@totemsdk/omnia-host 0.2.1 → 0.2.2

package/dist/api/jsonrpc.d.ts

@@ -24,6 +24,18 @@ export interface ControlServerOptions {
     isReady?: () => boolean;
     methods?: Map<string, JsonRpcHandler>;
     onConnection?: (socket: WebSocket) => void;
+    /**
+     * Browser Origin allowlist (AUD-009). When set, browser requests whose
+     * `Origin` header is not listed are rejected. Requests with no Origin
+     * (native clients, curl) are always allowed.
+     */
+    allowedOrigins?: string[];
+    /**
+     * When set, control-plane requests must present this bearer token (AUD-009):
+     * `Authorization: Bearer <token>` over HTTP, or a query param / subprotocol
+     * over the WebSocket handshake.
+     */
+    authToken?: string;
 }
 export interface ControlServer {
     listen(): Promise<void>;

package/dist/api/jsonrpc.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createControlServer = createControlServer;
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_http_1 = __importDefault(require("node:http"));
 const ws_1 = require("ws");
 function response(id, result) {
@@ -44,23 +45,95 @@ function sendJson(res, status, body) {
     res.writeHead(status, { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) });
     res.end(payload);
 }
+function pathname(url) {
+    if (!url)
+        return '/';
+    const query = url.indexOf('?');
+    return query === -1 ? url : url.slice(0, query);
+}
+function isOriginAllowed(req, allowedOrigins) {
+    const origin = req.headers.origin;
+    // Native clients (no browser Origin header) are always allowed.
+    if (!origin)
+        return true;
+    // RFC-020 H1: browser requests require an explicit allowlist (default deny).
+    if (!allowedOrigins || allowedOrigins.length === 0)
+        return false;
+    return allowedOrigins.includes(origin);
+}
+function bearerToken(req) {
+    const header = req.headers.authorization;
+    if (typeof header === 'string' && header.startsWith('Bearer '))
+        return header.slice('Bearer '.length);
+    return undefined;
+}
+function handshakeToken(req) {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    const queryToken = url.searchParams.get('token');
+    if (queryToken)
+        return queryToken;
+    const header = req.headers['sec-websocket-protocol'];
+    const raw = Array.isArray(header) ? header.join(',') : header;
+    if (typeof raw === 'string') {
+        for (const part of raw.split(',')) {
+            const protocol = part.trim();
+            if (protocol.startsWith('bearer.'))
+                return protocol.slice('bearer.'.length);
+            if (protocol)
+                return protocol;
+        }
+    }
+    return undefined;
+}
+function safeTokenEqual(provided, expected) {
+    if (provided === undefined)
+        return false;
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length)
+        return false;
+    return node_crypto_1.default.timingSafeEqual(a, b);
+}
 function createControlServer(options) {
+    // RFC-020 H1: a non-loopback bind must be authenticated. Refuse to start a
+    // network-exposed control plane without a token.
+    const isLoopback = options.host === '127.0.0.1' || options.host === '::1' || options.host === 'localhost';
+    if (!isLoopback && (options.authToken === undefined || options.authToken.length === 0)) {
+        throw new Error(`Refusing to bind the control plane to ${options.host} without a control token (OMNIA_CONTROL_TOKEN)`);
+    }
     const methods = options.methods ?? new Map();
     const wsPath = options.wsPath ?? '/rpc';
+    const allowedOrigins = options.allowedOrigins;
+    const authToken = options.authToken;
     const server = node_http_1.default.createServer(async (req, res) => {
-        if (req.method === 'GET' && req.url === '/healthz') {
+        if (req.method === 'GET' && pathname(req.url) === '/healthz') {
             sendJson(res, 200, { ok: true });
             return;
         }
-        if (req.method === 'GET' && req.url === '/readyz') {
+        if (req.method === 'GET' && pathname(req.url) === '/readyz') {
             const ready = options.isReady?.() ?? false;
             sendJson(res, ready ? 200 : 503, { ok: ready });
             return;
         }
-        if (req.method !== 'POST' || req.url !== wsPath) {
+        if (req.method !== 'POST' || pathname(req.url) !== wsPath) {
             sendJson(res, 404, { error: 'Not found' });
             return;
         }
+        if (!isOriginAllowed(req, allowedOrigins)) {
+            sendJson(res, 403, { error: 'Forbidden' });
+            return;
+        }
+        // RFC-020 H1: require application/json — a browser cross-origin `text/plain`
+        // POST (a classic CSRF vector that skips CORS preflight) must be rejected.
+        const contentType = String(req.headers['content-type'] ?? '').toLowerCase();
+        if (!contentType.startsWith('application/json')) {
+            sendJson(res, 415, { error: 'Unsupported Media Type: application/json required' });
+            return;
+        }
+        if (authToken !== undefined && !safeTokenEqual(bearerToken(req), authToken)) {
+            sendJson(res, 403, { error: 'Forbidden' });
+            return;
+        }
         try {
             const request = JSON.parse(await readBody(req));
             sendJson(res, 200, await dispatch(request, methods));
@@ -72,7 +145,15 @@ function createControlServer(options) {
     });
     const webSockets = new ws_1.WebSocketServer({ noServer: true });
     server.on('upgrade', (req, socket, head) => {
-        if (req.url !== wsPath) {
+        if (pathname(req.url) !== wsPath) {
+            socket.destroy();
+            return;
+        }
+        if (!isOriginAllowed(req, allowedOrigins)) {
+            socket.destroy();
+            return;
+        }
+        if (authToken !== undefined && !safeTokenEqual(handshakeToken(req), authToken)) {
             socket.destroy();
             return;
         }

package/dist/config.d.ts

@@ -26,6 +26,16 @@ export interface OmniaHostConfig {
     identityFile?: string;
     /** EdgeServiceManifest serviceType (default "omnia-router"). */
     serviceType: string;
+    /**
+     * Browser Origin allowlist for the control plane (OMNIA_ALLOWED_ORIGINS,
+     * comma-separated). Undefined/empty allows any Origin.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Bearer token required on control-plane requests (OMNIA_CONTROL_TOKEN).
+     * Undefined disables token auth.
+     */
+    controlToken?: string;
 }
 /** Load the daemon configuration from the documented OMNIA_* environment. */
 export declare function loadConfigFromEnv(env?: NodeJS.ProcessEnv): OmniaHostConfig;

package/dist/config.js

@@ -28,6 +28,13 @@ function optionalInteger(value) {
         throw new Error(`OMNIA_LOCAL_ADDRESS_INDEX must be a non-negative integer; received ${value}`);
     return parsed;
 }
+function parseOrigins(value) {
+    const parts = value
+        ?.split(',')
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+    return parts && parts.length > 0 ? parts : undefined;
+}
 function parseSeed(value) {
     const seed = optional(value);
     if (!seed)
@@ -76,5 +83,7 @@ function loadConfigFromEnv(env = process.env) {
         readOnly: env.OMNIA_HOST_READ_ONLY?.trim() === '1',
         identityFile: optional(env.OMNIA_HOST_IDENTITY_FILE),
         serviceType: optional(env.OMNIA_HOST_SERVICE_TYPE) ?? 'omnia-router',
+        allowedOrigins: parseOrigins(env.OMNIA_ALLOWED_ORIGINS),
+        controlToken: optional(env.OMNIA_CONTROL_TOKEN),
     };
 }

package/dist/lifecycle.js

@@ -86,6 +86,8 @@ function createOmniaHost(config, dependencies = {}) {
                     port: config.port,
                     wsPath: config.wsPath,
                     isReady: () => started,
+                    allowedOrigins: config.allowedOrigins,
+                    authToken: config.controlToken,
                     methods: dependencies.methods ?? (0, methods_js_1.createHostMethods)({
                         channels: channelStore,
                         routing: routingProvider,

package/dist/signing.d.ts

@@ -43,13 +43,15 @@ interface KeyfilePayload {
 export declare function encryptSeedForKeyfile(seed: Uint8Array, passphrase: string): KeyfilePayload;
 /**
  * JSON-file-backed StorageAdapter rooted at a directory next to the channel DB.
- * Each key is stored as `<key>.json`; the directory is created on first write.
+ *
+ * Delegates to the hardened shared `FileStore` from `@totemsdk/storage/fs`
+ * (RFC-007): one versioned codec record per key written temp+rename with an
+ * fsync; corrupt records surface as `StorageError` (`corrupt`) rather than
+ * silently returning JSON `null`. The directory is created on first write.
  */
 export declare class JsonFileStorageAdapter implements StorageAdapter {
-    private readonly dir;
+    private readonly store;
     constructor(dir: string);
-    private fileFor;
-    private ensureDir;
     get<T>(key: string): Promise<T | null>;
     set<T>(key: string, value: T): Promise<void>;
     remove(key: string): Promise<boolean>;

package/dist/signing.js

@@ -30,6 +30,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = require("node:crypto");
 const core_1 = require("@totemsdk/core");
+const fs_1 = require("@totemsdk/storage/fs");
 const wots_lease_1 = require("@totemsdk/wots-lease");
 const wots_lease_2 = require("@totemsdk/wots-lease");
 const KEYFILE_SCRYPT_N = 16384;
@@ -115,58 +116,34 @@ function resolveBaseSeed(config) {
 }
 /**
  * JSON-file-backed StorageAdapter rooted at a directory next to the channel DB.
- * Each key is stored as `<key>.json`; the directory is created on first write.
+ *
+ * Delegates to the hardened shared `FileStore` from `@totemsdk/storage/fs`
+ * (RFC-007): one versioned codec record per key written temp+rename with an
+ * fsync; corrupt records surface as `StorageError` (`corrupt`) rather than
+ * silently returning JSON `null`. The directory is created on first write.
  */
 class JsonFileStorageAdapter {
-    dir;
+    store;
     constructor(dir) {
-        this.dir = dir;
-    }
-    fileFor(key) {
-        const safe = key.replace(/[^a-zA-Z0-9_-]/g, '_');
-        return node_path_1.default.join(this.dir, `${safe}.json`);
-    }
-    ensureDir() {
-        node_fs_1.default.mkdirSync(this.dir, { recursive: true });
+        this.store = new fs_1.FileStore(dir);
     }
     async get(key) {
-        const file = this.fileFor(key);
-        if (!node_fs_1.default.existsSync(file))
-            return null;
-        try {
-            return JSON.parse(node_fs_1.default.readFileSync(file, 'utf8'));
-        }
-        catch {
-            return null;
-        }
+        return this.store.get(key);
     }
     async set(key, value) {
-        this.ensureDir();
-        node_fs_1.default.writeFileSync(this.fileFor(key), JSON.stringify(value));
+        return this.store.set(key, value);
     }
     async remove(key) {
-        const file = this.fileFor(key);
-        if (!node_fs_1.default.existsSync(file))
-            return false;
-        node_fs_1.default.unlinkSync(file);
-        return true;
+        return this.store.remove(key);
     }
     async clear() {
-        if (!node_fs_1.default.existsSync(this.dir))
-            return;
-        for (const entry of node_fs_1.default.readdirSync(this.dir)) {
-            node_fs_1.default.unlinkSync(node_path_1.default.join(this.dir, entry));
-        }
+        return this.store.clear();
     }
     async keys() {
-        if (!node_fs_1.default.existsSync(this.dir))
-            return [];
-        return node_fs_1.default.readdirSync(this.dir)
-            .filter((name) => name.endsWith('.json'))
-            .map((name) => name.slice(0, -'.json'.length));
+        return this.store.keys();
     }
     async has(key) {
-        return node_fs_1.default.existsSync(this.fileFor(key));
+        return this.store.has(key);
     }
 }
 exports.JsonFileStorageAdapter = JsonFileStorageAdapter;
@@ -200,14 +177,22 @@ function createHostSigning(config) {
     const kp = (0, core_1.wotsKeypairFromSeed)(perAddressSeed, 0);
     const publicKeyDigest = `0x${(0, core_1.bytesToHex)(kp.pk)}`;
     const address = (0, core_1.wotsAddressFromKeypair)(kp);
+    const storage = new JsonFileStorageAdapter(leaseStorageDir(config.dbPath));
+    const leaseProvider = new wots_lease_1.LocalLeaseProvider(storage, undefined, deviceId);
     const signer = {
         publicKeyDigest,
-        async sign(payload, _indices) {
-            return (0, core_1.wotsSign)(perAddressSeed, 0, payload);
+        async sign(payload, indices) {
+            // RFC-020 C1: honor the reserved leaf instead of hardcoding index 0. The
+            // reservation must belong to this signer's address; the leaf within the
+            // per-address seed is (l1*64 + l2). Callers must supply the pk digest for
+            // the leaf they reserved (the default reservation is leaf (0,0)).
+            if (indices.addressIndex !== addressIndex) {
+                throw new Error(`omnia-host signer address ${addressIndex} cannot sign reserved address ${indices.addressIndex}`);
+            }
+            const leafIndex = indices.l1 * 64 + indices.l2;
+            return (0, core_1.wotsSign)(perAddressSeed, leafIndex, payload);
         },
     };
-    const storage = new JsonFileStorageAdapter(leaseStorageDir(config.dbPath));
-    const leaseProvider = new wots_lease_1.LocalLeaseProvider(storage, undefined, deviceId);
     return {
         signer,
         leaseProvider,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totemsdk/omnia-host",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Durable Omnia node daemon for channel lifecycle, routing, and control APIs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -22,17 +22,18 @@
   "dependencies": {
     "better-sqlite3": "^12.2.0",
     "ws": "^8.21.1",
-    "@totemsdk/core": "^1.2.9",
-    "@totemsdk/identity": "^1.0.0",
+    "@totemsdk/chain-provider": "^0.2.1",
+    "@totemsdk/core": "^1.2.11",
+    "@totemsdk/identity": "^1.0.1",
     "@totemsdk/manifest": "^1.0.0",
-    "@totemsdk/chain-provider": "^0.2.0",
-    "@totemsdk/omnia": "^1.0.1",
-    "@totemsdk/omnia-factory": "^0.2.0",
-    "@totemsdk/omnia-router": "^0.2.0",
-    "@totemsdk/omnia-splice": "^0.2.0",
-    "@totemsdk/minima-rpc": "^0.2.0",
-    "@totemsdk/omnia-vtxo": "^0.2.0",
-    "@totemsdk/wots-lease": "^1.0.0"
+    "@totemsdk/omnia": "^1.0.2",
+    "@totemsdk/omnia-factory": "^0.2.1",
+    "@totemsdk/omnia-splice": "^0.2.1",
+    "@totemsdk/omnia-vtxo": "^0.2.1",
+    "@totemsdk/minima-rpc": "^0.2.2",
+    "@totemsdk/storage": "^0.1.0",
+    "@totemsdk/wots-lease": "^1.0.1",
+    "@totemsdk/omnia-router": "^0.2.1"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
@@ -42,7 +43,7 @@
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "5.9.3",
-    "@totemsdk/txpow": "^1.0.0"
+    "@totemsdk/txpow": "^1.0.2"
   },
   "engines": {
     "node": ">=20.0.0"