@goodandready/dsh-kanban 0.2.29 → 0.2.31

package/lib/index.js

@@ -12,6 +12,8 @@ import { registerPluginUpdater } from './updater.js'
 import {
   MAX_BODY_BYTES,
   isTrustedRequest,
+  rejectUntrustedRequest,
+  getRejectionStatus,
   parseTaskPath,
   buildBoard,
   applyMove,
@@ -109,7 +111,7 @@ export const name = '@goodandready/dsh-kanban'
  * Services are injected where needed. Declaring an unavailable service prevents
  * the plugin from loading entirely.
  */
-export const inject = ['settings', 'webServer', 'agents', 'agentDefaultModel', 'credentials', 'llm', 'tools']
+export const inject = ['settings', 'webServer', 'agents', 'agentDefaultModel', 'credentials', 'llm', 'tools', 'connection']
 
 /** Settings namespace string matching client bundle definition. */
 // Constant string defined in this file; identical across core versions.
@@ -634,12 +636,36 @@ export function apply(ctx, config) {
     return () => { rearmers.delete(arm); clearInterval(timer) }
   }, 'dsh-kanban: sync timer')
 
+  const resolveConnection = () => {
+    try {
+      if (ctx && typeof ctx.get === 'function') {
+        const c = ctx.get('connection')
+        if (c) return c
+      }
+    } catch { /* ignore */ }
+    try {
+      if (ctx && ctx.connection) {
+        return ctx.connection
+      }
+    } catch { /* ignore */ }
+    return undefined
+  }
+
+  const routeOptions = () => ({
+    get connection() {
+      return resolveConnection()
+    },
+  })
+
+  const isTrusted = (req) => isTrustedRequest(req, routeOptions())
+  const rejectUntrusted = (req, res) => rejectUntrustedRequest(req, res, routeOptions())
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-kanban/project-task',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       try {
         const input = await readBody(req)
         reply(res, await createProjectTask({
@@ -661,7 +687,7 @@ export function apply(ctx, config) {
     // Both services are optional in minimal environments. Empty lists render gracefully.
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const presets = ctx.get('agentPresets')
       const permissions = ctx.get('permissionPresets')
       let agentPresets = []
@@ -698,7 +724,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/sessions',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       reply(res, { sessions: liveSessions({ store, agents: ctx.agents }) })
     },
   }), 'dsh-kanban: live sessions')
@@ -708,7 +734,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/batch',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       try {
         const input = await readBody(req)
         const ids = Array.isArray(input.ids) ? input.ids : []
@@ -740,7 +766,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/archive',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       reply(res, listArchive({ store }))
     },
   }), 'dsh-kanban: archive')
@@ -750,7 +776,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/sync',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       try {
         writeJson(res, 200, await runSync())
       } catch (error) {
@@ -846,7 +872,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/board',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const url = urlOf(req)
       reply(res, buildBoard({
         store,
@@ -881,7 +907,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/metrics',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const url = urlOf(req)
       const days = Number(url.searchParams.get('staleDays'))
       reply(res, boardMetrics({
@@ -898,7 +924,7 @@ export function apply(ctx, config) {
     // Empty login indicates unconfigured or unreachable Gitea; client omits "Mine" filter.
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       reply(res, { login: await whoAmI() })
     },
   }), 'dsh-kanban: whoami')
@@ -908,7 +934,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/export.csv',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const u = urlOf(req)
       const board = u.searchParams.get('board') || 'main'
       const csv = exportTasksCsv({ store, board })
@@ -925,7 +951,7 @@ export function apply(ctx, config) {
     kind: 'exact',
     path: '/dsh-kanban/events',
     handler: (req, res) => {
-      eventHub.handleSseRequest(req, res, { isTrustedRequest })
+      eventHub.handleSseRequest(req, res, { isTrustedRequest: isTrusted })
     },
   }), 'dsh-kanban: sse events stream')
 
@@ -941,7 +967,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/templates',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const u = new URL(req.url, 'http://localhost')
       const tid = u.searchParams.get('id')
       if (tid) {
@@ -958,7 +984,7 @@ export function apply(ctx, config) {
     kind: 'exact',
     path: '/dsh-kanban/snapshot',
     handler: async (req, res) => {
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       if (req.method === 'GET') { reply(res, exportBoard({ store })); return }
       if (req.method !== 'POST') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
       try {
@@ -984,7 +1010,7 @@ export function apply(ctx, config) {
       // Path without ID handles local task creation.
       if (pathname === '/dsh-kanban/task' || pathname === '/dsh-kanban/task/') {
         if (req.method !== 'POST') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-        if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+        if (rejectUntrusted(req, res)) return
         try {
           const resObj = createTask({ store, input: await readBody(req) })
           if (resObj?.task) {
@@ -1001,7 +1027,7 @@ export function apply(ctx, config) {
       if (parsed === undefined) { writeJson(res, 404, { error: 'not-found' }); return }
       const { id, action } = parsed
 
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
 
       if (req.method === 'GET' && action === 'log') { reply(res, taskLog({ store, id })); return }
       if (req.method === 'GET' && action === 'body') { reply(res, taskBody({ store, id })); return }
@@ -1393,7 +1419,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/gitea/repos',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const url = urlOf(req)
       reply(res, await searchRepos({ gitea: git, query: url.searchParams.get('q') || '' }))
     },
@@ -1404,7 +1430,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/gitea/issues',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const url = urlOf(req)
       reply(res, await listImportable({
         gitea: git,
@@ -1421,7 +1447,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/import',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       try {
         const input = await readBody(req)
         reply(res, await importIssue({
@@ -1442,7 +1468,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/models',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const current = ctx.get('agentDefaultModel')?.currentSelection?.() ?? null
       const llmService = ctx.get('llm')
       let providers = []
@@ -1471,7 +1497,7 @@ export function apply(ctx, config) {
     path: '/dsh-kanban/session',
     handler: (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { error: 'method-not-allowed' }); return }
-      if (!isTrustedRequest(req)) { writeJson(res, 403, { error: 'cross-site' }); return }
+      if (rejectUntrusted(req, res)) return
       const m = /^\/dsh-kanban\/session\/([^/]+)\/task\/?$/.exec(urlOf(req).pathname)
       if (m === null) { writeJson(res, 404, { error: 'not-found' }); return }
       reply(res, taskBySession({ store, sessionId: decodeURIComponent(m[1]), agents: ctx.agents }))

package/lib/routes.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto'
 // HTTP route handlers for the board.
 //
 // The client bundle runs in the browser without direct access to SQLite or host services;
@@ -57,40 +58,140 @@ export function isTrustedHost(host) {
   return false
 }
 
+export function normalizeIp(addr) {
+  if (!addr || typeof addr !== 'string') return ''
+  return addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+}
+
+export function cookieNameForAuthority(authority) {
+  if (!authority || typeof authority !== 'string') return ''
+  const hash = crypto.createHash('sha256').update(authority.trim()).digest('base64url')
+  return 'dsh-auth-' + hash
+}
+
+export function isLoopbackCookieName(name, host = '') {
+  if (!name || typeof name !== 'string' || !name.startsWith('dsh-auth-')) return false
+  const authorities = [
+    host,
+    '127.0.0.1:3000',
+    '127.0.0.1:3080',
+    '127.0.0.1:3082',
+    '127.0.0.1',
+    'localhost:3000',
+    'localhost:3080',
+    'localhost:3082',
+    'localhost',
+    '[::1]:3000',
+    '[::1]',
+  ]
+  for (const auth of authorities) {
+    if (auth && isLoopbackAddress(auth.split(':')[0])) {
+      if (cookieNameForAuthority(auth) === name) return true
+    }
+  }
+  return false
+}
+
+export function hasClientCredentials(req) {
+  if (!req || !req.headers) return false
+  if (req.headers.authorization) return true
+  if (req.headers['x-dsh-lan-pin']) return true
+  const cookie = req.headers.cookie
+  if (!cookie || typeof cookie !== 'string') return false
+  if (cookie.includes('dsh_token=') || cookie.includes('dsh_lan_pin=')) return true
+
+  const parts = cookie.split(';')
+  for (const part of parts) {
+    const trimmed = part.trim()
+    const eqIdx = trimmed.indexOf('=')
+    if (eqIdx === -1) continue
+    const name = trimmed.slice(0, eqIdx).trim()
+    if (name.startsWith('dsh-auth-')) {
+      if (!isLoopbackCookieName(name, req.headers.host)) {
+        return true
+      }
+    }
+  }
+  return false
+}
+
+export function getClientIp(req) {
+  const socketAddress =
+    req?.socket?.remoteAddress ||
+    req?.connection?.remoteAddress ||
+    req?.info?.remoteAddress ||
+    ''
+  const socketIp = normalizeIp(socketAddress)
+  const xff = req?.headers?.['x-forwarded-for']
+  if (xff && typeof xff === 'string' && (isLoopbackAddress(socketIp) || !socketIp)) {
+    const first = xff.split(',')[0].trim()
+    if (first) {
+      return normalizeIp(first)
+    }
+  }
+  return socketIp
+}
+
 /**
- * Cross-site request and DNS rebinding validation (#261, #369).
- * Endpoints reject cross-site and DNS-rebinding requests:
- * 1. Host header is required and must target a trusted host (loopback, LAN, .local).
- * 2. Origin/Referer (if present) must target a trusted host and match Host header.
- * 3. Safe sec-fetch-site ('same-origin', 'same-site', 'none').
- * 4. Loopback or private LAN remoteAddress.
+ * Cross-site request, DNS rebinding, and authentication validation (#261, #369, #384).
+ *
+ * Requirements:
+ * 1. If DSH connection service is available (options.connection), requestRejection(req)
+ *    is the authoritative gate for browser session authentication and trusted network access.
+ *    If rejection is returned, the numeric status (e.g. 401 or 403) is returned.
+ * 2. Host header is required and must target a trusted host (loopback, LAN, .local).
+ * 3. Cross-site requests ('sec-fetch-site: cross-site' or origin mismatch) are rejected with 403.
+ * 4. Origin & Referer headers (if present) must match Host or a trusted host.
+ * 5. Network boundary validation:
+ *    - Loopback callers (127.0.0.1, ::1) are allowed.
+ *    - Non-loopback / LAN callers require valid connection authentication (fail-closed, return 401).
+ *    - Unknown remote address (socket present but empty remoteAddress) fails closed with 403.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ connection?: { requestRejection?: (req: any) => number | undefined } }} [options]
+ * @returns {number|undefined} Rejection HTTP status code (401, 403), or undefined if allowed.
  */
-export function isTrustedRequest(req) {
-  if (!req || !req.headers) return false
+export function getRejectionStatus(req, options = {}) {
+  const connection = options?.connection
+  if (connection && typeof connection.requestRejection === 'function') {
+    try {
+      const rejection = connection.requestRejection(req)
+      if (rejection !== undefined) {
+        if (typeof rejection === 'number' && Number.isInteger(rejection) && rejection >= 400 && rejection < 600) {
+          return rejection
+        }
+        return rejection === 401 ? 401 : 403
+      }
+    } catch {
+      // Fail closed if connection service throws
+      return 403
+    }
+  }
+
+  if (!req || !req.headers) return 403
 
   const host = req.headers.host
   if (!host || !isTrustedHost(host)) {
-    return false
+    return 403
   }
 
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress
   const site = req.headers['sec-fetch-site']
 
   // 1. Explicit cross-site or same-site requests are rejected
   if (site === 'cross-site' || site === 'same-site') {
-    return false
+    return 403
   }
 
   // 2. Validate origin against trusted hosts and host header
   const origin = req.headers.origin
   if (origin !== undefined) {
-    if (origin === 'null' || !origin) return false
+    if (origin === 'null' || !origin) return 403
     try {
       const parsed = new URL(origin)
-      if (!isTrustedHost(parsed.hostname)) return false
-      if (parsed.host && parsed.host !== host) return false
+      if (!isTrustedHost(parsed.hostname)) return 403
+      if (parsed.host && parsed.host !== host) return 403
     } catch {
-      return false
+      return 403
     }
   }
 
@@ -99,36 +200,91 @@ export function isTrustedRequest(req) {
   if (referer !== undefined && referer) {
     try {
       const parsedRef = new URL(referer)
-      if (!isTrustedHost(parsedRef.hostname)) return false
-      if (parsedRef.host && parsedRef.host !== host) return false
+      if (!isTrustedHost(parsedRef.hostname)) return 403
+      if (parsedRef.host && parsedRef.host !== host) return 403
     } catch {
-      return false
+      return 403
     }
   }
 
-  // 4. Browser request with declared site:
-  // Must be same-origin or none (e.g. top-level navigation / bookmark / isolated subresource)
-  if (site === 'same-origin' || site === 'none') {
-    if (remote && !isLoopbackAddress(remote) && !isLanAddress(remote)) {
-      return false
+  // 4. Validate remote address and network boundary
+  const hasSocket = !!(req.socket || req.connection)
+  const remote = getClientIp(req)
+
+  if (hasSocket) {
+    if (!remote) {
+      return 403
+    }
+    if (!isLoopbackAddress(remote) && !isLanAddress(remote)) {
+      return 403
+    }
+    // Remote / LAN callers without connection authentication are rejected (#384)
+    if (!isLoopbackAddress(remote)) {
+      if (!connection) {
+        return 401
+      }
+      // If request was forwarded through a reverse proxy (x-forwarded-for),
+      // the proxy may have injected loopback credentials. Validate that the client
+      // itself supplied authentic credentials (bearer token, PIN, or client session cookie).
+      const xff = req.headers['x-forwarded-for']
+      if (xff && !hasClientCredentials(req)) {
+        return 401
+      }
+    }
+  } else {
+    // Synthetic mock request without socket
+    const xff = req.headers['x-forwarded-for']
+    if (xff) {
+      const first = xff.split(',')[0].trim()
+      if (first && !isLoopbackAddress(normalizeIp(first))) {
+        if (!connection || !hasClientCredentials(req)) {
+          return 401
+        }
+      }
+    } else if (!connection) {
+      const hostname = String(host).split(':')[0].toLowerCase()
+      if (!isLoopbackAddress(hostname) && hostname !== 'localhost') {
+        return 401
+      }
     }
-    return true
   }
 
-  // 5. Request without declared site:
-  // Allowed strictly for loopback remoteAddress (DSH Desktop Electron forwardWebRequest, local CLI, curl)
-  if (remote && isLoopbackAddress(remote)) {
-    return true
+  // 5. Browser request with declared site:
+  // Must be same-origin or none
+  if (site && site !== 'same-origin' && site !== 'none') {
+    return 403
   }
 
-  // 6. Fallback for test harnesses / mocks without socket where host header targets loopback
-  if (!remote && host) {
-    const hostName = String(host).split(':')[0]
-    if (isLoopbackAddress(hostName)) {
-      return true
-    }
+  // 6. Request without declared site from non-loopback requires connection
+  if (!site && remote && !isLoopbackAddress(remote) && !connection) {
+    return 401
   }
 
+  return undefined
+}
+
+export function isTrustedRequest(req, options = {}) {
+  return getRejectionStatus(req, options) === undefined
+}
+
+export function rejectUntrustedRequest(req, res, options = {}) {
+  const status = getRejectionStatus(req, options)
+  if (status !== undefined) {
+    try {
+      res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Cache-Control': 'no-store',
+      })
+      res.end(
+        JSON.stringify({
+          error: status === 401 ? 'unauthorized' : 'cross-site',
+        })
+      )
+    } catch {
+      /* socket closed */
+    }
+    return true
+  }
   return false
 }
 

package/lib/updater.js

@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
+import { hasClientCredentials } from './routes.js'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -42,10 +43,28 @@ function isPrivateLan(value) {
   )
 }
 
-export function isTrustedUpdateRequest(request) {
+export function isTrustedUpdateRequest(request, targetCtx = null) {
   if (header(request, UPDATE_HEADER) !== '1') return false
-  const remote = request.socket?.remoteAddress
+  const conn = (targetCtx && typeof targetCtx.get === 'function' ? targetCtx.get('connection') : null)
+    || targetCtx?.connection
+    || request?.connectionService
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(request)
+    } catch {
+      return false
+    }
+    if (rejection !== undefined) return false
+  }
+  const socketAddress = request.socket?.remoteAddress
+  const xff = header(request, 'x-forwarded-for')
+  let remote = socketAddress
+  if (xff && isLoopback(socketAddress)) {
+    remote = xff.split(',')[0].trim()
+  }
   if (!isLoopback(remote) && !isPrivateLan(remote)) return false
+  if (!isLoopback(remote) && xff && !hasClientCredentials(request)) return false
   const site = header(request, 'sec-fetch-site')
   if (!site || (site !== 'same-origin' && site !== 'same-site' && site !== 'none')) return false
   const origin = header(request, 'origin')
@@ -300,7 +319,7 @@ export function registerPluginUpdater(ctx, options) {
           response.end()
           return
         }
-        if (!isTrustedUpdateRequest(request)) {
+        if (!isTrustedUpdateRequest(request, ctx)) {
           json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
           return
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.29",
+  "version": "0.2.31",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",