@ferrule-io/ok-fine 0.3.6 → 0.3.7

package/dist/server.js

@@ -9,28 +9,67 @@ import { JwtTokenVerifier, principalFromAuthInfo } from "./auth/verifier.js";
 import { OkfError } from "./errors.js";
 import { registerMcpRoute } from "./http/mcp-route.js";
 import { registerRestRoutes } from "./http/rest.js";
+import { DEFAULT_UI_DIR, endpointOrigins, registerUiRoutes } from "./http/ui.js";
 import { createMcpServer } from "./mcp/server.js";
 import { KnowledgeService } from "./service/knowledge-service.js";
 import { Catalog } from "./store/catalog.js";
 import { GitBackend } from "./store/git-backend.js";
+import { VERSION } from "./version.js";
 const DISCOVERY_ATTEMPTS = 5;
 const DISCOVERY_RETRY_MS = 2000;
-export async function startServer(config) {
+function parseHostHeader(hostHeader) {
+    if (!hostHeader || typeof hostHeader !== "string")
+        return null;
+    const trimmed = hostHeader.trim();
+    if (trimmed.length === 0 || /[/\s\\@]/.test(trimmed))
+        return null;
+    if (trimmed.startsWith("[")) {
+        const closeBracket = trimmed.indexOf("]");
+        if (closeBracket === -1)
+            return null;
+        const rest = trimmed.slice(closeBracket + 1);
+        if (rest.length > 0 && !/^:\d+$/.test(rest))
+            return null;
+        return trimmed.slice(0, closeBracket + 1).toLowerCase();
+    }
+    const colonIndex = trimmed.indexOf(":");
+    if (colonIndex !== -1) {
+        const port = trimmed.slice(colonIndex + 1);
+        if (!/^\d+$/.test(port))
+            return null;
+        return trimmed.slice(0, colonIndex).toLowerCase();
+    }
+    return trimmed.toLowerCase();
+}
+export async function startServer(config, options = {}) {
+    const tp = config.trustProxy;
+    const trustProxy = typeof tp === "number"
+        ? (_addr, hop) => hop < tp
+        : typeof tp === "string"
+            ? tp
+                .split(",")
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0)
+            : tp;
     const app = Fastify({
         logger: { level: config.logLevel, redact: ["req.headers.authorization"] },
-        trustProxy: true,
+        trustProxy,
+        requestTimeout: 120_000,
+        connectionTimeout: 120_000,
         bodyLimit: 4 * 1024 * 1024,
     });
     app.removeContentTypeParser("text/plain");
     app.addContentTypeParser(/^text\//, { parseAs: "string", bodyLimit: config.maxFileBytes + 65536 }, (_req, body, done) => done(null, body));
     app.addContentTypeParser(["application/gzip", "application/x-gzip", "application/octet-stream"], { parseAs: "buffer", bodyLimit: config.maxArchiveBytes }, (_req, body, done) => done(null, body));
     let authHandler;
+    let uiConnectSrc = [];
     if (config.auth.mode === "oidc") {
         let discovered;
         for (let attempt = 1; !discovered; attempt++) {
             try {
                 discovered = await discoverAuthorizationServer(config.auth.issuer, {
                     timeoutMs: 5000,
+                    allowInsecureIssuer: config.auth.allowInsecureIssuer,
                     ...(config.auth.jwksUri === undefined ? {} : { jwksUri: config.auth.jwksUri }),
                 });
             }
@@ -42,6 +81,8 @@ export async function startServer(config) {
             }
         }
         const { metadata, jwksUri } = discovered;
+        // The web UI fetches these cross-origin; it reaches authorization_endpoint by navigation, which CSP does not cover.
+        uiConnectSrc = endpointOrigins(metadata.token_endpoint, metadata.registration_endpoint);
         const resourceServerUrl = new URL(`${config.publicBaseUrl}/mcp`);
         const prm = buildOAuthProtectedResourceMetadata({
             // Discovery checked `issuer`; buildOAuthProtectedResourceMetadata validates the rest and throws on misconfiguration.
@@ -55,11 +96,19 @@ export async function startServer(config) {
             app.get(path, async (_req, reply) => reply.header("access-control-allow-origin", "*").send(prm));
         }
         app.get("/.well-known/oauth-authorization-server", async (_req, reply) => reply.header("access-control-allow-origin", "*").send(metadata));
+        const { access } = config.auth;
+        if (access.allowedSubjects.length === 0 &&
+            access.allowedEmails.length === 0 &&
+            access.requiredGroups.length === 0 &&
+            access.allowedClientIds.length === 0) {
+            app.log.warn(`no OAUTH_ALLOWED_* / OAUTH_REQUIRED_GROUPS policy set: every token from ${config.auth.issuer} with an ok-fine scope can read all projects`);
+        }
         const verifier = new JwtTokenVerifier({
             issuer: config.auth.issuer,
             audiences: config.auth.audiences,
             jwksUri,
             identityClaims: config.auth.identityClaims,
+            access: config.auth.access,
         });
         const authenticator = createAuthenticator({
             verifier,
@@ -81,6 +130,55 @@ export async function startServer(config) {
     }
     else {
         app.log.warn("authentication disabled, every request has admin access; never expose this beyond localhost");
+        const allowedHosts = {
+            localhost: true,
+            "127.0.0.1": true,
+            "[::1]": true,
+            "::1": true,
+        };
+        const publicHost = new URL(config.publicBaseUrl).hostname.toLowerCase();
+        allowedHosts[publicHost] = true;
+        if (publicHost.startsWith("[") && publicHost.endsWith("]")) {
+            allowedHosts[publicHost.slice(1, -1)] = true;
+        }
+        app.addHook("onRequest", async (req, reply) => {
+            if (req.method === "GET" && (req.url === "/healthz" || req.url.startsWith("/healthz?"))) {
+                return;
+            }
+            const host = parseHostHeader(req.headers.host);
+            if (!host || !allowedHosts[host]) {
+                return reply.code(403).send({
+                    error: {
+                        code: "forbidden",
+                        message: `Host header '${req.headers.host ?? ""}' is not allowed in AUTH_MODE=none`,
+                    },
+                });
+            }
+            if (req.headers.origin !== undefined) {
+                const rawOrigin = Array.isArray(req.headers.origin) ? req.headers.origin[0] : req.headers.origin;
+                let originAllowed = false;
+                if (typeof rawOrigin === "string") {
+                    try {
+                        const parsed = new URL(rawOrigin);
+                        if ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
+                            allowedHosts[parsed.hostname.toLowerCase()]) {
+                            originAllowed = true;
+                        }
+                    }
+                    catch {
+                        // invalid origin URL
+                    }
+                }
+                if (!originAllowed) {
+                    return reply.code(403).send({
+                        error: {
+                            code: "forbidden",
+                            message: `Origin '${rawOrigin ?? ""}' is not allowed in AUTH_MODE=none`,
+                        },
+                    });
+                }
+            }
+        });
         const allScopes = [config.scopeNames.read, config.scopeNames.write, config.scopeNames.admin];
         const anonymousAuthInfo = {
             token: "",
@@ -135,15 +233,26 @@ export async function startServer(config) {
         return reply.code(500).send({ error: { code: "internal", message: "internal error" } });
     });
     app.get("/healthz", async () => ({ status: "ok" }));
+    await registerUiRoutes(app, {
+        dir: options.uiDir ?? DEFAULT_UI_DIR,
+        publicBaseUrl: config.publicBaseUrl,
+        clientConfig: {
+            authMode: config.auth.mode,
+            oauthClientId: config.auth.mode === "oidc" ? (config.auth.uiClientId ?? null) : null,
+            scope: config.scopeNames.read,
+            version: VERSION,
+        },
+        connectSrc: uiConnectSrc,
+    });
     app.decorateRequest("principal", null);
     app.decorateRequest("authInfo", null);
     await app.register(async (secured) => {
-        secured.addHook("preHandler", async (req, reply) => {
+        secured.addHook("onRequest", async (req, reply) => {
             const challenge = await authHandler.authenticate(req);
             if (challenge)
                 return reply.send(challenge);
             if (authHandler.mode === "oidc") {
-                const need = req.routeOptions.config.permission ?? "read";
+                const need = req.routeOptions?.config?.permission ?? "read";
                 const p = req.principal;
                 const permitted = p !== null && (need === "admin" ? p.canAdmin : need === "write" ? p.canWrite : p.canRead);
                 if (!permitted)

package/dist/store/fs-util.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
-import { access, mkdir, readdir, readFile, rename, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { access, lstat, mkdir, readdir, readFile, rename, writeFile } from "node:fs/promises";
+import { basename, dirname, join, posix } from "node:path";
+import { OkfError } from "../errors.js";
 export async function atomicWrite(absPath, data) {
     const dir = dirname(absPath);
     await mkdir(dir, { recursive: true });
@@ -19,8 +20,8 @@ export async function pathExists(absPath) {
 }
 export async function isDirectory(absPath) {
     try {
-        const s = await stat(absPath);
-        return s.isDirectory();
+        const s = await lstat(absPath);
+        return s.isDirectory() && !s.isSymbolicLink();
     }
     catch {
         return false;
@@ -31,6 +32,15 @@ export async function isDirectory(absPath) {
  * non-regular entries are excluded and never followed. A missing root yields [].
  */
 export async function listTreeFiles(rootDir) {
+    try {
+        const s = await lstat(rootDir);
+        if (s.isSymbolicLink() || !s.isDirectory()) {
+            return [];
+        }
+    }
+    catch {
+        return [];
+    }
     const files = [];
     async function walk(rel) {
         let entries;
@@ -62,4 +72,49 @@ export async function fsBundleSource(rootDir) {
         read: (path) => readFile(join(rootDir, path)).catch(() => null),
     };
 }
+export async function assertContainedPath(repoDir, project, relPath) {
+    const projectDir = join(repoDir, project);
+    try {
+        const s = await lstat(projectDir);
+        if (s.isSymbolicLink()) {
+            throw new OkfError("invalid_path", 400, `project directory "${project}" is a symbolic link`);
+        }
+        if (!s.isDirectory()) {
+            throw new OkfError("invalid_path", 400, `project directory "${project}" is not a directory`);
+        }
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            return;
+        }
+        throw err;
+    }
+    if (!relPath) {
+        return;
+    }
+    const parentDir = posix.dirname(relPath);
+    if (parentDir === "." || parentDir === "") {
+        return;
+    }
+    const segments = parentDir.split("/").filter((s) => s.length > 0);
+    let current = projectDir;
+    for (const segment of segments) {
+        current = join(current, segment);
+        try {
+            const s = await lstat(current);
+            if (s.isSymbolicLink()) {
+                throw new OkfError("invalid_path", 400, `path component "${segment}" is a symbolic link`);
+            }
+            if (!s.isDirectory()) {
+                throw new OkfError("invalid_path", 400, `path component "${segment}" is not a directory`);
+            }
+        }
+        catch (err) {
+            if (err.code === "ENOENT") {
+                break;
+            }
+            throw err;
+        }
+    }
+}
 //# sourceMappingURL=fs-util.js.map