@iasiv5/dsh-obmc-web 0.1.0 → 0.1.2

package/README.md

@@ -121,8 +121,18 @@ bootstrap），地址仍会写入配置并提示下一步去点「安装并启
 - 上游仅 `127.0.0.1`（SSH 隧道，端口默认 18443），不新增任何公网监听。
 - 剥掉的响应头：`X-Frame-Options`、`Strict-Transport-Security`、
   `WWW-Authenticate`（防止 bmcweb 的 401 Basic challenge 弹浏览器原生
-  凭据框；BMC SPA 走 POST /login JSON + cookie），CSP 仅移除
+  凭据框；BMC SPA 走 POST /login JSON + cookie）、`Clear-Site-Data`
+  （bmcweb 登出会发 `Clear-Site-Data: "cache","cookies","storage"`，语义
+  是清空整个源的 Cookie 与存储——在同源代理下会连带清掉 GUI 自身的会话
+  Cookie，把 DSH 一起登出；BMC 侧登出不受影响：显式的 `SESSION=` 过期
+  Set-Cookie 照常透传，服务端会话照常销毁），CSP 仅移除
   `frame-ancestors` 指令；其余（含 Cookie）原样透传。
+- 非 `/login` 的上游 401 统一降级为 403：BMC SPA 的 axios 拦截器对其他
+  401 会执行 `window.location = "/login"`——根绝对路径的顶层导航，在
+  同源代理下会逃出 `/bmc` 前缀，落到 GUI 自己的 `/login` 并被认证门
+  重定向进 DSH 应用，把用户从 BMC 控制台拽走（首次打开最常见）。403
+  走 SPA 的原地「未授权」提示，不发生导航；`/login` 的真实 401 保留
+  （登录表单错误处理与 CSRF 探测依赖它）。
 - 不在任何地方存储 BMC 凭据；登录在 BMC 自身页面完成。
 - 信任围栏仿照 dsh-better-sidebar 的 trust-fence（Host 必须是 loopback
   或部署信任的 authority、`Sec-Fetch-Site` 不得为 cross-site、Origin 若有

package/lib/index.js

@@ -10,11 +10,16 @@
  * after its own exact table, so the GUI's own longer routes always win and
  * a duplicate registration is skipped (never throws the plugin).
  *
- * Embed-hostile response headers are removed (X-Frame-Options, HSTS,
- * CSP frame-ancestors — and WWW-Authenticate, so bmcweb's 401 Basic
- * challenges can never pop the browser's native credential dialog; the BMC
- * SPA logs in via POST /login JSON + cookie). Everything else passes
- * through untouched; no credentials are stored anywhere.
+ * Embed-hostile and origin-hostile response headers are removed
+ * (X-Frame-Options, HSTS, CSP frame-ancestors, WWW-Authenticate so bmcweb's
+ * 401 Basic challenges can never pop the browser's native credential
+ * dialog — the BMC SPA logs in via POST /login JSON + cookie — and
+ * Clear-Site-Data, whose origin-wide wipe on BMC logout would otherwise
+ * destroy the GUI's session cookie). Non-/login 401s are degraded
+ * to 403: the BMC SPA redirects the whole tab to root-absolute /login on
+ * any other 401, which on this origin lands in the GUI's auth gate and
+ * bounces the browser into the DSH app. Everything else passes through
+ * untouched; no credentials are stored anywhere.
  *
  * BMC address discovery: the BMC's address is often DHCP-assigned by the
  * jump host that links it (a small LAN of its own) and may change. When
@@ -86,7 +91,18 @@ const HOP = new Set([
 // www-authenticate is dropped so bmcweb's 401 Basic challenges (e.g. on
 // /login and unknown paths) can never pop the browser's native credential
 // dialog — the BMC SPA logs in via POST /login JSON + cookie, not Basic.
-const DROP_RESPONSE = new Set([...HOP, 'x-frame-options', 'strict-transport-security', 'www-authenticate'])
+// clear-site-data is dropped because bmcweb's logout answers
+// Clear-Site-Data: "cache","cookies","storage" — an instruction to wipe
+// EVERY cookie/cache/storage entry for the ORIGIN. Through this same-origin
+// proxy that origin is the GUI's: one BMC logoff would otherwise destroy
+// the DSH session cookie (and DSH's localStorage) too. BMC-side logout
+// still works without it: bmcweb expires its SESSION cookie via an
+// explicit Set-Cookie (passes through) and destroys the session
+// server-side; only the origin-wide nuke is suppressed.
+const DROP_RESPONSE = new Set([
+  ...HOP, 'x-frame-options', 'strict-transport-security', 'www-authenticate',
+  'clear-site-data',
+])
 
 const agent = new https.Agent({ keepAlive: true, maxSockets: 8, rejectUnauthorized: false })
 
@@ -514,7 +530,20 @@ function proxyRequest(req, res, targetPath, log) {
         }
         raw.push(key, value)
       }
-      res.writeHead(up.statusCode, raw)
+      // The BMC SPA's axios interceptor treats ANY 401 outside /login as
+      // "session lost" and answers with `window.location = "/login"` — a
+      // ROOT-ABSOLUTE navigation that escapes the /bmc prefix. On this
+      // origin /login belongs to the GUI's auth gate, which 307s such
+      // navigations into the DSH app, yanking the browser out of the BMC
+      // console entirely (seen on the first console open after a DSH
+      // restart: the SPA boots with stale localStorage login hints, probes
+      // /redfish/... while logged out, and the 401 bounce follows). Degrade
+      // every non-/login 401 to 403: the SPA's 403 path (setUnauthorized)
+      // is an in-place toast, never a navigation. /login keeps its true
+      // status so the login form's error handling and the CSRF probe keep
+      // working.
+      const status = up.statusCode === 401 && !/^\/login(\?|$)/.test(targetPath) ? 403 : up.statusCode
+      res.writeHead(status, raw)
       up.pipe(res)
     },
   )

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@iasiv5/dsh-obmc-web",
-  "version": "0.1.0",
-  "description": "BMC Web UI in the DSH sidebar: same-origin host proxy riding an SSH local-forward relay (obmc-web-relay), plus a Settings launcher panel.",
+  "version": "0.1.2",
+  "description": "OpenBMC 控制台入口：设置一级菜单「BMC 控制台」面板一键在顶层标签页打开 BMC Web UI，同源代理经 SSH 本地转发 relay（obmc-web-relay）抵达 BMC，BMC IP 变化自动探测并重定向隧道；需 SSH 跳板机可达 BMC。",
   "type": "module",
   "main": "./lib/index.js",
   "exports": {