@camstack/server 1.2.578 → 1.2.580

package/dist/agent/agent-config.js

@@ -73,7 +73,7 @@ function ensurePersistedNodeId(configPath, dataDir) {
     const id = envSeed && envSeed.length > 0 ? envSeed : `agent-${crypto.randomBytes(4).toString('hex')}`;
     raw.nodeId = id;
     try {
-        // Owner-only: the same file holds the cluster secret.
+        // Owner-only: the same file holds the agent's private mesh key.
         (0, node_1.writeOwnerOnlyFileSync)(resolvedPath, JSON.stringify(raw, null, 2));
     }
     catch {
@@ -105,26 +105,20 @@ function loadAgentConfig(configPath, dataDirOverride) {
         process.env.CAMSTACK_AGENT_NAME ??
         `${os.hostname()}-${os.arch()}`;
     // Environment variable for the hub connection (optional — agent starts
-    // without). The cluster secret is NOT one of them (D797): it lives only in
-    // agent.json.
+    // without). Pairing material lives only in agent.json.
     const envHubAddress = process.env.CAMSTACK_HUB_ADDRESS || undefined;
     const configFullPath = path.resolve(resolvedDataDir, filePath);
     const nodeId = ensurePersistedNodeId(filePath, resolvedDataDir);
     // Read persisted config — these override env vars
     let fileHubAddress;
     let fileName;
-    let fileSecret;
     let fileMeshTls;
-    let filePendingJoinToken;
     if (fs.existsSync(configFullPath)) {
         try {
             const raw = JSON.parse(fs.readFileSync(configFullPath, 'utf-8'));
             fileHubAddress = typeof raw.hubAddress === 'string' ? raw.hubAddress : undefined;
             fileName = typeof raw.name === 'string' ? raw.name : undefined;
-            fileSecret = typeof raw.secret === 'string' ? raw.secret : undefined;
             fileMeshTls = parseMeshTls(raw.meshTls);
-            filePendingJoinToken =
-                typeof raw.joinToken === 'string' && raw.joinToken.length > 0 ? raw.joinToken : undefined;
         }
         catch {
             /* corrupt config */
@@ -133,7 +127,6 @@ function loadAgentConfig(configPath, dataDirOverride) {
     // Config file wins over env for all user-editable fields
     const effectiveName = fileName ?? envName;
     const effectiveHub = fileHubAddress ?? envHubAddress;
-    const effectiveSecret = fileSecret;
     return {
         nodeId,
         name: effectiveName,
@@ -141,9 +134,7 @@ function loadAgentConfig(configPath, dataDirOverride) {
         dataDir: resolvedDataDir,
         addonsDir: path.resolve(resolvedDataDir, 'addons'),
         logLevel: process.env.CAMSTACK_LOG_LEVEL ?? 'info',
-        secret: effectiveSecret,
         ...(fileMeshTls !== undefined ? { meshTls: fileMeshTls } : {}),
-        ...(filePendingJoinToken !== undefined ? { pendingJoinToken: filePendingJoinToken } : {}),
         configPath: configFullPath,
         statusPort: Number(process.env.CAMSTACK_STATUS_PORT) || 4444,
     };

package/dist/agent/agent-http-auth.js

@@ -3,30 +3,83 @@
  * Agent HTTP auth — pure request-authorization helpers for the agent's
  * port-4444 API (mirrors the hub's /health hardening).
  *
- * The surface was fully unauthenticated on 0.0.0.0 — including
- * `POST /api/agent/config`, which can rewrite `hubAddress` and the
- * cluster secret itself. Model:
- *   - loopback callers (the Electron renderer, in-container probes) are
- *     always allowed — the desktop app keeps working with zero changes,
- *   - remote callers must present `Authorization: Bearer <cluster secret>`
- *     OR a short-lived unlock session token minted after a hub admin
- *     unlock ticket (D821) — the cluster secret stays a mesh / pairing
- *     credential, not a daily paste into the browser,
- *   - an UNPAIRED agent (no secret configured yet) can be set up remotely
- *     through the pairing surface only; everything else stays denied.
+ * Model (D857, which replaced the Bearer cluster secret):
+ *   - loopback callers (the Electron renderer, the agent's own page on its own
+ *     machine, in-container probes) are always allowed — whoever is at the
+ *     machine is the operator;
+ *   - remote callers need a session token, minted by redeeming a hub unlock
+ *     ticket (D821): an ES256 ticket signed by the mesh CA the agent was paired
+ *     with, redeemed through `POST /api/agent/session`;
+ *   - the PAIRING protocol endpoints are reachable by anyone on the network,
+ *     in either state: each is authorized by what it carries (a pairing id the
+ *     agent made up, a proof the mesh CA signed), never by who calls. An
+ *     unpaired agent offers nothing else remotely.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLocalHostHeader = isLocalHostHeader;
+exports.authInputOf = authInputOf;
 exports.hasForwardingHeader = hasForwardingHeader;
 exports.isGenuineLoopback = isGenuineLoopback;
 exports.isLoopbackAddress = isLoopbackAddress;
-exports.bearerMatchesSecret = bearerMatchesSecret;
 exports.readBearerToken = readBearerToken;
 exports.isAuthorizedAgentRequest = isAuthorizedAgentRequest;
-exports.isPairingRequest = isPairingRequest;
+exports.isPairingProtocolRequest = isPairingProtocolRequest;
 exports.isUnlockSessionRequest = isUnlockSessionRequest;
 exports.isUnlockInfoRequest = isUnlockInfoRequest;
-exports.isPairingProtocolRequest = isPairingProtocolRequest;
-const node_crypto_1 = require("node:crypto");
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** `host[:port]` of the agent's own machine: localhost, 127.0.0.1 or [::1]. */
+function isLocalHostHeader(host) {
+    const lower = host.trim().toLowerCase();
+    const name = lower.startsWith('[') ? lower.slice(0, lower.indexOf(']') + 1) : lower.split(':')[0];
+    return name !== undefined && LOCAL_HOSTNAMES.has(name);
+}
+/**
+ * The Host/Origin/Content-Type checks that keep a WEB PAGE from being "this machine". A page on
+ * any site can make the browser call 127.0.0.1:4444 (CORS blocks reading, not sending) or rebind
+ * a hostname to it; what it cannot do is send a local Host, a same-origin Origin or a JSON
+ * content type on a cross-site request (D857).
+ */
+function isBrowserSafeLocal(input) {
+    if (input.host !== undefined && !isLocalHostHeader(input.host))
+        return false;
+    if (input.origin !== undefined) {
+        let originHost;
+        try {
+            originHost = new URL(input.origin).host;
+        }
+        catch {
+            return false;
+        }
+        if (!isLocalHostHeader(originHost))
+            return false;
+        if (input.host !== undefined && originHost.toLowerCase() !== input.host.trim().toLowerCase()) {
+            return false;
+        }
+    }
+    const method = input.method?.toUpperCase();
+    if (method !== undefined && method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {
+        const type = (input.contentType ?? '').split(';')[0]?.trim().toLowerCase();
+        if (type !== 'application/json')
+            return false;
+    }
+    return true;
+}
+/** Build the auth input of a Node/Fastify request. */
+function authInputOf(req) {
+    const one = (name) => {
+        const v = req.headers[name];
+        return typeof v === 'string' ? v : undefined;
+    };
+    return {
+        remoteAddress: req.socket.remoteAddress ?? undefined,
+        forwarded: hasForwardingHeader(req.headers),
+        method: req.method,
+        host: one('host'),
+        origin: one('origin'),
+        contentType: one('content-type'),
+        authorization: one('authorization'),
+    };
+}
 const FORWARDING_HEADERS = [
     'forwarded',
     'x-forwarded-for',
@@ -46,7 +99,7 @@ function hasForwardingHeader(headers) {
  * the same host makes every caller look like 127.0.0.1; the header it adds is what gives it away.
  */
 function isGenuineLoopback(input) {
-    return input.forwarded !== true && isLoopbackAddress(input.remoteAddress);
+    return (input.forwarded !== true && isLoopbackAddress(input.remoteAddress) && isBrowserSafeLocal(input));
 }
 /** IPv4/IPv6 loopback (incl. the IPv4-mapped IPv6 form Node reports). */
 function isLoopbackAddress(addr) {
@@ -61,16 +114,6 @@ function isLoopbackAddress(addr) {
         return false;
     return parts.every((p) => /^\d{1,3}$/.test(p));
 }
-/** Timing-safe `Authorization: Bearer <secret>` compare. Empty secrets never match. */
-function bearerMatchesSecret(authorization, secret) {
-    if (secret.length === 0)
-        return false;
-    if (!authorization?.startsWith('Bearer '))
-        return false;
-    const token = Buffer.from(authorization.slice('Bearer '.length));
-    const expected = Buffer.from(secret);
-    return token.length === expected.length && (0, node_crypto_1.timingSafeEqual)(token, expected);
-}
 /** Extract the bearer token value, or `null`. */
 function readBearerToken(authorization) {
     if (!authorization?.startsWith('Bearer '))
@@ -79,61 +122,15 @@ function readBearerToken(authorization) {
     return token.length > 0 ? token : null;
 }
 /**
- * True when the request may access the protected agent API. `clusterSecret`
- * is the CURRENTLY configured secret (`null`/empty = unpaired agent — no
- * remote credential can be verified, so remote access is denied except for
- * the pairing surface, which the route layer allows via {@link isPairingRequest}).
- * `sessionTokenOk` admits a hub-minted unlock session (D821).
+ * True when the request may access the protected agent API: it comes from this
+ * machine, or it carries a session token minted from a hub unlock ticket.
  */
-function isAuthorizedAgentRequest(input, clusterSecret, sessionTokenOk = () => false) {
+function isAuthorizedAgentRequest(input, sessionTokenOk = () => false) {
     if (isGenuineLoopback(input))
         return true;
-    // A secretless agent (paired by certificate, D857) is still reachable through a hub-unlocked session.
-    const hasSecret = clusterSecret !== null && clusterSecret.length > 0;
-    if (hasSecret && bearerMatchesSecret(input.authorization, clusterSecret))
-        return true;
     const token = readBearerToken(input.authorization);
     return token !== null && sessionTokenOk(token);
 }
-/**
- * The first-boot pairing surface: what a remote browser needs to configure
- * a factory-fresh agent (read status/config, write hub address + secret,
- * trigger the reconnect). Process control and health details are NEVER
- * part of it. Only consulted while the agent has no secret configured.
- */
-function isPairingRequest(method, urlPath, 
-/** Pairing exists: the first-boot surface is read-only, writes need loopback or a hub session (D857). */
-readOnly = false) {
-    const pathOnly = urlPath.split('?')[0] ?? urlPath;
-    if (method === 'GET') {
-        return (pathOnly === '/api/agent/status' ||
-            pathOnly === '/api/agent/config' ||
-            pathOnly === '/api/agent/discovered-nodes' ||
-            pathOnly === '/api/agent/hubs-found');
-    }
-    if (method === 'POST' && !readOnly) {
-        return (pathOnly === '/api/agent/config' ||
-            pathOnly === '/api/agent/restart' ||
-            pathOnly === '/api/agent/hubs-found/refresh');
-    }
-    return false;
-}
-/**
- * Redeem a hub unlock ticket for a session token — reachable remotely without
- * a prior Bearer (the ticket IS the proof). Paired agents only.
- */
-function isUnlockSessionRequest(method, urlPath) {
-    const pathOnly = urlPath.split('?')[0] ?? urlPath;
-    return method === 'POST' && pathOnly === '/api/agent/session';
-}
-/**
- * Public unlock probe: `nodeId` + hub HTTPS origin for Continue-with-hub (D821).
- * No secrets, no metrics — only what the locked unlock screen needs.
- */
-function isUnlockInfoRequest(method, urlPath) {
-    const pathOnly = urlPath.split('?')[0] ?? urlPath;
-    return method === 'GET' && pathOnly === '/api/agent/unlock-info';
-}
 const PAIRING_GET = new Set([
     '/api/agent/pairing/hello',
     '/api/agent/pairing/status',
@@ -149,9 +146,9 @@ const PAIRING_POST = new Set([
     '/api/agent/pairing/complete',
 ]);
 /**
- * The pairing protocol endpoints (D857): reachable from the network without a session, each
- * authorized by what it carries (a pairing id the agent made up, a proof the mesh CA signed).
- * `forget` is NOT among them - leaving a hub is an authenticated action.
+ * The pairing protocol endpoints (D857): the only `/api/` routes reachable from
+ * the network without a session. `forget` is NOT among them — leaving a hub is an
+ * authenticated action (this machine, or a hub-unlocked session).
  */
 function isPairingProtocolRequest(method, urlPath) {
     const pathOnly = urlPath.split('?')[0] ?? urlPath;
@@ -161,3 +158,19 @@ function isPairingProtocolRequest(method, urlPath) {
         return PAIRING_POST.has(pathOnly);
     return false;
 }
+/**
+ * Redeem a hub unlock ticket for a session token — reachable remotely without
+ * a prior session (the ticket IS the proof). Paired agents only.
+ */
+function isUnlockSessionRequest(method, urlPath) {
+    const pathOnly = urlPath.split('?')[0] ?? urlPath;
+    return method === 'POST' && pathOnly === '/api/agent/session';
+}
+/**
+ * Public unlock probe: `nodeId` + hub HTTPS origin for Continue-with-hub (D821).
+ * No secrets, no metrics — only what the locked unlock screen needs.
+ */
+function isUnlockInfoRequest(method, urlPath) {
+    const pathOnly = urlPath.split('?')[0] ?? urlPath;
+    return method === 'GET' && pathOnly === '/api/agent/unlock-info';
+}