@syncular/server-hono 0.0.6-212 → 0.0.6-219

package/dist/websocket-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-origin.d.ts","sourceRoot":"","sources":["../src/websocket-origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAUpC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;CACjC,GAAG,OAAO,CA4BV;AAED,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,OAAO,EACV,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,GAC9B,OAAO,CAMT"}
+{"version":3,"file":"websocket-origin.d.ts","sourceRoot":"","sources":["../src/websocket-origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA4DpC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;CACjC,GAAG,OAAO,CAiCV;AAED,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,OAAO,EACV,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,GAC9B,OAAO,CAMT"}

package/dist/websocket-origin.js

@@ -6,6 +6,45 @@ function normalizeOrigin(origin) {
         return null;
     }
 }
+function defaultPortForProtocol(protocol) {
+    return protocol === 'https:' ? '443' : '80';
+}
+function matchesWildcardOriginPattern(origin, pattern) {
+    const match = pattern.match(/^(https?):\/\/(\*\.)?(\[[^\]]+\]|[^/:]+)(?::(\*|\d+))?$/i);
+    if (!match) {
+        return false;
+    }
+    const [, scheme, wildcardPrefix, rawHost, rawPort] = match;
+    const protocol = `${scheme.toLowerCase()}:`;
+    if (origin.protocol !== protocol) {
+        return false;
+    }
+    const patternHostname = rawHost.replace(/^\[(.*)\]$/, '$1').toLowerCase();
+    const originHostname = origin.hostname.toLowerCase();
+    if (wildcardPrefix) {
+        const suffix = `.${patternHostname}`;
+        if (originHostname === patternHostname ||
+            !originHostname.endsWith(suffix)) {
+            return false;
+        }
+    }
+    else if (originHostname !== patternHostname) {
+        return false;
+    }
+    if (rawPort === '*') {
+        return true;
+    }
+    const originPort = origin.port || defaultPortForProtocol(origin.protocol);
+    const patternPort = rawPort || defaultPortForProtocol(protocol);
+    return originPort === patternPort;
+}
+function isAllowedOriginMatch(origin, pattern) {
+    const exact = pattern.includes('*') ? null : normalizeOrigin(pattern);
+    if (exact) {
+        return origin.origin === exact;
+    }
+    return matchesWildcardOriginPattern(origin, pattern);
+}
 export function isRequestOriginAllowed(args) {
     if (args.allowedOrigins === '*') {
         return true;
@@ -14,10 +53,14 @@ export function isRequestOriginAllowed(args) {
     if (Array.isArray(args.allowedOrigins)) {
         if (!origin)
             return false;
-        const normalizedOrigin = normalizeOrigin(origin);
-        return normalizedOrigin
-            ? args.allowedOrigins.includes(normalizedOrigin)
-            : false;
+        let parsedOrigin;
+        try {
+            parsedOrigin = new URL(origin);
+        }
+        catch {
+            return false;
+        }
+        return args.allowedOrigins.some((pattern) => isAllowedOriginMatch(parsedOrigin, pattern));
     }
     if (!origin) {
         return true;

package/dist/websocket-origin.js.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-origin.js","sourceRoot":"","sources":["../src/websocket-origin.ts"],"names":[],"mappings":"AAEA,SAAS,eAAe,CAAC,MAAc,EAAiB;IACtD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AAAA,CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,IAItC,EAAW;IACV,IAAI,IAAI,CAAC,cAAc,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,gBAAgB;YACrB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAChD,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,gBAAgB,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AAAA,CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,CAAU,EACV,cAA+B,EACtB;IACT,OAAO,sBAAsB,CAAC;QAC5B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;QACrB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QACvE,cAAc;KACf,CAAC,CAAC;AAAA,CACJ"}
+{"version":3,"file":"websocket-origin.js","sourceRoot":"","sources":["../src/websocket-origin.ts"],"names":[],"mappings":"AAEA,SAAS,eAAe,CAAC,MAAc,EAAiB;IACtD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AAAA,CACF;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAU;IACxD,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CAC7C;AAED,SAAS,4BAA4B,CAAC,MAAW,EAAE,OAAe,EAAW;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CACzB,0DAA0D,CAC3D,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,MAAO,CAAC,WAAW,EAAE,GAAG,CAAC;IAC7C,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,OAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAErD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IACE,cAAc,KAAK,eAAe;YAClC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAChC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,OAAO,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAChE,OAAO,UAAU,KAAK,WAAW,CAAC;AAAA,CACnC;AAED,SAAS,oBAAoB,CAAC,MAAW,EAAE,OAAe,EAAW;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC;IACjC,CAAC;IACD,OAAO,4BAA4B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,CACtD;AAED,MAAM,UAAU,sBAAsB,CAAC,IAItC,EAAW;IACV,IAAI,IAAI,CAAC,cAAc,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,YAAiB,CAAC;QACtB,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,gBAAgB,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AAAA,CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,CAAU,EACV,cAA+B,EACtB;IACT,OAAO,sBAAsB,CAAC;QAC5B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;QACrB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QACvE,cAAc;KACf,CAAC,CAAC;AAAA,CACJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/server-hono",
-  "version": "0.0.6-212",
+  "version": "0.0.6-219",
   "description": "Hono adapter for the Syncular server with OpenAPI support",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -62,17 +62,17 @@
     "@hono/standard-validator": "^0.2.2",
     "@standard-community/standard-json": "^0.3.5",
     "@standard-community/standard-openapi": "^0.2.9",
-    "@syncular/console": "0.0.6-212",
-    "@syncular/core": "0.0.6-212",
-    "@syncular/server": "0.0.6-212",
+    "@syncular/console": "0.0.6-219",
+    "@syncular/core": "0.0.6-219",
+    "@syncular/server": "0.0.6-219",
     "@types/json-schema": "^7.0.15",
     "hono-openapi": "^1.2.0",
     "openapi-types": "^12.1.3"
   },
   "devDependencies": {
     "@syncular/config": "0.0.0",
-    "@syncular/dialect-pglite": "0.0.6-212",
-    "@syncular/server-dialect-postgres": "0.0.6-212",
+    "@syncular/dialect-pglite": "0.0.6-219",
+    "@syncular/server-dialect-postgres": "0.0.6-219",
     "kysely": "*",
     "zod": "*"
   },

package/src/__tests__/websocket-origin.test.ts

@@ -52,4 +52,44 @@ describe('websocket origin policy', () => {
       })
     ).toBe(false);
   });
+
+  it('supports wildcard ports for loopback origins', () => {
+    expect(
+      isRequestOriginAllowed({
+        requestUrl:
+          'https://space.syncular.space/api/sync/realtime?clientId=client-1',
+        originHeader: 'http://localhost:5180',
+        allowedOrigins: ['http://localhost:*'],
+      })
+    ).toBe(true);
+
+    expect(
+      isRequestOriginAllowed({
+        requestUrl:
+          'https://space.syncular.space/api/sync/realtime?clientId=client-1',
+        originHeader: 'http://127.0.0.1:5174',
+        allowedOrigins: ['http://127.0.0.1:*'],
+      })
+    ).toBe(true);
+  });
+
+  it('supports wildcard subdomain origin patterns', () => {
+    expect(
+      isRequestOriginAllowed({
+        requestUrl:
+          'https://space.syncular.space/api/sync/realtime?clientId=client-1',
+        originHeader: 'https://preview-123.pages.dev',
+        allowedOrigins: ['https://*.pages.dev'],
+      })
+    ).toBe(true);
+
+    expect(
+      isRequestOriginAllowed({
+        requestUrl:
+          'https://space.syncular.space/api/sync/realtime?clientId=client-1',
+        originHeader: 'https://pages.dev',
+        allowedOrigins: ['https://*.pages.dev'],
+      })
+    ).toBe(false);
+  });
 });

package/src/websocket-origin.ts

@@ -8,6 +8,56 @@ function normalizeOrigin(origin: string): string | null {
   }
 }
 
+function defaultPortForProtocol(protocol: string): string {
+  return protocol === 'https:' ? '443' : '80';
+}
+
+function matchesWildcardOriginPattern(origin: URL, pattern: string): boolean {
+  const match = pattern.match(
+    /^(https?):\/\/(\*\.)?(\[[^\]]+\]|[^/:]+)(?::(\*|\d+))?$/i
+  );
+  if (!match) {
+    return false;
+  }
+
+  const [, scheme, wildcardPrefix, rawHost, rawPort] = match;
+  const protocol = `${scheme!.toLowerCase()}:`;
+  if (origin.protocol !== protocol) {
+    return false;
+  }
+
+  const patternHostname = rawHost!.replace(/^\[(.*)\]$/, '$1').toLowerCase();
+  const originHostname = origin.hostname.toLowerCase();
+
+  if (wildcardPrefix) {
+    const suffix = `.${patternHostname}`;
+    if (
+      originHostname === patternHostname ||
+      !originHostname.endsWith(suffix)
+    ) {
+      return false;
+    }
+  } else if (originHostname !== patternHostname) {
+    return false;
+  }
+
+  if (rawPort === '*') {
+    return true;
+  }
+
+  const originPort = origin.port || defaultPortForProtocol(origin.protocol);
+  const patternPort = rawPort || defaultPortForProtocol(protocol);
+  return originPort === patternPort;
+}
+
+function isAllowedOriginMatch(origin: URL, pattern: string): boolean {
+  const exact = pattern.includes('*') ? null : normalizeOrigin(pattern);
+  if (exact) {
+    return origin.origin === exact;
+  }
+  return matchesWildcardOriginPattern(origin, pattern);
+}
+
 export function isRequestOriginAllowed(args: {
   requestUrl: string;
   originHeader?: string | null;
@@ -20,10 +70,15 @@ export function isRequestOriginAllowed(args: {
   const origin = args.originHeader;
   if (Array.isArray(args.allowedOrigins)) {
     if (!origin) return false;
-    const normalizedOrigin = normalizeOrigin(origin);
-    return normalizedOrigin
-      ? args.allowedOrigins.includes(normalizedOrigin)
-      : false;
+    let parsedOrigin: URL;
+    try {
+      parsedOrigin = new URL(origin);
+    } catch {
+      return false;
+    }
+    return args.allowedOrigins.some((pattern) =>
+      isAllowedOriginMatch(parsedOrigin, pattern)
+    );
   }
 
   if (!origin) {