@tinvar/renderer 0.4.19 → 0.4.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinvar/renderer",
-  "version": "0.4.19",
+  "version": "0.4.21",
   "license": "MIT",
   "files": [
     "src",

package/src/dev-guard.js

@@ -1,5 +1,5 @@
 // The one check dev mode makes before anything of it is loaded: that this is
-// not production. Its own module, importing nothing, so the refusal happens
+// a developer's machine. Its own module, importing nothing, so the refusal happens
 // before Vite -- or any dependency of the app -- has run a line.
 
 /** The variables any of which, saying `production`, rule the dev server out. Mirrors Tinvar\Support\DevMode. */
@@ -7,27 +7,43 @@ export const PRODUCTION_MARKERS = ['NODE_ENV', 'TINVAR_ENV', 'APP_ENV'];
 
 export class DevServerRefused extends Error {}
 
+/** The TINVAR_ENV values that say this is a developer's or a test's machine. Mirrors Tinvar\Support\DevMode::DEVELOPMENT. */
+export const DEVELOPMENT = ['local', 'development', 'testing'];
+
 /**
- * Refuses, loudly, anywhere that says production.
+ * Refuses, loudly, everywhere but a machine that says it is a developer's.
  *
  * The dev server runs unsandboxed, serves source over HTTP and shows stacks
- * to whoever loads a failing page. A NODE_ENV or TINVAR_ENV left saying
- * production is the one signal there is that this is the wrong place, so
- * any of them saying so stops it.
+ * to whoever loads a failing page. So, as Tinvar\Support\DevMode reads it
+ * (ADR 0213): TINVAR_ENV must say local, development or testing, and no
+ * NODE_ENV, TINVAR_ENV or APP_ENV may say production, nor TINVAR_ENV,
+ * APP_ENV or TINVAR_PROFILE staging. An environment that says nothing may
+ * be a server's, and is refused too.
  *
  * @param {Record<string, string | undefined>} env
  */
 export function assertDevelopment(env = process.env) {
+  const read = (name) =>
+    String(env[name] ?? '')
+      .trim()
+      .toLowerCase();
+  let why = null;
   for (const name of PRODUCTION_MARKERS) {
-    if (
-      String(env[name] ?? '')
-        .trim()
-        .toLowerCase() === 'production'
-    ) {
-      throw new DevServerRefused(
-        `The dev server is refused: ${name}=production. It runs without the renderer's sandbox and serves ` +
-          'source to the browser, so it never runs in production. Use the built renderer there.',
-      );
+    if (read(name) === 'production') {
+      why = `${name}=production`;
+      break;
     }
   }
+  for (const name of ['TINVAR_ENV', 'APP_ENV', 'TINVAR_PROFILE']) {
+    if (why === null && ['production', 'staging'].includes(read(name))) why = `${name}=${read(name)}`;
+  }
+  if (why === null && !DEVELOPMENT.includes(read('TINVAR_ENV'))) {
+    why = 'TINVAR_ENV is not local, development or testing';
+  }
+  if (why !== null) {
+    throw new DevServerRefused(
+      `The dev server is refused: ${why}. It runs without the renderer's sandbox and serves source to the ` +
+        "browser, so it runs only on a developer's machine: set TINVAR_ENV=local there. Use the built renderer anywhere else.",
+    );
+  }
 }

package/src/dev-server.js

@@ -42,6 +42,11 @@ export const DEV_BASE = '/_vite/';
 /** Addresses the dev server may listen on: this machine's, and nothing else. */
 const LOOPBACK = new Set(['127.0.0.1', '::1']);
 
+/** $path with the characters a glob reads escaped, so it matches itself alone. */
+function globEscape(path) {
+  return path.replace(/[\\*?[\]{}()!+@]/g, '\\$&');
+}
+
 /** The app's Vite config file. */
 function configFileOf(appRoot) {
   for (const name of ['vite.config.ts', 'vite.config.mts', 'vite.config.js', 'vite.config.mjs']) {
@@ -128,8 +133,23 @@ export async function createDevServer({
       ...(publicHosts.length > 0 ? { allowedHosts: [...publicHosts] } : {}),
       fs: {
         // Vite's own refusals, and the secrets an app keeps beside its code:
-        // a key file, a database, the PHP dependencies.
-        deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**', '**/*.key', '**/*.sqlite*', '**/vendor/**'],
+        // a key file, a database, the PHP dependencies. And, since a
+        // tunnel's visitor reaches whatever is served under the base (ADR
+        // 0214): the app's database/ directory whatever its files are named
+        // (APP_LOG, APP_MAIL_LOG, the sign-up and reset links in them),
+        // every log, and the secrets/ compose reads the app key from.
+        deny: [
+          '.env',
+          '.env.*',
+          '*.{crt,pem}',
+          '**/.git/**',
+          '**/*.key',
+          '**/*.sqlite*',
+          '**/vendor/**',
+          '**/*.log',
+          `${globEscape(appRoot)}/database/**`,
+          `${globEscape(appRoot)}/secrets/**`,
+        ],
       },
     },
   });