@openhoo/hoopilot 0.9.3 → 1.0.0

package/dist/index.js

@@ -2618,7 +2618,8 @@ var IS_STANDALONE_BINARY = BAKED_VERSION !== void 0;
 // src/server.ts
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
-var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Browser-origin requests require HOOPILOT_API_KEY unless the Origin is loopback.";
+var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Cross-origin browser requests are blocked unless the Origin is loopback or listed in HOOPILOT_ALLOWED_ORIGINS.";
+var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set(["local-key"]);
 var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
 var JSON_OBJECT_MESSAGE = "Request body must be a JSON object.";
 var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
@@ -2634,6 +2635,7 @@ var RequestBodyTooLargeError = class extends Error {
 function createHoopilotHandler(options = {}) {
   const client = new CopilotClient(options);
   const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
+  const allowedOrigins = parseAllowedOrigins(options.env);
   const logger = serverLogger(options);
   const metrics = options.metrics ?? new MetricsRegistry();
   const readUsage = createUsageReader(client, metrics);
@@ -2653,7 +2655,10 @@ function createHoopilotHandler(options = {}) {
       route
     });
     metrics.startRequest();
+    const origin = request.headers.get("origin")?.trim() || void 0;
+    const corsOrigin = resolveCorsAllowOrigin(origin, allowedOrigins);
     const finish = (response) => finishResponse(response, {
+      corsOrigin,
       logger: requestLogger,
       method: request.method,
       metrics,
@@ -2663,11 +2668,11 @@ function createHoopilotHandler(options = {}) {
       closeConnection: bufferProxyBodies,
       trackStreamingBody: !bufferProxyBodies
     });
-    const browserOrigin = forbiddenBrowserOrigin(request, apiKey);
+    const browserOrigin = forbiddenBrowserOrigin(origin, request, allowedOrigins);
     if (browserOrigin) {
       requestLogger.warn(
         { event: "http.request.forbidden_origin", origin: browserOrigin },
-        "blocked unauthenticated browser-origin request"
+        "blocked cross-origin browser request"
       );
       return finish(jsonError(403, "forbidden_origin", FORBIDDEN_BROWSER_ORIGIN_MESSAGE));
     }
@@ -2793,10 +2798,17 @@ function startHoopilotServer(options = {}) {
   const port = normalizeServerPort(options.port ?? envValue(options.env?.PORT) ?? DEFAULT_PORT);
   const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
   const allowUnauthenticated = options.allowUnauthenticated ?? envValue(options.env?.HOOPILOT_ALLOW_UNAUTHENTICATED) === "1";
-  if (!isLoopbackHost(host) && !apiKey && !allowUnauthenticated) {
-    throw new Error(
-      "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
-    );
+  if (!isLoopbackHost(host)) {
+    if (!apiKey && !allowUnauthenticated) {
+      throw new Error(
+        "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
+      );
+    }
+    if (apiKey && isWellKnownDemoApiKey(apiKey)) {
+      throw new Error(
+        "Refusing to listen on a non-loopback host with a well-known demo HOOPILOT_API_KEY. Set a strong, unique API key."
+      );
+    }
   }
   const server = Bun.serve({
     fetch: createHoopilotHandler({
@@ -3109,7 +3121,6 @@ function corsHeaders() {
   return {
     "access-control-allow-headers": "anthropic-beta, anthropic-dangerous-direct-browser-access, anthropic-version, authorization, content-type, x-api-key, x-request-id",
     "access-control-allow-methods": "GET, POST, OPTIONS",
-    "access-control-allow-origin": "*",
     "access-control-expose-headers": "x-request-id"
   };
 }
@@ -3121,17 +3132,34 @@ function isAuthorized(request, apiKey) {
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
   return bearer === apiKey || request.headers.get("x-api-key") === apiKey;
 }
-function forbiddenBrowserOrigin(request, apiKey) {
-  if (apiKey) {
-    return void 0;
-  }
-  const origin = request.headers.get("origin")?.trim();
+function forbiddenBrowserOrigin(origin, request, allowedOrigins) {
   if (origin) {
-    return isLoopbackOrigin(origin) ? void 0 : origin;
+    return isAllowedOrigin(origin, allowedOrigins) ? void 0 : origin;
   }
   const fetchSite = request.headers.get("sec-fetch-site")?.toLowerCase();
   return fetchSite === "cross-site" ? "cross-site" : void 0;
 }
+function parseAllowedOrigins(env) {
+  const raw = envValue(env?.HOOPILOT_ALLOWED_ORIGINS);
+  if (!raw) {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(
+    raw.split(",").map((value) => value.trim().toLowerCase()).filter((value) => value.length > 0)
+  );
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+  return isLoopbackOrigin(origin) || allowedOrigins.has(origin.toLowerCase());
+}
+function resolveCorsAllowOrigin(origin, allowedOrigins) {
+  if (!origin) {
+    return "*";
+  }
+  return isAllowedOrigin(origin, allowedOrigins) ? origin : void 0;
+}
+function isWellKnownDemoApiKey(apiKey) {
+  return WELL_KNOWN_DEMO_API_KEYS.has(apiKey.trim().toLowerCase());
+}
 function isUpstreamAuthStatus(status) {
   return status === 401 || status === 403;
 }
@@ -3191,7 +3219,12 @@ function shouldBufferProxyBodies(mode) {
   return process.platform === "win32" && IS_STANDALONE_BINARY;
 }
 function finishResponse(response, options) {
-  const withRequestId = responseWithRequestId(response, options.requestId, options.closeConnection);
+  const withRequestId = responseWithRequestId(
+    response,
+    options.requestId,
+    options.closeConnection,
+    options.corsOrigin
+  );
   const stream = isStreamingResponse(withRequestId);
   const status = withRequestId.status;
   const complete = () => {
@@ -3209,9 +3242,17 @@ function finishResponse(response, options) {
   complete();
   return withRequestId;
 }
-function responseWithRequestId(response, requestId, closeConnection) {
+function responseWithRequestId(response, requestId, closeConnection, corsOrigin) {
   const headers = new Headers(response.headers);
   headers.set("x-request-id", requestId);
+  if (corsOrigin) {
+    headers.set("access-control-allow-origin", corsOrigin);
+    if (corsOrigin !== "*") {
+      headers.append("vary", "Origin");
+    }
+  } else {
+    headers.delete("access-control-allow-origin");
+  }
   if (closeConnection) {
     headers.set("connection", "close");
   }