geonix 1.35.0 → 1.35.1

package/README.md

@@ -298,6 +298,7 @@ Each returned part has:
 | `GX_HEALTH_TIMEOUT` | `2000` | Registry health-probe timeout per advertised address (ms) |
 | `GX_SECRET` | — | Encryption key: AES-256-GCM payloads + HMAC-SHA256 subjects. Services without the same key cannot communicate. |
 | `GX_DEBUG_ENDPOINT` | — | Mount path for the debug router (e.g. `/_debug`). Disabled when unset. |
+| `GX_DEBUG_ENDPOINT_AUTH` | — | Basic-auth credentials for the debug router as `username:password`. When set, all debug routes (and the UI) require `Authorization: Basic …`. OPTIONS requests bypass to keep CORS preflight working. |
 
 ## Local transport (`GX_TRANSPORT=local://`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "geonix",
-    "version": "1.35.0",
+    "version": "1.35.1",
     "type": "module",
     "description": "",
     "bin": {

package/src/Gateway.js

@@ -10,6 +10,7 @@ import { logger } from "./Logger.js";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
+import { timingSafeEqual } from "node:crypto";
 
 const DEBUG_HTML = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "debug.html"), "utf8");
 
@@ -342,6 +343,39 @@ export class Gateway {
     #debugRouter() {
         const router = Router();
 
+        // Basic Auth gate: when GX_DEBUG_ENDPOINT_AUTH is set as "user:pass", all
+        // debug routes require a matching Authorization: Basic <base64> header.
+        // OPTIONS preflight bypasses so cross-origin CORS still works.
+        router.use((req, res, next) => {
+            const expected = process.env.GX_DEBUG_ENDPOINT_AUTH;
+            if (!expected) {
+                return next();
+            }
+            if (req.method === "OPTIONS") {
+                return next();
+            }
+            const challenge = (msg) => {
+                res.set("WWW-Authenticate", 'Basic realm="Geonix Debug", charset="UTF-8"');
+                res.status(401).json({ error: msg });
+            };
+            const header = req.headers.authorization;
+            if (!header || !header.startsWith("Basic ")) {
+                return challenge("authentication required");
+            }
+            let provided;
+            try {
+                provided = Buffer.from(header.slice(6).trim(), "base64").toString("utf8");
+            } catch {
+                return challenge("invalid Authorization header");
+            }
+            const a = Buffer.from(expected);
+            const b = Buffer.from(provided);
+            if (a.length !== b.length || !timingSafeEqual(a, b)) {
+                return challenge("invalid credentials");
+            }
+            next();
+        });
+
         router.use((req, res, next) => {
             stats.debug_requests++;