@runeya/runeya 2.0.83 → 2.0.85

package/index.js

@@ -279,7 +279,7 @@ async function main() {
   ensureNodeBinOnPath();
   await ensureUserBinsOnPath();
   if (!isPullEnv) stampConsole();
-  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-OHWIFAND.js");
+  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-URY4IL2E.js");
   if (isPullEnv) {
     if (!serviceArg) {
       console.error("Error: --service (-s) is required with --pull-env");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.83",
+  "version": "2.0.85",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/{src-OHWIFAND.js → src-URY4IL2E.js}

@@ -408,9 +408,20 @@ var authMiddleware = t.middleware(async ({ ctx, next }) => {
 });
 var protectedProcedure = t.procedure.use(authMiddleware);
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
-function requireLoopback(ctx) {
-  if (!ctx.remoteAddress || !LOOPBACK.has(ctx.remoteAddress)) {
-    throw new TRPCError({ code: "FORBIDDEN", message: "This route only answers the local machine." });
+async function requireLoopbackOrToken(ctx) {
+  if (ctx.remoteAddress && LOOPBACK.has(ctx.remoteAddress)) return;
+  if (isCiMode()) return;
+  const authorization = ctx.authorization;
+  if (!authorization?.startsWith("Bearer ")) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "This route answers the local machine, or a signed-in app."
+    });
+  }
+  try {
+    await verifyJwt(authorization.slice(7));
+  } catch {
+    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid or expired token" });
   }
 }
 function requireServiceAction(ctx, serviceId, action) {
@@ -603,7 +614,7 @@ var appUpdateRouter = router({
       ready: z2.boolean()
     })
   ).query(async ({ ctx }) => {
-    requireLoopback(ctx);
+    await requireLoopbackOrToken(ctx);
     const npmPath = resolveNpm();
     const npmVersion = await probeVersion(npmPath, ["--version"]);
     const globalPrefix = npmVersion ? await probeVersion(npmPath, ["prefix", "-g"]) : null;
@@ -630,7 +641,7 @@ var appUpdateRouter = router({
       installedVersion: z2.string().nullable()
     })
   ).mutation(async ({ ctx }) => {
-    requireLoopback(ctx);
+    await requireLoopbackOrToken(ctx);
     requireDesktop();
     const npmPath = resolveNpm();
     try {
@@ -655,8 +666,8 @@ var appUpdateRouter = router({
    * quelques instants — le démarrage réessaie déjà sur EADDRINUSE, c'est ce qui
    * rend ce relais possible sans temporisation ici.
    */
-  restart: publicProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(({ ctx }) => {
-    requireLoopback(ctx);
+  restart: publicProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(async ({ ctx }) => {
+    await requireLoopbackOrToken(ctx);
     requireDesktop();
     const child = spawn(process.execPath, process.argv.slice(1), {
       detached: true,
@@ -7702,13 +7713,23 @@ function getDeviceName() {
   const suffix = dir && dir !== ".runeya" ? ` \xB7 ${dir}` : "";
   return `${host}${suffix}`.slice(0, 64);
 }
-function isLocalOrigin(url) {
+function callbackForReturnTo(url) {
+  let parsed;
   try {
-    const { protocol, hostname: hostname2 } = new URL(url);
-    return (protocol === "http:" || protocol === "https:") && (hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "[::1]");
+    parsed = new URL(url);
   } catch {
-    return false;
+    return null;
   }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  const { hostname: hostname2, port } = parsed;
+  if (hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "[::1]") {
+    return `http://127.0.0.1:${env.PORT}/api/cloud/callback`;
+  }
+  if (!env.RUNEYA_LAN_PROXY) return null;
+  const effectivePort = port || (parsed.protocol === "https:" ? "443" : "80");
+  if (effectivePort !== String(env.PORT)) return null;
+  if (!lanIps().includes(hostname2)) return null;
+  return `${parsed.origin}/api/cloud/callback`;
 }
 async function cloudFetch2(path, init = {}) {
   try {
@@ -7727,11 +7748,14 @@ function isAllowedProxyPath(path) {
 var cloudAuthRouter = router({
   /** Build the cloud authorization URL to open in the browser. */
   startLogin: protectedProcedure.input(z16.object({ returnTo: z16.string().url().max(2048) })).mutation(async ({ input }) => {
-    if (!isLocalOrigin(input.returnTo)) {
-      throw new TRPCError11({ code: "BAD_REQUEST", message: "returnTo must be a local origin." });
+    const callback = callbackForReturnTo(input.returnTo);
+    if (!callback) {
+      throw new TRPCError11({
+        code: "BAD_REQUEST",
+        message: env.RUNEYA_LAN_PROXY ? "returnTo must be this machine, on the server port." : "returnTo must be a local origin."
+      });
     }
     const state = cloudSessionStore.createState(input.returnTo);
-    const callback = `http://127.0.0.1:${env.PORT}/api/cloud/callback`;
     const url = `${getCloudAppUrl()}/link-local?callback=${encodeURIComponent(callback)}&state=${encodeURIComponent(state)}`;
     return { url };
   }),
@@ -18253,4 +18277,4 @@ export {
   pullEnv,
   registerInstance
 };
-//# sourceMappingURL=src-OHWIFAND.js.map
+//# sourceMappingURL=src-URY4IL2E.js.map