dns-worker 1.1.0 → 1.1.1-canary.e00a6a3

package/README.md

@@ -2,7 +2,7 @@
   <img src="https://raw.githubusercontent.com/Obein/DNS-Worker/main/web/src/assets/obex_cat_eye_logo-256.webp" alt="DNS Worker Logo" width="128">
   <h1>DNS Worker</h1>
   <p>Privacy-First Protective DNS Resolver & DoH / DoT Server</p>
-  <p>Protect your first hop on the internet · Dual-Engine: Cloudflare Workers Edge or Standalone Server (VPS / Linux / macOS / Windows)</p>
+  <p>Protect your first hop on the internet</p>
   <p align="center">
     English | <a href="README_zh-CN.md">中文 (简体)</a> | <a href="README_zh-TW.md">中文 (正體)</a>
   </p>
@@ -51,23 +51,6 @@
 
 ---
 
-## 🔐 Advanced Privacy: Local-First & Post-Quantum E2EE
-
-DNS Worker redefines personal DNS observability by combining local-first browser computation with cutting-edge post-quantum cryptography:
-
-### ⚡ Local-First Browser SQLite (OPFS + WASM)
-* **Instantaneous 0ms Queries**: Resolution logs and analytical charts render immediately from an in-browser SQLite database powered by Origin Private File System (OPFS) and Dedicated Web Workers.
-* **Quota Preservation & Offline Analytics**: High-frequency filtering, pagination, and multi-dimensional analytics run locally without issuing remote D1 read queries, drastically reducing Cloudflare D1 quota consumption and enabling full offline inspection.
-* **Smart Bidirectional Sync**: Automatically reconciles local storage with remote D1 in the background with zero UI freeze.
-
-### 🛡️ Post-Quantum End-to-End Encryption (P256-MLKEM768)
-* **Zero-Knowledge Cloud Storage**: Sensitive log fields (domains, client IPs, answers, geo locations, and upstream servers) are encrypted before reaching persistent cloud storage. Cloudflare Workers and D1 database store only ciphertexts.
-* **Quantum-Resistant Hybrid Lattice KEM**: Adopts the NIST FIPS 203 standardized **P256-MLKEM768** (ML-KEM-768 + ECDH P-256) hybrid algorithm, defending user query logs against future "Harvest Now, Decrypt Later" quantum attacks.
-* **Decoupled Hourly Envelope Encryption**: Automatically encapsulates and provisions hourly Data Encryption Keys (DEK), compressing KEM database overhead by ~80% while sustaining hot-path pipeline encryption throughput of **20,000+ queries/second**.
-* **Hardware Passkey Protection**: The private key seed is wrapped with hardware Passkeys (WebAuthn PRF) and single-use self-rotating Recovery Keys; no plaintext secret ever touches the server.
-
----
-
 ## 🖼️ Quick Look
 
 | User Login |

package/dist/serverfull.mjs

@@ -1347,11 +1347,13 @@ function decodeName(buffer, offset) {
   let jumped = false;
   let consumed = 0;
   let iterations = 0;
+  let terminated = false;
   while (iterations < 128) {
     if (curr >= buffer.length) break;
     const len = buffer[curr];
     if (len === 0) {
       if (!jumped) consumed++;
+      terminated = true;
       break;
     }
     if ((len & 192) === 192) {
@@ -1365,6 +1367,9 @@ function decodeName(buffer, offset) {
       iterations++;
       continue;
     }
+    if ((len & 192) !== 0) {
+      break;
+    }
     if (name.length > 0) name += ".";
     if (curr + 1 + len > buffer.length) break;
     for (let i = 0; i < len; i++) {
@@ -1374,6 +1379,9 @@ function decodeName(buffer, offset) {
     curr += len + 1;
     iterations++;
   }
+  if (!terminated) {
+    return { name: "", read: 0 };
+  }
   return { name, read: consumed };
 }
 function getQTypeName(type) {
@@ -1383,6 +1391,7 @@ function parseDNSQueryFromRaw(raw) {
   try {
     if (raw.length < 16) return null;
     const { name, read } = decodeName(raw, 12);
+    if (read === 0) return null;
     const qtypeOffset = 12 + read;
     if (qtypeOffset + 4 > raw.length) return null;
     const qtypeCode = raw[qtypeOffset] << 8 | raw[qtypeOffset + 1];
@@ -1432,12 +1441,14 @@ function parseDNSAnswer(raw) {
   for (let i = 0; i < qCount; i++) {
     if (offset >= raw.length) return [];
     const { read } = decodeName(raw, offset);
+    if (read === 0) return [];
     offset += read + 4;
     if (offset > raw.length) return [];
   }
   for (let i = 0; i < ansCount; i++) {
     if (offset >= raw.length) break;
     const { name, read: nameRead } = decodeName(raw, offset);
+    if (nameRead === 0) break;
     offset += nameRead;
     if (offset + 10 > raw.length) {
       break;
@@ -1609,18 +1620,21 @@ function rebuildEchWithFronting(rawBase64, newFrontingDomain = DEFAULT_ECH_FRONT
     const pkLen = bytes[9] << 8 | bytes[10];
     const pkStart = 11;
     const pkEnd = pkStart + pkLen;
-    if (pkEnd > bytes.length) return rawBase64;
+    if (pkEnd + 4 > bytes.length) return rawBase64;
     const publicKey = bytes.slice(pkStart, pkEnd);
     let offset = pkEnd;
     const csLen = bytes[offset] << 8 | bytes[offset + 1];
     offset += 2;
+    if (offset + csLen + 2 > bytes.length) return rawBase64;
     const cipherSuites = bytes.slice(offset, offset + csLen);
     offset += csLen;
     const maxNameLen = bytes[offset++];
     const oldNameLen = bytes[offset++];
+    if (offset + oldNameLen + 2 > bytes.length) return rawBase64;
     offset += oldNameLen;
     const extLen = bytes[offset] << 8 | bytes[offset + 1];
     offset += 2;
+    if (offset + extLen > bytes.length) return rawBase64;
     const extensions = bytes.slice(offset, offset + extLen);
     const targetName = (newFrontingDomain || DEFAULT_ECH_FRONTING_DOMAIN).trim().toLowerCase();
     const nameBytes = new Uint8Array(targetName.length);
@@ -2098,21 +2112,6 @@ var SystemSettingsModel = class {
 // src/utils/ech/sync.ts
 var cachedActiveCfEchConfig = null;
 var loadPromise = null;
-function setActiveCfEchConfig(echBase64) {
-  if (echBase64 && echBase64 !== cachedActiveCfEchConfig) {
-    cachedActiveCfEchConfig = echBase64;
-  }
-}
-async function saveActiveCfEchConfig(db, echBase64) {
-  if (!echBase64) return;
-  setActiveCfEchConfig(echBase64);
-  try {
-    const settingsModel = new SystemSettingsModel(db);
-    await settingsModel.set("cf_active_ech_config", echBase64);
-  } catch (e) {
-    console.warn("[ECH] Could not persist active ECH config to DB:", e);
-  }
-}
 async function ensureCloudflareIpRangesLoaded(db) {
   const currentCidrs = getActiveCfProxyCidrs();
   if (currentCidrs.length > 0) {
@@ -2310,13 +2309,19 @@ function buildDNSQuery(name, type) {
   raw.set(new Uint8Array(question), header.length);
   return raw;
 }
+function createServFail(queryRaw) {
+  const res = new Uint8Array(12);
+  if (queryRaw && queryRaw.length >= 12) {
+    res.set(queryRaw.slice(0, 12));
+  }
+  res[2] = res[2] & 1 | 128;
+  res[3] = res[3] & 240 | 2;
+  return res;
+}
 function buildResponseMulti(queryRaw, records, rcode = 0) {
   try {
     if (!queryRaw || queryRaw.length < 12) {
-      const err = new Uint8Array(12);
-      err[2] = 129;
-      err[3] = 130;
-      return err;
+      return createServFail(queryRaw);
     }
     const header = new Uint8Array(12);
     header.set(queryRaw.slice(0, 12));
@@ -2326,14 +2331,12 @@ function buildResponseMulti(queryRaw, records, rcode = 0) {
     const qCount = queryRaw[4] << 8 | queryRaw[5];
     for (let i = 0; i < qCount; i++) {
       const { read } = decodeName(queryRaw, qEnd);
-      if (read === 0 && qEnd < queryRaw.length) {
-        qEnd++;
-      } else {
-        qEnd += read + 4;
+      if (read === 0) {
+        return createServFail(queryRaw);
       }
+      qEnd += read + 4;
       if (qEnd > queryRaw.length) {
-        qEnd = queryRaw.length;
-        break;
+        return createServFail(queryRaw);
       }
     }
     const questionSection = queryRaw.slice(12, qEnd);
@@ -2408,10 +2411,7 @@ function buildResponseMulti(queryRaw, records, rcode = 0) {
 function buildResponse(queryRaw, type, value, ttl = 60, rcode = 0) {
   try {
     if (!queryRaw || queryRaw.length < 12) {
-      const err = new Uint8Array(12);
-      err[2] = 129;
-      err[3] = 130;
-      return err;
+      return createServFail(queryRaw);
     }
     const header = new Uint8Array(12);
     header.set(queryRaw.slice(0, 12));
@@ -2421,14 +2421,12 @@ function buildResponse(queryRaw, type, value, ttl = 60, rcode = 0) {
     const qCount = queryRaw[4] << 8 | queryRaw[5];
     for (let i = 0; i < qCount; i++) {
       const { read } = decodeName(queryRaw, qEnd);
-      if (read === 0 && qEnd < queryRaw.length) {
-        qEnd++;
-      } else {
-        qEnd += read + 4;
+      if (read === 0) {
+        return createServFail(queryRaw);
       }
+      qEnd += read + 4;
       if (qEnd > queryRaw.length) {
-        qEnd = queryRaw.length;
-        break;
+        return createServFail(queryRaw);
       }
     }
     const questionSection = queryRaw.slice(12, qEnd);
@@ -3051,18 +3049,31 @@ var BloomFilter = class _BloomFilter {
    * 从原始二进制流恢复 (零拷贝/对齐安全反序列化)
    */
   static fromUint8Array(buffer) {
+    if (!buffer || buffer.byteLength < 8) {
+      throw new Error("Invalid bloom filter buffer: header too short");
+    }
     const view = new DataView(buffer.buffer, buffer.byteOffset, 8);
     const size = view.getUint32(0, true);
     const hashes = view.getUint32(4, true);
+    if (size === 0 || hashes === 0) {
+      throw new Error("Invalid bloom filter parameters: size and hashes must be positive integers");
+    }
     const offset = buffer.byteOffset + 8;
     const length = buffer.byteLength - 8;
+    const expectedWords = size + 31 >>> 5;
+    const actualWords = length >> 2;
+    if (actualWords < expectedWords) {
+      throw new Error(
+        `Invalid bloom filter buffer: bit array truncated (expected ${expectedWords} words, got ${actualWords})`
+      );
+    }
     let bitData;
     if (offset % 4 === 0) {
-      bitData = new Uint32Array(buffer.buffer, offset, length >> 2);
+      bitData = new Uint32Array(buffer.buffer, offset, expectedWords);
     } else {
-      const copy = new Uint8Array(length);
-      copy.set(buffer.subarray(8));
-      bitData = new Uint32Array(copy.buffer, 0, length >> 2);
+      const copy = new Uint8Array(expectedWords << 2);
+      copy.set(buffer.subarray(8, 8 + (expectedWords << 2)));
+      bitData = new Uint32Array(copy.buffer, 0, expectedWords);
     }
     return new _BloomFilter(size, hashes, bitData);
   }
@@ -3522,9 +3533,29 @@ var FORBIDDEN_HOSTNAMES = [
   "localhost",
   "metadata.google.internal",
   // GCP
-  "169.254.169.254"
+  "metadata.goog",
+  "169.254.169.254",
   // AWS/GCP/Azure IMDS
+  "instance-data",
+  "localtest.me"
+];
+var FORBIDDEN_HOSTNAME_SUFFIXES = [
+  ".localhost",
+  ".local",
+  ".internal",
+  ".lan",
+  ".home.arpa",
+  ".corp",
+  ".home",
+  ".localtest.me"
 ];
+function extractEmbeddedDnsIp(hostname) {
+  const dotMatch = hostname.match(/(?:^|\.)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\.(?:nip\.io|sslip\.io)$/i);
+  if (dotMatch) return dotMatch[1];
+  const dashMatch = hostname.match(/(?:^|\.)(\d{1,3})-(\d{1,3})-(\d{1,3})-(\d{1,3})\.(?:nip\.io|sslip\.io)$/i);
+  if (dashMatch) return `${dashMatch[1]}.${dashMatch[2]}.${dashMatch[3]}.${dashMatch[4]}`;
+  return null;
+}
 var PRIVATE_AND_RESERVED_CIDRS = [
   // IPv4 Special/Private Ranges
   "0.0.0.0/8",
@@ -3622,6 +3653,20 @@ function isSafeUrl(urlString) {
     if (FORBIDDEN_HOSTNAMES.includes(rawHostname) || FORBIDDEN_HOSTNAMES.includes(url.hostname.toLowerCase())) {
       return false;
     }
+    for (const suffix of FORBIDDEN_HOSTNAME_SUFFIXES) {
+      if (rawHostname.endsWith(suffix) || rawHostname === suffix.slice(1)) {
+        return false;
+      }
+    }
+    if (rawHostname.includes("metadata.google")) {
+      return false;
+    }
+    const embeddedIp = extractEmbeddedDnsIp(rawHostname);
+    if (embeddedIp) {
+      if (!isPublicInternetIP(embeddedIp)) {
+        return false;
+      }
+    }
     if ((isIPv4(rawHostname) || isIPv6(rawHostname)) && !isPublicInternetIP(rawHostname)) {
       return false;
     }
@@ -4005,7 +4050,6 @@ async function processBestEffortEch(query, initialParsedAnswers, initialAnswer,
       const echMatch = a.data.match(/ech=([A-Za-z0-9+/=]+)/);
       if (echMatch) {
         existingEch = echMatch[1];
-        context.ctx.waitUntil(saveActiveCfEchConfig(context.env.DB, existingEch));
       }
     }
     let isCf = existingIpv4s.some(isCloudflareIp) || existingIpv6s.some(isCloudflareIp);
@@ -10693,7 +10737,8 @@ var UdpDnsServer = class {
         env,
         ctx
       };
-      const request = new Request(`http://${rinfo.address}/dns-query`, {
+      const host = rinfo.address.includes(":") ? `[${rinfo.address}]` : rinfo.address;
+      const request = new Request(`http://${host}/dns-query`, {
         headers: {
           "CF-Connecting-IP": rinfo.address,
           "Accept": "application/dns-message",
@@ -10835,12 +10880,20 @@ Skipping DoT server.`);
         candidateKey = firstPart;
       }
     }
+    socket.setTimeout(3e4, () => {
+      socket.destroy();
+    });
     socket.on("error", (err) => {
       if (err.code !== "ECONNRESET") {
         console.warn(`[DoT] Socket error from ${remoteIp}:`, err.message);
       }
     });
+    const MAX_DOT_BUFFER = 65537;
     socket.on("data", async (chunk) => {
+      if (buffer.length + chunk.length > MAX_DOT_BUFFER) {
+        socket.destroy();
+        return;
+      }
       buffer = Buffer2.concat([buffer, chunk]);
       while (buffer.length >= 2) {
         const msgLen = buffer.readUInt16BE(0);
@@ -10884,7 +10937,8 @@ Skipping DoT server.`);
         env,
         ctx
       };
-      const request = new Request(`http://${remoteIp}/dns-query`, {
+      const host = remoteIp.includes(":") ? `[${remoteIp}]` : remoteIp;
+      const request = new Request(`http://${host}/dns-query`, {
         headers: {
           "CF-Connecting-IP": remoteIp,
           "Accept": "application/dns-message",
@@ -11235,7 +11289,8 @@ async function verifyTurnstile(token, secret, ip) {
       body: params,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
-      }
+      },
+      signal: AbortSignal.timeout(5e3)
     });
     const outcome = await result.json();
     return !!outcome.success;
@@ -11721,20 +11776,15 @@ async function verifyRegistrationResponse(options) {
   }
   const clientOriginUrl = new URL(clientData.origin);
   const expectedOriginUrl = expectedOrigin.includes("://") ? new URL(expectedOrigin) : new URL(`https://${expectedOrigin}`);
-  if (clientOriginUrl.hostname.toLowerCase() !== expectedOriginUrl.hostname.toLowerCase()) {
+  if (clientOriginUrl.origin.toLowerCase() !== expectedOriginUrl.origin.toLowerCase()) {
     throw new Error(
-      `WebAuthn origin mismatch: expected ${expectedOriginUrl.hostname}, received ${clientOriginUrl.hostname}`
+      `WebAuthn origin mismatch: expected ${expectedOriginUrl.origin}, received ${clientOriginUrl.origin}`
     );
   }
   const isLocalhost = clientOriginUrl.hostname === "localhost" || clientOriginUrl.hostname === "127.0.0.1";
   if (!isLocalhost && clientOriginUrl.protocol !== "https:") {
     throw new Error(`WebAuthn requires HTTPS origin, received: ${clientOriginUrl.protocol}`);
   }
-  if (clientOriginUrl.protocol !== expectedOriginUrl.protocol) {
-    throw new Error(
-      `WebAuthn protocol mismatch: expected ${expectedOriginUrl.protocol}, received ${clientOriginUrl.protocol}`
-    );
-  }
   const attestationBytes = base64UrlDecode(attestationObject);
   const { value: attestation } = decodeCbor(attestationBytes);
   if (!attestation.authData) {
@@ -11778,20 +11828,15 @@ async function verifyAuthenticationResponse(options) {
   }
   const clientOriginUrl = new URL(clientData.origin);
   const expectedOriginUrl = expectedOrigin.includes("://") ? new URL(expectedOrigin) : new URL(`https://${expectedOrigin}`);
-  if (clientOriginUrl.hostname.toLowerCase() !== expectedOriginUrl.hostname.toLowerCase()) {
+  if (clientOriginUrl.origin.toLowerCase() !== expectedOriginUrl.origin.toLowerCase()) {
     throw new Error(
-      `WebAuthn origin mismatch: expected ${expectedOriginUrl.hostname}, received ${clientOriginUrl.hostname}`
+      `WebAuthn origin mismatch: expected ${expectedOriginUrl.origin}, received ${clientOriginUrl.origin}`
     );
   }
   const isLocalhost = clientOriginUrl.hostname === "localhost" || clientOriginUrl.hostname === "127.0.0.1";
   if (!isLocalhost && clientOriginUrl.protocol !== "https:") {
     throw new Error(`WebAuthn requires HTTPS origin, received: ${clientOriginUrl.protocol}`);
   }
-  if (clientOriginUrl.protocol !== expectedOriginUrl.protocol) {
-    throw new Error(
-      `WebAuthn protocol mismatch: expected ${expectedOriginUrl.protocol}, received ${clientOriginUrl.protocol}`
-    );
-  }
   const authDataBytes = base64UrlDecode(authenticatorData);
   if (authDataBytes.length < 37) {
     throw new Error("Invalid authenticatorData length");
@@ -12052,7 +12097,9 @@ async function handleLoginRequest(request, env) {
       } else if ((hasTotp || hasPasskeys || hasRecoveryKeys) && recoveryKey) {
         let storedHashes = [];
         try {
-          storedHashes = JSON.parse(user.totp_recovery_keys || "[]");
+          const raw = user.totp_recovery_keys;
+          storedHashes = typeof raw === "string" ? JSON.parse(raw || "[]") : raw || [];
+          if (!Array.isArray(storedHashes)) storedHashes = [storedHashes];
         } catch {
         }
         const matchIndex = await findMatchingRecoveryKey(recoveryKey, storedHashes);
@@ -12444,14 +12491,18 @@ async function handleForgotPasswordRequest(request, env) {
     const passkeyModel = new PasskeyModel(env.DB);
     const passkeys = await passkeyModel.listByUser(user.id);
     const has_passkey = passkeys.length > 0;
-    const has_totp = !!user.totp_enabled && !!user.totp_secret;
+    const has_totp = !!user.totp_enabled && (!!user.totp_secret || !!user.totp_secret_encrypted);
     let has_recovery_keys = false;
-    if (user.totp_recovery_keys) {
+    const rawRecoveryKeys = user.totp_recovery_keys;
+    if (rawRecoveryKeys) {
       try {
-        const parsed = JSON.parse(user.totp_recovery_keys);
+        const parsed = typeof rawRecoveryKeys === "string" ? JSON.parse(rawRecoveryKeys) : rawRecoveryKeys;
         has_recovery_keys = Array.isArray(parsed) && parsed.length > 0;
       } catch {
+        has_recovery_keys = typeof rawRecoveryKeys === "string" && rawRecoveryKeys.length > 0;
       }
+    } else if (user.totp_recovery_keys_encrypted) {
+      has_recovery_keys = true;
     }
     if (!has_passkey && !has_totp && !has_recovery_keys) {
       return new Response(JSON.stringify({
@@ -12548,7 +12599,9 @@ async function handleForgotPasswordRequest(request, env) {
     } else if (recoveryKey) {
       let storedHashes = [];
       try {
-        storedHashes = JSON.parse(user.totp_recovery_keys || "[]");
+        const raw = user.totp_recovery_keys;
+        storedHashes = typeof raw === "string" ? JSON.parse(raw || "[]") : raw || [];
+        if (!Array.isArray(storedHashes)) storedHashes = [storedHashes];
       } catch {
       }
       const matchIndex = await findMatchingRecoveryKey(recoveryKey, storedHashes);
@@ -12560,12 +12613,22 @@ async function handleForgotPasswordRequest(request, env) {
       await userModel.consumeRecoveryKey(user.id, matchIndex, storedHashes);
       await activityLog.record(user.id, "recovery_key_used", clientIp, userAgent, { flow: "forgot_password", remaining: storedHashes.length - 1 });
     } else if (totpTokenHash && user.totp_secret) {
-      const isValid = await verifyTOTP(user.totp_secret, totpTokenHash, totpSalt);
-      if (!isValid) {
+      const totpResult = await verifyTOTPWithStep(user.totp_secret, totpTokenHash, totpSalt);
+      if (!totpResult.valid) {
         state.failedAttempts++;
         await cacheUtils.set(cache, cacheKey, state, 300);
         return new Response("Invalid TOTP code", { status: 400 });
       }
+      if (totpResult.timeStep !== void 0) {
+        const stepKey = `totp_step:${user.id}:${totpResult.timeStep}`;
+        const replayed = await cacheUtils.get(cache, stepKey);
+        if (replayed) {
+          state.failedAttempts++;
+          await cacheUtils.set(cache, cacheKey, state, 300);
+          return new Response("TOTP code already used, please wait for next code", { status: 400 });
+        }
+        await cacheUtils.set(cache, stepKey, true, 180);
+      }
       await activityLog.record(user.id, "totp_verify_success", clientIp, userAgent, { flow: "forgot_password" });
     } else {
       return new Response("No valid MFA credential provided", { status: 400 });
@@ -13345,14 +13408,62 @@ function parseLine(line) {
 
 // src/utils/listFetcher.ts
 async function fetchListContent(url, maxBytes, timeoutMs, onDomain) {
-  if (!isSafeUrl(url)) {
-    return {
-      count: 0,
-      error: "Invalid list URL. Private networks and localhosts are not allowed."
-    };
-  }
+  const deadline = Date.now() + timeoutMs;
+  let currentUrl = url;
+  let redirectCount = 0;
+  const MAX_REDIRECTS = 5;
+  let response;
   try {
-    const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    while (true) {
+      if (!isSafeUrl(currentUrl)) {
+        return {
+          count: 0,
+          error: "Invalid list URL. Private networks, localhosts, and internal domains are not allowed."
+        };
+      }
+      const remainingTimeout = deadline - Date.now();
+      if (remainingTimeout <= 0) {
+        return { count: 0, error: "Request timed out" };
+      }
+      response = await fetch(currentUrl, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(remainingTimeout)
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location) {
+          return {
+            count: 0,
+            error: `Redirect status ${response.status} without Location header`
+          };
+        }
+        redirectCount++;
+        if (redirectCount > MAX_REDIRECTS) {
+          return {
+            count: 0,
+            error: `Too many redirects (max ${MAX_REDIRECTS})`
+          };
+        }
+        try {
+          const nextUrl = new URL(location, currentUrl).toString();
+          const nextProto = new URL(nextUrl).protocol;
+          if (nextProto !== "http:" && nextProto !== "https:") {
+            return {
+              count: 0,
+              error: `Invalid redirect protocol: ${nextProto}`
+            };
+          }
+          currentUrl = nextUrl;
+          continue;
+        } catch {
+          return {
+            count: 0,
+            error: `Invalid redirect location: ${location}`
+          };
+        }
+      }
+      break;
+    }
     if (!response.ok) {
       return {
         count: 0,
@@ -14836,23 +14947,22 @@ async function handlePasskeysRequest(request, env, user, pathParts, _ctx) {
       const dbUser = await userModel.getById(user.id);
       let recoveryKeys = [];
       if (dbUser) {
+        let hasExistingRecoveryKeys = false;
         if (dbUser.totp_recovery_keys) {
-          let parsedKeys = null;
           try {
-            parsedKeys = typeof dbUser.totp_recovery_keys === "string" ? JSON.parse(dbUser.totp_recovery_keys) : dbUser.totp_recovery_keys;
+            const parsed2 = typeof dbUser.totp_recovery_keys === "string" ? JSON.parse(dbUser.totp_recovery_keys) : dbUser.totp_recovery_keys;
+            if (Array.isArray(parsed2) && parsed2.length > 0) {
+              hasExistingRecoveryKeys = true;
+            }
           } catch {
-            parsedKeys = [dbUser.totp_recovery_keys];
-          }
-          if (!Array.isArray(parsedKeys)) parsedKeys = [parsedKeys];
-          for (const item of parsedKeys) {
-            if (typeof item === "object" && item?.key) {
-              recoveryKeys.push(item.key);
-            } else if (typeof item === "string" && !/^[a-fA-F0-9]{64}$/.test(item.trim())) {
-              recoveryKeys.push(item);
+            if (dbUser.totp_recovery_keys.length > 0) {
+              hasExistingRecoveryKeys = true;
             }
           }
+        } else if (dbUser.totp_recovery_keys_encrypted) {
+          hasExistingRecoveryKeys = true;
         }
-        if (recoveryKeys.length === 0) {
+        if (!hasExistingRecoveryKeys) {
           const plaintextKeys = generateRecoveryKeys();
           const storedItems = await Promise.all(
             plaintextKeys.map(async (k) => ({
@@ -14864,10 +14974,16 @@ async function handlePasskeysRequest(request, env, user, pathParts, _ctx) {
         }
       }
       await activityLog.record(user.id, "passkey_registered", clientIp, userAgent, { name: passkeyName }, sessionHash);
-      return new Response(JSON.stringify({ ...created, recovery_keys: recoveryKeys }), {
-        status: 201,
-        headers: { "Content-Type": "application/json" }
-      });
+      return new Response(
+        JSON.stringify({
+          ...created,
+          recovery_keys: recoveryKeys.length > 0 ? recoveryKeys : void 0
+        }),
+        {
+          status: 201,
+          headers: { "Content-Type": "application/json" }
+        }
+      );
     } catch (err) {
       console.warn("[Passkey Registration] Verification failed:", err.message || err);
       return new Response(err.message || "Passkey registration failed", { status: 400 });
@@ -15931,6 +16047,12 @@ var HttpServer = class {
         const remoteIp = req.socket.remoteAddress?.replace(/^::ffff:/, "") || "127.0.0.1";
         headers.set("CF-Connecting-IP", remoteIp);
       }
+      if (!headers.has("CF-IPLatitude")) {
+        headers.set("CF-IPLatitude", "0.0");
+      }
+      if (!headers.has("CF-IPLongitude")) {
+        headers.set("CF-IPLongitude", "0.0");
+      }
       let body = null;
       if (req.method !== "GET" && req.method !== "HEAD") {
         const chunks = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dns-worker",
-  "version": "1.1.0",
+  "version": "1.1.1-canary.e00a6a3",
   "private": false,
   "description": "Privacy-first DNS & DoH Resolver with modern Web Dashboard, built for Cloudflare Workers & Node.js",
   "main": "./dist/serverfull.mjs",
@@ -29,7 +29,7 @@
     "deploy:skipdb": "npm run build && wrangler deploy",
     "build": "npm run ui:build",
     "build:pages": "npm run ui:build && npx esbuild src/index.ts --bundle --outfile=static/_worker.js --platform=neutral --format=esm --minify --external:cloudflare:* --external:node:*",
-    "postinstall": "npm run ui:install",
+    "prepare": "npm run ui:install",
     "db:setup": "wrangler d1 create dns_worker_db",
     "db:migrate:dev": "wrangler d1 migrations apply dns_worker_db --local",
     "db:migrate:prod": "echo \"y\" | wrangler d1 migrations apply dns_worker_db --remote",
@@ -40,7 +40,7 @@
     "lint": "eslint . --ext .ts,.tsx",
     "ui:dev": "cd web && npm run dev",
     "ui:build": "cd web && npm run build",
-    "ui:install": "cd web && npm install -f"
+    "ui:install": "cd web && npm install"
   },
   "keywords": [
     "dns",