1.0.35

src/lib/server/stack-filename.ts

@@ -0,0 +1,22 @@
+/**
+ * Filename gate for stack writes (#1196).
+ *
+ * Lives in its own file so unit tests can import the helper without pulling
+ * in stacks.ts (which transitively imports the DB layer and won't load
+ * under bun:test).
+ *
+ * v1.0.34 locked compose/env paths to a hardcoded set (docker-compose.yml,
+ * compose.yml, .env) which broke users who name their compose files after
+ * the service (e.g. `headscale.yml`). v1.0.35 relaxes to any .yml / .yaml
+ * file plus the `.env` family. The load-bearing security control is the
+ * containment + symlink-realpath + traversal checks in validateStackPath() —
+ * this gate is belt-and-suspenders to keep the write path producing
+ * stack-shaped files. Still blocks authorized_keys, evil.sh, /etc/cron.d/x.
+ */
+
+// Matches: foo.yml, foo.yaml, .env, foo.env, .env.local, prod.env.staging
+export const STACK_FILENAME_RE = /\.ya?ml$|(^|\.)env(\.|$)/;
+
+export function isAllowedStackFilename(filename: string): boolean {
+	return STACK_FILENAME_RE.test(filename);
+}