cabloy 5.1.136 → 5.1.138

package/vona/src/suite-vendor/a-vona/modules/a-security/test/origin.test.ts

@@ -0,0 +1,178 @@
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+import { app } from 'vona-mock';
+
+describe('origin.test.ts', { concurrency: false }, () => {
+  it('keeps normal CORS separate from exact credential-link authorization', async () => {
+    await withWhiteList('*', async () => {
+      assert.equal(
+        app.bean.security.checkOrigin('https://untrusted.example.test', 'api.example.test'),
+        'https://untrusted.example.test',
+      );
+      assert.equal(
+        app.bean.security.checkOriginExact('https://untrusted.example.test', 'api.example.test'),
+        '',
+      );
+      assert.equal(app.bean.security.checkOrigin(undefined, 'api.example.test'), 'null');
+      assert.equal(app.bean.security.checkOriginExact(undefined, 'api.example.test'), '');
+      const sameOrigin = `${app.ctx.protocol}://api.example.test`;
+      assert.equal(
+        app.bean.security.checkOriginExact(sameOrigin, 'api.example.test'),
+        new URL(sameOrigin).origin,
+      );
+    });
+  });
+
+  it('allows loopback origins across development ports while default CORS remains closed', async () => {
+    await withWhiteList([], async () => {
+      for (const [origin, host] of [
+        ['http://localhost:9000', 'localhost:7102'],
+        ['http://127.0.0.1:9000', 'localhost:7102'],
+        ['http://[::1]:9000', '127.0.0.1:7102'],
+      ]) {
+        assert.equal(app.bean.security.checkOrigin(origin, host), new URL(origin).origin);
+      }
+      assert.equal(
+        app.bean.security.checkOrigin('http://localhost.evil.test:9000', 'localhost:7102'),
+        '',
+      );
+      assert.equal(app.bean.security.checkOrigin('http://127.0.0.2:9000', 'localhost:7102'), '');
+      assert.equal(
+        app.bean.security.checkOrigin('https://untrusted.example.test', 'api.example.test'),
+        '',
+      );
+    });
+  });
+
+  it('accepts normalized explicit HTTP(S) origins only', async () => {
+    await withWhiteList(['http://localhost:9000', 'https://App.Example.Test:443/'], async () => {
+      assert.equal(
+        app.bean.security.checkOriginExact('http://localhost:9000'),
+        'http://localhost:9000',
+      );
+      assert.equal(
+        app.bean.security.checkOriginExact('https://app.example.test'),
+        'https://app.example.test',
+      );
+      assert.equal(app.bean.security.checkOriginExact('https://app.example.test:444'), '');
+      assert.equal(app.bean.security.checkOriginExact('https://other.example.test'), '');
+    });
+  });
+
+  it('supports exact same-origin authorization alongside whitelist and loopback policies', async () => {
+    await withWhiteList([], async () => {
+      const sameOrigin = `${app.ctx.protocol}://app.example.test`;
+      assert.equal(
+        app.bean.security.checkOriginExact(sameOrigin, 'app.example.test'),
+        new URL(sameOrigin).origin,
+      );
+      assert.equal(
+        app.bean.security.checkOriginExact(
+          `${app.ctx.protocol}://APP.EXAMPLE.TEST`,
+          'app.example.test',
+        ),
+        new URL(sameOrigin).origin,
+      );
+      const defaultPort = app.ctx.protocol === 'https' ? 443 : 80;
+      assert.equal(
+        app.bean.security.checkOriginExact(sameOrigin, `app.example.test:${defaultPort}`),
+        new URL(sameOrigin).origin,
+      );
+      assert.equal(
+        app.bean.security.checkOriginExact(
+          app.ctx.protocol === 'https' ? 'http://app.example.test' : 'https://app.example.test',
+          'app.example.test',
+        ),
+        '',
+      );
+      assert.equal(
+        app.bean.security.checkOriginExact(
+          `${app.ctx.protocol}://app.example.test:444`,
+          'app.example.test',
+        ),
+        '',
+      );
+      assert.equal(
+        app.bean.security.checkOriginExact(
+          `${app.ctx.protocol}://app.example.test.evil.test`,
+          'app.example.test',
+        ),
+        '',
+      );
+      assert.equal(app.bean.security.checkOriginExact(sameOrigin, undefined), '');
+      assert.equal(app.bean.security.checkOriginExact(sameOrigin, 'app.example.test/path'), '');
+
+      for (const origin of [
+        'http://localhost:9000',
+        'http://127.0.0.1:9000',
+        'http://[::1]:9000',
+      ]) {
+        for (const host of ['localhost:7102', '127.0.0.1:7102', '[::1]:7102']) {
+          assert.equal(app.bean.security.checkOriginExact(origin, host), new URL(origin).origin);
+        }
+      }
+      assert.equal(
+        app.bean.security.checkOriginExact('http://localhost:9000', 'localhost.evil.test:7102'),
+        '',
+      );
+      assert.equal(
+        app.bean.security.checkOriginExact('http://localhost:9000', '192.168.1.10:7102'),
+        '',
+      );
+    });
+
+    await withWhiteList(['https://app.example.test'], async () => {
+      assert.equal(
+        app.bean.security.checkOriginExact('https://app.example.test'),
+        'https://app.example.test',
+      );
+    });
+  });
+
+  it('rejects wildcard, suffix, and non-origin whitelist entries in credential-link mode', async () => {
+    for (const whiteList of [
+      ['*.example.test'],
+      ['.example.test'],
+      ['example.test'],
+      ['https://app.example.test/account'],
+      ['https://app.example.test?source=config'],
+      ['https://user@app.example.test'],
+    ]) {
+      await withWhiteList(whiteList, async () => {
+        assert.equal(app.bean.security.checkOriginExact('https://app.example.test'), '');
+      });
+    }
+  });
+
+  it('rejects non-origin caller values in credential-link mode', async () => {
+    await withWhiteList(['https://app.example.test'], async () => {
+      for (const origin of [
+        undefined,
+        null,
+        'null',
+        'https://user@app.example.test',
+        'https://app.example.test/path',
+        'https://app.example.test?query=value',
+        'https://app.example.test#fragment',
+        'javascript:alert(1)',
+        'file:///account/password-reset',
+      ]) {
+        assert.equal(app.bean.security.checkOriginExact(origin), '');
+      }
+    });
+  });
+});
+
+async function withWhiteList(whiteList: string | string[], fn: () => Promise<void>) {
+  await app.bean.executor.mockCtx(async () => {
+    const options =
+      app.bean.onion.middlewareSystem.getOnionSlice('a-security:cors').beanOptions.options;
+    const whiteListPrevious = options.whiteList;
+    options.whiteList = Array.isArray(whiteList) ? [...whiteList] : whiteList;
+    try {
+      await fn();
+    } finally {
+      options.whiteList = whiteListPrevious;
+    }
+  });
+}

package/vona/src/suite-vendor/a-vona/modules/a-serialization/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-serialization",
-  "version": "5.1.12",
+  "version": "5.1.13",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-serialization/src/.metadata/index.ts

@@ -4,15 +4,15 @@ export * from '../bean/interceptor.serializer.ts';
 import type { IInterceptorOptionsSerializer } from '../bean/interceptor.serializer.ts';
 import 'vona-module-a-aspect';
 declare module 'vona-module-a-aspect' {
-  
-  
+
+
 export interface IInterceptorRecordLocal {
   'a-serialization:serializer': IInterceptorOptionsSerializer;
 }
 
 }
 declare module 'vona-module-a-serialization' {
-  
+
         export interface InterceptorSerializer {
           /** @internal */
           get scope(): ScopeModuleASerialization;
@@ -22,7 +22,7 @@ declare module 'vona-module-a-serialization' {
             get $beanFullName(): 'a-serialization.interceptor.serializer';
             get $onionName(): 'a-serialization:serializer';
             get $onionOptions(): IInterceptorOptionsSerializer;
-          } 
+          }
 }
 /** interceptor: end */
 /** bean: begin */
@@ -30,15 +30,15 @@ export * from '../bean/bean.serializer.ts';
 
 import 'vona';
 declare module 'vona' {
-  
-  
+
+
 }
 declare module 'vona-module-a-serialization' {
-  
+
         export interface BeanSerializer {
           /** @internal */
           get scope(): ScopeModuleASerialization;
-        } 
+        }
 }
 /** bean: end */
 /** bean: begin */
@@ -61,7 +61,7 @@ import type { ISerializerTransformOptionsGetter } from '../bean/serializerTransf
 import type { ISerializerTransformOptionsReplace } from '../bean/serializerTransform.replace.ts';
 import 'vona-module-a-serialization';
 declare module 'vona-module-a-serialization' {
-  
+
     export interface ISerializerTransformRecord {
       'a-serialization:custom': ISerializerTransformOptionsCustom;
 'a-serialization:exclude': ISerializerTransformOptionsExclude;
@@ -69,10 +69,10 @@ declare module 'vona-module-a-serialization' {
 'a-serialization:replace': ISerializerTransformOptionsReplace;
     }
 
-  
+
 }
 declare module 'vona-module-a-serialization' {
-  
+
         export interface SerializerTransformCustom {
           /** @internal */
           get scope(): ScopeModuleASerialization;
@@ -115,7 +115,7 @@ declare module 'vona-module-a-serialization' {
             get $beanFullName(): 'a-serialization.serializerTransform.replace';
             get $onionName(): 'a-serialization:replace';
             get $onionOptions(): ISerializerTransformOptionsReplace;
-          } 
+          }
 }
 /** serializerTransform: end */
 /** scope: begin */
@@ -138,11 +138,11 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     serialization: ScopeModuleASerialization;
   }
-  
-  
 
-  
 
-  
+
+
+
+
 }
 /** scope: end */

package/vona/src/suite-vendor/a-vona/modules/a-startup/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-startup",
-  "version": "5.1.15",
+  "version": "5.1.16",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-startup/src/.metadata/index.ts

@@ -4,15 +4,15 @@ export * from '../service/startup.ts';
 
 import 'vona-module-a-bean';
 declare module 'vona-module-a-bean' {
-  
+
     export interface IServiceRecord {
       'a-startup:startup': never;
     }
 
-  
+
 }
 declare module 'vona-module-a-startup' {
-  
+
         export interface ServiceStartup {
           /** @internal */
           get scope(): ScopeModuleAStartup;
@@ -21,8 +21,7 @@ declare module 'vona-module-a-startup' {
           export interface ServiceStartup {
             get $beanFullName(): 'a-startup.service.startup';
             get $onionName(): 'a-startup:startup';
-            
-          } 
+          }
 }
 /** service: end */
 /** service: begin */
@@ -45,15 +44,15 @@ export * from '../bean/cacheRedis.startupDebounce.ts';
 
 import { type IDecoratorCacheRedisOptions } from 'vona-module-a-cache';
 declare module 'vona-module-a-cache' {
-  
+
     export interface ICacheRedisRecord {
       'a-startup:startupDebounce': IDecoratorCacheRedisOptions;
     }
 
-  
+
 }
 declare module 'vona-module-a-startup' {
-  
+
         export interface CacheRedisStartupDebounce {
           /** @internal */
           get scope(): ScopeModuleAStartup;
@@ -63,7 +62,7 @@ declare module 'vona-module-a-startup' {
             get $beanFullName(): 'a-startup.cacheRedis.startupDebounce';
             get $onionName(): 'a-startup:startupDebounce';
             get $onionOptions(): IDecoratorCacheRedisOptions;
-          } 
+          }
 }
 /** cacheRedis: end */
 /** cacheRedis: begin */
@@ -77,15 +76,15 @@ export * from '../bean/hmr.startup.ts';
 
 import 'vona';
 declare module 'vona' {
-  
+
     export interface IHmrRecord {
       'a-startup:startup': never;
     }
 
-  
+
 }
 declare module 'vona-module-a-startup' {
-  
+
         export interface HmrStartup {
           /** @internal */
           get scope(): ScopeModuleAStartup;
@@ -94,8 +93,7 @@ declare module 'vona-module-a-startup' {
           export interface HmrStartup {
             get $beanFullName(): 'a-startup.hmr.startup';
             get $onionName(): 'a-startup:startup';
-            
-          } 
+          }
 }
 /** hmr: end */
 /** meta: begin */
@@ -103,15 +101,15 @@ export * from '../bean/meta.redlock.ts';
 
 import 'vona-module-a-meta';
 declare module 'vona-module-a-meta' {
-  
+
     export interface IMetaRecord {
       'a-startup:redlock': never;
     }
 
-  
+
 }
 declare module 'vona-module-a-startup' {
-  
+
         export interface MetaRedlock {
           /** @internal */
           get scope(): ScopeModuleAStartup;
@@ -120,8 +118,7 @@ declare module 'vona-module-a-startup' {
           export interface MetaRedlock {
             get $beanFullName(): 'a-startup.meta.redlock';
             get $onionName(): 'a-startup:redlock';
-            
-          } 
+          }
 }
 /** meta: end */
 /** meta redlock: begin */
@@ -158,13 +155,13 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     startup: ScopeModuleAStartup;
   }
-  
+
   export interface IBeanScopeConfig {
     'a-startup': ReturnType<typeof config>;
   }
 
-  
 
-  
+
+
 }
 /** scope: end */

package/vona/src/suite-vendor/a-vona/modules/a-static/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-static",
-  "version": "5.1.14",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-static/src/.metadata/index.ts

@@ -4,15 +4,15 @@ export * from '../bean/middlewareSystem.static.ts';
 import type { IMiddlewareSystemOptionsStatic } from '../bean/middlewareSystem.static.ts';
 import 'vona-module-a-aspect';
 declare module 'vona-module-a-aspect' {
-  
+
     export interface IMiddlewareSystemRecord {
       'a-static:static': IMiddlewareSystemOptionsStatic;
     }
 
-  
+
 }
 declare module 'vona-module-a-static' {
-  
+
         export interface MiddlewareSystemStatic {
           /** @internal */
           get scope(): ScopeModuleAStatic;
@@ -22,7 +22,7 @@ declare module 'vona-module-a-static' {
             get $beanFullName(): 'a-static.middlewareSystem.static';
             get $onionName(): 'a-static:static';
             get $onionOptions(): IMiddlewareSystemOptionsStatic;
-          } 
+          }
 }
 /** middlewareSystem: end */
 /** event: begin */
@@ -30,11 +30,11 @@ export * from '../bean/event.resolvePath.ts';
 
 import 'vona';
 declare module 'vona' {
-  
-  
+
+
 }
 declare module 'vona-module-a-static' {
-  
+
         export interface EventResolvePath {
           /** @internal */
           get scope(): ScopeModuleAStatic;
@@ -43,8 +43,7 @@ declare module 'vona-module-a-static' {
           export interface EventResolvePath {
             get $beanFullName(): 'a-static.event.resolvePath';
             get $onionName(): 'a-static:resolvePath';
-            
-          } 
+          }
 }
 /** event: end */
 /** event: begin */
@@ -55,7 +54,7 @@ export interface IModuleEvent {
 /** event: end */
 /** event: begin */
 import type { TypeEventResolvePathData, TypeEventResolvePathResult } from '../bean/event.resolvePath.ts';
-import type { EventOn } from 'vona-module-a-event'; 
+import type { EventOn } from 'vona-module-a-event';
 declare module 'vona-module-a-event' {
   export interface IEventRecord {
     'a-static:resolvePath': EventOn<TypeEventResolvePathData, TypeEventResolvePathResult>;
@@ -83,11 +82,11 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     static: ScopeModuleAStatic;
   }
-  
-  
 
-  
 
-  
+
+
+
+
 }
 /** scope: end */

package/vona/src/suite-vendor/a-vona/modules/a-summer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-summer",
-  "version": "5.1.14",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Layered Cache",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-summer/src/.metadata/index.ts

@@ -4,15 +4,15 @@ export * from '../bean/bean.summer.ts';
 
 import 'vona';
 declare module 'vona' {
-  
-  
+
+
 }
 declare module 'vona-module-a-summer' {
-  
+
         export interface BeanSummer {
           /** @internal */
           get scope(): ScopeModuleASummer;
-        } 
+        }
 }
 /** bean: end */
 /** bean: begin */
@@ -32,11 +32,11 @@ export * from '../service/summerCacheBase_.ts';
 
 import 'vona-module-a-bean';
 declare module 'vona-module-a-bean' {
-  
-  
+
+
 }
 declare module 'vona-module-a-summer' {
-   
+
 }
 /** service: end */
 /** config: begin */
@@ -64,13 +64,13 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     summer: ScopeModuleASummer;
   }
-  
+
   export interface IBeanScopeConfig {
     'a-summer': ReturnType<typeof config>;
   }
 
-  
 
-  
+
+
 }
 /** scope: end */

package/vona/src/suite-vendor/a-vona/modules/a-swagger/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-swagger",
-  "version": "5.1.12",
+  "version": "5.1.13",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-swagger/src/.metadata/index.ts

@@ -5,15 +5,15 @@ export * from '../bean/meta.printTip.ts';
 
 import 'vona-module-a-meta';
 declare module 'vona-module-a-meta' {
-  
+
     export interface IMetaRecord {
       'a-swagger:printTip': never;
     }
 
-  
+
 }
 declare module 'vona-module-a-swagger' {
-  
+
         export interface MetaPrintTip {
           /** @internal */
           get scope(): ScopeModuleASwagger;
@@ -22,8 +22,7 @@ declare module 'vona-module-a-swagger' {
           export interface MetaPrintTip {
             get $beanFullName(): 'a-swagger.meta.printTip';
             get $onionName(): 'a-swagger:printTip';
-            
-          } 
+          }
 }
 /** meta: end */
 /** summerCache: begin */
@@ -32,16 +31,16 @@ export * from '../bean/summerCache.swagger.ts';
 
 import { type IDecoratorSummerCacheOptions } from 'vona-module-a-summer';
 declare module 'vona-module-a-summer' {
-  
+
     export interface ISummerCacheRecord {
       'a-swagger:rapidoc': IDecoratorSummerCacheOptions;
 'a-swagger:swagger': IDecoratorSummerCacheOptions;
     }
 
-  
+
 }
 declare module 'vona-module-a-swagger' {
-  
+
         export interface SummerCacheRapidoc {
           /** @internal */
           get scope(): ScopeModuleASwagger;
@@ -62,7 +61,7 @@ declare module 'vona-module-a-swagger' {
             get $beanFullName(): 'a-swagger.summerCache.swagger';
             get $onionName(): 'a-swagger:swagger';
             get $onionOptions(): IDecoratorSummerCacheOptions;
-          } 
+          }
 }
 /** summerCache: end */
 /** summerCache: begin */
@@ -80,16 +79,16 @@ import type { IControllerOptionsRapidoc } from '../controller/rapidoc.ts';
 import type { IControllerOptionsSwagger } from '../controller/swagger.ts';
 import 'vona-module-a-web';
 declare module 'vona-module-a-web' {
-  
+
     export interface IControllerRecord {
       'a-swagger:rapidoc': IControllerOptionsRapidoc;
 'a-swagger:swagger': IControllerOptionsSwagger;
     }
 
-  
+
 }
 declare module 'vona-module-a-swagger' {
-  
+
         export interface ControllerRapidoc {
           /** @internal */
           get scope(): ScopeModuleASwagger;
@@ -110,7 +109,7 @@ declare module 'vona-module-a-swagger' {
             get $beanFullName(): 'a-swagger.controller.swagger';
             get $onionName(): 'a-swagger:swagger';
             get $onionOptions(): IControllerOptionsSwagger;
-          } 
+          }
 }
 /** controller: end */
 /** controller: begin */
@@ -119,7 +118,7 @@ import type { ControllerRapidoc } from '../controller/rapidoc.ts';
 // @ts-ignore ignore
 import type { ControllerSwagger } from '../controller/swagger.ts';
 declare module 'vona-module-a-swagger' {
-  
+
     export interface IControllerOptionsRapidoc {
       actions?: TypeControllerOptionsActions<ControllerRapidoc>;
     }
@@ -164,13 +163,13 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     swagger: ScopeModuleASwagger;
   }
-  
+
   export interface IBeanScopeConfig {
     'a-swagger': ReturnType<typeof config>;
   }
 
-  
 
-  
+
+
 }
 /** scope: end */