@goodandready/dsh-subscriptions 0.6.36 → 0.6.37

package/lib/http.js

@@ -131,7 +131,49 @@ export function queryOf(req) {
 /**
  * Fetch with connect/overall timeout using AbortSignal.any.
  */
-export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000 } = {}) {
+
+export function isSameOrigin(url1, url2) {
+  try {
+    const u1 = new URL(url1)
+    const u2 = new URL(url2)
+    return u1.origin.toLowerCase() === u2.origin.toLowerCase()
+  } catch {
+    return false
+  }
+}
+
+export function sanitizeRequestHeaders(url, init = {}, options = {}) {
+  const headers = { ...(init.headers || {}) }
+  if (!url) return headers
+  try {
+    const parsed = new URL(url)
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      delete headers.authorization
+      delete headers.Authorization
+      delete headers.cookie
+      delete headers.Cookie
+      return headers
+    }
+    const allowedOrigins = options.allowedOrigins || []
+    if (allowedOrigins.length > 0) {
+      const targetOrigin = parsed.origin.toLowerCase()
+      const isAllowed = allowedOrigins.some(o => {
+        try { return new URL(o).origin.toLowerCase() === targetOrigin } catch { return false }
+      })
+      if (!isAllowed) {
+        delete headers.authorization
+        delete headers.Authorization
+        delete headers.cookie
+        delete headers.Cookie
+      }
+    }
+  } catch {}
+  return headers
+}
+
+export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000, allowedOrigins } = {}) {
+  const safeHeaders = sanitizeRequestHeaders(url, init, { allowedOrigins })
+  init = { ...init, headers: safeHeaders }
   const impl = fetchImpl || fetch
   if (!timeoutMs || timeoutMs <= 0) return impl(url, init)
   const controller = new AbortController()

package/lib/import-auth.js

@@ -232,7 +232,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
       accessToken: tok,
       refreshToken: tok,
       githubToken: tok,
-      expiresAt: Date.now() + 30 * 86400 * 1000,
+      expiresAt: 0,
       email,
       label: email,
     }

package/lib/index.js

@@ -198,12 +198,16 @@ export function apply(ctx, rawConfig) {
     return proxyFetch(slot.proxyUrl)
   }
 
-  function redirectFor(ref, provider) {
+  function redirectFor(provider, ref, reqOrigin) {
+    if (typeof provider === "object" && provider !== null) {
+      const opts = provider
+      provider = opts.provider
+      ref = opts.ref
+      reqOrigin = opts.origin
+    }
     if (live().useWebCallback) {
-      const origin = (ctx.webServer && typeof ctx.webServer.url === 'string')
-        ? ctx.webServer.url
-        : ''
-      return webCallbackUri(origin, ref)
+      const origin = reqOrigin || ((ctx.webServer && typeof ctx.webServer.url === "string") ? ctx.webServer.url : "")
+      return webCallbackUri(origin)
     }
     return getVendor(provider).redirectUri(vendorConfig(provider, live()))
   }
@@ -359,20 +363,17 @@ export function apply(ctx, rawConfig) {
   }
 
   async function completeOAuth({ provider, index, code, state }) {
-    if (!isProvider(provider)) throw new Error('unknown provider')
-    const n = Number(index)
-    const ref = oauthRef(provider, n)
+    if (!state) throw new Error('missing oauth state')
     sweepPending(Date.now())
-    let row = state ? pending.get(state) : null
-    if (!row) {
-      for (const item of pending.values()) {
-        if (item.provider === provider && item.index === n) row = item
-      }
-    }
-    if (!row || !row.verifier) throw new Error('login session expired; start Connect again')
-    if (row.provider !== provider || row.index !== n) throw new Error('state does not match this account')
-    const cfg = { ...vendorConfig(provider, live()), redirectUri: row.redirectUri }
-    const blob = await getVendor(provider).exchangeCode(cfg, {
+    const row = pending.get(state)
+    if (!row || !row.verifier) throw new Error('login session expired or invalid state; start Connect again')
+    if (provider && row.provider !== provider) throw new Error('state provider mismatch')
+    if (index !== undefined && index !== null && Number(index) !== row.index) throw new Error('state index mismatch')
+    const actualProvider = row.provider
+    const n = row.index
+    const ref = oauthRef(actualProvider, n)
+    const cfg = { ...vendorConfig(actualProvider, live()), redirectUri: row.redirectUri }
+    const blob = await getVendor(actualProvider).exchangeCode(cfg, {
       verifier: row.verifier,
       challenge: row.challenge,
       state: row.state,
@@ -384,7 +385,7 @@ export function apply(ctx, rawConfig) {
     pending.delete(row.state)
     await syncAdapter()
     refreshModels().catch(() => {})
-    return { ref, label: pmL(blob.label || blob.email) || displayName(provider) }
+    return { ref, label: pmL(blob.label || blob.email) || displayName(actualProvider) }
   }
 
   // Privacy masking

package/lib/routes/accounts.js

@@ -4,7 +4,7 @@ import { Config, plainConfig, publicConfig } from '../config-schema.js'
 import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
 import { discoverLocalCliSessions, loadLocalCliBlob } from '../import-auth.js'
-import { isProvider, oauthRef } from '../refs.js'
+import { isProvider, oauthRef, parseOauthRef } from '../refs.js'
 
 export function registerAccountsRoutes(ctx, state) {
   const {
@@ -143,8 +143,13 @@ export function registerAccountsRoutes(ctx, state) {
       } catch {
         body = null
       }
-      if (!body || !body.provider) {
-        writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'missing provider' } })
+      if (!body || !body.provider || !isProvider(body.provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'unknown or missing provider' } })
+        return
+      }
+      const idxNum = Number(body.index) || 1
+      if (!Number.isInteger(idxNum) || idxNum < 1 || idxNum > 99) {
+        writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'invalid account index' } })
         return
       }
       try {
@@ -164,7 +169,7 @@ export function registerAccountsRoutes(ctx, state) {
           syncCustomVendors()
         }
         const slot = normalizeSlots(live().slots).find((s) => s.provider === prov && s.index === idx)
-        const ref = slot ? slot.ref : `${prov.toUpperCase()}_OAUTH_${idx}`
+        const ref = slot ? slot.ref : oauthRef(prov, idx)
         await store.saveBlob(ref, blob)
         await syncAdapter()
         refreshModels().catch(() => {})
@@ -201,11 +206,12 @@ export function registerAccountsRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
         return
       }
-      const passphrase = payload.passphrase
-      if (!passphrase || typeof passphrase !== 'string') {
-        writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase is required' } })
+      const passphrase = String(payload.passphrase || '').trim()
+      if (!passphrase || passphrase.length < 12) {
+        writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase must be at least 12 characters' } })
         return
       }
+      const algorithm = payload.algorithm === 'pbkdf2' || payload.algorithm === 'scrypt-v2' || payload.algorithm === 'scrypt-hardened' ? payload.algorithm : 'scrypt'
       try {
         const accounts = []
         for (const slot of normalizeSlots(live().slots)) {
@@ -219,7 +225,7 @@ export function registerAccountsRoutes(ctx, state) {
           return
         }
         const bundle = JSON.stringify({ v: 1, exportedAt: Date.now(), accounts })
-        const encrypted = encryptWithPassphrase(bundle, passphrase)
+        const encrypted = encryptWithPassphrase(bundle, passphrase, { algorithm })
         writeJson(res, 200, { ok: true, payload: encrypted, count: accounts.length })
       } catch (e) {
         writeJson(res, 500, { ok: false, error: { code: 'export', message: String(e && e.message || e) } })
@@ -265,6 +271,7 @@ export function registerAccountsRoutes(ctx, state) {
       let imported = 0
       for (const row of bundle.accounts) {
         try {
+          if (!row || typeof row.ref !== 'string' || !parseOauthRef(row.ref) || !row.blob) continue
           await store.saveBlob(row.ref, row.blob)
           imported++
         } catch { /* skip broken */ }
@@ -301,6 +308,10 @@ export function registerAccountsRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
         return
       }
+      if (!Number.isInteger(index) || index < 1 || index > 99) {
+        writeJson(res, 400, { ok: false, error: { code: 'index', message: 'account index must be an integer between 1 and 99' } })
+        return
+      }
       if (!refreshToken && !apiKey) {
         writeJson(res, 400, { ok: false, error: { code: 'token', message: 'refreshToken or apiKey is required' } })
         return

package/lib/routes/oauth.js

@@ -39,7 +39,7 @@ export function registerOauthRoutes(ctx, state) {
         return
       }
       const origin = requestOrigin(req)
-      const redirectUri = redirectFor(provider, live(), origin)
+      const redirectUri = redirectFor(provider, `${provider}:${index}`, origin)
       const pkce = await createPkce()
       pending.set(pkce.state, {
         provider,

package/lib/routes/status.js

@@ -1,3 +1,4 @@
+// #374: Sensitive GET routes protected by same-origin check
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig } from '../config-schema.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.36",
+  "version": "0.6.37",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",