@vesk/adapter 0.2.65 → 0.2.66

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAkDjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkGD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkfxI"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAkDjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkGD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkiBxI"}

package/dist/prod-server.js

@@ -281,6 +281,52 @@ export async function startProdServer(outDir, options) {
             }
             return origWriteHead(statusCode, headers);
         });
+        // Per-request security overrides (`request.setCsp()`, `.setSecurityHeader()`,
+        // `.setRateLimit()`, `.setCsrf()`) accumulate in the runtime's
+        // AsyncLocalStorage bag. The server cannot import the runtime directly (it
+        // is injected into generated code as a string), so it reads the bridge it
+        // registers on globalThis. Without this every one of those setters was a
+        // silent no-op.
+        const securityBridge = globalThis.__vesk_security;
+        // Rate limiting is enforced BEFORE the handler runs, so a per-request
+        // limit set inside the handler cannot apply to this same request. It is
+        // surfaced here for the next request on the connection-independent bag;
+        // the global limit configured in vesk.config is what gates this one.
+        // Wrap a handler call so overrides it records land in a fresh bag that is
+        // still readable when the response is written. Falls back to a pass-through
+        // when the runtime has not registered its bridge.
+        const securityRun = securityBridge?.run;
+        const withSecurityScope = securityRun
+            ? (fn) => securityRun(fn)
+            : (fn) => fn();
+        const applyOverrideHeaders = (headers) => {
+            const overrides = securityBridge?.get?.();
+            if (!overrides)
+                return headers;
+            const next = { ...headers };
+            if (typeof overrides.contentSecurityPolicy === 'string') {
+                next['Content-Security-Policy'] = overrides.contentSecurityPolicy;
+            }
+            const custom = overrides.customHeaders;
+            if (custom) {
+                for (const [name, value] of Object.entries(custom)) {
+                    if (value === false)
+                        delete next[name];
+                    else
+                        next[name] = value;
+                }
+            }
+            return next;
+        };
+        const origWriteHead2 = res.writeHead.bind(res);
+        let overridesApplied = false;
+        res.writeHead = ((statusCode, headers) => {
+            if (!overridesApplied) {
+                overridesApplied = true;
+                headers = applyOverrideHeaders((headers || {}));
+            }
+            return origWriteHead2(statusCode, headers);
+        });
         const publicDir = resolve(staticDir, 'public');
         const rootFile = url.pathname.length > 1 ? resolveWithin(publicDir, url.pathname.slice(1)) : null;
         if (rootFile && existsSync(rootFile) && statSync(rootFile).isFile()) {
@@ -427,7 +473,8 @@ export async function startProdServer(outDir, options) {
             }
             try {
                 const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
-                const response = await mod.handleAction(webRequest, actionId);
+                const handleAction = mod.handleAction.bind(mod);
+                const response = await withSecurityScope(() => handleAction(webRequest, actionId));
                 await deliverResponse(res, response);
             }
             catch (e) {
@@ -449,7 +496,7 @@ export async function startProdServer(outDir, options) {
                         if (mod) {
                             try {
                                 const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
-                                const response = await mod.handle(webRequest);
+                                const response = await withSecurityScope(() => mod.handle(webRequest));
                                 await deliverResponse(res, response);
                                 return;
                             }
@@ -492,7 +539,7 @@ export async function startProdServer(outDir, options) {
                             if (route.revalidate && route.revalidate > 0) {
                                 const { pageIsr } = await import('@vesk/runtime/src/index-server');
                                 cachedResult = await pageIsr(url.pathname, async () => {
-                                    const response = await mod.handle(webRequest);
+                                    const response = await withSecurityScope(() => mod.handle(webRequest));
                                     return { html: await response.text(), headers: Object.fromEntries(response.headers) };
                                 }, { revalidate: route.revalidate, tags: route.tags || [] });
                             }
@@ -501,7 +548,7 @@ export async function startProdServer(outDir, options) {
                                 res.end(cachedResult.html);
                                 return;
                             }
-                            const response = await mod.handle(webRequest);
+                            const response = await withSecurityScope(() => mod.handle(webRequest));
                             const headers = Object.fromEntries(response.headers);
                             if (!headers['content-type'] && !headers['Content-Type'])
                                 headers['Content-Type'] = 'text/html';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/adapter",
-  "version": "0.2.65",
+  "version": "0.2.66",
   "type": "module",
   "description": "Vesk adapter — builds deployable .vesk/ output for Deno and Node serverless",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
     "sharp": "^0.35.3"
   },
   "dependencies": {
-    "@vesk/compiler": "^0.2.65",
-    "@vesk/runtime": "^0.2.65",
-    "@vesk/types": "^0.2.65"
+    "@vesk/compiler": "^0.2.66",
+    "@vesk/runtime": "^0.2.66",
+    "@vesk/types": "^0.2.66"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",