@zerotal/core 1.15.1 → 1.15.3

package/CHANGELOG.md

@@ -8,6 +8,28 @@ follows the Zerotal monorepo's unified versioning.
 
 ## [Unreleased]
 
+## [1.15.2] — 2026-10-23
+
+### Fixed
+
+- **A production build ships React's production build.** `browserEnvDefines()` defined
+  `import.meta.env` but not `process.env.NODE_ENV`, which is the switch React and most of
+  npm read — and Bun.build leaves that expression to whatever the shell has. An app that ran
+  `inertia:build --production` without `NODE_ENV` in its environment shipped React's
+  development build: a 522 KB vendor chunk where 322 KB would do, the DevTools notice in
+  every visitor's console, and full hydration diffs. The define now states it from the same
+  flag. Found on a live consumer app (Trekly).
+
+- **`back()` works behind a proxy that terminates TLS.** `safeRedirectPath` — which
+  `ctx.back()`, `validate()`'s redirect on failure, `FormRequest`, the intended-URL helpers
+  and flow all use — accepted a Referer only from the request's own origin. Behind Caddy or
+  nginx the request reaches the process as `http://…` while every browser sends
+  `https://…`, so every Referer was refused and "back" was always `/`: a form with one
+  mistake in it sent the user to the home page, its errors flashed to a page that never
+  shows them. The configured `app.url`'s origin now counts as the app's own as well; every
+  other site is still refused. Found on a live consumer app (Trekly), which had worked
+  round it in its exception handler.
+
 ## [1.15.1] — 2026-09-13
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/core",
-  "version": "1.15.1",
+  "version": "1.15.3",
   "license": "MIT",
   "maturity": "stable",
   "private": false,

package/src/dev/buildEnv.ts

@@ -37,5 +37,13 @@ export function browserEnvDefines(isProduction: boolean): Record<string, string>
       PROD: isProduction,
       MODE: isProduction ? "production" : "development",
     }),
+    // The other half of the convention, and the one that costs the most to miss.
+    // React and most of npm choose their production build with
+    // `process.env.NODE_ENV === "production"`, and Bun.build leaves the expression
+    // to the environment it runs in. A deploy that ran `inertia:build --production`
+    // without NODE_ENV set shipped React's development build — a 522 KB vendor
+    // chunk where 322 KB would do, the DevTools notice in every visitor's console,
+    // and full hydration diffs to anyone who looked. Stated here, the flag decides.
+    "process.env.NODE_ENV": JSON.stringify(isProduction ? "production" : "development"),
   };
 }

package/src/pipeline/HttpContext.ts

@@ -14,6 +14,7 @@ import {
   DEFAULT_MD_OPTIONS,
   type BunMarkdownOptions,
 } from "../helpers/markdown.ts";
+import { config } from "../helpers/config.ts";
 import type { SessionContract, TransactionContext } from "../contracts/index.ts";
 import type { ContextRegistry, ContextKey } from "./ContextRegistry.ts";
 
@@ -868,14 +869,24 @@ const _prototypeMethods: ReadonlyArray<[string, (...args: unknown[]) => unknown]
 })();
 
 /**
- * Return `url` only when it belongs to the same `origin`, otherwise `undefined`.
+ * Return `url` only when it belongs to the app, otherwise `undefined`.
  * Guards `ctx.back()` and similar helpers against open-redirect attacks by
  * rejecting absent, malformed, or cross-origin URLs.
  *
+ * "Belongs to the app" is the request's own `origin` **or the configured
+ * `app.url`'s**. The second matters behind a reverse proxy that terminates TLS:
+ * the request reaches the process as `http://…`, while every browser sends its
+ * `Referer` as `https://…`, so a same-origin check alone refused every one of
+ * them and `back()` — and `validate()`'s redirect on failure — fell back to "/"
+ * on every request in production. A form with one mistake in it sent the user
+ * to the home page, its errors flashed to a page that never shows them. The
+ * configured URL is the app's own address by definition, so accepting it opens
+ * nothing to anyone else.
+ *
  * @param url - Candidate redirect target (e.g. a `Referer` header value).
  * @param origin - The current request origin to match against.
- * @returns The same-origin `url`, or `undefined` when it is absent, unparseable,
- * or points to a different origin.
+ * @returns The `url`, or `undefined` when it is absent, unparseable, or points
+ * anywhere but this app.
  *
  * @internal
  */
@@ -885,7 +896,20 @@ export function safeRedirectPath(
 ): string | undefined {
   if (!url) return undefined;
   try {
-    return new URL(url).origin === origin ? url : undefined;
+    const target = new URL(url).origin;
+    if (target === origin) return url;
+    return target === configuredOrigin() ? url : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** The configured `app.url`'s origin, or `undefined` off-app or when it is unset or malformed. */
+function configuredOrigin(): string | undefined {
+  const base = config.safe("app.url", "") as string;
+  if (!base) return undefined;
+  try {
+    return new URL(base).origin;
   } catch {
     return undefined;
   }