@podosoft/podokit 0.16.3 → 0.16.4

package/dist/deploy-profile.d.ts

@@ -30,6 +30,9 @@ export interface VerificationCheckProfile {
     expectedStatus: number;
     expectedJson?: Record<string, string | number | boolean | null>;
 }
+export interface MigrationProfile {
+    command: string[];
+}
 export interface DeployProfileV1 {
     schemaVersion: 1;
     driver: "kubernetes-helm";
@@ -67,6 +70,7 @@ export interface DeployProfileV1 {
         web: NamedSecretProfile | null;
         imagePull: string;
     };
+    migration?: MigrationProfile;
     runtimeConfig: Record<string, string>;
     verification: {
         baseUrl: string;

package/dist/deploy-profile.js

@@ -83,6 +83,20 @@ function parseRequiredKeys(value, field) {
     }
     return keys.sort();
 }
+function parseCommand(value, field) {
+    if (!Array.isArray(value) || value.length === 0) {
+        throw new Error(`Deployment profile field "${field}" must be a non-empty string array.`);
+    }
+    return value.map((entry, index) => {
+        if (typeof entry !== "string" || entry.trim() === "") {
+            throw new Error(`Deployment profile field "${field}[${index}]" must be a non-empty string.`);
+        }
+        if (/[\u0000-\u001f\u007f]/.test(entry)) {
+            throw new Error(`Deployment profile field "${field}[${index}]" must not contain control characters.`);
+        }
+        return entry;
+    });
+}
 function parseNamedSecret(value, field) {
     if (!isRecord(value)) {
         throw new Error(`Deployment profile field "${field}" must be an object.`);
@@ -221,6 +235,7 @@ function parseProfile(value) {
         "workloads",
         "dependencies",
         "secrets",
+        "migration",
         "runtimeConfig",
         "verification",
     ], "root");
@@ -236,6 +251,7 @@ function parseProfile(value) {
     const workloads = requiredRecord(value, "workloads");
     const dependencies = requiredRecord(value, "dependencies");
     const secrets = requiredRecord(value, "secrets");
+    const migration = value.migration === undefined ? undefined : requiredRecord(value, "migration");
     const verification = requiredRecord(value, "verification");
     const runtimeConfig = requiredRecord(value, "runtimeConfig");
     assertOnlyKeys(target, ["context", "clusterFingerprint", "namespace", "release", "createNamespace"], "target");
@@ -244,6 +260,8 @@ function parseProfile(value) {
     assertOnlyKeys(workloads, ["api", "web", "worker"], "workloads");
     assertOnlyKeys(dependencies, ["postgres", "redis", "objectStorage"], "dependencies");
     assertOnlyKeys(secrets, ["api", "web", "imagePull"], "secrets");
+    if (migration)
+        assertOnlyKeys(migration, ["command"], "migration");
     assertOnlyKeys(verification, ["baseUrl", "checks"], "verification");
     const context = requiredString(target, "context");
     const clusterFingerprint = requiredString(target, "clusterFingerprint");
@@ -402,6 +420,9 @@ function parseProfile(value) {
                 : parseNamedSecret(secrets.web, "secrets.web"),
             imagePull: requiredString(secrets, "imagePull"),
         },
+        ...(migration
+            ? { migration: { command: parseCommand(migration.command, "migration.command") } }
+            : {}),
         runtimeConfig: parsedConfig,
         verification: { baseUrl, checks },
     };

package/dist/deploy-render.js

@@ -8,6 +8,14 @@ const deploy_profile_1 = require("./deploy-profile");
 function quote(value) {
     return JSON.stringify(value);
 }
+function yamlScalar(value) {
+    return /^(?!null$|true$|false$|~$)[A-Za-z_][A-Za-z0-9_./:-]*$/i.test(value)
+        ? value
+        : quote(value);
+}
+function yamlStringSequence(values) {
+    return `[${values.map((value) => yamlScalar(value)).join(", ")}]`;
+}
 function digest(parts) {
     const hash = (0, node_crypto_1.createHash)("sha256");
     for (const part of parts)
@@ -571,6 +579,7 @@ function migrationRuntimeEnv(profile) {
 }
 function migrationManifest(profile, release, images) {
     const releaseSlug = release.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+    const command = profile.migration?.command ?? ["npm", "run", "migrate:all"];
     return `apiVersion: batch/v1
 kind: Job
 metadata:
@@ -596,7 +605,7 @@ ${labels(`${profile.target.release}-migration`, 8)}    spec:
         - name: migrate
           image: ${quote(images.api)}
           imagePullPolicy: IfNotPresent
-          command: [npm, run, migrate:all]
+          command: ${yamlStringSequence(command)}
           env:
 ${migrationRuntimeEnv(profile)}
           envFrom:

package/dist/templates/fullstack-nest-svelte/apps/web/package.json

@@ -8,7 +8,7 @@
     "build": "vite build",
     "preview": "vite preview",
     "lint": "svelte-check --tsconfig ./tsconfig.json",
-    "test": "echo \"unit: add vitest; e2e: npm run test:e2e (see tests/)\" && exit 0"
+    "test": "vitest run"
   },
   "dependencies": {
     "@internationalized/date": "^3.12.2",
@@ -32,6 +32,7 @@
     "typesafe-i18n": "^5.26.2",
     "typescript": "^6.0.3",
     "vite": "^5.4.0",
+    "vitest": "^4.1.10",
     "tw-animate-css": "^1.4.0"
   }
 }

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/server/api.ts

@@ -1,12 +1,12 @@
 import type { RequestEvent } from "@sveltejs/kit";
 import { createApiClient, type ApiClient } from "@podosoft/podokit-api-client";
-import { backendBaseUrl, normalizeClientIp } from "./backend-proxy";
+import { backendBaseUrl, resolveClientIp } from "./backend-proxy";
 
 // Server-side client for load functions and hooks: points at the internal
 // backend URL and forwards the incoming request's cookies.
 export function serverApiClient(event: RequestEvent): ApiClient {
   const cookie = event.request.headers.get("cookie") ?? "";
-  const clientIp = normalizeClientIp(event.getClientAddress());
+  const clientIp = resolveClientIp(event.getClientAddress);
   const fetchWithCookies: typeof fetch = (input, init) => {
     const headers = new Headers(init?.headers);
     if (cookie) headers.set("cookie", cookie);

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/server/backend-proxy.test.ts

@@ -0,0 +1,58 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { proxyRequest, resolveClientIp } from "./backend-proxy";
+
+describe("backend proxy client address handling", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("returns the normalized address from a trusted proxy chain", () => {
+    expect(resolveClientIp(() => "::ffff:203.0.113.9")).toBe("203.0.113.9");
+  });
+
+  it("omits the address when the proxy header is absent", () => {
+    expect(
+      resolveClientIp(() => {
+        throw new Error("address header is absent");
+      }),
+    ).toBeUndefined();
+  });
+
+  it("omits the address when the proxy chain is too short", () => {
+    expect(
+      resolveClientIp(() => {
+        throw new Error("configured depth exceeds address count");
+      }),
+    ).toBeUndefined();
+  });
+
+  it("does not trust an incoming forwarded header as a fallback", async () => {
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, { status: 204 });
+    });
+
+    const request = new Request("http://app.localhost/api/health", {
+      headers: { "x-forwarded-for": "198.51.100.25" },
+    });
+    const response = await proxyRequest(request, "http://api:5002/health");
+
+    expect(response.status).toBe(204);
+    expect(upstreamHeaders?.get("x-forwarded-for")).toBeNull();
+  });
+
+  it("forwards a resolved client address", async () => {
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, { status: 204 });
+    });
+
+    const request = new Request("http://app.localhost/api/health");
+    const response = await proxyRequest(request, "http://api:5002/health", "203.0.113.9");
+
+    expect(response.status).toBe(204);
+    expect(upstreamHeaders?.get("x-forwarded-for")).toBe("203.0.113.9");
+  });
+});

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/server/backend-proxy.ts

@@ -19,6 +19,15 @@ export function normalizeClientIp(address: string | undefined): string | undefin
   return address;
 }
 
+export function resolveClientIp(getClientAddress: () => string): string | undefined {
+  try {
+    return normalizeClientIp(getClientAddress());
+  } catch {
+    // An absent or shorter-than-configured proxy chain is not a trusted source.
+    return undefined;
+  }
+}
+
 export async function proxyRequest(
   request: Request,
   targetUrl: string,

package/dist/templates/fullstack-nest-svelte/apps/web/src/routes/api/[...path]/+server.ts

@@ -1,9 +1,13 @@
 import type { RequestHandler } from "@sveltejs/kit";
-import { backendBaseUrl, proxyRequest } from "$lib/server/backend-proxy";
+import { backendBaseUrl, proxyRequest, resolveClientIp } from "$lib/server/backend-proxy";
 
 // Proxy the app's REST API, stripping the /api prefix (backend routes are at root).
 const handler: RequestHandler = ({ request, params, url, getClientAddress }) =>
-  proxyRequest(request, `${backendBaseUrl()}/${params.path}${url.search}`, getClientAddress());
+  proxyRequest(
+    request,
+    `${backendBaseUrl()}/${params.path}${url.search}`,
+    resolveClientIp(getClientAddress),
+  );
 
 export const GET = handler;
 export const POST = handler;

package/dist/templates/fullstack-nest-svelte/apps/web/src/routes/api/auth/[...all]/+server.ts

@@ -1,9 +1,13 @@
 import type { RequestHandler } from "@sveltejs/kit";
-import { backendBaseUrl, proxyRequest } from "$lib/server/backend-proxy";
+import { backendBaseUrl, proxyRequest, resolveClientIp } from "$lib/server/backend-proxy";
 
 // Proxy the better-auth handler, keeping the /api/auth prefix.
 const handler: RequestHandler = ({ request, params, url, getClientAddress }) =>
-  proxyRequest(request, `${backendBaseUrl()}/api/auth/${params.all}${url.search}`, getClientAddress());
+  proxyRequest(
+    request,
+    `${backendBaseUrl()}/api/auth/${params.all}${url.search}`,
+    resolveClientIp(getClientAddress),
+  );
 
 export const GET = handler;
 export const POST = handler;

package/dist/templates/todo/apps/web/package.json

@@ -8,7 +8,7 @@
     "build": "vite build",
     "preview": "vite preview",
     "lint": "svelte-check --tsconfig ./tsconfig.json",
-    "test": "echo \"unit: add vitest; e2e: npm run test:e2e (see tests/)\" && exit 0"
+    "test": "vitest run"
   },
   "dependencies": {
     "@internationalized/date": "^3.12.2",
@@ -32,6 +32,7 @@
     "typesafe-i18n": "^5.26.2",
     "typescript": "^6.0.3",
     "vite": "^5.4.0",
+    "vitest": "^4.1.10",
     "tw-animate-css": "^1.4.0"
   }
 }

package/dist/templates/todo/apps/web/src/lib/server/api.ts

@@ -1,12 +1,12 @@
 import type { RequestEvent } from "@sveltejs/kit";
 import { createApiClient, type ApiClient } from "@podosoft/podokit-api-client";
-import { backendBaseUrl, normalizeClientIp } from "./backend-proxy";
+import { backendBaseUrl, resolveClientIp } from "./backend-proxy";
 
 // Server-side client for load functions and hooks: points at the internal
 // backend URL and forwards the incoming request's cookies.
 export function serverApiClient(event: RequestEvent): ApiClient {
   const cookie = event.request.headers.get("cookie") ?? "";
-  const clientIp = normalizeClientIp(event.getClientAddress());
+  const clientIp = resolveClientIp(event.getClientAddress);
   const fetchWithCookies: typeof fetch = (input, init) => {
     const headers = new Headers(init?.headers);
     if (cookie) headers.set("cookie", cookie);

package/dist/templates/todo/apps/web/src/lib/server/backend-proxy.test.ts

@@ -0,0 +1,58 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { proxyRequest, resolveClientIp } from "./backend-proxy";
+
+describe("backend proxy client address handling", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("returns the normalized address from a trusted proxy chain", () => {
+    expect(resolveClientIp(() => "::ffff:203.0.113.9")).toBe("203.0.113.9");
+  });
+
+  it("omits the address when the proxy header is absent", () => {
+    expect(
+      resolveClientIp(() => {
+        throw new Error("address header is absent");
+      }),
+    ).toBeUndefined();
+  });
+
+  it("omits the address when the proxy chain is too short", () => {
+    expect(
+      resolveClientIp(() => {
+        throw new Error("configured depth exceeds address count");
+      }),
+    ).toBeUndefined();
+  });
+
+  it("does not trust an incoming forwarded header as a fallback", async () => {
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, { status: 204 });
+    });
+
+    const request = new Request("http://app.localhost/api/health", {
+      headers: { "x-forwarded-for": "198.51.100.25" },
+    });
+    const response = await proxyRequest(request, "http://api:5002/health");
+
+    expect(response.status).toBe(204);
+    expect(upstreamHeaders?.get("x-forwarded-for")).toBeNull();
+  });
+
+  it("forwards a resolved client address", async () => {
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, { status: 204 });
+    });
+
+    const request = new Request("http://app.localhost/api/health");
+    const response = await proxyRequest(request, "http://api:5002/health", "203.0.113.9");
+
+    expect(response.status).toBe(204);
+    expect(upstreamHeaders?.get("x-forwarded-for")).toBe("203.0.113.9");
+  });
+});

package/dist/templates/todo/apps/web/src/lib/server/backend-proxy.ts

@@ -19,6 +19,15 @@ export function normalizeClientIp(address: string | undefined): string | undefin
   return address;
 }
 
+export function resolveClientIp(getClientAddress: () => string): string | undefined {
+  try {
+    return normalizeClientIp(getClientAddress());
+  } catch {
+    // An absent or shorter-than-configured proxy chain is not a trusted source.
+    return undefined;
+  }
+}
+
 export async function proxyRequest(
   request: Request,
   targetUrl: string,

package/dist/templates/todo/apps/web/src/routes/api/[...path]/+server.ts

@@ -1,9 +1,13 @@
 import type { RequestHandler } from "@sveltejs/kit";
-import { backendBaseUrl, proxyRequest } from "$lib/server/backend-proxy";
+import { backendBaseUrl, proxyRequest, resolveClientIp } from "$lib/server/backend-proxy";
 
 // Proxy the app's REST API, stripping the /api prefix (backend routes are at root).
 const handler: RequestHandler = ({ request, params, url, getClientAddress }) =>
-  proxyRequest(request, `${backendBaseUrl()}/${params.path}${url.search}`, getClientAddress());
+  proxyRequest(
+    request,
+    `${backendBaseUrl()}/${params.path}${url.search}`,
+    resolveClientIp(getClientAddress),
+  );
 
 export const GET = handler;
 export const POST = handler;

package/dist/templates/todo/apps/web/src/routes/api/auth/[...all]/+server.ts

@@ -1,9 +1,13 @@
 import type { RequestHandler } from "@sveltejs/kit";
-import { backendBaseUrl, proxyRequest } from "$lib/server/backend-proxy";
+import { backendBaseUrl, proxyRequest, resolveClientIp } from "$lib/server/backend-proxy";
 
 // Proxy the better-auth handler, keeping the /api/auth prefix.
 const handler: RequestHandler = ({ request, params, url, getClientAddress }) =>
-  proxyRequest(request, `${backendBaseUrl()}/api/auth/${params.all}${url.search}`, getClientAddress());
+  proxyRequest(
+    request,
+    `${backendBaseUrl()}/api/auth/${params.all}${url.search}`,
+    resolveClientIp(getClientAddress),
+  );
 
 export const GET = handler;
 export const POST = handler;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {