@gen3/workspaces 0.12.72 → 0.12.73

package/dist/server/esm/server.js

@@ -334,20 +334,24 @@ async function proxyServerExtension(req, res, targetUrl, getToken) {
     // Inject identity headers so workspace-proxy auth passes.
     // Direct server-side calls bypass nginx (which normally injects X-Gen3-User-ID /
     // REMOTE_USER from the validated access_token), so we must add them explicitly.
-    // only add in production mode
-    // TODO: refactor this to handle development mode better
-    if (process.env.NODE_ENV === 'production') {
-        const jwt = getToken ? getToken(req) : extractTokenFallback(req);
-        if (jwt) {
-            const claims = decodeJwtClaims(jwt);
-            const rawUsername = claims?.sub ?? claims?.preferred_username ?? claims?.username;
-            if (typeof rawUsername === 'string') {
-                const safeUsername = rawUsername.replace(/[\r\n]/g, '');
-                const safeJwt = jwt.replace(/[\r\n]/g, '');
-                forwardHeaders['Authorization'] = `Bearer ${safeJwt}`;
-                forwardHeaders['REMOTE_USER'] = safeUsername;
-                forwardHeaders['X-Gen3-User-ID'] = safeUsername;
-            }
+    // SECURITY: decodeJwtClaims below does not verify the JWT signature — it relies on
+    // Ambassador/revproxy having already done so before this code path is reached. When
+    // serverExtensionProxyBaseUrl (WORKSPACE_PROXY_URL) targets workspace-proxy directly,
+    // that verification is skipped entirely, so a caller could supply a correctly-shaped
+    // but unsigned/forged JWT to impersonate another user via REMOTE_USER/X-Gen3-User-ID.
+    // Only point serverExtensionProxyBaseUrl at a network path a user's own request cannot
+    // otherwise forge, or add real signature verification (e.g. against Fence's JWKS)
+    // here before trusting these claims.
+    const jwt = getToken ? getToken(req) : extractTokenFallback(req);
+    if (jwt) {
+        const claims = decodeJwtClaims(jwt);
+        const rawUsername = claims?.sub ?? claims?.preferred_username ?? claims?.username;
+        if (typeof rawUsername === 'string') {
+            const safeUsername = rawUsername.replace(/[\r\n]/g, '');
+            const safeJwt = jwt.replace(/[\r\n]/g, '');
+            forwardHeaders['Authorization'] = `Bearer ${safeJwt}`;
+            forwardHeaders['REMOTE_USER'] = safeUsername;
+            forwardHeaders['X-Gen3-User-ID'] = safeUsername;
         }
     }
     const method = (req.method || 'GET').toUpperCase();
@@ -358,7 +362,9 @@ async function proxyServerExtension(req, res, targetUrl, getToken) {
     ].includes(method)) {
         try {
             body = await readBody$2(req);
-        } catch  {
+        } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error(`[workspace-assets] failed to read request body for ${method} ${targetUrl}: ${message}`);
             res.status(500).end('Failed to read request body');
             return;
         }
@@ -366,7 +372,8 @@ async function proxyServerExtension(req, res, targetUrl, getToken) {
             forwardHeaders['content-length'] = String(body.length);
         }
     }
-    console.log('[workspace-assets] proxying extension API to', targetUrl);
+    const startedAt = Date.now();
+    console.warn(`[workspace-assets] proxying ${method} ${targetUrl}${body?.length ? ` (body: ${body.length} bytes)` : ''}`);
     await new Promise((resolve)=>{
         const parsed = new URL(targetUrl);
         const transport = parsed.protocol === 'https:' ? https : http;
@@ -378,7 +385,8 @@ async function proxyServerExtension(req, res, targetUrl, getToken) {
             headers: forwardHeaders
         };
         const proxyReq = transport.request(reqOptions, (proxyRes)=>{
-            res.status(proxyRes.statusCode ?? 502);
+            const statusCode = proxyRes.statusCode ?? 502;
+            res.status(statusCode);
             const skip = new Set([
                 'transfer-encoding',
                 'content-length'
@@ -388,18 +396,24 @@ async function proxyServerExtension(req, res, targetUrl, getToken) {
                     res.setHeader(key, value);
                 }
             }
+            const log = statusCode >= 400 ? console.error : console.warn;
+            log(`[workspace-assets] ${method} ${targetUrl} -> ${statusCode} (${Date.now() - startedAt}ms)`);
             proxyRes.pipe(res, {
                 end: true
             });
             proxyRes.on('end', resolve);
         });
         proxyReq.on('error', (err)=>{
-            console.error('[workspace-assets] extension proxy failed for', targetUrl, err.message);
+            console.error(`[workspace-assets] extension proxy failed for ${method} ${targetUrl} after ${Date.now() - startedAt}ms: ${err.code ?? 'UNKNOWN'} ${err.message}`);
             if (!res.headersSent) {
                 res.status(502).end('Extension proxy unreachable');
             }
             resolve();
         });
+        proxyReq.on('timeout', ()=>{
+            console.error(`[workspace-assets] extension proxy timed out for ${method} ${targetUrl} after ${Date.now() - startedAt}ms`);
+            proxyReq.destroy();
+        });
         if (body?.length) {
             proxyReq.write(body);
         }
@@ -494,7 +508,6 @@ function createWorkspaceAssetsHandler(options) {
                 return `${proto}://${host}`;
             })();
             const targetUrl = `${proxyBase}${serverExtensionProxyPath}/${extensionPath}${qs}`;
-            console.log('[workspace-assets] proxying extension API to', targetUrl);
             return proxyServerExtension(req, res, targetUrl, getToken);
         }
         const allowedFiles = allowedFilesByTier[tier];
@@ -1185,8 +1198,12 @@ const DEFAULT_OPTIONS = {
     // Optional internal k8s service base URL for the extension proxy. When set,
     // proxy requests target this address directly instead of routing through the
     // ingress (avoiding self-signed-cert issues). Readable from the JSON config
-    // file or the WORKSPACE_EXTENSION_PROXY_BASE_URL env var.
-    serverExtensionProxyBaseUrl: 'http://workspace-proxy-service:8080',
+    // file or the WORKSPACE_PROXY_URL env var.
+    serverExtensionProxyBaseUrl: process.env.WORKSPACE_PROXY_URL || undefined,
+    // Direct calls to serverExtensionProxyBaseUrl bypass nginx, which normally
+    // injects the X-Gen3-User-ID/REMOTE_USER headers workspace-proxy requires —
+    // reuse this app's cookie extraction to inject them explicitly instead.
+    getToken: (req)=>getAccessToken(req.headers['cookie'] ?? '') ?? null,
     // in-browser Pyodide kernel must not be offered alongside it.
     additionalDisabledExtensions: [
         '@jupyterlite/pyodide-kernel-extension:kernel'