akanjs 3.0.0-alpha.93 → 3.0.0-alpha.95

package/common/index.ts

@@ -82,7 +82,7 @@ export { pathSet } from "./pathSet";
 export { plainFieldsOf } from "./plainFieldsOf";
 export { randomPick } from "./randomPick";
 export { randomPicks } from "./randomPicks";
-export { isJsonContentType, originFromRequest } from "./requestOrigin";
+export { hostFromRequest, isJsonContentType, originFromRequest } from "./requestOrigin";
 export { RestClient, type RestClientOptions, type RestRequestOptions } from "./restClient";
 export {
   assertUniqueRoutePatterns,

package/common/requestOrigin.ts

@@ -5,8 +5,7 @@
 export const originFromRequest = (headers: Headers, url: URL): string => {
   
   const forwardedProto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
-  const forwardedHost = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
-  const host = forwardedHost ?? headers.get("host")?.split(",")[0]?.trim();
+  const host = hostFromRequest(headers, url);
   const proto = forwardedProto ?? url.protocol.slice(0, -1);
   if (host && proto) {
     try {
@@ -17,6 +16,14 @@ export const originFromRequest = (headers: Headers, url: URL): string => {
   return url.origin;
 };
 
+/**
+ * The host a caller addressed, which — unlike the scheme — every proxy that rewrites the request still reports.
+ * `Host` is set by the browser from the URL it was told to open, so it names *this* deployment even for a
+ * request some other page initiated.
+ */
+export const hostFromRequest = (headers: Headers, url: URL): string =>
+  headers.get("x-forwarded-host")?.split(",")[0]?.trim() ?? headers.get("host")?.split(",")[0]?.trim() ?? url.host;
+
 /**
  * Whether a request body may be read as JSON.
  *

package/constant/getDefault.ts

@@ -39,6 +39,10 @@ const buildPlan = (fieldObj: FieldObject): DefaultPlan => {
     if (field.fieldType === "hidden" || field.fieldType === "secret") shared[key] = null;
     else if (field.default !== undefined && field.default !== null) {
       if (typeof field.default === "function") perCall.set(key, field.default as () => unknown);
+      else if (Array.isArray(field.default)) {
+        const items = field.default as unknown[];
+        perCall.set(key, () => [...items]);
+      }
       else shared[key] = field.default as object;
     } else if (field.isArray) perCall.set(key, () => []);
     else if (field.nullable) shared[key] = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.0.0-alpha.93",
+  "version": "3.0.0-alpha.95",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {

package/service/predefinedAdaptor/sql/SqlDocumentStore.ts

@@ -44,6 +44,8 @@ import {
 import { UpdateCompiler } from "./UpdateCompiler";
 import { decodeDateValue, encodeSqlValue, jsonStr } from "./values";
 
+const freshDefault = (value: unknown) => (Array.isArray(value) ? [...(value as unknown[])] : value);
+
 export class SqlDocumentStore {
   readonly schema: DocumentSchema;
   readonly table: string;
@@ -331,7 +333,10 @@ export class SqlDocumentStore {
       const value = data[key];
       if (value === undefined) {
         if (props.default !== undefined && props.default !== null) {
-          doc[key] = typeof props.default === "function" ? props.default(data) : props.default;
+          doc[key] = freshDefault(typeof props.default === "function" ? props.default(data) : props.default);
+        } else if (props.isClass && props.isScalar && !props.nullable) {
+
+          doc[key] = getDefault((props.modelRef as { [FIELD_META]: FieldMap })[FIELD_META] as never);
         } else if (!props.nullable && !["removedAt"].includes(key)) {
           if (["id", "createdAt", "updatedAt"].includes(key)) continue;
           throw new Error(`Missing required field: ${key}`);
@@ -597,9 +602,12 @@ export class SqlDocumentStore {
       if (value === undefined) {
         const def = props.default;
         if (def != null) {
-          result[key] = typeof def === "function" ? (def as (data: unknown) => unknown)(payload) : def;
+          result[key] = freshDefault(typeof def === "function" ? (def as (data: unknown) => unknown)(payload) : def);
         } else if (props.nullable) {
           result[key] = null;
+        } else if (props.isClass && props.isScalar) {
+
+          result[key] = getDefault((props.modelRef as { [FIELD_META]: FieldMap })[FIELD_META] as never);
         } else {
           result[key] =
             ((props as Record<string, unknown>).modelRef as { [DEFAULT_VALUE]?: unknown })?.[DEFAULT_VALUE] ?? null;

package/signal/CrossSiteGuard.ts

@@ -1,4 +1,4 @@
-import { isJsonContentType, Logger, originFromRequest } from "akanjs/common";
+import { hostFromRequest, isJsonContentType, Logger } from "akanjs/common";
 import { Exception } from "./exception";
 
 export interface CrossSiteOption {
@@ -62,10 +62,32 @@ export class CrossSiteGuard {
     if (!CrossSiteGuard.#enabled) return;
     const origin = req.headers.get("origin");
     if (origin === null) return;
-    if (origin !== "null" && (origin === originFromRequest(req.headers, url) || CrossSiteGuard.#allowed.has(origin)))
+    if (origin !== "null" && (CrossSiteGuard.#isSameSite(origin, req, url) || CrossSiteGuard.#allowed.has(origin)))
       return;
 
-    CrossSiteGuard.logger.warn(`Refused "${key}" from cross-site origin ${origin}`);
+    CrossSiteGuard.logger.warn(
+      `Refused "${key}" from cross-site origin ${origin} (request host ${hostFromRequest(req.headers, url)})`,
+    );
     throw new Exception.Forbidden("This request was not permitted.");
   }
+
+  /**
+   * Host, not full origin — the same comparison `McpRouter` makes, for the same reason.
+   *
+   * The host is what the browser wrote from the URL it was told to open, so a page on another site POSTing here
+   * still arrives with *our* host and its own `Origin`: comparing hosts refuses every cross-site caller. The
+   * scheme is the one part of the origin a proxy routinely loses — a TLS-terminating edge (a Cloudflare tunnel,
+   * an ingress without `x-forwarded-proto`) dials us over plain HTTP, so an `https://` caller would be measured
+   * against a computed `http://` self and refused on every mutation. What that costs is a page served over
+   * plaintext on our own host, which is an attacker who already holds the name.
+   */
+  static #isSameSite(origin: string, req: Request, url: URL): boolean {
+    try {
+      const { protocol, host } = new URL(origin);
+
+      return host === new URL(`${protocol}//${hostFromRequest(req.headers, url)}`).host;
+    } catch {
+      return false;
+    }
+  }
 }

package/types/common/index.d.ts

@@ -31,7 +31,7 @@ export { pathSet } from "./pathSet.d.ts";
 export { plainFieldsOf } from "./plainFieldsOf.d.ts";
 export { randomPick } from "./randomPick.d.ts";
 export { randomPicks } from "./randomPicks.d.ts";
-export { isJsonContentType, originFromRequest } from "./requestOrigin.d.ts";
+export { hostFromRequest, isJsonContentType, originFromRequest } from "./requestOrigin.d.ts";
 export { RestClient, type RestClientOptions, type RestRequestOptions } from "./restClient.d.ts";
 export { assertUniqueRoutePatterns, compareRouteSpecificity, getPageSourceFileViolation, getRouteExports, isRouteSourceFile, isSpecialRouteLeaf, LAYOUT_ROUTE_EXPORTS, matchRoutePattern, normalizeRoutePattern, PAGE_ROUTE_EXPORTS, type ParsedRouteModuleKey, parseRouteModuleKey, RESERVED_ROUTE_CONFIG_EXPORTS, ROOT_LAYOUT_ROUTE_EXPORTS, type RouteModuleKind, routeSegmentToPatternPart, routeSegmentToTreePath, tryParseRouteModuleKey, type ValidatePageSourceFileOptions, type ValidateSubRoutePageKeyOptions, validatePageSourceFile, validateSubRoutePageKey, } from "./routeConvention.d.ts";
 export { sleep } from "./sleep.d.ts";

package/types/common/requestOrigin.d.ts

@@ -3,6 +3,12 @@
  * they answer the same way for the cache layer, the CSRF gate, and anything else that has to compare origins.
  */
 export declare const originFromRequest: (headers: Headers, url: URL) => string;
+/**
+ * The host a caller addressed, which — unlike the scheme — every proxy that rewrites the request still reports.
+ * `Host` is set by the browser from the URL it was told to open, so it names *this* deployment even for a
+ * request some other page initiated.
+ */
+export declare const hostFromRequest: (headers: Headers, url: URL) => string;
 /**
  * Whether a request body may be read as JSON.
  *