@mmmbuto/nexuscrew 0.9.65 → 0.9.67

package/lib/proxy/federation.js

@@ -3,6 +3,8 @@
 const { createAskSlotVerifier, askSlotVerifier, binding: askSlotBinding } = require('../nodes/ask-slot-verifier.js');
 const http = require('node:http');
 const net = require('node:net');
+const fs = require('node:fs');
+const path = require('node:path');
 const crypto = require('node:crypto');
 const express = require('express');
 const { WebSocketServer } = require('ws');
@@ -15,9 +17,9 @@ const { bearerFrom } = require('../auth/middleware.js');
 const { safeEqual } = require('../nodes/peering.js');
 const { probeReverseSlot } = require('../nodes/reverse-slot-proof.js');
 const {
-  sanitizeRequestHeaders, sanitizeResponseHeaders, stripLocalTokenQuery,
+  sanitizeRequestHeaders, sanitizeResponseHeaders, sanitizeHostOnlyResponseHeaders, hostOnlyHeadFilter, stripLocalTokenQuery,
 } = require('./node-proxy.js');
-const { signHop, HOP_HEADER } = require('./hop-proof.js');
+const { signHop, verifyHop, HOP_HEADER } = require('./hop-proof.js');
 const { COOKIE_NAME: PANEL_COOKIE_NAME } = require('./panel-auth.js');
 
 const MAX_HOPS = 4;
@@ -113,14 +115,206 @@ function peerAllows(peer, otherId) {
   return Array.isArray(peer.selected) && peer.selected.includes(otherId);
 }
 
+// A host-only peer (publishRemote, schema 4) is a REMOTE node this installation
+// publishes to an explicit audience of its own admin nodes. The boundary is
+// one-way and does not depend on the peer's own claims or grants:
+//   audience -> peer : yes, while the reader is in the audience AND still holds
+//                      the operator grant (re-read on every call);
+//   peer -> anyone   : never (not another peer, not a topology, not a route);
+//   everyone else    : no, whatever `visibility` or `shared` say.
+function isHostOnlyPeer(peer) {
+  return !!peer && peer.publishRemote === true;
+}
+
+function audienceAllows(reader, hostOnly) {
+  return Array.isArray(hostOnly.publishRemoteAudience)
+    && typeof reader.nodeId === 'string'
+    && hostOnly.publishRemoteAudience.includes(reader.nodeId)
+    && !isHostOnlyPeer(reader)
+    && allowedByClass('operator', reader);
+}
+
 function canTransit(ingress, egress) {
   if (!ingress || !egress || ingress.name === egress.name) return !ingress;
+  // The ingress is the AUTHENTICATED peer record (looked up by its token), never
+  // something read from the query, a header or the visited chain.
+  if (isHostOnlyPeer(ingress)) return false;
+  if (isHostOnlyPeer(egress)) return audienceAllows(ingress, egress);
   // `shared` is the explicit publication gate. Visibility remains the hub ACL,
   // but it cannot make a private peer routable on its own.
   return egress.shared === true
     && peerAllows(ingress, egress.nodeId) && peerAllows(egress, ingress.nodeId);
 }
 
+// The audience decision for a CHAIN, not only for the last hop. A host-only peer
+// is published to its audience: every node that took part in the request (the
+// ones in `visited`, this node excluded) must be an audience member that still
+// holds the operator grant. An id this node does not know is refused — the chain
+// is what the peers declared, so only what the local store can vouch for counts.
+function chainInAudience(st, chain, egress) {
+  if (!isHostOnlyPeer(egress)) return true;
+  if (!st || !Array.isArray(st.nodes) || !Array.isArray(chain)) return false;
+  for (const id of chain) {
+    if (id === st.nodeId) continue;
+    const reader = st.nodes.find((n) => n && n.nodeId === id);
+    if (!reader || !audienceAllows(reader, egress)) return false;
+  }
+  return true;
+}
+
+// Does this target, or any hop of the route to it, resolve to a host-only peer
+// of THIS node? Read from the store at the time of the call, never from a cache.
+function touchesHostOnly(nodesPath, { target = null, route = [] } = {}) {
+  const st = store.loadStore(nodesPath);
+  if (!st) return true; // fail closed: an unreadable store vouches for nothing
+  const names = Array.isArray(route) ? route : [];
+  return st.nodes.some((n) => isHostOnlyPeer(n) && ((target && n.nodeId === target) || names.includes(n.name)));
+}
+
+// The first segments of `/<hop>/<hop>/_/...` (what is left after the /route mount).
+function routeNamesOf(rest) {
+  const parts = String(rest || '').split('?')[0].split('/').filter(Boolean);
+  const idx = parts.indexOf(ROUTE_DELIMITER);
+  return idx < 0 ? [] : parts.slice(0, idx);
+}
+
+// The identity of the caller of a LOCAL API handler that is the last hop of a
+// federated route. It exists only when the hop header verifies (HMAC over method,
+// path and chain, the same proof audio/origin.js reads); the bare presence of the
+// header proves nothing. Returns the verified chain, or null.
+function verifiedHopChain(req, st, hopSecret) {
+  const headers = (req && req.headers) || {};
+  const proof = headers[HOP_HEADER];
+  const secret = typeof hopSecret === 'function' ? hopSecret() : hopSecret;
+  const visited = String(headers['x-nexuscrew-visited'] || '').split(',').filter(Boolean);
+  if (!secret || !st || typeof proof !== 'string' || visited.length < 2 || visited.length > MAX_HOPS + 1) return null;
+  if (visited.some((id) => !store.NODE_ID_RE.test(id)) || new Set(visited).size !== visited.length) return null;
+  if (visited.at(-1) !== st.nodeId) return null;
+  if (!verifyHop(secret, { method: req.method || 'GET', path: req.originalUrl || req.url, visited }, proof)) return null;
+  return visited;
+}
+
+// Which host-only peers a local API caller must NOT learn about. The owner (a
+// request without the hop header) sees everything; a federated caller sees only
+// the peers whose audience contains its whole verified chain; any header that
+// does not verify, or an unknown id, hides all of them. Read fresh each time.
+function hostOnlyVisibility(nodesPath, req, hopSecret) {
+  const hiddenNames = new Set(); const hiddenIds = new Set();
+  const federated = Boolean(req && req.headers && req.headers[HOP_HEADER] !== undefined);
+  // The owner (no hop header) is never filtered, whatever the state of the store.
+  if (!federated) return { hiddenNames, hiddenIds, unreadable: false };
+  const st = store.loadStore(nodesPath);
+  if (!st) return { hiddenNames, hiddenIds, unreadable: true };
+  const chain = verifiedHopChain(req, st, hopSecret);
+  for (const n of st.nodes) {
+    if (!isHostOnlyPeer(n)) continue;
+    const visible = chain !== null && chainInAudience(st, chain, n);
+    if (!visible) { hiddenNames.add(n.name); if (n.nodeId) hiddenIds.add(n.nodeId); }
+  }
+  return { hiddenNames, hiddenIds, unreadable: false };
+}
+
+// Topology entries of hidden host-only peers, and anything announced behind one.
+function hideHostOnlyEntries(nodes, vis) {
+  if (!Array.isArray(nodes) || (!vis.hiddenNames.size && !vis.hiddenIds.size)) return nodes;
+  return nodes.filter((e) => !vis.hiddenIds.has(e && e.instanceId)
+    && !(e && Array.isArray(e.route) && e.route.some((name) => vis.hiddenNames.has(name))));
+}
+
+// Removes, from any JSON value, the objects that point at a hidden host-only peer: by route name (`node`, a path of
+// names, or `route`), or by instance id (`ownerId`, `nodeId`, `instanceId`). Used on the answers of handlers that
+// store references to nodes (decks).
+function redactHostOnlyReferences(value, vis) {
+  if (!vis || (!vis.hiddenNames.size && !vis.hiddenIds.size)) return value;
+  const points = (o) => o && typeof o === 'object' && !Array.isArray(o) && (
+    (typeof o.node === 'string' && o.node.split('/').some((n) => vis.hiddenNames.has(n)))
+    || ['ownerId', 'nodeId', 'instanceId'].some((k) => typeof o[k] === 'string' && vis.hiddenIds.has(o[k]))
+    || (Array.isArray(o.route) && o.route.some((n) => vis.hiddenNames.has(n))));
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.filter((e) => !points(e)).map(walk);
+    if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x)]));
+    return v;
+  };
+  return walk(value);
+}
+
+// Streams (SSE, WebSocket) opened towards a host-only peer for a peer caller:
+// the authorization is re-read about every second and a stream that no longer
+// passes (audience, operator grant, mode off, peer or reader removed, store
+// unreadable) is closed. Owner streams are not tracked.
+const HOST_ONLY_RECHECK_MS = 1000;
+const hostOnlyStreams = new Set();
+let hostOnlyTimer = null;
+const credentialFingerprint = (v) => crypto.createHash('sha256').update(String(v || '')).digest('hex');
+// The generation of the publication a stream was opened under. Every opt-in takes its
+// own full backup next to the store (never overwritten), so the SET of those backups
+// changes whenever the mode is turned on again — even with the same audience, even
+// within the same second (names are not ordered in time, so the whole set is read, not
+// the "newest"). A removed backup changes it too. Unreadable directory: a value that
+// never matches (fail closed).
+function publicationGeneration(nodesPath) {
+  try {
+    const base = `${path.basename(nodesPath)}.pre-publish-remote-`;
+    const names = fs.readdirSync(path.dirname(nodesPath)).filter((n) => n.startsWith(base) && n.endsWith('.bak')).sort();
+    return crypto.createHash('sha256').update(names.join('\n')).digest('hex');
+  } catch (_) { return `unreadable:${Date.now()}:${Math.random()}`; }
+}
+const audienceFingerprint = (egress) => crypto.createHash('sha256').update(JSON.stringify([...(egress.publishRemoteAudience || [])].sort())).digest('hex');
+function hostOnlyGuardFor(nodesPath, ingress, egress, visited) {
+  return {
+    nodesPath, ingressNodeId: ingress.nodeId, ingressFp: credentialFingerprint(ingress.acceptToken),
+    egressName: egress.name, egressNodeId: egress.nodeId, egressPort: egress.localPort,
+    egressFp: credentialFingerprint(egress.token),
+    audienceFp: audienceFingerprint(egress), generation: publicationGeneration(nodesPath), visited,
+  };
+}
+// A stream opened through a peer that was NOT host-only keeps the behaviour it always had, with one exception: when
+// the publication is turned ON for that peer, every federated stream in flight through it ends.
+function plainStreamGuardFor(nodesPath, egress) {
+  return { plain: true, nodesPath, egressName: egress.name, egressNodeId: egress.nodeId };
+}
+function streamGuardFor(nodesPath, ingress, egress, visited) {
+  return isHostOnlyPeer(egress) ? hostOnlyGuardFor(nodesPath, ingress, egress, visited) : plainStreamGuardFor(nodesPath, egress);
+}
+function hostOnlyStreamAllowed(guard, loaded) {
+  const st = loaded === undefined ? store.loadStore(guard.nodesPath) : loaded;
+  if (guard.plain) {
+    if (!st) return true;                                  // a plain stream is not judged on an unreadable store
+    return !st.nodes.some((n) => n && n.nodeId === guard.egressNodeId && isHostOnlyPeer(n));
+  }
+  if (!st) return false;
+  const egress = store.getNode(st, guard.egressName);
+  const reader = st.nodes.find((n) => n && n.nodeId === guard.ingressNodeId);
+  if (!egress || !reader || !egress.token || !canTransit(reader, egress)) return false;
+  // The stream was opened under a host-only publication: it lives only while THAT publication
+  // is what authorizes it. Legacy sharing (shared=true after an off) is a different authorization.
+  if (!isHostOnlyPeer(egress)) return false;
+  if (audienceFingerprint(egress) !== guard.audienceFp || publicationGeneration(guard.nodesPath) !== guard.generation) return false;
+  // Same identities and credentials that were authenticated when the stream opened.
+  if (credentialFingerprint(reader.acceptToken) !== guard.ingressFp || credentialFingerprint(egress.token) !== guard.egressFp
+    || egress.nodeId !== guard.egressNodeId || egress.localPort !== guard.egressPort) return false;
+  return chainInAudience(st, guard.visited, egress);
+}
+function trackHostOnlyStream(guard, close) {
+  if (!guard) return () => {};
+  const entry = { guard, close };
+  hostOnlyStreams.add(entry);
+  if (!hostOnlyTimer) {
+    hostOnlyTimer = setInterval(() => {
+      const loaded = new Map();                            // the store is read once per file per tick
+      const load = (p) => { if (!loaded.has(p)) { let v = null; try { v = store.loadStore(p); } catch (_) { v = null; } loaded.set(p, v); } return loaded.get(p); };
+      for (const e of [...hostOnlyStreams]) {
+        let ok = false;
+        try { ok = hostOnlyStreamAllowed(e.guard, load(e.guard.nodesPath)); } catch (_) { ok = e.guard.plain === true; }
+        if (!ok) { hostOnlyStreams.delete(e); try { e.close(); } catch (_) { /* gone */ } }
+      }
+      if (!hostOnlyStreams.size) { clearInterval(hostOnlyTimer); hostOnlyTimer = null; }
+    }, HOST_ONLY_RECHECK_MS);
+    if (typeof hostOnlyTimer.unref === 'function') hostOnlyTimer.unref();
+  }
+  return () => { hostOnlyStreams.delete(entry); };
+}
+
 function parseRoute(raw) {
   const parts = String(raw || '').split('?')[0].split('/').filter(Boolean);
   const idx = parts.indexOf(ROUTE_DELIMITER);
@@ -274,6 +468,9 @@ function liveHostAllowedFor(ingress) {
 // WebSocket upgrade. A resource whose class is unknown, or whose grants the
 // owner has not conceded, is refused before anything is dispatched.
 function classGateCheck(resource, method, ingress) {
+  // A host-only peer reaches nothing of ours, whatever grants its record carries
+  // or gains: the zeroed vector is the first lock, this is the second.
+  if (isHostOnlyPeer(ingress)) return { ok: false, status: 403, reason: 'host-only-peer' };
   const cls = classifyResource(resource, method);
   if (!cls) return { ok: false, status: 404, reason: 'resource-not-classified' };
   if (!allowedByClass(cls, ingress)) return { ok: false, status: 403, reason: `grant-required:${cls}` };
@@ -489,7 +686,7 @@ function liveHostLedgerCapture({ ledger, ownerId, resource }) {
 const SSE_IDLE_TIMEOUT_MS = 90000;
 const SSE_CONTENT_TYPE_RE = /^text\/event-stream/i;
 
-function proxyHttp(req, res, { port, path, credential, visited = null, hopProof = null, setCookiePrefix = null, panelCookie = null, capture = null, getTimeoutMs = 10000, sseIdleMs = SSE_IDLE_TIMEOUT_MS, onForwardFailure = null, abortWithClient = false }) {
+function proxyHttp(req, res, { port, path, credential, visited = null, hopProof = null, setCookiePrefix = null, panelCookie = null, hostOnlyEgress = false, streamGuard = null, capture = null, getTimeoutMs = 10000, sseIdleMs = SSE_IDLE_TIMEOUT_MS, onForwardFailure = null, abortWithClient = false }) {
   // A body a local middleware has already read is no longer in the stream: the
   // headers would announce bytes that nothing sends, and the peer would wait for
   // a body that never arrives. Say it at once, with a name, instead of letting
@@ -507,8 +704,23 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
     if (r.statusCode < 200 || r.statusCode >= 300) failed();
     r.once('aborted', failed); r.once('error', failed);
     const headers = setCookiePrefix ? rewriteSetCookiePath(r.headers, setCookiePrefix) : r.headers;
+    const cleanResponse = hostOnlyEgress ? sanitizeHostOnlyResponseHeaders : sanitizeResponseHeaders;
+    if (hostOnlyEgress && r.statusCode >= 300 && r.statusCode < 400) {
+      // A redirect from a host-only peer would be followed by the browser WITH the owner's Authorization,
+      // towards any route of this node or of a trusted peer: it is never passed along.
+      r.resume();
+      return res.status(502).json({ error: 'redirect refused', reason: 'host-only-redirect' });
+    }
+    // host-only: every answer; a plain peer: only the long-lived (event streams)
+    if (streamGuard && (!streamGuard.plain || SSE_CONTENT_TYPE_RE.test(String(r.headers['content-type'] || '')))) {
+      const untrack = trackHostOnlyStream(streamGuard, () => {
+        try { up.destroy(); } catch (_) { /* gone */ }
+        try { res.destroy(); } catch (_) { /* gone */ }
+      });
+      res.once('close', untrack); up.once('close', untrack);
+    }
     if (!capture) {
-      res.writeHead(r.statusCode, sanitizeResponseHeaders(headers));
+      res.writeHead(r.statusCode, cleanResponse(headers));
       if (SSE_CONTENT_TYPE_RE.test(String(r.headers['content-type'] || ''))) {
         // The response is open: no inactivity timeout any more (the 504 below
         // still covers a peer that never answers), and the watchdog is rearmed
@@ -542,7 +754,7 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
       const body = Buffer.concat(chunks);
       try { capture(r.statusCode, body.toString('utf8')); } catch (_) { /* the ledger never breaks the forward */ }
       if (res.writableEnded) return;
-      res.writeHead(r.statusCode, sanitizeResponseHeaders(headers));
+      res.writeHead(r.statusCode, cleanResponse(headers));
       res.end(body);
     });
   });
@@ -642,7 +854,16 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     }
     const next = st && store.getNode(st, parsed.route[0]);
     const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
-    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return rejectAskRequest(403, { error: 'route non consentita' });
+    // A host-only peer has no panel and no Live host to offer: refused for the
+    // owner as well, and before any other decision.
+    if (next && isHostOnlyPeer(next) && (isPanelResource(parsed.resource) || isLiveHostResource(parsed.resource))) {
+      return res.status(403).json({
+        error: 'risorsa non disponibile verso un nodo solo-host',
+        reason: isPanelResource(parsed.resource) ? 'host-only-no-panel' : 'host-only-no-live-host',
+      });
+    }
+    if (!next || !next.token || privateInbound
+      || (ingress && (!canTransit(ingress, next) || !chainInAudience(st, visited, next)))) return rejectAskRequest(403, { error: 'route non consentita' });
     if (parsed.resource === '/asks' && req.method === 'POST') {
       const view = accessPresets.grantsOf(next);
       if (!view.configured || view.label !== 'admin') {
@@ -713,7 +934,7 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
       if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) {
         return rejectForward(403, { error: 'READONLY: federated mutation blocked' });
       }
-      if (!currentNext.token || currentNext.shared !== true || (currentIngress && !canTransit(currentIngress, currentNext))) {
+      if (!currentNext.token || currentNext.shared !== true || (currentIngress && (!canTransit(currentIngress, currentNext) || !chainInAudience(current, visited, currentNext)))) {
         return rejectForward(403, { error: 'route non consentita' });
       }
       if (!controlledVisited(req, currentIngress, current.nodeId)) return rejectForward(409, { error: 'federation cycle rejected' });
@@ -725,6 +946,8 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
       try { JSON.parse(text); } catch (_) { invalidateProof(); }
     } : capture;
     proxyHttp(req, res, { port: forwardPort, path, credential: next.token, visited, setCookiePrefix, panelCookie, capture: actionCapture,
+      hostOnlyEgress: isHostOnlyPeer(next),
+      streamGuard: ingress ? streamGuardFor(nodesPath, ingress, next, visited) : null,
       onForwardFailure: isAskAction ? invalidateProof : null, abortWithClient: isAskAction, getTimeoutMs: forwardGetTimeoutMs, sseIdleMs: forwardSseIdleMs });
   };
 }
@@ -1200,7 +1423,7 @@ async function collectTopologyDetailed({
     // clients become part of Hydra only after their explicit Share toggle.
     if (!n.nodeId || seen.has(n.nodeId)
       || (!ingress && n.direction === 'inbound' && n.shared !== true)
-      || (ingress && !canTransit(ingress, n))) continue;
+      || (ingress && (!canTransit(ingress, n) || !chainInAudience(st, [...seen, ingress.nodeId], n)))) continue;
     // `name` e' lo slug locale con cui si indirizza; `label` e' il nome
     // leggibile. Senza quest'ultimo un nodo raggiunto in transito arriva agli
     // altri come uno slug scelto da qualcun altro, e cinque installazioni
@@ -1209,7 +1432,9 @@ async function collectTopologyDetailed({
       instanceId: n.nodeId, name: n.name, route: [n.name], direct: true,
       label: store.validLabel(n.label) ? n.label.trim() : '',
     });
-    if (ttl <= 1 || !n.token) continue;
+    // A host-only peer is published as a LEAF: whatever it says about its own
+    // children is never asked for, so it cannot announce nodes to our readers.
+    if (ttl <= 1 || !n.token || isHostOnlyPeer(n)) continue;
     probes.push({ n, pending: fetchPeerTopology({ node: n, ttl, seen, fetchImpl, timeoutMs: childBudget }) });
   }
   const results = await Promise.all(probes.map(async ({ n, pending }) => {
@@ -1261,12 +1486,38 @@ async function collectTopologyDetailed({
       });
     }
   }
-  const ids = new Set(); const routes = new Set(); const unique = [];
+  const ids = new Set(); const routes = new Set(); let unique = [];
   for (const n of out.sort((a, b) => a.route.length - b.route.length)) {
     const routeKey = n.route.join('/');
     if (ids.has(n.instanceId) || routes.has(routeKey)) continue;
     ids.add(n.instanceId); routes.add(routeKey); unique.push(n);
   }
+  if (ingress) {
+    // The fan-out above waited: whatever authorized the reader at the start is read AGAIN now, before the
+    // answer leaves. A host-only peer stays only if the SAME reader (same credential) still passes.
+    const now = store.loadStore(nodesPath);
+    const reader = now && now.nodes.find((n) => n && n.nodeId === ingress.nodeId
+      && credentialFingerprint(n.acceptToken) === credentialFingerprint(ingress.acceptToken));
+    const chain = [...seen, ingress.nodeId];
+    // A peer is judged by the FULL rule NOW if it was host-only when the walk started or is host-only now: one that
+    // stopped being host-only meanwhile (the publication ended during the wait) does not keep its leaf, and neither
+    // does one whose mode, audience or chain no longer passes. Unreadable store: nothing is vouched for.
+    const wasHostOnly = new Map(st.nodes.filter((n) => isHostOnlyPeer(n)).map((n) => [n.nodeId, audienceFingerprint(n)]));
+    const candidates = new Map();
+    for (const n of st.nodes) if (isHostOnlyPeer(n)) candidates.set(n.nodeId, n);
+    for (const n of (now ? now.nodes : [])) if (isHostOnlyPeer(n)) candidates.set(n.nodeId, n);
+    const closed = [...candidates.values()].filter((n) => {
+      if (!now || !reader) return true;
+      const cur = now.nodes.find((x) => x.nodeId === n.nodeId);
+      if (!cur || !isHostOnlyPeer(cur)) return true;                                   // the publication ended (or the peer is gone)
+      if (wasHostOnly.has(n.nodeId) && wasHostOnly.get(n.nodeId) !== audienceFingerprint(cur)) return true;   // another audience
+      return !(canTransit(reader, cur) && chainInAudience(now, chain, cur));
+    });
+    if (closed.length) {
+      const closedIds = new Set(closed.map((n) => n.nodeId)); const closedNames = new Set(closed.map((n) => n.name));
+      unique = unique.filter((e) => !closedIds.has(e.instanceId) && !(e.direct && closedNames.has(e.name)) && !e.route.some((name, i) => i === 0 && closedNames.has(name)));
+    }
+  }
   return { instanceId: st.nodeId, nodes: unique, authoritative };
 }
 
@@ -1286,7 +1537,9 @@ async function collectLocalTopology({
   const live = await collectTopologyDetailed({ nodesPath, fetchImpl, timeoutMs, childSnapshots: false });
   const st = store.loadStore(nodesPath);
   const directNames = new Set(((st && st.nodes) || [])
-    .filter((n) => n.direction !== 'inbound' || n.shared === true)
+    // A host-only peer is a leaf: nothing cached "behind" it survives (entries
+    // written before the mode was turned on included).
+    .filter((n) => (n.direction !== 'inbound' || n.shared === true) && !isHostOnlyPeer(n))
     .map((n) => n.name));
   const authoritative = new Set(live.authoritative);
   const liveIds = new Set(live.nodes.map((n) => n.instanceId));
@@ -1362,6 +1615,15 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
     if (!peer) return res.status(401).json({ error: 'unauthorized peer' });
     req.peer = peer; next();
   });
+  // A host-only peer (publish-remote) reaches NOTHING of ours over the protocol:
+  // the only thing it may do is the authenticated health probe. Share, topology,
+  // reverse-pool and routes are all refused here, before their handlers run.
+  r.use((req, res, next) => {
+    if (isHostOnlyPeer(req.peer) && !(req.method === 'GET' && req.path === '/health')) {
+      return res.status(403).json({ error: 'non concesso a questo nodo', reason: 'host-only-peer' });
+    }
+    return next();
+  });
   // Health federato: il peer autenticato (acceptToken matchato sopra) ottiene un
   // 200 esplicito con instanceId/version. Serve da target di probeHealth() lato
   // Initiator: distingue transport (porta aperta) da auth (200 vs 401) da
@@ -1683,10 +1945,15 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
   let port = typeof localPort === 'function' ? localPort() : localPort; let credential = localCredential();
   // Ultimo hop: `/ws` entra com'e', il pannello rientra nell'API locale.
   let path = parsed.resource === '/ws' ? '/ws' : `/api${parsed.resource}`;
+  let hostOnlyEgress = false; let hostOnlyGuard = null;
   if (parsed.route.length) {
     const next = store.getNode(st, parsed.route[0]);
     const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
-    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return reject(socket, 403);
+    if (next && isHostOnlyPeer(next) && isPanelResource(parsed.resource)) return reject(socket, 403);
+    if (!next || !next.token || privateInbound
+      || (ingress && (!canTransit(ingress, next) || !chainInAudience(st, visited, next)))) return reject(socket, 403);
+    hostOnlyEgress = isHostOnlyPeer(next);
+    if (ingress) hostOnlyGuard = streamGuardFor(nodesPath, ingress, next, visited);
     port = next.localPort; credential = next.token;
     const rest = parsed.route.slice(1);
     path = `/federation/route/${rest.length ? `${rest.join('/')}/` : ''}${ROUTE_DELIMITER}${parsed.resource}`;
@@ -1707,6 +1974,13 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
       // cambiare), l'output va scritto grezzo (i frame li ha gia' incorniciati
       // l'upstream).
       try { socket.write(handshake); } catch (_) { /* morto */ }
+      if (hostOnlyGuard) {
+        const untrackTaken = trackHostOnlyStream(hostOnlyGuard, () => {
+          try { socket.destroy(); } catch (_) { /* gone */ }
+          try { record.up.destroy(); } catch (_) { /* gone */ }
+        });
+        record.up.once('close', untrackTaken);
+      }
       // Gli eventuali byte gia' arrivati dopo la richiesta di upgrade vanno
       // inoltrati come nel ramo normale, non persi.
       if (head && head.length) { try { record.up.write(head); } catch (_) { /* morto */ } }
@@ -1729,6 +2003,14 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
     }
   }
   const up = net.connect({ host: '127.0.0.1', port });
+  // What we read from the peer: for a host-only peer the head of its answer is
+  // filtered like its HTTP answers.
+  let upRead = up;
+  if (hostOnlyEgress) {
+    const headFilter = hostOnlyHeadFilter();
+    headFilter.on('error', () => { try { up.destroy(); } catch (_) { /* gone */ } });   // refused head: upstreamGone() answers the client with our own bytes
+    upRead = up.pipe(headFilter);
+  }
   // ECONNREFUSED sull'hop locale (tunnel che si riavvia) arriva PRIMA del
   // 'connect': nel ramo hubMode il listener 'error' era registrato solo dentro
   // up.once('connect', …) e l'evento restava senza gestore → Unhandled 'error'
@@ -1752,7 +2034,7 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
   let saw101 = false;
   let headBuf = Buffer.alloc(0);
   let gone = false;
-  up.on('data', (chunk) => {
+  upRead.on('data', (chunk) => {
     if (saw101 || headBuf.length >= 1024) return;
     headBuf = Buffer.concat([headBuf, chunk.subarray(0, Math.max(0, 1024 - headBuf.length))]);
     if (headBuf.includes(' 101')) saw101 = true;
@@ -1798,6 +2080,15 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
       const remove = () => { activeSockets.delete(socket); activeSockets.delete(up); };
       socket.once('close', remove); up.once('close', remove);
     }
+    if (hostOnlyGuard) {
+      // Released when the UPSTREAM goes: a held attach keeps `up` after the
+      // client has gone, and it must still be closed on revocation.
+      const untrack = trackHostOnlyStream(hostOnlyGuard, () => {
+        try { socket.destroy(); } catch (_) { /* gone */ }
+        try { up.destroy(); } catch (_) { /* gone */ }
+      });
+      up.once('close', untrack);
+    }
     if (hubMode) {
       // Attach trattenuta: l'output passa dal ring quando il client non c'è,
       // e il record entra nello store sotto la sua identità.
@@ -1805,7 +2096,7 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
         attachId, tokenHash: tokenFingerprint(attachToken), route: attachRoute, session: attachSession, up,
       });
       heldRecord = record;
-      up.on('data', (chunk) => hubAttaches.feed(record, chunk));
+      upRead.on('data', (chunk) => hubAttaches.feed(record, chunk));
       up.on('close', () => hubAttaches.destroy(record));
       up.on('error', () => hubAttaches.destroy(record));
       // end:false: la caduta del CLIENT non deve chiudere l'upstream — è
@@ -1831,7 +2122,7 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
     socket.pipe(up);
     // end:false: la chiusura verso il browser la governiamo noi, o la pipe
     // chiuderebbe il socket PRIMA che il frame di close 4402 possa partire.
-    up.pipe(socket, { end: false });
+    upRead.pipe(socket, { end: false });
   });
   if (!hubMode) {
     // Nel ramo trattenuto la morte dell'upstream la governa lo store (destroy
@@ -2072,9 +2363,9 @@ function acceptWsThenClose(socket, req, code, reason) {
 
 
 module.exports = {
-  isPanelResource, panelAllowedFor, isLiveHostResource, liveHostAllowedFor, routeHandler,
+  isPanelResource, panelAllowedFor, isLiveHostResource, liveHostAllowedFor, classGateCheck, routeHandler,
   MAX_HOPS, ROUTE_DELIMITER, TOPOLOGY_PEER_TIMEOUT_MS, SHARE_NOT_READY_CODE, classifyShareFailure, activeReversePort,
-  peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource, allowedQuery, readonlyBlocksFederated,
+  peerFromToken, peerAllows, canTransit, isHostOnlyPeer, chainInAudience, touchesHostOnly, routeNamesOf, hostOnlyVisibility, hideHostOnlyEntries, redactHostOnlyReferences, parseRoute, knownResource, allowedResource, allowedQuery, readonlyBlocksFederated,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade, createHubAttachStore,
   probeHealth, waitForHealthyPeer, canListenLoopback, preflightHubReverse, notifyHubShare, reconcilePeerShare, runShareRevokeBoot, probeReverseOwner,
   hubPoolRequest, verifyHubPoolSlot, reserveHubPoolSlot, commitHubPoolSlot, settleHubPoolSlot, abortHubPoolSlot, getHubPoolStatus,

package/lib/proxy/node-proxy.js

@@ -22,6 +22,7 @@
 // raw socket TCP (upgrade WS). resolveNode/httpRequest/connect iniettabili (test).
 const http = require('node:http');
 const net = require('node:net');
+const { Transform } = require('node:stream');
 const { NODE_NAME_RE } = require('../nodes/store.js');
 const { bearerFrom } = require('../auth/middleware.js');
 
@@ -142,6 +143,77 @@ function sanitizeResponseHeaders(headers) {
   return out;
 }
 
+// Answers of a host-only peer: the peer is published one way, so nothing it says
+// may act on the origin of the PWA. Its cookies, its Clear-Site-Data and its CSP
+// are dropped; the body is served sandboxed and without MIME sniffing.
+const HOST_ONLY_STRIPPED_HEADERS = new Set([
+  'set-cookie', 'set-cookie2', 'clear-site-data', 'content-security-policy', 'content-security-policy-report-only',
+  'x-content-type-options', 'cross-origin-opener-policy', 'cross-origin-embedder-policy', 'cross-origin-resource-policy',
+  'location', 'content-location', 'refresh',
+]);
+function sanitizeHostOnlyResponseHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(sanitizeResponseHeaders(headers))) {
+    if (HOST_ONLY_STRIPPED_HEADERS.has(k.toLowerCase())) continue;
+    out[k] = v;
+  }
+  out['content-security-policy'] = "sandbox; default-src 'none'";
+  out['x-content-type-options'] = 'nosniff';
+  return out;
+}
+
+// The head of an upgrade answer from a host-only peer: the same headers dropped as on the HTTP
+// answers (cookies, Clear-Site-Data, CSP). The head is parsed the way the most lenient consumer
+// would read it, so what is dropped here cannot reappear there: the end of the head is the first
+// empty line (CRLF or bare LF), lines end with CRLF or bare LF, folded (continuation) lines are
+// unfolded, a header name is a strict token. Anything that does not parse that way — a bare CR, a
+// NUL, a line without a colon or with a malformed name, a first line that is not a status line, a
+// head over 16 KB — is refused (the stream errors, the connection is closed) instead of passed
+// along. Bytes after the head pass as they are.
+const HOST_ONLY_HEAD_DROPPED = new Set(['set-cookie', 'set-cookie2', 'clear-site-data', 'content-security-policy', 'content-security-policy-report-only']);
+const HOST_ONLY_HEAD_MAX = 16384;
+function sanitizeUpgradeHead(headText) {
+  if (/\0/.test(headText) || /\r(?!\n)/.test(headText)) throw new Error('upgrade head with a NUL or a bare CR');
+  const raw = headText.split(/\r?\n/);
+  // The ONLY answer to an upgrade that is passed along is a 101: a refusal, a 100 Continue (an interim answer
+  // that would let a second head slip through) or anything else is refused here.
+  if (!/^HTTP\/1\.[01] 101(?: [^\r\n]*)?$/.test(raw[0])) throw new Error('upgrade answer of a host-only peer is not a 101');
+  const logical = [];
+  for (const line of raw.slice(1)) {
+    if (/^[ \t]/.test(line)) {                        // obs-fold: continuation of the previous header
+      if (!logical.length) throw new Error('upgrade head with a continuation before any header');
+      logical[logical.length - 1] += ` ${line.trim()}`;
+    } else logical.push(line);
+  }
+  const kept = [raw[0]];
+  for (const line of logical) {
+    const i = line.indexOf(':');
+    if (i <= 0) throw new Error('upgrade head with a malformed header line');
+    const name = line.slice(0, i).trim();
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) throw new Error('upgrade head with a malformed header name');
+    if (HOST_ONLY_HEAD_DROPPED.has(name.toLowerCase())) continue;
+    kept.push(`${name}:${line.slice(i + 1)}`);
+  }
+  return `${kept.join('\r\n')}\r\n\r\n`;
+}
+function hostOnlyHeadFilter() {
+  let buf = Buffer.alloc(0); let done = false;
+  return new Transform({
+    transform(chunk, _enc, cb) {
+      if (done) return cb(null, chunk);
+      buf = Buffer.concat([buf, chunk]);
+      const window = buf.toString('latin1', 0, Math.min(buf.length, HOST_ONLY_HEAD_MAX + 4));
+      const m = /\r?\n\r?\n/.exec(window);
+      if (!m || m.index > HOST_ONLY_HEAD_MAX) return buf.length > HOST_ONLY_HEAD_MAX ? cb(new Error('upgrade head too large')) : cb();
+      let head;
+      try { head = sanitizeUpgradeHead(window.slice(0, m.index)); } catch (e) { return cb(e); }
+      const rest = buf.subarray(m.index + m[0].length);
+      done = true; buf = null;
+      return cb(null, Buffer.concat([Buffer.from(head, 'latin1'), rest]));
+    },
+  });
+}
+
 function notFound(res) { res.status(404).json({ error: 'not found' }); }
 
 // --- HTTP proxy middleware --------------------------------------------------
@@ -186,7 +258,12 @@ function proxyHttp(req, res, node, rest, search, httpRequest, timeoutMs) {
   let upstream;
   try {
     upstream = httpRequest(options, (up) => {
-      res.writeHead(up.statusCode, sanitizeResponseHeaders(up.headers));
+      if (node.hostOnly === true && up.statusCode >= 300 && up.statusCode < 400) {
+        // A redirect from a host-only peer would be followed by the browser WITH the owner's Authorization.
+        up.resume();
+        return res.status(502).json({ error: 'redirect refused', reason: 'host-only-redirect' });
+      }
+      res.writeHead(up.statusCode, (node.hostOnly === true ? sanitizeHostOnlyResponseHeaders : sanitizeResponseHeaders)(up.headers));
       up.pipe(res);
     });
   } catch (_) {
@@ -327,7 +404,13 @@ function handleNodeUpgrade(ctx) {
     socket.on('error', () => { try { upstream.destroy(); } catch (_) {} });
     upstream.on('error', () => { try { socket.destroy(); } catch (_) {} });
     socket.pipe(upstream);
-    upstream.pipe(socket);
+    let down = upstream;
+    if (node.hostOnly === true) {
+      const filter = hostOnlyHeadFilter();
+      filter.on('error', () => { try { upstream.destroy(); } catch (_) {} abortUpgrade(socket, 502); });
+      down = upstream.pipe(filter);
+    }
+    down.pipe(socket);
   });
   upstream.on('error', () => { clearTimeout(timer); fail(502); });
 }
@@ -340,7 +423,7 @@ module.exports = {
   createNodeProxy,
   handleNodeUpgrade,
   // esposti per i test
-  splitNodePath, isTransitiveRest, sanitizeRequestHeaders, sanitizeResponseHeaders,
+  splitNodePath, isTransitiveRest, sanitizeRequestHeaders, sanitizeResponseHeaders, sanitizeHostOnlyResponseHeaders, hostOnlyHeadFilter,
   buildUpgradeRequest, stripLocalTokenQuery, isStrippedRequestHeader, connectionOptions, bearerFromUpgrade,
   MUTATING, HOP_BY_HOP, PROXY_TIMEOUT_MS,
 };