co-maintainer 0.4.4 → 0.4.6

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "co-maintainer",
-    "version": "0.4.4",
+    "version": "0.4.6",
     "description": "Analyzes a GitHub repository and writes repository-specific contribution guidance.",
     "license": "MIT",
     "repository": {

package/dist/src/cli/commands/serve.d.ts

@@ -4,6 +4,7 @@ import { type Platform } from "../../util/runtime.ts";
 /** `undefined` on Linux, otherwise one line naming the platform (a pure
  * function so it is testable without actually being off Linux). */
 export declare function platformWarning(os: Platform): string | undefined;
+export declare function resolveTrustProxy(args: string[], env?: (name: string) => string | undefined): boolean;
 /** `--password=` replaces the stored password. With no flag the stored one is
  * kept, and a first start generates one, returned so the caller can print it. */
 export declare function ensureDashboardPassword(args: string[], hasStoredPassword: boolean, store: PasswordStore): Promise<string | undefined>;

package/dist/src/cli/commands/serve.js

@@ -27,6 +27,9 @@ function generatePassword() {
     crypto.getRandomValues(bytes);
     return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
+export function resolveTrustProxy(args, env = getEnv) {
+    return args.includes("--trust-proxy") || env("CM_TRUST_PROXY") === "1";
+}
 /** `--password=` replaces the stored password. With no flag the stored one is
  * kept, and a first start generates one, returned so the caller can print it. */
 export async function ensureDashboardPassword(args, hasStoredPassword, store) {
@@ -168,6 +171,10 @@ export async function runServe(args) {
     startRemakeScheduler();
     if (auth.github)
         console.log(`[serve] GitHub sign-in enabled for ${githubOAuth.allowedUser}`);
+    const trustProxy = resolveTrustProxy(args);
+    if (trustProxy) {
+        console.log("[serve] trusting x-forwarded-for and x-forwarded-proto from a reverse proxy");
+    }
     const inject500 = args.includes("--inject-500") || getEnv("CM_INJECT_500") === "1";
     if (inject500) {
         console.log("[serve] --inject-500 is on. Mutating /api requests return 500.");
@@ -177,6 +184,7 @@ export async function runServe(args) {
         passwordStore,
         webhookUrl,
         inject500,
+        trustProxy,
         auth,
         githubOAuth,
     });

package/dist/src/server/app.d.ts

@@ -6,6 +6,9 @@ export type AppDeps = {
     passwordStore?: PasswordStore;
     webhookUrl?: string;
     secureCookie?: boolean;
+    /** Behind a reverse proxy this process trusts, the client address and the
+     * scheme come from `x-forwarded-for` and `x-forwarded-proto`. */
+    trustProxy?: boolean;
     inject500?: boolean;
     /** Defaults to password-only when omitted, matching every caller that
      * pre-dates GitHub sign-in. */

package/dist/src/server/app.js

@@ -4,6 +4,7 @@ import { VERSION } from "../version.js";
 import { errorResponse } from "./errors.js";
 import { hasCsrfHeader, login, logout, readSessionToken, sessionCookieHeader, verifySession, } from "./auth.js";
 import { memoryPasswordStore } from "./auth.js";
+import { clientAddress, forwardedHttps } from "./proxy_headers.js";
 import { readConfig } from "../config.js";
 import { listJobs } from "../store/jobs.js";
 import { handleJobsRoute } from "./api/jobs.js";
@@ -96,8 +97,13 @@ function liveGithubConfig() {
 export function createApp(deps) {
     const passwords = deps.passwordStore ?? memoryPasswordStore(deps.password);
     return {
-        async fetch(request, remoteAddr = "unknown") {
+        async fetch(request, socketAddress = "unknown") {
             const url = new URL(request.url);
+            const remoteAddr = deps.trustProxy
+                ? clientAddress(request, socketAddress)
+                : socketAddress;
+            const secureCookie = Boolean(deps.secureCookie) ||
+                (Boolean(deps.trustProxy) && forwardedHttps(request));
             const { githubApp, webhookSecret } = liveGithubConfig();
             const mutating = ["POST", "PATCH", "PUT", "DELETE"].includes(request.method);
             if (url.pathname === "/api/health" && request.method === "GET") {
@@ -106,7 +112,7 @@ export function createApp(deps) {
             if (url.pathname === "/github/webhook" && request.method === "POST") {
                 return await handleWebhookRequest(request, webhookSecret);
             }
-            const page = await handlePageRequest(request, { ...deps, githubApp, passwordStore: passwords }, remoteAddr);
+            const page = await handlePageRequest(request, { ...deps, githubApp, passwordStore: passwords, secureCookie }, remoteAddr);
             if (page)
                 return page;
             if (url.pathname.startsWith("/api/remote/")) {
@@ -117,7 +123,7 @@ export function createApp(deps) {
                     return errorResponse(403, "csrf", `every mutating request needs the X-Requested-With header`);
                 }
                 if (url.pathname === "/api/login" && request.method === "POST") {
-                    return await handleLogin(request, deps, passwords, remoteAddr);
+                    return await handleLogin(request, { ...deps, secureCookie }, passwords, remoteAddr);
                 }
                 const session = await requireSession(request);
                 if (!session) {

package/dist/src/server/proxy_headers.d.ts

@@ -0,0 +1,4 @@
+/** The rightmost entry is the one the nearest trusted proxy appended, so a
+ * client cannot forge it the way it can the entries to its left. */
+export declare function clientAddress(request: Request, socketAddress: string): string;
+export declare function forwardedHttps(request: Request): boolean;

package/dist/src/server/proxy_headers.js

@@ -0,0 +1,16 @@
+import { isIP } from "node:net";
+/** The rightmost entry is the one the nearest trusted proxy appended, so a
+ * client cannot forge it the way it can the entries to its left. */
+export function clientAddress(request, socketAddress) {
+    const last = request.headers.get("x-forwarded-for")?.split(",").pop()?.trim();
+    return last && isIP(last) ? last : socketAddress;
+}
+export function forwardedHttps(request) {
+    const last = request.headers
+        .get("x-forwarded-proto")
+        ?.split(",")
+        .pop()
+        ?.trim()
+        .toLowerCase();
+    return last === "https";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "co-maintainer",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Analyzes a GitHub repository and writes repository-specific contribution guidance.",
   "license": "MIT",
   "repository": {