@calimero-network/registry-cli 1.22.3 → 1.23.0

package/dist/index.js

@@ -15,7 +15,7 @@ var DEFAULT_REGISTRY_URL = "https://apps.calimero.network";
 function defaultConfig() {
   return { registry: { url: DEFAULT_REGISTRY_URL } };
 }
-var RemoteConfig = class {
+var RemoteConfig = class _RemoteConfig {
   configPath;
   config;
   constructor() {
@@ -57,7 +57,13 @@ var RemoteConfig = class {
         ...this.config.registry.apiKey ? { apiKey: this.config.registry.apiKey } : {}
       }
     };
-    fs7.writeFileSync(this.configPath, JSON.stringify(configToSave, null, 2));
+    fs7.writeFileSync(this.configPath, JSON.stringify(configToSave, null, 2), {
+      mode: 384
+    });
+    try {
+      fs7.chmodSync(this.configPath, 384);
+    } catch {
+    }
   }
   /**
    * Get registry URL with priority:
@@ -72,9 +78,44 @@ var RemoteConfig = class {
    * Set registry URL
    */
   setRegistryUrl(url) {
+    if (_RemoteConfig.isInsecureRemoteUrl(url)) {
+      console.warn(
+        "\u26A0\uFE0F  Registry URL uses http:// on a non-local host. Your API key would be sent in cleartext \u2014 prefer https:// for remote registries."
+      );
+    }
     this.config.registry.url = url;
     this.saveConfig();
   }
+  /**
+   * True when `url` is http:// to a host other than localhost/loopback, i.e. a
+   * Bearer token would traverse the network in cleartext.
+   */
+  static isInsecureRemoteUrl(url) {
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      return false;
+    }
+    if (parsed.protocol !== "http:") return false;
+    const host = parsed.hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1");
+    const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".localhost");
+    return !isLocal;
+  }
+  /**
+   * Throws when an API key would be sent to `url` over plain http:// to a
+   * non-loopback host. Called wherever the effective registry URL (flag, env
+   * var or config file) is about to receive the Bearer key. https:// and
+   * http://localhost / 127.0.0.1 / [::1] are always allowed.
+   */
+  static assertApiKeyTransport(url, apiKey) {
+    if (!apiKey) return;
+    if (_RemoteConfig.isInsecureRemoteUrl(url)) {
+      throw new Error(
+        `Refusing to send the API key to ${url}: plain http:// is only allowed for localhost / 127.0.0.1 / [::1]. Use an https:// registry URL (check --url, CALIMERO_REGISTRY_URL and \`calimero-registry config get registry-url\`).`
+      );
+    }
+  }
   /**
    * Get API key with priority:
    * 1. Environment variable CALIMERO_API_KEY
@@ -749,6 +790,18 @@ var LocalArtifactServer = class {
     };
   }
 };
+function isAllowedOrigin(origin, allowedHosts) {
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return false;
+  }
+  return allowedHosts.has(parsed.hostname.toLowerCase());
+}
 var LocalRegistryServer = class {
   config;
   dataStore;
@@ -794,6 +847,43 @@ var LocalRegistryServer = class {
         });
       }
     });
+    const allowedOriginHosts = /* @__PURE__ */ new Set();
+    for (const name of allowedHosts) {
+      allowedOriginHosts.add(name.replace(/:\d+$/, ""));
+    }
+    this.server.addHook("onRequest", async (request, reply) => {
+      const method = request.method.toUpperCase();
+      if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
+        return;
+      }
+      const origin = request.headers.origin;
+      if (origin !== void 0 && !isAllowedOrigin(origin, allowedOriginHosts)) {
+        return reply.code(403).send({
+          statusCode: 403,
+          error: "Forbidden",
+          message: "Cross-origin request not allowed"
+        });
+      }
+      const fetchSite = request.headers["sec-fetch-site"];
+      if (fetchSite !== void 0 && fetchSite !== "same-origin" && fetchSite !== "none") {
+        return reply.code(403).send({
+          statusCode: 403,
+          error: "Forbidden",
+          message: "Cross-site request not allowed"
+        });
+      }
+      const pathname = request.url.split("?")[0];
+      if (pathname.startsWith("/local/")) {
+        const contentType = String(request.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
+        if (contentType !== "application/json") {
+          return reply.code(415).send({
+            statusCode: 415,
+            error: "Unsupported Media Type",
+            message: "Content-Type must be application/json"
+          });
+        }
+      }
+    });
     await this.registerRoutes();
     await this.server.listen({ port: serverPort, host });
     this.isRunning = true;
@@ -1728,11 +1818,12 @@ Note:
   - Config file values are used unless overridden by flags or environment variables
   - Priority: flag > environment variable > config file > default
 `
-  ).action(async (bundleFile, options) => {
+  ).action(async (bundleFile, options, command) => {
+    const urlFlag = command.optsWithGlobals().url;
     let mpkPath;
     let tempMpk = null;
     try {
-      if (!options.remote && (options.url || options.apiKey)) {
+      if (!options.remote && (urlFlag || options.apiKey)) {
         console.warn(
           "\u26A0\uFE0F  Warning: --url and --api-key are only used with --remote flag"
         );
@@ -1862,8 +1953,9 @@ Note:
         );
       } else if (useRemote) {
         const remoteConfig = new RemoteConfig();
-        const registryUrl = options.url || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
+        const registryUrl = urlFlag || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
         const apiKey = options.apiKey || process.env.CALIMERO_API_KEY || remoteConfig.getApiKey();
+        RemoteConfig.assertApiKeyTransport(registryUrl, apiKey);
         await pushToRemote(mpkPath, manifest, registryUrl, apiKey);
       }
     } catch (error) {
@@ -1922,7 +2014,8 @@ Examples:
   # 3) With custom registry URL:
   $ calimero-registry bundle edit com.calimero.myapp 1.0.0 --remote --url https://apps.calimero.network --manifest signed-manifest.json
 `
-  ).action(async (pkg, version2, options) => {
+  ).action(async (pkg, version2, options, command) => {
+    const urlFlag = command.optsWithGlobals().url;
     try {
       if (!options.remote) {
         console.error(
@@ -1931,8 +2024,9 @@ Examples:
         process.exit(1);
       }
       const remoteConfig = new RemoteConfig();
-      const registryUrl = options.url || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
+      const registryUrl = urlFlag || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
       const apiKey = options.apiKey || process.env.CALIMERO_API_KEY || remoteConfig.getApiKey();
+      RemoteConfig.assertApiKeyTransport(registryUrl, apiKey);
       const baseUrl = registryUrl.replace(/\/$/, "");
       const bundleUrl = `${baseUrl}/api/v2/bundles/${encodeURIComponent(pkg)}/${encodeURIComponent(version2)}`;
       const headers = {
@@ -2399,7 +2493,7 @@ function getGlobalOpts(command) {
     timeout: parseInt(String(opts.timeout ?? DEFAULT_TIMEOUT), 10) || DEFAULT_TIMEOUT
   };
 }
-function getAuthHeaders() {
+function getAuthHeaders(url) {
   const remoteConfig = new RemoteConfig();
   const apiKey = remoteConfig.getApiKey();
   if (!apiKey) {
@@ -2407,6 +2501,7 @@ function getAuthHeaders() {
       "API token required for org write operations.\nGet a token from the Organizations page in the web UI, then run:\n  calimero-registry config set api-key <token>"
     );
   }
+  RemoteConfig.assertApiKeyTransport(url, apiKey);
   return { Authorization: `Bearer ${apiKey}` };
 }
 async function fetchJson(url, options = {}) {
@@ -2434,9 +2529,9 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
     const spinner2 = ora4("Resolving identity...").start();
     let authHeaders;
     try {
-      authHeaders = getAuthHeaders();
+      authHeaders = getAuthHeaders(url);
     } catch (e) {
-      spinner2.fail("API token required");
+      spinner2.fail("Cannot use API token");
       console.error(chalk4.red(e instanceof Error ? e.message : String(e)));
       process.exit(1);
     }
@@ -2511,7 +2606,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       const { url, timeout } = getGlobalOpts(command);
       const spinner2 = ora4("Creating organization...").start();
       try {
-        const authHeaders = getAuthHeaders();
+        const authHeaders = getAuthHeaders(url);
         const pathname = "/api/v2/orgs";
         const body = {
           name: options.name.trim(),
@@ -2572,7 +2667,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       const { url, timeout } = getGlobalOpts(command);
       const spinner2 = ora4("Updating organization...").start();
       try {
-        const authHeaders = getAuthHeaders();
+        const authHeaders = getAuthHeaders(url);
         const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
         const body = {};
         if (options.name !== void 0) body.name = options.name;
@@ -2637,7 +2732,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
       const spinner2 = ora4("Deleting organization...").start();
       try {
-        const authHeaders = getAuthHeaders();
+        const authHeaders = getAuthHeaders(url);
         const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
         const base = url.replace(/\/$/, "");
         const { data, status } = await fetchJson(`${base}${pathname}`, {
@@ -2693,7 +2788,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
         const { url, timeout } = getGlobalOpts(command);
         const spinner2 = ora4("Adding member...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members`;
           const body = {
             email: email.trim(),
@@ -2730,7 +2825,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
         const role = options.role === "admin" ? "admin" : "member";
         const spinner2 = ora4("Updating member role...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(email.trim())}`;
           const body = { role };
           const base = url.replace(/\/$/, "");
@@ -2763,7 +2858,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
         const { url, timeout } = getGlobalOpts(command);
         const spinner2 = ora4("Removing member...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(email.trim())}`;
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {
@@ -2796,7 +2891,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
         const { url, timeout } = getGlobalOpts(command);
         const spinner2 = ora4("Linking package...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/packages`;
           const body = { package: pkg.trim() };
           const base = url.replace(/\/$/, "");
@@ -2829,7 +2924,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
         const { url, timeout } = getGlobalOpts(command);
         const spinner2 = ora4("Unlinking package...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/packages/${encodeURIComponent(pkg.trim())}`;
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {