ijihun-planner-studio 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ijihun-planner-studio",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "A local owner-only timebox and Mandarart planner with Apple Reminders and Google Tasks bridge support.",
   "type": "module",
   "bin": {

package/server.mjs

@@ -45,7 +45,7 @@ const trustedOrigins = new Set([
     .split(",")
     .map((item) => item.trim())
     .filter(Boolean)
-]);
+].map(normalizeOrigin).filter(Boolean));
 
 const mimeTypes = {
   ".html": "text/html; charset=utf-8",
@@ -118,6 +118,34 @@ function sendJson(res, status, payload, headers = {}) {
   res.end(JSON.stringify(payload, null, 2));
 }
 
+function corsHeaders(req) {
+  const origin = req.headers.origin;
+  if (!origin || !originAllowed(req)) return {};
+  const requestedHeaders = String(req.headers["access-control-request-headers"] || "").trim();
+  const requestedMethod = String(req.headers["access-control-request-method"] || "").trim();
+  return {
+    "access-control-allow-origin": origin,
+    "access-control-allow-credentials": "true",
+    "access-control-allow-methods": requestedMethod || "GET,HEAD,POST,OPTIONS",
+    "access-control-allow-headers": requestedHeaders || "content-type,x-csrf-token",
+    "vary": "Origin"
+  };
+}
+
+function sendCorsPreflight(req, res) {
+  const headers = corsHeaders(req);
+  if (!Object.keys(headers).length) {
+    logOriginBlocked(req, "preflight");
+    sendJson(res, 403, { ok: false, error: "Origin not allowed" });
+    return;
+  }
+  res.writeHead(204, securityHeaders({
+    "cache-control": "no-store",
+    ...headers
+  }));
+  res.end();
+}
+
 function redirect(res, location) {
   res.writeHead(303, securityHeaders({
     location,
@@ -126,6 +154,15 @@ function redirect(res, location) {
   res.end();
 }
 
+function permanentRedirect(res, location) {
+  res.writeHead(301, securityHeaders({
+    location,
+    "content-type": "text/plain; charset=utf-8",
+    "cache-control": "no-store"
+  }));
+  res.end("Moved Permanently");
+}
+
 function runFile(command, commandArgs, options = {}) {
   return new Promise((resolveRun, rejectRun) => {
     const child = execFile(command, commandArgs, {
@@ -316,14 +353,70 @@ function acceptsJson(req) {
   return String(req.headers.accept || "").includes("application/json");
 }
 
+function acceptsHtml(req) {
+  const accept = String(req.headers.accept || "");
+  return accept.includes("text/html") && !acceptsJson(req);
+}
+
 function isUnsafeMethod(method) {
   return !["GET", "HEAD", "OPTIONS"].includes(method || "GET");
 }
 
-function originAllowed(req) {
+function originAllowed(req, options = {}) {
   const origin = req.headers.origin;
   if (!origin) return true;
-  return trustedOrigins.has(origin);
+  const normalized = normalizeOrigin(origin);
+  if (!normalized) {
+    return Boolean(
+      options.allowNullOrigin
+      && String(origin).trim() === "null"
+      && trustedOrigins.has(requestOrigin(req))
+    );
+  }
+  return trustedOrigins.has(normalized) || normalized === requestOrigin(req);
+}
+
+function logOriginBlocked(req, route) {
+  const origin = String(req.headers.origin || "");
+  console.warn(JSON.stringify({
+    event: "origin_blocked",
+    route,
+    method: req.method,
+    origin,
+    normalizedOrigin: normalizeOrigin(origin),
+    requestOrigin: requestOrigin(req),
+    host: req.headers.host || "",
+    forwardedHost: req.headers["x-forwarded-host"] || "",
+    forwardedProto: req.headers["x-forwarded-proto"] || ""
+  }));
+}
+
+function normalizeOrigin(value) {
+  try {
+    return new URL(String(value).trim()).origin;
+  } catch {
+    return "";
+  }
+}
+
+function requestOrigin(req) {
+  const host = String(req.headers["x-forwarded-host"] || req.headers.host || "").split(",")[0].trim();
+  if (!host) return "";
+  const proto = String(req.headers["x-forwarded-proto"] || "").split(",")[0].trim() || "http";
+  return normalizeOrigin(`${proto}://${host}`);
+}
+
+function shouldRedirectToHttps(req) {
+  const host = String(req.headers["x-forwarded-host"] || req.headers.host || "").split(",")[0].trim().toLowerCase();
+  if (host !== "planner.ljihun.store") return false;
+  const proto = String(req.headers["x-forwarded-proto"] || "").split(",")[0].trim().toLowerCase();
+  if (proto === "http") return true;
+  return String(req.headers["cf-visitor"] || "").includes('"scheme":"http"');
+}
+
+function redirectToHttps(req, res) {
+  const host = String(req.headers["x-forwarded-host"] || req.headers.host || "planner.ljihun.store").split(",")[0].trim();
+  permanentRedirect(res, `https://${host}${req.url || "/"}`);
 }
 
 function csrfAllowed(req, session) {
@@ -420,8 +513,13 @@ function sendAuthCss(res) {
 }
 
 async function handleAuth(req, res, url) {
+  if ((req.method === "GET" || req.method === "HEAD") && url.pathname === "/api/auth/login" && acceptsHtml(req)) {
+    redirect(res, "/login");
+    return true;
+  }
+
   if (req.method === "GET" && url.pathname === "/api/auth/session") {
-    sendJson(res, 200, sessionPayload(getSession(req)));
+    sendJson(res, 200, sessionPayload(getSession(req)), corsHeaders(req));
     return true;
   }
 
@@ -429,11 +527,13 @@ async function handleAuth(req, res, url) {
     const formLogin = String(req.headers["content-type"] || "").startsWith("application/x-www-form-urlencoded");
     if (!authConfigured) {
       if (formLogin) redirect(res, "/login?error=1");
-      else sendJson(res, 503, { ok: false, error: "Owner authentication is not configured" });
+      else sendJson(res, 503, { ok: false, error: "Owner authentication is not configured" }, corsHeaders(req));
       return true;
     }
-    if (!originAllowed(req)) {
-      sendJson(res, 403, { ok: false, error: "Origin not allowed" });
+    if (!originAllowed(req, { allowNullOrigin: formLogin })) {
+      logOriginBlocked(req, url.pathname);
+      if (formLogin) redirect(res, "/login?error=1");
+      else sendJson(res, 403, { ok: false, error: "Origin not allowed" }, corsHeaders(req));
       return true;
     }
 
@@ -442,7 +542,7 @@ async function handleAuth(req, res, url) {
     const password = String(payload.password || "");
     if (isLockedOut(req, email)) {
       if (formLogin) redirect(res, "/login?locked=1");
-      else sendJson(res, 429, { ok: false, error: "Too many login attempts" });
+      else sendJson(res, 429, { ok: false, error: "Too many login attempts" }, corsHeaders(req));
       return true;
     }
 
@@ -450,25 +550,25 @@ async function handleAuth(req, res, url) {
     if (!ok) {
       recordLoginFailure(req, email || ownerEmail);
       if (formLogin) redirect(res, "/login?error=1");
-      else sendJson(res, 401, { ok: false, error: "Invalid credentials" });
+      else sendJson(res, 401, { ok: false, error: "Invalid credentials" }, corsHeaders(req));
       return true;
     }
 
     clearLoginFailures(req, email);
     const session = createSession(res);
     if (formLogin) redirect(res, "/");
-    else sendJson(res, 200, sessionPayload(session));
+    else sendJson(res, 200, sessionPayload(session), corsHeaders(req));
     return true;
   }
 
   if (req.method === "POST" && url.pathname === "/api/auth/logout") {
     const session = getSession(req);
     if (session && !csrfAllowed(req, session)) {
-      sendJson(res, 403, { ok: false, error: "CSRF token required" });
+      sendJson(res, 403, { ok: false, error: "CSRF token required" }, corsHeaders(req));
       return true;
     }
     clearSession(req, res);
-    sendJson(res, 200, { ok: true });
+    sendJson(res, 200, { ok: true }, corsHeaders(req));
     return true;
   }
 
@@ -485,7 +585,8 @@ async function handleApi(req, res, url) {
       return;
     }
     if (!originAllowed(req)) {
-      sendJson(res, 403, { ok: false, error: "Origin not allowed" });
+      logOriginBlocked(req, url.pathname);
+      sendJson(res, 403, { ok: false, error: "Origin not allowed" }, corsHeaders(req));
       return;
     }
     if (!csrfAllowed(req, session)) {
@@ -617,6 +718,11 @@ const server = createServer(async (req, res) => {
 
   const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
 
+  if (shouldRedirectToHttps(req)) {
+    redirectToHttps(req, res);
+    return;
+  }
+
   if (req.method === "GET" && url.pathname === "/login") {
     sendLoginPage(req, res, url);
     return;
@@ -625,6 +731,10 @@ const server = createServer(async (req, res) => {
     sendAuthCss(res);
     return;
   }
+  if (req.method === "OPTIONS" && url.pathname.startsWith("/api/")) {
+    sendCorsPreflight(req, res);
+    return;
+  }
   if (url.pathname.startsWith("/api/")) {
     await handleApi(req, res, url);
     return;