@muhkoo/connect 0.7.0-alpha.4 → 0.7.0-alpha.5

package/dist/connect.d.ts

@@ -2695,6 +2695,8 @@ declare class HttpError extends Error {
 }
 declare class HttpClient {
     readonly baseUrl: string;
+    /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
+    private readonly baseOrigin;
     private readonly apiKey;
     private readonly getSessionToken;
     private readonly onUnauthorized;
@@ -2706,6 +2708,8 @@ declare class HttpClient {
      * up credentials without knowing about them.
      */
     readonly fetch: typeof fetch;
+    /** True when `input` resolves to {@link baseOrigin} (relative URLs always do). */
+    private isSameOrigin;
     get<T = unknown>(path: string): Promise<T>;
     post<T = unknown>(path: string, body?: unknown): Promise<T>;
     patch<T = unknown>(path: string, body?: unknown): Promise<T>;

package/dist/server/index.js

@@ -1734,16 +1734,15 @@ class DoubleRatchetManager {
     }
     async registerZK(clientId, secret, salt, ecdsaPub) {
         await this._authenticator.initializeZK();
-        console.log(`Registering ZK for ${clientId}...`);
-        console.log('ECDSA Public Key:', ecdsaPub);
         const ecdsaJwk = await crypto.subtle.exportKey('jwk', ecdsaPub);
         const ecdsaHex = toHex(fromBase64Url(ecdsaJwk.x)).slice(0, 64);
         const ecdsaPubField = new Field(BigInt('0x' + ecdsaHex));
         const ecdsaPubHash = await Poseidon.hash([ecdsaPubField]);
         const commitment = await Poseidon.hash([secret, salt, ecdsaPubHash]);
-        console.log(`Commitment for ${clientId}:`, { commitment, salt });
         this.registeredUsers.set(clientId, { commitment, salt });
-        appLogger.debug(`Registered ${clientId}: commitment=${commitment.toString()}, salt=${salt.toString()}`);
+        // NB: never log `secret`, `salt`, or `commitment` — `salt` is a private
+        // witness for the ZK circuit and `commitment` is the user's stable id.
+        appLogger.debug(`Registered ZK identity for ${clientId}`);
     }
     async performHandshake(senderId, recipientId, zkProof, publicInput, clientPublicKey, // ECDH pub for session
     clientAuthPublicKey, // ECDSA pub for auth
@@ -3005,6 +3004,8 @@ class HttpError extends Error {
 }
 class HttpClient {
     baseUrl;
+    /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
+    baseOrigin;
     apiKey;
     getSessionToken;
     onUnauthorized;
@@ -3013,6 +3014,12 @@ class HttpClient {
         if (!opts?.baseUrl)
             throw new Error("HttpClient: `baseUrl` is required");
         this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+        try {
+            this.baseOrigin = new URL(this.baseUrl).origin;
+        }
+        catch {
+            this.baseOrigin = "";
+        }
         this.apiKey = opts.apiKey ?? null;
         this.getSessionToken = opts.getSessionToken ?? (() => null);
         this.onUnauthorized = opts.onUnauthorized ?? null;
@@ -3029,13 +3036,34 @@ class HttpClient {
      */
     fetch = (input, init) => {
         const headers = new Headers(init?.headers);
-        if (this.apiKey)
-            headers.set("X-Muhkoo-Key", this.apiKey);
-        const token = this.getSessionToken();
-        if (token)
-            headers.set("X-Muhkoo-Session", token);
+        // Only attach credentials when the request stays on the accelerator's
+        // origin. An absolute URL pointing elsewhere (e.g. a caller-supplied or
+        // server-reflected path that escapes `baseUrl`) must NOT receive the app
+        // key or session token, or it becomes a token-exfiltration vector.
+        if (this.isSameOrigin(input)) {
+            if (this.apiKey)
+                headers.set("X-Muhkoo-Key", this.apiKey);
+            const token = this.getSessionToken();
+            if (token)
+                headers.set("X-Muhkoo-Session", token);
+        }
         return this.fetchFn(input, { ...init, headers });
     };
+    /** True when `input` resolves to {@link baseOrigin} (relative URLs always do). */
+    isSameOrigin(input) {
+        try {
+            const urlStr = typeof input === "string" ? input
+                : input instanceof URL ? input.href
+                    : input.url;
+            // Relative URLs are resolved against baseUrl downstream → same origin.
+            if (!/^https?:\/\//i.test(urlStr))
+                return true;
+            return new URL(urlStr).origin === this.baseOrigin;
+        }
+        catch {
+            return true;
+        }
+    }
     // -------------------------------------------------------------------------
     // JSON convenience helpers (path is relative to baseUrl)
     // -------------------------------------------------------------------------