@jondotsoy/envs 0.1.9-alpha.2 → 0.1.9-alpha.4

package/README.md

@@ -43,7 +43,7 @@ A walkthrough with a screenshot of each action is in [docs/ui.md](docs/ui.md) (i
 | Command | What it does |
 | --- | --- |
 | `envs edit` | Runs `init` if `.envs/values.yml` does not exist yet, then runs `pull`, opens `values.yml` with `code -w` and, when the editor closes, runs `push`. If the editor fails, it does not `push`. |
-| `envs edit --ui` | Same `init` and `pull`, but instead of VS Code it starts a local server (`127.0.0.1`, random port) and opens a React web editor with the values of `values.yml` (worktree profiles, defaults and per-worktree values). The **Save** button in the top right corner writes `values.yml` and runs `push`. Its **History** panel lists the history points (newest first); hovering or clicking a point shows what restoring it would change in the editor (red: removed, green: changed or added), and its **Restore** button, after a confirmation, runs `envs restore` for that point. Open the address it prints (it carries a one-time access token); requests without the token, from another host name or from another site are refused (see [docs/ui.md](docs/ui.md)). Stop the server with Ctrl+C. |
+| `envs edit --ui` | Same `init` and `pull`, but instead of VS Code it starts a local server (`127.0.0.1`, random port) and opens a React web editor with the values of `values.yml` (worktree profiles, defaults and per-worktree values). The **Save** button in the top right corner writes `values.yml` and runs `push`. Its **History** panel lists the history points (newest first); hovering or clicking a point shows what restoring it would change in the editor (red: removed, green: changed or added), and its **Restore** button, after a confirmation, runs `envs restore` for that point. Open the address it prints (it carries a single-use access token: the first visit trades it for a session cookie, and using it prints a fresh single-use address; if the browser cannot be opened, the address is printed to open by hand; the token never appears in `ps`); requests without the token, from another host name or from another site are refused (see [docs/ui.md](docs/ui.md)). Stop the server with Ctrl+C. |
 | `envs init` | Creates `.envs/`, `.envs/.gitignore` (containing `*`) and an empty `.envs/values.yml`. Does not overwrite existing files. |
 | `envs pull` | Reads the `.env` of the main repo and of each worktree and writes it to `values.yml`. Variables that are no longer in a `.env` are removed from `values.yml` for that worktree. |
 | `envs push` | Writes `values.yml` to the `.env` of each worktree. Updates existing variables in place, appends new ones at the end, keeps comments, refuses (writing nothing) a variable name that is not valid or a value with a line break, and removes the orphan variables: those `envs` manages (they are, or were, in `values.yml` or its history) but that the worktree no longer resolves, for example after `envs restore`. Variables that `envs` never saw are left alone. |

package/SECURITY.md

@@ -28,7 +28,7 @@ I will reply as soon as possible and we will coordinate the fix and the disclosu
 | `envs init` | — | Creates `<root>/.envs/`, `<root>/.envs/.gitignore` and `<root>/.envs/values.yml`, only if they do not exist. Never overwrites. |
 | `envs pull` | `<worktree>/.env` of each worktree | Rewrites `<root>/.envs/values.yml`. The file is serialized again, so YAML comments are lost. |
 | `envs push` | `<root>/.envs/values.yml` | Creates or updates `<worktree>/.env` of each worktree that has values. Updates existing variables in place, appends new ones at the end and keeps the rest of the file (it sets the mode of every `.env` it writes to `600`, so another user, such as a container mounting it, can no longer read it), except the orphan variables: those `envs` manages (they are or were in `values.yml` or its history) that the worktree no longer resolves are removed. If there are `defaults`, this includes all worktrees. |
-| `envs edit` | Same as `pull` and `push` | Same as `pull` and `push`. It also runs `code -w <root>/.envs/values.yml`. With `--ui` it serves the web editor instead (see below). |
+| `envs edit` | Same as `pull` and `push` | Same as `pull` and `push`. It also runs `code -w <root>/.envs/values.yml`. With `--ui` it serves the web editor instead and runs the system opener (`xdg-open`, `open` or `explorer`) on a temporary redirect page under the OS temp directory (see below). |
 | `envs use`, `envs restore` | `<root>/.envs/values.yml`, `<root>/.envs/history.ndjson` | Rewrite `values.yml` and then act as `push`. |
 | `envs config` | `<root>/.envs/config.yml` | Creates or updates `<root>/.envs/config.yml` (mode `600`). |
 
@@ -51,7 +51,14 @@ Additionally:
 
 ## Web editor (`envs edit --ui`)
 
-The server listens on `127.0.0.1` only and exposes the values of every `.env`, secrets included, so each request must pass these checks: a random per-run access token (in the printed URL, then an `HttpOnly`, `SameSite=Strict` cookie), a `Host` of this server (no DNS rebinding), an `Origin` of this server, `application/json` bodies and a body of at most 5 MiB; it never answers CORS preflights. Open only the address printed by the command and do not share it: it carries the token. See [docs/ui.md](docs/ui.md).
+The server listens on `127.0.0.1` only and exposes the values of every `.env`, secrets included, so each request must pass these checks: a random per-run access token (in the printed URL, **single-use**: the first visit trades it for a different session secret, set as an `HttpOnly`, `SameSite=Strict` cookie), a `Host` of this server (no DNS rebinding), an `Origin` of this server, `application/json` bodies and a body of at most 5 MiB; it never answers CORS preflights. Open only the address printed by the command and do not share it: it carries the token. See [docs/ui.md](docs/ui.md).
+
+How the access token is handled:
+
+- **Single-use.** Once the token in the URL is used it stops working (`401`), so a copy left in the browser history, the terminal or a screenshot is useless afterwards. Using it prints a fresh single-use URL to stdout (`New single-use URL: …`) to open the editor from another browser; every URL gives the same session. The session secret is never in a URL.
+- **Not in `ps`.** The URL is not passed as an argument to `xdg-open`/`open`/`explorer`, where any user could read it in the process list. The opener receives a private temporary page (a directory made with `mkdtemp`, file mode `600`) that redirects to the URL. The page is removed as soon as the token is used, after 60 seconds at most, when the process exits, or when the opener fails.
+- **If the browser cannot be opened** the command prints `Could not open the browser. Open this address manually: …`.
+- **Remaining exposure.** The token is printed to stdout and is in the address bar until it is used, so anyone who can read your screen or your terminal output in that moment can use it before you do. If the address is opened by someone else first, your own visit gets a `401`: stop the server (Ctrl+C) and start it again.
 
 ## The history
 

package/envs.js

@@ -499,8 +499,16 @@ function presentedToken(req) {
 }
 async function serveUi(ctx) {
   const assets = await loadAssets();
-  const token = randomBytes(24).toString("base64url");
+  let opened;
+  let token = randomBytes(24).toString("base64url");
+  const session = randomBytes(24).toString("base64url");
   const guard = (handler) => async (req) => {
+    const res = await check(req, handler);
+    for (const [name, value] of Object.entries(HARDENING_HEADERS))
+      res.headers.set(name, value);
+    return res;
+  };
+  const check = async (req, handler) => {
     const port = server.port;
     const hosts = [`127.0.0.1:${port}`, `localhost:${port}`];
     if (!hosts.includes(req.headers.get("host") ?? "")) {
@@ -511,18 +519,24 @@ async function serveUi(ctx) {
       return new Response("Forbidden origin", { status: 403 });
     }
     const url = new URL(req.url);
-    if (url.pathname === "/" && sameToken(url.searchParams.get("token"), token)) {
+    if (req.method === "GET" && url.pathname === "/" && sameToken(url.searchParams.get("token"), token)) {
+      token = randomBytes(24).toString("base64url");
+      ctx.log(`New single-use URL: ${urlWith(token)}`);
+      opened?.then((cleanup) => cleanup?.(), () => {});
       return new Response(null, {
         status: 302,
         headers: {
           location: "/",
-          "set-cookie": `${TOKEN_COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/`
+          "set-cookie": `${TOKEN_COOKIE}=${session}; HttpOnly; SameSite=Lax; Path=/`
         }
       });
     }
-    if (!sameToken(presentedToken(req), token)) {
+    if (!sameToken(presentedToken(req), session)) {
       return new Response("Unauthorized: open the address printed by `envs edit --ui`.", { status: 401 });
     }
+    if (!["GET", "HEAD", "PUT", "POST"].includes(req.method)) {
+      return new Response("Method not allowed", { status: 405, headers: { allow: "GET, HEAD, PUT, POST" } });
+    }
     if (req.method !== "GET" && req.method !== "HEAD" && !req.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
       return new Response("Unsupported media type", { status: 415 });
     }
@@ -574,17 +588,28 @@ async function serveUi(ctx) {
       return asset ? new Response(asset) : new Response("Not found", { status: 404 });
     })
   });
-  const url = `http://127.0.0.1:${server.port}/?token=${token}`;
+  const urlWith = (t) => `http://127.0.0.1:${server.port}/?token=${t}`;
+  const url = urlWith(token);
   ctx.log(`Web editor running at ${url} (Ctrl+C to stop)`);
-  await ctx.openUrl?.(url);
+  try {
+    opened = ctx.openUrl?.(url);
+    await opened;
+  } catch {
+    ctx.log(`Could not open the browser. Open this address manually: ${url}`);
+  }
   await (ctx.waitForExit ?? (() => new Promise(() => {})))();
   await server.stop(true);
   return 0;
 }
-var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v), TOKEN_COOKIE = "envs_token", MAX_BODY_BYTES;
+var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v), TOKEN_COOKIE = "envs_token", HARDENING_HEADERS, MAX_BODY_BYTES;
 var init_server = __esm(() => {
   init_envs();
   ANSI = /\x1b\[[0-9;]*m/g;
+  HARDENING_HEADERS = {
+    "x-content-type-options": "nosniff",
+    "content-security-policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+    "referrer-policy": "no-referrer"
+  };
   MAX_BODY_BYTES = 5 * 1024 * 1024;
 });
 
@@ -593,6 +618,8 @@ import { AsyncLocalStorage } from "async_hooks";
 import { chmod, mkdir, open, rename, unlink, writeFile } from "fs/promises";
 import { basename, dirname, join as join2 } from "path";
 import { stat } from "fs/promises";
+import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
 import { createHash, createHmac, randomBytes as randomBytes2 } from "crypto";
 import { appendFile, truncate } from "fs/promises";
 var {$ } = globalThis.Bun;
@@ -1567,9 +1594,21 @@ Commands:
   },
   openUrl: async (url) => {
     const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+    const dir = mkdtempSync(join2(tmpdir(), "envs-"));
+    const cleanup = () => rmSync(dir, { recursive: true, force: true });
     try {
-      await Bun.spawn([opener, url], { stdio: ["ignore", "ignore", "ignore"] }).exited;
-    } catch {}
+      const page = join2(dir, "open.html");
+      writeFileSync(page, `<!doctype html><meta charset="utf-8"><meta http-equiv="refresh" content="0;url=${url}"><script>location.replace(${JSON.stringify(url)})</script>`, { mode: 384 });
+      process.once("exit", cleanup);
+      setTimeout(cleanup, 60000).unref();
+      const code = await Bun.spawn([opener, page], { stdio: ["ignore", "ignore", "ignore"] }).exited;
+      if (code !== 0)
+        throw new Error(`${opener} exited with code ${code}`);
+      return cleanup;
+    } catch (error) {
+      cleanup();
+      throw error;
+    }
   },
   waitForExit: () => new Promise((resolve) => {
     process.once("SIGINT", () => resolve());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jondotsoy/envs",
-  "version": "0.1.9-alpha.2",
+  "version": "0.1.9-alpha.4",
   "license": "MIT",
   "author": {
     "name": "Jonathan Delgado",