@goodandready/dsh-plugin-notify 0.3.4 → 0.3.6

package/CHANGELOG.md

@@ -4,7 +4,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.3.4] - 2026-09-24
+## [0.3.6] - 2026-09-25
+
+### Fixed
+- **SSE Authentication Security Boundary (#21)**: Replaced client-controlled header checks (`Authorization.length > 5`, `sec-fetch-site`) with authentic DSH session verification via `connection.requestRejection(req)` (`Host`/`Origin` fence and browser session validation), with loopback-only fallback when connection service is absent.
+- **SSE Clients & Turn Starts Lifecycle Leak (#40)**: Bound SSE clients, route registration, heartbeat timer, and `turnStarts` map to unified effect-owned lifecycle. On plugin dispose, active SSE connections are cleanly terminated with closing comment and ended, route is unregistered, and `turnStarts` map is cleared to ensure complete isolation on reload.
+
+## [0.3.5] - 2026-09-24
 
 ### Fixed
 - **Memory Leak in Turn Tracking (#32)**: Added TTL-based cleanup (30m max age) for stale `turnStarts` entries with automatic pruning on turn events.

package/README.md

@@ -193,11 +193,17 @@ Expected output:
 ✔ AbortSignal.timeout is attached to webhook POST
 ✔ excluded session prefixes suppress notifications
 ✔ Config schema validates sound, toast, and desktop notification fields with opt-in defaults
-✔ SSE route registers on webServer, rejects untrusted requests, and handles trusted stream
+✔ SSE route delegates authentication to DSH connection service with loopback fallback (issue #21 fix)
+✔ SSE route falls back to loopback-only check when connection service is absent (issue #21 fix)
 ✔ client does not register settings.section slot (issue #16 fix)
 ✔ deliveries and warnings are routed through ctx.logger without console calls (issue #22 fix)
-ℹ tests 15
-ℹ pass 15
+✔ cleanupTurnStarts purges stale turnStarts entries older than TTL (issue #32 fix)
+✔ sendSseHeartbeat writes ping comment to active clients and purges failed clients (issue #33 fix)
+✔ summarizeTurn safely reverse iterates events and handles missing session.events (issue #34 fix)
+✔ textOf handles plain strings, arrays of blocks, and strings in arrays (issue #35 fix)
+✔ lifecycle: apply -> dispose closes SSE clients, resets turnStarts, and isolates re-apply (issue #40 fix)
+ℹ tests 21
+ℹ pass 21
 ℹ fail 0
 ```
 

package/README.ru.md

@@ -182,11 +182,17 @@ npm test
 ✔ AbortSignal.timeout is attached to webhook POST
 ✔ excluded session prefixes suppress notifications
 ✔ Config schema validates sound, toast, and desktop notification fields with opt-in defaults
-✔ SSE route registers on webServer, rejects untrusted requests, and handles trusted stream
+✔ SSE route delegates authentication to DSH connection service with loopback fallback (issue #21 fix)
+✔ SSE route falls back to loopback-only check when connection service is absent (issue #21 fix)
 ✔ client does not register settings.section slot (issue #16 fix)
 ✔ deliveries and warnings are routed through ctx.logger without console calls (issue #22 fix)
-ℹ tests 15
-ℹ pass 15
+✔ cleanupTurnStarts purges stale turnStarts entries older than TTL (issue #32 fix)
+✔ sendSseHeartbeat writes ping comment to active clients and purges failed clients (issue #33 fix)
+✔ summarizeTurn safely reverse iterates events and handles missing session.events (issue #34 fix)
+✔ textOf handles plain strings, arrays of blocks, and strings in arrays (issue #35 fix)
+✔ lifecycle: apply -> dispose closes SSE clients, resets turnStarts, and isolates re-apply (issue #40 fix)
+ℹ tests 21
+ℹ pass 21
 ℹ fail 0
 ```
 

package/README.zh.md

@@ -181,11 +181,17 @@ npm test
 ✔ AbortSignal.timeout is attached to webhook POST
 ✔ excluded session prefixes suppress notifications
 ✔ Config schema validates sound, toast, and desktop notification fields with opt-in defaults
-✔ SSE route registers on webServer, rejects untrusted requests, and handles trusted stream
+✔ SSE route delegates authentication to DSH connection service with loopback fallback (issue #21 fix)
+✔ SSE route falls back to loopback-only check when connection service is absent (issue #21 fix)
 ✔ client does not register settings.section slot (issue #16 fix)
 ✔ deliveries and warnings are routed through ctx.logger without console calls (issue #22 fix)
-ℹ tests 15
-ℹ pass 15
+✔ cleanupTurnStarts purges stale turnStarts entries older than TTL (issue #32 fix)
+✔ sendSseHeartbeat writes ping comment to active clients and purges failed clients (issue #33 fix)
+✔ summarizeTurn safely reverse iterates events and handles missing session.events (issue #34 fix)
+✔ textOf handles plain strings, arrays of blocks, and strings in arrays (issue #35 fix)
+✔ lifecycle: apply -> dispose closes SSE clients, resets turnStarts, and isolates re-apply (issue #40 fix)
+ℹ tests 21
+ℹ pass 21
 ℹ fail 0
 ```
 

package/lib/index.js

@@ -6,8 +6,8 @@ export const name = '@goodandready/dsh-plugin-notify';
 /** Settings namespace shared with the Web settings card. */
 export const NS = '@goodandready/dsh-plugin-notify';
 
-// Session firehose + credentials (webhook URL refs) + settings scope for the card + webServer for SSE events.
-export const inject = ['sessions', 'credentials', 'settings', 'webServer'];
+// Session firehose + credentials (webhook URL refs) + settings scope for the card + webServer for SSE events + connection for authentication.
+export const inject = ['sessions', 'credentials', 'settings', 'webServer', 'connection'];
 
 const webhookRef = (label) => Schema.string()
     .role('credential-ref')
@@ -123,34 +123,27 @@ function isLoopback(address) {
     return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1' || address === 'localhost';
 }
 
+function connectionOf(ctx) {
+    if (!ctx) return null;
+    return Reflect.get(ctx, 'connection') || null;
+}
+
 /**
- * Fail-closed origin check for internal SSE events stream.
- * Accepts same-origin sec-fetch-site, matching origin and host, loopback remote address, or DSH auth.
+ * Origin and session verification for internal SSE events stream.
+ * Delegates to DSH connection service (Host/Origin fence + browser authentication session),
+ * with loopback-only fallback when connection service is absent (e.g. standalone tests).
  */
-export function isTrustedRequest(request) {
+export function isTrustedRequest(request, targetCtx) {
     if (!request || !request.headers) return false;
 
-    const authHeader = request.headers['authorization'] || request.headers['x-dsh-auth'];
-    if (authHeader && authHeader.length > 5) return true;
-
-    const remoteAddr = request.socket?.remoteAddress || request.connection?.remoteAddress;
-    if (remoteAddr && isLoopback(remoteAddr)) return true;
-
-    const secFetchSite = request.headers['sec-fetch-site'];
-    if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
-        return true;
-    }
-
-    const origin = request.headers['origin'];
-    const host = request.headers['host'];
-    if (origin && host) {
-        try {
-            const originHost = new URL(origin).host;
-            if (originHost === host) return true;
-        } catch { /* invalid origin URL */ }
+    const conn = connectionOf(targetCtx);
+    if (conn && typeof conn.requestRejection === 'function') {
+        const rejection = conn.requestRejection(request);
+        return rejection === void 0;
     }
 
-    return false;
+    const remoteAddr = request.socket?.remoteAddress || request.connection?.remoteAddress;
+    return Boolean(remoteAddr && isLoopback(remoteAddr));
 }
 
 export function broadcastSse(eventData) {
@@ -168,17 +161,42 @@ export function broadcastSse(eventData) {
     return sent;
 }
 
-export function handleSseConnection(req, res) {
+export function handleSseConnection(req, res, targetCtx) {
     if (req.method !== 'GET') {
-        if (typeof res.writeHead === 'function') res.writeHead(405, { 'Content-Type': 'text/plain' });
+        res.statusCode = 405;
+        if (typeof res.setHeader === 'function') res.setHeader('allow', 'GET');
+        if (typeof res.writeHead === 'function') res.writeHead(405, { 'Content-Type': 'text/plain; charset=utf-8' });
         if (typeof res.end === 'function') res.end('Method Not Allowed');
         return;
     }
-    if (!isTrustedRequest(req)) {
-        if (typeof res.writeHead === 'function') res.writeHead(403, { 'Content-Type': 'text/plain' });
-        if (typeof res.end === 'function') res.end('Forbidden');
-        return;
+
+    const conn = connectionOf(targetCtx);
+    if (conn && typeof conn.requestRejection === 'function') {
+        const rejection = conn.requestRejection(req);
+        if (rejection !== void 0) {
+            res.statusCode = rejection;
+            if (typeof res.writeHead === 'function') {
+                res.writeHead(rejection, { 'Content-Type': 'text/plain; charset=utf-8' });
+            }
+            if (typeof res.end === 'function') {
+                res.end(rejection === 401 ? 'Unauthorized' : 'Forbidden');
+            }
+            return;
+        }
+    } else {
+        const remoteAddr = req.socket?.remoteAddress || req.connection?.remoteAddress;
+        if (!remoteAddr || !isLoopback(remoteAddr)) {
+            res.statusCode = 403;
+            if (typeof res.writeHead === 'function') {
+                res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+            }
+            if (typeof res.end === 'function') {
+                res.end('Forbidden');
+            }
+            return;
+        }
     }
+
     if (typeof res.writeHead === 'function') {
         res.writeHead(200, {
             'Content-Type': 'text/event-stream',
@@ -201,39 +219,114 @@ export function handleSseConnection(req, res) {
     }
 }
 
-function mountWebServer(targetCtx) {
-    if (!targetCtx?.webServer?.register) return;
+export function closeAllSseClients() {
+    for (const res of Array.from(sseClients)) {
+        try {
+            if (!res.writableEnded) {
+                if (typeof res.write === 'function' && res.headersSent) {
+                    try {
+                        res.write(': closing\n\n');
+                    } catch { /* ignore write failure */ }
+                }
+                if (typeof res.end === 'function') {
+                    res.end();
+                } else if (typeof res.destroy === 'function') {
+                    res.destroy();
+                }
+            }
+        } catch {
+            // ignore close error
+        } finally {
+            sseClients.delete(res);
+        }
+    }
+    sseClients.clear();
+}
+
+function mountWebServer(targetCtx, hostCtx) {
+    if (!targetCtx?.webServer?.register) return () => {};
     const routeDef = {
         kind: 'exact',
         path: '/dsh-plugin-notify/events',
-        handler: (req, res) => handleSseConnection(req, res),
+        handler: (req, res) => handleSseConnection(req, res, targetCtx),
     };
+
+    let timer = null;
     const startHeartbeat = () => {
-        const timer = setInterval(() => sendSseHeartbeat(), 25000);
+        timer = setInterval(() => sendSseHeartbeat(), 25000);
         timer?.unref?.();
-        return () => clearInterval(timer);
+        return () => {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+        };
+    };
+
+    let unregister = null;
+    let disposed = false;
+    const cleanup = () => {
+        if (disposed) return;
+        disposed = true;
+        if (timer) {
+            clearInterval(timer);
+            timer = null;
+        }
+        if (typeof unregister === 'function') {
+            try { unregister(); } catch { /* ignore */ }
+            unregister = null;
+        }
+        closeAllSseClients();
     };
+
     if (typeof targetCtx.effect === 'function') {
-        targetCtx.effect(() => targetCtx.webServer.register(routeDef), 'dsh-plugin-notify: sse events');
-        targetCtx.effect(startHeartbeat, 'dsh-plugin-notify: sse heartbeat');
+        targetCtx.effect(() => {
+            unregister = targetCtx.webServer.register(routeDef);
+            return () => cleanup();
+        }, 'dsh-plugin-notify: sse events');
+        targetCtx.effect(() => {
+            return startHeartbeat();
+        }, 'dsh-plugin-notify: sse heartbeat');
     } else {
-        targetCtx.webServer.register(routeDef);
+        unregister = targetCtx.webServer.register(routeDef);
         startHeartbeat();
     }
+
+    return cleanup;
 }
 
 export function apply(ctx, config = {}) {
     let getConfig = () => config ?? {};
 
     let webServerMounted = false;
+    let unmountWebServer = null;
+
     const tryMountWebServer = (target) => {
         if (webServerMounted) return;
         if (target?.webServer?.register) {
             webServerMounted = true;
-            mountWebServer(target);
+            const effectiveTarget = target?.connection ? target : (ctx?.connection ? ctx : target);
+            unmountWebServer = mountWebServer(effectiveTarget, ctx);
         }
     };
 
+    const disposePlugin = () => {
+        if (typeof unmountWebServer === 'function') {
+            try { unmountWebServer(); } catch { /* ignore */ }
+            unmountWebServer = null;
+        }
+        closeAllSseClients();
+        turnStarts.clear();
+        webServerMounted = false;
+    };
+
+    if (typeof ctx.effect === 'function') {
+        ctx.effect(() => () => disposePlugin(), 'dsh-plugin-notify: lifecycle cleanup');
+    }
+    if (typeof ctx.on === 'function') {
+        ctx.on('dispose', disposePlugin);
+    }
+
     if (typeof ctx.inject === 'function') {
         ctx.inject(['settings'], (sctx) => {
             const scope = sctx.settings.register(NS, Config, { base: config ?? {} });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-plugin-notify",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "DSH plugin: audio chimes, cross-session toasts, desktop push, and IM webhooks for turn completion, errors, and approvals.",
   "license": "MIT",
   "type": "module",