@openparachute/hub 0.7.3-rc.8 → 0.7.3

package/src/hub-origin.ts

@@ -14,6 +14,70 @@
 
 export const HUB_ORIGIN_ENV = "PARACHUTE_HUB_ORIGIN";
 
+/**
+ * The env var carrying the SET of origins the hub legitimately answers on,
+ * comma-separated (multi-origin iss-set, onboarding-streamline 2026-06-25).
+ *
+ * Supervised resource servers (vault, scribe) read this in addition to the
+ * single canonical `PARACHUTE_HUB_ORIGIN` and widen their accepted-`iss` check
+ * from one string to this set — so a token minted under one URL of a
+ * multi-URL box (loopback ∪ `<ip>.sslip.io` ∪ a custom domain behind Caddy)
+ * validates when the resource is reached via another URL of the SAME box. The
+ * signing key is stable + origin-independent, so only the `iss` string varies.
+ *
+ * SECURITY INVARIANT: the value MUST be the hub's `buildHubBoundOrigins`
+ * output — configured issuer ∪ loopback aliases ∪ expose-state public origin ∪
+ * platform origin — published BY THE HUB. It must NEVER contain an unvalidated
+ * request `Host` / `X-Forwarded-Host`. Accepting `iss ∈ this-set` is safe
+ * ONLY because the resource server's JWKS signature verify runs first and
+ * proves the hub minted the token.
+ *
+ * `PARACHUTE_HUB_ORIGIN` (the single canonical origin) is ALWAYS written
+ * alongside this var for back-compat: a resource server on an older
+ * scope-guard that doesn't read `PARACHUTE_HUB_ORIGINS` keeps its existing
+ * single-origin behavior.
+ */
+export const HUB_ORIGINS_ENV = "PARACHUTE_HUB_ORIGINS";
+
+/**
+ * Serialize an origin SET into the comma-separated `PARACHUTE_HUB_ORIGINS`
+ * wire form. Dedupes, drops empties, preserves first-seen order. Returns
+ * `undefined` when nothing survives (caller skips setting the env var so a
+ * resource server falls back to single-origin behavior). Pair with
+ * `buildHubBoundOrigins` to produce `origins`.
+ */
+export function serializeHubOrigins(origins: readonly string[]): string | undefined {
+  const seen = new Set<string>();
+  for (const raw of origins) {
+    if (typeof raw !== "string") continue;
+    const trimmed = raw.trim().replace(/\/+$/, "");
+    if (trimmed.length > 0) seen.add(trimmed);
+  }
+  if (seen.size === 0) return undefined;
+  return Array.from(seen).join(",");
+}
+
+/**
+ * Parse the comma-separated `PARACHUTE_HUB_ORIGINS` wire form back into an
+ * origin array. Tolerant of surrounding whitespace + trailing slashes + empty
+ * segments. The resource-server inverse of `serializeHubOrigins`; lives here
+ * (rather than only in the consumer adapters) so the hub's own injection tests
+ * can round-trip against the canonical parser. Returns `[]` for an
+ * absent/empty/garbage value.
+ */
+export function parseHubOrigins(raw: string | undefined): string[] {
+  if (!raw) return [];
+  const out: string[] = [];
+  const seen = new Set<string>();
+  for (const seg of raw.split(",")) {
+    const trimmed = seg.trim().replace(/\/+$/, "");
+    if (trimmed.length === 0 || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
+
 export interface DeriveHubOriginOpts {
   /** Explicit user override (e.g., `--hub-origin`). Wins over everything else. */
   override?: string;

package/src/hub-server.ts

@@ -578,6 +578,16 @@ export type RequestLayer = "loopback" | "tailnet" | "public";
  * the cloak fires. When `peerAddr` is unknown (null/undefined — no Server
  * threaded, e.g. a unit test calling `layerOf(req)` directly), we fail CLOSED
  * to `public` rather than open to `loopback`.
+ *
+ * Caddy/nginx-direct (hub#704): a SAME-BOX reverse proxy dials loopback (peer
+ * is 127.0.0.1) but, unlike cloudflared/tailscale, sets NO cf/tailscale header
+ * — so a header-only-or-peer-only classifier would call every public request
+ * through it "loopback" (most-trusted). The discriminator is the standard
+ * reverse-proxy forwarding headers (X-Forwarded-For / X-Forwarded-Host /
+ * Forwarded): a loopback peer that carries one is a proxied PUBLIC request →
+ * `public`; a header-less loopback peer (direct on-box caller — CLI, probes,
+ * the init bootstrap-token loopback probe) stays `loopback`. See the inline
+ * comment in the function for the full rationale + spoof analysis.
  */
 export function layerOf(req: Request, peerAddr?: string | null): RequestLayer {
   const h = req.headers;
@@ -590,6 +600,42 @@ export function layerOf(req: Request, peerAddr?: string | null): RequestLayer {
   // value to compare against, hence the presence-check above.
   if (h.get("tailscale-funnel-request") === "?1") return "public";
   if (h.get("tailscale-user-login") !== null) return "tailnet";
+  // Caddy/nginx-direct deploy (hub#704): a same-box reverse proxy terminates
+  // TLS and `reverse_proxy 127.0.0.1:1939` — so it dials loopback (peer is
+  // 127.0.0.1) and, unlike cloudflared/tailscale, stamps NO cf/tailscale
+  // header. Without this branch every PUBLIC request through such a proxy
+  // would classify "loopback" (the MOST-trusted layer): the GET /admin/setup
+  // bootstrap-token JSON probe would hand the token to any public visitor, and
+  // the publicExposure:"loopback" 404-cloak would stop hiding loopback-only
+  // services/vaults from the network.
+  //
+  // The discriminator is the standard reverse-proxy forwarding headers. A
+  // same-box proxy carrying a PUBLIC request sets X-Forwarded-For /
+  // X-Forwarded-Host / Forwarded; a direct on-box caller (the CLI, health
+  // probes, the init bootstrap-token loopback probe `curl 127.0.0.1/admin/setup`,
+  // the hub's own loopback self-requests) sets none of them — the hub never
+  // injects X-Forwarded-* on the INBOUND request it classifies (it only stamps
+  // X-Forwarded-Host/Proto on OUTBOUND proxy requests to modules). So a
+  // loopback peer that ALSO carries a forwarding header is a proxied public
+  // request → "public"; a header-less loopback peer stays "loopback".
+  //
+  // No spoof vector: a NON-loopback peer is already "public" regardless of
+  // headers (the branch below), so adding these headers can only DOWNGRADE a
+  // loopback caller (the on-box operator hurting only their own request) —
+  // never upgrade a network peer to "loopback".
+  //
+  // Presence check (`!== null`), NOT a trim: an empty/whitespace forwarding
+  // header still means "a proxy is in front" → err to public. Downgrading on
+  // ambiguity is the safe direction for a trust classifier; a future ".trim()
+  // tidy-up" that let an empty XFF fall back to loopback would re-open the leak.
+  if (
+    isLoopbackPeer(peerAddr) &&
+    (h.get("x-forwarded-for") !== null ||
+      h.get("x-forwarded-host") !== null ||
+      h.get("forwarded") !== null)
+  ) {
+    return "public";
+  }
   // No proxy headers — classify by peer address, failing closed when unknown.
   return isLoopbackPeer(peerAddr) ? "loopback" : "public";
 }

package/src/jwt-sign.ts

@@ -55,9 +55,20 @@ export interface SignAccessTokenOpts {
   clientId: string;
   /**
    * Hub origin — sets the `iss` claim. Required: every consumer (vault,
-   * scribe, channel) validates `iss` against `PARACHUTE_HUB_ORIGIN`, and a
-   * missing claim is rejected. Callers derive this via `deriveHubOrigin()`
-   * or thread it from `OAuthDeps.issuer`.
+   * scribe, agent) validates `iss`, and a missing claim is rejected. Callers
+   * derive this via `deriveHubOrigin()` or thread it from `OAuthDeps.issuer`
+   * (the per-request origin from `resolveIssuer`).
+   *
+   * Multi-origin iss-set (onboarding-streamline 2026-06-25): consumers no
+   * longer pin `iss` to a SINGLE `PARACHUTE_HUB_ORIGIN`. The hub publishes the
+   * SET of origins it legitimately answers on via `PARACHUTE_HUB_ORIGINS`
+   * (`buildHubBoundOrigins` — issuer ∪ loopback ∪ expose-state ∪ platform),
+   * and a scope-guard ≥0.5.0 consumer accepts `iss` ∈ that set. So a token
+   * minted here with one URL of a multi-URL box validates when the resource is
+   * reached via another URL of the SAME box. Mint stays per-request as-is: the
+   * canonical configured origin (the intended Caddy/zero-SSH deploy) is minted
+   * on every request AND is a member of the published set, so mint and validate
+   * already align — no clamp needed here.
    */
   issuer: string;
   /**

package/src/setup-wizard.ts

@@ -60,6 +60,7 @@ import {
   SETUP_EXPOSE_MODES,
   type SetupExposeMode,
   deleteSetting,
+  getHubOrigin,
   getSetting,
   isSetupExposeMode,
   openFirstClientAutoApproveWindow,
@@ -89,6 +90,7 @@ import {
 } from "./sessions.ts";
 import type { Supervisor } from "./supervisor.ts";
 import { createUser, userCount } from "./users.ts";
+import { sanitizePublicOrigin } from "./vault-hub-origin-env.ts";
 import { DEFAULT_VAULT_NAME, validateVaultName } from "./vault-name.ts";
 
 // --- shared chrome --------------------------------------------------------
@@ -352,6 +354,24 @@ export function deriveWizardState(deps: {
       setSetting(deps.db, "setup_expose_mode", seeded);
     }
   }
+  // hub Caddy-direct case: a reverse-proxy box (`parachute init --hub-origin
+  // https://<host>`, or `parachute hub set-origin`) persists a real public
+  // origin to `hub_settings.hub_origin` (also honored from PARACHUTE_HUB_ORIGIN).
+  // That origin already answers "how is this hub reached?" — Caddy/Let's-Encrypt
+  // fronts the loopback hub, no `parachute expose` and no Render/Fly env var.
+  // Auto-seed `setup_expose_mode = "public"` so the wizard skips the expose step
+  // exactly as the Render/Fly + live-tailscale branches do. `sanitizePublicOrigin`
+  // (the SAME guard `resolveIssuer`/`exposeIssuerOrigin` use) requires an absolute
+  // http(s) URL and REJECTS loopback/0.0.0.0 — so a laptop/loopback/unset origin
+  // returns undefined and the expose step still renders (the operator chooses).
+  if (getSetting(deps.db, "setup_expose_mode") === undefined) {
+    const configured =
+      sanitizePublicOrigin(getHubOrigin(deps.db) ?? undefined) ??
+      sanitizePublicOrigin(deps.env?.PARACHUTE_HUB_ORIGIN ?? process.env.PARACHUTE_HUB_ORIGIN);
+    if (configured !== undefined) {
+      setSetting(deps.db, "setup_expose_mode", "public");
+    }
+  }
   const hasExposeMode = getSetting(deps.db, "setup_expose_mode") !== undefined;
   let step: WizardStep;
   // Note: `"account"` is a visual-only step in the progress header —

package/src/vault-hub-origin-env.ts

@@ -29,7 +29,10 @@
 import { join } from "node:path";
 import { parseEnvFile, removeEnvLine, upsertEnvLine, writeEnvFile } from "./env-file.ts";
 import { EXPOSE_STATE_PATH, readExposeState } from "./expose-state.ts";
-import { HUB_ORIGIN_ENV } from "./hub-origin.ts";
+import { readHubPort } from "./hub-control.ts";
+import { HUB_ORIGINS_ENV, HUB_ORIGIN_ENV, serializeHubOrigins } from "./hub-origin.ts";
+import { HUB_UNIT_DEFAULT_PORT } from "./hub-unit.ts";
+import { buildHubBoundOrigins } from "./origin-check.ts";
 
 /**
  * Loopback origins (`http://127.0.0.1:<port>`, `localhost`, `[::1]`) are the
@@ -91,11 +94,80 @@ function vaultEnvPath(configDir: string): string {
   return join(configDir, "vault", ".env");
 }
 
+/**
+ * Compose `https://${FLY_APP_NAME}.fly.dev` when FLY_APP_NAME is a plausible
+ * Fly app slug (no slashes — Fly slugs don't contain them). Mirrors the
+ * private helper in operator-token.ts / hub-server.ts; kept local so the
+ * origin-SET assembly here doesn't reach across modules for a 3-line guard.
+ */
+function flyDefaultOriginFromEnv(env: NodeJS.ProcessEnv): string | undefined {
+  const app = env.FLY_APP_NAME;
+  if (typeof app !== "string" || app.length === 0 || app.includes("/")) return undefined;
+  return `https://${app}.fly.dev`;
+}
+
+/**
+ * Assemble the comma-separated `PARACHUTE_HUB_ORIGINS` value the hub injects
+ * into supervised resource servers (multi-origin iss-set). The SET is the
+ * hub's own legitimate origins — the env-injection sibling of the operator
+ * token's `buildKnownIssuersForOperatorToken` and the per-request
+ * `buildHubBoundOrigins` call in hub-server.ts. Inputs:
+ *
+ *   - `issuer` — the canonical hub origin the child also receives as the
+ *     single `PARACHUTE_HUB_ORIGIN` (the seed; always included).
+ *   - loopback aliases — `http://127.0.0.1:<port>` ∪ `http://localhost:<port>`
+ *     for the hub's port (`readHubPort(configDir) ?? HUB_UNIT_DEFAULT_PORT`).
+ *   - the expose-state public origin — `expose-state.json`'s `hubOrigin`.
+ *   - the platform/env public origin — `RENDER_EXTERNAL_URL` ∪ the composed
+ *     Fly default (container deploys where the public origin comes from the
+ *     platform, not expose-state).
+ *
+ * SECURITY INVARIANT: every input is hub/operator-controlled config or
+ * on-disk state — NEVER an unvalidated request `Host` / `X-Forwarded-Host`.
+ * The accepted-`iss` widening this enables is safe only because the resource
+ * server verifies the JWKS signature first; this set is the belt-and-
+ * suspenders allowlist layered on top.
+ *
+ * Returns `undefined` when the seed issuer is absent AND nothing else resolves
+ * (caller skips the env var so the child keeps single-origin behavior).
+ */
+export function buildHubOriginsEnvValue(
+  configDir: string,
+  issuer: string | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+  exposeStatePath: string = EXPOSE_STATE_PATH,
+): string | undefined {
+  const loopbackPort = readHubPort(configDir) ?? HUB_UNIT_DEFAULT_PORT;
+  let exposeHubOrigin: string | undefined;
+  try {
+    exposeHubOrigin = readExposeState(exposeStatePath)?.hubOrigin;
+  } catch {
+    // A malformed expose-state.json must never block a module spawn — the seed
+    // issuer + loopback aliases already cover legitimate access.
+    exposeHubOrigin = undefined;
+  }
+  const platformOrigin = env.RENDER_EXTERNAL_URL ?? flyDefaultOriginFromEnv(env);
+  const origins = buildHubBoundOrigins({
+    // buildHubBoundOrigins requires `issuer`; pass "" when absent (it's dropped
+    // by the URL parse) so the loopback aliases still seed the set.
+    issuer: issuer ?? "",
+    loopbackPort,
+    ...(exposeHubOrigin !== undefined ? { exposeHubOrigin } : {}),
+    ...(platformOrigin !== undefined ? { platformOrigin } : {}),
+  });
+  return serializeHubOrigins(origins);
+}
+
 /**
  * Upsert `PARACHUTE_HUB_ORIGIN=<origin>` into `vault/.env` when `origin` is a
- * non-loopback public origin. Idempotent — skips the write (and the log) when
- * the value is already current so repeated `start`s don't churn the file.
- * Returns true iff the file was written this call.
+ * non-loopback public origin, AND the `PARACHUTE_HUB_ORIGINS` set (the
+ * multi-origin iss-set: origin ∪ loopback aliases ∪ expose-state ∪ platform)
+ * so the daemon-boot path validates `iss` against every URL the box answers on
+ * (a Caddy-fronted box reached via loopback + sslip.io + a custom domain at
+ * once). The set is assembled from hub-controlled inputs only (see
+ * `buildHubOriginsEnvValue`'s security invariant). Idempotent — skips the
+ * write (and the log) when BOTH values are already current so repeated
+ * `start`s don't churn the file. Returns true iff the file was written.
  */
 export function persistVaultHubOrigin(
   configDir: string,
@@ -105,26 +177,47 @@ export function persistVaultHubOrigin(
   if (isLoopbackOrigin(origin)) return false;
   const path = vaultEnvPath(configDir);
   const parsed = parseEnvFile(path);
-  if (parsed.values[HUB_ORIGIN_ENV] === origin) return false;
-  writeEnvFile(path, upsertEnvLine(parsed.lines, HUB_ORIGIN_ENV, origin));
-  log(`  persisted ${HUB_ORIGIN_ENV}=${origin} to ${path} (survives daemon restart)`);
+  const originsValue = buildHubOriginsEnvValue(configDir, origin);
+  const originCurrent = parsed.values[HUB_ORIGIN_ENV] === origin;
+  const originsCurrent =
+    originsValue === undefined || parsed.values[HUB_ORIGINS_ENV] === originsValue;
+  if (originCurrent && originsCurrent) return false;
+  let lines = parsed.lines;
+  if (!originCurrent) lines = upsertEnvLine(lines, HUB_ORIGIN_ENV, origin);
+  if (!originsCurrent && originsValue !== undefined) {
+    lines = upsertEnvLine(lines, HUB_ORIGINS_ENV, originsValue);
+  }
+  writeEnvFile(path, lines);
+  if (!originCurrent) {
+    log(`  persisted ${HUB_ORIGIN_ENV}=${origin} to ${path} (survives daemon restart)`);
+  }
+  if (!originsCurrent && originsValue !== undefined) {
+    log(`  persisted ${HUB_ORIGINS_ENV}=${originsValue} to ${path} (multi-origin iss-set)`);
+  }
   return true;
 }
 
 /**
- * Drop a previously-persisted `PARACHUTE_HUB_ORIGIN` from `vault/.env`. Called
- * on `expose … off`: once exposure is torn down, a local-only hub mints tokens
- * with a loopback `iss`, so a stale public origin left in `.env` would itself
- * cause the mismatch. Removing the line reverts vault to its loopback default
- * (`getHubOrigin`), which matches what the local hub now stamps. No-op (returns
- * false) when the key isn't present. Returns true iff the file was rewritten.
+ * Drop a previously-persisted `PARACHUTE_HUB_ORIGIN` (and `PARACHUTE_HUB_ORIGINS`)
+ * from `vault/.env`. Called on `expose … off`: once exposure is torn down, a
+ * local-only hub mints tokens with a loopback `iss`, so a stale public origin
+ * left in `.env` would itself cause the mismatch. Removing the lines reverts
+ * vault to its loopback default (`getHubOrigin`), which matches what the local
+ * hub now stamps. No-op (returns false) when neither key is present. Returns
+ * true iff the file was rewritten.
  */
 export function clearVaultHubOrigin(configDir: string, log: (line: string) => void): boolean {
   const path = vaultEnvPath(configDir);
   const parsed = parseEnvFile(path);
-  if (parsed.values[HUB_ORIGIN_ENV] === undefined) return false;
-  writeEnvFile(path, removeEnvLine(parsed.lines, HUB_ORIGIN_ENV));
-  log(`  cleared ${HUB_ORIGIN_ENV} from ${path} (exposure torn down)`);
+  const hadOrigin = parsed.values[HUB_ORIGIN_ENV] !== undefined;
+  const hadOrigins = parsed.values[HUB_ORIGINS_ENV] !== undefined;
+  if (!hadOrigin && !hadOrigins) return false;
+  let lines = parsed.lines;
+  if (hadOrigin) lines = removeEnvLine(lines, HUB_ORIGIN_ENV);
+  if (hadOrigins) lines = removeEnvLine(lines, HUB_ORIGINS_ENV);
+  writeEnvFile(path, lines);
+  if (hadOrigin) log(`  cleared ${HUB_ORIGIN_ENV} from ${path} (exposure torn down)`);
+  if (hadOrigins) log(`  cleared ${HUB_ORIGINS_ENV} from ${path} (exposure torn down)`);
   return true;
 }