@timber-js/app 0.2.0-alpha.209 → 0.2.0-alpha.210

package/dist/_chunks/{dev-server-C4WZdB7L.js → dev-server-v97rQH4b.js}

@@ -3,9 +3,9 @@ import { n as RENDER_TIMEOUT_CEILING_MS, t as DEFAULT_RENDER_TIMEOUT_MS } from "
 import { l as registerDevDiscovery } from "./graph-cache-CYiUS2aS.js";
 import { n as isScannableSourceFile, t as buildSourceExtensions } from "./scan-BoP17W3w.js";
 import { t as RSC_CONTENT_TYPE } from "./rsc-media-type-DDc7duTD.js";
+import { t as matchUrlParts } from "./tree-match-6yihorhk.js";
 import { o as isMetadataRouteServePath } from "./metadata-routes-DSDjM_hJ.js";
 import { r as canonicalize } from "./canonicalize-CgHoscYO.js";
-import { t as matchUrlParts } from "./tree-match-6yihorhk.js";
 import { normalizePath } from "vite";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -961,6 +961,19 @@ function validateConfig(config) {
 			}
 		}
 	}
+	if (config.allowedOrigins !== void 0) {
+		if (!Array.isArray(config.allowedOrigins)) errors.push({
+			field: "allowedOrigins",
+			message: "allowedOrigins must be an array of origin strings.",
+			value: config.allowedOrigins,
+			fatal: true,
+			suggestion: "Example: allowedOrigins: [\"https://app.example.com\"]"
+		});
+		else for (const entry of config.allowedOrigins) {
+			const error = allowedOriginError(entry);
+			if (error) errors.push(error);
+		}
+	}
 	if (config.slowRequestMs !== void 0) {
 		if (typeof config.slowRequestMs !== "number" || config.slowRequestMs < 0) errors.push({
 			field: "slowRequestMs",
@@ -1035,24 +1048,101 @@ function validateConfig(config) {
 	});
 	return errors;
 }
+/**
+* Why one `allowedOrigins` entry can never match, or null when it can.
+*
+* The CSRF check compares entries to the request's `Origin` header by
+* exact string, and browsers send only the canonical form — scheme, host,
+* and non-default port, lowercased, no path. So an entry that is not its
+* own `new URL(x).origin` (`https://example.com/`, `https://Example.com`,
+* `example.com`) silently matches nothing. `"null"` is refused outright:
+* it is the `Origin` of every opaque context at once.
+*/
+function allowedOriginError(entry) {
+	const field = "allowedOrigins";
+	const fatal = true;
+	if (typeof entry !== "string") return {
+		field,
+		message: `allowedOrigins contains a non-string value: ${JSON.stringify(entry)}.`,
+		value: entry,
+		fatal
+	};
+	if (entry === "null") return {
+		field,
+		message: "allowedOrigins cannot contain \"null\". Browsers send Origin: null from every opaque context — sandboxed iframes (an attacker's <iframe sandbox> included), POSTs redirected across origins, and file: pages — so allowing it allows all of them.",
+		value: entry,
+		suggestion: "To accept a cross-site POST on one endpoint, handle it in a route.ts that exports `const csrf = false` instead.",
+		fatal
+	};
+	if (entry.includes("*")) return {
+		field,
+		message: `allowedOrigins entry ${JSON.stringify(entry)} uses a wildcard. Matching is exact; wildcards are not supported.`,
+		value: entry,
+		suggestion: "List each origin, e.g. [\"https://app.example.com\", \"https://admin.example.com\"].",
+		fatal
+	};
+	const canonical = canonicalOrigin(entry) ?? canonicalOrigin(`https://${entry}`);
+	if (canonical === entry) return null;
+	return {
+		field,
+		message: `allowedOrigins entry ${JSON.stringify(entry)} is not a canonical origin, so it can never match a request's Origin header.`,
+		value: entry,
+		suggestion: canonical ? `Did you mean "${canonical}"? An origin is scheme://host[:port] — lowercase, no path or trailing slash.` : "An origin is scheme://host[:port], e.g. \"https://app.example.com\".",
+		fatal
+	};
+}
+/** `new URL(x).origin` for an http(s) URL, or null. Opaque origins are not origins here. */
+function canonicalOrigin(value) {
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:" ? url.origin : null;
+	} catch {
+		return null;
+	}
+}
 var RED = "\x1B[31m";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
 /**
-* Format config errors for terminal output.
+* Format config errors for terminal output. Pass `color: false` for text
+* that goes into a thrown `Error` — escapes there reach CI logs and the
+* Vite overlay as raw bytes.
 */
-function formatConfigErrors(errors) {
+function formatConfigErrors(errors, { color = true } = {}) {
 	if (errors.length === 0) return "";
+	const [red, bold, dim, reset] = color ? [
+		RED,
+		BOLD,
+		DIM,
+		RESET
+	] : [
+		"",
+		"",
+		"",
+		""
+	];
 	const lines = [];
-	lines.push(`${RED}${BOLD}[timber]${RESET} ${RED}${errors.length} config error${errors.length !== 1 ? "s" : ""} in timber.config.ts:${RESET}`);
+	lines.push(`${red}${bold}[timber]${reset} ${red}${errors.length} config error${errors.length !== 1 ? "s" : ""} in timber.config.ts:${reset}`);
 	for (const err of errors) {
 		lines.push("");
-		lines.push(`  ${RED}✗${RESET} ${BOLD}${err.field}${RESET}: ${err.message}`);
-		if (err.suggestion) lines.push(`    ${DIM}${err.suggestion}${RESET}`);
+		lines.push(`  ${red}✗${reset} ${bold}${err.field}${reset}: ${err.message}`);
+		if (err.suggestion) lines.push(`    ${dim}${err.suggestion}${reset}`);
 	}
 	return lines.join("\n");
 }
+/**
+* Surface config errors at startup: non-fatal ones are written to stderr
+* (Vite may still work partially, and the message guides the fix); fatal
+* ones then stop startup with a thrown error. Non-fatal errors are written
+* first so a fatal one does not hide them.
+*/
+function reportConfigErrors(errors, write = (text) => process.stderr.write(text)) {
+	const warnings = errors.filter((e) => !e.fatal);
+	if (warnings.length > 0) write(`${formatConfigErrors(warnings)}\n\n`);
+	const fatal = errors.filter((e) => e.fatal);
+	if (fatal.length > 0) throw new Error(formatConfigErrors(fatal, { color: false }));
+}
 var VIRTUAL_MODULE_NAMES = {
 	"virtual:timber-rsc-entry": "RSC entry (server component handler)",
 	"virtual:timber-ssr-entry": "SSR entry (HTML renderer)",
@@ -1246,7 +1336,7 @@ function createGraphEndpointMiddleware(server, ctx) {
 		}
 		reflectCors(res, origin);
 		try {
-			const { classifyLiveFile, classifyLiveProject } = await import("./live-graph-Dv-JJCZw.js");
+			const { classifyLiveFile, classifyLiveProject } = await import("./live-graph-9cSnn_h9.js");
 			const preserveSymlinks = server.config.resolve.preserveSymlinks;
 			const root = normalizePath(preserveSymlinks ? ctx.root : await realpath(ctx.root));
 			const appDir = normalizePath(preserveSymlinks ? ctx.appDir : await realpath(ctx.appDir).catch(() => join(root, relative(ctx.root, ctx.appDir))));
@@ -1944,6 +2034,6 @@ function listenForClientErrors(server, projectRoot) {
 	});
 }
 //#endregion
-export { formatMissingPeers as a, formatConfigErrors as i, timberDevServer as n, validateConfig as o, checkPeerDependencies as r, dev_server_exports as t };
+export { reportConfigErrors as a, formatMissingPeers as i, timberDevServer as n, validateConfig as o, checkPeerDependencies as r, dev_server_exports as t };
 
-//# sourceMappingURL=dev-server-C4WZdB7L.js.map
+//# sourceMappingURL=dev-server-v97rQH4b.js.map