cyberia 3.0.2 → 3.1.3

package/src/proxy.js

@@ -3,14 +3,11 @@
 // https://nodejs.org/api
 // https://expressjs.com/en/4x/api.html
 
-import dotenv from 'dotenv';
 import { loggerFactory } from './server/logger.js';
 import { buildProxy } from './server/proxy.js';
 import { ProcessController } from './server/process.js';
 import { Config } from './server/conf.js';
 
-dotenv.config();
-
 await Config.build(process.argv[2], process.argv[3], process.argv[4]);
 
 const logger = loggerFactory(import.meta);

package/src/runtime/express/Express.js

@@ -165,14 +165,7 @@ class ExpressService {
         });
       }
 
-      // Swagger UI setup
-      if (fs.existsSync(swaggerJsonPath)) {
-        const swaggerDoc = JSON.parse(fs.readFileSync(swaggerJsonPath, 'utf8'));
-        const swaggerUiOptions = await buildSwaggerUiOptions();
-        app.use(swaggerPath, swaggerUi.serve, swaggerUi.setup(swaggerDoc, swaggerUiOptions));
-      }
-
-      // Security and CORS
+      // Security and CORS — must run before swagger-ui so CSP headers are included in swagger responses
       if (process.env.NODE_ENV === 'development' && useLocalSsl)
         origins = origins.map((origin) => origin.replace('http', 'https'));
 
@@ -180,6 +173,13 @@ class ExpressService {
         origin: origins,
       });
 
+      // Swagger UI setup (after security middleware so responses carry correct CSP headers)
+      if (fs.existsSync(swaggerJsonPath)) {
+        const swaggerDoc = JSON.parse(fs.readFileSync(swaggerJsonPath, 'utf8'));
+        const swaggerUiOptions = await buildSwaggerUiOptions();
+        app.use(swaggerPath, swaggerUi.serve, swaggerUi.setup(swaggerDoc, swaggerUiOptions));
+      }
+
       // Database and Valkey connections
       if (db && apis) await DataBaseProvider.load({ apis, host, path, db });
 
@@ -249,7 +249,13 @@ class ExpressService {
     for (const [_, ssrMiddleware] of Object.entries(ssr)) app.use(ssrMiddleware);
 
     // Start listening on the main port
-    if (useLocalSsl && process.env.NODE_ENV === 'development') {
+    // When behind a dev proxy (isDevProxyContext), the proxy handles TLS termination,
+    // so backend servers should listen on plain HTTP to be reachable via http://localhost:PORT
+    if (
+      (useLocalSsl || process.argv.find((arg) => arg === 'tls')) &&
+      process.env.NODE_ENV === 'development' &&
+      !isDevProxyContext()
+    ) {
       if (!Underpost.tls.validateSecureContext()) shellExec(`node bin/deploy tls`);
       const { ServerSSL } = await Underpost.tls.createSslServer(app);
       await Underpost.start.listenPortController(ServerSSL, port, runningData);

package/src/runtime/lampp/Lampp.js

@@ -21,11 +21,11 @@ const logger = loggerFactory(import.meta);
 class LamppService {
   /**
    * @method
-   * @type {string | undefined}
+   * @type {string}
    * @description Stores the accumulated Apache virtual host configuration (router definition).
    * @memberof LamppService
    */
-  router;
+  router = '';
 
   /**
    * @public
@@ -42,7 +42,7 @@ class LamppService {
    * @memberof LamppService
    */
   constructor() {
-    this.router = undefined;
+    this.router = '';
     this.ports = [];
   }
 
@@ -125,7 +125,6 @@ class LamppService {
 
     // 6. Start the service
     cmd = `sudo /opt/lampp/lampp start`;
-    if (this.router) fs.writeFileSync(`./tmp/lampp-router.conf`, this.router, 'utf-8');
     shellExec(cmd);
   }
 
@@ -139,13 +138,7 @@ class LamppService {
    * @memberof LamppService
    */
   appendRouter(render) {
-    if (!this.router) {
-      if (fs.existsSync(`./tmp/lampp-router.conf`)) {
-        this.router = fs.readFileSync(`./tmp/lampp-router.conf`, 'utf-8');
-        return this.router + render;
-      }
-      return (this.router = render);
-    }
+    if (!this.router) return (this.router = render);
     return (this.router += render);
   }
 
@@ -154,10 +147,10 @@ class LamppService {
    *
    * @memberof LamppService
    * @returns {void}
+   * @method removeRouter
    */
   removeRouter() {
-    this.router = undefined;
-    if (fs.existsSync(`./tmp/lampp-router.conf`)) fs.rmSync(`./tmp/lampp-router.conf`);
+    this.router = '';
   }
 
   /**

package/src/server/auth.js

@@ -4,7 +4,6 @@
  * @namespace Auth
  */
 
-import dotenv from 'dotenv';
 import jwt from 'jsonwebtoken';
 import { loggerFactory } from './logger.js';
 import crypto from 'crypto';
@@ -19,7 +18,6 @@ import cookieParser from 'cookie-parser';
 import { DataBaseProvider } from '../db/DataBaseProvider.js';
 import { isDevProxyContext } from './conf.js';
 
-dotenv.config();
 const logger = loggerFactory(import.meta);
 
 // Promisified crypto functions
@@ -349,12 +347,7 @@ const cookieOptionsFactory = (req, host) => {
     secure,
     sameSite,
     path: '/',
-    domain:
-      process.env.NODE_ENV === 'production' ||
-      isDevProxyContext() ||
-      (req.headers.host && req.headers.host.toLocaleLowerCase().match(host))
-        ? host
-        : 'localhost',
+    domain: process.env.NODE_ENV === 'production' || isDevProxyContext() ? host : 'localhost',
     maxAge,
   };
 
@@ -389,7 +382,11 @@ async function createSessionAndUserToken(user, User, req, res, options = { host:
   };
 
   // push session
-  const updatedUser = await User.findByIdAndUpdate(user._id, { $push: { activeSessions: newSession } }, { new: true });
+  const updatedUser = await User.findByIdAndUpdate(
+    user._id,
+    { $push: { activeSessions: newSession } },
+    { returnDocument: 'after' },
+  );
   const session = updatedUser.activeSessions[updatedUser.activeSessions.length - 1];
   const jwtid = session._id.toString();
 
@@ -616,13 +613,13 @@ function applySecurity(app, opts = {}) {
         frameAncestors: frameAncestors,
         imgSrc: ["'self'", 'data:', httpDirective, 'https:', 'blob:'],
         objectSrc: ["'none'"],
-        // script-src and script-src-elem include dynamic nonce
-        scriptSrc: [
+        // script-src and script-src-elem: use 'unsafe-inline' for swagger (no nonce, otherwise
+        // the nonce causes 'unsafe-inline' to be ignored per CSP3 spec), nonce for everything else.
+        scriptSrc: ["'self'", (req, res) => (res.locals.isSwagger ? "'unsafe-inline'" : `'nonce-${res.locals.nonce}'`)],
+        scriptSrcElem: [
           "'self'",
-          (req, res) => `'nonce-${res.locals.nonce}'`,
-          (req, res) => (res.locals.isSwagger ? "'unsafe-inline'" : ''),
+          (req, res) => (res.locals.isSwagger ? "'unsafe-inline'" : `'nonce-${res.locals.nonce}'`),
         ],
-        scriptSrcElem: ["'self'", (req, res) => `'nonce-${res.locals.nonce}'`],
         // style-src: avoid 'unsafe-inline' when possible; if you must inline styles,
         // use a nonce for them too (or hash).
         styleSrc: [
@@ -630,6 +627,7 @@ function applySecurity(app, opts = {}) {
           httpDirective,
           (req, res) => (res.locals.isSwagger ? "'unsafe-inline'" : `'nonce-${res.locals.nonce}'`),
         ],
+        styleSrcAttr: [(req, res) => (res.locals.isSwagger ? "'unsafe-inline'" : "'none'")],
         // deny plugins
         objectSrc: ["'none'"],
       },

package/src/server/backup.js

@@ -7,10 +7,8 @@
 import fs from 'fs-extra';
 import { loggerFactory } from './logger.js';
 import { shellExec } from './process.js';
-import dotenv from 'dotenv';
 import Underpost from '../index.js';
-
-dotenv.config();
+import { loadCronDeployEnv } from './conf.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -33,6 +31,7 @@ class BackUp {
    * @memberof UnderpostBakcUp
    */
   static callback = async function (deployList, options = { git: false }) {
+    loadCronDeployEnv();
     if ((!deployList || deployList === 'dd') && fs.existsSync(`./engine-private/deploy/dd.router`))
       deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8').trim();