@rogatio/cli 6.14.0 → 6.14.2

package/dist/node/index.js

@@ -24445,8 +24445,8 @@ function normalizeMockConfig(value, matcherById) {
     if (!Array.isArray(record.headers) || record.headers.length > LIMITS.maxMockHeadersPerRule)
       return null;
     const normalizedHeaders = [];
-    for (const headerValue3 of record.headers) {
-      const header = normalizeMockHeader(headerValue3);
+    for (const headerValue32 of record.headers) {
+      const header = normalizeMockHeader(headerValue32);
       if (header === null) return null;
       normalizedHeaders.push(header);
     }
@@ -27616,6 +27616,26 @@ async function writeSavedMockRoot(filePath, root, env = process.env) {
 }
 
 // packages/cli/src/server/routes.ts
+function headerValue3(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.length === 1 && typeof value[0] === "string") {
+    return value[0];
+  }
+  return void 0;
+}
+function isAllowedEditorHost(host, boundPort) {
+  if (host === void 0 || !Number.isInteger(boundPort) || boundPort <= 0) {
+    return false;
+  }
+  const expected = String(boundPort);
+  return host === `127.0.0.1:${expected}` || host === `localhost:${expected}`;
+}
+function isAllowedEditorOrigin(origin, boundPort) {
+  if (origin === void 0) return true;
+  if (!Number.isInteger(boundPort) || boundPort <= 0) return false;
+  const expected = String(boundPort);
+  return origin === `http://127.0.0.1:${expected}` || origin === `http://localhost:${expected}`;
+}
 function generateCsrfToken() {
   return randomBytes3(16).toString("hex");
 }
@@ -27739,22 +27759,40 @@ function parseCompilerDiagnostics(result) {
 }
 function createRoutes(context) {
   return async function handleRequest(req, res) {
+    const host = headerValue3(req.headers.host);
+    if (!isAllowedEditorHost(host, context.boundPort)) {
+      res.writeHead(403, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          code: "host-invalid",
+          message: "Invalid Host header"
+        })
+      );
+      return;
+    }
     const { pathname } = parseUrl(req);
     const method = req.method || "GET";
-    const corsHeaders = {
-      "Access-Control-Allow-Origin": "http://127.0.0.1:*",
-      "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-      "Access-Control-Allow-Headers": "Content-Type, X-CSRF-Token"
-    };
+    if (method === "POST") {
+      const origin = headerValue3(req.headers.origin);
+      if (!isAllowedEditorOrigin(origin, context.boundPort)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "origin-invalid",
+            message: "Invalid Origin header"
+          })
+        );
+        return;
+      }
+    }
     if (method === "OPTIONS") {
-      res.writeHead(204, corsHeaders);
+      res.writeHead(204);
       res.end();
       return;
     }
     if (pathname === "/editor.html" && method === "GET") {
       res.writeHead(200, {
-        "Content-Type": "text/html; charset=utf-8",
-        ...corsHeaders
+        "Content-Type": "text/html; charset=utf-8"
       });
       res.end(context.editorHtml);
       return;
@@ -27763,8 +27801,7 @@ function createRoutes(context) {
       try {
         const bundle = await readFile4(context.editorBundlePath, "utf-8");
         res.writeHead(200, {
-          "Content-Type": "text/javascript; charset=utf-8",
-          ...corsHeaders
+          "Content-Type": "text/javascript; charset=utf-8"
         });
         res.end(bundle);
       } catch (e) {
@@ -27782,8 +27819,7 @@ function createRoutes(context) {
       try {
         const css = await readFile4(context.editorCssPath, "utf-8");
         res.writeHead(200, {
-          "Content-Type": "text/css; charset=utf-8",
-          ...corsHeaders
+          "Content-Type": "text/css; charset=utf-8"
         });
         res.end(css);
       } catch (e) {
@@ -27807,8 +27843,7 @@ function createRoutes(context) {
       try {
         const font = await readFile4(resolve2(context.editorFontsPath, fileName));
         res.writeHead(200, {
-          "Content-Type": "font/woff2",
-          ...corsHeaders
+          "Content-Type": "font/woff2"
         });
         res.end(font);
       } catch {
@@ -28177,8 +28212,7 @@ function createRoutes(context) {
         res.writeHead(200, {
           "Content-Type": "text/event-stream",
           "Cache-Control": "no-cache",
-          Connection: "keep-alive",
-          ...corsHeaders
+          Connection: "keep-alive"
         });
         const stream = context.aiClient?.stream(options);
         for await (const chunk of stream) {
@@ -28805,6 +28839,7 @@ async function editCommand(args, options = {}) {
     shutdown: () => {
       shutdown();
     },
+    boundPort: 0,
     editorHtml: "",
     editorBundlePath: "",
     editorCssPath: "",
@@ -28824,6 +28859,7 @@ async function editCommand(args, options = {}) {
     return { exitCode: Promise.resolve(2), shutdown: () => {
     } };
   }
+  context.boundPort = server.port;
   const serverUrl = `http://127.0.0.1:${server.port}`;
   const editorUrl = `${serverUrl}/editor.html`;
   const {
@@ -28950,9 +28986,9 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
       import { createEditor } from '@rogatio/editor';
     
     const root = document.getElementById('editor-root');
-    const apiBase = '${apiBase}';
-    const csrfToken = '${csrfToken}';
-    const filePath = '${filePath}';
+    const apiBase = ${JSON.stringify(apiBase)};
+    const csrfToken = ${JSON.stringify(csrfToken)};
+    const filePath = ${JSON.stringify(filePath)};
     
     async function fetchProject() {
       const res = await fetch(apiBase + '/api/project');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.14.0",
+  "version": "6.14.2",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",