npm - @stonyx/rest-server - Versions diffs - 0.2.1-beta.91 → 0.2.1-beta.93 - Mend

@stonyx/rest-server 0.2.1-beta.91 → 0.2.1-beta.93

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/README.md +251 -26
package/config/environment.js +144 -7
package/dist/request.d.ts.map +1 -1
package/dist/request.js +91 -3
package/dist/request.js.map +1 -1
package/dist/route-matching.d.ts +188 -21
package/dist/route-matching.d.ts.map +1 -1
package/dist/route-matching.js +248 -20
package/dist/route-matching.js.map +1 -1
package/package.json +1 -1

package/README.md CHANGED Viewed

@@ -81,23 +81,40 @@ Configuration is read from `stonyx/config` under `restServer`:
 | `enableHealthCheck` |   **Boolean**     | `true`      | Register `GET /health` endpoint (disable via `REST_HEALTH_CHECK_DISABLE=true`) |
 | `caseSensitiveRoutes` | **Boolean**   | `true`      | Match route paths case-sensitively. Disable via `REST_CASE_SENSITIVE_ROUTES=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**. |
 | `strictRoutes`    | **Boolean**   | `true`      | Match route paths strictly, so a trailing slash does not match a route registered without one. Disable via `REST_STRICT_ROUTES=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**, and note `GET /health/` now 404s. |
+| `canonicalRoutes` | **Boolean**   | `true`      | Reject a request whose raw target is not the canonical path express matched, before your `auth` hook runs. Disable via `REST_CANONICAL_ROUTES=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**, and note `GET /route/` at a mount root and every absolute-form request target now 404 on the routes this module registers (see the scope limit under [Upgrading](#upgrading-behaviour-changes)). |
+| `canonicalEncoding` | **Boolean**   | `true`      | Reject a request whose raw target percent-encodes an RFC 3986 §2.3 *unreserved* character (`A-Z a-z 0-9 - . _ ~`), before your `auth` hook runs. Disable via `REST_CANONICAL_ENCODING=false`. See [Route Matching Strictness](#route-matching-strictness) — **disabling this re-opens a security hole**, and note that a client over-encoding an unreserved character in a path now gets 404 (see [Upgrading](#upgrading-behaviour-changes)). Like `canonicalRoutes` this is a **registration-site** control, not a global one: the check runs in the handlers mounted from your request classes, so a route registered directly on `RestServer.instance.api` gets none of it — measured, `GET /direct/%73ecret` → **200** with `id "secret"` while `GET /enc/%73ecret` → 404. |
 |  `trustProxy`   |     **Boolean**     | `false`     | Trust reverse proxy headers (e.g. `X-Forwarded-Proto`). Enable via `REST_TRUST_PROXY=true` when running behind a load balancer such as AWS ALB/ELB to ensure correct protocol detection. |
 |    `statusMap`    |      **Object**     | `{}`        | Optional mapping of HTTP status codes to custom messages   |
 ### Route Matching Strictness
-Routes match **case-sensitively and strictly by default**. Two settings, both
-on, both applied at both express construction sites:
+Routes match **case-sensitively, strictly, and only at their canonical target**
+by default, and a raw target that percent-encodes an RFC 3986 §2.3 *unreserved*
+character is rejected. Four controls, all on.
-| axis | setting | example that no longer matches |
+Note what that does **not** say. It is not "one accepted spelling per id", and
+this module cannot give you that: reserved characters, non-ASCII bytes and
+control octets all stay encodable, and every one of them whose hex carries a
+letter digit aliases by hex-digit case. The residual is stated and measured
+below, under [the residual](#the-residual-stated-plainly).
+| axis | control | example that no longer matches |
 |---|---|---|
-| casing | `case sensitive routing` | `GET /users/Success` -> does not reach `/success` |
-| trailing slash | `strict routing` | `GET /users/success/` -> does not reach `/success` |
+| casing | `case sensitive routing` (setting) | `GET /users/Success` -> does not reach `/success` |
+| trailing slash | `strict routing` (setting) | `GET /users/success/` -> does not reach `/success` |
+| canonical target | `canonicalRoutes` (per-request check) | `GET /users/` and `GET http://host/users` -> do not reach the mounted `/users` class |
+| percent-encoding | `canonicalEncoding` (per-request check) | `GET /users/%73ecret` -> does not reach `/users/:id` with `id === "secret"` |
+The first two are express settings applied at both construction sites. The last
+two are **not settings** — no express setting can express either — they are
+per-request checks run ahead of your `auth` hook: one compares the raw request
+target against the path express matched, the other rejects a raw target that
+percent-encodes a character which never needs encoding. See
+[`src/route-matching.ts`](src/route-matching.ts).
 Read [What this does not do](#what-this-does-not-do) and
-[Upgrading](#upgrading-behaviour-changes) before you rely on that. Two things
-the table does not say: "does not reach the handler" is not the same as "404",
-and one edge of the trailing-slash axis is **not** closed and cannot be.
+[Upgrading](#upgrading-behaviour-changes) before you rely on that. One thing the
+table does not say: "does not reach the handler" is not the same as "404".
 This is deliberate and security-relevant. Express matches both case-insensitively
 and slash-insensitively by default, which means any authorization written
@@ -128,11 +145,10 @@ be the exact registered spelling, in the exact registered casing, with no
 trailing slash. That closes [#47](https://github.com/abofs/stonyx-rest-server/issues/47)
 and [#50](https://github.com/abofs/stonyx-rest-server/issues/50).
-#### What this does not do
+#### The canonical-target check (`canonicalRoutes`)
-**It does not close the trailing slash on a mount root, and no setting can.**
-This is the one edge that remains open, so do not read the section above as
-closing the class outright:
+**No express *setting* closes the trailing slash on a mount root**, and that has
+not changed:
 ```
 GET /public   -> req.path '/'   req.originalUrl '/public'
@@ -144,16 +160,143 @@ unconditionally (`router@2.2.0`; the file-and-line citation is in
 [`docs/project-structure.md`](docs/project-structure.md) § *Strict routing
 (#50)*), so both forms reach the mounted route class and both arrive with
 `req.path === '/'`. A hook authorizing on `req.path` cannot tell them apart, so
-for that hook there is no asymmetry to exploit. **A hook comparing
-`req.originalUrl` still sees two different strings, and `strictRoutes` does not
-change that.** If your authorization compares `req.originalUrl` rather than
-`req.path`, keep whatever URL normalization you have.
+for that hook there is no asymmetry to exploit — and there is nothing for
+`strict routing` to reject. **A hook comparing `req.originalUrl` sees two
+different strings**, and that was a live authorization bypass.
+`canonicalRoutes` closes it, as a per-request check rather than a setting
+([#54](https://github.com/abofs/stonyx-rest-server/issues/54)). Before your
+`auth` hook runs, the raw request target is compared against the path express
+matched, and a mismatch is rejected as a plain 404. It closes **two** vectors
+against `req.originalUrl` — the field express does not normalize:
+```
+                                   before   after
+GET /admin                           401      401   (hook fires, request blocked)
+GET /admin/                          200      404   (hook never fired; now a miss)
+GET http://host/admin                200      404   (absolute-form; hook never fired)
+GET http://host/admin/settings       200      404   (absolute-form; every route from a request class)
+```
+The second vector is the one to check first. [RFC 9112
+§3.2.2](https://www.rfc-editor.org/rfc/rfc9112#section-3.2.2) permits an
+**absolute-form** request target, express routes it, and it hands your hook the
+whole URI — `req.originalUrl === "http://host/admin"`. Unlike the mount-root
+slash, that affects **every route mounted from a request class**, not one edge.
+The qualifier is a registration-site limit, not a special case for one URL: the
+check runs inside the handlers this module registers, so anything you register
+directly on `RestServer.instance.api` is outside it. In this repo that is
+`/health` alone, and `GET http://host/health` still returns 200 — measured.
+The target is compared **raw**. It is not parsed, normalized or resolved first:
+normalizing it would launder exactly the string your hook is exposed to and
+re-open the absolute-form vector by construction. Only the query string is
+removed before comparison, so `GET /admin?x=1` still reaches your hook — **strip
+the query yourself** if your hook compares `req.originalUrl` against a fixed
+path, or it will not match (see [Consumer
+Contracts](#consumer-contracts)). Rejections are indistinguishable from a
+genuine miss by design; see [Upgrading](#upgrading-behaviour-changes).
+Routes registered *with* a literal trailing slash are unaffected — their
+canonical target carries the slash. So are index-mounted route classes and
+query strings on canonical paths.
+**Param routes: "unaffected" means "no regression".** `/resource/:id` keeps
+matching exactly as it did. `canonicalRoutes` is structurally blind to how a
+param value is *spelled* — express decodes only `req.params`, so `target` and
+`canonical` are both the same encoded string and this comparison passes the
+request through by construction. That axis has its own control, below.
+#### The percent-encoding check (`canonicalEncoding`)
+Express decodes **`req.params` and nothing else**. `req.path` and
+`req.originalUrl` both stay percent-encoded, so an `auth` hook comparing either
+of them against a fixed string was walked past by re-spelling the id:
+```
+                          before   after
+GET /enc/secret             401      401   (hook fires, request blocked)
+GET /enc/%73ecret           200      404   (hook never fired; handler got id "secret")
+GET /enc/%73%65%63%72%65%74 200      404
+GET /private/%66ailure      200      404   (guard missed; absorbed by a sibling /:id)
+```
+`canonicalEncoding` closes it
+([#56](https://github.com/abofs/stonyx-rest-server/issues/56)). Before your
+`auth` hook runs, the query-stripped raw target is rejected as a plain 404 if it
+contains a percent-triplet whose octet is an
+[RFC 3986 §2.3](https://www.rfc-editor.org/rfc/rfc3986#section-2.3)
+**unreserved** character — `A-Z`, `a-z`, `0-9`, `-`, `.`, `_`, `~`. Those are
+exactly the characters a URI generator must **not** encode and a normalizer
+**must** decode, so nothing a client is required to send is affected.
+**This is not a list of spellings, it is a family.** For an id of *n* bytes
+there are `∏(1 + vᵢ) − 1` non-canonical spellings, where a byte whose hex
+carries a letter digit has two (`m`, `%6d`, `%6D`). Measured against unfixed
+code: **63 of 63** spellings of `secret` returned 200, and **71 of 71** of
+`admin`. Enumerating them in your own hook is not a remedy.
+**Three things it deliberately does not reject:**
-No *setting* closes this, but the module can:
-[#54](https://github.com/abofs/stonyx-rest-server/issues/54) tracks closing it
-with a canonical-path check ahead of the `auth` hook. Until that ships, an
-`originalUrl` hook is bypassed by one character — `GET /admin` denied,
-`GET /admin/` reaching the route class's index handler.
+```
+GET /enc/sec%2fret   -> 200  id "sec/ret"    %2f is RESERVED — must stay encodable
+GET /enc/a%2Bb       -> 200  id "a+b"        %2B is RESERVED
+GET /enc/%2573ecret  -> 200  id "%73ecret"   express decodes exactly ONCE
+GET /enc/x?name=%61  -> 200  id "x"          the query string is stripped, not scanned
+GET /enc/%zz         -> 400                  malformed escapes are the router's 400, unchanged
+```
+If you were tempted to write `decodeURIComponent(req.path)` in your hook: the
+first line is why not. The router **splits then decodes**, so `sec%2fret` is one
+segment naming the id `sec/ret`; a hook that decodes then splits sees two
+segments and denies a request the router routed somewhere else entirely. And a
+hook that decodes *until stable* denies line three, which is a legitimately
+distinct id.
+#### The residual, stated plainly
+**This does not give each id one spelling.** The rule rejects an over-encoded
+*unreserved* octet, which means every octet **outside** `A-Za-z0-9-._~` stays
+encodable — and any such octet whose hex carries a letter digit therefore has
+two accepted spellings, upper- and lower-case hex. **That is every reserved
+character, every non-ASCII byte, and every control octet whose hex carries a
+letter digit — not only the reserved ones.** It is not the whole complement of
+`A-Za-z0-9-._~`: `%21` and `%40` carry no letter hex digit and alias
+literal-versus-encoded instead, `%00` and `%09` keep exactly one accepted
+spelling and do not alias at all, and `%90` is a 400. Two different raw targets
+can still name the same record:
+```
+GET /enc/a+b                  -> 200  id "a+b"
+GET /enc/a%2Bb                -> 200  id "a+b"      <- two accepted spellings, one id
+GET /enc/sec%2fret            -> 200  id "sec/ret"
+GET /enc/sec%2Fret            -> 200  id "sec/ret"  <- hex-digit case, same id again
+GET /i18n/caf%C3%A9           -> 401  hook denies this spelling
+GET /i18n/caf%c3%a9           -> 200  id "café"     <- same id, hook walked past
+GET /i18n/%E5%8C%97%E4%BA%AC  -> 401
+GET /i18n/%e5%8c%97%e4%ba%ac  -> 200  id "北京"
+GET /i18n/a%0Db               -> 401
+GET /i18n/a%0db               -> 200  id "a\rb"     <- a CONTROL octet, same aliasing
+```
+The last six lines were measured against this module's shipped predicate on a
+deny list holding **no reserved character at all** — the three uppercase-hex
+spellings, nothing else. If your ids are i18n text, or anything else that is not
+pure `A-Za-z0-9-._~`, the residual applies to you. Reading it as "only affects
+ids with a `/` or a `+` in them" is the mistake this paragraph exists to
+prevent.
+**So a hook comparing a raw path string is still unsound for any id carrying an
+octet outside `A-Za-z0-9-._~` that keeps more than one accepted spelling —
+reserved characters, non-ASCII bytes and control octets whose hex carries a
+letter digit alike — and `req.params` is the sound comparison.** `req.params` is
+decoded by express and is populated *before* your `auth` hook runs, by design —
+compare that, and none of this applies to you. This module cannot close the
+residual for you without 404ing encodings clients are entitled to send; see
+[Consumer Contracts](#consumer-contracts).
+#### What this does not do
 **It does not normalize path *parameter values*.** If your `auth()` hook rejects
 `params.id === 'restricted'`, then `GET /private/RESTRICTED` still reaches the
@@ -182,7 +325,49 @@ another variant of the bug above.
 #### Upgrading: behaviour changes
-Both settings change which requests match, so both are consumer-visible.
+All four controls change which requests match, so all four are
+consumer-visible.
+**A client that over-encodes an unreserved character in a path now gets 404.**
+`GET /public/url-params/%61/b/c` returns **404** where it previously returned
+200 — measured on this repo's own fixture. `%61` is `a`, and
+[RFC 3986 §2.3](https://www.rfc-editor.org/rfc/rfc3986#section-2.3) says a
+generator must not encode it, so no correct client emits this. Some do anyway:
+over-eager `encodeURIComponent` on an id that never needed it, a URL builder
+that percent-encodes everything, or a client library normalizing in the wrong
+direction. Reserved characters are **unaffected** — `%2f`, `%2B`, `%25` and
+every non-ASCII byte still route, and so does anything in the query string.
+Remediation is `REST_CANONICAL_ENCODING=false`, or fix the client. Like the two
+below, the rejection is **indistinguishable from a route that was never
+registered**, and this module emits no request logging.
+**Clients or forward proxies sending absolute-form request targets now get 404
+on every route mounted from a request class.** `GET http://host/admin HTTP/1.1`
+is a legal request target
+([RFC 9112 §3.2.2](https://www.rfc-editor.org/rfc/rfc9112#section-3.2.2)), and
+express used to route it. It is now rejected on every route this module
+registers — for a client that emits it, this is a total outage, not a partial
+one, and it is the largest blast radius in this change. The one carve-out is a
+**registration site**, not a route: the check lives in the handlers mounted from
+your request classes, so anything registered directly on
+`RestServer.instance.api` never reaches it. `GET /health` is the only such route
+in this repo, and `GET http://host/health` still returns 200 — so do not use it
+to confirm the new rejection is live, and do not assume an authorized route you
+registered on `api` yourself is covered. Reverse proxies in normal use (nginx,
+HAProxy, AWS ALB) send origin-form and are unaffected; **forward** proxies and
+hand-rolled HTTP clients are the exposure. Remediation is
+`REST_CANONICAL_ROUTES=false`, or fix the client.
+**`GET /route/` at a mounted route class's root now returns 404.** Previously
+200. If a client appends a trailing slash to a mount root, it stops working.
+Both rejections are **indistinguishable from a route that was never
+registered** — same status, same `Content-Type`, same headers — which is the
+intended security property: a distinguishable rejection is an oracle telling an
+attacker the route exists and was merely spelled wrong. Combined with this
+module emitting **no request logging**, a broken client shows up as a bare
+`Cannot GET …` with nothing at all on the server side. **Check this first if
+routes start 404ing after upgrade.**
 **`GET /health/` now returns 404.** `GET /health` is unaffected. This is the
 change most likely to page someone, and it is an **availability** problem rather
@@ -208,21 +393,44 @@ no log line and no stack, so it looks like a deploy that dropped a route.
 #### Opting out
-Two separate flags, one per axis:
+Four separate flags, one per axis:
 ```bash
 REST_CASE_SENSITIVE_ROUTES=false   # restores case-insensitive matching (#47)
 REST_STRICT_ROUTES=false           # restores trailing-slash tolerance (#50)
+REST_CANONICAL_ROUTES=false        # restores non-canonical request targets (#54)
+REST_CANONICAL_ENCODING=false      # restores percent-encoded spellings (#56)
 ```
-or equivalently `restServer: { caseSensitiveRoutes: false, strictRoutes: false }`.
+or equivalently
+`restServer: { caseSensitiveRoutes: false, strictRoutes: false, canonicalRoutes: false, canonicalEncoding: false }`.
-**They are deliberately separate keys, and neither implies the other.** Slash
+**They are deliberately separate keys, and none implies the others.** Slash
 tolerance is a legitimate need — a health-check URL you cannot change today is
 the common case. Casing tolerance almost never is. Folding them into one flag
 would force anyone who needs the first to accept the second, which is why a
 consumer who took the `#47` opt-out still has to set `REST_STRICT_ROUTES=false`
-separately to keep trailing slashes working.
+separately to keep trailing slashes working. `REST_CANONICAL_ROUTES=false` is
+separate for the same reason: a consumer who needs mount-root slash tolerance
+should not have to re-open `#50`'s sub-path bypass to get it.
+`REST_CANONICAL_ROUTES=false` is a **temporary remediation**, not a
+configuration to run on. It re-opens both `#54` vectors at once — the mount-root
+slash *and* the absolute-form target — against any hook authorizing on
+`req.originalUrl`. It is env-only, so restoring service does not need a
+redeploy; use it to stop the bleeding, then fix the client and remove it.
+**`REST_CANONICAL_ENCODING=false` re-opens the `#56` bypass, and it is the
+widest of the four.** With it set, `GET /users/%73ecret` reaches your `/:id`
+handler with `id === "secret"` while your hook compared `%73ecret` and did not
+match — and it does that against a hook comparing `req.path` **or**
+`req.originalUrl`, on every route class with a param segment. The other three
+flags each re-open one field's worth of exposure; this one re-opens both. It is
+also **independent** of `REST_CANONICAL_ROUTES`: if you have to set that one for
+an absolute-form-emitting forward proxy, you keep this one on, which is exactly
+why they are separate keys. If you must set it, the mitigation that costs you
+nothing is to compare `req.params` in your hook rather than a raw path string —
+`req.params` is decoded and was never exposed to this.
 **Each flag restores the corresponding vulnerability described above** — the
 URL-based authorization in your application becomes bypassable along that axis
@@ -230,6 +438,23 @@ again. They exist as one-line remediations for an existing deployment, not as a
 configuration to run on. Set the flag to restore service, then fix the client
 and remove the flag.
+### Consumer Contracts
+Three things this module deliberately does **not** do for you. Each is a state
+the framework permits, only your own discipline prevents, and that produces **no
+error and no log** when that discipline lapses — so they are collected here
+rather than left implied by the sections above.
+| you must | because | symptom if you don't |
+|---|---|---|
+| **Strip the query string** before comparing `req.originalUrl` to a fixed path in an `auth` hook | `canonicalRoutes` compares the query-*stripped* target — a query string is a legitimately variable part of a request target, and rejecting on it would 404 every `?`-carrying request | `GET /admin?x=1` reaches your guarded handler **unauthenticated**, 200, no error, no log. Measured identical before and after `canonicalRoutes` |
+| **Compare `req.params`, not a raw path string** | express decodes only `req.params`; `req.path` and `req.originalUrl` both stay percent-encoded. `canonicalEncoding` (#56) rejects an over-encoded *unreserved* character, but every octet outside `A-Za-z0-9-._~` stays encodable — **reserved characters, non-ASCII bytes and control octets alike** — and every one of them whose hex carries a letter digit aliases by hex-digit case, so one decoded id still has more than one accepted spelling: `GET /orders/a+b` and `GET /orders/a%2Bb` both run the handler with `id === "a+b"`, `sec%2fret` / `sec%2Fret` both give `sec/ret`, and `caf%C3%A9` / `caf%c3%a9` both give `café`. The class is **not** limited to reserved characters — see [the residual](#the-residual-stated-plainly) | your hook compares one spelling, the request arrives in another, and the handler runs **unauthenticated** — 200, no error, no log. Comparing `req.params.id` instead is immune by construction, and it is populated before `auth()` runs |
+| **Compare param values with the same casing you look them up with** | param *values* are never case-normalized, and record ids are legitimately case-sensitive | `GET /orders/SECRET` runs the handler with `id === "SECRET"` while your hook compared `secret`. Note that lower-casing the value is **not** the fix: it false-denies a genuinely distinct `SECRET` record and, measured in a sibling module, false-allowed an encoded spelling at the same time |
+| **Return `undefined` from `auth()` to mean "authorized"** — never `0` | any integer return is sent as the HTTP status | returning `0` sends a `0` status rather than allowing the request |
+`test/sample/requests/admin.ts` in this repo is the worked example of a
+correctly-written `originalUrl` hook for the first row.
 ### Running Behind a Load Balancer
 When your application runs behind a reverse proxy or load balancer (e.g. AWS ALB/ELB), the load balancer terminates SSL and forwards requests to your server over HTTP internally. This means Express sees `http` as the protocol even though the original client request used `https`.

package/config/environment.js CHANGED Viewed

@@ -1,4 +1,6 @@
 const {
+  REST_CANONICAL_ENCODING,
+  REST_CANONICAL_ROUTES,
   REST_CASE_SENSITIVE_ROUTES,
   REST_CORS_ORIGIN,
   REST_CORS_METHODS,
@@ -22,13 +24,20 @@ const config = {
   // stubs `caseSensitiveRoutes` to `undefined` and src/route-matching.ts reads
   // `!== false`, so AC6 guards the source's read and not this default.
   // Measured: pin `caseSensitiveRoutes: true` in test/config/environment.ts AND
-  // invert this line, and the suite reports 28 pass / 0 fail. A naive pin makes
+  // invert this line, and the suite reports 34 pass / 0 fail. A naive pin makes
   // an insecure published default completely invisible to a green suite --
   // quieter and weaker, which is the outcome pinning was supposed to prevent.
+  // Inverting this line ALONE, unpinned, reports 31 pass / 3 fail (#47's AC3,
+  // AC4 and AC5; AC6 green).
   //
   // The cost of leaving it unpinned is that the suite is ambient-sensitive here
-  // (`REST_CASE_SENSITIVE_ROUTES=false pnpm test` => 25 pass / 3 fail), but it
-  // fails LOUDLY, so there is no false green. Closing #43 for this key needs
+  // (`REST_CASE_SENSITIVE_ROUTES=false pnpm test` => 31 pass / 3 fail), but it
+  // fails LOUDLY, so there is no false green.
+  //
+  // Every count in this block was re-measured against the 34-test suite at
+  // #54's head. PASS totals here move whenever a test is ADDED anywhere in the
+  // repo -- the FAIL counts are the load-bearing half. Re-measure, do not
+  // adjust by arithmetic, when this block next looks stale. Closing #43 for this key needs
   // the subprocess-based env isolation this repo does not yet have; any fix
   // must keep a live assertion on this default.
   caseSensitiveRoutes: REST_CASE_SENSITIVE_ROUTES !== 'false',
@@ -46,23 +55,151 @@ const config = {
   // DELIBERATELY NOT PINNED in test/config/environment.ts -- do not "fix" this
   // as part of abofs/stonyx-rest-server#43. Same trap as the key above, and now
   // measured for both: pin `strictRoutes: true` in test/config/environment.ts
-  // AND invert this line to `=== 'true'`, and the suite reports 31 pass /
+  // AND invert this line to `=== 'true'`, and the suite reports 34 pass /
   // 0 fail. A naive pin makes an insecure published default completely
   // invisible to a green suite.
   //
-  // Unpinned, inverting this line alone turns #50's AC1 and AC2 red (29/2).
+  // Unpinned, inverting this line alone turns #50's AC1 and AC2 red (32/2).
   // AC3 stays GREEN under that mutation, because AC3 sets `strictRoutes` on the
   // config object directly and so guards src/route-matching.ts's READ rather
   // than this default -- the two assertions cover different halves and neither
   // subsumes the other.
   //
   // The cost is that the suite is ambient-sensitive here
-  // (`REST_STRICT_ROUTES=false pnpm test` => 29 pass / 2 fail), but it fails
-  // LOUDLY, so there is no false green. Closing #43 for either key needs
+  // (`REST_STRICT_ROUTES=false pnpm test` => 32 pass / 2 fail), but it fails
+  // LOUDLY, so there is no false green. All counts in this block re-measured
+  // against the 34-test suite at #54's head; the FAIL count is the load-bearing
+  // half, since PASS totals move whenever a test is added anywhere. Closing #43 for either key needs
   // subprocess-based env isolation this repo does not have; any fix must keep a
   // live assertion on this default.
   strictRoutes: REST_STRICT_ROUTES !== 'false',
+  // Secure by default, same polarity and same reasoning as the two keys above:
+  // a request whose RAW target is not the canonical path express matched is
+  // rejected with a plain 404 before the consumer's `auth` hook runs
+  // (abofs/stonyx-rest-server#54). This is NOT an express setting -- it is a
+  // per-request check in src/route-matching.ts (`shouldRejectTarget`), called
+  // from the handler closure in src/request.ts.
+  //
+  // BEHAVIOUR CHANGE for consumers upgrading, on TWO axes:
+  //   1. `GET /route/` at a mounted route class's ROOT now returns 404.
+  //   2. Clients or forward proxies emitting an ABSOLUTE-FORM request target
+  //      (`GET http://host/admin HTTP/1.1`, RFC 9112 3.2.2) now receive 404 on
+  //      every route registered through Request.registerCalls(). That is a
+  //      REGISTRATION-SITE limit, not a carve-out for one URL: /health is
+  //      registered directly on the parent app (src/main.ts) and still answers
+  //      200 to an absolute-form target -- and so would any route a consumer
+  //      registers on the public RestServer.instance.api itself. This is the
+  //      larger blast radius: for such a client it is a total outage, not a
+  //      partial one. Reverse proxies in normal use
+  //      (nginx, HAProxy, ALB) send origin-form and are unaffected.
+  // This module emits no request log, so both look like a dropped route.
+  //
+  // Opt out with REST_CANONICAL_ROUTES=false only as a temporary remediation --
+  // it RE-OPENS the bypass. Separate key from REST_STRICT_ROUTES and
+  // REST_CASE_SENSITIVE_ROUTES on purpose: coupling it to strictness would
+  // force a consumer who needs mount-root slash tolerance to also re-open #50's
+  // sub-path bypass.
+  //
+  // Note trustProxy below deliberately uses `=== 'true'` instead. That is not
+  // an inconsistency to "fix": its safe default is FALSY, so a truthy check
+  // already fails closed for it. The rule is "the guard must fail toward the
+  // safe value", not "all guards look alike".
+  //
+  // DELIBERATELY NOT PINNED in test/config/environment.ts -- do not "fix" this
+  // as part of abofs/stonyx-rest-server#43. Same trap as the two keys above,
+  // and now measured for all three: pin `canonicalRoutes: true` in
+  // test/config/environment.ts AND invert this line to `=== 'true'`, and the
+  // suite reports 34 pass / 0 fail while an insecure default ships. The pin is
+  // quieter AND weaker than no pin, which is the outcome pinning was supposed
+  // to prevent.
+  //
+  // Unpinned, inverting this line alone reports 32 pass / 2 fail: #54's
+  // integration AC1 and #50's AC2. AC2 (unit) stays GREEN under that mutation,
+  // because it sets `canonicalRoutes` on the config object directly and so
+  // guards src/route-matching.ts's READ rather than this default -- the two
+  // assertions cover different halves and neither subsumes the other.
+  // Conversely, weakening the READ to `=== true` reports 33 pass / 1 fail with
+  // AC2 as the only failure and AC1 fully green. All four counts in this block
+  // were re-measured on the #54 branch head after the AC1.11/AC1.12 assertions
+  // were added; the suite is 34 tests, and the FAIL count is the load-bearing
+  // half.
+  //
+  // The cost is that the suite is ambient-sensitive here
+  // (`REST_CANONICAL_ROUTES=false pnpm test` => 32 pass / 2 fail), but it fails
+  // LOUDLY, so there is no false green. Closing #43 for any of the three keys
+  // needs subprocess-based env isolation this repo does not have; any fix must
+  // keep a live assertion on this default.
+  canonicalRoutes: REST_CANONICAL_ROUTES !== 'false',
+  // Secure by default, same polarity and same reasoning as the three keys
+  // above: a request whose RAW target percent-encodes an RFC 3986 2.3
+  // UNRESERVED character (ALPHA / DIGIT / "-" / "." / "_" / "~") is rejected
+  // with a plain 404 before the consumer's `auth` hook runs
+  // (abofs/stonyx-rest-server#56). Like canonicalRoutes this is NOT an express
+  // setting -- it is a per-request check in src/route-matching.ts
+  // (`shouldRejectEncoding`), called from the handler closure in
+  // src/request.ts.
+  //
+  // What it closes: express decodes `req.params` and NOTHING else, so a
+  // consumer hook comparing `req.path` OR `req.originalUrl` was walked past by
+  // re-spelling an id -- `GET /enc/secret` -> 401 while
+  // `GET /enc/%73ecret` -> 200 with the guarded handler running
+  // unauthenticated and `req.params.id === 'secret'`. The spelling family is
+  // PROD(1 + v_i) - 1 per id, measured at 63 spellings for `secret` and 71 for
+  // `admin`, ALL of them 200 before this key existed. It is EXCLUSIVE to route
+  // classes carrying a `:param` segment; literal routes and mount segments
+  // match raw and were never reachable this way.
+  //
+  // BEHAVIOUR CHANGE for consumers upgrading, on a FOURTH axis:
+  //   Any client that over-encodes an unreserved character in a path now gets
+  //   404. Measured on this repo's own fixture:
+  //   `GET /public/url-params/%61/b/c` -> 404 (was 200). Over-encoding an
+  //   unreserved character is never required by RFC 3986 -- a normaliser MUST
+  //   decode these (6.2.2.2) -- so the blast radius is smaller than #54's,
+  //   whose absolute-form vector hits a real deployment shape. It is still a
+  //   breaking change and it is documented as one in the README.
+  //
+  // Opt out with REST_CANONICAL_ENCODING=false only as a temporary remediation
+  // -- it RE-OPENS the bypass. SEPARATE key from REST_CANONICAL_ROUTES on
+  // purpose, and this one is not a symmetry argument but a measurement: with
+  // the rule gated on `canonicalRoutes` instead of its own key,
+  // `REST_CANONICAL_ROUTES=false` returns `GET /enc/%73ecret` to 200 -- and
+  // that flag is exactly what a consumer behind an absolute-form-emitting
+  // forward proxy must set to stay up. Folding the two would hand precisely
+  // those consumers the encoding bypass as the price. Killed by
+  // test/unit/request-test.ts AC5.
+  //
+  // DELIBERATELY NOT PINNED in test/config/environment.ts -- do not "fix" this
+  // as part of abofs/stonyx-rest-server#43. Both halves RE-MEASURED for this
+  // key rather than inferred from the three above, against the 41-test suite
+  // at #56's head:
+  //   (a) invert this line to `=== 'true'` ALONE, unpinned:
+  //       36 pass / 5 fail -- #56's integration AC1 and AC2, unit AC5 and AC6,
+  //       and [Unit] Config AC7. It fails LOUDLY, so there is no false green.
+  //   (b) pin `canonicalEncoding: true` in test/config/environment.ts AND
+  //       invert this line: 40 pass / 1 fail, and the ONE failure is
+  //       [Unit] Config AC7 -- every behavioural assertion goes green because
+  //       the pin supplies the secure value the suite then observes. Measured
+  //       again with test/unit/config-test.ts removed: 40 pass / 0 fail, a
+  //       fully green suite shipping an insecure default. That is the trap, and
+  //       AC7 is the only thing standing between this key and it.
+  //
+  // Conversely, weakening the READ in src/route-matching.ts to `=== true`
+  // reports 40 pass / 1 fail with unit AC6 as the only failure and every
+  // integration assertion green -- the two guard different halves and neither
+  // subsumes the other. Closing #43 for any of the four keys needs the
+  // subprocess-based env isolation this repo does not have; any fix must keep a
+  // live assertion on this default.
+  //
+  // FOUR security-relevant keys now, all defaulting on, all disable-able, none
+  // pinned. Per docs/framework/testing.md the pinned set has to be evaluated as
+  // a SET rather than key by key; [Unit] Config AC7 asserts all four together
+  // for that reason. Whoever takes #43 inherits four keys and this paragraph as
+  // the reason they are unpinned, rather than finding four and assuming
+  // neglect.
+  canonicalEncoding: REST_CANONICAL_ENCODING !== 'false',
   enableHealthCheck: REST_HEALTH_CHECK_DISABLE !== 'true',
   origin: REST_CORS_ORIGIN ?? '*',
   methods: REST_CORS_METHODS ?? 'GET,POST,PATCH,PUT,DELETE',

package/dist/request.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,OAAO,IAAI,cAAc,EAAE,KAAK,QAAQ,IAAI,eAAe,~~EAAE~~,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;~~AAOlH~~,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACtG,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;AAC3F,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,SAAmB;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY;IASlD,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWrE,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAG,aAAa,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;;~~IAmB3B~~,aAAa,IAAI,IAAI;~~CAqDtB~~"}
1	+ {"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,OAAO,IAAI,cAAc,EAAE,KAAK,QAAQ,IAAI,eAAe,EAAqB,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAOrI,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACtG,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;AAC3F,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,SAAmB;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY;IASlD,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWrE,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAG,aAAa,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;;IA4B3B,aAAa,IAAI,IAAI;CAoItB"}

package/dist/request.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import express from 'express';
 import config from 'stonyx/config';
 import { makeArray } from '@stonyx/utils/object';
-import applyRouteMatching from './route-matching.js';
+import applyRouteMatching, { shouldRejectEncoding, shouldRejectTarget } from './route-matching.js';
 const METHODS = new Set(['get', 'post', 'put', 'delete', 'patch']);
 export default class Request {
     static stateProp = '__stonyxState';
@@ -28,7 +28,7 @@ export default class Request {
     constructor() {
         const api = express();
         api.disable('x-powered-by');
-        // Applies BOTH route-matching settings: case sensitive routing
+        // Applies BOTH route-matching SETTINGS: case sensitive routing
         // (abofs/stonyx-rest-server#47) and strict routing (#50). For #47 this
         // call closes sub-paths (/public/SUCCESS) and the parent's call closes the
         // mount segment; for #50 THIS call closes the entire trailing-slash
@@ -36,6 +36,15 @@ export default class Request {
         // role. Must stay in the constructor: registerCalls() materializes this
         // router, and a set applied afterwards has no effect. The parent app's
         // setting does not reach here -- see src/route-matching.ts.
+        //
+        // The third route-matching control, `canonicalRoutes` (#54), is NOT applied
+        // here and must not be moved here. It is not an express setting, and its
+        // timing contract is the opposite of these two: it is read PER REQUEST
+        // inside the handler closure in registerCalls() below, via
+        // shouldRejectTarget(). These two are constructor-timed because a late
+        // `set` is silently ineffective; that hazard does not exist for #54, and
+        // reading it per request is what lets the unit AC flip the flag between
+        // probes.
         applyRouteMatching(api);
         this.expressInstance = api;
     }
@@ -48,7 +57,86 @@ export default class Request {
                 continue;
             }
             for (const [route, handler] of Object.entries(handlers)) {
-                expressInstance[method](route, async (req, res) => {
+                expressInstance[method](route, async (req, res, next) => {
+                    // abofs/stonyx-rest-server#54 -- reject a request whose RAW target is
+                    // not the canonical path express matched, closing two authorization
+                    // bypasses against hooks that authorize on `req.originalUrl`: the
+                    // mount-root trailing slash and the absolute-form request target.
+                    //
+                    // Three properties of this line are load-bearing. Each is named with
+                    // the ONE assertion that turns red when it is removed -- assertion
+                    // numbers in `test/integration/rest-server-test.ts` AC1, so the claim
+                    // is checkable rather than a promise that coverage exists somewhere:
+                    //
+                    //   1. It runs OUTSIDE `if (this.auth)`. Gating it on the hook would
+                    //      leave `GET /public/` at 200 and make a security control depend
+                    //      on an unrelated consumer choice. Killed by AC1.6, which probes
+                    //      a route class with no hook.
+                    //   2. It runs BEFORE that block, not merely outside it. This is a
+                    //      SEPARATE property from 1 and needs its own probe: AC1.6 is on
+                    //      a hookless class, so it stays green if this line is merely
+                    //      moved BELOW the block. Measured with it moved: the suite was
+                    //      34 pass / 0 fail while `GET http://HOST/private/failure`
+                    //      answered 505 -- the consumer's hook status, which is the same
+                    //      oracle class as 3, and the hook itself ran on a request this
+                    //      module was about to reject. Killed by AC1.11.
+                    //   3. It rejects with `next('router')`, NOT sendStatusResponse() or
+                    //      res.sendStatus(404). Measured: sendStatus returns
+                    //      `text/plain "Not Found"` while a genuine miss returns
+                    //      `text/html <pre>Cannot GET ...</pre>` -- a working ORACLE
+                    //      telling an attacker the route exists but was spelled wrong.
+                    //      next('router') exits this sub-app's router into finalhandler
+                    //      and is shape-identical to a real miss (same status, same
+                    //      Content-Type, same CSP header). Routing it through
+                    //      sendStatusResponse() would additionally re-introduce the
+                    //      oracle for any consumer who sets a 404 in `statusMap`.
+                    //      Killed by AC1.5.
+                    //
+                    // Properties 1 and 2 were previously stated here as a single item
+                    // asserted to have "its own red-able assertion". It did not: only
+                    // half of it was covered. Do not re-merge them.
+                    if (shouldRejectTarget(req))
+                        return next('router');
+                    // abofs/stonyx-rest-server#56 -- reject a request whose RAW target
+                    // spells an UNRESERVED character (RFC 3986 2.3) as a percent-triplet,
+                    // closing the authorization bypass against a hook that compares
+                    // `req.path` OR `req.originalUrl` on any route class with a `:param`
+                    // segment. Express decodes only `req.params`, so both raw fields see
+                    // `%73ecret` while the handler is given `secret`.
+                    //
+                    // A SEPARATE line and a SEPARATE predicate from #54's above, and it
+                    // must stay that way. Extending shouldRejectTarget()'s comparison
+                    // cannot reach this: `target === canonical` for EVERY one of these
+                    // spellings, because both sides carry the same encoded string.
+                    // Reading #54's key here is worse than useless -- measured, gating
+                    // this rule on `canonicalRoutes` returns `GET /enc/%73ecret` to 200
+                    // under `REST_CANONICAL_ROUTES=false`, which is exactly the flag an
+                    // absolute-form-proxy consumer must set. Killed by
+                    // `test/unit/request-test.ts` AC5.
+                    //
+                    // The same three load-bearing properties as the line above apply
+                    // verbatim -- outside `if (this.auth)`, BEFORE it, and rejecting with
+                    // `next('router')` rather than a sendStatus that answers `text/plain`
+                    // and becomes an oracle. They are killed here by
+                    // `test/integration/rest-server-test.ts` #56 AC1.4 (the shape
+                    // deep-equal against a genuine miss) and AC1.6
+                    // (`/private/restricte%64` -> 404 rather than the hook's own 403),
+                    // on a class WITH a hook.
+                    //
+                    // AC1.6, NOT AC1.5, and the difference is measured rather than
+                    // reasoned. This comment named AC1.5 (`/private/%66ailure`) until
+                    // #58's fix round; that assertion CANNOT fail for the relocation.
+                    // For that request `private.ts`'s hook sees `req.path === '/%66ailure'`
+                    // (no 505) and `req.params.id === 'failure'` (no 403), so it returns
+                    // undefined and the relocated check still fires. Only
+                    // `/private/restricte%64` trips a hook clause -- `req.params.id` is
+                    // DECODED by express, so it equals `restricted` and answers 403 --
+                    // which is what makes AC1.6 the assertion that reds. Measured: move
+                    // this line below the `if (this.auth)` block, rebuild, and the suite
+                    // reports 40 pass / 1 fail, the single failure being #56's AC1 with
+                    // both of assertion 6's messages red and assertion 5 GREEN.
+                    if (shouldRejectEncoding(req))
+                        return next('router');
                     // Run auth after route matching so request.params is populated
                     if (this.auth) {
                         const status = this.auth(req, getState(req));

package/dist/request.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,~~OAA2F~~,MAAM,SAAS,CAAC;~~AAClH~~,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,kBAAkB,MAAM,qBAAqB,CAAC;~~AAErD~~,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAOnE,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAmB;QACjC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAyC,CAAC;QACzD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;QAE9E,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAoB,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,eAAe,CAAU;IACzB,QAAQ,CAAiB;IAGzB;QACE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE5B,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,4DAA4D;QAC5D,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAEjD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,2CAA2C,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,~~eAA6I~~,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;~~oBAChN~~,+DAA+D;oBAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;wBACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC7C,IAAI,MAAM;4BAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACrD,CAAC;oBAED,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAqB,CAAC;oBAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAG,CAAC;oBAClC,IAAI,QAAiB,CAAC;oBAEtB,iBAAiB;oBACjB,OAAM,SAAS,CAAC,MAAM,EAAE,CAAC;wBACvB,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnE,IAAI,QAAQ,KAAK,SAAS;4BAAE,MAAM;oBACpC,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS;wBAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,QAAkB,CAAC,CAAC;oBAEnF,+CAA+C;oBAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;oBAC3B,IAAI,QAAQ;wBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAkB,CAAC,CAAC;oBAEtD,2CAA2C;oBAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;oBACvB,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAA0F,CAAC;wBAEvH,IAAI,OAAO;4BAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gCAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBACrF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAEtE,GAAG,CAAC,IAAI,CAAC,QAAmC,CAAC,CAAC;gBAChD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC"}
1	+ {"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,OAA8G,MAAM,SAAS,CAAC;AACrI,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,kBAAkB,EAAE,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEnG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAOnE,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B,MAAM,CAAC,SAAS,GAAG,eAAe,CAAC;IAEnC,MAAM,CAAC,QAAQ,CAAC,GAAmB;QACjC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAyC,CAAC;QACzD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;QAE9E,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,SAAS,CAAiB,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAoB,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,eAAe,CAAU;IACzB,QAAQ,CAAiB;IAGzB;QACE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE5B,+DAA+D;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,4DAA4D;QAC5D,EAAE;QACF,4EAA4E;QAC5E,yEAAyE;QACzE,uEAAuE;QACvE,2DAA2D;QAC3D,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,UAAU;QACV,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC;QAEjD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,2CAA2C,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,eAAiK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;oBACxP,sEAAsE;oBACtE,oEAAoE;oBACpE,kEAAkE;oBAClE,kEAAkE;oBAClE,EAAE;oBACF,qEAAqE;oBACrE,mEAAmE;oBACnE,sEAAsE;oBACtE,qEAAqE;oBACrE,EAAE;oBACF,qEAAqE;oBACrE,sEAAsE;oBACtE,sEAAsE;oBACtE,mCAAmC;oBACnC,mEAAmE;oBACnE,qEAAqE;oBACrE,kEAAkE;oBAClE,oEAAoE;oBACpE,gEAAgE;oBAChE,qEAAqE;oBACrE,oEAAoE;oBACpE,qDAAqD;oBACrD,qEAAqE;oBACrE,yDAAyD;oBACzD,6DAA6D;oBAC7D,iEAAiE;oBACjE,mEAAmE;oBACnE,oEAAoE;oBACpE,gEAAgE;oBAChE,0DAA0D;oBAC1D,gEAAgE;oBAChE,8DAA8D;oBAC9D,wBAAwB;oBACxB,EAAE;oBACF,kEAAkE;oBAClE,kEAAkE;oBAClE,gDAAgD;oBAChD,IAAI,kBAAkB,CAAC,GAAG,CAAC;wBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAEnD,mEAAmE;oBACnE,sEAAsE;oBACtE,gEAAgE;oBAChE,qEAAqE;oBACrE,qEAAqE;oBACrE,kDAAkD;oBAClD,EAAE;oBACF,oEAAoE;oBACpE,kEAAkE;oBAClE,mEAAmE;oBACnE,+DAA+D;oBAC/D,mEAAmE;oBACnE,oEAAoE;oBACpE,oEAAoE;oBACpE,mDAAmD;oBACnD,mCAAmC;oBACnC,EAAE;oBACF,iEAAiE;oBACjE,sEAAsE;oBACtE,sEAAsE;oBACtE,iDAAiD;oBACjD,8DAA8D;oBAC9D,+CAA+C;oBAC/C,mEAAmE;oBACnE,0BAA0B;oBAC1B,EAAE;oBACF,+DAA+D;oBAC/D,kEAAkE;oBAClE,kEAAkE;oBAClE,wEAAwE;oBACxE,qEAAqE;oBACrE,sDAAsD;oBACtD,oEAAoE;oBACpE,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,oEAAoE;oBACpE,4DAA4D;oBAC5D,IAAI,oBAAoB,CAAC,GAAG,CAAC;wBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAErD,+DAA+D;oBAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;wBACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC7C,IAAI,MAAM;4BAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACrD,CAAC;oBAED,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAqB,CAAC;oBAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAG,CAAC;oBAClC,IAAI,QAAiB,CAAC;oBAEtB,iBAAiB;oBACjB,OAAM,SAAS,CAAC,MAAM,EAAE,CAAC;wBACvB,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnE,IAAI,QAAQ,KAAK,SAAS;4BAAE,MAAM;oBACpC,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS;wBAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,QAAkB,CAAC,CAAC;oBAEnF,+CAA+C;oBAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;oBAC3B,IAAI,QAAQ;wBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAkB,CAAC,CAAC;oBAEtD,2CAA2C;oBAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;oBACvB,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAA0F,CAAC;wBAEvH,IAAI,OAAO;4BAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gCAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBACrF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC1B,CAAC;oBAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ;wBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAEtE,GAAG,CAAC,IAAI,CAAC,QAAmC,CAAC,CAAC;gBAChD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC"}

package/dist/route-matching.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { Express } from 'express';
+import type { Express, Request as ExpressRequest } from 'express';
 /**
  * Applies this module's route-matching settings to an express app.
  *
@@ -63,28 +63,195 @@ import type { Express } from 'express';
  * settings (they share this function), but the justification differs and the
  * tests are built on the measured split, not on the analogy.
  *
- * Consequence worth stating so nobody expects this setting to cover it: the
- * mount-segment trailing slash (`/public/`) cannot be closed by an express
- * SETTING. For both `/public` and `/public/` the mounted sub-app receives
- * `req.path === '/'`, so a `req.path` auth hook sees no difference, and a test
- * asserting `/public/` -> 404 could never pass.
- *
- * That is NOT the same as saying the edge is harmless or unclosable.
- * `req.originalUrl` does differ, and a hook authorizing on it is bypassed by
- * one character -- measured: `GET /admin` -> 401, `GET /admin/` -> 200 with the
- * guarded handler running unauthenticated. That is a live bypass of the same
- * class as #47 and #50, and it IS closable by this module: a canonical-path
- * check ahead of the `auth` call in `Request.registerCalls()`, or opt-in
- * normalizing middleware. It is tracked as abofs/stonyx-rest-server#54. Do not
- * close it here, and do not read this note as saying it cannot be closed.
- *
- * Both guards are `!== false` for the same reason: these flags default to the
+ * Consequence worth stating so nobody expects this SETTING to cover it: no
+ * express setting rejects the mount-segment trailing slash (`/public/`). For
+ * both `/public` and `/public/` the mounted sub-app receives `req.path === '/'`,
+ * so a `req.path` auth hook sees no difference and there is nothing for the
+ * setting to reject. That statement is still true, and it is still the reason
+ * `applyRouteMatching()` is not the fix site for that edge.
+ *
+ * The edge itself is CLOSED, by `shouldRejectTarget()` below rather than by a
+ * setting (abofs/stonyx-rest-server#54). `req.originalUrl` does differ between
+ * the two spellings, and a hook authorizing on it was bypassed by one
+ * character -- measured: `GET /admin` -> 401, `GET /admin/` -> 200 with the
+ * guarded handler running unauthenticated. `GET /public/` now returns 404, and
+ * the integration AC asserts exactly that.
+ *
+ * All four guards in this file are `!== false` for the same reason: these flags
+ * default to the
  * truthy direction, so a truthy check fails OPEN for a consumer whose shipped
- * config predates the key. Both are also asserted at the unit tier for BOTH
+ * config predates the key. All are also asserted at the unit tier for BOTH
  * failure shapes -- key present-and-`undefined` and key absent as an own
- * property -- in `test/unit/request-test.ts` (#47's AC6, #50's AC3). The
- * integration tier cannot see either: with the shipped default `true`, a
- * fail-open guard leaves every integration assertion green.
+ * property -- in `test/unit/request-test.ts` (#47's AC6, #50's AC3, #54's AC2,
+ * #56's AC6). The integration tier cannot see any of them: with the shipped
+ * default `true`, a fail-open guard leaves every integration assertion green.
  */
 export default function applyRouteMatching(api: Express): void;
+/**
+ * Decides whether a request must be rejected because its RAW request target is
+ * not the canonical path express matched (abofs/stonyx-rest-server#54).
+ *
+ * Closes two live authorization bypasses against a consumer hook that
+ * authorizes on `req.originalUrl` -- the field express does NOT normalize:
+ *
+ *   1. mount-root trailing slash    GET /admin/                  -> was 200
+ *   2. absolute-form request target GET http://host/admin        -> was 200
+ *      (RFC 9112 3.2.2; hits EVERY route, not just the mount root)
+ *
+ * Both were measured reaching the guarded handler unauthenticated while
+ * `GET /admin` was denied 401.
+ *
+ * COMPARE THE RAW TARGET; DO NOT PARSE IT. Any implementation reaching for
+ * `new URL(req.originalUrl, base).pathname` to "get the path" re-opens vector 2
+ * BY CONSTRUCTION: parsing normalizes the exact string the consumer's hook is
+ * exposed to, so the check would compare a laundered value while the hook still
+ * sees the raw one. Measured: the narrow `endsWith('/')` form closes 1 and
+ * leaves 2 at 200.
+ *
+ * `req.baseUrl + req.path` is likewise NOT usable as the left-hand side. It is
+ * `/admin/` for BOTH spellings of vector 1 -- `originalUrl` is the only field
+ * that differs, which is precisely why the bypass exists. A check built on
+ * `baseUrl + path` cannot see its own defect.
+ *
+ * TIMING CONTRACT -- DELIBERATELY DIFFERENT FROM ITS TWO SIBLINGS. This lives
+ * beside `applyRouteMatching()` for the same "one place anchors it" reason, but
+ * deliberately OUTSIDE it: that function's contract is *apply express settings
+ * to an app*, it is called from two constructors, and this is neither a setting
+ * nor constructor-timed. `caseSensitiveRoutes`/`strictRoutes` are read once in a
+ * constructor and are silently ineffective if applied late; this flag is read
+ * PER REQUEST, inside the handler closure. There is no lazy-materialisation
+ * hazard here, so do not carry that constraint across.
+ *
+ * The caller must reject with `next('router')`, NOT `res.sendStatus(404)`, and
+ * must run this BEFORE `this.auth` as well as outside `if (this.auth)` -- those
+ * are two separate properties with two separate assertions (AC1.11 and AC1.6);
+ * see src/request.ts.
+ *
+ * Guard polarity is `!== false`, matching its three siblings, for the same measured
+ * reason: the secure value is the TRUTHY one, so a plain truthy check fails
+ * OPEN for any consumer whose shipped `restServer` block predates the key --
+ * the state every existing consumer is in, and reachable in practice because
+ * the stonyx loader only merges a module's `config/environment.js` for modules
+ * in devDependencies. `trustProxy` deliberately differs (`=== 'true'`): its safe
+ * default is FALSY, so a truthy check already fails closed for it. The rule is
+ * "the guard must fail toward the safe value", not "all guards look alike" --
+ * preserve the asymmetry.
+ *
+ * The integration tier cannot see a fail-open guard here: with the shipped
+ * default `true`, `=== true` leaves every integration assertion green. Only
+ * `test/unit/request-test.ts` AC2 can, and it probes BOTH failure shapes --
+ * key present-and-`undefined` and key absent as an own property.
+ */
+export declare function shouldRejectTarget(req: ExpressRequest): boolean;
+/**
+ * Decides whether a request must be rejected because its RAW request target
+ * spells an unreserved character as a percent-triplet
+ * (abofs/stonyx-rest-server#56).
+ *
+ * Closes a live authorization bypass on any route class carrying a `:param`
+ * segment. Express decodes `req.params` and NOTHING else -- `req.path` and
+ * `req.originalUrl` both stay percent-encoded -- so a consumer hook comparing
+ * either of those raw fields was walked past by re-spelling the id:
+ *
+ *   GET /enc/secret     -> 401  (hook fires)
+ *   GET /enc/%73ecret   -> 200  guarded handler, unauthenticated, id "secret"
+ *
+ * Both hook shapes are affected and neither is safer than the other; there is
+ * no spelling that defeats one and not the same-id comparison in the other.
+ * A third shape is worse still: a LITERAL guarded route co-registered with a
+ * sibling `/:id` (this repo's own `test/sample/requests/private.ts`) has the
+ * encoded spelling miss the literal layer and be ABSORBED by the param route,
+ * so the guard is walked past without the guarded handler ever running --
+ * measured `GET /private/failure` -> 505 vs `GET /private/%66ailure` -> 200.
+ *
+ * THE RULE IS AN UNRESERVED-OCTET SCAN, NOT A DECODE-AND-COMPARE. Two wrong
+ * implementations were built and measured, and each breaks a legitimate
+ * request:
+ *
+ *   1. `decodeURIComponent(target) !== target` -- rejects `/enc/sec%2fret`
+ *      (404), which names the DISTINCT id `sec/ret`. The router SPLITS then
+ *      DECODES; a whole-target decode decodes then splits, and the two
+ *      disagree about `%2f` by construction. Killed by AC3.
+ *   2. decode until stable -- rejects `/enc/%2573ecret` (404), which names the
+ *      legitimate id `%73ecret`. Express decodes EXACTLY ONCE, so `%2561` is
+ *      not a bypass and a loop invents a false deny. Killed by AC4.
+ *
+ * WHY THIS IS NOT PART OF `shouldRejectTarget()` (#54), and why extending that
+ * comparison cannot work: for `GET /enc/%73ecret`, `originalUrl` is
+ * `/enc/%73ecret`, `baseUrl` is `/enc` and `path` is `/%73ecret`, so
+ * `target === canonical` -- both sides carry the SAME encoded string. The
+ * comparison is structurally blind to this axis and no change to it can see it.
+ *
+ * WHY IT IS A FOURTH KEY AND NOT A REUSE OF `canonicalRoutes`. Measured with
+ * the rule implemented correctly but gated on #54's key:
+ * `REST_CANONICAL_ROUTES=false` returns `GET /enc/%73ecret` to 200. That flag
+ * is exactly what a consumer behind an absolute-form-emitting forward proxy
+ * must set, so folding the two would hand precisely those consumers the
+ * encoding bypass as the price of staying up. Same argument the block above
+ * makes for why #50 is not a rename of #47. Pinned by
+ * `test/unit/request-test.ts` AC5, which also asserts -- in that same state --
+ * that #54's own vector IS re-opened, so an implementation that simply ignores
+ * `canonicalRoutes` cannot pass it vacuously.
+ *
+ * TIMING CONTRACT: identical to `shouldRejectTarget()` and NOT to the two
+ * settings above. Read per request, inside the handler closure in
+ * `Request.registerCalls()`; there is no lazy-materialisation hazard, so do not
+ * move it into `applyRouteMatching()`. The caller must reject with
+ * `next('router')`, and must run this BEFORE `this.auth` as well as outside
+ * `if (this.auth)` -- see src/request.ts.
+ *
+ * Guard polarity is `!== false`, matching all three siblings, for the same
+ * measured reason: the secure value is the TRUTHY one, so `=== true` fails OPEN
+ * for any consumer whose shipped `restServer` block predates the key. The
+ * integration tier CANNOT see that mutation -- with the shipped default `true`
+ * every integration assertion stays green -- so it is `test/unit/request-test.ts`
+ * AC6 that kills it, probing the key present-and-`undefined` and absent as an
+ * own property separately.
+ *
+ * WHAT THIS DOES NOT CLOSE, stated here rather than left implied. It cannot
+ * give each decoded id exactly one accepted spelling, because everything the
+ * allowlist above does NOT cover must remain encodable: `/enc/a+b` and
+ * `/enc/a%2Bb` both name the id `a+b`, and `/enc/sec%2fret` and
+ * `/enc/sec%2Fret` both name `sec/ret`.
+ *
+ * THE RESIDUAL IS WIDER THAN "RESERVED CHARACTERS" AND MUST NOT BE WRITTEN
+ * DOWN THAT WAY. An octet outside `[A-Za-z0-9-._~]` keeps more than one
+ * accepted spelling when its hex carries a letter digit (upper- and lower-case
+ * hex) or when a client may also send it literally. That is every reserved
+ * character, every non-ASCII byte AND every control octet whose hex carries a
+ * letter digit. Measured through a real listener against this predicate, on a
+ * deny list holding NO reserved character at all:
+ *
+ *   GET /i18n/caf%C3%A9          -> 401     GET /i18n/caf%c3%a9          -> 200, id "café"
+ *   GET /i18n/%E5%8C%97%E4%BA%AC -> 401     GET /i18n/%e5%8c%97%e4%ba%ac -> 200, id "北京"
+ *   GET /i18n/a%0Db              -> 401     GET /i18n/a%0db              -> 200, id "a\rb"
+ *
+ * A consumer whose ids are i18n text reads "any id containing a reserved
+ * character" as not applying to them. It does. The three docs that carried the
+ * narrow wording (`README.md`, `docs/project-structure.md`,
+ * `docs/agents/security-reviewer.md`) were widened to this scope rather than
+ * this comment being narrowed to theirs.
+ *
+ * NOT the whole complement of the unreserved set, and this qualifier is load-
+ * bearing rather than pedantry -- the sentence above is stated as measured, so
+ * it must not over-warn either. Measured counterexamples: `%21` and `%40` are
+ * reserved and carry no letter hex digit, so they alias literal-versus-encoded
+ * rather than by hex case; `%00` and `%09` have exactly one accepted spelling
+ * and do not alias at all; `%90` is a 400 (invalid UTF-8), not an alias.
+ *
+ * So a hook comparing a raw path string REMAINS UNSOUND for any id carrying an
+ * octet outside `[A-Za-z0-9-._~]` that keeps more than one accepted spelling,
+ * and `req.params` -- which express decodes, and which is populated before
+ * `auth()` runs -- is the sound idiom. That
+ * residual is the consumer's comparison to own; the module cannot close it
+ * without 404ing encodings clients are required to emit.
+ *
+ * SCOPE LIMIT, separate from the residual above: this predicate is called from
+ * `Request.registerCalls()`, so it covers the routes mounted from request
+ * classes and nothing else. A route registered directly on the public
+ * `RestServer.instance.api` gets none of it -- measured,
+ * `GET /direct/%73ecret` -> 200 with `id "secret"` while `GET /enc/%73ecret`
+ * -> 404. Same registration-site limit `canonicalRoutes` (#54) has.
+ */
+export declare function shouldRejectEncoding(req: ExpressRequest): boolean;
 //# sourceMappingURL=route-matching.d.ts.map

package/dist/route-matching.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route-matching.d.ts","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;~~AAGvC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAG7D"}
1	+ {"version":3,"file":"route-matching.d.ts","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,SAAS,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAG7D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAuB/D;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAkBjE"}

package/dist/route-matching.js CHANGED Viewed

@@ -63,28 +63,28 @@ import config from 'stonyx/config';
  * settings (they share this function), but the justification differs and the
  * tests are built on the measured split, not on the analogy.
  *
- * Consequence worth stating so nobody expects this setting to cover it: the
- * mount-segment trailing slash (`/public/`) cannot be closed by an express
- * SETTING. For both `/public` and `/public/` the mounted sub-app receives
- * `req.path === '/'`, so a `req.path` auth hook sees no difference, and a test
- * asserting `/public/` -> 404 could never pass.
- *
- * That is NOT the same as saying the edge is harmless or unclosable.
- * `req.originalUrl` does differ, and a hook authorizing on it is bypassed by
- * one character -- measured: `GET /admin` -> 401, `GET /admin/` -> 200 with the
- * guarded handler running unauthenticated. That is a live bypass of the same
- * class as #47 and #50, and it IS closable by this module: a canonical-path
- * check ahead of the `auth` call in `Request.registerCalls()`, or opt-in
- * normalizing middleware. It is tracked as abofs/stonyx-rest-server#54. Do not
- * close it here, and do not read this note as saying it cannot be closed.
- *
- * Both guards are `!== false` for the same reason: these flags default to the
+ * Consequence worth stating so nobody expects this SETTING to cover it: no
+ * express setting rejects the mount-segment trailing slash (`/public/`). For
+ * both `/public` and `/public/` the mounted sub-app receives `req.path === '/'`,
+ * so a `req.path` auth hook sees no difference and there is nothing for the
+ * setting to reject. That statement is still true, and it is still the reason
+ * `applyRouteMatching()` is not the fix site for that edge.
+ *
+ * The edge itself is CLOSED, by `shouldRejectTarget()` below rather than by a
+ * setting (abofs/stonyx-rest-server#54). `req.originalUrl` does differ between
+ * the two spellings, and a hook authorizing on it was bypassed by one
+ * character -- measured: `GET /admin` -> 401, `GET /admin/` -> 200 with the
+ * guarded handler running unauthenticated. `GET /public/` now returns 404, and
+ * the integration AC asserts exactly that.
+ *
+ * All four guards in this file are `!== false` for the same reason: these flags
+ * default to the
  * truthy direction, so a truthy check fails OPEN for a consumer whose shipped
- * config predates the key. Both are also asserted at the unit tier for BOTH
+ * config predates the key. All are also asserted at the unit tier for BOTH
  * failure shapes -- key present-and-`undefined` and key absent as an own
- * property -- in `test/unit/request-test.ts` (#47's AC6, #50's AC3). The
- * integration tier cannot see either: with the shipped default `true`, a
- * fail-open guard leaves every integration assertion green.
+ * property -- in `test/unit/request-test.ts` (#47's AC6, #50's AC3, #54's AC2,
+ * #56's AC6). The integration tier cannot see any of them: with the shipped
+ * default `true`, a fail-open guard leaves every integration assertion green.
  */
 export default function applyRouteMatching(api) {
     if (config.restServer?.caseSensitiveRoutes !== false)
@@ -92,4 +92,232 @@ export default function applyRouteMatching(api) {
     if (config.restServer?.strictRoutes !== false)
         api.set('strict routing', true);
 }
+/**
+ * Decides whether a request must be rejected because its RAW request target is
+ * not the canonical path express matched (abofs/stonyx-rest-server#54).
+ *
+ * Closes two live authorization bypasses against a consumer hook that
+ * authorizes on `req.originalUrl` -- the field express does NOT normalize:
+ *
+ *   1. mount-root trailing slash    GET /admin/                  -> was 200
+ *   2. absolute-form request target GET http://host/admin        -> was 200
+ *      (RFC 9112 3.2.2; hits EVERY route, not just the mount root)
+ *
+ * Both were measured reaching the guarded handler unauthenticated while
+ * `GET /admin` was denied 401.
+ *
+ * COMPARE THE RAW TARGET; DO NOT PARSE IT. Any implementation reaching for
+ * `new URL(req.originalUrl, base).pathname` to "get the path" re-opens vector 2
+ * BY CONSTRUCTION: parsing normalizes the exact string the consumer's hook is
+ * exposed to, so the check would compare a laundered value while the hook still
+ * sees the raw one. Measured: the narrow `endsWith('/')` form closes 1 and
+ * leaves 2 at 200.
+ *
+ * `req.baseUrl + req.path` is likewise NOT usable as the left-hand side. It is
+ * `/admin/` for BOTH spellings of vector 1 -- `originalUrl` is the only field
+ * that differs, which is precisely why the bypass exists. A check built on
+ * `baseUrl + path` cannot see its own defect.
+ *
+ * TIMING CONTRACT -- DELIBERATELY DIFFERENT FROM ITS TWO SIBLINGS. This lives
+ * beside `applyRouteMatching()` for the same "one place anchors it" reason, but
+ * deliberately OUTSIDE it: that function's contract is *apply express settings
+ * to an app*, it is called from two constructors, and this is neither a setting
+ * nor constructor-timed. `caseSensitiveRoutes`/`strictRoutes` are read once in a
+ * constructor and are silently ineffective if applied late; this flag is read
+ * PER REQUEST, inside the handler closure. There is no lazy-materialisation
+ * hazard here, so do not carry that constraint across.
+ *
+ * The caller must reject with `next('router')`, NOT `res.sendStatus(404)`, and
+ * must run this BEFORE `this.auth` as well as outside `if (this.auth)` -- those
+ * are two separate properties with two separate assertions (AC1.11 and AC1.6);
+ * see src/request.ts.
+ *
+ * Guard polarity is `!== false`, matching its three siblings, for the same measured
+ * reason: the secure value is the TRUTHY one, so a plain truthy check fails
+ * OPEN for any consumer whose shipped `restServer` block predates the key --
+ * the state every existing consumer is in, and reachable in practice because
+ * the stonyx loader only merges a module's `config/environment.js` for modules
+ * in devDependencies. `trustProxy` deliberately differs (`=== 'true'`): its safe
+ * default is FALSY, so a truthy check already fails closed for it. The rule is
+ * "the guard must fail toward the safe value", not "all guards look alike" --
+ * preserve the asymmetry.
+ *
+ * The integration tier cannot see a fail-open guard here: with the shipped
+ * default `true`, `=== true` leaves every integration assertion green. Only
+ * `test/unit/request-test.ts` AC2 can, and it probes BOTH failure shapes --
+ * key present-and-`undefined` and key absent as an own property.
+ */
+export function shouldRejectTarget(req) {
+    // Written as `!== false` rather than `=== false` on purpose: the polarity is
+    // the load-bearing part and it should read identically to the two guards in
+    // applyRouteMatching() above.
+    const enforced = config.restServer?.canonicalRoutes !== false;
+    if (!enforced)
+        return false;
+    // Raw, unparsed. Only the query string is removed, by string split.
+    const target = req.originalUrl.split('?')[0];
+    // At a mount root express reports `req.path === '/'` while the canonical
+    // target is the bare mount segment, so the two are not simply concatenated.
+    //
+    // `&& req.baseUrl` is load-bearing and is NOT a redundant truthiness guard.
+    // A route class named `index` mounts at '/' (src/main.ts `mountRoute()`),
+    // and that is the one mount shape where `req.baseUrl` is ''. Without the
+    // conjunct, `GET /` compares the raw target '/' against a canonical of '' and
+    // the APPLICATION ROOT is rejected. Measured before it had a guard: shipped
+    // `GET /` -> 200, conjunct dropped -> 404, suite 34 pass / 0 fail BOTH ways.
+    // Killed now by AC1.12, against `test/sample/requests/index.ts`.
+    const canonical = req.path === '/' && req.baseUrl ? req.baseUrl : req.baseUrl + req.path;
+    return target !== canonical;
+}
+// RFC 3986 §2.3 UNRESERVED = ALPHA / DIGIT / "-" / "." / "_" / "~".
+//
+// These are the characters a URI generator MUST NOT percent-encode and that a
+// normaliser MUST decode (§6.2.2.2), so an encoded one carries no information
+// a client is ever required to send. Everything else -- every RESERVED
+// character and every non-ASCII octet -- stays encodable, which is the whole
+// reason this is an allowlist of octets rather than a ban on triplets. See
+// `shouldRejectEncoding()` below.
+const UNRESERVED_OCTET = /^[A-Za-z0-9\-._~]$/;
+// A percent-triplet: `%` followed by exactly two hex digits, either case.
+//
+// A `%` can never be part of ANOTHER triplet's hex digits, because `%` is not a
+// hex digit -- so scanning left to right without skipping cannot produce an
+// overlapping false match. `%2561` therefore yields exactly one candidate
+// (`%25`), which is the property AC4 pins.
+//
+// Malformed and over-long escapes (`%zz`, `%`, `%6`, `%c1%a1`, `%e0%81%a1`) are
+// deliberately NOT this function's business: `router@2.2.0`'s `decodeParam`
+// (lib/layer.js:225) answers 400 for them before any handler or hook runs.
+// Verified here rather than imported -- measured 400 both before and after this
+// change. None of those octets is unreserved, and the first three are not valid
+// triplets at all, so the rule does not touch them either way.
+const PERCENT_TRIPLET = /%([0-9A-Fa-f]{2})/g;
+/**
+ * Decides whether a request must be rejected because its RAW request target
+ * spells an unreserved character as a percent-triplet
+ * (abofs/stonyx-rest-server#56).
+ *
+ * Closes a live authorization bypass on any route class carrying a `:param`
+ * segment. Express decodes `req.params` and NOTHING else -- `req.path` and
+ * `req.originalUrl` both stay percent-encoded -- so a consumer hook comparing
+ * either of those raw fields was walked past by re-spelling the id:
+ *
+ *   GET /enc/secret     -> 401  (hook fires)
+ *   GET /enc/%73ecret   -> 200  guarded handler, unauthenticated, id "secret"
+ *
+ * Both hook shapes are affected and neither is safer than the other; there is
+ * no spelling that defeats one and not the same-id comparison in the other.
+ * A third shape is worse still: a LITERAL guarded route co-registered with a
+ * sibling `/:id` (this repo's own `test/sample/requests/private.ts`) has the
+ * encoded spelling miss the literal layer and be ABSORBED by the param route,
+ * so the guard is walked past without the guarded handler ever running --
+ * measured `GET /private/failure` -> 505 vs `GET /private/%66ailure` -> 200.
+ *
+ * THE RULE IS AN UNRESERVED-OCTET SCAN, NOT A DECODE-AND-COMPARE. Two wrong
+ * implementations were built and measured, and each breaks a legitimate
+ * request:
+ *
+ *   1. `decodeURIComponent(target) !== target` -- rejects `/enc/sec%2fret`
+ *      (404), which names the DISTINCT id `sec/ret`. The router SPLITS then
+ *      DECODES; a whole-target decode decodes then splits, and the two
+ *      disagree about `%2f` by construction. Killed by AC3.
+ *   2. decode until stable -- rejects `/enc/%2573ecret` (404), which names the
+ *      legitimate id `%73ecret`. Express decodes EXACTLY ONCE, so `%2561` is
+ *      not a bypass and a loop invents a false deny. Killed by AC4.
+ *
+ * WHY THIS IS NOT PART OF `shouldRejectTarget()` (#54), and why extending that
+ * comparison cannot work: for `GET /enc/%73ecret`, `originalUrl` is
+ * `/enc/%73ecret`, `baseUrl` is `/enc` and `path` is `/%73ecret`, so
+ * `target === canonical` -- both sides carry the SAME encoded string. The
+ * comparison is structurally blind to this axis and no change to it can see it.
+ *
+ * WHY IT IS A FOURTH KEY AND NOT A REUSE OF `canonicalRoutes`. Measured with
+ * the rule implemented correctly but gated on #54's key:
+ * `REST_CANONICAL_ROUTES=false` returns `GET /enc/%73ecret` to 200. That flag
+ * is exactly what a consumer behind an absolute-form-emitting forward proxy
+ * must set, so folding the two would hand precisely those consumers the
+ * encoding bypass as the price of staying up. Same argument the block above
+ * makes for why #50 is not a rename of #47. Pinned by
+ * `test/unit/request-test.ts` AC5, which also asserts -- in that same state --
+ * that #54's own vector IS re-opened, so an implementation that simply ignores
+ * `canonicalRoutes` cannot pass it vacuously.
+ *
+ * TIMING CONTRACT: identical to `shouldRejectTarget()` and NOT to the two
+ * settings above. Read per request, inside the handler closure in
+ * `Request.registerCalls()`; there is no lazy-materialisation hazard, so do not
+ * move it into `applyRouteMatching()`. The caller must reject with
+ * `next('router')`, and must run this BEFORE `this.auth` as well as outside
+ * `if (this.auth)` -- see src/request.ts.
+ *
+ * Guard polarity is `!== false`, matching all three siblings, for the same
+ * measured reason: the secure value is the TRUTHY one, so `=== true` fails OPEN
+ * for any consumer whose shipped `restServer` block predates the key. The
+ * integration tier CANNOT see that mutation -- with the shipped default `true`
+ * every integration assertion stays green -- so it is `test/unit/request-test.ts`
+ * AC6 that kills it, probing the key present-and-`undefined` and absent as an
+ * own property separately.
+ *
+ * WHAT THIS DOES NOT CLOSE, stated here rather than left implied. It cannot
+ * give each decoded id exactly one accepted spelling, because everything the
+ * allowlist above does NOT cover must remain encodable: `/enc/a+b` and
+ * `/enc/a%2Bb` both name the id `a+b`, and `/enc/sec%2fret` and
+ * `/enc/sec%2Fret` both name `sec/ret`.
+ *
+ * THE RESIDUAL IS WIDER THAN "RESERVED CHARACTERS" AND MUST NOT BE WRITTEN
+ * DOWN THAT WAY. An octet outside `[A-Za-z0-9-._~]` keeps more than one
+ * accepted spelling when its hex carries a letter digit (upper- and lower-case
+ * hex) or when a client may also send it literally. That is every reserved
+ * character, every non-ASCII byte AND every control octet whose hex carries a
+ * letter digit. Measured through a real listener against this predicate, on a
+ * deny list holding NO reserved character at all:
+ *
+ *   GET /i18n/caf%C3%A9          -> 401     GET /i18n/caf%c3%a9          -> 200, id "café"
+ *   GET /i18n/%E5%8C%97%E4%BA%AC -> 401     GET /i18n/%e5%8c%97%e4%ba%ac -> 200, id "北京"
+ *   GET /i18n/a%0Db              -> 401     GET /i18n/a%0db              -> 200, id "a\rb"
+ *
+ * A consumer whose ids are i18n text reads "any id containing a reserved
+ * character" as not applying to them. It does. The three docs that carried the
+ * narrow wording (`README.md`, `docs/project-structure.md`,
+ * `docs/agents/security-reviewer.md`) were widened to this scope rather than
+ * this comment being narrowed to theirs.
+ *
+ * NOT the whole complement of the unreserved set, and this qualifier is load-
+ * bearing rather than pedantry -- the sentence above is stated as measured, so
+ * it must not over-warn either. Measured counterexamples: `%21` and `%40` are
+ * reserved and carry no letter hex digit, so they alias literal-versus-encoded
+ * rather than by hex case; `%00` and `%09` have exactly one accepted spelling
+ * and do not alias at all; `%90` is a 400 (invalid UTF-8), not an alias.
+ *
+ * So a hook comparing a raw path string REMAINS UNSOUND for any id carrying an
+ * octet outside `[A-Za-z0-9-._~]` that keeps more than one accepted spelling,
+ * and `req.params` -- which express decodes, and which is populated before
+ * `auth()` runs -- is the sound idiom. That
+ * residual is the consumer's comparison to own; the module cannot close it
+ * without 404ing encodings clients are required to emit.
+ *
+ * SCOPE LIMIT, separate from the residual above: this predicate is called from
+ * `Request.registerCalls()`, so it covers the routes mounted from request
+ * classes and nothing else. A route registered directly on the public
+ * `RestServer.instance.api` gets none of it -- measured,
+ * `GET /direct/%73ecret` -> 200 with `id "secret"` while `GET /enc/%73ecret`
+ * -> 404. Same registration-site limit `canonicalRoutes` (#54) has.
+ */
+export function shouldRejectEncoding(req) {
+    // `!== false`, not `=== false` and not a truthy check: the polarity is the
+    // load-bearing part and it should read identically to the three guards above.
+    const enforced = config.restServer?.canonicalEncoding !== false;
+    if (!enforced)
+        return false;
+    // Raw, unparsed, and only the query string removed -- by string split, for
+    // the same reason #54 gives: parsing would launder the exact string the
+    // consumer's hook is exposed to. The query is stripped because a query string
+    // is a legitimately variable part of a request target and may carry any
+    // encoding at all; `?name=%61` is a normal request and must not 404.
+    const target = req.originalUrl.split('?')[0];
+    for (const [, hex] of target.matchAll(PERCENT_TRIPLET)) {
+        if (UNRESERVED_OCTET.test(String.fromCharCode(parseInt(hex, 16))))
+            return true;
+    }
+    return false;
+}
 //# sourceMappingURL=route-matching.js.map

package/dist/route-matching.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route-matching.js","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAY;IACrD,IAAI,MAAM,CAAC,UAAU,EAAE,mBAAmB,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,UAAU,EAAE,YAAY,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACjF,CAAC"}
1	+ {"version":3,"file":"route-matching.js","sourceRoot":"","sources":["../src/route-matching.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,GAAY;IACrD,IAAI,MAAM,CAAC,UAAU,EAAE,mBAAmB,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,UAAU,EAAE,YAAY,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAmB;IACpD,6EAA6E;IAC7E,4EAA4E;IAC5E,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,eAAe,KAAK,KAAK,CAAC;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,oEAAoE;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7C,yEAAyE;IACzE,4EAA4E;IAC5E,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IAEzF,OAAO,MAAM,KAAK,SAAS,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,0EAA0E;AAC1E,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,0EAA0E;AAC1E,2CAA2C;AAC3C,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,+DAA+D;AAC/D,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,iBAAiB,KAAK,KAAK,CAAC;IAChE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,2EAA2E;IAC3E,wEAAwE;IACxE,8EAA8E;IAC9E,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7C,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvD,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAClF,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json CHANGED Viewed

@@ -4,7 +4,7 @@
     "stonyx-async",
     "stonyx-module"
   ],
-  "version": "0.2.1-beta.91",
+  "version": "0.2.1-beta.93",
   "description": "Rest Server Module for Stonyx Framework",
   "repository": {
     "type": "git",