redweb 0.13.2 → 0.13.5

package/recipes/dashboard/app.tsx

@@ -1,5 +1,6 @@
 import express, { type ErrorRequestHandler } from 'express';
 import { mkdirSync } from 'node:fs';
+import type { IncomingMessage } from 'node:http';
 import { dirname, resolve } from 'node:path';
 import { page, start, type LivePageRequestContext } from 'redweb';
 import { DashboardAuth, sessionToken } from './auth';
@@ -11,6 +12,23 @@ export interface DashboardOptions { port?: number; database?: string; origin?: s
 
 export function databasePath() { return resolve(process.env.DASHBOARD_DATABASE ?? 'data/dashboard.sqlite'); }
 
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]']);
+
+/** Development is loopback-only, so its equivalent browser hostnames share one trust boundary. */
+export function allowsDashboardOrigin(candidate: string | undefined, expected: string, configured: boolean, host?: string) {
+    if (!candidate) return false;
+    if (configured) return candidate === expected;
+    if (!host || /[\/@?#\\]/.test(host)) return false;
+    try {
+        const actual = new URL(candidate);
+        const local = new URL(expected);
+        const target = new URL(`http://${host}`);
+        return actual.origin === candidate && actual.protocol === 'http:'
+            && actual.origin === target.origin && actual.port === local.port
+            && LOOPBACK_HOSTS.has(actual.hostname);
+    } catch { return false; }
+}
+
 export function createApp(options: DashboardOptions = {}) {
     const port = options.port ?? Number(process.env.PORT ?? 8181);
     const configuredOrigin = options.origin ?? process.env.DASHBOARD_ORIGIN;
@@ -32,6 +50,8 @@ export function createApp(options: DashboardOptions = {}) {
     };
     app.use(invalidBody);
     const origin = () => configuredOrigin ?? `http://127.0.0.1:${(server.server.address() as { port: number }).port}`;
+    const allowsOrigin = (candidate: string | undefined, request: IncomingMessage) =>
+        allowsDashboardOrigin(candidate, origin(), Boolean(configuredOrigin), request.headers.host);
 
     @page('/login', { live: false, css: 'app.css', head: { title: 'Sign in · Your cards' } })
     class Login {
@@ -57,10 +77,10 @@ export function createApp(options: DashboardOptions = {}) {
         }
     }
 
-    auth.mount(app, origin, account => server.revoke(account));
+    auth.mount(app, origin, allowsOrigin, account => server.revoke(account));
     const server = start([Login, Dashboard], {
         server: app, port, bind: configuredOrigin ? '0.0.0.0' : '127.0.0.1', logger: null, templateRoot: __dirname,
-        origins: value => value === origin(),
+        origins: allowsOrigin,
         authenticate: request => request.method === 'GET' && request.url?.split('?')[0] === '/login'
             ? true : store.session(sessionToken(request.headers.cookie))?.account,
     });

package/recipes/dashboard/auth.ts

@@ -26,8 +26,10 @@ export class DashboardAuth {
     private closed = false;
     private readonly attempts = new Map<string, { count: number; expires: number }>();
 
-    constructor(private readonly store: DashboardStore, private readonly ttlMs = 3600000) {
+    constructor(private readonly store: DashboardStore, private readonly ttlMs = 3600000,
+        private readonly attemptWindowMs = 60000) {
         if (!Number.isInteger(ttlMs) || ttlMs < 100 || ttlMs > 86400000) throw new RangeError('Invalid session lifetime.');
+        if (!Number.isInteger(attemptWindowMs) || attemptWindowMs < 20 || attemptWindowMs > 60000) throw new RangeError('Invalid login attempt window.');
     }
 
     async login(ip: string, account: unknown, password: unknown): Promise<string | undefined> {
@@ -37,7 +39,7 @@ export class DashboardAuth {
         let attempt = this.attempts.get(ip);
         if (!attempt) {
             if (this.attempts.size >= 1024) return undefined;
-            attempt = { count: 0, expires: now + 60000 };
+            attempt = { count: 0, expires: now + this.attemptWindowMs };
             this.attempts.set(ip, attempt);
         }
         if (++attempt.count > 10 || this.active >= 4) return undefined;
@@ -55,12 +57,12 @@ export class DashboardAuth {
 
     close() { this.closed = true; this.attempts.clear(); }
 
-    mount(app: Application, origin: () => string, revoke: (account: string) => Promise<unknown>) {
+    mount(app: Application, origin: () => string, allowsOrigin: (candidate: string | undefined, request: Request) => boolean, revoke: (account: string) => Promise<unknown>) {
         const cookie = (token: string) => `${COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${token ? Math.ceil(this.ttlMs / 1000) : 0}${origin().startsWith('https:') ? '; Secure' : ''}`;
         const post = (route: string, handler: (request: Request, response: Response) => Promise<void>) => {
             app.post(route, (request, response) => {
                 response.set('Cache-Control', 'private, no-store');
-                if (request.get('origin') !== origin()) { response.status(403).send('This form must be submitted from this site.'); return; }
+                if (!allowsOrigin(request.get('origin'), request)) { response.status(403).send('This form must be submitted from this site.'); return; }
                 void handler(request, response).catch(() => response.status(503).send('Unable to complete the request. Try again later.'));
             });
         };

package/recipes/dashboard/rate-window.test.cjs

@@ -3,15 +3,15 @@ const { test } = require('node:test');
 const { DashboardStore } = require('../dist/store');
 const { DashboardAuth, credentials } = require('../dist/auth');
 
-test('login admission reopens after the real one-minute window, without clock mocks', { timeout: 65000 }, async t => {
+test('login admission reopens after its configured short real window', async t => {
     const store = new DashboardStore(':memory:');
-    const auth = new DashboardAuth(store);
+    const auth = new DashboardAuth(store, 3600000, 250);
     t.after(() => { auth.close(); store.close(); });
     const password = 'test-only-login-window-password';
     store.provision('alice', await credentials(password));
-    for (let attempt = 0; attempt < 10; attempt++) assert.equal(await auth.login('same-peer', 'invalid', password), undefined);
+    for (let attempt = 0; attempt < 10; attempt++) assert.equal(await auth.login('same-peer', 'invalid', 'short'), undefined);
     assert.equal(await auth.login('same-peer', 'alice', password), undefined);
-    await new Promise(resolve => setTimeout(resolve, 60010));
+    await new Promise(resolve => setTimeout(resolve, 275));
     const token = await auth.login('same-peer', 'alice', password);
     assert.equal(store.session(token).account, 'alice');
 });

package/recipes/realtime/README.md

@@ -4,5 +4,5 @@
 The browser button invokes only the decorated `increment` action; it does not supply the new count.
 Open two tabs to check the broadcast. State is in memory and resets when the server restarts.
 
-`<output>{this.count}</output>` updates automatically because the page reads decorated state during rendering.
+`{this.count}` updates automatically because the page reads decorated state during rendering; no wrapper element is required.
 No repeated binding name or browser-side state is needed. State changes are assignment-driven; render methods must not modify state.

package/recipes/realtime/app.test.cjs

@@ -6,10 +6,10 @@ test('one server action updates both visitors', { timeout: 10000 }, async t => {
     const origin = await listen(t);
     const first = await live(t, origin);
     const second = await live(t, origin);
-    await first.patch(patch => patch.html.includes('<output>0</output>'));
-    await second.patch(patch => patch.html.includes('<output>0</output>'));
+    await first.patch(patch => patch.html.includes('Count 0'));
+    await second.patch(patch => patch.html.includes('Count 0'));
     first.action('increment');
-    await first.patch(patch => patch.html.includes('<output>1</output>'));
-    await second.patch(patch => patch.html.includes('<output>1</output>'));
-    assert.match(await (await fetch(origin)).text(), /<output>1<\/output>/);
+    await first.patch(patch => patch.html.includes('Count 1'));
+    await second.patch(patch => patch.html.includes('Count 1'));
+    assert.match(await (await fetch(origin)).text(), /Count 1/);
 });

package/recipes/realtime/app.tsx

@@ -14,7 +14,7 @@ export class CounterPage {
                 <h1>A counter owned by the server</h1>
                 <p>Open this page in two tabs. Either button updates both.</p>
                 <button rw-click="increment">
-                    Count <output>{this.count}</output>
+                    Count {this.count}
                 </button>
             </main>
         );