@goodandready/dsh-moa 0.2.52 → 0.2.55

package/README.md

@@ -302,6 +302,9 @@ dsh-moa:
 
 ## 📊 REST API & Endpoints
 
+> [!IMPORTANT]
+> **Authentication & Access Control**: All HTTP endpoints enforce fail-closed authentication via the DeepSeek Harness Connection Service (`ctx.connection.requestRejection`). Unauthenticated remote callers over LAN/WAN receive HTTP 401 (`Authentication required`) or 403 (`Forbidden`), strictly preventing disclosure of prompts, workspace structures, and candidate files. Mutation endpoints additionally require loopback origin and CSRF validation (`sec-fetch-site`).
+
 | Endpoint | Method | Description |
 |:---|:---|:---|
 | `/dsh-moa/status` | `GET` | Health/enablement snapshot used by the settings card status chip |
@@ -332,7 +335,7 @@ npm test
 ## 🛠️ Internal Tooling & Development
 
 For local verification and package integrity validation:
-- `npm test`: runs the full test suite (95 tests)
+- `npm test`: runs the full test suite (288 tests)
 - `./deploy.sh`: local infrastructure validation script (verifies package size, identity parity in package.json/cordis.patch.yml/client.js, and tests). Excluded from the published npm package.
 
 ## 📄 License

package/README.ru.md

@@ -302,6 +302,9 @@ dsh-moa:
 
 ## 📊 REST API эндпоинты
 
+> [!IMPORTANT]
+> **Аутентификация и контроль доступа**: Все HTTP-эндпоинты плагина защищены каноническим сервисом соединений DeepSeek Harness (`ctx.connection.requestRejection`). Неаутентифицированные удалённые запросы из сети LAN/WAN отклоняются с кодом HTTP 401 (`Authentication required`) или 403 (`Forbidden`), предотвращая утечку промптов, структуры рабочей директории и файлов кандидатов. Мутирующие эндпоинты дополнительно требуют loopback-вызова и проверки CSRF (`sec-fetch-site`).
+
 | Эндпоинт | Метод | Описание |
 |:---|:---|:---|
 | `/dsh-moa/status` | `GET` | Снимок здоровья/включенности для статус-бейджа карточки настроек |

package/lib/access.js

@@ -0,0 +1,203 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Access Control & Route Guard (#257)
+ */
+
+import crypto from 'node:crypto'
+import { assertPathContained } from './file-workspace.js'
+
+export function writeJson(res, status, body) {
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' })
+  res.end(JSON.stringify(body))
+}
+
+export function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let acc = ''
+    req.on('data', (chunk) => {
+      acc += chunk
+      if (acc.length > 5 * 1024 * 1024) { req.destroy(); reject(new Error('Payload Too Large')) }
+    })
+    req.on('end', () => resolve(acc))
+    req.on('error', reject)
+  })
+}
+
+export function isAllowedWorkspace(targetCwd, allowedRoots) {
+  if (!targetCwd || typeof targetCwd !== 'string') return false
+  for (const root of allowedRoots) {
+    if (!root) continue
+    try {
+      assertPathContained(root, targetCwd)
+      return true
+    } catch {
+      // not within root
+    }
+  }
+  return false
+}
+
+export function getConnection(ctx) {
+  try {
+    const fromCtx = ctx?.reflect?.get
+      ? (ctx.reflect.get('connection') || ctx?.connection)
+      : (ctx?.get ? (ctx.get('connection') || ctx?.connection) : Reflect.get(ctx || {}, 'connection'))
+    if (fromCtx) return fromCtx
+    if (ctx?.root) return getConnection(ctx.root)
+    return undefined
+  } catch {
+    return undefined
+  }
+}
+
+export function isLoopbackIp(ip) {
+  if (!ip || typeof ip !== 'string') return false
+  const clean = ip.trim().toLowerCase().replace(/^::ffff:/, '').replace(/^\[|\]$/g, '')
+  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost'
+}
+
+export function cookieNameForAuthority(authority) {
+  if (!authority || typeof authority !== 'string') return ''
+  const hash = crypto.createHash('sha256').update(authority.trim()).digest('base64url')
+  return 'dsh-auth-' + hash
+}
+
+export function isLoopbackCookieName(name, host = '') {
+  if (!name || typeof name !== 'string' || !name.startsWith('dsh-auth-')) return false
+  const authorities = [
+    host,
+    '127.0.0.1:3000',
+    '127.0.0.1:3080',
+    '127.0.0.1:3082',
+    '127.0.0.1',
+    'localhost:3000',
+    'localhost:3080',
+    'localhost:3082',
+    'localhost',
+    '[::1]:3000',
+    '[::1]',
+  ]
+  for (const auth of authorities) {
+    if (auth && isLoopbackIp(auth.split(':')[0])) {
+      if (cookieNameForAuthority(auth) === name) return true
+    }
+  }
+  return false
+}
+
+export function hasClientCredentials(req) {
+  if (!req || !req.headers) return false
+  const cookie = req.headers.cookie
+  if (!cookie || typeof cookie !== 'string') return false
+  if (
+    cookie.includes('dsh_token=') ||
+    cookie.includes('dsh_lan_pin=') ||
+    cookie.includes('dsh_auth_session=')
+  ) {
+    return true
+  }
+
+  const parts = cookie.split(';')
+  for (const part of parts) {
+    const trimmed = part.trim()
+    const eqIdx = trimmed.indexOf('=')
+    if (eqIdx === -1) continue
+    const name = trimmed.slice(0, eqIdx).trim()
+    if (name.startsWith('dsh-auth-')) {
+      if (!isLoopbackCookieName(name, req.headers.host)) {
+        return true
+      }
+    }
+  }
+  return false
+}
+
+/**
+ * Validates whether an incoming HTTP request is authenticated and admitted (#257).
+ *
+ * Requirements:
+ * 1. CSRF protection: rejects sec-fetch-site: cross-site with 403.
+ * 2. Reverse proxy inspection: if request is forwarded with non-loopback x-forwarded-for,
+ *    verify that the client itself supplied authentic credentials (not just injected loopback proxy cookie).
+ * 3. Authoritative DSH connection gate: if connection.requestRejection is present,
+ *    its verdict (401, 403, or undefined) is authoritative.
+ * 4. Network boundary: non-loopback callers without connection service authentication
+ *    fail closed with 401. Loopback callers are admitted.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {any} [ctx]
+ * @returns {number|undefined} Rejection status (401, 403) or undefined if admitted.
+ */
+export function getReadRejectionStatus(req, ctx = null) {
+  if (!req || !req.headers) return 403
+
+  // 1. Strict CSRF protection: reject cross-site requests
+  const site = req.headers['sec-fetch-site']
+  if (site === 'cross-site') {
+    return 403
+  }
+
+  // 2. Reverse-proxy / forwarded client verification (#257)
+  const xff = req.headers['x-forwarded-for']
+  let isForwardedRemote = false
+  if (xff && typeof xff === 'string') {
+    const firstIp = xff.split(',')[0].trim()
+    if (firstIp && !isLoopbackIp(firstIp)) {
+      isForwardedRemote = true
+      if (!hasClientCredentials(req)) {
+        return 401
+      }
+    }
+  }
+
+  // 3. Authoritative DSH connection service check (#257)
+  const conn = getConnection(ctx) || req?.connectionService || ctx?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(req)
+    } catch {
+      rejection = 403
+    }
+    if (rejection !== undefined) {
+      if (typeof rejection === 'number' && Number.isInteger(rejection) && rejection >= 400 && rejection < 600) {
+        return rejection
+      }
+      return rejection === 401 ? 401 : 403
+    }
+    return undefined
+  }
+
+  // 4. Network boundary evaluation when connection service is absent
+  const rawRemote = req?.socket?.remoteAddress || req?.connection?.remoteAddress || ''
+  const cleanRemote = String(rawRemote).trim().toLowerCase().replace(/^::ffff:/, '')
+
+  if (cleanRemote && !isLoopbackIp(cleanRemote)) {
+    return 401
+  }
+
+  if (isForwardedRemote) {
+    return 401
+  }
+
+  const host = String(req.headers.host || '').trim().toLowerCase()
+  if (!cleanRemote && host) {
+    const hostName = host.split(':')[0]
+    if (!isLoopbackIp(hostName)) {
+      return 401
+    }
+  }
+
+  return undefined
+}
+
+export function assertAuthorizedRequest(req, res, ctx = null) {
+  const status = getReadRejectionStatus(req, ctx)
+  if (status !== undefined) {
+    writeJson(res, status, {
+      ok: false,
+      error: status === 401 ? 'Authentication required' : 'Forbidden',
+    })
+    return false
+  }
+  return true
+}

package/lib/file-workspace.js

@@ -403,9 +403,9 @@ export async function cleanMoaWorkspaces(baseDir, options = {}) {
   if (!baseDir) return
   const rawRunId = typeof options === 'string' ? options : options?.runId
   const safeRunId = rawRunId ? String(rawRunId).trim().replace(/[^a-zA-Z0-9_-]/g, '') : null
-  const moaRoot = path.join(baseDir, '.moa')
+  const moaRoot = assertPathContained(baseDir, '.moa')
   if (safeRunId) {
-    await bestEffort('cleanMoaWorkspaces runId', () => fs.rm(path.join(moaRoot, safeRunId), { recursive: true, force: true }))
+    await bestEffort('cleanMoaWorkspaces runId', () => fs.rm(assertPathContained(moaRoot, safeRunId), { recursive: true, force: true }))
     await bestEffort('clean empty moaRoot', async () => {
       if ((await fs.readdir(moaRoot)).length === 0) await fs.rmdir(moaRoot)
     })

package/lib/routes.js

@@ -3,8 +3,10 @@
  */
 
 import path from 'node:path'
-import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory } from './history.js'
+import os from 'node:os'
+import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory, isTestEnvironment } from './history.js'
 import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath, isLoopbackUrl } from './file-workspace.js'
+import { writeJson, readBody, isAllowedWorkspace, assertAuthorizedRequest } from './access.js'
 import { isSafeWriteRequest } from './updater.js'
 import { runMoAPipeline } from './moa-runner.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
@@ -13,30 +15,14 @@ import { resolvePresetForPrompt } from './moa-router.js'
 let _modelsCache = { timestamp: 0, models: [] }
 const MODELS_CACHE_TTL = 60 * 1000
 
-function writeJson(res, status, body) {
-  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' })
-  res.end(JSON.stringify(body))
-}
-
-function readBody(req) {
-  return new Promise((resolve, reject) => {
-    let acc = ''
-    req.on('data', (chunk) => {
-      acc += chunk
-      if (acc.length > 5 * 1024 * 1024) { req.destroy(); reject(new Error('Payload Too Large')) }
-    })
-    req.on('end', () => resolve(acc))
-    req.on('error', reject)
-  })
-}
-
-export function registerMoaRoutes(ctx, { live, callLlm, liveCanvas, saveConfig, Config, plainConfig, webServerPort, timeMachineEngine }) {
+export function registerMoaRoutes(ctx, { live, callLlm, liveCanvas, saveConfig, Config, plainConfig, webServerPort, timeMachineEngine, workspaceRoot }) {
 
 ctx.effect(() => {
     return ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-moa/status',
       handler: (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const cfg = live()
@@ -57,6 +43,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/models',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         if (_modelsCache.models.length > 0 && Date.now() - _modelsCache.timestamp < MODELS_CACHE_TTL) {
           writeJson(res, 200, { ok: true, models: _modelsCache.models, cached: true })
@@ -153,6 +140,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/presets',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         const cfg = live()
         if (req.method === 'GET') {
           writeJson(res, 200, {
@@ -222,6 +210,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/history',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const u = new URL(req.url, 'http://localhost')
@@ -240,6 +229,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/leaderboard',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const url = new URL(req.url || '', 'http://127.0.0.1')
@@ -269,6 +259,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/promote',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
@@ -321,6 +312,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/diff',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const u = new URL(req.url, 'http://localhost')
@@ -393,6 +385,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/history/export',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const url = new URL(req.url || '', 'http://127.0.0.1')
@@ -415,8 +408,9 @@ ctx.effect(() => {
   ctx.effect(() => {
     return ctx.webServer.register({
       kind: 'prefix',
-      path: '/dsh-moa/runs/',
+      path: '/dsh-moa/runs',
       handler: (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         const urlPath = req.url.split('?')[0]
         const parts = urlPath.split('/').filter(Boolean)
@@ -462,6 +456,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/route-preset',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
@@ -502,6 +497,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/run',
       handler: async (req, res) => {
+        if (!assertAuthorizedRequest(req, res, ctx)) return
         if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
@@ -535,13 +531,28 @@ ctx.effect(() => {
           const presetName = payload.preset || cfg.default_preset || 'default'
           const preset = (cfg.presets || []).find((p) => p.name === presetName) || cfg.presets?.[0]
 
+          const baseWorkspaceRoot = workspaceRoot || ctx.baseDir || ctx.workspaceDir || process.cwd()
+          const allowedRoots = [
+            baseWorkspaceRoot,
+            process.cwd(),
+            cfg.workspace_root,
+            ...(Array.isArray(cfg.allowed_workspaces) ? cfg.allowed_workspaces : (cfg.allowed_workspaces ? [cfg.allowed_workspaces] : [])),
+            ...(isTestEnvironment() ? [os.tmpdir()] : []),
+          ].filter(Boolean)
+
+          const targetCwd = payload.cwd ? path.resolve(payload.cwd) : baseWorkspaceRoot
+          if (payload.cwd && !isAllowedWorkspace(targetCwd, allowedRoots)) {
+            writeJson(res, 403, { ok: false, error: 'Forbidden: cwd escapes allowed workspace boundary' })
+            return
+          }
+
           const result = await runMoAPipeline({
             userPrompt: prompt, messages: payload.messages || [], preset, callLlm,
-            cwd: payload.cwd || process.cwd(), prices: cfg.prices || {}, liveCanvas,
+            cwd: targetCwd, prices: cfg.prices || {}, liveCanvas,
             webServerPort: webServerPort || ctx.webServer?.port,
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),
-            timeMachineUrl: payload.timeMachineUrl, force: payload.force,
-            checkpoint: payload.checkpoint,
+            timeMachineUrl: payload.timeMachineUrl, force: false,
+            checkpoint: true,
             runId: payload.runId,
           })
 

package/lib/updater.js

@@ -44,8 +44,7 @@ export function isTrustedUpdateRequest(request) {
 /** General safe write check for plugin write endpoints (CSRF / Cross-Site protection, #234) */
 export function isSafeWriteRequest(request) {
   const remote = request?.socket?.remoteAddress || request?.connection?.remoteAddress;
-  const isLoop = !remote || isLoopback(remote);
-  if (!isLoop) return false;
+  if (!remote || !isLoopback(remote)) return false;
 
   const site = header(request, 'sec-fetch-site');
   if (site === 'cross-site') return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.52",
+  "version": "0.2.55",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",