@fased/fased 0.1.62 → 0.1.64

package/dist/gateway/a2a-task-store.js

@@ -0,0 +1,524 @@
+import { resolveStateDir } from "../config/paths.js";
+import { resolveProcessScopedMap } from "../shared/process-scoped-map.js";
+import { acquireFileLock, withFileLock } from "../plugin-sdk/file-lock.js";
+import "../infra/file-lock.js";
+import { serializeWalletState, writeWalletStateFileAtomically } from "../wallet/wallet-atomic-state.js";
+import { emitDurableCapacityWarning } from "./durable-capacity.js";
+import syncFs from "node:fs";
+import path from "node:path";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+
+//#region src/gateway/a2a-task-store.ts
+const TASK_STATUSES = new Set([
+	"queued",
+	"running",
+	"succeeded",
+	"failed",
+	"canceled"
+]);
+const LOCK_OPTIONS = {
+	retries: {
+		retries: 100,
+		factor: 1.15,
+		minTimeout: 10,
+		maxTimeout: 200,
+		randomize: true
+	},
+	stale: 3e4
+};
+const EXECUTION_LOCK_OPTIONS = {
+	retries: {
+		retries: 1,
+		factor: 1,
+		minTimeout: 10,
+		maxTimeout: 10,
+		randomize: false
+	},
+	stale: 3e4
+};
+const ACTIVE_EXECUTIONS = resolveProcessScopedMap(Symbol.for("fased.gateway.a2aTask.activeExecutions"));
+const MAX_TASKS_PER_SENDER_PER_HOUR = 60;
+const MAX_ACTIVE_TASKS_PER_SENDER = 8;
+const MAX_RETAINED_TASKS = 5e3;
+const MAX_TASK_FILES_ON_DISK = 1e4;
+const MAX_PAYMENT_CHALLENGE_FILES = 1e4;
+const MAX_PAYMENT_CLAIM_FILES = 1e5;
+const TERMINAL_TASK_RETENTION_MS = 7 * 24 * 60 * 6e4;
+const PAYMENT_CHALLENGE_TTL_MS = 10 * 6e4;
+function canonicalJson(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") {
+		return JSON.stringify(value);
+	}
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) {
+			throw new Error("A2A task intent contains a non-finite number");
+		}
+		return JSON.stringify(value);
+	}
+	if (Array.isArray(value)) {
+		return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
+	}
+	if (value && typeof value === "object") {
+		const record = value;
+		return `{${Object.keys(record).filter((key) => record[key] !== undefined).toSorted().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+	}
+	throw new Error("A2A task intent contains an unsupported value");
+}
+function taskDigest(taskId) {
+	return createHash("sha256").update(taskId).digest("hex");
+}
+function taskDirectory(env) {
+	return path.join(resolveStateDir(env), "federation", "a2a-tasks");
+}
+function taskPath(taskId, env) {
+	return path.join(taskDirectory(env), `${taskDigest(taskId)}.json`);
+}
+function senderQuotaLockPath(senderHandle, env) {
+	const digest = createHash("sha256").update(senderHandle, "utf8").digest("hex");
+	return path.join(taskDirectory(env), ".sender-quotas", digest);
+}
+function taskCapacityLockPath(env) {
+	return path.join(taskDirectory(env), ".capacity");
+}
+function executionLockTarget(taskId, env) {
+	return path.join(taskDirectory(env), ".executions", taskDigest(taskId));
+}
+function paymentClaimPath(txRef, env) {
+	const digest = createHash("sha256").update(txRef, "utf8").digest("hex");
+	return path.join(taskDirectory(env), ".payment-claims", `${digest}.json`);
+}
+function paymentChallengeDirectory(env) {
+	return path.join(taskDirectory(env), ".payment-challenges");
+}
+function paymentChallengePath(taskId, env) {
+	return path.join(paymentChallengeDirectory(env), `${taskDigest(taskId)}.json`);
+}
+function paymentChallengeClaimLockPath(env) {
+	return path.join(paymentChallengeDirectory(env), ".claims");
+}
+function paymentClaimDirectory(env) {
+	return path.join(taskDirectory(env), ".payment-claims");
+}
+function paymentReferenceClaimLockPath(env) {
+	return path.join(paymentClaimDirectory(env), ".claims");
+}
+function listJsonLedgerFiles(directory) {
+	if (!syncFs.existsSync(directory)) {
+		return [];
+	}
+	return syncFs.readdirSync(directory).filter((name) => /^[a-f0-9]{64}\.json$/u.test(name));
+}
+function requireJsonLedgerCapacity(directory, maximum, label) {
+	const used = listJsonLedgerFiles(directory).length;
+	emitDurableCapacityWarning(label, used, maximum);
+	if (used >= maximum) {
+		throw new Error(`${label} reached its safe on-disk record limit`);
+	}
+}
+function pruneExpiredPaymentChallenges(env, nowMs) {
+	const directory = paymentChallengeDirectory(env);
+	for (const name of listJsonLedgerFiles(directory)) {
+		const filePath = path.join(directory, name);
+		try {
+			const raw = JSON.parse(syncFs.readFileSync(filePath, "utf8"));
+			if (!isRecord(raw) || typeof raw.taskId !== "string") {
+				continue;
+			}
+			const challenge = validatePaymentChallenge(raw, raw.taskId);
+			const expiredUnclaimed = challenge.status === "issued" && Date.parse(challenge.expiresAt) < nowMs;
+			const claimedAt = challenge.claimedAt ? Date.parse(challenge.claimedAt) : Number.NaN;
+			const orphanedClaim = challenge.status === "claimed" && !syncFs.existsSync(taskPath(challenge.taskId, env)) && Number.isFinite(claimedAt) && nowMs - claimedAt > TERMINAL_TASK_RETENTION_MS;
+			if (expiredUnclaimed || orphanedClaim) {
+				syncFs.unlinkSync(filePath);
+			}
+		} catch {}
+	}
+}
+function a2aTaskIntentDigest(intent) {
+	return `sha256:${createHash("sha256").update(canonicalJson(intent)).digest("hex")}`;
+}
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isValidPaymentRecovery(value) {
+	if (!isRecord(value)) {
+		return false;
+	}
+	return (value.status === "refund-required" || value.status === "refunded" || value.status === "disputed") && typeof value.paymentTxRef === "string" && value.paymentTxRef.length > 0 && typeof value.reason === "string" && value.reason.length > 0 && typeof value.updatedAt === "string" && (value.refundTxRef === undefined || typeof value.refundTxRef === "string" && value.refundTxRef.length > 0) && (value.approvalRequestId === undefined || typeof value.approvalRequestId === "string" && value.approvalRequestId.length > 0);
+}
+function validatePaymentChallenge(value, expectedTaskId) {
+	if (!isRecord(value) || value.version !== 1 || value.taskId !== expectedTaskId || typeof value.challengeId !== "string" || !/^[0-9a-f]{64}$/u.test(value.challengeId) || typeof value.senderHandle !== "string" || !value.senderHandle.trim() || typeof value.offerId !== "string" || !value.offerId.trim() || typeof value.invoiceId !== "string" || !value.invoiceId.trim() || typeof value.receiptId !== "string" || !value.receiptId.trim() || typeof value.payerAddress !== "string" || !value.payerAddress.trim() || typeof value.payeeAddress !== "string" || !value.payeeAddress.trim() || typeof value.amount !== "number" || !Number.isSafeInteger(value.amount) || value.amount <= 0 || typeof value.currency !== "string" || !value.currency.trim() || !isRecord(value.asset) || value.asset.kind !== "native" && value.asset.kind !== "spl-token" || value.asset.address !== undefined && typeof value.asset.address !== "string" || typeof value.paymentMemo !== "string" || !/^fased:a2a-payment:v1:[0-9a-f]{64}$/u.test(value.paymentMemo) || value.status !== "issued" && value.status !== "claimed" || typeof value.issuedAt !== "string" || !Number.isFinite(Date.parse(value.issuedAt)) || typeof value.expiresAt !== "string" || !Number.isFinite(Date.parse(value.expiresAt)) || value.txRefDigest !== undefined && (typeof value.txRefDigest !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(value.txRefDigest)) || value.claimedAt !== undefined && (typeof value.claimedAt !== "string" || !Number.isFinite(Date.parse(value.claimedAt)))) {
+		throw new Error("durable A2A payment challenge contains an invalid record");
+	}
+	return value;
+}
+function validateRecord(value, expectedTaskId) {
+	if (!isRecord(value) || value.version !== 2 || value.taskId !== expectedTaskId || typeof value.intentDigest !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(value.intentDigest) || typeof value.accessTokenHash !== "string" || !/^[0-9a-f]{64}$/u.test(value.accessTokenHash) || typeof value.senderHandle !== "string" || typeof value.status !== "string" || !TASK_STATUSES.has(value.status) || typeof value.createdAt !== "string" || typeof value.updatedAt !== "string" || value.error !== undefined && typeof value.error !== "string" || value.paymentRecovery !== undefined && !isValidPaymentRecovery(value.paymentRecovery)) {
+		throw new Error("durable A2A task contains an invalid record");
+	}
+	return value;
+}
+function hashAccessToken(value) {
+	return createHash("sha256").update(`fased:a2a-task-access:v1:${value}`, "utf8").digest("hex");
+}
+function tokensMatch(expectedHash, token) {
+	const actual = Buffer.from(hashAccessToken(token), "hex");
+	const expected = Buffer.from(expectedHash, "hex");
+	return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function normalizeNewAccessToken(value) {
+	const token = value?.trim() ?? "";
+	if (!token) {
+		return null;
+	}
+	if (token.length < 43 || token.length > 256 || !/^[A-Za-z0-9_-]+$/u.test(token)) {
+		throw new Error("caller-provided A2A task access token must be a strong base64url secret");
+	}
+	return token;
+}
+function listDurableRecords(env) {
+	const dir = taskDirectory(env);
+	if (!syncFs.existsSync(dir)) {
+		return [];
+	}
+	const records = [];
+	const taskFiles = syncFs.readdirSync(dir).filter((name) => /^[a-f0-9]{64}\.json$/u.test(name));
+	if (taskFiles.length > MAX_TASK_FILES_ON_DISK) {
+		throw new Error("A2A task store exceeds its safe on-disk record limit");
+	}
+	for (const name of taskFiles) {
+		try {
+			const raw = JSON.parse(syncFs.readFileSync(path.join(dir, name), "utf8"));
+			if (raw && typeof raw === "object" && typeof raw.taskId === "string") {
+				records.push(validateRecord(raw, raw.taskId));
+			}
+		} catch {}
+	}
+	return records;
+}
+function enforceSenderQuota(params) {
+	const now = Date.now();
+	const senderRecords = listDurableRecords(params.env).filter((record) => record.senderHandle === params.senderHandle);
+	const recent = senderRecords.filter((record) => now - Date.parse(record.createdAt) < 60 * 6e4);
+	if (recent.length >= MAX_TASKS_PER_SENDER_PER_HOUR) {
+		throw new Error("A2A sender hourly task quota exceeded");
+	}
+	const active = senderRecords.filter((record) => record.status === "queued" || record.status === "running");
+	if (active.length >= MAX_ACTIVE_TASKS_PER_SENDER) {
+		throw new Error("A2A sender active task quota exceeded");
+	}
+}
+function pruneDurableTasks(env) {
+	const now = Date.now();
+	const terminal = listDurableRecords(env).filter((record) => (record.status === "succeeded" || record.status === "failed" || record.status === "canceled") && record.paymentRecovery?.status !== "refund-required").toSorted((left, right) => Date.parse(left.updatedAt) - Date.parse(right.updatedAt));
+	const remove = terminal.filter((record, index) => now - Date.parse(record.updatedAt) > TERMINAL_TASK_RETENTION_MS || terminal.length - index > MAX_RETAINED_TASKS);
+	for (const record of remove) {
+		try {
+			syncFs.unlinkSync(taskPath(record.taskId, env));
+		} catch {}
+	}
+}
+function readDurableA2aPaymentChallenge(params) {
+	const env = params.env ?? process.env;
+	const taskId = params.taskId.trim();
+	if (!taskId) {
+		return null;
+	}
+	const filePath = paymentChallengePath(taskId, env);
+	if (!syncFs.existsSync(filePath)) {
+		return null;
+	}
+	try {
+		return validatePaymentChallenge(JSON.parse(syncFs.readFileSync(filePath, "utf8")), taskId);
+	} catch (error) {
+		throw new Error("durable A2A payment challenge is unreadable", { cause: error });
+	}
+}
+async function issueDurableA2aPaymentChallenge(params) {
+	const env = params.env ?? process.env;
+	const taskId = params.taskId.trim();
+	const senderHandle = params.senderHandle.trim().toLowerCase();
+	if (!taskId || taskId.length > 240 || !senderHandle || !params.offerId.trim()) {
+		throw new Error("A2A payment challenge identity is invalid");
+	}
+	if (!Number.isSafeInteger(params.amount) || params.amount <= 0) {
+		throw new Error("A2A payment challenge amount is invalid");
+	}
+	const filePath = paymentChallengePath(taskId, env);
+	syncFs.mkdirSync(path.dirname(filePath), {
+		recursive: true,
+		mode: 448
+	});
+	return await withFileLock(paymentChallengeClaimLockPath(env), LOCK_OPTIONS, async () => {
+		return await withFileLock(filePath, LOCK_OPTIONS, async () => {
+			const existing = readDurableA2aPaymentChallenge({
+				taskId,
+				env
+			});
+			const nowMs = params.nowMs ?? Date.now();
+			if (existing && Date.parse(existing.expiresAt) >= nowMs) {
+				if (existing.senderHandle !== senderHandle || existing.offerId !== params.offerId.trim() || existing.payerAddress !== params.payerAddress.trim() || existing.payeeAddress !== params.payeeAddress.trim() || existing.amount !== params.amount || existing.currency !== params.currency.trim().toUpperCase() || canonicalJson(existing.asset) !== canonicalJson(params.asset)) {
+					throw new Error("A2A taskId is already bound to different payment terms");
+				}
+				return existing;
+			}
+			if (existing?.status === "claimed") {
+				throw new Error("claimed A2A payment challenge cannot be replaced");
+			}
+			pruneExpiredPaymentChallenges(env, nowMs);
+			if (!existing) {
+				requireJsonLedgerCapacity(paymentChallengeDirectory(env), MAX_PAYMENT_CHALLENGE_FILES, "A2A payment challenge store");
+			}
+			const challengeId = randomBytes(32).toString("hex");
+			const issuedAt = new Date(nowMs).toISOString();
+			const record = {
+				version: 1,
+				challengeId,
+				taskId,
+				senderHandle,
+				offerId: params.offerId.trim(),
+				invoiceId: `invoice-${challengeId.slice(0, 32)}`,
+				receiptId: `receipt-${challengeId.slice(32)}`,
+				payerAddress: params.payerAddress.trim(),
+				payeeAddress: params.payeeAddress.trim(),
+				amount: params.amount,
+				currency: params.currency.trim().toUpperCase(),
+				asset: params.asset,
+				paymentMemo: `fased:a2a-payment:v1:${challengeId}`,
+				status: "issued",
+				issuedAt,
+				expiresAt: new Date(nowMs + PAYMENT_CHALLENGE_TTL_MS).toISOString()
+			};
+			writeWalletStateFileAtomically(filePath, serializeWalletState(record));
+			return record;
+		});
+	});
+}
+async function claimDurableA2aPaymentChallenge(params) {
+	const env = params.env ?? process.env;
+	const taskId = params.taskId.trim();
+	const txRefDigest = `sha256:${createHash("sha256").update(params.txRef.trim(), "utf8").digest("hex")}`;
+	return await withFileLock(paymentChallengeClaimLockPath(env), LOCK_OPTIONS, async () => {
+		const challenge = readDurableA2aPaymentChallenge({
+			taskId,
+			env
+		});
+		if (!challenge || challenge.challengeId !== params.challengeId.trim() || challenge.senderHandle !== params.senderHandle.trim().toLowerCase() || challenge.payerAddress !== params.payerAddress.trim()) {
+			throw new Error("A2A payment challenge identity does not match the verified settlement");
+		}
+		const challengeFiles = syncFs.existsSync(paymentChallengeDirectory(env)) ? syncFs.readdirSync(paymentChallengeDirectory(env)).filter((name) => /^[a-f0-9]{64}\.json$/u.test(name)) : [];
+		for (const name of challengeFiles) {
+			const raw = JSON.parse(syncFs.readFileSync(path.join(paymentChallengeDirectory(env), name), "utf8"));
+			if (isRecord(raw) && raw.txRefDigest === txRefDigest && raw.taskId !== taskId) {
+				throw new Error("payment transaction was already claimed by a different A2A task");
+			}
+		}
+		if (challenge.status === "claimed") {
+			if (challenge.txRefDigest !== txRefDigest) {
+				throw new Error("A2A payment challenge was already claimed by a different transaction");
+			}
+			return challenge;
+		}
+		const claimed = {
+			...challenge,
+			status: "claimed",
+			txRefDigest,
+			claimedAt: new Date().toISOString()
+		};
+		writeWalletStateFileAtomically(paymentChallengePath(taskId, env), serializeWalletState(claimed));
+		return claimed;
+	});
+}
+function authorizeDurableA2aTask(params) {
+	const record = readDurableA2aTask({
+		taskId: params.taskId,
+		env: params.env
+	});
+	const token = params.accessToken.trim();
+	if (!record || !token || !tokensMatch(record.accessTokenHash, token)) {
+		return null;
+	}
+	return record;
+}
+function readDurableA2aTask(params) {
+	const taskId = params.taskId.trim();
+	if (!taskId) {
+		return null;
+	}
+	const filePath = taskPath(taskId, params.env ?? process.env);
+	if (!syncFs.existsSync(filePath)) {
+		return null;
+	}
+	try {
+		return validateRecord(JSON.parse(syncFs.readFileSync(filePath, "utf8")), taskId);
+	} catch (error) {
+		throw new Error("durable A2A task is unreadable; refusing to replace it", { cause: error });
+	}
+}
+function writeRecord(record, env) {
+	syncFs.mkdirSync(taskDirectory(env), {
+		recursive: true,
+		mode: 448
+	});
+	writeWalletStateFileAtomically(taskPath(record.taskId, env), serializeWalletState(record));
+}
+async function claimDurableA2aPaymentReference(params) {
+	const env = params.env ?? process.env;
+	const taskId = params.taskId.trim();
+	const txRef = params.txRef.trim();
+	if (!taskId || !txRef) {
+		throw new Error("A2A payment claim requires taskId and txRef");
+	}
+	const claimPath = paymentClaimPath(txRef, env);
+	await withFileLock(paymentReferenceClaimLockPath(env), LOCK_OPTIONS, async () => {
+		await withFileLock(claimPath, LOCK_OPTIONS, async () => {
+			if (syncFs.existsSync(claimPath)) {
+				const existing = JSON.parse(syncFs.readFileSync(claimPath, "utf8"));
+				if (!isRecord(existing) || existing.taskId !== taskId) {
+					throw new Error("payment transaction was already claimed by a different A2A task");
+				}
+				return;
+			}
+			const claimDir = path.dirname(claimPath);
+			syncFs.mkdirSync(claimDir, {
+				recursive: true,
+				mode: 448
+			});
+			requireJsonLedgerCapacity(claimDir, MAX_PAYMENT_CLAIM_FILES, "A2A payment transaction claim store");
+			writeWalletStateFileAtomically(claimPath, serializeWalletState({
+				version: 1,
+				taskId,
+				txRefDigest: `sha256:${createHash("sha256").update(txRef, "utf8").digest("hex")}`,
+				createdAt: new Date().toISOString()
+			}));
+		});
+	});
+}
+async function reserveDurableA2aTask(params) {
+	const env = params.env ?? process.env;
+	const taskId = params.taskId.trim();
+	if (!taskId || taskId.length > 240) {
+		throw new Error("A2A taskId is invalid");
+	}
+	const intentDigest = a2aTaskIntentDigest({
+		taskId,
+		senderHandle: params.senderHandle.trim(),
+		input: params.input,
+		marketplacePayment: params.marketplacePayment
+	});
+	syncFs.mkdirSync(taskDirectory(env), {
+		recursive: true,
+		mode: 448
+	});
+	const senderHandle = params.senderHandle.trim();
+	return await withFileLock(taskCapacityLockPath(env), LOCK_OPTIONS, async () => {
+		pruneDurableTasks(env);
+		return await withFileLock(senderQuotaLockPath(senderHandle, env), LOCK_OPTIONS, async () => {
+			return await withFileLock(taskPath(taskId, env), LOCK_OPTIONS, async () => {
+				const existing = readDurableA2aTask({
+					taskId,
+					env
+				});
+				if (existing) {
+					if (existing.intentDigest !== intentDigest) {
+						throw new Error("A2A taskId is already bound to a different immutable task intent");
+					}
+					if (!params.accessToken || !tokensMatch(existing.accessTokenHash, params.accessToken)) {
+						throw new Error("A2A taskId already exists and requires its task access token");
+					}
+					return {
+						record: existing,
+						created: false
+					};
+				}
+				enforceSenderQuota({
+					senderHandle,
+					env
+				});
+				requireJsonLedgerCapacity(taskDirectory(env), MAX_TASK_FILES_ON_DISK, "A2A task store");
+				const now = new Date().toISOString();
+				const accessToken = normalizeNewAccessToken(params.accessToken) ?? randomBytes(32).toString("base64url");
+				const record = {
+					version: 2,
+					taskId,
+					intentDigest,
+					accessTokenHash: hashAccessToken(accessToken),
+					senderHandle,
+					input: params.input,
+					...params.marketplacePayment !== undefined ? { marketplacePayment: params.marketplacePayment } : {},
+					status: "queued",
+					createdAt: now,
+					updatedAt: now
+				};
+				writeRecord(record, env);
+				return {
+					record,
+					created: true,
+					accessToken
+				};
+			});
+		});
+	});
+}
+async function updateDurableA2aTask(params) {
+	const env = params.env ?? process.env;
+	const taskId = params.taskId.trim();
+	return await withFileLock(taskPath(taskId, env), LOCK_OPTIONS, async () => {
+		const record = readDurableA2aTask({
+			taskId,
+			env
+		});
+		if (!record) {
+			throw new Error("durable A2A task does not exist");
+		}
+		if (params.expectedStatuses && !params.expectedStatuses.includes(record.status)) {
+			throw new Error(`durable A2A task is ${record.status}; expected ${params.expectedStatuses.join(" or ")}`);
+		}
+		if (params.status) {
+			record.status = params.status;
+		}
+		if (params.output !== undefined) {
+			record.output = params.output;
+		}
+		if (params.error !== undefined) {
+			record.error = params.error;
+		}
+		if (params.settlement !== undefined) {
+			record.settlement = params.settlement;
+		}
+		if (params.paymentRecovery !== undefined) {
+			record.paymentRecovery = params.paymentRecovery;
+		}
+		record.updatedAt = new Date().toISOString();
+		writeRecord(record, env);
+		return record;
+	});
+}
+async function claimDurableA2aTaskExecution(params) {
+	const env = params.env ?? process.env;
+	const taskId = params.taskId.trim();
+	const key = `${taskDirectory(env)}\0${taskId}`;
+	if (ACTIVE_EXECUTIONS.has(key)) {
+		return null;
+	}
+	ACTIVE_EXECUTIONS.set(key, true);
+	let lock;
+	try {
+		lock = await acquireFileLock(executionLockTarget(taskId, env), EXECUTION_LOCK_OPTIONS);
+	} catch {
+		ACTIVE_EXECUTIONS.delete(key);
+		return null;
+	}
+	let released = false;
+	return async () => {
+		if (released) {
+			return;
+		}
+		released = true;
+		ACTIVE_EXECUTIONS.delete(key);
+		await lock.release();
+	};
+}
+
+//#endregion
+export { authorizeDurableA2aTask, claimDurableA2aPaymentChallenge, claimDurableA2aTaskExecution, issueDurableA2aPaymentChallenge, readDurableA2aPaymentChallenge, readDurableA2aTask, reserveDurableA2aTask, updateDurableA2aTask };

package/dist/gateway/auth.js

@@ -54,6 +54,19 @@ function isLocalDirectRequest(req, trustedProxies, allowRealIpFallback) {
 	}
 	return false;
 }
+/**
+* Returns true only when the peer itself is loopback and the request carries
+* no proxy-origin headers. This stricter predicate is required for auth mode
+* "none"; configured proxies must never turn an unauthenticated request into
+* a local one.
+*/
+function isDirectLoopbackRequest(req, trustedProxies) {
+	if (!req) {
+		return false;
+	}
+	const remoteAddr = req.socket?.remoteAddress;
+	return isLoopbackAddress(remoteAddr) && !isTrustedProxyAddress(remoteAddr, trustedProxies) && !hasForwardedProxyHeaders(req);
+}
 function getTailscaleUser(req) {
 	if (!req) {
 		return null;
@@ -81,7 +94,16 @@ function hasForwardedProxyHeaders(req) {
 	if (!req) {
 		return false;
 	}
-	return Boolean(req.headers["forwarded"] || req.headers["x-forwarded-for"] || req.headers["x-forwarded-host"] || req.headers["x-forwarded-proto"] || req.headers["x-real-ip"]);
+	return [
+		"forwarded",
+		"via",
+		"x-forwarded-for",
+		"x-forwarded-host",
+		"x-forwarded-port",
+		"x-forwarded-proto",
+		"x-forwarded-server",
+		"x-real-ip"
+	].some((header) => Object.prototype.hasOwnProperty.call(req.headers, header));
 }
 function isTailscaleProxyRequest(req) {
 	if (!req) {
@@ -270,6 +292,20 @@ async function authorizeGatewayConnect(params) {
 			};
 		}
 	}
+	if (auth.mode === "none") {
+		if (!auth.allowTailscale && isDirectLoopbackRequest(req, trustedProxies)) {
+			limiter?.reset(ip, rateLimitScope);
+			return {
+				ok: true,
+				method: "none"
+			};
+		}
+		limiter?.recordFailure(ip, rateLimitScope);
+		return {
+			ok: false,
+			reason: "unauthorized"
+		};
+	}
 	let sessionAuthResolved;
 	const trySessionTokenAuth = async () => {
 		if (sessionAuthResolved !== undefined) {
@@ -384,4 +420,4 @@ async function authorizeGatewayConnect(params) {
 }
 
 //#endregion
-export { assertGatewayAuthConfigured, authorizeGatewayConnect, isLocalDirectRequest, resolveGatewayAuth };
+export { assertGatewayAuthConfigured, authorizeGatewayConnect, isDirectLoopbackRequest, isLocalDirectRequest, resolveGatewayAuth };