xypriss 9.12.10 → 9.12.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/src/plugins/builtin/xems/XemsBuiltinPlugin.js +20 -19
- package/dist/cjs/src/plugins/builtin/xems/XemsBuiltinPlugin.js.map +1 -1
- package/dist/esm/src/plugins/builtin/xems/XemsBuiltinPlugin.js +20 -19
- package/dist/esm/src/plugins/builtin/xems/XemsBuiltinPlugin.js.map +1 -1
- package/package.json +1 -1
|
@@ -26,6 +26,11 @@ class XemsBuiltinPlugin {
|
|
|
26
26
|
autoRotation: true,
|
|
27
27
|
attachTo: "session",
|
|
28
28
|
gracePeriod: 1000,
|
|
29
|
+
cookieOptions: {
|
|
30
|
+
httpOnly: true,
|
|
31
|
+
secure: true,
|
|
32
|
+
sameSite: "Strict",
|
|
33
|
+
},
|
|
29
34
|
};
|
|
30
35
|
this.hasValidSecret = false;
|
|
31
36
|
this.logger = Logger.Logger.getInstance();
|
|
@@ -42,7 +47,7 @@ class XemsBuiltinPlugin {
|
|
|
42
47
|
// 1. Configuration Extraction
|
|
43
48
|
// Use local app config strictly to avoid global singleton pollution in multi-server/auxiliary modes
|
|
44
49
|
// If not explicitly configured, fallback to global defaults only if NOT an auxiliary server
|
|
45
|
-
let xemsOptions = app.configs?.server?.xems;
|
|
50
|
+
let xemsOptions = app.configs?.server?.xems || ConfigurationManager.CM.get("server")?.xems;
|
|
46
51
|
if (!xemsOptions) {
|
|
47
52
|
if (app.configs?.isAuxiliary) {
|
|
48
53
|
// Auxiliary servers should NEVER auto-spawn persistence unless explicitly requested.
|
|
@@ -69,13 +74,18 @@ class XemsBuiltinPlugin {
|
|
|
69
74
|
autoRotation: xemsOptions.autoRotation !== false,
|
|
70
75
|
attachTo: xemsOptions.attachTo || "session",
|
|
71
76
|
gracePeriod: xemsOptions.gracePeriod || 1000,
|
|
77
|
+
cookieOptions: xemsOptions.cookieOptions ?? {
|
|
78
|
+
httpOnly: true,
|
|
79
|
+
secure: true,
|
|
80
|
+
sameSite: "Strict",
|
|
81
|
+
},
|
|
72
82
|
};
|
|
73
83
|
if (!isAuxiliary) {
|
|
74
84
|
logger.info("plugins", `XEMS Session Sandbox: ${this.sessionOptions.sandbox}`);
|
|
75
85
|
}
|
|
76
86
|
// Check for valid secret (mandatory for any XEMS API usage)
|
|
77
87
|
const secret = xemsOptions.persistence?.secret;
|
|
78
|
-
if (secret.length < 32) {
|
|
88
|
+
if (secret && secret.length < 32) {
|
|
79
89
|
this.hasValidSecret = false;
|
|
80
90
|
logger.error("plugins", "XEMS Persistence enabled but no valid 32-byte secret found.");
|
|
81
91
|
}
|
|
@@ -140,7 +150,7 @@ class XemsBuiltinPlugin {
|
|
|
140
150
|
* Native/Fast validation logic (runs on every request)
|
|
141
151
|
*/
|
|
142
152
|
async onRequest(req, res, next) {
|
|
143
|
-
const { sandbox, cookieName, headerName, ttl, autoRotation, attachTo } = this.sessionOptions;
|
|
153
|
+
const { sandbox, cookieName, headerName, ttl, autoRotation, attachTo, cookieOptions, } = this.sessionOptions;
|
|
144
154
|
const token = (req.cookies && req.cookies[cookieName]) ||
|
|
145
155
|
req.headers[headerName];
|
|
146
156
|
// 2. Inject xLink (Session Initiation)
|
|
@@ -170,11 +180,7 @@ class XemsBuiltinPlugin {
|
|
|
170
180
|
});
|
|
171
181
|
res._xemsNewToken = newToken;
|
|
172
182
|
// Apply immediately
|
|
173
|
-
res.cookie(cookieName, newToken,
|
|
174
|
-
httpOnly: true,
|
|
175
|
-
secure: true,
|
|
176
|
-
sameSite: "strict",
|
|
177
|
-
});
|
|
183
|
+
res.cookie(cookieName, newToken, cookieOptions);
|
|
178
184
|
res.setHeader(headerName, newToken);
|
|
179
185
|
req[actualAttachTo] = data;
|
|
180
186
|
return newToken;
|
|
@@ -197,7 +203,10 @@ class XemsBuiltinPlugin {
|
|
|
197
203
|
if (currentToken) {
|
|
198
204
|
await this.runner.from(actualSandbox).del(currentToken);
|
|
199
205
|
}
|
|
200
|
-
res.clearCookie(cookieName
|
|
206
|
+
res.clearCookie(cookieName, {
|
|
207
|
+
path: cookieOptions.path,
|
|
208
|
+
domain: cookieOptions.domain,
|
|
209
|
+
});
|
|
201
210
|
res.removeHeader(headerName);
|
|
202
211
|
req[actualAttachTo] = null;
|
|
203
212
|
};
|
|
@@ -217,11 +226,7 @@ class XemsBuiltinPlugin {
|
|
|
217
226
|
res.send = function (body) {
|
|
218
227
|
const newToken = res._xemsNewToken;
|
|
219
228
|
if (newToken) {
|
|
220
|
-
res.cookie(cookieName, newToken,
|
|
221
|
-
httpOnly: true,
|
|
222
|
-
secure: true,
|
|
223
|
-
sameSite: "strict",
|
|
224
|
-
});
|
|
229
|
+
res.cookie(cookieName, newToken, cookieOptions);
|
|
225
230
|
res.setHeader(headerName, newToken);
|
|
226
231
|
}
|
|
227
232
|
return originalSend.call(this, body);
|
|
@@ -230,11 +235,7 @@ class XemsBuiltinPlugin {
|
|
|
230
235
|
res.json = function (data) {
|
|
231
236
|
const newToken = res._xemsNewToken;
|
|
232
237
|
if (newToken) {
|
|
233
|
-
res.cookie(cookieName, newToken,
|
|
234
|
-
httpOnly: true,
|
|
235
|
-
secure: true,
|
|
236
|
-
sameSite: "strict",
|
|
237
|
-
});
|
|
238
|
+
res.cookie(cookieName, newToken, cookieOptions);
|
|
238
239
|
res.setHeader(headerName, newToken);
|
|
239
240
|
}
|
|
240
241
|
return originalJson.call(this, data);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"XemsBuiltinPlugin.js","sources":["../../../../../../src/plugins/builtin/xems/XemsBuiltinPlugin.ts"],"sourcesContent":[null],"names":["Logger","XemsRunner","Configs"],"mappings":";;;;;;AAAA;;;;;;;AAOG;
|
|
1
|
+
{"version":3,"file":"XemsBuiltinPlugin.js","sources":["../../../../../../src/plugins/builtin/xems/XemsBuiltinPlugin.ts"],"sourcesContent":[null],"names":["Logger","XemsRunner","Configs"],"mappings":";;;;;;AAAA;;;;;;;AAOG;MASU,iBAAiB,CAAA;AAoC1B,IAAA,WAAA,GAAA;QAnCgB,IAAA,CAAA,IAAI,GAAG,oBAAoB;QAC3B,IAAA,CAAA,OAAO,GAAG,QAAQ;QAClB,IAAA,CAAA,IAAI,GAAG,UAAU;QACjB,IAAA,CAAA,WAAW,GACvB,qDAAqD;AAIjD,QAAA,IAAA,CAAA,cAAc,GASlB;AACA,YAAA,OAAO,EAAE,uBAAuB;AAChC,YAAA,UAAU,EAAE,YAAY;AACxB,YAAA,UAAU,EAAE,iBAAiB;AAC7B,YAAA,GAAG,EAAE,KAAK;AACV,YAAA,YAAY,EAAE,IAAI;AAClB,YAAA,QAAQ,EAAE,SAAS;AACnB,YAAA,WAAW,EAAE,IAAI;AACjB,YAAA,aAAa,EAAE;AACX,gBAAA,QAAQ,EAAE,IAAI;AACd,gBAAA,MAAM,EAAE,IAAI;AACZ,gBAAA,QAAQ,EAAE,QAAQ;AACrB,aAAA;SACJ;QAEO,IAAA,CAAA,cAAc,GAAY,KAAK;AAC/B,QAAA,IAAA,CAAA,MAAM,GAAGA,aAAM,CAAC,WAAW,EAAE;;;AAKjC,QAAA,IAAI,CAAC,MAAM,GAAG,IAAIC,qBAAU,EAAE;IAClC;AAEA;;AAEG;IACI,MAAM,aAAa,CAAC,MAAoB,EAAA;AAC3C,QAAA,MAAM,GAAG,GAAG,MAAM,CAAC,GAAU;AAC7B,QAAA,MAAM,MAAM,GAAI,GAAW,CAAC,MAAM;;;;AAKlC,QAAA,IAAI,WAAW,GAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,IAAIC,uBAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI;QAEpF,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE;;;AAG1B,gBAAA,WAAW,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;YACnC;iBAAO;;AAEH,gBAAA,WAAW,GAAGA,uBAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;YAClE;QACJ;;AAGA,QAAA,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM;AAEtB,QAAA,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,WAAW;QAE5C,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,2CAA2C,CAAC;QACvE;;QAGA,IAAI,CAAC,cAAc,GAAG;AAClB,YAAA,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,cAAc;AAC9C,YAAA,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,YAAY;AAClD,YAAA,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,iBAAiB;AACvD,YAAA,GAAG,EAAE,WAAW,CAAC,GAAG,IAAI,KAAK;AAC7B,YAAA,YAAY,EAAE,WAAW,CAAC,YAAY,KAAK,KAAK;AAChD,YAAA,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,SAAS;AAC3C,YAAA,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,IAAI;AAC5C,YAAA,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI;AACxC,gBAAA,QAAQ,EAAE,IAAI;AACd,gBAAA,MAAM,EAAE,IAAI;AACZ,gBAAA,QAAQ,EAAE,QAAQ;AACrB,aAAA;SACJ;QAED,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,MAAM,CAAC,IAAI,CACP,SAAS,EACT,CAAA,sBAAA,EAAyB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAA,CAAE,CACzD;QACL;;AAGA,QAAA,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,MAAM;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE;AAC9B,YAAA,IAAI,CAAC,cAAc,GAAG,KAAK;AAC3B,YAAA,MAAM,CAAC,KAAK,CACR,SAAS,EACT,6DAA6D,CAChE;QACL;AACA,QAAA,IACI,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EACzC;AACE,YAAA,IAAI,CAAC,cAAc,GAAG,IAAI;QAC9B;AAEA,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA,OAAA,EAAU,GAAG,CAAC,EAAE,IAAI,WAAW,CAAA,mCAAA,EAAsC,IAAI,CAAC,cAAc,CAAA,UAAA,EAAa,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA,CAAE,CAAC;;;;;;;;;AAUjK,QAAA,IAAI,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE;AAClC,YAAA,MAAM,EACF,IAAI,EAAE,OAAO,EACb,MAAM,EACN,SAAS,GACZ,GAAG,WAAW,CAAC,WAAW;AAE3B,YAAA,IAAI,OAAO,IAAI,MAAM,EAAE;;;gBAGnB,IAAI,CAAC,MAAM,GAAGD,qBAAU,CAAC,WAAW,CAAC,OAAO,EAAE;oBAC1C,MAAM;oBACN,SAAS,EAAE,SAAS,EAAE,SAAS;AAClC,iBAAA,CAAC;AAEF,gBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA,4BAAA,EAAgCA,qBAAkB,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,cAAc,OAAO,CAAA,CAAE,CAAC;;AAG7H,gBAAA,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM;AAEtB,gBAAA,IAAI;oBACA,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAQ,EAAE,MAAM,EAAE;wBAC5C,SAAS,EAAE,SAAS,EAAE,SAAS;AAClC,qBAAA,CAAC;gBACN;gBAAE,OAAO,GAAG,EAAE;oBACV,MAAM,CAAC,KAAK,CACR,SAAS,EACT,oDAAoD,EACpD,GAAG,CACN;gBACL;YACJ;iBAAO,IAAI,CAAC,WAAW,EAAE;AACrB,gBAAA,MAAM,CAAC,IAAI,CACP,SAAS,EACT,mFAAmF,CACtF;YACL;QACJ;;AAGA,QAAA,IAAI;AACA,YAAA,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;AAE9C,YAAA,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,EAAE;gBACzB,IAAI,CAAC,WAAW,EAAE;AACd,oBAAA,MAAM,CAAC,IAAI,CACP,SAAS,EACT,CAAA,wCAAA,EAA2C,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA,GAAA,CAAK,CACtE;gBACL;YACJ;iBAAO;AACH,gBAAA,MAAM,CAAC,IAAI,CACP,SAAS,EACT,6CAA6C,CAChD;YACL;QACJ;QAAE,OAAO,CAAC,EAAE;YACR,MAAM,CAAC,KAAK,CACR,SAAS,EACT,oEAAoE,EACpE,CAAC,CACJ;QACL;IACJ;AAEA;;AAEG;AACI,IAAA,MAAM,SAAS,CAClB,GAAY,EACZ,GAAa,EACb,IAAkB,EAAA;AAElB,QAAA,MAAM,EACF,OAAO,EACP,UAAU,EACV,UAAU,EACV,GAAG,EACH,YAAY,EACZ,QAAQ,EACR,aAAa,GAChB,GAAG,IAAI,CAAC,cAAc;AAEvB,QAAA,MAAM,KAAK,GACP,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;AACtC,YAAA,GAAG,CAAC,OAAO,CAAC,UAAU,CAAY;;QAGtC,GAAW,CAAC,KAAK,GAAG,OACjB,IAAS,EACT,WAEY,KACZ;AACA,YAAA,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;gBACtB,MAAM,IAAI,KAAK,CACX,oGAAoG;AAChG,oBAAA,sDAAsD,CAC7D;YACL;YAEA,IAAI,aAAa,GAAG,OAAO;YAC3B,IAAI,cAAc,GAAG,QAAQ;YAC7B,IAAI,SAAS,GAAG,GAAG;AAEnB,YAAA,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE;gBACjC,aAAa,GAAG,WAAW;YAC/B;iBAAO,IAAI,WAAW,EAAE;gBACpB,IAAI,WAAW,CAAC,OAAO;AAAE,oBAAA,aAAa,GAAG,WAAW,CAAC,OAAO;gBAC5D,IAAI,WAAW,CAAC,QAAQ;AAAE,oBAAA,cAAc,GAAG,WAAW,CAAC,QAAQ;gBAC/D,IAAI,WAAW,CAAC,GAAG;AAAE,oBAAA,SAAS,GAAG,WAAW,CAAC,GAAG;YACpD;AAEA,YAAA,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;iBACvB,IAAI,CAAC,aAAa;iBAClB,aAAa,CAAC,IAAI,EAAE;AACjB,gBAAA,GAAG,EAAE,SAAS;AACjB,aAAA,CAAC;AACL,YAAA,GAAW,CAAC,aAAa,GAAG,QAAQ;;YAGrC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC;AAC/C,YAAA,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC;AAElC,YAAA,GAAW,CAAC,cAAc,CAAC,GAAG,IAAI;AACnC,YAAA,OAAO,QAAQ;AACnB,QAAA,CAAC;;AAGA,QAAA,GAAW,CAAC,OAAO,GAAG,OACnB,aAAgE,KAChE;YACA,IAAI,aAAa,GAAG,OAAO;YAC3B,IAAI,cAAc,GAAG,QAAQ;AAE7B,YAAA,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE;gBACnC,aAAa,GAAG,aAAa;YACjC;iBAAO,IAAI,aAAa,EAAE;gBACtB,IAAI,aAAa,CAAC,OAAO;AACrB,oBAAA,aAAa,GAAG,aAAa,CAAC,OAAO;gBACzC,IAAI,aAAa,CAAC,QAAQ;AACtB,oBAAA,cAAc,GAAG,aAAa,CAAC,QAAQ;YAC/C;AAEA,YAAA,MAAM,YAAY,GACd,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;AACtC,gBAAA,GAAG,CAAC,OAAO,CAAC,UAAU,CAAY;YAEvC,IAAI,YAAY,EAAE;AACd,gBAAA,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3D;AAEA,YAAA,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE;gBACxB,IAAI,EAAE,aAAa,CAAC,IAAI;gBACxB,MAAM,EAAE,aAAa,CAAC,MAAM;AAC/B,aAAA,CAAC;AACF,YAAA,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC;AAC3B,YAAA,GAAW,CAAC,cAAc,CAAC,GAAG,IAAI;AACvC,QAAA,CAAC;;AAGD,QAAA,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE;AAC9B,YAAA,IAAI;AACA,gBAAA,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC1D,GAAG;AACH,oBAAA,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW;AAC/C,iBAAA,CAAC;gBAEF,IAAI,OAAO,EAAE;AACR,oBAAA,GAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI;AAErC,oBAAA,IAAI,YAAY,IAAI,OAAO,CAAC,QAAQ,EAAE;AACjC,wBAAA,GAAW,CAAC,aAAa,GAAG,OAAO,CAAC,QAAQ;;AAG7C,wBAAA,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI;AAC7B,wBAAA,GAAG,CAAC,IAAI,GAAG,UAAqB,IAAS,EAAA;AACrC,4BAAA,MAAM,QAAQ,GAAI,GAAW,CAAC,aAAa;4BAC3C,IAAI,QAAQ,EAAE;gCACV,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC;AAC/C,gCAAA,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC;4BACvC;4BACA,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;AACxC,wBAAA,CAAC;AAED,wBAAA,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI;AAC7B,wBAAA,GAAG,CAAC,IAAI,GAAG,UAAqB,IAAS,EAAA;AACrC,4BAAA,MAAM,QAAQ,GAAI,GAAW,CAAC,aAAa;4BAC3C,IAAI,QAAQ,EAAE;gCACV,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC;AAC/C,gCAAA,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC;4BACvC;4BACA,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;AACxC,wBAAA,CAAQ;oBACZ;gBACJ;YACJ;YAAE,OAAO,GAAG,EAAE;;YAEd;QACJ;AAEA,QAAA,IAAI,EAAE;IACV;AAEA;;AAEG;AACI,IAAA,MAAM,YAAY,GAAA;AACrB,QAAA,IAAI,IAAI,CAAC,MAAM,EAAE;AACb,YAAA,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QACzB;IACJ;AACH;;;;"}
|
|
@@ -24,6 +24,11 @@ class XemsBuiltinPlugin {
|
|
|
24
24
|
autoRotation: true,
|
|
25
25
|
attachTo: "session",
|
|
26
26
|
gracePeriod: 1000,
|
|
27
|
+
cookieOptions: {
|
|
28
|
+
httpOnly: true,
|
|
29
|
+
secure: true,
|
|
30
|
+
sameSite: "Strict",
|
|
31
|
+
},
|
|
27
32
|
};
|
|
28
33
|
this.hasValidSecret = false;
|
|
29
34
|
this.logger = Logger.getInstance();
|
|
@@ -40,7 +45,7 @@ class XemsBuiltinPlugin {
|
|
|
40
45
|
// 1. Configuration Extraction
|
|
41
46
|
// Use local app config strictly to avoid global singleton pollution in multi-server/auxiliary modes
|
|
42
47
|
// If not explicitly configured, fallback to global defaults only if NOT an auxiliary server
|
|
43
|
-
let xemsOptions = app.configs?.server?.xems;
|
|
48
|
+
let xemsOptions = app.configs?.server?.xems || ConfigurationManager.get("server")?.xems;
|
|
44
49
|
if (!xemsOptions) {
|
|
45
50
|
if (app.configs?.isAuxiliary) {
|
|
46
51
|
// Auxiliary servers should NEVER auto-spawn persistence unless explicitly requested.
|
|
@@ -67,13 +72,18 @@ class XemsBuiltinPlugin {
|
|
|
67
72
|
autoRotation: xemsOptions.autoRotation !== false,
|
|
68
73
|
attachTo: xemsOptions.attachTo || "session",
|
|
69
74
|
gracePeriod: xemsOptions.gracePeriod || 1000,
|
|
75
|
+
cookieOptions: xemsOptions.cookieOptions ?? {
|
|
76
|
+
httpOnly: true,
|
|
77
|
+
secure: true,
|
|
78
|
+
sameSite: "Strict",
|
|
79
|
+
},
|
|
70
80
|
};
|
|
71
81
|
if (!isAuxiliary) {
|
|
72
82
|
logger.info("plugins", `XEMS Session Sandbox: ${this.sessionOptions.sandbox}`);
|
|
73
83
|
}
|
|
74
84
|
// Check for valid secret (mandatory for any XEMS API usage)
|
|
75
85
|
const secret = xemsOptions.persistence?.secret;
|
|
76
|
-
if (secret.length < 32) {
|
|
86
|
+
if (secret && secret.length < 32) {
|
|
77
87
|
this.hasValidSecret = false;
|
|
78
88
|
logger.error("plugins", "XEMS Persistence enabled but no valid 32-byte secret found.");
|
|
79
89
|
}
|
|
@@ -138,7 +148,7 @@ class XemsBuiltinPlugin {
|
|
|
138
148
|
* Native/Fast validation logic (runs on every request)
|
|
139
149
|
*/
|
|
140
150
|
async onRequest(req, res, next) {
|
|
141
|
-
const { sandbox, cookieName, headerName, ttl, autoRotation, attachTo } = this.sessionOptions;
|
|
151
|
+
const { sandbox, cookieName, headerName, ttl, autoRotation, attachTo, cookieOptions, } = this.sessionOptions;
|
|
142
152
|
const token = (req.cookies && req.cookies[cookieName]) ||
|
|
143
153
|
req.headers[headerName];
|
|
144
154
|
// 2. Inject xLink (Session Initiation)
|
|
@@ -168,11 +178,7 @@ class XemsBuiltinPlugin {
|
|
|
168
178
|
});
|
|
169
179
|
res._xemsNewToken = newToken;
|
|
170
180
|
// Apply immediately
|
|
171
|
-
res.cookie(cookieName, newToken,
|
|
172
|
-
httpOnly: true,
|
|
173
|
-
secure: true,
|
|
174
|
-
sameSite: "strict",
|
|
175
|
-
});
|
|
181
|
+
res.cookie(cookieName, newToken, cookieOptions);
|
|
176
182
|
res.setHeader(headerName, newToken);
|
|
177
183
|
req[actualAttachTo] = data;
|
|
178
184
|
return newToken;
|
|
@@ -195,7 +201,10 @@ class XemsBuiltinPlugin {
|
|
|
195
201
|
if (currentToken) {
|
|
196
202
|
await this.runner.from(actualSandbox).del(currentToken);
|
|
197
203
|
}
|
|
198
|
-
res.clearCookie(cookieName
|
|
204
|
+
res.clearCookie(cookieName, {
|
|
205
|
+
path: cookieOptions.path,
|
|
206
|
+
domain: cookieOptions.domain,
|
|
207
|
+
});
|
|
199
208
|
res.removeHeader(headerName);
|
|
200
209
|
req[actualAttachTo] = null;
|
|
201
210
|
};
|
|
@@ -215,11 +224,7 @@ class XemsBuiltinPlugin {
|
|
|
215
224
|
res.send = function (body) {
|
|
216
225
|
const newToken = res._xemsNewToken;
|
|
217
226
|
if (newToken) {
|
|
218
|
-
res.cookie(cookieName, newToken,
|
|
219
|
-
httpOnly: true,
|
|
220
|
-
secure: true,
|
|
221
|
-
sameSite: "strict",
|
|
222
|
-
});
|
|
227
|
+
res.cookie(cookieName, newToken, cookieOptions);
|
|
223
228
|
res.setHeader(headerName, newToken);
|
|
224
229
|
}
|
|
225
230
|
return originalSend.call(this, body);
|
|
@@ -228,11 +233,7 @@ class XemsBuiltinPlugin {
|
|
|
228
233
|
res.json = function (data) {
|
|
229
234
|
const newToken = res._xemsNewToken;
|
|
230
235
|
if (newToken) {
|
|
231
|
-
res.cookie(cookieName, newToken,
|
|
232
|
-
httpOnly: true,
|
|
233
|
-
secure: true,
|
|
234
|
-
sameSite: "strict",
|
|
235
|
-
});
|
|
236
|
+
res.cookie(cookieName, newToken, cookieOptions);
|
|
236
237
|
res.setHeader(headerName, newToken);
|
|
237
238
|
}
|
|
238
239
|
return originalJson.call(this, data);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"XemsBuiltinPlugin.js","sources":["../../../../../../src/plugins/builtin/xems/XemsBuiltinPlugin.ts"],"sourcesContent":[null],"names":["Configs"],"mappings":";;;;AAAA;;;;;;;AAOG;
|
|
1
|
+
{"version":3,"file":"XemsBuiltinPlugin.js","sources":["../../../../../../src/plugins/builtin/xems/XemsBuiltinPlugin.ts"],"sourcesContent":[null],"names":["Configs"],"mappings":";;;;AAAA;;;;;;;AAOG;MASU,iBAAiB,CAAA;AAoC1B,IAAA,WAAA,GAAA;QAnCgB,IAAA,CAAA,IAAI,GAAG,oBAAoB;QAC3B,IAAA,CAAA,OAAO,GAAG,QAAQ;QAClB,IAAA,CAAA,IAAI,GAAG,UAAU;QACjB,IAAA,CAAA,WAAW,GACvB,qDAAqD;AAIjD,QAAA,IAAA,CAAA,cAAc,GASlB;AACA,YAAA,OAAO,EAAE,uBAAuB;AAChC,YAAA,UAAU,EAAE,YAAY;AACxB,YAAA,UAAU,EAAE,iBAAiB;AAC7B,YAAA,GAAG,EAAE,KAAK;AACV,YAAA,YAAY,EAAE,IAAI;AAClB,YAAA,QAAQ,EAAE,SAAS;AACnB,YAAA,WAAW,EAAE,IAAI;AACjB,YAAA,aAAa,EAAE;AACX,gBAAA,QAAQ,EAAE,IAAI;AACd,gBAAA,MAAM,EAAE,IAAI;AACZ,gBAAA,QAAQ,EAAE,QAAQ;AACrB,aAAA;SACJ;QAEO,IAAA,CAAA,cAAc,GAAY,KAAK;AAC/B,QAAA,IAAA,CAAA,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE;;;AAKjC,QAAA,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,EAAE;IAClC;AAEA;;AAEG;IACI,MAAM,aAAa,CAAC,MAAoB,EAAA;AAC3C,QAAA,MAAM,GAAG,GAAG,MAAM,CAAC,GAAU;AAC7B,QAAA,MAAM,MAAM,GAAI,GAAW,CAAC,MAAM;;;;AAKlC,QAAA,IAAI,WAAW,GAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,IAAIA,oBAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI;QAEpF,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE;;;AAG1B,gBAAA,WAAW,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE;YACnC;iBAAO;;AAEH,gBAAA,WAAW,GAAGA,oBAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;YAClE;QACJ;;AAGA,QAAA,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM;AAEtB,QAAA,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,WAAW;QAE5C,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,2CAA2C,CAAC;QACvE;;QAGA,IAAI,CAAC,cAAc,GAAG;AAClB,YAAA,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,cAAc;AAC9C,YAAA,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,YAAY;AAClD,YAAA,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,iBAAiB;AACvD,YAAA,GAAG,EAAE,WAAW,CAAC,GAAG,IAAI,KAAK;AAC7B,YAAA,YAAY,EAAE,WAAW,CAAC,YAAY,KAAK,KAAK;AAChD,YAAA,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,SAAS;AAC3C,YAAA,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,IAAI;AAC5C,YAAA,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI;AACxC,gBAAA,QAAQ,EAAE,IAAI;AACd,gBAAA,MAAM,EAAE,IAAI;AACZ,gBAAA,QAAQ,EAAE,QAAQ;AACrB,aAAA;SACJ;QAED,IAAI,CAAC,WAAW,EAAE;AACd,YAAA,MAAM,CAAC,IAAI,CACP,SAAS,EACT,CAAA,sBAAA,EAAyB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAA,CAAE,CACzD;QACL;;AAGA,QAAA,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,MAAM;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE;AAC9B,YAAA,IAAI,CAAC,cAAc,GAAG,KAAK;AAC3B,YAAA,MAAM,CAAC,KAAK,CACR,SAAS,EACT,6DAA6D,CAChE;QACL;AACA,QAAA,IACI,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EACzC;AACE,YAAA,IAAI,CAAC,cAAc,GAAG,IAAI;QAC9B;AAEA,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA,OAAA,EAAU,GAAG,CAAC,EAAE,IAAI,WAAW,CAAA,mCAAA,EAAsC,IAAI,CAAC,cAAc,CAAA,UAAA,EAAa,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA,CAAE,CAAC;;;;;;;;;AAUjK,QAAA,IAAI,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE;AAClC,YAAA,MAAM,EACF,IAAI,EAAE,OAAO,EACb,MAAM,EACN,SAAS,GACZ,GAAG,WAAW,CAAC,WAAW;AAE3B,YAAA,IAAI,OAAO,IAAI,MAAM,EAAE;;;gBAGnB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE;oBAC1C,MAAM;oBACN,SAAS,EAAE,SAAS,EAAE,SAAS;AAClC,iBAAA,CAAC;AAEF,gBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA,4BAAA,EAAgC,UAAkB,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,cAAc,OAAO,CAAA,CAAE,CAAC;;AAG7H,gBAAA,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM;AAEtB,gBAAA,IAAI;oBACA,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAQ,EAAE,MAAM,EAAE;wBAC5C,SAAS,EAAE,SAAS,EAAE,SAAS;AAClC,qBAAA,CAAC;gBACN;gBAAE,OAAO,GAAG,EAAE;oBACV,MAAM,CAAC,KAAK,CACR,SAAS,EACT,oDAAoD,EACpD,GAAG,CACN;gBACL;YACJ;iBAAO,IAAI,CAAC,WAAW,EAAE;AACrB,gBAAA,MAAM,CAAC,IAAI,CACP,SAAS,EACT,mFAAmF,CACtF;YACL;QACJ;;AAGA,QAAA,IAAI;AACA,YAAA,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;AAE9C,YAAA,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,EAAE;gBACzB,IAAI,CAAC,WAAW,EAAE;AACd,oBAAA,MAAM,CAAC,IAAI,CACP,SAAS,EACT,CAAA,wCAAA,EAA2C,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA,GAAA,CAAK,CACtE;gBACL;YACJ;iBAAO;AACH,gBAAA,MAAM,CAAC,IAAI,CACP,SAAS,EACT,6CAA6C,CAChD;YACL;QACJ;QAAE,OAAO,CAAC,EAAE;YACR,MAAM,CAAC,KAAK,CACR,SAAS,EACT,oEAAoE,EACpE,CAAC,CACJ;QACL;IACJ;AAEA;;AAEG;AACI,IAAA,MAAM,SAAS,CAClB,GAAY,EACZ,GAAa,EACb,IAAkB,EAAA;AAElB,QAAA,MAAM,EACF,OAAO,EACP,UAAU,EACV,UAAU,EACV,GAAG,EACH,YAAY,EACZ,QAAQ,EACR,aAAa,GAChB,GAAG,IAAI,CAAC,cAAc;AAEvB,QAAA,MAAM,KAAK,GACP,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;AACtC,YAAA,GAAG,CAAC,OAAO,CAAC,UAAU,CAAY;;QAGtC,GAAW,CAAC,KAAK,GAAG,OACjB,IAAS,EACT,WAEY,KACZ;AACA,YAAA,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;gBACtB,MAAM,IAAI,KAAK,CACX,oGAAoG;AAChG,oBAAA,sDAAsD,CAC7D;YACL;YAEA,IAAI,aAAa,GAAG,OAAO;YAC3B,IAAI,cAAc,GAAG,QAAQ;YAC7B,IAAI,SAAS,GAAG,GAAG;AAEnB,YAAA,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE;gBACjC,aAAa,GAAG,WAAW;YAC/B;iBAAO,IAAI,WAAW,EAAE;gBACpB,IAAI,WAAW,CAAC,OAAO;AAAE,oBAAA,aAAa,GAAG,WAAW,CAAC,OAAO;gBAC5D,IAAI,WAAW,CAAC,QAAQ;AAAE,oBAAA,cAAc,GAAG,WAAW,CAAC,QAAQ;gBAC/D,IAAI,WAAW,CAAC,GAAG;AAAE,oBAAA,SAAS,GAAG,WAAW,CAAC,GAAG;YACpD;AAEA,YAAA,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;iBACvB,IAAI,CAAC,aAAa;iBAClB,aAAa,CAAC,IAAI,EAAE;AACjB,gBAAA,GAAG,EAAE,SAAS;AACjB,aAAA,CAAC;AACL,YAAA,GAAW,CAAC,aAAa,GAAG,QAAQ;;YAGrC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC;AAC/C,YAAA,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC;AAElC,YAAA,GAAW,CAAC,cAAc,CAAC,GAAG,IAAI;AACnC,YAAA,OAAO,QAAQ;AACnB,QAAA,CAAC;;AAGA,QAAA,GAAW,CAAC,OAAO,GAAG,OACnB,aAAgE,KAChE;YACA,IAAI,aAAa,GAAG,OAAO;YAC3B,IAAI,cAAc,GAAG,QAAQ;AAE7B,YAAA,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE;gBACnC,aAAa,GAAG,aAAa;YACjC;iBAAO,IAAI,aAAa,EAAE;gBACtB,IAAI,aAAa,CAAC,OAAO;AACrB,oBAAA,aAAa,GAAG,aAAa,CAAC,OAAO;gBACzC,IAAI,aAAa,CAAC,QAAQ;AACtB,oBAAA,cAAc,GAAG,aAAa,CAAC,QAAQ;YAC/C;AAEA,YAAA,MAAM,YAAY,GACd,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;AACtC,gBAAA,GAAG,CAAC,OAAO,CAAC,UAAU,CAAY;YAEvC,IAAI,YAAY,EAAE;AACd,gBAAA,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3D;AAEA,YAAA,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE;gBACxB,IAAI,EAAE,aAAa,CAAC,IAAI;gBACxB,MAAM,EAAE,aAAa,CAAC,MAAM;AAC/B,aAAA,CAAC;AACF,YAAA,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC;AAC3B,YAAA,GAAW,CAAC,cAAc,CAAC,GAAG,IAAI;AACvC,QAAA,CAAC;;AAGD,QAAA,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE;AAC9B,YAAA,IAAI;AACA,gBAAA,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC1D,GAAG;AACH,oBAAA,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW;AAC/C,iBAAA,CAAC;gBAEF,IAAI,OAAO,EAAE;AACR,oBAAA,GAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI;AAErC,oBAAA,IAAI,YAAY,IAAI,OAAO,CAAC,QAAQ,EAAE;AACjC,wBAAA,GAAW,CAAC,aAAa,GAAG,OAAO,CAAC,QAAQ;;AAG7C,wBAAA,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI;AAC7B,wBAAA,GAAG,CAAC,IAAI,GAAG,UAAqB,IAAS,EAAA;AACrC,4BAAA,MAAM,QAAQ,GAAI,GAAW,CAAC,aAAa;4BAC3C,IAAI,QAAQ,EAAE;gCACV,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC;AAC/C,gCAAA,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC;4BACvC;4BACA,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;AACxC,wBAAA,CAAC;AAED,wBAAA,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI;AAC7B,wBAAA,GAAG,CAAC,IAAI,GAAG,UAAqB,IAAS,EAAA;AACrC,4BAAA,MAAM,QAAQ,GAAI,GAAW,CAAC,aAAa;4BAC3C,IAAI,QAAQ,EAAE;gCACV,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC;AAC/C,gCAAA,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC;4BACvC;4BACA,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;AACxC,wBAAA,CAAQ;oBACZ;gBACJ;YACJ;YAAE,OAAO,GAAG,EAAE;;YAEd;QACJ;AAEA,QAAA,IAAI,EAAE;IACV;AAEA;;AAEG;AACI,IAAA,MAAM,YAAY,GAAA;AACrB,QAAA,IAAI,IAAI,CAAC,MAAM,EAAE;AACb,YAAA,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QACzB;IACJ;AACH;;;;"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "xypriss",
|
|
3
|
-
"version": "9.12.
|
|
3
|
+
"version": "9.12.11",
|
|
4
4
|
"description": "XyPriss is a high-performance, TypeScript-first hyper-system web framework powered by a native Go core (XHSC), featuring robust multi-tenant sandboxing, secure native file streaming, and zero Express dependencies.",
|
|
5
5
|
"author": {
|
|
6
6
|
"DEV.to": "https://dev.to/nehonix",
|