@lanes-sh/link 0.6.8 → 0.6.10

package/src/server/cors.ts

@@ -217,9 +217,9 @@ function withCors(response: Response, headers: Record<string, string>): Response
  *
  * Wrapped at `serve()` rather than inside the router, which is also where the
  * policy is decided: cross-origin access is a property of the address this is
- * bound to, exactly as `allowedHostnames` and the dashboard are, and putting all
- * three in one function is what makes the loopback exclusion legible instead of
- * an invariant spread across two files.
+ * bound to, exactly as `allowedHostnames` is, and putting both in one function
+ * is what makes the loopback exclusion legible instead of an invariant spread
+ * across two files.
  *
  * It is what makes the ordering safe, too. A preflight answered here never
  * reaches the rebinding guard inside `inner` — and does not need to, because a

package/src/server/edge.ts

@@ -1,3 +1,4 @@
+import { challenge, type AuthOutcome, type ChallengeError } from '#auth';
 import { RateLimiter } from '#policy';
 
 /**
@@ -15,6 +16,56 @@ import { RateLimiter } from '#policy';
  */
 export const FAILED_AUTH_PER_MINUTE = 30;
 
+/**
+ * A ceiling on the surface that answers *before* authentication.
+ *
+ * The limit above sits behind the bearer gate, and for a long time that was the
+ * whole of it — which left the four things that answer in front of the gate with
+ * no ceiling at all. On a `public` deployment every one of them costs the owner
+ * something, and none of them needs a credential to reach:
+ *
+ *   - `/health` presented with a credential re-reads the credential store, which
+ *     on a deployed target is a Secret Manager call — two, when the value the
+ *     process cached does not match, because a mismatch against a cached value
+ *     forces the re-read that makes a rotation take effect.
+ *   - `/register` writes an object to the workspace bucket, then lists two
+ *     namespaces to decide whether anything needs evicting.
+ *   - `/authorize` compares against the endpoint token, which is another read of
+ *     the credential store.
+ *   - `/token` reads and writes bucket objects.
+ *
+ * `/health` presented with *no* credential is deliberately free: it reads
+ * nothing, and it is what a platform probe and `lanes link outputs` send.
+ * Metering it would put a ceiling on the one request that costs nothing to
+ * answer.
+ */
+export const UNAUTHENTICATED_PER_MINUTE = 30;
+
+/**
+ * The same ceiling for the endpoint as a whole, keyed on nothing.
+ *
+ * **This is the one that actually holds.** The per-caller key below is the first
+ * `X-Forwarded-For` hop, which anyone talking to the endpoint directly can write
+ * as they please — so a per-caller limit alone bounds only a caller who is not
+ * trying, and rotating the header walks straight through it.
+ *
+ * A shared bucket has the opposite problem: whoever is spending it locks
+ * everyone else out, which is why `index.ts` refuses to key the *failed-auth*
+ * limit that way. Here the trade is different, because what is behind these
+ * paths is not the owner's ability to use their endpoint — a client that has
+ * already authorised holds a token and never comes back through them — it is a
+ * discovery document, a registration, and a consent screen. Losing those for a
+ * minute is an authorization that has to be retried. Not losing them costs a
+ * stranger's arbitrary spend against the credential store.
+ *
+ * Two hundred a minute is far above what an authorization flow uses: a connector
+ * being added is a handful of requests, once.
+ */
+export const UNAUTHENTICATED_TOTAL_PER_MINUTE = 200;
+
+/** The key the endpoint-wide bucket is held under. Constant on purpose. */
+const EVERYONE = 'endpoint';
+
 /**
  * Who an attempt is counted against.
  *
@@ -47,7 +98,143 @@ export function tooManyAttempts(retryAfterMs: number): Response {
   );
 }
 
-/** One bucket set per endpoint. Idle callers are dropped so keys do not accumulate. */
+/**
+ * One bucket set per endpoint.
+ *
+ * The map is bounded by `RateLimiter` itself rather than by a caller
+ * remembering to prune it. This comment used to say idle callers were dropped
+ * "so keys do not accumulate", and nothing anywhere called `prune` — so on a
+ * public URL the map grew one entry per distinct `X-Forwarded-For` for as long
+ * as the process lived, which is a header a stranger writes.
+ */
 export function failedAuthLimiter(): RateLimiter {
   return new RateLimiter();
 }
+
+/** The same, for the pre-authentication surface. Separate so one cannot spend the other. */
+export function unauthenticatedLimiter(): RateLimiter {
+  return new RateLimiter();
+}
+
+/**
+ * The refusal for a pre-authentication request over budget, or `undefined` to
+ * let it through.
+ *
+ * One function rather than a branch in the router, for the reason `./cors.ts`
+ * and `./oauth.ts` are their own files: `index.ts` gains a delegation instead of
+ * the whole of this behaviour, and it stays inside the size budget that would
+ * otherwise be the rule relaxed to fit this in.
+ *
+ * `isAuthorizationPath` is passed rather than imported so this file does not
+ * reach back into the router's path constants — `corsAware` takes the same shape
+ * for the same reason.
+ *
+ * Two buckets are taken rather than one short-circuiting the other, so a caller
+ * that has exhausted its own budget still counts against the endpoint's: the
+ * alternative lets a flood of distinct forwarded-for values leave the shared
+ * bucket untouched, which is precisely the case the shared bucket exists for.
+ */
+export function unauthenticatedRefusal(input: {
+  readonly request: Request;
+  readonly pathname: string;
+  readonly limiter: RateLimiter;
+  readonly healthPath: string;
+  readonly isAuthorizationPath: (pathname: string) => boolean;
+  readonly authorizationEnabled: boolean;
+}): Response | undefined {
+  // A `/health` carrying no credential reads nothing and is deliberately free —
+  // it is what a platform probe and `lanes link outputs` send, and a ceiling on
+  // the one request that costs nothing to answer is an outage waiting for an
+  // attack that did not have to cause one.
+  const costly =
+    input.pathname === input.healthPath
+      ? input.request.headers.get('authorization') !== null
+      : input.authorizationEnabled && input.isAuthorizationPath(input.pathname);
+
+  if (!costly) return undefined;
+
+  const caller = callerKey(input.request);
+  const mine = input.limiter.take(`caller:${caller}`, UNAUTHENTICATED_PER_MINUTE);
+  const everyone = input.limiter.take(EVERYONE, UNAUTHENTICATED_TOTAL_PER_MINUTE);
+  if (mine.allowed && everyone.allowed) return undefined;
+
+  return tooManyAttempts(Math.max(mine.retryAfterMs, everyone.retryAfterMs));
+}
+
+type RefusalReason = Extract<AuthOutcome, { ok: false }>['reason'];
+
+/**
+ * What a caller should do about each refusal.
+ *
+ * `invalid` is the only one a client can act on by itself: it presented a
+ * credential and this endpoint did not accept it, which is what a refresh is
+ * for. RFC 6750 §3.1 has a name for that and clients branch on it; the others
+ * mean there is nothing to refresh, and §3 says to stay quiet rather than send
+ * a client after a token it does not hold. `malformed` says nothing either —
+ * `invalid_request` carries a SHOULD of a 400 status, and changing that path's
+ * status is a larger question than this answers.
+ */
+const CHALLENGE: Partial<Record<RefusalReason, ChallengeError>> = {
+  invalid: {
+    code: 'invalid_token',
+    description: 'The credential is expired, revoked, or not one this endpoint issued.',
+  },
+};
+
+/** The same four, for whoever is reading the body rather than the header. */
+const HINTS: Record<RefusalReason, string> = {
+  missing: 'Present the profile token as: Authorization: Bearer <token>',
+  malformed: 'Present the profile token as: Authorization: Bearer <token>',
+  invalid: 'Refresh the credential. Authorize again only if the refresh is refused too.',
+  not_configured: 'This profile has no token yet. Run: lanes link token rotate',
+};
+
+/**
+ * The `401`, with whatever the caller can act on.
+ *
+ * Here rather than in the router because it is the same subject as the two
+ * ceilings above — what this endpoint does about a caller who has not
+ * authenticated — and because the router was over its size budget carrying both.
+ * The vocabulary is RFC 6750's on the header and plain English in the body, so
+ * whoever is reading a terminal and whoever is writing a client each get the
+ * version they can use.
+ */
+function unauthorized(reason: RefusalReason, metadataUrl: string | null): Response {
+  return new Response(
+    JSON.stringify({ error: 'unauthorized', reason, hint: HINTS[reason] }),
+    {
+      status: 401,
+      headers: {
+        'content-type': 'application/json',
+        'www-authenticate': challenge(metadataUrl, CHALLENGE[reason]),
+      },
+    },
+  );
+}
+
+/**
+ * What a caller who failed authentication gets: the `401`, or the `429` once
+ * they have failed too often.
+ *
+ * The ceiling is spent **after** the attempt rather than before it. Keyed on the
+ * caller alone, anyone able to reach the endpoint could spend the owner's budget
+ * and lock them out, which trades a cost problem for a worse availability one.
+ * Only a failure consumes a token, so a valid credential is never refused by
+ * this.
+ *
+ * `metadataUrl` is the whole handshake for a remote client: it reads the named
+ * document, finds the authorization server, and starts a flow. Without it the
+ * client has to guess the document's location, and a client that guesses wrong
+ * reports the endpoint as unreachable.
+ */
+export function authRefusal(input: {
+  readonly request: Request;
+  readonly reason: RefusalReason;
+  readonly limiter: RateLimiter;
+  readonly metadataUrl: string | null;
+}): Response {
+  const budget = input.limiter.take(callerKey(input.request), FAILED_AUTH_PER_MINUTE);
+  return budget.allowed
+    ? unauthorized(input.reason, input.metadataUrl)
+    : tooManyAttempts(budget.retryAfterMs);
+}

package/src/server/endpoint.ts

@@ -77,16 +77,6 @@ export interface EndpointOptions {
   readonly reporter?: EndpointReporter | undefined;
   /** Operational events. Silent when absent, which is what the tests want. */
   readonly log?: Logger | undefined;
-  /**
-   * Serve the dashboard at `/dashboard`.
-   *
-   * True for `lanes link start`, absent in a container — the same split as
-   * `mintToken`, and for a related reason. A deployed instance has no door a
-   * browser can come through (ADR-018), so a page there would be either
-   * unreachable or unguarded depending on `deploy.access`, and both are worse
-   * than not having one.
-   */
-  readonly dashboard?: boolean | undefined;
 }
 
 export interface RunningEndpoint {
@@ -184,12 +174,6 @@ function profileRuntimes(runtimes: ReadonlyMap<string, Runtime>): Map<string, Pr
         // through `skills.manage.write`, or by `lanes link skills add` in another
         // terminal — is a prompt without a restart (ADR-014).
         refreshSkills: runtime.refreshSkills,
-        // For a surface that reports rather than dispatches. A thunk rather
-        // than a snapshot because a reconcile lands between requests, and the
-        // dashboard reading a list captured at boot would keep showing an
-        // account as unauthorized after the connect that fixed it.
-        target: runtime.target,
-        connections: () => runtime.state.connections.list(),
       },
     ]),
   );
@@ -336,7 +320,6 @@ export async function startEndpoint(options: EndpointOptions): Promise<RunningEn
         : primary.authenticator,
       log,
       ...(gate ? { authorization: gate.surface } : {}),
-      ...(options.dashboard ? { dashboard: true } : {}),
       ...(options.port !== undefined ? { port: options.port } : {}),
       ...(options.host !== undefined ? { host: options.host } : {}),
     });

package/src/server/harness.ts

@@ -116,8 +116,15 @@ export interface HarnessOptions {
    * serving the old generation" case is reached; absent means nothing new.
    */
   reopen?: () => Promise<ReadonlyMap<string, ProfileRuntime>>;
-  /** Serve `/dashboard`, as `lanes link start` does and a container never does. */
-  dashboard?: boolean;
+  /**
+   * Meter the pre-authentication surface, as a routable deployment does.
+   *
+   * A harness binds loopback, where `serve()` leaves this off — the ceiling
+   * protects a credential-store call over the network and an object written to a
+   * bucket, and on loopback both are a local file. Set it to drive the deployed
+   * behaviour without a deployment.
+   */
+  meterUnauthenticated?: boolean;
 }
 
 /**
@@ -178,10 +185,6 @@ export function wireProfiles(options: HarnessOptions): WiredProfiles {
       dispatcher,
       policy,
       ...(options.refreshSkills ? { refreshSkills: () => options.refreshSkills!(registry) } : {}),
-      // As `profileRuntimes` supplies them for real. A harness that claims to
-      // be the real wiring and omits a field leaves that field untested.
-      target: 'local',
-      connections: () => state.connections.list(),
     }),
   );
 
@@ -260,7 +263,7 @@ export function startHarness(options: HarnessOptions): Harness {
     primary: options.profile,
     authenticator: gate ? new AuthenticatorChain([bearer, gate.authenticator]) : bearer,
     ...(gate ? { authorization: gate.surface } : {}),
-    ...(options.dashboard ? { dashboard: true } : {}),
+    ...(options.meterUnauthenticated ? { meterUnauthenticated: true } : {}),
     log,
   });
 

package/src/server/index.ts

@@ -1,18 +1,17 @@
-import { challenge, type Authenticator, type AuthOutcome, type ChallengeError } from '#auth';
+import type { Authenticator } from '#auth';
 import type { Logger } from '#connectivity';
 import { capabilityIdForToolName } from '#server/mcp';
 import { ATTACHMENTS_PATH, stageAttachment } from './attachments.ts';
 import { allowedHostnamesFor, rebindingRefusal } from './rebinding.ts';
 import { ANY_ORIGIN, corsAware, type CorsPolicy } from './cors.ts';
-import {
-  DASHBOARD_PATH,
-  dashboardSessions,
-  handleDashboard,
-  servesDashboard,
-} from './dashboard.ts';
 import type { Generation } from './generation.ts';
 import type { Generations } from './generations.ts';
-import { callerKey, failedAuthLimiter, FAILED_AUTH_PER_MINUTE, tooManyAttempts } from './edge.ts';
+import {
+  authRefusal,
+  failedAuthLimiter,
+  unauthenticatedLimiter,
+  unauthenticatedRefusal,
+} from './edge.ts';
 import {
   handleAuthorization,
   isAuthorizationPath,
@@ -57,46 +56,28 @@ export interface ServerOptions {
   /** Hostnames this endpoint answers to. See `./rebinding.ts`. */
   readonly allowedHostnames?: readonly string[] | undefined;
   /**
-   * Serve the dashboard.
+   * Meter the surface that answers before authentication.
    *
-   * Off unless asked for, and `serve()` withholds it anyway when the bind
-   * address is not loopback. `lanes link start` asks; `container.ts` does not.
-   * See `./dashboard.ts` for why a deployed instance has no browser-shaped door
-   * to put it behind.
+   * A property of what this is bound to, exactly as `cors` and
+   * `allowedHostnames` are, and decided in the same lines of `serve()`. Off on
+   * loopback, and that is not a gap: what the ceiling protects is a
+   * credential-store call over the network and an object written to a bucket,
+   * and on loopback both are a local file belonging to whoever is already
+   * standing at the machine. `./rebinding.ts` refuses the one caller that is not
+   * — a page the owner happens to be visiting — before this would be reached.
    */
-  readonly dashboard?: boolean | undefined;
+  readonly meterUnauthenticated?: boolean | undefined;
 }
 
-type RefusalReason = Extract<AuthOutcome, { ok: false }>['reason'];
-
-/**
- * What a caller should do about each refusal.
- *
- * `invalid` is the only one a client can act on by itself: it presented a
- * credential and this endpoint did not accept it, which is what a refresh is
- * for. RFC 6750 §3.1 has a name for that and clients branch on it; the others
- * mean there is nothing to refresh, and §3 says to stay quiet rather than send
- * a client after a token it does not hold. `malformed` says nothing either —
- * `invalid_request` carries a SHOULD of a 400 status, and changing that path's
- * status is a larger question than this answers.
- */
-const CHALLENGE: Partial<Record<RefusalReason, ChallengeError>> = {
-  invalid: {
-    code: 'invalid_token',
-    description: 'The credential is expired, revoked, or not one this endpoint issued.',
-  },
-};
-
-/** The same four, for whoever is reading the body rather than the header. */
-const HINTS: Record<RefusalReason, string> = {
-  missing: 'Present the profile token as: Authorization: Bearer <token>',
-  malformed: 'Present the profile token as: Authorization: Bearer <token>',
-  invalid: 'Refresh the credential. Authorize again only if the refresh is refused too.',
-  not_configured: 'This profile has no token yet. Run: lanes link token rotate',
-};
-
 export const MCP_PATH = '/mcp';
 export const RELOAD_PATH = '/reload';
+/**
+ * Named rather than inline, because two places now decide about it: the branch
+ * that answers it, and the ceiling in front of that branch which has to know
+ * that a `/health` carrying a credential is not the free request the other one
+ * is.
+ */
+export const HEALTH_PATH = '/health';
 
 /**
  * Loopback addresses. What binding to one changes is the browser threat model,
@@ -126,7 +107,7 @@ export interface RequestHandler {
 export function createRequestHandler(options: ServerOptions): RequestHandler {
   let probedAt = 0;
   const failedAuth = failedAuthLimiter();
-  const sessions = dashboardSessions();
+  const unauthenticated = options.meterUnauthenticated ? unauthenticatedLimiter() : null;
 
   /**
    * Re-read the config because a call named a tool we do not serve.
@@ -160,6 +141,27 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
 
       const url = new URL(request.url);
 
+      // Ahead of every path that answers without a credential, because the
+      // ceiling further down is inside the `401` branch and so has never covered
+      // any of them. Each costs a read of the credential store or a write to the
+      // workspace bucket, and none of them asks who is calling first. See
+      // `./edge.ts` for which ones, and for why `/health` is only sometimes
+      // among them.
+      if (unauthenticated) {
+        const refusal = unauthenticatedRefusal({
+          request,
+          pathname: url.pathname,
+          limiter: unauthenticated,
+          healthPath: HEALTH_PATH,
+          isAuthorizationPath,
+          authorizationEnabled: options.authorization !== undefined,
+        });
+        if (refusal) {
+          options.log.warn('rejected request', { reason: 'unauthenticated_rate' });
+          return refusal;
+        }
+      }
+
       // Before authentication, deliberately: a client's first request is the
       // one that discovers how to authenticate, so requiring a token to read
       // the document that says where tokens come from would close the loop it
@@ -168,7 +170,7 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
         return await handleAuthorization(request, options.authorization);
       }
 
-      if (url.pathname === '/health') {
+      if (url.pathname === HEALTH_PATH) {
         // `status` is unauthenticated because the platform's own probe reads it
         // and a deploy waits on it. The profile *names* are not: on a public URL
         // that is a list of what this endpoint holds, handed to anyone who asks,
@@ -186,19 +188,6 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
         });
       }
 
-      // Above the 404 gate and outside the bearer path below, because a
-      // top-level browser navigation carries no `Authorization` header — so it
-      // authenticates itself, against the same authenticator. Unset, this is
-      // never reached and `/dashboard` is a 404 like any other unknown path.
-      if (options.dashboard && url.pathname === DASHBOARD_PATH) {
-        return await handleDashboard(request, {
-          generations: options.generations,
-          authenticator: options.authenticator,
-          primary: options.primary,
-          sessions,
-        });
-      }
-
       if (
         url.pathname !== MCP_PATH &&
         url.pathname !== ATTACHMENTS_PATH &&
@@ -211,37 +200,17 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
         request.headers.get('authorization'),
       );
 
+      // The refusal, and the ceiling on how often one may be provoked. Both in
+      // `./edge.ts`, which is the subject: what this endpoint does about a
+      // caller who has not authenticated.
       if (!outcome.ok) {
         options.log.warn('rejected request', { reason: outcome.reason });
-
-        // After the attempt rather than before it: keyed on the caller alone,
-        // anyone able to reach the endpoint could spend the owner's budget and
-        // lock them out, which trades a cost problem for a worse availability
-        // one. Only a failure consumes a token, so a valid credential is never
-        // refused by this.
-        const budget = failedAuth.take(callerKey(request), FAILED_AUTH_PER_MINUTE);
-        if (!budget.allowed) return tooManyAttempts(budget.retryAfterMs);
-
-        // The pointer is the whole handshake for a remote client: it reads the
-        // named document, finds the authorization server, and starts a flow.
-        // Without it the client has to guess the document's location, and a
-        // client that guesses wrong reports the endpoint as unreachable.
-        const metadata = options.authorization ? resourceMetadataUrl(request) : null;
-
-        return new Response(
-          JSON.stringify({
-            error: 'unauthorized',
-            reason: outcome.reason,
-            hint: HINTS[outcome.reason],
-          }),
-          {
-            status: 401,
-            headers: {
-              'content-type': 'application/json',
-              'www-authenticate': challenge(metadata, CHALLENGE[outcome.reason]),
-            },
-          },
-        );
+        return authRefusal({
+          request,
+          reason: outcome.reason,
+          limiter: failedAuth,
+          metadataUrl: options.authorization ? resourceMetadataUrl(request) : null,
+        });
       }
 
       // Behind the same bearer check as everything else, and deliberately not a
@@ -369,15 +338,18 @@ export function serve(options: ServeOptions): RunningServer {
   const allowedHostnames = options.allowedHostnames ?? allowedHostnamesFor(host, loopback);
 
   // Cross-origin access, and its absence, are decided here for the same reason
-  // `allowedHostnames` and `dashboard` are: they are all properties of what this
-  // is bound to. The two are mutually exclusive and the exclusion is the
-  // decision — see `./cors.ts`, and ADR-039.
+  // `allowedHostnames` is: both are properties of what this is bound to. The
+  // two are mutually exclusive and the exclusion is the decision — see
+  // `./cors.ts`, and ADR-039.
   const cors: CorsPolicy | undefined = loopback
     ? undefined
     : { allowedOrigins: primary.config.auth.allowed_origins ?? [ANY_ORIGIN] };
   const handler = createRequestHandler({
     ...options,
-    dashboard: servesDashboard(options.dashboard, loopback),
+    // Off on loopback for the same reason `cors` is undefined there, and decided
+    // here so every property of the bind address is decided together. An
+    // explicit `true` wins, which is how a test drives the deployed behaviour.
+    meterUnauthenticated: options.meterUnauthenticated ?? !loopback,
     ...(allowedHostnames ? { allowedHostnames } : {}),
   });
 

package/src/server/mcp/index.ts

@@ -28,7 +28,6 @@ export {
   visibleCapabilities,
   visibleToolCount,
   type BuildServerOptions,
-  type ConnectionState,
   type MergedCapability,
   type ProfileRuntime,
 } from './visibility.ts';

package/src/server/mcp/visibility.ts

@@ -20,20 +20,6 @@ import { allowedConnections } from '#policy';
  * still a leak.
  */
 
-/**
- * A connection's reconciled state, as much of it as a reader needs.
- *
- * Structural rather than the store's own `ConnectionRecord`: `server` does not
- * import `stores` (`src/architecture.test.ts`), and what a surface that reports
- * wants from a connection is its key and whether it is working — not the
- * timestamps and credential expiry the repository keeps behind it.
- */
-export interface ConnectionState {
-  readonly provider: string;
-  readonly id: string;
-  readonly status: string;
-}
-
 /** Everything one profile contributes to the endpoint. */
 export interface ProfileRuntime {
   readonly config: Config;
@@ -49,25 +35,6 @@ export interface ProfileRuntime {
    * how often to ask (ADR-014).
    */
   refreshSkills?(): Promise<void>;
-  /**
-   * Which target's adapters this profile was opened against.
-   *
-   * Not derivable from `config`: a target is *selected* per run, and the config
-   * only says which one is the default. Optional for the same reason the one
-   * below is — a runtime built to answer "what is visible" was never opened
-   * against anything.
-   */
-  readonly target?: string | undefined;
-  /**
-   * Reconciled connection state, for a surface that reports rather than
-   * dispatches.
-   *
-   * Optional exactly as `refreshSkills` is: only a served endpoint holds the
-   * state handle this reads through, and nothing on the dispatch path asks —
-   * a capability's visibility is decided by policy, not by whether the
-   * credential behind it currently works.
-   */
-  connections?(): Promise<readonly ConnectionState[]>;
 }
 
 export interface BuildServerOptions {

package/src/server/oauth.ts

@@ -62,11 +62,30 @@ export function isAuthorizationPath(pathname: string): boolean {
  * `http` and every metadata document would name a resource no client asked for
  * — which fails the exact-match the specification requires. Config cannot help
  * either: the hostname carries a project hash assigned at deploy time.
+ *
+ * **The host is `Host`, and `X-Forwarded-Host` is not consulted.** It used to
+ * be, ahead of `Host`, and the justification above is entirely about the
+ * *scheme* — nothing ever needed the other header. What it cost is that four
+ * documents were steerable per request by whoever sent it: both discovery
+ * documents, the `resource_metadata` pointer on every `401`, and the `action` of
+ * the consent form that asks the owner to paste their endpoint token. Cloud Run
+ * sets `Host` and routes on it, so it is the one value a caller cannot invent
+ * without the request going somewhere else; a proxy that genuinely rewrites it
+ * rewrites `Host` too, which is what a domain mapping does.
+ *
+ * The scheme is checked rather than trusted for the same reason, and it is a
+ * smaller hole — naming `http` in a document downgrades nothing, it just makes
+ * the exact-match fail — but a header that decides part of a URL should not
+ * accept an arbitrary string.
  */
 export function publicOrigin(request: Request): string {
   const url = new URL(request.url);
-  const host = request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? url.host;
-  const proto = request.headers.get('x-forwarded-proto') ?? url.protocol.replace(':', '');
+  const host = request.headers.get('host') ?? url.host;
+
+  const forwarded = request.headers.get('x-forwarded-proto');
+  const proto =
+    forwarded === 'https' || forwarded === 'http' ? forwarded : url.protocol.replace(':', '');
+
   return `${proto}://${host}`;
 }