jskelet 0.5.5 → 0.6.0

package/src/server/auth/handoff.js

@@ -9,9 +9,12 @@
  *
  * Bilet süreç belleğinde; tek süreçte tüm locale host'ları servis eden
  * kurulumlar için yeterli. Değer kısa session id olmalı.
+ *
+ * Güvenlik: mint CSRF'den *sonra* mount edilir (create-app); cookie adı
+ * allowlist + RFC 6265 doğrulaması; bekleyen bilet ve IP başına mint sınırı.
  */
 import { getConfig } from "../../config/index.js";
-import { randomToken, setCookie } from "../../http/cookies.js";
+import { isValidCookieName, randomToken, setCookie } from "../../http/cookies.js";
 import {
   SHARED_COOKIE_WARN_BYTES,
   requestIsHttps,
@@ -22,11 +25,26 @@ import { resolveSharedCookieDomain } from "../../shared/cookie-domain.js";
 /** @type {Map<string, { name: string, value: string, maxAge?: number, exp: number }>} */
 const tickets = new Map();
 
+/** IP → { count, windowStart } — basit mint rate limit. */
+/** @type {Map<string, { count: number, windowStart: number }>} */
+const mintWindows = new Map();
+
 const DEFAULT_TTL_SECONDS = 60;
+const DEFAULT_MAX_PENDING = 256;
+const DEFAULT_MAX_MINTS_PER_IP = 30;
+const MINT_WINDOW_MS = 60_000;
 const HANDOFF_PATH = "/_jskelet/auth/handoff";
 
 /**
- * @returns {{ enabled: boolean, ttlSeconds: number, path: string, maxValueBytes: number }}
+ * @returns {{
+ *   enabled: boolean,
+ *   ttlSeconds: number,
+ *   path: string,
+ *   maxValueBytes: number,
+ *   allowedCookieNames: string[],
+ *   maxPendingTickets: number,
+ *   maxMintsPerIpPerMinute: number,
+ * }}
  */
 function settings() {
   const auth = getConfig().auth ?? {};
@@ -37,21 +55,26 @@ function settings() {
       ttlSeconds: DEFAULT_TTL_SECONDS,
       path: HANDOFF_PATH,
       maxValueBytes: SHARED_COOKIE_WARN_BYTES,
+      allowedCookieNames: [],
+      maxPendingTickets: DEFAULT_MAX_PENDING,
+      maxMintsPerIpPerMinute: DEFAULT_MAX_MINTS_PER_IP,
     };
   }
 
-  if (raw === true) {
-    return {
-      enabled: true,
-      ttlSeconds: DEFAULT_TTL_SECONDS,
-      path: HANDOFF_PATH,
-      maxValueBytes: SHARED_COOKIE_WARN_BYTES,
-    };
-  }
+  /** @type {Record<string, unknown>} */
+  const source = raw === true ? {} : /** @type {Record<string, unknown>} */ (raw);
 
-  const source = /** @type {Record<string, unknown>} */ (raw);
   const ttl = Number(source.ttlSeconds);
   const maxBytes = Number(source.maxValueBytes);
+  const maxPending = Number(source.maxPendingTickets);
+  const maxMints = Number(source.maxMintsPerIpPerMinute);
+
+  const namesRaw = source.allowedCookieNames;
+  /** @type {string[]} */
+  const allowedCookieNames = Array.isArray(namesRaw)
+    ? namesRaw.filter((n) => typeof n === "string" && isValidCookieName(n.trim())).map((n) => n.trim())
+    : [];
+
   return {
     enabled: source.enabled !== false,
     ttlSeconds:
@@ -64,6 +87,15 @@ function settings() {
       Number.isFinite(maxBytes) && maxBytes > 0
         ? Math.floor(maxBytes)
         : SHARED_COOKIE_WARN_BYTES,
+    allowedCookieNames,
+    maxPendingTickets:
+      Number.isFinite(maxPending) && maxPending > 0
+        ? Math.floor(maxPending)
+        : DEFAULT_MAX_PENDING,
+    maxMintsPerIpPerMinute:
+      Number.isFinite(maxMints) && maxMints > 0
+        ? Math.floor(maxMints)
+        : DEFAULT_MAX_MINTS_PER_IP,
   };
 }
 
@@ -74,6 +106,24 @@ function sweep() {
   }
 }
 
+/**
+ * @param {string} ip
+ * @param {number} limit
+ * @returns {boolean} true ise mint'e izin var
+ */
+function allowMint(ip, limit) {
+  const now = Date.now();
+  const key = ip || "unknown";
+  const entry = mintWindows.get(key);
+  if (!entry || now - entry.windowStart >= MINT_WINDOW_MS) {
+    mintWindows.set(key, { count: 1, windowStart: now });
+    return true;
+  }
+  if (entry.count >= limit) return false;
+  entry.count += 1;
+  return true;
+}
+
 /**
  * @param {string} next
  * @param {import('express').Request} req
@@ -146,6 +196,7 @@ function redeem(ticketId) {
 
 /**
  * Handoff uçlarını mount eder. `auth.crossSubdomainHandoff` kapalıysa no-op.
+ * create-app CSRF'den *sonra* çağırmalıdır.
  *
  * @param {import('express').Express} app
  * @returns {void}
@@ -154,9 +205,27 @@ export function mountAuthHandoff(app) {
   const cfg = settings();
   if (!cfg.enabled) return;
 
+  if (cfg.allowedCookieNames.length === 0) {
+    console.warn(
+      "[auth.handoff] enabled but allowedCookieNames is empty — " +
+        "POST mint will return 400 until you list cookie names in " +
+        "auth.crossSubdomainHandoff.allowedCookieNames",
+    );
+  }
+
   app.post(cfg.path, (req, res) => {
     sweep();
 
+    if (!allowMint(String(req.ip || ""), cfg.maxMintsPerIpPerMinute)) {
+      res.status(429).json({ ok: false, error: "too many handoff requests" });
+      return;
+    }
+
+    if (tickets.size >= cfg.maxPendingTickets) {
+      res.status(503).json({ ok: false, error: "handoff ticket store is full" });
+      return;
+    }
+
     const name = typeof req.body?.name === "string" ? req.body.name.trim() : "";
     const value = typeof req.body?.value === "string" ? req.body.value : "";
     const next = typeof req.body?.next === "string" ? req.body.next.trim() : "";
@@ -170,6 +239,19 @@ export function mountAuthHandoff(app) {
       return;
     }
 
+    if (!isValidCookieName(name)) {
+      res.status(400).json({ ok: false, error: "invalid cookie name" });
+      return;
+    }
+
+    if (cfg.allowedCookieNames.length === 0 || !cfg.allowedCookieNames.includes(name)) {
+      res.status(400).json({
+        ok: false,
+        error: "cookie name is not in allowedCookieNames",
+      });
+      return;
+    }
+
     if (Buffer.byteLength(value, "utf8") > cfg.maxValueBytes) {
       res.status(400).json({
         ok: false,
@@ -218,6 +300,7 @@ export function mountAuthHandoff(app) {
 /** @returns {void} */
 export function _resetHandoffTickets() {
   tickets.clear();
+  mintWindows.clear();
 }
 
 /** @returns {number} */

package/src/server/create-app.js

@@ -21,13 +21,12 @@
  *      body parser'dan önce, admin ile aynı katmanda.
  *   5. body parser'lar — statikten sonra: görsel isteklerinde gövde ayrıştırma
  *      maliyeti ödenmesin.
- *   5b. auth handoff (açıksa) — POST bilet + `?handoff=` redeem; csrf'den
- *      önce değil sonra: JSON gövde parser'ı hazır olsun. Redeem GET route
- *      render'ından önce olmalı.
- *   6. csrf — body parser'lardan sonra olmalı: token form alanından okunuyor.
+ *   5b. csrf — body parser'lardan sonra: token form alanından okunuyor.
  *      Rewrite'lardan önce, çünkü kontrol istemcinin gördüğü yola bakar.
- *   7. rewrites(afterFiles) — statik denendikten sonra, sayfalardan önce.
- *   8. route'lar → 404 → hata yönetimi.
+ *   5c. auth handoff (açıksa) — CSRF'den *sonra*: mint POST origin koruması
+ *      görsün. Redeem GET güvenli metot; route render'ından önce kalır.
+ *   6. rewrites(afterFiles) — statik denendikten sonra, sayfalardan önce.
+ *   7. route'lar → 404 → hata yönetimi.
  */
 import path from "node:path";
 import process from "node:process";
@@ -51,6 +50,7 @@ import { configureUpstreamLimiter } from "./upstream-limiter.js";
 import { connectRedis, disconnectRedis } from "./redis.js";
 import { configureLogs, flushLogs, closeLogs } from "./logs/pipeline.js";
 import { isNotFoundError, isRedirectError } from "../http/control-flow.js";
+import { ensurePortFree } from "./port-guard.js";
 
 /**
  * @param {{ root?: string, configFile?: string }} [options]
@@ -152,6 +152,8 @@ export async function createApp(options = {}) {
   app.use(express.urlencoded({ extended: false, limit: "64kb" }));
   app.use(express.json({ limit: "256kb" }));
 
+  app.use(csrf());
+
   const handoff = config.auth?.crossSubdomainHandoff;
   if (
     handoff === true ||
@@ -163,8 +165,6 @@ export async function createApp(options = {}) {
     mountAuthHandoff(app);
   }
 
-  app.use(csrf());
-
   app.use(configRewrites("afterFiles"));
 
   await registerRoutes(app);
@@ -222,12 +222,21 @@ export async function createApp(options = {}) {
  * Uygulamayı kurup dinlemeye başlar. CLI `jskelet start` bunu çağırır;
  * gömülü kullanımda `createApp()` tercih edilir.
  *
- * @param {{ root?: string, configFile?: string, port?: number, host?: string }} [options]
+ * Port doluysa başlamaz. `murder: true` veya argv'de `--murder` varsa
+ * dinleyen süreç öldürülüp bağlama denenir.
+ *
+ * @param {{ root?: string, configFile?: string, port?: number, host?: string, murder?: boolean }} [options]
  * @returns {Promise<import('http').Server>}
  */
 export async function startServer(options = {}) {
-  const app = await createApp(options);
   const port = Number(options.port ?? process.env.PORT ?? 3000);
+  const murder =
+    options.murder === true || process.argv.includes("--murder");
+
+  // createApp pahalı; dolu portta uygulama kurmadan önce net hata ver.
+  await ensurePortFree(port, { murder });
+
+  const app = await createApp(options);
 
   // Varsayılan `::`, `0.0.0.0` değil: ikisi de "tüm arayüzler" demek, ama
   // yalnızca IPv6 soketi çift yığın çalışır ve `localhost`un `::1`e çözüldüğü
@@ -276,6 +285,15 @@ export async function startServer(options = {}) {
           listen("0.0.0.0");
           return;
         }
+        if (error.code === "EADDRINUSE") {
+          const hint = murder
+            ? `port ${port} is still in use after --murder`
+            : `port ${port} is already in use. Pass --murder to kill it and start, or set PORT to another value.`;
+          const wrapped = new Error(hint);
+          /** @type {NodeJS.ErrnoException} */ (wrapped).code = "EADDRINUSE";
+          reject(wrapped);
+          return;
+        }
         reject(error);
       });
 

package/src/server/ejs-adapter.js

@@ -0,0 +1,59 @@
+/**
+ * Legacy EJS şablon motoru — opsiyonel peer.
+ *
+ * `.jsk`-only uygulamalar `ejs` kurmadan çalışır. Bir `.ejs` view veya layout
+ * istendiğinde bu modül uygulamadan (yoksa framework'ten) `ejs` yükler;
+ * paket yoksa göç yolunu gösteren net bir hata verir.
+ */
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import path from "node:path";
+import { getConfig, FRAMEWORK_ROOT } from "../config/index.js";
+import { tryImportFromApp } from "../build/resolve-peer.mjs";
+
+/** @type {import('ejs') | null | undefined} */
+let cached;
+
+const MISSING =
+  "EJS templates require the optional peer dependency `ejs`. " +
+  "Install it (`npm i ejs`) or migrate the template to `.jsk`.";
+
+/**
+ * @returns {Promise<import('ejs')>}
+ */
+export async function loadEjs() {
+  if (cached) return cached;
+  if (cached === null) throw new Error(MISSING);
+
+  const config = getConfig();
+  let mod = await tryImportFromApp(config.root, "ejs");
+
+  // Framework kendi test/dev ortamında peer olarak tutuyor olabilir.
+  if (!mod) {
+    try {
+      const require = createRequire(path.join(FRAMEWORK_ROOT, "package.json"));
+      mod = await import(pathToFileURL(require.resolve("ejs")).href);
+    } catch {
+      mod = null;
+    }
+  }
+
+  if (!mod) {
+    cached = null;
+    throw new Error(MISSING);
+  }
+
+  cached = /** @type {import('ejs')} */ (mod.default ?? mod);
+  return cached;
+}
+
+/**
+ * @param {string} file
+ * @param {Record<string, unknown>} data
+ * @param {object} options
+ * @returns {Promise<string>}
+ */
+export async function renderEjsFile(file, data, options) {
+  const ejs = await loadEjs();
+  return ejs.renderFile(file, data, options);
+}

package/src/server/image-optimizer.js

@@ -8,8 +8,13 @@
  *
  * sharp yoksa 302 ile orijinale yönlendirilir — sayfa bozulmaz, tasarruf
  * olmaz. Deployment notu: remote açıksa sharp runtime bağımlılığıdır.
+ *
+ * Fetch redirect'leri elle takip edilir: her hop allowlist + blocked-address
+ * (ve mümkünse DNS çözümü) ile yeniden doğrulanır — açık redirect SSRF'sini
+ * kapatmak için `redirect: "follow"` kullanılmaz.
  */
 import crypto from "node:crypto";
+import dns from "node:dns/promises";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
@@ -22,6 +27,8 @@ let sharpModule;
 /** @type {string | null} */
 let cacheDir = null;
 
+const MAX_REDIRECTS = 5;
+
 /**
  * @returns {import('../config/index.js').ImagesRemoteConfig | null}
  */
@@ -49,13 +56,45 @@ export function parseAllowedRemoteUrl(src) {
     return null;
   }
 
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (!isHostAllowed(url.hostname, remote.allowHosts)) return null;
-  if (isBlockedAddress(url.hostname)) return null;
-
+  if (!isRemoteUrlShapeAllowed(url, remote.allowHosts)) return null;
   return url;
 }
 
+/**
+ * Host allowlist + literal private IP; redirect hop'larında da kullanılır.
+ *
+ * @param {URL} url
+ * @param {string[]} allowHosts
+ * @returns {boolean}
+ */
+export function isRemoteUrlShapeAllowed(url, allowHosts) {
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  if (!isHostAllowed(url.hostname, allowHosts)) return false;
+  if (isBlockedAddress(url.hostname)) return false;
+  return true;
+}
+
+/**
+ * Hostname'i çözümleyip private IP'ye düşüyorsa reddet (DNS rebinding
+ * savunması; TOCTOU kalır ama check-time private resolve yakalanır).
+ *
+ * @param {string} hostname
+ * @returns {Promise<boolean>} true = güvenli
+ */
+export async function assertResolvedHostSafe(hostname) {
+  if (isBlockedAddress(hostname)) return false;
+  try {
+    const results = await dns.lookup(hostname, { all: true, verbatim: true });
+    if (!results.length) return false;
+    for (const { address } of results) {
+      if (isBlockedAddress(address)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * @param {string} hostname
  * @param {string[]} allowHosts
@@ -257,6 +296,8 @@ async function handleOptimize(req, res, remote) {
 }
 
 /**
+ * Redirect'leri elle takip eder; her hop allowlist + DNS private kontrolünden geçer.
+ *
  * @param {string} href
  * @param {import('../config/index.js').ImagesRemoteConfig} remote
  * @returns {Promise<{ ok: true, buffer: Buffer } | { ok: false }>}
@@ -266,30 +307,57 @@ async function fetchUpstream(href, remote) {
   const timer = setTimeout(() => controller.abort(), remote.fetchTimeoutMs);
 
   try {
-    const response = await fetch(href, {
-      signal: controller.signal,
-      redirect: "follow",
-      headers: {
-        // Bazı CDN'ler bot UA reddeder; tarayıcıya yakın tut.
-        Accept: "image/avif,image/webp,image/*,*/*;q=0.8",
-        "User-Agent": "jskelet-image-optimizer/1",
-      },
-    });
-
-    if (!response.ok) return { ok: false };
-
-    const type = response.headers.get("content-type") ?? "";
-    if (type && !type.startsWith("image/") && !type.includes("octet-stream")) {
-      return { ok: false };
+    let current = href;
+
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+      let url;
+      try {
+        url = new URL(current);
+      } catch {
+        return { ok: false };
+      }
+
+      if (!isRemoteUrlShapeAllowed(url, remote.allowHosts)) return { ok: false };
+      if (!(await assertResolvedHostSafe(url.hostname))) return { ok: false };
+
+      const response = await fetch(url.href, {
+        signal: controller.signal,
+        redirect: "manual",
+        headers: {
+          // Bazı CDN'ler bot UA reddeder; tarayıcıya yakın tut.
+          Accept: "image/avif,image/webp,image/*,*/*;q=0.8",
+          "User-Agent": "jskelet-image-optimizer/1",
+        },
+      });
+
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location) return { ok: false };
+        try {
+          current = new URL(location, url).href;
+        } catch {
+          return { ok: false };
+        }
+        continue;
+      }
+
+      if (!response.ok) return { ok: false };
+
+      const type = response.headers.get("content-type") ?? "";
+      if (type && !type.startsWith("image/") && !type.includes("octet-stream")) {
+        return { ok: false };
+      }
+
+      const length = Number(response.headers.get("content-length") ?? 0);
+      if (length > remote.maxBytes) return { ok: false };
+
+      const buffer = Buffer.from(await response.arrayBuffer());
+      if (buffer.byteLength > remote.maxBytes) return { ok: false };
+
+      return { ok: true, buffer };
     }
 
-    const length = Number(response.headers.get("content-length") ?? 0);
-    if (length > remote.maxBytes) return { ok: false };
-
-    const buffer = Buffer.from(await response.arrayBuffer());
-    if (buffer.byteLength > remote.maxBytes) return { ok: false };
-
-    return { ok: true, buffer };
+    return { ok: false };
   } catch {
     return { ok: false };
   } finally {