@runeya/runeya 2.0.79 → 2.0.81

package/index.js

@@ -279,7 +279,7 @@ async function main() {
   ensureNodeBinOnPath();
   await ensureUserBinsOnPath();
   if (!isPullEnv) stampConsole();
-  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-6PAM4JRF.js");
+  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-J5NMLOGO.js");
   if (isPullEnv) {
     if (!serviceArg) {
       console.error("Error: --service (-s) is required with --pull-env");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.79",
+  "version": "2.0.81",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/{src-6PAM4JRF.js → src-J5NMLOGO.js}

@@ -358,7 +358,10 @@ var apiKeyStore = new ApiKeyStore();
 // ../server/src/trpc/trpc.ts
 function createContext({ req }) {
   return {
-    authorization: req.headers.authorization ?? null
+    authorization: req.headers.authorization ?? null,
+    // L'adresse de la socket, et non `req.ip` : celle-ci ne dépend d'aucun
+    // en-tête, donc d'aucune valeur qu'un appelant distant puisse forger.
+    remoteAddress: req.socket.remoteAddress ?? null
   };
 }
 var t = initTRPC.context().meta().create({
@@ -403,6 +406,12 @@ var authMiddleware = t.middleware(async ({ ctx, next }) => {
   return next({ ctx: { ...ctx, callerType: "app", apiKey: null } });
 });
 var protectedProcedure = t.procedure.use(authMiddleware);
+var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+function requireLoopback(ctx) {
+  if (!ctx.remoteAddress || !LOOPBACK.has(ctx.remoteAddress)) {
+    throw new TRPCError({ code: "FORBIDDEN", message: "This route only answers the local machine." });
+  }
+}
 function requireServiceAction(ctx, serviceId, action) {
   if (ctx.callerType !== "api") return;
   const perm = ctx.apiKey.scopes.services.find((p) => p.serviceId === serviceId);
@@ -583,7 +592,7 @@ function requireDesktop() {
 }
 var appUpdateRouter = router({
   /** De quoi la mise à jour a besoin, et ce que la machine en offre. */
-  prerequisites: protectedProcedure.output(
+  prerequisites: publicProcedure.output(
     z2.object({
       fromDesktop: z2.boolean(),
       nodeVersion: z2.string(),
@@ -592,7 +601,8 @@ var appUpdateRouter = router({
       globalPrefix: z2.string().nullable(),
       ready: z2.boolean()
     })
-  ).query(async () => {
+  ).query(async ({ ctx }) => {
+    requireLoopback(ctx);
     const npmPath = resolveNpm();
     const npmVersion = await probeVersion(npmPath, ["--version"]);
     const globalPrefix = npmVersion ? await probeVersion(npmPath, ["prefix", "-g"]) : null;
@@ -612,13 +622,14 @@ var appUpdateRouter = router({
    * `npm` refuse (droits sur le préfixe, réseau, registre privé), son message
    * est la seule chose qui dit à l'utilisateur quoi faire.
    */
-  install: protectedProcedure.output(
+  install: publicProcedure.output(
     z2.object({
       ok: z2.boolean(),
       output: z2.string(),
       installedVersion: z2.string().nullable()
     })
-  ).mutation(async () => {
+  ).mutation(async ({ ctx }) => {
+    requireLoopback(ctx);
     requireDesktop();
     const npmPath = resolveNpm();
     try {
@@ -643,7 +654,8 @@ var appUpdateRouter = router({
    * quelques instants — le démarrage réessaie déjà sur EADDRINUSE, c'est ce qui
    * rend ce relais possible sans temporisation ici.
    */
-  restart: protectedProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(() => {
+  restart: publicProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(({ ctx }) => {
+    requireLoopback(ctx);
     requireDesktop();
     const child = spawn(process.execPath, process.argv.slice(1), {
       detached: true,
@@ -4611,7 +4623,7 @@ import { networkInterfaces } from "os";
 import { readFile as readFile10, writeFile as writeFile10, rename as rename10, mkdir as mkdir10 } from "fs/promises";
 import { join as join11 } from "path";
 import { z as z10 } from "zod";
-var LOOPBACK = "127.0.0.1";
+var LOOPBACK2 = "127.0.0.1";
 var ANY = "0.0.0.0";
 var NETWORK_FILE = "network.json";
 var NetworkFileSchema = z10.object({
@@ -4707,7 +4719,7 @@ async function rebind(host, previousHost) {
 }
 async function applyPersistedLanMode() {
   if (env.RUNEYA_LAN_PROXY) return;
-  if (env.HOST !== LOOPBACK && env.HOST !== "localhost") return;
+  if (env.HOST !== LOOPBACK2 && env.HOST !== "localhost") return;
   if (!await readPersisted()) return;
   setHost(ANY, true);
   console.log("[server] LAN mode: activ\xE9 par les r\xE9glages \u2014 \xE9coute sur 0.0.0.0");
@@ -4715,7 +4727,7 @@ async function applyPersistedLanMode() {
 async function setLanMode(enabled) {
   await writePersisted(enabled);
   const previousHost = env.HOST;
-  const host = enabled ? ANY : LOOPBACK;
+  const host = enabled ? ANY : LOOPBACK2;
   setHost(host, enabled);
   if (host !== previousHost) await rebind(host, previousHost);
   console.log(`[server] LAN mode: ${enabled ? "activ\xE9" : "d\xE9sactiv\xE9"} \u2014 \xE9coute sur ${host}`);
@@ -18207,4 +18219,4 @@ export {
   pullEnv,
   registerInstance
 };
-//# sourceMappingURL=src-6PAM4JRF.js.map
+//# sourceMappingURL=src-J5NMLOGO.js.map