tina4-nodejs 3.13.136 → 3.13.138

package/packages/core/src/server.ts

@@ -1,4 +1,13 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import { createServer, IncomingMessage, ServerResponse } from "node:http";
+import { createTina4HttpServer, guardUnsafeHeaders, sendTransportRejection } from "./transport.js";
 import { randomBytes } from "node:crypto";
 import { resolve, dirname, join, relative } from "node:path";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
@@ -21,7 +30,7 @@ import {
   TAKEOVER_KILLED,
   TAKEOVER_REFUSALS,
 } from "./portTakeover.js";
-import { createRequest } from "./request.js";
+import { createRequest, PayloadTooLargeError } from "./request.js";
 import {
   resetRequestCaches,
   headStripIntercept,
@@ -36,7 +45,7 @@ import { isDebugMode } from "./errorOverlay.js";
 import { createHealthRoutes } from "./health.js";
 import { rateLimiter } from "./rateLimiter.js";
 import { Log } from "./logger.js";
-import { DevAdmin, RequestInspector, WsTracker, devMutationDenial, DEV_SAFE_METHODS } from "./devAdmin.js";
+import { DevAdmin, RequestInspector, WsTracker, devRequestDenial, devHostAllowed } from "./devAdmin.js";
 import { CLOSE_GOING_AWAY, devReloadWs, serveWebSocketRoute, wsRouteManager } from "./websocket.js";
 import { feedbackEnabled, injectFeedbackWidget } from "./feedback.js";
 import { I18n } from "./i18n.js";
@@ -355,6 +364,35 @@ function findAvailablePort(start: number): number {
   }
 }
 
+/**
+ * Variables that mark a CI run, in ADR-0070's order (ci_env_vars). A run is CI
+ * when any of them holds a value that, trimmed and lower-cased, is non-empty
+ * and not in CI_NOT_SET_VALUES.
+ */
+export const CI_ENVIRONMENT_VARIABLES = ["CI", "CONTINUOUS_INTEGRATION", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "JENKINS_URL", "TF_BUILD", "TEAMCITY_VERSION"];
+
+/** Values that say "not under CI" (ADR-0070 ci_not_set_values), compared trimmed and lower-cased. */
+export const CI_NOT_SET_VALUES = ["false", "0", "no", "off"];
+
+/**
+ * Whether the server may open a browser (ADR-0070): only for a developer at a
+ * desk. Every rule is a veto; nothing forces a browser open past one.
+ *
+ *   1. development only - the caller's resolved debug mode, and never with
+ *      TINA4_PRODUCTION truthy or in a cluster worker (the primary decides);
+ *   2. never when TINA4_NO_BROWSER is truthy (true/1/yes/on);
+ *   3. never with --no-browser / a programmatic noBrowser (it can only veto);
+ *   4. never under CI.
+ */
+export function shouldOpenBrowser(isDevelopment: boolean, noBrowser = false): boolean {
+  if (!isDevelopment || isTruthy(process.env.TINA4_PRODUCTION) || cluster.isWorker) return false;
+  if (noBrowser || isTruthy(process.env.TINA4_NO_BROWSER)) return false;
+  return !CI_ENVIRONMENT_VARIABLES.some((name) => {
+    const value = (process.env[name] ?? "").trim().toLowerCase();
+    return value !== "" && !CI_NOT_SET_VALUES.includes(value);
+  });
+}
+
 /**
  * Open the user's default browser after a short delay so the server is ready.
  */
@@ -578,9 +616,9 @@ const HTTP_REASON_PHRASES: Record<number, string> = {
   304: "Not Modified", 307: "Temporary Redirect", 308: "Permanent Redirect",
   400: "Bad Request", 401: "Unauthorized", 403: "Forbidden",
   404: "Not Found", 405: "Method Not Allowed", 406: "Not Acceptable",
-  409: "Conflict", 410: "Gone", 413: "Content Too Large",
+  408: "Request Timeout", 409: "Conflict", 410: "Gone", 413: "Content Too Large",
   415: "Unsupported Media Type", 422: "Unprocessable Content",
-  429: "Too Many Requests",
+  429: "Too Many Requests", 431: "Request Header Fields Too Large",
   500: "Internal Server Error", 501: "Not Implemented",
   502: "Bad Gateway", 503: "Service Unavailable", 504: "Gateway Timeout",
 };
@@ -628,6 +666,9 @@ export function resolveTemplate(pathname: string, templatesDir: string): string
     // Skip underscore-prefixed files even within pages/ — they're private
     // by Hugo/Jekyll convention (helpers, fragments) and shouldn't auto-serve.
     if (cleanPath.split("/").some((seg) => seg.startsWith("_"))) return null;
+    // ADR-0082: a "." / ".." segment (or a backslash) could walk out of pages/
+    // - the only directory that auto-routes. Refuse it outright.
+    if (cleanPath.includes("\\") || cleanPath.split("/").some((seg) => seg === "" || seg === "." || seg === "..")) return null;
     const pagesDir = resolve(templatesDir, TEMPLATE_PAGES_DIR);
     for (const ext of [".twig", ".html"]) {
       if (existsSync(resolve(pagesDir, cleanPath + ext))) {
@@ -1101,21 +1142,6 @@ async function runMatchedRoute(ctx: MatchedRouteContext): Promise<void> {
   const { req, res, match, postMatchMiddleware } = ctx;
   req.params = match.params as never;
 
-  // DEVADMIN-DEC-01/02: fail-closed same-origin + loopback gate on every /__dev
-  // write (POST/PUT/PATCH/DELETE), BEFORE the handler runs. Closes drive-by CSRF
-  // (a cross-origin page POSTing to /file/save then /reload) and a network-exposed
-  // debug box. Scoped to /__dev so /__feedback + /ai are unaffected; GET/HEAD/
-  // OPTIONS are safe and skip the gate. The MCP endpoints keep their own 404 gate
-  // (devMutationDenial skips the mcp prefixes for the loopback part).
-  const devMethod = (req.method ?? "GET").toUpperCase();
-  if (ctx.pathname.startsWith("/__dev") && !DEV_SAFE_METHODS.has(devMethod)) {
-    const denial = devMutationDenial(req);
-    if (denial) {
-      res.json({ ok: false, error: denial.error }, denial.status);
-      return;
-    }
-  }
-
   if (await runGlobalMiddlewarePass(postMatchMiddleware, req, res)) return;
 
   // Auth enforcement lives in enforceRouteAuth (authGate.ts) so the in-process
@@ -1707,6 +1733,10 @@ async function dispatchInner(
   // These four close over nothing but the raw req/res (never ctx), which is
   // why they take no context object at all.
   await resetRequestCaches();
+  // Installed FIRST so it is the innermost wrapper of end()/write(): whatever
+  // the later interceptors do, a response carrying a header node:http refused
+  // leaves as the ADR-0068 500 {"error":"Invalid response header"}.
+  guardUnsafeHeaders(rawRes);
   headStripIntercept(rawReq, rawRes);
   // Feature 40 (CE-DEC-01/02): gzip + ETag + conditional-GET for every
   // dynamic response. Installed right after headStripIntercept so it runs
@@ -1718,6 +1748,11 @@ async function dispatchInner(
   // res.render() is handled natively by response.ts via Frond
 
   try {
+    // Gate before middleware, matching and automatic OPTIONS handling (ADR-0082).
+    if (req.path.replace(/\/+/g, "/").startsWith("/__dev")) {
+      const denial = devRequestDenial(req);
+      if (denial) { res.json({ ok: false, error: denial.error }, denial.status); return; }
+    }
     // sessionAutoStart is the one prologue stage INSIDE the try. It degrades
     // on its own (ADR-0021), so the only thing that escapes it is a
     // TINA4_SESSION_STRICT refusal - and that must become a 500 through the
@@ -1740,6 +1775,16 @@ async function dispatchInner(
     try {
       await req.parseBody();
     } catch (err) {
+      // The transport already answered (a 408 for a stalled body) and the
+      // connection is going away: nothing left to say.
+      if (rawRes.writableEnded) return;
+      // A body over TINA4_MAX_UPLOAD_SIZE is a transport rejection (ADR-0068
+      // section 4): exact body, security headers, and Connection: close, so
+      // node:http does not go on reading the rest of the upload.
+      if (err instanceof PayloadTooLargeError) {
+        sendTransportRejection(rawRes, 413, err.message);
+        return;
+      }
       const status = (err as { statusCode?: number })?.statusCode;
       if (typeof status === "number" && status >= 400 && status < 500) {
         if (!rawRes.writableEnded) {
@@ -1910,7 +1955,7 @@ function startLoopbackSiblings(
     siblingHosts.map(
       (siblingHost) =>
         new Promise<ReturnType<typeof createServer> | null>((resolveSibling) => {
-          const sibling = createServer(dispatch);
+          const sibling = createTina4HttpServer(dispatch);
           let settled = false;
           sibling.on("error", (err: NodeJS.ErrnoException) => {
             const expected =
@@ -2186,7 +2231,7 @@ export async function startServer(config?: Tina4Config): Promise<{
   // dev; the stable AI port (port+1000, created below) suppresses reload/toolbar so an
   // AI tool can drive it without its own edits triggering refreshes. The tina4 client
   // posts /__dev/api/reload to the MAIN port. Matches Python (master).
-  const server = createServer(dispatch);
+  const server = createTina4HttpServer(dispatch);
 
   // WebSocket upgrade handling on the MAIN port. Two responsibilities:
   //
@@ -2217,6 +2262,11 @@ export async function startServer(config?: Tina4Config): Promise<{
     const upPath = (req.url ?? "/").split("?")[0];
     // Dev-reload channel (debug only).
     if (isDevMode() && upPath === "/__dev_reload") {
+      // ADR-0082: the reload socket answers only a loopback / TINA4_HOST Host.
+      if (!devHostAllowed(req.headers.host)) {
+        try { socket.write("HTTP/1.1 403 Forbidden\r\n\r\n"); socket.destroy(); } catch { /* gone */ }
+        return;
+      }
       devReloadWs.handleUpgrade(req, socket, head);
       return;
     }
@@ -2295,7 +2345,7 @@ export async function startServer(config?: Tina4Config): Promise<{
 
       if (isDebug && !noAiPort && aiPortInRange) {
         // Stable AI port (port+1000): tag requests so /__dev_reload + toolbar are suppressed.
-        aiServer = createServer(async (req, res) => {
+        aiServer = createTina4HttpServer(async (req, res) => {
           (req as any)._tina4AiPort = true;
           await dispatch(req, res);
         });
@@ -2352,8 +2402,7 @@ ${reset}
   Debug:     ${isDebug ? "ON" : "OFF"} (Log level: ${logLevel})${dualPortLines}
 `);
       }
-      const noBrowser = isTruthy(process.env.TINA4_NO_BROWSER);
-      if (!noBrowser) {
+      if (shouldOpenBrowser(isDebug, config?.noBrowser === true)) {
         // Open the browser on the MAIN port — that's the hot-reload port.
         openBrowser(`http://${displayHost}:${port}`);
       }

package/packages/core/src/service.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Service Runner — in-process background services using Node.js timers.
  * Zero dependencies. Supports cron timing, simple intervals, and daemon mode.

package/packages/core/src/session.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 Session — Pluggable session backends, zero core dependencies.
  *

package/packages/core/src/sessionHandlers/childError.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 session handlers — turn a failed `execFileSync` child into a readable cause.
  *

package/packages/core/src/sessionHandlers/databaseHandler.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 Database Session Handler — sessions in a `tina4_session` table on ANY
  * engine the ORM Database layer supports: sqlite, postgres, mysql, mssql,

package/packages/core/src/sessionHandlers/memcachedHandler.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 Memcached Session Handler — zero-dependency text protocol over TCP.
  *

package/packages/core/src/sessionHandlers/mongoClient.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 synchronous MongoDB transport — ONE persistent client per target.
  *

package/packages/core/src/sessionHandlers/mongoHandler.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 MongoDB Session Handler — MongoDB wire protocol via raw TCP, zero dependencies.
  *

package/packages/core/src/sessionHandlers/respClient.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 synchronous RESP transport — shared by every Redis/Valkey session handler.
  *

package/packages/core/src/sessionHandlers/sqlClient.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 synchronous SQL transport for the database session backend.
  *

package/packages/core/src/sessionHandlers/syncBridge.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 sync-over-async bridge — call an ASYNC worker from SYNCHRONOUS code.
  *

package/packages/core/src/sessionHandlers/syncSocket.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 synchronous socket transport — ONE persistent connection per target.
  *

package/packages/core/src/sessionHandlers/valkeyHandler.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 Valkey Session Handler — Valkey (Redis-compatible) via raw TCP, zero dependencies.
  *

package/packages/core/src/sso.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /** Provider-neutral, configuration-first OpenID Connect SSO. */
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import type { Router } from "./router.js";

package/packages/core/src/static.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import { readFileSync, realpathSync, statSync, type Stats } from "node:fs";
 import { join, extname, sep } from "node:path";
 import { gzipSync } from "node:zlib";

package/packages/core/src/test.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 — The Intelligent Native Application 4ramework
  * Copyright 2007 - current Tina4

package/packages/core/src/testClient.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 Test Client — Test routes without starting a server.
  *

package/packages/core/src/testing.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 Node.js — Inline testing framework.
  *