dsh-todo-time-log 0.5.2 → 0.6.0

package/README.md

@@ -9,7 +9,7 @@
 | 中文显示名 | 待办时间日志 |
 | 短别名 | `todo-time-log`、`ttl`（文档与工具前缀用；dsh 的 Entry / Slot / Tool 标识统一用包名） |
 | 数据文件 | `<DSH_PROFILE_DIR 或 ~/.dsh>/todo-time-log/todos.json`（可用环境变量或行配置覆盖） |
-| HTTP 接口 | `POST /api/dsh-todo-time-log/*` |
+| HTTP 接口 | `POST /api/dsh-todo-time-log/*`（**经宿主认证**：每条请求先过 `connection.requestRejection()`，无登录 cookie 返回 401、跨站/不可信来源返回 403） |
 | 智能体工具 | `todo_time_log`（action = list / get / create / complete / uncomplete / update / delete / health） |
 | UI 位置 | 中央面板 `main`（key = `dsh-todo-time-log`）+ 侧边栏图标 `sidebar.panellist`（id 同名，点击打开面板） |
 | 视图 | 四视图：**表格 / 看板 / 甘特图 / 日历**（甘特条 = 创建 → 完成，未完成延伸到「现在」；四视图内均可完成/编辑/删除） |
@@ -188,7 +188,15 @@ export function apply(ctx, config = {}) {
 
   mountOn(ctx, ['webServer'], (scope) => {        // 路由：供 UI 调用
     scope.effect(() => scope.webServer.register({
-      kind: 'prefix', path: ROUTE_PREFIX, handler: createHttpHandler(store),
+      kind: 'prefix', path: ROUTE_PREFIX,
+      handler: createHttpHandler(store, {
+        // 宿主认证：connection 缺失或抛错一律拒绝，不退回到 Host/Origin 自检
+        authorize: (req) => {
+          const connection = ctx.get('connection');
+          if (!connection) return 403;
+          return connection.requestRejection(req) ?? undefined;
+        },
+      }),
     }));
   });
 

package/lib/index.js

@@ -219,6 +219,9 @@ import { createFileIndex } from './files.js';
  * @property {() => string} [getWorkspaceRoot]
  * @property {string} [workspaceRoot]
  * @property {() => Array<{ path: string, title: string, source: string }>} [listWorkspaces]
+ * @property {(req: import('node:http').IncomingMessage) => number | undefined | null} [authorize]
+ *   Host admission check; `apply()` wires `connection.requestRejection()`. When
+ *   omitted (direct handler tests) every request is admitted.
  */
 
 export const name = 'dsh-todo-time-log';
@@ -1113,6 +1116,15 @@ export function createHttpHandler(store, options = {}) {
   const listWorkspaces = typeof options.listWorkspaces === 'function'
     ? options.listWorkspaces
     : () => [{ path: getWorkspaceRoot(), title: '', source: 'default' }];
+  /**
+   * Host admission check, supplied by `apply()` from the composition's
+   * `connection` service. It returns the HTTP status that rejects the request
+   * (`401`/`403`) or a falsy value when the caller is an authenticated Peer.
+   * Omitting it (tests that drive the handler directly) admits every request.
+   *
+   * @type {((req: import('node:http').IncomingMessage) => number | undefined | null) | null}
+   */
+  const authorize = typeof options.authorize === 'function' ? options.authorize : null;
   const resolveRequestRoot = (requested) => {
     const candidates = listWorkspaces();
     if (typeof requested !== 'string' || requested.trim() === '') {
@@ -1132,6 +1144,27 @@ export function createHttpHandler(store, options = {}) {
     return { root: match.path, candidates, error: null };
   };
   return async function handler(req, res) {
+    // Authenticate before touching any data: the routes below read and write
+    // the todo file and enumerate the workspace and live sessions, so they must
+    // stay behind the host's Host/Origin fence and login-token cookie.
+    if (authorize) {
+      let rejection;
+      try {
+        rejection = authorize(req);
+      } catch {
+        rejection = 403;
+      }
+      if (rejection) {
+        sendJson(res, rejection === 401 ? 401 : 403, {
+          ok: false,
+          error: {
+            code: rejection === 401 ? 'UNAUTHORIZED' : 'FORBIDDEN',
+            message: '请求未经 DSH 宿主认证（connection.requestRejection）',
+          },
+        });
+        return;
+      }
+    }
     let url;
     try {
       url = new URL(req.url ?? '/', 'http://127.0.0.1');
@@ -1394,6 +1427,15 @@ export function apply(ctx, config = {}) {
       fileIndex,
       getWorkspaceRoot,
       listWorkspaces: () => listWorkspaceCandidates(ctx, config),
+      // Host admission: the composition's `connection` service owns the
+      // Host/Origin fence and browser authentication. A missing or failing
+      // service rejects the request instead of falling back to a weaker check.
+      authorize: (req) => {
+        const connection = ctx.get('connection');
+        if (!connection || typeof connection.requestRejection !== 'function') return 403;
+        const rejection = connection.requestRejection(req);
+        return rejection === undefined || rejection === null ? undefined : rejection;
+      },
     }),
     }));
     logger.info(`routes mounted at ${ROUTE_PREFIX}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-todo-time-log",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "查看待办事项，并记录与展示每个待办的创建时间与完成时间（Todo time log for DeepSeek Harness）",
   "keywords": [
     "dsh",