cabloy 5.1.188 → 5.1.189

package/.cabloy-version

@@ -1 +1 @@
-5.1.188
+5.1.189

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 5.1.189
+
+### Features
+
+- Add anonymous context creation support.
+- Add home user functionality.
+- Add application host utility access through the context.
+- Add authentication enhancements.
+- Update core feature behavior.
+
 ## 5.1.188
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.188",
+  "version": "5.1.189",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-docs/backend/runtime-and-flavors.md

@@ -133,7 +133,7 @@ Use this page as the runtime-facing overview, then inspect the current app confi
 
 When configured, `SERVER_SERVE_PROTOCOL` and `SERVER_SERVE_HOST` define Vona's canonical public origin for backend APIs and backend-hosted SSR sites. If either serve value is not configured, Vona resolves the effective protocol and host from the current proxy-aware request context; background work that needs a stable backend public origin should configure both serve values explicitly.
 
-A browser consumer can be deployed on a different origin and pathname. Account password-set and password-reset delivery therefore does not derive its destination from `SERVER_SERVE_*`, SSR Site metadata, `publicPath`, `siteId`, `Referer`, or browser-selected mount data: Zova supplies the complete token-free absolute public page URL, and Vona validates only HTTP(S), absence of userinfo/query/fragment, and an exact trusted origin. `checkOriginExact` permits the exact current origin when protocol, host, and effective port all match; request or proxy Host values are not a general cross-origin allowlist and cannot authorize lookalike, suffix, alternate-scheme, or alternate-port destinations. Other production consumer origins must exactly match an explicit `a-security:cors` `whiteList` entry. In `dev/test`, exact credential-link authorization additionally accepts different ports only when both API and consumer hostnames are loopback (`localhost`, `127.0.0.1`, or `::1`). Vona preserves the frontend pathname and alone adds the raw token as the `token` URL query parameter. Query transport reaches the initial request; Referrer-Policy and Vona, edge, or APM query-log redaction are intentionally outside this flow's current scope. Normal CORS defaults to an empty `whiteList`; configure `CORS_WHITE_LIST` with the permitted browser origins, or explicitly configure `a-security:cors`. In `dev/test`, loopback requests may cross ports; elsewhere, cross-origin CORS requires an allowed entry. Normal CORS wildcard and suffix matching remain available when configured but are not credential-link authorization.
+A browser consumer can be deployed on a different origin and pathname. Account password-set and password-reset delivery does not derive its destination from SSR Site metadata, `publicPath`, `siteId`, `Referer`, or browser-selected mount data: Zova supplies the complete token-free absolute public page URL, and Vona validates only HTTP(S), absence of userinfo/query/fragment, and an exact trusted origin. Production origin checks supply `app.util.host` as their same-host authority: when configured, `SERVER_SERVE_HOST` is the canonical host; otherwise Vona falls back to the current proxy-aware request host. `checkOriginExact` permits an origin whose protocol, canonical/fallback host, and effective port match; request or proxy Host values are not a general cross-origin allowlist and cannot authorize lookalike, suffix, alternate-scheme, or alternate-port destinations when a canonical host is configured. Other production consumer origins must exactly match an explicit `a-security:cors` `whiteList` entry. This change supplies the canonical host only; `checkOriginExact` continues to obtain the protocol from the active request context. In `dev/test`, exact credential-link authorization additionally accepts different ports only when both API and consumer hostnames are loopback (`localhost`, `127.0.0.1`, or `::1`). Vona preserves the frontend pathname and alone adds the raw token as the `token` URL query parameter. Query transport reaches the initial request; Referrer-Policy and Vona, edge, or APM query-log redaction are intentionally outside this flow's current scope. Normal CORS defaults to an empty `whiteList`; configure `CORS_WHITE_LIST` with the permitted browser origins, or explicitly configure `a-security:cors`. In `dev/test`, loopback requests may cross ports; elsewhere, cross-origin CORS requires an allowed entry. Normal CORS wildcard and suffix matching remain available when configured but are not credential-link authorization.
 
 ## Configure browser CORS origins
 

package/vona/docker-compose-original/config/nginx/conf.d/nginx.conf

@@ -12,9 +12,9 @@ server {
     proxy_http_version 1.1;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header Host $http_host;
+    proxy_set_header Host $host;
     proxy_set_header X-NginX-Proxy true;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.154",
+  "version": "1.1.155",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.152",
+  "version": "1.1.153",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.99",
+  "version": "5.1.100",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.40",
+  "version": "5.1.41",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/core/application.ts

@@ -72,22 +72,29 @@ export class VonaApplication extends KoaApplication {
     if (req) {
       request = req;
     } else {
-      const host = `localhost:${this.meta.env.SERVER_LISTEN_PORT}`;
+      const port = this.config?.server.listen.port ?? this.meta.env.SERVER_LISTEN_PORT;
+      const hostFallback = port ? `localhost:${port}` : 'localhost';
+      const protocol = (this.config ? this.util.protocol : undefined) || 'http';
+      const host = (this.config ? this.util.host : undefined) || hostFallback;
+      const hostname = new URL(`${protocol}://${host}`).hostname;
       request = {
         headers: {
           'host': host,
-          'x-forwarded-for': host,
+          'x-forwarded-for': '127.0.0.1',
+          'x-forwarded-host': host,
+          'x-forwarded-proto': protocol,
         },
         query: {},
         querystring: '',
         host,
-        hostname: 'localhost',
-        protocol: 'http',
-        secure: 'false',
+        hostname,
+        protocol,
+        secure: protocol === 'https',
         method: 'POST',
         url: '',
         path: '',
         socket: {
+          encrypted: protocol === 'https',
           remoteAddress: '127.0.0.1',
           remotePort: 7001,
         },

package/vona/packages-vona/vona-core/src/lib/core/context.ts

@@ -127,7 +127,7 @@ export const contextBase: ContextBase = {
       typeof statusOrOptions === 'number' ? { status: statusOrOptions } : (statusOrOptions ?? {});
     // checkOrigin
     if (!url.startsWith('/') && !options.trustedExternal) {
-      const origin = cast(self.app.bean).security.checkOrigin(url, self.host);
+      const origin = cast(self.app.bean).security.checkOrigin(url, self.app.util.host);
       if (!origin) self.app.throw(403);
     }
     // throw

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.40",
+  "version": "6.1.41",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/src/suite/a-home/modules/home-user/src/service/account.ts

@@ -601,7 +601,7 @@ export class ServiceAccount extends BeanBase {
       url.password ||
       url.search ||
       url.hash ||
-      this.bean.security.checkOriginExact(url.origin, this.ctx.host) !== url.origin
+      this.bean.security.checkOriginExact(url.origin, this.app.util.host) !== url.origin
     ) {
       this.app.throw(503, `account ${purpose} consumer URL is invalid`);
     }

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordReset.test.ts

@@ -248,21 +248,38 @@ describe('accountPasswordReset.test.ts', { concurrency: false }, () => {
     }
   });
 
-  it('allows an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the canonical host for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordResetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
+    let serve: typeof app.config.server.serve | undefined;
+    let servePrevious: { protocol?: string; host?: string } | undefined;
     try {
       fixture = await createFixture({ simpleAuth: true });
       restoreConfig = await configurePasswordReset([]);
+      await app.bean.executor.mockCtx(async () => {
+        serve = app.ctx.config.server.serve;
+        servePrevious = { ...serve };
+        (serve as any).host = 'canonical.example.test';
+      });
 
       const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-reset`;
+        return `${app.ctx.protocol}://${app.util.host}/home/user/password-reset`;
       });
       const issued = await issuePasswordResetLink(fixture, sameOriginConsumerUrl);
       assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
       assert.equal(issued.path, '/home/user/password-reset');
       assert.equal(issued.search, `?token=${issued.token}`);
+
+      await clearPasswordResetState(fixture.userId);
+      await clearPasswordResetRecipientCooldown(fixture.email);
+      const requestOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
+        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-reset`;
+      });
+      await requestPasswordReset(fixture.email, requestOriginConsumerUrl);
+      await assertNoPasswordResetState(fixture.userId);
+      await assertNoPasswordResetRecipientCooldown(fixture.email);
     } finally {
+      if (serve && servePrevious) Object.assign(serve, servePrevious);
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
     }
@@ -706,9 +723,11 @@ async function assertNoPasswordResetRecipientCooldown(email: string) {
 }
 
 async function clearPasswordResetState(userId: string): Promise<void> {
-  const digest = await app.scope('home-user').cacheRedis.passwordResetCurrent.get(userId as any);
-  if (digest) await app.scope('home-user').cacheRedis.passwordReset.del(digest);
-  await app.scope('home-user').cacheRedis.passwordResetCurrent.del(userId as any);
+  await app.bean.executor.mockCtx(async () => {
+    const digest = await app.scope('home-user').cacheRedis.passwordResetCurrent.get(userId as any);
+    if (digest) await app.scope('home-user').cacheRedis.passwordReset.del(digest);
+    await app.scope('home-user').cacheRedis.passwordResetCurrent.del(userId as any);
+  });
 }
 
 async function assertNoPasswordResetState(userId: string, digest?: string): Promise<void> {

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordSet.test.ts

@@ -453,21 +453,36 @@ describe('accountPasswordSet.test.ts', { concurrency: false, sequential: true },
     }
   });
 
-  it('allows an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the canonical host for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordSetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
+    let serve: typeof app.config.server.serve | undefined;
+    let servePrevious: { protocol?: string; host?: string } | undefined;
     try {
       fixture = await createFixture();
       restoreConfig = await configurePasswordSet([]);
+      await app.bean.executor.mockCtx(async () => {
+        serve = app.ctx.config.server.serve;
+        servePrevious = { ...serve };
+        (serve as any).host = 'canonical.example.test';
+      });
 
       const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-set`;
+        return `${app.ctx.protocol}://${app.util.host}/home/user/password-set`;
       });
       const issued = await issuePasswordSetLink(fixture, sameOriginConsumerUrl);
       assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
       assert.equal(issued.path, '/home/user/password-set');
       assert.equal(issued.search, `?token=${issued.token}`);
+
+      await clearPasswordSetState(fixture.userId);
+      const requestOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
+        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-set`;
+      });
+      await issuePasswordSetLinkRejected(fixture, requestOriginConsumerUrl);
+      await assertNoPasswordSetState(fixture.userId);
     } finally {
+      if (serve && servePrevious) Object.assign(serve, servePrevious);
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
     }
@@ -784,9 +799,11 @@ async function getCacheTtl(cacheName: 'passwordSet' | 'passwordSetCurrent', key:
 }
 
 async function clearPasswordSetState(userId: string): Promise<void> {
-  const digest = await app.scope('home-user').cacheRedis.passwordSetCurrent.get(userId);
-  if (digest) await app.scope('home-user').cacheRedis.passwordSet.del(digest);
-  await app.scope('home-user').cacheRedis.passwordSetCurrent.del(userId);
+  await app.bean.executor.mockCtx(async () => {
+    const digest = await app.scope('home-user').cacheRedis.passwordSetCurrent.get(userId);
+    if (digest) await app.scope('home-user').cacheRedis.passwordSet.del(digest);
+    await app.scope('home-user').cacheRedis.passwordSetCurrent.del(userId);
+  });
 }
 
 async function assertNoPasswordSetState(userId: string, digest?: string): Promise<void> {

package/vona/src/suite-vendor/a-auth/modules/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-auth",
-  "version": "5.1.23",
+  "version": "5.1.24",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/lib/utils.ts

@@ -7,3 +7,45 @@ export function getStrategyOauth2Profile<T = IAuthUserProfile>(
 ): T {
   return args[2];
 }
+
+export type TypeOauthRedirectKind =
+  | 'absolute'
+  | 'invalid'
+  | 'missing'
+  | 'non_http'
+  | 'protocol_relative'
+  | 'relative';
+
+export interface IOauthRedirectDiagnostic {
+  redirectKind: TypeOauthRedirectKind;
+  redirectOrigin?: string;
+  redirectProtocol?: string;
+  redirectHost?: string;
+  redirectHostname?: string;
+  redirectPort?: string;
+}
+
+export function getOauthRedirectDiagnostic(redirect: string): IOauthRedirectDiagnostic {
+  if (redirect.startsWith('//')) return { redirectKind: 'protocol_relative' };
+  if (redirect.startsWith('/')) return { redirectKind: 'relative' };
+
+  let url: URL;
+  try {
+    url = new URL(redirect);
+  } catch {
+    return { redirectKind: 'invalid' };
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return { redirectKind: 'non_http', redirectProtocol: url.protocol };
+  }
+
+  return {
+    redirectKind: 'absolute',
+    redirectOrigin: url.origin,
+    redirectProtocol: url.protocol,
+    redirectHost: url.host,
+    redirectHostname: url.hostname,
+    redirectPort: url.port || undefined,
+  };
+}

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/service/auth.ts

@@ -20,6 +20,7 @@ import type {
 } from '../types/authProvider.ts';
 
 import { StrategyMock } from '../lib/strategyMock.ts';
+import { getOauthRedirectDiagnostic } from '../lib/utils.ts';
 
 @Service()
 export class ServiceAuth extends BeanBase {
@@ -247,10 +248,27 @@ export class ServiceAuth extends BeanBase {
           if (clientOptions.mockUsername) {
             return resolve(jwt);
           }
+          // redirect
+          if (!strategyState.redirect) {
+            this._logOauthRedirectRejected(entityAuthProvider, strategyState, 'redirect_missing');
+            return reject(new Error('redirect not specified'));
+          }
+          if (!strategyState.redirect.startsWith('/')) {
+            const redirectAllowed = !!this.bean.security.checkOrigin(
+              strategyState.redirect,
+              this.app.util.host,
+            );
+            if (!redirectAllowed) {
+              this._logOauthRedirectRejected(
+                entityAuthProvider,
+                strategyState,
+                'origin_disallowed',
+              );
+              return this.app.throw(403);
+            }
+          }
           // code
           const code = await this.bean.passport.createOauthCodeFromOauthAuthToken(jwt.accessToken);
-          // redirect
-          if (!strategyState.redirect) return reject(new Error('redirect not specified'));
           const redirectUrl = combineQueries(strategyState.redirect, {
             [this.scope.config.oauthCodeField]: code,
           });
@@ -266,6 +284,46 @@ export class ServiceAuth extends BeanBase {
     });
   }
 
+  private _logOauthRedirectRejected(
+    entityAuthProvider: EntityAuthProvider,
+    strategyState: IAuthenticateStrategyState,
+    reason: 'origin_disallowed' | 'redirect_missing',
+  ) {
+    const redirectDiagnostic = strategyState.redirect
+      ? getOauthRedirectDiagnostic(strategyState.redirect)
+      : { redirectKind: 'missing' as const };
+    const onionCors = this.bean.onion.middlewareSystem.getOnionSlice('a-security:cors');
+    const whiteList = onionCors?.beanOptions.options?.whiteList;
+    const whiteListEntries =
+      typeof whiteList === 'string' ? whiteList.split(',').filter(Boolean) : whiteList;
+    this.$logger.warn('OAuth callback final redirect rejected', {
+      event: 'auth.oauth_final_redirect_rejected',
+      stage: 'redirect_validation',
+      outcome: 'rejected',
+      reason,
+      authProviderId: entityAuthProvider.id,
+      providerName: entityAuthProvider.providerName,
+      clientName: entityAuthProvider.clientName,
+      intention: strategyState.intention ?? 'login',
+      instanceName: strategyState.instanceName,
+      mockMode: !!strategyState.clientOptions?.mockUsername,
+      requestHost: this.app.util.host,
+      requestProtocol: this.app.util.protocol,
+      serveHost: this.ctx.config.server.serve.host || null,
+      serveProtocol: this.ctx.config.server.serve.protocol || null,
+      proxyEnabled: this.app.proxy,
+      hostMatches:
+        redirectDiagnostic.redirectHost === undefined
+          ? undefined
+          : redirectDiagnostic.redirectHost === this.app.util.host,
+      whiteListConfigured: Array.isArray(whiteList) ? whiteList.length > 0 : !!whiteList,
+      whiteListKind: Array.isArray(whiteList) ? 'array' : typeof whiteList,
+      whiteListEntryCount: Array.isArray(whiteListEntries) ? whiteListEntries.length : 0,
+      whiteListWildcard: whiteList === '*',
+      ...redirectDiagnostic,
+    });
+  }
+
   public async getStrategyConstructable(
     beanAuthProvider: IAuthProviderVerify & IAuthProviderStrategy,
     clientOptions: IAuthProviderClientOptions,

package/vona/src/suite-vendor/a-auth/modules/a-auth/test/authCallbackRedirect.test.ts

@@ -0,0 +1,44 @@
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+
+import { getOauthRedirectDiagnostic } from '../src/lib/utils.ts';
+
+describe('authCallbackRedirect.test.ts', () => {
+  it('keeps absolute redirect diagnostics free of sensitive URL components', () => {
+    const code = 'oauth-authorization-code-sentinel';
+    const state = 'oauth-state-sentinel';
+    const token = 'oauth-token-sentinel';
+    const redirect = `https://user:password@app.example.test:8443/auth/callback?code=${code}&state=${state}&token=${token}#fragment-sentinel`;
+
+    const diagnostic = getOauthRedirectDiagnostic(redirect);
+    const serialized = JSON.stringify(diagnostic);
+
+    assert.deepEqual(diagnostic, {
+      redirectKind: 'absolute',
+      redirectOrigin: 'https://app.example.test:8443',
+      redirectProtocol: 'https:',
+      redirectHost: 'app.example.test:8443',
+      redirectHostname: 'app.example.test',
+      redirectPort: '8443',
+    });
+    for (const value of [code, state, token, 'user', 'password', 'callback', 'fragment-sentinel']) {
+      assert.equal(serialized.includes(value), false);
+    }
+  });
+
+  it('classifies redirect shapes without retaining raw values', () => {
+    assert.deepEqual(getOauthRedirectDiagnostic('/home/base/authCallback?token=secret'), {
+      redirectKind: 'relative',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('//app.example.test/authCallback?token=secret'), {
+      redirectKind: 'protocol_relative',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('https://[invalid'), {
+      redirectKind: 'invalid',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('javascript:alert(secret)'), {
+      redirectKind: 'non_http',
+      redirectProtocol: 'javascript:',
+    });
+  });
+});

package/vona/src/suite-vendor/a-auth/modules/a-auth/test/oauthRequestContext.test.ts

@@ -0,0 +1,171 @@
+import assert from 'node:assert';
+import { after, before, describe, it } from 'node:test';
+import { acquireTestLock, app } from 'vona-mock';
+
+describe('oauthRequestContext.test.ts', { concurrency: false }, () => {
+  const releases: Array<() => void> = [];
+
+  before(async () => {
+    releases.push(await acquireTestLock('a-security'));
+  });
+
+  after(() => {
+    for (const release of releases.reverse()) release();
+  });
+  it('passes the callback request through an isolated context without rewriting it', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const proxyPrevious = app.proxy;
+      app.proxy = true;
+      try {
+        const req = {
+          method: 'GET',
+          url: '/api/auth/passport/callback?a=1&b=2',
+          headers: {
+            'host': 'origin.internal.test',
+            'x-forwarded-host': 'demo.example.test',
+            'x-forwarded-proto': 'https',
+            'user-agent': 'oauth-callback-test',
+          },
+          httpVersionMajor: 1,
+          socket: {
+            remoteAddress: '192.0.2.10',
+            remotePort: 443,
+          },
+        };
+        const originalUrl = req.url;
+        const originalHeaders = { ...req.headers };
+        const outerContext = app.ctx;
+        const result = await app.bean.executor.newCtx(
+          async () => {
+            return {
+              context: app.ctx,
+              request: app.ctx.req,
+              method: app.ctx.method,
+              host: app.ctx.host,
+              protocol: app.ctx.protocol,
+              secure: app.ctx.secure,
+              query: app.ctx.request.query,
+              userAgent: app.ctx.get('user-agent'),
+            };
+          },
+          {
+            instanceName: outerContext.instanceName!,
+            req,
+          },
+        );
+
+        assert.notEqual(result.context, outerContext);
+        assert.equal(result.request, req);
+        assert.equal(result.method, 'GET');
+        assert.equal(result.host, 'demo.example.test');
+        assert.equal(result.protocol, 'https');
+        assert.equal(result.secure, true);
+        assert.deepEqual(result.query, { a: '1', b: '2' });
+        assert.equal(result.userAgent, 'oauth-callback-test');
+        assert.equal(req.url, originalUrl);
+        assert.deepEqual(req.headers, originalHeaders);
+        assert.equal(app.ctx, outerContext);
+      } finally {
+        app.proxy = proxyPrevious;
+      }
+    });
+  });
+
+  it('logs rejected redirects against the canonical server origin', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const proxyPrevious = app.proxy;
+      const serve = app.ctx.config.server.serve;
+      const servePrevious = { ...serve };
+      app.proxy = true;
+      (serve as any).host = 'canonical.example.test';
+      (serve as any).protocol = 'http';
+      try {
+        const req = {
+          method: 'GET',
+          url: '/api/auth/passport/callback',
+          headers: {
+            'host': 'origin.internal.test',
+            'x-forwarded-host': 'edge.example.test',
+            'x-forwarded-proto': 'https',
+          },
+          httpVersionMajor: 1,
+          socket: {
+            remoteAddress: '192.0.2.10',
+            remotePort: 443,
+          },
+        };
+        await app.bean.executor.newCtx(
+          async () => {
+            assert.equal(app.ctx.host, 'edge.example.test');
+            assert.equal(app.ctx.protocol, 'https');
+            assert.equal(app.util.host, 'canonical.example.test');
+            assert.equal(app.util.protocol, 'http');
+
+            const service = app.scope('a-auth').service.auth;
+            const logger = (service as any).$logger;
+            const warnPrevious = logger.warn;
+            const warnings: unknown[][] = [];
+            logger.warn = (...args: unknown[]) => warnings.push(args);
+            try {
+              (service as any)._logOauthRedirectRejected(
+                {
+                  id: -1,
+                  providerName: 'auth-oauth:oauth',
+                  clientName: 'github',
+                },
+                {
+                  authProviderId: -1,
+                  instanceName: app.ctx.instanceName!,
+                  locale: app.ctx.locale,
+                  redirect: 'https://edge.example.test/oauth/callback',
+                },
+                'origin_disallowed',
+              );
+            } finally {
+              logger.warn = warnPrevious;
+            }
+
+            assert.equal(warnings.length, 1);
+            assert.equal(warnings[0][0], 'OAuth callback final redirect rejected');
+            const diagnostic = warnings[0][1] as Record<string, unknown>;
+            assert.deepEqual(
+              {
+                event: diagnostic.event,
+                stage: diagnostic.stage,
+                outcome: diagnostic.outcome,
+                reason: diagnostic.reason,
+                requestHost: diagnostic.requestHost,
+                requestProtocol: diagnostic.requestProtocol,
+                serveHost: diagnostic.serveHost,
+                serveProtocol: diagnostic.serveProtocol,
+                proxyEnabled: diagnostic.proxyEnabled,
+                redirectHost: diagnostic.redirectHost,
+                hostMatches: diagnostic.hostMatches,
+              },
+              {
+                event: 'auth.oauth_final_redirect_rejected',
+                stage: 'redirect_validation',
+                outcome: 'rejected',
+                reason: 'origin_disallowed',
+                requestHost: 'canonical.example.test',
+                requestProtocol: 'http',
+                serveHost: 'canonical.example.test',
+                serveProtocol: 'http',
+                proxyEnabled: true,
+                redirectHost: 'edge.example.test',
+                hostMatches: false,
+              },
+            );
+          },
+          {
+            instanceName: app.ctx.instanceName!,
+            req,
+          },
+        );
+      } finally {
+        app.proxy = proxyPrevious;
+        Object.assign(serve, servePrevious);
+      }
+    });
+  });
+});

package/vona/src/suite-vendor/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-auth",
-  "version": "5.1.27",
+  "version": "5.1.28",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-cabloy/modules/a-socket/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-socket",
-  "version": "5.1.16",
+  "version": "5.1.17",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/modules/a-socket/src/bean/socketConnection.cors.ts

@@ -14,7 +14,7 @@ export interface ISocketConnectionOptionsCors extends IDecoratorSocketConnection
 export class SocketConnectionCors extends BeanBase implements ISocketConnectionExecute {
   async enter(ws: WebSocket, _options: ISocketConnectionOptionsCors, next: Next): Promise<void> {
     // cors
-    const origin = this.bean.security.checkOrigin(this.ctx.get('origin'), this.ctx.host);
+    const origin = this.bean.security.checkOrigin(this.ctx.get('origin'), this.app.util.host);
     if (!origin) {
       ws.terminate();
       return;

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ssr",
-  "version": "5.1.32",
+  "version": "5.1.33",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.56",
+  "version": "5.1.57",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.54",
+  "version": "5.1.55",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-security",
-  "version": "5.1.13",
+  "version": "5.1.14",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-security/src/bean/middlewareSystem.cors.ts

@@ -52,5 +52,5 @@ export class MiddlewareSystemCors extends BeanBase implements IMiddlewareSystemE
 }
 
 function _corsOrigin(ctx: VonaContext) {
-  return ctx.app.bean.security.checkOrigin(ctx.get('origin'), ctx.host);
+  return ctx.app.bean.security.checkOrigin(ctx.get('origin'), ctx.app.util.host);
 }

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.90",
+  "version": "5.1.91",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/zova/pnpm-lock.yaml

@@ -77,7 +77,7 @@ importers:
         version: 10.6.0(postcss@8.5.28)
       axios:
         specifier: ^1.18.1
-        version: 1.20.0
+        version: 1.20.0(supports-color@10.2.2)
       compression:
         specifier: ^1.8.1
         version: 1.8.2
@@ -369,7 +369,7 @@ importers:
     devDependencies:
       '@cabloy/cli':
         specifier: ^3.1.29
-        version: 3.1.29(vue@3.5.42(typescript@5.9.3))
+        version: 3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))
       '@cabloy/lint':
         specifier: ^5.1.35
         version: 5.1.35(@typescript-eslint/eslint-plugin@8.70.0(@typescript-eslint/parser@8.70.0(eslint@10.10.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@5.9.3))(eslint@10.10.0(jiti@2.7.0))(typescript@5.9.3))(@typescript-eslint/typescript-estree@8.70.0(typescript@5.9.3))(@typescript-eslint/utils@8.70.0(eslint@10.10.0(jiti@2.7.0))(typescript@5.9.3))(eslint@10.10.0(jiti@2.7.0))(oxfmt@0.62.0)(oxlint@1.82.0)(supports-color@10.2.2)(typescript@5.9.3)(vue-eslint-parser@10.4.1(eslint@10.10.0(jiti@2.7.0)))
@@ -444,7 +444,7 @@ importers:
     dependencies:
       '@cabloy/cli':
         specifier: ^3.1.29
-        version: 3.1.29(vue@3.5.42(typescript@5.9.3))
+        version: 3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))
       '@cabloy/process-helper':
         specifier: ^3.1.8
         version: 3.1.8
@@ -455,7 +455,7 @@ importers:
         specifier: ^7.6.2
         version: 7.8.5
       zova-cli-set-front:
-        specifier: ^1.2.108
+        specifier: ^1.2.109
         version: link:../cli-set-front
     devDependencies:
       clean-package:
@@ -478,7 +478,7 @@ importers:
         version: 7.29.7(@babel/core@7.29.7)
       '@cabloy/cli':
         specifier: ^3.1.29
-        version: 3.1.29(vue@3.5.42(typescript@5.9.3))
+        version: 3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))
       '@cabloy/extend':
         specifier: ^3.2.8
         version: 3.2.8
@@ -564,7 +564,7 @@ importers:
         specifier: ^1.1.17
         version: link:../../packages-utils/zova-openapi
       zova-vite:
-        specifier: ^1.1.46
+        specifier: ^1.1.47
         version: link:../../packages-utils/zova-vite
     devDependencies:
       clean-package:
@@ -1204,7 +1204,7 @@ importers:
     dependencies:
       axios:
         specifier: ^1.18.1
-        version: 1.20.0
+        version: 1.20.0(supports-color@10.2.2)
     devDependencies:
       clean-package:
         specifier: ^2.2.0
@@ -1477,7 +1477,7 @@ importers:
     devDependencies:
       '@cabloy/cli':
         specifier: ^3.1.29
-        version: 3.1.29(vue@3.5.42(typescript@5.9.3))
+        version: 3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))
       '@types/luxon':
         specifier: ^3.7.1
         version: 3.7.5
@@ -8851,7 +8851,7 @@ snapshots:
 
   '@bufbuild/protobuf@2.15.0': {}
 
-  '@cabloy/cli@3.1.29(vue@3.5.42(typescript@5.9.3))':
+  '@cabloy/cli@3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))':
     dependencies:
       '@babel/parser': 7.29.8
       '@cabloy/module-glob': 5.3.18
@@ -8860,7 +8860,7 @@ snapshots:
       '@cabloy/utils': 2.1.27
       '@cabloy/word-utils': link:packages-utils/word-utils
       '@npmcli/config': 10.12.0
-      '@zhennann/common-bin': 4.0.1
+      '@zhennann/common-bin': 4.0.1(supports-color@10.2.2)
       '@zhennann/ejs': 3.0.1
       boxen: 4.2.0
       chalk: 3.0.0
@@ -11048,7 +11048,7 @@ snapshots:
 
   '@vue/shared@3.5.13': {}
 
-  '@zhennann/common-bin@4.0.1':
+  '@zhennann/common-bin@4.0.1(supports-color@10.2.2)':
     dependencies:
       chalk: 4.1.2
       change-case: 4.1.2
@@ -11082,7 +11082,7 @@ snapshots:
 
   acorn@8.18.0: {}
 
-  agent-base@6.0.2:
+  agent-base@6.0.2(supports-color@10.2.2):
     dependencies:
       debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
@@ -11190,11 +11190,11 @@ snapshots:
     dependencies:
       possible-typed-array-names: 1.1.0
 
-  axios@1.20.0:
+  axios@1.20.0(supports-color@10.2.2):
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.6
-      https-proxy-agent: 5.0.1
+      https-proxy-agent: 5.0.1(supports-color@10.2.2)
       proxy-from-env: 2.1.0
     transitivePeerDependencies:
       - debug
@@ -12589,9 +12589,9 @@ snapshots:
       statuses: 2.0.2
       toidentifier: 1.0.1
 
-  https-proxy-agent@5.0.1:
+  https-proxy-agent@5.0.1(supports-color@10.2.2):
     dependencies:
-      agent-base: 6.0.2
+      agent-base: 6.0.2(supports-color@10.2.2)
       debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color