@goodandready/dsh-kanban 0.2.34 → 0.2.36

package/lib/routes/board.js

@@ -0,0 +1,286 @@
+import { COLUMN_ORDER, columnsOf, wipLimitField, columnNamesOf } from '../config.js'
+import { parsePlan, planItems, planProgress, taskState, queuePosition } from '../plan.js'
+import { columnStats, doneWithin, stale } from '../metrics.js'
+import { isStale } from '../time.js'
+import { facetsOf, facetsOfTask, groupByRepo, sortByLife } from '../filters.js'
+import { computeNextRun } from '../cron.js'
+import { computeBlocksMap, checkTaskBlocked } from '../dependencies.js'
+
+export function withPlan(task, liveOf, config, now, sameSession) {
+  const plan = parsePlan(task.plan)
+  // Registry error implies agent unavailable; do not fail whole board render.
+  let live
+  try {
+    if (typeof liveOf === 'function' && task.sessionId) live = liveOf(task.sessionId)
+  } catch { live = undefined }
+  const liveStatus = typeof live === 'object' && live !== null ? live.status : live
+  const liveStep = typeof live === 'object' && live !== null
+    ? (live.step || live.activity || live.stateDetail || '')
+    : ''
+
+  const costMetrics = task.costMetrics || null
+  const costLimitExceeded = (config?.costMeterEnabled !== false && Number(config?.taskCostLimit) > 0 && costMetrics?.costUsd)
+    ? costMetrics.costUsd >= Number(config.taskCostLimit)
+    : Boolean(task.costLimitExceeded)
+
+  return {
+    ...task,
+    plan: { items: planItems(plan), progress: planProgress(plan) },
+    state: taskState({ task, live: liveStatus }),
+    liveStep: liveStep || task.liveStep || '',
+    costMetrics,
+    costLimitExceeded,
+    // Queue position calculated dynamically across active tasks in same session.
+    queuePos: queuePosition(task, sameSession),
+    // Label facets extracted on server for consistent client filtering.
+    facets: facetsOfTask(task),
+    // Stale calculation performed on host where configuration resides.
+    stale: isStale({
+      now,
+      updatedAt: task.updatedAt,
+      sessionId: task.sessionId,
+      afterMinutes: config?.staleAfterMin,
+    }),
+    // Overdue calculated on host using server clock.
+    overdue: typeof task.dueAt === 'number' && task.dueAt > 0 && task.dueAt < now,
+  }
+}
+
+/** Order tasks: by column, grouped by repository, with active tasks on top. */
+function orderForBoard(tasks, columns) {
+  const out = []
+  for (const column of columns) {
+    const inColumn = tasks.filter((t) => t.column === column)
+    for (const group of groupByRepo(sortByLife(inColumn))) out.push(...group.tasks)
+  }
+  // Retain tasks in columns not visible on current board to prevent data loss.
+  const seen = new Set(out.map((t) => t.id))
+  for (const task of tasks) if (!seen.has(task.id)) out.push(task)
+  return out
+}
+
+/**
+ * Build board response payload: columns in canonical order, tasks, and limits.
+ */
+export function buildBoard({ store, config, board = 'main', repo, liveOf, sync, projectRoot, costMeterAvailable = false }) {
+  // Uniform timestamp across snapshot calculation.
+  const now = Date.now()
+  // Tasks are sorted and grouped on server: repo grouping with active items first.
+  const raw = store.listTasks({ board, repo })
+  // Queue position scoped per session.
+  const bySession = new Map()
+  for (const task of raw) {
+    const id = typeof task.sessionId === 'string' ? task.sessionId : ''
+    if (id === '') continue
+    if (!bySession.has(id)) bySession.set(id, [])
+    bySession.get(id).push(task)
+  }
+  const blocksMap = computeBlocksMap(raw)
+  const tasks = orderForBoard(
+    raw.map((task) => {
+      const enriched = withPlan(task, liveOf, config, now, bySession.get(task.sessionId) ?? [])
+      if (task.isEpic) {
+        enriched.subtasksCount = store.countSubtasks(task.id)
+      }
+      enriched.blocks = blocksMap[task.id] || []
+      enriched.isBlocked = checkTaskBlocked(task, store).isBlocked
+      return enriched
+    }),
+    columnsOf(store.boardKind(board)),
+  )
+  const kind = store.boardKind(board)
+  // Column custom names sent from server; locale translation handled by client.
+  const names = columnNamesOf(config)
+  const columns = columnsOf(kind).map((id) => {
+    const count = tasks.filter((t) => t.column === id).length
+    const limit = wipLimitField(config, id)
+    return { id, name: names[id], count, limit, overLimit: limit !== undefined && count > limit }
+  })
+  // Filter counts calculated over all tasks on board.
+  return {
+    board, kind, now, boards: store.listBoards(), columns, tasks,
+    // Resolved project root {path, set} computed on host.
+    projectRoot: projectRoot ?? { path: '', set: false },
+
+    facets: facetsOf(tasks),
+    // Sync telemetry state attached directly to board snapshot.
+    sync: sync ?? { state: 'never' },
+    costMeterAvailable: Boolean(costMeterAvailable),
+    remoteMode: Boolean(config?.remoteMode),
+  }
+}
+
+/**
+ * Card move transition. WIP limit is advisory: move executes, and exceeded status
+ * is returned for UI highlighting.
+ */
+
+export function boardMetrics({ store, board = 'main', now = Date.now(), staleDays = 14 }) {
+  const tasks = store.listTasks({ board })
+  const byTask = new Map()
+  for (const row of store.listAllTransitions()) {
+    if (!byTask.has(row.taskId)) byTask.set(row.taskId, [])
+    byTask.get(row.taskId).push(row)
+  }
+  const rows = tasks.map((task) => ({ task, moves: byTask.get(task.id) ?? [] }))
+  const day = 24 * 60 * 60 * 1000
+
+  return {
+    tasks: tasks.length,
+    columns: columnStats(rows, now),
+    done: {
+      week: doneWithin(rows, now - 7 * day, now),
+      month: doneWithin(rows, now - 30 * day, now),
+    },
+    staleDays,
+    stale: stale(tasks, now, staleDays * day).slice(0, 50),
+  }
+}
+
+/**
+ * Check whether a task can be resumed.
+ * Eligible when task has recorded sessionId but no active agent is running.
+ */
+
+export function exportBoard({ store }) {
+  return store.exportAll()
+}
+
+/**
+ * Restore board from backup snapshot (idempotent; skips existing IDs).
+ *
+ * @returns {{imported: number, skipped: number, error?: string}}
+ */
+export function importBoard({ store, input }) {
+  let backupMeta = undefined
+  if (typeof store.backupDatabase === 'function') {
+    try {
+      backupMeta = store.backupDatabase()
+    } catch { /* backup best effort */ }
+  }
+  if (input === null || typeof input !== 'object') return { error: 'bad-import', status: 400 }
+  if (input.version !== 1) return { error: 'bad-import-version', status: 400 }
+  if (!Array.isArray(input.tasks)) return { error: 'bad-import', status: 400 }
+
+  let imported = 0
+  let skipped = 0
+
+  const doImport = () => {
+    for (const board of Array.isArray(input.boards) ? input.boards : []) {
+      if (typeof board?.id !== 'string' || board.id === '') continue
+      store.createBoard({
+        id: board.id,
+        title: board.title,
+        kind: board.kind,
+        position: board.position,
+        createdAt: board.createdAt,
+      })
+    }
+
+    for (const task of input.tasks) {
+      if (typeof task?.id !== 'string' || task.id === '') continue
+      if (store.getTask(task.id) !== undefined) { skipped += 1; continue }
+      if (typeof store.restoreTask === 'function') {
+        store.restoreTask(task)
+      } else {
+        store.createTask(task)
+      }
+      imported += 1
+    }
+
+    for (const trans of Array.isArray(input.transitions) ? input.transitions : []) {
+      if (typeof trans?.taskId !== 'string' || trans.taskId === '') continue
+      if (typeof store.restoreTransition === 'function') {
+        store.restoreTransition(trans)
+      } else if (typeof store.addTransition === 'function') {
+        store.addTransition(trans)
+      }
+    }
+  }
+
+  if (typeof store.withTransaction === 'function') {
+    store.withTransaction(doImport)
+  } else {
+    doImport()
+  }
+
+  return { imported, skipped, backup: backupMeta?.backup }
+}
+
+/**
+ * Export tasks to Excel-compatible CSV with UTF-8 BOM (#223).
+ *
+ * @param {{store: object, board?: string}} options
+ * @returns {string} CSV string with UTF-8 BOM prefix
+ */
+export function exportTasksCsv({ store, board = 'main' }) {
+  const tasks = store.listTasks({ board })
+  const headers = [
+    'ID',
+    'Title',
+    'Column',
+    'Priority',
+    'Repository',
+    'Issue #',
+    'Assignee',
+    'Model',
+    'Provider',
+    'Reasoning Effort',
+    'Workspace',
+    'Branch',
+    'Created',
+    'Updated',
+  ]
+
+  function escapeCsv(val) {
+    if (val === null || val === undefined) return ''
+    let str = String(val)
+    // OWASP CSV Injection mitigation (#340)
+    const trimmed = str.replace(/^[\s\t\r\n]+/, '')
+    if (/^[=+\-@\t\r]/.test(str) || (trimmed.length > 0 && /^[=+\-@]/.test(trimmed))) {
+      str = `'${str}`
+    }
+    if (str.includes(',') || str.includes('"') || str.includes('\n') || str.includes('\r')) {
+      return `"${str.replace(/"/g, '""')}"`
+    }
+    return str
+  }
+
+  function formatDate(ts) {
+    if (!ts || typeof ts !== 'number') return ''
+    try {
+      return new Date(ts).toISOString().replace('T', ' ').slice(0, 19)
+    } catch {
+      return ''
+    }
+  }
+
+  const rows = [headers.join(',')]
+  for (const t of tasks) {
+    const row = [
+      escapeCsv(t.id),
+      escapeCsv(t.title),
+      escapeCsv(t.column),
+      escapeCsv(t.priority),
+      escapeCsv(t.repo),
+      escapeCsv(t.issueNumber ?? ''),
+      escapeCsv(t.assignee),
+      escapeCsv(t.model),
+      escapeCsv(t.provider),
+      escapeCsv(t.reasoningEffort ?? ''),
+      escapeCsv(t.workspaceId),
+      escapeCsv(t.branch),
+      escapeCsv(formatDate(t.createdAt)),
+      escapeCsv(formatDate(t.updatedAt)),
+    ]
+    rows.push(row.join(','))
+  }
+
+  // UTF-8 BOM prefix for Microsoft Excel
+  return '\uFEFF' + rows.join('\r\n')
+}
+
+
+/**
+ * Clean up task worktree.
+ */

package/lib/routes/security.js

@@ -0,0 +1,274 @@
+import crypto from 'node:crypto'
+
+export const MAX_BODY_BYTES = 256 * 1024
+
+export function isLoopbackAddress(addr) {
+  if (!addr || typeof addr !== 'string') return false
+  const clean = addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+  return (
+    clean === '127.0.0.1' ||
+    clean === '::1' ||
+    clean === 'localhost' ||
+    clean === 'localhost.' ||
+    clean.startsWith('127.')
+  )
+}
+
+export function isLanAddress(addr) {
+  if (!addr || typeof addr !== 'string') return false
+  const clean = addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+  if (isLoopbackAddress(clean)) return true
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
+  const m = clean.match(/^172\.(\d+)\./)
+  if (m) {
+    const octet = parseInt(m[1], 10)
+    if (octet >= 16 && octet <= 31) return true
+  }
+  return false
+}
+
+export function isTrustedHost(host) {
+  if (!host || typeof host !== 'string') return false
+  let hostname = host.trim()
+  if (hostname.startsWith('[')) {
+    const end = hostname.indexOf(']')
+    if (end > 0) hostname = hostname.slice(1, end)
+  } else {
+    hostname = hostname.split(':')[0]
+  }
+  hostname = hostname.toLowerCase()
+  if (!hostname) return false
+  if (hostname === 'localhost' || hostname === 'localhost.' || hostname.endsWith('.local')) return true
+  if (isLoopbackAddress(hostname) || isLanAddress(hostname)) return true
+  return false
+}
+
+export function normalizeIp(addr) {
+  if (!addr || typeof addr !== 'string') return ''
+  return addr.toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+}
+
+export function cookieNameForAuthority(authority) {
+  if (!authority || typeof authority !== 'string') return ''
+  const hash = crypto.createHash('sha256').update(authority.trim()).digest('base64url')
+  return 'dsh-auth-' + hash
+}
+
+export function isLoopbackCookieName(name, host = '') {
+  if (!name || typeof name !== 'string' || !name.startsWith('dsh-auth-')) return false
+  const authorities = [
+    host,
+    '127.0.0.1:3000',
+    '127.0.0.1:3080',
+    '127.0.0.1:3082',
+    '127.0.0.1',
+    'localhost:3000',
+    'localhost:3080',
+    'localhost:3082',
+    'localhost',
+    '[::1]:3000',
+    '[::1]',
+  ]
+  for (const auth of authorities) {
+    if (auth && isLoopbackAddress(auth.split(':')[0])) {
+      if (cookieNameForAuthority(auth) === name) return true
+    }
+  }
+  return false
+}
+
+export function hasClientCredentials(req) {
+  if (!req || !req.headers) return false
+  if (req.headers.authorization) return true
+  if (req.headers['x-dsh-lan-pin']) return true
+  const cookie = req.headers.cookie
+  if (!cookie || typeof cookie !== 'string') return false
+  if (cookie.includes('dsh_token=') || cookie.includes('dsh_lan_pin=')) return true
+
+  const parts = cookie.split(';')
+  for (const part of parts) {
+    const trimmed = part.trim()
+    const eqIdx = trimmed.indexOf('=')
+    if (eqIdx === -1) continue
+    const name = trimmed.slice(0, eqIdx).trim()
+    if (name.startsWith('dsh-auth-')) {
+      if (!isLoopbackCookieName(name, req.headers.host)) {
+        return true
+      }
+    }
+  }
+  return false
+}
+
+export function getClientIp(req) {
+  const socketAddress =
+    req?.socket?.remoteAddress ||
+    req?.connection?.remoteAddress ||
+    req?.info?.remoteAddress ||
+    ''
+  const socketIp = normalizeIp(socketAddress)
+  const xff = req?.headers?.['x-forwarded-for']
+  if (xff && typeof xff === 'string' && (isLoopbackAddress(socketIp) || !socketIp)) {
+    const first = xff.split(',')[0].trim()
+    if (first) {
+      return normalizeIp(first)
+    }
+  }
+  return socketIp
+}
+
+/**
+ * Cross-site request, DNS rebinding, and authentication validation (#261, #369, #384).
+ *
+ * Requirements:
+ * 1. If DSH connection service is available (options.connection), requestRejection(req)
+ *    is the authoritative gate for browser session authentication and trusted network access.
+ *    If rejection is returned, the numeric status (e.g. 401 or 403) is returned.
+ * 2. Host header is required and must target a trusted host (loopback, LAN, .local).
+ * 3. Cross-site requests ('sec-fetch-site: cross-site' or origin mismatch) are rejected with 403.
+ * 4. Origin & Referer headers (if present) must match Host or a trusted host.
+ * 5. Network boundary validation:
+ *    - Loopback callers (127.0.0.1, ::1) are allowed.
+ *    - Non-loopback / LAN callers require valid connection authentication (fail-closed, return 401).
+ *    - Unknown remote address (socket present but empty remoteAddress) fails closed with 403.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ connection?: { requestRejection?: (req: any) => number | undefined } }} [options]
+ * @returns {number|undefined} Rejection HTTP status code (401, 403), or undefined if allowed.
+ */
+export function getRejectionStatus(req, options = {}) {
+  const connection = options?.connection
+  if (connection && typeof connection.requestRejection === 'function') {
+    try {
+      const rejection = connection.requestRejection(req)
+      if (rejection !== undefined) {
+        if (typeof rejection === 'number' && Number.isInteger(rejection) && rejection >= 400 && rejection < 600) {
+          return rejection
+        }
+        return rejection === 401 ? 401 : 403
+      }
+    } catch {
+      // Fail closed if connection service throws
+      return 403
+    }
+  }
+
+  if (!req || !req.headers) return 403
+
+  const host = req.headers.host
+  if (!host || !isTrustedHost(host)) {
+    return 403
+  }
+
+  const site = req.headers['sec-fetch-site']
+
+  // 1. Explicit cross-site or same-site requests are rejected
+  if (site === 'cross-site' || site === 'same-site') {
+    return 403
+  }
+
+  // 2. Validate origin against trusted hosts and host header
+  const origin = req.headers.origin
+  if (origin !== undefined) {
+    if (origin === 'null' || !origin) return 403
+    try {
+      const parsed = new URL(origin)
+      if (!isTrustedHost(parsed.hostname)) return 403
+      if (parsed.host && parsed.host !== host) return 403
+    } catch {
+      return 403
+    }
+  }
+
+  // 3. Validate referer against trusted hosts and host header if present
+  const referer = req.headers.referer
+  if (referer !== undefined && referer) {
+    try {
+      const parsedRef = new URL(referer)
+      if (!isTrustedHost(parsedRef.hostname)) return 403
+      if (parsedRef.host && parsedRef.host !== host) return 403
+    } catch {
+      return 403
+    }
+  }
+
+  // 4. Validate remote address and network boundary
+  const hasSocket = !!(req.socket || req.connection)
+  const remote = getClientIp(req)
+
+  if (hasSocket) {
+    if (!remote) {
+      return 403
+    }
+    if (!isLoopbackAddress(remote) && !isLanAddress(remote)) {
+      return 403
+    }
+    // Remote / LAN callers without connection authentication are rejected (#384)
+    if (!isLoopbackAddress(remote)) {
+      if (!connection) {
+        return 401
+      }
+      // If request was forwarded through a reverse proxy (x-forwarded-for),
+      // the proxy may have injected loopback credentials. Validate that the client
+      // itself supplied authentic credentials (bearer token, PIN, or client session cookie).
+      const xff = req.headers['x-forwarded-for']
+      if (xff && !hasClientCredentials(req)) {
+        return 401
+      }
+    }
+  } else {
+    // Synthetic mock request without socket
+    const xff = req.headers['x-forwarded-for']
+    if (xff) {
+      const first = xff.split(',')[0].trim()
+      if (first && !isLoopbackAddress(normalizeIp(first))) {
+        if (!connection || !hasClientCredentials(req)) {
+          return 401
+        }
+      }
+    } else if (!connection) {
+      const hostname = String(host).split(':')[0].toLowerCase()
+      if (!isLoopbackAddress(hostname) && hostname !== 'localhost') {
+        return 401
+      }
+    }
+  }
+
+  // 5. Browser request with declared site:
+  // Must be same-origin or none
+  if (site && site !== 'same-origin' && site !== 'none') {
+    return 403
+  }
+
+  // 6. Request without declared site from non-loopback requires connection
+  if (!site && remote && !isLoopbackAddress(remote) && !connection) {
+    return 401
+  }
+
+  return undefined
+}
+
+export function isTrustedRequest(req, options = {}) {
+  return getRejectionStatus(req, options) === undefined
+}
+
+export function rejectUntrustedRequest(req, res, options = {}) {
+  const status = getRejectionStatus(req, options)
+  if (status !== undefined) {
+    try {
+      res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Cache-Control': 'no-store',
+      })
+      res.end(
+        JSON.stringify({
+          error: status === 401 ? 'unauthorized' : 'cross-site',
+        })
+      )
+    } catch {
+      /* socket closed */
+    }
+    return true
+  }
+  return false
+}