\n    keyPrefix: process.env.RATE_LIMIT_KEY_PREFIX ?? 'rl',\n    redisUrl: process.env.REDIS_URL,\n    trustProxyDepth,\n  }\n}\n\n/**\n * Read per-endpoint rate limit config from environment variables with hardcoded defaults.\n * Environment variable names follow the pattern: RATE_LIMIT_{PREFIX}_POINTS, RATE_LIMIT_{PREFIX}_DURATION, etc.\n */\nexport function readEndpointRateLimitConfig(\n  envPrefix: string,\n  defaults: { points: number; duration: number; blockDuration?: number; keyPrefix: string },\n): RateLimitConfig {\n  return {\n    points: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_POINTS`]) ?? defaults.points,\n    duration: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_DURATION`]) ?? defaults.duration,\n    blockDuration: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_BLOCK_DURATION`]) ?? defaults.blockDuration,\n    keyPrefix: defaults.keyPrefix,\n  }\n}\n\nfunction parsePositiveInt(raw: string | undefined): number | undefined {\n  if (raw === undefined || raw === '') return undefined\n  const parsed = Number(raw)\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined\n}\n"],
-  "mappings": "AAAA,SAAS,+BAA+B;AAGxC,MAAM,mBAAwC,CAAC,UAAU,OAAO;AAEzD,SAAS,sBAA6C;AAC3D,QAAM,WAAY,QAAQ,IAAI,uBAAuB;AACrD,MAAI,CAAC,iBAAiB,SAAS,QAAQ,GAAG;AACxC,UAAM,IAAI,MAAM,gCAAgC,QAAQ,sBAAsB,iBAAiB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7G;AAEA,QAAM,kBAAkB,iBAAiB,QAAQ,IAAI,4BAA4B,KAAK;AAEtF,SAAO;AAAA,IACL,SAAS,wBAAwB,QAAQ,IAAI,oBAAoB,IAAI;AAAA,IACrE;AAAA,IACA,WAAW,QAAQ,IAAI,yBAAyB;AAAA,IAChD,UAAU,QAAQ,IAAI;AAAA,IACtB;AAAA,EACF;AACF;AAMO,SAAS,4BACd,WACA,UACiB;AACjB,SAAO;AAAA,IACL,QAAQ,iBAAiB,QAAQ,IAAI,cAAc,SAAS,SAAS,CAAC,KAAK,SAAS;AAAA,IACpF,UAAU,iBAAiB,QAAQ,IAAI,cAAc,SAAS,WAAW,CAAC,KAAK,SAAS;AAAA,IACxF,eAAe,iBAAiB,QAAQ,IAAI,cAAc,SAAS,iBAAiB,CAAC,KAAK,SAAS;AAAA,IACnG,WAAW,SAAS;AAAA,EACtB;AACF;AAEA,SAAS,iBAAiB,KAA6C;AACrE,MAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAC5C,QAAM,SAAS,OAAO,GAAG;AACzB,SAAO,OAAO,SAAS,MAAM,KAAK,UAAU,IAAI,SAAS;AAC3D;",
+  "sourcesContent": ["import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport type { RateLimitConfig, RateLimitGlobalConfig, RateLimitStrategy } from './types'\n\nconst VALID_STRATEGIES: RateLimitStrategy[] = ['memory', 'redis']\n\nexport function readRateLimitConfig(): RateLimitGlobalConfig {\n  const strategy = (process.env.RATE_LIMIT_STRATEGY ?? 'memory') as RateLimitStrategy\n  if (!VALID_STRATEGIES.includes(strategy)) {\n    throw new Error(`Invalid RATE_LIMIT_STRATEGY \"${strategy}\". Must be one of: ${VALID_STRATEGIES.join(', ')}`)\n  }\n\n  const trustProxyDepth = parsePositiveInt(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH) ?? 1\n\n  // Integration test runs disable rate limiting globally so suites do not\n  // have to juggle per-endpoint bypass headers or reshape default caps.\n  // The targeted OM_TEST_MODE + OM_TEST_AUTH_RATE_LIMIT_MODE=opt-in escape\n  // hatch (checkAuthRateLimit) still works for suites that explicitly test\n  // rate-limit behavior.\n  const integrationTest = parseBooleanWithDefault(process.env.OM_INTEGRATION_TEST, false)\n  const enabled = integrationTest\n    ? false\n    : parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true)\n\n  return {\n    enabled,\n    strategy,\n    keyPrefix: process.env.RATE_LIMIT_KEY_PREFIX ?? 'rl',\n    redisUrl: process.env.REDIS_URL,\n    trustProxyDepth,\n  }\n}\n\n/**\n * Read per-endpoint rate limit config from environment variables with hardcoded defaults.\n * Environment variable names follow the pattern: RATE_LIMIT_{PREFIX}_POINTS, RATE_LIMIT_{PREFIX}_DURATION, etc.\n */\nexport function readEndpointRateLimitConfig(\n  envPrefix: string,\n  defaults: { points: number; duration: number; blockDuration?: number; keyPrefix: string },\n): RateLimitConfig {\n  return {\n    points: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_POINTS`]) ?? defaults.points,\n    duration: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_DURATION`]) ?? defaults.duration,\n    blockDuration: parsePositiveInt(process.env[`RATE_LIMIT_${envPrefix}_BLOCK_DURATION`]) ?? defaults.blockDuration,\n    keyPrefix: defaults.keyPrefix,\n  }\n}\n\nfunction parsePositiveInt(raw: string | undefined): number | undefined {\n  if (raw === undefined || raw === '') return undefined\n  const parsed = Number(raw)\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined\n}\n"],
+  "mappings": "AAAA,SAAS,+BAA+B;AAGxC,MAAM,mBAAwC,CAAC,UAAU,OAAO;AAEzD,SAAS,sBAA6C;AAC3D,QAAM,WAAY,QAAQ,IAAI,uBAAuB;AACrD,MAAI,CAAC,iBAAiB,SAAS,QAAQ,GAAG;AACxC,UAAM,IAAI,MAAM,gCAAgC,QAAQ,sBAAsB,iBAAiB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7G;AAEA,QAAM,kBAAkB,iBAAiB,QAAQ,IAAI,4BAA4B,KAAK;AAOtF,QAAM,kBAAkB,wBAAwB,QAAQ,IAAI,qBAAqB,KAAK;AACtF,QAAM,UAAU,kBACZ,QACA,wBAAwB,QAAQ,IAAI,oBAAoB,IAAI;AAEhE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,QAAQ,IAAI,yBAAyB;AAAA,IAChD,UAAU,QAAQ,IAAI;AAAA,IACtB;AAAA,EACF;AACF;AAMO,SAAS,4BACd,WACA,UACiB;AACjB,SAAO;AAAA,IACL,QAAQ,iBAAiB,QAAQ,IAAI,cAAc,SAAS,SAAS,CAAC,KAAK,SAAS;AAAA,IACpF,UAAU,iBAAiB,QAAQ,IAAI,cAAc,SAAS,WAAW,CAAC,KAAK,SAAS;AAAA,IACxF,eAAe,iBAAiB,QAAQ,IAAI,cAAc,SAAS,iBAAiB,CAAC,KAAK,SAAS;AAAA,IACnG,WAAW,SAAS;AAAA,EACtB;AACF;AAEA,SAAS,iBAAiB,KAA6C;AACrE,MAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAC5C,QAAM,SAAS,OAAO,GAAG;AACzB,SAAO,OAAO,SAAS,MAAM,KAAK,UAAU,IAAI,SAAS;AAC3D;",
   "names": []
 }

package/dist/lib/url.js

@@ -51,27 +51,64 @@ function originFromHost(protocol, rawHost) {
   if (!host) return null;
   return normalizeOrigin(`${protocol}//${host}`);
 }
-function requestOrigins(input) {
-  const origins = /* @__PURE__ */ new Set();
-  if (!input) return origins;
+function readRequestOriginCandidates(input) {
+  const candidates = {
+    urlOrigin: null,
+    headerOrigins: /* @__PURE__ */ new Set()
+  };
+  if (!input) return candidates;
   const requestUrl = typeof input === "string" ? input : input.url;
   let parsedUrl;
   try {
     parsedUrl = new URL(requestUrl);
   } catch {
-    return origins;
+    return candidates;
   }
-  const urlOrigin = normalizeOrigin(parsedUrl.origin);
-  if (urlOrigin) origins.add(urlOrigin);
-  if (typeof input === "string") return origins;
+  candidates.urlOrigin = normalizeOrigin(parsedUrl.origin);
+  if (typeof input === "string") return candidates;
   const forwardedProto = readFirstHeaderValue(input.headers.get("x-forwarded-proto")) ?? parsedUrl.protocol.replace(/:$/, "");
   const protocol = forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
   const hostOrigin = originFromHost(protocol, input.headers.get("host"));
   const forwardedHostOrigin = originFromHost(protocol, input.headers.get("x-forwarded-host"));
-  if (hostOrigin) origins.add(hostOrigin);
-  if (forwardedHostOrigin) origins.add(forwardedHostOrigin);
+  if (hostOrigin) candidates.headerOrigins.add(hostOrigin);
+  if (forwardedHostOrigin) candidates.headerOrigins.add(forwardedHostOrigin);
+  return candidates;
+}
+function requestOrigins(input) {
+  const origins = /* @__PURE__ */ new Set();
+  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input);
+  if (urlOrigin) origins.add(urlOrigin);
+  for (const origin of headerOrigins) origins.add(origin);
   return origins;
 }
+function logOriginDebugContext(input, allowedOrigins, rejectedOrigin, level = "error", nodeEnv) {
+  if (level === "warn" && nodeEnv === "test") return;
+  const log = level === "warn" ? console.warn : console.error;
+  if (typeof input === "string") {
+    log("[origin-check] rejected string input", {
+      requestUrl: input,
+      rejectedOrigin: rejectedOrigin ?? null,
+      allowedOrigins: Array.from(allowedOrigins)
+    });
+    return;
+  }
+  if (!input) {
+    log("[origin-check] rejected empty input", {
+      rejectedOrigin: rejectedOrigin ?? null,
+      allowedOrigins: Array.from(allowedOrigins)
+    });
+    return;
+  }
+  log("[origin-check] rejected request", {
+    requestUrl: input.url,
+    host: input.headers.get("host"),
+    forwardedHost: input.headers.get("x-forwarded-host"),
+    forwardedProto: input.headers.get("x-forwarded-proto"),
+    derivedOrigins: Array.from(requestOrigins(input)),
+    rejectedOrigin: rejectedOrigin ?? null,
+    allowedOrigins: Array.from(allowedOrigins)
+  });
+}
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
 }
@@ -113,18 +150,25 @@ function assertAllowedAppOrigin(input, env = process.env) {
   const allowedOrigins = readAllowedOrigins(env);
   if (allowedOrigins.size === 0) {
     if (env.NODE_ENV === "production") {
+      logOriginDebugContext(input, allowedOrigins);
       throw new AppOriginConfigurationError("APP_URL must be configured in production");
     }
     return;
   }
-  const origins = requestOrigins(input);
-  if (origins.size === 0) return;
-  for (const origin of origins) {
-    if (!allowedOrigins.has(origin)) {
-      if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue;
-      throw new AppOriginRejectedError("Request origin is not allowed");
-    }
+  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input);
+  const hasAllowedHeaderOrigin = Array.from(headerOrigins).some((origin) => allowedOrigins.has(origin));
+  for (const origin of headerOrigins) {
+    if (allowedOrigins.has(origin)) continue;
+    if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue;
+    logOriginDebugContext(input, allowedOrigins, origin, "warn", env.NODE_ENV);
+    throw new AppOriginRejectedError("Request origin is not allowed");
   }
+  if (!urlOrigin) return;
+  if (allowedOrigins.has(urlOrigin)) return;
+  if (shouldAllowLoopbackOrigin(urlOrigin, allowedOrigins, env)) return;
+  if (isLoopbackOrigin(urlOrigin) && hasAllowedHeaderOrigin) return;
+  logOriginDebugContext(input, allowedOrigins, urlOrigin, "warn", env.NODE_ENV);
+  throw new AppOriginRejectedError("Request origin is not allowed");
 }
 function resolveRequestOrigin(req) {
   const url = new URL(req.url);

package/dist/lib/url.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/url.ts"],
-  "sourcesContent": ["const DEFAULT_DEV_APP_URL = 'http://localhost:3000'\n\ntype EnvLike = Record<string, string | undefined> & {\n  APP_URL?: string\n  NEXT_PUBLIC_APP_URL?: string\n  APP_ALLOWED_ORIGINS?: string\n  NODE_ENV?: string\n}\ntype RequestInput = Request | string | undefined\n\nexport type SecurityEmailUrlErrorMapping = {\n  scope: string\n  configMessage: string\n}\n\nexport class AppOriginConfigurationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginConfigurationError'\n  }\n}\n\nexport class AppOriginRejectedError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginRejectedError'\n  }\n}\n\nfunction parseBaseUrl(raw: string | undefined): URL | null {\n  const value = raw?.trim()\n  if (!value) return null\n  try {\n    const url = new URL(value)\n    url.hash = ''\n    url.search = ''\n    return url\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeBaseUrl(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.toString().replace(/\\/$/, '') : null\n}\n\nfunction normalizeOrigin(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.origin : null\n}\n\nfunction readCsv(value: string | undefined): string[] {\n  return (value ?? '')\n    .split(',')\n    .map((item) => item.trim())\n    .filter((item) => item.length > 0)\n}\n\nfunction readAllowedOrigins(env: EnvLike): Set<string> {\n  const origins = new Set<string>()\n  for (const raw of [env.APP_URL, env.NEXT_PUBLIC_APP_URL, ...readCsv(env.APP_ALLOWED_ORIGINS)]) {\n    const origin = normalizeOrigin(raw)\n    if (origin) origins.add(origin)\n  }\n  return origins\n}\n\nfunction readFirstHeaderValue(value: string | null): string | null {\n  const first = value?.split(',')[0]?.trim()\n  return first && first.length > 0 ? first : null\n}\n\nfunction originFromHost(protocol: string, rawHost: string | null): string | null {\n  const host = readFirstHeaderValue(rawHost)\n  if (!host) return null\n  return normalizeOrigin(`${protocol}//${host}`)\n}\n\nfunction requestOrigins(input: RequestInput): Set<string> {\n  const origins = new Set<string>()\n  if (!input) return origins\n\n  const requestUrl = typeof input === 'string' ? input : input.url\n  let parsedUrl: URL\n  try {\n    parsedUrl = new URL(requestUrl)\n  } catch {\n    return origins\n  }\n\n  const urlOrigin = normalizeOrigin(parsedUrl.origin)\n  if (urlOrigin) origins.add(urlOrigin)\n\n  if (typeof input === 'string') return origins\n\n  const forwardedProto = readFirstHeaderValue(input.headers.get('x-forwarded-proto')) ?? parsedUrl.protocol.replace(/:$/, '')\n  const protocol = forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`\n  const hostOrigin = originFromHost(protocol, input.headers.get('host'))\n  const forwardedHostOrigin = originFromHost(protocol, input.headers.get('x-forwarded-host'))\n  if (hostOrigin) origins.add(hostOrigin)\n  if (forwardedHostOrigin) origins.add(forwardedHostOrigin)\n  return origins\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    return isLoopbackHostname(new URL(origin).hostname)\n  } catch {\n    return false\n  }\n}\n\nfunction normalizeOriginPort(url: URL): string {\n  if (url.port) return url.port\n  if (url.protocol === 'https:') return '443'\n  if (url.protocol === 'http:') return '80'\n  return ''\n}\n\nfunction isEquivalentLoopbackOrigin(origin: string, allowedOrigin: string): boolean {\n  try {\n    const candidateUrl = new URL(origin)\n    const allowedUrl = new URL(allowedOrigin)\n    if (!isLoopbackHostname(candidateUrl.hostname) || !isLoopbackHostname(allowedUrl.hostname)) {\n      return false\n    }\n    return normalizeOriginPort(candidateUrl) === normalizeOriginPort(allowedUrl)\n  } catch {\n    return false\n  }\n}\n\nfunction shouldAllowLoopbackOrigin(origin: string, allowedOrigins: Set<string>, env: EnvLike): boolean {\n  if (!isLoopbackOrigin(origin)) return false\n  for (const allowedOrigin of allowedOrigins) {\n    if (!isLoopbackOrigin(allowedOrigin)) continue\n    if (env.NODE_ENV !== 'production') return true\n    if (isEquivalentLoopbackOrigin(origin, allowedOrigin)) return true\n  }\n  return false\n}\n\nexport function assertAllowedAppOrigin(input: RequestInput, env: EnvLike = process.env): void {\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.size === 0) {\n    if (env.NODE_ENV === 'production') {\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return\n  }\n  const origins = requestOrigins(input)\n  if (origins.size === 0) return\n\n  for (const origin of origins) {\n    if (!allowedOrigins.has(origin)) {\n      if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue\n      throw new AppOriginRejectedError('Request origin is not allowed')\n    }\n  }\n}\n\nexport function resolveRequestOrigin(req: Request): string {\n  const url = new URL(req.url)\n  const proto = req.headers.get('x-forwarded-proto') || url.protocol.replace(':', '')\n  const host = req.headers.get('x-forwarded-host') || req.headers.get('host') || url.host\n  return `${proto}://${host}`\n}\n\nexport function getAppBaseUrl(req: Request): string {\n  return (\n    process.env.NEXT_PUBLIC_APP_URL ||\n    process.env.APP_URL ||\n    resolveRequestOrigin(req)\n  )\n}\n\nexport function toAbsoluteUrl(req: Request, path: string): string {\n  return new URL(path, getAppBaseUrl(req)).toString()\n}\n\nexport function getSecurityEmailBaseUrl(input?: RequestInput, env: EnvLike = process.env): string {\n  const configuredAppUrl = normalizeBaseUrl(env.APP_URL)\n  if (!configuredAppUrl) {\n    if (env.NODE_ENV === 'production') {\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return DEFAULT_DEV_APP_URL\n  }\n\n  assertAllowedAppOrigin(input, env)\n  return configuredAppUrl\n}\n\nexport function toSecurityEmailUrl(input: RequestInput, path: string, env: EnvLike = process.env): string {\n  const base = getSecurityEmailBaseUrl(input, env)\n  return `${base}/${path.replace(/^\\/+/, '')}`\n}\n\nexport function mapSecurityEmailUrlError(\n  error: unknown,\n  mapping: SecurityEmailUrlErrorMapping,\n): { status: number; body: { error: string } } | null {\n  if (error instanceof AppOriginRejectedError) {\n    return { status: 400, body: { error: 'Invalid request origin' } }\n  }\n  if (error instanceof AppOriginConfigurationError) {\n    console.error(`[${mapping.scope}] APP_URL is required in production`)\n    return { status: 500, body: { error: mapping.configMessage } }\n  }\n  return null\n}\n"],
-  "mappings": "AAAA,MAAM,sBAAsB;AAerB,MAAM,oCAAoC,MAAM;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,+BAA+B,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,aAAa,KAAqC;AACzD,QAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,OAAO;AACX,QAAI,SAAS;AACb,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,KAAwC;AAChE,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE,IAAI;AACnD;AAEA,SAAS,gBAAgB,KAAwC;AAC/D,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS;AAC5B;AAEA,SAAS,QAAQ,OAAqC;AACpD,UAAQ,SAAS,IACd,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACrC;AAEA,SAAS,mBAAmB,KAA2B;AACrD,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,OAAO,CAAC,IAAI,SAAS,IAAI,qBAAqB,GAAG,QAAQ,IAAI,mBAAmB,CAAC,GAAG;AAC7F,UAAM,SAAS,gBAAgB,GAAG;AAClC,QAAI,OAAQ,SAAQ,IAAI,MAAM;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAqC;AACjE,QAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACzC,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,eAAe,UAAkB,SAAuC;AAC/E,QAAM,OAAO,qBAAqB,OAAO;AACzC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,gBAAgB,GAAG,QAAQ,KAAK,IAAI,EAAE;AAC/C;AAEA,SAAS,eAAe,OAAkC;AACxD,QAAM,UAAU,oBAAI,IAAY;AAChC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC7D,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,UAAU;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,gBAAgB,UAAU,MAAM;AAClD,MAAI,UAAW,SAAQ,IAAI,SAAS;AAEpC,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,iBAAiB,qBAAqB,MAAM,QAAQ,IAAI,mBAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,MAAM,EAAE;AAC1H,QAAM,WAAW,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc;AAClF,QAAM,aAAa,eAAe,UAAU,MAAM,QAAQ,IAAI,MAAM,CAAC;AACrE,QAAM,sBAAsB,eAAe,UAAU,MAAM,QAAQ,IAAI,kBAAkB,CAAC;AAC1F,MAAI,WAAY,SAAQ,IAAI,UAAU;AACtC,MAAI,oBAAqB,SAAQ,IAAI,mBAAmB;AACxD,SAAO;AACT;AAEA,SAAS,mBAAmB,UAA2B;AACrD,SAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,iBAAiB,QAAyB;AACjD,MAAI;AACF,WAAO,mBAAmB,IAAI,IAAI,MAAM,EAAE,QAAQ;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,KAAkB;AAC7C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AAEA,SAAS,2BAA2B,QAAgB,eAAgC;AAClF,MAAI;AACF,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,UAAM,aAAa,IAAI,IAAI,aAAa;AACxC,QAAI,CAAC,mBAAmB,aAAa,QAAQ,KAAK,CAAC,mBAAmB,WAAW,QAAQ,GAAG;AAC1F,aAAO;AAAA,IACT;AACA,WAAO,oBAAoB,YAAY,MAAM,oBAAoB,UAAU;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,QAAgB,gBAA6B,KAAuB;AACrG,MAAI,CAAC,iBAAiB,MAAM,EAAG,QAAO;AACtC,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,CAAC,iBAAiB,aAAa,EAAG;AACtC,QAAI,IAAI,aAAa,aAAc,QAAO;AAC1C,QAAI,2BAA2B,QAAQ,aAAa,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAqB,MAAe,QAAQ,KAAW;AAC5F,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,SAAS,GAAG;AAC7B,QAAI,IAAI,aAAa,cAAc;AACjC,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA;AAAA,EACF;AACA,QAAM,UAAU,eAAe,KAAK;AACpC,MAAI,QAAQ,SAAS,EAAG;AAExB,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,eAAe,IAAI,MAAM,GAAG;AAC/B,UAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG;AAC5D,YAAM,IAAI,uBAAuB,+BAA+B;AAAA,IAClE;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,KAAsB;AACzD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,QAAQ,IAAI,QAAQ,IAAI,mBAAmB,KAAK,IAAI,SAAS,QAAQ,KAAK,EAAE;AAClF,QAAM,OAAO,IAAI,QAAQ,IAAI,kBAAkB,KAAK,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI;AACnF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEO,SAAS,cAAc,KAAsB;AAClD,SACE,QAAQ,IAAI,uBACZ,QAAQ,IAAI,WACZ,qBAAqB,GAAG;AAE5B;AAEO,SAAS,cAAc,KAAc,MAAsB;AAChE,SAAO,IAAI,IAAI,MAAM,cAAc,GAAG,CAAC,EAAE,SAAS;AACpD;AAEO,SAAS,wBAAwB,OAAsB,MAAe,QAAQ,KAAa;AAChG,QAAM,mBAAmB,iBAAiB,IAAI,OAAO;AACrD,MAAI,CAAC,kBAAkB;AACrB,QAAI,IAAI,aAAa,cAAc;AACjC,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAEA,yBAAuB,OAAO,GAAG;AACjC,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAqB,MAAc,MAAe,QAAQ,KAAa;AACxG,QAAM,OAAO,wBAAwB,OAAO,GAAG;AAC/C,SAAO,GAAG,IAAI,IAAI,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAC5C;AAEO,SAAS,yBACd,OACA,SACoD;AACpD,MAAI,iBAAiB,wBAAwB;AAC3C,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,yBAAyB,EAAE;AAAA,EAClE;AACA,MAAI,iBAAiB,6BAA6B;AAChD,YAAQ,MAAM,IAAI,QAAQ,KAAK,qCAAqC;AACpE,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,QAAQ,cAAc,EAAE;AAAA,EAC/D;AACA,SAAO;AACT;",
+  "sourcesContent": ["const DEFAULT_DEV_APP_URL = 'http://localhost:3000'\n\ntype EnvLike = Record<string, string | undefined> & {\n  APP_URL?: string\n  NEXT_PUBLIC_APP_URL?: string\n  APP_ALLOWED_ORIGINS?: string\n  NODE_ENV?: string\n}\ntype RequestInput = Request | string | undefined\n\nexport type SecurityEmailUrlErrorMapping = {\n  scope: string\n  configMessage: string\n}\n\nexport class AppOriginConfigurationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginConfigurationError'\n  }\n}\n\nexport class AppOriginRejectedError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AppOriginRejectedError'\n  }\n}\n\nfunction parseBaseUrl(raw: string | undefined): URL | null {\n  const value = raw?.trim()\n  if (!value) return null\n  try {\n    const url = new URL(value)\n    url.hash = ''\n    url.search = ''\n    return url\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeBaseUrl(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.toString().replace(/\\/$/, '') : null\n}\n\nfunction normalizeOrigin(raw: string | undefined): string | null {\n  const url = parseBaseUrl(raw)\n  return url ? url.origin : null\n}\n\nfunction readCsv(value: string | undefined): string[] {\n  return (value ?? '')\n    .split(',')\n    .map((item) => item.trim())\n    .filter((item) => item.length > 0)\n}\n\nfunction readAllowedOrigins(env: EnvLike): Set<string> {\n  const origins = new Set<string>()\n  for (const raw of [env.APP_URL, env.NEXT_PUBLIC_APP_URL, ...readCsv(env.APP_ALLOWED_ORIGINS)]) {\n    const origin = normalizeOrigin(raw)\n    if (origin) origins.add(origin)\n  }\n  return origins\n}\n\nfunction readFirstHeaderValue(value: string | null): string | null {\n  const first = value?.split(',')[0]?.trim()\n  return first && first.length > 0 ? first : null\n}\n\nfunction originFromHost(protocol: string, rawHost: string | null): string | null {\n  const host = readFirstHeaderValue(rawHost)\n  if (!host) return null\n  return normalizeOrigin(`${protocol}//${host}`)\n}\n\ntype RequestOriginCandidates = {\n  urlOrigin: string | null\n  headerOrigins: Set<string>\n}\n\nfunction readRequestOriginCandidates(input: RequestInput): RequestOriginCandidates {\n  const candidates: RequestOriginCandidates = {\n    urlOrigin: null,\n    headerOrigins: new Set<string>(),\n  }\n  if (!input) return candidates\n\n  const requestUrl = typeof input === 'string' ? input : input.url\n  let parsedUrl: URL\n  try {\n    parsedUrl = new URL(requestUrl)\n  } catch {\n    return candidates\n  }\n\n  candidates.urlOrigin = normalizeOrigin(parsedUrl.origin)\n  if (typeof input === 'string') return candidates\n\n  const forwardedProto = readFirstHeaderValue(input.headers.get('x-forwarded-proto')) ?? parsedUrl.protocol.replace(/:$/, '')\n  const protocol = forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`\n  const hostOrigin = originFromHost(protocol, input.headers.get('host'))\n  const forwardedHostOrigin = originFromHost(protocol, input.headers.get('x-forwarded-host'))\n  if (hostOrigin) candidates.headerOrigins.add(hostOrigin)\n  if (forwardedHostOrigin) candidates.headerOrigins.add(forwardedHostOrigin)\n  return candidates\n}\n\nfunction requestOrigins(input: RequestInput): Set<string> {\n  const origins = new Set<string>()\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  if (urlOrigin) origins.add(urlOrigin)\n  for (const origin of headerOrigins) origins.add(origin)\n  return origins\n}\n\nfunction logOriginDebugContext(\n  input: RequestInput,\n  allowedOrigins: Set<string>,\n  rejectedOrigin?: string,\n  level: 'error' | 'warn' = 'error',\n  nodeEnv?: string,\n): void {\n  if (level === 'warn' && nodeEnv === 'test') return\n  const log = level === 'warn' ? console.warn : console.error\n\n  if (typeof input === 'string') {\n    log('[origin-check] rejected string input', {\n      requestUrl: input,\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  if (!input) {\n    log('[origin-check] rejected empty input', {\n      rejectedOrigin: rejectedOrigin ?? null,\n      allowedOrigins: Array.from(allowedOrigins),\n    })\n    return\n  }\n\n  log('[origin-check] rejected request', {\n    requestUrl: input.url,\n    host: input.headers.get('host'),\n    forwardedHost: input.headers.get('x-forwarded-host'),\n    forwardedProto: input.headers.get('x-forwarded-proto'),\n    derivedOrigins: Array.from(requestOrigins(input)),\n    rejectedOrigin: rejectedOrigin ?? null,\n    allowedOrigins: Array.from(allowedOrigins),\n  })\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    return isLoopbackHostname(new URL(origin).hostname)\n  } catch {\n    return false\n  }\n}\n\nfunction normalizeOriginPort(url: URL): string {\n  if (url.port) return url.port\n  if (url.protocol === 'https:') return '443'\n  if (url.protocol === 'http:') return '80'\n  return ''\n}\n\nfunction isEquivalentLoopbackOrigin(origin: string, allowedOrigin: string): boolean {\n  try {\n    const candidateUrl = new URL(origin)\n    const allowedUrl = new URL(allowedOrigin)\n    if (!isLoopbackHostname(candidateUrl.hostname) || !isLoopbackHostname(allowedUrl.hostname)) {\n      return false\n    }\n    return normalizeOriginPort(candidateUrl) === normalizeOriginPort(allowedUrl)\n  } catch {\n    return false\n  }\n}\n\nfunction shouldAllowLoopbackOrigin(origin: string, allowedOrigins: Set<string>, env: EnvLike): boolean {\n  if (!isLoopbackOrigin(origin)) return false\n  for (const allowedOrigin of allowedOrigins) {\n    if (!isLoopbackOrigin(allowedOrigin)) continue\n    if (env.NODE_ENV !== 'production') return true\n    if (isEquivalentLoopbackOrigin(origin, allowedOrigin)) return true\n  }\n  return false\n}\n\nexport function assertAllowedAppOrigin(input: RequestInput, env: EnvLike = process.env): void {\n  const allowedOrigins = readAllowedOrigins(env)\n  if (allowedOrigins.size === 0) {\n    if (env.NODE_ENV === 'production') {\n      logOriginDebugContext(input, allowedOrigins)\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return\n  }\n  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)\n  const hasAllowedHeaderOrigin = Array.from(headerOrigins).some((origin) => allowedOrigins.has(origin))\n\n  for (const origin of headerOrigins) {\n    if (allowedOrigins.has(origin)) continue\n    if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue\n    logOriginDebugContext(input, allowedOrigins, origin, 'warn', env.NODE_ENV)\n    throw new AppOriginRejectedError('Request origin is not allowed')\n  }\n\n  if (!urlOrigin) return\n  if (allowedOrigins.has(urlOrigin)) return\n  if (shouldAllowLoopbackOrigin(urlOrigin, allowedOrigins, env)) return\n  if (isLoopbackOrigin(urlOrigin) && hasAllowedHeaderOrigin) return\n\n  logOriginDebugContext(input, allowedOrigins, urlOrigin, 'warn', env.NODE_ENV)\n  throw new AppOriginRejectedError('Request origin is not allowed')\n}\n\nexport function resolveRequestOrigin(req: Request): string {\n  const url = new URL(req.url)\n  const proto = req.headers.get('x-forwarded-proto') || url.protocol.replace(':', '')\n  const host = req.headers.get('x-forwarded-host') || req.headers.get('host') || url.host\n  return `${proto}://${host}`\n}\n\nexport function getAppBaseUrl(req: Request): string {\n  return (\n    process.env.NEXT_PUBLIC_APP_URL ||\n    process.env.APP_URL ||\n    resolveRequestOrigin(req)\n  )\n}\n\nexport function toAbsoluteUrl(req: Request, path: string): string {\n  return new URL(path, getAppBaseUrl(req)).toString()\n}\n\nexport function getSecurityEmailBaseUrl(input?: RequestInput, env: EnvLike = process.env): string {\n  const configuredAppUrl = normalizeBaseUrl(env.APP_URL)\n  if (!configuredAppUrl) {\n    if (env.NODE_ENV === 'production') {\n      throw new AppOriginConfigurationError('APP_URL must be configured in production')\n    }\n    return DEFAULT_DEV_APP_URL\n  }\n\n  assertAllowedAppOrigin(input, env)\n  return configuredAppUrl\n}\n\nexport function toSecurityEmailUrl(input: RequestInput, path: string, env: EnvLike = process.env): string {\n  const base = getSecurityEmailBaseUrl(input, env)\n  return `${base}/${path.replace(/^\\/+/, '')}`\n}\n\nexport function mapSecurityEmailUrlError(\n  error: unknown,\n  mapping: SecurityEmailUrlErrorMapping,\n): { status: number; body: { error: string } } | null {\n  if (error instanceof AppOriginRejectedError) {\n    return { status: 400, body: { error: 'Invalid request origin' } }\n  }\n  if (error instanceof AppOriginConfigurationError) {\n    console.error(`[${mapping.scope}] APP_URL is required in production`)\n    return { status: 500, body: { error: mapping.configMessage } }\n  }\n  return null\n}\n"],
+  "mappings": "AAAA,MAAM,sBAAsB;AAerB,MAAM,oCAAoC,MAAM;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,+BAA+B,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,aAAa,KAAqC;AACzD,QAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,OAAO;AACX,QAAI,SAAS;AACb,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,KAAwC;AAChE,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE,IAAI;AACnD;AAEA,SAAS,gBAAgB,KAAwC;AAC/D,QAAM,MAAM,aAAa,GAAG;AAC5B,SAAO,MAAM,IAAI,SAAS;AAC5B;AAEA,SAAS,QAAQ,OAAqC;AACpD,UAAQ,SAAS,IACd,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACrC;AAEA,SAAS,mBAAmB,KAA2B;AACrD,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,OAAO,CAAC,IAAI,SAAS,IAAI,qBAAqB,GAAG,QAAQ,IAAI,mBAAmB,CAAC,GAAG;AAC7F,UAAM,SAAS,gBAAgB,GAAG;AAClC,QAAI,OAAQ,SAAQ,IAAI,MAAM;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAqC;AACjE,QAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACzC,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,eAAe,UAAkB,SAAuC;AAC/E,QAAM,OAAO,qBAAqB,OAAO;AACzC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,gBAAgB,GAAG,QAAQ,KAAK,IAAI,EAAE;AAC/C;AAOA,SAAS,4BAA4B,OAA8C;AACjF,QAAM,aAAsC;AAAA,IAC1C,WAAW;AAAA,IACX,eAAe,oBAAI,IAAY;AAAA,EACjC;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC7D,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,UAAU;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,gBAAgB,UAAU,MAAM;AACvD,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,iBAAiB,qBAAqB,MAAM,QAAQ,IAAI,mBAAmB,CAAC,KAAK,UAAU,SAAS,QAAQ,MAAM,EAAE;AAC1H,QAAM,WAAW,eAAe,SAAS,GAAG,IAAI,iBAAiB,GAAG,cAAc;AAClF,QAAM,aAAa,eAAe,UAAU,MAAM,QAAQ,IAAI,MAAM,CAAC;AACrE,QAAM,sBAAsB,eAAe,UAAU,MAAM,QAAQ,IAAI,kBAAkB,CAAC;AAC1F,MAAI,WAAY,YAAW,cAAc,IAAI,UAAU;AACvD,MAAI,oBAAqB,YAAW,cAAc,IAAI,mBAAmB;AACzE,SAAO;AACT;AAEA,SAAS,eAAe,OAAkC;AACxD,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,MAAI,UAAW,SAAQ,IAAI,SAAS;AACpC,aAAW,UAAU,cAAe,SAAQ,IAAI,MAAM;AACtD,SAAO;AACT;AAEA,SAAS,sBACP,OACA,gBACA,gBACA,QAA0B,SAC1B,SACM;AACN,MAAI,UAAU,UAAU,YAAY,OAAQ;AAC5C,QAAM,MAAM,UAAU,SAAS,QAAQ,OAAO,QAAQ;AAEtD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,wCAAwC;AAAA,MAC1C,YAAY;AAAA,MACZ,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,CAAC,OAAO;AACV,QAAI,uCAAuC;AAAA,MACzC,gBAAgB,kBAAkB;AAAA,MAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,IAC3C,CAAC;AACD;AAAA,EACF;AAEA,MAAI,mCAAmC;AAAA,IACrC,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,MAAM;AAAA,IAC9B,eAAe,MAAM,QAAQ,IAAI,kBAAkB;AAAA,IACnD,gBAAgB,MAAM,QAAQ,IAAI,mBAAmB;AAAA,IACrD,gBAAgB,MAAM,KAAK,eAAe,KAAK,CAAC;AAAA,IAChD,gBAAgB,kBAAkB;AAAA,IAClC,gBAAgB,MAAM,KAAK,cAAc;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,mBAAmB,UAA2B;AACrD,SAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,iBAAiB,QAAyB;AACjD,MAAI;AACF,WAAO,mBAAmB,IAAI,IAAI,MAAM,EAAE,QAAQ;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,KAAkB;AAC7C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AAEA,SAAS,2BAA2B,QAAgB,eAAgC;AAClF,MAAI;AACF,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,UAAM,aAAa,IAAI,IAAI,aAAa;AACxC,QAAI,CAAC,mBAAmB,aAAa,QAAQ,KAAK,CAAC,mBAAmB,WAAW,QAAQ,GAAG;AAC1F,aAAO;AAAA,IACT;AACA,WAAO,oBAAoB,YAAY,MAAM,oBAAoB,UAAU;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,0BAA0B,QAAgB,gBAA6B,KAAuB;AACrG,MAAI,CAAC,iBAAiB,MAAM,EAAG,QAAO;AACtC,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,CAAC,iBAAiB,aAAa,EAAG;AACtC,QAAI,IAAI,aAAa,aAAc,QAAO;AAC1C,QAAI,2BAA2B,QAAQ,aAAa,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAqB,MAAe,QAAQ,KAAW;AAC5F,QAAM,iBAAiB,mBAAmB,GAAG;AAC7C,MAAI,eAAe,SAAS,GAAG;AAC7B,QAAI,IAAI,aAAa,cAAc;AACjC,4BAAsB,OAAO,cAAc;AAC3C,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA;AAAA,EACF;AACA,QAAM,EAAE,WAAW,cAAc,IAAI,4BAA4B,KAAK;AACtE,QAAM,yBAAyB,MAAM,KAAK,aAAa,EAAE,KAAK,CAAC,WAAW,eAAe,IAAI,MAAM,CAAC;AAEpG,aAAW,UAAU,eAAe;AAClC,QAAI,eAAe,IAAI,MAAM,EAAG;AAChC,QAAI,0BAA0B,QAAQ,gBAAgB,GAAG,EAAG;AAC5D,0BAAsB,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;AACzE,UAAM,IAAI,uBAAuB,+BAA+B;AAAA,EAClE;AAEA,MAAI,CAAC,UAAW;AAChB,MAAI,eAAe,IAAI,SAAS,EAAG;AACnC,MAAI,0BAA0B,WAAW,gBAAgB,GAAG,EAAG;AAC/D,MAAI,iBAAiB,SAAS,KAAK,uBAAwB;AAE3D,wBAAsB,OAAO,gBAAgB,WAAW,QAAQ,IAAI,QAAQ;AAC5E,QAAM,IAAI,uBAAuB,+BAA+B;AAClE;AAEO,SAAS,qBAAqB,KAAsB;AACzD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,QAAQ,IAAI,QAAQ,IAAI,mBAAmB,KAAK,IAAI,SAAS,QAAQ,KAAK,EAAE;AAClF,QAAM,OAAO,IAAI,QAAQ,IAAI,kBAAkB,KAAK,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI;AACnF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEO,SAAS,cAAc,KAAsB;AAClD,SACE,QAAQ,IAAI,uBACZ,QAAQ,IAAI,WACZ,qBAAqB,GAAG;AAE5B;AAEO,SAAS,cAAc,KAAc,MAAsB;AAChE,SAAO,IAAI,IAAI,MAAM,cAAc,GAAG,CAAC,EAAE,SAAS;AACpD;AAEO,SAAS,wBAAwB,OAAsB,MAAe,QAAQ,KAAa;AAChG,QAAM,mBAAmB,iBAAiB,IAAI,OAAO;AACrD,MAAI,CAAC,kBAAkB;AACrB,QAAI,IAAI,aAAa,cAAc;AACjC,YAAM,IAAI,4BAA4B,0CAA0C;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AAEA,yBAAuB,OAAO,GAAG;AACjC,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAqB,MAAc,MAAe,QAAQ,KAAa;AACxG,QAAM,OAAO,wBAAwB,OAAO,GAAG;AAC/C,SAAO,GAAG,IAAI,IAAI,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAC5C;AAEO,SAAS,yBACd,OACA,SACoD;AACpD,MAAI,iBAAiB,wBAAwB;AAC3C,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,yBAAyB,EAAE;AAAA,EAClE;AACA,MAAI,iBAAiB,6BAA6B;AAChD,YAAQ,MAAM,IAAI,QAAQ,KAAK,qCAAqC;AACpE,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,QAAQ,cAAc,EAAE;AAAA,EAC/D;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.5.1-develop.2855.9b058b7483";
+const APP_VERSION = "0.5.1-develop.2860.07af3a6a9d";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.5.1-develop.2855.9b058b7483'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.5.1-develop.2860.07af3a6a9d'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.5.1-develop.2855.9b058b7483",
+  "version": "0.5.1-develop.2860.07af3a6a9d",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -92,7 +92,7 @@
     "@mikro-orm/core": "^7.0.10",
     "@mikro-orm/decorators": "^7.0.10",
     "@mikro-orm/postgresql": "^7.0.10",
-    "@open-mercato/cache": "0.5.1-develop.2855.9b058b7483",
+    "@open-mercato/cache": "0.5.1-develop.2860.07af3a6a9d",
     "dotenv": "^17.4.2",
     "rate-limiter-flexible": "^11.0.1",
     "reflect-metadata": "^0.2.2",

package/src/lib/__tests__/url.test.ts

@@ -34,6 +34,22 @@ describe('security email URL helpers', () => {
     expect(() => assertAllowedAppOrigin(request, env)).toThrow(AppOriginRejectedError)
   })
 
+  test('rejects an untrusted request URL even when forwarded host matches the configured app origin', () => {
+    const env = {
+      APP_URL: 'https://auth.openmercato.com',
+      NODE_ENV: 'production',
+    }
+    const request = new Request('https://evil.example/api/auth/reset', {
+      headers: {
+        host: 'auth.openmercato.com',
+        'x-forwarded-host': 'auth.openmercato.com',
+        'x-forwarded-proto': 'https',
+      },
+    })
+
+    expect(() => assertAllowedAppOrigin(request, env)).toThrow(AppOriginRejectedError)
+  })
+
   test('rejects a mismatched Host header even when the request URL origin is allowed', () => {
     const env = {
       APP_URL: 'https://app.example.com',
@@ -57,6 +73,22 @@ describe('security email URL helpers', () => {
     expect(() => assertAllowedAppOrigin(request, env)).not.toThrow()
   })
 
+  test('allows internal request URLs when forwarded host matches the configured app origin', () => {
+    const env = {
+      APP_URL: 'https://auth.openmercato.com',
+      NODE_ENV: 'production',
+    }
+    const request = new Request('https://localhost:9876/api/auth/reset', {
+      headers: {
+        host: 'auth.openmercato.com',
+        'x-forwarded-host': 'auth.openmercato.com',
+        'x-forwarded-proto': 'https',
+      },
+    })
+
+    expect(() => assertAllowedAppOrigin(request, env)).not.toThrow()
+  })
+
   test('allows loopback origin mismatches outside production', () => {
     const env = {
       APP_URL: 'http://localhost:3000',

package/src/lib/ratelimit/__tests__/config.test.ts

@@ -0,0 +1,33 @@
+import { readRateLimitConfig } from '../config'
+
+describe('readRateLimitConfig', () => {
+  const originalEnv = { ...process.env }
+
+  afterEach(() => {
+    process.env = { ...originalEnv }
+  })
+
+  it('defaults to enabled when no env is set', () => {
+    delete process.env.RATE_LIMIT_ENABLED
+    delete process.env.OM_INTEGRATION_TEST
+    expect(readRateLimitConfig().enabled).toBe(true)
+  })
+
+  it('honors RATE_LIMIT_ENABLED=false', () => {
+    process.env.RATE_LIMIT_ENABLED = 'false'
+    delete process.env.OM_INTEGRATION_TEST
+    expect(readRateLimitConfig().enabled).toBe(false)
+  })
+
+  it('forces enabled=false under OM_INTEGRATION_TEST=true even when RATE_LIMIT_ENABLED=true', () => {
+    process.env.RATE_LIMIT_ENABLED = 'true'
+    process.env.OM_INTEGRATION_TEST = 'true'
+    expect(readRateLimitConfig().enabled).toBe(false)
+  })
+
+  it('ignores OM_INTEGRATION_TEST=false', () => {
+    process.env.RATE_LIMIT_ENABLED = 'true'
+    process.env.OM_INTEGRATION_TEST = 'false'
+    expect(readRateLimitConfig().enabled).toBe(true)
+  })
+})

package/src/lib/ratelimit/config.ts

@@ -11,8 +11,18 @@ export function readRateLimitConfig(): RateLimitGlobalConfig {
 
   const trustProxyDepth = parsePositiveInt(process.env.RATE_LIMIT_TRUST_PROXY_DEPTH) ?? 1
 
+  // Integration test runs disable rate limiting globally so suites do not
+  // have to juggle per-endpoint bypass headers or reshape default caps.
+  // The targeted OM_TEST_MODE + OM_TEST_AUTH_RATE_LIMIT_MODE=opt-in escape
+  // hatch (checkAuthRateLimit) still works for suites that explicitly test
+  // rate-limit behavior.
+  const integrationTest = parseBooleanWithDefault(process.env.OM_INTEGRATION_TEST, false)
+  const enabled = integrationTest
+    ? false
+    : parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true)
+
   return {
-    enabled: parseBooleanWithDefault(process.env.RATE_LIMIT_ENABLED, true),
+    enabled,
     strategy,
     keyPrefix: process.env.RATE_LIMIT_KEY_PREFIX ?? 'rl',
     redisUrl: process.env.REDIS_URL,

package/src/lib/url.ts

@@ -77,32 +77,84 @@ function originFromHost(protocol: string, rawHost: string | null): string | null
   return normalizeOrigin(`${protocol}//${host}`)
 }
 
-function requestOrigins(input: RequestInput): Set<string> {
-  const origins = new Set<string>()
-  if (!input) return origins
+type RequestOriginCandidates = {
+  urlOrigin: string | null
+  headerOrigins: Set<string>
+}
+
+function readRequestOriginCandidates(input: RequestInput): RequestOriginCandidates {
+  const candidates: RequestOriginCandidates = {
+    urlOrigin: null,
+    headerOrigins: new Set<string>(),
+  }
+  if (!input) return candidates
 
   const requestUrl = typeof input === 'string' ? input : input.url
   let parsedUrl: URL
   try {
     parsedUrl = new URL(requestUrl)
   } catch {
-    return origins
+    return candidates
   }
 
-  const urlOrigin = normalizeOrigin(parsedUrl.origin)
-  if (urlOrigin) origins.add(urlOrigin)
-
-  if (typeof input === 'string') return origins
+  candidates.urlOrigin = normalizeOrigin(parsedUrl.origin)
+  if (typeof input === 'string') return candidates
 
   const forwardedProto = readFirstHeaderValue(input.headers.get('x-forwarded-proto')) ?? parsedUrl.protocol.replace(/:$/, '')
   const protocol = forwardedProto.endsWith(':') ? forwardedProto : `${forwardedProto}:`
   const hostOrigin = originFromHost(protocol, input.headers.get('host'))
   const forwardedHostOrigin = originFromHost(protocol, input.headers.get('x-forwarded-host'))
-  if (hostOrigin) origins.add(hostOrigin)
-  if (forwardedHostOrigin) origins.add(forwardedHostOrigin)
+  if (hostOrigin) candidates.headerOrigins.add(hostOrigin)
+  if (forwardedHostOrigin) candidates.headerOrigins.add(forwardedHostOrigin)
+  return candidates
+}
+
+function requestOrigins(input: RequestInput): Set<string> {
+  const origins = new Set<string>()
+  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)
+  if (urlOrigin) origins.add(urlOrigin)
+  for (const origin of headerOrigins) origins.add(origin)
   return origins
 }
 
+function logOriginDebugContext(
+  input: RequestInput,
+  allowedOrigins: Set<string>,
+  rejectedOrigin?: string,
+  level: 'error' | 'warn' = 'error',
+  nodeEnv?: string,
+): void {
+  if (level === 'warn' && nodeEnv === 'test') return
+  const log = level === 'warn' ? console.warn : console.error
+
+  if (typeof input === 'string') {
+    log('[origin-check] rejected string input', {
+      requestUrl: input,
+      rejectedOrigin: rejectedOrigin ?? null,
+      allowedOrigins: Array.from(allowedOrigins),
+    })
+    return
+  }
+
+  if (!input) {
+    log('[origin-check] rejected empty input', {
+      rejectedOrigin: rejectedOrigin ?? null,
+      allowedOrigins: Array.from(allowedOrigins),
+    })
+    return
+  }
+
+  log('[origin-check] rejected request', {
+    requestUrl: input.url,
+    host: input.headers.get('host'),
+    forwardedHost: input.headers.get('x-forwarded-host'),
+    forwardedProto: input.headers.get('x-forwarded-proto'),
+    derivedOrigins: Array.from(requestOrigins(input)),
+    rejectedOrigin: rejectedOrigin ?? null,
+    allowedOrigins: Array.from(allowedOrigins),
+  })
+}
+
 function isLoopbackHostname(hostname: string): boolean {
   return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'
 }
@@ -149,19 +201,28 @@ export function assertAllowedAppOrigin(input: RequestInput, env: EnvLike = proce
   const allowedOrigins = readAllowedOrigins(env)
   if (allowedOrigins.size === 0) {
     if (env.NODE_ENV === 'production') {
+      logOriginDebugContext(input, allowedOrigins)
       throw new AppOriginConfigurationError('APP_URL must be configured in production')
     }
     return
   }
-  const origins = requestOrigins(input)
-  if (origins.size === 0) return
+  const { urlOrigin, headerOrigins } = readRequestOriginCandidates(input)
+  const hasAllowedHeaderOrigin = Array.from(headerOrigins).some((origin) => allowedOrigins.has(origin))
 
-  for (const origin of origins) {
-    if (!allowedOrigins.has(origin)) {
-      if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue
-      throw new AppOriginRejectedError('Request origin is not allowed')
-    }
+  for (const origin of headerOrigins) {
+    if (allowedOrigins.has(origin)) continue
+    if (shouldAllowLoopbackOrigin(origin, allowedOrigins, env)) continue
+    logOriginDebugContext(input, allowedOrigins, origin, 'warn', env.NODE_ENV)
+    throw new AppOriginRejectedError('Request origin is not allowed')
   }
+
+  if (!urlOrigin) return
+  if (allowedOrigins.has(urlOrigin)) return
+  if (shouldAllowLoopbackOrigin(urlOrigin, allowedOrigins, env)) return
+  if (isLoopbackOrigin(urlOrigin) && hasAllowedHeaderOrigin) return
+
+  logOriginDebugContext(input, allowedOrigins, urlOrigin, 'warn', env.NODE_ENV)
+  throw new AppOriginRejectedError('Request origin is not allowed')
 }
 
 export function resolveRequestOrigin(req: Request): string {