@stonyx/rest-server 0.2.1-beta.90 → 0.2.1-beta.91

package/README.md

@@ -79,59 +79,82 @@ Configuration is read from `stonyx/config` under `restServer`:
 |      `origin`     | **String \| Array** | `'*'`       | CORS origin(s) allowed                                     |
 |    `methods`      | **String**          | `'GET,POST,PATCH,PUT,DELETE'` | CORS allowed methods                              |
 | `enableHealthCheck` |   **Boolean**     | `true`      | Register `GET /health` endpoint (disable via `REST_HEALTH_CHECK_DISABLE=true`) |
-| `caseSensitiveRoutes` | **Boolean**   | `true`      | Match route paths case-sensitively. Disable via `REST_CASE_SENSITIVE_ROUTES=false`. See [Case-Sensitive Routing](#case-sensitive-routing) — **disabling this re-opens a security hole**. |
+| `caseSensitiveRoutes` | **Boolean**   | `true`      | Match route paths case-sensitively. Disable via `REST_CASE_SENSITIVE_ROUTES=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**. |
+| `strictRoutes`    | **Boolean**   | `true`      | Match route paths strictly, so a trailing slash does not match a route registered without one. Disable via `REST_STRICT_ROUTES=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**, and note `GET /health/` now 404s. |
 |  `trustProxy`   |     **Boolean**     | `false`     | Trust reverse proxy headers (e.g. `X-Forwarded-Proto`). Enable via `REST_TRUST_PROXY=true` when running behind a load balancer such as AWS ALB/ELB to ensure correct protocol detection. |
 |    `statusMap`    |      **Object**     | `{}`        | Optional mapping of HTTP status codes to custom messages   |
 
-### Case-Sensitive Routing
+### Route Matching Strictness
 
-Routes match **case-sensitively by default**. `GET /users` reaches a route
-mounted at `/users`; `GET /Users` does not reach that mount, and
-`GET /users/Success` does not reach a `/success` handler registered inside it.
+Routes match **case-sensitively and strictly by default**. Two settings, both
+on, both applied at both express construction sites:
 
-Read [What this does not do](#what-this-does-not-do) before you rely on that
-sentence. Two things it does not say: "does not reach the handler" is not the
-same as "404", and casing is only one of the two ways express matches more
-loosely than the authorization predicates written against it.
+| axis | setting | example that no longer matches |
+|---|---|---|
+| casing | `case sensitive routing` | `GET /users/Success` -> does not reach `/success` |
+| trailing slash | `strict routing` | `GET /users/success/` -> does not reach `/success` |
 
-This is deliberate and security-relevant. Express matches case-insensitively by
-default, which means any authorization written against the request URL can be
-walked past by changing the case of the request:
+Read [What this does not do](#what-this-does-not-do) and
+[Upgrading](#upgrading-behaviour-changes) before you rely on that. Two things
+the table does not say: "does not reach the handler" is not the same as "404",
+and one edge of the trailing-slash axis is **not** closed and cannot be.
+
+This is deliberate and security-relevant. Express matches both case-insensitively
+and slash-insensitively by default, which means any authorization written
+against the request URL can be walked past by changing the case of the request,
+or by appending one character:
 
 ```
-GET    /owners/angela  -> 404      (correctly filtered)
-GET    /OwNeRs/angela  -> 200      (full record)
-DELETE /ANIMALS/22     -> 204      (record destroyed)
+GET    /owners/angela   -> 404      (correctly filtered)
+GET    /OwNeRs/angela   -> 200      (full record)     <- closed by case sensitive routing
+GET    /owners/angela/  -> 200      (full record)     <- closed by strict routing
+DELETE /ANIMALS/22      -> 204      (record destroyed)
+DELETE /animals/22/     -> 204      (record destroyed)
 ```
 
 The consumer's predicate is stricter than the router that dispatched the
 request, so the router hands the handler a request the predicate would have
-rejected. Case-sensitive matching closes the **casing** half of that asymmetry:
-the path a handler sees can only ever be the exact registered casing.
-
-It does not close the asymmetry itself. Express exposes `case sensitive
-routing` and `strict routing` as a pair of loose-by-default router settings and
-this change sets only the first, so the identical bypass is still reachable by
-appending a slash. Measured on this release against this repo's own fixture:
+rejected. Measured against this repo's own fixture, before and after:
 
 ```
-GET /private/failure   -> 505      (auth hook fires, request blocked)
-GET /private/failure/  -> 200      (auth hook never fires, handler runs)
+                          before   after
+GET /private/failure        505      505    (auth hook fires, request blocked)
+GET /private/failure/       200      404    (auth hook never fired; now a miss)
+GET /private/FAILURE        200      200    (absorbed by /:id — see below)
 ```
 
-That is the same defect, one character instead of a case shift — translated to
-the example above, `DELETE /animals/22` is filtered and `DELETE /animals/22/`
-destroys the record. It is tracked as
-[#50](https://github.com/abofs/stonyx-rest-server/issues/50) and is not fixed
-here; it is a second consumer-visible behaviour change that needs its own flag
-and its own release note.
-
-**So do not drop a URL-normalizing defence you already have on the strength of
-this section.** If your authorization compares `req.path` or `req.originalUrl`,
-keep whatever normalization you have until #50 ships.
+For a handler that authorizes on `req.path`, the path it sees can now only ever
+be the exact registered spelling, in the exact registered casing, with no
+trailing slash. That closes [#47](https://github.com/abofs/stonyx-rest-server/issues/47)
+and [#50](https://github.com/abofs/stonyx-rest-server/issues/50).
 
 #### What this does not do
 
+**It does not close the trailing slash on a mount root, and no setting can.**
+This is the one edge that remains open, so do not read the section above as
+closing the class outright:
+
+```
+GET /public   -> req.path '/'   req.originalUrl '/public'
+GET /public/  -> req.path '/'   req.originalUrl '/public/'
+```
+
+Express's router applies mount-prefix matching with `strict: false`
+unconditionally (`router@2.2.0`; the file-and-line citation is in
+[`docs/project-structure.md`](docs/project-structure.md) § *Strict routing
+(#50)*), so both forms reach the mounted route class and both arrive with
+`req.path === '/'`. A hook authorizing on `req.path` cannot tell them apart, so
+for that hook there is no asymmetry to exploit. **A hook comparing
+`req.originalUrl` still sees two different strings, and `strictRoutes` does not
+change that.** If your authorization compares `req.originalUrl` rather than
+`req.path`, keep whatever URL normalization you have.
+
+No *setting* closes this, but the module can:
+[#54](https://github.com/abofs/stonyx-rest-server/issues/54) tracks closing it
+with a canonical-path check ahead of the `auth` hook. Until that ships, an
+`originalUrl` hook is bypassed by one character — `GET /admin` denied,
+`GET /admin/` reaching the route class's index handler.
+
 **It does not normalize path *parameter values*.** If your `auth()` hook rejects
 `params.id === 'restricted'`, then `GET /private/RESTRICTED` still reaches the
 handler — the router matched the route correctly, and `restricted` and
@@ -148,36 +171,64 @@ repo's AC5 asserts exactly that. A class exposing `/orders/summary` alongside
 database lookup. The param route's own `auth()` hook still runs, so this is an
 expectation defect rather than a bypass — but plan for a reroute, not a 404.
 
-**It does not cover trailing slashes.** See
-[#50](https://github.com/abofs/stonyx-rest-server/issues/50) above.
+Note the two axes differ here. A *trailing slash* is not absorbed by `/:id`,
+because `/:id` is equally strict: `GET /private/failure/` misses `/failure` and
+misses `/:id`, and is a true 404.
+
+**It does not redirect or rewrite** mixed-case or trailing-slash requests to
+their canonical form. Whether `/Users` is a typo to forgive or an attack to
+reject is an application policy decision, and encoding it here would mint
+another variant of the bug above.
 
-**It does not redirect or rewrite** mixed-case requests to their canonical
-casing. Whether `/Users` is a typo to forgive or an attack to reject is an
-application policy decision, and encoding it here would mint another variant of
-the bug above.
+#### Upgrading: behaviour changes
+
+Both settings change which requests match, so both are consumer-visible.
+
+**`GET /health/` now returns 404.** `GET /health` is unaffected. This is the
+change most likely to page someone, and it is an **availability** problem rather
+than a 404 you will read about in a log: if a Kubernetes liveness probe, an ELB
+target-group health check or an uptime monitor is pointed at the trailing-slash
+form, it starts failing and the deployment gets marked unhealthy and cycled.
+This module emits no request logging, so the only symptom is the probe going
+red. **Check your probe URLs before upgrading.**
+
+Also affected:
+
+- **Param routes.** `/resource/:id/` no longer matches. Any client calling
+  `/private/restricted/` gets a 404 where it previously got the param route.
+- **Trailing-slash-normalizing proxies.** nginx `try_files`/`rewrite`, Apache
+  `DirectorySlash On` and some CDN edge rules append a slash; behind one of
+  those, every route stops matching at once.
+- **Mount paths from filenames.** With `camelCaseRoutes` truthy, `phone-number.ts`
+  mounts at `/phoneNumber`, so `GET /phonenumber` returns 404; with it falsy,
+  `Users.ts` mounts at `/Users`, so `GET /users` returns 404.
+
+A request that stops matching returns express's default `404 Cannot GET /x` with
+no log line and no stack, so it looks like a deploy that dropped a route.
 
 #### Opting out
 
+Two separate flags, one per axis:
+
 ```bash
-REST_CASE_SENSITIVE_ROUTES=false
+REST_CASE_SENSITIVE_ROUTES=false   # restores case-insensitive matching (#47)
+REST_STRICT_ROUTES=false           # restores trailing-slash tolerance (#50)
 ```
 
-**This restores the vulnerability described above** — any URL-based
-authorization in your application becomes bypassable by changing case. It
-exists as a one-line remediation for an existing deployment, not as a
-configuration to run on.
+or equivalently `restServer: { caseSensitiveRoutes: false, strictRoutes: false }`.
 
-You need it if clients call your endpoints with casing that does not match the
-mount path. Mount paths come from filenames, so this is not hypothetical:
+**They are deliberately separate keys, and neither implies the other.** Slash
+tolerance is a legitimate need — a health-check URL you cannot change today is
+the common case. Casing tolerance almost never is. Folding them into one flag
+would force anyone who needs the first to accept the second, which is why a
+consumer who took the `#47` opt-out still has to set `REST_STRICT_ROUTES=false`
+separately to keep trailing slashes working.
 
-- with `camelCaseRoutes` truthy, `phone-number.ts` mounts at `/phoneNumber`, and
-  `GET /phonenumber` now returns 404
-- with `camelCaseRoutes` falsy, filenames are used verbatim, so
-  `Users.ts` mounts at `/Users` and `GET /users` now returns 404
-
-A request that stops matching returns express's default `404 Cannot GET /x` with
-no log line and no stack, so it looks like a deploy that dropped a route. Set
-the flag to restore service, then fix the client's casing and remove the flag.
+**Each flag restores the corresponding vulnerability described above** — the
+URL-based authorization in your application becomes bypassable along that axis
+again. They exist as one-line remediations for an existing deployment, not as a
+configuration to run on. Set the flag to restore service, then fix the client
+and remove the flag.
 
 ### Running Behind a Load Balancer
 

package/config/environment.js

@@ -5,6 +5,7 @@ const {
   REST_HEALTH_CHECK_DISABLE,
   REST_PORT,
   REST_REQUEST_PATH,
+  REST_STRICT_ROUTES,
   REST_TRUST_PROXY
 } = process.env;
 
@@ -31,6 +32,37 @@ const config = {
   // the subprocess-based env isolation this repo does not yet have; any fix
   // must keep a live assertion on this default.
   caseSensitiveRoutes: REST_CASE_SENSITIVE_ROUTES !== 'false',
+
+  // Secure by default, same polarity and same reasoning as caseSensitiveRoutes
+  // above: routes match strictly, so a trailing slash cannot walk past a
+  // consumer's URL-based authorization (abofs/stonyx-rest-server#50).
+  //
+  // BEHAVIOUR CHANGE for consumers upgrading: `/health/` now returns 404, and
+  // param routes like `/resource/:id/` no longer match. Opt out with
+  // REST_STRICT_ROUTES=false only as a temporary remediation. It is a separate
+  // key from REST_CASE_SENSITIVE_ROUTES on purpose -- opting out of slash
+  // strictness must not silently re-open #47's case bypass.
+  //
+  // DELIBERATELY NOT PINNED in test/config/environment.ts -- do not "fix" this
+  // as part of abofs/stonyx-rest-server#43. Same trap as the key above, and now
+  // measured for both: pin `strictRoutes: true` in test/config/environment.ts
+  // AND invert this line to `=== 'true'`, and the suite reports 31 pass /
+  // 0 fail. A naive pin makes an insecure published default completely
+  // invisible to a green suite.
+  //
+  // Unpinned, inverting this line alone turns #50's AC1 and AC2 red (29/2).
+  // AC3 stays GREEN under that mutation, because AC3 sets `strictRoutes` on the
+  // config object directly and so guards src/route-matching.ts's READ rather
+  // than this default -- the two assertions cover different halves and neither
+  // subsumes the other.
+  //
+  // The cost is that the suite is ambient-sensitive here
+  // (`REST_STRICT_ROUTES=false pnpm test` => 29 pass / 2 fail), but it fails
+  // LOUDLY, so there is no false green. Closing #43 for either key needs
+  // subprocess-based env isolation this repo does not have; any fix must keep a
+  // live assertion on this default.
+  strictRoutes: REST_STRICT_ROUTES !== 'false',
+
   enableHealthCheck: REST_HEALTH_CHECK_DISABLE !== 'true',
   origin: REST_CORS_ORIGIN ?? '*',
   methods: REST_CORS_METHODS ?? 'GET,POST,PATCH,PUT,DELETE',

package/dist/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAiBA,OAAgB,EAAE,KAAK,OAAO,EAAoE,MAAM,SAAS,CAAC;AAKlH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,UAAU;IAC7B,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;IAE5B,GAAG,EAAG,OAAO,CAAC;IACd,MAAM,EAAG,MAAM,CAAC;;IAgBhB,MAAM,CAAC,KAAK,IAAI,IAAI;IAQd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAerB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAelC,qBAAqB,IAAI,IAAI;IAW7B,UAAU,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;CAarG"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAiBA,OAAgB,EAAE,KAAK,OAAO,EAAoE,MAAM,SAAS,CAAC;AAKlH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,UAAU;IAC7B,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;IAE5B,GAAG,EAAG,OAAO,CAAC;IACd,MAAM,EAAG,MAAM,CAAC;;IAwBhB,MAAM,CAAC,KAAK,IAAI,IAAI;IAQd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAerB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAelC,qBAAqB,IAAI,IAAI;IAW7B,UAAU,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;CAarG"}

package/dist/main.js

@@ -29,11 +29,19 @@ export default class RestServer {
             return RestServer.instance;
         RestServer.instance = this;
         this.api = express();
-        // Closes the mount segment (/PUBLIC/...) for abofs/stonyx-rest-server#47.
+        // Applies BOTH route-matching settings: case sensitive routing
+        // (abofs/stonyx-rest-server#47) and strict routing (#50). The two do not
+        // have the same role at this site:
+        //   - #47: this call closes the mount segment (/PUBLIC/...). The matching
+        //     call in Request's constructor closes sub-paths; both are required.
+        //   - #50: this call closes exactly /health/, the only route registered
+        //     directly on this app. It has NO security role for #50 -- do not
+        //     describe it as having one. Router.prototype.use hardcodes
+        //     `strict: false`, so mount segments are strict-immune, and the call in
+        //     Request's constructor closes the trailing-slash bypass on its own.
         // Must stay in the constructor: the router is materialized lazily on first
         // route registration, so applying this after setupRouter() is silently
-        // ineffective. The matching call in Request's constructor is what closes
-        // sub-paths -- see src/route-matching.ts for why both are required.
+        // ineffective. See src/route-matching.ts for the per-site split.
         applyRouteMatching(this.api);
     }
     static close() {

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAA2F,MAAM,SAAS,CAAC;AAClH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,GAAG,MAAM,YAAY,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,kBAAkB,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,UAAU;IAC7B,MAAM,CAAC,QAAQ,CAAa;IAE5B,GAAG,CAAW;IACd,MAAM,CAAU;IAEhB;QACE,IAAI,UAAU,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QACpD,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;QAErB,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,KAAK;QACV,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAErF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;QACvC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACrE,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEpC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAEzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAEnC,oBAAoB;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEnH,IAAI,iBAAiB;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAoB,EAAE,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAE1D,IAAI,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAElD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACX,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,iBAA0B,EAAE,EAAE,IAAI,EAAE,OAAO,EAAuC;QAC3F,MAAM,UAAU,GAAG,iBAAmG,CAAC;QACvH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,MAAM,EAAE,eAAe,EAAE,GAAG,aAAa,CAAC;QAE1C,aAAa,CAAC,aAAa,EAAE,CAAC;QAC9B,eAAe,CAAC,SAAS,GAAG,KAAK,CAAC;QAElC,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAA2F,MAAM,SAAS,CAAC;AAClH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,GAAG,MAAM,YAAY,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,kBAAkB,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,UAAU;IAC7B,MAAM,CAAC,QAAQ,CAAa;IAE5B,GAAG,CAAW;IACd,MAAM,CAAU;IAEhB;QACE,IAAI,UAAU,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QACpD,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;QAErB,+DAA+D;QAC/D,yEAAyE;QACzE,mCAAmC;QACnC,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,gEAAgE;QAChE,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,iEAAiE;QACjE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,KAAK;QACV,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAErF,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;QACvC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACrE,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEpC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAEzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAEnC,oBAAoB;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEnH,IAAI,iBAAiB;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAoB,EAAE,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QAE1D,IAAI,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAElD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACX,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,iBAA0B,EAAE,EAAE,IAAI,EAAE,OAAO,EAAuC;QAC3F,MAAM,UAAU,GAAG,iBAAmG,CAAC;QACvH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,MAAM,EAAE,eAAe,EAAE,GAAG,aAAa,CAAC;QAE1C,aAAa,CAAC,aAAa,EAAE,CAAC;QAC9B,eAAe,CAAC,SAAS,GAAG,KAAK,CAAC;QAElC,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,OAAO,IAAI,cAAc,EAAE,KAAK,QAAQ,IAAI,eAAe,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAOlH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACtG,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;AAC3F,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,SAAmB;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY;IASlD,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWrE,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAG,aAAa,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;;IAe3B,aAAa,IAAI,IAAI;CAqDtB"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,OAAO,IAAI,cAAc,EAAE,KAAK,QAAQ,IAAI,eAAe,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAOlH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACtG,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;AAC3F,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,SAAmB;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY;IASlD,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWrE,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAG,aAAa,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;;IAmB3B,aAAa,IAAI,IAAI;CAqDtB"}

package/dist/request.js

@@ -28,10 +28,14 @@ export default class Request {
     constructor() {
         const api = express();
         api.disable('x-powered-by');
-        // Closes sub-paths (/public/SUCCESS) for abofs/stonyx-rest-server#47.
-        // Must stay in the constructor: registerCalls() materializes this router,
-        // and a set applied afterwards has no effect. The parent app's setting
-        // does not reach here -- see src/route-matching.ts.
+        // Applies BOTH route-matching settings: case sensitive routing
+        // (abofs/stonyx-rest-server#47) and strict routing (#50). For #47 this
+        // call closes sub-paths (/public/SUCCESS) and the parent's call closes the
+        // mount segment; for #50 THIS call closes the entire trailing-slash
+        // authorization bypass on its own, and the parent's call has no security
+        // role. Must stay in the constructor: registerCalls() materializes this
+        // router, and a set applied afterwards has no effect. The parent app's
+        // setting does not reach here -- see src/route-matching.ts.
         applyRouteMatching(api);
         this.expressInstance = api;
     }

package/dist/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2F,MAAM,SAAS,CAAC;AAClH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,kBAAkB,MAAM,qBAAqB,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAOnE,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAmB;QACjC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAyC,CAAC;QACzD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;QAE9E,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAoB,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,eAAe,CAAU;IACzB,QAAQ,CAAiB;IAGzB;QACE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE5B,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,oDAAoD;QACpD,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAEjD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,2CAA2C,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,eAA6I,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;oBAChN,+DAA+D;oBAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;wBACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC7C,IAAI,MAAM;4BAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACrD,CAAC;oBAED,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAqB,CAAC;oBAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAG,CAAC;oBAClC,IAAI,QAAiB,CAAC;oBAEtB,iBAAiB;oBACjB,OAAM,SAAS,CAAC,MAAM,EAAE,CAAC;wBACvB,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnE,IAAI,QAAQ,KAAK,SAAS;4BAAE,MAAM;oBACpC,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS;wBAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,QAAkB,CAAC,CAAC;oBAEnF,+CAA+C;oBAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;oBAC3B,IAAI,QAAQ;wBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAkB,CAAC,CAAC;oBAEtD,2CAA2C;oBAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;oBACvB,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAA0F,CAAC;wBAEvH,IAAI,OAAO;4BAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gCAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBACrF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAEtE,GAAG,CAAC,IAAI,CAAC,QAAmC,CAAC,CAAC;gBAChD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2F,MAAM,SAAS,CAAC;AAClH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,kBAAkB,MAAM,qBAAqB,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAOnE,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAmB;QACjC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAyC,CAAC;QACzD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;QAE9E,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAoB,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,eAAe,CAAU;IACzB,QAAQ,CAAiB;IAGzB;QACE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE5B,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,4DAA4D;QAC5D,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAEjD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,2CAA2C,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,eAA6I,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;oBAChN,+DAA+D;oBAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;wBACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC7C,IAAI,MAAM;4BAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACrD,CAAC;oBAED,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAqB,CAAC;oBAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAG,CAAC;oBAClC,IAAI,QAAiB,CAAC;oBAEtB,iBAAiB;oBACjB,OAAM,SAAS,CAAC,MAAM,EAAE,CAAC;wBACvB,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnE,IAAI,QAAQ,KAAK,SAAS;4BAAE,MAAM;oBACpC,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS;wBAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,QAAkB,CAAC,CAAC;oBAEnF,+CAA+C;oBAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;oBAC3B,IAAI,QAAQ;wBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAkB,CAAC,CAAC;oBAEtD,2CAA2C;oBAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;oBACvB,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAA0F,CAAC;wBAEvH,IAAI,OAAO;4BAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gCAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBACrF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAEtE,GAAG,CAAC,IAAI,CAAC,QAAmC,CAAC,CAAC;gBAChD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC"}

package/dist/route-matching.d.ts

@@ -29,7 +29,62 @@ import type { Express } from 'express';
  *
  * Note `express({ caseSensitive: true })` does NOT work: express 5's
  * `createApplication()` takes zero arguments and forwards nothing. The app
- * setting is the only mechanism.
+ * setting is the only mechanism. The same is true of `strict`.
+ *
+ * ---
+ *
+ * `strict routing` (abofs/stonyx-rest-server#50) closes the same class of
+ * authorization bypass for a TRAILING SLASH: `GET /private/failure` was denied
+ * by a consumer's auth hook while `GET /private/failure/` reached the guarded
+ * handler, because the hook compares `req.path` against `/failure`.
+ *
+ * It is a SEPARATE key from `caseSensitiveRoutes`, not a rename and not a
+ * reuse. Coupling them would force any consumer who legitimately needs
+ * trailing-slash tolerance -- a load balancer probing `/health/`, a
+ * slash-normalizing proxy -- to re-open #47's case bypass to get it. Case
+ * insensitivity is almost never intentional; slash tolerance frequently is.
+ *
+ * The two settings do NOT share the #47 split above, and this is the one thing
+ * not to carry across from that fix. For `strict routing`:
+ *
+ *   - The CHILD site (Request's constructor) closes the entire security
+ *     defect on its own. The parent site does nothing for it.
+ *   - The PARENT site (RestServer's constructor) closes exactly one thing in
+ *     this repo: `/health/`, the only route registered directly on the parent
+ *     app. It has no security role here; do not describe it as having one.
+ *
+ * The cause is concrete: `Router.prototype.use` hardcodes `strict: false` (and
+ * `end: false`), so mount segments are structurally strict-immune. That is the
+ * OPPOSITE of `sensitive`, which `use()` DOES forward, and which is why #47's
+ * parent site closed `/PUBLIC/...`. The version-pinned file-and-line citation
+ * for that upstream behaviour is deliberately kept in ONE place --
+ * `docs/project-structure.md`, section "Strict routing (#50)" -- so a router
+ * upgrade invalidates one line rather than five. Both sites still get both
+ * settings (they share this function), but the justification differs and the
+ * tests are built on the measured split, not on the analogy.
+ *
+ * Consequence worth stating so nobody expects this setting to cover it: the
+ * mount-segment trailing slash (`/public/`) cannot be closed by an express
+ * SETTING. For both `/public` and `/public/` the mounted sub-app receives
+ * `req.path === '/'`, so a `req.path` auth hook sees no difference, and a test
+ * asserting `/public/` -> 404 could never pass.
+ *
+ * That is NOT the same as saying the edge is harmless or unclosable.
+ * `req.originalUrl` does differ, and a hook authorizing on it is bypassed by
+ * one character -- measured: `GET /admin` -> 401, `GET /admin/` -> 200 with the
+ * guarded handler running unauthenticated. That is a live bypass of the same
+ * class as #47 and #50, and it IS closable by this module: a canonical-path
+ * check ahead of the `auth` call in `Request.registerCalls()`, or opt-in
+ * normalizing middleware. It is tracked as abofs/stonyx-rest-server#54. Do not
+ * close it here, and do not read this note as saying it cannot be closed.
+ *
+ * Both guards are `!== false` for the same reason: these flags default to the
+ * truthy direction, so a truthy check fails OPEN for a consumer whose shipped
+ * config predates the key. Both are also asserted at the unit tier for BOTH
+ * failure shapes -- key present-and-`undefined` and key absent as an own
+ * property -- in `test/unit/request-test.ts` (#47's AC6, #50's AC3). The
+ * integration tier cannot see either: with the shipped default `true`, a
+ * fail-open guard leaves every integration assertion green.
  */
 export default function applyRouteMatching(api: Express): void;
 //# sourceMappingURL=route-matching.d.ts.map

package/dist/route-matching.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-matching.d.ts","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAE7D"}
+{"version":3,"file":"route-matching.d.ts","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAG7D"}

package/dist/route-matching.js

@@ -29,10 +29,67 @@ import config from 'stonyx/config';
  *
  * Note `express({ caseSensitive: true })` does NOT work: express 5's
  * `createApplication()` takes zero arguments and forwards nothing. The app
- * setting is the only mechanism.
+ * setting is the only mechanism. The same is true of `strict`.
+ *
+ * ---
+ *
+ * `strict routing` (abofs/stonyx-rest-server#50) closes the same class of
+ * authorization bypass for a TRAILING SLASH: `GET /private/failure` was denied
+ * by a consumer's auth hook while `GET /private/failure/` reached the guarded
+ * handler, because the hook compares `req.path` against `/failure`.
+ *
+ * It is a SEPARATE key from `caseSensitiveRoutes`, not a rename and not a
+ * reuse. Coupling them would force any consumer who legitimately needs
+ * trailing-slash tolerance -- a load balancer probing `/health/`, a
+ * slash-normalizing proxy -- to re-open #47's case bypass to get it. Case
+ * insensitivity is almost never intentional; slash tolerance frequently is.
+ *
+ * The two settings do NOT share the #47 split above, and this is the one thing
+ * not to carry across from that fix. For `strict routing`:
+ *
+ *   - The CHILD site (Request's constructor) closes the entire security
+ *     defect on its own. The parent site does nothing for it.
+ *   - The PARENT site (RestServer's constructor) closes exactly one thing in
+ *     this repo: `/health/`, the only route registered directly on the parent
+ *     app. It has no security role here; do not describe it as having one.
+ *
+ * The cause is concrete: `Router.prototype.use` hardcodes `strict: false` (and
+ * `end: false`), so mount segments are structurally strict-immune. That is the
+ * OPPOSITE of `sensitive`, which `use()` DOES forward, and which is why #47's
+ * parent site closed `/PUBLIC/...`. The version-pinned file-and-line citation
+ * for that upstream behaviour is deliberately kept in ONE place --
+ * `docs/project-structure.md`, section "Strict routing (#50)" -- so a router
+ * upgrade invalidates one line rather than five. Both sites still get both
+ * settings (they share this function), but the justification differs and the
+ * tests are built on the measured split, not on the analogy.
+ *
+ * Consequence worth stating so nobody expects this setting to cover it: the
+ * mount-segment trailing slash (`/public/`) cannot be closed by an express
+ * SETTING. For both `/public` and `/public/` the mounted sub-app receives
+ * `req.path === '/'`, so a `req.path` auth hook sees no difference, and a test
+ * asserting `/public/` -> 404 could never pass.
+ *
+ * That is NOT the same as saying the edge is harmless or unclosable.
+ * `req.originalUrl` does differ, and a hook authorizing on it is bypassed by
+ * one character -- measured: `GET /admin` -> 401, `GET /admin/` -> 200 with the
+ * guarded handler running unauthenticated. That is a live bypass of the same
+ * class as #47 and #50, and it IS closable by this module: a canonical-path
+ * check ahead of the `auth` call in `Request.registerCalls()`, or opt-in
+ * normalizing middleware. It is tracked as abofs/stonyx-rest-server#54. Do not
+ * close it here, and do not read this note as saying it cannot be closed.
+ *
+ * Both guards are `!== false` for the same reason: these flags default to the
+ * truthy direction, so a truthy check fails OPEN for a consumer whose shipped
+ * config predates the key. Both are also asserted at the unit tier for BOTH
+ * failure shapes -- key present-and-`undefined` and key absent as an own
+ * property -- in `test/unit/request-test.ts` (#47's AC6, #50's AC3). The
+ * integration tier cannot see either: with the shipped default `true`, a
+ * fail-open guard leaves every integration assertion green.
  */
 export default function applyRouteMatching(api) {
     if (config.restServer?.caseSensitiveRoutes !== false)
         api.set('case sensitive routing', true);
+    if (config.restServer?.strictRoutes !== false)
+        api.set('strict routing', true);
 }
 //# sourceMappingURL=route-matching.js.map

package/dist/route-matching.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-matching.js","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAY;IACrD,IAAI,MAAM,CAAC,UAAU,EAAE,mBAAmB,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;AAChG,CAAC"}
+{"version":3,"file":"route-matching.js","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAY;IACrD,IAAI,MAAM,CAAC,UAAU,EAAE,mBAAmB,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,UAAU,EAAE,YAAY,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACjF,CAAC"}

package/package.json

@@ -4,7 +4,7 @@
     "stonyx-async",
     "stonyx-module"
   ],
-  "version": "0.2.1-beta.90",
+  "version": "0.2.1-beta.91",
   "description": "Rest Server Module for Stonyx Framework",
   "repository": {
     "type": "git",