@goodandready/dsh-cron 0.3.6 → 0.3.7

package/lib/index.js

@@ -305,6 +305,10 @@ export function apply(ctx, rawConfig) {
     path: '/dsh-cron/settings',
     handler: async (req, res) => {
       try {
+        const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
+        const apiToken = settings.apiToken;
+        if (rejectCrossOrigin(req, res, { apiToken })) return;
+
         if (req.method === 'GET') {
           const unwrapped = {
             ...unwrapConfig(getContextConfig(ctx, rawConfig)),

package/lib/metrics.js

@@ -1,3 +1,4 @@
+import { rejectCrossOrigin } from './http-utils.js';
 /**
  * Prometheus exposition of the scheduler (#53).
  *
@@ -108,6 +109,10 @@ export function createMetricsHandler({ store, scheduler }) {
       res.end('Method not allowed' + NL);
       return;
     }
+    const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
+    const apiToken = settings.apiToken;
+    if (rejectCrossOrigin(req, res, { apiToken })) return;
+
     const body = renderMetrics({
       tasks: store.list({ status: 'all' }),
       stats: store.getAggregatedStats(),

package/lib/routes.js

@@ -88,6 +88,9 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     kind: 'exact',
     path: '/dsh-cron/models',
     handler: async (req, res) => {
+      const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
+      const apiToken = settings.apiToken;
+      if (rejectCrossOrigin(req, res, { apiToken })) return;
       await getModelsHandler(ctx, req, res, sendJson);
     }
   }), 'dsh-cron: /models');
@@ -108,6 +111,10 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
     path: '/dsh-cron/analytics',
     handler: async (req, res) => {
       try {
+        const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
+        const apiToken = settings.apiToken;
+        if (rejectCrossOrigin(req, res, { apiToken })) return;
+
         const url = new URL(req.url, 'http://127.0.0.1');
         const path = url.pathname;
 
@@ -211,6 +218,8 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
           return;
         }
         const settings = store.getSettings ? store.getSettings() : {};
+        const apiToken = settings.apiToken;
+        if (rejectCrossOrigin(req, res, { apiToken })) return;
         const categories = recipesByCategory();
         const recipes = listVerifiedRecipes(settings);
         sendJson(res, 200, { ok: true, categories, recipes });
@@ -230,6 +239,10 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
           sendJson(res, 405, { ok: false, error: 'Method not allowed' });
           return;
         }
+        const settings = store.getSettings ? store.getSettings() : {};
+        const apiToken = settings.apiToken;
+        if (rejectCrossOrigin(req, res, { apiToken })) return;
+
         const tasks = store.list({ status: 'active' });
         const lastRuns = tasks.map((t) => t.lastRunAt || 0);
         sendJson(res, 200, {
@@ -319,7 +332,9 @@ export function registerRoutes(ctx, { store, scheduler, recommendations }) {
  * Handler for chain step retries (#319)
  */
 export async function handleChainRoutes(store, scheduler, req, res) {
-  if (req.method === 'POST' && rejectCrossOrigin(req, res)) return;
+  const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
+  const apiToken = settings.apiToken;
+  if (rejectCrossOrigin(req, res, { apiToken })) return;
   const url = new URL(req.url, 'http://localhost');
 
   // GET /dsh-cron/chains/:chainRunId (#334)
@@ -374,6 +389,10 @@ export async function handleRunArtifactRoutes(store, req, res) {
     sendJson(res, 405, { ok: false, error: 'Method not allowed' });
     return;
   }
+  const settings = store && typeof store.getSettings === 'function' ? store.getSettings() : {};
+  const apiToken = settings.apiToken;
+  if (rejectCrossOrigin(req, res, { apiToken })) return;
+
   const [, runId, artifactId, action] = m;
   if (!artifactId) {
     const artifacts = store.getArtifactsForRun(runId);

package/lib/validators.js

@@ -128,7 +128,8 @@ export function validateRunResult(task, runInfo, options = {}) {
         // Guard against directory traversal escaping baseDir
         const resolvedPath = path.resolve(baseDir, relPath);
         const resolvedBase = path.resolve(baseDir);
-        if (!resolvedPath.startsWith(resolvedBase)) {
+        const basePrefix = resolvedBase.endsWith(path.sep) ? resolvedBase : resolvedBase + path.sep;
+        if (resolvedPath !== resolvedBase && !resolvedPath.startsWith(basePrefix)) {
           const message = `File path "${relPath}" escapes allowed directory boundary`;
           details.push({ type: 'file', passed: false, message });
           return { ok: false, status: 'failed', error: message, details };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.",
   "type": "module",
   "main": "lib/index.js",