@goodandready/dsh-github-ops 0.6.4 → 0.6.5

package/lib/routes.js

@@ -8,7 +8,7 @@
 import { existsSync, statSync, readFileSync } from 'node:fs'
 import { join as joinPath } from 'node:path'
 
-import { statusPayload, isTrustedRequest, isTrustedWriteRequest, sendJson } from './status.js'
+import { statusPayload, isTrustedRequest, isTrustedWriteRequest, getRejectionStatus, getWriteRejectionStatus, sendJson } from './status.js'
 import { buildAction, validateCwd, validateStashRef, resolveConflictFile } from './scm-write.js'
 import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, scmPayload, mergeStateFrom, hasConflicts, parseConflictBlocks, parseDiffHunks, parseGitGraph } from './scm.js'
 import { SseEventManager } from './events.js'
@@ -64,6 +64,25 @@ export function registerRoutes(ctx, deps = {}) {
     makeGitRunner = () => () => ({ code: 1, stdout: '', stderr: 'git not available' }),
     cacheStats = () => null,
   } = deps
+
+  const resolveConnection = deps.resolveConnection || (() => {
+    try {
+      if (ctx && typeof ctx.get === 'function') {
+        const c = ctx.get('connection')
+        if (c) return c
+      }
+    } catch { /* ignore */ }
+    try {
+      if (ctx && ctx.connection) return ctx.connection
+    } catch { /* ignore */ }
+    try {
+      const c = Reflect.get(ctx, 'connection')
+      if (c) return c
+    } catch { /* ignore */ }
+    return undefined
+  })
+  const routeOptions = () => ({ get connection() { return resolveConnection() } })
+
   // The card reads the access status from here instead of from a tool result: the model has
   // no business holding the access value, and the payload describes this machine's account,
   // so only a local or same-origin caller is answered.
@@ -74,7 +93,10 @@ export function registerRoutes(ctx, deps = {}) {
         path: STATUS_PATH,
         handler: async (req, res) => {
           if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          if (!isTrustedRequest(req, routeOptions())) {
+            const status = getRejectionStatus(req, routeOptions()) || 403
+            return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+          }
           const access = await resolveToken()
           let identity = null
           let rateLimit = null
@@ -120,9 +142,15 @@ export function registerRoutes(ctx, deps = {}) {
           try {
           if (req.method !== 'GET' && req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' })
           if (req.method === 'POST') {
-            if (!isTrustedWriteRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            if (!isTrustedWriteRequest(req, routeOptions())) {
+              const status = getWriteRejectionStatus(req, routeOptions()) || 403
+              return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+            }
           } else {
-            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            if (!isTrustedRequest(req, routeOptions())) {
+              const status = getRejectionStatus(req, routeOptions()) || 403
+              return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+            }
           }
           const git = makeGitRunner()
           const url = new URL(req.url || '/', 'http://localhost')
@@ -306,7 +334,10 @@ export function registerRoutes(ctx, deps = {}) {
         path: PANEL_PATH,
         handler: async (req, res) => {
           if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          if (!isTrustedRequest(req, routeOptions())) {
+            const status = getRejectionStatus(req, routeOptions()) || 403
+            return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+          }
           const access = await resolveToken()
           if (!access.value) return sendJson(res, 200, { configured: false, guidance: access.guidance })
           const url = new URL(req.url || '/', 'http://localhost')
@@ -381,9 +412,15 @@ export function registerRoutes(ctx, deps = {}) {
           try {
             if (req.method !== 'GET' && req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' })
             if (req.method === 'POST') {
-              if (!isTrustedWriteRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+              if (!isTrustedWriteRequest(req, routeOptions())) {
+                const status = getWriteRejectionStatus(req, routeOptions()) || 403
+                return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+              }
             } else {
-              if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+              if (!isTrustedRequest(req, routeOptions())) {
+                const status = getRejectionStatus(req, routeOptions()) || 403
+                return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+              }
             }
             const git = makeGitRunner()
             const url = new URL(req.url || '/', 'http://localhost')
@@ -451,7 +488,10 @@ export function registerRoutes(ctx, deps = {}) {
         handler: async (req, res) => {
           try {
             if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            if (!isTrustedRequest(req, routeOptions())) {
+              const status = getRejectionStatus(req, routeOptions()) || 403
+              return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+            }
             const access = await resolveToken()
             if (!access.value) return sendJson(res, 200, { configured: false, guidance: access.guidance })
             const url = new URL(req.url || '/', 'http://localhost')
@@ -474,7 +514,10 @@ export function registerRoutes(ctx, deps = {}) {
         handler: async (req, res) => {
           try {
             if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            if (!isTrustedRequest(req, routeOptions())) {
+              const status = getRejectionStatus(req, routeOptions()) || 403
+              return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+            }
             const git = makeGitRunner()
             const url = new URL(req.url || '/', 'http://localhost')
             const requested = validateCwd(url.searchParams.get('cwd') || '')
@@ -515,7 +558,10 @@ export function registerRoutes(ctx, deps = {}) {
         path: EVENTS_PATH,
         handler: async (req, res) => {
           if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          if (!isTrustedRequest(req, routeOptions())) {
+            const status = getRejectionStatus(req, routeOptions()) || 403
+            return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+          }
           res.writeHead(200, {
             'Content-Type': 'text/event-stream',
             'Cache-Control': 'no-cache, no-transform',

package/lib/status.js

@@ -8,8 +8,46 @@ import { auditTokenScopes } from './token-audit.js'
 // The payload never contains the access value. The route answers only a local or same-origin
 // caller, because the payload describes the machine's account.
 
-/** Whether a request may read the status payload. Fail-closed. */
-function isTrustedHost(host) {
+/** Whether an address or host string represents local loopback. */
+export function isLoopbackAddress(val) {
+  if (!val || typeof val !== 'string') return false
+  let h = val.trim().toLowerCase()
+  if (h.startsWith('[')) {
+    const end = h.indexOf(']')
+    if (end > 0) h = h.slice(1, end)
+  } else if (h.includes(':')) {
+    const colons = h.split(':').length - 1
+    if (colons === 1) h = h.split(':')[0]
+  }
+  const clean = h.replace(/^::ffff:/, '')
+  return clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.') || clean === 'localhost' || clean === 'localhost.' || clean === '[::1]'
+}
+export const isLoopback = isLoopbackAddress
+
+/** Whether an address or host string represents a private LAN network. */
+export function isLanAddress(ip) {
+  if (!ip || typeof ip !== 'string') return false
+  let h = ip.trim().toLowerCase()
+  if (h.startsWith('[')) {
+    const end = h.indexOf(']')
+    if (end > 0) h = h.slice(1, end)
+  } else if (h.includes(':')) {
+    const colons = h.split(':').length - 1
+    if (colons === 1) h = h.split(':')[0]
+  }
+  const clean = h.replace(/^::ffff:/, '')
+  if (isLoopbackAddress(clean)) return true
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
+  const match172 = clean.match(/^172\.(\d+)\./)
+  if (match172) {
+    const octet = parseInt(match172[1], 10)
+    if (octet >= 16 && octet <= 31) return true
+  }
+  return false
+}
+
+/** Whether a host header passes DNS-rebinding guards. Fail-closed. */
+export function isTrustedHost(host) {
   if (!host || typeof host !== 'string') return false
   let hostname = host.trim()
   if (hostname.startsWith('[')) {
@@ -24,146 +62,226 @@ function isTrustedHost(host) {
   hostname = hostname.toLowerCase()
   if (!hostname) return false
   if (hostname === 'localhost' || hostname.endsWith('.local') || hostname.endsWith('.lan')) return true
-  const clean = hostname.replace(/^::ffff:/, '')
-  if (clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.')) return true
-  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
-  const match172 = clean.match(/^172\.(\d+)\./)
-  if (match172) {
-    const octet = parseInt(match172[1], 10)
-    if (octet >= 16 && octet <= 31) return true
-  }
-  return false
+  return isLoopbackAddress(hostname) || isLanAddress(hostname)
 }
 
-/** Whether an address or host string represents local loopback. */
-function isLoopback(val) {
-  if (!val || typeof val !== 'string') return false
-  let h = val.trim().toLowerCase()
-  if (h.startsWith('[')) {
-    const end = h.indexOf(']')
-    if (end > 0) h = h.slice(1, end)
-  } else if (h.includes(':')) {
-    const colons = h.split(':').length - 1
-    if (colons === 1) h = h.split(':')[0]
-  }
-  const clean = h.replace(/^::ffff:/, '')
-  return clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.') || clean === 'localhost' || clean === 'localhost.'
+/** Resolves remote client IP from socket or request metadata. */
+export function getClientIp(req) {
+  return (
+    req?.socket?.remoteAddress ||
+    req?.socket?.address?.()?.address ||
+    req?.connection?.remoteAddress ||
+    req?.info?.remoteAddress ||
+    ''
+  )
 }
 
-/** Whether a request may read the status payload. Fail-closed. */
-export function isTrustedRequest(req) {
-  if (!req) return false
+/**
+ * Evaluates whether an incoming HTTP request is trusted and authenticated (#129).
+ *
+ * Requirements:
+ * 1. If DSH connection service is available (options.connection), requestRejection(req)
+ *    is the authoritative gate for browser session authentication and trusted network access.
+ *    If rejection is returned, the numeric status (e.g. 401 or 403) is returned.
+ * 2. Host header, if present, must pass isTrustedHost (prevents DNS rebinding).
+ * 3. Cross-site requests (sec-fetch-site: cross-site) are strictly rejected with 403.
+ * 4. Origin & Referer headers (if present) must match Host or a trusted host.
+ * 5. Fallback when connection service is absent (unit tests, standalone runner):
+ *    - Loopback callers (127.0.0.1, ::1) are allowed.
+ *    - Remote / LAN callers without connection authentication are rejected with 403 (fail closed).
+ *    - Unknown remote address (socket present but empty remoteAddress) fails closed with 403.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ connection?: { requestRejection?: (req: any) => number | undefined } }} [options]
+ * @returns {number|undefined} Rejection HTTP status code (401, 403), or undefined if allowed.
+ */
+export function getRejectionStatus(req, options = {}) {
+  if (!req) return 403
 
-  // Fail-closed against cross-site fetches regardless of source IP
-  const secFetchSite = header(req, 'sec-fetch-site')
-  if (secFetchSite === 'cross-site') return false
+  const connection = options?.connection
+  if (connection && typeof connection.requestRejection === 'function') {
+    try {
+      const rejection = connection.requestRejection(req)
+      if (rejection !== undefined) {
+        if (typeof rejection === 'number' && Number.isInteger(rejection) && rejection >= 400 && rejection < 600) {
+          return rejection
+        }
+        return rejection === 401 ? 401 : 403
+      }
+    } catch {
+      // Fail closed if connection service throws
+      return 403
+    }
+  }
 
-  const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
-  const cleanIp = address.replace(/^::ffff:/, '')
-  const loopback = cleanIp === '127.0.0.1' || cleanIp === '::1' || cleanIp.startsWith('127.')
+  const host = header(req, 'host')
 
-  // If socket remoteAddress is present, it MUST be a trusted local/private IP (never an untrusted remote IP)
-  if (cleanIp && !isTrustedHost(cleanIp)) return false
+  // 1. Host header must be present and trusted if provided
+  if (host && !isTrustedHost(host)) {
+    return 403
+  }
 
-  const host = header(req, 'host')
-  // If host is provided, it MUST be a trusted local/private host (DNS rebinding guard)
-  if (host && !isTrustedHost(host)) return false
+  // 2. Strict rejection of cross-site requests
+  const site = header(req, 'sec-fetch-site')
+  if (site === 'cross-site') {
+    return 403
+  }
 
+  // 3. Origin header validation if present
   const origin = header(req, 'origin')
-  const referer = header(req, 'referer')
-
-  // Check origin header first
   if (origin) {
+    if (origin === 'null') return 403
     try {
       const originUrl = new URL(origin)
-      if (!isTrustedHost(originUrl.hostname)) return false
-      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return false
-      return true
+      if (!isTrustedHost(originUrl.hostname)) return 403
+      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return 403
     } catch {
-      return false
+      return 403
     }
   }
 
-  // Check referer header
+  // 4. Referer header validation if present
+  const referer = header(req, 'referer')
   if (referer) {
     try {
       const refUrl = new URL(referer)
       if (refUrl.protocol === 'http:' || refUrl.protocol === 'https:') {
-        if (!isTrustedHost(refUrl.hostname)) return false
-        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return false
-        return true
-      }
-      // Non-http referer (e.g. dsh-app://app/ in DSH Desktop Electron):
-      // Desktop removes origin/sec-fetch-site and sets custom scheme referer.
-      // Accept only if caller is loopback (socket or loopback host).
-      const hostIsLoopback = host ? isLoopback(host) : false
-      if (loopback || (!address && hostIsLoopback)) {
-        return true
+        if (!isTrustedHost(refUrl.hostname)) return 403
+        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return 403
+      } else {
+        // Non-http custom scheme referer (e.g. dsh-app://app/ in DSH Desktop Electron):
+        // Permitted only from local loopback
+        const ip = getClientIp(req)
+        const hostIsLoopback = host ? isLoopbackAddress(host) : false
+        const isLocal = ip ? isLoopbackAddress(ip) : hostIsLoopback
+        if (!isLocal) return 403
       }
-      return false
     } catch {
-      return false
+      return 403
     }
   }
 
-  // If browser headers (origin/referer/sec-fetch-site) are absent and caller is loopback, allow local caller
-  if (!secFetchSite && loopback) return true
+  // 5. Network boundary validation when connection service is absent:
+  const hasSocket = !!(req.socket || req.connection)
+  const ip = getClientIp(req)
 
-  // Non-loopback caller without origin/referer is refused
-  if (!loopback) return false
+  if (hasSocket) {
+    // Fail closed on missing/unknown remoteAddress
+    if (!ip) {
+      return 403
+    }
+    // Remote / LAN callers without connection authentication are rejected (fail closed!)
+    if (!isLoopbackAddress(ip)) {
+      if (!connection) {
+        return 403
+      }
+    }
+  } else if (!connection) {
+    // Synthetic mock request without socket: allow loopback host for unit tests
+    if (host && !isLoopbackAddress(host)) {
+      return 403
+    }
+  }
 
-  return true
-}
+  // If browser headers are absent and caller is non-loopback without connection
+  if (!connection) {
+    const isLocal = ip ? isLoopbackAddress(ip) : (host ? isLoopbackAddress(host) : false)
+    if (!isLocal) return 403
+  }
 
-/** Whether a write/mutating request (e.g. POST /scm) is safe. Strict write guard against CSRF. */
-export function isTrustedWriteRequest(req) {
-  if (!req) return false
-  if (!isTrustedRequest(req)) return false
+  return undefined
+}
 
-  const secFetchSite = header(req, 'sec-fetch-site')
-  if (secFetchSite && secFetchSite !== 'same-origin' && secFetchSite !== 'none') {
-    return false
+/**
+ * Evaluates whether an incoming HTTP write request is safe for mutation (#129).
+ *
+ * Additional Write Requirements:
+ * 1. Must satisfy all getRejectionStatus checks (including connection.requestRejection).
+ * 2. If Origin header is present:
+ *    - must match Host exactly (same-origin).
+ * 3. If Referer header is present:
+ *    - must match Host exactly (same-origin).
+ * 4. If Sec-Fetch-Site header is present:
+ *    - must be "same-origin" or "none" (same-site and cross-site are rejected).
+ * 5. If connection service is absent, only local loopback callers are allowed for writes.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ connection?: { requestRejection?: (req: any) => number | undefined } }} [options]
+ * @returns {number|undefined} Rejection HTTP status code (401, 403), or undefined if allowed.
+ */
+export function getWriteRejectionStatus(req, options = {}) {
+  const readStatus = getRejectionStatus(req, options)
+  if (readStatus !== undefined) {
+    return readStatus
   }
 
-  const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
-  const cleanIp = address.replace(/^::ffff:/, '')
-  const loopback = cleanIp === '127.0.0.1' || cleanIp === '::1' || cleanIp.startsWith('127.')
-
-  if (cleanIp && !isTrustedHost(cleanIp)) return false
+  const site = header(req, 'sec-fetch-site')
+  if (site && site !== 'same-origin' && site !== 'none') {
+    return 403
+  }
 
   const host = header(req, 'host')
   const origin = header(req, 'origin')
   const referer = header(req, 'referer')
+  const ip = getClientIp(req)
+  const connection = options?.connection
 
   if (origin) {
+    if (origin === 'null') return 403
     try {
       const originUrl = new URL(origin)
-      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return false
+      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return 403
     } catch {
-      return false
+      return 403
     }
   } else if (referer) {
     try {
       const refUrl = new URL(referer)
       if (refUrl.protocol === 'http:' || refUrl.protocol === 'https:') {
-        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return false
+        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return 403
       } else {
-        // Non-http custom scheme referer from loopback: permitted as local loopback writer
-        const hostIsLoopback = host ? isLoopback(host) : false
-        if (!loopback && (address || !hostIsLoopback)) return false
+        const hostIsLoopback = host ? isLoopbackAddress(host) : false
+        const isLocal = ip ? isLoopbackAddress(ip) : hostIsLoopback
+        if (!isLocal) return 403
       }
     } catch {
-      return false
+      return 403
     }
   } else {
     // Write request without origin/referer: only permit local loopback
-    if (!loopback) return false
+    const hostIsLoopback = host ? isLoopbackAddress(host) : false
+    const isLocal = ip ? isLoopbackAddress(ip) : hostIsLoopback
+    if (!isLocal) return 403
   }
 
-  return true
+  // If connection service is absent, only local loopback callers are allowed for writes
+  if (!connection) {
+    const hasSocket = !!(req.socket || req.connection)
+    if (hasSocket) {
+      if (!ip || !isLoopbackAddress(ip)) {
+        return 403
+      }
+    } else {
+      if (!host || !isLoopbackAddress(host)) {
+        return 403
+      }
+    }
+  }
+
+  return undefined
+}
+
+/** Whether a request may read the status payload. Fail-closed. */
+export function isTrustedRequest(req, options = {}) {
+  return getRejectionStatus(req, options) === undefined
+}
+
+/** Whether a write/mutating request (e.g. POST /scm) is safe. Strict write guard against CSRF. */
+export function isTrustedWriteRequest(req, options = {}) {
+  return getWriteRejectionStatus(req, options) === undefined
 }
 
-function header(req, name) {
+export function header(req, name) {
   if (!req || !req.headers) return ''
   const value = req.headers[name] || req.headers[name.toLowerCase()]
   return typeof value === 'string' ? value.trim() : ''

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",