cabloy 5.1.188 → 5.1.190

package/.cabloy-version

@@ -1 +1 @@
-5.1.188
+5.1.190

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 5.1.190
+
+### Features
+
+- Update application and authentication capabilities.
+
+### Bug Fixes
+
+- Correct test coverage and authentication request handling.
+
+### Improvements
+
+- Simplify `bean.core` by removing obsolete methods.
+- Update application, Passport, OAuth request context, and project documentation.
+
+## 5.1.189
+
+### Features
+
+- Add anonymous context creation support.
+- Add home user functionality.
+- Add application host utility access through the context.
+- Add authentication enhancements.
+- Update core feature behavior.
+
 ## 5.1.188
 
 ### Bug Fixes

package/CLAUDE.md

@@ -88,6 +88,7 @@ Before inventing a custom implementation path:
 - For replay-safe transient failures, use `@Core.retryable(...)` with an explicit `errorCodes` allowlist. It retries the downstream AOP suffix, so place it closest to the method when it must wrap and retry a `@Core.transaction(...)` boundary; use `ownerOnly: true` for dual-role leaves that must not retry inside a caller-owned transaction; do not retry external side effects or infer retryability from isolation level.
 - Backend tests that use scoped Vona state must own an `app.bean.executor.mockCtx(...)` boundary; every intentionally competing operation must run in a separate `mockCtx(...)`.
 - Do not set `TEST_CONCURRENCY=false` for normal `npm run test` or CI runs: an unset value defaults to concurrent execution. For stateful `node:test` suites, declare `{ concurrency: false }` explicitly. Prove business contention by explicitly launching competing operations and asserting their combined durable outcome, never through runner parallelism or scheduling.
+- Unit tests must not temporarily mutate process-global origin or proxy configuration, including `app.config.server.serve.protocol`, `app.config.server.serve.host`, and `app.proxy`. Model request-origin cases with an explicit `req` fixture, and use the established `AppUtil` loopback fallback for requestless local URLs. Do not introduce a broad origin lock to serialize such tests; retain narrowly scoped locks only for genuinely shared domain state.
 - Unit tests must delete every test-owned persisted resource in `finally`, using precise owned identities and reverse dependency order.
 - Shared durable test or local-development fixtures must be created through the owning module's `meta.version.ts` `seed()` hook and treated as read-only by tests; the managed seed path starts from a newly recreated database rather than repeating against one database.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.188",
+  "version": "5.1.190",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-docs/backend/runtime-and-flavors.md

@@ -133,7 +133,7 @@ Use this page as the runtime-facing overview, then inspect the current app confi
 
 When configured, `SERVER_SERVE_PROTOCOL` and `SERVER_SERVE_HOST` define Vona's canonical public origin for backend APIs and backend-hosted SSR sites. If either serve value is not configured, Vona resolves the effective protocol and host from the current proxy-aware request context; background work that needs a stable backend public origin should configure both serve values explicitly.
 
-A browser consumer can be deployed on a different origin and pathname. Account password-set and password-reset delivery therefore does not derive its destination from `SERVER_SERVE_*`, SSR Site metadata, `publicPath`, `siteId`, `Referer`, or browser-selected mount data: Zova supplies the complete token-free absolute public page URL, and Vona validates only HTTP(S), absence of userinfo/query/fragment, and an exact trusted origin. `checkOriginExact` permits the exact current origin when protocol, host, and effective port all match; request or proxy Host values are not a general cross-origin allowlist and cannot authorize lookalike, suffix, alternate-scheme, or alternate-port destinations. Other production consumer origins must exactly match an explicit `a-security:cors` `whiteList` entry. In `dev/test`, exact credential-link authorization additionally accepts different ports only when both API and consumer hostnames are loopback (`localhost`, `127.0.0.1`, or `::1`). Vona preserves the frontend pathname and alone adds the raw token as the `token` URL query parameter. Query transport reaches the initial request; Referrer-Policy and Vona, edge, or APM query-log redaction are intentionally outside this flow's current scope. Normal CORS defaults to an empty `whiteList`; configure `CORS_WHITE_LIST` with the permitted browser origins, or explicitly configure `a-security:cors`. In `dev/test`, loopback requests may cross ports; elsewhere, cross-origin CORS requires an allowed entry. Normal CORS wildcard and suffix matching remain available when configured but are not credential-link authorization.
+A browser consumer can be deployed on a different origin and pathname. Account password-set and password-reset delivery does not derive its destination from SSR Site metadata, `publicPath`, `siteId`, `Referer`, or browser-selected mount data: Zova supplies the complete token-free absolute public page URL, and Vona validates only HTTP(S), absence of userinfo/query/fragment, and an exact trusted origin. Production origin checks supply `app.util.host` as their same-host authority: when configured, `SERVER_SERVE_HOST` is the canonical host; otherwise Vona falls back to the current proxy-aware request host. `checkOriginExact` permits an origin whose protocol, canonical/fallback host, and effective port match; request or proxy Host values are not a general cross-origin allowlist and cannot authorize lookalike, suffix, alternate-scheme, or alternate-port destinations when a canonical host is configured. Other production consumer origins must exactly match an explicit `a-security:cors` `whiteList` entry. This change supplies the canonical host only; `checkOriginExact` continues to obtain the protocol from the active request context. In `dev/test`, exact credential-link authorization additionally accepts different ports only when both API and consumer hostnames are loopback (`localhost`, `127.0.0.1`, or `::1`). Vona preserves the frontend pathname and alone adds the raw token as the `token` URL query parameter. Query transport reaches the initial request; Referrer-Policy and Vona, edge, or APM query-log redaction are intentionally outside this flow's current scope. Normal CORS defaults to an empty `whiteList`; configure `CORS_WHITE_LIST` with the permitted browser origins, or explicitly configure `a-security:cors`. In `dev/test`, loopback requests may cross ports; elsewhere, cross-origin CORS requires an allowed entry. Normal CORS wildcard and suffix matching remain available when configured but are not credential-link authorization.
 
 ## Configure browser CORS origins
 

package/vona/docker-compose-original/config/nginx/conf.d/nginx.conf

@@ -12,9 +12,9 @@ server {
     proxy_http_version 1.1;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header Host $http_host;
+    proxy_set_header Host $host;
     proxy_set_header X-NginX-Proxy true;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.154",
+  "version": "1.1.156",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.152",
+  "version": "1.1.154",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-cli/cli-set-api/toolsIsolate/test.ts

@@ -99,8 +99,8 @@ async function testRun(projectPath: string, coverage: boolean, patterns: string[
       .on('test:coverage', data => {
         outputCoverageReport(data.summary.totals);
       })
-      .on('test:pass', t => {
-        if (t.name === '---done---') {
+      .on('test:pass', data => {
+        if (data.nesting === 0 && data.name === '---done---') {
           void closeApplicationOnce();
         }
       });

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.99",
+  "version": "5.1.101",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.40",
+  "version": "5.1.42",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/core/application.ts

@@ -72,22 +72,28 @@ export class VonaApplication extends KoaApplication {
     if (req) {
       request = req;
     } else {
-      const host = `localhost:${this.meta.env.SERVER_LISTEN_PORT}`;
+      const protocol = 'http';
+      const port = this.meta.env.SERVER_LISTEN_PORT;
+      const host = port ? `localhost:${port}` : 'localhost';
+      const hostname = new URL(`${protocol}://${host}`).hostname;
       request = {
         headers: {
           'host': host,
-          'x-forwarded-for': host,
+          'x-forwarded-for': '127.0.0.1',
+          'x-forwarded-host': host,
+          'x-forwarded-proto': protocol,
         },
         query: {},
         querystring: '',
         host,
-        hostname: 'localhost',
-        protocol: 'http',
-        secure: 'false',
+        hostname,
+        protocol,
+        secure: false,
         method: 'POST',
         url: '',
         path: '',
         socket: {
+          encrypted: false,
           remoteAddress: '127.0.0.1',
           remotePort: 7001,
         },

package/vona/packages-vona/vona-core/src/lib/core/context.ts

@@ -127,7 +127,7 @@ export const contextBase: ContextBase = {
       typeof statusOrOptions === 'number' ? { status: statusOrOptions } : (statusOrOptions ?? {});
     // checkOrigin
     if (!url.startsWith('/') && !options.trustedExternal) {
-      const origin = cast(self.app.bean).security.checkOrigin(url, self.host);
+      const origin = cast(self.app.bean).security.checkOrigin(url, self.app.util.host);
       if (!origin) self.app.throw(403);
     }
     // throw

package/vona/packages-vona/vona-core/src/lib/utils/util.ts

@@ -61,12 +61,17 @@ export class AppUtil extends BeanSimple {
 
   get protocol() {
     const config = this.ctx ? this.ctx.config : this.app.config;
-    return config.server.serve.protocol || this.ctx?.protocol;
+    return config.server.serve.protocol || this.ctx?.protocol || 'http';
   }
 
   get host() {
     const config = this.ctx ? this.ctx.config : this.app.config;
-    return config.server.serve.host || this.ctx?.host;
+    let host = config.server.serve.host || this.ctx?.host;
+    if (!host) {
+      const port = this.app.meta.env.SERVER_LISTEN_PORT;
+      host = port ? `localhost:${port}` : 'localhost';
+    }
+    return host;
   }
 
   getAbsoluteUrl(path?: string) {

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.40",
+  "version": "6.1.42",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/src/suite/a-commerce/modules/commerce-catalog/src/service/product.ts

@@ -17,11 +17,11 @@ import type { EntityProduct } from '../entity/product.tsx';
 import type { ModelProduct } from '../model/product.ts';
 
 const serializationRetryOptions = {
-  retries: 3,
-  factor: 1,
+  retries: 6,
+  factor: 2,
   minTimeout: 10,
-  maxTimeout: 10,
-  randomize: false,
+  maxTimeout: 160,
+  randomize: true,
   errorCodes: [
     '40001',
     'ER_LOCK_DEADLOCK',

package/vona/src/suite/a-commerce/modules/commerce-catalog/test/productContent.test.ts

@@ -243,7 +243,7 @@ describe('productContent.test.ts', { concurrency: false }, () => {
         return product.id;
       });
 
-      await Promise.all(
+      const results = await Promise.allSettled(
         markdowns.map(descriptionMarkdown =>
           runInMockCtx(async () => {
             await app.scope('commerce-catalog').service.product.update(productId, {
@@ -252,10 +252,17 @@ describe('productContent.test.ts', { concurrency: false }, () => {
           }),
         ),
       );
+      assert.deepEqual(
+        results.map(result => result.status),
+        ['fulfilled', 'fulfilled'],
+      );
 
       await runInMockCtx(async () => {
-        const stored = await app.scope('commerce-catalog').model.productContent.get({ productId });
-        assert.ok(stored);
+        const storeds = await app.scope('commerce-catalog').model.productContent.select({
+          where: { productId },
+        });
+        assert.equal(storeds.length, 1);
+        const stored = storeds[0]!;
         assert.ok(markdowns.includes(stored.descriptionMarkdown!));
         assert.equal(
           stored.descriptionHtml,

package/vona/src/suite/a-commerce/modules/commerce-payment/src/bean/payScene.commerceOrder.ts

@@ -23,7 +23,9 @@ import 'vona-module-a-ssr';
       input.candidate.clientName,
     );
     const server = _ctx.app.config.server.serve;
-    const hasPublicServer = !!(server.protocol && server.host);
+    const hasCallbackOrigin = _ctx.app.meta.isTest
+      ? !!(_ctx.app.util.protocol && _ctx.app.util.host)
+      : !!(server.protocol && server.host);
     if (input.candidate.key === 'paypal') {
       const options = clientOptions as IPayProviderPaypalClientOptions;
       return !!(
@@ -31,12 +33,12 @@ import 'vona-module-a-ssr';
         options.secretCredential.clientSecret &&
         options.webhookId &&
         options.merchantReference &&
-        hasPublicServer
+        hasCallbackOrigin
       );
     }
     if (input.candidate.key === 'stripe') {
       const options = clientOptions as IPayProviderStripeClientOptions;
-      return !!(options.secretCredential && options.secretWebhook && hasPublicServer);
+      return !!(options.secretCredential && options.secretWebhook && hasCallbackOrigin);
     }
     return false;
   },

package/vona/src/suite/a-home/modules/home-index/src/bean/meta.printTip.ts

@@ -8,7 +8,7 @@ export class MetaPrintTip extends BeanBase implements IMetaPrintTipExecute {
   async execute(): Promise<TypeMetaPrintTipResult> {
     return {
       title: 'home',
-      message: this.bean.core.getAbsoluteUrl(),
+      message: this.app.util.getAbsoluteUrl(),
     };
   }
 }

package/vona/src/suite/a-home/modules/home-user/src/service/account.ts

@@ -601,7 +601,7 @@ export class ServiceAccount extends BeanBase {
       url.password ||
       url.search ||
       url.hash ||
-      this.bean.security.checkOriginExact(url.origin, this.ctx.host) !== url.origin
+      this.bean.security.checkOriginExact(url.origin, this.app.util.host) !== url.origin
     ) {
       this.app.throw(503, `account ${purpose} consumer URL is invalid`);
     }

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordReset.test.ts

@@ -248,20 +248,29 @@ describe('accountPasswordReset.test.ts', { concurrency: false }, () => {
     }
   });
 
-  it('allows an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the fallback origin for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordResetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
     try {
       fixture = await createFixture({ simpleAuth: true });
       restoreConfig = await configurePasswordReset([]);
 
-      const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-reset`;
-      });
+      const port = app.meta.env.SERVER_LISTEN_PORT;
+      const fallbackOrigin = `http://${port ? `localhost:${port}` : 'localhost'}`;
+      const sameOriginConsumerUrl = `${fallbackOrigin}/home/user/password-reset`;
       const issued = await issuePasswordResetLink(fixture, sameOriginConsumerUrl);
-      assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
+      assert.equal(issued.origin, fallbackOrigin);
       assert.equal(issued.path, '/home/user/password-reset');
       assert.equal(issued.search, `?token=${issued.token}`);
+
+      await clearPasswordResetState(fixture.userId);
+      await clearPasswordResetRecipientCooldown(fixture.email);
+      await requestPasswordReset(
+        fixture.email,
+        'https://request.example.test/home/user/password-reset',
+      );
+      await assertNoPasswordResetState(fixture.userId);
+      await assertNoPasswordResetRecipientCooldown(fixture.email);
     } finally {
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
@@ -706,9 +715,11 @@ async function assertNoPasswordResetRecipientCooldown(email: string) {
 }
 
 async function clearPasswordResetState(userId: string): Promise<void> {
-  const digest = await app.scope('home-user').cacheRedis.passwordResetCurrent.get(userId as any);
-  if (digest) await app.scope('home-user').cacheRedis.passwordReset.del(digest);
-  await app.scope('home-user').cacheRedis.passwordResetCurrent.del(userId as any);
+  await app.bean.executor.mockCtx(async () => {
+    const digest = await app.scope('home-user').cacheRedis.passwordResetCurrent.get(userId as any);
+    if (digest) await app.scope('home-user').cacheRedis.passwordReset.del(digest);
+    await app.scope('home-user').cacheRedis.passwordResetCurrent.del(userId as any);
+  });
 }
 
 async function assertNoPasswordResetState(userId: string, digest?: string): Promise<void> {

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordSet.test.ts

@@ -453,20 +453,27 @@ describe('accountPasswordSet.test.ts', { concurrency: false, sequential: true },
     }
   });
 
-  it('allows an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the fallback origin for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordSetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
     try {
       fixture = await createFixture();
       restoreConfig = await configurePasswordSet([]);
 
-      const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-set`;
-      });
+      const port = app.meta.env.SERVER_LISTEN_PORT;
+      const fallbackOrigin = `http://${port ? `localhost:${port}` : 'localhost'}`;
+      const sameOriginConsumerUrl = `${fallbackOrigin}/home/user/password-set`;
       const issued = await issuePasswordSetLink(fixture, sameOriginConsumerUrl);
-      assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
+      assert.equal(issued.origin, fallbackOrigin);
       assert.equal(issued.path, '/home/user/password-set');
       assert.equal(issued.search, `?token=${issued.token}`);
+
+      await clearPasswordSetState(fixture.userId);
+      await issuePasswordSetLinkRejected(
+        fixture,
+        'https://request.example.test/home/user/password-set',
+      );
+      await assertNoPasswordSetState(fixture.userId);
     } finally {
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
@@ -784,9 +791,11 @@ async function getCacheTtl(cacheName: 'passwordSet' | 'passwordSetCurrent', key:
 }
 
 async function clearPasswordSetState(userId: string): Promise<void> {
-  const digest = await app.scope('home-user').cacheRedis.passwordSetCurrent.get(userId);
-  if (digest) await app.scope('home-user').cacheRedis.passwordSet.del(digest);
-  await app.scope('home-user').cacheRedis.passwordSetCurrent.del(userId);
+  await app.bean.executor.mockCtx(async () => {
+    const digest = await app.scope('home-user').cacheRedis.passwordSetCurrent.get(userId);
+    if (digest) await app.scope('home-user').cacheRedis.passwordSet.del(digest);
+    await app.scope('home-user').cacheRedis.passwordSetCurrent.del(userId);
+  });
 }
 
 async function assertNoPasswordSetState(userId: string, digest?: string): Promise<void> {

package/vona/src/suite-vendor/a-auth/modules/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-auth",
-  "version": "5.1.23",
+  "version": "5.1.25",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/controller/passport.ts

@@ -15,7 +15,7 @@ export class ControllerPassport extends BeanBase {
   @Aspect.guardGlobal('a-user:passport', { public: true })
   @Api.exclude()
   async callback() {
-    const code = this.ctx.query.code as string;
+    // const code = this.ctx.query.code as string;
     const stateQuery = this.ctx.query.state as string;
     if (!stateQuery) this.app.throw(403);
     const strategyState: IAuthenticateStrategyState = (await this.bean.jwt
@@ -23,7 +23,7 @@ export class ControllerPassport extends BeanBase {
       .verify(stateQuery)) as unknown as IAuthenticateStrategyState;
     return await this.bean.executor.newCtx(
       async () => {
-        this.ctx.request.query = { code, state: stateQuery };
+        // this.ctx.request.query = { code, state: stateQuery };
         return await this.scope.service.auth.authCallback(strategyState);
       },
       {
@@ -31,6 +31,8 @@ export class ControllerPassport extends BeanBase {
         tz: strategyState.tz,
         instanceName: strategyState.instanceName,
         instance: true,
+        req: this.ctx.req,
+        res: this.ctx.res,
       },
     );
   }

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/lib/utils.ts

@@ -7,3 +7,45 @@ export function getStrategyOauth2Profile<T = IAuthUserProfile>(
 ): T {
   return args[2];
 }
+
+export type TypeOauthRedirectKind =
+  | 'absolute'
+  | 'invalid'
+  | 'missing'
+  | 'non_http'
+  | 'protocol_relative'
+  | 'relative';
+
+export interface IOauthRedirectDiagnostic {
+  redirectKind: TypeOauthRedirectKind;
+  redirectOrigin?: string;
+  redirectProtocol?: string;
+  redirectHost?: string;
+  redirectHostname?: string;
+  redirectPort?: string;
+}
+
+export function getOauthRedirectDiagnostic(redirect: string): IOauthRedirectDiagnostic {
+  if (redirect.startsWith('//')) return { redirectKind: 'protocol_relative' };
+  if (redirect.startsWith('/')) return { redirectKind: 'relative' };
+
+  let url: URL;
+  try {
+    url = new URL(redirect);
+  } catch {
+    return { redirectKind: 'invalid' };
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return { redirectKind: 'non_http', redirectProtocol: url.protocol };
+  }
+
+  return {
+    redirectKind: 'absolute',
+    redirectOrigin: url.origin,
+    redirectProtocol: url.protocol,
+    redirectHost: url.host,
+    redirectHostname: url.hostname,
+    redirectPort: url.port || undefined,
+  };
+}

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/service/auth.ts

@@ -20,6 +20,7 @@ import type {
 } from '../types/authProvider.ts';
 
 import { StrategyMock } from '../lib/strategyMock.ts';
+import { getOauthRedirectDiagnostic } from '../lib/utils.ts';
 
 @Service()
 export class ServiceAuth extends BeanBase {
@@ -247,10 +248,27 @@ export class ServiceAuth extends BeanBase {
           if (clientOptions.mockUsername) {
             return resolve(jwt);
           }
+          // redirect
+          if (!strategyState.redirect) {
+            this._logOauthRedirectRejected(entityAuthProvider, strategyState, 'redirect_missing');
+            return reject(new Error('redirect not specified'));
+          }
+          if (!strategyState.redirect.startsWith('/')) {
+            const redirectAllowed = !!this.bean.security.checkOrigin(
+              strategyState.redirect,
+              this.app.util.host,
+            );
+            if (!redirectAllowed) {
+              this._logOauthRedirectRejected(
+                entityAuthProvider,
+                strategyState,
+                'origin_disallowed',
+              );
+              return this.app.throw(403);
+            }
+          }
           // code
           const code = await this.bean.passport.createOauthCodeFromOauthAuthToken(jwt.accessToken);
-          // redirect
-          if (!strategyState.redirect) return reject(new Error('redirect not specified'));
           const redirectUrl = combineQueries(strategyState.redirect, {
             [this.scope.config.oauthCodeField]: code,
           });
@@ -266,6 +284,46 @@ export class ServiceAuth extends BeanBase {
     });
   }
 
+  private _logOauthRedirectRejected(
+    entityAuthProvider: EntityAuthProvider,
+    strategyState: IAuthenticateStrategyState,
+    reason: 'origin_disallowed' | 'redirect_missing',
+  ) {
+    const redirectDiagnostic = strategyState.redirect
+      ? getOauthRedirectDiagnostic(strategyState.redirect)
+      : { redirectKind: 'missing' as const };
+    const onionCors = this.bean.onion.middlewareSystem.getOnionSlice('a-security:cors');
+    const whiteList = onionCors?.beanOptions.options?.whiteList;
+    const whiteListEntries =
+      typeof whiteList === 'string' ? whiteList.split(',').filter(Boolean) : whiteList;
+    this.$logger.warn('OAuth callback final redirect rejected', {
+      event: 'auth.oauth_final_redirect_rejected',
+      stage: 'redirect_validation',
+      outcome: 'rejected',
+      reason,
+      authProviderId: entityAuthProvider.id,
+      providerName: entityAuthProvider.providerName,
+      clientName: entityAuthProvider.clientName,
+      intention: strategyState.intention ?? 'login',
+      instanceName: strategyState.instanceName,
+      mockMode: !!strategyState.clientOptions?.mockUsername,
+      requestHost: this.app.util.host,
+      requestProtocol: this.app.util.protocol,
+      serveHost: this.ctx.config.server.serve.host || null,
+      serveProtocol: this.ctx.config.server.serve.protocol || null,
+      proxyEnabled: this.app.proxy,
+      hostMatches:
+        redirectDiagnostic.redirectHost === undefined
+          ? undefined
+          : redirectDiagnostic.redirectHost === this.app.util.host,
+      whiteListConfigured: Array.isArray(whiteList) ? whiteList.length > 0 : !!whiteList,
+      whiteListKind: Array.isArray(whiteList) ? 'array' : typeof whiteList,
+      whiteListEntryCount: Array.isArray(whiteListEntries) ? whiteListEntries.length : 0,
+      whiteListWildcard: whiteList === '*',
+      ...redirectDiagnostic,
+    });
+  }
+
   public async getStrategyConstructable(
     beanAuthProvider: IAuthProviderVerify & IAuthProviderStrategy,
     clientOptions: IAuthProviderClientOptions,

package/vona/src/suite-vendor/a-auth/modules/a-auth/test/authCallbackRedirect.test.ts

@@ -0,0 +1,44 @@
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+
+import { getOauthRedirectDiagnostic } from '../src/lib/utils.ts';
+
+describe('authCallbackRedirect.test.ts', () => {
+  it('keeps absolute redirect diagnostics free of sensitive URL components', () => {
+    const code = 'oauth-authorization-code-sentinel';
+    const state = 'oauth-state-sentinel';
+    const token = 'oauth-token-sentinel';
+    const redirect = `https://user:password@app.example.test:8443/auth/callback?code=${code}&state=${state}&token=${token}#fragment-sentinel`;
+
+    const diagnostic = getOauthRedirectDiagnostic(redirect);
+    const serialized = JSON.stringify(diagnostic);
+
+    assert.deepEqual(diagnostic, {
+      redirectKind: 'absolute',
+      redirectOrigin: 'https://app.example.test:8443',
+      redirectProtocol: 'https:',
+      redirectHost: 'app.example.test:8443',
+      redirectHostname: 'app.example.test',
+      redirectPort: '8443',
+    });
+    for (const value of [code, state, token, 'user', 'password', 'callback', 'fragment-sentinel']) {
+      assert.equal(serialized.includes(value), false);
+    }
+  });
+
+  it('classifies redirect shapes without retaining raw values', () => {
+    assert.deepEqual(getOauthRedirectDiagnostic('/home/base/authCallback?token=secret'), {
+      redirectKind: 'relative',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('//app.example.test/authCallback?token=secret'), {
+      redirectKind: 'protocol_relative',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('https://[invalid'), {
+      redirectKind: 'invalid',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('javascript:alert(secret)'), {
+      redirectKind: 'non_http',
+      redirectProtocol: 'javascript:',
+    });
+  });
+});

package/vona/src/suite-vendor/a-auth/modules/a-auth/test/oauthRequestContext.test.ts

@@ -0,0 +1,148 @@
+import assert from 'node:assert';
+import { after, before, describe, it } from 'node:test';
+import { acquireTestLock, app } from 'vona-mock';
+
+describe('oauthRequestContext.test.ts', { concurrency: false }, () => {
+  let release: () => void;
+
+  before(async () => {
+    release = await acquireTestLock('a-security');
+  });
+
+  after(() => {
+    release();
+  });
+
+  it('passes the callback request through an isolated context without rewriting it', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const req = {
+        method: 'GET',
+        url: '/api/auth/passport/callback?a=1&b=2',
+        headers: {
+          'host': 'demo.example.test',
+          'user-agent': 'oauth-callback-test',
+        },
+        httpVersionMajor: 1,
+        socket: {
+          encrypted: true,
+          remoteAddress: '192.0.2.10',
+          remotePort: 443,
+        },
+      };
+      const originalUrl = req.url;
+      const originalHeaders = { ...req.headers };
+      const outerContext = app.ctx;
+      const result = await app.bean.executor.newCtx(
+        async () => {
+          return {
+            context: app.ctx,
+            request: app.ctx.req,
+            method: app.ctx.method,
+            host: app.ctx.host,
+            protocol: app.ctx.protocol,
+            secure: app.ctx.secure,
+            query: app.ctx.request.query,
+            userAgent: app.ctx.get('user-agent'),
+          };
+        },
+        {
+          instanceName: outerContext.instanceName!,
+          req,
+        },
+      );
+
+      assert.notEqual(result.context, outerContext);
+      assert.equal(result.request, req);
+      assert.equal(result.method, 'GET');
+      assert.equal(result.host, 'demo.example.test');
+      assert.equal(result.protocol, 'https');
+      assert.equal(result.secure, true);
+      assert.deepEqual(result.query, { a: '1', b: '2' });
+      assert.equal(result.userAgent, 'oauth-callback-test');
+      assert.equal(req.url, originalUrl);
+      assert.deepEqual(req.headers, originalHeaders);
+      assert.equal(app.ctx, outerContext);
+    });
+  });
+
+  it('logs rejected redirects against the effective request origin', async () => {
+    const req = {
+      method: 'GET',
+      url: '/api/auth/passport/callback',
+      headers: {
+        host: 'edge.example.test',
+      },
+      httpVersionMajor: 1,
+      socket: {
+        encrypted: true,
+        remoteAddress: '192.0.2.10',
+        remotePort: 443,
+      },
+    };
+    await app.bean.executor.mockCtx(
+      async () => {
+        assert.equal(app.ctx.host, 'edge.example.test');
+        assert.equal(app.ctx.protocol, 'https');
+        assert.equal(app.util.host, 'edge.example.test');
+        assert.equal(app.util.protocol, 'https');
+
+        const service = app.scope('a-auth').service.auth;
+        const logger = (service as any).$logger;
+        const warnPrevious = logger.warn;
+        const warnings: unknown[][] = [];
+        logger.warn = (...args: unknown[]) => warnings.push(args);
+        try {
+          (service as any)._logOauthRedirectRejected(
+            {
+              id: -1,
+              providerName: 'auth-oauth:oauth',
+              clientName: 'github',
+            },
+            {
+              authProviderId: -1,
+              instanceName: app.ctx.instanceName!,
+              locale: app.ctx.locale,
+              redirect: 'https://redirect.example.test/oauth/callback',
+            },
+            'origin_disallowed',
+          );
+        } finally {
+          logger.warn = warnPrevious;
+        }
+
+        assert.equal(warnings.length, 1);
+        assert.equal(warnings[0][0], 'OAuth callback final redirect rejected');
+        const diagnostic = warnings[0][1] as Record<string, unknown>;
+        assert.deepEqual(
+          {
+            event: diagnostic.event,
+            stage: diagnostic.stage,
+            outcome: diagnostic.outcome,
+            reason: diagnostic.reason,
+            requestHost: diagnostic.requestHost,
+            requestProtocol: diagnostic.requestProtocol,
+            serveHost: diagnostic.serveHost,
+            serveProtocol: diagnostic.serveProtocol,
+            proxyEnabled: diagnostic.proxyEnabled,
+            redirectHost: diagnostic.redirectHost,
+            hostMatches: diagnostic.hostMatches,
+          },
+          {
+            event: 'auth.oauth_final_redirect_rejected',
+            stage: 'redirect_validation',
+            outcome: 'rejected',
+            reason: 'origin_disallowed',
+            requestHost: 'edge.example.test',
+            requestProtocol: 'https',
+            serveHost: null,
+            serveProtocol: null,
+            proxyEnabled: false,
+            redirectHost: 'redirect.example.test',
+            hostMatches: false,
+          },
+        );
+      },
+      { req },
+    );
+  });
+});

package/vona/src/suite-vendor/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-auth",
-  "version": "5.1.27",
+  "version": "5.1.29",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-cabloy/modules/a-socket/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-socket",
-  "version": "5.1.16",
+  "version": "5.1.17",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/modules/a-socket/src/bean/socketConnection.cors.ts

@@ -14,7 +14,7 @@ export interface ISocketConnectionOptionsCors extends IDecoratorSocketConnection
 export class SocketConnectionCors extends BeanBase implements ISocketConnectionExecute {
   async enter(ws: WebSocket, _options: ISocketConnectionOptionsCors, next: Next): Promise<void> {
     // cors
-    const origin = this.bean.security.checkOrigin(this.ctx.get('origin'), this.ctx.host);
+    const origin = this.bean.security.checkOrigin(this.ctx.get('origin'), this.app.util.host);
     if (!origin) {
       ws.terminate();
       return;

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ssr",
-  "version": "5.1.32",
+  "version": "5.1.33",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.56",
+  "version": "5.1.57",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-pay/modules/a-pay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-pay",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/a-pay/src/service/paymentCallback.ts

@@ -88,7 +88,7 @@ export class ServicePaymentCallback extends BeanBase {
 
   private _assertTrustedOrigin() {
     const { protocol, host } = this.app.config.server.serve;
-    if (!protocol || !host) {
+    if (!this.app.meta.isTest && (!protocol || !host)) {
       this.app.throw(503, 'payment callbacks require configured server serve protocol and host');
     }
   }

package/vona/src/suite-vendor/a-pay/modules/pay-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-mock",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/pay-paypal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-paypal",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/pay-stripe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-stripe",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/package.json

@@ -1,15 +1,15 @@
 {
   "name": "vona-suite-a-pay",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "author": "",
   "files": [],
   "type": "module",
   "dependencies": {
-    "vona-module-a-pay": "^5.0.8",
-    "vona-module-pay-mock": "^5.0.8",
-    "vona-module-pay-paypal": "^5.0.8",
-    "vona-module-pay-stripe": "^5.0.8"
+    "vona-module-a-pay": "^5.0.9",
+    "vona-module-pay-mock": "^5.0.9",
+    "vona-module-pay-paypal": "^5.0.9",
+    "vona-module-pay-stripe": "^5.0.9"
   },
   "title": "a-pay"
 }

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.54",
+  "version": "5.1.56",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-core/src/bean/bean.core.ts

@@ -5,23 +5,7 @@ import type { TypeContextFetch } from '../types/fetch.ts';
 
 @Bean()
 export class BeanCore extends BeanBase {
-  get protocol() {
-    return this.app.util.protocol;
-  }
-
-  get host() {
-    return this.app.util.host;
-  }
-
   get fetch(): TypeContextFetch {
     return this.ctx.state.fetch ?? globalThis.fetch;
   }
-
-  getAbsoluteUrl(path?: string) {
-    return this.app.util.getAbsoluteUrl(path);
-  }
-
-  getAbsoluteUrlByApiPath(path: string) {
-    return this.app.util.getAbsoluteUrlByApiPath(path);
-  }
 }

package/vona/src/suite-vendor/a-vona/modules/a-core/src/bean/meta.runtime.ts

@@ -12,8 +12,8 @@ export interface TypeMetaRuntimeResult {
 export class MetaRuntime extends BeanBase implements IMetaRuntimeExecute {
   async execute(): Promise<TypeMetaRuntimeResult> {
     return {
-      protocol: this.bean.core.protocol,
-      host: this.bean.core.host,
+      protocol: this.app.util.protocol,
+      host: this.app.util.host,
     };
   }
 }

package/vona/src/suite-vendor/a-vona/modules/a-ormdialect/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ormdialect",
-  "version": "5.1.17",
+  "version": "5.1.18",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-ormdialect/src/bean/databaseDialect.betterSqlite3.ts

@@ -98,6 +98,7 @@ export class DatabaseDialectBetterSqlite3 extends ServiceDatabaseDialectBase {
 }
 
 async function sqlite3_afterCreate(conn) {
+  conn.pragma('busy_timeout = 5000');
   const pragma: { journal_mode: string }[] = conn.pragma('journal_mode');
   if (pragma[0]?.journal_mode?.toLocaleLowerCase() !== 'wal') {
     conn.pragma('journal_mode = wal');

package/vona/src/suite-vendor/a-vona/modules/a-security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-security",
-  "version": "5.1.13",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-security/src/bean/middlewareSystem.cors.ts

@@ -52,5 +52,5 @@ export class MiddlewareSystemCors extends BeanBase implements IMiddlewareSystemE
 }
 
 function _corsOrigin(ctx: VonaContext) {
-  return ctx.app.bean.security.checkOrigin(ctx.get('origin'), ctx.host);
+  return ctx.app.bean.security.checkOrigin(ctx.get('origin'), ctx.app.util.host);
 }

package/vona/src/suite-vendor/a-vona/modules/a-security/test/origin.test.ts

@@ -1,8 +1,18 @@
 import assert from 'node:assert';
-import { describe, it } from 'node:test';
-import { app } from 'vona-mock';
+import { after, before, describe, it } from 'node:test';
+import { acquireTestLock, app } from 'vona-mock';
 
 describe('origin.test.ts', { concurrency: false }, () => {
+  let release: () => void;
+
+  before(async () => {
+    release = await acquireTestLock('a-security');
+  });
+
+  after(() => {
+    release();
+  });
+
   it('keeps normal CORS separate from exact credential-link authorization', async () => {
     await withWhiteList('*', async () => {
       assert.equal(

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.90",
+  "version": "5.1.92",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/zova/pnpm-lock.yaml

@@ -77,7 +77,7 @@ importers:
         version: 10.6.0(postcss@8.5.28)
       axios:
         specifier: ^1.18.1
-        version: 1.20.0
+        version: 1.20.0(supports-color@10.2.2)
       compression:
         specifier: ^1.8.1
         version: 1.8.2
@@ -369,7 +369,7 @@ importers:
     devDependencies:
       '@cabloy/cli':
         specifier: ^3.1.29
-        version: 3.1.29(vue@3.5.42(typescript@5.9.3))
+        version: 3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))
       '@cabloy/lint':
         specifier: ^5.1.35
         version: 5.1.35(@typescript-eslint/eslint-plugin@8.70.0(@typescript-eslint/parser@8.70.0(eslint@10.10.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@5.9.3))(eslint@10.10.0(jiti@2.7.0))(typescript@5.9.3))(@typescript-eslint/typescript-estree@8.70.0(typescript@5.9.3))(@typescript-eslint/utils@8.70.0(eslint@10.10.0(jiti@2.7.0))(typescript@5.9.3))(eslint@10.10.0(jiti@2.7.0))(oxfmt@0.62.0)(oxlint@1.82.0)(supports-color@10.2.2)(typescript@5.9.3)(vue-eslint-parser@10.4.1(eslint@10.10.0(jiti@2.7.0)))
@@ -444,7 +444,7 @@ importers:
     dependencies:
       '@cabloy/cli':
         specifier: ^3.1.29
-        version: 3.1.29(vue@3.5.42(typescript@5.9.3))
+        version: 3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))
       '@cabloy/process-helper':
         specifier: ^3.1.8
         version: 3.1.8
@@ -455,7 +455,7 @@ importers:
         specifier: ^7.6.2
         version: 7.8.5
       zova-cli-set-front:
-        specifier: ^1.2.108
+        specifier: ^1.2.109
         version: link:../cli-set-front
     devDependencies:
       clean-package:
@@ -478,7 +478,7 @@ importers:
         version: 7.29.7(@babel/core@7.29.7)
       '@cabloy/cli':
         specifier: ^3.1.29
-        version: 3.1.29(vue@3.5.42(typescript@5.9.3))
+        version: 3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))
       '@cabloy/extend':
         specifier: ^3.2.8
         version: 3.2.8
@@ -564,7 +564,7 @@ importers:
         specifier: ^1.1.17
         version: link:../../packages-utils/zova-openapi
       zova-vite:
-        specifier: ^1.1.46
+        specifier: ^1.1.47
         version: link:../../packages-utils/zova-vite
     devDependencies:
       clean-package:
@@ -1204,7 +1204,7 @@ importers:
     dependencies:
       axios:
         specifier: ^1.18.1
-        version: 1.20.0
+        version: 1.20.0(supports-color@10.2.2)
     devDependencies:
       clean-package:
         specifier: ^2.2.0
@@ -1477,7 +1477,7 @@ importers:
     devDependencies:
       '@cabloy/cli':
         specifier: ^3.1.29
-        version: 3.1.29(vue@3.5.42(typescript@5.9.3))
+        version: 3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))
       '@types/luxon':
         specifier: ^3.7.1
         version: 3.7.5
@@ -8851,7 +8851,7 @@ snapshots:
 
   '@bufbuild/protobuf@2.15.0': {}
 
-  '@cabloy/cli@3.1.29(vue@3.5.42(typescript@5.9.3))':
+  '@cabloy/cli@3.1.29(supports-color@10.2.2)(vue@3.5.42(typescript@5.9.3))':
     dependencies:
       '@babel/parser': 7.29.8
       '@cabloy/module-glob': 5.3.18
@@ -8860,7 +8860,7 @@ snapshots:
       '@cabloy/utils': 2.1.27
       '@cabloy/word-utils': link:packages-utils/word-utils
       '@npmcli/config': 10.12.0
-      '@zhennann/common-bin': 4.0.1
+      '@zhennann/common-bin': 4.0.1(supports-color@10.2.2)
       '@zhennann/ejs': 3.0.1
       boxen: 4.2.0
       chalk: 3.0.0
@@ -11048,7 +11048,7 @@ snapshots:
 
   '@vue/shared@3.5.13': {}
 
-  '@zhennann/common-bin@4.0.1':
+  '@zhennann/common-bin@4.0.1(supports-color@10.2.2)':
     dependencies:
       chalk: 4.1.2
       change-case: 4.1.2
@@ -11082,7 +11082,7 @@ snapshots:
 
   acorn@8.18.0: {}
 
-  agent-base@6.0.2:
+  agent-base@6.0.2(supports-color@10.2.2):
     dependencies:
       debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
@@ -11190,11 +11190,11 @@ snapshots:
     dependencies:
       possible-typed-array-names: 1.1.0
 
-  axios@1.20.0:
+  axios@1.20.0(supports-color@10.2.2):
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.6
-      https-proxy-agent: 5.0.1
+      https-proxy-agent: 5.0.1(supports-color@10.2.2)
       proxy-from-env: 2.1.0
     transitivePeerDependencies:
       - debug
@@ -12589,9 +12589,9 @@ snapshots:
       statuses: 2.0.2
       toidentifier: 1.0.1
 
-  https-proxy-agent@5.0.1:
+  https-proxy-agent@5.0.1(supports-color@10.2.2):
     dependencies:
-      agent-base: 6.0.2
+      agent-base: 6.0.2(supports-color@10.2.2)
       debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color