@revealui/core 0.14.7 → 0.15.0

package/dist/session-cookie-domain.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Session cookie domain for a request host (GAP-343).
+ *
+ * Staging hosts always resolve to `staging.revealui.com` so a production
+ * `SESSION_COOKIE_DOMAIN` (for example `.revealui.com`) is not attached to
+ * the staging subtree. Every other host returns `configuredDomain` unchanged.
+ * This function does not read the environment and does not apply the
+ * production-only gate. Callers keep that gate.
+ */
+/** Cookie Domain attribute for the staging.revealui.com subtree. No leading dot. */
+export declare const STAGING_SESSION_COOKIE_DOMAIN = "staging.revealui.com";
+/**
+ * Hostname from a Host or X-Forwarded-Host value.
+ * Strips a scheme, path, trailing dot, and numeric port. Uses the first
+ * comma-separated entry. Returns null when nothing usable remains.
+ * String methods only (no regular expressions).
+ */
+export declare function normalizeRequestHost(raw: string | null | undefined): string | null;
+/**
+ * True for `staging.revealui.com` and any host under `*.staging.revealui.com`.
+ * Label-boundary match: `evilstaging.revealui.com` and
+ * `staging.revealui.com.evil.com` are not staging hosts.
+ */
+export declare function isStagingRevealHost(requestHost: string | null | undefined): boolean;
+/**
+ * Cookie Domain for this request.
+ *
+ * Staging hosts return `staging.revealui.com` even when `configuredDomain`
+ * is the production domain or unset. Every other host, including a missing
+ * host, returns `configuredDomain` exactly (including `undefined`).
+ */
+export declare function sessionCookieDomainForHost(requestHost: string | null | undefined, configuredDomain: string | undefined): string | undefined;
+/**
+ * Public request host. Prefer `Host` so a client-supplied `X-Forwarded-Host`
+ * cannot override the host the platform already set. Fall back to
+ * `X-Forwarded-Host` only when `Host` is absent.
+ */
+export declare function requestHostFromHeaders(getHeader: (name: string) => string | null | undefined): string | null;
+//# sourceMappingURL=session-cookie-domain.d.ts.map

package/dist/session-cookie-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie-domain.d.ts","sourceRoot":"","sources":["../src/session-cookie-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAEpE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CA0ClF;AAUD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAKnF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,GAAG,SAAS,CAKpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GACrD,MAAM,GAAG,IAAI,CAMf"}

package/dist/session-cookie-domain.js

@@ -0,0 +1,106 @@
+/**
+ * Session cookie domain for a request host (GAP-343).
+ *
+ * Staging hosts always resolve to `staging.revealui.com` so a production
+ * `SESSION_COOKIE_DOMAIN` (for example `.revealui.com`) is not attached to
+ * the staging subtree. Every other host returns `configuredDomain` unchanged.
+ * This function does not read the environment and does not apply the
+ * production-only gate. Callers keep that gate.
+ */
+/** Cookie Domain attribute for the staging.revealui.com subtree. No leading dot. */
+export const STAGING_SESSION_COOKIE_DOMAIN = 'staging.revealui.com';
+/**
+ * Hostname from a Host or X-Forwarded-Host value.
+ * Strips a scheme, path, trailing dot, and numeric port. Uses the first
+ * comma-separated entry. Returns null when nothing usable remains.
+ * String methods only (no regular expressions).
+ */
+export function normalizeRequestHost(raw) {
+    if (raw == null)
+        return null;
+    let value = raw.trim().toLowerCase();
+    if (value.length === 0)
+        return null;
+    const comma = value.indexOf(',');
+    if (comma !== -1) {
+        value = value.slice(0, comma).trim();
+    }
+    if (value.length === 0)
+        return null;
+    const scheme = value.indexOf('://');
+    if (scheme !== -1) {
+        value = value.slice(scheme + 3);
+    }
+    const slash = value.indexOf('/');
+    if (slash !== -1) {
+        value = value.slice(0, slash);
+    }
+    if (value.startsWith('[')) {
+        const end = value.indexOf(']');
+        if (end === -1)
+            return null;
+        const bracketed = value.slice(0, end + 1);
+        return bracketed.length > 2 ? bracketed : null;
+    }
+    const colon = value.lastIndexOf(':');
+    if (colon !== -1) {
+        const port = value.slice(colon + 1);
+        if (port.length > 0 && isAllDigits(port)) {
+            value = value.slice(0, colon);
+        }
+    }
+    if (value.endsWith('.')) {
+        value = value.slice(0, -1);
+    }
+    if (value.length === 0)
+        return null;
+    return value;
+}
+function isAllDigits(value) {
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 48 || code > 57)
+            return false;
+    }
+    return true;
+}
+/**
+ * True for `staging.revealui.com` and any host under `*.staging.revealui.com`.
+ * Label-boundary match: `evilstaging.revealui.com` and
+ * `staging.revealui.com.evil.com` are not staging hosts.
+ */
+export function isStagingRevealHost(requestHost) {
+    const host = normalizeRequestHost(requestHost);
+    if (!host)
+        return false;
+    if (host === STAGING_SESSION_COOKIE_DOMAIN)
+        return true;
+    return host.endsWith(`.${STAGING_SESSION_COOKIE_DOMAIN}`);
+}
+/**
+ * Cookie Domain for this request.
+ *
+ * Staging hosts return `staging.revealui.com` even when `configuredDomain`
+ * is the production domain or unset. Every other host, including a missing
+ * host, returns `configuredDomain` exactly (including `undefined`).
+ */
+export function sessionCookieDomainForHost(requestHost, configuredDomain) {
+    if (isStagingRevealHost(requestHost)) {
+        return STAGING_SESSION_COOKIE_DOMAIN;
+    }
+    return configuredDomain;
+}
+/**
+ * Public request host. Prefer `Host` so a client-supplied `X-Forwarded-Host`
+ * cannot override the host the platform already set. Fall back to
+ * `X-Forwarded-Host` only when `Host` is absent.
+ */
+export function requestHostFromHeaders(getHeader) {
+    const host = getHeader('host');
+    if (typeof host === 'string' && host.trim().length > 0)
+        return host;
+    const forwarded = getHeader('x-forwarded-host');
+    if (typeof forwarded === 'string' && forwarded.trim().length > 0)
+        return forwarded;
+    return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/core",
-  "version": "0.14.7",
+  "version": "0.15.0",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
@@ -23,8 +23,8 @@
     "pg": "^8.22.0",
     "yjs": "^13.6.31",
     "zod": "^4.4.3",
-    "@revealui/contracts": "0.11.0",
-    "@revealui/presentation": "0.14.7",
+    "@revealui/contracts": "0.12.0",
+    "@revealui/presentation": "0.14.8",
     "@revealui/resilience": "0.2.4",
     "@revealui/security": "0.8.2",
     "@revealui/utils": "0.3.6"
@@ -66,6 +66,11 @@
       "import": "./dist/deployment-mode.js",
       "default": "./dist/deployment-mode.js"
     },
+    "./session-cookie-domain": {
+      "types": "./dist/session-cookie-domain.d.ts",
+      "import": "./dist/session-cookie-domain.js",
+      "default": "./dist/session-cookie-domain.js"
+    },
     "./margin-governor": {
       "types": "./dist/margin-governor.d.ts",
       "import": "./dist/margin-governor.js",