@lanes-sh/link 0.7.1 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/brand.ts

@@ -150,6 +150,19 @@ a { color: inherit; }
 .footer a { text-decoration: underline; }
 `.trim();
 
+/** What a page may widen its policy by, for the two pages that need to. */
+export interface PagePolicy {
+  /** The page carries an inline script, and has to say so. */
+  readonly script?: boolean;
+  /**
+   * Where this page's form is allowed to end up, beyond `'self'`.
+   *
+   * A source expression, not a URL: an origin (`https://client.example`) or a
+   * bare scheme (`vscode:`) for a native client's redirect.
+   */
+  readonly formAction?: readonly string[];
+}
+
 /**
  * What every page these modules serve loads, and nothing else.
  *
@@ -158,16 +171,32 @@ a { color: inherit; }
  * a page here has no script by default — the consent screen, which has one
  * listener for its submit spinner, extends this rather than replacing it.
  */
-export const PAGE_CSP =
-  "frame-ancestors 'none'; default-src 'none'; " +
-  // `form-action` does **not** fall back to `default-src`, so `'none'` above
-  // says nothing about where a form may post. One page here posts the owner's
-  // endpoint token, and its `action` is built from the request's own `Host` —
-  // this is the second lock on that, so a form target that ever came from
-  // somewhere else is refused by the browser rather than followed.
-  "form-action 'self'; " +
-  "style-src 'unsafe-inline' https://fonts.googleapis.com; " +
-  'font-src https://fonts.gstatic.com';
+export function pageCsp(policy: PagePolicy = {}): string {
+  return [
+    "frame-ancestors 'none'",
+    "default-src 'none'",
+    // `form-action` does **not** fall back to `default-src`, so `'none'` above
+    // says nothing about where a form may post. One page here posts the owner's
+    // endpoint token, and its `action` is built from the request's own `Host` —
+    // this is the second lock on that, so a form target that ever came from
+    // somewhere else is refused by the browser rather than followed.
+    //
+    // It takes sources beyond `'self'` because Chrome and Safari re-check this
+    // directive against the *redirect* a submission produces, not only against
+    // the `action` — and the consent form's whole purpose is to end in a 302 to
+    // the client that asked. Named nothing else, the directive accepts the
+    // POST, mints the code, and then blocks the browser from delivering it,
+    // which is indistinguishable from a hung page. Firefox does not do this, so
+    // it stays broken in exactly half the browsers. See ADR-054.
+    ["form-action 'self'", ...(policy.formAction ?? [])].join(' '),
+    "style-src 'unsafe-inline' https://fonts.googleapis.com",
+    'font-src https://fonts.gstatic.com',
+    ...(policy.script ? ["script-src 'unsafe-inline'"] : []),
+  ].join('; ');
+}
+
+/** The policy a page with nothing to widen answers with. */
+export const PAGE_CSP = pageCsp();
 
 /**
  * Headers every page here answers with.

package/src/cli/callback-page.ts

@@ -26,7 +26,7 @@
  * else — not on emphasis, and not on the heading.
  */
 
-import { escapeHtml, FONTS, FOOTER, PAGE_CSP, PAGE_HEADERS, TOKENS } from './brand.ts';
+import { escapeHtml, FONTS, FOOTER, pageCsp, PAGE_HEADERS, TOKENS } from './brand.ts';
 
 export interface CallbackPage {
   /** The focal line, set in Lora. A provider name, or the outcome itself. */
@@ -74,6 +74,11 @@ export interface ApprovalPage {
   readonly client: string;
   /** Where the code would be sent. The part of the request that cannot be faked. */
   readonly redirectHost: string;
+  /**
+   * The same destination as a CSP source, so the browser will follow the
+   * redirect this form's approval ends in rather than blocking it.
+   */
+  readonly formAction?: string;
   /** Hidden fields carrying the authorization request through the POST. */
   readonly fields: Readonly<Record<string, string>>;
   readonly action: string;
@@ -121,7 +126,10 @@ ${hidden}
 </form>
 <p class="small"><code>lanes link outputs --show --target ${escapeHtml(page.target)}</code></p>`;
 
-  return shell(body, 'Authorise', page.retry ? 401 : 200, '', SUBMIT_SPINNER);
+  return shell(body, 'Authorise', page.retry ? 401 : 200, '', {
+    script: SUBMIT_SPINNER,
+    ...(page.formAction ? { formAction: [page.formAction] } : {}),
+  });
 }
 
 /**
@@ -152,8 +160,9 @@ function shell(
   title: string,
   status: number,
   cardClass = '',
-  script = '',
+  policy: { readonly script?: string; readonly formAction?: readonly string[] } = {},
 ): Response {
+  const script = policy.script ?? '';
   return new Response(
     `<!doctype html>
 <html lang="en">
@@ -182,7 +191,10 @@ ${script ? `<script>\n${script}\n</script>` : ''}
       status,
       headers: {
         ...PAGE_HEADERS,
-        ...(script ? { 'content-security-policy': `${PAGE_CSP}; script-src 'unsafe-inline'` } : {}),
+        'content-security-policy': pageCsp({
+          ...(script ? { script: true } : {}),
+          ...(policy.formAction ? { formAction: policy.formAction } : {}),
+        }),
       },
     },
   );

package/src/server/oauth.ts

@@ -168,6 +168,9 @@ function render(result: OAuthResult, request: Request, target: string): Response
         // anything, but it cannot change where the code is sent.
         client: result.clientName ?? result.request.clientId,
         redirectHost: hostOf(result.request.redirectUri),
+        // The page's policy has to admit the redirect the page's own approval
+        // ends in, or the browser blocks it. See `formActionFor`.
+        ...formActionFor(result.request.redirectUri),
         action: `${publicOrigin(request)}${AUTHORIZE_PATH}`,
         fields: formFromRequest(result.request),
         retry: result.retry,
@@ -219,6 +222,37 @@ function hostOf(uri: string): string {
   }
 }
 
+/**
+ * The redirect target as a CSP source, for the consent page's `form-action`.
+ *
+ * Chrome and Safari check that directive against the redirect a form submission
+ * produces, so the page has to name where its own approval is about to send the
+ * browser — `'self'` alone mints the code and then blocks its delivery.
+ *
+ * Taken from the request being approved rather than from what the client
+ * registered, because the two legitimately differ: a native client registers
+ * `http://localhost/callback` and binds whatever port it got (RFC 8252), and
+ * the origin the browser navigates to is the one carrying that port. It is
+ * already checked against the registration — by `authorize` before this page is
+ * rendered, and again by `approve` before anything is minted — and it cannot
+ * move the token, because the form's `action` is built here rather than read
+ * from the request.
+ *
+ * An origin and nothing else, because `isSafeRedirect` registers nothing else:
+ * https, or http on loopback. A private-use scheme — `vscode:`, the other shape
+ * RFC 8252 allows — would need a scheme-source here, and is refused two steps
+ * earlier, so a branch for it would be a branch nothing can reach.
+ */
+function formActionFor(uri: string): { formAction?: string } {
+  try {
+    const { protocol, origin } = new URL(uri);
+    if (protocol !== 'http:' && protocol !== 'https:') return {};
+    return { formAction: origin };
+  } catch {
+    return {};
+  }
+}
+
 async function safeJson(request: Request): Promise<unknown> {
   try {
     return await request.json();