levix-bot 2.1.1 → 2.1.2

package/app.cjs

@@ -41,11 +41,11 @@ function isAllowedOrigin(origin, host) {
 }
 
 // Browsers may legitimately serialize the Origin header as the literal string
-// "null" for a same-origin navigation in an opaque-origin context. Treating
-// that as a foreign origin breaks first-run/login forms in real browsers even
-// though Sec-Fetch-Site still proves the navigation is same-origin. Fetch
-// metadata headers are forbidden to page JavaScript, so they are a stronger
-// browser signal than trying to special-case the string "null" globally.
+// "null" for a same-origin navigation in an opaque-origin context. Prefer
+// Fetch Metadata when the browser sends it. Some Chromium form navigations omit
+// Sec-Fetch-Site entirely, so only the two credential-gated auth forms get a
+// narrow fallback for Origin:null; every other mutation remains strict.
+const OPAQUE_ORIGIN_AUTH_PATHS = new Set(["/setup", "/login"]);
 function isAllowedMutationRequest(req) {
   const origin = req.get("origin");
   const host = req.get("host");
@@ -58,6 +58,14 @@ function isAllowedMutationRequest(req) {
   if (fetchSite === "same-origin") return true;
   if (fetchSite === "cross-site") return false;
 
+  // Real Chromium can submit a top-level auth form with Origin:null and no
+  // Sec-Fetch-Site header. Setup is still protected by the one-time setup code
+  // for remote clients; login by the password; both share TCP-peer throttling.
+  // Do not generalize this exception to dashboard APIs or logout.
+  if (origin === "null" && !fetchSite && OPAQUE_ORIGIN_AUTH_PATHS.has(req.path)) {
+    return true;
+  }
+
   return isAllowedOrigin(origin, host);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "levix-bot",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "A self-hosted personal WhatsApp bot with an AI agent, group moderation and a web control panel.",
   "main": "src/index.js",
   "scripts": {