@wtfalch/foundry 0.36.1 → 0.37.0

package/dist/plan/executor.d.ts

@@ -15,6 +15,7 @@ import { type MailCopyPort } from './mail-copy.js';
 import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
+import type { RequestHeaderPort } from './platform-providers.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
 /**
  * The Coolify calls this executor makes, shaped to match
@@ -1595,6 +1596,13 @@ export interface FoundryStepExecutorPorts {
      * `edge.tunnels` (see {@link EdgePort.tunnels}). Kept for a host or a test that supplies its own.
      */
     tunnels?: TunnelPort;
+    /**
+     * #745: the Cloudflare request header rule call, edge's `platform.requestHeaders`
+     * (`@wtfalch/edge` 0.14.0). A company's sign-in hostname gets its header strip rule
+     * through it before its DNS record; without it the step logs one fixed line and
+     * writes no rule. Mail and SFU hostnames never use it.
+     */
+    requestHeaders?: RequestHeaderPort;
     /**
      * F4.access: overrides the Access calls, which otherwise go through
      * `edge.access` (see {@link EdgePort.access}). Kept for a host or a test that supplies its own.

package/dist/plan/executor.js

@@ -5749,7 +5749,12 @@ export class FoundryStepExecutor {
             apex: hn.zone,
             gitRef,
             project: { ensure: () => this.ensureCoolifyProject(org, context) },
-            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:auth`),
+            network: orgNetwork({
+                dns: this.dnsPort(),
+                tunnels: this.tunnelPort(),
+                requestHeaders: this.ports.requestHeaders,
+                zones: this.zonePort(),
+            }, scope, `${org.slug}:auth`),
             smtpSender: `noreply@${hn.mailDomain}`,
             defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
             ownerCompany: null,

package/dist/plan/own-services.d.ts

@@ -6,7 +6,7 @@ import type { DnsPort } from './edge-dns.js';
 import type { ZonePort } from './edge-zones.js';
 import type { CallsSfuPort, CloudflarePort, CoolifyPort, FilesOrganisationPort, FoundryStepExecutorPorts, JobsSchedulerPort, MailPort, ZitadelPort } from './executor.js';
 import type { PlatformStepExecutionContext, StepExecutionContext } from './plan-apply.js';
-import type { FoundryPlatformStepExecutorOptions, PlatformAuthDeps, PlatformDnsFactory, PlatformFilesDeps, PlatformMailDeps, PlatformTunnelPort, PlatformTunnelsFactory } from './platform-providers.js';
+import type { FoundryPlatformStepExecutorOptions, PlatformAuthDeps, PlatformDnsFactory, PlatformFilesDeps, PlatformMailDeps, PlatformRequestHeadersFactory, PlatformTunnelPort, PlatformTunnelsFactory, RequestHeaderPort } from './platform-providers.js';
 /** Applied-state key under which an own org's provisioned-services marker is recorded. */
 export declare const OWN_SERVICES_APPLIED_SCOPE_KEY = "own_services_applied";
 /**
@@ -82,10 +82,13 @@ export interface ServiceNetwork {
     dns(): Promise<DnsPort>;
     tunnels(): Promise<PlatformTunnelPort>;
     zoneId(apex: string): Promise<string | undefined>;
+    /** Undefined when the host supplies no way to write Cloudflare request header rules. */
+    requestHeaders(): Promise<RequestHeaderPort | undefined>;
 }
 export declare function platformNetwork(deps: {
     dns: PlatformDnsFactory;
     tunnels: PlatformTunnelsFactory;
+    requestHeaders?: PlatformRequestHeadersFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
 }, scope: StepScope, step: string): ServiceNetwork;
 /**
@@ -96,6 +99,7 @@ export declare function platformNetwork(deps: {
 export declare function orgNetwork(ports: {
     dns?: DnsPort;
     tunnels?: PlatformTunnelPort;
+    requestHeaders?: RequestHeaderPort;
     zones?: Pick<ZonePort, 'findZoneByApex'>;
 }, scope: StepScope, step: string): ServiceNetwork;
 /** Where the project comes from: the platform's 'platform' project, or the org's own. */

package/dist/plan/own-services.js

@@ -1,5 +1,5 @@
 import { NO_DOMAIN_ZONE } from './own-hostnames.js';
-import { apexZoneKey, exactZone, platformDns, platformTunnels } from './platform-providers.js';
+import { apexZoneKey, exactZone, platformDns, platformRequestHeaders, platformTunnels, } from './platform-providers.js';
 /** The key the org's zone step records its Cloudflare zone id under. */
 const ORG_ZONE_SCOPE_KEY = 'cloudflare_zone';
 /** Applied-state key under which an own org's provisioned-services marker is recorded. */
@@ -123,6 +123,7 @@ export function platformNetwork(deps, scope, step) {
     return {
         dns: () => platformDns(deps, scope.recordedIds(), step),
         tunnels: () => platformTunnels(deps, scope.recordedIds(), step),
+        requestHeaders: () => platformRequestHeaders(deps, scope.recordedIds()),
         zoneId: async (apex) => scope.recordedIds()[apexZoneKey(apex)] ?? (await exactZone(deps.cloudflare, apex))?.id,
     };
 }
@@ -143,6 +144,7 @@ export function orgNetwork(ports, scope, step) {
                 throw new Error(`${step}: the host supplies no tunnel port for this org`);
             return ports.tunnels;
         },
+        requestHeaders: async () => ports.requestHeaders,
         zoneId: async (apex) => {
             // The recorded zone is the company's own; `oikos.host` is never it.
             const recorded = apex === NO_DOMAIN_ZONE ? undefined : scope.recordedIds()[ORG_ZONE_SCOPE_KEY];

package/dist/plan/platform-providers.d.ts

@@ -59,6 +59,33 @@ export type PlatformTunnelPort = Pick<TunnelPort, 'findTunnelByName' | 'createTu
 export declare function platformTunnels(deps: {
     tunnels: PlatformTunnelsFactory;
 }, recorded: Readonly<Record<string, string>>, step: string): Promise<PlatformTunnelPort>;
+/**
+ * Request headers a client can set that ZITADEL reads to pick or name an
+ * instance (auth#241, auth#252). Cloudflare removes them from every inbound
+ * request on a sign-in hostname, because the tunnel routes ZITADEL's paths
+ * straight to ZITADEL and no app code sees them first.
+ */
+export declare const SIGNIN_STRIPPED_REQUEST_HEADERS: readonly ["X-Zitadel-Instance-Host", "X-Zitadel-Public-Host", "X-Zitadel-Forward-Host", "X-Forwarded-Host"];
+/** One Cloudflare request-header Transform Rule (phase `http_request_late_transform`) that removes headers. */
+export interface RequestHeaderStripRule {
+    /** Names the rule in the zone: the key that makes a repeat safe. */
+    description: string;
+    expression: string;
+    headers: readonly string[];
+}
+/** The Cloudflare request header rule calls a sign-in step makes. */
+export interface RequestHeaderPort {
+    /** Makes the rule, or returns the one already made for that zone and description. */
+    ensureRequestHeaderStrip(zoneId: string, rule: RequestHeaderStripRule): Promise<{
+        id: string;
+    }>;
+}
+/** Like {@link PlatformTunnelsFactory}: builds the {@link RequestHeaderPort} at edge's recorded address. */
+export type PlatformRequestHeadersFactory = (edgeUrl: string) => RequestHeaderPort | Promise<RequestHeaderPort>;
+/** The request header port for a platform step; undefined when edge is not recorded or the host supplied no factory. */
+export declare function platformRequestHeaders(deps: {
+    requestHeaders?: PlatformRequestHeadersFactory;
+}, recorded: Readonly<Record<string, string>>): Promise<RequestHeaderPort | undefined>;
 /**
  * F4.access: builds the {@link AccessPort} a platform step finds, creates and
  * deletes its Access app through, given the same address as
@@ -110,6 +137,11 @@ export interface PlatformAuthDeps {
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
     tunnels: PlatformTunnelsFactory;
+    /**
+     * Request header rules through edge. Edge has no such call yet (@wtfalch/edge 0.13.0 offers
+     * rate limit rules only), so a host that leaves this out gets no rule and a logged line per run.
+     */
+    requestHeaders?: PlatformRequestHeadersFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;

package/dist/plan/platform-providers.js

@@ -53,6 +53,23 @@ export async function platformTunnels(deps, recorded, step) {
     }
     return deps.tunnels(edgeUrl);
 }
+/**
+ * Request headers a client can set that ZITADEL reads to pick or name an
+ * instance (auth#241, auth#252). Cloudflare removes them from every inbound
+ * request on a sign-in hostname, because the tunnel routes ZITADEL's paths
+ * straight to ZITADEL and no app code sees them first.
+ */
+export const SIGNIN_STRIPPED_REQUEST_HEADERS = [
+    'X-Zitadel-Instance-Host',
+    'X-Zitadel-Public-Host',
+    'X-Zitadel-Forward-Host',
+    'X-Forwarded-Host',
+];
+/** The request header port for a platform step; undefined when edge is not recorded or the host supplied no factory. */
+export async function platformRequestHeaders(deps, recorded) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    return edgeUrl && deps.requestHeaders ? deps.requestHeaders(edgeUrl) : undefined;
+}
 /** The Access port for a platform step; same address and same reason as {@link platformDns}. */
 async function platformAccess(deps, recorded, step) {
     const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
@@ -1701,6 +1718,18 @@ export async function provisionAuthStack(scope, deps, target, input) {
     if (!zoneId) {
         throw new Error(`${label}: no Cloudflare zone for ${apex} to put ${hostname} in`);
     }
+    // Before the DNS record, so the hostname is never published without the rule.
+    const requestHeaders = await network.requestHeaders();
+    if (requestHeaders) {
+        await requestHeaders.ensureRequestHeaderStrip(zoneId, {
+            description: `strip spoofable sign-in headers: ${hostname}`,
+            expression: `(http.host eq "${hostname}")`,
+            headers: SIGNIN_STRIPPED_REQUEST_HEADERS,
+        });
+    }
+    else {
+        console.error(`${label}: no request header port, so the sign-in hostname keeps X-Zitadel-* and X-Forwarded-Host from clients`);
+    }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
     const dns = await network.dns();
     const [dnsRecord] = await dns.findDnsRecord(apex, hostname, 'CNAME');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.36.1",
+  "version": "0.37.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",