@procedures/http 0.28.0 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # @procedures/http
 
+## 0.29.0
+
+### Minor Changes
+
+- fa26063: The default modules refuse a loopback, private or link-local host through the host policy (audit pass 2, roadmap O55, findings 12 and 32, decision D35).
+  
+  MINOR: a break. Before, `weather.forecast` and the `mcpHostModules` of `geo` and `ics` sent a request to such a host with the global `fetch`. Version 0.28 gave a `DeprecationWarning` for it. Now the request gets `FORBIDDEN` with the reason `host-not-allowed`, and the host gets no request.
+  
+  - `weather.forecast` of the default `weatherModule` refuses a `baseUrl` on a loopback, private or link-local address. The warning `PROCEDURES_WEATHER_PRIVATE_HOST` goes away.
+  - The `mcpHostModules` of `@procedures/bundle-assistant` refuse such a `baseUrl` of `geo.geocode` and `geo.route`, and such a feed of `ics.fetch`. The warnings `PROCEDURES_GEO_PRIVATE_HOST` and `PROCEDURES_ICS_PRIVATE_HOST` go away. The dev-tools server uses these modules.
+  - `createHostFetch()` of `@procedures/http` loses the deprecated option `warnOnRefusal`. A refused host always throws.
+  - The default modules of `geo` and `ics` do not change. They keep the global `fetch`, because their roots run in a browser.
+  
+  Migration:
+  
+  - A host that sends `weather.forecast` to its own Open-Meteo server on such an address gives a `fetch` that allows it: `createRegistry(createWeatherModule({ fetch: createHostFetch({ allow: ["10.0.0.5:8080"] }) }))`.
+  - A host with a private Nominatim, OSRM or calendar server gives `createGeoModule({ fetch: createHostFetch({ allow: [...] }) })` or `createIcsModule({ fetch: createHostFetch({ allow: [...] }) })` to `createRegistry()` before the bundle.
+  - A host that gave `warnOnRefusal` to `createHostFetch()` removes it, and puts the host in `allow`.
+  - The site: no change. It does not call `weather.forecast`, `geo.*` or `ics.fetch` through a registry of Node.
+  - MiniMongo and Graph: no change. They do not use these procedures.
+  - jarvis: no change. `packages/pipeline` calls the function `geocode()` of `@procedures/geo`, not the procedure, so the host policy does not apply.
+
+### Patch Changes
+
+- @procedures/client@0.29.0
+
+## 0.28.1
+
+### Patch Changes
+
+- 21dc858: Fixes for the security findings of the second code audit (roadmap O55).
+  
+  PATCH: bug fixes and additive options. Each fix refuses only an input that the documentation does not give. A caller that uses the documented behavior sees no change. A request to a loopback, private or link-local host still works, with a deprecation notice. Version 0.29.0 refuses it (decision D35).
+  
+  - `procedure.delete` and `procedure.define` of `@procedures/client` obey the expose rule of the host, as `procedure.get` does (R17). `procedure.delete` does not find a hidden procedure, and `procedure.define` refuses to replace one with `NOT_EXPOSED`. A new procedure at a free path stays possible, as before. Before, a caller could remove or replace a hidden procedure that the host defined.
+  - The task store of `@procedures/mcp-server` keeps a task without a session (stdio, an SDK transport) apart from the HTTP sessions, both ways. Before, each HTTP session could list, read and cancel such a task.
+  - `restic.run` of `@procedures/restic` refuses each input that lets the caller choose a program for restic to start: `--from-password-command`, `--password-command2`, an extended option that sets `sftp.command`, `sftp.args`, `rclone.program` or `rclone.args` (each spelling), an sftp or rclone repository whose host or remote starts with `-`, and a positional argument that starts with `-` after a last flag without a value. Before, only `--password-command` was refused.
+  - `@procedures/http` exports `createHostFetch(options)`: a `fetch` for GET requests through the host policy, with the options of `createHttpModule()`. It also exports `httpSettings(options)`. The deprecated option `warnOnRefusal` keeps a refused host working: the process gets one `DeprecationWarning`, and the request goes through the global `fetch`.
+  - `weather.forecast` of `@procedures/weather` sends its request through `createHostFetch()` with `warnOnRefusal`. A `baseUrl` on a loopback, private or link-local address still works, with the warning `PROCEDURES_WEATHER_PRIVATE_HOST`. `createWeatherModule({ fetch })` gives another `fetch`, for a server of the host on such an address.
+  - `@procedures/geo` and `@procedures/ics` add `createGeoModule({ fetch })` and `createIcsModule({ fetch })`. Their default stays the global `fetch`, because their roots run in a browser. A refusal of the host policy keeps its code and its reason. The refusal of `ics.fetch` does not name the feed address.
+  - `@procedures/bundle-assistant` exports `mcpHostModules`: the modules of `geo` and `ics` with `createHostFetch()` and `warnOnRefusal`. A refused host gets the warning `PROCEDURES_GEO_PRIVATE_HOST` or `PROCEDURES_ICS_PRIVATE_HOST`. The bundle keeps the default modules, so `mark` and the site load it next to `geo` and `ics` as before.
+  - The dev-tools server of `@procedures/mcp-dev-tools` gives the `mcpHostModules` of each bundle to `createRegistry()` before the bundles. In one call, the first module of a name counts. Thus `geo.geocode`, `geo.route`, `weather.forecast` and `ics.fetch` of the dev-tools server go through the default host policy.
+  
+  A host that sends `weather.forecast`, or the bundle's `geo` tools, to a server on a private address can remove the warning now. It gives a `fetch` that allows the server: `createWeatherModule({ fetch: createHostFetch({ allow: ["10.0.0.5:8080"] }) })`. This `fetch` refuses each other private host now, as 0.29.0 does by default.
+- Updated dependencies [345c740]
+- Updated dependencies [984c13b]
+- Updated dependencies [21dc858]
+  - @procedures/client@0.28.1
+
 ## 0.28.0
 
 ### Patch Changes

package/README.md

@@ -90,6 +90,23 @@ const registry = createRegistry(createHttpModule({ allow: ["localhost:11434", "1
 - A bad entry of `allow` makes `createHttpModule()` throw.
 - A host gives `createHttpModule()` to `createRegistry()` before its bundles. Then it replaces the `httpModule` in the modules of a bundle.
 
+### The host policy in other packages
+
+`createHostFetch(options)` gives a `fetch` for GET requests through the same checks. Its options are the options of `createHttpModule()`. A procedure of another package uses it for a URL of its caller:
+
+- `weather.forecast` uses it by default.
+- `createGeoModule({ fetch })` and `createIcsModule({ fetch })` take it. Their default stays the global `fetch`, because their roots run in a browser.
+- `mcpHostModules` of `@procedures/bundle-assistant` gives it to the modules of `geo` and `ics`. The dev-tools server puts them before its bundles.
+
+```ts
+import { createHostFetch } from "@procedures/http";
+import { createGeoModule } from "@procedures/geo/module";
+
+const registry = createRegistry(createGeoModule({ fetch: createHostFetch({ allow: ["osrm.lan:5000"] }) }));
+```
+
+A refusal is `FORBIDDEN` with the reason `host-not-allowed`. When the signal of the caller aborts, the function throws the reason of the signal, as `fetch` does.
+
 ## Limits and time
 
 - Each input of `http.request` and `http.json` has `timeoutMs`. The default is 30 seconds.