@ultimat3/http 22.0.0 → 22.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/http",
-  "version": "22.0.0",
+  "version": "22.1.0",
   "description": "Owned request lifecycle over Bun.serve: router, ordered pipeline, problem+json errors",
   "license": "MIT",
   "type": "module",
@@ -31,9 +31,9 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "22.0.0",
-    "@ultimat3/i18n": "22.0.0",
-    "@ultimat3/schema": "22.0.0",
-    "@ultimat3/time": "22.0.0"
+    "@ultimat3/core": "22.1.0",
+    "@ultimat3/i18n": "22.1.0",
+    "@ultimat3/schema": "22.1.0",
+    "@ultimat3/time": "22.1.0"
   }
 }

package/src/csrf.ts

@@ -5,7 +5,7 @@
 // went through. `setRedirect` exists so those form posts work without JS, which makes them a
 // first-class surface here rather than a legacy one.
 
-import { classifyAddress } from '@ultimat3/core';
+import { classifyAddress, proveSameOrigin } from '@ultimat3/core';
 import type { CorsConfig } from './cors';
 import { originListed } from './cors';
 import { HttpError } from './errors';
@@ -26,9 +26,6 @@ export const DEFAULT_CSRF: CsrfConfig = { mode: 'origin' };
 /** Methods with no side effects, per RFC 9110. A CSRF check on these is a check on nothing. */
 const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS', 'TRACE']);
 
-/** The complete `Sec-Fetch-Site` vocabulary. Anything else was written by a non-browser. */
-const KNOWN_SITES = new Set(['same-origin', 'same-site', 'cross-site', 'none']);
-
 export interface CsrfCheckInput {
   readonly method: string;
   /** The origin this app was reached on — scheme from `ctx.https`, host from the request URL. */
@@ -60,29 +57,21 @@ export const checkCsrf = (input: CsrfCheckInput): CsrfVerdict => {
   if (input.anonymous) return { ok: true };
   if (input.hasAuthorizationHeader) return { ok: true };
 
-  const site = input.secFetchSite;
-  if (site === 'same-origin' || site === 'none') return { ok: true };
-  if (input.origin === input.selfOrigin) return { ok: true };
+  // The rule itself is core's, shared with the sync node's upgrade: one answer to "did this
+  // come from this app?" on every surface an ambient credential reaches.
+  //
   // `originListed`, never `allowedOrigin`: that one answers the RESPONSE header, and for
   // `origins: ['*'], credentials: false` — the only wildcard `assertCorsConfig` admits — its
   // answer is `'*'`, which is not null and so read as "this origin is one we allow". A
   // credentialed cross-site POST from evil.test was therefore accepted by the check that exists
   // to refuse exactly it. An exact match is the only allowance a write may be built on.
-  if (originListed(input.cors, input.origin)) return { ok: true };
-  // Only the four values a browser can send are quoted back. Anything else is a client that
-  // wrote the header itself, and echoing what it wrote is how a rejected value reaches the log
-  // store and the response body — the same defect the error-map stage's log line had.
-  if (site !== null) {
-    const known = KNOWN_SITES.has(site) ? site : 'a value no browser sends';
-    return { ok: false, reason: `the request reported sec-fetch-site: ${known}` };
-  }
-  return {
-    ok: false,
-    reason:
-      input.origin === null
-        ? 'the request carried neither sec-fetch-site nor origin, so it cannot be shown to be same-origin'
-        : 'the origin it declares is not this app and is not listed in http.cors.origins',
-  };
+  return proveSameOrigin({
+    selfOrigins: [input.selfOrigin],
+    origin: input.origin,
+    secFetchSite: input.secFetchSite,
+    listed: (origin) => originListed(input.cors, origin),
+    listName: 'http.cors.origins',
+  });
 };
 
 /** The origin a browser compares against — the PUBLIC one, so a TLS-terminating proxy agrees. */

package/src/error-map.ts

@@ -425,6 +425,11 @@ export const ERROR_STATUS = {
   X_REALTIME_UNINSTALLED: 500,
   // Boot-time: a realtime config and its environment that disagree refuse before any request.
   X_REALTIME_TOPOLOGY: 500,
+  // The replicator's own Postgres connection failed TLS. A role that never answers a request, so the
+  // row keeps the table closed at 500, beside `X_REALTIME_TOPOLOGY`.
+  X_REPLICATION_TLS: 500,
+  // A browser page on a foreign origin asked for a socket — refused, not unauthenticated: 403.
+  X_SOCKET_ORIGIN_REFUSED: 403,
   X_RECORD_KEY_MISSING: 500,
   X_RECORD_REJECTED: 500,
   X_SYNC_UNCONFIGURED: 500,