@stonyx/rest-server 0.2.1-alpha.22 → 0.2.1-alpha.24

package/README.md

@@ -81,23 +81,30 @@ Configuration is read from `stonyx/config` under `restServer`:
 | `enableHealthCheck` |   **Boolean**     | `true`      | Register `GET /health` endpoint (disable via `REST_HEALTH_CHECK_DISABLE=true`) |
 | `caseSensitiveRoutes` | **Boolean**   | `true`      | Match route paths case-sensitively. Disable via `REST_CASE_SENSITIVE_ROUTES=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**. |
 | `strictRoutes`    | **Boolean**   | `true`      | Match route paths strictly, so a trailing slash does not match a route registered without one. Disable via `REST_STRICT_ROUTES=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**, and note `GET /health/` now 404s. |
+| `canonicalRoutes` | **Boolean**   | `true`      | Reject a request whose raw target is not the canonical path express matched, before your `auth` hook runs. Disable via `REST_CANONICAL_ROUTES=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**, and note `GET /route/` at a mount root and **every** absolute-form request target now 404. |
 |  `trustProxy`   |     **Boolean**     | `false`     | Trust reverse proxy headers (e.g. `X-Forwarded-Proto`). Enable via `REST_TRUST_PROXY=true` when running behind a load balancer such as AWS ALB/ELB to ensure correct protocol detection. |
 |    `statusMap`    |      **Object**     | `{}`        | Optional mapping of HTTP status codes to custom messages   |
 
 ### Route Matching Strictness
 
-Routes match **case-sensitively and strictly by default**. Two settings, both
-on, both applied at both express construction sites:
+Routes match **case-sensitively, strictly, and only at their canonical target
+by default**. Three controls, all on:
 
-| axis | setting | example that no longer matches |
+| axis | control | example that no longer matches |
 |---|---|---|
-| casing | `case sensitive routing` | `GET /users/Success` -> does not reach `/success` |
-| trailing slash | `strict routing` | `GET /users/success/` -> does not reach `/success` |
+| casing | `case sensitive routing` (setting) | `GET /users/Success` -> does not reach `/success` |
+| trailing slash | `strict routing` (setting) | `GET /users/success/` -> does not reach `/success` |
+| canonical target | `canonicalRoutes` (per-request check) | `GET /users/` and `GET http://host/users` -> do not reach the mounted `/users` class |
+
+The first two are express settings applied at both construction sites. The
+third is **not a setting** — no express setting can express it — it is a
+per-request comparison of the raw request target against the path express
+matched, run ahead of your `auth` hook. See
+[`src/route-matching.ts`](src/route-matching.ts).
 
 Read [What this does not do](#what-this-does-not-do) and
-[Upgrading](#upgrading-behaviour-changes) before you rely on that. Two things
-the table does not say: "does not reach the handler" is not the same as "404",
-and one edge of the trailing-slash axis is **not** closed and cannot be.
+[Upgrading](#upgrading-behaviour-changes) before you rely on that. One thing the
+table does not say: "does not reach the handler" is not the same as "404".
 
 This is deliberate and security-relevant. Express matches both case-insensitively
 and slash-insensitively by default, which means any authorization written
@@ -128,11 +135,10 @@ be the exact registered spelling, in the exact registered casing, with no
 trailing slash. That closes [#47](https://github.com/abofs/stonyx-rest-server/issues/47)
 and [#50](https://github.com/abofs/stonyx-rest-server/issues/50).
 
-#### What this does not do
+#### The canonical-target check (`canonicalRoutes`)
 
-**It does not close the trailing slash on a mount root, and no setting can.**
-This is the one edge that remains open, so do not read the section above as
-closing the class outright:
+**No express *setting* closes the trailing slash on a mount root**, and that has
+not changed:
 
 ```
 GET /public   -> req.path '/'   req.originalUrl '/public'
@@ -140,13 +146,47 @@ GET /public/  -> req.path '/'   req.originalUrl '/public/'
 ```
 
 Express's router applies mount-prefix matching with `strict: false`
-unconditionally (`router@2.2.0`, `index.js:400-401`), so both forms reach the
-mounted route class and both arrive with `req.path === '/'`. A hook authorizing
-on `req.path` cannot tell them apart, so for that hook there is no asymmetry to
-exploit. **A hook comparing `req.originalUrl` still sees two different strings,
-and `strictRoutes` does not change that.** If your authorization compares
-`req.originalUrl` rather than `req.path`, keep whatever URL normalization you
-have.
+unconditionally (`router@2.2.0`; the file-and-line citation is in
+[`docs/project-structure.md`](docs/project-structure.md) § *Strict routing
+(#50)*), so both forms reach the mounted route class and both arrive with
+`req.path === '/'`. A hook authorizing on `req.path` cannot tell them apart, so
+for that hook there is no asymmetry to exploit — and there is nothing for
+`strict routing` to reject. **A hook comparing `req.originalUrl` sees two
+different strings**, and that was a live authorization bypass.
+
+`canonicalRoutes` closes it, as a per-request check rather than a setting
+([#54](https://github.com/abofs/stonyx-rest-server/issues/54)). Before your
+`auth` hook runs, the raw request target is compared against the path express
+matched, and a mismatch is rejected as a plain 404. It closes **two** vectors
+against `req.originalUrl` — the field express does not normalize:
+
+```
+                                   before   after
+GET /admin                           401      401   (hook fires, request blocked)
+GET /admin/                          200      404   (hook never fired; now a miss)
+GET http://host/admin                200      404   (absolute-form; hook never fired)
+GET http://host/admin/settings       200      404   (absolute-form, and every other route)
+```
+
+The second vector is the one to check first. [RFC 9112
+§3.2.2](https://www.rfc-editor.org/rfc/rfc9112#section-3.2.2) permits an
+**absolute-form** request target, express routes it, and it hands your hook the
+whole URI — `req.originalUrl === "http://host/admin"`. Unlike the mount-root
+slash, that affects **every route**, not one edge.
+
+The target is compared **raw**. It is not parsed, normalized or resolved first:
+normalizing it would launder exactly the string your hook is exposed to and
+re-open the absolute-form vector by construction. Only the query string is
+removed before comparison, so `GET /admin?x=1` still reaches your hook — **strip
+the query yourself** if your hook compares `req.originalUrl` against a fixed
+path, or it will not match. Rejections are indistinguishable from a genuine miss
+by design; see [Upgrading](#upgrading-behaviour-changes).
+
+Routes registered *with* a literal trailing slash are unaffected — their
+canonical target carries the slash. So are param routes, index-mounted route
+classes, and query strings on canonical paths.
+
+#### What this does not do
 
 **It does not normalize path *parameter values*.** If your `auth()` hook rejects
 `params.id === 'restricted'`, then `GET /private/RESTRICTED` still reaches the
@@ -175,7 +215,29 @@ another variant of the bug above.
 
 #### Upgrading: behaviour changes
 
-Both settings change which requests match, so both are consumer-visible.
+All three controls change which requests match, so all three are
+consumer-visible.
+
+**Clients or forward proxies sending absolute-form request targets now get 404
+on every route.** `GET http://host/admin HTTP/1.1` is a legal request target
+([RFC 9112 §3.2.2](https://www.rfc-editor.org/rfc/rfc9112#section-3.2.2)) and
+express used to route it. It is now rejected, on **every** route — for a client
+that emits it, this is a total outage, not a partial one, and it is the largest
+blast radius in this change. Reverse proxies in normal use (nginx, HAProxy,
+AWS ALB) send origin-form and are unaffected; **forward** proxies and
+hand-rolled HTTP clients are the exposure. Remediation is
+`REST_CANONICAL_ROUTES=false`, or fix the client.
+
+**`GET /route/` at a mounted route class's root now returns 404.** Previously
+200. If a client appends a trailing slash to a mount root, it stops working.
+
+Both rejections are **indistinguishable from a route that was never
+registered** — same status, same `Content-Type`, same headers — which is the
+intended security property: a distinguishable rejection is an oracle telling an
+attacker the route exists and was merely spelled wrong. Combined with this
+module emitting **no request logging**, a broken client shows up as a bare
+`Cannot GET …` with nothing at all on the server side. **Check this first if
+routes start 404ing after upgrade.**
 
 **`GET /health/` now returns 404.** `GET /health` is unaffected. This is the
 change most likely to page someone, and it is an **availability** problem rather
@@ -201,21 +263,31 @@ no log line and no stack, so it looks like a deploy that dropped a route.
 
 #### Opting out
 
-Two separate flags, one per axis:
+Three separate flags, one per axis:
 
 ```bash
 REST_CASE_SENSITIVE_ROUTES=false   # restores case-insensitive matching (#47)
 REST_STRICT_ROUTES=false           # restores trailing-slash tolerance (#50)
+REST_CANONICAL_ROUTES=false        # restores non-canonical request targets (#54)
 ```
 
-or equivalently `restServer: { caseSensitiveRoutes: false, strictRoutes: false }`.
+or equivalently
+`restServer: { caseSensitiveRoutes: false, strictRoutes: false, canonicalRoutes: false }`.
 
-**They are deliberately separate keys, and neither implies the other.** Slash
+**They are deliberately separate keys, and none implies the others.** Slash
 tolerance is a legitimate need — a health-check URL you cannot change today is
 the common case. Casing tolerance almost never is. Folding them into one flag
 would force anyone who needs the first to accept the second, which is why a
 consumer who took the `#47` opt-out still has to set `REST_STRICT_ROUTES=false`
-separately to keep trailing slashes working.
+separately to keep trailing slashes working. `REST_CANONICAL_ROUTES=false` is
+separate for the same reason: a consumer who needs mount-root slash tolerance
+should not have to re-open `#50`'s sub-path bypass to get it.
+
+`REST_CANONICAL_ROUTES=false` is a **temporary remediation**, not a
+configuration to run on. It re-opens both `#54` vectors at once — the mount-root
+slash *and* the absolute-form target — against any hook authorizing on
+`req.originalUrl`. It is env-only, so restoring service does not need a
+redeploy; use it to stop the bleeding, then fix the client and remove it.
 
 **Each flag restores the corresponding vulnerability described above** — the
 URL-based authorization in your application becomes bypassable along that axis

package/config/environment.js

@@ -1,4 +1,5 @@
 const {
+  REST_CANONICAL_ROUTES,
   REST_CASE_SENSITIVE_ROUTES,
   REST_CORS_ORIGIN,
   REST_CORS_METHODS,
@@ -63,6 +64,57 @@ const config = {
   // live assertion on this default.
   strictRoutes: REST_STRICT_ROUTES !== 'false',
 
+  // Secure by default, same polarity and same reasoning as the two keys above:
+  // a request whose RAW target is not the canonical path express matched is
+  // rejected with a plain 404 before the consumer's `auth` hook runs
+  // (abofs/stonyx-rest-server#54). This is NOT an express setting -- it is a
+  // per-request check in src/route-matching.ts (`shouldRejectTarget`), called
+  // from the handler closure in src/request.ts.
+  //
+  // BEHAVIOUR CHANGE for consumers upgrading, on TWO axes:
+  //   1. `GET /route/` at a mounted route class's ROOT now returns 404.
+  //   2. Clients or forward proxies emitting an ABSOLUTE-FORM request target
+  //      (`GET http://host/admin HTTP/1.1`, RFC 9112 3.2.2) now receive 404 on
+  //      EVERY route. This is the larger blast radius: for such a client it is
+  //      a total outage, not a partial one. Reverse proxies in normal use
+  //      (nginx, HAProxy, ALB) send origin-form and are unaffected.
+  // This module emits no request log, so both look like a dropped route.
+  //
+  // Opt out with REST_CANONICAL_ROUTES=false only as a temporary remediation --
+  // it RE-OPENS the bypass. Separate key from REST_STRICT_ROUTES and
+  // REST_CASE_SENSITIVE_ROUTES on purpose: coupling it to strictness would
+  // force a consumer who needs mount-root slash tolerance to also re-open #50's
+  // sub-path bypass.
+  //
+  // Note trustProxy below deliberately uses `=== 'true'` instead. That is not
+  // an inconsistency to "fix": its safe default is FALSY, so a truthy check
+  // already fails closed for it. The rule is "the guard must fail toward the
+  // safe value", not "all guards look alike".
+  //
+  // DELIBERATELY NOT PINNED in test/config/environment.ts -- do not "fix" this
+  // as part of abofs/stonyx-rest-server#43. Same trap as the two keys above,
+  // and now measured for all three: pin `canonicalRoutes: true` in
+  // test/config/environment.ts AND invert this line to `=== 'true'`, and the
+  // suite reports 34 pass / 0 fail while an insecure default ships. The pin is
+  // quieter AND weaker than no pin, which is the outcome pinning was supposed
+  // to prevent.
+  //
+  // Unpinned, inverting this line alone reports 32 pass / 2 fail: #54's
+  // integration AC1 and #50's AC2. AC2 (unit) stays GREEN under that mutation,
+  // because it sets `canonicalRoutes` on the config object directly and so
+  // guards src/route-matching.ts's READ rather than this default -- the two
+  // assertions cover different halves and neither subsumes the other.
+  // Conversely, weakening the READ to `=== true` reports 33 pass / 1 fail with
+  // AC2 as the only failure and AC1 fully green. Both measurements are on the
+  // #54 branch head.
+  //
+  // The cost is that the suite is ambient-sensitive here
+  // (`REST_CANONICAL_ROUTES=false pnpm test` => 32 pass / 2 fail), but it fails
+  // LOUDLY, so there is no false green. Closing #43 for any of the three keys
+  // needs subprocess-based env isolation this repo does not have; any fix must
+  // keep a live assertion on this default.
+  canonicalRoutes: REST_CANONICAL_ROUTES !== 'false',
+
   enableHealthCheck: REST_HEALTH_CHECK_DISABLE !== 'true',
   origin: REST_CORS_ORIGIN ?? '*',
   methods: REST_CORS_METHODS ?? 'GET,POST,PATCH,PUT,DELETE',

package/dist/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAiBA,OAAgB,EAAE,KAAK,OAAO,EAAoE,MAAM,SAAS,CAAC;AAKlH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,UAAU;IAC7B,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;IAE5B,GAAG,EAAG,OAAO,CAAC;IACd,MAAM,EAAG,MAAM,CAAC;;IAgBhB,MAAM,CAAC,KAAK,IAAI,IAAI;IAQd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAerB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAelC,qBAAqB,IAAI,IAAI;IAW7B,UAAU,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;CAarG"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAiBA,OAAgB,EAAE,KAAK,OAAO,EAAoE,MAAM,SAAS,CAAC;AAKlH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,UAAU;IAC7B,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;IAE5B,GAAG,EAAG,OAAO,CAAC;IACd,MAAM,EAAG,MAAM,CAAC;;IAwBhB,MAAM,CAAC,KAAK,IAAI,IAAI;IAQd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAerB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAelC,qBAAqB,IAAI,IAAI;IAW7B,UAAU,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;CAarG"}

package/dist/main.js

@@ -29,11 +29,19 @@ export default class RestServer {
             return RestServer.instance;
         RestServer.instance = this;
         this.api = express();
-        // Closes the mount segment (/PUBLIC/...) for abofs/stonyx-rest-server#47.
+        // Applies BOTH route-matching settings: case sensitive routing
+        // (abofs/stonyx-rest-server#47) and strict routing (#50). The two do not
+        // have the same role at this site:
+        //   - #47: this call closes the mount segment (/PUBLIC/...). The matching
+        //     call in Request's constructor closes sub-paths; both are required.
+        //   - #50: this call closes exactly /health/, the only route registered
+        //     directly on this app. It has NO security role for #50 -- do not
+        //     describe it as having one. Router.prototype.use hardcodes
+        //     `strict: false`, so mount segments are strict-immune, and the call in
+        //     Request's constructor closes the trailing-slash bypass on its own.
         // Must stay in the constructor: the router is materialized lazily on first
         // route registration, so applying this after setupRouter() is silently
-        // ineffective. The matching call in Request's constructor is what closes
-        // sub-paths -- see src/route-matching.ts for why both are required.
+        // ineffective. See src/route-matching.ts for the per-site split.
         applyRouteMatching(this.api);
     }
     static close() {

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAA2F,MAAM,SAAS,CAAC;AAClH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,GAAG,MAAM,YAAY,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,kBAAkB,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,UAAU;IAC7B,MAAM,CAAC,QAAQ,CAAa;IAE5B,GAAG,CAAW;IACd,MAAM,CAAU;IAEhB;QACE,IAAI,UAAU,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QACpD,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;QAErB,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,KAAK;QACV,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAErF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;QACvC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACrE,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEpC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAEzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAEnC,oBAAoB;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEnH,IAAI,iBAAiB;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAoB,EAAE,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAE1D,IAAI,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAElD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACX,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,iBAA0B,EAAE,EAAE,IAAI,EAAE,OAAO,EAAuC;QAC3F,MAAM,UAAU,GAAG,iBAAmG,CAAC;QACvH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,MAAM,EAAE,eAAe,EAAE,GAAG,aAAa,CAAC;QAE1C,aAAa,CAAC,aAAa,EAAE,CAAC;QAC9B,eAAe,CAAC,SAAS,GAAG,KAAK,CAAC;QAElC,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAA2F,MAAM,SAAS,CAAC;AAClH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,GAAG,MAAM,YAAY,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,kBAAkB,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,UAAU;IAC7B,MAAM,CAAC,QAAQ,CAAa;IAE5B,GAAG,CAAW;IACd,MAAM,CAAU;IAEhB;QACE,IAAI,UAAU,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QACpD,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;QAErB,+DAA+D;QAC/D,yEAAyE;QACzE,mCAAmC;QACnC,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,gEAAgE;QAChE,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,iEAAiE;QACjE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,KAAK;QACV,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAErF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;QACvC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACrE,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEpC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAEzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAEnC,oBAAoB;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEnH,IAAI,iBAAiB;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAoB,EAAE,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAE1D,IAAI,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAElD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACX,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,iBAA0B,EAAE,EAAE,IAAI,EAAE,OAAO,EAAuC;QAC3F,MAAM,UAAU,GAAG,iBAAmG,CAAC;QACvH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,MAAM,EAAE,eAAe,EAAE,GAAG,aAAa,CAAC;QAE1C,aAAa,CAAC,aAAa,EAAE,CAAC;QAC9B,eAAe,CAAC,SAAS,GAAG,KAAK,CAAC;QAElC,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,OAAO,IAAI,cAAc,EAAE,KAAK,QAAQ,IAAI,eAAe,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAOlH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACtG,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;AAC3F,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,SAAmB;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY;IASlD,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWrE,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAG,aAAa,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;;IAe3B,aAAa,IAAI,IAAI;CAqDtB"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,OAAO,IAAI,cAAc,EAAE,KAAK,QAAQ,IAAI,eAAe,EAAqB,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAOrI,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACtG,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;AAC3F,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,SAAmB;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY;IASlD,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWrE,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAG,aAAa,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;;IA4B3B,aAAa,IAAI,IAAI;CA4EtB"}

package/dist/request.js

@@ -1,7 +1,7 @@
 import express from 'express';
 import config from 'stonyx/config';
 import { makeArray } from '@stonyx/utils/object';
-import applyRouteMatching from './route-matching.js';
+import applyRouteMatching, { shouldRejectTarget } from './route-matching.js';
 const METHODS = new Set(['get', 'post', 'put', 'delete', 'patch']);
 export default class Request {
     static stateProp = '__stonyxState';
@@ -28,10 +28,23 @@ export default class Request {
     constructor() {
         const api = express();
         api.disable('x-powered-by');
-        // Closes sub-paths (/public/SUCCESS) for abofs/stonyx-rest-server#47.
-        // Must stay in the constructor: registerCalls() materializes this router,
-        // and a set applied afterwards has no effect. The parent app's setting
-        // does not reach here -- see src/route-matching.ts.
+        // Applies BOTH route-matching SETTINGS: case sensitive routing
+        // (abofs/stonyx-rest-server#47) and strict routing (#50). For #47 this
+        // call closes sub-paths (/public/SUCCESS) and the parent's call closes the
+        // mount segment; for #50 THIS call closes the entire trailing-slash
+        // authorization bypass on its own, and the parent's call has no security
+        // role. Must stay in the constructor: registerCalls() materializes this
+        // router, and a set applied afterwards has no effect. The parent app's
+        // setting does not reach here -- see src/route-matching.ts.
+        //
+        // The third route-matching control, `canonicalRoutes` (#54), is NOT applied
+        // here and must not be moved here. It is not an express setting, and its
+        // timing contract is the opposite of these two: it is read PER REQUEST
+        // inside the handler closure in registerCalls() below, via
+        // shouldRejectTarget(). These two are constructor-timed because a late
+        // `set` is silently ineffective; that hazard does not exist for #54, and
+        // reading it per request is what lets the unit AC flip the flag between
+        // probes.
         applyRouteMatching(api);
         this.expressInstance = api;
     }
@@ -44,7 +57,30 @@ export default class Request {
                 continue;
             }
             for (const [route, handler] of Object.entries(handlers)) {
-                expressInstance[method](route, async (req, res) => {
+                expressInstance[method](route, async (req, res, next) => {
+                    // abofs/stonyx-rest-server#54 -- reject a request whose RAW target is
+                    // not the canonical path express matched, closing two authorization
+                    // bypasses against hooks that authorize on `req.originalUrl`: the
+                    // mount-root trailing slash and the absolute-form request target.
+                    //
+                    // Two properties of this line are load-bearing, and each has its own
+                    // red-able assertion:
+                    //
+                    //   1. It runs BEFORE auth, and OUTSIDE `if (this.auth)`. Gating it on
+                    //      the hook would leave `GET /public/` at 200 and make a security
+                    //      control depend on an unrelated consumer choice.
+                    //   2. It rejects with `next('router')`, NOT sendStatusResponse() or
+                    //      res.sendStatus(404). Measured: sendStatus returns
+                    //      `text/plain "Not Found"` while a genuine miss returns
+                    //      `text/html <pre>Cannot GET ...</pre>` -- a working ORACLE
+                    //      telling an attacker the route exists but was spelled wrong.
+                    //      next('router') exits this sub-app's router into finalhandler
+                    //      and is shape-identical to a real miss (same status, same
+                    //      Content-Type, same CSP header). Routing it through
+                    //      sendStatusResponse() would additionally re-introduce the
+                    //      oracle for any consumer who sets a 404 in `statusMap`.
+                    if (shouldRejectTarget(req))
+                        return next('router');
                     // Run auth after route matching so request.params is populated
                     if (this.auth) {
                         const status = this.auth(req, getState(req));

package/dist/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2F,MAAM,SAAS,CAAC;AAClH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,kBAAkB,MAAM,qBAAqB,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAOnE,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAmB;QACjC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAyC,CAAC;QACzD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;QAE9E,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAoB,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,eAAe,CAAU;IACzB,QAAQ,CAAiB;IAGzB;QACE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE5B,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,oDAAoD;QACpD,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAEjD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,2CAA2C,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,eAA6I,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;oBAChN,+DAA+D;oBAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;wBACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC7C,IAAI,MAAM;4BAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACrD,CAAC;oBAED,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAqB,CAAC;oBAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAG,CAAC;oBAClC,IAAI,QAAiB,CAAC;oBAEtB,iBAAiB;oBACjB,OAAM,SAAS,CAAC,MAAM,EAAE,CAAC;wBACvB,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnE,IAAI,QAAQ,KAAK,SAAS;4BAAE,MAAM;oBACpC,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS;wBAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,QAAkB,CAAC,CAAC;oBAEnF,+CAA+C;oBAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;oBAC3B,IAAI,QAAQ;wBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAkB,CAAC,CAAC;oBAEtD,2CAA2C;oBAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;oBACvB,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAA0F,CAAC;wBAEvH,IAAI,OAAO;4BAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gCAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBACrF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAEtE,GAAG,CAAC,IAAI,CAAC,QAAmC,CAAC,CAAC;gBAChD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,OAA8G,MAAM,SAAS,CAAC;AACrI,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,kBAAkB,EAAE,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAOnE,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAmB;QACjC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAyC,CAAC;QACzD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;QAE9E,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAoB,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,eAAe,CAAU;IACzB,QAAQ,CAAiB;IAGzB;QACE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE5B,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,4DAA4D;QAC5D,EAAE;QACF,4EAA4E;QAC5E,yEAAyE;QACzE,uEAAuE;QACvE,2DAA2D;QAC3D,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,UAAU;QACV,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAEjD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,2CAA2C,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,eAAiK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;oBACxP,sEAAsE;oBACtE,oEAAoE;oBACpE,kEAAkE;oBAClE,kEAAkE;oBAClE,EAAE;oBACF,qEAAqE;oBACrE,sBAAsB;oBACtB,EAAE;oBACF,uEAAuE;oBACvE,sEAAsE;oBACtE,uDAAuD;oBACvD,qEAAqE;oBACrE,yDAAyD;oBACzD,6DAA6D;oBAC7D,iEAAiE;oBACjE,mEAAmE;oBACnE,oEAAoE;oBACpE,gEAAgE;oBAChE,0DAA0D;oBAC1D,gEAAgE;oBAChE,8DAA8D;oBAC9D,IAAI,kBAAkB,CAAC,GAAG,CAAC;wBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAEnD,+DAA+D;oBAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;wBACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC7C,IAAI,MAAM;4BAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACrD,CAAC;oBAED,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAqB,CAAC;oBAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAG,CAAC;oBAClC,IAAI,QAAiB,CAAC;oBAEtB,iBAAiB;oBACjB,OAAM,SAAS,CAAC,MAAM,EAAE,CAAC;wBACvB,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnE,IAAI,QAAQ,KAAK,SAAS;4BAAE,MAAM;oBACpC,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS;wBAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,QAAkB,CAAC,CAAC;oBAEnF,+CAA+C;oBAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;oBAC3B,IAAI,QAAQ;wBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAkB,CAAC,CAAC;oBAEtD,2CAA2C;oBAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;oBACvB,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAA0F,CAAC;wBAEvH,IAAI,OAAO;4BAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gCAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBACrF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAEtE,GAAG,CAAC,IAAI,CAAC,QAAmC,CAAC,CAAC;gBAChD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC"}

package/dist/route-matching.d.ts

@@ -1,4 +1,4 @@
-import type { Express } from 'express';
+import type { Express, Request as ExpressRequest } from 'express';
 /**
  * Applies this module's route-matching settings to an express app.
  *
@@ -53,25 +53,91 @@ import type { Express } from 'express';
  *     this repo: `/health/`, the only route registered directly on the parent
  *     app. It has no security role here; do not describe it as having one.
  *
- * The cause is concrete: router@2.2.0 `index.js:400-401` hardcodes
- * `strict: false, end: false` for `Router.prototype.use`, so mount segments
- * are structurally strict-immune. That is the OPPOSITE of `sensitive`, which
- * `use()` does forward (line 399) and which is why #47's parent site closed
- * `/PUBLIC/...`. Both sites still get both settings -- they share this
- * function -- but the justification differs and the tests are built on the
- * measured split, not on the analogy.
- *
- * Consequence worth stating so nobody "fixes" it: the mount-segment trailing
- * slash (`/public/`) can never be closed by this setting, and does not need to
- * be. For both `/public` and `/public/` the mounted sub-app receives
- * `req.path === '/'`, so a `req.path` auth hook sees no difference and there is
- * no asymmetry. A test asserting `/public/` -> 404 could never pass. The
- * residual is `req.originalUrl`, which DOES differ; that is disclosed in the
- * README rather than silently closed over.
+ * The cause is concrete: `Router.prototype.use` hardcodes `strict: false` (and
+ * `end: false`), so mount segments are structurally strict-immune. That is the
+ * OPPOSITE of `sensitive`, which `use()` DOES forward, and which is why #47's
+ * parent site closed `/PUBLIC/...`. The version-pinned file-and-line citation
+ * for that upstream behaviour is deliberately kept in ONE place --
+ * `docs/project-structure.md`, section "Strict routing (#50)" -- so a router
+ * upgrade invalidates one line rather than five. Both sites still get both
+ * settings (they share this function), but the justification differs and the
+ * tests are built on the measured split, not on the analogy.
+ *
+ * Consequence worth stating so nobody expects this SETTING to cover it: no
+ * express setting rejects the mount-segment trailing slash (`/public/`). For
+ * both `/public` and `/public/` the mounted sub-app receives `req.path === '/'`,
+ * so a `req.path` auth hook sees no difference and there is nothing for the
+ * setting to reject. That statement is still true, and it is still the reason
+ * `applyRouteMatching()` is not the fix site for that edge.
+ *
+ * The edge itself is CLOSED, by `shouldRejectTarget()` below rather than by a
+ * setting (abofs/stonyx-rest-server#54). `req.originalUrl` does differ between
+ * the two spellings, and a hook authorizing on it was bypassed by one
+ * character -- measured: `GET /admin` -> 401, `GET /admin/` -> 200 with the
+ * guarded handler running unauthenticated. `GET /public/` now returns 404, and
+ * the integration AC asserts exactly that.
  *
  * Both guards are `!== false` for the same reason: these flags default to the
  * truthy direction, so a truthy check fails OPEN for a consumer whose shipped
- * config predates the key.
+ * config predates the key. Both are also asserted at the unit tier for BOTH
+ * failure shapes -- key present-and-`undefined` and key absent as an own
+ * property -- in `test/unit/request-test.ts` (#47's AC6, #50's AC3). The
+ * integration tier cannot see either: with the shipped default `true`, a
+ * fail-open guard leaves every integration assertion green.
  */
 export default function applyRouteMatching(api: Express): void;
+/**
+ * Decides whether a request must be rejected because its RAW request target is
+ * not the canonical path express matched (abofs/stonyx-rest-server#54).
+ *
+ * Closes two live authorization bypasses against a consumer hook that
+ * authorizes on `req.originalUrl` -- the field express does NOT normalize:
+ *
+ *   1. mount-root trailing slash    GET /admin/                  -> was 200
+ *   2. absolute-form request target GET http://host/admin        -> was 200
+ *      (RFC 9112 3.2.2; hits EVERY route, not just the mount root)
+ *
+ * Both were measured reaching the guarded handler unauthenticated while
+ * `GET /admin` was denied 401.
+ *
+ * COMPARE THE RAW TARGET; DO NOT PARSE IT. Any implementation reaching for
+ * `new URL(req.originalUrl, base).pathname` to "get the path" re-opens vector 2
+ * BY CONSTRUCTION: parsing normalizes the exact string the consumer's hook is
+ * exposed to, so the check would compare a laundered value while the hook still
+ * sees the raw one. Measured: the narrow `endsWith('/')` form closes 1 and
+ * leaves 2 at 200.
+ *
+ * `req.baseUrl + req.path` is likewise NOT usable as the left-hand side. It is
+ * `/admin/` for BOTH spellings of vector 1 -- `originalUrl` is the only field
+ * that differs, which is precisely why the bypass exists. A check built on
+ * `baseUrl + path` cannot see its own defect.
+ *
+ * TIMING CONTRACT -- DELIBERATELY DIFFERENT FROM ITS TWO SIBLINGS. This lives
+ * beside `applyRouteMatching()` for the same "one place anchors it" reason, but
+ * deliberately OUTSIDE it: that function's contract is *apply express settings
+ * to an app*, it is called from two constructors, and this is neither a setting
+ * nor constructor-timed. `caseSensitiveRoutes`/`strictRoutes` are read once in a
+ * constructor and are silently ineffective if applied late; this flag is read
+ * PER REQUEST, inside the handler closure. There is no lazy-materialisation
+ * hazard here, so do not carry that constraint across.
+ *
+ * The caller must reject with `next('router')`, NOT `res.sendStatus(404)`, and
+ * must run this whether or not `this.auth` is set -- see src/request.ts.
+ *
+ * Guard polarity is `!== false`, matching both siblings, for the same measured
+ * reason: the secure value is the TRUTHY one, so a plain truthy check fails
+ * OPEN for any consumer whose shipped `restServer` block predates the key --
+ * the state every existing consumer is in, and reachable in practice because
+ * the stonyx loader only merges a module's `config/environment.js` for modules
+ * in devDependencies. `trustProxy` deliberately differs (`=== 'true'`): its safe
+ * default is FALSY, so a truthy check already fails closed for it. The rule is
+ * "the guard must fail toward the safe value", not "all guards look alike" --
+ * preserve the asymmetry.
+ *
+ * The integration tier cannot see a fail-open guard here: with the shipped
+ * default `true`, `=== true` leaves every integration assertion green. Only
+ * `test/unit/request-test.ts` AC2 can, and it probes BOTH failure shapes --
+ * key present-and-`undefined` and key absent as an own property.
+ */
+export declare function shouldRejectTarget(req: ExpressRequest): boolean;
 //# sourceMappingURL=route-matching.d.ts.map

package/dist/route-matching.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-matching.d.ts","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAG7D"}
+{"version":3,"file":"route-matching.d.ts","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,SAAS,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAG7D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAe/D"}

package/dist/route-matching.js

@@ -53,25 +53,37 @@ import config from 'stonyx/config';
  *     this repo: `/health/`, the only route registered directly on the parent
  *     app. It has no security role here; do not describe it as having one.
  *
- * The cause is concrete: router@2.2.0 `index.js:400-401` hardcodes
- * `strict: false, end: false` for `Router.prototype.use`, so mount segments
- * are structurally strict-immune. That is the OPPOSITE of `sensitive`, which
- * `use()` does forward (line 399) and which is why #47's parent site closed
- * `/PUBLIC/...`. Both sites still get both settings -- they share this
- * function -- but the justification differs and the tests are built on the
- * measured split, not on the analogy.
- *
- * Consequence worth stating so nobody "fixes" it: the mount-segment trailing
- * slash (`/public/`) can never be closed by this setting, and does not need to
- * be. For both `/public` and `/public/` the mounted sub-app receives
- * `req.path === '/'`, so a `req.path` auth hook sees no difference and there is
- * no asymmetry. A test asserting `/public/` -> 404 could never pass. The
- * residual is `req.originalUrl`, which DOES differ; that is disclosed in the
- * README rather than silently closed over.
+ * The cause is concrete: `Router.prototype.use` hardcodes `strict: false` (and
+ * `end: false`), so mount segments are structurally strict-immune. That is the
+ * OPPOSITE of `sensitive`, which `use()` DOES forward, and which is why #47's
+ * parent site closed `/PUBLIC/...`. The version-pinned file-and-line citation
+ * for that upstream behaviour is deliberately kept in ONE place --
+ * `docs/project-structure.md`, section "Strict routing (#50)" -- so a router
+ * upgrade invalidates one line rather than five. Both sites still get both
+ * settings (they share this function), but the justification differs and the
+ * tests are built on the measured split, not on the analogy.
+ *
+ * Consequence worth stating so nobody expects this SETTING to cover it: no
+ * express setting rejects the mount-segment trailing slash (`/public/`). For
+ * both `/public` and `/public/` the mounted sub-app receives `req.path === '/'`,
+ * so a `req.path` auth hook sees no difference and there is nothing for the
+ * setting to reject. That statement is still true, and it is still the reason
+ * `applyRouteMatching()` is not the fix site for that edge.
+ *
+ * The edge itself is CLOSED, by `shouldRejectTarget()` below rather than by a
+ * setting (abofs/stonyx-rest-server#54). `req.originalUrl` does differ between
+ * the two spellings, and a hook authorizing on it was bypassed by one
+ * character -- measured: `GET /admin` -> 401, `GET /admin/` -> 200 with the
+ * guarded handler running unauthenticated. `GET /public/` now returns 404, and
+ * the integration AC asserts exactly that.
  *
  * Both guards are `!== false` for the same reason: these flags default to the
  * truthy direction, so a truthy check fails OPEN for a consumer whose shipped
- * config predates the key.
+ * config predates the key. Both are also asserted at the unit tier for BOTH
+ * failure shapes -- key present-and-`undefined` and key absent as an own
+ * property -- in `test/unit/request-test.ts` (#47's AC6, #50's AC3). The
+ * integration tier cannot see either: with the shipped default `true`, a
+ * fail-open guard leaves every integration assertion green.
  */
 export default function applyRouteMatching(api) {
     if (config.restServer?.caseSensitiveRoutes !== false)
@@ -79,4 +91,71 @@ export default function applyRouteMatching(api) {
     if (config.restServer?.strictRoutes !== false)
         api.set('strict routing', true);
 }
+/**
+ * Decides whether a request must be rejected because its RAW request target is
+ * not the canonical path express matched (abofs/stonyx-rest-server#54).
+ *
+ * Closes two live authorization bypasses against a consumer hook that
+ * authorizes on `req.originalUrl` -- the field express does NOT normalize:
+ *
+ *   1. mount-root trailing slash    GET /admin/                  -> was 200
+ *   2. absolute-form request target GET http://host/admin        -> was 200
+ *      (RFC 9112 3.2.2; hits EVERY route, not just the mount root)
+ *
+ * Both were measured reaching the guarded handler unauthenticated while
+ * `GET /admin` was denied 401.
+ *
+ * COMPARE THE RAW TARGET; DO NOT PARSE IT. Any implementation reaching for
+ * `new URL(req.originalUrl, base).pathname` to "get the path" re-opens vector 2
+ * BY CONSTRUCTION: parsing normalizes the exact string the consumer's hook is
+ * exposed to, so the check would compare a laundered value while the hook still
+ * sees the raw one. Measured: the narrow `endsWith('/')` form closes 1 and
+ * leaves 2 at 200.
+ *
+ * `req.baseUrl + req.path` is likewise NOT usable as the left-hand side. It is
+ * `/admin/` for BOTH spellings of vector 1 -- `originalUrl` is the only field
+ * that differs, which is precisely why the bypass exists. A check built on
+ * `baseUrl + path` cannot see its own defect.
+ *
+ * TIMING CONTRACT -- DELIBERATELY DIFFERENT FROM ITS TWO SIBLINGS. This lives
+ * beside `applyRouteMatching()` for the same "one place anchors it" reason, but
+ * deliberately OUTSIDE it: that function's contract is *apply express settings
+ * to an app*, it is called from two constructors, and this is neither a setting
+ * nor constructor-timed. `caseSensitiveRoutes`/`strictRoutes` are read once in a
+ * constructor and are silently ineffective if applied late; this flag is read
+ * PER REQUEST, inside the handler closure. There is no lazy-materialisation
+ * hazard here, so do not carry that constraint across.
+ *
+ * The caller must reject with `next('router')`, NOT `res.sendStatus(404)`, and
+ * must run this whether or not `this.auth` is set -- see src/request.ts.
+ *
+ * Guard polarity is `!== false`, matching both siblings, for the same measured
+ * reason: the secure value is the TRUTHY one, so a plain truthy check fails
+ * OPEN for any consumer whose shipped `restServer` block predates the key --
+ * the state every existing consumer is in, and reachable in practice because
+ * the stonyx loader only merges a module's `config/environment.js` for modules
+ * in devDependencies. `trustProxy` deliberately differs (`=== 'true'`): its safe
+ * default is FALSY, so a truthy check already fails closed for it. The rule is
+ * "the guard must fail toward the safe value", not "all guards look alike" --
+ * preserve the asymmetry.
+ *
+ * The integration tier cannot see a fail-open guard here: with the shipped
+ * default `true`, `=== true` leaves every integration assertion green. Only
+ * `test/unit/request-test.ts` AC2 can, and it probes BOTH failure shapes --
+ * key present-and-`undefined` and key absent as an own property.
+ */
+export function shouldRejectTarget(req) {
+    // Written as `!== false` rather than `=== false` on purpose: the polarity is
+    // the load-bearing part and it should read identically to the two guards in
+    // applyRouteMatching() above.
+    const enforced = config.restServer?.canonicalRoutes !== false;
+    if (!enforced)
+        return false;
+    // Raw, unparsed. Only the query string is removed, by string split.
+    const target = req.originalUrl.split('?')[0];
+    // At a mount root express reports `req.path === '/'` while the canonical
+    // target is the bare mount segment, so the two are not simply concatenated.
+    const canonical = req.path === '/' && req.baseUrl ? req.baseUrl : req.baseUrl + req.path;
+    return target !== canonical;
+}
 //# sourceMappingURL=route-matching.js.map

package/dist/route-matching.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-matching.js","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAY;IACrD,IAAI,MAAM,CAAC,UAAU,EAAE,mBAAmB,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,UAAU,EAAE,YAAY,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACjF,CAAC"}
+{"version":3,"file":"route-matching.js","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAY;IACrD,IAAI,MAAM,CAAC,UAAU,EAAE,mBAAmB,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,UAAU,EAAE,YAAY,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAmB;IACpD,6EAA6E;IAC7E,4EAA4E;IAC5E,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,eAAe,KAAK,KAAK,CAAC;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,oEAAoE;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7C,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IAEzF,OAAO,MAAM,KAAK,SAAS,CAAC;AAC9B,CAAC"}

package/package.json

@@ -4,7 +4,7 @@
     "stonyx-async",
     "stonyx-module"
   ],
-  "version": "0.2.1-alpha.22",
+  "version": "0.2.1-alpha.24",
   "description": "Rest Server Module for Stonyx Framework",
   "repository": {
     "type": "git",