@lifeaitools/clauth 1.30.9 → 1.30.10

package/cli/commands/serve.js

@@ -583,6 +583,10 @@ function validateWriteToken(req, writeSession) {
   return a.length === b.length && crypto.timingSafeEqual(a, b);
 }
 
+export function isLoopbackAddress(remote) {
+  return remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+}
+
 export function supervisorRequiresWriteToken(port = getSupervisorPort(), env = process.env) {
   if (port !== getSupervisorPort()) return true;
   return env.CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN === "1";
@@ -3183,6 +3187,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
   function hasSupervisorWrite(req) {
     if (validateWriteToken(req, writeSession)) return true;
     if (!isSupervisorPort) return false;
+    if (!isLoopbackAddress(req.socket?.remoteAddress)) return false;
     return supervisorTestNoToken || !supervisorRequiresWriteToken(port);
   }
 
@@ -3611,9 +3616,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
   }
 
-  const server = http.createServer(async (req, res) => {
-    const remote = req.socket.remoteAddress;
-    const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+  const server = http.createServer(async (req, res) => {
+    const remote = req.socket.remoteAddress;
+    const isLocal = isLoopbackAddress(remote);
 
     const url    = new URL(req.url, `http://127.0.0.1:${port}`);
     const reqPath = url.pathname;

package/cli/supervisor-registry.test.js

@@ -17,7 +17,7 @@ import {
   supervisorHealth,
   validatePluginManifest,
 } from "./supervisor-registry.js";
-import { supervisorRequiresWriteToken } from "./commands/serve.js";
+import { isLoopbackAddress, supervisorRequiresWriteToken } from "./commands/serve.js";
 
 function withTempSupervisor(fn) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-"));
@@ -181,6 +181,10 @@ test("supervisor write-token policy is temporarily relaxed only for the localhos
   assert.equal(supervisorRequiresWriteToken(52439, {}), false);
   assert.equal(supervisorRequiresWriteToken(52439, { CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN: "1" }), true);
   assert.equal(supervisorRequiresWriteToken(52437, {}), true);
+  assert.equal(isLoopbackAddress("127.0.0.1"), true);
+  assert.equal(isLoopbackAddress("::1"), true);
+  assert.equal(isLoopbackAddress("::ffff:127.0.0.1"), true);
+  assert.equal(isLoopbackAddress("192.168.1.25"), false);
 });
 
 test("tunnel route add and remove produce reversible operation receipts", () => withTempSupervisor((root) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.9",
+  "version": "1.30.10",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {