toiljs 0.0.91 → 0.0.93

package/src/compiler/config.ts

@@ -51,8 +51,13 @@ export interface ClientConfig {
     readonly outDir?: string;
     /** Public base path. Default `/`. */
     readonly base?: string;
-    /** Dev server port. Default `3000`. */
+    /** Port the dev server AND the self-host (`toiljs start`) listen on. Default `3000`.
+     *  Overridden by the `--port` CLI flag and the `PORT` env var (in that precedence). */
     readonly port?: number;
+    /** Bind host for the dev server AND the self-host. Default `127.0.0.1` (loopback only).
+     *  Set to `0.0.0.0` (or a specific interface) to accept LAN / public connections.
+     *  Overridden by the `--host` CLI flag and the `HOST` env var (in that precedence). */
+    readonly host?: string;
     /**
      * Optimize imported images at build time (resize/convert via `vite-imagetools` + sharp): an
      * import like `logo.png?w=400;800&format=webp&as=srcset` emits resized, compressed variants.
@@ -194,6 +199,8 @@ export interface ResolvedToilConfig {
     readonly outDir: string;
     readonly base: string;
     readonly port: number;
+    /** Bind host for the dev server + self-host (`toiljs start`). Default `127.0.0.1`. */
+    readonly host: string;
     /** Whether build-time image optimization (`vite-imagetools`) is enabled. */
     readonly images: boolean;
     /** Whether build-time font preloading is enabled. */
@@ -246,7 +253,7 @@ function resolveRuntimePath(): string {
 
 /** Finds and loads `toil.config.*` or `toiljs.config.*` from `root`, then resolves defaults. */
 export async function loadConfig(
-    opts: { root?: string; port?: number } = {},
+    opts: { root?: string; port?: number; host?: string } = {},
 ): Promise<ResolvedToilConfig> {
     const root = path.resolve(opts.root ?? process.cwd());
 
@@ -278,7 +285,12 @@ export async function loadConfig(
         toilDir: path.join(root, '.toil'),
         outDir: client.outDir ?? 'build/client',
         base: client.base ?? '/',
-        port: opts.port ?? client.port ?? 3000,
+        // Port + bind host for the dev server and the self-host, resolved with the
+        // precedence: CLI flag (opts) > env (PORT/HOST) > config (client.*) > default.
+        // `PORT`/`HOST` are the conventional PaaS env vars; a platform that injects
+        // `PORT` (Heroku, Render, Fly, containers) works with zero config.
+        port: opts.port ?? envPort() ?? client.port ?? 3000,
+        host: opts.host ?? envHost() ?? client.host ?? '127.0.0.1',
         images: client.images ?? true,
         fonts: client.fonts ?? true,
         viewTransitions: client.viewTransitions ?? false,
@@ -299,6 +311,21 @@ export async function loadConfig(
     };
 }
 
+/** The `PORT` env var as a positive integer, or `undefined` when unset/invalid
+ *  (so it falls through to the config value / default rather than binding to 0). */
+function envPort(): number | undefined {
+    const v = process.env.PORT;
+    if (v == null || v.trim() === '') return undefined;
+    const n = Number(v);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : undefined;
+}
+
+/** The `HOST` env var (trimmed), or `undefined` when unset/blank. */
+function envHost(): string | undefined {
+    const v = process.env.HOST;
+    return v != null && v.trim() !== '' ? v.trim() : undefined;
+}
+
 const DEV_NODE_MODES: readonly DevNodeMode[] = ['hot', 'regional', 'continental', 'daemon', 'all'];
 
 /** A `nodeMode` outside the enum falls back to `all` with a warning (fail-soft:

package/src/compiler/index.ts

@@ -845,6 +845,17 @@ async function collectDevCss(server: ViteDevServer): Promise<string> {
     return css;
 }
 
+/** The host to show in a clickable URL: a wildcard bind (`0.0.0.0`/`::`/empty) is
+ *  not universally openable, so present `localhost` for those; otherwise the host. */
+function displayHost(host: string): string {
+    return host === '0.0.0.0' || host === '::' || host === '' ? 'localhost' : host;
+}
+
+/** Whether the bind host exposes the server beyond loopback (worth flagging to the user). */
+function isExposedHost(host: string): boolean {
+    return host !== '127.0.0.1' && host !== 'localhost' && host !== '::1';
+}
+
 export async function dev(opts: ToilCommandOptions = {}): Promise<ViteDevServer> {
     const cfg = await loadConfig(opts);
     // Server first: build it (regenerating shared/server.ts) before the client dev server starts.
@@ -921,6 +932,7 @@ export async function dev(opts: ToilCommandOptions = {}): Promise<ViteDevServer>
     const front = await startDevServer({
         root: cfg.root,
         port: cfg.port,
+        host: cfg.host,
         wasmFile: serverWasmFile(cfg.root),
         // The daemon (cold) emulator drives `release-cold.wasm` per `nodeMode`; absent for a
         // project with no `@daemon` (the cold artifact never gets built, so the host stays idle).
@@ -938,17 +950,21 @@ export async function dev(opts: ToilCommandOptions = {}): Promise<ViteDevServer>
     server.httpServer?.once('close', () => {
         void front.close();
     });
+    const shownHost = displayHost(front.host);
     process.stdout.write(
         '\n  ' +
             pc.green('➜') +
             '  ' +
             pc.bold('Local') +
             ':   ' +
-            pc.cyan(`http://localhost:${pc.bold(String(front.port))}/`) +
+            pc.cyan(`http://${shownHost}:${pc.bold(String(front.port))}/`) +
             pc.dim('  (wasm server + vite)') +
+            (isExposedHost(front.host)
+                ? pc.yellow(`\n  ⚠  exposed on ${front.host}:${String(front.port)} (not just loopback)`)
+                : '') +
             '\n',
     );
-    printEmailsUrl(cfg, `http://localhost:${String(front.port)}/`);
+    printEmailsUrl(cfg, `http://${shownHost}:${String(front.port)}/`);
 
     // Rebuild the server on server-file changes; Vite HMRs the regenerated shared/server.ts
     // and the dev server hot-swaps the recompiled wasm module.
@@ -1044,7 +1060,9 @@ export async function start(opts: ToilCommandOptions = {}): Promise<RunningBacke
         daemon: cfg.daemon,
         threads: opts.threads ?? cfg.threads,
         port: cfg.port,
-        host: opts.host,
+        // `cfg.host` already folds in the `--host` flag, `HOST` env, and `client.host`
+        // config (CLI > env > config > 127.0.0.1); see loadConfig.
+        host: cfg.host,
         email: cfg.email ?? undefined,
     });
 }

package/test/config-host-port.test.ts

@@ -0,0 +1,59 @@
+/**
+ * loadConfig host/port resolution: the dev server AND the self-host (`toiljs start`)
+ * bind to a host+port resolved with the precedence CLI flag > env (PORT/HOST) >
+ * config (client.host/port) > default (127.0.0.1:3000). These lock that precedence
+ * and the env parsing (a blank/garbage PORT must fall through, never bind to 0).
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { loadConfig } from '../src/compiler/config.js';
+
+// An empty dir with no toil.config so loadConfig exercises the env/opts/default path.
+const emptyRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'toil-cfg-'));
+
+describe('loadConfig host/port precedence', () => {
+    const savedPort = process.env.PORT;
+    const savedHost = process.env.HOST;
+    afterEach(() => {
+        if (savedPort === undefined) delete process.env.PORT;
+        else process.env.PORT = savedPort;
+        if (savedHost === undefined) delete process.env.HOST;
+        else process.env.HOST = savedHost;
+    });
+
+    it('defaults to 127.0.0.1:3000 with no flag / env / config', async () => {
+        delete process.env.PORT;
+        delete process.env.HOST;
+        const cfg = await loadConfig({ root: emptyRoot });
+        expect(cfg.port).toBe(3000);
+        expect(cfg.host).toBe('127.0.0.1');
+    });
+
+    it('reads the PORT / HOST env vars', async () => {
+        process.env.PORT = '8080';
+        process.env.HOST = '0.0.0.0';
+        const cfg = await loadConfig({ root: emptyRoot });
+        expect(cfg.port).toBe(8080);
+        expect(cfg.host).toBe('0.0.0.0');
+    });
+
+    it('CLI opts win over env (CLI > env)', async () => {
+        process.env.PORT = '8080';
+        process.env.HOST = '0.0.0.0';
+        const cfg = await loadConfig({ root: emptyRoot, port: 4321, host: '192.168.1.5' });
+        expect(cfg.port).toBe(4321);
+        expect(cfg.host).toBe('192.168.1.5');
+    });
+
+    it('a blank / non-numeric PORT env falls through to the default (never binds to 0)', async () => {
+        process.env.PORT = '';
+        delete process.env.HOST;
+        expect((await loadConfig({ root: emptyRoot })).port).toBe(3000);
+        process.env.PORT = 'not-a-number';
+        expect((await loadConfig({ root: emptyRoot })).port).toBe(3000);
+    });
+});

package/test/pqauth-email.test.ts

@@ -40,17 +40,20 @@ function loadModule(): WasmServerModule {
     return m;
 }
 
-/** Route the client's `fetch(path, {body})` into the dev wasm dispatcher (with a cookie jar). */
+/** Route the client's `fetch(path, {body})` into the dev wasm dispatcher (with a cookie jar).
+ *  The Host header the client's requests carry is settable (`setHost`) so a test can drive
+ *  the same client against DIFFERENT tenant domains and prove per-host auth isolation. */
 function installFetchShim(m: WasmServerModule): () => void {
     const original = globalThis.fetch;
     const jar = new Map<string, string>();
+    let host = 'localhost:3000';
     globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
         const url = typeof input === 'string' ? input : input.toString();
         const pathname = new URL(url, 'http://localhost').pathname;
         const bodyBytes =
             init?.body == null ? new Uint8Array(0) : new Uint8Array(init.body as ArrayBuffer);
         const headers: [string, string][] = [
-            ['host', 'localhost:3000'],
+            ['host', host],
             ['content-type', 'application/octet-stream'],
         ];
         if (jar.size > 0)
@@ -80,6 +83,9 @@ function installFetchShim(m: WasmServerModule): () => void {
             globalThis.fetch = original;
         },
         jar,
+        setHost: (h: string) => {
+            host = h;
+        },
     };
 }
 
@@ -136,6 +142,7 @@ describe.skipIf(!haveWasm)('built-in auth: email verification + password reset (
     let restoreFetch: () => void;
     let mod: WasmServerModule;
     let jar: Map<string, string>;
+    let setHost: (h: string) => void;
 
     beforeEach(() => {
         __resetDbForTests();
@@ -148,6 +155,7 @@ describe.skipIf(!haveWasm)('built-in auth: email verification + password reset (
         const shim = installFetchShim(mod);
         restoreFetch = shim.restore;
         jar = shim.jar;
+        setHost = shim.setHost;
     });
     afterEach(() => {
         restoreFetch();
@@ -179,10 +187,13 @@ describe.skipIf(!haveWasm)('built-in auth: email verification + password reset (
     it(
         'reset link is NOT poisonable via a crafted Host header (#6 host-header reset-poisoning)',
         async () => {
+            // grace lives on the victim tenant (realm = normalized Host "victim.com").
+            setHost('victim.com');
             await Auth.register('grace', 'pw-grace-correct', 'grace@x.com');
             __clearSentEmails();
             // Attacker triggers reset/request with a Host that routes to the victim
-            // (the edge strip_port -> "victim.com") but, dropped raw into a link,
+            // (the edge strip_port -> "victim.com", which is grace's realm, so the
+            // request DOES resolve her account) but, dropped raw into a link,
             // reparents the URL authority to attacker.com.
             const body = new DataWriter().writeString('grace@x.com').toBytes();
             const r = mod.dispatch({
@@ -634,4 +645,75 @@ describe.skipIf(!haveWasm)('built-in auth: email verification + password reset (
         },
         120_000,
     );
+
+    it(
+        '(g) per-domain isolation: a confirm/reset/2FA code minted on domain A is USELESS on domain B',
+        async () => {
+            const A = 'a.example.com';
+            const B = 'b.example.com';
+
+            // ---- confirm token: minted on A, unredeemable on B ----
+            setConfirmation(true);
+            setHost(A);
+            await Auth.register('mia', 'mia-pw-strong', 'mia@x.com'); // realm A + confirm token emailed
+            const confirmTok = tokenFromEmail('confirm', 'mia@x.com');
+
+            setHost(B);
+            __resetRatelimitForTests();
+            // Same raw token, different realm -> tokenId(B, raw) is a different key -> miss.
+            await expect(Auth.confirmEmail(confirmTok)).rejects.toThrow();
+
+            setHost(A);
+            __resetRatelimitForTests();
+            await Auth.confirmEmail(confirmTok); // realm A -> confirms
+            setConfirmation(false);
+
+            // ---- reset token: minted on A, unredeemable on B ----
+            setHost(A);
+            __clearSentEmails();
+            __resetRatelimitForTests();
+            await Auth.requestPasswordReset('mia@x.com');
+            const resetTok = tokenFromEmail('reset', 'mia@x.com');
+
+            setHost(B);
+            __resetRatelimitForTests();
+            await expect(Auth.resetPassword(resetTok, 'mia-pw-new')).rejects.toThrow(); // realm B miss
+
+            setHost(A);
+            __resetRatelimitForTests();
+            await Auth.resetPassword(resetTok, 'mia-pw-new'); // realm A -> resets
+
+            // ---- 2FA login code: minted on A, unusable on B ----
+            setHost(A);
+            __resetRatelimitForTests();
+            await Auth.login('mia', 'mia-pw-new'); // session on A (2FA still off)
+            __clearSentEmails();
+            await Auth.setupTwoFactor(Auth.TwoFactorMethod.Email);
+            await Auth.confirmTwoFactorSetup(codeFromEmail('mia@x.com')); // 2FA enabled on A
+
+            __clearSentEmails();
+            jar.clear();
+            __resetRatelimitForTests();
+            let err: unknown;
+            try {
+                await Auth.login('mia', 'mia-pw-new'); // -> 2FA challenge (twoFaId + code, realm A)
+            } catch (e) {
+                err = e;
+            }
+            const twoFaId = (err as TwoFactorRequiredError).twoFaId;
+            const loginCode = codeFromEmail('mia@x.com');
+
+            setHost(B);
+            __resetRatelimitForTests();
+            // The twoFaId lives in twoFaLogins under realm A; on B its key (and the
+            // realm-bound codeHash) miss -> a code from A cannot mint a session on B.
+            await expect(Auth.verifyTwoFactor(twoFaId, loginCode)).rejects.toThrow();
+
+            setHost(A);
+            __resetRatelimitForTests();
+            const session = await Auth.verifyTwoFactor(twoFaId, loginCode); // realm A -> mints
+            expect(session.length).toBeGreaterThan(0);
+        },
+        180_000,
+    );
 });