@goodandready/dsh-tts 0.4.34 → 0.4.36

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.4.36 (2026-10-23)
+
+### Fixed
+- **Edge TTS Transient Error Retry** (#212, GitHub #4):
+  - Retries transient `edge_tts.exceptions.NoAudioReceived` errors and empty audio payloads (`< 32` bytes) up to 3 times before failing or tripping circuit breaker.
+  - Automatically cleans up corrupt/empty audio artifacts between retry attempts.
+  - Honors `req.signal` (AbortSignal) cancellation during backoff delays without hanging.
+  - Fails fast on `ENOENT` / missing binary without wasting retry cycles.
+
+## 0.4.35 (2026-10-20)
+
+### Fixed
+- **Authentication Guard for Administrative and Credential Routes** (#210):
+  - Enforced DSH core connection authentication (`connection.requestRejection(req)`) across all `/dsh-tts/*` HTTP endpoints.
+  - Fail-closed: Remote LAN clients without an authenticated operator session or token are rejected with 401/403 and cannot manage credentials or mutate plugin configuration (`PUT/DELETE /dsh-tts/credential`, `PUT /dsh-tts/config`, `/dsh-tts/models/install`, `/dsh-tts/models/delete`, `/dsh-tts/cache/clear`).
+  - Permitted authenticated operators via DSH connection service to manage provider credentials and configuration from LAN or remote interfaces.
+  - Added helpers `getClientIp(req)`, `isLanAddress(address)`, and `getRejectionStatus(req, options)` with comprehensive unit test coverage.
+
 ## 0.4.34 (2026-10-17)
 
 - **Per-Reply Speak Action** (#208, GitHub PR #2):

package/lib/http-util.js

@@ -4,7 +4,7 @@ export function writeJson(res, code, body) {
   try {
     res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
     res.end(JSON.stringify(body))
-  } catch { /* socket closed */ }
+  } catch (_err) { /* socket closed */ }
 }
 
 export function readBody(req, maxBytes) {
@@ -23,15 +23,36 @@ export function readBody(req, maxBytes) {
 
 export function isLoopback(address) {
   if (!address || typeof address !== 'string') return false
+  const clean = address.toLowerCase().replace(/^\[|\]$/g, '')
   return (
-    address === '127.0.0.1' ||
-    address === '::1' ||
-    address === '::ffff:127.0.0.1' ||
-    address.startsWith('127.') ||
-    address === 'localhost'
+    clean === '127.0.0.1' ||
+    clean === '::1' ||
+    clean === '::ffff:127.0.0.1' ||
+    clean.startsWith('127.') ||
+    clean === 'localhost'
   )
 }
 
+export function isLanAddress(address) {
+  if (!address || typeof address !== 'string') return false
+  const clean = address.toLowerCase().replace(/^\[|\]$/g, '')
+  const ipv4 = clean.startsWith('::ffff:') ? clean.slice(7) : clean
+  return (
+    ipv4.startsWith('192.168.') ||
+    ipv4.startsWith('10.') ||
+    /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(ipv4)
+  )
+}
+
+export function getClientIp(request) {
+  if (!request) return ''
+  const remote = request.socket?.remoteAddress || request.connection?.remoteAddress
+  if (remote) {
+    return remote.startsWith('::ffff:') ? remote.slice(7) : remote
+  }
+  return ''
+}
+
 function parseCookies(cookieHeader) {
   if (!cookieHeader || typeof cookieHeader !== 'string') return {}
   const out = {}
@@ -47,66 +68,106 @@ function parseCookies(cookieHeader) {
 }
 
 /**
- * Strict fail-closed check for administrative/settings requests.
- * Only accepts loopback with matching origin/host, same-origin context,
- * or valid DSH auth tokens. Arbitrary headers, unverified tokens, and same-site requests are rejected.
+ * Returns undefined if the request is permitted, or an HTTP error status code (401, 403) if rejected.
+ *
+ * Evaluation order:
+ * 1. Base validation (fail-closed on missing headers or cross-site Sec-Fetch-Site).
+ * 2. Origin vs Host verification.
+ * 3. DSH connection service authentication (connection.requestRejection(request)).
+ * 4. Fallback authentication when connection service is absent (env token, loopback, etc.).
+ *
+ * @param {object} request Node HTTP request
+ * @param {object} [options]
+ * @param {object} [options.connection] DSH connection service
+ * @param {boolean} [options.requireAuth] require authenticated operator (fail-closed for remote)
+ * @param {boolean} [options.isRemote] mark in-memory/mock request as remote
+ * @returns {number|undefined} undefined if allowed, 401 or 403 if rejected
  */
-export function isTrustedSettingsRequest(request) {
-  if (!request || !request.headers) return false
+export function getRejectionStatus(request, options = {}) {
+  if (!request || !request.headers) return 403
 
-  // Fail-closed: unconditionally reject cross-site and non-same-origin Sec-Fetch-Site (e.g. same-site, cross-site)
+  // 1. Fail-closed: unconditionally reject cross-site and non-same-origin Sec-Fetch-Site (e.g. same-site, cross-site)
   const secFetch = request.headers['sec-fetch-site']
-  if (secFetch && secFetch !== 'same-origin') {
-    return false
+  if (secFetch && secFetch !== 'same-origin' && secFetch !== 'none') {
+    return 403
   }
 
-  // If origin is present, ensure it matches request host
+  // 2. If origin is present, ensure it matches request host
   const origin = request.headers['origin']
   const host = request.headers['host']
   if (origin && host) {
     try {
       const originHost = new URL(origin).host
-      if (originHost !== host) return false
-    } catch {
-      return false
+      if (originHost !== host) return 403
+    } catch (_err) {
+      return 403
+    }
+  }
+
+  // 3. If DSH connection service is available, invoke requestRejection(req)
+  const conn = options.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(request)
+    if (rejection !== undefined && rejection !== null && rejection !== false) {
+      return typeof rejection === 'number' ? rejection : 401
     }
+    // Admitted by DSH connection service
+    return undefined
   }
 
-  // Verify explicit authorization token against DSH environment tokens if defined
+  // 4. Verify explicit authorization token against DSH environment tokens if defined
   const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN
   const rawAuth = request.headers['authorization'] || request.headers['x-dsh-auth']
   const cookieHeader = request.headers['cookie']
 
   if (expectedToken) {
+    let token = ''
     if (typeof rawAuth === 'string') {
-      const token = rawAuth.startsWith('Bearer ') ? rawAuth.slice(7).trim() : rawAuth.trim()
-      if (token && token === expectedToken) return true
+      token = rawAuth.startsWith('Bearer ') ? rawAuth.slice(7).trim() : rawAuth.trim()
     }
-    if (typeof cookieHeader === 'string') {
+    if (!token && typeof cookieHeader === 'string') {
       const cookies = parseCookies(cookieHeader)
-      const token = cookies['token'] || cookies['dsh_token']
-      if (token && token === expectedToken) return true
+      token = cookies['token'] || cookies['dsh_token'] || ''
+    }
+    if (token && token === expectedToken) {
+      return undefined
     }
+    return 401
   }
 
-  // Remote IP loopback check
-  const remoteAddr = request.socket?.remoteAddress || request.connection?.remoteAddress
+  // 5. Remote IP check
+  const remoteAddr = getClientIp(request)
   if (remoteAddr) {
-    return isLoopback(remoteAddr)
+    if (isLoopback(remoteAddr)) {
+      return undefined
+    }
+    // Remote client (LAN or WAN) without connection auth or token:
+    // Fail-closed. For write / sensitive endpoints requireAuth returns 401, otherwise 403.
+    return options.requireAuth ? 401 : 403
   }
 
-  // Internal/mock caller without socket: only allow if sec-fetch-site is explicitly same-origin or origin matches host
+  // 6. Internal/mock caller without socket:
+  if (options.requireAuth && options.isRemote) {
+    return 401
+  }
   if (secFetch === 'same-origin') {
-    return true
+    return undefined
   }
-
   if (origin && host) {
     try {
-      return new URL(origin).host === host
-    } catch {
-      return false
+      if (new URL(origin).host === host) return undefined
+    } catch (_err) {
+      return 403
     }
   }
 
-  return false
+  return 403
 }
+
+/**
+ * Strict fail-closed check for administrative/settings requests.
+ * Backward-compatible boolean wrapper around getRejectionStatus.
+ */
+export function isTrustedSettingsRequest(request, options = {}) {
+  return getRejectionStatus(request, options) === undefined
+}

package/lib/local.js

@@ -3,23 +3,47 @@ import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
 
-function spawnCollect(bin, args, { stdinText, timeoutMs } = {}) {
+function spawnCollect(bin, args, { stdinText, timeoutMs, signal, spawnImpl = spawn } = {}) {
   return new Promise((resolve, reject) => {
-    const proc = spawn(bin, args, { stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true })
+    if (signal?.aborted) {
+      reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'))
+      return
+    }
+    const proc = spawnImpl === spawn
+      ? spawn(bin, args, { stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true })
+      : spawnImpl(bin, args, { stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true })
     const out = []
     const err = []
     const timer = setTimeout(() => {
-      try { proc.kill('SIGKILL') } catch { /* gone */ }
+      try { proc.kill('SIGKILL') } catch (_err) { /* process already exited */ }
       reject(new Error(`${bin} timed out`))
     }, timeoutMs || 60000)
-    proc.stdout.on('data', (c) => out.push(c))
-    proc.stderr.on('data', (c) => err.push(c))
-    proc.on('error', (e) => {
+
+    let onAbort = null
+    if (signal) {
+      onAbort = () => {
+        clearTimeout(timer)
+        try { proc.kill('SIGKILL') } catch (_err) { /* process already exited */ }
+        reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'))
+      }
+      signal.addEventListener('abort', onAbort, { once: true })
+    }
+
+    const cleanup = () => {
       clearTimeout(timer)
+      if (signal && onAbort) {
+        try { signal.removeEventListener('abort', onAbort) } catch (_err) { /* abort listener already removed */ }
+      }
+    }
+
+    proc.stdout?.on('data', (c) => out.push(c))
+    proc.stderr?.on('data', (c) => err.push(c))
+    proc.on('error', (e) => {
+      cleanup()
       reject(new Error(`${bin} unavailable: ${e.message}`))
     })
     proc.on('close', (code) => {
-      clearTimeout(timer)
+      cleanup()
       const stdout = Buffer.concat(out)
       const stderr = Buffer.concat(err).toString('utf8').slice(0, 240)
       if (code !== 0) {
@@ -29,10 +53,10 @@ function spawnCollect(bin, args, { stdinText, timeoutMs } = {}) {
       resolve(stdout)
     })
     if (stdinText != null) {
-      proc.stdin.on('error', () => {})
-      proc.stdin.end(Buffer.from(String(stdinText), 'utf8'))
+      proc.stdin?.on('error', () => {})
+      proc.stdin?.end(Buffer.from(String(stdinText), 'utf8'))
     } else {
-      proc.stdin.end()
+      proc.stdin?.end?.()
     }
   })
 }
@@ -64,24 +88,82 @@ export async function piperSpeak(text, { bin, model, timeoutMs }) {
   }
 }
 
-export async function edgeSpeak(text, { bin, voice, timeoutMs }) {
+export async function edgeSpeak(text, options = {}) {
+  const {
+    bin,
+    voice,
+    timeoutMs,
+    retries = 3,
+    retryDelayMs = 350,
+    signal,
+    spawnImpl = spawn,
+  } = options
+
+  const maxAttempts = Math.max(1, Number(retries) || 1)
   const dir = await mkdtemp(path.join(os.tmpdir(), 'dsh-tts-edge-'))
   const outFile = path.join(dir, 'out.mp3')
+  let lastError = null
+
   try {
-    await spawnCollect(bin || 'edge-tts', [
-      '--voice', voice || 'ru-RU-SvetlanaNeural',
-      '--text', text,
-      '--write-media', outFile,
-    ], { timeoutMs })
-    const bytes = await readFile(outFile)
-    if (!bytes || bytes.length < 32) throw new Error('edge-tts produced empty audio')
-    return { audio: bytes, mime: 'audio/mpeg' }
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+      if (signal?.aborted) {
+        throw signal.reason instanceof Error ? signal.reason : new Error('aborted')
+      }
+      try {
+        await rm(outFile, { force: true })
+      } catch (_err) { /* ignore cleanup error */ }
+
+      try {
+        await spawnCollect(bin || 'edge-tts', [
+          '--voice', voice || 'ru-RU-SvetlanaNeural',
+          '--text', text,
+          '--write-media', outFile,
+        ], { timeoutMs, signal, spawnImpl })
+
+        let bytes = null
+        try {
+          bytes = await readFile(outFile)
+        } catch (_readErr) {
+          throw new Error('edge-tts produced no output file')
+        }
+
+        if (!bytes || bytes.length < 32) {
+          throw new Error('edge-tts produced empty audio')
+        }
+
+        return { audio: bytes, mime: 'audio/mpeg' }
+      } catch (err) {
+        lastError = err
+        if (signal?.aborted) throw err
+
+        const errMsg = String((err && err.message) || err)
+        if (/ENOENT|not found/i.test(errMsg)) {
+          throw err
+        }
+
+        if (attempt < maxAttempts) {
+          const delay = typeof retryDelayMs === 'number' ? retryDelayMs * attempt : 350
+          if (delay > 0) {
+            await new Promise((resolve, reject) => {
+              const timer = setTimeout(resolve, delay)
+              if (signal) {
+                const onAbort = () => {
+                  clearTimeout(timer)
+                  reject(signal.reason instanceof Error ? signal.reason : new Error('aborted'))
+                }
+                signal.addEventListener('abort', onAbort, { once: true })
+              }
+            })
+          }
+        }
+      }
+    }
+    throw lastError || new Error('edge-tts failed after retries')
   } finally {
     await rm(dir, { recursive: true, force: true })
   }
 }
 
-
 /**
  * MiniMax via their official CLI utility.
  *
@@ -105,4 +187,4 @@ export async function minimaxSpeak(text, { bin, voice, model, timeoutMs }) {
   } finally {
     await rm(dir, { recursive: true, force: true })
   }
-}
+}

package/lib/providers/local.js

@@ -12,10 +12,21 @@ export function makeLocalProviders(deps, req) {
   const { cfg, modelManager } = deps
   const { text, lang, models, voices } = req
 
-  async function edge() {
+  async function edge(extraOptions = {}) {
     try {
       const voice = pick(DEFAULT_VOICES, voices, 'edge') || pick(DEFAULT_MODELS, models, 'edge')
-      const out = await edgeSpeak(text, { bin: cfg.edgeBin, voice, timeoutMs: cfg.timeoutMs })
+      const retries = typeof extraOptions.retries === 'number'
+        ? extraOptions.retries
+        : (typeof cfg.edgeRetries === 'number' ? cfg.edgeRetries : 3)
+      const out = await edgeSpeak(text, {
+        bin: cfg.edgeBin,
+        voice,
+        timeoutMs: cfg.timeoutMs,
+        retries,
+        retryDelayMs: extraOptions.retryDelayMs,
+        signal: req.signal,
+        spawnImpl: extraOptions.spawnImpl || req.edgeSpawnImpl,
+      })
       return { ok: true, provider: 'edge', audio: out.audio, mime: out.mime }
     } catch (e) {
       return { ok: false, provider: 'edge', reason: String(e && e.message || e) }
@@ -96,4 +107,4 @@ export function makeLocalProviders(deps, req) {
   }
 
   return { kokoro, f5, edge, piper, espeak, minimax }
-}
+}

package/lib/routes.js

@@ -1,7 +1,7 @@
 import { MODEL_SPECS } from './engines/manager.js'
 import { resolve } from 'node:path'
 import { registerPluginUpdater } from './updater.js'
-import { writeJson, readBody, isTrustedSettingsRequest } from './http-util.js'
+import { writeJson, readBody, getRejectionStatus, isTrustedSettingsRequest } from './http-util.js'
 import { addStreamSubscriber, removeStreamSubscriber, streamSubscriberCount } from './stream-hub.js'
 import { pendingKeyWrites, stripSecretsFromConfig, needsApiKey } from './keys.js'
 import { PROVIDER_KEYS } from './providers.js'
@@ -29,15 +29,43 @@ export function registerHttpRoutes(ctx, api) {
     validateConfig,
     breakerSnapshot,
   } = api
+
+  const resolveConnection = () => {
+    try {
+      if (api && api.connection) return api.connection
+    } catch (_err) { /* connection resolution fallback */ }
+    try {
+      if (ctx && typeof ctx.get === 'function') {
+        const c = ctx.get('connection')
+        if (c) return c
+      }
+    } catch (_err) { /* connection get fallback */ }
+    try {
+      if (ctx) return Reflect.get(ctx, 'connection') || ctx.connection
+    } catch (_err) { /* connection reflect fallback */ }
+    return undefined
+  }
+
+  const rejectIfUntrusted = (req, res, extraOptions = {}) => {
+    const conn = resolveConnection()
+    const status = getRejectionStatus(req, { connection: conn, ...extraOptions })
+    if (status !== undefined) {
+      const code = status === 401 ? 'unauthorized' : 'forbidden'
+      const message = status === 401
+        ? 'unauthorized: session or token required'
+        : (extraOptions.message || 'same-origin only')
+      writeJson(res, status, { ok: false, error: { code, message } })
+      return true
+    }
+    return false
+  }
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-tts/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res)) return
       const cfg = live()
       writeJson(res, 200, {
         ok: true,
@@ -67,7 +95,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/stream',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
+      if (rejectIfUntrusted(req, res)) return
       try {
         res.writeHead(200, {
           'Content-Type': 'text/event-stream',
@@ -88,7 +116,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/models/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
+      if (rejectIfUntrusted(req, res)) return
       try {
         const list = await modelManager.listStatus()
         writeJson(res, 200, { ok: true, models: list })
@@ -103,10 +131,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/models/install',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       let body = {}
       try {
         const raw = await readBody(req, 16 * 1024)
@@ -147,10 +172,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'DELETE or POST only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       let body = {}
       try {
         const raw = await readBody(req, 16 * 1024)
@@ -179,10 +201,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/integrations',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res)) return
       function isPluginOrServicePresent(id) {
         if (!ctx) return false
         try {
@@ -246,10 +265,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'DELETE only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       const removed = await speechCache.clear()
       writeJson(res, 200, { ok: true, removed, cleared: removed })
     },
@@ -263,10 +279,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       const removed = await speechCache.clear()
       writeJson(res, 200, { ok: true, removed, cleared: removed })
     },
@@ -280,10 +293,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res)) return
       let body = {}
       try {
         const raw = await readBody(req, 64 * 1024)
@@ -313,10 +323,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/stats',
     handler: async (req, res) => {
       if (req.method === 'GET') {
-        if (!isTrustedSettingsRequest(req)) {
-          writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-          return
-        }
+        if (rejectIfUntrusted(req, res)) return
         writeJson(res, 200, { ok: true, total: stats.total, cacheHits: stats.cacheHits, errors: stats.errors, providers: stats.providers, breaker: typeof breakerSnapshot === 'function' ? breakerSnapshot() : [] })
         return
       }
@@ -324,10 +331,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET or DELETE' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true })) return
       stats.total = 0
       stats.cacheHits = 0
       stats.errors = 0
@@ -340,11 +344,8 @@ export function registerHttpRoutes(ctx, api) {
     kind: 'exact',
     path: '/dsh-tts/config',
     handler: async (req, res) => {
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'dsh-tts: settings writes are same-origin only' } })
-        return
-      }
       if (req.method === 'GET') {
+        if (rejectIfUntrusted(req, res, { message: 'dsh-tts: settings writes are same-origin only' })) return
         writeJson(res, 200, await configResponse())
         return
       }
@@ -352,6 +353,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET or PUT' } })
         return
       }
+      if (rejectIfUntrusted(req, res, { requireAuth: true, message: 'dsh-tts: settings writes are same-origin only' })) return
       const settingsApi = typeof getSettingsApi === 'function' ? getSettingsApi() : null
       if (!settingsApi) {
         writeJson(res, 503, { ok: false, error: { code: 'settings', message: 'settings not ready' } })
@@ -423,10 +425,7 @@ export function registerHttpRoutes(ctx, api) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'PUT or DELETE only' } })
         return
       }
-      if (!isTrustedSettingsRequest(req)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'dsh-tts: keys are same-origin only' } })
-        return
-      }
+      if (rejectIfUntrusted(req, res, { requireAuth: true, message: 'dsh-tts: keys are same-origin only' })) return
       let payload = {}
       if (req.method === 'PUT' || (req.headers['content-length'] && Number(req.headers['content-length']) > 0)) {
         let raw
@@ -463,7 +462,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/pending',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
-      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
+      if (rejectIfUntrusted(req, res)) return
       const url = new URL(req.url || '/', 'http://127.0.0.1')
       const after = url.searchParams.get('after') || ''
       let items = pending.slice()
@@ -480,7 +479,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/speak',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
-      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
+      if (rejectIfUntrusted(req, res)) return
       let raw
       try { raw = await readBody(req, 256 * 1024) } catch (e) {
         writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return
@@ -531,4 +530,4 @@ export function registerHttpRoutes(ctx, api) {
     manifestUrl: new URL('../package.json', import.meta.url),
     mutex: updaterMutex,
   }), 'dsh-tts: updater route /api/dsh-tts/update')
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-tts",
-  "version": "0.4.34",
+  "version": "0.4.36",
   "description": "Text-to-speech for DeepSeek Harness: speak agent replies in the Web UI with a provider fallback chain (OpenAI, ElevenLabs, Google, Azure, Groq, Deepgram, OpenRouter, Edge, Piper, eSpeak).",
   "license": "MIT",
   "type": "module",