@oxyhq/core 21.0.1 → 21.1.0

package/src/server/__tests__/cors.socket.test.ts

@@ -0,0 +1,225 @@
+/**
+ * `createOxyCors` over a REAL socket, plus the two halves of the opaque-origin
+ * guard.
+ *
+ * `cors.test.ts` drives the middleware with a fake `Request`/`Response` pair,
+ * which is fine for header bookkeeping but cannot answer the question this
+ * suite exists for: what a client actually receives. These tests start an
+ * Express app on an ephemeral port and read the response headers off the wire.
+ *
+ * `node:http` rather than `fetch`: `Origin` is a forbidden header name for
+ * `fetch`, so the request under test has to be built by hand.
+ */
+
+import http from 'node:http';
+import type { AddressInfo } from 'node:net';
+import express from 'express';
+import { configureLogger, resetLoggerConfig } from '../../logger';
+import type { LogEntry } from '../../logger';
+import { createOxyCors, matchesAllowedOrigin, normalizeAppOrigins } from '../cors';
+import type { OxyCorsOptions } from '../cors';
+
+interface CorsResponse {
+  status: number;
+  allowOrigin: string | undefined;
+  allowCredentials: string | undefined;
+}
+
+/** Start an Express app carrying `createOxyCors(options)` on an ephemeral port. */
+async function startServer(options: OxyCorsOptions): Promise<http.Server> {
+  const app = express();
+  app.use(createOxyCors(options));
+  app.get('/catalogue', (_req, res) => {
+    res.json({ ok: true });
+  });
+  const server = http.createServer(app);
+  await new Promise<void>((resolve) => {
+    server.listen(0, '127.0.0.1', resolve);
+  });
+  return server;
+}
+
+async function stopServer(server: http.Server): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()));
+  });
+}
+
+/** Issue a real request carrying `Origin` and read the CORS headers back. */
+function requestWithOrigin(
+  server: http.Server,
+  method: 'GET' | 'OPTIONS',
+  origin: string,
+): Promise<CorsResponse> {
+  const { port } = server.address() as AddressInfo;
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      {
+        host: '127.0.0.1',
+        port,
+        method,
+        path: '/catalogue',
+        headers: { Origin: origin, 'Access-Control-Request-Method': 'GET' },
+      },
+      (res) => {
+        res.resume();
+        res.on('end', () => {
+          resolve({
+            status: res.statusCode ?? 0,
+            allowOrigin: res.headers['access-control-allow-origin'],
+            allowCredentials: res.headers['access-control-allow-credentials'],
+          });
+        });
+        res.on('error', reject);
+      },
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+/**
+ * The exact shape that was live: one custom-scheme entry alongside ordinary
+ * ones. Every origin below normalizes to the opaque origin, so before the fix
+ * the `exp://` entry admitted all of them.
+ */
+const CONFIGURED_WITH_OPAQUE_ENTRY = ['https://app.example.com', 'exp://localhost:8150'];
+const OTHER_OPAQUE_SCHEME_ORIGINS = [
+  'vscode-webview://abc123',
+  'capacitor://localhost',
+  'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+  'file://',
+];
+
+describe('createOxyCors over a real socket', () => {
+  let server: http.Server;
+
+  beforeAll(async () => {
+    // The dropped entry logs at error level by design; that log is asserted in
+    // the configure-side suite below. Swallow it here so this suite's output
+    // carries only its own failures.
+    configureLogger({ sink: () => undefined });
+    server = await startServer({ appOrigins: CONFIGURED_WITH_OPAQUE_ENTRY });
+    resetLoggerConfig();
+  });
+
+  afterAll(async () => {
+    await stopServer(server);
+  });
+
+  it('POSITIVE CONTROL: a configured https origin gets its headers over the wire', async () => {
+    for (const method of ['GET', 'OPTIONS'] as const) {
+      const res = await requestWithOrigin(server, method, 'https://app.example.com');
+      expect(res.allowOrigin).toBe('https://app.example.com');
+      expect(res.allowCredentials).toBe('true');
+    }
+  });
+
+  it('POSITIVE CONTROL: the built-in Oxy apex family still gets its headers', async () => {
+    const res = await requestWithOrigin(server, 'GET', 'https://auth.oxy.so');
+    expect(res.allowOrigin).toBe('https://auth.oxy.so');
+    expect(res.allowCredentials).toBe('true');
+  });
+
+  it('a custom-scheme origin is NOT admitted by a custom-scheme allowlist entry', async () => {
+    for (const origin of OTHER_OPAQUE_SCHEME_ORIGINS) {
+      for (const method of ['GET', 'OPTIONS'] as const) {
+        const res = await requestWithOrigin(server, method, origin);
+        expect(res.allowOrigin).toBeUndefined();
+        expect(res.allowCredentials).toBeUndefined();
+      }
+    }
+  });
+
+  it('the opaque-origin entry does not admit even ITSELF', async () => {
+    const res = await requestWithOrigin(server, 'GET', 'exp://localhost:8150');
+    expect(res.allowOrigin).toBeUndefined();
+    expect(res.allowCredentials).toBeUndefined();
+  });
+
+  it('NEGATIVE CONTROL: a literal `Origin: null` is refused, as it always was', async () => {
+    const res = await requestWithOrigin(server, 'GET', 'null');
+    expect(res.allowOrigin).toBeUndefined();
+    expect(res.allowCredentials).toBeUndefined();
+  });
+
+  it('NEGATIVE CONTROL: an unrelated https origin is refused', async () => {
+    const res = await requestWithOrigin(server, 'GET', 'https://evil.example.com');
+    expect(res.allowOrigin).toBeUndefined();
+    expect(res.allowCredentials).toBeUndefined();
+  });
+});
+
+/**
+ * The CONFIGURE-SIDE half. Its behavioural effect is masked by the match-side
+ * half — with both in place, deleting this one changes no response — so what
+ * this suite asserts is the observable the drop-rather-than-throw decision
+ * rests on: the entry is named in an error log, and nothing else stops.
+ */
+describe('normalizeAppOrigins (configure side)', () => {
+  let entries: LogEntry[];
+
+  beforeEach(() => {
+    entries = [];
+    configureLogger({ sink: (entry) => entries.push(entry) });
+  });
+
+  afterEach(() => {
+    resetLoggerConfig();
+  });
+
+  it('drops an opaque-origin entry from the set and names it in an error log', () => {
+    const explicit = normalizeAppOrigins(CONFIGURED_WITH_OPAQUE_ENTRY);
+
+    expect([...explicit]).toEqual(['https://app.example.com']);
+    expect(explicit.has('null')).toBe(false);
+
+    const dropped = entries.filter((entry) => entry.level === 'error');
+    expect(dropped).toHaveLength(1);
+    expect(dropped[0]?.context?.entry).toBe('exp://localhost:8150');
+    expect(dropped[0]?.message).toContain('no origin to match against');
+  });
+
+  it('drops an entry that is not a URL at all, separately named', () => {
+    const explicit = normalizeAppOrigins(['not a url', 'https://app.example.com']);
+
+    expect([...explicit]).toEqual(['https://app.example.com']);
+    const dropped = entries.filter((entry) => entry.level === 'error');
+    expect(dropped).toHaveLength(1);
+    expect(dropped[0]?.context?.entry).toBe('not a url');
+    expect(dropped[0]?.message).toContain('not a URL');
+  });
+
+  it('VACUITY FLOOR: a wholly valid list is dropped from silently', () => {
+    const explicit = normalizeAppOrigins(['https://app.example.com', 'http://localhost:3000']);
+
+    expect([...explicit].sort()).toEqual(['http://localhost:3000', 'https://app.example.com']);
+    expect(entries.filter((entry) => entry.level === 'error')).toHaveLength(0);
+  });
+});
+
+/**
+ * The MATCH-SIDE half, driven with the hostile precondition the configure side
+ * prevents: a set that already contains the opaque origin. This is the only
+ * way to observe this half — through `createOxyCors` it is unreachable, so a
+ * test there would measure `normalizeAppOrigins` and report on this.
+ */
+describe('matchesAllowedOrigin (match side)', () => {
+  const poisoned: ReadonlySet<string> = new Set(['null', 'https://app.example.com']);
+
+  it('refuses every opaque-scheme origin even against a set containing "null"', () => {
+    for (const origin of [...OTHER_OPAQUE_SCHEME_ORIGINS, 'exp://localhost:8150']) {
+      expect(matchesAllowedOrigin(poisoned, origin)).toBe(false);
+    }
+  });
+
+  it('POSITIVE CONTROL: the same poisoned set still matches its real entry', () => {
+    expect(matchesAllowedOrigin(poisoned, 'https://app.example.com')).toBe(true);
+    expect(matchesAllowedOrigin(poisoned, 'https://auth.oxy.so')).toBe(true);
+    expect(matchesAllowedOrigin(poisoned, 'https://evil.example.com')).toBe(false);
+  });
+
+  it('NEGATIVE CONTROL: a literal `null` never reaches the set lookup either', () => {
+    expect(matchesAllowedOrigin(poisoned, 'null')).toBe(false);
+  });
+});

package/src/server/__tests__/securityHeaders.test.ts

@@ -3,7 +3,10 @@ import {
   buildOxyCspDirectives,
   buildOxyPagesHeaders,
   createOxySecurityHeaders,
+  cspSourcesFor,
+  extractInlineScripts,
   formatOxyCspPolicy,
+  inlineScriptCspHash,
   OXY_CSP_BASELINE,
   type OxyCspExtensions,
 } from '../securityHeaders';
@@ -27,14 +30,11 @@ function renderPolicy(options: Parameters<typeof createOxySecurityHeaders>[0]):
   return headers['Content-Security-Policy'] ?? '';
 }
 
-/** The sources of one directive, parsed back out of the rendered header. */
-function policySources(policy: string, directive: string): string[] {
-  const found = policy
-    .split(';')
-    .map((segment) => segment.trim())
-    .find((segment) => segment === directive || segment.startsWith(`${directive} `));
-  if (found === undefined) return [];
-  return found.split(/\s+/).slice(1);
+/** The CSP value parsed back out of a Cloudflare Pages `_headers` block. */
+function cspOf(block: string): string {
+  const line = block.split('\n').find((entry) => entry.trim().startsWith('Content-Security-Policy:'));
+  if (line === undefined) throw new Error('no Content-Security-Policy line in _headers block');
+  return line.trim().slice('Content-Security-Policy:'.length).trim();
 }
 
 describe('@oxyhq/core/server buildOxyCspDirectives', () => {
@@ -179,12 +179,116 @@ describe('@oxyhq/core/server buildOxyPagesHeaders', () => {
   });
 });
 
+/**
+ * The inline script Expo Router's static export emits, verbatim, and the hash
+ * `accounts.oxy.so` was measured rejecting on 2026-08-21. Pinned as a LITERAL
+ * rather than recomputed: a test that derives the expected value the same way
+ * the code does would pass against any hashing bug they share.
+ */
+const EXPO_HYDRATE_SCRIPT = 'globalThis.__EXPO_ROUTER_HYDRATE__=true;';
+const EXPO_HYDRATE_SHA256 = "'sha256-67fhrP0+BkBqmgGGXTtgiVO/9EQs3QruYNU/7fnRkI8='";
+
+/** A static Expo export's HTML, reduced to the parts that decide the policy. */
+function expoExportHtml(body = EXPO_HYDRATE_SCRIPT): string {
+  return [
+    '<!DOCTYPE html><html><head>',
+    '<script src="/_expo/static/js/web/entry-abc.js" defer></script>',
+    `<script type="module">${body}</script>`,
+    '</head><body><div id="root"></div></body></html>',
+  ].join('');
+}
+
+describe('@oxyhq/core/server extractInlineScripts', () => {
+  it('returns inline bodies and skips external scripts', () => {
+    expect(extractInlineScripts(expoExportHtml())).toEqual([EXPO_HYDRATE_SCRIPT]);
+  });
+
+  it('does not let a ">" inside an attribute value truncate an inline tag', () => {
+    // Truncating here does not throw: the body window shifts right and the hash
+    // is taken over `b'>globalThis…`, which allows nothing. Note the attribute
+    // must precede the body for this to discriminate — an EXTERNAL script whose
+    // `src` comes first is skipped either way, which is why the beacon shape is
+    // not the case under test here.
+    const html = `<script type="module" data-x='a>b'>${EXPO_HYDRATE_SCRIPT}</script>`;
+    expect(extractInlineScripts(html)).toEqual([EXPO_HYDRATE_SCRIPT]);
+  });
+
+  it('still recognizes a src that follows a ">"-bearing attribute', () => {
+    // The mirror failure: truncation hides `src` from the attribute slice, so
+    // an external script is mistaken for an inline one and contributes a hash
+    // over a fragment of its own tag.
+    expect(extractInlineScripts(`<script data-x='a>b' src="/entry.js"></script>`)).toEqual([]);
+  });
+
+  it('hashes the exact bytes, so whitespace changes the source', () => {
+    expect(inlineScriptCspHash(EXPO_HYDRATE_SCRIPT)).toBe(EXPO_HYDRATE_SHA256);
+    expect(inlineScriptCspHash(` ${EXPO_HYDRATE_SCRIPT}`)).not.toBe(EXPO_HYDRATE_SHA256);
+  });
+});
+
+describe('@oxyhq/core/server buildOxyPagesHeaders inline-script hashes', () => {
+  it('allows the built HTML\'s inline script by hash', () => {
+    const block = buildOxyPagesHeaders({ html: [expoExportHtml()] });
+    expect(cspSourcesFor(cspOf(block), 'script-src')).toEqual([
+      "'self'",
+      CLOUDFLARE_SCRIPT_HOST,
+      EXPO_HYDRATE_SHA256,
+    ]);
+  });
+
+  it('emits no hash at all when the build has no inline script', () => {
+    // Negative control for the assertion above: without it, "contains a
+    // sha256-" would be satisfied by a builder that hashed unconditionally.
+    const block = buildOxyPagesHeaders({ html: ['<html><body>nothing inline</body></html>'] });
+    expect(cspOf(block)).not.toContain('sha256-');
+    expect(cspSourcesFor(cspOf(block), 'script-src')).toEqual(["'self'", CLOUDFLARE_SCRIPT_HOST]);
+  });
+
+  it('dedupes one route-per-file export down to a single hash', () => {
+    const block = buildOxyPagesHeaders({
+      html: [expoExportHtml(), expoExportHtml(), expoExportHtml()],
+    });
+    expect(cspOf(block).match(/sha256-/g)).toHaveLength(1);
+  });
+
+  it('keeps per-app extensions and the baseline alongside the hash', () => {
+    const block = buildOxyPagesHeaders({
+      csp: { imgSrc: ['blob:'], connectSrc: ['blob:'] },
+      html: [expoExportHtml()],
+    });
+    expect(cspSourcesFor(cspOf(block), 'img-src')).toContain('blob:');
+    expect(cspSourcesFor(cspOf(block), 'script-src')).toContain(EXPO_HYDRATE_SHA256);
+    expect(cspSourcesFor(cspOf(block), 'script-src')).toContain("'self'");
+  });
+
+  it('never hashes styles, which would disable style-src unsafe-inline', () => {
+    // A style hash would neutralize 'unsafe-inline' and render every
+    // react-native-web app unstyled — the one directive that must stay open.
+    const block = buildOxyPagesHeaders({
+      html: ['<html><head><style>.a{color:red}</style></head></html>'],
+    });
+    expect(cspSourcesFor(cspOf(block), 'style-src')).toEqual(["'self'", "'unsafe-inline'"]);
+    expect(cspOf(block)).not.toContain('sha256-');
+  });
+
+  it('refuses a build whose inline scripts vary per route', () => {
+    // An Expo route loader emits `__EXPO_ROUTER_LOADER_DATA__` with different
+    // bytes per route. The hashes would still be correct; the policy would grow
+    // with the route count. That has to be a decision, so it fails loudly.
+    const perRoute = Array.from({ length: 9 }, (_, index) =>
+      expoExportHtml(`globalThis.__EXPO_ROUTER_LOADER_DATA__={"r":${index}};`),
+    );
+    expect(() => buildOxyPagesHeaders({ html: perRoute })).toThrow(RangeError);
+    expect(() => buildOxyPagesHeaders({ html: perRoute.slice(0, 8) })).not.toThrow();
+  });
+});
+
 describe('@oxyhq/core/server createOxySecurityHeaders', () => {
   it('sends the resolved baseline as a real Content-Security-Policy header', () => {
     const policy = renderPolicy({});
 
-    expect(policySources(policy, 'script-src')).toEqual(["'self'", CLOUDFLARE_SCRIPT_HOST]);
-    expect(policySources(policy, 'connect-src')).toEqual([
+    expect(cspSourcesFor(policy, 'script-src')).toEqual(["'self'", CLOUDFLARE_SCRIPT_HOST]);
+    expect(cspSourcesFor(policy, 'connect-src')).toEqual([
       "'self'",
       CLOUDFLARE_REPORT_HOST,
       'https://api.oxy.so',
@@ -202,7 +306,7 @@ describe('@oxyhq/core/server createOxySecurityHeaders', () => {
       },
     });
 
-    expect(policySources(policy, 'connect-src')).toEqual([
+    expect(cspSourcesFor(policy, 'connect-src')).toEqual([
       "'self'",
       CLOUDFLARE_REPORT_HOST,
       'https://api.oxy.so',
@@ -211,7 +315,7 @@ describe('@oxyhq/core/server createOxySecurityHeaders', () => {
       'https://api.mention.earth',
       'wss://api.mention.earth',
     ]);
-    expect(policySources(policy, 'frame-src')).toEqual([
+    expect(cspSourcesFor(policy, 'frame-src')).toEqual([
       "'self'",
       'https://www.youtube-nocookie.com',
     ]);

package/src/server/cors.ts

@@ -15,6 +15,7 @@
  *     one-label subdomains such as `auth.oxy.so`, `api.oxy.so`,
  *     `accounts.oxy.so`, `console.oxy.so`, and `inbox.oxy.so`,
  *   - allows the caller's explicit `appOrigins`,
+ *   - REFUSES the opaque origin on both sides (see `OPAQUE_ORIGIN`),
  *   - DENIES everything else (no reflection, never a wildcard with credentials),
  *   - echoes back the EXACT matched origin (so credentialed requests work) and
  *     sets `Vary: Origin` for correct caching,
@@ -24,8 +25,11 @@
  */
 
 import type { NextFunction, Request, RequestHandler, Response } from 'express';
+import { createLogger } from '../logger';
 import { CENTRAL_IDP_APEX } from '../utils/authWebUrl';
 
+const log = createLogger('OxyCors');
+
 /** Default HTTP methods allowed across origins. */
 const DEFAULT_ALLOWED_METHODS = ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE', 'OPTIONS'];
 
@@ -52,6 +56,11 @@ export interface OxyCorsOptions {
    * `https://app.example.com`, `http://localhost:3000`). These are allowed IN
    * ADDITION TO the built-in HTTPS Oxy apex origin family. Each is normalized
    * via `new URL().origin`.
+   *
+   * An entry that is not a URL, or whose origin is the opaque origin
+   * (`exp://…`, `capacitor://…`, `chrome-extension://…`, `file:`, `data:`), is
+   * DROPPED with an error log rather than admitted — see `OPAQUE_ORIGIN` for
+   * why one such entry would otherwise admit every other one.
    */
   appOrigins?: string[];
   /**
@@ -94,6 +103,30 @@ function isOxyFamilyOrigin(candidate: string): boolean {
   }
 }
 
+/**
+ * The URL standard's serialization of an OPAQUE origin: the literal string
+ * `"null"`, which `new URL(x).origin` returns for every scheme that has no
+ * origin to speak of — `exp:`, `capacitor:`, `chrome-extension:`,
+ * `vscode-webview:`, and also `file:`, `data:` and `about:`.
+ *
+ * This value is why an allowlist may never store it. Every such scheme
+ * normalizes to the SAME `"null"`, so a set built by normalization cannot tell
+ * them apart: ONE opaque entry admits ALL of them. With credentials on and the
+ * raw header echoed back, a single `myapp://` in `appOrigins` turned this
+ * helper into "allow any custom-scheme browsing context" — measured live, an
+ * `exp://localhost:8150` entry answered `Origin: vscode-webview://…` with
+ * `access-control-allow-origin: vscode-webview://…` and
+ * `access-control-allow-credentials: true`.
+ *
+ * There is deliberately no escape hatch that matches such an origin by raw
+ * string instead. Admitting a custom-scheme browsing context to a CREDENTIALED
+ * allowlist is a distinct decision with its own threat model, and it must not
+ * arrive as a side effect of someone adding one line to `appOrigins`. Note
+ * also that a native client is not subject to CORS at all — React Native sends
+ * no `Origin` header — so a mobile app never needs an entry here.
+ */
+const OPAQUE_ORIGIN = 'null';
+
 /** Normalize a raw origin string to its canonical `scheme://host[:port]` form. */
 function normalizeOrigin(raw: string): string | null {
   try {
@@ -104,21 +137,63 @@ function normalizeOrigin(raw: string): string | null {
 }
 
 /**
- * Build the origin-matching predicate: true iff `origin` is in the built-in
- * HTTPS Oxy apex family OR exactly matches one of the configured app origins.
+ * Normalize the configured `appOrigins` into the exact-match set — the
+ * CONFIGURE-SIDE half of the opaque-origin guard.
+ *
+ * An entry that is not a URL, or whose origin is opaque, is dropped and named
+ * in an error log. Dropped rather than thrown on because `appOrigins` is
+ * deployment configuration — at least one Oxy backend reads it from the
+ * environment — and a typo there must cost that one origin its CORS headers,
+ * never the whole service its boot. Both failure modes are equally SAFE (the
+ * entry is absent from the set either way), so the choice is purely about
+ * blast radius, and dropping keeps it to one origin whose requests then fail
+ * visibly in the browser.
+ *
+ * Exported for `__tests__/cors.socket.test.ts` and NOT re-exported from
+ * `server/index.ts`, so it is not part of the package's public surface. The
+ * two halves of the guard are separately exported because they are separately
+ * testable only that way: with this half in place the match-side half is
+ * unreachable through `createOxyCors`, so a test driving the public API alone
+ * would measure this function twice and the other one never.
  */
-function buildOriginAllowed(appOrigins: string[]): (origin: string) => boolean {
+export function normalizeAppOrigins(appOrigins: string[]): Set<string> {
   const explicit = new Set<string>();
   for (const raw of appOrigins) {
     const normalized = normalizeOrigin(raw);
-    if (normalized) explicit.add(normalized);
+    if (normalized === null) {
+      log.error('CORS allowlist entry ignored: it is not a URL', undefined, { entry: raw });
+      continue;
+    }
+    if (normalized === OPAQUE_ORIGIN) {
+      log.error('CORS allowlist entry ignored: it has no origin to match against', undefined, {
+        entry: raw,
+      });
+      continue;
+    }
+    explicit.add(normalized);
   }
-  return (origin: string): boolean => {
-    const normalized = normalizeOrigin(origin);
-    if (normalized === null) return false;
-    if (explicit.has(normalized)) return true;
-    return isOxyFamilyOrigin(normalized);
-  };
+  return explicit;
+}
+
+/**
+ * Whether `origin` may be echoed back: it is in the built-in HTTPS Oxy apex
+ * family, or it exactly matches one of the configured app origins.
+ *
+ * The opaque-origin refusal here is the MATCH-SIDE half of the guard, and it
+ * is what makes the property hold regardless of how `explicit` was built — a
+ * set that somehow contains `"null"` still matches nothing, because no
+ * incoming origin ever normalizes past this line. `normalizeAppOrigins` is
+ * what stops such a set existing today; this is what stops it mattering.
+ *
+ * Exported for the same reason as `normalizeAppOrigins`, and likewise absent
+ * from `server/index.ts`.
+ */
+export function matchesAllowedOrigin(explicit: ReadonlySet<string>, origin: string): boolean {
+  const normalized = normalizeOrigin(origin);
+  if (normalized === null) return false;
+  if (normalized === OPAQUE_ORIGIN) return false;
+  if (explicit.has(normalized)) return true;
+  return isOxyFamilyOrigin(normalized);
 }
 
 /**
@@ -139,7 +214,7 @@ export function createOxyCors(options: OxyCorsOptions = {}): RequestHandler {
     maxAgeSeconds = DEFAULT_MAX_AGE_SECONDS,
   } = options;
 
-  const isOriginAllowed = buildOriginAllowed(appOrigins);
+  const explicitOrigins = normalizeAppOrigins(appOrigins);
   const methodsHeader = methods.join(', ');
   const allowedHeadersHeader = allowedHeaders.join(', ');
   const exposedHeadersHeader = exposedHeaders.join(', ');
@@ -161,7 +236,7 @@ export function createOxyCors(options: OxyCorsOptions = {}): RequestHandler {
     // Origin is present. Caching correctness: this response varies by Origin.
     res.setHeader('Vary', 'Origin');
 
-    if (!isOriginAllowed(origin)) {
+    if (!matchesAllowedOrigin(explicitOrigins, origin)) {
       // DENY: do NOT reflect the origin, do NOT emit a wildcard. The browser
       // will block the cross-origin read. Preflights for denied origins get a
       // 204 with no CORS headers (the actual request then fails CORS).

package/src/server/index.ts

@@ -71,11 +71,20 @@ export type { OxyCorsOptions } from './cors';
 
 // Shared Helmet + Content-Security-Policy baseline (Cloudflare Insights beacon,
 // Oxy API/CDN origins) with additive, per-app extensions.
+//
+// `extractInlineScripts` / `inlineScriptCspHash` / `cspSourcesFor` are exported
+// so a post-deploy gate can ask the SERVED document and the SERVED policy the
+// same questions `buildOxyPagesHeaders` asked the built ones. A gate that
+// re-implemented the scan or the parse would be testing its own copy, and would
+// agree with a broken original.
 export {
   buildOxyCspDirectives,
   buildOxyPagesHeaders,
   createOxySecurityHeaders,
+  cspSourcesFor,
+  extractInlineScripts,
   formatOxyCspPolicy,
+  inlineScriptCspHash,
   OXY_CSP_BASELINE,
 } from './securityHeaders';
 export type {