@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/auth/sessionStore.js

@@ -39,12 +39,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getStoredAuthSession = getStoredAuthSession;
 exports.persistAuthSession = persistAuthSession;
 exports.applyIdeBootstrapForContext = applyIdeBootstrapForContext;
-exports.refreshRoutingCredentialsForContext = refreshRoutingCredentialsForContext;
 exports.getAgentHippoAccessToken = getAgentHippoAccessToken;
 exports.clearAuthSession = clearAuthSession;
 exports.storedSessionToVsCode = storedSessionToVsCode;
 const vscode = __importStar(require("vscode"));
 const brokerClient_js_1 = require("./brokerClient.js");
+const authBaseUrl_js_1 = require("./authBaseUrl.js");
 const bootstrapApply_js_1 = require("./bootstrapApply.js");
 const SESSION_SECRET_KEY = 'agenthippo.auth.session';
 /**
@@ -94,7 +94,7 @@ async function persistAuthSession(secrets, tokens, bootstrap, scopes) {
     return toVsCodeSession(session);
 }
 async function applyIdeBootstrapForContext(context, accessToken) {
-    const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+    const baseUrl = (0, authBaseUrl_js_1.resolveAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide'), (m) => console.warn(m));
     const bootstrap = await (0, brokerClient_js_1.fetchBootstrap)(baseUrl, accessToken);
     await (0, bootstrapApply_js_1.applyIdeBootstrap)(bootstrap, {
         getConfiguration: (section) => vscode.workspace.getConfiguration(section),
@@ -110,43 +110,6 @@ async function applyIdeBootstrapForContext(context, accessToken) {
     });
     return bootstrap;
 }
-/**
- * Refresh only the LiteLLM routing credentials (lighter than re-fetching the full bootstrap)
- * and re-apply them, merging into the last cached bootstrap. Handles server-side rotation of
- * the team routing key without requiring a re-sign-in. No-op if no bootstrap has been applied.
- */
-async function refreshRoutingCredentialsForContext(context, accessToken) {
-    const cached = context.globalState.get(bootstrapApply_js_1.TEAM_BOOTSTRAP_CACHE_KEY);
-    if (!cached) {
-        return;
-    }
-    const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
-    const refreshed = await (0, brokerClient_js_1.fetchBootstrapRefresh)(baseUrl, accessToken);
-    // Skip the settings write when nothing rotated: applyIdeBootstrap re-writes store + routing
-    // and setAPIKey fires onDidChangeKeys on every call, so re-applying an unchanged key every
-    // few minutes would churn listeners and SecretStorage.
-    const keyChanged = refreshed.routing.litellmApiKey !== cached.routing.litellmApiKey;
-    const baseUrlChanged = refreshed.routing.litellmBaseUrl !== cached.routing.litellmBaseUrl;
-    if (!keyChanged && !baseUrlChanged) {
-        return;
-    }
-    const merged = {
-        ...cached,
-        routing: { ...cached.routing, ...refreshed.routing },
-    };
-    await (0, bootstrapApply_js_1.applyIdeBootstrap)(merged, {
-        getConfiguration: (section) => vscode.workspace.getConfiguration(section),
-        ConfigurationTarget: vscode.ConfigurationTarget,
-        setParticipantApiKey: async (args) => {
-            await vscode.commands.executeCommand('agentide.setParticipantApiKey', args);
-            await vscode.commands.executeCommand('agentide.auth.applyBootstrapKeys', args);
-        },
-        globalStateUpdate: async (key, value) => {
-            await context.globalState.update(key, value);
-        },
-        globalStateGet: (key) => context.globalState.get(key),
-    });
-}
 async function getAgentHippoAccessToken(context) {
     const stored = await getStoredAuthSession(context.secrets);
     if (!stored) {
@@ -157,7 +120,7 @@ async function getAgentHippoAccessToken(context) {
     }
     // Near expiry — refresh exactly once across concurrent callers.
     if (!inFlightRefresh) {
-        const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+        const baseUrl = (0, authBaseUrl_js_1.resolveAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide'), (m) => console.warn(m));
         const refreshing = stored;
         inFlightRefresh = (async () => {
             try {

package/out/auth/signInFlow.js

@@ -40,6 +40,7 @@ exports.runAgentHippoSignInFlow = runAgentHippoSignInFlow;
 exports.ensureAgentHippoSignedIn = ensureAgentHippoSignedIn;
 const vscode = __importStar(require("vscode"));
 const brokerClient_js_1 = require("./brokerClient.js");
+const authBaseUrl_js_1 = require("./authBaseUrl.js");
 const pkce_js_1 = require("./pkce.js");
 const callbackUriParse_js_1 = require("./callbackUriParse.js");
 const types_js_1 = require("./types.js");
@@ -77,7 +78,7 @@ function extractRedirectUriFromText(text) {
  * Falls back to pasted redirect URL when loopback does not fire (remote/SSH/headless).
  */
 async function runAgentHippoSignInFlow(context, options) {
-    const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+    const baseUrl = (0, authBaseUrl_js_1.resolveAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide'), (m) => console.warn(m));
     const scopes = options?.scopes ?? [...types_js_1.AUTH_SCOPES];
     const loopback = new loopbackAuthServer_js_1.AgentHippoLoopbackAuthServer();
     const verifier = (0, pkce_js_1.generateCodeVerifier)();

package/out/auth-broker/config.js

@@ -3,7 +3,8 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_JWT_SECRET = void 0;
+exports.DEFAULT_AUTH_BIND = exports.AUTH_PROXY_SECRET_HEADER = exports.DEFAULT_JWT_SECRET = void 0;
+exports.resolveAuthBrokerBind = resolveAuthBrokerBind;
 exports.loadAuthBrokerConfig = loadAuthBrokerConfig;
 exports.emailDomainAllowed = emailDomainAllowed;
 function parseDomains(raw) {
@@ -14,6 +15,50 @@ function parseDomains(raw) {
 }
 /** Well-known default secret used in dev/test. Never acceptable in production. */
 exports.DEFAULT_JWT_SECRET = 'dev-agenthippo-auth-secret-change-me';
+/**
+ * Header the trusted proxy sets to prove it is the trusted proxy.
+ *
+ * `X-Auth-Request-Email` is set by oauth2-proxy AFTER a real Google login, but nothing about the
+ * header itself proves it came from oauth2-proxy — anything that can reach the broker's port can
+ * send it. The proxy therefore also sets this header from a secret only it and the broker know.
+ */
+exports.AUTH_PROXY_SECRET_HEADER = 'x-agenthippo-proxy-secret';
+/**
+ * Where the broker listens. 127.0.0.1 by default: this port mints tokens, and every intended caller
+ * (the Caddy/oauth2-proxy sidecar) is same-host. Binding a routable interface is an explicit,
+ * separately-flagged decision — see `resolveAuthBrokerBind`.
+ */
+exports.DEFAULT_AUTH_BIND = '127.0.0.1';
+const LOOPBACK_BINDS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+/**
+ * Resolve (and gate) the bind address.
+ *
+ * The old default was `0.0.0.0`, which put a token-minting endpoint on every interface: reach
+ * :9780 directly, forge `X-Auth-Request-Email`, get an auth code for any address, and exchange it
+ * at the ungated `/oauth/token`. Loopback is now the default, and a public bind must be asked for
+ * TWICE — the address plus `AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND=1` — so it can never happen by
+ * inheriting a stray env var from a base image.
+ */
+function resolveAuthBrokerBind(env = process.env) {
+    const requested = env.AGENTHIPPO_AUTH_BIND?.trim() || exports.DEFAULT_AUTH_BIND;
+    const isPublic = !LOOPBACK_BINDS.has(requested.toLowerCase());
+    if (!isPublic) {
+        return { address: requested, isPublic: false };
+    }
+    if (env.AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND !== '1') {
+        throw new Error(`Refusing to bind the auth broker to "${requested}". This port issues authorization codes ` +
+            `and access tokens, and a directly reachable broker can be asked to mint a token for an ` +
+            `arbitrary email by forging X-Auth-Request-Email.\n` +
+            `  - Same-host proxy (recommended): bind 127.0.0.1 and run Caddy/oauth2-proxy alongside it.\n` +
+            `  - SEPARATE CONTAINER for the proxy (the compose/Cloud Run layout, where Caddy dials\n` +
+            `    "auth-broker:9780"): the broker must listen on the container's network interface, so set\n` +
+            `    BOTH  AGENTHIPPO_AUTH_BIND=${requested}  AND  AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND=1,\n` +
+            `    and make sure the port is not published outside the private network.\n` +
+            `In either case set AGENTHIPPO_AUTH_PROXY_SECRET (and have the proxy send it) so a forged ` +
+            `X-Auth-Request-Email is rejected — that is what actually stops the token-minting attack.`);
+    }
+    return { address: requested, isPublic: true };
+}
 function loadAuthBrokerConfig(env = process.env) {
     const jwtSecret = env.AGENTHIPPO_AUTH_JWT_SECRET?.trim() || exports.DEFAULT_JWT_SECRET;
     const publicBaseUrl = (env.AGENTHIPPO_AUTH_PUBLIC_URL?.trim() || `http://127.0.0.1:${env.AGENTHIPPO_AUTH_PORT?.trim() || '9780'}`).replace(/\/+$/, '');
@@ -27,21 +72,26 @@ function loadAuthBrokerConfig(env = process.env) {
         accessTokenTtlSec: Number(env.AGENTHIPPO_AUTH_ACCESS_TTL_SEC || 3600),
         refreshTokenTtlSec: Number(env.AGENTHIPPO_AUTH_REFRESH_TTL_SEC || 30 * 24 * 3600),
         allowedEmailDomains: parseDomains(env.AGENTHIPPO_AUTH_ALLOWED_DOMAINS),
-        devMode: env.AGENTHIPPO_AUTH_DEV === '1' || env.NODE_ENV === 'test',
+        // Deliberately not gated on NODE_ENV=test: that value is too easy to inherit by accident
+        // (test runners, base images, wrapper scripts) and this flag unlocks an unauthenticated
+        // login bypass (/oauth/dev/login, login_hint auto-auth) — require the explicit opt-in.
+        devMode: env.AGENTHIPPO_AUTH_DEV === '1',
         rateLimitPerMin: env.AGENTHIPPO_AUTH_RATE_LIMIT !== undefined ? Number(env.AGENTHIPPO_AUTH_RATE_LIMIT) : 60,
         logPii: env.AGENTHIPPO_AUTH_LOG_PII === '1',
         cookieName: env.AGENTHIPPO_AUTH_COOKIE_NAME?.trim() || 'ah_token',
         cookieDomain: env.AGENTHIPPO_AUTH_COOKIE_DOMAIN?.trim() || '',
         idpBaseUrl: (env.AGENTHIPPO_AUTH_IDP_URL?.trim() || '').replace(/\/+$/, ''),
+        proxySecret: env.AGENTHIPPO_AUTH_PROXY_SECRET?.trim() || '',
+        trustProxyHeadersUnverified: env.AGENTHIPPO_AUTH_TRUST_PROXY_UNVERIFIED === '1',
         dataDir: env.AGENTHIPPO_AUTH_DATA_DIR?.trim() || undefined,
+        teamConfigured: Boolean(env.AGENTHIPPO_TEAM_ID?.trim()),
         team: {
             id: env.AGENTHIPPO_TEAM_ID?.trim() || 'team_default',
             name: env.AGENTHIPPO_TEAM_NAME?.trim() || 'Default Team',
             storeRepo,
             storeIndexUrl: env.AGENTHIPPO_TEAM_STORE_INDEX_URL?.trim() || `https://${storeOwner}.github.io/${storeName}`,
             githubOrg: env.AGENTHIPPO_TEAM_GITHUB_ORG?.trim() || storeOwner,
-            litellmBaseUrl: env.AGENTHIPPO_TEAM_LITELLM_BASE_URL?.trim() || 'http://127.0.0.1:4000',
-            litellmApiKey: env.AGENTHIPPO_TEAM_LITELLM_API_KEY?.trim() || 'ahk_team_dev_key',
+            gatewayUrl: env.AGENTHIPPO_TEAM_GATEWAY_URL?.trim() || 'https://gateway.agenthippo.ai/v1',
         },
     };
 }

package/out/auth-broker/server.js

@@ -36,6 +36,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAllowedRedirectUri = isAllowedRedirectUri;
+exports.hasTrustedProxyProof = hasTrustedProxyProof;
 exports.createAuthBrokerServer = createAuthBrokerServer;
 exports.startAuthBrokerServer = startAuthBrokerServer;
 const http = __importStar(require("http"));
@@ -47,7 +49,78 @@ const store_js_1 = require("./store.js");
 const pkce_js_1 = require("./pkce.js");
 const jwt_js_1 = require("./jwt.js");
 const types_js_1 = require("../auth/types.js");
+const callbackUriParse_js_1 = require("../auth/callbackUriParse.js");
 const serve_hardening_js_1 = require("../cli/serve-hardening.js");
+/**
+ * Restrict `redirect_uri` to the shapes our own clients actually send — the CLI/IDE loopback
+ * callback (127.0.0.1/localhost, any OS-assigned port, see loopbackAuthServer.ts) and the IDE
+ * URI-scheme callback (any editor scheme, fixed authority+path, see callbackUri.ts). Without
+ * this, `/oauth/authorize` would hand a real auth code to whatever `redirect_uri` a caller
+ * supplies — an attacker can send a victim (who has an active SSO session) a link with their
+ * own redirect_uri and code_challenge and steal the resulting code via their own server.
+ */
+function isAllowedRedirectUri(redirectUri) {
+    let target;
+    try {
+        target = new url_1.URL(redirectUri);
+    }
+    catch {
+        return false;
+    }
+    // No embedded credentials, no query, no fragment. A permitted shape with a `?next=…` rider or a
+    // `user:pass@` prefix is a different destination wearing an allowed hostname; the exchange binds
+    // the code to this exact string, so anything that isn't the literal callback is refused here.
+    if (target.username || target.password || target.search || target.hash) {
+        return false;
+    }
+    if (target.protocol === 'http:') {
+        // The loopback callback is the real IDE/CLI flow (loopbackAuthServer.ts binds an OS-assigned
+        // port on 127.0.0.1), so the port cannot be pinned. The port is not what makes this safe:
+        // the code is single-use, bound to THIS redirect_uri at issue time and verified against it at
+        // /oauth/token, and PKCE binds it to a verifier only the initiating client holds. An attacker
+        // who forges a loopback redirect_uri still receives a code they cannot exchange.
+        // `localhost` is accepted for parity with the client, but nothing else resolves here.
+        if (target.hostname !== '127.0.0.1' && target.hostname !== 'localhost') {
+            return false;
+        }
+        if (target.pathname !== '/callback') {
+            return false;
+        }
+        // A bare `http://127.0.0.1/callback` (port 80) is not something the loopback server ever
+        // asks for — it needs a bindable ephemeral port — and port 80 is the one loopback port a
+        // non-root process cannot claim, so refuse it rather than leave the shape open.
+        return target.port !== '' && Number(target.port) > 1024;
+    }
+    if (target.protocol === 'https:') {
+        // No https redirect target is a client of this broker: the IDE uses the editor URI scheme
+        // and the CLI uses loopback. Allowing https here would make "redirect to my server" a
+        // one-line manifest away.
+        return false;
+    }
+    return (0, callbackUriParse_js_1.isAuthCallbackParts)(target.host, target.pathname);
+}
+/**
+ * Does this request carry the trusted proxy's proof?
+ *
+ * `X-Auth-Request-Email` is only meaningful when it was set by our oauth2-proxy sidecar after a real
+ * Google login. Nothing about the header says so, so the proxy also stamps a shared secret and this
+ * is where it is checked — constant-time, so a mismatched secret cannot be recovered byte by byte.
+ */
+function hasTrustedProxyProof(headers, expectedSecret) {
+    if (!expectedSecret) {
+        return false;
+    }
+    const raw = headers[config_js_1.AUTH_PROXY_SECRET_HEADER];
+    const presented = typeof raw === 'string' ? raw : Array.isArray(raw) ? String(raw[0] ?? '') : '';
+    if (!presented) {
+        return false;
+    }
+    // Hash both sides first: timingSafeEqual throws on a length mismatch, which would itself leak
+    // the secret's length.
+    const a = crypto.createHash('sha256').update(presented).digest();
+    const b = crypto.createHash('sha256').update(expectedSecret).digest();
+    return crypto.timingSafeEqual(a, b);
+}
 function sendJson(res, status, body) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(body));
@@ -114,6 +187,9 @@ function extractCookieToken(cookieHeader, name) {
 function safeReturnTo(rawReturnTo, cookieDomain, fallback) {
     try {
         const target = new url_1.URL(rawReturnTo);
+        if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+            return fallback;
+        }
         if (cookieDomain) {
             const parent = cookieDomain.replace(/^\./, '').toLowerCase();
             if (target.hostname.toLowerCase() === parent || target.hostname.toLowerCase().endsWith('.' + parent)) {
@@ -136,6 +212,28 @@ function createAuthBrokerServer(config) {
         throw new Error('AGENTHIPPO_AUTH_JWT_SECRET must be set to a strong secret in production. ' +
             'Generate one with: openssl rand -hex 32');
     }
+    // Fail-closed: without a proxy proof, `X-Auth-Request-Email` is a self-asserted claim. Anything
+    // that can reach this port could send `X-Auth-Request-Email: ceo@example.com` with a loopback
+    // redirect_uri to /oauth/authorize and exchange the resulting code at the ungated /oauth/token —
+    // a full account takeover with no credential. Same posture as the JWT/LiteLLM defaults above:
+    // refuse to boot rather than run a broker whose identity input is unauthenticated.
+    if (!resolved.devMode && !resolved.proxySecret && !resolved.trustProxyHeadersUnverified) {
+        throw new Error('AGENTHIPPO_AUTH_PROXY_SECRET must be set in production. The broker trusts ' +
+            'X-Auth-Request-Email from the oauth2-proxy/Caddy forward_auth sidecar; without a shared ' +
+            'secret proving the header came from that sidecar, any caller that reaches this port can ' +
+            'mint a token for an arbitrary email.\n' +
+            '  1. Generate one:  openssl rand -hex 32\n' +
+            `  2. Set it here:   AGENTHIPPO_AUTH_PROXY_SECRET=<secret>\n` +
+            `  3. Have the proxy send it, e.g. in the Caddyfile:\n` +
+            `       header_up ${config_js_1.AUTH_PROXY_SECRET_HEADER} {env.AGENTHIPPO_AUTH_PROXY_SECRET}\n` +
+            'If the broker is genuinely unreachable except through the proxy and you accept the risk, ' +
+            'set AGENTHIPPO_AUTH_TRUST_PROXY_UNVERIFIED=1.');
+    }
+    if (!resolved.devMode && !resolved.proxySecret && resolved.trustProxyHeadersUnverified) {
+        console.warn('[auth-broker] WARNING: AGENTHIPPO_AUTH_TRUST_PROXY_UNVERIFIED=1 — X-Auth-Request-Email is ' +
+            'accepted without proof. Anything that can reach this port can mint a token for any email. ' +
+            'Set AGENTHIPPO_AUTH_PROXY_SECRET to close this.');
+    }
     // Warn when no domain restriction is configured: any SSO-authenticated email can sign in.
     if (!resolved.devMode && resolved.allowedEmailDomains.length === 0) {
         console.warn('[auth-broker] Warning: AGENTHIPPO_AUTH_ALLOWED_DOMAINS is not set — ' +
@@ -198,11 +296,12 @@ function createAuthBrokerServer(config) {
         // IdP's own broker still hits getUser for its locally-created users, so this fallback is
         // a no-op there.
         if (!user) {
+            const teamIdFromToken = typeof payload.team_id === 'string' && payload.team_id ? payload.team_id : undefined;
             user = {
                 id: String(payload.sub),
                 email: String(payload.email),
                 displayName: typeof payload.name === 'string' && payload.name ? payload.name : String(payload.email),
-                teamId: typeof payload.team_id === 'string' && payload.team_id ? payload.team_id : resolved.team.id,
+                teamId: teamIdFromToken ?? (resolved.teamConfigured ? resolved.team.id : undefined),
             };
         }
         if (payload.exp) {
@@ -222,6 +321,33 @@ function createAuthBrokerServer(config) {
         }
         return user;
     }
+    /**
+     * Read the SSO-asserted email, but only if the request proved it came from the trusted proxy.
+     * Returns `undefined` when there is no email, and `null` when an email was present but the proof
+     * was missing/wrong — those are different failures and the second one is worth auditing loudly.
+     */
+    const proxyAssertedEmail = (req) => {
+        const email = (req.headers['x-auth-request-email'] || '').trim().toLowerCase();
+        if (!email) {
+            return undefined;
+        }
+        // devMode and the explicit unverified opt-in are the only ways past the proof.
+        if (resolved.devMode || (!resolved.proxySecret && resolved.trustProxyHeadersUnverified)) {
+            return email;
+        }
+        if (!hasTrustedProxyProof(req.headers, resolved.proxySecret)) {
+            return null;
+        }
+        return email;
+    };
+    const rejectForgedProxyHeader = (res, ip, pathname) => {
+        audit('proxy_header.unverified', { ip, path: pathname });
+        sendJson(res, 401, {
+            error: 'unauthorized',
+            error_description: `X-Auth-Request-Email was present without a valid ${config_js_1.AUTH_PROXY_SECRET_HEADER} header. ` +
+                'Only the trusted reverse proxy may assert an identity to this broker.',
+        });
+    };
     const server = http.createServer(async (req, res) => {
         try {
             const host = req.headers.host || `127.0.0.1:${resolved.port}`;
@@ -256,6 +382,11 @@ function createAuthBrokerServer(config) {
                     sendJson(res, 400, { error: 'invalid_request' });
                     return;
                 }
+                if (!isAllowedRedirectUri(redirectUri)) {
+                    audit('authorize.invalid_redirect_uri', { client_id: clientId });
+                    sendJson(res, 400, { error: 'invalid_request', error_description: 'redirect_uri not allowed' });
+                    return;
+                }
                 // Dev mode with explicit login_hint: auto-authenticate (backward compat for tests).
                 if (resolved.devMode && loginHint) {
                     const user = store.upsertUser(loginHint);
@@ -272,8 +403,14 @@ function createAuthBrokerServer(config) {
                 }
                 // Caddy forward_auth (via oauth2-proxy) sets X-Auth-Request-Email after the user
                 // logs in with Google. The authorize endpoint is gated behind forward_auth in the
-                // Caddyfile so this header is always present when the request reaches the broker.
-                const userEmail = (req.headers['x-auth-request-email'] || '').trim().toLowerCase();
+                // Caddyfile so this header is always present when the request reaches the broker —
+                // but a caller that reaches the broker DIRECTLY can set it too, which is why the
+                // proxy also has to prove who it is.
+                const userEmail = proxyAssertedEmail(req);
+                if (userEmail === null) {
+                    rejectForgedProxyHeader(res, ip, pathname);
+                    return;
+                }
                 if (!userEmail) {
                     sendJson(res, 401, { error: 'unauthorized', error_description: 'No authenticated user (missing X-Auth-Request-Email)' });
                     return;
@@ -299,7 +436,11 @@ function createAuthBrokerServer(config) {
                 // (same as /oauth/authorize) — X-Auth-Request-Email is only set once Google login
                 // completes. Federated agent services never hit this path (they have no oauth2-proxy),
                 // so it 401s there, which is correct.
-                const userEmail = (req.headers['x-auth-request-email'] || '').trim().toLowerCase();
+                const userEmail = proxyAssertedEmail(req);
+                if (userEmail === null) {
+                    rejectForgedProxyHeader(res, ip, pathname);
+                    return;
+                }
                 if (!userEmail) {
                     sendJson(res, 401, { error: 'unauthorized', error_description: 'No authenticated user (missing X-Auth-Request-Email)' });
                     return;
@@ -483,20 +624,6 @@ function createAuthBrokerServer(config) {
                 sendJson(res, 200, store.buildBootstrap(user));
                 return;
             }
-            if (req.method === 'POST' && pathname === '/api/ide/bootstrap/refresh') {
-                if (!user) {
-                    sendJson(res, 401, { error: 'unauthorized' });
-                    return;
-                }
-                const routing = store.refreshRoutingCredentials();
-                sendJson(res, 200, {
-                    routing: {
-                        litellmBaseUrl: resolved.team.litellmBaseUrl,
-                        ...routing,
-                    },
-                });
-                return;
-            }
             if (req.method === 'POST' && pathname === '/api/ide/signout') {
                 if (user) {
                     store.revokeRefreshTokensForUser(user.id);
@@ -536,9 +663,14 @@ function createAuthBrokerServer(config) {
 }
 async function startAuthBrokerServer(config) {
     const broker = createAuthBrokerServer(config);
-    const bind = process.env.AGENTHIPPO_AUTH_BIND?.trim() || '0.0.0.0';
+    const bind = (0, config_js_1.resolveAuthBrokerBind)();
+    if (bind.isPublic) {
+        console.warn(`[auth-broker] WARNING: listening on ${bind.address}:${broker.config.port} — this ` +
+            `token-issuing endpoint is reachable from off-host (AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND=1). ` +
+            `Ensure only the reverse proxy can reach it and that AGENTHIPPO_AUTH_PROXY_SECRET is set.`);
+    }
     await new Promise((resolve, reject) => {
-        broker.server.listen(broker.config.port, bind, () => resolve());
+        broker.server.listen(broker.config.port, bind.address, () => resolve());
         broker.server.once('error', reject);
     });
     return broker;

package/out/auth-broker/store.js

@@ -136,7 +136,7 @@ class AuthBrokerStore {
             id: `usr_${crypto.randomBytes(8).toString('hex')}`,
             email: normalized,
             displayName: displayName?.trim() || normalized.split('@')[0] || normalized,
-            teamId: this.config.team.id,
+            ...(this.config.teamConfigured ? { teamId: this.config.team.id } : {}),
         };
         this.users.set(user.id, user);
         this.persist();
@@ -210,7 +210,7 @@ class AuthBrokerStore {
             sub: user.id,
             email: user.email,
             name: user.displayName,
-            team_id: user.teamId,
+            ...(user.teamId ? { team_id: user.teamId } : {}),
             scope,
         }, this.config.jwtSecret, this.config.accessTokenTtlSec);
         const refreshToken = this.createRefreshToken(user.id, clientId);
@@ -221,6 +221,9 @@ class AuthBrokerStore {
         };
     }
     buildBootstrap(user) {
+        // No AGENTHIPPO_TEAM_ID ⇒ solo deployment: no team object, and nothing is team-managed —
+        // store/routing still apply as defaults but are not locked against the user changing them.
+        const teamConfigured = this.config.teamConfigured;
         return {
             version: 1,
             user: {
@@ -228,34 +231,28 @@ class AuthBrokerStore {
                 email: user.email,
                 displayName: user.displayName,
             },
-            team: {
-                id: this.config.team.id,
-                name: this.config.team.name,
-                role: 'member',
-            },
+            ...(teamConfigured
+                ? {
+                    team: {
+                        id: this.config.team.id,
+                        name: this.config.team.name,
+                        role: 'member',
+                    },
+                }
+                : {}),
             store: {
                 repo: this.config.team.storeRepo,
                 indexUrl: this.config.team.storeIndexUrl,
                 githubOrg: this.config.team.githubOrg,
             },
             routing: {
-                litellmBaseUrl: this.config.team.litellmBaseUrl,
-                litellmApiKey: this.config.team.litellmApiKey,
-                // No litellmApiKeyExpiresAt: the team key is static — a fabricated expiry
-                // would only pretend rotation exists. Per-user virtual keys are the upgrade path.
+                inferenceGatewayUrl: this.config.team.gatewayUrl,
             },
             policy: {
-                byokAllowed: true,
-                teamManagedSettings: ['store', 'routing'],
+                teamManagedSettings: teamConfigured ? ['store', 'routing'] : [],
             },
         };
     }
-    refreshRoutingCredentials() {
-        // The team key is static (no rotation backend yet), so no expiry is reported.
-        return {
-            litellmApiKey: this.config.team.litellmApiKey,
-        };
-    }
     buildMe(user) {
         return {
             user: {
@@ -263,11 +260,15 @@ class AuthBrokerStore {
                 email: user.email,
                 displayName: user.displayName,
             },
-            team: {
-                id: this.config.team.id,
-                name: this.config.team.name,
-                role: 'member',
-            },
+            ...(this.config.teamConfigured
+                ? {
+                    team: {
+                        id: this.config.team.id,
+                        name: this.config.team.name,
+                        role: 'member',
+                    },
+                }
+                : {}),
         };
     }
 }