@circuitwall/jarela 2.2.1 → 2.3.0

package/.next/standalone/.next/server/app/api/v1/security/pin/route.js

@@ -269,202 +269,7 @@ module.exports = require("stream");
 
 /***/ }),
 
-/***/ 28354:
-/***/ ((module) => {
-
-module.exports = require("util");
-
-/***/ }),
-
-/***/ 29021:
-/***/ ((module) => {
-
-module.exports = require("fs");
-
-/***/ }),
-
-/***/ 29294:
-/***/ ((module) => {
-
-module.exports = require("next/dist/server/app-render/work-async-storage.external.js");
-
-/***/ }),
-
-/***/ 31421:
-/***/ ((module) => {
-
-module.exports = require("node:child_process");
-
-/***/ }),
-
-/***/ 33873:
-/***/ ((module) => {
-
-module.exports = require("path");
-
-/***/ }),
-
-/***/ 34909:
-/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   XH: () => (/* binding */ isLoopbackRequest)
-/* harmony export */ });
-/* unused harmony exports requireAccess, validateRequestOrigin */
-/* harmony import */ var _lib_stores_access__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(88725);
-
-// Loopback host header signal — only meaningful when the server is bound to
-// 127.0.0.1 (the default). When a reverse proxy fronts Jarela, the proxy is
-// expected to preserve the client's original Host header, so this still
-// distinguishes "local user typed localhost" from "tailnet client".
-const LOOPBACK_HOST = /^(localhost|127\.0\.0\.1|\[::1\])(:|$)/;
-const LOOPBACK_IP = /^(127\.|::1$|::ffff:127\.)/;
-function readHeader(headers, name) {
-    if (typeof headers.get === "function") {
-        return headers.get(name);
-    }
-    const lookup = name.toLowerCase();
-    const v = headers[lookup] ?? headers[name];
-    if (Array.isArray(v)) return v[0] ?? null;
-    return v ?? null;
-}
-function requireAccess({ headers, host, remoteAddress }) {
-    // If tailscaled is proxying this request through `tailscale serve` it
-    // *always* injects the Tailscale-User-Login header. Whenever the header
-    // is present, treat the request as a tailnet request and enforce the
-    // whitelist, regardless of whether the source IP / Host header looks
-    // like loopback. Otherwise a non-whitelisted tailnet user could chat
-    // just because the proxy is local.
-    const identity = readHeader(headers, "tailscale-user-login")?.trim() || null;
-    if (identity) {
-        if (isWhitelisted(identity)) {
-            touchLastSeen(identity);
-            return {
-                allowed: true,
-                identity,
-                reason: "whitelisted"
-            };
-        }
-        return {
-            allowed: false,
-            identity,
-            reason: "not-whitelisted"
-        };
-    }
-    // No tailscale identity → only loopback is allowed (the host machine's
-    // own user typing http://localhost:4312).
-    // 1. Actual TCP source available — most reliable loopback signal. Used
-    //    by callers that have the raw socket (e.g. raw Node handlers).
-    if (remoteAddress && LOOPBACK_IP.test(remoteAddress)) {
-        return {
-            allowed: true,
-            identity: null,
-            reason: "loopback"
-        };
-    }
-    // 2. HTTP middleware path: socket source not available, fall back to Host
-    //    header. Only trustworthy when the bind is 127.0.0.1 (default).
-    if (!remoteAddress && host && LOOPBACK_HOST.test(host)) {
-        return {
-            allowed: true,
-            identity: null,
-            reason: "loopback"
-        };
-    }
-    return {
-        allowed: false,
-        identity: null,
-        reason: "no-identity"
-    };
-}
-// Convenience wrapper for API route handlers — they only have `Request`.
-function isLoopbackRequest(req) {
-    const host = req.headers.get("host");
-    return !!host && LOOPBACK_HOST.test(host);
-}
-// ---------------------------------------------------------------------------
-// CSRF / cross-origin / DNS-rebinding defense
-// ---------------------------------------------------------------------------
-//
-// The proxy auth above accepts any loopback request — but every page in the
-// user's browser can issue `fetch("http://127.0.0.1:4312/...")`, and a
-// remote DNS-rebinding attacker can make `evil.com` resolve to `127.0.0.1`
-// so the request looks loopback to the kernel. We need to confirm the
-// request *originated* same-origin, not just that the socket terminated on
-// loopback.
-//
-// Defense in depth:
-//   1. `Sec-Fetch-Site` — sent by every modern browser. `same-origin` and
-//      `none` (top-level nav, address-bar) are safe; `cross-site` and
-//      `same-site` are not. Header absent = non-browser caller (curl,
-//      installer scripts) — allow, since those can't be tricked into
-//      attaching cookies/auth.
-//   2. `Origin` — when present, scheme+host+port must match `Host`. Blocks
-//      DNS rebinding because the Origin reflects the URL the attacker's
-//      page was loaded from (`https://evil.com`), not the resolved IP.
-//
-// Read-only methods (GET / HEAD / OPTIONS) skip the check: the legitimate
-// SSE attach uses GET and is intentionally cross-tab in some PWA flows,
-// and these methods shouldn't have side effects anyway.
-const SAFE_METHODS = new Set([
-    "GET",
-    "HEAD",
-    "OPTIONS"
-]);
-const SAFE_FETCH_SITES = new Set([
-    "same-origin",
-    "none"
-]);
-function validateRequestOrigin({ method, headers, host }) {
-    if (SAFE_METHODS.has(method.toUpperCase())) {
-        return {
-            allowed: true,
-            reason: "safe-method"
-        };
-    }
-    const secFetchSite = readHeader(headers, "sec-fetch-site");
-    const origin = readHeader(headers, "origin");
-    // Neither header → non-browser caller. The loopback bind plus the
-    // tailnet identity check already gate this.
-    if (!secFetchSite && !origin) {
-        return {
-            allowed: true,
-            reason: "no-headers"
-        };
-    }
-    if (secFetchSite && !SAFE_FETCH_SITES.has(secFetchSite)) {
-        return {
-            allowed: false,
-            reason: "cross-site"
-        };
-    }
-    if (origin && host) {
-        try {
-            const originHost = new URL(origin).host;
-            if (originHost !== host) {
-                return {
-                    allowed: false,
-                    reason: "origin-mismatch"
-                };
-            }
-        } catch  {
-            // Malformed Origin → reject.
-            return {
-                allowed: false,
-                reason: "origin-mismatch"
-            };
-        }
-    }
-    return {
-        allowed: true,
-        reason: "same-origin"
-    };
-}
-
-
-/***/ }),
-
-/***/ 35793:
+/***/ 28331:
 /***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
 
 __webpack_require__.r(__webpack_exports__);
@@ -906,6 +711,201 @@ async function handler(req, res, ctx) {
 //# sourceMappingURL=app-route.js.map
 
 
+/***/ }),
+
+/***/ 28354:
+/***/ ((module) => {
+
+module.exports = require("util");
+
+/***/ }),
+
+/***/ 29021:
+/***/ ((module) => {
+
+module.exports = require("fs");
+
+/***/ }),
+
+/***/ 29294:
+/***/ ((module) => {
+
+module.exports = require("next/dist/server/app-render/work-async-storage.external.js");
+
+/***/ }),
+
+/***/ 31421:
+/***/ ((module) => {
+
+module.exports = require("node:child_process");
+
+/***/ }),
+
+/***/ 33873:
+/***/ ((module) => {
+
+module.exports = require("path");
+
+/***/ }),
+
+/***/ 34909:
+/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   XH: () => (/* binding */ isLoopbackRequest)
+/* harmony export */ });
+/* unused harmony exports requireAccess, validateRequestOrigin */
+/* harmony import */ var _lib_stores_access__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(88725);
+
+// Loopback host header signal — only meaningful when the server is bound to
+// 127.0.0.1 (the default). When a reverse proxy fronts Jarela, the proxy is
+// expected to preserve the client's original Host header, so this still
+// distinguishes "local user typed localhost" from "tailnet client".
+const LOOPBACK_HOST = /^(localhost|127\.0\.0\.1|\[::1\])(:|$)/;
+const LOOPBACK_IP = /^(127\.|::1$|::ffff:127\.)/;
+function readHeader(headers, name) {
+    if (typeof headers.get === "function") {
+        return headers.get(name);
+    }
+    const lookup = name.toLowerCase();
+    const v = headers[lookup] ?? headers[name];
+    if (Array.isArray(v)) return v[0] ?? null;
+    return v ?? null;
+}
+function requireAccess({ headers, host, remoteAddress }) {
+    // If tailscaled is proxying this request through `tailscale serve` it
+    // *always* injects the Tailscale-User-Login header. Whenever the header
+    // is present, treat the request as a tailnet request and enforce the
+    // whitelist, regardless of whether the source IP / Host header looks
+    // like loopback. Otherwise a non-whitelisted tailnet user could chat
+    // just because the proxy is local.
+    const identity = readHeader(headers, "tailscale-user-login")?.trim() || null;
+    if (identity) {
+        if (isWhitelisted(identity)) {
+            touchLastSeen(identity);
+            return {
+                allowed: true,
+                identity,
+                reason: "whitelisted"
+            };
+        }
+        return {
+            allowed: false,
+            identity,
+            reason: "not-whitelisted"
+        };
+    }
+    // No tailscale identity → only loopback is allowed (the host machine's
+    // own user typing http://localhost:4312).
+    // 1. Actual TCP source available — most reliable loopback signal. Used
+    //    by callers that have the raw socket (e.g. raw Node handlers).
+    if (remoteAddress && LOOPBACK_IP.test(remoteAddress)) {
+        return {
+            allowed: true,
+            identity: null,
+            reason: "loopback"
+        };
+    }
+    // 2. HTTP middleware path: socket source not available, fall back to Host
+    //    header. Only trustworthy when the bind is 127.0.0.1 (default).
+    if (!remoteAddress && host && LOOPBACK_HOST.test(host)) {
+        return {
+            allowed: true,
+            identity: null,
+            reason: "loopback"
+        };
+    }
+    return {
+        allowed: false,
+        identity: null,
+        reason: "no-identity"
+    };
+}
+// Convenience wrapper for API route handlers — they only have `Request`.
+function isLoopbackRequest(req) {
+    const host = req.headers.get("host");
+    return !!host && LOOPBACK_HOST.test(host);
+}
+// ---------------------------------------------------------------------------
+// CSRF / cross-origin / DNS-rebinding defense
+// ---------------------------------------------------------------------------
+//
+// The proxy auth above accepts any loopback request — but every page in the
+// user's browser can issue `fetch("http://127.0.0.1:4312/...")`, and a
+// remote DNS-rebinding attacker can make `evil.com` resolve to `127.0.0.1`
+// so the request looks loopback to the kernel. We need to confirm the
+// request *originated* same-origin, not just that the socket terminated on
+// loopback.
+//
+// Defense in depth:
+//   1. `Sec-Fetch-Site` — sent by every modern browser. `same-origin` and
+//      `none` (top-level nav, address-bar) are safe; `cross-site` and
+//      `same-site` are not. Header absent = non-browser caller (curl,
+//      installer scripts) — allow, since those can't be tricked into
+//      attaching cookies/auth.
+//   2. `Origin` — when present, scheme+host+port must match `Host`. Blocks
+//      DNS rebinding because the Origin reflects the URL the attacker's
+//      page was loaded from (`https://evil.com`), not the resolved IP.
+//
+// Read-only methods (GET / HEAD / OPTIONS) skip the check: the legitimate
+// SSE attach uses GET and is intentionally cross-tab in some PWA flows,
+// and these methods shouldn't have side effects anyway.
+const SAFE_METHODS = new Set([
+    "GET",
+    "HEAD",
+    "OPTIONS"
+]);
+const SAFE_FETCH_SITES = new Set([
+    "same-origin",
+    "none"
+]);
+function validateRequestOrigin({ method, headers, host }) {
+    if (SAFE_METHODS.has(method.toUpperCase())) {
+        return {
+            allowed: true,
+            reason: "safe-method"
+        };
+    }
+    const secFetchSite = readHeader(headers, "sec-fetch-site");
+    const origin = readHeader(headers, "origin");
+    // Neither header → non-browser caller. The loopback bind plus the
+    // tailnet identity check already gate this.
+    if (!secFetchSite && !origin) {
+        return {
+            allowed: true,
+            reason: "no-headers"
+        };
+    }
+    if (secFetchSite && !SAFE_FETCH_SITES.has(secFetchSite)) {
+        return {
+            allowed: false,
+            reason: "cross-site"
+        };
+    }
+    if (origin && host) {
+        try {
+            const originHost = new URL(origin).host;
+            if (originHost !== host) {
+                return {
+                    allowed: false,
+                    reason: "origin-mismatch"
+                };
+            }
+        } catch  {
+            // Malformed Origin → reject.
+            return {
+                allowed: false,
+                reason: "origin-mismatch"
+            };
+        }
+    }
+    return {
+        allowed: true,
+        reason: "same-origin"
+    };
+}
+
+
 /***/ }),
 
 /***/ 37067:
@@ -1172,7 +1172,7 @@ module.exports = import("@huggingface/transformers");;
 var __webpack_require__ = require("../../../../../webpack-runtime.js");
 __webpack_require__.C(exports);
 var __webpack_exec__ = (moduleId) => (__webpack_require__(__webpack_require__.s = moduleId))
-var __webpack_exports__ = __webpack_require__.X(0, [2970,7377,1813,7981,4992,46], () => (__webpack_exec__(35793)));
+var __webpack_exports__ = __webpack_require__.X(0, [2970,7377,1813,7981,4992,46], () => (__webpack_exec__(28331)));
 module.exports = __webpack_exports__;
 
 })();

package/.next/standalone/.next/server/app/api/v1/security/state/route.js

@@ -302,56 +302,7 @@ module.exports = require("node:fs/promises");
 
 /***/ }),
 
-/***/ 55511:
-/***/ ((module) => {
-
-module.exports = require("crypto");
-
-/***/ }),
-
-/***/ 55591:
-/***/ ((module) => {
-
-module.exports = require("https");
-
-/***/ }),
-
-/***/ 57075:
-/***/ ((module) => {
-
-module.exports = require("node:stream");
-
-/***/ }),
-
-/***/ 57975:
-/***/ ((module) => {
-
-module.exports = require("node:util");
-
-/***/ }),
-
-/***/ 63033:
-/***/ ((module) => {
-
-module.exports = require("next/dist/server/app-render/work-unit-async-storage.external.js");
-
-/***/ }),
-
-/***/ 73024:
-/***/ ((module) => {
-
-module.exports = require("node:fs");
-
-/***/ }),
-
-/***/ 75919:
-/***/ ((module) => {
-
-module.exports = require("node:worker_threads");
-
-/***/ }),
-
-/***/ 76697:
+/***/ 53059:
 /***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
 
 __webpack_require__.r(__webpack_exports__);
@@ -793,6 +744,55 @@ async function handler(req, res, ctx) {
 //# sourceMappingURL=app-route.js.map
 
 
+/***/ }),
+
+/***/ 55511:
+/***/ ((module) => {
+
+module.exports = require("crypto");
+
+/***/ }),
+
+/***/ 55591:
+/***/ ((module) => {
+
+module.exports = require("https");
+
+/***/ }),
+
+/***/ 57075:
+/***/ ((module) => {
+
+module.exports = require("node:stream");
+
+/***/ }),
+
+/***/ 57975:
+/***/ ((module) => {
+
+module.exports = require("node:util");
+
+/***/ }),
+
+/***/ 63033:
+/***/ ((module) => {
+
+module.exports = require("next/dist/server/app-render/work-unit-async-storage.external.js");
+
+/***/ }),
+
+/***/ 73024:
+/***/ ((module) => {
+
+module.exports = require("node:fs");
+
+/***/ }),
+
+/***/ 75919:
+/***/ ((module) => {
+
+module.exports = require("node:worker_threads");
+
 /***/ }),
 
 /***/ 76760:
@@ -865,7 +865,7 @@ module.exports = import("@huggingface/transformers");;
 var __webpack_require__ = require("../../../../../webpack-runtime.js");
 __webpack_require__.C(exports);
 var __webpack_exec__ = (moduleId) => (__webpack_require__(__webpack_require__.s = moduleId))
-var __webpack_exports__ = __webpack_require__.X(0, [2970,7377,1813,7981,4992,46], () => (__webpack_exec__(76697)));
+var __webpack_exports__ = __webpack_require__.X(0, [2970,7377,1813,7981,4992,46], () => (__webpack_exec__(53059)));
 module.exports = __webpack_exports__;
 
 })();