@artenx/dshb 0.1.18 → 0.1.20

package/lib/auth/decorate-webserver.d.ts

@@ -1,7 +1,8 @@
 import { CredentialStore } from "./credentials.js";
+import { AuthGate } from "./gate.js";
 import WebServer from "@deepseek-ai/dsh-host-webserver";
 //#region src/auth/decorate-webserver.d.ts
-declare function decorateWebServer(webServer: WebServer, store: CredentialStore): () => void;
+declare function decorateWebServer(webServer: WebServer, store: CredentialStore, gate?: AuthGate): () => void;
 //#endregion
 export { decorateWebServer };
 //# sourceMappingURL=decorate-webserver.d.ts.map

package/lib/auth/decorate-webserver.js

@@ -1,9 +1,12 @@
 import { AuthGate, rewriteToLoopback } from "./gate.js";
 //#region src/auth/decorate-webserver.ts
-function decorateWebServer(webServer, store) {
-	const gate = new AuthGate(store);
+function isResourceFallback(fallback) {
+	return typeof fallback === "object" && fallback !== null && "resource" in fallback && typeof fallback.resource === "function";
+}
+function decorateWebServer(webServer, store, gate = new AuthGate(store)) {
 	const origRegister = webServer.register.bind(webServer);
-	const origRegisterFallback = webServer.registerFallback.bind(webServer);
+	const fallbackServer = webServer;
+	const origRegisterFallback = fallbackServer.registerFallback.bind(webServer);
 	const origRegisterUpgrade = webServer.registerUpgrade.bind(webServer);
 	webServer.register = (route) => {
 		return origRegister({
@@ -11,7 +14,8 @@ function decorateWebServer(webServer, store) {
 			handler: (req, res) => guarded(route, req, res)
 		});
 	};
-	webServer.registerFallback = (handler) => {
+	fallbackServer.registerFallback = (handler) => {
+		if (isResourceFallback(handler)) return origRegisterFallback(handler);
 		return origRegisterFallback((req, res) => guarded({
 			kind: "exact",
 			path: "/",
@@ -24,8 +28,7 @@ function decorateWebServer(webServer, store) {
 			handler: (req, socket, head) => guardedUpgrade(route, req, socket, head)
 		});
 	};
-	const ws = webServer;
-	const origFallback = ws.fallback;
+	const origFallback = fallbackServer.fallback;
 	if (typeof origFallback === "function" && !origFallback.__dshbGated) {
 		const wrapped = (req, res) => guarded({
 			kind: "exact",
@@ -33,7 +36,7 @@ function decorateWebServer(webServer, store) {
 			handler: origFallback
 		}, req, res);
 		wrapped.__dshbGated = true;
-		ws.fallback = wrapped;
+		fallbackServer.fallback = wrapped;
 	}
 	function guarded(route, req, res) {
 		const decision = gate.decide(req);
@@ -47,6 +50,14 @@ function decorateWebServer(webServer, store) {
 			res.end();
 			return;
 		}
+		if (decision === "forbidden") {
+			res.writeHead(403, { "content-type": "application/json" });
+			res.end(JSON.stringify({
+				ok: false,
+				error: "forbidden"
+			}));
+			return;
+		}
 		res.writeHead(401, { "content-type": "application/json" });
 		res.end(JSON.stringify({
 			ok: false,
@@ -59,14 +70,14 @@ function decorateWebServer(webServer, store) {
 			if (decision === "allow") rewriteToLoopback(req, webServer.port);
 			return route.handler(req, socket, head);
 		}
-		socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+		socket.write(decision === "forbidden" ? "HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n" : "HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
 		socket.destroy();
 	}
 	return () => {
 		webServer.register = origRegister;
-		webServer.registerFallback = origRegisterFallback;
+		fallbackServer.registerFallback = origRegisterFallback;
 		webServer.registerUpgrade = origRegisterUpgrade;
-		ws.fallback = origFallback;
+		fallbackServer.fallback = origFallback;
 	};
 }
 //#endregion

package/lib/auth/decorate-webserver.js.map

@@ -1 +1 @@
-{"version":3,"file":"decorate-webserver.js","names":[],"sources":["../../src/auth/decorate-webserver.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'\nimport type WebServer from '@deepseek-ai/dsh-host-webserver'\nimport { AuthGate, rewriteToLoopback } from './gate.js'\nimport type { CredentialStore } from './credentials.js'\n\nexport function decorateWebServer(\n  webServer: WebServer,\n  store: CredentialStore,\n): () => void {\n  const gate = new AuthGate(store)\n\n  const origRegister = webServer.register.bind(webServer)\n  const origRegisterFallback = webServer.registerFallback.bind(webServer)\n  const origRegisterUpgrade = webServer.registerUpgrade.bind(webServer)\n\n  webServer.register = (route: WebRoute): (() => void) => {\n    return origRegister({\n      ...route,\n      handler: (req, res) => guarded(route, req, res),\n    })\n  }\n\n  webServer.registerFallback = (handler: WebRoute['handler']): (() => void) => {\n    return origRegisterFallback((req, res) =>\n      guarded({ kind: 'exact', path: '/', handler }, req, res),\n    )\n  }\n\n  webServer.registerUpgrade = (route: WebUpgradeRoute): (() => void) => {\n    return origRegisterUpgrade({\n      ...route,\n      handler: (req, socket, head) => guardedUpgrade(route, req, socket, head),\n    })\n  }\n\n  // DSH 0.1.5+: the frontend-static plugin may have claimed the fallback seat\n  // *before* this decoration runs (plugin apply order is not guaranteed). The\n  // registerFallback wrap above only gates fallbacks registered later, so also\n  // wrap an already-claimed seat in place. Idempotent via the __dshbGated mark.\n  const ws = webServer as unknown as { fallback?: WebRoute['handler'] & { __dshbGated?: true } }\n  const origFallback = ws.fallback\n  if (typeof origFallback === 'function' && !origFallback.__dshbGated) {\n    const wrapped: WebRoute['handler'] & { __dshbGated?: true } = (req, res) =>\n      guarded({ kind: 'exact', path: '/', handler: origFallback }, req, res)\n    wrapped.__dshbGated = true\n    ws.fallback = wrapped\n  }\n\n  function guarded(\n    route: WebRoute,\n    req: IncomingMessage,\n    res: ServerResponse,\n  ): void | Promise<void> {\n    const decision = gate.decide(req)\n    if (decision === 'allow') {\n      rewriteToLoopback(req, webServer.port)\n      return route.handler(req, res)\n    }\n    if (decision === 'exempt') {\n      return route.handler(req, res)\n    }\n    if (decision === 'redirect-login') {\n      res.writeHead(302, { location: '/login' })\n      res.end()\n      return\n    }\n    res.writeHead(401, { 'content-type': 'application/json' })\n    res.end(JSON.stringify({ ok: false, error: 'unauthorized' }))\n  }\n\n  function guardedUpgrade(\n    route: WebUpgradeRoute,\n    req: IncomingMessage,\n    socket: Duplex,\n    head: Buffer,\n  ): void | Promise<void> {\n    const decision = gate.decide(req)\n    if (decision === 'allow' || decision === 'exempt') {\n      if (decision === 'allow') rewriteToLoopback(req, webServer.port)\n      return route.handler(req, socket, head)\n    }\n    socket.write('HTTP/1.1 401 Unauthorized\\r\\nConnection: close\\r\\n\\r\\n')\n    socket.destroy()\n  }\n\n  return () => {\n    webServer.register = origRegister\n    webServer.registerFallback = origRegisterFallback\n    webServer.registerUpgrade = origRegisterUpgrade\n    ws.fallback = origFallback\n  }\n}\n"],"mappings":";;AAOA,SAAgB,kBACd,WACA,OACY;CACZ,MAAM,OAAO,IAAI,SAAS,KAAK;CAE/B,MAAM,eAAe,UAAU,SAAS,KAAK,SAAS;CACtD,MAAM,uBAAuB,UAAU,iBAAiB,KAAK,SAAS;CACtE,MAAM,sBAAsB,UAAU,gBAAgB,KAAK,SAAS;CAEpE,UAAU,YAAY,UAAkC;EACtD,OAAO,aAAa;GAClB,GAAG;GACH,UAAU,KAAK,QAAQ,QAAQ,OAAO,KAAK,GAAG;EAChD,CAAC;CACH;CAEA,UAAU,oBAAoB,YAA+C;EAC3E,OAAO,sBAAsB,KAAK,QAChC,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK;EAAQ,GAAG,KAAK,GAAG,CACzD;CACF;CAEA,UAAU,mBAAmB,UAAyC;EACpE,OAAO,oBAAoB;GACzB,GAAG;GACH,UAAU,KAAK,QAAQ,SAAS,eAAe,OAAO,KAAK,QAAQ,IAAI;EACzE,CAAC;CACH;CAMA,MAAM,KAAK;CACX,MAAM,eAAe,GAAG;CACxB,IAAI,OAAO,iBAAiB,cAAc,CAAC,aAAa,aAAa;EACnE,MAAM,WAAyD,KAAK,QAClE,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK,SAAS;EAAa,GAAG,KAAK,GAAG;EACvE,QAAQ,cAAc;EACtB,GAAG,WAAW;CAChB;CAEA,SAAS,QACP,OACA,KACA,KACsB;EACtB,MAAM,WAAW,KAAK,OAAO,GAAG;EAChC,IAAI,aAAa,SAAS;GACxB,kBAAkB,KAAK,UAAU,IAAI;GACrC,OAAO,MAAM,QAAQ,KAAK,GAAG;EAC/B;EACA,IAAI,aAAa,UACf,OAAO,MAAM,QAAQ,KAAK,GAAG;EAE/B,IAAI,aAAa,kBAAkB;GACjC,IAAI,UAAU,KAAK,EAAE,UAAU,SAAS,CAAC;GACzC,IAAI,IAAI;GACR;EACF;EACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,IAAI,IAAI,KAAK,UAAU;GAAE,IAAI;GAAO,OAAO;EAAe,CAAC,CAAC;CAC9D;CAEA,SAAS,eACP,OACA,KACA,QACA,MACsB;EACtB,MAAM,WAAW,KAAK,OAAO,GAAG;EAChC,IAAI,aAAa,WAAW,aAAa,UAAU;GACjD,IAAI,aAAa,SAAS,kBAAkB,KAAK,UAAU,IAAI;GAC/D,OAAO,MAAM,QAAQ,KAAK,QAAQ,IAAI;EACxC;EACA,OAAO,MAAM,wDAAwD;EACrE,OAAO,QAAQ;CACjB;CAEA,aAAa;EACX,UAAU,WAAW;EACrB,UAAU,mBAAmB;EAC7B,UAAU,kBAAkB;EAC5B,GAAG,WAAW;CAChB;AACF"}
+{"version":3,"file":"decorate-webserver.js","names":[],"sources":["../../src/auth/decorate-webserver.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'\nimport type WebServer from '@deepseek-ai/dsh-host-webserver'\nimport { AuthGate, rewriteToLoopback } from './gate.js'\nimport type { CredentialStore } from './credentials.js'\n\ntype ResourceFallback = { resource: unknown }\ntype CompatibleFallback = WebRoute['handler'] | ResourceFallback\n\nfunction isResourceFallback(fallback: CompatibleFallback): fallback is ResourceFallback {\n  return typeof fallback === 'object'\n    && fallback !== null\n    && 'resource' in fallback\n    && typeof fallback.resource === 'function'\n}\n\nexport function decorateWebServer(\n  webServer: WebServer,\n  store: CredentialStore,\n  gate = new AuthGate(store),\n): () => void {\n  const origRegister = webServer.register.bind(webServer)\n  const fallbackServer = webServer as unknown as {\n    registerFallback: (fallback: CompatibleFallback) => () => void\n    fallback?: CompatibleFallback & { __dshbGated?: true }\n  }\n  const origRegisterFallback = fallbackServer.registerFallback.bind(webServer)\n  const origRegisterUpgrade = webServer.registerUpgrade.bind(webServer)\n\n  webServer.register = (route: WebRoute): (() => void) => {\n    return origRegister({\n      ...route,\n      handler: (req, res) => guarded(route, req, res),\n    })\n  }\n\n  fallbackServer.registerFallback = (handler: CompatibleFallback): (() => void) => {\n    // Newer DSH releases register SPA fallbacks as resources. Their resource\n    // callback owns index authorization and must keep its original contract.\n    if (isResourceFallback(handler)) return origRegisterFallback(handler)\n    return origRegisterFallback((req, res) =>\n      guarded({ kind: 'exact', path: '/', handler }, req, res),\n    )\n  }\n\n  webServer.registerUpgrade = (route: WebUpgradeRoute): (() => void) => {\n    return origRegisterUpgrade({\n      ...route,\n      handler: (req, socket, head) => guardedUpgrade(route, req, socket, head),\n    })\n  }\n\n  // DSH 0.1.5+: the frontend-static plugin may have claimed the fallback seat\n  // *before* this decoration runs (plugin apply order is not guaranteed). The\n  // registerFallback wrap above only gates fallbacks registered later, so also\n  // wrap an already-claimed seat in place. Idempotent via the __dshbGated mark.\n  const origFallback = fallbackServer.fallback\n  if (typeof origFallback === 'function' && !origFallback.__dshbGated) {\n    const wrapped: WebRoute['handler'] & { __dshbGated?: true } = (req, res) =>\n      guarded({ kind: 'exact', path: '/', handler: origFallback }, req, res)\n    wrapped.__dshbGated = true\n    fallbackServer.fallback = wrapped\n  }\n\n  function guarded(\n    route: WebRoute,\n    req: IncomingMessage,\n    res: ServerResponse,\n  ): void | Promise<void> {\n    const decision = gate.decide(req)\n    if (decision === 'allow') {\n      rewriteToLoopback(req, webServer.port)\n      return route.handler(req, res)\n    }\n    if (decision === 'exempt') {\n      return route.handler(req, res)\n    }\n    if (decision === 'redirect-login') {\n      res.writeHead(302, { location: '/login' })\n      res.end()\n      return\n    }\n    if (decision === 'forbidden') {\n      res.writeHead(403, { 'content-type': 'application/json' })\n      res.end(JSON.stringify({ ok: false, error: 'forbidden' }))\n      return\n    }\n    res.writeHead(401, { 'content-type': 'application/json' })\n    res.end(JSON.stringify({ ok: false, error: 'unauthorized' }))\n  }\n\n  function guardedUpgrade(\n    route: WebUpgradeRoute,\n    req: IncomingMessage,\n    socket: Duplex,\n    head: Buffer,\n  ): void | Promise<void> {\n    const decision = gate.decide(req)\n    if (decision === 'allow' || decision === 'exempt') {\n      if (decision === 'allow') rewriteToLoopback(req, webServer.port)\n      return route.handler(req, socket, head)\n    }\n    socket.write(decision === 'forbidden'\n      ? 'HTTP/1.1 403 Forbidden\\r\\nConnection: close\\r\\n\\r\\n'\n      : 'HTTP/1.1 401 Unauthorized\\r\\nConnection: close\\r\\n\\r\\n')\n    socket.destroy()\n  }\n\n  return () => {\n    webServer.register = origRegister\n    fallbackServer.registerFallback = origRegisterFallback\n    webServer.registerUpgrade = origRegisterUpgrade\n    fallbackServer.fallback = origFallback\n  }\n}\n"],"mappings":";;AAUA,SAAS,mBAAmB,UAA4D;CACtF,OAAO,OAAO,aAAa,YACtB,aAAa,QACb,cAAc,YACd,OAAO,SAAS,aAAa;AACpC;AAEA,SAAgB,kBACd,WACA,OACA,OAAO,IAAI,SAAS,KAAK,GACb;CACZ,MAAM,eAAe,UAAU,SAAS,KAAK,SAAS;CACtD,MAAM,iBAAiB;CAIvB,MAAM,uBAAuB,eAAe,iBAAiB,KAAK,SAAS;CAC3E,MAAM,sBAAsB,UAAU,gBAAgB,KAAK,SAAS;CAEpE,UAAU,YAAY,UAAkC;EACtD,OAAO,aAAa;GAClB,GAAG;GACH,UAAU,KAAK,QAAQ,QAAQ,OAAO,KAAK,GAAG;EAChD,CAAC;CACH;CAEA,eAAe,oBAAoB,YAA8C;EAG/E,IAAI,mBAAmB,OAAO,GAAG,OAAO,qBAAqB,OAAO;EACpE,OAAO,sBAAsB,KAAK,QAChC,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK;EAAQ,GAAG,KAAK,GAAG,CACzD;CACF;CAEA,UAAU,mBAAmB,UAAyC;EACpE,OAAO,oBAAoB;GACzB,GAAG;GACH,UAAU,KAAK,QAAQ,SAAS,eAAe,OAAO,KAAK,QAAQ,IAAI;EACzE,CAAC;CACH;CAMA,MAAM,eAAe,eAAe;CACpC,IAAI,OAAO,iBAAiB,cAAc,CAAC,aAAa,aAAa;EACnE,MAAM,WAAyD,KAAK,QAClE,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK,SAAS;EAAa,GAAG,KAAK,GAAG;EACvE,QAAQ,cAAc;EACtB,eAAe,WAAW;CAC5B;CAEA,SAAS,QACP,OACA,KACA,KACsB;EACtB,MAAM,WAAW,KAAK,OAAO,GAAG;EAChC,IAAI,aAAa,SAAS;GACxB,kBAAkB,KAAK,UAAU,IAAI;GACrC,OAAO,MAAM,QAAQ,KAAK,GAAG;EAC/B;EACA,IAAI,aAAa,UACf,OAAO,MAAM,QAAQ,KAAK,GAAG;EAE/B,IAAI,aAAa,kBAAkB;GACjC,IAAI,UAAU,KAAK,EAAE,UAAU,SAAS,CAAC;GACzC,IAAI,IAAI;GACR;EACF;EACA,IAAI,aAAa,aAAa;GAC5B,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;GACzD,IAAI,IAAI,KAAK,UAAU;IAAE,IAAI;IAAO,OAAO;GAAY,CAAC,CAAC;GACzD;EACF;EACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,IAAI,IAAI,KAAK,UAAU;GAAE,IAAI;GAAO,OAAO;EAAe,CAAC,CAAC;CAC9D;CAEA,SAAS,eACP,OACA,KACA,QACA,MACsB;EACtB,MAAM,WAAW,KAAK,OAAO,GAAG;EAChC,IAAI,aAAa,WAAW,aAAa,UAAU;GACjD,IAAI,aAAa,SAAS,kBAAkB,KAAK,UAAU,IAAI;GAC/D,OAAO,MAAM,QAAQ,KAAK,QAAQ,IAAI;EACxC;EACA,OAAO,MAAM,aAAa,cACtB,wDACA,wDAAwD;EAC5D,OAAO,QAAQ;CACjB;CAEA,aAAa;EACX,UAAU,WAAW;EACrB,eAAe,mBAAmB;EAClC,UAAU,kBAAkB;EAC5B,eAAe,WAAW;CAC5B;AACF"}

package/lib/auth/gate.d.ts

@@ -1,10 +1,12 @@
 import { CredentialStore } from "./credentials.js";
 import { IncomingMessage } from "node:http";
 //#region src/auth/gate.d.ts
-type GateDecision = 'allow' | 'exempt' | 'redirect-login' | 'reject';
+type GateDecision = 'allow' | 'exempt' | 'redirect-login' | 'reject' | 'forbidden';
 declare class AuthGate {
   private readonly store;
+  private isTrustedAuthRequest;
   constructor(store: CredentialStore);
+  setAuthRequestTrustCheck(check: (req: IncomingMessage) => boolean): void;
   decide(req: IncomingMessage): GateDecision;
   private isPageRequest;
 }

package/lib/auth/gate.js

@@ -1,14 +1,31 @@
 import { isLoopbackRequest } from "./loopback.js";
 import { SESSION_COOKIE, readCookie, verifySession } from "./session.js";
 //#region src/auth/gate.ts
+function isTrustedLoopbackAuthRequest(req) {
+	if (!isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return false;
+	if (req.headers["sec-fetch-site"] === "cross-site") return false;
+	const origin = req.headers.origin;
+	if (origin === void 0) return true;
+	if (typeof origin !== "string" || !req.headers.host) return false;
+	try {
+		return new URL(origin).host === new URL(`http://${req.headers.host}`).host;
+	} catch {
+		return false;
+	}
+}
 var AuthGate = class {
 	store;
+	isTrustedAuthRequest;
 	constructor(store) {
 		this.store = store;
 	}
+	setAuthRequestTrustCheck(check) {
+		this.isTrustedAuthRequest = check;
+	}
 	decide(req) {
 		const path = new URL(req.url ?? "/", "http://x").pathname;
-		if (path === "/login" || path.startsWith("/api/auth/")) return "exempt";
+		if (path === "/login") return "exempt";
+		if (path === "/api/auth" || path.startsWith("/api/auth/")) return (this.isTrustedAuthRequest ? this.isTrustedAuthRequest(req) : isTrustedLoopbackAuthRequest(req)) ? "exempt" : "forbidden";
 		if (isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return "allow";
 		const secret = this.store.sessionSecret;
 		const username = this.store.username;

package/lib/auth/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","names":[],"sources":["../../src/auth/gate.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\nimport { isLoopbackRequest } from './loopback.js'\nimport { readCookie, SESSION_COOKIE, verifySession } from './session.js'\nimport type { CredentialStore } from './credentials.js'\n\nexport type GateDecision = 'allow' | 'exempt' | 'redirect-login' | 'reject'\n\nexport class AuthGate {\n  constructor(private readonly store: CredentialStore) {}\n\n  decide(req: IncomingMessage): GateDecision {\n    const path = new URL(req.url ?? '/', 'http://x').pathname\n    if (path === '/login' || path.startsWith('/api/auth/')) return 'exempt'\n    if (isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return 'allow'\n    const secret = this.store.sessionSecret\n    const username = this.store.username\n    if (secret && username) {\n      const value = readCookie(req.headers.cookie, SESSION_COOKIE)\n      if (verifySession(value, secret, username)) return 'allow'\n    }\n    if (this.isPageRequest(req)) return 'redirect-login'\n    return 'reject'\n  }\n\n  private isPageRequest(req: IncomingMessage): boolean {\n    if (req.method !== 'GET' && req.method !== 'HEAD') return false\n    const path = new URL(req.url ?? '/', 'http://x').pathname\n    if (path.startsWith('/api/')) return false\n    const accept = req.headers.accept ?? ''\n    return accept.includes('text/html') || accept.includes('*/*')\n  }\n}\n\nexport function rewriteToLoopback(req: IncomingMessage, port?: number): void {\n  const localPort = port ?? req.socket.localPort\n  if (typeof localPort !== 'number') return\n  const authority = `127.0.0.1:${localPort}`\n  req.headers.host = authority\n  for (const name of ['origin', 'referer'] as const) {\n    const value = req.headers[name]\n    if (typeof value !== 'string') continue\n    try {\n      const url = new URL(value)\n      url.host = authority\n      req.headers[name] = url.toString()\n    } catch {}\n  }\n}\n"],"mappings":";;;AAOA,IAAa,WAAb,MAAsB;CACS;CAA7B,YAAY,OAAyC;EAAxB,KAAA,QAAA;CAAyB;CAEtD,OAAO,KAAoC;EACzC,MAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC;EACjD,IAAI,SAAS,YAAY,KAAK,WAAW,YAAY,GAAG,OAAO;EAC/D,IAAI,kBAAkB,IAAI,OAAO,eAAe,IAAI,QAAQ,IAAI,GAAG,OAAO;EAC1E,MAAM,SAAS,KAAK,MAAM;EAC1B,MAAM,WAAW,KAAK,MAAM;EAC5B,IAAI,UAAU,UAAU;GACtB,MAAM,QAAQ,WAAW,IAAI,QAAQ,QAAQ,cAAc;GAC3D,IAAI,cAAc,OAAO,QAAQ,QAAQ,GAAG,OAAO;EACrD;EACA,IAAI,KAAK,cAAc,GAAG,GAAG,OAAO;EACpC,OAAO;CACT;CAEA,cAAsB,KAA+B;EACnD,IAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ,OAAO;EAE1D,IADa,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC,SACxC,WAAW,OAAO,GAAG,OAAO;EACrC,MAAM,SAAS,IAAI,QAAQ,UAAU;EACrC,OAAO,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,KAAK;CAC9D;AACF;AAEA,SAAgB,kBAAkB,KAAsB,MAAqB;CAC3E,MAAM,YAAY,QAAQ,IAAI,OAAO;CACrC,IAAI,OAAO,cAAc,UAAU;CACnC,MAAM,YAAY,aAAa;CAC/B,IAAI,QAAQ,OAAO;CACnB,KAAK,MAAM,QAAQ,CAAC,UAAU,SAAS,GAAY;EACjD,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI,OAAO,UAAU,UAAU;EAC/B,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,KAAK;GACzB,IAAI,OAAO;GACX,IAAI,QAAQ,QAAQ,IAAI,SAAS;EACnC,QAAQ,CAAC;CACX;AACF"}
+{"version":3,"file":"gate.js","names":[],"sources":["../../src/auth/gate.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\nimport { isLoopbackRequest } from './loopback.js'\nimport { readCookie, SESSION_COOKIE, verifySession } from './session.js'\nimport type { CredentialStore } from './credentials.js'\n\nexport type GateDecision = 'allow' | 'exempt' | 'redirect-login' | 'reject' | 'forbidden'\n\nfunction isTrustedLoopbackAuthRequest(req: IncomingMessage): boolean {\n  if (!isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return false\n  if (req.headers['sec-fetch-site'] === 'cross-site') return false\n  const origin = req.headers.origin\n  if (origin === undefined) return true\n  if (typeof origin !== 'string' || !req.headers.host) return false\n  try {\n    return new URL(origin).host === new URL(`http://${req.headers.host}`).host\n  } catch {\n    return false\n  }\n}\n\nexport class AuthGate {\n  private isTrustedAuthRequest: ((req: IncomingMessage) => boolean) | undefined\n\n  constructor(private readonly store: CredentialStore) {}\n\n  setAuthRequestTrustCheck(check: (req: IncomingMessage) => boolean): void {\n    this.isTrustedAuthRequest = check\n  }\n\n  decide(req: IncomingMessage): GateDecision {\n    const path = new URL(req.url ?? '/', 'http://x').pathname\n    if (path === '/login') return 'exempt'\n    if (path === '/api/auth' || path.startsWith('/api/auth/')) {\n      const trusted = this.isTrustedAuthRequest\n        ? this.isTrustedAuthRequest(req)\n        : isTrustedLoopbackAuthRequest(req)\n      return trusted ? 'exempt' : 'forbidden'\n    }\n    if (isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return 'allow'\n    const secret = this.store.sessionSecret\n    const username = this.store.username\n    if (secret && username) {\n      const value = readCookie(req.headers.cookie, SESSION_COOKIE)\n      if (verifySession(value, secret, username)) return 'allow'\n    }\n    if (this.isPageRequest(req)) return 'redirect-login'\n    return 'reject'\n  }\n\n  private isPageRequest(req: IncomingMessage): boolean {\n    if (req.method !== 'GET' && req.method !== 'HEAD') return false\n    const path = new URL(req.url ?? '/', 'http://x').pathname\n    if (path.startsWith('/api/')) return false\n    const accept = req.headers.accept ?? ''\n    return accept.includes('text/html') || accept.includes('*/*')\n  }\n}\n\nexport function rewriteToLoopback(req: IncomingMessage, port?: number): void {\n  const localPort = port ?? req.socket.localPort\n  if (typeof localPort !== 'number') return\n  const authority = `127.0.0.1:${localPort}`\n  req.headers.host = authority\n  for (const name of ['origin', 'referer'] as const) {\n    const value = req.headers[name]\n    if (typeof value !== 'string') continue\n    try {\n      const url = new URL(value)\n      url.host = authority\n      req.headers[name] = url.toString()\n    } catch {}\n  }\n}\n"],"mappings":";;;AAOA,SAAS,6BAA6B,KAA+B;CACnE,IAAI,CAAC,kBAAkB,IAAI,OAAO,eAAe,IAAI,QAAQ,IAAI,GAAG,OAAO;CAC3E,IAAI,IAAI,QAAQ,sBAAsB,cAAc,OAAO;CAC3D,MAAM,SAAS,IAAI,QAAQ;CAC3B,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,YAAY,CAAC,IAAI,QAAQ,MAAM,OAAO;CAC5D,IAAI;EACF,OAAO,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,UAAU,IAAI,QAAQ,MAAM,CAAC,CAAC;CACxE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CAGS;CAF7B;CAEA,YAAY,OAAyC;EAAxB,KAAA,QAAA;CAAyB;CAEtD,yBAAyB,OAAgD;EACvE,KAAK,uBAAuB;CAC9B;CAEA,OAAO,KAAoC;EACzC,MAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC;EACjD,IAAI,SAAS,UAAU,OAAO;EAC9B,IAAI,SAAS,eAAe,KAAK,WAAW,YAAY,GAItD,QAHgB,KAAK,uBACjB,KAAK,qBAAqB,GAAG,IAC7B,6BAA6B,GAAG,KACnB,WAAW;EAE9B,IAAI,kBAAkB,IAAI,OAAO,eAAe,IAAI,QAAQ,IAAI,GAAG,OAAO;EAC1E,MAAM,SAAS,KAAK,MAAM;EAC1B,MAAM,WAAW,KAAK,MAAM;EAC5B,IAAI,UAAU,UAAU;GACtB,MAAM,QAAQ,WAAW,IAAI,QAAQ,QAAQ,cAAc;GAC3D,IAAI,cAAc,OAAO,QAAQ,QAAQ,GAAG,OAAO;EACrD;EACA,IAAI,KAAK,cAAc,GAAG,GAAG,OAAO;EACpC,OAAO;CACT;CAEA,cAAsB,KAA+B;EACnD,IAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ,OAAO;EAE1D,IADa,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC,SACxC,WAAW,OAAO,GAAG,OAAO;EACrC,MAAM,SAAS,IAAI,QAAQ,UAAU;EACrC,OAAO,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,KAAK;CAC9D;AACF;AAEA,SAAgB,kBAAkB,KAAsB,MAAqB;CAC3E,MAAM,YAAY,QAAQ,IAAI,OAAO;CACrC,IAAI,OAAO,cAAc,UAAU;CACnC,MAAM,YAAY,aAAa;CAC/B,IAAI,QAAQ,OAAO;CACnB,KAAK,MAAM,QAAQ,CAAC,UAAU,SAAS,GAAY;EACjD,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI,OAAO,UAAU,UAAU;EAC/B,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,KAAK;GACzB,IAAI,OAAO;GACX,IAAI,QAAQ,QAAQ,IAAI,SAAS;EACnC,QAAQ,CAAC;CACX;AACF"}

package/lib/auth/index.js

@@ -1,4 +1,5 @@
 import { sharedCredentialStore } from "./credentials.js";
+import { AuthGate } from "./gate.js";
 import { decorateWebServer } from "./decorate-webserver.js";
 import { installLoopbackCompat } from "./loopback-compat.js";
 import { LoginRateLimiter } from "./ratelimit.js";
@@ -41,16 +42,23 @@ function registerFrontendBootRaceWorkaround(ctx) {
 	} catch {}
 }
 function apply(ctx) {
-	decorateWebServer(ctx.webServer, sharedCredentialStore());
+	const store = sharedCredentialStore();
+	const gate = new AuthGate(store);
+	decorateWebServer(ctx.webServer, store, gate);
 	registerFrontendBootRaceWorkaround(ctx);
 	ctx.webServer.tapIndex(installLoopbackCompat);
-	registerAuthRoutes(ctx, sharedCredentialStore(), new LoginRateLimiter());
+	registerAuthRoutes(ctx, store, new LoginRateLimiter());
 	ctx.inject(["connection"], (connCtx) => {
-		const auth = connCtx.connection?.browserAuth;
+		const conn = connCtx.connection;
+		const auth = conn?.browserAuth;
 		if (auth && typeof auth.isAuthenticated === "function" && !auth.__dshbNeutralized) {
 			auth.isAuthenticated = () => true;
 			auth.__dshbNeutralized = true;
 		}
+		if (conn && typeof conn.requestRejection === "function") gate.setAuthRequestTrustCheck((req) => {
+			const rejection = conn.requestRejection(req);
+			return rejection === void 0 || rejection === 401;
+		});
 	});
 }
 //#endregion

package/lib/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { readFileSync, readdirSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport { basename, dirname, join } from 'node:path'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sharedCredentialStore } from './credentials.js'\nimport { decorateWebServer } from './decorate-webserver.js'\nimport { installLoopbackCompat } from './loopback-compat.js'\nimport { LoginRateLimiter } from './ratelimit.js'\nimport { registerAuthRoutes } from './routes.js'\n\nexport const name = 'dshb-auth'\n\nexport const inject = ['webServer']\n\nfunction registerFrontendBootRaceWorkaround(ctx: Context): void {\n  try {\n    // Resolve the frontend through the same `dsh-web-app` bundle the webserver\n    // loads, so the patched hashed asset is the one the static fallback serves.\n    // `process.cwd()` may hold a different installation whose asset filename\n    // the server never requests, leaving the served bundle unpatched.\n    const resolver = createRequire(import.meta.url)\n    let manifestPath: string\n    try {\n      const webAppManifest = resolver.resolve('@deepseek-ai/dsh-web-app/package.json')\n      manifestPath = createRequire(webAppManifest).resolve('@deepseek-ai/dsh-web-frontend/package.json')\n    } catch {\n      manifestPath = resolver.resolve('@deepseek-ai/dsh-web-frontend/package.json', {\n        paths: [process.cwd()],\n      })\n    }\n    const assetDir = join(dirname(manifestPath), 'dist', 'assets')\n    const assetName = readdirSync(assetDir).find((name) => /^index-.*\\.js$/.test(name))\n    if (!assetName) return\n\n    const assetPath = join(assetDir, assetName)\n    const source = readFileSync(assetPath, 'utf8')\n    // DSH asserts before api-remotes' dynamic remote namespace fibers settle.\n    // Delay the assertion so mountApp sees the complete client graph; real\n    // activation failures still throw after the bounded wait. The minified\n    // identifiers vary between builds, and 0.1.7 moved the assertion into nE.\n    const legacyPatch = source.replace(\n      /await ([A-Za-z_$][\\w$]*)\\.await\\(\\),this\\.assertEntriesActive\\(([A-Za-z_$][\\w$]*)\\)/,\n      'await $1.await(),await new Promise(r=>setTimeout(r,8000)),this.assertEntriesActive($2)',\n    )\n    const patched = legacyPatch !== source\n      ? legacyPatch\n      : source.replace(\n          /await ([A-Za-z_$][\\w$]*)\\.await\\(\\),([A-Za-z_$][\\w$]*)\\(([A-Za-z_$][\\w$]*),([A-Za-z_$][\\w$]*(?:\\.[A-Za-z_$][\\w$]*)*)\\)/,\n          'await $1.await(),await new Promise(r=>setTimeout(r,8000)),$2($3,$4)',\n        )\n    if (patched === source) return\n\n    ctx.effect(() =>\n      ctx.webServer.register({\n        kind: 'exact',\n        path: `/assets/${basename(assetPath)}`,\n        handler: (_req, res) => {\n          res.writeHead(200, {\n            'cache-control': 'no-store',\n            'content-type': 'application/javascript; charset=utf-8',\n          })\n          res.end(patched)\n        },\n      }),\n    )\n  } catch {\n    // Upstream assets are optional from DSHB's perspective. A missing or changed\n    // frontend layout simply skips this version-specific workaround.\n  }\n}\n\nexport function apply(ctx: Context): void {\n  decorateWebServer(ctx.webServer, sharedCredentialStore())\n  registerFrontendBootRaceWorkaround(ctx)\n  ctx.webServer.tapIndex(installLoopbackCompat)\n  registerAuthRoutes(ctx, sharedCredentialStore(), new LoginRateLimiter())\n\n  // DSH 0.1.5 introduced a browser-auth fence on the connection package: the SPA\n  // fallback calls connection.authorizeIndex() on \"/\" (mints/checks DSH's own\n  // launch-token cookie), and /api routes run requestRejection() which 401s when\n  // that DSH cookie is absent. DSHB uses its own session cookie and must stay the\n  // sole auth gate (DSH 0.1.1 had no such connection fence, so DSHB worked there).\n  // Neutralize the connection's browserAuth.isAuthenticated check so DSH's fence\n  // never rejects a DSHB-authenticated (or loopback) request; DSHB's gate still\n  // rejects unauthenticated access to gated routes. Property is read at request\n  // time, so installing it once after connection is ready suffices.\n  ctx.inject(['connection'], (connCtx: Context) => {\n    const conn = (connCtx as unknown as { connection?: { browserAuth?: { isAuthenticated?: (...a: unknown[]) => unknown; __dshbNeutralized?: true } } }).connection\n    const auth = conn?.browserAuth\n    if (auth && typeof auth.isAuthenticated === 'function' && !auth.__dshbNeutralized) {\n      auth.isAuthenticated = () => true\n      auth.__dshbNeutralized = true\n    }\n  })\n}\n"],"mappings":";;;;;;;;;AAUA,MAAa,OAAO;AAEpB,MAAa,SAAS,CAAC,WAAW;AAElC,SAAS,mCAAmC,KAAoB;CAC9D,IAAI;EAKF,MAAM,WAAW,cAAc,YAAY,GAAG;EAC9C,IAAI;EACJ,IAAI;GACF,MAAM,iBAAiB,SAAS,QAAQ,uCAAuC;GAC/E,eAAe,cAAc,cAAc,CAAC,CAAC,QAAQ,4CAA4C;EACnG,QAAQ;GACN,eAAe,SAAS,QAAQ,8CAA8C,EAC5E,OAAO,CAAC,QAAQ,IAAI,CAAC,EACvB,CAAC;EACH;EACA,MAAM,WAAW,KAAK,QAAQ,YAAY,GAAG,QAAQ,QAAQ;EAC7D,MAAM,YAAY,YAAY,QAAQ,CAAC,CAAC,MAAM,SAAS,iBAAiB,KAAK,IAAI,CAAC;EAClF,IAAI,CAAC,WAAW;EAEhB,MAAM,YAAY,KAAK,UAAU,SAAS;EAC1C,MAAM,SAAS,aAAa,WAAW,MAAM;EAK7C,MAAM,cAAc,OAAO,QACzB,uFACA,wFACF;EACA,MAAM,UAAU,gBAAgB,SAC5B,cACA,OAAO,QACL,0HACA,qEACF;EACJ,IAAI,YAAY,QAAQ;EAExB,IAAI,aACF,IAAI,UAAU,SAAS;GACrB,MAAM;GACN,MAAM,WAAW,SAAS,SAAS;GACnC,UAAU,MAAM,QAAQ;IACtB,IAAI,UAAU,KAAK;KACjB,iBAAiB;KACjB,gBAAgB;IAClB,CAAC;IACD,IAAI,IAAI,OAAO;GACjB;EACF,CAAC,CACH;CACF,QAAQ,CAGR;AACF;AAEA,SAAgB,MAAM,KAAoB;CACxC,kBAAkB,IAAI,WAAW,sBAAsB,CAAC;CACxD,mCAAmC,GAAG;CACtC,IAAI,UAAU,SAAS,qBAAqB;CAC5C,mBAAmB,KAAK,sBAAsB,GAAG,IAAI,iBAAiB,CAAC;CAWvE,IAAI,OAAO,CAAC,YAAY,IAAI,YAAqB;EAE/C,MAAM,OADQ,QAAuI,YAClI;EACnB,IAAI,QAAQ,OAAO,KAAK,oBAAoB,cAAc,CAAC,KAAK,mBAAmB;GACjF,KAAK,wBAAwB;GAC7B,KAAK,oBAAoB;EAC3B;CACF,CAAC;AACH"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { readFileSync, readdirSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport { basename, dirname, join } from 'node:path'\nimport type { IncomingMessage } from 'node:http'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sharedCredentialStore } from './credentials.js'\nimport { decorateWebServer } from './decorate-webserver.js'\nimport { AuthGate } from './gate.js'\nimport { installLoopbackCompat } from './loopback-compat.js'\nimport { LoginRateLimiter } from './ratelimit.js'\nimport { registerAuthRoutes } from './routes.js'\n\nexport const name = 'dshb-auth'\n\nexport const inject = ['webServer']\n\nfunction registerFrontendBootRaceWorkaround(ctx: Context): void {\n  try {\n    // Resolve the frontend through the same `dsh-web-app` bundle the webserver\n    // loads, so the patched hashed asset is the one the static fallback serves.\n    // `process.cwd()` may hold a different installation whose asset filename\n    // the server never requests, leaving the served bundle unpatched.\n    const resolver = createRequire(import.meta.url)\n    let manifestPath: string\n    try {\n      const webAppManifest = resolver.resolve('@deepseek-ai/dsh-web-app/package.json')\n      manifestPath = createRequire(webAppManifest).resolve('@deepseek-ai/dsh-web-frontend/package.json')\n    } catch {\n      manifestPath = resolver.resolve('@deepseek-ai/dsh-web-frontend/package.json', {\n        paths: [process.cwd()],\n      })\n    }\n    const assetDir = join(dirname(manifestPath), 'dist', 'assets')\n    const assetName = readdirSync(assetDir).find((name) => /^index-.*\\.js$/.test(name))\n    if (!assetName) return\n\n    const assetPath = join(assetDir, assetName)\n    const source = readFileSync(assetPath, 'utf8')\n    // DSH asserts before api-remotes' dynamic remote namespace fibers settle.\n    // Delay the assertion so mountApp sees the complete client graph; real\n    // activation failures still throw after the bounded wait. The minified\n    // identifiers vary between builds, and 0.1.7 moved the assertion into nE.\n    const legacyPatch = source.replace(\n      /await ([A-Za-z_$][\\w$]*)\\.await\\(\\),this\\.assertEntriesActive\\(([A-Za-z_$][\\w$]*)\\)/,\n      'await $1.await(),await new Promise(r=>setTimeout(r,8000)),this.assertEntriesActive($2)',\n    )\n    const patched = legacyPatch !== source\n      ? legacyPatch\n      : source.replace(\n          /await ([A-Za-z_$][\\w$]*)\\.await\\(\\),([A-Za-z_$][\\w$]*)\\(([A-Za-z_$][\\w$]*),([A-Za-z_$][\\w$]*(?:\\.[A-Za-z_$][\\w$]*)*)\\)/,\n          'await $1.await(),await new Promise(r=>setTimeout(r,8000)),$2($3,$4)',\n        )\n    if (patched === source) return\n\n    ctx.effect(() =>\n      ctx.webServer.register({\n        kind: 'exact',\n        path: `/assets/${basename(assetPath)}`,\n        handler: (_req, res) => {\n          res.writeHead(200, {\n            'cache-control': 'no-store',\n            'content-type': 'application/javascript; charset=utf-8',\n          })\n          res.end(patched)\n        },\n      }),\n    )\n  } catch {\n    // Upstream assets are optional from DSHB's perspective. A missing or changed\n    // frontend layout simply skips this version-specific workaround.\n  }\n}\n\nexport function apply(ctx: Context): void {\n  const store = sharedCredentialStore()\n  const gate = new AuthGate(store)\n  decorateWebServer(ctx.webServer, store, gate)\n  registerFrontendBootRaceWorkaround(ctx)\n  ctx.webServer.tapIndex(installLoopbackCompat)\n  registerAuthRoutes(ctx, store, new LoginRateLimiter())\n\n  // DSH 0.1.5 introduced a browser-auth fence on the connection package: the SPA\n  // fallback calls connection.authorizeIndex() on \"/\" (mints/checks DSH's own\n  // launch-token cookie), and /api routes run requestRejection() which 401s when\n  // that DSH cookie is absent. DSHB uses its own session cookie and must stay the\n  // sole auth gate (DSH 0.1.1 had no such connection fence, so DSHB worked there).\n  // Neutralize the connection's browserAuth.isAuthenticated check so DSH's fence\n  // never rejects a DSHB-authenticated (or loopback) request; DSHB's gate still\n  // rejects unauthenticated access to gated routes. Property is read at request\n  // time, so installing it once after connection is ready suffices.\n  ctx.inject(['connection'], (connCtx: Context) => {\n    const conn = (connCtx as unknown as {\n      connection?: {\n        browserAuth?: { isAuthenticated?: (...a: unknown[]) => unknown; __dshbNeutralized?: true }\n        requestRejection?: (request: IncomingMessage) => number | undefined\n      }\n    }).connection\n    const auth = conn?.browserAuth\n    if (auth && typeof auth.isAuthenticated === 'function' && !auth.__dshbNeutralized) {\n      auth.isAuthenticated = () => true\n      auth.__dshbNeutralized = true\n    }\n    if (conn && typeof conn.requestRejection === 'function') {\n      gate.setAuthRequestTrustCheck((req) => {\n        const rejection = conn.requestRejection!(req)\n        // DSH 401 is its browser-cookie gate; DSHB owns that check for these routes.\n        return rejection === undefined || rejection === 401\n      })\n    }\n  })\n}\n"],"mappings":";;;;;;;;;;AAYA,MAAa,OAAO;AAEpB,MAAa,SAAS,CAAC,WAAW;AAElC,SAAS,mCAAmC,KAAoB;CAC9D,IAAI;EAKF,MAAM,WAAW,cAAc,YAAY,GAAG;EAC9C,IAAI;EACJ,IAAI;GACF,MAAM,iBAAiB,SAAS,QAAQ,uCAAuC;GAC/E,eAAe,cAAc,cAAc,CAAC,CAAC,QAAQ,4CAA4C;EACnG,QAAQ;GACN,eAAe,SAAS,QAAQ,8CAA8C,EAC5E,OAAO,CAAC,QAAQ,IAAI,CAAC,EACvB,CAAC;EACH;EACA,MAAM,WAAW,KAAK,QAAQ,YAAY,GAAG,QAAQ,QAAQ;EAC7D,MAAM,YAAY,YAAY,QAAQ,CAAC,CAAC,MAAM,SAAS,iBAAiB,KAAK,IAAI,CAAC;EAClF,IAAI,CAAC,WAAW;EAEhB,MAAM,YAAY,KAAK,UAAU,SAAS;EAC1C,MAAM,SAAS,aAAa,WAAW,MAAM;EAK7C,MAAM,cAAc,OAAO,QACzB,uFACA,wFACF;EACA,MAAM,UAAU,gBAAgB,SAC5B,cACA,OAAO,QACL,0HACA,qEACF;EACJ,IAAI,YAAY,QAAQ;EAExB,IAAI,aACF,IAAI,UAAU,SAAS;GACrB,MAAM;GACN,MAAM,WAAW,SAAS,SAAS;GACnC,UAAU,MAAM,QAAQ;IACtB,IAAI,UAAU,KAAK;KACjB,iBAAiB;KACjB,gBAAgB;IAClB,CAAC;IACD,IAAI,IAAI,OAAO;GACjB;EACF,CAAC,CACH;CACF,QAAQ,CAGR;AACF;AAEA,SAAgB,MAAM,KAAoB;CACxC,MAAM,QAAQ,sBAAsB;CACpC,MAAM,OAAO,IAAI,SAAS,KAAK;CAC/B,kBAAkB,IAAI,WAAW,OAAO,IAAI;CAC5C,mCAAmC,GAAG;CACtC,IAAI,UAAU,SAAS,qBAAqB;CAC5C,mBAAmB,KAAK,OAAO,IAAI,iBAAiB,CAAC;CAWrD,IAAI,OAAO,CAAC,YAAY,IAAI,YAAqB;EAC/C,MAAM,OAAQ,QAKX;EACH,MAAM,OAAO,MAAM;EACnB,IAAI,QAAQ,OAAO,KAAK,oBAAoB,cAAc,CAAC,KAAK,mBAAmB;GACjF,KAAK,wBAAwB;GAC7B,KAAK,oBAAoB;EAC3B;EACA,IAAI,QAAQ,OAAO,KAAK,qBAAqB,YAC3C,KAAK,0BAA0B,QAAQ;GACrC,MAAM,YAAY,KAAK,iBAAkB,GAAG;GAE5C,OAAO,cAAc,KAAA,KAAa,cAAc;EAClD,CAAC;CAEL,CAAC;AACH"}

package/lib/auth/webserver.d.ts

@@ -8,7 +8,9 @@ declare class AuthedWebServer extends WebServer {
     port: number;
   });
   register(route: WebRoute): () => void;
-  registerFallback(handler: WebRoute['handler']): () => void;
+  registerFallback(handler: WebRoute['handler'] | {
+    resource: unknown;
+  }): () => void;
   registerUpgrade(route: WebUpgradeRoute): () => void;
   private guarded;
   private guardedUpgrade;

package/lib/auth/webserver.js

@@ -14,6 +14,7 @@ var AuthedWebServer = class extends WebServer {
 		});
 	}
 	registerFallback(handler) {
+		if (typeof handler === "object" && handler !== null && "resource" in handler && typeof handler.resource === "function") return super.registerFallback(handler);
 		return super.registerFallback((req, res) => this.guarded({
 			kind: "exact",
 			path: "/",
@@ -38,6 +39,14 @@ var AuthedWebServer = class extends WebServer {
 			res.end();
 			return;
 		}
+		if (decision === "forbidden") {
+			res.writeHead(403, { "content-type": "application/json" });
+			res.end(JSON.stringify({
+				ok: false,
+				error: "forbidden"
+			}));
+			return;
+		}
 		res.writeHead(401, { "content-type": "application/json" });
 		res.end(JSON.stringify({
 			ok: false,
@@ -50,7 +59,7 @@ var AuthedWebServer = class extends WebServer {
 			if (decision === "allow") rewriteToLoopback(req, this.port);
 			return route.handler(req, socket, head);
 		}
-		socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+		socket.write(decision === "forbidden" ? "HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n" : "HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
 		socket.destroy();
 	}
 };

package/lib/auth/webserver.js.map

@@ -1 +1 @@
-{"version":3,"file":"webserver.js","names":[],"sources":["../../src/auth/webserver.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport WebServer from '@deepseek-ai/dsh-host-webserver'\nimport type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sharedCredentialStore } from './credentials.js'\nimport { AuthGate, rewriteToLoopback } from './gate.js'\n\nexport default class AuthedWebServer extends WebServer {\n  private readonly gate = new AuthGate(sharedCredentialStore())\n\n  constructor(ctx: Context, config: { host: string; port: number }) {\n    super(ctx, config)\n  }\n\n  override register(route: WebRoute): () => void {\n    return super.register({ ...route, handler: (req, res) => this.guarded(route, req, res) })\n  }\n\n  override registerFallback(handler: WebRoute['handler']): () => void {\n    return super.registerFallback((req, res) =>\n      this.guarded({ kind: 'exact', path: '/', handler }, req, res),\n    )\n  }\n\n  override registerUpgrade(route: WebUpgradeRoute): () => void {\n    return super.registerUpgrade({\n      ...route,\n      handler: (req, socket, head) => this.guardedUpgrade(route, req, socket, head),\n    })\n  }\n\n  private guarded(route: WebRoute, req: IncomingMessage, res: ServerResponse): void | Promise<void> {\n    const decision = this.gate.decide(req)\n    if (decision === 'allow') {\n      rewriteToLoopback(req, this.port)\n      return route.handler(req, res)\n    }\n    if (decision === 'exempt') {\n      return route.handler(req, res)\n    }\n    if (decision === 'redirect-login') {\n      res.writeHead(302, { location: '/login' })\n      res.end()\n      return\n    }\n    res.writeHead(401, { 'content-type': 'application/json' })\n    res.end(JSON.stringify({ ok: false, error: 'unauthorized' }))\n  }\n\n  private guardedUpgrade(\n    route: WebUpgradeRoute,\n    req: IncomingMessage,\n    socket: Duplex,\n    head: Buffer,\n  ): void | Promise<void> {\n    const decision = this.gate.decide(req)\n    if (decision === 'allow' || decision === 'exempt') {\n      if (decision === 'allow') rewriteToLoopback(req, this.port)\n      return route.handler(req, socket, head)\n    }\n    socket.write('HTTP/1.1 401 Unauthorized\\r\\nConnection: close\\r\\n\\r\\n')\n    socket.destroy()\n  }\n}\n"],"mappings":";;;;AAQA,IAAqB,kBAArB,cAA6C,UAAU;CACrD,OAAwB,IAAI,SAAS,sBAAsB,CAAC;CAE5D,YAAY,KAAc,QAAwC;EAChE,MAAM,KAAK,MAAM;CACnB;CAEA,SAAkB,OAA6B;EAC7C,OAAO,MAAM,SAAS;GAAE,GAAG;GAAO,UAAU,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,GAAG;EAAE,CAAC;CAC1F;CAEA,iBAA0B,SAA0C;EAClE,OAAO,MAAM,kBAAkB,KAAK,QAClC,KAAK,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK;EAAQ,GAAG,KAAK,GAAG,CAC9D;CACF;CAEA,gBAAyB,OAAoC;EAC3D,OAAO,MAAM,gBAAgB;GAC3B,GAAG;GACH,UAAU,KAAK,QAAQ,SAAS,KAAK,eAAe,OAAO,KAAK,QAAQ,IAAI;EAC9E,CAAC;CACH;CAEA,QAAgB,OAAiB,KAAsB,KAA2C;EAChG,MAAM,WAAW,KAAK,KAAK,OAAO,GAAG;EACrC,IAAI,aAAa,SAAS;GACxB,kBAAkB,KAAK,KAAK,IAAI;GAChC,OAAO,MAAM,QAAQ,KAAK,GAAG;EAC/B;EACA,IAAI,aAAa,UACf,OAAO,MAAM,QAAQ,KAAK,GAAG;EAE/B,IAAI,aAAa,kBAAkB;GACjC,IAAI,UAAU,KAAK,EAAE,UAAU,SAAS,CAAC;GACzC,IAAI,IAAI;GACR;EACF;EACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,IAAI,IAAI,KAAK,UAAU;GAAE,IAAI;GAAO,OAAO;EAAe,CAAC,CAAC;CAC9D;CAEA,eACE,OACA,KACA,QACA,MACsB;EACtB,MAAM,WAAW,KAAK,KAAK,OAAO,GAAG;EACrC,IAAI,aAAa,WAAW,aAAa,UAAU;GACjD,IAAI,aAAa,SAAS,kBAAkB,KAAK,KAAK,IAAI;GAC1D,OAAO,MAAM,QAAQ,KAAK,QAAQ,IAAI;EACxC;EACA,OAAO,MAAM,wDAAwD;EACrE,OAAO,QAAQ;CACjB;AACF"}
+{"version":3,"file":"webserver.js","names":[],"sources":["../../src/auth/webserver.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport WebServer from '@deepseek-ai/dsh-host-webserver'\nimport type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sharedCredentialStore } from './credentials.js'\nimport { AuthGate, rewriteToLoopback } from './gate.js'\n\nexport default class AuthedWebServer extends WebServer {\n  private readonly gate = new AuthGate(sharedCredentialStore())\n\n  constructor(ctx: Context, config: { host: string; port: number }) {\n    super(ctx, config)\n  }\n\n  override register(route: WebRoute): () => void {\n    return super.register({ ...route, handler: (req, res) => this.guarded(route, req, res) })\n  }\n\n  override registerFallback(handler: WebRoute['handler'] | { resource: unknown }): () => void {\n    if (typeof handler === 'object'\n      && handler !== null\n      && 'resource' in handler\n      && typeof handler.resource === 'function') {\n      return super.registerFallback(handler as unknown as WebRoute['handler'])\n    }\n    return super.registerFallback((req, res) =>\n      this.guarded({ kind: 'exact', path: '/', handler: handler as WebRoute['handler'] }, req, res),\n    )\n  }\n\n  override registerUpgrade(route: WebUpgradeRoute): () => void {\n    return super.registerUpgrade({\n      ...route,\n      handler: (req, socket, head) => this.guardedUpgrade(route, req, socket, head),\n    })\n  }\n\n  private guarded(route: WebRoute, req: IncomingMessage, res: ServerResponse): void | Promise<void> {\n    const decision = this.gate.decide(req)\n    if (decision === 'allow') {\n      rewriteToLoopback(req, this.port)\n      return route.handler(req, res)\n    }\n    if (decision === 'exempt') {\n      return route.handler(req, res)\n    }\n    if (decision === 'redirect-login') {\n      res.writeHead(302, { location: '/login' })\n      res.end()\n      return\n    }\n    if (decision === 'forbidden') {\n      res.writeHead(403, { 'content-type': 'application/json' })\n      res.end(JSON.stringify({ ok: false, error: 'forbidden' }))\n      return\n    }\n    res.writeHead(401, { 'content-type': 'application/json' })\n    res.end(JSON.stringify({ ok: false, error: 'unauthorized' }))\n  }\n\n  private guardedUpgrade(\n    route: WebUpgradeRoute,\n    req: IncomingMessage,\n    socket: Duplex,\n    head: Buffer,\n  ): void | Promise<void> {\n    const decision = this.gate.decide(req)\n    if (decision === 'allow' || decision === 'exempt') {\n      if (decision === 'allow') rewriteToLoopback(req, this.port)\n      return route.handler(req, socket, head)\n    }\n    socket.write(decision === 'forbidden'\n      ? 'HTTP/1.1 403 Forbidden\\r\\nConnection: close\\r\\n\\r\\n'\n      : 'HTTP/1.1 401 Unauthorized\\r\\nConnection: close\\r\\n\\r\\n')\n    socket.destroy()\n  }\n}\n"],"mappings":";;;;AAQA,IAAqB,kBAArB,cAA6C,UAAU;CACrD,OAAwB,IAAI,SAAS,sBAAsB,CAAC;CAE5D,YAAY,KAAc,QAAwC;EAChE,MAAM,KAAK,MAAM;CACnB;CAEA,SAAkB,OAA6B;EAC7C,OAAO,MAAM,SAAS;GAAE,GAAG;GAAO,UAAU,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,GAAG;EAAE,CAAC;CAC1F;CAEA,iBAA0B,SAAkE;EAC1F,IAAI,OAAO,YAAY,YAClB,YAAY,QACZ,cAAc,WACd,OAAO,QAAQ,aAAa,YAC/B,OAAO,MAAM,iBAAiB,OAAyC;EAEzE,OAAO,MAAM,kBAAkB,KAAK,QAClC,KAAK,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAc;EAA+B,GAAG,KAAK,GAAG,CAC9F;CACF;CAEA,gBAAyB,OAAoC;EAC3D,OAAO,MAAM,gBAAgB;GAC3B,GAAG;GACH,UAAU,KAAK,QAAQ,SAAS,KAAK,eAAe,OAAO,KAAK,QAAQ,IAAI;EAC9E,CAAC;CACH;CAEA,QAAgB,OAAiB,KAAsB,KAA2C;EAChG,MAAM,WAAW,KAAK,KAAK,OAAO,GAAG;EACrC,IAAI,aAAa,SAAS;GACxB,kBAAkB,KAAK,KAAK,IAAI;GAChC,OAAO,MAAM,QAAQ,KAAK,GAAG;EAC/B;EACA,IAAI,aAAa,UACf,OAAO,MAAM,QAAQ,KAAK,GAAG;EAE/B,IAAI,aAAa,kBAAkB;GACjC,IAAI,UAAU,KAAK,EAAE,UAAU,SAAS,CAAC;GACzC,IAAI,IAAI;GACR;EACF;EACA,IAAI,aAAa,aAAa;GAC5B,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;GACzD,IAAI,IAAI,KAAK,UAAU;IAAE,IAAI;IAAO,OAAO;GAAY,CAAC,CAAC;GACzD;EACF;EACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,IAAI,IAAI,KAAK,UAAU;GAAE,IAAI;GAAO,OAAO;EAAe,CAAC,CAAC;CAC9D;CAEA,eACE,OACA,KACA,QACA,MACsB;EACtB,MAAM,WAAW,KAAK,KAAK,OAAO,GAAG;EACrC,IAAI,aAAa,WAAW,aAAa,UAAU;GACjD,IAAI,aAAa,SAAS,kBAAkB,KAAK,KAAK,IAAI;GAC1D,OAAO,MAAM,QAAQ,KAAK,QAAQ,IAAI;EACxC;EACA,OAAO,MAAM,aAAa,cACtB,wDACA,wDAAwD;EAC5D,OAAO,QAAQ;CACjB;AACF"}