dsh-daily-brief 2.0.2 → 2.0.3

package/lib/host/routes.js

@@ -1,14 +1,52 @@
 /**
- * Loopback HTTP surface used by the client panel (relative `api/daily-brief/*`).
- * Every mutating call must carry the private header; all calls are loopback-only.
+ * Host HTTP surface used by the client panel (relative `api/daily-brief/*`).
+ *
+ * The plugin owns this route, so it also owns the request policy. On hosts that
+ * expose DSH's Connection service every call passes the same Host/Origin fence
+ * and browser-session check as the built-in `/api` bridge
+ * (`connection.requestRejection`). That covers both the Web GUI and the Desktop
+ * renderer: the `dsh-app` scheme forwards an authenticated, same-origin request
+ * for the panel, so no plugin-specific header is needed.
+ *
+ * Hosts without that service keep the historical local-only gate, now strict:
+ * the request must come from loopback *and* carry `x-daily-brief-client: 1`.
  */
 const PREFIX = '/api/daily-brief';
+const CLIENT_HEADER = 'x-daily-brief-client';
 
 function isLoopback(req) {
   const address = req.socket?.remoteAddress || '';
   return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
 }
 
+/**
+ * Decide whether one request may reach the panel API.
+ * @returns `undefined` when admitted, otherwise the status and error to answer with.
+ */
+function admissionFailure(ctx, req) {
+  let connection;
+  try {
+    connection = typeof ctx.get === 'function' ? ctx.get('connection') : ctx.connection;
+  } catch {
+    connection = undefined;
+  }
+  if (connection && typeof connection.requestRejection === 'function') {
+    try {
+      const status = connection.requestRejection(req);
+      if (!status) return undefined;
+      return {
+        status,
+        error: status === 401 ? '需要 DSH 网页会话认证' : '请求来源不受信任',
+      };
+    } catch {
+      return { status: 503, error: '暂时无法校验请求来源' };
+    }
+  }
+  if (!isLoopback(req)) return { status: 403, error: '仅限本机访问' };
+  if (req.headers[CLIENT_HEADER] !== '1') return { status: 403, error: '客户端标识无效' };
+  return undefined;
+}
+
 function sendJson(res, status, body) {
   const payload = JSON.stringify(body ?? null);
   res.statusCode = status;
@@ -55,12 +93,13 @@ export function registerRoutes(ctx, service) {
     const sub = url.pathname.slice(PREFIX.length) || '/';
     const method = req.method || 'GET';
 
-    if (!isLoopback(req)) {
-      sendJson(res, 403, { error: '仅限本机访问' });
+    const failure = admissionFailure(ctx, req);
+    if (failure) {
+      sendJson(res, failure.status, { error: failure.error });
       return;
     }
 
-    // The exported page is opened by the user directly; it needs no header.
+    // `/artifact` has no panel client of its own; admission above is the guard.
     if (sub === '/artifact' && method === 'GET') {
       const id = url.searchParams.get('id') || 'latest';
       const briefing = await service.getBriefing(id);
@@ -88,13 +127,6 @@ export function registerRoutes(ctx, service) {
       return;
     }
 
-    // The Desktop renderer reaches these routes through the dsh-app scheme handler,
-    // which cannot attach custom headers on preflighted reads; loopback is the guard.
-    if (req.headers['x-daily-brief-client'] !== undefined && req.headers['x-daily-brief-client'] !== '1') {
-      sendJson(res, 403, { error: '客户端标识无效' });
-      return;
-    }
-
     try {
       if (sub === '/state' && method === 'GET') {
         sendJson(res, 200, await service.getState());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-daily-brief",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "publishConfig": {
     "access": "public"
   },