redweb 0.13.3 → 0.13.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "redweb",
-  "version": "0.13.3",
+  "version": "0.13.5",
   "description": "A small Node.js foundation for HTTP, WebSockets, multiplayer services, and server-rendered HTML",
   "main": "index.js",
   "types": "index.d.ts",
@@ -83,6 +83,7 @@
     "verify:live-html:browser": "node scripts/build-live-html-examples.js --check && node scripts/verify-live-html-browser.js",
     "verify:browser:supplements": "node node_modules/jest/bin/jest.js tests/unit/browser-supplements.unit.test.js tests/integration/browser-supplements.integration.test.js --runInBand --coverage --collectCoverageFrom=scripts/lib/verify-live-page-ownership.js --collectCoverageFrom=scripts/lib/verify-runtime-browser.js --coverageDirectory=coverage/browser-supplements-authored",
     "verify:dashboard:coverage": "node node_modules/jest/bin/jest.js tests/unit/dashboard-verifier.unit.test.js tests/integration/dashboard-verifier.integration.test.js --runInBand --coverage --collectCoverageFrom=scripts/lib/verify-dashboard-browser.js --coverageDirectory=coverage/dashboard-verifier",
+    "verify:starter:browser:coverage": "node node_modules/jest/bin/jest.js tests/unit/browser-acceptance.unit.test.js tests/unit/browser-handle-release.unit.test.js tests/unit/starter-browser.unit.test.js tests/integration/starter-browser.integration.test.js --runInBand --coverage --collectCoverageFrom=scripts/lib/BrowserAcceptance.js --collectCoverageFrom=scripts/lib/releaseBrowserHandles.js --collectCoverageFrom=scripts/lib/verify-starter-browser.js --coverageDirectory=coverage/starter-browser",
     "verify:refresh:coverage": "node node_modules/jest/bin/jest.js tests/unit/refresh-controls-failures.unit.test.js tests/unit/refresh-observation.unit.test.js tests/unit/heading-readiness.unit.test.js tests/integration/refresh-observation.integration.test.js tests/integration/refresh-coverage.integration.test.js --runInBand --coverage --collectCoverageFrom=scripts/lib/verify-refresh-controls.js --collectCoverageFrom=scripts/lib/verify-refresh-coverage.js --coverageDirectory=coverage/refresh-verifier",
     "verify:browser:coverage": "node node_modules/jest/bin/jest.js tests/unit/browser-coverage.unit.test.js tests/unit/application-coverage.unit.test.js tests/unit/packed-browser-harness.unit.test.js --runInBand --coverage --collectCoverageFrom=scripts/lib/BrowserCoverage.js --collectCoverageFrom=scripts/lib/ApplicationCoverage.js --collectCoverageFrom=scripts/lib/assertCoverageFile.js --coverageDirectory=coverage/browser-collector && npm run verify:browser:coordinator:coverage",
     "verify:browser:coordinator:coverage": "node node_modules/jest/bin/jest.js tests/unit/browser-coordinator-report.unit.test.js tests/unit/browser-coordinator-lifecycle.unit.test.js tests/unit/browser-coverage-cleanup.unit.test.js tests/unit/browser-supplements.unit.test.js tests/unit/refresh-controls-failures.unit.test.js tests/unit/refresh-observation.unit.test.js tests/unit/heading-readiness.unit.test.js tests/integration/browser-coordinator.integration.test.js tests/integration/browser-supplements.integration.test.js tests/integration/refresh-observation.integration.test.js tests/integration/refresh-coverage.integration.test.js --runInBand --coverage --collectCoverageFrom=scripts/verify-browser-coverage.js --collectCoverageFrom=scripts/lib/verify-live-page-ownership.js --collectCoverageFrom=scripts/lib/verify-runtime-browser.js --collectCoverageFrom=scripts/lib/verify-refresh-controls.js --collectCoverageFrom=scripts/lib/verify-refresh-coverage.js --coverageDirectory=coverage/browser-coordinator",
@@ -107,7 +108,7 @@
     "verify:package:examples:coverage": "node node_modules/jest/bin/jest.js tests/unit/packed-action.unit.test.js tests/unit/example-dependencies.unit.test.js tests/unit/example-probe.unit.test.js tests/integration/packed-action.integration.test.js tests/integration/example-dependencies.integration.test.js --runInBand --coverage --collectCoverageFrom=scripts/lib/performProbeAction.js --collectCoverageFrom=scripts/lib/verify-example-dependencies.js --collectCoverageFrom=scripts/lib/example-dependency-probe.cjs --coverageDirectory=coverage/example-dependency-tools",
     "verify:package:browser:coverage": "node node_modules/jest/bin/jest.js tests/unit/browser-pages.unit.test.js tests/unit/packed-browser-verifier.unit.test.js tests/unit/browser-coverage-cleanup.unit.test.js tests/integration/packed-browser-verifier.integration.test.js --runInBand --silent --coverage --collectCoverageFrom=scripts/lib/verify-packed-browser.js --collectCoverageFrom=scripts/lib/BrowserPages.js --coverageDirectory=coverage/packed-browser-verifier",
     "verify:client:link": "node --test tests/integration/npm-link.integration.test.cjs",
-    "test": "npx jest"
+    "test": "npx jest --testPathIgnorePatterns=soak-.*[.]test[.]js$ --testPathIgnorePatterns=benchmark-measurement[.]integration[.]test[.]js$"
   },
   "files": [
     "bin",

package/recipes/dashboard/README.md

@@ -14,11 +14,11 @@ npm test
 npm run dev
 ```
 
-The provisioning command displays a randomly generated password once. Save it securely; there are no default accounts or passwords. Open **http://127.0.0.1:8181/login**, sign in, and add a card. A second signed-in tab updates immediately. Restart the app: your cards and unexpired credentials remain valid. Sign out all sessions to close every connected tab for that account and invalidate all its cookies.
+The provisioning command displays a randomly generated password once. Save it securely; there are no default accounts or passwords. Open **http://127.0.0.1:8181/login** or **http://localhost:8181/login**, sign in, and add a card. A second signed-in tab updates immediately. Restart the app: your cards and unexpired credentials remain valid. Sign out all sessions to close every connected tab for that account and invalidate all its cookies.
 
-`npm test` provisions temporary test accounts and a real temporary database, then exercises HTTP, WebSockets, isolation, restart, and session expiry. It never modifies your application database. Integration tests use no mocks. A separately labelled unit test injects a cleanup error after closing a real SQLite database to verify rejection handling; it does not simulate a real operating-system failure.
+`npm test` provisions temporary test accounts and a real temporary database, then exercises HTTP, WebSockets, isolation, restart, and session expiry. It never modifies your application database. Integration tests use no mocks, including hostile cross-loopback form and socket origins. Redweb's release gate also signs in with both valid and invalid credentials through a visible Chromium window, using `localhost` so synthetic request headers cannot hide browser-origin bugs. CI supplies a virtual display for that same headed test. A separately labelled unit test injects a cleanup error after closing a real SQLite database to verify rejection handling; it does not simulate a real operating-system failure.
 
-`npm run test:coverage` measures the TypeScript application through source maps, separately from Redweb's own instrumented-library coverage. It also waits through the actual one-minute login admission window without mocking the clock. The report includes TypeScript-generated decorator accessor functions; inspect that distinction rather than assuming a library coverage figure applies to this recipe. The generated npm configuration enforces this recipe's Node engine requirement before installation.
+`npm run test:coverage` measures the TypeScript application through source maps, separately from Redweb's own instrumented-library coverage. Login-window expiry uses the same real limiter with an explicitly short test configuration; it never waits through the production one-minute default. The report includes TypeScript-generated decorator accessor functions; inspect that distinction rather than assuming a library coverage figure applies to this recipe. The generated npm configuration enforces this recipe's Node engine requirement before installation.
 
 ## Where the behavior lives
 

package/recipes/dashboard/app.test.cjs

@@ -8,7 +8,7 @@ const { DatabaseSync } = require('node:sqlite');
 const { spawn, spawnSync } = require('node:child_process');
 const net = require('node:net');
 const { WebSocketServer, WebSocket } = require('ws');
-const { createApp, databasePath } = require('../dist/app');
+const { allowsDashboardOrigin, createApp, databasePath } = require('../dist/app');
 const { DashboardStore } = require('../dist/store');
 const { DashboardAuth, credentials, sessionToken } = require('../dist/auth');
 const { PrivateCards } = require('../dist/cards');
@@ -70,9 +70,12 @@ async function cardClient(t, origin, cookie) {
 test('private live cards: real HTTP, sockets, isolation, reconnect, sign-out and durable restart', async t => {
     const fixtureApp = await fixture(t);
     let { origin } = fixtureApp;
+    const localhost = origin.replace('127.0.0.1', 'localhost');
     assert.equal((await fetch(`${origin}/login`)).status, 200);
     assert.equal((await fetch(origin)).status, 401);
     assert.equal((await post(origin, '/login', { account: 'alice', password }, '', 'https://foreign.example')).status, 403);
+    assert.equal((await post(origin, '/login', { account: 'alice', password }, '', localhost)).status, 403);
+    assert.equal((await post(localhost, '/login', { account: 'alice', password: 'wrong-password-at-least-16' })).status, 401);
     assert.equal((await post(origin, '/login', { account: 'alice', password: 'wrong-password-at-least-16' })).status, 401);
     const alice = await login(origin);
     const alice2 = await login(origin);
@@ -80,6 +83,14 @@ test('private live cards: real HTTP, sockets, isolation, reconnect, sign-out and
     const page = await fetch(origin, { headers: { Cookie: alice } });
     assert.match(page.headers.get('cache-control'), /private.*no-store/);
     assert.equal(page.headers.get('etag'), null);
+    const document = await page.text();
+    const pageConfig = JSON.parse(document.match(/id="__redweb_page">([^<]+)/)[1]);
+    const hostile = new WebSocket(`${origin.replace('http:', 'ws:')}${pageConfig.socketPath}?pageId=${pageConfig.pageId}&redwebVersion=${encodeURIComponent(pageConfig.version)}`,
+        { headers: { Cookie: alice, Origin: localhost } });
+    hostile.on('error', () => {});
+    const [, rejection] = await once(hostile, 'unexpected-response');
+    assert.equal(rejection.statusCode, 403);
+    rejection.resume();
     const first = await cardClient(t, origin, alice);
     const second = await cardClient(t, origin, alice2);
     const other = await cardClient(t, origin, bob);
@@ -124,6 +135,23 @@ test('private live cards: real HTTP, sockets, isolation, reconnect, sign-out and
     await client.items(value => value.length === 1);
 });
 
+test('unit: development accepts only equivalent loopback browser origins on the listening port', () => {
+    const expected = 'http://127.0.0.1:8181';
+    assert.equal(allowsDashboardOrigin('http://localhost:8181', expected, false, 'localhost:8181'), true);
+    assert.equal(allowsDashboardOrigin('http://127.0.0.1:8181', expected, false, '127.0.0.1:8181'), true);
+    assert.equal(allowsDashboardOrigin('http://[::1]:8181', expected, false, '[::1]:8181'), true);
+    assert.equal(allowsDashboardOrigin('http://localhost:8181', expected, false, '127.0.0.1:8181'), false);
+    assert.equal(allowsDashboardOrigin('https://localhost:8181', expected, false, 'localhost:8181'), false);
+    assert.equal(allowsDashboardOrigin('http://localhost:8182', expected, false, 'localhost:8182'), false);
+    assert.equal(allowsDashboardOrigin('http://localhost:8181/path', expected, false, 'localhost:8181'), false);
+    assert.equal(allowsDashboardOrigin('not an origin', expected, false, 'localhost:8181'), false);
+    assert.equal(allowsDashboardOrigin(undefined, expected, false, 'localhost:8181'), false);
+    assert.equal(allowsDashboardOrigin('http://localhost:8181', expected, false), false);
+    assert.equal(allowsDashboardOrigin('http://localhost:8181', expected, false, 'localhost:8181/path'), false);
+    assert.equal(allowsDashboardOrigin('https://dashboard.example', 'https://dashboard.example', true), true);
+    assert.equal(allowsDashboardOrigin('http://localhost:8181', 'https://dashboard.example', true), false);
+});
+
 test('session expiry closes idle sockets and rejects later HTTP access', async t => {
     const { origin } = await fixture(t, { sessionLifetimeMs: 1200 });
     const cookie = await login(origin);
@@ -200,6 +228,8 @@ test('logout fences password checks in flight; close and admission bounds stop n
     assert.equal(await closing, undefined);
     assert.equal(await auth.login('peer', 'alice', password), undefined);
     assert.throws(() => new DashboardAuth(store, 0));
+    assert.throws(() => new DashboardAuth(store, 3600000, 19));
+    assert.throws(() => new DashboardAuth(store, 3600000, 60001));
     const limited = new DashboardAuth(store);
     const concurrent = Array.from({ length: 5 }, (_, index) => limited.login(`peer-${index}`, 'alice', password));
     assert.equal(await concurrent[4], undefined);

package/recipes/dashboard/app.tsx

@@ -1,5 +1,6 @@
 import express, { type ErrorRequestHandler } from 'express';
 import { mkdirSync } from 'node:fs';
+import type { IncomingMessage } from 'node:http';
 import { dirname, resolve } from 'node:path';
 import { page, start, type LivePageRequestContext } from 'redweb';
 import { DashboardAuth, sessionToken } from './auth';
@@ -11,6 +12,23 @@ export interface DashboardOptions { port?: number; database?: string; origin?: s
 
 export function databasePath() { return resolve(process.env.DASHBOARD_DATABASE ?? 'data/dashboard.sqlite'); }
 
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]']);
+
+/** Development is loopback-only, so its equivalent browser hostnames share one trust boundary. */
+export function allowsDashboardOrigin(candidate: string | undefined, expected: string, configured: boolean, host?: string) {
+    if (!candidate) return false;
+    if (configured) return candidate === expected;
+    if (!host || /[\/@?#\\]/.test(host)) return false;
+    try {
+        const actual = new URL(candidate);
+        const local = new URL(expected);
+        const target = new URL(`http://${host}`);
+        return actual.origin === candidate && actual.protocol === 'http:'
+            && actual.origin === target.origin && actual.port === local.port
+            && LOOPBACK_HOSTS.has(actual.hostname);
+    } catch { return false; }
+}
+
 export function createApp(options: DashboardOptions = {}) {
     const port = options.port ?? Number(process.env.PORT ?? 8181);
     const configuredOrigin = options.origin ?? process.env.DASHBOARD_ORIGIN;
@@ -32,6 +50,8 @@ export function createApp(options: DashboardOptions = {}) {
     };
     app.use(invalidBody);
     const origin = () => configuredOrigin ?? `http://127.0.0.1:${(server.server.address() as { port: number }).port}`;
+    const allowsOrigin = (candidate: string | undefined, request: IncomingMessage) =>
+        allowsDashboardOrigin(candidate, origin(), Boolean(configuredOrigin), request.headers.host);
 
     @page('/login', { live: false, css: 'app.css', head: { title: 'Sign in · Your cards' } })
     class Login {
@@ -57,10 +77,10 @@ export function createApp(options: DashboardOptions = {}) {
         }
     }
 
-    auth.mount(app, origin, account => server.revoke(account));
+    auth.mount(app, origin, allowsOrigin, account => server.revoke(account));
     const server = start([Login, Dashboard], {
         server: app, port, bind: configuredOrigin ? '0.0.0.0' : '127.0.0.1', logger: null, templateRoot: __dirname,
-        origins: value => value === origin(),
+        origins: allowsOrigin,
         authenticate: request => request.method === 'GET' && request.url?.split('?')[0] === '/login'
             ? true : store.session(sessionToken(request.headers.cookie))?.account,
     });

package/recipes/dashboard/auth.ts

@@ -26,8 +26,10 @@ export class DashboardAuth {
     private closed = false;
     private readonly attempts = new Map<string, { count: number; expires: number }>();
 
-    constructor(private readonly store: DashboardStore, private readonly ttlMs = 3600000) {
+    constructor(private readonly store: DashboardStore, private readonly ttlMs = 3600000,
+        private readonly attemptWindowMs = 60000) {
         if (!Number.isInteger(ttlMs) || ttlMs < 100 || ttlMs > 86400000) throw new RangeError('Invalid session lifetime.');
+        if (!Number.isInteger(attemptWindowMs) || attemptWindowMs < 20 || attemptWindowMs > 60000) throw new RangeError('Invalid login attempt window.');
     }
 
     async login(ip: string, account: unknown, password: unknown): Promise<string | undefined> {
@@ -37,7 +39,7 @@ export class DashboardAuth {
         let attempt = this.attempts.get(ip);
         if (!attempt) {
             if (this.attempts.size >= 1024) return undefined;
-            attempt = { count: 0, expires: now + 60000 };
+            attempt = { count: 0, expires: now + this.attemptWindowMs };
             this.attempts.set(ip, attempt);
         }
         if (++attempt.count > 10 || this.active >= 4) return undefined;
@@ -55,12 +57,12 @@ export class DashboardAuth {
 
     close() { this.closed = true; this.attempts.clear(); }
 
-    mount(app: Application, origin: () => string, revoke: (account: string) => Promise<unknown>) {
+    mount(app: Application, origin: () => string, allowsOrigin: (candidate: string | undefined, request: Request) => boolean, revoke: (account: string) => Promise<unknown>) {
         const cookie = (token: string) => `${COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${token ? Math.ceil(this.ttlMs / 1000) : 0}${origin().startsWith('https:') ? '; Secure' : ''}`;
         const post = (route: string, handler: (request: Request, response: Response) => Promise<void>) => {
             app.post(route, (request, response) => {
                 response.set('Cache-Control', 'private, no-store');
-                if (request.get('origin') !== origin()) { response.status(403).send('This form must be submitted from this site.'); return; }
+                if (!allowsOrigin(request.get('origin'), request)) { response.status(403).send('This form must be submitted from this site.'); return; }
                 void handler(request, response).catch(() => response.status(503).send('Unable to complete the request. Try again later.'));
             });
         };

package/recipes/dashboard/rate-window.test.cjs

@@ -3,15 +3,15 @@ const { test } = require('node:test');
 const { DashboardStore } = require('../dist/store');
 const { DashboardAuth, credentials } = require('../dist/auth');
 
-test('login admission reopens after the real one-minute window, without clock mocks', { timeout: 65000 }, async t => {
+test('login admission reopens after its configured short real window', async t => {
     const store = new DashboardStore(':memory:');
-    const auth = new DashboardAuth(store);
+    const auth = new DashboardAuth(store, 3600000, 250);
     t.after(() => { auth.close(); store.close(); });
     const password = 'test-only-login-window-password';
     store.provision('alice', await credentials(password));
-    for (let attempt = 0; attempt < 10; attempt++) assert.equal(await auth.login('same-peer', 'invalid', password), undefined);
+    for (let attempt = 0; attempt < 10; attempt++) assert.equal(await auth.login('same-peer', 'invalid', 'short'), undefined);
     assert.equal(await auth.login('same-peer', 'alice', password), undefined);
-    await new Promise(resolve => setTimeout(resolve, 60010));
+    await new Promise(resolve => setTimeout(resolve, 275));
     const token = await auth.login('same-peer', 'alice', password);
     assert.equal(store.session(token).account, 'alice');
 });