@stonyx/rest-server 0.2.1-alpha.18 → 0.2.1-alpha.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/config/environment.js +17 -0
- package/package.json +1 -1
package/config/environment.js
CHANGED
|
@@ -13,6 +13,23 @@ const config = {
|
|
|
13
13
|
// URL-based authorization cannot be walked past by changing case
|
|
14
14
|
// (abofs/stonyx-rest-server#47). Opt out with REST_CASE_SENSITIVE_ROUTES=false
|
|
15
15
|
// only as a temporary remediation for a client that relies on loose casing.
|
|
16
|
+
//
|
|
17
|
+
// DELIBERATELY NOT PINNED in test/config/environment.ts -- do not "fix" this
|
|
18
|
+
// as part of abofs/stonyx-rest-server#43. This line is the only thing the
|
|
19
|
+
// suite still checks about the SHIPPED default. Inverting it to
|
|
20
|
+
// `=== 'true'` turns AC3, AC4 and AC5 red; AC6 stays GREEN, because AC6
|
|
21
|
+
// stubs `caseSensitiveRoutes` to `undefined` and src/route-matching.ts reads
|
|
22
|
+
// `!== false`, so AC6 guards the source's read and not this default.
|
|
23
|
+
// Measured: pin `caseSensitiveRoutes: true` in test/config/environment.ts AND
|
|
24
|
+
// invert this line, and the suite reports 28 pass / 0 fail. A naive pin makes
|
|
25
|
+
// an insecure published default completely invisible to a green suite --
|
|
26
|
+
// quieter and weaker, which is the outcome pinning was supposed to prevent.
|
|
27
|
+
//
|
|
28
|
+
// The cost of leaving it unpinned is that the suite is ambient-sensitive here
|
|
29
|
+
// (`REST_CASE_SENSITIVE_ROUTES=false pnpm test` => 25 pass / 3 fail), but it
|
|
30
|
+
// fails LOUDLY, so there is no false green. Closing #43 for this key needs
|
|
31
|
+
// the subprocess-based env isolation this repo does not yet have; any fix
|
|
32
|
+
// must keep a live assertion on this default.
|
|
16
33
|
caseSensitiveRoutes: REST_CASE_SENSITIVE_ROUTES !== 'false',
|
|
17
34
|
enableHealthCheck: REST_HEALTH_CHECK_DISABLE !== 'true',
|
|
18
35
|
origin: REST_CORS_ORIGIN ?? '*',
|