@vulkano/core 1.16.1 → 1.17.0

package/bootstrap/express.js

@@ -38,6 +38,7 @@ module.exports = function getExpressConfiguration() {
   const expressDefaultConfig = {
     timeout: 120000,
     poweredBy: false,
+    trustProxy: 1,
     port: ENV_NODE_PORT || ENV_PORT || expressUserPort || expressSettingsPort || 8000,
     cors: {},
     cookies: {},

package/bootstrap/server.js

@@ -61,7 +61,9 @@ module.exports = function loadServer() {
       app.vulkano = vulkano;
 
       // Settings
-      vulkano.enable('trust proxy');
+      // trustProxy: true = trust all proxies, 1 = trust one hop (recommended behind a single LB)
+      const trustProxy = expressConfig.trustProxy !== undefined ? expressConfig.trustProxy : 1;
+      vulkano.set('trust proxy', trustProxy);
 
       // ---------------
       // PORT - File: app/config/express/settings.js
@@ -148,7 +150,7 @@ module.exports = function loadServer() {
       vulkano.use( (req, res, next) => {
 
         const proto = req.secure ? 'https' : 'http';
-        const forwarded = req.headers['x-forwaded-proto'] || null;
+        const forwarded = req.headers['x-forwarded-proto'] || null;
         const currentProtocol = (forwarded || proto).split('://')[0];
         req.protocol = currentProtocol;
 
@@ -173,12 +175,10 @@ module.exports = function loadServer() {
           tmpCustomHeaders = tmpCustomHeaders.concat(expressConfig.cors.headers || []);
           res.header('Access-Control-Allow-Origin', expressConfig.cors.origin);
           res.header('Access-Control-Allow-Headers', tmpCustomHeaders.join(', '));
-        } else {
-          res.header('Access-Control-Allow-Origin', '*');
-          res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept');
+          res.header('Access-Control-Allow-Methods', 'GET,PUT,PATCH,POST,DELETE,OPTIONS');
         }
+
         res.header('Allow', 'GET,PUT,PATCH,POST,DELETE,OPTIONS');
-        res.header('Access-Control-Allow-Methods', 'GET,PUT,PATCH,POST,DELETE,OPTIONS');
 
         res.status(200).end();
 

package/database/scaffold.js

@@ -80,13 +80,30 @@ module.exports = {
    */
   update(_id, data) {
 
+    // Blocklist: these fields are never writable from outside
+    const BLOCKED = ['_id', 'createdAt', '__v'];
+    const sanitized = { ...data };
+    BLOCKED.forEach((field) => delete sanitized[field]);
+
+    // Allowlist: if fillable is defined and non-empty, only those fields pass through
+    const { fillable } = this;
+    let filtered = sanitized;
+    if (Array.isArray(fillable) && fillable.length > 0) {
+      filtered = {};
+      fillable.forEach((field) => {
+        if (sanitized[field] !== undefined) {
+          filtered[field] = sanitized[field];
+        }
+      });
+    }
+
     return this.getByField(_id)
       .then( (record) => {
 
         // Merge current info with incoming values
         const merged = {
           ...record,
-          ...data,
+          ...filtered,
           updatedAt: Date.now()
         };
 

package/libs/Encrypter.js

@@ -2,10 +2,14 @@ const crypto = require('crypto');
 
 class Encrypter {
 
-  constructor(encryptionKey) {
+  constructor(encryptionKey, opts = {}) {
 
-    this.algorithm = 'aes-256-cbc';
-    this.key = crypto.scryptSync(encryptionKey, 'salt', 32);
+    const { encryption } = (typeof app !== 'undefined' && app.config) ? app.config : {};
+    const salt = opts.salt || (encryption && encryption.salt) || process.env.ENCRYPTION_SALT || 'vulkano-salt-v1';
+    const algorithm = opts.algorithm || (encryption && encryption.algorithm) || process.env.ENCRYPTION_ALGORITHM || 'aes-256-cbc';
+
+    this.algorithm = algorithm;
+    this.key = crypto.scryptSync(encryptionKey, salt, 32);
 
   }
 

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@vulkano/core",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "A MVC framework using Express 4",
   "license": "MIT",
   "author": "Vulkano Team",
   "engines": {
-    "node": "^22"
+    "node": ">=20"
   },
   "main": "app.js",
   "scripts": {
@@ -53,7 +53,7 @@
     "nunjucks": "^3.2.4",
     "redis": "^5.12.1",
     "socket.io": "^4.8.1",
-    "undici": "^8.1.0"
+    "undici": "^6.25.0"
   },
   "devDependencies": {
     "@babel/core": "^7.26.9",

package/responses/vsr.js

@@ -76,7 +76,7 @@ module.exports = function VSRPromise(promiseToRun, httpStatusCode) {
         errorCode: message.code || '001',
         errorName: message.name || 'BadRequest',
         detail: message.message || message.error || message.invalidAttributes || message.toString(),
-        output: message
+        ...(app.PRODUCTION ? {} : { output: message })
       };
 
     })