@riceawa/dsh-lan-gateway 0.6.2 → 0.7.1

package/src/gateway.ts

@@ -53,6 +53,7 @@ import {
 } from './login.ts'
 import {
   downstreamResponseHeaders,
+  isLoopbackAuthority,
   isOwnedPath,
   loginOriginAllowed,
   pathOf,
@@ -265,6 +266,24 @@ export class LanGateway {
       : classifySource(req.socket.remoteAddress, this.config.lanCidrs)
   }
 
+  /**
+   * Whether a request for the gateway-owned management prefix comes from the
+   * host itself, and may therefore be relayed to the loopback-only config and
+   * password routes.
+   *
+   * Both tests are required and neither is sufficient alone. The socket source
+   * is what a remote client cannot forge; the authority the client named is what
+   * a trusted TLS terminator deployment cannot blur, because there every socket
+   * source is the terminator's own loopback address while the browser still
+   * names the public host it dialed. A local browser that used `127.0.0.1` (or
+   * `localhost`) is the same operator the native route already trusts, and it
+   * still has to clear the session gate and the same-site fence below before
+   * anything is forwarded.
+   */
+  private localManagementRequest(req: http.IncomingMessage, source: SourceClass): boolean {
+    return source === 'loopback' && isLoopbackAuthority(req.headers.host)
+  }
+
   /**
    * The session a request carries, or undefined when it presents none, presents
    * one that no longer verifies under the current epoch, or presents one whose
@@ -323,7 +342,10 @@ export class LanGateway {
     return `${this.config.cookieName}=${value}; ${attributes}${this.config.secureCookies ? '; Secure' : ''}`
   }
 
-  /** Handle one HTTP request: login surface → owned-path refuse → session gate → same-site gate → relay. */
+  /**
+   * Handle one HTTP request: login surface → owned-path gate → session gate →
+   * same-site gate → relay.
+   */
   private async handleHttp(req: http.IncomingMessage, res: http.ServerResponse): Promise<void> {
     const url = req.url ?? '/'
     const pathname = pathOf(url)
@@ -338,10 +360,14 @@ export class LanGateway {
       return
     }
 
-    // The gateway's own management surface never reaches dsh: an unauthenticated
-    // remote request must not be able to touch the loopback-only config route by
-    // having the gateway rewrite Host to loopback for it.
-    if (isOwnedPath(pathname)) {
+    // The gateway's own management surface never reaches dsh from anywhere but
+    // the host itself: an unauthenticated remote request must not be able to
+    // touch the loopback-only config route by having the gateway rewrite Host to
+    // loopback for it. A host-local browser (`localManagementRequest`) is
+    // exempt, so the settings card on the gateway origin behaves like the native
+    // card instead of being refused exactly where the user goes looking for it;
+    // it still has to clear the session and same-site gates below.
+    if (isOwnedPath(pathname) && !this.localManagementRequest(req, source)) {
       res.writeHead(403, this.securityHeaders())
       res.end('forbidden')
       return

package/src/index.ts

@@ -61,10 +61,7 @@ import {
 } from './config-fields.ts'
 import { LanGateway } from './gateway.ts'
 import { readBody } from './login.ts'
-import {
-  isLoopbackHost,
-  READ_ONLY_METHODS,
-} from './request-policy.ts'
+import { isLoopbackHost } from './request-policy.ts'
 import {
   loadState,
   saveState,
@@ -451,8 +448,24 @@ function tlsStatusLine(cfg: Config): string {
  * gateway refuses to relay this prefix, so the only way in is the native
  * loopback listener itself (a genuine local user, or a local process that could
  * already read `~/.dsh`). Host must be loopback (also blocks DNS rebinding),
- * cross-site fetches are refused, an Origin must match the Host the browser
- * used, and a state-changing method must carry that Origin. Exported for tests.
+ * cross-site fetches are refused, and an Origin that *is* attached must match
+ * the Host this request named. These are exactly dsh's own rules for a request
+ * that may reach its API (`isTrustedApiRequest`), Origin-optional included.
+ *
+ * **Why an absent Origin is accepted, on a write too.** The Desktop app answers
+ * its UI from the `dsh-app://app` origin and forwards every non-asset path to
+ * this loopback server through a bridge that strips `host`/`origin`/`cookie`/
+ * `sec-fetch-site` and re-attaches dsh's own host session cookie
+ * (`forwardWebRequest` in `@deepseek-ai/dsh-desktop-host`). A read from that
+ * bridge was always fine; demanding an Origin on a state change made every save
+ * from the Desktop card a 403 — the one place a local operator goes looking for
+ * this setting — while dsh's own routes accept the shape. Nothing is given up:
+ * a non-browser client on this host sets Host *and* Origin freely, so that rule
+ * never fenced it, and a browser cannot suppress the markers that do the work —
+ * a cross-site request carries `sec-fetch-site: cross-site`, or an Origin that
+ * does not name this Host (a cross-origin redirect or a sandboxed frame makes
+ * it the literal `null`, which fails the match just as well), and both stay
+ * refused. Exported for tests.
  */
 export function isTrustedConfigRequest(req: IncomingMessage): boolean {
   const host = req.headers?.host
@@ -467,8 +480,6 @@ export function isTrustedConfigRequest(req: IncomingMessage): boolean {
   if (req.headers?.['sec-fetch-site'] === 'cross-site') return false
   const origin = req.headers?.origin
   if (origin !== undefined && !originMatchesHost(origin, host)) return false
-  const method = req.method ?? 'GET'
-  if (!READ_ONLY_METHODS.has(method) && origin === undefined) return false
   return true
 }
 

package/src/request-policy.ts

@@ -122,6 +122,42 @@ export function isLoopbackHost(hostname: string): boolean {
   )
 }
 
+/**
+ * Whether a `Host` header names a loopback authority (127/8, `localhost`, ::1).
+ *
+ * This is the second half of the gateway's local-management exemption, and it
+ * answers a different question from {@link isLoopbackHost}'s own callers: not
+ * "is this authority loopback" but "did the browser itself use a loopback
+ * address". The two tests are combined on purpose. The socket source is what a
+ * remote client cannot forge; the Host is what a deployment cannot blur — behind
+ * a trusted TLS terminator every socket source is the terminator's loopback
+ * address, so the source test alone would readmit every remote browser, while a
+ * remote browser names the public host it dialed and stays refused.
+ *
+ * A client that can set an arbitrary Host (curl, not a browser) must still pass
+ * the socket-source test and hold a gateway session to reach anything, and the
+ * route behind the prefix is the one the native loopback listener already
+ * answers with no credential at all.
+ * @param host - the `Host` header value, or undefined.
+ * @returns true only when it parses and names a loopback authority.
+ */
+export function isLoopbackAuthority(host: string | undefined): boolean {
+  if (host === undefined || host === '') return false
+  let url: URL
+  try {
+    url = new URL(`http://${host}`)
+  } catch {
+    return false
+  }
+  // A Host header is nothing but an authority. Anything URL parsing had to read
+  // beyond `host[:port]` — userinfo, a path, a query — means the value is not
+  // one, and `http://evil.com@127.0.0.1` must not read as loopback.
+  if (url.username !== '' || url.password !== '' || url.pathname !== '/' || url.search !== '' || url.hash !== '') {
+    return false
+  }
+  return isLoopbackHost(url.hostname)
+}
+
 /** Whether this source must present a gateway session (default: everyone). */
 export function requiresLogin(source: SourceClass, lanPasswordless: boolean): boolean {
   return !(lanPasswordless && source !== 'internet')