@teamscala/service-boot 0.23.358 → 0.23.360

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.358",
+  "version": "0.23.360",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/attach-transfers-upload.ts

@@ -62,6 +62,16 @@ export async function attachTransfersUpload(app: Hono): Promise<void> {
 		const userId = session?.user?.id;
 		if (!userId) return c.json({ error: "Not authenticated" }, 401);
 
+		// Reject on Content-Length BEFORE formData() buffers the body — a
+		// file.size check after buffering is a report, not a limit (an attacker
+		// sends the bytes either way). The global 30MB boot-level bodyLimit
+		// remains the real bound for lying/absent Content-Length; this early
+		// return bounds the honest case without parsing a megabyte stream.
+		const declaredLength = Number(c.req.header("content-length") ?? 0);
+		if (declaredLength > MAX_FILE_SIZE) {
+			return c.json({ error: "file too large (max 25MB)" }, 413);
+		}
+
 		const form = await c.req.formData();
 		const file = form.get("file");
 		const type = String(form.get("type") ?? "uploads");

package/src/csrf-body-limit.test.ts

@@ -0,0 +1,177 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavior proofs for the two boot-chain security invariants:
+ *  - security-csrf-protection: a state-changing form-element POST from an
+ *    untrusted Origin is refused 403; the managed-base-domain Origin (the
+ *    derived trusted set) is allowed; same-origin sec-fetch-site is allowed.
+ *  - security-body-limit: a body over the global limit is refused 413 BEFORE
+ *    any handler runs, and the transfers upload rejects an over-sized
+ *    Content-Length without buffering the body.
+ * Proxy-is-not-behaviour guards: these exercise the real middleware through
+ * real Hono requests.
+ */
+import { describe, expect, it } from "bun:test";
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { csrf } from "hono/csrf";
+import { csrfProtection } from "./csrf-protection.ts";
+
+type CacheGlobal = typeof globalThis & {
+	__registryCache?: Map<string, { type: string; slug: string; config: unknown }>;
+};
+
+function seedPortalBaseDomain(base: string): void {
+	const g = globalThis as CacheGlobal;
+	if (!g.__registryCache) g.__registryCache = new Map();
+	g.__registryCache.set("config:portal-domains", {
+		type: "config",
+		slug: "portal-domains",
+		config: { base },
+	});
+}
+
+describe("csrfProtection", () => {
+	it("refuses a cross-site form POST from an untrusted origin (403)", async () => {
+		seedPortalBaseDomain("scala.business");
+		const app = new Hono();
+		app.use("*", csrfProtection());
+		app.post("/api/settings", (c) => c.text("ok"));
+		const res = await app.request("https://portal.scala.business/api/settings", {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				origin: "https://evil.example",
+			},
+			body: "x=1",
+		});
+		expect(res.status).toBe(403);
+	});
+
+	it("allows a form POST whose origin is under the managed base domain", async () => {
+		seedPortalBaseDomain("scala.business");
+		const app = new Hono();
+		app.use("*", csrfProtection());
+		app.post("/api/settings", (c) => c.text("ok"));
+		const res = await app.request("https://portal.scala.business/api/settings", {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				// cross-SERVICE, same platform: the proposals → sign redirect-chain shape
+				origin: "https://sign.scala.business",
+			},
+			body: "x=1",
+		});
+		expect(res.status).toBe(200);
+	});
+
+	it("allows a same-origin browser post via sec-fetch-site", async () => {
+		seedPortalBaseDomain("scala.business");
+		const app = new Hono();
+		app.use("*", csrfProtection());
+		app.post("/api/settings", (c) => c.text("ok"));
+		const res = await app.request("https://portal.scala.business/api/settings", {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				"sec-fetch-site": "same-origin",
+			},
+			body: "x=1",
+		});
+		expect(res.status).toBe(200);
+	});
+
+	it("does not arm on application/json (cross-site JSON is not formable)", async () => {
+		seedPortalBaseDomain("scala.business");
+		const app = new Hono();
+		app.use("*", csrfProtection());
+		app.post("/api/rpc/x", (c) => c.text("ok"));
+		const res = await app.request("https://portal.scala.business/api/rpc/x", {
+			method: "POST",
+			headers: { "content-type": "application/json", origin: "https://evil.example" },
+			body: JSON.stringify({ x: 1 }),
+		});
+		expect(res.status).toBe(200);
+	});
+});
+
+describe("global body limit (security-body-limit)", () => {
+	const limit = 1024;
+
+	function appWithLimit(): Hono {
+		const app = new Hono();
+		let handlerRan = false;
+		app.use(
+			"*",
+			bodyLimit({
+				maxSize: limit,
+				onError: (c) => c.text("Payload Too Large", 413),
+			}),
+		);
+		app.post("/api/upload", async (c) => {
+			handlerRan = true;
+			return c.text("ok");
+		});
+		// expose the flag after the request via a closure read below
+		(app as unknown as Record<string, unknown>).__handlerRan = () => handlerRan;
+		return app;
+	}
+
+	it("refuses an oversized body with 413 before the handler runs", async () => {
+		const app = appWithLimit();
+		const res = await app.request("https://host.example/api/upload", {
+			method: "POST",
+			headers: { "content-type": "application/octet-stream" },
+			body: "x".repeat(limit + 1),
+		});
+		expect(res.status).toBe(413);
+		expect(
+			(app as unknown as { __handlerRan: () => boolean }).__handlerRan(),
+		).toBe(false);
+	});
+
+	it("allows a body within the limit", async () => {
+		const app = appWithLimit();
+		const res = await app.request("https://host.example/api/upload", {
+			method: "POST",
+			headers: { "content-type": "application/octet-stream" },
+			body: "x".repeat(limit - 1),
+		});
+		expect(res.status).toBe(200);
+	});
+
+	it("a route-level smaller limit still refuses what the global limit allows", async () => {
+		const app = new Hono();
+		app.use(
+			"*",
+			bodyLimit({
+				maxSize: 4 * limit,
+				onError: (c) => c.text("Payload Too Large", 413),
+			}),
+		);
+		app.post(
+			"/api/rpc/*",
+			bodyLimit({
+				maxSize: limit,
+				onError: (c) => c.text("Request body too large", 413),
+			}),
+			(c) => c.text("ok"),
+		);
+		const res = await app.request("https://host.example/api/rpc/x", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: "x".repeat(2 * limit),
+		});
+		expect(res.status).toBe(413);
+	});
+});
+
+describe("csrf import wiring", () => {
+	it("csrfProtection() composes hono csrf without options drift", () => {
+		const mw = csrfProtection();
+		expect(typeof mw).toBe("function");
+		expect(typeof csrf).toBe("function");
+	});
+});

package/src/csrf-protection.ts

@@ -0,0 +1,100 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * csrf-protection.ts — platform CSRF middleware (`security-csrf-protection`).
+ *
+ * Hono's csrf() with a DERIVED trusted-origin set, never a hand-authored
+ * allowlist: every trusted origin comes from ONE source per
+ * `offered-is-derived` —
+ *   - the managed base domain (registry portal-domains) covers the platform's
+ *     own `*.scala.business` origins, INCLUDING the cross-service form POST
+ *     redirect chains CSP form-action allowlists (proposals → sign etc.), so
+ *     the CSRF origin set and the CSP form-action set cannot disagree about
+ *     what "one of ours" means;
+ *   - customer custom domains resolve through `isTrustedAuthOrigin`
+ *     (builda_websites lookup) — the SAME lookup better-auth's trustedOrigins
+ *     uses in @teamscala/auth, so a new custom domain is trusted everywhere at
+ *     once or nowhere.
+ *
+ * hono csrf() arms only on form-element content types (urlencoded, multipart,
+ * text/plain) — browsers cannot produce a cross-site application/json request
+ * from a form, so the JSON API surface (ORPC) is protected by cookie
+ * SameSite=Lax + this middleware's text/plain coverage.
+ *
+ * Custom-domain lookups are cached per-hostname with a TTL: a POSITIVE result
+ * is cached for the full TTL (a domain that stopped being ours keeps working
+ * for at most the TTL), a NEGATIVE result for a short window (a brand-new
+ * custom domain becomes trusted within seconds). The cache is a request
+ * accelerator over a DB fact, never the source of truth.
+ */
+
+import { getManagedBaseDomain } from "@teamscala/auth/auth-env-resolution";
+import { isTrustedAuthOrigin } from "@teamscala/auth/is-trusted-auth-origin";
+import { csrf } from "hono/csrf";
+import type { Context, MiddlewareHandler } from "hono";
+
+const POSITIVE_TTL_MS = 5 * 60_000;
+const NEGATIVE_TTL_MS = 10_000;
+
+type CacheEntry = { trusted: boolean; expiresAt: number };
+const customDomainCache = new Map<string, CacheEntry>();
+
+function isPlatformOrigin(origin: string, baseDomain: string): boolean {
+	let host: string;
+	try {
+		host = new URL(origin).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (!host) return false;
+	return host === baseDomain || host.endsWith(`.${baseDomain}`);
+}
+
+async function isTrustedCustomOrigin(origin: string): Promise<boolean> {
+	let host: string;
+	try {
+		host = new URL(origin).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (!host) return false;
+
+	const now = Date.now();
+	const cached = customDomainCache.get(host);
+	if (cached && cached.expiresAt > now) return cached.trusted;
+
+	const trusted = await (async () => {
+		try {
+			const { getPrisma } = await import("@teamscala/db/prisma-registry");
+			const prisma = getPrisma();
+			return await isTrustedAuthOrigin(
+				prisma as unknown as Parameters<typeof isTrustedAuthOrigin>[0],
+				host,
+			);
+		} catch {
+			// A lookup that cannot run is a lookup that trusts nothing: an
+			// unavailable DB degrades to platform-origin-only CSRF, never to
+			// allow-everything.
+			return false;
+		}
+	})();
+
+	customDomainCache.set(host, {
+		trusted,
+		expiresAt: now + (trusted ? POSITIVE_TTL_MS : NEGATIVE_TTL_MS),
+	});
+	if (customDomainCache.size > 512) customDomainCache.clear();
+	return trusted;
+}
+
+export function csrfProtection(): MiddlewareHandler {
+	return csrf({
+		origin: async (origin: string, _c: Context) => {
+			const baseDomain = getManagedBaseDomain();
+			if (isPlatformOrigin(origin, baseDomain)) return true;
+			return isTrustedCustomOrigin(origin);
+		},
+	});
+}

package/src/security-headers.test.ts

@@ -0,0 +1,82 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Behavior proof for the `security-content-type-nosniff` +
+ * `security-permissions-policy` invariants: exercise injectSecurityHeaders
+ * through a real Hono request and assert the headers on the RESPONSE —
+ * a registry row naming a header is not evidence the header is served.
+ * Covers both modes: the seeded-registry path (config row applied, CSP
+ * {{nonce}} substituted) and the DB-less fallback (secureHeaders defaults).
+ */
+import { describe, expect, it } from "bun:test";
+import { Hono } from "hono";
+import { injectSecurityHeaders } from "./security-headers.ts";
+
+type CacheGlobal = typeof globalThis & {
+	__registryCache?: Map<string, { type: string; slug: string; config: unknown }>;
+};
+
+function seedRegistryHeaders(config: Record<string, string>): void {
+	const g = globalThis as CacheGlobal;
+	if (!g.__registryCache) g.__registryCache = new Map();
+	g.__registryCache.set("config:security-headers", {
+		type: "config",
+		slug: "security-headers",
+		config,
+	});
+}
+
+function clearRegistryHeaders(): void {
+	(globalThis as CacheGlobal).__registryCache?.delete("config:security-headers");
+}
+
+function appWithMiddleware(): Hono {
+	const app = new Hono();
+	app.use("*", injectSecurityHeaders);
+	app.get("/", (c) => c.text("ok"));
+	return app;
+}
+
+describe("injectSecurityHeaders (registry mode)", () => {
+	it("serves X-Content-Type-Options: nosniff and the configured Permissions-Policy", async () => {
+		seedRegistryHeaders({
+			"X-Content-Type-Options": "nosniff",
+			"Permissions-Policy": "camera=(), microphone=(self), geolocation=()",
+			"Content-Security-Policy": "script-src 'nonce-{{nonce}}' 'strict-dynamic'",
+		});
+		try {
+			const res = await appWithMiddleware().request("https://host.example/");
+			expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
+			expect(res.headers.get("Permissions-Policy")).toBe(
+				"camera=(), microphone=(self), geolocation=()",
+			);
+		} finally {
+			clearRegistryHeaders();
+		}
+	});
+
+	it("substitutes the CSP {{nonce}} placeholder — the served policy carries a real nonce", async () => {
+		seedRegistryHeaders({
+			"Content-Security-Policy": "script-src 'nonce-{{nonce}}' 'strict-dynamic'",
+		});
+		try {
+			const res = await appWithMiddleware().request("https://host.example/");
+			const csp = res.headers.get("Content-Security-Policy") ?? "";
+			expect(csp).not.toContain("{{nonce}}");
+			expect(csp).toMatch(/'nonce-[^']+'/);
+		} finally {
+			clearRegistryHeaders();
+		}
+	});
+});
+
+describe("injectSecurityHeaders (fallback mode, no registry)", () => {
+	it("still serves X-Content-Type-Options: nosniff from secureHeaders defaults", async () => {
+		clearRegistryHeaders();
+		const res = await appWithMiddleware().request("https://host.example/");
+		expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
+		expect((res.headers.get("Content-Security-Policy") ?? "")).not.toContain("{{nonce}}");
+	});
+});

package/src/two-phase-boot.ts

@@ -18,6 +18,7 @@ import { buildWakingPageHtml } from "@teamscala/os/brand/waking-page-html";
 import { BootFatalError } from "@teamscala/os/errors/boot-error";
 import { createTimer } from "@teamscala/timing/create-timer";
 import { Hono, type Context } from "hono";
+import { bodyLimit } from "hono/body-limit";
 import { compress } from "hono/compress";
 import { cors } from "hono/cors";
 import { timing } from "hono/timing";
@@ -33,6 +34,7 @@ import { attachProposalMagic } from "./attach-proposal-magic.ts";
 import { attachPortalMembers } from "./attach-portal-members.ts";
 import { attachTransfersUpload } from "./attach-transfers-upload.ts";
 import { attachAuthGate } from "./auth-gate.ts";
+import { csrfProtection } from "./csrf-protection.ts";
 import { attachRequestLogger } from "./install-logging.ts";
 import type { ServiceInstallConfig } from "./load-service-install-row.ts";
 import { mountOrpcRouter } from "./mount-orpc-router.ts";
@@ -276,6 +278,26 @@ export async function buildMinimalApp(
 	);
 	app.use("*", compress());
 	app.use("*", timing());
+	// CSRF (`security-csrf-protection`): state-changing form-element requests
+	// must carry a trusted Origin — derived set (managed base domain +
+	// builda_websites custom domains via isTrustedAuthOrigin), never an
+	// allowlist beside better-auth's. Registered after security headers, before
+	// every route + gate.
+	app.use("*", csrfProtection());
+	// GLOBAL body limit (`security-body-limit`): every request body is bounded
+	// BEFORE any handler buffers it — a per-route file.size check AFTER
+	// formData() has buffered is a report, not a limit. 30MB sits above the
+	// 25MB transfers-upload maximum; routes wanting a smaller bound mount their
+	// own bodyLimit BEFORE this one (Hono runs matching middleware in
+	// registration order, and /api/rpc registers its 10MB limit in
+	// mount-orpc-router).
+	app.use(
+		"*",
+		bodyLimit({
+			maxSize: 30 * 1024 * 1024,
+			onError: (c) => c.text("Payload Too Large", 413),
+		}),
+	);
 	attachRequestLogger(app, serviceSlug);
 
 	// Fire independent I/O + compilation NOW, overlapping with the gate chain