claude-code-workflow 6.3.18 → 6.3.19

package/ccw/src/core/auth/csrf-middleware.ts

@@ -0,0 +1,159 @@
+import type http from 'http';
+import type { IncomingMessage, ServerResponse } from 'http';
+import { randomBytes } from 'crypto';
+import { getCsrfTokenManager } from './csrf-manager.js';
+
+export interface CsrfMiddlewareContext {
+  pathname: string;
+  req: IncomingMessage;
+  res: ServerResponse;
+}
+
+function getHeaderValue(header: string | string[] | undefined): string | null {
+  if (!header) return null;
+  if (Array.isArray(header)) return header[0] ?? null;
+  return header;
+}
+
+function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string> {
+  if (!cookieHeader) return {};
+
+  const cookies: Record<string, string> = {};
+  for (const part of cookieHeader.split(';')) {
+    const [rawName, ...rawValueParts] = part.trim().split('=');
+    if (!rawName) continue;
+    const rawValue = rawValueParts.join('=');
+    try {
+      cookies[rawName] = decodeURIComponent(rawValue);
+    } catch {
+      cookies[rawName] = rawValue;
+    }
+  }
+  return cookies;
+}
+
+function appendSetCookie(res: ServerResponse, cookie: string): void {
+  const existing = res.getHeader('Set-Cookie');
+  if (!existing) {
+    res.setHeader('Set-Cookie', cookie);
+    return;
+  }
+
+  if (Array.isArray(existing)) {
+    res.setHeader('Set-Cookie', [...existing, cookie]);
+    return;
+  }
+
+  res.setHeader('Set-Cookie', [String(existing), cookie]);
+}
+
+function setCsrfCookie(res: ServerResponse, token: string, maxAgeSeconds: number): void {
+  const attributes = [
+    `XSRF-TOKEN=${encodeURIComponent(token)}`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Strict',
+    `Max-Age=${maxAgeSeconds}`,
+  ];
+  appendSetCookie(res, attributes.join('; '));
+}
+
+function envFlagEnabled(name: string): boolean {
+  const value = process.env[name];
+  if (!value) return false;
+  return ['1', 'true', 'yes', 'on'].includes(value.trim().toLowerCase());
+}
+
+async function readRawBody(req: IncomingMessage): Promise<string> {
+  const withCache = req as http.IncomingMessage & { __ccwRawBody?: string };
+  if (typeof withCache.__ccwRawBody === 'string') return withCache.__ccwRawBody;
+
+  return new Promise((resolve, reject) => {
+    let body = '';
+    req.on('data', (chunk) => {
+      body += chunk.toString();
+    });
+    req.on('end', () => {
+      withCache.__ccwRawBody = body;
+      resolve(body);
+    });
+    req.on('error', reject);
+  });
+}
+
+async function readJsonBody(req: IncomingMessage): Promise<unknown> {
+  const withCache = req as http.IncomingMessage & { body?: unknown };
+  if (withCache.body !== undefined) return withCache.body;
+
+  const raw = await readRawBody(req);
+  if (!raw) return undefined;
+
+  try {
+    const parsed = JSON.parse(raw) as unknown;
+    withCache.body = parsed;
+    return parsed;
+  } catch {
+    return undefined;
+  }
+}
+
+function extractCsrfTokenFromBody(body: unknown): string | null {
+  if (!body || typeof body !== 'object') return null;
+  const record = body as Record<string, unknown>;
+  const token = record.csrfToken;
+  return typeof token === 'string' && token ? token : null;
+}
+
+function writeJson(res: ServerResponse, status: number, body: Record<string, unknown>): void {
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8' });
+  res.end(JSON.stringify(body));
+}
+
+export async function csrfValidation(ctx: CsrfMiddlewareContext): Promise<boolean> {
+  const { pathname, req, res } = ctx;
+
+  if (!pathname.startsWith('/api/')) return true;
+  if (envFlagEnabled('CCW_DISABLE_CSRF')) return true;
+
+  const method = (req.method || 'GET').toUpperCase();
+  if (!['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) return true;
+
+  // Always allow token acquisition routes and webhook endpoints.
+  if (pathname === '/api/auth/token') return true;
+  if (pathname === '/api/hook') return true;
+
+  // Requests authenticated via Authorization header do not require CSRF protection.
+  const authorization = getHeaderValue(req.headers.authorization);
+  if (authorization && /^Bearer\s+.+$/i.test(authorization)) return true;
+
+  const headerToken = getHeaderValue(req.headers['x-csrf-token']);
+  const cookies = parseCookieHeader(getHeaderValue(req.headers.cookie));
+  const cookieToken = cookies['XSRF-TOKEN'];
+
+  let bodyToken: string | null = null;
+  if (!headerToken && !cookieToken) {
+    const body = await readJsonBody(req);
+    bodyToken = extractCsrfTokenFromBody(body);
+  }
+
+  const token = headerToken || bodyToken || cookieToken || null;
+  const sessionId = cookies.ccw_session_id;
+
+  if (!token || !sessionId) {
+    writeJson(res, 403, { error: 'CSRF validation failed' });
+    return false;
+  }
+
+  const tokenManager = getCsrfTokenManager();
+  const ok = tokenManager.validateToken(token, sessionId);
+  if (!ok) {
+    writeJson(res, 403, { error: 'CSRF validation failed' });
+    return false;
+  }
+
+  const nextToken = tokenManager.generateToken(sessionId);
+  res.setHeader('X-CSRF-Token', nextToken);
+  setCsrfCookie(res, nextToken, 15 * 60);
+
+  return true;
+}

package/ccw/src/core/auth/middleware.ts

@@ -0,0 +1,94 @@
+import type http from 'http';
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { TokenManager } from './token-manager.js';
+
+export interface AuthMiddlewareContext {
+  pathname: string;
+  req: IncomingMessage;
+  res: ServerResponse;
+  tokenManager: TokenManager;
+  secretKey: string;
+  unauthenticatedPaths?: Set<string>;
+}
+
+function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string> {
+  if (!cookieHeader) return {};
+
+  const cookies: Record<string, string> = {};
+  for (const part of cookieHeader.split(';')) {
+    const [rawName, ...rawValueParts] = part.trim().split('=');
+    if (!rawName) continue;
+    const rawValue = rawValueParts.join('=');
+    try {
+      cookies[rawName] = decodeURIComponent(rawValue);
+    } catch {
+      cookies[rawName] = rawValue;
+    }
+  }
+  return cookies;
+}
+
+function getHeaderValue(header: string | string[] | undefined): string | null {
+  if (!header) return null;
+  if (Array.isArray(header)) return header[0] ?? null;
+  return header;
+}
+
+export function extractAuthToken(req: IncomingMessage): string | null {
+  const authorization = getHeaderValue(req.headers.authorization);
+  if (authorization) {
+    const match = authorization.match(/^Bearer\s+(.+)$/i);
+    if (match?.[1]) return match[1].trim();
+  }
+
+  const cookies = parseCookieHeader(getHeaderValue(req.headers.cookie));
+  if (cookies.auth_token) return cookies.auth_token;
+
+  return null;
+}
+
+export function isLocalhostRequest(req: IncomingMessage): boolean {
+  const remote = req.socket?.remoteAddress ?? '';
+  return remote === '127.0.0.1' || remote === '::1' || remote === '::ffff:127.0.0.1';
+}
+
+export function setAuthCookie(res: ServerResponse, token: string, expiresAt: Date): void {
+  const maxAgeSeconds = Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1000));
+
+  const attributes = [
+    `auth_token=${encodeURIComponent(token)}`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Strict',
+    `Max-Age=${maxAgeSeconds}`,
+  ];
+
+  res.setHeader('Set-Cookie', attributes.join('; '));
+}
+
+function writeJson(res: ServerResponse, status: number, body: Record<string, unknown>): void {
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8' });
+  res.end(JSON.stringify(body));
+}
+
+export function authMiddleware(ctx: AuthMiddlewareContext): boolean {
+  const { pathname, req, res, tokenManager, secretKey, unauthenticatedPaths } = ctx;
+
+  if (!pathname.startsWith('/api/')) return true;
+  if (unauthenticatedPaths?.has(pathname)) return true;
+
+  const token = extractAuthToken(req);
+  if (!token) {
+    writeJson(res, 401, { error: 'Unauthorized' });
+    return false;
+  }
+
+  const ok = tokenManager.validateToken(token, secretKey);
+  if (!ok) {
+    writeJson(res, 401, { error: 'Unauthorized' });
+    return false;
+  }
+
+  (req as http.IncomingMessage & { authenticated?: boolean }).authenticated = true;
+  return true;
+}

package/ccw/src/core/auth/token-manager.ts

@@ -0,0 +1,219 @@
+import { randomBytes } from 'crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'fs';
+import { dirname, join } from 'path';
+import jwt from 'jsonwebtoken';
+import type { Algorithm } from 'jsonwebtoken';
+import { getCCWHome } from '../../config/storage-paths.js';
+
+export interface TokenResult {
+  token: string;
+  expiresAt: Date;
+}
+
+export interface TokenInfo extends TokenResult {
+  issuedAt: Date;
+  revokedAt?: Date;
+  rotatedAt?: Date;
+  replacedBy?: string;
+}
+
+export interface TokenManagerOptions {
+  authDir?: string;
+  secretKeyPath?: string;
+  tokenPath?: string;
+  tokenTtlMs?: number;
+  rotateBeforeExpiryMs?: number;
+}
+
+const DEFAULT_TOKEN_TTL_MS = 24 * 60 * 60 * 1000;
+const DEFAULT_ROTATE_BEFORE_EXPIRY_MS = 60 * 60 * 1000;
+const JWT_ALGORITHM: Algorithm = 'HS256';
+
+function ensureDirectory(dirPath: string): void {
+  if (!existsSync(dirPath)) {
+    mkdirSync(dirPath, { recursive: true });
+  }
+}
+
+function bestEffortRestrictPermissions(filePath: string, mode: number): void {
+  try {
+    chmodSync(filePath, mode);
+  } catch {
+    // Ignore permission errors (e.g., Windows or restrictive environments)
+  }
+}
+
+function writeSecretFile(filePath: string, content: string): void {
+  ensureDirectory(dirname(filePath));
+  writeFileSync(filePath, content, { encoding: 'utf8', mode: 0o600 });
+  bestEffortRestrictPermissions(filePath, 0o600);
+}
+
+function writeTokenFile(filePath: string, content: string): void {
+  ensureDirectory(dirname(filePath));
+  writeFileSync(filePath, content, { encoding: 'utf8', mode: 0o600 });
+  bestEffortRestrictPermissions(filePath, 0o600);
+}
+
+function parseJwtExpiry(token: string): Date | null {
+  const decoded = jwt.decode(token);
+  if (!decoded || typeof decoded !== 'object') return null;
+  if (typeof decoded.exp !== 'number') return null;
+  return new Date(decoded.exp * 1000);
+}
+
+export class TokenManager {
+  private readonly authDir: string;
+  private readonly secretKeyPath: string;
+  private readonly tokenPath: string;
+  private readonly tokenTtlMs: number;
+  private readonly rotateBeforeExpiryMs: number;
+
+  private secretKey: string | null = null;
+  private readonly activeTokens = new Map<string, TokenInfo>();
+
+  constructor(options: TokenManagerOptions = {}) {
+    this.authDir = options.authDir ?? join(getCCWHome(), 'auth');
+    this.secretKeyPath = options.secretKeyPath ?? join(this.authDir, 'secret.key');
+    this.tokenPath = options.tokenPath ?? join(this.authDir, 'token.jwt');
+    this.tokenTtlMs = options.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
+    this.rotateBeforeExpiryMs = options.rotateBeforeExpiryMs ?? DEFAULT_ROTATE_BEFORE_EXPIRY_MS;
+  }
+
+  getSecretKey(): string {
+    if (this.secretKey) return this.secretKey;
+
+    ensureDirectory(this.authDir);
+    if (existsSync(this.secretKeyPath)) {
+      const loaded = readFileSync(this.secretKeyPath, 'utf8').trim();
+      if (!loaded) {
+        throw new Error('Auth secret key file is empty');
+      }
+      this.secretKey = loaded;
+      return loaded;
+    }
+
+    const generated = randomBytes(32).toString('hex');
+    writeSecretFile(this.secretKeyPath, generated);
+    this.secretKey = generated;
+    return generated;
+  }
+
+  generateToken(secretKey: string): TokenResult {
+    const token = jwt.sign(
+      {
+        typ: 'ccw-api',
+        jti: randomBytes(16).toString('hex'),
+      },
+      secretKey,
+      {
+        algorithm: JWT_ALGORITHM,
+        expiresIn: Math.floor(this.tokenTtlMs / 1000),
+      }
+    );
+
+    const expiresAt = parseJwtExpiry(token) ?? new Date(Date.now() + this.tokenTtlMs);
+    this.activeTokens.set(token, { token, expiresAt, issuedAt: new Date() });
+    return { token, expiresAt };
+  }
+
+  validateToken(token: string, secretKey: string): boolean {
+    const info = this.activeTokens.get(token);
+    if (info?.revokedAt) return false;
+
+    try {
+      jwt.verify(token, secretKey, { algorithms: [JWT_ALGORITHM] });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  refreshToken(token: string, secretKey: string): TokenResult {
+    const existing = this.activeTokens.get(token);
+    if (existing) {
+      existing.revokedAt = new Date();
+    }
+
+    const next = this.generateToken(secretKey);
+    if (existing) {
+      existing.rotatedAt = new Date();
+      existing.replacedBy = next.token;
+    }
+    return next;
+  }
+
+  /**
+   * Read an existing persisted token or create a new one.
+   * If the existing token is nearing expiry, rotate it.
+   */
+  getOrCreateAuthToken(): TokenResult {
+    const secretKey = this.getSecretKey();
+
+    if (existsSync(this.tokenPath)) {
+      const persisted = readFileSync(this.tokenPath, 'utf8').trim();
+      if (persisted && this.validateToken(persisted, secretKey)) {
+        const expiresAt = parseJwtExpiry(persisted);
+        if (expiresAt) {
+          // Ensure persisted token is tracked for revocation support
+          if (!this.activeTokens.has(persisted)) {
+            this.activeTokens.set(persisted, { token: persisted, expiresAt, issuedAt: new Date() });
+          }
+
+          const msUntilExpiry = expiresAt.getTime() - Date.now();
+          if (msUntilExpiry > this.rotateBeforeExpiryMs) {
+            return { token: persisted, expiresAt };
+          }
+        }
+
+        // Token exists but is expiring soon (or expiry missing) → rotate
+        const rotated = this.generateToken(secretKey);
+        writeTokenFile(this.tokenPath, rotated.token);
+
+        const existing = this.activeTokens.get(persisted);
+        if (existing) {
+          existing.rotatedAt = new Date();
+          existing.replacedBy = rotated.token;
+        }
+
+        return rotated;
+      }
+    }
+
+    const created = this.generateToken(secretKey);
+    writeTokenFile(this.tokenPath, created.token);
+    return created;
+  }
+
+  revokeToken(token: string): void {
+    const info = this.activeTokens.get(token);
+    if (info) {
+      info.revokedAt = new Date();
+    } else {
+      this.activeTokens.set(token, {
+        token,
+        issuedAt: new Date(),
+        expiresAt: new Date(0),
+        revokedAt: new Date(),
+      });
+    }
+  }
+}
+
+let tokenManagerInstance: TokenManager | null = null;
+
+export function getTokenManager(options?: TokenManagerOptions): TokenManager {
+  if (!tokenManagerInstance) {
+    tokenManagerInstance = new TokenManager(options);
+  }
+  return tokenManagerInstance;
+}
+
+export function resetTokenManager(): void {
+  tokenManagerInstance = null;
+}
+
+export function getOrCreateAuthToken(): TokenResult {
+  return getTokenManager().getOrCreateAuthToken();
+}
+