npm - tina4-nodejs - Versions diffs - 3.13.142 → 3.13.143 - Mend

tina4-nodejs 3.13.142 → 3.13.143

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (37) hide show

package/CLAUDE.md +28 -2
package/package.json +1 -1
package/packages/cli/dist/bin.js +379 -85
package/packages/cli/src/commands/generate.ts +7 -2
package/packages/cli/src/commands/init.ts +18 -8
package/packages/core/dist/index.js +377 -78
package/packages/core/gallery/auth/src/routes/gallery/auth/get.ts +27 -11
package/packages/core/gallery/queue/src/routes/gallery/queue/get.ts +20 -7
package/packages/core/gallery/templates/src/templates/gallery_page.twig +34 -15
package/packages/core/src/csp.ts +138 -0
package/packages/core/src/errorOverlay.ts +80 -37
package/packages/core/src/index.ts +10 -0
package/packages/core/src/middleware.ts +20 -6
package/packages/core/src/response.ts +14 -3
package/packages/core/src/server.ts +52 -15
package/packages/core/src/session.ts +154 -7
package/packages/core/src/sso.ts +1 -1
package/packages/core/src/types.ts +8 -0
package/packages/core/templates/errors/302.twig +1 -1
package/packages/core/templates/errors/401.twig +2 -2
package/packages/core/templates/errors/403.twig +1 -1
package/packages/core/templates/errors/404.twig +1 -1
package/packages/core/templates/errors/500.twig +1 -1
package/packages/core/templates/errors/502.twig +2 -2
package/packages/core/templates/errors/503.twig +2 -2
package/packages/core/templates/errors/base.twig +4 -1
package/packages/frond/dist/index.js +2 -0
package/packages/frond/src/engine.ts +23 -0
package/packages/orm/dist/index.js +378 -87
package/packages/swagger/dist/index.js +4 -4
package/packages/swagger/src/ui.ts +7 -4
package/types/core/src/csp.d.ts +42 -0
package/types/core/src/index.d.ts +1 -0
package/types/core/src/middleware.d.ts +6 -0
package/types/core/src/session.d.ts +62 -2
package/types/core/src/types.d.ts +8 -0
package/types/frond/src/engine.d.ts +7 -0

package/packages/swagger/dist/index.js CHANGED Viewed

@@ -487,13 +487,13 @@ function uniqueOperationId(method, openApiPath, seen) {
 function swaggerUiCdn() {
   return (process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5").replace(/\/+$/, "");
 }
-var SWAGGER_UI_HTML = (specUrl) => `<!DOCTYPE html>
+var SWAGGER_UI_HTML = (specUrl, nonce) => `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <title>Tina4 API Documentation</title>
   <link rel="stylesheet" href="${swaggerUiCdn()}/swagger-ui.css">
-  <style>
+  <style nonce="${nonce}">
     body { margin: 0; background: #fafafa; }
     .topbar { display: none !important; }
   </style>
@@ -501,7 +501,7 @@ var SWAGGER_UI_HTML = (specUrl) => `<!DOCTYPE html>
 <body>
   <div id="swagger-ui"></div>
   <script src="${swaggerUiCdn()}/swagger-ui-bundle.js"></script>
-  <script>
+  <script nonce="${nonce}">
     SwaggerUIBundle({
       url: "${specUrl}",
       dom_id: '#swagger-ui',
@@ -522,7 +522,7 @@ function swaggerEnabled() {
 }
 function createSwaggerRoutes(getSpec) {
   const serveUi = async (_req, res) => {
-    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json", res.cspNonce));
   };
   return [
     {

package/packages/swagger/src/ui.ts CHANGED Viewed

@@ -18,13 +18,16 @@ function swaggerUiCdn(): string {
   return (process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5").replace(/\/+$/, "");
 }
-const SWAGGER_UI_HTML = (specUrl: string) => `<!DOCTYPE html>
+// The inline <style> and the inline SwaggerUIBundle(...) <script> carry this
+// response's CSP nonce (ADR-0088) so they run under the strict default
+// Content-Security-Policy; the external <script src>/<link> need none.
+const SWAGGER_UI_HTML = (specUrl: string, nonce: string) => `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <title>Tina4 API Documentation</title>
   <link rel="stylesheet" href="${swaggerUiCdn()}/swagger-ui.css">
-  <style>
+  <style nonce="${nonce}">
     body { margin: 0; background: #fafafa; }
     .topbar { display: none !important; }
   </style>
@@ -32,7 +35,7 @@ const SWAGGER_UI_HTML = (specUrl: string) => `<!DOCTYPE html>
 <body>
   <div id="swagger-ui"></div>
   <script src="${swaggerUiCdn()}/swagger-ui-bundle.js"></script>
-  <script>
+  <script nonce="${nonce}">
     SwaggerUIBundle({
       url: "${specUrl}",
       dom_id: '#swagger-ui',
@@ -65,7 +68,7 @@ export function createSwaggerRoutes(
   getSpec: () => unknown
 ): RouteDefinition[] {
   const serveUi = async (_req: Tina4Request, res: Tina4Response): Promise<void> => {
-    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json", res.cspNonce));
   };
   return [

package/types/core/src/csp.d.ts ADDED Viewed

@@ -0,0 +1,42 @@
+/** Return a fresh cryptographically-random nonce (128 bits, base64). */
+export declare function generateNonce(): string;
+/** Run `fn` with `nonce` established as the request-scoped CSP nonce. */
+export declare function runWithCspNonce<T>(nonce: string, fn: () => T): T;
+/** Set the nonce for the current request context (mirrors Log.setRequestId). */
+export declare function setCurrentNonce(nonce: string | undefined): void;
+/** Clear the nonce (mirrors Log.clearRequestId); the scope ends on its own. */
+export declare function clearCurrentNonce(): void;
+/**
+ * Return the current request's nonce, minting one on first access.
+ *
+ * Generate-on-first-access makes the value independent of ordering: whether the
+ * inline body or the CSP header is built first, both read the same nonce.
+ */
+export declare function currentCspNonce(): string;
+/**
+ * Frond global `csp_nonce()`: the current response's CSP nonce.
+ *
+ * Use it on any inline element a template emits:
+ *
+ *   <style nonce="{{ csp_nonce() }}"> ... </style>
+ *   <script nonce="{{ csp_nonce() }}"> ... </script>
+ */
+export declare function cspNonce(): string;
+/**
+ * Return `csp` with `'nonce-<nonce>'` present in style-src AND script-src.
+ *
+ * For the default `default-src 'self'` this yields
+ * `default-src 'self'; style-src 'self' 'nonce-X'; script-src 'self' 'nonce-X'`.
+ * When a directive is absent it is derived from `default-src` (falling back to
+ * `'self'`) so the framework's own nonce'd content always works; when present
+ * the nonce is appended (idempotently). Every other directive is kept, in order.
+ */
+export declare function injectNonceIntoCsp(csp: string, nonce: string): string;
+/**
+ * Build the CSP header value for `nonce` from the environment.
+ *
+ * Honours `TINA4_CSP` (default `default-src 'self'`) and always injects the
+ * nonce into style-src and script-src. An empty `TINA4_CSP` is treated as the
+ * default policy, matching how the warn-once gate reads "unset".
+ */
+export declare function resolveCspHeader(nonce: string): string;

package/types/core/src/index.d.ts CHANGED Viewed

@@ -54,6 +54,7 @@ export { WSDLService, WSDLOperation } from "./wsdl.js";
 export type { WSDLOperationMeta } from "./wsdl.js";
 export { HtmlElement, htmlElement, addHtmlHelpers, Raw, SafeString } from "./htmlElement.js";
 export { renderErrorOverlay, isDebugMode } from "./errorOverlay.js";
+export { cspNonce, currentCspNonce, generateNonce, injectNonceIntoCsp, resolveCspHeader, runWithCspNonce, setCurrentNonce, clearCurrentNonce, } from "./csp.js";
 export { AI_TOOLS, isInstalled, showMenu, installSelected, installAll, generateContext } from "./ai.js";
 export type { AiTool } from "./ai.js";
 export { Sso, SSO, SsoError } from "./sso.js";

package/types/core/src/middleware.d.ts CHANGED Viewed

@@ -344,6 +344,12 @@ export declare class SecurityHeadersMiddleware {
      * overrides, WITHOUT Strict-Transport-Security, which depends on the
      * request's scheme. Also what a transport rejection carries (ADR-0068
      * section 4), written before the scheme is known.
+     *
+     * Content-Security-Policy always carries a per-response nonce in style-src
+     * AND script-src (ADR-0088), read from the request async-context (minted on
+     * first access), so the framework's own inline content runs under the strict
+     * default without 'unsafe-inline'. The nonce is random per response, so a
+     * caller comparing this header must assert its STRUCTURE, never a byte string.
      */
     static canonicalHeaders(): Record<string, string>;
     static beforeSecurity(req: Tina4Request, res: Tina4Response): [Tina4Request, Tina4Response];

package/types/core/src/session.d.ts CHANGED Viewed

@@ -123,6 +123,29 @@ export declare class Session {
      * Lets `start()` tell "no such session" from "the store is unreachable".
      */
     private lastReadFailed;
+    /**
+     * What this request last saw of the stored record, one fingerprint per key:
+     * taken by start() and again by every save. save() compares the live data
+     * against it to find the keys THIS request changed.
+     */
+    private loaded;
+    /**
+     * True when this request is working on a record the store holds: start()
+     * adopted one, or a save has written one since. A save never re-creates such
+     * a record once another request has removed it.
+     */
+    private stored;
+    /**
+     * True when clear() ran since the last save: the save then replaces the
+     * stored record instead of merging into it.
+     */
+    private cleared;
+    /**
+     * True once this request found its session ended by another request (the
+     * record it loaded is gone). It stays ended for the rest of the request:
+     * regenerate() mints nothing either.
+     */
+    private ended;
     constructor(backend?: string, config?: SessionConfig);
     /**
      * Use a custom session handler (for advanced use cases).
@@ -209,8 +232,14 @@ export declare class Session {
      * session fixation — the pre-auth ID is destroyed and the data is carried
      * onto a fresh, unguessable ID. A backend destroy/write failure is logged
      * (never silent) but does not throw under the default policy.
+     *
+     * What is carried is the session as it is stored now with this request's
+     * own changes applied, the same merge save() does. If another request ended
+     * the session after this one loaded it (a logout, or a regenerate of its
+     * own), it stays ended: nothing is carried, no id is minted and null is
+     * returned, so no cookie goes out to replace the one that request sent.
      */
-    regenerate(): string;
+    regenerate(): string | null;
     /**
      * Dual-mode flash: set with value, get+remove without.
      *
@@ -256,9 +285,40 @@ export declare class Session {
      *
      * Returns true on a successful persist, false if the backend was unreachable
      * (logged). The dirty flag is cleared only on success so a later save()
-     * retries once the backend recovers. A nothing-to-persist call returns true.
+     * retries once the backend recovers. A call with no session returns true.
+     *
+     * Other requests on the same session run while this one does, so the save
+     * writes only THIS request's changes, onto the record as it is stored now.
+     * Writing back the whole snapshot start() loaded undid whatever another
+     * request did in between: a logout (destroy, clear, regenerate) or a
+     * privilege change made with set(). A record removed since this request
+     * loaded it is never re-created: the session has ended, for this request
+     * too. A request that has not loaded a stored record (a new session, the new
+     * id regenerate() mints) writes its data whole, as before.
+     *
+     * A session the store already holds is re-written even when this request
+     * changed nothing: that write re-stamps the backend deadline to
+     * now + TINA4_SESSION_TTL, so a session expires after that span of INACTIVITY
+     * rather than that long after its last CHANGE (ADR-0087 — a session's expiry
+     * slides on activity). The re-write is the re-read, merged record, so sliding
+     * the deadline is concurrent-safe: it never clobbers another request's change,
+     * never re-creates an ended record, and TINA4_SESSION_TTL=0 still re-stamps a
+     * never-expires deadline (ADR-0027). A request with no stored session and no
+     * change writes nothing — there is no deadline to move.
      */
     save(): boolean;
+    /**
+     * The stored record with this request's changes applied: every key whose
+     * value differs from what this request loaded or last saved, and the
+     * removal of every key it deleted. Keys it did not touch keep whatever is
+     * stored now.
+     */
+    private merged;
+    /**
+     * End the session for this request without touching the store: no id and
+     * no data, so nothing more is written and no cookie goes out for it.
+     */
+    private forget;
 }
 /**
  * Is the client's scheme HTTPS? Proxy-aware.

package/types/core/src/types.d.ts CHANGED Viewed

@@ -116,6 +116,14 @@ export interface Tina4ResponseMethods {
     stream(source: AsyncIterable<string | Buffer>, contentType?: string): Promise<Tina4Response>;
     /** The underlying ServerResponse for advanced use */
     raw: ServerResponse;
+    /**
+     * This response's Content-Security-Policy nonce (ADR-0088). `runDispatch()`
+     * mints one per request and publishes it on the async-context (csp.ts) so the
+     * framework's inline `<style>`/`<script>`, the Frond `csp_nonce()` global, and
+     * the value the security middleware names in the header all agree. Stamp it on
+     * any inline block a route emits: `<script nonce="${res.cspNonce}">`.
+     */
+    cspNonce: string;
 }
 /**
  * Tina4 Response — callable AND has methods.

package/types/frond/src/engine.d.ts CHANGED Viewed

@@ -53,6 +53,13 @@ export declare const expressionFormCache: Map<string, number>;
  * Set the session ID used by formToken() / form_token() for CSRF session binding.
  */
 export declare function setFormTokenSessionId(sessionId: string): void;
+/**
+ * Register the function that backs the `{{ csp_nonce() }}` template global.
+ * @tina4/core calls this once with its request-scoped nonce source so every
+ * Frond instance (framework templates AND the app's) resolves the same nonce
+ * the Content-Security-Policy header names.
+ */
+export declare function setCspNonceProvider(fn: () => string): void;
 export declare class Frond {
     private static classFilters;
     private static classGlobals;