@calimero-network/registry-cli 1.22.2 → 1.22.4

package/dist/index.js

@@ -5,10 +5,9 @@ import { createRequire } from 'module';
 import ora4 from 'ora';
 import axios from 'axios';
 import fs7, { existsSync, writeFileSync } from 'fs';
-import path5 from 'path';
+import path6 from 'path';
 import os2 from 'os';
 import fastify from 'fastify';
-import cors from '@fastify/cors';
 import crypto2 from 'crypto';
 import * as tar from 'tar';
 
@@ -16,11 +15,11 @@ var DEFAULT_REGISTRY_URL = "https://apps.calimero.network";
 function defaultConfig() {
   return { registry: { url: DEFAULT_REGISTRY_URL } };
 }
-var RemoteConfig = class {
+var RemoteConfig = class _RemoteConfig {
   configPath;
   config;
   constructor() {
-    this.configPath = path5.join(
+    this.configPath = path6.join(
       os2.homedir(),
       ".calimero-registry",
       "remote-config.json"
@@ -47,7 +46,7 @@ var RemoteConfig = class {
     return defaults;
   }
   saveConfig() {
-    const configDir = path5.dirname(this.configPath);
+    const configDir = path6.dirname(this.configPath);
     if (!fs7.existsSync(configDir)) {
       fs7.mkdirSync(configDir, { recursive: true });
     }
@@ -58,7 +57,13 @@ var RemoteConfig = class {
         ...this.config.registry.apiKey ? { apiKey: this.config.registry.apiKey } : {}
       }
     };
-    fs7.writeFileSync(this.configPath, JSON.stringify(configToSave, null, 2));
+    fs7.writeFileSync(this.configPath, JSON.stringify(configToSave, null, 2), {
+      mode: 384
+    });
+    try {
+      fs7.chmodSync(this.configPath, 384);
+    } catch {
+    }
   }
   /**
    * Get registry URL with priority:
@@ -73,9 +78,30 @@ var RemoteConfig = class {
    * Set registry URL
    */
   setRegistryUrl(url) {
+    if (_RemoteConfig.isInsecureRemoteUrl(url)) {
+      console.warn(
+        "\u26A0\uFE0F  Registry URL uses http:// on a non-local host. Your API key would be sent in cleartext \u2014 prefer https:// for remote registries."
+      );
+    }
     this.config.registry.url = url;
     this.saveConfig();
   }
+  /**
+   * True when `url` is http:// to a host other than localhost/loopback, i.e. a
+   * Bearer token would traverse the network in cleartext.
+   */
+  static isInsecureRemoteUrl(url) {
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      return false;
+    }
+    if (parsed.protocol !== "http:") return false;
+    const host = parsed.hostname.toLowerCase();
+    const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".localhost");
+    return !isLocal;
+  }
   /**
    * Get API key with priority:
    * 1. Environment variable CALIMERO_API_KEY
@@ -128,20 +154,20 @@ var RemoteConfig = class {
 function defaultConfig2() {
   return {
     server: {
-      // Reset used to say localhost here, but never reached the listener:
-      // `local start` sets the host on every run and defaults to 0.0.0.0,
-      // which is also what publicHost assumes, since a container reaching
-      // host.docker.internal cannot be served from loopback.
-      host: "0.0.0.0",
+      // Hardening: default to loopback so the dev server is not reachable from
+      // the LAN or a browsing website. Docker users who need container access
+      // opt in explicitly with `local start --host 0.0.0.0`; publicHost stays
+      // host.docker.internal for the URLs baked into manifests in that case.
+      host: "127.0.0.1",
       port: 8082,
       publicHost: "host.docker.internal"
     },
     data: {
-      dir: path5.join(os2.homedir(), ".calimero-registry", "data"),
-      artifactsDir: path5.join(os2.homedir(), ".calimero-registry", "artifacts")
+      dir: path6.join(os2.homedir(), ".calimero-registry", "data"),
+      artifactsDir: path6.join(os2.homedir(), ".calimero-registry", "artifacts")
     },
     artifacts: {
-      storageDir: path5.join(os2.homedir(), ".calimero-registry", "artifacts"),
+      storageDir: path6.join(os2.homedir(), ".calimero-registry", "artifacts"),
       serveLocal: true,
       copyArtifacts: true,
       maxFileSize: "100MB",
@@ -154,12 +180,12 @@ var LocalConfig = class {
   dataDir;
   config;
   constructor() {
-    this.configPath = path5.join(
+    this.configPath = path6.join(
       os2.homedir(),
       ".calimero-registry",
       "config.json"
     );
-    this.dataDir = path5.join(os2.homedir(), ".calimero-registry");
+    this.dataDir = path6.join(os2.homedir(), ".calimero-registry");
     this.config = this.loadConfig();
   }
   loadConfig() {
@@ -190,7 +216,7 @@ var LocalConfig = class {
     return defaults;
   }
   saveConfig() {
-    const configDir = path5.dirname(this.configPath);
+    const configDir = path6.dirname(this.configPath);
     if (!fs7.existsSync(configDir)) {
       fs7.mkdirSync(configDir, { recursive: true });
     }
@@ -224,8 +250,8 @@ var LocalConfig = class {
   }
   setDataDir(dir) {
     this.config.data.dir = dir;
-    this.config.data.artifactsDir = path5.join(dir, "artifacts");
-    this.config.artifacts.storageDir = path5.join(dir, "artifacts");
+    this.config.data.artifactsDir = path6.join(dir, "artifacts");
+    this.config.artifacts.storageDir = path6.join(dir, "artifacts");
     this.saveConfig();
   }
   getArtifactsDir() {
@@ -249,8 +275,8 @@ var LocalConfig = class {
     const dirs = [
       this.getDataDir(),
       this.getArtifactsDir(),
-      path5.join(this.getDataDir(), "backups"),
-      path5.join(this.getDataDir(), "logs")
+      path6.join(this.getDataDir(), "backups"),
+      path6.join(this.getDataDir(), "logs")
     ];
     dirs.forEach((dir) => {
       if (!fs7.existsSync(dir)) {
@@ -390,12 +416,12 @@ var LocalDataStore = class {
   artifactsFile;
   constructor(config) {
     this.config = config;
-    this.appsFile = path5.join(config.getDataDir(), "apps.json");
-    this.bundleManifestsFile = path5.join(
+    this.appsFile = path6.join(config.getDataDir(), "apps.json");
+    this.bundleManifestsFile = path6.join(
       config.getDataDir(),
       "bundle_manifests.json"
     );
-    this.artifactsFile = path5.join(config.getDataDir(), "artifacts.json");
+    this.artifactsFile = path6.join(config.getDataDir(), "artifacts.json");
     this.data = {
       apps: /* @__PURE__ */ new Map(),
       bundleManifests: /* @__PURE__ */ new Map(),
@@ -516,12 +542,12 @@ var LocalDataStore = class {
   // Backup and restore
   async backup(outputPath) {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const backupPath = outputPath || path5.join(
+    const backupPath = outputPath || path6.join(
       this.config.getDataDir(),
       "backups",
       `backup-${timestamp}.json`
     );
-    const backupDir = path5.dirname(backupPath);
+    const backupDir = path6.dirname(backupPath);
     if (!fs7.existsSync(backupDir)) {
       fs7.mkdirSync(backupDir, { recursive: true });
     }
@@ -613,16 +639,30 @@ var LocalArtifactServer = class {
       fs7.mkdirSync(this.artifactsDir, { recursive: true });
     }
   }
+  /**
+   * Hardening: build a path under artifactsDir from untrusted segments (request
+   * params, or bundle-provided package/version/filename) and guarantee it stays
+   * inside artifactsDir. A `..` or absolute segment would otherwise let a
+   * request read or write outside the artifact store (path traversal).
+   */
+  resolveArtifactPath(...segments) {
+    const base = path6.resolve(this.artifactsDir);
+    const resolved = path6.resolve(base, ...segments);
+    if (resolved !== base && !resolved.startsWith(base + path6.sep)) {
+      throw new Error("Invalid artifact path: escapes artifacts directory");
+    }
+    return resolved;
+  }
   // Copy artifact to local storage
   async copyArtifactToLocal(sourcePath, appId, version2, filename) {
     if (!fs7.existsSync(sourcePath)) {
       throw new Error(`Source file not found: ${sourcePath}`);
     }
-    const appVersionDir = path5.join(this.artifactsDir, appId, version2);
+    const targetPath = this.resolveArtifactPath(appId, version2, filename);
+    const appVersionDir = path6.dirname(targetPath);
     if (!fs7.existsSync(appVersionDir)) {
       fs7.mkdirSync(appVersionDir, { recursive: true });
     }
-    const targetPath = path5.join(appVersionDir, filename);
     fs7.copyFileSync(sourcePath, targetPath);
     const fileHash = await this.calculateFileHash(targetPath);
     this.dataStore.setArtifactPath(fileHash, targetPath);
@@ -630,7 +670,7 @@ var LocalArtifactServer = class {
   }
   // Serve artifact by app ID, version, and filename
   async serveArtifact(appId, version2, filename) {
-    const artifactPath = path5.join(this.artifactsDir, appId, version2, filename);
+    const artifactPath = this.resolveArtifactPath(appId, version2, filename);
     if (!fs7.existsSync(artifactPath)) {
       throw new Error(`Artifact not found: ${artifactPath}`);
     }
@@ -679,7 +719,7 @@ var LocalArtifactServer = class {
       let files = [];
       const items = fs7.readdirSync(dir);
       for (const item of items) {
-        const fullPath = path5.join(dir, item);
+        const fullPath = path6.join(dir, item);
         const stat = fs7.statSync(fullPath);
         if (stat.isDirectory()) {
           files = files.concat(getAllFiles(fullPath));
@@ -708,7 +748,7 @@ var LocalArtifactServer = class {
       let files = [];
       const items = fs7.readdirSync(dir);
       for (const item of items) {
-        const fullPath = path5.join(dir, item);
+        const fullPath = path6.join(dir, item);
         const stat = fs7.statSync(fullPath);
         if (stat.isDirectory()) {
           files = files.concat(getAllFiles(fullPath));
@@ -759,9 +799,27 @@ var LocalRegistryServer = class {
         level: "info"
       }
     });
-    await this.server.register(cors, {
-      origin: true,
-      credentials: true
+    const allowedHosts = /* @__PURE__ */ new Set();
+    for (const name of [
+      "localhost",
+      "127.0.0.1",
+      "[::1]",
+      this.config.getPublicHost(),
+      host === "0.0.0.0" || host === "::" ? "" : host
+    ]) {
+      if (!name) continue;
+      allowedHosts.add(name);
+      allowedHosts.add(`${name}:${serverPort}`);
+    }
+    this.server.addHook("onRequest", async (request, reply) => {
+      const hostHeader = (request.headers.host ?? "").toLowerCase();
+      if (!allowedHosts.has(hostHeader)) {
+        return reply.code(403).send({
+          statusCode: 403,
+          error: "Forbidden",
+          message: "Invalid Host header"
+        });
+      }
     });
     await this.registerRoutes();
     await this.server.listen({ port: serverPort, host });
@@ -805,6 +863,20 @@ var LocalRegistryServer = class {
   async seed() {
     await this.dataStore.seed();
   }
+  /**
+   * Hardening: resolve a caller-supplied backup path relative to the CLI data
+   * dir and verify it stays inside it. Rejects absolute paths and `..` segments
+   * that would escape, so the HTTP backup/restore routes cannot read or write
+   * arbitrary filesystem locations.
+   */
+  confineToDataDir(candidate) {
+    const dataDir = path6.resolve(this.config.getDataDir());
+    const resolved = path6.resolve(dataDir, candidate);
+    if (resolved !== dataDir && !resolved.startsWith(dataDir + path6.sep)) {
+      throw new Error("Path escapes data directory");
+    }
+    return resolved;
+  }
   async registerRoutes() {
     if (!this.server) {
       throw new Error("Server not initialized");
@@ -868,14 +940,37 @@ var LocalRegistryServer = class {
       await this.reset();
       return { message: "Local registry data reset successfully" };
     });
-    this.server.get("/local/backup", async (request) => {
+    this.server.post("/local/backup", async (request, reply) => {
       const query = request.query;
-      const backupPath = await this.backup(query.output);
+      let output;
+      if (query.output) {
+        try {
+          output = this.confineToDataDir(query.output);
+        } catch {
+          return reply.code(400).send({
+            error: "invalid_path",
+            message: "output escapes data dir"
+          });
+        }
+      }
+      const backupPath = await this.backup(output);
       return { backupPath };
     });
-    this.server.post("/local/restore", async (request) => {
-      const { backupPath } = request.body;
-      await this.restore(backupPath);
+    this.server.post("/local/restore", async (request, reply) => {
+      const { backupPath } = request.body ?? {};
+      if (!backupPath) {
+        return reply.code(400).send({ error: "invalid_path", message: "backupPath is required" });
+      }
+      let resolved;
+      try {
+        resolved = this.confineToDataDir(backupPath);
+      } catch {
+        return reply.code(400).send({
+          error: "invalid_path",
+          message: "backupPath escapes data dir"
+        });
+      }
+      await this.restore(resolved);
       return { message: "Data restored successfully" };
     });
     this.server.post("/local/seed", async () => {
@@ -948,7 +1043,7 @@ var localCommand = new Command("local").description(
   "Manage local registry for development"
 );
 localCommand.addCommand(
-  new Command("start").description("Start local registry server").option("-p, --port <port>", "Port to run the server on", "8082").option("-h, --host <host>", "Host to bind the server to", "0.0.0.0").option(
+  new Command("start").description("Start local registry server").option("-p, --port <port>", "Port to run the server on", "8082").option("-h, --host <host>", "Host to bind the server to", "127.0.0.1").option(
     "--public-host <host>",
     "Public host exposed in manifest artifact URLs",
     "host.docker.internal"
@@ -1315,7 +1410,7 @@ Note:
     try {
       let manifestConfig = {};
       if (options.manifest) {
-        const manifestPath = path5.resolve(options.manifest);
+        const manifestPath = path6.resolve(options.manifest);
         if (!fs7.existsSync(manifestPath)) {
           console.error(`\u274C Manifest file not found: ${options.manifest}`);
           process.exit(1);
@@ -1392,12 +1487,12 @@ Note:
         );
         process.exit(1);
       }
-      const wasmPath = path5.resolve(wasmFile);
+      const wasmPath = path6.resolve(wasmFile);
       if (!fs7.existsSync(wasmPath)) {
         console.error(`\u274C WASM file not found: ${wasmFile}`);
         process.exit(1);
       }
-      console.log(`\u{1F4E6} Creating MPK bundle from: ${path5.basename(wasmPath)}`);
+      console.log(`\u{1F4E6} Creating MPK bundle from: ${path6.basename(wasmPath)}`);
       const wasmContent = fs7.readFileSync(wasmPath);
       const wasmSize = wasmContent.length;
       const wasmHash = crypto2.createHash("sha256").update(wasmContent).digest("hex");
@@ -1407,10 +1502,10 @@ Note:
       const abiPathFromManifest = typeof manifestConfig.abi === "string" ? manifestConfig.abi : null;
       const abiFilePath = abiPathFromOption || abiPathFromManifest;
       if (abiFilePath) {
-        const abiResolvedPath = abiPathFromOption ? path5.resolve(abiFilePath) : options.manifest && abiPathFromManifest ? path5.resolve(
-          path5.dirname(path5.resolve(options.manifest)),
+        const abiResolvedPath = abiPathFromOption ? path6.resolve(abiFilePath) : options.manifest && abiPathFromManifest ? path6.resolve(
+          path6.dirname(path6.resolve(options.manifest)),
           abiFilePath
-        ) : path5.resolve(abiFilePath);
+        ) : path6.resolve(abiFilePath);
         if (!fs7.existsSync(abiResolvedPath)) {
           console.error(`\u274C ABI file not found: ${abiFilePath}`);
           console.error(`   Resolved path: ${abiResolvedPath}`);
@@ -1426,7 +1521,7 @@ Note:
             size: abiContent.length
           };
           console.log(
-            `   Including ABI file: ${path5.basename(abiResolvedPath)}`
+            `   Including ABI file: ${path6.basename(abiResolvedPath)}`
           );
         } catch (error) {
           console.error(
@@ -1450,7 +1545,7 @@ Note:
       const manifestServices = Array.isArray(
         manifestConfig.services
       ) ? manifestConfig.services : [];
-      const manifestDir = options.manifest ? path5.dirname(path5.resolve(options.manifest)) : process.cwd();
+      const manifestDir = options.manifest ? path6.dirname(path6.resolve(options.manifest)) : process.cwd();
       const allServiceSources = [
         ...cliServices.map((src) => ({ src, baseDir: process.cwd() })),
         ...manifestServices.map((src) => ({ src, baseDir: manifestDir }))
@@ -1484,7 +1579,7 @@ Note:
           );
           process.exit(1);
         }
-        const svcWasmPath = path5.resolve(baseDir, src.wasm);
+        const svcWasmPath = path6.resolve(baseDir, src.wasm);
         if (!fs7.existsSync(svcWasmPath)) {
           console.error(
             `\u274C Service "${src.name}" WASM not found: ${src.wasm}`
@@ -1508,7 +1603,7 @@ Note:
           content: svcWasmContent
         });
         if (src.abi) {
-          const svcAbiPath = path5.resolve(baseDir, src.abi);
+          const svcAbiPath = path6.resolve(baseDir, src.abi);
           if (!fs7.existsSync(svcAbiPath)) {
             console.error(
               `\u274C Service "${src.name}" ABI not found: ${src.abi}`
@@ -1542,7 +1637,7 @@ Note:
         }
         serviceArtifacts.push(entry);
         console.log(
-          `   Including service: ${src.name} (${path5.basename(svcWasmPath)})`
+          `   Including service: ${src.name} (${path6.basename(svcWasmPath)})`
         );
       }
       const metadata = {
@@ -1575,29 +1670,29 @@ Note:
         links: Object.keys(links).length > 0 ? links : void 0,
         signature: void 0
       };
-      let outputDir = finalOutput ? path5.resolve(finalOutput) : path5.join(process.cwd(), finalPackage, finalVersion);
+      let outputDir = finalOutput ? path6.resolve(finalOutput) : path6.join(process.cwd(), finalPackage, finalVersion);
       if (!fs7.existsSync(outputDir)) {
         fs7.mkdirSync(outputDir, { recursive: true });
       }
       fs7.writeFileSync(
-        path5.join(outputDir, "manifest.json"),
+        path6.join(outputDir, "manifest.json"),
         JSON.stringify(manifest, null, 2)
       );
-      fs7.writeFileSync(path5.join(outputDir, "app.wasm"), wasmContent);
+      fs7.writeFileSync(path6.join(outputDir, "app.wasm"), wasmContent);
       if (abiContent) {
-        fs7.writeFileSync(path5.join(outputDir, "abi.json"), abiContent);
+        fs7.writeFileSync(path6.join(outputDir, "abi.json"), abiContent);
       }
-      const servicesDir = path5.join(outputDir, "services");
+      const servicesDir = path6.join(outputDir, "services");
       for (const { relPath, content } of serviceFilesToWrite) {
-        const dest = path5.join(outputDir, relPath);
-        const rel = path5.relative(servicesDir, dest);
-        if (rel.startsWith("..") || path5.isAbsolute(rel)) {
+        const dest = path6.join(outputDir, relPath);
+        const rel = path6.relative(servicesDir, dest);
+        if (rel.startsWith("..") || path6.isAbsolute(rel)) {
           console.error(
             `\u274C Refusing to write service file outside services/: ${relPath}`
           );
           process.exit(1);
         }
-        fs7.mkdirSync(path5.dirname(dest), { recursive: true });
+        fs7.mkdirSync(path6.dirname(dest), { recursive: true });
         fs7.writeFileSync(dest, content);
       }
       console.log(`\u2705 Bundle files written to: ${outputDir}`);
@@ -1615,7 +1710,7 @@ Note:
       console.log("");
       console.log("Next steps:");
       console.log(
-        `  1. Sign the manifest:  mero-sign sign ${path5.join(outputDir, "manifest.json")} --key key.json`
+        `  1. Sign the manifest:  mero-sign sign ${path6.join(outputDir, "manifest.json")} --key key.json`
       );
       console.log(
         `  2. Push the bundle:    calimero-registry bundle push ${outputDir} --remote`
@@ -1684,15 +1779,15 @@ Note:
         );
         process.exit(1);
       }
-      const fullPath = path5.resolve(bundleFile);
+      const fullPath = path6.resolve(bundleFile);
       if (!fs7.existsSync(fullPath)) {
         console.error(`\u274C File not found: ${bundleFile}`);
         process.exit(1);
       }
       mpkPath = fullPath;
       if (fs7.statSync(fullPath).isDirectory()) {
-        const manifestInDir = path5.join(fullPath, "manifest.json");
-        const wasmInDir = path5.join(fullPath, "app.wasm");
+        const manifestInDir = path6.join(fullPath, "manifest.json");
+        const wasmInDir = path6.join(fullPath, "app.wasm");
         if (!fs7.existsSync(manifestInDir)) {
           console.error(
             `\u274C manifest.json not found in directory: ${fullPath}`
@@ -1703,7 +1798,7 @@ Note:
           console.error(`\u274C app.wasm not found in directory: ${fullPath}`);
           process.exit(1);
         }
-        tempMpk = path5.join(fullPath, `.temp-push-${Date.now()}.mpk`);
+        tempMpk = path6.join(fullPath, `.temp-push-${Date.now()}.mpk`);
         let dirManifest;
         try {
           dirManifest = JSON.parse(
@@ -1740,7 +1835,7 @@ Note:
           process.exit(1);
         }
         for (const f of archiveFiles) {
-          if (!fs7.existsSync(path5.join(fullPath, f))) {
+          if (!fs7.existsSync(path6.join(fullPath, f))) {
             console.error(
               `\u274C Bundle file referenced by manifest not found: ${f}`
             );
@@ -1756,7 +1851,7 @@ Note:
           `\u{1F4E6} Packed directory into temporary bundle (${archiveFiles.length} files)`
         );
       }
-      console.log(`\u{1F4E6} Processing bundle: ${path5.basename(mpkPath)}`);
+      console.log(`\u{1F4E6} Processing bundle: ${path6.basename(mpkPath)}`);
       const manifest = await extractManifest(mpkPath);
       if (!manifest) {
         console.error("\u274C manifest.json not found in bundle");
@@ -1872,7 +1967,7 @@ Examples:
       };
       if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
       if (options.manifest) {
-        const manifestPath = path5.resolve(options.manifest);
+        const manifestPath = path6.resolve(options.manifest);
         if (!fs7.existsSync(manifestPath)) {
           console.error(`\u274C Manifest file not found: ${options.manifest}`);
           process.exit(1);
@@ -1964,7 +2059,7 @@ Examples:
         if (!manifest.links) manifest.links = {};
         manifest.links.docs = options.docs;
       }
-      const outputPath = path5.resolve(options.output || "manifest.json");
+      const outputPath = path6.resolve(options.output || "manifest.json");
       fs7.writeFileSync(outputPath, JSON.stringify(manifest, null, 2));
       console.log(`\u2705 Wrote modified manifest to: ${outputPath}`);
       console.log("");
@@ -2140,7 +2235,7 @@ async function extractManifest(bundlePath) {
       if (entry.path === "manifest.json") ;
     }
   });
-  const extractDir = path5.join(path5.dirname(bundlePath), `.temp-${Date.now()}`);
+  const extractDir = path6.join(path6.dirname(bundlePath), `.temp-${Date.now()}`);
   if (!fs7.existsSync(extractDir)) {
     fs7.mkdirSync(extractDir);
   }
@@ -2148,9 +2243,9 @@ async function extractManifest(bundlePath) {
     await tar.x({
       file: bundlePath,
       cwd: extractDir,
-      filter: (path6) => path6 === "manifest.json"
+      filter: (path7) => path7 === "manifest.json"
     });
-    const manifestPath = path5.join(extractDir, "manifest.json");
+    const manifestPath = path6.join(extractDir, "manifest.json");
     if (fs7.existsSync(manifestPath)) {
       const content = fs7.readFileSync(manifestPath, "utf8");
       manifestContent = content;