@x47base/pocketbase-addon 0.1.0 → 0.2.0

package/multinode/gateway.go

@@ -0,0 +1,347 @@
+// Package multinode routes tenants to a single authoritative origin and caches explicitly public reads.
+package multinode
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+type Tenant struct {
+	Store       string   `json:"store,omitempty"`
+	Host        string   `json:"host"`
+	Origin      string   `json:"origin"`
+	PublicPaths []string `json:"publicPaths,omitempty"`
+}
+type Config struct {
+	Tenants       []Tenant `json:"tenants"`
+	AllowHTTP     bool     `json:"allowHTTP"`
+	CacheSeconds  int      `json:"cacheSeconds"`
+	CacheEntries  int      `json:"cacheEntries"`
+	MaxConcurrent int      `json:"maxConcurrent"`
+	MaxBodyBytes  int64    `json:"maxBodyBytes"`
+}
+type entry struct {
+	status  int
+	header  http.Header
+	body    []byte
+	expires time.Time
+}
+type route struct {
+	store  string
+	proxy  *httputil.ReverseProxy
+	public map[string]bool
+}
+type Gateway struct {
+	transport              *http.Transport
+	routes                 map[string]route
+	config                 Config
+	slots                  chan struct{}
+	mu                     sync.Mutex
+	cache                  map[string]entry
+	pending                map[string]chan struct{}
+	hits, misses, rejected atomic.Uint64
+}
+
+func New(c Config) (*Gateway, error) {
+	if c.CacheSeconds == 0 {
+		c.CacheSeconds = 2
+	}
+	if c.CacheEntries == 0 {
+		c.CacheEntries = 128
+	}
+	if c.MaxConcurrent == 0 {
+		c.MaxConcurrent = 128
+	}
+	if c.MaxBodyBytes == 0 {
+		c.MaxBodyBytes = 2 << 20
+	}
+	if len(c.Tenants) == 0 || len(c.Tenants) > 10000 || c.CacheSeconds < 1 || c.CacheSeconds > 60 || c.CacheEntries < 1 || c.CacheEntries > 4096 || c.MaxConcurrent < 1 || c.MaxConcurrent > 4096 || c.MaxBodyBytes < 1 || c.MaxBodyBytes > 64<<20 {
+		return nil, errors.New("invalid gateway limits")
+	}
+	g := &Gateway{config: c, routes: map[string]route{}, slots: make(chan struct{}, c.MaxConcurrent), cache: map[string]entry{}, pending: map[string]chan struct{}{}}
+	transport := &http.Transport{Proxy: nil, DialContext: (&net.Dialer{Timeout: 3 * time.Second, KeepAlive: 30 * time.Second}).DialContext, ForceAttemptHTTP2: true, MaxIdleConns: 256, MaxIdleConnsPerHost: 32, IdleConnTimeout: 60 * time.Second, TLSHandshakeTimeout: 5 * time.Second, ResponseHeaderTimeout: 15 * time.Second, MaxResponseHeaderBytes: 64 << 10}
+	g.transport = transport
+	for _, t := range c.Tenants {
+		host := strings.ToLower(t.Host)
+		if t.Store != "" && !validStore(t.Store) {
+			return nil, errors.New("invalid store binding")
+		}
+		u, err := url.Parse(t.Origin)
+		if err != nil || u.Hostname() == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || (u.Path != "" && u.Path != "/") || (u.Scheme != "https" && !(c.AllowHTTP && u.Scheme == "http")) || host == "" || strings.ContainsAny(host, " /\\?#@\r\n") || len(host) > 253 {
+			return nil, errors.New("invalid tenant host or origin")
+		}
+		if _, exists := g.routes[host]; exists {
+			return nil, errors.New("duplicate tenant host")
+		}
+		public := map[string]bool{}
+		for _, path := range t.PublicPaths {
+			if !strings.HasPrefix(path, "/api/commerce/stores/") || strings.ContainsAny(path, "?#%") || strings.HasSuffix(path, "/applications") {
+				return nil, errors.New("only explicit public store projection paths may be cached")
+			}
+			public[path] = true
+		}
+		proxy := &httputil.ReverseProxy{Transport: transport, FlushInterval: -1, Rewrite: func(pr *httputil.ProxyRequest) {
+			pr.SetURL(u)
+			pr.Out.Host = u.Host
+			if t.Store != "" {
+				pr.Out.Host = host
+			}
+			pr.Out.Header.Del("X-Spink-Operator")
+			pr.Out.Header.Del("X-Real-IP")
+			pr.SetXForwarded()
+		}, ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
+			w.Header().Set("Cache-Control", "no-store")
+			http.Error(w, "Origin unavailable; verify the result before repeating a write", 502)
+		}}
+		g.routes[host] = route{store: t.Store, proxy: proxy, public: public}
+	}
+	return g, nil
+}
+func (g *Gateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path == "/healthz" && r.Method == "GET" {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Write([]byte("ok\n"))
+		return
+	}
+	if r.URL.Path == "/metrics" && r.Method == "GET" {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Cache-Control", "no-store")
+		json.NewEncoder(w).Encode(map[string]uint64{"cacheHits": g.hits.Load(), "cacheMisses": g.misses.Load(), "rejected": g.rejected.Load()})
+		return
+	}
+	host := strings.ToLower(r.Host)
+	rt, ok := g.routes[host]
+	if !ok {
+		http.Error(w, "Unknown tenant host", 421)
+		return
+	}
+	if rt.store != "" && !storePath(r, rt.store) {
+		http.Error(w, "Route unavailable on this store domain", 404)
+		return
+	}
+	select {
+	case g.slots <- struct{}{}:
+		defer func() { <-g.slots }()
+	default:
+		g.rejected.Add(1)
+		w.Header().Set("Retry-After", "1")
+		http.Error(w, "Gateway capacity reached", 503)
+		return
+	}
+	if r.ContentLength > g.config.MaxBodyBytes {
+		g.rejected.Add(1)
+		http.Error(w, "Request body too large", 413)
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Minute)
+	defer cancel()
+	r = r.WithContext(ctx)
+	deadline, _ := ctx.Deadline()
+	controller := http.NewResponseController(w)
+	_ = controller.SetReadDeadline(deadline)
+	_ = controller.SetWriteDeadline(deadline)
+	defer controller.SetReadDeadline(time.Time{})
+	defer controller.SetWriteDeadline(time.Time{})
+	r.Body = http.MaxBytesReader(w, r.Body, g.config.MaxBodyBytes)
+	// Credentials and cache variants always bypass the public projection cache.
+	cacheable := r.Method == "GET" && rt.public[r.URL.Path] && r.URL.RawQuery == "" && r.Header.Get("Authorization") == "" && r.Header.Get("Cookie") == "" && r.Header.Get("Range") == "" && r.Header.Get("Origin") == "" && r.Header.Get("Cache-Control") == "" && r.Header.Get("If-None-Match") == "" && r.Header.Get("If-Modified-Since") == "" && r.ContentLength == 0
+	if !cacheable {
+		rt.proxy.ServeHTTP(w, r)
+		return
+	}
+	key := host + r.URL.EscapedPath()
+	for {
+		g.mu.Lock()
+		if value, ok := g.cache[key]; ok && time.Now().Before(value.expires) {
+			g.mu.Unlock()
+			g.hits.Add(1)
+			writeEntry(w, value)
+			return
+		}
+		if done, ok := g.pending[key]; ok {
+			g.mu.Unlock()
+			select {
+			case <-done:
+				continue
+			case <-r.Context().Done():
+				return
+			}
+		}
+		done := make(chan struct{})
+		g.pending[key] = done
+		g.mu.Unlock()
+		func() {
+			defer func() { g.mu.Lock(); delete(g.pending, key); close(done); g.mu.Unlock() }()
+			g.misses.Add(1)
+			// Request a single representation; never retain compressed variants or Vary responses.
+			clone := r.Clone(r.Context())
+			clone.Header = r.Header.Clone()
+			clone.Header.Del("Accept-Encoding")
+			capture := &captureWriter{ResponseWriter: w, limit: 64 << 10}
+			rt.proxy.ServeHTTP(capture, clone)
+			if value, ok := capture.entry(time.Duration(g.config.CacheSeconds) * time.Second); ok {
+				g.mu.Lock()
+				if len(g.cache) >= g.config.CacheEntries {
+					for k := range g.cache {
+						delete(g.cache, k)
+						break
+					}
+				}
+				g.cache[key] = value
+				g.mu.Unlock()
+			}
+		}()
+		return
+	}
+}
+func writeEntry(w http.ResponseWriter, e entry) {
+	for k, v := range e.header {
+		w.Header()[k] = append([]string(nil), v...)
+	}
+	w.Header().Set("X-Public-Cache", "hit")
+	w.WriteHeader(e.status)
+	w.Write(e.body)
+}
+
+type captureWriter struct {
+	http.ResponseWriter
+	header   http.Header
+	status   int
+	body     []byte
+	limit    int
+	overflow bool
+}
+
+func (c *captureWriter) Unwrap() http.ResponseWriter { return c.ResponseWriter }
+func (c *captureWriter) WriteHeader(status int) {
+	if status < 200 {
+		c.ResponseWriter.WriteHeader(status)
+		return
+	}
+	if c.status != 0 {
+		return
+	}
+	c.status = status
+	c.header = c.Header().Clone()
+	c.ResponseWriter.WriteHeader(status)
+}
+func (c *captureWriter) Write(p []byte) (int, error) {
+	if c.status == 0 {
+		c.WriteHeader(200)
+	}
+	if !c.overflow {
+		if len(c.body)+len(p) > c.limit {
+			c.overflow = true
+			c.body = nil
+		} else {
+			c.body = append(c.body, p...)
+		}
+	}
+	return c.ResponseWriter.Write(p)
+}
+func (c *captureWriter) entry(ttl time.Duration) (entry, bool) {
+	if c.status != 200 || c.overflow || c.header.Get("Set-Cookie") != "" || c.header.Get("Vendure-Auth-Token") != "" || !safeVary(c.header) {
+		return entry{}, false
+	}
+	public := false
+	maxAge := 0
+	for _, part := range strings.Split(strings.ToLower(strings.Join(c.header.Values("Cache-Control"), ",")), ",") {
+		part = strings.TrimSpace(part)
+		if part == "public" {
+			public = true
+		}
+		if part == "private" || part == "no-store" || part == "no-cache" {
+			return entry{}, false
+		}
+		if strings.HasPrefix(part, "max-age=") {
+			maxAge, _ = strconv.Atoi(strings.TrimPrefix(part, "max-age="))
+		}
+	}
+	if !public || maxAge < 1 {
+		return entry{}, false
+	}
+	if limit := time.Duration(maxAge) * time.Second; limit < ttl {
+		ttl = limit
+	}
+	// The local TTL is the only cache lifetime. Do not grant a fresh downstream TTL on a hit.
+	c.header.Set("Cache-Control", "no-store")
+	return entry{c.status, c.header, c.body, time.Now().Add(ttl)}, true
+}
+func Load(r io.Reader) (Config, error) {
+	var c Config
+	d := json.NewDecoder(io.LimitReader(r, 2<<20))
+	d.DisallowUnknownFields()
+	err := d.Decode(&c)
+	if err == nil {
+		var extra any
+		if d.Decode(&extra) != io.EOF {
+			err = errors.New("trailing config content")
+		}
+	}
+	return c, err
+}
+
+func safeVary(header http.Header) bool {
+	for _, value := range header.Values("Vary") {
+		for _, field := range strings.Split(value, ",") {
+			field = strings.TrimSpace(field)
+			if field != "" && !strings.EqualFold(field, "Origin") {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func validStore(s string) bool {
+	if len(s) < 1 || len(s) > 64 {
+		return false
+	}
+	for _, c := range s {
+		if !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '-' || c == '_') {
+			return false
+		}
+	}
+	return true
+}
+func storePath(r *http.Request, store string) bool {
+	path := r.URL.Path
+	if strings.Contains(path, "..") || strings.Contains(path, "\\") || r.URL.RawPath != "" {
+		return false
+	}
+	read := r.Method == "GET" || r.Method == "HEAD"
+	if read && (path == "/" || path == "/favicon.ico" || strings.HasPrefix(path, "/assets/")) {
+		return true
+	}
+	if read && path == "/api/storefront/stores" {
+		return true
+	}
+	if path == "/api/storefront/"+store+"/shop" {
+		return r.Method == "POST"
+	}
+	base := "/api/commerce/stores/" + store
+	if path == base || path == base+"/offers" {
+		return read
+	}
+	if path == base+"/account" {
+		return r.Method == "POST"
+	}
+	if path == base+"/applications" {
+		return r.Method == "GET" || r.Method == "POST"
+	}
+	return false
+}
+
+// CloseIdleConnections releases pooled origin connections after a routing reload.
+func (g *Gateway) CloseIdleConnections() { g.transport.CloseIdleConnections() }

package/multinode/gateway_test.go

@@ -0,0 +1,217 @@
+package multinode
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func fixture(t *testing.T, h http.HandlerFunc) *Gateway {
+	t.Helper()
+	up := httptest.NewServer(h)
+	t.Cleanup(up.Close)
+	g, err := New(Config{AllowHTTP: true, Tenants: []Tenant{{Host: "shop.test", Origin: up.URL, PublicPaths: []string{"/api/commerce/stores/main"}}, {Host: "other.test", Origin: up.URL, PublicPaths: []string{"/api/commerce/stores/main"}}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return g
+}
+func request(g *Gateway, host, auth string) *httptest.ResponseRecorder {
+	r := httptest.NewRequest("GET", "http://"+host+"/api/commerce/stores/main", nil)
+	if auth != "" {
+		r.Header.Set("Authorization", auth)
+	}
+	w := httptest.NewRecorder()
+	g.ServeHTTP(w, r)
+	return w
+}
+func TestPublicCollapseTenantIsolationAndPrivateBypass(t *testing.T) {
+	var calls atomic.Int32
+	g := fixture(t, func(w http.ResponseWriter, r *http.Request) {
+		calls.Add(1)
+		time.Sleep(20 * time.Millisecond)
+		if r.Header.Get("Authorization") != "" {
+			w.Header().Set("Cache-Control", "private")
+			w.Write([]byte("private"))
+			return
+		}
+		w.Header().Set("Cache-Control", "public,max-age=2")
+		w.Write([]byte("public"))
+	})
+	var wg sync.WaitGroup
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if w := request(g, "shop.test", ""); w.Body.String() != "public" {
+				t.Error(w.Body.String())
+			}
+		}()
+	}
+	wg.Wait()
+	if calls.Load() != 1 {
+		t.Fatal("no collapse", calls.Load())
+	}
+	request(g, "other.test", "")
+	if calls.Load() != 2 {
+		t.Fatal("tenant cache collision")
+	}
+	for i := 0; i < 2; i++ {
+		if w := request(g, "shop.test", "Bearer private"); w.Body.String() != "private" {
+			t.Fatal("private cache leak")
+		}
+	}
+	if calls.Load() != 4 {
+		t.Fatal("private response cached")
+	}
+	if w := request(g, "unknown.test", ""); w.Code != 421 {
+		t.Fatal(w.Code)
+	}
+}
+func TestNoMutationRetryAndEarlyBodyRejection(t *testing.T) {
+	var calls atomic.Int32
+	g := fixture(t, func(w http.ResponseWriter, r *http.Request) { calls.Add(1); w.WriteHeader(503) })
+	for i := 0; i < 2; i++ {
+		r := httptest.NewRequest("POST", "http://shop.test/api/orders", strings.NewReader("{}"))
+		w := httptest.NewRecorder()
+		g.ServeHTTP(w, r)
+		if w.Code != 503 {
+			t.Fatal(w.Code)
+		}
+	}
+	if calls.Load() != 2 {
+		t.Fatal("mutation retried")
+	}
+	r := httptest.NewRequest("POST", "http://shop.test/api/orders", strings.NewReader("x"))
+	r.ContentLength = 1 << 30
+	w := httptest.NewRecorder()
+	g.ServeHTTP(w, r)
+	if w.Code != 413 || calls.Load() != 2 {
+		t.Fatal("oversized body reached origin")
+	}
+}
+func TestCacheExpiryAndUnsafeResponseExclusion(t *testing.T) {
+	for _, header := range []string{"private", "no-store", "public, max-age=0", "public, max-age=1"} {
+		t.Run(header, func(t *testing.T) {
+			var calls atomic.Int32
+			g := fixture(t, func(w http.ResponseWriter, r *http.Request) {
+				calls.Add(1)
+				w.Header().Set("Cache-Control", header)
+				if header == "public, max-age=1" {
+					w.Header().Set("Set-Cookie", "session=secret")
+				}
+				w.Write([]byte("data"))
+			})
+			request(g, "shop.test", "")
+			request(g, "shop.test", "")
+			if calls.Load() != 2 {
+				t.Fatal("unsafe response cached")
+			}
+		})
+	}
+	var calls atomic.Int32
+	g := fixture(t, func(w http.ResponseWriter, r *http.Request) {
+		calls.Add(1)
+		w.Header().Set("Cache-Control", "public,max-age=1")
+		fmt.Fprint(w, "ok")
+	})
+	request(g, "shop.test", "")
+	g.mu.Lock()
+	for k, v := range g.cache {
+		v.expires = time.Now().Add(-time.Second)
+		g.cache[k] = v
+	}
+	g.mu.Unlock()
+	request(g, "shop.test", "")
+	if calls.Load() != 2 {
+		t.Fatal("expired cache used")
+	}
+}
+func TestChunkedLimitAndForwardedHeaders(t *testing.T) {
+	g := fixture(t, func(w http.ResponseWriter, r *http.Request) {
+		if strings.Contains(r.Header.Get("X-Forwarded-For"), "attacker") {
+			t.Error("trusted spoofed forwarding")
+		}
+		_, err := io.ReadAll(r.Body)
+		if err != nil {
+			w.WriteHeader(400)
+			return
+		}
+		w.WriteHeader(200)
+	})
+	g.config.MaxBodyBytes = 4
+	r := httptest.NewRequest("POST", "http://shop.test/api/orders", strings.NewReader("12345678"))
+	r.ContentLength = -1
+	r.Header.Set("X-Forwarded-For", "attacker")
+	w := httptest.NewRecorder()
+	g.ServeHTTP(w, r)
+	if w.Code == 200 {
+		t.Fatal("unbounded chunked body")
+	}
+}
+
+func TestPocketBaseOriginVaryAndMultipleCacheDirectives(t *testing.T) {
+	var calls atomic.Int32
+	g := fixture(t, func(w http.ResponseWriter, r *http.Request) {
+		calls.Add(1)
+		w.Header().Set("Vary", "Origin")
+		w.Header().Set("Cache-Control", "public,max-age=2")
+		w.Header().Set("Access-Control-Allow-Origin", r.Header.Get("Origin"))
+		w.Write([]byte("store"))
+	})
+	request(g, "shop.test", "")
+	request(g, "shop.test", "")
+	if calls.Load() != 1 {
+		t.Fatal("PocketBase Vary Origin prevented public cache")
+	}
+	r := httptest.NewRequest("GET", "http://shop.test/api/commerce/stores/main", nil)
+	r.Header.Set("Origin", "https://customer.test")
+	w := httptest.NewRecorder()
+	g.ServeHTTP(w, r)
+	if calls.Load() != 2 || w.Header().Get("X-Public-Cache") != "" {
+		t.Fatal("CORS response reused")
+	}
+	capture := &captureWriter{status: 200, header: http.Header{"Cache-Control": []string{"public,max-age=2", "no-store"}}}
+	if _, ok := capture.entry(time.Second); ok {
+		t.Fatal("ignored second cache directive")
+	}
+	if safeVary(http.Header{"Vary": []string{"Origin", "Authorization"}}) {
+		t.Fatal("ignored second Vary header")
+	}
+}
+
+func TestStoreBoundHostRejectsOtherStoresAndAdmin(t *testing.T) {
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Host != "team.example.com" {
+			t.Errorf("lost domain host: %s", r.Host)
+		}
+		w.WriteHeader(200)
+	}))
+	defer origin.Close()
+	g, err := New(Config{AllowHTTP: true, Tenants: []Tenant{{Host: "team.example.com", Store: "team-one", Origin: origin.URL}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{"/_/", "/commerce/", "/api/collections/commerce_stores/records", "/api/storefront/team-two/shop", "/api/commerce/stores/team-two/account"} {
+		r := httptest.NewRequest("GET", "https://team.example.com"+path, nil)
+		w := httptest.NewRecorder()
+		g.ServeHTTP(w, r)
+		if w.Code != 404 {
+			t.Fatal(path, w.Code)
+		}
+	}
+	for _, path := range []string{"/", "/api/storefront/stores", "/api/commerce/stores/team-one"} {
+		r := httptest.NewRequest("GET", "https://team.example.com"+path, nil)
+		w := httptest.NewRecorder()
+		g.ServeHTTP(w, r)
+		if w.Code != 200 {
+			t.Fatal(path, w.Code)
+		}
+	}
+}

package/multinode/security_regression_test.go

@@ -0,0 +1,106 @@
+package multinode
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestGatewayStripsPrivateOperatorIdentity(t *testing.T) {
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Spink-Operator") != "" || r.Header.Get("X-Real-IP") != "" {
+			t.Error("private identity crossed public gateway")
+		}
+		if r.Header.Get("X-Forwarded-For") != "192.0.2.10" {
+			t.Error("connection identity lost")
+		}
+	}))
+	defer origin.Close()
+	g, err := New(Config{AllowHTTP: true, Tenants: []Tenant{{Host: "tenant.example", Origin: origin.URL}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer g.CloseIdleConnections()
+	req := httptest.NewRequest("GET", "http://tenant.example/api/health", nil)
+	req.RemoteAddr = "192.0.2.10:1234"
+	req.Header.Set("X-Spink-Operator", "1")
+	req.Header.Set("X-Real-IP", "127.0.0.1")
+	req.Header.Set("X-Forwarded-For", "127.0.0.1")
+	g.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+type deadlineWriter struct {
+	*httptest.ResponseRecorder
+	reads, writes []time.Time
+}
+
+func (w *deadlineWriter) SetReadDeadline(d time.Time) error { w.reads = append(w.reads, d); return nil }
+func (w *deadlineWriter) SetWriteDeadline(d time.Time) error {
+	w.writes = append(w.writes, d)
+	return nil
+}
+func TestGatewaySetsSocketDeadlinesForAdmittedRequests(t *testing.T) {
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("ok")) }))
+	defer origin.Close()
+	g, err := New(Config{AllowHTTP: true, Tenants: []Tenant{{Host: "tenant.example", Origin: origin.URL}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer g.CloseIdleConnections()
+	deadline := time.Now().Add(time.Second)
+	ctx, cancel := context.WithDeadline(context.Background(), deadline)
+	defer cancel()
+	req := httptest.NewRequest("GET", "http://tenant.example/", nil).WithContext(ctx)
+	w := &deadlineWriter{ResponseRecorder: httptest.NewRecorder()}
+	g.ServeHTTP(w, req)
+	for _, values := range [][]time.Time{w.reads, w.writes} {
+		if len(values) != 2 || !values[0].Equal(deadline) || !values[1].IsZero() {
+			t.Fatalf("socket deadline not set/reset: %v", values)
+		}
+	}
+}
+
+func TestSlowReaderReleasesAdmissionSlot(t *testing.T) {
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		block := make([]byte, 64<<10)
+		for i := 0; i < 2048; i++ {
+			if _, err := w.Write(block); err != nil {
+				return
+			}
+		}
+	}))
+	defer origin.Close()
+	g, err := New(Config{AllowHTTP: true, MaxConcurrent: 1, Tenants: []Tenant{{Host: "tenant.example", Origin: origin.URL}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer g.CloseIdleConnections()
+	done := make(chan struct{})
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer close(done)
+		ctx, cancel := context.WithTimeout(r.Context(), 150*time.Millisecond)
+		defer cancel()
+		g.ServeHTTP(w, r.WithContext(ctx))
+	}))
+	defer server.Close()
+	conn, err := net.Dial("tcp", server.Listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	if _, err = io.WriteString(conn, "GET / HTTP/1.1\r\nHost: tenant.example\r\n\r\n"); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-done:
+		if len(g.slots) != 0 {
+			t.Fatal("admission slot leaked")
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("non-reading client held admission past request deadline")
+	}
+}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@x47base/pocketbase-addon",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "scripts": {
-    "test": "node --test security/ui/*.test.mjs",
-    "check": "./scripts/check.sh"
+    "test": "node --test security/ui/*.test.mjs bin/*.test.mjs",
+    "check": "sh scripts/check.sh"
   },
   "files": [
     "*.go",
@@ -35,12 +35,17 @@
     "edge",
     "Dockerfile",
     ".dockerignore",
-    "deploy"
+    "deploy",
+    "hosting",
+    "multinode",
+    "SECURITY-REVIEW.md",
+    "VERIFY.md"
   ],
   "license": "MIT",
-  "description": "PocketBase add-on: security dashboard, encrypted backups and development extensions",
+  "description": "PocketBase extensions with security controls, encrypted backups, hosting policies and single-owner multinode routing",
   "bin": {
-    "pocketbase-extension": "bin/pocketbase-extension.mjs"
+    "pocketbase-extension": "bin/pocketbase-extension.mjs",
+    "pocketbase-addon": "bin/pocketbase-extension.mjs"
   },
   "engines": {
     "node": ">=22"