@goodandready/dsh-goal 0.2.25 → 0.2.26

package/lib/routes.js

@@ -44,76 +44,164 @@ export function isTrustedHost(val) {
   return false;
 }
 
-export function isTrustedCaller(req, authToken = process.env.DSH_GOAL_AUTH_TOKEN) {
-  if (!req) return false;
-  const rawRemote = req.socket?.remoteAddress || req.connection?.remoteAddress || "";
-  const cleanRemote = String(rawRemote).trim().toLowerCase().replace(/^::ffff:/, '');
-  const site = req.headers?.["sec-fetch-site"];
-
-  // 1. Cross-site and same-site browser requests are rejected
-  if (site === "cross-site" || site === "same-site") return false;
-
-  // 2. If remoteAddress is present, it must be a trusted local/private IP (never untrusted WAN)
-  if (cleanRemote && !isTrustedHost(cleanRemote)) {
-    return false;
+/**
+ * Safely extract DSH connection service from Cordis Context if available (#172).
+ * @param {any} ctx
+ * @returns {any}
+ */
+export function getConnection(ctx) {
+  if (!ctx) return undefined;
+  try {
+    const fromCtx = ctx?.reflect?.get
+      ? (ctx.reflect.get('connection') || ctx?.connection)
+      : (ctx?.get ? (ctx.get('connection') || ctx?.connection) : Reflect.get(ctx, 'connection'));
+    if (fromCtx) return fromCtx;
+    if (ctx?.root) {
+      return getConnection(ctx.root);
+    }
+    return undefined;
+  } catch {
+    return undefined;
   }
+}
 
-  // 3. If Host header is present, it must be a trusted local/private host (DNS rebinding guard)
-  const host = String(req.headers?.host || "").trim().toLowerCase();
-  if (host && !isTrustedHost(host)) {
-    return false;
+function resolveAuthOptions(optionsOrToken, maybeCtx) {
+  let authToken = process.env.DSH_GOAL_AUTH_TOKEN;
+  let ctx = null;
+  let connection = null;
+
+  if (typeof optionsOrToken === 'string') {
+    authToken = optionsOrToken;
+    ctx = maybeCtx;
+  } else if (optionsOrToken && typeof optionsOrToken === 'object') {
+    if (optionsOrToken.authToken !== undefined) authToken = optionsOrToken.authToken;
+    if (optionsOrToken.connection !== undefined) connection = optionsOrToken.connection;
+    if (optionsOrToken.ctx !== undefined) {
+      ctx = optionsOrToken.ctx;
+    } else if (optionsOrToken.webServer || optionsOrToken.reflect || optionsOrToken.connectionService) {
+      ctx = optionsOrToken;
+    }
   }
+  if (!connection && ctx) {
+    connection = getConnection(ctx);
+  }
+  return { authToken, ctx, connection };
+}
 
-  // 4. Optional authorization token check (supports x-dsh-auth-token or Authorization: Bearer <token>)
-  if (authToken) {
-    const headerVal = req.headers?.["x-dsh-auth-token"] || req.headers?.authorization;
-    const cleanHeader = headerVal ? String(headerVal).replace(/^Bearer\s+/i, "").trim() : "";
-    if (cleanHeader === authToken) {
-      return true;
-    }
-    // When authToken is explicitly configured, non-loopback callers without valid token are rejected
-    if (!isLoopback(cleanRemote)) {
-      return false;
+/**
+ * Evaluates whether an incoming HTTP request is trusted and authenticated (#172).
+ *
+ * Requirements:
+ * 1. Strict CSRF guard: rejects sec-fetch-site cross-site or same-site with 403.
+ * 2. DNS rebinding & WAN protection: validates Host and remoteAddress against isTrustedHost.
+ * 3. Origin & Referer headers must match Host and pass isTrustedHost.
+ * 4. Explicit auth token: valid X-DSH-Auth-Token or Authorization: Bearer bypasses session check.
+ * 5. Loopback callers (127.0.0.1, ::1) are admitted for local CLI, health checks, and monitoring.
+ * 6. Remote LAN callers must be authenticated via DSH connection service (connection.requestRejection).
+ *    If connection service is absent or returns a rejection code, caller is rejected (fail-closed, 401/403).
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {string|object} [optionsOrToken]
+ * @param {any} [maybeCtx]
+ * @returns {number|undefined} Rejection HTTP status code (401, 403) or undefined if admitted.
+ */
+export function getRequestRejection(req, optionsOrToken = process.env.DSH_GOAL_AUTH_TOKEN, maybeCtx = null) {
+  if (!req || !req.headers) return 403;
+
+  const { authToken, ctx, connection } = resolveAuthOptions(optionsOrToken, maybeCtx);
+
+  // 1. Cross-site and same-site browser requests are rejected (CSRF guard)
+  const site = req.headers['sec-fetch-site'];
+  if (site === 'cross-site' || site === 'same-site') return 403;
+
+  // 2. Host header validation (DNS rebinding guard)
+  const host = String(req.headers.host || '').trim().toLowerCase();
+  if (host && !isTrustedHost(host)) return 403;
+
+  // 3. Remote address validation if socket is present
+  const rawRemote = req.socket?.remoteAddress || req.connection?.remoteAddress || '';
+  const cleanRemote = String(rawRemote).trim().toLowerCase().replace(/^::ffff:/, '');
+  if (cleanRemote && !isTrustedHost(cleanRemote)) return 403;
+
+  // 4. Origin header validation if present
+  const origin = req.headers.origin;
+  if (origin !== undefined) {
+    if (origin === 'null' || !origin) return 403;
+    try {
+      const u = new URL(origin);
+      if (!isTrustedHost(u.hostname)) return 403;
+      if (host && u.host.toLowerCase() !== host.toLowerCase()) return 403;
+    } catch {
+      return 403;
     }
   }
 
-  // 5. Same-origin browser UI requests (operator UI on LAN or localhost)
-  if (site === "same-origin") {
-    const origin = String(req.headers?.origin || "").trim().toLowerCase();
-    if (origin && host) {
-      try {
-        const u = new URL(origin);
-        if (!isTrustedHost(u.hostname)) return false;
-        if (u.host === host) return true;
-      } catch (err) {
-        return false;
+  // 5. Referer header validation if present
+  const referer = req.headers.referer;
+  if (referer !== undefined && referer) {
+    try {
+      const u = new URL(referer);
+      if (u.protocol === 'http:' || u.protocol === 'https:') {
+        if (!isTrustedHost(u.hostname)) return 403;
+        if (host && u.host.toLowerCase() !== host.toLowerCase()) return 403;
+      } else {
+        const isLocal = isLoopback(cleanRemote) || (host ? isLoopback(host.split(':')[0]) : false);
+        if (!isLocal) return 403;
       }
+    } catch {
+      return 403;
     }
-    const referer = String(req.headers?.referer || "").trim().toLowerCase();
-    if (referer && host) {
-      try {
-        const u = new URL(referer);
-        if (!isTrustedHost(u.hostname)) return false;
-        if (u.host === host) return true;
-      } catch (err) {
-        return false;
-      }
+  }
+
+  // 6. Explicit auth token check (supports x-dsh-auth-token or Authorization: Bearer <token>)
+  if (authToken) {
+    const headerVal = req.headers['x-dsh-auth-token'] || req.headers.authorization;
+    const cleanHeader = headerVal ? String(headerVal).replace(/^Bearer\s+/i, '').trim() : '';
+    if (cleanHeader && cleanHeader === authToken) {
+      return undefined;
+    }
+    if (cleanRemote && !isLoopback(cleanRemote)) {
+      return 401;
     }
-    return false;
   }
 
-  // 6. No declared site: only loopback remote clients (CLI, reverse proxy) are trusted
-  if (isLoopback(cleanRemote)) return true;
+  // 7. Verified loopback callers (local CLI, health checks, deploy.sh verify)
+  if (isLoopback(cleanRemote)) {
+    return undefined;
+  }
 
-  // 7. Fallback for test harnesses without remote socket where host header explicitly targets loopback
+  // Mock test requests without remoteAddress where host targets loopback
   if (!cleanRemote && host) {
-    const hostName = host.split(":")[0];
+    const hostName = host.split(':')[0];
     if (isLoopback(hostName)) {
-      return true;
+      return undefined;
     }
   }
 
-  return false;
+  // 8. Remote / LAN callers must be authenticated via DSH connection service (#172)
+  const conn = connection || (ctx && getConnection(ctx)) || req.connectionService;
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection;
+    try {
+      rejection = conn.requestRejection(req);
+    } catch {
+      return 403;
+    }
+    if (rejection !== undefined) {
+      if (typeof rejection === 'number' && Number.isInteger(rejection) && rejection >= 400 && rejection < 600) {
+        return rejection;
+      }
+      return rejection === 401 ? 401 : 403;
+    }
+    return undefined;
+  }
+
+  // 9. Fail-closed: Remote/LAN caller without connection service or valid token is rejected
+  return 401;
+}
+
+export function isTrustedCaller(req, optionsOrToken = process.env.DSH_GOAL_AUTH_TOKEN, maybeCtx = null) {
+  return getRequestRejection(req, optionsOrToken, maybeCtx) === undefined;
 }
 
 export { isPathInsideOrEqual, getSafeCwd };
@@ -218,10 +306,11 @@ export function registerRoutes(ctx, {
 
         // GET /dsh-goal/events: Server-Sent Events realtime snapshot stream
         if (req.method === 'GET' && (pathname === '/dsh-goal/events' || pathname === '/dsh-goal/events/')) {
-          if (!isTrustedCaller(req)) {
-            res.statusCode = 403;
+          const rejection = getRequestRejection(req, { ctx });
+          if (rejection !== undefined) {
+            res.statusCode = rejection;
             if (typeof res.setHeader === 'function') res.setHeader('Content-Type', 'application/json; charset=utf-8');
-            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+            return res.end(JSON.stringify({ error: rejection === 401 ? 'Unauthorized: authentication required' : 'Forbidden: untrusted caller origin' }));
           }
           const sid = sessionIdOf(req, 'default');
           if (typeof res.writeHead === 'function') {
@@ -265,9 +354,10 @@ export function registerRoutes(ctx, {
 
         // GET /dsh-goal/templates
         if (req.method === 'GET' && (pathname === '/dsh-goal/templates' || pathname === '/dsh-goal/templates/')) {
-          if (!isTrustedCaller(req)) {
-            res.statusCode = 403;
-            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          const rejection = getRequestRejection(req, { ctx });
+          if (rejection !== undefined) {
+            res.statusCode = rejection;
+            return res.end(JSON.stringify({ error: rejection === 401 ? 'Unauthorized: authentication required' : 'Forbidden: untrusted caller origin' }));
           }
           res.statusCode = 200;
           return res.end(JSON.stringify({ ok: true, templates: getTemplatesCatalogue() }));
@@ -275,9 +365,10 @@ export function registerRoutes(ctx, {
 
         // GET /dsh-goal/state
         if (req.method === 'GET' && (pathname === '/dsh-goal/state' || pathname === '/dsh-goal/state/')) {
-          if (!isTrustedCaller(req)) {
-            res.statusCode = 403;
-            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          const rejection = getRequestRejection(req, { ctx });
+          if (rejection !== undefined) {
+            res.statusCode = rejection;
+            return res.end(JSON.stringify({ error: rejection === 401 ? 'Unauthorized: authentication required' : 'Forbidden: untrusted caller origin' }));
           }
           const sid = sessionIdOf(req, 'default');
           res.statusCode = 200;
@@ -316,9 +407,10 @@ export function registerRoutes(ctx, {
             }
           }
 
-          if (!isTrustedCaller(req)) {
-            res.statusCode = 403;
-            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          const rejection = getRequestRejection(req, { ctx });
+          if (rejection !== undefined) {
+            res.statusCode = rejection;
+            return res.end(JSON.stringify({ error: rejection === 401 ? 'Unauthorized: authentication required' : 'Forbidden: untrusted caller origin' }));
           }
 
           let body = '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.25",
+  "version": "0.2.26",
   "description": "Core Goal Addon (Token Budget, Milestones, Git Snapshots & Retrospective Reports) for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",