@neat.is/core 0.3.7 → 0.3.8

package/dist/index.d.cts

@@ -114,6 +114,8 @@ interface BuildApiOptions {
     errorsPath?: string;
     staleEventsPath?: string;
     searchIndex?: SearchIndex;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 declare function buildApi(opts: BuildApiOptions): Promise<FastifyInstance>;
 
@@ -145,6 +147,8 @@ interface BuildOtelReceiverOptions {
     onSpan: SpanHandler;
     onErrorSpanSync?: (span: ParsedSpan) => Promise<void>;
     bodyLimit?: number;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 interface OtlpKeyValue {
     key: string;
@@ -200,6 +204,8 @@ declare function logSpanHandler(span: ParsedSpan): void;
 
 interface BuildOtelGrpcReceiverOptions {
     onSpan: SpanHandler;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 interface OtelGrpcReceiver {
     address: string;

package/dist/index.d.ts

@@ -114,6 +114,8 @@ interface BuildApiOptions {
     errorsPath?: string;
     staleEventsPath?: string;
     searchIndex?: SearchIndex;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 declare function buildApi(opts: BuildApiOptions): Promise<FastifyInstance>;
 
@@ -145,6 +147,8 @@ interface BuildOtelReceiverOptions {
     onSpan: SpanHandler;
     onErrorSpanSync?: (span: ParsedSpan) => Promise<void>;
     bodyLimit?: number;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 interface OtlpKeyValue {
     key: string;
@@ -200,6 +204,8 @@ declare function logSpanHandler(span: ParsedSpan): void;
 
 interface BuildOtelGrpcReceiverOptions {
     onSpan: SpanHandler;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 interface OtelGrpcReceiver {
     address: string;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   routeSpanToProject,
   startDaemon
-} from "./chunk-EDHOCFOG.js";
+} from "./chunk-LQ3JFBTX.js";
 import {
   ProjectNameCollisionError,
   addProject,
@@ -37,15 +37,15 @@ import {
   thresholdForEdgeType,
   touchLastSeen,
   writeAtomically
-} from "./chunk-ZU2RQRCN.js";
+} from "./chunk-CZ3T6TE2.js";
 import {
   startOtelGrpcReceiver
-} from "./chunk-CY67YKNO.js";
+} from "./chunk-V4TU7OKZ.js";
 import {
   buildOtelReceiver,
   logSpanHandler,
   parseOtlpRequest
-} from "./chunk-75IBA4UL.js";
+} from "./chunk-7TYESDAI.js";
 export {
   ProjectNameCollisionError,
   addProject,

package/dist/neatd.cjs

@@ -40,6 +40,75 @@ var init_cjs_shims = __esm({
   }
 });
 
+// src/auth.ts
+function isLoopbackHost(host) {
+  if (!host) return false;
+  return LOOPBACK_HOSTS.has(host);
+}
+function assertBindAuthority(host, token) {
+  if (token && token.length > 0) return;
+  if (isLoopbackHost(host)) return;
+  throw new BindAuthorityError(host);
+}
+function mountBearerAuth(app, opts) {
+  if (!opts.token || opts.token.length === 0) return;
+  if (opts.trustProxy) return;
+  const expected = Buffer.from(opts.token, "utf8");
+  const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  app.addHook("preHandler", (req2, reply, done) => {
+    const path39 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    for (const suffix of suffixes) {
+      if (path39 === suffix || path39.endsWith(suffix)) {
+        done();
+        return;
+      }
+    }
+    const header = req2.headers.authorization;
+    if (typeof header !== "string" || !header.startsWith("Bearer ")) {
+      void reply.code(401).send({ error: "unauthorized" });
+      return;
+    }
+    const provided = Buffer.from(header.slice("Bearer ".length).trim(), "utf8");
+    if (provided.length !== expected.length || !(0, import_node_crypto.timingSafeEqual)(provided, expected)) {
+      void reply.code(401).send({ error: "unauthorized" });
+      return;
+    }
+    done();
+  });
+}
+function readAuthEnv(env = process.env) {
+  const t = env.NEAT_AUTH_TOKEN;
+  const ot = env.NEAT_OTEL_TOKEN;
+  return {
+    authToken: t && t.length > 0 ? t : void 0,
+    otelToken: ot && ot.length > 0 ? ot : t && t.length > 0 ? t : void 0,
+    trustProxy: env.NEAT_AUTH_PROXY === "true"
+  };
+}
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, DEFAULT_UNAUTH_SUFFIXES;
+var init_auth = __esm({
+  "src/auth.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_crypto = require("crypto");
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+      "127.0.0.1",
+      "localhost",
+      "::1",
+      "::ffff:127.0.0.1"
+    ]);
+    BindAuthorityError = class extends Error {
+      constructor(host) {
+        super(
+          `NEAT refuses to bind on a public interface without \`NEAT_AUTH_TOKEN\` set (host="${host}"). Set the token or bind to loopback only.`
+        );
+        this.name = "BindAuthorityError";
+      }
+    };
+    DEFAULT_UNAUTH_SUFFIXES = ["/health", "/healthz", "/readyz"];
+  }
+});
+
 // src/otel-grpc.ts
 var otel_grpc_exports = {};
 __export(otel_grpc_exports, {
@@ -122,8 +191,21 @@ function loadTraceService() {
 async function startOtelGrpcReceiver(opts) {
   const server = new grpc.Server();
   const service = loadTraceService();
+  const requiresAuth = !opts.trustProxy && !!opts.authToken && opts.authToken.length > 0;
+  const expectedHeader = requiresAuth ? `Bearer ${opts.authToken}` : "";
   server.addService(service, {
     Export: (call, callback) => {
+      if (requiresAuth) {
+        const meta = call.metadata.get("authorization");
+        const got = meta.length > 0 ? String(meta[0]) : "";
+        const a = Buffer.from(got, "utf8");
+        const b = Buffer.from(expectedHeader, "utf8");
+        const ok = a.length === b.length && (0, import_node_crypto2.timingSafeEqual)(a, b);
+        if (!ok) {
+          callback({ code: grpc.status.UNAUTHENTICATED, message: "unauthorized" });
+          return;
+        }
+      }
       void (async () => {
         try {
           const reshaped = reshapeGrpcRequest(call.request ?? {});
@@ -156,13 +238,14 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path34, grpc, protoLoader;
+var import_node_url, import_node_path34, import_node_crypto2, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
     import_node_path34 = __toESM(require("path"), 1);
+    import_node_crypto2 = require("crypto");
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
     init_otel();
@@ -303,6 +386,7 @@ async function buildOtelReceiver(opts) {
     logger: false,
     bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024
   });
+  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
   const queue = [];
   let draining = false;
   let drainPromise = Promise.resolve();
@@ -390,6 +474,7 @@ var init_otel = __esm({
     import_node_url2 = require("url");
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
+    init_auth();
     exportTraceServiceRequestType = null;
     exportTraceServiceResponseType = null;
     cachedProtobufResponseBody = null;
@@ -4646,6 +4731,7 @@ data: ${JSON.stringify(envelope.payload)}
 }
 
 // src/api.ts
+init_auth();
 function serializeGraph(graph) {
   const nodes = [];
   graph.forEachNode((_id, attrs) => {
@@ -5011,6 +5097,7 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = (0, import_fastify.default)({ logger: false });
   await app.register(import_cors.default, { origin: true });
+  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -5074,6 +5161,7 @@ async function buildApi(opts) {
 
 // src/daemon.ts
 init_otel();
+init_auth();
 function neatHomeFor(opts) {
   if (opts.neatHome && opts.neatHome.length > 0) return import_node_path36.default.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
@@ -5280,8 +5368,14 @@ async function startDaemon(opts = {}) {
     const host = resolveHost(opts);
     const restPort = resolveRestPort(opts);
     const otlpPort = resolveOtlpPort(opts);
+    const auth = readAuthEnv();
+    assertBindAuthority(host, auth.authToken);
     try {
-      restApp = await buildApi({ projects: registry });
+      restApp = await buildApi({
+        projects: registry,
+        authToken: auth.authToken,
+        trustProxy: auth.trustProxy
+      });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(`neatd: REST listening on ${restAddress}`);
     } catch (err) {
@@ -5318,6 +5412,8 @@ async function startDaemon(opts = {}) {
     }
     try {
       otlpApp = await buildOtelReceiver({
+        authToken: auth.otelToken,
+        trustProxy: auth.trustProxy,
         onSpan: async (span) => {
           const slot = await resolveTargetSlot(span.service);
           if (!slot) return;
@@ -5397,6 +5493,9 @@ async function startDaemon(opts = {}) {
   return { slots, reload, stop, pidPath, restAddress, otlpAddress };
 }
 
+// src/neatd.ts
+init_auth();
+
 // src/web-spawn.ts
 init_cjs_shims();
 var import_node_child_process = require("child_process");
@@ -5592,7 +5691,16 @@ function restPortFromEnv() {
   return raw && raw.length > 0 ? Number.parseInt(raw, 10) : 8080;
 }
 async function cmdStart() {
-  const handle = await startDaemon();
+  let handle;
+  try {
+    handle = await startDaemon();
+  } catch (err) {
+    if (err instanceof BindAuthorityError) {
+      console.error(`neatd: ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
+  }
   console.log(`neatd: started, PID ${process.pid}, ${handle.slots.size} project(s)`);
   console.log(`neatd: registry at ${registryPath()}`);
   if (handle.restAddress) console.log(`neatd: REST  \u2192 ${handle.restAddress}`);