jskelet 0.5.3 → 0.5.5

package/src/http/shared-cookie.js

@@ -0,0 +1,178 @@
+/**
+ * Alt alan adları arasında paylaşılan cookie yazma.
+ *
+ * `Secure` protokole bakılır (`https` / `x-forwarded-proto`), `NODE_ENV`'e değil —
+ * yerel https veya prod http yanlış bayrak üretmesin.
+ *
+ * Domain `brand.sharedCookieRoots` ile seçilir. Eşleşme yoksa ya da değer çok
+ * büyükse `{ ok: false, handoff: true }` döner; çağıran handoff yoluna düşer.
+ *
+ * JWT'yi paylaşımlı cookie'ye koymayın: kısa session id koyun.
+ */
+import { getConfig } from "../config/index.js";
+import {
+  SHARED_COOKIE_WARN_BYTES,
+  resolveSharedCookieDomain,
+  stripHostPort,
+} from "../shared/cookie-domain.js";
+import { clearCookie, setCookie } from "./cookies.js";
+
+export {
+  SHARED_COOKIE_WARN_BYTES,
+  resolveSharedCookieDomain,
+  stripHostPort,
+} from "../shared/cookie-domain.js";
+
+/**
+ * @param {{ secure?: boolean, protocol?: string,
+ *   headers?: Record<string, unknown>, get?: (name: string) => string | undefined }} [req]
+ * @returns {boolean}
+ */
+export function requestIsHttps(req) {
+  if (!req) return false;
+  if (req.secure === true) return true;
+  if (typeof req.protocol === "string" && req.protocol === "https") return true;
+
+  const forwarded =
+    req.get?.("x-forwarded-proto") ??
+    (typeof req.headers?.["x-forwarded-proto"] === "string"
+      ? req.headers["x-forwarded-proto"]
+      : Array.isArray(req.headers?.["x-forwarded-proto"])
+        ? req.headers["x-forwarded-proto"][0]
+        : "");
+  const first = String(forwarded ?? "")
+    .split(",")[0]
+    .trim()
+    .toLowerCase();
+  return first === "https";
+}
+
+/**
+ * @param {{ headers?: Record<string, unknown>, get?: (name: string) => string | undefined,
+ *   hostname?: string }} [req]
+ * @returns {string}
+ */
+function hostFromReq(req) {
+  if (!req) return "";
+  const forwarded =
+    req.get?.("x-forwarded-host") ??
+    (typeof req.headers?.["x-forwarded-host"] === "string"
+      ? req.headers["x-forwarded-host"]
+      : "");
+  const raw =
+    forwarded ||
+    req.get?.("host") ||
+    (typeof req.headers?.host === "string" ? req.headers.host : "") ||
+    (typeof req.hostname === "string" ? req.hostname : "");
+  return stripHostPort(String(raw).split(",")[0]);
+}
+
+/**
+ * @returns {string[]}
+ */
+function configuredRoots() {
+  try {
+    const roots = getConfig().brand?.sharedCookieRoots;
+    return Array.isArray(roots) ? roots.map(String) : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * @typedef {import('./cookies.js').CookieOptions} CookieOptions
+ *
+ * @typedef {object} SharedCookieResult
+ * @property {boolean} ok Domain seçildi ve Set-Cookie yazıldı.
+ * @property {string | null} domain Yazılan Domain ya da null.
+ * @property {boolean} handoff ok değilse çağıran handoff denemeli.
+ * @property {string} [reason] Teşhis.
+ */
+
+/**
+ * Paylaşımlı Domain ile cookie yazar.
+ *
+ * @param {import('http').ServerResponse & { req?: import('http').IncomingMessage }} res
+ * @param {string} name
+ * @param {string} value Kısa session id — JWT değil.
+ * @param {CookieOptions & { req?: import('http').IncomingMessage, roots?: string[],
+ *   host?: string }} [options]
+ * @returns {SharedCookieResult}
+ */
+export function writeSharedCookie(res, name, value, options = {}) {
+  const { req: optReq, roots: optRoots, host: optHost, ...cookieOpts } = options;
+  const req = optReq ?? /** @type {{ req?: import('http').IncomingMessage }} */ (res).req;
+  const roots = optRoots ?? configuredRoots();
+  const host = optHost ? stripHostPort(optHost) : hostFromReq(req);
+  const domain = resolveSharedCookieDomain(host, roots);
+
+  if (!domain) {
+    return {
+      ok: false,
+      domain: null,
+      handoff: true,
+      reason: "no-matching-root",
+    };
+  }
+
+  const text = String(value ?? "");
+  if (Buffer.byteLength(text, "utf8") > SHARED_COOKIE_WARN_BYTES) {
+    console.warn(
+      `[cookies] shared cookie "${name}" is ${Buffer.byteLength(text, "utf8")} bytes; ` +
+        `prefer a short session id (≤${SHARED_COOKIE_WARN_BYTES}). Large tokens do not belong in shared cookies.`,
+    );
+    return {
+      ok: false,
+      domain,
+      handoff: true,
+      reason: "value-too-large",
+    };
+  }
+
+  const secure = cookieOpts.secure ?? requestIsHttps(req);
+
+  setCookie(res, name, text, {
+    ...cookieOpts,
+    domain,
+    secure,
+    // Paylaşımlı oturum kimliği JS'ye gerekmez; HttpOnly kalsın.
+    httpOnly: cookieOpts.httpOnly !== false,
+    sameSite: cookieOpts.sameSite ?? "Lax",
+    path: cookieOpts.path ?? "/",
+  });
+
+  // Sunucuda document.cookie read-back yok; Domain seçildiyse yazım başarılı sayılır.
+  // İstemci `writeSharedCookie` read-back yapar; başarısızsa handoff'a düşer.
+  return { ok: true, domain, handoff: false };
+}
+
+/**
+ * Aynı Domain ile cookie siler.
+ *
+ * @param {import('http').ServerResponse & { req?: import('http').IncomingMessage }} res
+ * @param {string} name
+ * @param {CookieOptions & { req?: import('http').IncomingMessage, roots?: string[],
+ *   host?: string }} [options]
+ * @returns {SharedCookieResult}
+ */
+export function clearSharedCookie(res, name, options = {}) {
+  const { req: optReq, roots: optRoots, host: optHost, ...cookieOpts } = options;
+  const req = optReq ?? /** @type {{ req?: import('http').IncomingMessage }} */ (res).req;
+  const roots = optRoots ?? configuredRoots();
+  const host = optHost ? stripHostPort(optHost) : hostFromReq(req);
+  const domain = resolveSharedCookieDomain(host, roots);
+
+  if (!domain) {
+    return { ok: false, domain: null, handoff: false, reason: "no-matching-root" };
+  }
+
+  const secure = cookieOpts.secure ?? requestIsHttps(req);
+  clearCookie(res, name, {
+    ...cookieOpts,
+    domain,
+    secure,
+    path: cookieOpts.path ?? "/",
+  });
+
+  return { ok: true, domain, handoff: false };
+}

package/src/index.js

@@ -35,6 +35,13 @@ export {
   setCookie,
   setSignedCookie,
 } from "./http/cookies.js";
+export {
+  clearSharedCookie,
+  requestIsHttps,
+  resolveSharedCookieDomain,
+  SHARED_COOKIE_WARN_BYTES,
+  writeSharedCookie,
+} from "./http/shared-cookie.js";
 export { reportUpstreamFailure } from "./server/upstream-tracking.js";
 export { asset, hasAsset, optimizedImage, getSpriteIds } from "./server/assets.js";
 export { remoteImageUrl, parseAllowedRemoteUrl } from "./server/image-optimizer.js";

package/src/server/auth/handoff.js

@@ -0,0 +1,226 @@
+/**
+ * Alt alan adı handoff: kısa ömürlü tek kullanımlık bilet.
+ *
+ * Akış:
+ *   1. Paylaşımlı cookie yazımı başarısız (istemci read-back fail)
+ *   2. POST /_jskelet/auth/handoff { name, value, next }
+ *   3. Yanıt { url: "https://tr.…/path?handoff=TICKET" }
+ *   4. Hedef host'ta GET middleware bileti tüketir → Set-Cookie + 303
+ *
+ * Bilet süreç belleğinde; tek süreçte tüm locale host'ları servis eden
+ * kurulumlar için yeterli. Değer kısa session id olmalı.
+ */
+import { getConfig } from "../../config/index.js";
+import { randomToken, setCookie } from "../../http/cookies.js";
+import {
+  SHARED_COOKIE_WARN_BYTES,
+  requestIsHttps,
+  writeSharedCookie,
+} from "../../http/shared-cookie.js";
+import { resolveSharedCookieDomain } from "../../shared/cookie-domain.js";
+
+/** @type {Map<string, { name: string, value: string, maxAge?: number, exp: number }>} */
+const tickets = new Map();
+
+const DEFAULT_TTL_SECONDS = 60;
+const HANDOFF_PATH = "/_jskelet/auth/handoff";
+
+/**
+ * @returns {{ enabled: boolean, ttlSeconds: number, path: string, maxValueBytes: number }}
+ */
+function settings() {
+  const auth = getConfig().auth ?? {};
+  const raw = auth.crossSubdomainHandoff;
+  if (raw === false || raw == null) {
+    return {
+      enabled: false,
+      ttlSeconds: DEFAULT_TTL_SECONDS,
+      path: HANDOFF_PATH,
+      maxValueBytes: SHARED_COOKIE_WARN_BYTES,
+    };
+  }
+
+  if (raw === true) {
+    return {
+      enabled: true,
+      ttlSeconds: DEFAULT_TTL_SECONDS,
+      path: HANDOFF_PATH,
+      maxValueBytes: SHARED_COOKIE_WARN_BYTES,
+    };
+  }
+
+  const source = /** @type {Record<string, unknown>} */ (raw);
+  const ttl = Number(source.ttlSeconds);
+  const maxBytes = Number(source.maxValueBytes);
+  return {
+    enabled: source.enabled !== false,
+    ttlSeconds:
+      Number.isFinite(ttl) && ttl > 0 ? Math.min(300, Math.floor(ttl)) : DEFAULT_TTL_SECONDS,
+    path:
+      typeof source.path === "string" && source.path.startsWith("/")
+        ? source.path
+        : HANDOFF_PATH,
+    maxValueBytes:
+      Number.isFinite(maxBytes) && maxBytes > 0
+        ? Math.floor(maxBytes)
+        : SHARED_COOKIE_WARN_BYTES,
+  };
+}
+
+function sweep() {
+  const now = Date.now();
+  for (const [id, entry] of tickets) {
+    if (entry.exp <= now) tickets.delete(id);
+  }
+}
+
+/**
+ * @param {string} next
+ * @param {import('express').Request} req
+ * @returns {URL | null}
+ */
+function parseNext(next, req) {
+  try {
+    return new URL(next, `${req.protocol}://${req.get("host")}`);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {URL} url
+ * @param {import('express').Request} req
+ * @returns {boolean}
+ */
+function nextAllowed(url, req) {
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+
+  const roots = getConfig().brand?.sharedCookieRoots ?? [];
+  const targetHost = url.hostname.toLowerCase();
+  const sourceHost = String(req.hostname || "")
+    .toLowerCase()
+    .replace(/:\d+$/, "");
+
+  if (targetHost === sourceHost) return true;
+
+  const sourceRoot = resolveSharedCookieDomain(sourceHost, roots);
+  const targetRoot = resolveSharedCookieDomain(targetHost, roots);
+  return Boolean(sourceRoot && targetRoot && sourceRoot === targetRoot);
+}
+
+/**
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {{ name: string, value: string, maxAge?: number }} payload
+ * @returns {void}
+ */
+function issueCookie(req, res, payload) {
+  const shared = writeSharedCookie(res, payload.name, payload.value, {
+    req,
+    maxAge: payload.maxAge,
+  });
+
+  if (shared.ok) return;
+
+  setCookie(res, payload.name, payload.value, {
+    path: "/",
+    httpOnly: true,
+    sameSite: "Lax",
+    secure: requestIsHttps(req),
+    maxAge: payload.maxAge,
+  });
+}
+
+/**
+ * @param {string} ticketId
+ * @returns {{ name: string, value: string, maxAge?: number } | null}
+ */
+function redeem(ticketId) {
+  sweep();
+  const entry = tickets.get(ticketId);
+  if (!entry) return null;
+  tickets.delete(ticketId);
+  if (entry.exp <= Date.now()) return null;
+  return { name: entry.name, value: entry.value, maxAge: entry.maxAge };
+}
+
+/**
+ * Handoff uçlarını mount eder. `auth.crossSubdomainHandoff` kapalıysa no-op.
+ *
+ * @param {import('express').Express} app
+ * @returns {void}
+ */
+export function mountAuthHandoff(app) {
+  const cfg = settings();
+  if (!cfg.enabled) return;
+
+  app.post(cfg.path, (req, res) => {
+    sweep();
+
+    const name = typeof req.body?.name === "string" ? req.body.name.trim() : "";
+    const value = typeof req.body?.value === "string" ? req.body.value : "";
+    const next = typeof req.body?.next === "string" ? req.body.next.trim() : "";
+    const maxAge =
+      req.body?.maxAge != null && Number.isFinite(Number(req.body.maxAge))
+        ? Math.floor(Number(req.body.maxAge))
+        : undefined;
+
+    if (!name || !next) {
+      res.status(400).json({ ok: false, error: "name and next are required" });
+      return;
+    }
+
+    if (Buffer.byteLength(value, "utf8") > cfg.maxValueBytes) {
+      res.status(400).json({
+        ok: false,
+        error: `value exceeds ${cfg.maxValueBytes} bytes; use a short session id`,
+      });
+      return;
+    }
+
+    const nextUrl = parseNext(next, req);
+    if (!nextUrl || !nextAllowed(nextUrl, req)) {
+      res.status(400).json({ ok: false, error: "next is not an allowed URL" });
+      return;
+    }
+
+    const id = randomToken(24);
+    tickets.set(id, {
+      name,
+      value,
+      maxAge,
+      exp: Date.now() + cfg.ttlSeconds * 1000,
+    });
+
+    nextUrl.searchParams.set("handoff", id);
+    res.setHeader("Cache-Control", "no-store");
+    res.json({ ok: true, url: nextUrl.href });
+  });
+
+  // Hedef host'ta `?handoff=` yakala — route render'ından önce.
+  app.use((req, res, next) => {
+    if (req.method !== "GET" && req.method !== "HEAD") return next();
+    const ticket = typeof req.query?.handoff === "string" ? req.query.handoff : "";
+    if (!ticket) return next();
+
+    const payload = redeem(ticket);
+    if (!payload) return next();
+
+    issueCookie(req, res, payload);
+
+    const url = new URL(req.originalUrl || req.url, `${req.protocol}://${req.get("host")}`);
+    url.searchParams.delete("handoff");
+    res.setHeader("Cache-Control", "no-store");
+    res.redirect(303, url.pathname + url.search + url.hash);
+  });
+}
+
+/** @returns {void} */
+export function _resetHandoffTickets() {
+  tickets.clear();
+}
+
+/** @returns {number} */
+export function _handoffTicketCount() {
+  return tickets.size;
+}

package/src/server/create-app.js

@@ -21,6 +21,9 @@
  *      body parser'dan önce, admin ile aynı katmanda.
  *   5. body parser'lar — statikten sonra: görsel isteklerinde gövde ayrıştırma
  *      maliyeti ödenmesin.
+ *   5b. auth handoff (açıksa) — POST bilet + `?handoff=` redeem; csrf'den
+ *      önce değil sonra: JSON gövde parser'ı hazır olsun. Redeem GET route
+ *      render'ından önce olmalı.
  *   6. csrf — body parser'lardan sonra olmalı: token form alanından okunuyor.
  *      Rewrite'lardan önce, çünkü kontrol istemcinin gördüğü yola bakar.
  *   7. rewrites(afterFiles) — statik denendikten sonra, sayfalardan önce.
@@ -149,6 +152,17 @@ export async function createApp(options = {}) {
   app.use(express.urlencoded({ extended: false, limit: "64kb" }));
   app.use(express.json({ limit: "256kb" }));
 
+  const handoff = config.auth?.crossSubdomainHandoff;
+  if (
+    handoff === true ||
+    (handoff &&
+      typeof handoff === "object" &&
+      /** @type {{ enabled?: boolean }} */ (handoff).enabled !== false)
+  ) {
+    const { mountAuthHandoff } = await import("./auth/handoff.js");
+    mountAuthHandoff(app);
+  }
+
   app.use(csrf());
 
   app.use(configRewrites("afterFiles"));

package/src/shared/cookie-domain.js

@@ -0,0 +1,66 @@
+/**
+ * Paylaşımlı cookie Domain seçimi — sunucu ve istemci aynı kuralları kullanır.
+ *
+ * `brand.sharedCookieRoots` örn. `[".investvio.com", ".localhost"]`.
+ * Host bu köklerden birine uyuyorsa Domain olarak o kök yazılır.
+ */
+
+/**
+ * @param {string} host Host veya Host:port.
+ * @returns {string} Lowercase, portsuz.
+ */
+export function stripHostPort(host) {
+  const raw = String(host ?? "")
+    .split(",")[0]
+    .trim()
+    .toLowerCase();
+  if (!raw) return "";
+  if (raw.startsWith("[")) {
+    const end = raw.indexOf("]");
+    return end === -1 ? raw : raw.slice(0, end + 1);
+  }
+  const colon = raw.lastIndexOf(":");
+  if (colon === -1) return raw;
+  if (raw.indexOf(":") !== colon) return raw;
+  return raw.slice(0, colon);
+}
+
+/**
+ * Kökü `Domain=` biçimine getirir (başında nokta).
+ *
+ * @param {unknown} root
+ * @returns {string | null}
+ */
+export function normalizeCookieRoot(root) {
+  if (typeof root !== "string") return null;
+  const trimmed = root.trim().toLowerCase();
+  if (!trimmed || trimmed === ".") return null;
+  const bare = trimmed.replace(/^\./, "");
+  if (!bare || bare.includes("/") || bare.includes(":")) return null;
+  return `.${bare}`;
+}
+
+/**
+ * @param {string} hostname Portsuz hostname.
+ * @param {Iterable<string>} roots `brand.sharedCookieRoots`.
+ * @returns {string | null} `Domain` değeri (başında nokta) ya da eşleşme yoksa null.
+ */
+export function resolveSharedCookieDomain(hostname, roots) {
+  const host = stripHostPort(hostname);
+  if (!host) return null;
+
+  for (const entry of roots ?? []) {
+    const root = normalizeCookieRoot(entry);
+    if (!root) continue;
+    const bare = root.slice(1);
+    if (host === bare || host.endsWith(`.${bare}`)) return root;
+  }
+
+  return null;
+}
+
+/**
+ * Paylaşımlı cookie için önerilen üst sınır. JWT / büyük token buraya
+ * sığmaz — kısa session id koyun; aksi halde handoff veya host-only cookie.
+ */
+export const SHARED_COOKIE_WARN_BYTES = 512;