@irtio/protocol 0.3.0 → 0.5.0

package/dist/index.d.ts

@@ -384,4 +384,52 @@ declare const relaySchema: Schema<{
 declare const RELAY_HASH8: Uint8Array;
 declare function isRelayHash8(hash8: Uint8Array): boolean;
 
-export { type Call, type ClientCallable, type Credential, ERROR_CATALOGUE, type ErrorCatalogueEntry, ErrorCode, type ErrorCodeDef, type ErrorCodeName, type ErrorPayload, type Frame, FrameType, type Hello, type Msg, type MsgTarget, PRESENCE_COLLECTION, PROTOCOL_VERSION, type Ping, type Pong, type PresenceRecord, RELAY_HASH8, type Reply, type Welcome, builtinRpcs, correctPayload, decodeCall, decodeErrorPayload, decodeFrame, decodeHello, decodeMsg, decodePing, decodePong, decodeReply, decodeWelcome, deltaPayload, encodeCall, encodeCorrectFrame, encodeDeltaFrame, encodeErrorPayload, encodeFrame, encodeHello, encodeMsg, encodePing, encodePong, encodeReply, encodeWelcome, encodeWriteFrame, errorByCode, formatError, isFrameType, isRelayHash8, presenceEntity, readCorrectAppliedTick, readCorrectClientTick, relaySchema, requestOwnership, rpcByIdOf, rpcIdOf, rpcTable, withBuiltins, writePayload };
+/**
+ * Browser-origin policy, shared by every component that has to answer "may this page connect?"
+ *
+ * Three components ask that question about the same project and must answer it identically: the
+ * router (from the control plane's fresh list), the guest supervisor (from the list frozen into
+ * its boot env), and `irtio dev` (from `IRT_ORIGINS`). It lived only in the supervisor until the
+ * router was given the list it had been fetching and discarding, at which point one copy of the
+ * rules became the only honest arrangement.
+ *
+ * The rules, in the order they are applied:
+ *
+ *   1. No `Origin` header at all — bots, native clients, tests, `curl` — is NOT a browser and is
+ *      allowed unless the caller opts out. Origin locking is a same-origin-policy backstop; it
+ *      protects a browser user from a page they did not open, and there is no such user here.
+ *   2. `*` in the list allows every origin.
+ *   3. Localhost is ALWAYS allowed, on any port and any scheme. A project's list starts blank,
+ *      and a developer running `vite dev` against hosted rooms must not have to register a port
+ *      number before anything works. Nothing is protected by refusing it: an attacker who can
+ *      serve the victim a page from their own machine has already won.
+ *   4. Otherwise the origin must appear in the list verbatim.
+ */
+/**
+ * Is `origin` a page served from the connecting developer's own machine?
+ *
+ * Matches on the HOSTNAME only, so every port passes — a dev server's port is an implementation
+ * detail that changes per tool and per run. `*.localhost` (which resolves to loopback in every
+ * current browser) counts too. A `file://` page sends the literal `null`, which does not parse
+ * as a URL and is therefore not local: it is indistinguishable from a sandboxed iframe on a
+ * hostile site, and lumping the two together would silently widen rule 3 to the open internet.
+ */
+declare function isLocalhostOrigin(origin: string): boolean;
+/**
+ * `origins: ['*']` allows every browser origin; an empty list allows only localhost. A missing
+ * `Origin` (bots, native clients, tests) is allowed unless `allowNoOrigin` is explicitly `false`.
+ */
+declare function originAllowed(origins: readonly string[], allowNoOrigin: boolean, origin: string | undefined): boolean;
+/**
+ * Splits an `IRT_ORIGINS`-shaped value into a list. The distinction that matters is UNSET vs
+ * EMPTY, and it is the caller's to make: unset means "no policy configured, allow everything"
+ * (`['*']`, what a hand-run supervisor and every pre-blank-default deployment expect), while an
+ * empty string means "a policy IS configured and it lists nothing" — localhost only.
+ *
+ * Getting that backwards fails OPEN, which is why it is one function with one test rather than a
+ * `?? '*'` at each call site. `deploy/host/rootfs/tenant-init` has the same trap in shell:
+ * `${IRT_ORIGINS:-*}` treats empty as unset, `${IRT_ORIGINS-*}` does not.
+ */
+declare function parseOriginList(raw: string | undefined): readonly string[];
+
+export { type Call, type ClientCallable, type Credential, ERROR_CATALOGUE, type ErrorCatalogueEntry, ErrorCode, type ErrorCodeDef, type ErrorCodeName, type ErrorPayload, type Frame, FrameType, type Hello, type Msg, type MsgTarget, PRESENCE_COLLECTION, PROTOCOL_VERSION, type Ping, type Pong, type PresenceRecord, RELAY_HASH8, type Reply, type Welcome, builtinRpcs, correctPayload, decodeCall, decodeErrorPayload, decodeFrame, decodeHello, decodeMsg, decodePing, decodePong, decodeReply, decodeWelcome, deltaPayload, encodeCall, encodeCorrectFrame, encodeDeltaFrame, encodeErrorPayload, encodeFrame, encodeHello, encodeMsg, encodePing, encodePong, encodeReply, encodeWelcome, encodeWriteFrame, errorByCode, formatError, isFrameType, isLocalhostOrigin, isRelayHash8, originAllowed, parseOriginList, presenceEntity, readCorrectAppliedTick, readCorrectClientTick, relaySchema, requestOwnership, rpcByIdOf, rpcIdOf, rpcTable, withBuiltins, writePayload };

package/dist/index.js

@@ -405,6 +405,29 @@ function isRelayHash8(hash8) {
   for (const b of hash8) if (b !== 0) return false;
   return true;
 }
+
+// src/origin.ts
+var LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]", "0.0.0.0"]);
+function isLocalhostOrigin(origin) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return LOCAL_HOSTNAMES.has(host) || host.endsWith(".localhost");
+}
+function originAllowed(origins, allowNoOrigin, origin) {
+  if (origin === void 0 || origin === "") return allowNoOrigin;
+  if (origins.includes("*")) return true;
+  if (isLocalhostOrigin(origin)) return true;
+  return origins.includes(origin);
+}
+function parseOriginList(raw) {
+  if (raw === void 0) return ["*"];
+  return raw.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
+}
 export {
   ERROR_CATALOGUE,
   ErrorCode,
@@ -439,7 +462,10 @@ export {
   errorByCode,
   formatError,
   isFrameType,
+  isLocalhostOrigin,
   isRelayHash8,
+  originAllowed,
+  parseOriginList,
   presenceEntity,
   readCorrectAppliedTick,
   readCorrectClientTick,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@irtio/protocol",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "irtio wire protocol: frames, framing, session payloads, error codes, built-in presence",
   "license": "MIT",
   "publishConfig": {
@@ -20,7 +20,7 @@
     "dist"
   ],
   "dependencies": {
-    "@irtio/schema": "0.3.0"
+    "@irtio/schema": "0.5.0"
   },
   "scripts": {
     "build": "tsup",