create-ailk 0.11.1 → 0.11.3

package/templates/apps/api/src/config/index.ts

@@ -17,6 +17,16 @@ export interface Config {
   PORT: number;
   FRONTEND_URL: string;
 
+  // The browser origins this API trusts (#7395) — the one list CORS, the
+  // cookie-forwarded write check (middleware/auth.ts) and the checkout
+  // redirect lock (routes/checkout/sessions.ts) all read. Resolved once, at
+  // startup, by resolveTrustedOrigins() below from FRONTEND_URL's origin plus
+  // the opt-in AILK_TRUSTED_ORIGINS (a comma-separated list of exact origins,
+  // for a hub that serves its Admin app and spoke sites). Frozen; no request
+  // input can add to it, and no entry can be `*` or a wildcard host.
+  TRUSTED_ORIGINS: readonly string[];
+  AILK_TRUSTED_ORIGINS?: string;
+
   // Local Database (for auth: User, Session, ApiToken, etc.). Required in
   // production; unset elsewhere starts the API database-less (#6482).
   DATABASE_URL?: string;
@@ -94,6 +104,103 @@ export interface Config {
   CAL_WEBHOOK_SECRET?: string;
 }
 
+/** Why an AILK_TRUSTED_ORIGINS entry was refused (#7395 D2). */
+export type TrustedOriginRefusal =
+  | 'wildcard'
+  | 'unparseable'
+  | 'scheme'
+  | 'not-canonical'
+  | 'trailing-dot';
+
+/** The zero-config development origin (`apps/web`'s `pnpm dev`). */
+const DEV_FRONTEND_ORIGIN = 'http://localhost:3000';
+
+/** `FRONTEND_URL`'s origin, or null when it is unusable as one (#7395 D2). */
+function primaryOrigin(raw: string): string | null {
+  // A comma means a list was put in the wrong variable:
+  // new URL('https://a.example,https://b.example').origin is 'https://a.example,https'.
+  if (raw.includes('*') || raw.includes(',')) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return null;
+  // WHATWG decodes a percent-encoded host: `https://%2A.example.com` has origin
+  // `https://*.example.com`, which the raw-string check above cannot see.
+  if (parsed.origin.includes('*')) return null;
+  return parsed.origin;
+}
+
+/** Why one AILK_TRUSTED_ORIGINS entry is refused, or null when it is an exact origin. */
+function refuseExtra(entry: string, nodeEnv: Config['NODE_ENV']): TrustedOriginRefusal | null {
+  // WHATWG parses `https://*.example.com` and keeps it as its own origin, so
+  // the wildcard is refused by name, before the parse (spec § 1.3).
+  if (entry.includes('*')) return 'wildcard';
+  let parsed: URL;
+  try {
+    parsed = new URL(entry);
+  } catch {
+    return 'unparseable';
+  }
+  if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && nodeEnv !== 'production')) {
+    return 'scheme';
+  }
+  // Written exactly as a browser serialises an Origin header: lower-case
+  // punycode host, no default port, path, trailing slash or userinfo.
+  if (entry !== parsed.origin) return 'not-canonical';
+  // `https://a.example.` is a different origin from `https://a.example`.
+  if (parsed.hostname.endsWith('.')) return 'trailing-dot';
+  return null;
+}
+
+/**
+ * The trusted browser-origin allowlist (#7395 D2). Pure; `validateConfig()`
+ * calls it once.
+ *
+ * - `FRONTEND_URL` is normalised to its origin, as the checkout lock always
+ *   did; unset outside production it is the dev default. Unset in production,
+ *   or unusable (unparseable, not http(s), or containing `*` or `,`), it
+ *   contributes nothing, and `primaryUnusable` reports the latter.
+ * - `AILK_TRUSTED_ORIGINS` entries must already be exact origins, https-only in
+ *   production. A refused entry is reported by 1-based position and reason —
+ *   never its text, which may carry userinfo or a misplaced secret.
+ *
+ * The result is de-duplicated in first-seen order and frozen.
+ */
+export function resolveTrustedOrigins(env: {
+  FRONTEND_URL?: string | undefined;
+  AILK_TRUSTED_ORIGINS?: string | undefined;
+  NODE_ENV: Config['NODE_ENV'];
+}): {
+  origins: readonly string[];
+  refused: { position: number; reason: TrustedOriginRefusal }[];
+  primaryUnusable: boolean;
+} {
+  const origins: string[] = [];
+  const refused: { position: number; reason: TrustedOriginRefusal }[] = [];
+  let primaryUnusable = false;
+
+  if (env.FRONTEND_URL) {
+    const primary = primaryOrigin(env.FRONTEND_URL);
+    if (primary === null) primaryUnusable = true;
+    else origins.push(primary);
+  } else if (env.NODE_ENV !== 'production') {
+    origins.push(DEV_FRONTEND_ORIGIN);
+  }
+
+  (env.AILK_TRUSTED_ORIGINS ?? '').split(',').forEach((piece, index) => {
+    const entry = piece.trim();
+    if (!entry) return;
+    const reason = refuseExtra(entry, env.NODE_ENV);
+    if (reason !== null) refused.push({ position: index + 1, reason });
+    else origins.push(entry);
+  });
+
+  return { origins: Object.freeze([...new Set(origins)]), refused, primaryUnusable };
+}
+
 /** Enabled modules whose state lives in the database (see validateConfig). */
 const DATABASE_MODULES = [
   'commerce',
@@ -135,10 +242,39 @@ function validateConfig(): Config {
     );
   }
 
+  // #7395 D3 — a refused AILK_TRUSTED_ORIGINS entry stops the API in every
+  // environment: the variable is opt-in, and an entry dropped silently would
+  // resurface as the very 401 it was added to fix. Position and reason only,
+  // never the entry's text. console.error too, because pino-pretty's worker
+  // transport can drop the last line written before exit.
+  const trusted = resolveTrustedOrigins({
+    FRONTEND_URL: process.env.FRONTEND_URL,
+    AILK_TRUSTED_ORIGINS: process.env.AILK_TRUSTED_ORIGINS,
+    NODE_ENV: nodeEnv,
+  });
+  if (trusted.refused.length > 0) {
+    const message =
+      '❌ AILK_TRUSTED_ORIGINS has entries that are not exact http(s) origins (https only in production; no `*`, path, trailing slash or userinfo)';
+    logger.error({ refused: trusted.refused }, message);
+    console.error(message, JSON.stringify({ refused: trusted.refused }));
+    process.exit(1);
+  }
+  // #7395 D5 — a set-but-unusable FRONTEND_URL predates this list, so it is
+  // logged rather than fatal. The value is never echoed.
+  if (trusted.primaryUnusable) {
+    logger.error(
+      "FRONTEND_URL is set but is not an absolute http(s) URL without '*' or ',' — it is not a trusted origin",
+    );
+  }
+
   return {
     NODE_ENV: nodeEnv,
     PORT: parseInt(process.env.PORT || '3002', 10),
     FRONTEND_URL: process.env.FRONTEND_URL || 'http://localhost:3000',
+    TRUSTED_ORIGINS: trusted.origins,
+    ...(process.env.AILK_TRUSTED_ORIGINS !== undefined && {
+      AILK_TRUSTED_ORIGINS: process.env.AILK_TRUSTED_ORIGINS,
+    }),
 
     ...(process.env.DATABASE_URL !== undefined && {
       DATABASE_URL: process.env.DATABASE_URL,

package/templates/apps/api/src/lib/auth-email-budget.ts

@@ -34,11 +34,12 @@ import { createHash } from "node:crypto";
 
 import { getClock } from "@working-theory/common";
 
-/** The three fixed message kinds the relay will send. */
+/** The four fixed message kinds the relay will send. */
 export type AuthEmailKind =
   | "password-reset"
   | "email-verification"
-  | "password-changed";
+  | "password-changed"
+  | "magic-link";
 
 /** Sends allowed per (recipient, kind) per hour. */
 export const RECIPIENT_HOURLY_MAX = 3;

package/templates/apps/api/src/middleware/__tests__/adversarial/bearer-token-format.test.ts

@@ -37,7 +37,7 @@ import { authPreHandlerPlugin } from "../../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/cookie-or-bearer-precedence.test.ts

@@ -38,7 +38,7 @@ const BEARER = "tok_live_xyz";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-bearer-skip.test.ts

@@ -33,7 +33,7 @@ const BEARER = "tok_live_abc";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;
 }

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-cookie-path.test.ts

@@ -35,7 +35,7 @@ const COOKIE_NAME = "better-auth.session_token";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   // HEAD is auto-registered by Fastify when GET is declared; no explicit handler needed.
@@ -72,7 +72,7 @@ describe("S13 adversarial — CSRF on cookie path", () => {
     expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
   });
 
-  it("rejects POST when Origin scheme differs from the configured frontendOrigin", async () => {
+  it("rejects POST when Origin scheme differs from the configured trusted origin", async () => {
     app = buildApp();
     await app.ready();
 

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-trusted-origins.test.ts

@@ -0,0 +1,142 @@
+/**
+ * @file csrf-trusted-origins.test.ts (#7395 AC-3)
+ *
+ * The cookie path's CSRF check against a multi-origin allowlist. A spoke site
+ * forwards the visitor's cookie and the browser's real `Origin` to the hub
+ * API, so a write is accepted iff that `Origin` is EXACTLY one of the
+ * configured trusted origins — never a prefix, a suffix or the first entry
+ * alone — and an empty list refuses every cookie write in every environment
+ * (the dev fail-open is gone, spec D4/D6.2). The non-rejecting resolver the
+ * checkout route uses applies the same check (#6866 D2).
+ */
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin, resolveOptionalCookieUser } from "../../auth.js";
+
+const HUB = "https://hub.example";
+const SPOKE_A = "https://spoke-a.example";
+const TRUSTED = [HUB, SPOKE_A];
+const COOKIE = "better-auth.session_token=sess_tok_abc";
+
+function buildApp(trustedOrigins: readonly string[]): FastifyInstance {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { trustedOrigins });
+  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
+  return app;
+}
+
+function buildResolverApp(trustedOrigins: readonly string[]): FastifyInstance {
+  const app = Fastify();
+  app.post("/resolve", async (req) =>
+    resolveOptionalCookieUser(req, { trustedOrigins }),
+  );
+  return app;
+}
+
+function post(app: FastifyInstance, url: string, origin?: string) {
+  return app.inject({
+    method: "POST",
+    url,
+    headers: { cookie: COOKIE, ...(origin !== undefined && { origin }) },
+  });
+}
+
+describe("#7395 — cookie-path CSRF against the trusted-origin allowlist", () => {
+  const originalNodeEnv = process.env.NODE_ENV;
+  const originalDatabaseUrl = process.env.DATABASE_URL;
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      id: "ses_1",
+      userId: "usr_42",
+      expiresAt: new Date(Date.now() + 60_000),
+      activeOrganizationId: null,
+      activeWorkspaceId: null,
+    });
+  });
+
+  afterEach(async () => {
+    await app.close();
+    if (originalNodeEnv === undefined) delete process.env.NODE_ENV;
+    else process.env.NODE_ENV = originalNodeEnv;
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = originalDatabaseUrl;
+  });
+
+  it.each([HUB, SPOKE_A])(
+    "accepts a cookie POST from the listed origin %s",
+    async (origin) => {
+      app = buildApp(TRUSTED);
+      await app.ready();
+
+      const res = await post(app, "/echo", origin);
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json()).toEqual({ userId: "usr_42" });
+    },
+  );
+
+  it.each([
+    ["an unlisted spoke", "https://spoke-b.example"],
+    ["a listed origin as a host prefix", "https://spoke-a.example.evil.test"],
+    ["an opaque origin", "null"],
+    ["a case variant of a listed origin", "HTTPS://HUB.EXAMPLE"],
+    ["a listed origin with a trailing slash", "https://hub.example/"],
+    ["a listed origin with its default port", "https://hub.example:443"],
+    ["a missing Origin", undefined],
+  ])("refuses a cookie POST from %s with 401", async (_label, origin) => {
+    app = buildApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/echo", origin);
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: "unauthorized" });
+  });
+
+  it("refuses every cookie POST with an empty list, even in development", async () => {
+    process.env.NODE_ENV = "development";
+    app = buildApp([]);
+    await app.ready();
+
+    const res = await post(app, "/echo", HUB);
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: "unauthorized" });
+  });
+
+  it("resolveOptionalCookieUser returns the user for a listed spoke", async () => {
+    app = buildResolverApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/resolve", SPOKE_A);
+
+    expect(res.json()).toEqual({ kind: "user", userId: "usr_42" });
+  });
+
+  it("resolveOptionalCookieUser returns none/cross_origin for an unlisted spoke", async () => {
+    app = buildResolverApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/resolve", "https://spoke-b.example");
+
+    expect(res.json()).toEqual({ kind: "none", reason: "cross_origin" });
+  });
+});

package/templates/apps/api/src/middleware/__tests__/adversarial/session-fixation.test.ts

@@ -40,7 +40,7 @@ const COOKIE_NAME = "better-auth.session_token";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/session-timeout.test.ts

@@ -46,7 +46,7 @@ let CURRENT_TIME = 1_000_000_000_000;
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.bearer-path.test.ts

@@ -37,7 +37,7 @@ const BEARER_HASH = createHash("sha256").update(BEARER).digest("hex");
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.both-present-precedence.test.ts

@@ -27,7 +27,7 @@ import { authPreHandlerPlugin } from "../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.cookie-path.test.ts

@@ -33,7 +33,7 @@ const FRONTEND = "https://app.example.com";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.database-not-configured.test.ts

@@ -31,7 +31,7 @@ const echoHandler = jest.fn(async () => ({ ok: true }));
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", echoHandler);
   app.post("/echo", echoHandler);

package/templates/apps/api/src/middleware/__tests__/auth.neither-present.test.ts

@@ -27,7 +27,7 @@ import { authPreHandlerPlugin } from "../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async () => ({ ok: true }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.optional-cookie.test.ts

@@ -28,7 +28,7 @@ const COOKIE = "better-auth.session_token=sess_tok_abc.signature";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.post("/resolve", async (req) =>
-    resolveOptionalCookieUser(req, { frontendOrigin: FRONTEND }),
+    resolveOptionalCookieUser(req, { trustedOrigins: [FRONTEND] }),
   );
   return app;
 }