http/origin_wildcard.ts

Wildcard allowlist entries — refused at server assembly unless the operator opts in (FUZ_ALLOW_ORIGIN_WILDCARDS=true), and said aloud on every boot that admits them. Twin of the Rust fuz_http::origin_wildcard, word for word.

Wildcards are origin syntax an operator may want, but each one admits pages the server does not serve, and the server trusts them all. The forms, as parse_allowed_origins matches them (OriginWildcard):

port (:*) — the host at any port, or none;
host — each * label is any one label, in any position (https://*.example.com, https://example.*), and a host that is all * labels (http://*, https://*.*) is every host with that many labels — four of them cover every IPv4 address;
both (http://*:*, https://*.example.com:*).

A bracketed IPv6 host is exact, so it takes only the port form.

view source

Declarations
#

8 declarations

admit_origin_wildcards
#

http/origin_wildcard.ts view source

(origins: readonly RegExp[], allowed: boolean, origins_var?: string): Result<{ wildcards: OriginWildcardEntry[]; }, { message: string; }>

import {admit_origin_wildcards} from '@fuzdev/fuz_app/http/origin_wildcard.js';

Admit origins' wildcard entries when allowed, returning what each admits for the caller to warn with; an exact list passes either way with none. Classifies the matchers parse_allowed_origins built (origin_pattern_of, read through a realm-global brand, so a second fuz_app copy's matchers classify too). A matcher built any other way can't be classified, so it is refused whatever allowed says — build the list with parse_allowed_origins.

`origins`

the allowlist's matchers

type readonly RegExp[]

`allowed`

whether the operator opted in (FUZ_ALLOW_ORIGIN_WILDCARDS=true)

type boolean

`origins_var?`

what the list is called in the refusal: the env var it was read from, or the option that carried it

type string

optional default ALLOWED_ORIGINS_VAR

returns

Result

the wildcard entries admitted, or the refusal — naming each unclassifiable matcher, or else each wildcard entry, what it admits, and the flag (the Rust spine's boot error, word for word)

ALLOW_ORIGIN_WILDCARDS_VAR
#

http/origin_wildcard.ts view source

"FUZ_ALLOW_ORIGIN_WILDCARDS" import {ALLOW_ORIGIN_WILDCARDS_VAR} from '@fuzdev/fuz_app/http/origin_wildcard.js';

The env var that admits wildcard allowlist entries: exactly true admits them, exactly false (or unset) refuses them, and anything else fails the env schema (BaseServerEnv).

ALLOWED_ORIGINS_VAR
#

http/origin_wildcard.ts view source

"FUZ_ALLOWED_ORIGINS" import {ALLOWED_ORIGINS_VAR} from '@fuzdev/fuz_app/http/origin_wildcard.js';

The env var the allowlist is read from (BaseServerEnv).

HostWildcard
#

http/origin_wildcard.ts view source

HostWildcard

type { kind: "partial"; } | { kind: "whole"; labels: number; }

import type {HostWildcard} from '@fuzdev/fuz_app/http/origin_wildcard.js';

How much of a pattern's host its * labels leave open.

origin_wildcard_kind
#

http/origin_wildcard.ts view source

(pattern: OriginPattern): OriginWildcard | null import {origin_wildcard_kind} from '@fuzdev/fuz_app/http/origin_wildcard.js';

Which wildcards pattern holds, null for an exact entry.

`pattern`

a parsed allowlist entry

type OriginPattern

returns

OriginWildcard | null

its wildcard shape, or null

origin_wildcard_warning
#

http/origin_wildcard.ts view source

(pattern: OriginPattern): string | null import {origin_wildcard_warning} from '@fuzdev/fuz_app/http/origin_wildcard.js';

What a wildcard in pattern admits — the text admit_origin_wildcards warns or refuses with; null for an exact entry. The TS spine mounts no Host check and adds no note, so this is the Rust text with OriginWildcardOptions::DEFAULT.