pierre-review 0.1.14 → 0.1.15

package/dist/app.js

@@ -30,6 +30,39 @@ export async function buildApp() {
                 : { target: 'pino-pretty', options: { translateTime: 'HH:MM:ss' } },
         },
     });
+    // Cloud only: canonicalise the host and pin HTTPS. Local mode runs on
+    // http://127.0.0.1, where HSTS would wrongly pin localhost to HTTPS and a www
+    // redirect is meaningless — so both are cloud-gated. Registered first so it runs
+    // before everything else (the redirect short-circuits before CORS/routing).
+    if (config.isCloud) {
+        let canonicalHost = '';
+        try {
+            // hostname (not host) so a configured port never enters the comparison.
+            canonicalHost = new URL(config.appBaseUrl).hostname.toLowerCase();
+        }
+        catch {
+            canonicalHost = '';
+        }
+        app.addHook('onRequest', async (req, reply) => {
+            // HSTS: keep browsers on HTTPS for this domain. Honored only over HTTPS
+            // (Railway terminates TLS); ignored on plain HTTP. `includeSubDomains` also
+            // covers www. No `preload` — it's hard to undo. HSTS_MAX_AGE=0 disables it.
+            if (config.hstsMaxAge > 0) {
+                reply.header('Strict-Transport-Security', `max-age=${config.hstsMaxAge}; includeSubDomains`);
+            }
+            // Canonical host: 301 www.<apex> → <apex> so the OAuth round-trip and the
+            // session cookie stay on a single origin (and crawlers see one canonical
+            // URL). The HSTS header set above still rides on the redirect response.
+            if (canonicalHost) {
+                // Strip any :port from the Host header before comparing hostnames.
+                const host = (req.headers.host ?? '').toLowerCase().split(':')[0] ?? '';
+                if (host !== canonicalHost &&
+                    host.replace(/^www\./, '') === canonicalHost) {
+                    return reply.redirect(`${config.appBaseUrl}${req.url}`, 301);
+                }
+            }
+        });
+    }
     // CORS: in cloud mode lock to the app's own origin and allow credentials so the
     // session cookie rides along; local mode reflects any origin (dev convenience).
     await app.register(cors, {

package/dist/config.js

@@ -96,6 +96,11 @@ export const config = {
     sessionSecret: process.env.SESSION_SECRET ?? '',
     // 32-byte (64-hex) key for AES-256-GCM encryption of stored access tokens.
     encryptionKey: process.env.ENCRYPTION_KEY ?? '',
+    // HSTS max-age (seconds) for the cloud public origin. Sent only in cloud mode
+    // and honored only over HTTPS (Railway terminates TLS). Default 1 year. Set
+    // HSTS_MAX_AGE=0 as a kill switch. `preload` is intentionally NOT sent — it is
+    // hard to undo; opt in manually once the domain is proven.
+    hstsMaxAge: intFromEnv('HSTS_MAX_AGE', 31536000),
     // ---- Claude Review (agentic PR review; opt-in, LOCAL-ONLY) ----
     // OFF by default: the feature spends real money / Agent-SDK credits per run.
     // Enable with ENABLE_CLAUDE_REVIEW=true. FORCE-DISABLED in cloud mode (it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pierre-review",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).",
   "type": "module",
   "author": "Alex Wakeman",