dsh-realtime-audio-ws 0.2.1 → 0.2.2

package/lib/diagnostics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAG3C;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;AAEjF,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAA;KAAE,KAAK,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;IAClG,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;CACrC;AAED,0GAA0G;AAC1G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAA;CACtE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAmBxE"}
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAG3C;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;AAEjF,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAA;KAAE,KAAK,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;IAClG,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;CACrC;AAED,0GAA0G;AAC1G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAA;CACtE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAgCxE"}

package/lib/diagnostics.js

@@ -35,21 +35,58 @@ export function diagnosticsRoute(deps) {
         kind: 'exact',
         path: deps.path,
         handler: (req, res) => {
+            // The host's own page is cross-origin to loopback, and a browser discards a cross-origin response
+            // that carries no `Access-Control-Allow-Origin` — the request authenticates, the route answers
+            // 200, and the caller sees a CORS failure with no body. The WebSocket sibling is exempt from CORS,
+            // which is how this went unnoticed: one policy, two doors, and only one of them told the browser
+            // it was allowed to read the answer.
+            const origin = typeof req.headers.origin === 'string' ? req.headers.origin : undefined;
             const rejection = verdictFor(deps.rejectionFor(req), tokenFromUrl(req.url), deps.token);
             if (rejection !== undefined) {
                 // The status carries the verdict the connection service actually gave, so a reader can tell a
                 // missing credential from a refused one rather than guessing from a generic failure.
-                send(res, rejection, { error: rejection === 401 ? 'unauthorized' : 'forbidden' });
+                send(res, rejection, { error: rejection === 401 ? 'unauthorized' : 'forbidden' }, origin);
+                return;
+            }
+            // A preflight is answered only after the verdict, never before it. Answering one unauthenticated
+            // would confirm the route's existence to a caller holding no capability at all.
+            if (req.method === 'OPTIONS') {
+                res.writeHead(204, headers(origin));
+                res.end();
                 return;
             }
             const entries = deps.journal.snapshot();
             // `size` and `oldestSeq` travel with the entries rather than being left for the reader to infer:
             // a truncated buffer and an idle one are the same empty-looking list otherwise, and the sequence
             // number is the only thing that separates "nothing happened" from "the buffer rolled over".
-            send(res, 200, { size: deps.journal.size, oldestSeq: deps.journal.oldestSeq, entries });
+            send(res, 200, { size: deps.journal.size, oldestSeq: deps.journal.oldestSeq, entries }, origin);
         },
     };
 }
+/**
+ * The headers every response from this route carries.
+ *
+ * `Access-Control-Allow-Origin` **reflects the caller's own origin** rather than naming one. The token is
+ * the authorisation here, not the origin: a request only reaches this point holding a capability that
+ * exists nowhere but the page the host injected it into, so echoing the origin grants nothing the token
+ * has not already granted — and it keeps the route readable from a profile whose page is served on some
+ * other scheme. `Vary: Origin`, because the header varies with the request and a cache that missed that
+ * would serve one origin's answer to another.
+ * @param origin - the request's `Origin`, when it sent one.
+ * @returns the response headers.
+ */
+function headers(origin) {
+    const built = {
+        'content-type': 'application/json',
+        'cache-control': 'no-store',
+        vary: 'Origin',
+    };
+    // Absent when the caller sent no origin — a command-line client needs no permission to read a response
+    // it was never going to have a browser apply a same-origin policy to.
+    if (origin !== undefined)
+        built['access-control-allow-origin'] = origin;
+    return built;
+}
 /**
  * Write one JSON response.
  *
@@ -58,9 +95,10 @@ export function diagnosticsRoute(deps) {
  * @param res - the response this handler owns.
  * @param status - HTTP status to write.
  * @param body - value to serialise as the JSON body.
+ * @param origin - the request's `Origin`, carried through so the answer is readable by whoever asked.
  */
-function send(res, status, body) {
-    res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+function send(res, status, body, origin) {
+    res.writeHead(status, headers(origin));
     res.end(JSON.stringify(body));
 }
 //# sourceMappingURL=diagnostics.js.map

package/lib/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AA8BzD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqB;IACpD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YACvF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,8FAA8F;gBAC9F,qFAAqF;gBACrF,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;gBACjF,OAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAA;YACvC,iGAAiG;YACjG,iGAAiG;YACjG,4FAA4F;YAC5F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;QACzF,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/B,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AA8BzD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqB;IACpD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpB,kGAAkG;YAClG,+FAA+F;YAC/F,mGAAmG;YACnG,iGAAiG;YACjG,qCAAqC;YACrC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YACtF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YACvF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,8FAA8F;gBAC9F,qFAAqF;gBACrF,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;gBACzF,OAAM;YACR,CAAC;YACD,iGAAiG;YACjG,gFAAgF;YAChF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;gBACnC,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAA;YACvC,iGAAiG;YACjG,iGAAiG;YACjG,4FAA4F;YAC5F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;QACjG,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,OAAO,CAAC,MAA0B;IACzC,MAAM,KAAK,GAA2B;QACpC,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU;QAC3B,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,uGAAuG;IACvG,sEAAsE;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAA;IACvE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAE,MAA0B;IAC1F,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACtC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-realtime-audio-ws",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "The host end of the client half's transport: a WebSocket upgrade route that bridges microphone audio in and agent speech out.",
   "type": "module",
   "main": "lib/index.js",

package/src/diagnostics.ts

@@ -67,22 +67,59 @@ export function diagnosticsRoute(deps: DiagnosticsDeps): DiagnosticsRoute {
     kind: 'exact',
     path: deps.path,
     handler: (req, res) => {
+      // The host's own page is cross-origin to loopback, and a browser discards a cross-origin response
+      // that carries no `Access-Control-Allow-Origin` — the request authenticates, the route answers
+      // 200, and the caller sees a CORS failure with no body. The WebSocket sibling is exempt from CORS,
+      // which is how this went unnoticed: one policy, two doors, and only one of them told the browser
+      // it was allowed to read the answer.
+      const origin = typeof req.headers.origin === 'string' ? req.headers.origin : undefined
       const rejection = verdictFor(deps.rejectionFor(req), tokenFromUrl(req.url), deps.token)
       if (rejection !== undefined) {
         // The status carries the verdict the connection service actually gave, so a reader can tell a
         // missing credential from a refused one rather than guessing from a generic failure.
-        send(res, rejection, { error: rejection === 401 ? 'unauthorized' : 'forbidden' })
+        send(res, rejection, { error: rejection === 401 ? 'unauthorized' : 'forbidden' }, origin)
+        return
+      }
+      // A preflight is answered only after the verdict, never before it. Answering one unauthenticated
+      // would confirm the route's existence to a caller holding no capability at all.
+      if (req.method === 'OPTIONS') {
+        res.writeHead(204, headers(origin))
+        res.end()
         return
       }
       const entries = deps.journal.snapshot()
       // `size` and `oldestSeq` travel with the entries rather than being left for the reader to infer:
       // a truncated buffer and an idle one are the same empty-looking list otherwise, and the sequence
       // number is the only thing that separates "nothing happened" from "the buffer rolled over".
-      send(res, 200, { size: deps.journal.size, oldestSeq: deps.journal.oldestSeq, entries })
+      send(res, 200, { size: deps.journal.size, oldestSeq: deps.journal.oldestSeq, entries }, origin)
     },
   }
 }
 
+/**
+ * The headers every response from this route carries.
+ *
+ * `Access-Control-Allow-Origin` **reflects the caller's own origin** rather than naming one. The token is
+ * the authorisation here, not the origin: a request only reaches this point holding a capability that
+ * exists nowhere but the page the host injected it into, so echoing the origin grants nothing the token
+ * has not already granted — and it keeps the route readable from a profile whose page is served on some
+ * other scheme. `Vary: Origin`, because the header varies with the request and a cache that missed that
+ * would serve one origin's answer to another.
+ * @param origin - the request's `Origin`, when it sent one.
+ * @returns the response headers.
+ */
+function headers(origin: string | undefined): Record<string, string> {
+  const built: Record<string, string> = {
+    'content-type': 'application/json',
+    'cache-control': 'no-store',
+    vary: 'Origin',
+  }
+  // Absent when the caller sent no origin — a command-line client needs no permission to read a response
+  // it was never going to have a browser apply a same-origin policy to.
+  if (origin !== undefined) built['access-control-allow-origin'] = origin
+  return built
+}
+
 /**
  * Write one JSON response.
  *
@@ -91,8 +128,9 @@ export function diagnosticsRoute(deps: DiagnosticsDeps): DiagnosticsRoute {
  * @param res - the response this handler owns.
  * @param status - HTTP status to write.
  * @param body - value to serialise as the JSON body.
+ * @param origin - the request's `Origin`, carried through so the answer is readable by whoever asked.
  */
-function send(res: ServerResponse, status: number, body: unknown): void {
-  res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' })
+function send(res: ServerResponse, status: number, body: unknown, origin: string | undefined): void {
+  res.writeHead(status, headers(origin))
   res.end(JSON.stringify(body))
 }