@goodandready/dsh-kanban 0.2.33 → 0.2.35

package/lib/routes/security.js

@@ -0,0 +1,274 @@
+import crypto from 'node:crypto'
+
+export const MAX_BODY_BYTES = 256 * 1024
+
+export function isLoopbackAddress(addr) {
+  if (!addr || typeof addr !== 'string') return false
+  const clean = addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+  return (
+    clean === '127.0.0.1' ||
+    clean === '::1' ||
+    clean === 'localhost' ||
+    clean === 'localhost.' ||
+    clean.startsWith('127.')
+  )
+}
+
+export function isLanAddress(addr) {
+  if (!addr || typeof addr !== 'string') return false
+  const clean = addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+  if (isLoopbackAddress(clean)) return true
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
+  const m = clean.match(/^172\.(\d+)\./)
+  if (m) {
+    const octet = parseInt(m[1], 10)
+    if (octet >= 16 && octet <= 31) return true
+  }
+  return false
+}
+
+export function isTrustedHost(host) {
+  if (!host || typeof host !== 'string') return false
+  let hostname = host.trim()
+  if (hostname.startsWith('[')) {
+    const end = hostname.indexOf(']')
+    if (end > 0) hostname = hostname.slice(1, end)
+  } else {
+    hostname = hostname.split(':')[0]
+  }
+  hostname = hostname.toLowerCase()
+  if (!hostname) return false
+  if (hostname === 'localhost' || hostname === 'localhost.' || hostname.endsWith('.local')) return true
+  if (isLoopbackAddress(hostname) || isLanAddress(hostname)) return true
+  return false
+}
+
+export function normalizeIp(addr) {
+  if (!addr || typeof addr !== 'string') return ''
+  return addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+}
+
+export function cookieNameForAuthority(authority) {
+  if (!authority || typeof authority !== 'string') return ''
+  const hash = crypto.createHash('sha256').update(authority.trim()).digest('base64url')
+  return 'dsh-auth-' + hash
+}
+
+export function isLoopbackCookieName(name, host = '') {
+  if (!name || typeof name !== 'string' || !name.startsWith('dsh-auth-')) return false
+  const authorities = [
+    host,
+    '127.0.0.1:3000',
+    '127.0.0.1:3080',
+    '127.0.0.1:3082',
+    '127.0.0.1',
+    'localhost:3000',
+    'localhost:3080',
+    'localhost:3082',
+    'localhost',
+    '[::1]:3000',
+    '[::1]',
+  ]
+  for (const auth of authorities) {
+    if (auth && isLoopbackAddress(auth.split(':')[0])) {
+      if (cookieNameForAuthority(auth) === name) return true
+    }
+  }
+  return false
+}
+
+export function hasClientCredentials(req) {
+  if (!req || !req.headers) return false
+  if (req.headers.authorization) return true
+  if (req.headers['x-dsh-lan-pin']) return true
+  const cookie = req.headers.cookie
+  if (!cookie || typeof cookie !== 'string') return false
+  if (cookie.includes('dsh_token=') || cookie.includes('dsh_lan_pin=')) return true
+
+  const parts = cookie.split(';')
+  for (const part of parts) {
+    const trimmed = part.trim()
+    const eqIdx = trimmed.indexOf('=')
+    if (eqIdx === -1) continue
+    const name = trimmed.slice(0, eqIdx).trim()
+    if (name.startsWith('dsh-auth-')) {
+      if (!isLoopbackCookieName(name, req.headers.host)) {
+        return true
+      }
+    }
+  }
+  return false
+}
+
+export function getClientIp(req) {
+  const socketAddress =
+    req?.socket?.remoteAddress ||
+    req?.connection?.remoteAddress ||
+    req?.info?.remoteAddress ||
+    ''
+  const socketIp = normalizeIp(socketAddress)
+  const xff = req?.headers?.['x-forwarded-for']
+  if (xff && typeof xff === 'string' && (isLoopbackAddress(socketIp) || !socketIp)) {
+    const first = xff.split(',')[0].trim()
+    if (first) {
+      return normalizeIp(first)
+    }
+  }
+  return socketIp
+}
+
+/**
+ * Cross-site request, DNS rebinding, and authentication validation (#261, #369, #384).
+ *
+ * Requirements:
+ * 1. If DSH connection service is available (options.connection), requestRejection(req)
+ *    is the authoritative gate for browser session authentication and trusted network access.
+ *    If rejection is returned, the numeric status (e.g. 401 or 403) is returned.
+ * 2. Host header is required and must target a trusted host (loopback, LAN, .local).
+ * 3. Cross-site requests ('sec-fetch-site: cross-site' or origin mismatch) are rejected with 403.
+ * 4. Origin & Referer headers (if present) must match Host or a trusted host.
+ * 5. Network boundary validation:
+ *    - Loopback callers (127.0.0.1, ::1) are allowed.
+ *    - Non-loopback / LAN callers require valid connection authentication (fail-closed, return 401).
+ *    - Unknown remote address (socket present but empty remoteAddress) fails closed with 403.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ connection?: { requestRejection?: (req: any) => number | undefined } }} [options]
+ * @returns {number|undefined} Rejection HTTP status code (401, 403), or undefined if allowed.
+ */
+export function getRejectionStatus(req, options = {}) {
+  const connection = options?.connection
+  if (connection && typeof connection.requestRejection === 'function') {
+    try {
+      const rejection = connection.requestRejection(req)
+      if (rejection !== undefined) {
+        if (typeof rejection === 'number' && Number.isInteger(rejection) && rejection >= 400 && rejection < 600) {
+          return rejection
+        }
+        return rejection === 401 ? 401 : 403
+      }
+    } catch {
+      // Fail closed if connection service throws
+      return 403
+    }
+  }
+
+  if (!req || !req.headers) return 403
+
+  const host = req.headers.host
+  if (!host || !isTrustedHost(host)) {
+    return 403
+  }
+
+  const site = req.headers['sec-fetch-site']
+
+  // 1. Explicit cross-site or same-site requests are rejected
+  if (site === 'cross-site' || site === 'same-site') {
+    return 403
+  }
+
+  // 2. Validate origin against trusted hosts and host header
+  const origin = req.headers.origin
+  if (origin !== undefined) {
+    if (origin === 'null' || !origin) return 403
+    try {
+      const parsed = new URL(origin)
+      if (!isTrustedHost(parsed.hostname)) return 403
+      if (parsed.host && parsed.host !== host) return 403
+    } catch {
+      return 403
+    }
+  }
+
+  // 3. Validate referer against trusted hosts and host header if present
+  const referer = req.headers.referer
+  if (referer !== undefined && referer) {
+    try {
+      const parsedRef = new URL(referer)
+      if (!isTrustedHost(parsedRef.hostname)) return 403
+      if (parsedRef.host && parsedRef.host !== host) return 403
+    } catch {
+      return 403
+    }
+  }
+
+  // 4. Validate remote address and network boundary
+  const hasSocket = !!(req.socket || req.connection)
+  const remote = getClientIp(req)
+
+  if (hasSocket) {
+    if (!remote) {
+      return 403
+    }
+    if (!isLoopbackAddress(remote) && !isLanAddress(remote)) {
+      return 403
+    }
+    // Remote / LAN callers without connection authentication are rejected (#384)
+    if (!isLoopbackAddress(remote)) {
+      if (!connection) {
+        return 401
+      }
+      // If request was forwarded through a reverse proxy (x-forwarded-for),
+      // the proxy may have injected loopback credentials. Validate that the client
+      // itself supplied authentic credentials (bearer token, PIN, or client session cookie).
+      const xff = req.headers['x-forwarded-for']
+      if (xff && !hasClientCredentials(req)) {
+        return 401
+      }
+    }
+  } else {
+    // Synthetic mock request without socket
+    const xff = req.headers['x-forwarded-for']
+    if (xff) {
+      const first = xff.split(',')[0].trim()
+      if (first && !isLoopbackAddress(normalizeIp(first))) {
+        if (!connection || !hasClientCredentials(req)) {
+          return 401
+        }
+      }
+    } else if (!connection) {
+      const hostname = String(host).split(':')[0].toLowerCase()
+      if (!isLoopbackAddress(hostname) && hostname !== 'localhost') {
+        return 401
+      }
+    }
+  }
+
+  // 5. Browser request with declared site:
+  // Must be same-origin or none
+  if (site && site !== 'same-origin' && site !== 'none') {
+    return 403
+  }
+
+  // 6. Request without declared site from non-loopback requires connection
+  if (!site && remote && !isLoopbackAddress(remote) && !connection) {
+    return 401
+  }
+
+  return undefined
+}
+
+export function isTrustedRequest(req, options = {}) {
+  return getRejectionStatus(req, options) === undefined
+}
+
+export function rejectUntrustedRequest(req, res, options = {}) {
+  const status = getRejectionStatus(req, options)
+  if (status !== undefined) {
+    try {
+      res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Cache-Control': 'no-store',
+      })
+      res.end(
+        JSON.stringify({
+          error: status === 401 ? 'unauthorized' : 'cross-site',
+        })
+      )
+    } catch {
+      /* socket closed */
+    }
+    return true
+  }
+  return false
+}

package/lib/routes/task-actions.js

@@ -0,0 +1,345 @@
+/**
+ * Extended actions for task route handlers (comments, reports, checklist, triage, subtasks, PR, nudge).
+ * Zero Cyrillic in lib/ according to Issue #366.
+ */
+
+export function handleTaskChecklist({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const list = Array.isArray(input?.checklist) ? input.checklist : Array.isArray(input) ? input : []
+  const updated = store.updateChecklist(task.id, list)
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Set completion report for task.
+ */
+export function handleTaskReport({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const updated = store.setReport(task.id, input)
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Get comments for task.
+ */
+export function handleGetTaskComments({ task }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  return { status: 200, body: { comments: task.comments || [] } }
+}
+
+/**
+ * Add comment to task.
+ */
+export function handleAddTaskComment({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const author = input?.author || 'user'
+  const role = input?.role || 'user'
+  const text = input?.text || ''
+  const updated = store.addComment(task.id, { author, role, text })
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Accept task review (transition to done).
+ */
+export function handleAcceptTask({ store, task }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const updated = store.acceptTask(task.id)
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Reject task review (return to in_progress).
+ */
+export function handleRejectTask({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const reason = String(input?.reason || '').trim()
+  if (!reason) return { status: 400, body: { error: 'reason-required' } }
+  const updated = store.rejectTask(task.id, reason)
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Save task progress dump snapshot.
+ */
+export function handleProgressDump({ store, task, input, formatProgressDump }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const formatted = typeof input === 'string' ? input : formatProgressDump(input)
+  const updated = store.updateTask(task.id, { progressDump: formatted })
+  return { status: 200, body: { task: updated } }
+}
+
+/**
+ * Decompose a task into subtasks and make the parent an Epic.
+ */
+export async function handleTriageTask({ store, gitea, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const subtasksInput = Array.isArray(input?.subtasks) ? input.subtasks : []
+  if (subtasksInput.length === 0) {
+    return { status: 400, body: { error: 'subtasks-required' } }
+  }
+  const createGitea = input?.createGiteaIssues === true && Boolean(task.owner && task.repo && gitea)
+
+  // Convert parent into Epic
+  store.updateTask(task.id, { isEpic: true })
+
+  const created = []
+  for (const item of subtasksInput) {
+    const title = String(item?.title ?? '').trim()
+    if (!title) continue
+    const body = String(item?.body ?? '').trim()
+    let issueNumber = null
+    let issueUrl = null
+
+    if (createGitea) {
+      try {
+        const issueBody = body ? `${body}\n\nParent epic: #${task.issueNumber || task.id}` : `Parent epic: #${task.issueNumber || task.id}`
+        const giteaIssue = await gitea.createIssue({
+          owner: task.owner,
+          repo: task.repo,
+          title,
+          body: issueBody,
+        })
+        if (giteaIssue?.number) {
+          issueNumber = giteaIssue.number
+          issueUrl = giteaIssue.html_url || null
+        }
+      } catch { /* ignore gitea subtask creation failure */ }
+    }
+
+    const sub = store.createTask({
+      board: task.board || 'main',
+      column: 'backlog',
+      title,
+      body,
+      parentId: task.id,
+      owner: task.owner || null,
+      repo: task.repo || null,
+      issueNumber,
+      issueUrl,
+      labels: Array.isArray(item?.labels) ? item.labels : [],
+      workspaceId: task.workspaceId || '',
+    })
+    created.push(sub)
+  }
+
+  store.addTransition({
+    taskId: task.id,
+    fromCol: task.column,
+    toCol: task.column,
+    source: 'manual',
+    detail: `decomposed into ${created.length} subtasks (epic triage)`,
+  })
+
+  return {
+    status: 200,
+    body: {
+      epic: store.getTask(task.id),
+      subtasks: store.listSubtasks(task.id),
+      counts: store.countSubtasks(task.id),
+      createdCount: created.length,
+    },
+  }
+}
+
+/**
+ * Get subtasks of a task.
+ */
+export function handleGetSubtasks({ store, task }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  return {
+    status: 200,
+    body: {
+      subtasks: store.listSubtasks(task.id),
+      counts: store.countSubtasks(task.id),
+    },
+  }
+}
+
+/**
+ * Create a single subtask linked to a parent task.
+ */
+export async function handleCreateSubtask({ store, gitea, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const title = String(input?.title ?? '').trim()
+  if (!title) return { status: 400, body: { error: 'title-required' } }
+  const body = String(input?.body ?? '').trim()
+  let issueNumber = null
+  let issueUrl = null
+
+  if (input?.createGiteaIssue === true && task.owner && task.repo && gitea) {
+    try {
+      const issueBody = body ? `${body}\n\nParent epic: #${task.issueNumber || task.id}` : `Parent epic: #${task.issueNumber || task.id}`
+      const giteaIssue = await gitea.createIssue({
+        owner: task.owner,
+        repo: task.repo,
+        title,
+        body: issueBody,
+      })
+      if (giteaIssue?.number) {
+        issueNumber = giteaIssue.number
+        issueUrl = giteaIssue.html_url || null
+      }
+    } catch { /* ignore gitea subtask creation failure */ }
+  }
+
+  store.updateTask(task.id, { isEpic: true })
+  const sub = store.createTask({
+    board: task.board || 'main',
+    column: input?.column || 'backlog',
+    title,
+    body,
+    parentId: task.id,
+    owner: task.owner || null,
+    repo: task.repo || null,
+    issueNumber,
+    issueUrl,
+    labels: Array.isArray(input?.labels) ? input.labels : [],
+    workspaceId: task.workspaceId || '',
+  })
+  return { status: 200, body: { subtask: sub, counts: store.countSubtasks(task.id) } }
+}
+
+/**
+ * Toggle a checklist item atomically by index or text.
+ */
+export function handleToggleChecklistItem({ store, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  const current = Array.isArray(task.checklist) ? [...task.checklist] : []
+  let targetIndex = -1
+
+  if (typeof input?.index === 'number' && input.index >= 0 && input.index < current.length) {
+    targetIndex = input.index
+  } else if (typeof input?.text === 'string' && input.text.trim()) {
+    const q = input.text.trim().toLowerCase()
+    targetIndex = current.findIndex((item) => {
+      const t = typeof item === 'string' ? item : item?.text
+      return typeof t === 'string' && t.toLowerCase().includes(q)
+    })
+  }
+
+  if (targetIndex === -1) {
+    return { status: 404, body: { error: 'checklist-item-not-found' } }
+  }
+
+  const item = current[targetIndex]
+  let updatedItem
+  if (typeof item === 'string') {
+    const checked = input?.checked !== undefined ? Boolean(input.checked) : true
+    updatedItem = { text: item, completed: checked, done: checked }
+  } else {
+    const isCurrentlyDone = item.completed !== undefined ? Boolean(item.completed) : Boolean(item.done)
+    const checked = input?.checked !== undefined ? Boolean(input.checked) : !isCurrentlyDone
+    updatedItem = { ...item, completed: checked, done: checked }
+  }
+  current[targetIndex] = updatedItem
+  const updated = store.updateChecklist(task.id, current)
+  return { status: 200, body: { task: updated, item: updatedItem, index: targetIndex } }
+}
+
+/**
+ * Create a Gitea Pull Request for a task.
+ */
+export async function handleCreateTaskPr({ store, gitea, task, input }) {
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+  if (!task.owner || !task.repo) {
+    return { status: 400, body: { error: 'task-no-repo' } }
+  }
+  const head = String(input?.head || task.branch || '').trim()
+  if (!head) return { status: 400, body: { error: 'branch-required' } }
+  const base = String(input?.base || 'main').trim()
+  const title = String(input?.title || task.title || `PR: ${task.title}`).trim()
+  const body = String(input?.body || (task.issueNumber ? `Closes #${task.issueNumber}` : '')).trim()
+
+  try {
+    const pr = await gitea.createPullRequest({
+      owner: task.owner,
+      repo: task.repo,
+      title,
+      body,
+      head,
+      base,
+    })
+    store.addTransition({
+      taskId: task.id,
+      fromCol: task.column,
+      toCol: task.column,
+      source: 'manual',
+      detail: `Created PR #${pr?.number || ''}: ${head} -> ${base}`,
+    })
+    return { status: 200, body: { pr, prUrl: pr?.html_url } }
+  } catch (err) {
+    return { status: 502, body: { error: 'gitea-pr-failed', detail: err?.message } }
+  }
+}
+/**
+ * Handle interactive live steering (nudge) for an active task agent (#373).
+ *
+ * @param {{
+ *   store: object,
+ *   id: string,
+ *   prompt: string,
+ *   agents?: object,
+ *   createMessage?: Function,
+ *   eventHub?: object,
+ *   now?: number
+ * }} options
+ * @returns {Promise<{ status: number, body: object }>}
+ */
+export async function handleTaskNudge({ store, id, prompt, agents, createMessage, eventHub, now = Date.now() }) {
+  if (!store || !id) return { status: 400, body: { error: 'invalid-parameters' } }
+  const task = store.getTask(id)
+  if (!task) return { status: 404, body: { error: 'task-not-found' } }
+
+  const text = typeof prompt === 'string' ? prompt.trim() : ''
+  if (!text) return { status: 400, body: { error: 'prompt-required' } }
+
+  const sessionId = typeof task.sessionId === 'string' ? task.sessionId : ''
+  if (!sessionId) return { status: 409, body: { error: 'no-session' } }
+
+  let agent
+  try { agent = agents?.get?.(sessionId) } catch { agent = undefined }
+  if (!agent || typeof agent.followup !== 'function') {
+    return { status: 409, body: { error: 'session-not-live' } }
+  }
+
+  const msg = typeof createMessage === 'function'
+    ? createMessage({
+        content: [{ type: 'text', text }],
+        source: { kind: 'dsh-kanban', plugin: 'dsh-kanban', form: 'task-nudge' },
+      })
+    : { content: [{ type: 'text', text }] }
+
+  agent.followup(msg)
+
+  // Append user steering comment to task
+  if (typeof store.addComment === 'function') {
+    store.addComment(id, {
+      author: 'user',
+      role: 'user',
+      text: `[Steering Nudge] ${text}`,
+    })
+  } else if (typeof store.addTaskComment === 'function') {
+    store.addTaskComment(id, {
+      author: 'user',
+      role: 'user',
+      text: `[Steering Nudge] ${text}`,
+    })
+  }
+
+  // Broadcast change via eventHub
+  if (eventHub && typeof eventHub.broadcast === 'function') {
+    eventHub.broadcast('task:change', { id, col: task.col || task.column })
+  }
+
+  return {
+    status: 200,
+    body: {
+      success: true,
+      id,
+      sessionId,
+      prompt: text,
+      nudgedAt: now,
+    },
+  }
+}