nucleus-core-ts 0.9.721 → 0.9.723

package/dist/src/Client/Proxy/authz.js

@@ -38,17 +38,33 @@ import { createHmac, timingSafeEqual } from 'node:crypto';
     for(let i = 0; i < t.length; i++){
         const seg = t[i];
         if (seg === undefined) return false;
-        if (seg.startsWith('{') && seg.endsWith('}')) continue;
+        if (seg.startsWith('{') && seg.endsWith('}')) {
+            // A path parameter must bind a REAL, non-empty segment. An empty segment (from a
+            // `//` double slash) is never a valid binding — reject it so the route stays
+            // unmapped (fail-closed) instead of over-matching the parameterized route's claim.
+            if (c[i] === '' || c[i] === undefined) return false;
+            continue;
+        }
         if (seg !== c[i]) return false;
     }
     return true;
 }
+/** Count full-segment `{param}` wildcards — fewer = more specific (more literal segments). */ function templateSpecificity(template) {
+    return template.replace(/\/+$/, '').split('/').filter((s)=>s.startsWith('{') && s.endsWith('}')).length;
+}
 export function findRequiredAction(manifest, method, path) {
     const m = method.toUpperCase();
-    for (const r of manifest){
-        if (r.method === m && pathMatchesTemplate(r.path, path)) return r.action;
-    }
-    return null;
+    const matches = manifest.filter((r)=>r.method === m && pathMatchesTemplate(r.path, path));
+    if (matches.length === 0) return null;
+    // MOST-SPECIFIC wins (never first-match): a literal route (`/files/admin`) must beat a
+    // parameterized sibling (`/files/{id}`) regardless of manifest order — else a request to
+    // an admin endpoint resolves to the weaker by-id claim (privilege escalation). Rank by
+    // fewest `{param}` segments, deterministic tiebreak on path for equal specificity.
+    matches.sort((a, b)=>{
+        const d = templateSpecificity(a.path) - templateSpecificity(b.path);
+        return d !== 0 ? d : a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
+    });
+    return matches[0]?.action ?? null;
 }
 function matchesGlob(path, patterns) {
     if (!patterns?.length) return false;

package/dist/src/Client/Proxy/authz.test.js

@@ -94,6 +94,54 @@ describe('findRequiredAction', ()=>{
         expect(findRequiredAction(MANIFEST, 'POST', '/api/v1/templates')).toBeNull();
     });
 });
+describe('findRequiredAction — most-specific wins (round-4 privilege-escalation guards)', ()=>{
+    // Bug D: a LITERAL route must beat a parameterized sibling regardless of manifest
+    // declaration order — else GET /files/admin resolves to the weaker /files/{id} claim
+    // and a user holding only files.get reaches the admin endpoint.
+    const order = (o)=>{
+        const lit = {
+            action: 'files.admin',
+            path: '/files/admin',
+            method: 'GET'
+        };
+        const param = {
+            action: 'files.get',
+            path: '/files/{id}',
+            method: 'GET'
+        };
+        return o === 'literal-first' ? [
+            lit,
+            param
+        ] : [
+            param,
+            lit
+        ];
+    };
+    it('literal route beats parameterized sibling, in EITHER declaration order', ()=>{
+        expect(findRequiredAction(order('param-first'), 'GET', '/files/admin')).toBe('files.admin');
+        expect(findRequiredAction(order('literal-first'), 'GET', '/files/admin')).toBe('files.admin');
+        // a real id still resolves to the by-id claim
+        expect(findRequiredAction(order('param-first'), 'GET', '/files/42')).toBe('files.get');
+    });
+    // Bug E: a {param} must not bind an EMPTY segment produced by a `//` double slash;
+    // the route stays unmapped (fail-closed) rather than passing the {id}-route's claim.
+    it('a parameter never binds an empty segment (double slash) → unmapped', ()=>{
+        const manifest = [
+            {
+                action: 'x.gety',
+                path: '/x/{id}/y',
+                method: 'GET'
+            },
+            {
+                action: 'x.getxy',
+                path: '/x/y',
+                method: 'GET'
+            }
+        ];
+        expect(findRequiredAction(manifest, 'GET', '/x//y')).toBeNull();
+        expect(findRequiredAction(manifest, 'GET', '/x/5/y')).toBe('x.gety');
+    });
+});
 describe('evaluateAccess', ()=>{
     const base = {
         manifest: MANIFEST,

package/dist/src/Services/Authorization/EndpointDiscovery/index.d.ts

@@ -41,7 +41,10 @@ export declare function pathMatchesTemplate(template: string, concrete: string):
 /**
  * Given the claim specs for a service and an incoming (method, concrete-path),
  * return the required claim action, or null when no route matches (the caller
- * decides allow/deny for unmapped routes).
+ * decides allow/deny for unmapped routes). When several templates match, the
+ * MOST-SPECIFIC one wins (never first-declared): a literal route must beat a
+ * parameterized sibling so `/files/admin` requires its own claim, not `/files/{id}`'s.
+ * This MUST stay in lockstep with the proxy's findRequiredAction (Client/Proxy/authz.ts).
  */
 export declare function matchRouteToAction(specs: ClaimSpec[], method: string, concretePath: string): string | null;
 /** An existing claim row as seen during reconcile. */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.721",
+	"version": "0.9.723",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",