locadot 2.1.0 → 2.3.0

package/dist/index.js

@@ -44,8 +44,17 @@ program
     .description("HTTPS custom *.localhost domains for any local or remote upstream")
     .version(package_json_1.version)
     .helpOption("--help", "Display help for command");
-destinationOptions(program.command("add").description("Map a new domain to a port or URL").addOption(hostOption())).action(run((options) => commands_1.default.add(options)));
+destinationOptions(program.command("add").description("Map a new domain to a port or URL").addOption(hostOption()))
+    .option("--allow <addresses>", "Internal addresses shared visitors may reach through --cors, e.g. localhost:3000,localhost:4000")
+    .action(run((options) => commands_1.default.add(options)));
 destinationOptions(program.command("update").description("Change the destination of a mapped domain").addOption(hostOption())).action(run((options) => commands_1.default.update(options)));
+program
+    .command("allow [addresses...]")
+    .description("Let tunnel visitors and connected machines reach internal addresses (localhost:3000) through a --cors domain")
+    .addOption(hostOption())
+    .option("--rm", "Remove the given addresses instead of adding them")
+    .option("--clear", "Remove every allowed address")
+    .action(run((addresses, options) => commands_1.default.allow(addresses, options)));
 program
     .command("remove")
     .alias("rm")
@@ -74,8 +83,9 @@ program
     .action(run((host) => commands_1.default.open(host)));
 program
     .command("tunnel")
-    .description("Share a domain on a public https://*.trycloudflare.com URL (Cloudflare quick tunnel, no account); lists shared domains without --host")
+    .description("Share a domain on a public https://*.trycloudflare.com URL (Cloudflare quick tunnel, no account) or on your own hostname; lists shared domains without --host")
     .option("-h, --host <host>", "Domain to share, e.g. app.localhost")
+    .option("-d, --domain <hostname>", "Share on this hostname in your Cloudflare account (named tunnel), e.g. app.example.com")
     .option("--off", "Stop sharing it")
     .action(run((options) => commands_1.default.tunnel(options)));
 program.command("tunnel:install").description("Download cloudflared into the locadot state dir").action(run(() => commands_1.default.installTunnel()));
@@ -136,6 +146,10 @@ program
     .command("hub:localhost <onOrOff>")
     .description("Sender: let admin peers reach any port on this machine's localhost (on/off)")
     .action(run((value) => commands_1.default.hubLocalhost(value)));
+program
+    .command("hub:panel <onOrOff>")
+    .description("Sender: open this dashboard to browsers at the hub's public URL, behind the dashboard password (on/off)")
+    .action(run((value) => commands_1.default.hubPanel(value)));
 program
     .command("ui:password")
     .description("Set or reset the dashboard password (prompts; hashed with scrypt). The API token keeps working for scripts")

package/dist/lib/allow.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowMatches = exports.splitHost = exports.parseAllowList = exports.parseAllow = exports.MAX_ALLOW = void 0;
+const net_1 = __importDefault(require("net"));
+const guard_1 = require("../proxy/guard");
+const localhost_1 = require("./localhost");
+/**
+ * A mapping's `allow` list: internal addresses (`localhost:3000`, `api.internal`) that a tunnel visitor or hub peer
+ * may reach through that mapping's --cors pass-through. Everyone else stays limited to public hosts.
+ */
+exports.MAX_ALLOW = 32;
+const LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+const HOSTNAME = new RegExp(`^${LABEL}(?:\\.${LABEL})*$`);
+/** Loopback spellings (127.0.0.1, 0.0.0.0) all mean this machine, and the shim sends whichever the app wrote. */
+const canonicalHost = (host) => ((0, guard_1.isLoopbackHost)(host) && !host.endsWith(".localhost") ? "localhost" : host);
+const parseAllow = (value) => {
+    if (typeof value !== "string")
+        throw new localhost_1.InputError("❌ Each allowed address must be a string, e.g. localhost:3000.");
+    const raw = value.trim().toLowerCase();
+    const bare = raw.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/\/$/, "");
+    const match = bare.match(/^([^:/\s]+)(?::(\d{1,5}))?$/);
+    const port = match?.[2] === undefined ? undefined : Number(match[2]);
+    if (!match || !(net_1.default.isIPv4(match[1]) || HOSTNAME.test(match[1])) || (port !== undefined && (port < 1 || port > 65535))) {
+        throw new localhost_1.InputError(`❌ "${value}" isn't a host or host:port, e.g. localhost:3000 or api.internal.`);
+    }
+    const host = canonicalHost(match[1]);
+    return port === undefined ? host : `${host}:${port}`;
+};
+exports.parseAllow = parseAllow;
+/** Normalizes and de-duplicates; an empty list clears it. */
+const parseAllowList = (value) => {
+    const items = typeof value === "string" ? value.split(",").filter((item) => item.trim()) : value;
+    if (!Array.isArray(items))
+        throw new localhost_1.InputError("❌ `allow` must be a list of addresses, e.g. [\"localhost:3000\"].");
+    const list = [...new Set(items.map(exports.parseAllow))];
+    if (list.length > exports.MAX_ALLOW)
+        throw new localhost_1.InputError(`❌ At most ${exports.MAX_ALLOW} allowed addresses per mapping.`);
+    return list;
+};
+exports.parseAllowList = parseAllowList;
+const defaultPort = (scheme) => (scheme === "https" || scheme === "wss" ? 443 : 80);
+/** `host` from the pass-through URL (no brackets: parseVia only accepts names and IPv4). */
+const splitHost = (host, scheme) => {
+    const match = host.toLowerCase().match(/^(.*?)(?::(\d+))?$/);
+    return { host: canonicalHost(match[1].replace(/\.$/, "")), port: match[2] ? Number(match[2]) : defaultPort(scheme) };
+};
+exports.splitHost = splitHost;
+const allowMatches = (allow, host, scheme) => {
+    if (!allow?.length)
+        return false;
+    const target = (0, exports.splitHost)(host, scheme);
+    return allow.some((entry) => {
+        const [name, port] = entry.split(":");
+        return name === target.host && (port === undefined || Number(port) === target.port);
+    });
+};
+exports.allowMatches = allowMatches;

package/dist/lib/hosts.js

@@ -36,10 +36,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConflictError = exports.NotFoundError = void 0;
+exports.parseTunnelDomain = exports.ConflictError = exports.NotFoundError = void 0;
 const constants_1 = __importDefault(require("../constants"));
 const localhost_1 = __importStar(require("./localhost"));
 const registry_1 = __importDefault(require("./registry"));
+const allow_1 = require("./allow");
+const hub_config_1 = __importDefault(require("./hub-config"));
 class NotFoundError extends localhost_1.InputError {
 }
 exports.NotFoundError = NotFoundError;
@@ -53,17 +55,30 @@ const requireTarget = (value) => {
     }
     return localhost_1.default.parseTarget(String(value));
 };
+const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** A public hostname on the user's Cloudflare zone, e.g. app.example.com (scheme and trailing slash allowed). */
+const parseTunnelDomain = (value) => {
+    const domain = typeof value === "string" ? value.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/$/, "") : "";
+    const labels = domain.split(".");
+    const tld = labels[labels.length - 1];
+    if (domain.length > 253 || labels.length < 2 || tld === "localhost" || !/[a-z]/.test(tld) || !labels.every((label) => LABEL.test(label))) {
+        throw new localhost_1.InputError(`❌ "${value}" isn't a public hostname, e.g. app.example.com.`);
+    }
+    return domain;
+};
+exports.parseTunnelDomain = parseTunnelDomain;
 class HostOps {
     static async add(input) {
         const host = localhost_1.default.requireHost(input.host);
         const target = requireTarget(input.target);
+        const allow = input.allow === undefined ? [] : (0, allow_1.parseAllowList)(input.allow);
         const now = new Date().toISOString();
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (existing) {
                 throw new ConflictError(`❌ ${host} is already mapped to ${existing.target}. Use \`locadot update --host ${host} ...\` instead.`);
             }
-            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, createdAt: now, updatedAt: now };
+            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, allow: allow.length ? allow : undefined, createdAt: now, updatedAt: now };
             return registry.hosts[host];
         });
         return { host, entry };
@@ -71,24 +86,57 @@ class HostOps {
     static async update(input) {
         const host = localhost_1.default.requireHost(input.host);
         const target = requireTarget(input.target);
+        const allow = input.allow === undefined ? undefined : (0, allow_1.parseAllowList)(input.allow);
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (!existing)
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
             const insecure = input.insecure ?? existing.insecure;
             const cors = input.cors ?? existing.cors;
-            registry.hosts[host] = { ...existing, target, insecure: insecure || undefined, cors: cors || undefined, updatedAt: new Date().toISOString() };
+            const list = allow ?? existing.allow;
+            registry.hosts[host] = {
+                ...existing,
+                target,
+                insecure: insecure || undefined,
+                cors: cors || undefined,
+                allow: list?.length ? list : undefined,
+                updatedAt: new Date().toISOString(),
+            };
             return registry.hosts[host];
         });
         return { host, entry };
     }
+    /** Sharing on: `domain` shares on that hostname, none on a random trycloudflare.com URL. Sharing off keeps the hostname for next time. */
     static async setTunnel(input) {
         const host = localhost_1.default.requireHost(input.host);
+        const domain = input.tunnel && input.domain !== undefined && input.domain !== null && input.domain !== "" ? (0, exports.parseTunnelDomain)(input.domain) : undefined;
+        if (domain && hub_config_1.default.read()?.domain === domain)
+            throw new ConflictError(`❌ ${domain} is this machine's remote-access hostname.`);
+        const entry = await registry_1.default.mutate((registry) => {
+            const existing = registry.hosts[host];
+            if (!existing)
+                throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+            if (domain && existing.remote)
+                throw new localhost_1.InputError(`❌ ${host} is a remote's mapping; share it on a custom hostname from that machine.`);
+            const taken = domain && Object.entries(registry.hosts).find(([other, e]) => other !== host && e.tunnelDomain === domain)?.[0];
+            if (taken)
+                throw new ConflictError(`❌ ${domain} is already the shared hostname of ${taken}.`);
+            const tunnelDomain = input.tunnel ? domain : existing.tunnelDomain;
+            registry.hosts[host] = { ...existing, tunnel: input.tunnel || undefined, tunnelDomain, updatedAt: new Date().toISOString() };
+            return registry.hosts[host];
+        });
+        return { host, entry };
+    }
+    static async setAllow(input) {
+        const host = localhost_1.default.requireHost(input.host);
+        const allow = (0, allow_1.parseAllowList)(input.allow);
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (!existing)
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
-            registry.hosts[host] = { ...existing, tunnel: input.tunnel || undefined, updatedAt: new Date().toISOString() };
+            if (existing.remote)
+                throw new localhost_1.InputError(`❌ ${host} is a remote's mapping; set its allowed addresses on that machine.`);
+            registry.hosts[host] = { ...existing, allow: allow.length ? allow : undefined, updatedAt: new Date().toISOString() };
             return registry.hosts[host];
         });
         return { host, entry };

package/dist/lib/ui-auth.js

@@ -9,6 +9,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const constants_1 = __importDefault(require("../constants"));
 const file_1 = __importDefault(require("../utils/file"));
+const hub_config_1 = __importDefault(require("./hub-config"));
 exports.SESSION_COOKIE = "locadot_ui";
 exports.SESSION_TTL_SEC = 7 * 24 * 3600;
 exports.MIN_PASSWORD = 8;
@@ -68,6 +69,10 @@ class UiAuth {
     static clear() {
         file_1.default.remove("UI_AUTH_FILE");
         cache = undefined;
+        // The shared dashboard needs the password, so it doesn't come back on its own when a new one is set.
+        const hub = hub_config_1.default.read();
+        if (hub?.panel)
+            hub_config_1.default.write({ ...hub, panel: false });
     }
     static verify(password) {
         const data = UiAuth.read();

package/dist/proxy/guard.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.publicOnlyAgents = exports.isPublicHost = exports.isLoopbackHost = exports.isPublicAddress = void 0;
+exports.notSelfAgents = exports.isSelfAddress = exports.publicOnlyAgents = exports.isPublicHost = exports.isLoopbackHost = exports.isPublicAddress = void 0;
 const dns_1 = __importDefault(require("dns"));
 const http_1 = __importDefault(require("http"));
 const https_1 = __importDefault(require("https"));
 const net_1 = __importDefault(require("net"));
+const os_1 = __importDefault(require("os"));
 /**
  * Tunnel visitors are the internet. Their --cors pass-through calls may only leave this machine
  * for public addresses, never loopback, the LAN or cloud metadata.
@@ -93,3 +94,31 @@ exports.publicOnlyAgents = {
     http: new http_1.default.Agent({ keepAlive: true, lookup: publicLookup }),
     https: new https_1.default.Agent({ keepAlive: true, lookup: publicLookup }),
 };
+/** Loopback or one of this machine's own interface addresses (its LAN IP reaches the proxy just as well). */
+const isSelfAddress = (address) => {
+    if ((0, exports.isLoopbackHost)(address))
+        return true;
+    const own = Object.values(os_1.default.networkInterfaces()).flatMap((list) => (list || []).map((item) => item.address.toLowerCase()));
+    return own.includes(address.replace(/^\[|\]$/g, "").toLowerCase());
+};
+exports.isSelfAddress = isSelfAddress;
+// For an allowed address on the proxy's own port: whatever the name resolves to, it must not be this machine.
+const notSelfLookup = (hostname, options, callback) => {
+    dns_1.default.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err)
+            return callback(err, "", 0);
+        const allowed = addresses.filter((entry) => !(0, exports.isSelfAddress)(entry.address));
+        if (!allowed.length) {
+            const error = new Error(`${hostname} is this machine`);
+            error.code = "ESELF";
+            return callback(error, "", 0);
+        }
+        if (options.all)
+            return callback(null, allowed);
+        callback(null, allowed[0].address, allowed[0].family);
+    });
+};
+exports.notSelfAgents = {
+    http: new http_1.default.Agent({ keepAlive: true, lookup: notSelfLookup }),
+    https: new https_1.default.Agent({ keepAlive: true, lookup: notSelfLookup }),
+};

package/dist/proxy/hub.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetRateLimiter = void 0;
+exports.clientIp = exports.resetRateLimiter = void 0;
 exports.classify = classify;
 exports.handleHubApi = handleHubApi;
 const os_1 = __importDefault(require("os"));
@@ -45,6 +45,7 @@ const logger_1 = __importDefault(require("../utils/logger"));
 const links_1 = __importStar(require("../lib/links"));
 const hosts_1 = __importStar(require("../lib/hosts"));
 const hub_config_1 = __importDefault(require("../lib/hub-config"));
+const ui_auth_1 = __importDefault(require("../lib/ui-auth"));
 const localhost_1 = __importStar(require("../lib/localhost"));
 const registry_1 = require("../lib/registry");
 const request_1 = require("./request");
@@ -80,6 +81,7 @@ const clientIp = (req) => {
     const value = Array.isArray(header) ? header[0] : header;
     return value || req.socket.remoteAddress || "unknown";
 };
+exports.clientIp = clientIp;
 /** `X-Original-Host` from the receiver, only if it is a `*.localhost` name with an optional port. */
 const receiverHost = (req) => {
     const header = req.headers["x-original-host"];
@@ -137,7 +139,13 @@ function classify(req, publicHost, hosts, opts) {
     const pathname = (req.url || "/").split("?")[0];
     if (pathname === "/_locadot" || pathname.startsWith("/_locadot/"))
         return { kind: "api" };
-    const ip = clientIp(req);
+    // Peers always send X-Locadot-Peer; a plain browser gets the shared dashboard, which has its own sign-in limiter.
+    if (opts?.panel && req.headers["x-locadot-peer"] === undefined) {
+        if (!ui_auth_1.default.enabled())
+            return { kind: "deny", status: 403, message: "Set a dashboard password to share the dashboard." };
+        return { kind: "panel" };
+    }
+    const ip = (0, exports.clientIp)(req);
     if (isLimited(ip))
         return { kind: "deny", status: 429, message: "Too many failed attempts. Try again later." };
     // Not Authorization: the sender's own apps may need that header from the visitor.
@@ -269,7 +277,7 @@ async function handleHubApi(req, res, ctx) {
     const url = new URL(req.url || "/", "http://hub.invalid");
     const path = url.pathname;
     const method = req.method || "GET";
-    const ip = clientIp(req);
+    const ip = (0, exports.clientIp)(req);
     try {
         if (path === "/_locadot/v1/connect" && method === "POST") {
             const body = await readJson(req);

package/dist/proxy/options.js

@@ -22,14 +22,22 @@ const proxyOptions = (req, entry, lookup) => ({
     headers: { "X-Original-Host": req.headers.host || "", ...(entry.cors ? { ...(0, cors_1.sameOriginHeaders)(req, entry, lookup), ...DECODABLE } : {}) },
 });
 exports.proxyOptions = proxyOptions;
-const viaOptions = (req, entry, via) => ({
+const agentFor = (req, via, listed) => {
+    const tls = via.scheme === "https" || via.scheme === "wss";
+    if (listed === "not-self")
+        return { agent: tls ? guard_1.notSelfAgents.https : guard_1.notSelfAgents.http };
+    if ((0, request_1.fromTunnel)(req) && !listed)
+        return { agent: tls ? guard_1.publicOnlyAgents.https : guard_1.publicOnlyAgents.http };
+    return {};
+};
+const viaOptions = (req, entry, via, listed) => ({
     target: (0, exports.viaOrigin)(via),
     changeOrigin: true,
     ws: true,
     secure: !entry.insecure,
     cookieDomainRewrite: { "*": "" },
     headers: { ...(0, passthrough_1.viaHeaders)(req, via, entry.target), ...DECODABLE },
-    ...((0, request_1.fromTunnel)(req) ? { agent: via.scheme === "https" || via.scheme === "wss" ? guard_1.publicOnlyAgents.https : guard_1.publicOnlyAgents.http } : {}),
+    ...agentFor(req, via, listed),
 });
 exports.viaOptions = viaOptions;
 const viaOrigin = (via) => `${via.scheme}://${via.host}`;

package/dist/proxy/request.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTls = exports.viaOf = exports.loopbackOf = exports.peerNamesOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
+exports.isTls = exports.viaOf = exports.loopbackOf = exports.peerNamesOf = exports.peerOriginOf = exports.isPanel = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
 const tags = new WeakMap();
 const tag = (req, values) => {
     tags.set(req, { ...tags.get(req), ...values });
@@ -21,6 +21,8 @@ const fromTunnel = (req) => Boolean(tags.get(req)?.tunnel);
 exports.fromTunnel = fromTunnel;
 const fromRemote = (req) => Boolean(tags.get(req)?.remote);
 exports.fromRemote = fromRemote;
+const isPanel = (req) => Boolean(tags.get(req)?.panel);
+exports.isPanel = isPanel;
 const peerOriginOf = (req) => tags.get(req)?.peerOrigin;
 exports.peerOriginOf = peerOriginOf;
 const peerNamesOf = (req) => tags.get(req)?.peerNames;

package/dist/proxy/router.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleRequest = handleRequest;
 exports.handleUpgrade = handleUpgrade;
 const http_1 = __importDefault(require("http"));
+const net_1 = __importDefault(require("net"));
 const template_1 = require("../constants/template");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
@@ -14,15 +15,22 @@ const remote_1 = require("./remote");
 const cors_1 = require("./cors");
 const options_1 = require("./options");
 const guard_1 = require("./guard");
+const allow_1 = require("../lib/allow");
 const passthrough_1 = require("./passthrough");
 const request_1 = require("./request");
 const stats_1 = require("./stats");
+// Cloudflare swaps an origin's 502/504 for its own "bad gateway" page, so through a tunnel say 503 and the page survives.
+const downStatus = (req) => ((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req) ? 503 : 502);
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
 const resolveHost = (req, ctx, hub) => {
     if (hub?.kind === "app") {
         (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names, loopback: hub.loopback });
         return hub.host;
     }
+    if (hub?.kind === "panel") {
+        (0, request_1.tag)(req, { host: "localhost", remote: true, secure: ctx.hub.secure(), peerOrigin: (req.headers.host || "").toLowerCase(), panel: true });
+        return "localhost";
+    }
     if (hub?.kind === "dashboard") {
         (0, request_1.tag)(req, { host: "localhost", remote: true, secure: ctx.hub.secure(), peerOrigin: hub.origin });
         return "localhost";
@@ -49,8 +57,23 @@ const peerMayReach = (req, via) => {
     const port = Number(via.host.match(/:(\d+)$/)?.[1] || (via.scheme === "https" || via.scheme === "wss" ? 443 : 80));
     return Boolean(allowed && !allowed.includes(port));
 };
-/** Same-origin only, a tunnel visitor may only reach public hosts (see guard.ts), and a peer only its share of localhost. */
-const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host)) && peerMayReach(req, via);
+/**
+ * An address on the mapping's `allow` list. The proxy's own ports on this machine never are (the dashboard is behind
+ * them): "not-self" means the name must be checked at connect time, on the address actually dialled.
+ */
+const listed = (req, ctx, entry, via) => {
+    if (!((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req)) || !(0, allow_1.allowMatches)(entry.allow, via.host, via.scheme))
+        return undefined;
+    const { host, port } = (0, allow_1.splitHost)(via.host, via.scheme);
+    if (!(ctx.ownPorts?.() ?? []).includes(port))
+        return "open";
+    return (0, guard_1.isSelfAddress)(host) ? undefined : net_1.default.isIP(host) ? "open" : "not-self";
+};
+/**
+ * Same-origin only, a tunnel visitor may only reach public hosts (see guard.ts), and a peer only its share of localhost,
+ * unless the mapping's owner listed the address in `allow`.
+ */
+const viaAllowed = (req, via, allowed) => (0, passthrough_1.isSameOrigin)(req) && (Boolean(allowed) || ((!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host)) && peerMayReach(req, via)));
 /**
  * Receiver side: `<sender host>=<our URL for it>` for every mapping of this remote, so a --cors sender rewrites
  * its apps' origins to the names this machine uses rather than its own.
@@ -110,7 +133,7 @@ function handleRequest(req, res, ctx) {
                 forwardLocal(req, res, ctx, host, local);
                 return;
             }
-            res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+            res.writeHead(downStatus(req), { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
             res.end((0, template_1.proxyNotFound)(host, dashboardUrl(req)));
             return;
         }
@@ -130,9 +153,11 @@ function handleRequest(req, res, ctx) {
             return;
         }
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
-        if (via && !viaAllowed(req, via)) {
+        const allowed = via && listed(req, ctx, entry, via);
+        if (via && !viaAllowed(req, via, allowed)) {
             res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
-            res.end("locadot: the pass-through only serves the page's own requests, and only public hosts through a tunnel.\n");
+            res.end(`locadot: the pass-through only serves the page's own requests, and only public hosts to shared visitors. ` +
+                `To let them reach ${via.host}, run \`locadot allow --host ${host} ${via.host}\` on this machine, or use Internal access on the mapping in the dashboard.\n`);
             return;
         }
         const started = Date.now();
@@ -142,7 +167,7 @@ function handleRequest(req, res, ctx) {
         let options = (0, options_1.proxyOptions)(req, entry, ctx.lookup);
         if (via) {
             (0, request_1.tag)(req, { via });
-            options = (0, options_1.viaOptions)(req, entry, via);
+            options = (0, options_1.viaOptions)(req, entry, via, allowed);
             req.url = via.path;
         }
         const upstream = via ? (0, options_1.viaOrigin)(via) : entry.target;
@@ -152,8 +177,8 @@ function handleRequest(req, res, ctx) {
                 res.destroy();
                 return;
             }
-            // With --cors the page should see a 502, not a CORS error.
-            res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", ...(entry.cors ? (0, cors_1.allowOrigin)(req) : {}) });
+            // With --cors the page should see the error, not a CORS failure.
+            res.writeHead(downStatus(req), { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", ...(entry.cors ? (0, cors_1.allowOrigin)(req) : {}) });
             res.end((0, template_1.upstreamDown)(host, upstream, reason(err) || "error", dashboardUrl(req)));
         });
     }
@@ -207,13 +232,13 @@ function forwardLocal(req, res, ctx, host, local) {
             res.destroy();
             return;
         }
-        html(res, 502, (0, template_1.upstreamDown)(host, label, reason(err) || "error", dashboardUrl(req)));
+        html(res, downStatus(req), (0, template_1.upstreamDown)(host, label, reason(err) || "error", dashboardUrl(req)));
     });
 }
 function handleUpgrade(req, socket, head, ctx) {
     socket.on("error", () => socket.destroy());
     const hub = ctx.hub?.classify(req);
-    if (hub?.kind === "api" || hub?.kind === "deny") {
+    if (hub?.kind === "api" || hub?.kind === "deny" || hub?.kind === "panel") {
         const status = hub.kind === "deny" ? hub.status : 400;
         socket.end(`HTTP/1.1 ${status} ${http_1.default.STATUS_CODES[status] || "Error"}\r\nConnection: close\r\n\r\n`);
         return;
@@ -246,14 +271,15 @@ function handleUpgrade(req, socket, head, ctx) {
             return;
         }
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
-        if (via && !viaAllowed(req, via)) {
+        const allowed = via && listed(req, ctx, entry, via);
+        if (via && !viaAllowed(req, via, allowed)) {
             socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
             return;
         }
         logger_1.default.debug(`WebSocket upgrade for ${host}`);
         let options = (0, options_1.proxyOptions)(req, entry, ctx.lookup);
         if (via) {
-            options = (0, options_1.viaOptions)(req, entry, via);
+            options = (0, options_1.viaOptions)(req, entry, via, allowed);
             req.url = via.path;
         }
         ctx.proxy.ws(req, socket, head, options, (err) => {