crewly 1.20.406 → 1.20.408

package/dist/cli/backend/src/middleware/agent-origin-correction.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Process-tree corrections of a request's agent identity, kept out of band.
+ *
+ * The agent-origin middleware proves from `X-Agent-Pid` which agent PTY a
+ * skill shell really runs under. When that contradicts the identity the
+ * shell claimed, it records the correction here. The caller-identity
+ * middleware (#999) reads it to override a leaked agent badge. A header
+ * would not do: a client could send it itself.
+ *
+ * @module middleware/agent-origin-correction
+ */
+/** The shell claimed `claimed`; its process runs under `actual`. */
+export interface AgentOriginCorrection {
+    claimed: string;
+    actual: string;
+}
+/**
+ * Record a correction for a request.
+ *
+ * @param req - Request object
+ * @param correction - Claimed and actual sessions
+ */
+export declare function setAgentOriginCorrection(req: object, correction: AgentOriginCorrection): void;
+/**
+ * The correction recorded for a request, if any.
+ *
+ * @param req - Request object
+ * @returns The correction or undefined
+ */
+export declare function getAgentOriginCorrection(req: object): AgentOriginCorrection | undefined;
+//# sourceMappingURL=agent-origin-correction.d.ts.map

package/dist/cli/backend/src/middleware/agent-origin-correction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-origin-correction.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin-correction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CACf;AAID;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEvF"}

package/dist/cli/backend/src/middleware/agent-origin-correction.js

@@ -0,0 +1,31 @@
+/**
+ * Process-tree corrections of a request's agent identity, kept out of band.
+ *
+ * The agent-origin middleware proves from `X-Agent-Pid` which agent PTY a
+ * skill shell really runs under. When that contradicts the identity the
+ * shell claimed, it records the correction here. The caller-identity
+ * middleware (#999) reads it to override a leaked agent badge. A header
+ * would not do: a client could send it itself.
+ *
+ * @module middleware/agent-origin-correction
+ */
+const corrections = new WeakMap();
+/**
+ * Record a correction for a request.
+ *
+ * @param req - Request object
+ * @param correction - Claimed and actual sessions
+ */
+export function setAgentOriginCorrection(req, correction) {
+    corrections.set(req, correction);
+}
+/**
+ * The correction recorded for a request, if any.
+ *
+ * @param req - Request object
+ * @returns The correction or undefined
+ */
+export function getAgentOriginCorrection(req) {
+    return corrections.get(req);
+}
+//# sourceMappingURL=agent-origin-correction.js.map

package/dist/cli/backend/src/middleware/agent-origin-correction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-origin-correction.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin-correction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,GAAG,IAAI,OAAO,EAAiC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,UAAiC;IACtF,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IACnD,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cli/backend/src/middleware/api-token.middleware.d.ts

@@ -0,0 +1,171 @@
+/**
+ * API token middleware.
+ *
+ * Gates `/api/*`, Socket.IO and raw WebSocket upgrades behind the shared
+ * API token for every caller that is NOT on loopback. Loopback callers
+ * (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) pass without a token — that is
+ * how local skills (`api_call` in `config/skills/_common/lib.sh`) and the
+ * local dashboard work with zero setup.
+ *
+ * The token can be presented as `Authorization: Bearer <token>`,
+ * `X-Crewly-Token: <token>`, a `crewly_token` cookie, or (WebSocket /
+ * dashboard deep link only) a `?token=` query parameter.
+ *
+ * `X-Forwarded-For` is honoured ONLY when `CREWLY_TRUST_PROXY=1`, otherwise
+ * any LAN caller could spoof a loopback origin.
+ *
+ * The existing `require-auth.middleware.ts` (HS256 JWT for chat-v2) is
+ * untouched; this module only re-uses its verifier so that `/ws/chat`
+ * clients holding a valid JWT keep working when `CREWLY_JWT_SECRET` is set.
+ *
+ * @module middleware/api-token
+ */
+import type { Request, Response, NextFunction } from 'express';
+import type { IncomingMessage, Server as HttpServer } from 'http';
+/** Minimal request shape shared by Express requests and raw upgrade requests. */
+export interface AddressableRequest {
+    headers: IncomingMessage['headers'];
+    socket?: {
+        remoteAddress?: string;
+    } | null;
+    url?: string;
+}
+/**
+ * Whether `X-Forwarded-For` should be trusted for loopback classification.
+ *
+ * @returns True when `CREWLY_TRUST_PROXY` is `1` or `true`
+ */
+export declare function isProxyTrusted(): boolean;
+/**
+ * Resolve the address a request originates from.
+ *
+ * @param req - Express request or raw upgrade request
+ * @returns Remote address string, or empty string when unknown
+ */
+export declare function getClientAddress(req: AddressableRequest): string;
+/**
+ * Whether an address is one of the loopback forms Node reports.
+ *
+ * @param address - Remote address
+ * @returns True for `127.0.0.1`, `::1` and `::ffff:127.0.0.1`
+ */
+export declare function isLoopbackAddress(address: string): boolean;
+/**
+ * Whether a request originates from loopback (honouring the proxy rule).
+ *
+ * @param req - Express request or raw upgrade request
+ * @returns True when the caller is local
+ */
+export declare function isLoopbackRequest(req: AddressableRequest): boolean;
+/**
+ * Extract the token a caller presented, if any.
+ *
+ * Order: `Authorization: Bearer`, `X-Crewly-Token`, `crewly_token` cookie,
+ * then (when `allowQuery`) the `?token=` query parameter.
+ *
+ * @param req - Request carrying headers and url
+ * @param allowQuery - Whether to consult the query string (WebSocket handshakes)
+ * @returns Presented token or null
+ */
+export declare function extractPresentedToken(req: AddressableRequest, allowQuery: boolean): string | null;
+/**
+ * The API token a caller presented in a header (`Authorization: Bearer` or
+ * `X-Crewly-Token`) or, failing that, in the `crewly_token` cookie, and which
+ * of the two it was. A cookie is sent by the browser on its own, so a
+ * cookie-borne token alone does not authorise a write (#999).
+ *
+ * @param req - Request carrying headers
+ * @returns Token and source, or null when none was presented
+ */
+export declare function extractPresentedTokenWithSource(req: AddressableRequest): {
+    token: string;
+    source: 'header' | 'cookie';
+} | null;
+/**
+ * Parse a `Cookie` header (exported for the caller-identity middleware).
+ *
+ * @param header - Raw cookie header
+ * @returns Parsed cookies
+ */
+export declare function parseCookieHeader(header: string | undefined): Record<string, string>;
+/**
+ * Whether a request presented a valid API token.
+ *
+ * @param req - Request carrying headers and url
+ * @param allowQuery - Whether to consult the query string
+ * @returns True when the presented token matches
+ */
+export declare function hasValidApiToken(req: AddressableRequest, allowQuery: boolean): boolean;
+/**
+ * Express middleware: loopback passes, everyone else needs the API token.
+ *
+ * Mounted in front of `/api` in `backend/src/index.ts`. `/health`, static
+ * assets and the SPA shell are not under `/api` and stay open.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Express next
+ */
+export declare function apiTokenMiddleware(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Whether `GET /health` is configured open to everyone (`CREWLY_PUBLIC_HEALTH`).
+ *
+ * @returns True when the env var is `1` or `true`
+ */
+export declare function isPublicHealthEnabled(): boolean;
+/**
+ * Gate for the root `GET /health` (#825).
+ *
+ * - Loopback: passes straight to the handler, untouched (CLI, Docker
+ *   healthchecks, desktop, local dashboard).
+ * - Non-loopback with a valid API token (header, Bearer or cookie): passes.
+ * - Non-loopback without one: the standard 401 token challenge, same as
+ *   `/api`, and nothing about the install is disclosed.
+ * - `CREWLY_PUBLIC_HEALTH=1`: everyone passes (public monitors behind a
+ *   reverse proxy).
+ *
+ * Why: crewly-mobile probes `/health` to choose its LAN transport. While
+ * `/health` answered 200 to anyone, a phone without the token chose LAN and
+ * then got 401 on every `/api` call, never falling back to the relay. A 401
+ * here makes that probe fail, so the app uses the relay, which works.
+ * "Loopback" follows {@link getClientAddress}: the socket address, or the
+ * first `X-Forwarded-For` hop only when `CREWLY_TRUST_PROXY` is set.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Express next
+ */
+export declare function healthGateMiddleware(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Decide whether a raw HTTP request (WebSocket upgrade or Engine.IO
+ * handshake) may proceed.
+ *
+ * Loopback passes. Otherwise the API token must be present (query `token`
+ * accepted here because browsers cannot set headers on WebSocket
+ * handshakes). `/ws/chat` additionally accepts a valid chat JWT when
+ * `CREWLY_JWT_SECRET` is configured, since that gateway has its own auth.
+ *
+ * @param req - Incoming HTTP request
+ * @returns True when the connection is allowed
+ */
+export declare function isUpgradeAllowed(req: IncomingMessage): boolean;
+/**
+ * Engine.IO `allowRequest` hook for the Socket.IO server. Covers both the
+ * polling handshake (which bypasses Express) and the WebSocket transport.
+ *
+ * @param req - Handshake request
+ * @param callback - Engine.IO callback `(err, success)`
+ */
+export declare function socketIoAllowRequest(req: IncomingMessage, callback: (err: string | null | undefined, success: boolean) => void): void;
+/**
+ * Install the WebSocket upgrade gate on an HTTP server.
+ *
+ * Wraps `httpServer.emit` (the same exclusive-handoff pattern the browser
+ * bridge and chat gateway use) so an unauthorised `upgrade` is answered
+ * with `401` and closed before ANY gateway sees it. Must be installed
+ * AFTER every gateway has attached so this wrapper is the outermost one.
+ *
+ * @param httpServer - Server whose upgrades to gate
+ */
+export declare function installWebSocketGate(httpServer: HttpServer): void;
+//# sourceMappingURL=api-token.middleware.d.ts.map

package/dist/cli/backend/src/middleware/api-token.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token.middleware.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/api-token.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAYlE,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAGxC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAShE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAElE;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA0BjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,kBAAkB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAM9H;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEpF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAEtF;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAexF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAM1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAkB9D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,GACnE,IAAI,CASN;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAuBjE"}

package/dist/cli/backend/src/middleware/api-token.middleware.js

@@ -0,0 +1,329 @@
+/**
+ * API token middleware.
+ *
+ * Gates `/api/*`, Socket.IO and raw WebSocket upgrades behind the shared
+ * API token for every caller that is NOT on loopback. Loopback callers
+ * (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) pass without a token — that is
+ * how local skills (`api_call` in `config/skills/_common/lib.sh`) and the
+ * local dashboard work with zero setup.
+ *
+ * The token can be presented as `Authorization: Bearer <token>`,
+ * `X-Crewly-Token: <token>`, a `crewly_token` cookie, or (WebSocket /
+ * dashboard deep link only) a `?token=` query parameter.
+ *
+ * `X-Forwarded-For` is honoured ONLY when `CREWLY_TRUST_PROXY=1`, otherwise
+ * any LAN caller could spoof a loopback origin.
+ *
+ * The existing `require-auth.middleware.ts` (HS256 JWT for chat-v2) is
+ * untouched; this module only re-uses its verifier so that `/ws/chat`
+ * clients holding a valid JWT keep working when `CREWLY_JWT_SECRET` is set.
+ *
+ * @module middleware/api-token
+ */
+import { API_SECURITY_CONSTANTS } from '../../../config/constants.js';
+import { verifyApiToken } from '../services/core/api-token.service.js';
+import { verifyHs256Token } from './require-auth.middleware.js';
+import { LoggerService } from '../services/core/logger.service.js';
+const logger = LoggerService.getInstance().createComponentLogger('ApiTokenMiddleware');
+/** Path prefix of the chat-v2 WebSocket gateway (has its own JWT verifier). */
+const CHAT_WS_PATH = '/ws/chat';
+/**
+ * Whether `X-Forwarded-For` should be trusted for loopback classification.
+ *
+ * @returns True when `CREWLY_TRUST_PROXY` is `1` or `true`
+ */
+export function isProxyTrusted() {
+    const raw = process.env[API_SECURITY_CONSTANTS.ENV.TRUST_PROXY];
+    return raw === '1' || raw === 'true';
+}
+/**
+ * Resolve the address a request originates from.
+ *
+ * @param req - Express request or raw upgrade request
+ * @returns Remote address string, or empty string when unknown
+ */
+export function getClientAddress(req) {
+    if (isProxyTrusted()) {
+        const forwarded = req.headers['x-forwarded-for'];
+        const first = (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(',')[0]?.trim();
+        if (first) {
+            return first;
+        }
+    }
+    return req.socket?.remoteAddress ?? '';
+}
+/**
+ * Whether an address is one of the loopback forms Node reports.
+ *
+ * @param address - Remote address
+ * @returns True for `127.0.0.1`, `::1` and `::ffff:127.0.0.1`
+ */
+export function isLoopbackAddress(address) {
+    return API_SECURITY_CONSTANTS.LOOPBACK_ADDRESSES.includes(address);
+}
+/**
+ * Whether a request originates from loopback (honouring the proxy rule).
+ *
+ * @param req - Express request or raw upgrade request
+ * @returns True when the caller is local
+ */
+export function isLoopbackRequest(req) {
+    return isLoopbackAddress(getClientAddress(req));
+}
+/**
+ * Parse a `Cookie` header into a name → value map.
+ *
+ * @param header - Raw cookie header
+ * @returns Parsed cookies (URL-decoded values)
+ */
+function parseCookies(header) {
+    const out = {};
+    if (!header)
+        return out;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const name = part.slice(0, eq).trim();
+        const value = part.slice(eq + 1).trim();
+        try {
+            out[name] = decodeURIComponent(value);
+        }
+        catch {
+            out[name] = value;
+        }
+    }
+    return out;
+}
+/**
+ * Extract the token a caller presented, if any.
+ *
+ * Order: `Authorization: Bearer`, `X-Crewly-Token`, `crewly_token` cookie,
+ * then (when `allowQuery`) the `?token=` query parameter.
+ *
+ * @param req - Request carrying headers and url
+ * @param allowQuery - Whether to consult the query string (WebSocket handshakes)
+ * @returns Presented token or null
+ */
+export function extractPresentedToken(req, allowQuery) {
+    const auth = req.headers.authorization;
+    if (typeof auth === 'string' && auth.startsWith('Bearer ')) {
+        const value = auth.slice('Bearer '.length).trim();
+        if (value)
+            return value;
+    }
+    const headerToken = req.headers[API_SECURITY_CONSTANTS.TOKEN_HEADER];
+    const headerValue = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+    if (headerValue)
+        return headerValue.trim();
+    const cookies = parseCookies(req.headers.cookie);
+    const cookieValue = cookies[API_SECURITY_CONSTANTS.TOKEN_COOKIE];
+    if (cookieValue)
+        return cookieValue;
+    if (allowQuery && req.url) {
+        try {
+            const host = req.headers.host || 'localhost';
+            const queryValue = new URL(req.url, `http://${host}`).searchParams.get(API_SECURITY_CONSTANTS.TOKEN_QUERY_PARAM);
+            if (queryValue)
+                return queryValue;
+        }
+        catch {
+            // Malformed URL — treat as no token
+        }
+    }
+    return null;
+}
+/**
+ * The API token a caller presented in a header (`Authorization: Bearer` or
+ * `X-Crewly-Token`) or, failing that, in the `crewly_token` cookie, and which
+ * of the two it was. A cookie is sent by the browser on its own, so a
+ * cookie-borne token alone does not authorise a write (#999).
+ *
+ * @param req - Request carrying headers
+ * @returns Token and source, or null when none was presented
+ */
+export function extractPresentedTokenWithSource(req) {
+    const headers = req.headers ?? {};
+    const fromHeaders = extractPresentedToken({ headers: { ...headers, cookie: undefined } }, false);
+    if (fromHeaders)
+        return { token: fromHeaders, source: 'header' };
+    const fromCookie = parseCookies(typeof headers.cookie === 'string' ? headers.cookie : undefined)[API_SECURITY_CONSTANTS.TOKEN_COOKIE];
+    return fromCookie ? { token: fromCookie, source: 'cookie' } : null;
+}
+/**
+ * Parse a `Cookie` header (exported for the caller-identity middleware).
+ *
+ * @param header - Raw cookie header
+ * @returns Parsed cookies
+ */
+export function parseCookieHeader(header) {
+    return parseCookies(header);
+}
+/**
+ * Whether a request presented a valid API token.
+ *
+ * @param req - Request carrying headers and url
+ * @param allowQuery - Whether to consult the query string
+ * @returns True when the presented token matches
+ */
+export function hasValidApiToken(req, allowQuery) {
+    return verifyApiToken(extractPresentedToken(req, allowQuery));
+}
+/**
+ * Send the standard 401 challenge.
+ *
+ * @param res - Express response
+ */
+function sendUnauthorized(res) {
+    res.setHeader('WWW-Authenticate', API_SECURITY_CONSTANTS.AUTH_SCHEME);
+    res.status(401).json({
+        success: false,
+        error: API_SECURITY_CONSTANTS.ERRORS.UNAUTHORIZED,
+        hint: API_SECURITY_CONSTANTS.UNAUTHORIZED_HINT,
+    });
+}
+/**
+ * Express middleware: loopback passes, everyone else needs the API token.
+ *
+ * Mounted in front of `/api` in `backend/src/index.ts`. `/health`, static
+ * assets and the SPA shell are not under `/api` and stay open.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Express next
+ */
+export function apiTokenMiddleware(req, res, next) {
+    if (isLoopbackRequest(req)) {
+        next();
+        return;
+    }
+    if (hasValidApiToken(req, false)) {
+        next();
+        return;
+    }
+    logger.warn('Rejected unauthenticated non-loopback API request', {
+        address: getClientAddress(req),
+        method: req.method,
+        path: req.originalUrl,
+    });
+    sendUnauthorized(res);
+}
+/**
+ * Whether `GET /health` is configured open to everyone (`CREWLY_PUBLIC_HEALTH`).
+ *
+ * @returns True when the env var is `1` or `true`
+ */
+export function isPublicHealthEnabled() {
+    const v = (process.env[API_SECURITY_CONSTANTS.ENV.PUBLIC_HEALTH] ?? '').trim().toLowerCase();
+    return v === '1' || v === 'true';
+}
+/**
+ * Gate for the root `GET /health` (#825).
+ *
+ * - Loopback: passes straight to the handler, untouched (CLI, Docker
+ *   healthchecks, desktop, local dashboard).
+ * - Non-loopback with a valid API token (header, Bearer or cookie): passes.
+ * - Non-loopback without one: the standard 401 token challenge, same as
+ *   `/api`, and nothing about the install is disclosed.
+ * - `CREWLY_PUBLIC_HEALTH=1`: everyone passes (public monitors behind a
+ *   reverse proxy).
+ *
+ * Why: crewly-mobile probes `/health` to choose its LAN transport. While
+ * `/health` answered 200 to anyone, a phone without the token chose LAN and
+ * then got 401 on every `/api` call, never falling back to the relay. A 401
+ * here makes that probe fail, so the app uses the relay, which works.
+ * "Loopback" follows {@link getClientAddress}: the socket address, or the
+ * first `X-Forwarded-For` hop only when `CREWLY_TRUST_PROXY` is set.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Express next
+ */
+export function healthGateMiddleware(req, res, next) {
+    if (isPublicHealthEnabled() || isLoopbackRequest(req) || hasValidApiToken(req, false)) {
+        next();
+        return;
+    }
+    sendUnauthorized(res);
+}
+/**
+ * Decide whether a raw HTTP request (WebSocket upgrade or Engine.IO
+ * handshake) may proceed.
+ *
+ * Loopback passes. Otherwise the API token must be present (query `token`
+ * accepted here because browsers cannot set headers on WebSocket
+ * handshakes). `/ws/chat` additionally accepts a valid chat JWT when
+ * `CREWLY_JWT_SECRET` is configured, since that gateway has its own auth.
+ *
+ * @param req - Incoming HTTP request
+ * @returns True when the connection is allowed
+ */
+export function isUpgradeAllowed(req) {
+    if (isLoopbackRequest(req))
+        return true;
+    if (hasValidApiToken(req, true))
+        return true;
+    const jwtSecret = process.env['CREWLY_JWT_SECRET'];
+    if (jwtSecret && req.url) {
+        try {
+            const host = req.headers.host || 'localhost';
+            const parsed = new URL(req.url, `http://${host}`);
+            if (parsed.pathname === CHAT_WS_PATH) {
+                const jwt = parsed.searchParams.get(API_SECURITY_CONSTANTS.TOKEN_QUERY_PARAM);
+                if (jwt && verifyHs256Token(jwt, jwtSecret)?.sub)
+                    return true;
+            }
+        }
+        catch {
+            // fall through
+        }
+    }
+    return false;
+}
+/**
+ * Engine.IO `allowRequest` hook for the Socket.IO server. Covers both the
+ * polling handshake (which bypasses Express) and the WebSocket transport.
+ *
+ * @param req - Handshake request
+ * @param callback - Engine.IO callback `(err, success)`
+ */
+export function socketIoAllowRequest(req, callback) {
+    if (isUpgradeAllowed(req)) {
+        callback(null, true);
+        return;
+    }
+    logger.warn('Rejected unauthenticated non-loopback Socket.IO handshake', {
+        address: getClientAddress(req),
+    });
+    callback(API_SECURITY_CONSTANTS.ERRORS.UNAUTHORIZED, false);
+}
+/**
+ * Install the WebSocket upgrade gate on an HTTP server.
+ *
+ * Wraps `httpServer.emit` (the same exclusive-handoff pattern the browser
+ * bridge and chat gateway use) so an unauthorised `upgrade` is answered
+ * with `401` and closed before ANY gateway sees it. Must be installed
+ * AFTER every gateway has attached so this wrapper is the outermost one.
+ *
+ * @param httpServer - Server whose upgrades to gate
+ */
+export function installWebSocketGate(httpServer) {
+    const originalEmit = httpServer.emit.bind(httpServer);
+    httpServer.emit = (event, ...args) => {
+        if (event === 'upgrade') {
+            const request = args[0];
+            const socket = args[1];
+            if (!isUpgradeAllowed(request)) {
+                logger.warn('Rejected unauthenticated non-loopback WebSocket upgrade', {
+                    address: getClientAddress(request),
+                    path: request.url,
+                });
+                socket.write(`HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: ${API_SECURITY_CONSTANTS.AUTH_SCHEME}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+                socket.destroy();
+                return true;
+            }
+        }
+        return originalEmit(event, ...args);
+    };
+}
+//# sourceMappingURL=api-token.middleware.js.map

package/dist/cli/backend/src/middleware/api-token.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token.middleware.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/api-token.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAEnE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;AAEvF,+EAA+E;AAC/E,MAAM,YAAY,GAAG,UAAU,CAAC;AAShC;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3F,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAQ,sBAAsB,CAAC,kBAAwC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,OAAO,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB,EAAE,UAAmB;IAChF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9E,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,UAAU,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CACpE,sBAAsB,CAAC,iBAAiB,CACzC,CAAC;YACF,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAuB;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACjG,IAAI,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjE,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtI,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB,EAAE,UAAmB;IAC3E,OAAO,cAAc,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAa;IACrC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,YAAY;QACjD,IAAI,EAAE,sBAAsB,CAAC,iBAAiB;KAC/C,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAChF,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;QAC/D,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,WAAW;KACtB,CAAC,CAAC;IACH,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7F,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAClF,IAAI,qBAAqB,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACtF,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;gBAC9E,IAAI,GAAG,IAAI,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,GAAG;oBAAE,OAAO,IAAI,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,QAAoE;IAEpE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;QACvE,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;IACH,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAsB;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAoC,CAAC;IACxF,UAAwD,CAAC,IAAI,GAAG,CAC/D,KAAc,EACd,GAAG,IAAe,EACT,EAAE;QACX,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAoB,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;oBACrE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;oBAClC,IAAI,EAAE,OAAO,CAAC,GAAG;iBAClB,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,CACV,kDAAkD,sBAAsB,CAAC,WAAW,oDAAoD,CACzI,CAAC;gBACF,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}