@goodandready/dsh-kanban 0.2.30 → 0.2.31

package/lib/index.js

@@ -111,7 +111,7 @@ export const name = '@goodandready/dsh-kanban'
  * Services are injected where needed. Declaring an unavailable service prevents
  * the plugin from loading entirely.
  */
-export const inject = ['settings', 'webServer', 'agents', 'agentDefaultModel', 'credentials', 'llm', 'tools']
+export const inject = ['settings', 'webServer', 'agents', 'agentDefaultModel', 'credentials', 'llm', 'tools', 'connection']
 
 /** Settings namespace string matching client bundle definition. */
 // Constant string defined in this file; identical across core versions.

package/lib/routes.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto'
 // HTTP route handlers for the board.
 //
 // The client bundle runs in the browser without direct access to SQLite or host services;
@@ -57,13 +58,78 @@ export function isTrustedHost(host) {
   return false
 }
 
+export function normalizeIp(addr) {
+  if (!addr || typeof addr !== 'string') return ''
+  return addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+}
+
+export function cookieNameForAuthority(authority) {
+  if (!authority || typeof authority !== 'string') return ''
+  const hash = crypto.createHash('sha256').update(authority.trim()).digest('base64url')
+  return 'dsh-auth-' + hash
+}
+
+export function isLoopbackCookieName(name, host = '') {
+  if (!name || typeof name !== 'string' || !name.startsWith('dsh-auth-')) return false
+  const authorities = [
+    host,
+    '127.0.0.1:3000',
+    '127.0.0.1:3080',
+    '127.0.0.1:3082',
+    '127.0.0.1',
+    'localhost:3000',
+    'localhost:3080',
+    'localhost:3082',
+    'localhost',
+    '[::1]:3000',
+    '[::1]',
+  ]
+  for (const auth of authorities) {
+    if (auth && isLoopbackAddress(auth.split(':')[0])) {
+      if (cookieNameForAuthority(auth) === name) return true
+    }
+  }
+  return false
+}
+
+export function hasClientCredentials(req) {
+  if (!req || !req.headers) return false
+  if (req.headers.authorization) return true
+  if (req.headers['x-dsh-lan-pin']) return true
+  const cookie = req.headers.cookie
+  if (!cookie || typeof cookie !== 'string') return false
+  if (cookie.includes('dsh_token=') || cookie.includes('dsh_lan_pin=')) return true
+
+  const parts = cookie.split(';')
+  for (const part of parts) {
+    const trimmed = part.trim()
+    const eqIdx = trimmed.indexOf('=')
+    if (eqIdx === -1) continue
+    const name = trimmed.slice(0, eqIdx).trim()
+    if (name.startsWith('dsh-auth-')) {
+      if (!isLoopbackCookieName(name, req.headers.host)) {
+        return true
+      }
+    }
+  }
+  return false
+}
+
 export function getClientIp(req) {
-  return (
+  const socketAddress =
     req?.socket?.remoteAddress ||
     req?.connection?.remoteAddress ||
     req?.info?.remoteAddress ||
     ''
-  )
+  const socketIp = normalizeIp(socketAddress)
+  const xff = req?.headers?.['x-forwarded-for']
+  if (xff && typeof xff === 'string' && (isLoopbackAddress(socketIp) || !socketIp)) {
+    const first = xff.split(',')[0].trim()
+    if (first) {
+      return normalizeIp(first)
+    }
+  }
+  return socketIp
 }
 
 /**
@@ -157,12 +223,29 @@ export function getRejectionStatus(req, options = {}) {
       if (!connection) {
         return 401
       }
+      // If request was forwarded through a reverse proxy (x-forwarded-for),
+      // the proxy may have injected loopback credentials. Validate that the client
+      // itself supplied authentic credentials (bearer token, PIN, or client session cookie).
+      const xff = req.headers['x-forwarded-for']
+      if (xff && !hasClientCredentials(req)) {
+        return 401
+      }
     }
-  } else if (!connection) {
-    // Synthetic mock request without socket: allow loopback host for unit tests
-    const hostname = String(host).split(':')[0].toLowerCase()
-    if (!isLoopbackAddress(hostname) && hostname !== 'localhost') {
-      return 401
+  } else {
+    // Synthetic mock request without socket
+    const xff = req.headers['x-forwarded-for']
+    if (xff) {
+      const first = xff.split(',')[0].trim()
+      if (first && !isLoopbackAddress(normalizeIp(first))) {
+        if (!connection || !hasClientCredentials(req)) {
+          return 401
+        }
+      }
+    } else if (!connection) {
+      const hostname = String(host).split(':')[0].toLowerCase()
+      if (!isLoopbackAddress(hostname) && hostname !== 'localhost') {
+        return 401
+      }
     }
   }
 

package/lib/updater.js

@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
+import { hasClientCredentials } from './routes.js'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -56,8 +57,14 @@ export function isTrustedUpdateRequest(request, targetCtx = null) {
     }
     if (rejection !== undefined) return false
   }
-  const remote = request.socket?.remoteAddress
+  const socketAddress = request.socket?.remoteAddress
+  const xff = header(request, 'x-forwarded-for')
+  let remote = socketAddress
+  if (xff && isLoopback(socketAddress)) {
+    remote = xff.split(',')[0].trim()
+  }
   if (!isLoopback(remote) && !isPrivateLan(remote)) return false
+  if (!isLoopback(remote) && xff && !hasClientCredentials(request)) return false
   const site = header(request, 'sec-fetch-site')
   if (!site || (site !== 'same-origin' && site !== 'same-site' && site !== 'none')) return false
   const origin = header(request, 'origin')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.30",
+  "version": "0.2.31",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",