@tea-agent/loop-agent 0.39.2 → 0.40.0-beta.1

package/dist/worker/console/security.js

@@ -119,12 +119,12 @@ function safeEqualToken(a, b) {
 function loopbackOriginMatches(origin, consoleOrigin) {
     if (origin === consoleOrigin)
         return true;
-    const parseLoopback = (value) => {
+    const parseLoopbackPort = (value) => {
         const match = /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i.exec(value);
-        return match ? `${match[1].toLowerCase()}${match[2] ?? ""}` : null;
+        return match ? (match[2] ?? ":80") : null;
     };
-    const originKey = parseLoopback(origin);
-    const consoleKey = parseLoopback(consoleOrigin);
+    const originKey = parseLoopbackPort(origin);
+    const consoleKey = parseLoopbackPort(consoleOrigin);
     return originKey !== null && consoleKey !== null && originKey === consoleKey;
 }
 export function evaluateMutationGate(req, ctx) {
@@ -218,6 +218,41 @@ export function evaluateMutationGate(req, ctx) {
     }
     return undefined;
 }
+/**
+ * Authorize a browser-initiated download without weakening the mutation gate.
+ * Same-origin GET requests do not reliably carry Origin, so Referer is the
+ * required source proof when Origin is absent. Capability, confirmation, Host,
+ * and Fetch Metadata checks remain identical to mutations.
+ */
+export function evaluateProtectedDownloadGate(req, ctx) {
+    const origin = req.headers.origin;
+    if (typeof origin === "string" && origin.length > 0) {
+        return evaluateMutationGate(req, ctx);
+    }
+    const referer = req.headers.referer;
+    let refererOrigin = "";
+    if (typeof referer === "string" && referer.length > 0) {
+        try {
+            refererOrigin = new URL(referer).origin;
+        }
+        catch {
+            // Keep the synthesized Origin empty so the normal gate fails closed.
+        }
+    }
+    const requestWithSource = Object.create(req);
+    requestWithSource.headers = {
+        ...req.headers,
+        origin: refererOrigin,
+    };
+    const failure = evaluateMutationGate(requestWithSource, ctx);
+    if (failure?.code === "origin-mismatch") {
+        return {
+            ...failure,
+            message: "Referer does not match Console origin",
+        };
+    }
+    return failure;
+}
 export function isMutationMethod(method) {
     const m = (method ?? "GET").toUpperCase();
     return m === "POST" || m === "PUT" || m === "PATCH" || m === "DELETE";