@metric-im/administrate 2.1.1 → 2.1.4

package/.claude/settings.local.json

@@ -1,10 +1,20 @@
 {
   "permissions": {
     "allow": [
-      "Read(//home/msprague/workspace/sitewell/**)",
-      "Read(//home/msprague/workspace/rootz/data-wallet-demos/**)"
+      "Read(//home/msprague/workspace/rootz/epistery/docs/**)",
+      "Read(//home/msprague/workspace/rootz/epistery/src/**)",
+      "Read(//home/msprague/workspace/rootz/epistery/**)",
+      "Read(//home/msprague/workspace/rootz/rhonda/node_modules/epistery/**)",
+      "Read(//home/msprague/workspace/rootz/rhonda/**)",
+      "Read(//home/msprague/workspace/metric-im/account-control/**)",
+      "Bash(sed:*)",
+      "Bash(git checkout:*)",
+      "Bash(npm view *)",
+      "Bash(git --no-pager diff --stat)",
+      "Bash(node -p \"require\\('./package-lock.json'\\).packages['node_modules/epistery'].version\")",
+      "Bash(git *)"
     ],
     "deny": [],
     "ask": []
   }
-}
+}

package/certify.mjs

@@ -3,6 +3,9 @@ import Acme from 'acme-client';
 import tls from 'tls';
 import { Config } from 'epistery';
 import moment from 'moment';
+import fs from 'fs';
+import { resolve } from 'path';
+import { Site } from './multisite.mjs';
 
 const MAX_AGE = 75; // days
 const MAX_WAIT_TIME = 60; // seconds
@@ -42,6 +45,14 @@ export class Certify {
         app.use('/',instance.routes());
         return instance;
     }
+    // A name is certifiable when it parses as a hostname and, where a sites
+    // folder declares what this front publishes, is one of those sites.
+    static WillCertify(sitename) {
+      if (Site.WashName(sitename) !== String(sitename).toLowerCase()) return false;
+      const root = resolve('./sites');
+      if (!fs.existsSync(root)) return true;   // standalone Certify — nothing to check against
+      return !!Site.Dir(sitename);
+    }
     get SNI() {
         return {SNICallback: async (hostname, cb) => {
             try {
@@ -128,6 +139,12 @@ export class Certify {
       if (sitename === 'localhost' || sitename.includes('.local') || sitename.match(/^\d+\.\d+\.\d+\.\d+$/)) {
         return null; // Use default certificate
       }
+      // The SNI name comes off the wire, so it decides a Config path and an ACME
+      // order. Neither should be reachable by an arbitrary string: a junk name
+      // spends a failed authorization, and enough of those exhaust the account's
+      // rate limit and block renewal for every real domain. Mint only for a
+      // hostname we actually publish.
+      if (!Certify.WillCertify(sitename)) return null;
 
       // Load domain-specific config to check SSL section
       await this.config.setPath(`/${sitename}`);

package/multisite.mjs

@@ -4,7 +4,7 @@ import tls from 'tls';
 import { Config } from 'epistery';
 import moment from 'moment';
 import fs from "fs";
-import {resolve} from "path";
+import {resolve, sep} from "path";
 import child_process from "child_process";
 import axios from 'axios';
 
@@ -157,7 +157,12 @@ export class MultiSite {
         }
 
         // Create new site
-        this.sites[domain] = Site.Clone(domain, this);
+        const site = Site.Clone(domain, this);
+        if (!site) {
+            delete this.sites[domain];
+            return;
+        }
+        this.sites[domain] = site;
         console.log(`Restarted site for domain: ${domain}`);
     }
 
@@ -221,8 +226,13 @@ export class MultiSite {
         if (fs.existsSync(resolve('./sites'))) {
             instance.sites = (fs.readdirSync(resolve('./sites'))).reduce((result,hostName)=>{
                 const domainName = Site.WashName(hostName);
+                const dir = Site.Dir(domainName);
+                if (!dir) {
+                    console.error(`Ignoring sites/${hostName}: not a usable domain name`);
+                    return result;
+                }
                 const options = {
-                    cwd: resolve(`./sites/${hostName}`),
+                    cwd: dir,
                     env: {PORT:instance.spawnPort,meta:instance.options}
                 };
                 result[domainName] = Site.Spawn(domainName,options,instance);
@@ -329,6 +339,11 @@ export class MultiSite {
 
                     res.status(502).send('Bad Gateway. Try reloading.');
                 }
+            } else if (!Site.Dir(domain)) {
+                // No sites/<domain> — nothing is published here. Say so and stop.
+                // Spawning from an unmatched Host is what let a request choose
+                // the directory npm ran in.
+                res.status(404).send('Not found');
             } else {
                 // Check if already spawning to prevent race condition
                 if (this.spawning.has(domain)) {
@@ -339,7 +354,12 @@ export class MultiSite {
                 } else {
                     // Mark as spawning
                     this.spawning.add(domain);
-                    this.sites[domain] = Site.Clone(domain,this);
+                    const site = Site.Clone(domain,this);
+                    if (!site) {
+                        this.spawning.delete(domain);
+                        return res.status(404).send('Not found');
+                    }
+                    this.sites[domain] = site;
                     // Remove from spawning set after spawn completes
                     setTimeout(() => {
                         this.spawning.delete(domain);
@@ -372,12 +392,17 @@ export class Site {
         return instance;
     }
     static Clone(name, multisite) {
+        // The site runs from its own sites/<name> dir — same as the startup
+        // path. Using process.cwd() (the harness dir) here spawned the child
+        // in the wrong directory, so restartSite() and add-a-site-after-boot
+        // never launched the actual site.
+        const dir = Site.Dir(name);
+        if (!dir) {
+            console.error(`Refusing to spawn ${name}: no sites/${name} directory`);
+            return null;
+        }
         const options = {
-            // The site runs from its own sites/<name> dir — same as the startup
-            // path. Using process.cwd() (the harness dir) here spawned the child
-            // in the wrong directory, so restartSite() and add-a-site-after-boot
-            // never launched the actual site.
-            cwd: resolve(`./sites/${name}`),
+            cwd: dir,
             env: {PORT:multisite.spawnPort,meta:multisite.options}
         };
         const instance = new Site(name,options);
@@ -443,9 +468,29 @@ export class Site {
             this.proc = null;
         }
     }
+    // A Host header is a hostname or it is nothing. A bare IP, an IPv6 literal,
+    // an absent Host, or a header carrying path syntax are all not site names,
+    // and "" is what keeps them out of `sites/${name}`. Without this the Host
+    // header picks the directory that `npm run start` runs in.
     static WashName(hostName="") {
-      if (!hostName || hostName.match(/^[\d]{1,3}\.[\d]{1,3}\.[\d]{1,3}\.[\d]{1,3}$/)) return "";
-      else return hostName.toLowerCase();
+      const name = String(hostName).toLowerCase();
+      if (!name || name.length > 253) return "";
+      if (name.match(/^[\d]{1,3}\.[\d]{1,3}\.[\d]{1,3}\.[\d]{1,3}$/)) return "";
+      const label = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+      if (!name.match(new RegExp(`^${label}(?:\\.${label})*$`))) return "";
+      return name;
+    }
+
+    // Where a site runs from. Null unless sites/<name> is a real entry that
+    // stays inside the sites folder: a site exists because someone symlinked
+    // it, never because a request asked for it.
+    static Dir(name) {
+      const washed = Site.WashName(name);
+      if (!washed) return null;
+      const root = resolve('./sites');
+      const dir = resolve(root, washed);
+      if (dir === root || !dir.startsWith(root + sep)) return null;
+      return fs.existsSync(dir) ? dir : null;
     }
     static SafeName(hostName) {
       return Site.WashName(hostName).replace(/[^a-z0-9-]+/g,'_');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metric-im/administrate",
-  "version": "2.1.1",
+  "version": "2.1.4",
   "description": "Tools for site administration",
   "homepage": "https://github.com/metric-im/administrate#readme",
   "bugs": {
@@ -22,7 +22,7 @@
     "acme-client": "^5.4.0",
     "axios": "^1.7.0",
     "compression": "^1.8.1",
-    "epistery": "2.2",
+    "epistery": "^2.2.11",
     "express": "^5.1.0",
     "moment": "^2.30.1"
   }