@selvajs/cli 4.14.1 → 4.14.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/cli",
-  "version": "4.14.1",
+  "version": "4.14.2",
   "description": "Scaffold and operate a Selva white-label deployment. `npx @selvajs/cli <dir>` to bootstrap, `selva <cmd>` to manage.",
   "license": "MIT",
   "author": "VektorNode",

package/src/checks/config.js

@@ -232,6 +232,60 @@ export function checkBodySizeLimit(env) {
 	return green(`BODY_SIZE_LIMIT=${raw}`);
 }
 
+/**
+ * `ADDRESS_HEADER` / `XFF_DEPTH` are read by adapter-node, not by Selva, and
+ * unset they are invisible: nothing fails, nothing logs, and the deployment
+ * looks healthy.
+ *
+ * What actually happens is that `getClientAddress()` returns the socket peer,
+ * which behind a reverse proxy is the proxy — `127.0.0.1` for every request
+ * from every user. Login rate limiting keys on that, so the whole instance
+ * shares one bucket: five failed logins from anywhere return 429 to everyone,
+ * and only a *successful* login clears a bucket, which nobody can then reach.
+ *
+ * `ORIGIN` is the proxy tell. It is only needed when the app is served under a
+ * public URL it can't derive from its own socket, so its presence means a proxy
+ * is terminating requests. Without it we say nothing: on a directly-reachable
+ * app these settings are a footgun, since `X-Forwarded-For` is client-supplied
+ * and anyone could then pick their own rate-limit bucket.
+ */
+export function checkClientAddress(env) {
+	const header = env.ADDRESS_HEADER;
+	const depth = env.XFF_DEPTH;
+
+	if (!env.ORIGIN) {
+		// No proxy signal — nothing to advise either way.
+		return green('ADDRESS_HEADER not needed (no ORIGIN, so no reverse proxy)');
+	}
+
+	if (!header) {
+		return red(
+			`ADDRESS_HEADER unset while ORIGIN is set — every request looks like it came from ` +
+				`the proxy, so all users share ONE login rate-limit bucket. Five failed logins ` +
+				`from anyone locks out the whole instance for 15 minutes. ` +
+				`Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH=<number of proxies>.`
+		);
+	}
+
+	if (header.toLowerCase() === 'x-forwarded-for' && !depth) {
+		return yellow(
+			`ADDRESS_HEADER=${header} but XFF_DEPTH is unset. X-Forwarded-For is a ` +
+				`client-appendable list, so a caller can prepend fake entries — adapter-node ` +
+				`needs the proxy count to know which entry is real. Set XFF_DEPTH=1 for a ` +
+				`single reverse proxy, 2 if a CDN or load balancer sits in front of it.`
+		);
+	}
+
+	if (depth !== undefined && !/^[1-9][0-9]*$/.test(depth)) {
+		return red(
+			`XFF_DEPTH="${depth}" is not a positive integer — it counts proxies from the ` +
+				`outside in. Use 1 for a single reverse proxy.`
+		);
+	}
+
+	return green(`ADDRESS_HEADER=${header}${depth ? ` (XFF_DEPTH=${depth})` : ''}`);
+}
+
 // A rename is auto-fixable (`selva migrate` rewrites the key). A replacement
 // encodes a value in the new name, so migrate leaves it alone rather than
 // guessing — it's reported here and nowhere else.

package/src/commands/create.js

@@ -127,9 +127,14 @@ function nextSteps({ rawDir, values, supabase }) {
 	if (supabase) {
 		lines.push(
 			`  ${n++}. Apply the database schema (once per Supabase project):`,
+			pc.dim('       npx supabase login          # or: export SUPABASE_ACCESS_TOKEN=sbp_...'),
 			pc.dim('       npx selva-supabase          # copy migrations into ./supabase'),
 			pc.dim('       npx supabase link --project-ref <ref>'),
-			pc.dim('       npx supabase db push')
+			pc.dim('       npx supabase db push'),
+			// `link` fails without an ACCOUNT credential, which is none of the three
+			// project keys the prompts just collected — the distinction is the most
+			// common first-run stall, so name it here rather than only in the docs.
+			pc.dim('       (login is a Supabase account credential — not the keys in .env)')
 		);
 	}
 

package/src/commands/doctor.js

@@ -28,6 +28,7 @@ import { checkBootPersistence } from '../checks/boot.js';
 import { checkRuntimeEnvironment } from '../checks/runtime.js';
 import {
 	checkBodySizeLimit,
+	checkClientAddress,
 	checkDeprecatedEnv,
 	checkEnvDocumentation,
 	checkHeaderNames,
@@ -84,6 +85,7 @@ export async function runDoctor(argv = []) {
 	checks.push(...checkBootPersistence(dir));
 	checks.push(checkOrigin(env));
 	checks.push(checkBodySizeLimit(env));
+	checks.push(checkClientAddress(env));
 	checks.push(...checkDeprecatedEnv(env));
 	checks.push(checkEnvDocs(dir));
 
@@ -265,7 +267,7 @@ async function checkSupabaseMigrations(dir, env) {
 		clearTimeout(timer);
 		if (res.status === 404) {
 			return red(
-				`Database is missing selva.migration_head() — migrations are pending (expected head ${expected}). Sync + run: npx supabase db push`
+				`Database is missing selva.migration_head() — migrations are pending (expected head ${expected}). Run: npx selva-supabase && npx supabase db push`
 			);
 		}
 		if (!res.ok) {
@@ -274,13 +276,13 @@ async function checkSupabaseMigrations(dir, env) {
 		const actual = String((await res.json()) ?? '');
 		if (!actual) {
 			return red(
-				`Database reports no applied migrations (expected head ${expected}). Sync + run: npx supabase db push`
+				`Database reports no applied migrations (expected head ${expected}). Run: npx selva-supabase && npx supabase db push`
 			);
 		}
 		// String comparison — relies on both heads being fixed-width, zero-padded timestamps.
 		if (actual < expected) {
 			return red(
-				`Database migration head ${actual} is behind the installed provider (${expected}). Sync + run: npx supabase db push`
+				`Database migration head ${actual} is behind the installed provider (${expected}). Run: npx selva-supabase && npx supabase db push`
 			);
 		}
 		return green(`Database migration head ${actual} matches the installed provider`);

package/src/commands/proxy.js

@@ -128,6 +128,22 @@ export async function runSetupProxy(argv = []) {
 		return;
 	}
 
+	// Caddy sets X-Forwarded-For on its own, but the app ignores it unless told
+	// to trust it — and unset, every request looks like it came from Caddy, so
+	// all users share one login rate-limit bucket. Nothing fails visibly, which
+	// is why it is said here rather than left to the docs.
+	if (!env.ADDRESS_HEADER) {
+		p.log.warn(
+			`Add these to .env, then \`selva restart\`:\n` +
+				pc.cyan('  ADDRESS_HEADER=X-Forwarded-For\n  XFF_DEPTH=1\n') +
+				pc.dim(
+					'Without them the app sees every request as coming from Caddy, so one\n' +
+						'user failing five logins rate-limits everyone. Use XFF_DEPTH=2 if a CDN\n' +
+						'or load balancer sits in front of Caddy.'
+				)
+		);
+	}
+
 	p.outro(
 		[
 			pc.green(`Caddy is serving ${domain}.`),

package/src/deployment-package.js

@@ -71,7 +71,7 @@ const DEPENDENCIES = {
  * without this. Its migration SQL is not: `@selvajs/selva` publishes only
  * `build` + `templates`, while the SQL and the `selva-supabase` bin ship in
  * this package's own tarball. Without it, a deployment has no way to reach the
- * schema it needs — `npx selva-supabase sync-migrations` resolves nothing and
+ * schema it needs — `npx selva-supabase` resolves nothing and
  * `doctor`'s migration-head check finds no directory to compare against.
  */
 export const SUPABASE_DEPENDENCIES = {