@cerefox/memory 1.19.6 → 1.21.0

package/dist/bin/cerefox.js

@@ -5318,7 +5318,7 @@ var init_cli_core = __esm(() => {
 });
 
 // src/meta.ts
-var PKG_VERSION = "1.19.6";
+var PKG_VERSION = "1.21.0";
 var init_meta = () => {};
 
 // ../../_shared/config/paths.ts
@@ -26567,15 +26567,15 @@ function decideAuth(input) {
   const keys = input.configuredKeys.trim();
   if (!keys)
     return { allow: true, reason: "disabled" };
-  const local = isLoopbackAddress(input.remoteAddress);
-  if (local && !input.requireKeyEverywhere) {
-    return { allow: true, reason: "loopback" };
-  }
   const result = checkAccessToken(input.authorization, {
     tokens: parseAccessTokens(keys)
   });
   if (result.ok)
     return { allow: true, reason: "valid_key" };
+  const local = isLoopbackAddress(input.remoteAddress);
+  if (local && !input.requireKeyEverywhere) {
+    return { allow: true, reason: "loopback" };
+  }
   if (result.reason === "no_token") {
     return {
       allow: false,
@@ -26589,6 +26589,49 @@ function decideAuth(input) {
     message: "The API key presented is not valid for this server."
   };
 }
+function hostnameOf(hostHeader) {
+  const h = hostHeader.trim().toLowerCase();
+  if (h.startsWith("[")) {
+    const end = h.indexOf("]");
+    return end === -1 ? h : h.slice(0, end + 1);
+  }
+  const colon = h.lastIndexOf(":");
+  return colon === -1 ? h : h.slice(0, colon);
+}
+function isIpLiteral(hostname) {
+  return /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname) || /^\[[0-9a-f:.]+\]$/.test(hostname);
+}
+function browserGuard(input) {
+  if ((input.secFetchSite ?? "").trim().toLowerCase() === "cross-site") {
+    return { allow: false, message: "Refused a cross-site request: a page from another site cannot use this server." };
+  }
+  const host = (input.host ?? "").trim().toLowerCase();
+  if (host) {
+    const name = hostnameOf(host);
+    const extra = input.allowedHosts.split(",").map((h) => h.trim().toLowerCase()).filter(Boolean);
+    if (!SAFE_HOST_NAMES.has(name) && !isIpLiteral(name) && !extra.includes("*") && !extra.includes(name)) {
+      return {
+        allow: false,
+        message: `Refused: this server was reached as "${name}". Without an API key it answers only to ` + "an IP address or localhost, so a web page cannot re-point its own name at it. If you " + "use this name on purpose, add it to CEREFOX_ALLOWED_HOSTS, or turn the API key on."
+      };
+    }
+  }
+  const origin = input.origin?.trim();
+  if (origin) {
+    let originHost = null;
+    try {
+      originHost = new URL(origin).host.toLowerCase();
+    } catch {
+      originHost = null;
+    }
+    const sameAsHost = originHost !== null && originHost === host;
+    const fromThisMachine = originHost !== null && LOCAL_HOST_NAMES.has(hostnameOf(originHost));
+    if (!sameAsHost && !fromThisMachine) {
+      return { allow: false, message: `Refused a request from the page at ${origin}: a page from another site cannot use this server.` };
+    }
+  }
+  return { allow: true };
+}
 function restGatewayKeys(env = process.env) {
   const keys = env.CEREFOX_API_KEY ?? "";
   if (!keys.trim() || !(env.CEREFOX_POSTGREST_UPSTREAM ?? "").trim())
@@ -26604,8 +26647,19 @@ function apiAuth(keys = () => process.env.CEREFOX_API_KEY ?? "") {
       configuredKeys: keys(),
       requireKeyEverywhere: (process.env.CEREFOX_API_REQUIRE_KEY ?? "") === "1"
     });
-    if (decision.allow)
+    if (decision.allow) {
+      if (decision.reason !== "valid_key") {
+        const guard = browserGuard({
+          host: c.req.header("Host") ?? null,
+          origin: c.req.header("Origin") ?? null,
+          secFetchSite: c.req.header("Sec-Fetch-Site") ?? null,
+          allowedHosts: process.env.CEREFOX_ALLOWED_HOSTS ?? ""
+        });
+        if (!guard.allow)
+          return c.json({ detail: guard.message }, 403);
+      }
       return next();
+    }
     return c.json({ detail: decision.message }, 401, {
       "WWW-Authenticate": 'Bearer realm="cerefox"'
     });
@@ -26618,7 +26672,7 @@ function remoteAddressOf(c) {
     return;
   }
 }
-var API_KEY_PREFIX = "cfx_lak_", LOOPBACK_ADDRESSES;
+var API_KEY_PREFIX = "cfx_lak_", LOOPBACK_ADDRESSES, LOCAL_HOST_NAMES, SAFE_HOST_NAMES;
 var init_auth = __esm(() => {
   init_conninfo();
   init_ef_auth();
@@ -26627,6 +26681,8 @@ var init_auth = __esm(() => {
     "::1",
     "::ffff:127.0.0.1"
   ]);
+  LOCAL_HOST_NAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+  SAFE_HOST_NAMES = new Set([...LOCAL_HOST_NAMES, "host.docker.internal"]);
 });
 
 // src/web/daemon.ts
@@ -26902,7 +26958,7 @@ var init_update_check = __esm(() => {
 });
 
 // ../../_shared/ef-meta/index.ts
-var EF_VERSION = "1.19.6", CEREFOX_VERSION = "1.19.6", EF_LAST_CHANGED = "1.19.0";
+var EF_VERSION = "1.21.0", CEREFOX_VERSION = "1.21.0", EF_LAST_CHANGED = "1.19.0";
 var init_ef_meta = () => {};
 
 // ../../_shared/embeddings/onnx-embedder.ts
@@ -68423,10 +68479,16 @@ async function applyRpcs(opts) {
   }
 }
 
+// src/cli/util/npx-env.ts
+function nestedNpxEnv(env = process.env) {
+  const { npm_config_package: _leaked, ...rest } = env;
+  return rest;
+}
+
 // src/cli/commands/deploy-server.ts
 function commandSucceeds(cmd, args) {
   try {
-    const r = spawnSync2(cmd, args, { encoding: "utf8", timeout: 15000 });
+    const r = spawnSync2(cmd, args, { encoding: "utf8", timeout: 15000, env: nestedNpxEnv() });
     return r.status === 0;
   } catch {
     return false;
@@ -68633,7 +68695,8 @@ Proceed with deployment to Supabase?`, true);
         encoding: "utf8",
         stdio: ["inherit", "pipe", "pipe"],
         cwd: workdir,
-        timeout: 120000
+        timeout: 120000,
+        env: nestedNpxEnv()
       });
       if (r.stdout)
         process.stdout.write(r.stdout);
@@ -76591,7 +76654,7 @@ function setSecret(setValue, projectRef, dryRun) {
     println(c.dim(`   (dry-run) npx supabase secrets set ${SECRET_NAME}=${shown}` + (projectRef ? ` --project-ref ${projectRef}` : "")));
     return;
   }
-  const r = spawnSync7("npx", args, { encoding: "utf8", stdio: "inherit" });
+  const r = spawnSync7("npx", args, { encoding: "utf8", stdio: "inherit", env: nestedNpxEnv() });
   if (r.status !== 0) {
     throw userError(`Failed to set the ${SECRET_NAME} Function secret.`, "Install the Supabase CLI and link the project (or pass --project-ref <ref>).");
   }