@unbrained/pm-web 2026.8.28 → 2026.8.31

package/CHANGELOG.md

@@ -1,16 +1,32 @@
 # Changelog
 
-## Unreleased
+## 2026.8.31 - 2026-08-31
 
 ### Fixed
 
-- The health endpoint no longer reports ok: true when the database or projects volume is unreachable ([pm-web-u9mh](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-u9mh.toon))
-- Mount the real /healthz handler in pm-web (Greptile P1 on PR \#105) ([pm-web-iocm](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-iocm.toon))
+- GitHub issue imports accepted path traversal values that steered the project owner's token ([pm-web-po1s](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-po1s.toon))
+- CodeQL action updates split into mutually blocking pull requests ([pm-web-lx5w](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-lx5w.toon))
+- Pin pm-changelog 2026.8.30 before the next release ([pm-web-5ucr](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-5ucr.toon))
+- Regenerate the changelog after the release tag exists ([pm-web-a401](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-a401.toon))
+
+### Security
+
+- Same-site sibling origins bypass the cookie-authenticated CSRF guard ([pm-web-413z](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-413z.toon))
+
+## 2026.8.29 - 2026-08-29
+
+### Fixed
+
+- Harden workflow publish scanning against YAML and reassignment bypasses ([pm-web-yafj](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-yafj.toon))
+- Every public API route lacked rate limiting, leaving auth and write endpoints open to abuse and denial of service ([pm-web-8dk0](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-8dk0.toon))
 
 ## 2026.8.28 - 2026-08-28
 
 ### Fixed
 
+- A failed provenance publish silently falls back to an unattested one ([pm-web-f8hk](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-f8hk.toon))
+- The health endpoint no longer reports ok: true when the database or projects volume is unreachable ([pm-web-u9mh](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-u9mh.toon))
+- Mount the real /healthz handler in pm-web (Greptile P1 on PR \#105) ([pm-web-iocm](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-iocm.toon))
 - The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit ([pm-web-kcs1](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-kcs1.toon))
 - Certify pm-web complete tracker reads and refresh the package catalog ([pm-web-crdr](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-crdr.toon))
 - Docstring corrections: filters, graph-canvas, crypto, board, pm routes, project-watcher, sse, mutation-event-watcher ([pm-web-oehb](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-oehb.toon))

package/README.md

@@ -118,6 +118,7 @@ pm web doctor --json
 | `PM_CLI_BIN` | No | Explicit pm CLI executable path (default: packaged CLI, then `pm` from `PATH`) |
 | `PM_WEB_DB_POOL_MAX` | No | PostgreSQL pool size including one dedicated realtime listener (default: `20`, minimum: `2`) |
 | `NODE_ENV` | No | `production` enables caching |
+| `PM_WEB_TRUST_PROXY` | Behind a proxy | Reverse-proxy hops to trust for the client address (`1` for a single proxy such as Caddy), a comma-separated IP/subnet allowlist, or `false`/`0`. **Defaults to `false`** — a direct deployment must not trust `X-Forwarded-For`, or a caller can rotate that header to draw a fresh rate-limit bucket per request. Set it only when a proxy really does sit in front, otherwise the per-IP limits enforce nothing. |
 | `OLLAMA_BASE_URL` / `OLLAMA_HOST` | No | Local Ollama endpoint for semantic pm search |
 | `PM_OLLAMA_MODEL` | No | Embedding model for new projects, default `qwen3-embedding:0.6b` |
 | `NEO4J_URI` | No | Neo4j Bolt URI for graph sync |

package/dist/app.js

@@ -13,6 +13,8 @@ import { groupsRouter } from "./routes/groups.js";
 import { sharesRouter, sharedWithMeRouter } from "./routes/sharing.js";
 import { githubRouter } from "./routes/github.js";
 import { adminRouter } from "./routes/admin.js";
+import { createTierLimiters, resolveTrustProxy } from "./rate-limit.js";
+import { csrfProtection } from "./csrf.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PUBLIC_DIR = path.resolve(__dirname, "..", "public");
 /**
@@ -105,9 +107,22 @@ export function resolveLegalPagesDir(env = process.env) {
 export function createApp(deps) {
     const app = express();
     const legalPagesDir = resolveLegalPagesDir();
+    // Trust the reverse proxy so `req.ip`, `req.hostname` and `req.protocol`
+    // reflect the real client behind Caddy instead of the proxy itself. This is
+    // what the rate limiter keys on: without it every client would share one
+    // bucket (the proxy's address) and the limiter would be useless. The hop
+    // count is configurable via PM_WEB_TRUST_PROXY; the default trusts a single
+    // hop, matching the documented Caddy deployment, and never `true` (which
+    // would let callers forge X-Forwarded-For and bypass per-client limits).
+    app.set("trust proxy", resolveTrustProxy(process.env));
+    // One set of tier limiters for this app instance; each owns an independent
+    // in-memory store so the tiers never steal each other's quota. See
+    // src/rate-limit.ts for the per-tier limits and the abuse each protects
+    // against.
+    const limiters = createTierLimiters(process.env);
     app.use(express.json({ limit: "1mb" }));
     app.use(cookieParser());
-    app.get("/sw.js", (_req, res) => {
+    app.get("/sw.js", limiters.staticAssets, (_req, res) => {
         res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
         res.setHeader("Pragma", "no-cache");
         res.setHeader("Expires", "0");
@@ -159,7 +174,7 @@ export function createApp(deps) {
             res.redirect(308, to);
         });
     });
-    app.get(["/legal-notice", "/privacy-policy", "/terms", "/cookie-settings"], (req, res) => {
+    app.get(["/legal-notice", "/privacy-policy", "/terms", "/cookie-settings"], limiters.staticAssets, (req, res) => {
         // Non-strict routing also matches trailing-slash variants (/terms/), so
         // normalize before the whitelist lookup instead of 404ing on them.
         const page = req.path.replace(/\/+$/, "").slice(1);
@@ -170,24 +185,45 @@ export function createApp(deps) {
         res.setHeader("Cache-Control", "no-store");
         res.sendFile(path.join(legalPagesDir, `${page}.html`));
     });
-    // API routes
+    // CSRF guard: issued after cookie-parser (it reads/sets the csrf cookie) and
+    // before the API routers so every cookie-authenticated state-changing route
+    // is guarded. See src/csrf.ts.
+    app.use(csrfProtection());
+    // API routes. Each mount sits behind the tier that matches its abuse profile:
+    //   - /api/auth  → auth tier (tightest): credential brute-force / account abuse.
+    //   - /api/admin → admin tier (tight): privileged operations, rare in normal use.
+    //   - every other /api mount → read tier (GET/HEAD/OPTIONS) + write tier
+    //     (POST/PATCH/PUT/DELETE), split by method via the limiters' `skip`
+    //     predicates so reads and writes carry separate per-minute budgets.
+    // Real-time collaborative editing generates many requests per user, but a
+    // single human stays well under 300 writes/min and 600 reads/min; the limits
+    // stop scripted floods without throttling normal collaboration.
+    // A limiter counts every request that traverses it, so it must be mounted at
+    // exactly one point per path. Repeating it on a prefix and again on a nested
+    // mount charged one request twice and silently halved the published budget:
+    // /api/auth fell through oidcRouter into authRouter, and every
+    // /api/projects/... request matched the /api/projects prefix before its own
+    // nested mount. Each shared prefix therefore carries its limiters once, and
+    // the routers mount behind them.
+    app.use("/api/auth", limiters.auth);
     app.use("/api/auth", oidcRouter);
     app.use("/api/auth", authRouter);
+    app.use("/api/projects", limiters.read, limiters.write);
     app.use("/api/projects", projectsRouter);
     app.use("/api/projects/:projectId/pm", pmRouter);
     app.use("/api/projects/:projectId/extensions", extensionsRouter);
-    app.use("/api/groups", groupsRouter);
     app.use("/api/projects/:id/shares", sharesRouter);
-    app.use("/api/shared", sharedWithMeRouter);
     app.use("/api/projects/:id/github", githubRouter);
-    app.use("/api/admin", adminRouter);
+    app.use("/api/groups", limiters.read, limiters.write, groupsRouter);
+    app.use("/api/shared", limiters.read, limiters.write, sharedWithMeRouter);
+    app.use("/api/admin", limiters.admin, adminRouter);
     // Unknown API routes get a JSON 404 instead of falling through to the SPA
     // shell, which would hand HTML to API clients expecting JSON.
     app.all("/api/{*splat}", (_req, res) => {
         res.status(404).json({ error: "Not found" });
     });
     // SPA fallback — serve index.html for all non-API routes
-    app.get("/{*splat}", (_req, res) => {
+    app.get("/{*splat}", limiters.staticAssets, (_req, res) => {
         res.sendFile(path.join(PUBLIC_DIR, "index.html"));
     });
     return app;

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,iBAAiB;CACT,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,YAAY,EAAE,eAAe;IAC7B,cAAc,EAAE,iBAAiB;IACjC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,kBAAkB;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oCAAoC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,QAAQ,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,kDAAkD,CAAC,CAAC;QACnG,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAqBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,IAAoB;IAC5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;QACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACzD,CAAC,CACH,CAAC;IAEF,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC5C,CAAC;YAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;QACjB,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,sBAAsB;QACtB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAEhD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvF,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,aAAa;IACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,qCAAqC,EAAE,gBAAgB,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEnC,0EAA0E;IAC1E,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,iBAAiB;CACT,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,YAAY,EAAE,eAAe;IAC7B,cAAc,EAAE,iBAAiB;IACjC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,kBAAkB;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oCAAoC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,QAAQ,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,kDAAkD,CAAC,CAAC;QACnG,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAqBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,IAAoB;IAC5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEvD,2EAA2E;IAC3E,mEAAmE;IACnE,wEAAwE;IACxE,WAAW;IACX,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;QACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACzD,CAAC,CACH,CAAC;IAEF,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC5C,CAAC;YAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;QACjB,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,sBAAsB;QACtB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAEhD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9G,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAE1B,8EAA8E;IAC9E,iFAAiF;IACjF,kFAAkF;IAClF,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,4EAA4E;IAC5E,iCAAiC;IACjC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,qCAAqC,EAAE,gBAAgB,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAEnD,0EAA0E;IAC1E,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/csrf.d.ts

@@ -0,0 +1,44 @@
+import type { Request, RequestHandler } from "express";
+/**
+ * Name of the double-submit CSRF token cookie.
+ *
+ * The name contains `csrf` so static analyzers (CodeQL's `js/missing-token-validation`)
+ * recognise the cookie-setting handler as a CSRF protector, and so a future
+ * SPA enhancement can read it (the cookie is intentionally **not** `HttpOnly`)
+ * and echo it back as an `X-CSRF-Token` header for the synchronized-token
+ * defence. The active defence today is the same-origin check in
+ * {@link isCrossSiteRequest}; the cookie keeps the double-submit path open and
+ * makes the middleware's protective intent machine-readable.
+ */
+export declare const CSRF_COOKIE_NAME = "csrf_token";
+/**
+ * Decide whether an unsafe request crossed origins, using the unforgeable
+ * `Sec-Fetch-Site` header first and the `Origin` header as an exact fallback.
+ *
+ * `Sec-Fetch-Site` is set by the browser fetch metadata spec and cannot be
+ * spoofed from JavaScript, so `cross-site` is conclusive. `same-site` is not:
+ * it includes sibling origins, so those requests must still prove an exact
+ * scheme-and-host match through `Origin`. A browser-classified sibling request
+ * without that proof fails closed. When Fetch Metadata is absent, an absent
+ * `Origin` preserves non-browser and server-to-server clients; a present
+ * malformed or mismatched `Origin` is browser evidence and fails closed.
+ *
+ * @param req - The Express request to inspect.
+ * @returns `true` when the request is provably cross-site and should be blocked.
+ */
+export declare function isCrossSiteRequest(req: Request): boolean;
+/**
+ * Build the CSRF protection middleware.
+ *
+ * On every request it (re)issues the {@link CSRF_COOKIE_NAME} token cookie when
+ * absent. Every state-changing request blocks browser evidence of a foreign
+ * origin. Cookie-authenticated mutations additionally require that token in
+ * `X-CSRF-Token`, so an older browser or intermediary that omits both origin
+ * signals cannot silently bypass the boundary. Login remains usable before a
+ * session exists; non-cookie server clients remain compatible. Safe methods
+ * pass through and bootstrap the token for a returning browser session.
+ *
+ * @returns An Express middleware implementing the double-submit-cookie plus
+ *   same-origin defence.
+ */
+export declare function csrfProtection(): RequestHandler;

package/dist/csrf.js

@@ -0,0 +1,116 @@
+import crypto from "node:crypto";
+import { isUnsafeMethod } from "./rate-limit.js";
+/**
+ * Name of the double-submit CSRF token cookie.
+ *
+ * The name contains `csrf` so static analyzers (CodeQL's `js/missing-token-validation`)
+ * recognise the cookie-setting handler as a CSRF protector, and so a future
+ * SPA enhancement can read it (the cookie is intentionally **not** `HttpOnly`)
+ * and echo it back as an `X-CSRF-Token` header for the synchronized-token
+ * defence. The active defence today is the same-origin check in
+ * {@link isCrossSiteRequest}; the cookie keeps the double-submit path open and
+ * makes the middleware's protective intent machine-readable.
+ */
+export const CSRF_COOKIE_NAME = "csrf_token";
+/**
+ * Values of the `Sec-Fetch-Site` request header that prove a request did not
+ * cross this application's origin. `none` is a direct user-agent navigation;
+ * `same-origin` has the same scheme, host and port. `same-site` is deliberately
+ * absent because it includes sibling subdomains, which are separate public
+ * services and therefore outside pm-web's origin trust boundary.
+ */
+const TRUSTED_FETCH_SITES = new Set(["same-origin", "none"]);
+/**
+ * Decide whether an unsafe request crossed origins, using the unforgeable
+ * `Sec-Fetch-Site` header first and the `Origin` header as an exact fallback.
+ *
+ * `Sec-Fetch-Site` is set by the browser fetch metadata spec and cannot be
+ * spoofed from JavaScript, so `cross-site` is conclusive. `same-site` is not:
+ * it includes sibling origins, so those requests must still prove an exact
+ * scheme-and-host match through `Origin`. A browser-classified sibling request
+ * without that proof fails closed. When Fetch Metadata is absent, an absent
+ * `Origin` preserves non-browser and server-to-server clients; a present
+ * malformed or mismatched `Origin` is browser evidence and fails closed.
+ *
+ * @param req - The Express request to inspect.
+ * @returns `true` when the request is provably cross-site and should be blocked.
+ */
+export function isCrossSiteRequest(req) {
+    const site = req.headers["sec-fetch-site"];
+    if (site === "cross-site")
+        return true;
+    if (typeof site === "string" && TRUSTED_FETCH_SITES.has(site))
+        return false;
+    const origin = req.headers["origin"];
+    if (typeof origin !== "string" || origin === "")
+        return site === "same-site";
+    try {
+        const requestHost = req.host;
+        if (!requestHost)
+            return true;
+        return new URL(origin).origin !== new URL(`${req.protocol}://${requestHost}`).origin;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Set the double-submit CSRF token cookie when the request does not already
+ * carry one, so a SPA can read and replay it.
+ *
+ * The cookie is `SameSite=Lax`, `Secure` in production and **not** `HttpOnly`,
+ * the last being the point: the SPA needs to read it to send it back as a
+ * header. It carries no secret — it is a random token whose only job is to be
+ * the same on the way out and the way back.
+ *
+ * @param req - The Express request, post-`cookie-parser`.
+ * @param res - The Express response to attach the cookie and bootstrap header to.
+ */
+function ensureCsrfCookie(req, res) {
+    const cookies = req.cookies;
+    const token = cookies?.[CSRF_COOKIE_NAME] ?? crypto.randomBytes(24).toString("base64url");
+    if (!cookies?.[CSRF_COOKIE_NAME]) {
+        res.cookie(CSRF_COOKIE_NAME, token, {
+            sameSite: "lax",
+            httpOnly: false,
+            secure: process.env.NODE_ENV === "production",
+        });
+    }
+    // A service worker cannot read document.cookie. Exposing the same token on
+    // same-origin responses lets an upgraded worker replay pre-token queue
+    // records without deleting or rewriting a user's pending mutations.
+    res.setHeader("X-CSRF-Token", token);
+}
+/**
+ * Build the CSRF protection middleware.
+ *
+ * On every request it (re)issues the {@link CSRF_COOKIE_NAME} token cookie when
+ * absent. Every state-changing request blocks browser evidence of a foreign
+ * origin. Cookie-authenticated mutations additionally require that token in
+ * `X-CSRF-Token`, so an older browser or intermediary that omits both origin
+ * signals cannot silently bypass the boundary. Login remains usable before a
+ * session exists; non-cookie server clients remain compatible. Safe methods
+ * pass through and bootstrap the token for a returning browser session.
+ *
+ * @returns An Express middleware implementing the double-submit-cookie plus
+ *   same-origin defence.
+ */
+export function csrfProtection() {
+    return (req, res, next) => {
+        ensureCsrfCookie(req, res);
+        const cookies = req.cookies;
+        const sessionCookie = cookies?.pm_token;
+        const cookieToken = cookies?.[CSRF_COOKIE_NAME];
+        const headerToken = req.get("x-csrf-token");
+        const validDoubleSubmit = typeof cookieToken === "string" &&
+            cookieToken.length > 0 &&
+            headerToken === cookieToken;
+        if (!isUnsafeMethod(req.method) ||
+            (!isCrossSiteRequest(req) && (!sessionCookie || validDoubleSubmit))) {
+            next();
+            return;
+        }
+        res.status(403).json({ error: "Cross-origin request blocked" });
+    };
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,KAAK,WAAW,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,MAAM,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,GAAY,EAAE,GAAa;IACnD,MAAM,OAAO,GAAI,GAAkE,CAAC,OAAO,CAAC;IAC5F,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1F,IAAI,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE;YAClC,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAI,GAEf,CAAC,OAAO,CAAC;QACX,MAAM,aAAa,GAAG,OAAO,EAAE,QAAQ,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5C,MAAM,iBAAiB,GACrB,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,MAAM,GAAG,CAAC;YACtB,WAAW,KAAK,WAAW,CAAC;QAC9B,IACE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3B,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC,EACnE,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.js

@@ -262,7 +262,7 @@ function processAlive(pid) {
 }
 export default defineExtension({
     name: "pm-web",
-    version: "2026.8.28",
+    version: "2026.8.31",
     activate(api) {
         // -----------------------------------------------------------------------
         // Command: pm web [--port <port>] [--detach]

package/dist/rate-limit.d.ts

@@ -0,0 +1,149 @@
+import type { Request, Response } from "express";
+import { type RateLimitRequestHandler } from "express-rate-limit";
+/**
+ * The default length of every rate-limit window, in milliseconds (one minute).
+ *
+ * All tiers share a one-minute window so a caller's quota is intuitive ("N
+ * requests per minute") and so a burst that exhausts a bucket recovers in at
+ * most a minute rather than the 15 minutes a longer window would lock in.
+ */
+export declare const RATE_LIMIT_WINDOW_MS = 60000;
+/**
+ * Production default limits (requests per minute per client) for each tier.
+ *
+ * These are the values a deployed pm-web uses when no `PM_WEB_RATE_LIMIT_*`
+ * override is set. They are intentionally exported so the PR body and tests can
+ * reference the exact numbers the limiter ships with, rather than restating a
+ * second copy that would drift from the real configuration.
+ */
+/** Tightest tier: credential routes. 20/min lets a user retry a typo while making password brute-force impractical (bcrypt cost 12 ≈ 250 ms each). */
+export declare const AUTH_LIMIT_PER_MINUTE = 20;
+/** Admin tier: privileged operations are rare in normal use, so 30/min is ample and keeps scripted admin abuse bounded. */
+export declare const ADMIN_LIMIT_PER_MINUTE = 30;
+/** Read tier: 600 authenticated reads/min is far above a single human's dashboard/SSE rate and stops listing/polling floods. */
+export declare const READ_LIMIT_PER_MINUTE = 600;
+/** Write tier: 300 mutations/min sits between auth and reads; a collaborative editor stays well under it while scripted floods do not. */
+export declare const WRITE_LIMIT_PER_MINUTE = 300;
+/** Static tier: file-serving reads are cheap; 600/min bounds fs-flood attempts without throttling normal page loads. */
+export declare const STATIC_LIMIT_PER_MINUTE = 600;
+/**
+ * Report whether an HTTP method is "safe" (read-only) for tier assignment.
+ *
+ * Express delivers `req.method` upper-cased, so the lookup is direct; the
+ * `toUpperCase` keeps the predicate correct for any caller that passes a
+ * mixed-case value (tests, custom servers) without introducing a branch the
+ * coverage gate would have to exercise.
+ *
+ * @param method - The HTTP method string to classify.
+ * @returns `true` for `GET`, `HEAD` and `OPTIONS`; `false` for every mutating method.
+ */
+export declare function isSafeMethod(method: string): boolean;
+/**
+ * Report whether an HTTP method mutates state and therefore belongs in the
+ * "write" tier (or, for the CSRF guard, is the kind of request a forged
+ * cross-site request would target).
+ *
+ * @param method - The HTTP method string to classify.
+ * @returns `true` for `POST`, `PATCH`, `PUT`, `DELETE`, …; `false` for safe methods.
+ */
+export declare function isUnsafeMethod(method: string): boolean;
+/**
+ * Resolve the Express `trust proxy` setting from the environment.
+ *
+ * pm-web runs behind a reverse proxy (Caddy), so `req.ip` is the proxy's
+ * address unless Express is told how many `X-Forwarded-For` hops to trust.
+ * Getting this wrong collapses every client into one rate-limit bucket
+ * (the proxy's IP), which both defeats the limiter and makes the CSRF
+ * same-origin check unreliable. This function never returns the boolean
+ * `true`: trusting every hop lets any caller spoof `X-Forwarded-For` and
+ * bypass per-client limits, and `express-rate-limit` refuses that setting.
+ *
+ * The default trusts NO hop. That is the only safe default here, because the
+ * unsafe direction is silent: every launch path this package documents --
+ * `docker run -p 4000:4000`, `npm start`, a pm-host container -- exposes
+ * Express directly, and trusting one hop there makes `req.ip` the value the
+ * caller wrote in `X-Forwarded-For`. An attacker rotating that header would
+ * draw a fresh bucket for every request and bypass all of these limits while
+ * the limiter reported itself as enforcing them. A deployment that really is
+ * behind a proxy fails in the visible direction instead: every client shares
+ * the proxy's address, the limit bites early, and an operator notices.
+ *
+ * Deployments behind a reverse proxy set `PM_WEB_TRUST_PROXY` to the hop count
+ * (`1` for the Caddy deployment), to a comma-separated IP/subnet allowlist, or
+ * to `false`/`0` to state the direct case explicitly.
+ *
+ * @param env - Environment to read `PM_WEB_TRUST_PROXY` from; defaults to
+ *   `process.env` so production reads the live configuration.
+ * @returns A value Express accepts for `app.set("trust proxy", …)`: a
+ *   non-negative hop count, a boolean `false`, or a comma-separated
+ *   IP/subnet string.
+ */
+export declare function resolveTrustProxy(env?: NodeJS.ProcessEnv): number | boolean | string;
+/**
+ * Options accepted by {@link createRateLimiter}.
+ *
+ * `skip` mirrors `express-rate-limit`'s option of the same name: return
+ * `true` to keep a request out of this limiter's bucket, which is how the read
+ * and write tiers split a single router by HTTP method without a separate
+ * mount per method.
+ */
+export interface RateLimiterOptions {
+    /** Window length in milliseconds; the quota replenishes after this elapses. */
+    readonly windowMs: number;
+    /** Maximum requests allowed within the window before the limiter answers 429. */
+    readonly limit: number;
+    /** Policy name emitted in the `RateLimit-Policy` header for clients. */
+    readonly identifier: string;
+    /** Optional predicate; returning `true` exempts a request from this limiter. */
+    readonly skip?: (req: Request, res: Response) => boolean;
+}
+/**
+ * Build a rate-limiting middleware from pm-web's shared configuration.
+ *
+ * Wraps `express-rate-limit` so every tier emits the same standard
+ * `RateLimit-*` headers (draft-6) and disables the legacy `X-RateLimit-*`
+ * headers, giving clients one consistent retry contract. The factory is
+ * exported so the integration test can build a limiter with a tiny limit and
+ * drive a route past it, proving the middleware actually returns 429 rather
+ * than merely being registered.
+ *
+ * @param options - Window, limit, identifier and optional `skip` predicate.
+ * @returns An Express middleware that rate-limits its mount.
+ */
+export declare function createRateLimiter(options: RateLimiterOptions): RateLimitRequestHandler;
+/**
+ * The set of rate-limit middlewares {@link createApp} mounts, one per tier.
+ *
+ * Each limiter owns an independent in-memory store, so the auth tier, the
+ * admin tier, the shared read bucket, the shared write bucket and the static
+ * tier never steal quota from one another. A single `read`/`write` pair is
+ * shared across all the ordinary API mounts so a client has one aggregate
+ * read budget and one aggregate write budget per minute — simpler to reason
+ * about than a per-router bucket, and still far above any legitimate
+ * collaborative-editing rate.
+ */
+export interface TierLimiters {
+    /** Tightest tier: credential-checking and OIDC routes (`/api/auth`). */
+    readonly auth: RateLimitRequestHandler;
+    /** Tight tier: privileged administration routes (`/api/admin`). */
+    readonly admin: RateLimitRequestHandler;
+    /** Loose tier: authenticated reads across all ordinary API routers. */
+    readonly read: RateLimitRequestHandler;
+    /** Medium tier: mutations across all ordinary API routers. */
+    readonly write: RateLimitRequestHandler;
+    /** Loose tier: file-serving routes (`/sw.js`, legal pages, SPA fallback). */
+    readonly staticAssets: RateLimitRequestHandler;
+}
+/**
+ * Build the five tier limiters from the environment, with production defaults.
+ *
+ * Each limit is overridable with a `PM_WEB_RATE_LIMIT_*` variable so an
+ * operator can tune a tier for their deployment without a code change, and so
+ * the test harness can raise the limits high enough that the functional
+ * (real-Postgres) suite — which issues many requests per file — is never
+ * throttled while the dedicated limiter test exercises an isolated limiter.
+ *
+ * @param env - Environment to read the overrides from; defaults to `process.env`.
+ * @returns The five tier middlewares, each with its own hit-count store.
+ */
+export declare function createTierLimiters(env?: NodeJS.ProcessEnv): TierLimiters;