@goodandready/dsh-tts 0.4.34 → 0.4.35

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.4.35 (2026-10-20)
+
+### Fixed
+- **Authentication Guard for Administrative and Credential Routes** (#210):
+  - Enforced DSH core connection authentication (`connection.requestRejection(req)`) across all `/dsh-tts/*` HTTP endpoints.
+  - Fail-closed: Remote LAN clients without an authenticated operator session or token are rejected with 401/403 and cannot manage credentials or mutate plugin configuration (`PUT/DELETE /dsh-tts/credential`, `PUT /dsh-tts/config`, `/dsh-tts/models/install`, `/dsh-tts/models/delete`, `/dsh-tts/cache/clear`).
+  - Permitted authenticated operators via DSH connection service to manage provider credentials and configuration from LAN or remote interfaces.
+  - Added helpers `getClientIp(req)`, `isLanAddress(address)`, and `getRejectionStatus(req, options)` with comprehensive unit test coverage.
+
 ## 0.4.34 (2026-10-17)
 
 - **Per-Reply Speak Action** (#208, GitHub PR #2):

package/lib/http-util.js

@@ -4,7 +4,7 @@ export function writeJson(res, code, body) {
   try {
     res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
     res.end(JSON.stringify(body))
-  } catch { /* socket closed */ }
+  } catch (_err) { /* socket closed */ }
 }
 
 export function readBody(req, maxBytes) {
@@ -23,15 +23,36 @@ export function readBody(req, maxBytes) {
 
 export function isLoopback(address) {
   if (!address || typeof address !== 'string') return false
+  const clean = address.toLowerCase().replace(/^\[|\]$/g, '')
   return (
-    address === '127.0.0.1' ||
-    address === '::1' ||
-    address === '::ffff:127.0.0.1' ||
-    address.startsWith('127.') ||
-    address === 'localhost'
+    clean === '127.0.0.1' ||
+    clean === '::1' ||
+    clean === '::ffff:127.0.0.1' ||
+    clean.startsWith('127.') ||
+    clean === 'localhost'
   )
 }
 
+export function isLanAddress(address) {
+  if (!address || typeof address !== 'string') return false
+  const clean = address.toLowerCase().replace(/^\[|\]$/g, '')
+  const ipv4 = clean.startsWith('::ffff:') ? clean.slice(7) : clean
+  return (
+    ipv4.startsWith('192.168.') ||
+    ipv4.startsWith('10.') ||
+    /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(ipv4)
+  )
+}
+
+export function getClientIp(request) {
+  if (!request) return ''
+  const remote = request.socket?.remoteAddress || request.connection?.remoteAddress
+  if (remote) {
+    return remote.startsWith('::ffff:') ? remote.slice(7) : remote
+  }
+  return ''
+}
+
 function parseCookies(cookieHeader) {
   if (!cookieHeader || typeof cookieHeader !== 'string') return {}
   const out = {}
@@ -47,66 +68,106 @@ function parseCookies(cookieHeader) {
 }
 
 /**
- * Strict fail-closed check for administrative/settings requests.
- * Only accepts loopback with matching origin/host, same-origin context,
- * or valid DSH auth tokens. Arbitrary headers, unverified tokens, and same-site requests are rejected.
+ * Returns undefined if the request is permitted, or an HTTP error status code (401, 403) if rejected.
+ *
+ * Evaluation order:
+ * 1. Base validation (fail-closed on missing headers or cross-site Sec-Fetch-Site).
+ * 2. Origin vs Host verification.
+ * 3. DSH connection service authentication (connection.requestRejection(request)).
+ * 4. Fallback authentication when connection service is absent (env token, loopback, etc.).
+ *
+ * @param {object} request Node HTTP request
+ * @param {object} [options]
+ * @param {object} [options.connection] DSH connection service
+ * @param {boolean} [options.requireAuth] require authenticated operator (fail-closed for remote)
+ * @param {boolean} [options.isRemote] mark in-memory/mock request as remote
+ * @returns {number|undefined} undefined if allowed, 401 or 403 if rejected
  */
-export function isTrustedSettingsRequest(request) {
-  if (!request || !request.headers) return false
+export function getRejectionStatus(request, options = {}) {
+  if (!request || !request.headers) return 403
 
-  // Fail-closed: unconditionally reject cross-site and non-same-origin Sec-Fetch-Site (e.g. same-site, cross-site)
+  // 1. Fail-closed: unconditionally reject cross-site and non-same-origin Sec-Fetch-Site (e.g. same-site, cross-site)
   const secFetch = request.headers['sec-fetch-site']
-  if (secFetch && secFetch !== 'same-origin') {
-    return false
+  if (secFetch && secFetch !== 'same-origin' && secFetch !== 'none') {
+    return 403
   }
 
-  // If origin is present, ensure it matches request host
+  // 2. If origin is present, ensure it matches request host
   const origin = request.headers['origin']
   const host = request.headers['host']
   if (origin && host) {
     try {
       const originHost = new URL(origin).host
-      if (originHost !== host) return false
-    } catch {
-      return false
+      if (originHost !== host) return 403
+    } catch (_err) {
+      return 403
+    }
+  }
+
+  // 3. If DSH connection service is available, invoke requestRejection(req)
+  const conn = options.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(request)
+    if (rejection !== undefined && rejection !== null && rejection !== false) {
+      return typeof rejection === 'number' ? rejection : 401
     }
+    // Admitted by DSH connection service
+    return undefined
   }
 
-  // Verify explicit authorization token against DSH environment tokens if defined
+  // 4. Verify explicit authorization token against DSH environment tokens if defined
   const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN
   const rawAuth = request.headers['authorization'] || request.headers['x-dsh-auth']
   const cookieHeader = request.headers['cookie']
 
   if (expectedToken) {
+    let token = ''
     if (typeof rawAuth === 'string') {
-      const token = rawAuth.startsWith('Bearer ') ? rawAuth.slice(7).trim() : rawAuth.trim()
-      if (token && token === expectedToken) return true
+      token = rawAuth.startsWith('Bearer ') ? rawAuth.slice(7).trim() : rawAuth.trim()
     }
-    if (typeof cookieHeader === 'string') {
+    if (!token && typeof cookieHeader === 'string') {
       const cookies = parseCookies(cookieHeader)
-      const token = cookies['token'] || cookies['dsh_token']
-      if (token && token === expectedToken) return true
+      token = cookies['token'] || cookies['dsh_token'] || ''
+    }
+    if (token && token === expectedToken) {
+      return undefined
     }
+    return 401
   }
 
-  // Remote IP loopback check
-  const remoteAddr = request.socket?.remoteAddress || request.connection?.remoteAddress
+  // 5. Remote IP check
+  const remoteAddr = getClientIp(request)
   if (remoteAddr) {
-    return isLoopback(remoteAddr)
+    if (isLoopback(remoteAddr)) {
+      return undefined
+    }
+    // Remote client (LAN or WAN) without connection auth or token:
+    // Fail-closed. For write / sensitive endpoints requireAuth returns 401, otherwise 403.
+    return options.requireAuth ? 401 : 403
   }
 
-  // Internal/mock caller without socket: only allow if sec-fetch-site is explicitly same-origin or origin matches host
+  // 6. Internal/mock caller without socket:
+  if (options.requireAuth && options.isRemote) {
+    return 401
+  }
   if (secFetch === 'same-origin') {
-    return true
+    return undefined
   }
-
   if (origin && host) {
     try {
-      return new URL(origin).host === host
-    } catch {
-      return false
+      if (new URL(origin).host === host) return undefined
+    } catch (_err) {
+      return 403
     }
   }
 
-  return false
+  return 403
 }
+
+/**
+ * Strict fail-closed check for administrative/settings requests.
+ * Backward-compatible boolean wrapper around getRejectionStatus.
+ */
+export function isTrustedSettingsRequest(request, options = {}) {
+  return getRejectionStatus(request, options) === undefined
+}

package/lib/routes.js

@@ -1,7 +1,7 @@
 import { MODEL_SPECS } from './engines/manager.js'
 import { resolve } from 'node:path'
 import { registerPluginUpdater } from './updater.js'
-import { writeJson, readBody, isTrustedSettingsRequest } from './http-util.js'
+import { writeJson, readBody, getRejectionStatus, isTrustedSettingsRequest } from './http-util.js'
 import { addStreamSubscriber, removeStreamSubscriber, streamSubscriberCount } from './stream-hub.js'
 import { pendingKeyWrites, stripSecretsFromConfig, needsApiKey } from './keys.js'
 import { PROVIDER_KEYS } from './providers.js'
@@ -29,15 +29,43 @@ export function registerHttpRoutes(ctx, api) {
     validateConfig,
     breakerSnapshot,
   } = api
+
+  const resolveConnection = () => {
+    try {
+      if (api && api.connection) return api.connection
+    } catch (_err) { /* connection resolution fallback */ }
+    try {
+      if (ctx && typeof ctx.get === 'function') {
+        const c = ctx.get('connection')
+        if (c) return c
+      }
+    } catch (_err) { /* connection get fallback */ }
+    try {
+      if (ctx) return Reflect.get(ctx, 'connection') || ctx.connection
+    } catch (_err) { /* connection reflect fallback */ }
+    return undefined
+  }
+
+  const rejectIfUntrusted = (req, res, extraOptions = {}) => {
+    const conn = resolveConnection()
+    const status = getRejectionStatus(req, { connection: conn, ...extraOptions })
+    if (status !== undefined) {
+      const code = status === 401 ? 'unauthorized' : 'forbidden'
+      const message = status === 401
+        ? 'unauthorized: session or token required'
+        : (extraOptions.message || 'same-origin only')
+      writeJson(res, status, { ok: false, error: { code, message } })
+      return true
+    }
+    return false
+  }
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-tts/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res)) return
       const cfg = live()
       writeJson(res, 200, {
         ok: true,
@@ -67,7 +95,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/stream',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
+      if (rejectIfUntrusted(req, res)) return
       try {
         res.writeHead(200, {
           'Content-Type': 'text/event-stream',
@@ -88,7 +116,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/models/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
+      if (rejectIfUntrusted(req, res)) return
       try {
         const list = await modelManager.listStatus()
         writeJson(res, 200, { ok: true, models: list })
@@ -103,10 +131,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/models/install',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       let body = {}
       try {
         const raw = await readBody(req, 16 * 1024)
@@ -147,10 +172,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'DELETE or POST only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       let body = {}
       try {
         const raw = await readBody(req, 16 * 1024)
@@ -179,10 +201,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/integrations',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res)) return
       function isPluginOrServicePresent(id) {
         if (!ctx) return false
         try {
@@ -246,10 +265,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'DELETE only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       const removed = await speechCache.clear()
       writeJson(res, 200, { ok: true, removed, cleared: removed })
     },
@@ -263,10 +279,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       const removed = await speechCache.clear()
       writeJson(res, 200, { ok: true, removed, cleared: removed })
     },
@@ -280,10 +293,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res)) return
       let body = {}
       try {
         const raw = await readBody(req, 64 * 1024)
@@ -313,10 +323,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/stats',
     handler: async (req, res) => {
       if (req.method === 'GET') {
-        if (!isTrustedSettingsRequest(req)) {
-          writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-          return
-        }
+        if (rejectIfUntrusted(req, res)) return
         writeJson(res, 200, { ok: true, total: stats.total, cacheHits: stats.cacheHits, errors: stats.errors, providers: stats.providers, breaker: typeof breakerSnapshot === 'function' ? breakerSnapshot() : [] })
         return
       }
@@ -324,10 +331,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET or DELETE' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       stats.total = 0
       stats.cacheHits = 0
       stats.errors = 0
@@ -340,11 +344,8 @@ export function registerHttpRoutes(ctx, api) {
     kind: 'exact',
     path: '/dsh-tts/config',
     handler: async (req, res) => {
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'dsh-tts: settings writes are same-origin only' } })
-        return
-      }
       if (req.method === 'GET') {
+        if (rejectIfUntrusted(req, res, { message: 'dsh-tts: settings writes are same-origin only' })) return
         writeJson(res, 200, await configResponse())
         return
       }
@@ -352,6 +353,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET or PUT' } })
         return
       }
+      if (rejectIfUntrusted(req, res, { requireAuth: true, message: 'dsh-tts: settings writes are same-origin only' })) return
       const settingsApi = typeof getSettingsApi === 'function' ? getSettingsApi() : null
       if (!settingsApi) {
         writeJson(res, 503, { ok: false, error: { code: 'settings', message: 'settings not ready' } })
@@ -423,10 +425,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'PUT or DELETE only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'dsh-tts: keys are same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true, message: 'dsh-tts: keys are same-origin only' })) return
       let payload = {}
       if (req.method === 'PUT' || (req.headers['content-length'] && Number(req.headers['content-length']) > 0)) {
         let raw
@@ -463,7 +462,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/pending',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
+      if (rejectIfUntrusted(req, res)) return
       const url = new URL(req.url || '/', 'http://127.0.0.1')
       const after = url.searchParams.get('after') || ''
       let items = pending.slice()
@@ -480,7 +479,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/speak',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
-      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
+      if (rejectIfUntrusted(req, res)) return
       let raw
       try { raw = await readBody(req, 256 * 1024) } catch (e) {
         writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return
@@ -531,4 +530,4 @@ export function registerHttpRoutes(ctx, api) {
     manifestUrl: new URL('../package.json', import.meta.url),
     mutex: updaterMutex,
   }), 'dsh-tts: updater route /api/dsh-tts/update')
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-tts",
-  "version": "0.4.34",
+  "version": "0.4.35",
   "description": "Text-to-speech for DeepSeek Harness: speak agent replies in the Web UI with a provider fallback chain (OpenAI, ElevenLabs, Google, Azure, Groq, Deepgram, OpenRouter, Edge, Piper, eSpeak).",
   "license": "MIT",
   "type": "module",