okengine 0.1.4

package/src/runtime/primitives.ts

@@ -0,0 +1,242 @@
+/**
+ * WinterTC-aligned runtime primitives shared by adapters.
+ * Prefer `globalThis` Web APIs; fall back to host env only where the
+ * Minimum Common Web API has no answer (process env, filesystem).
+ */
+
+import type {
+  PasswordAlgorithm,
+  RuntimeCrypto,
+  RuntimeEnv,
+  RuntimeFiles,
+  RuntimeTimers,
+} from "./types.ts";
+
+/** HTML / WinterTC timers on `globalThis`. */
+export function createTimers(): RuntimeTimers {
+  return {
+    sleep(ms) {
+      return new Promise((resolve) => {
+        globalThis.setTimeout(resolve, ms);
+      });
+    },
+    setTimeout(fn, ms) {
+      return globalThis.setTimeout(fn, ms);
+    },
+    clearTimeout(id) {
+      globalThis.clearTimeout(id as ReturnType<typeof globalThis.setTimeout>);
+    },
+    setInterval(fn, ms) {
+      return globalThis.setInterval(fn, ms);
+    },
+    clearInterval(id) {
+      globalThis.clearInterval(id as ReturnType<typeof globalThis.setInterval>);
+    },
+    now() {
+      return globalThis.performance?.now?.() ?? Date.now();
+    },
+  };
+}
+
+/**
+ * Environment reader — Bun.env → process.env → Deno.env.
+ */
+export function createEnv(): RuntimeEnv {
+  return {
+    get(key) {
+      const bunEnv = (globalThis as { Bun?: { env?: Record<string, string | undefined> } })
+        .Bun?.env;
+      if (bunEnv && key in bunEnv) return bunEnv[key];
+      const proc = (globalThis as { process?: { env?: Record<string, string | undefined> } })
+        .process?.env;
+      if (proc && key in proc) return proc[key];
+      const deno = (
+        globalThis as {
+          Deno?: { env?: { get?(k: string): string | undefined } };
+        }
+      ).Deno?.env;
+      if (deno?.get) return deno.get(key);
+      return undefined;
+    },
+    has(key) {
+      return this.get(key) !== undefined;
+    },
+  };
+}
+
+/**
+ * Best-effort filesystem for adapters. Prefers `Bun.file`, then `node:fs`.
+ */
+export function createFiles(): RuntimeFiles {
+  return {
+    async read(path) {
+      const bun = (globalThis as { Bun?: { file?(p: string): { arrayBuffer(): Promise<ArrayBuffer> } } })
+        .Bun;
+      if (bun?.file) {
+        return new Uint8Array(await bun.file(path).arrayBuffer());
+      }
+      const fs = await import("node:fs/promises");
+      return new Uint8Array(await fs.readFile(path));
+    },
+    async write(path, data) {
+      const bun = (
+        globalThis as {
+          Bun?: {
+            write?(p: string, data: Uint8Array | string): Promise<number>;
+          };
+        }
+      ).Bun;
+      if (bun?.write) {
+        await bun.write(path, data);
+        return;
+      }
+      const fs = await import("node:fs/promises");
+      await fs.writeFile(path, data);
+    },
+    async exists(path) {
+      const bun = (globalThis as { Bun?: { file?(p: string): { exists(): Promise<boolean> } } })
+        .Bun;
+      if (bun?.file) {
+        return bun.file(path).exists();
+      }
+      const fs = await import("node:fs/promises");
+      try {
+        await fs.access(path);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+  };
+}
+
+/**
+ * Web Crypto base + PBKDF2 password helpers (web-standard path).
+ */
+export function createWebCrypto(): RuntimeCrypto {
+  const web = globalThis.crypto;
+  return {
+    subtle: web.subtle,
+    randomUUID() {
+      return web.randomUUID();
+    },
+    getRandomValues(array) {
+      return web.getRandomValues(array);
+    },
+    async hashPassword(password, algorithm = "pbkdf2") {
+      if (algorithm !== "pbkdf2") {
+        throw new Error(
+          `web-standard runtime supports only pbkdf2 passwords (got ${algorithm}); use the Bun adapter for argon2id/bcrypt`,
+        );
+      }
+      return hashPbkdf2(password);
+    },
+    async verifyPassword(password, hash) {
+      if (!hash.startsWith("pbkdf2$")) {
+        throw new Error(
+          "web-standard runtime can only verify pbkdf2$ hashes; use the Bun adapter for Bun.password hashes",
+        );
+      }
+      return verifyPbkdf2(password, hash);
+    },
+  };
+}
+
+/**
+ * Bun.password-backed crypto (argon2id / bcrypt) with Web Crypto for the rest.
+ */
+export function createBunCrypto(): RuntimeCrypto {
+  const web = globalThis.crypto;
+  return {
+    subtle: web.subtle,
+    randomUUID() {
+      return web.randomUUID();
+    },
+    getRandomValues(array) {
+      return web.getRandomValues(array);
+    },
+    async hashPassword(password, algorithm = "argon2id") {
+      if (algorithm === "pbkdf2") return hashPbkdf2(password);
+      const algo = algorithm === "bcrypt" ? "bcrypt" : "argon2id";
+      return Bun.password.hash(password, algo);
+    },
+    async verifyPassword(password, hash) {
+      if (hash.startsWith("pbkdf2$")) return verifyPbkdf2(password, hash);
+      return Bun.password.verify(password, hash);
+    },
+  };
+}
+
+/** Encode bytes as unpadded base64url. */
+function b64url(bytes: Uint8Array): string {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+/** Decode unpadded base64url. */
+function b64urlDecode(s: string): Uint8Array {
+  const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));
+  const bin = atob(padded + pad);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+const PBKDF2_ITERATIONS = 100_000;
+
+async function hashPbkdf2(password: string): Promise<string> {
+  const salt = globalThis.crypto.getRandomValues(new Uint8Array(16));
+  const key = await globalThis.crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"],
+  );
+  const bits = await globalThis.crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: PBKDF2_ITERATIONS,
+      hash: "SHA-256",
+    },
+    key,
+    256,
+  );
+  return `pbkdf2$${PBKDF2_ITERATIONS}$${b64url(salt)}$${b64url(new Uint8Array(bits))}`;
+}
+
+async function verifyPbkdf2(password: string, hash: string): Promise<boolean> {
+  const parts = hash.split("$");
+  if (parts.length !== 4 || parts[0] !== "pbkdf2") return false;
+  const iterations = Number(parts[1]);
+  const salt = Uint8Array.from(b64urlDecode(parts[2]!));
+  const expected = b64urlDecode(parts[3]!);
+  const key = await globalThis.crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"],
+  );
+  const bits = await globalThis.crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations,
+      hash: "SHA-256",
+    },
+    key,
+    expected.length * 8,
+  );
+  const actual = new Uint8Array(bits);
+  if (actual.length !== expected.length) return false;
+  let diff = 0;
+  for (let i = 0; i < actual.length; i++) diff |= actual[i]! ^ expected[i]!;
+  return diff === 0;
+}
+
+/** Re-export algorithm type for adapters. */
+export type { PasswordAlgorithm };

package/src/runtime/security.test.ts

@@ -0,0 +1,170 @@
+import { describe, expect, test } from "bun:test";
+import {
+  checkRequestSecurity,
+  isHostAllowed,
+  normalizeHost,
+  resolveAllowedHosts,
+  secureFetch,
+} from "./security.ts";
+
+describe("normalizeHost", () => {
+  test("strips port and lowercases", () => {
+    expect(normalizeHost("LocalHost:6530")).toBe("localhost");
+    expect(normalizeHost("APP.Example.COM")).toBe("app.example.com");
+  });
+
+  test("handles IPv6 bracket form", () => {
+    expect(normalizeHost("[::1]:6530")).toBe("::1");
+    expect(normalizeHost("[::1]")).toBe("::1");
+  });
+});
+
+describe("resolveAllowedHosts", () => {
+  test("always includes loopback and listen hostname", () => {
+    const hosts = resolveAllowedHosts("0.0.0.0", ["app.example.com"]);
+    expect(hosts.has("localhost")).toBe(true);
+    expect(hosts.has("127.0.0.1")).toBe(true);
+    expect(hosts.has("app.example.com")).toBe(true);
+    expect(hosts.has("0.0.0.0")).toBe(false);
+  });
+});
+
+describe("isHostAllowed", () => {
+  test("exact and leading-dot suffix", () => {
+    const allowed = new Set(["localhost", ".example.com"]);
+    expect(isHostAllowed("localhost", allowed)).toBe(true);
+    expect(isHostAllowed("a.example.com", allowed)).toBe(true);
+    expect(isHostAllowed("example.com", allowed)).toBe(true);
+    expect(isHostAllowed("attacker.com", allowed)).toBe(false);
+  });
+});
+
+describe("checkRequestSecurity", () => {
+  const allowed = resolveAllowedHosts("127.0.0.1", ["app.example.com"]);
+
+  test("accepts allowed Host", () => {
+    const req = new Request("http://127.0.0.1/ping", {
+      headers: { host: "127.0.0.1:6530" },
+    });
+    expect(checkRequestSecurity(req, allowed)).toEqual({ ok: true });
+  });
+
+  test("rejects unexpected Host (DNS rebinding class)", () => {
+    const req = new Request("http://attacker.com/ping", {
+      headers: { host: "attacker.com" },
+    });
+    expect(checkRequestSecurity(req, allowed)).toEqual({
+      ok: false,
+      reason: "host",
+    });
+  });
+
+  test("rejects missing Host", () => {
+    // Request from constructor may synthesize Host from URL — force empty
+    const bare = new Request("http://127.0.0.1/ping", {
+      headers: { host: "" },
+    });
+    expect(checkRequestSecurity(bare, allowed).ok).toBe(false);
+  });
+
+  test("rejects unexpected Origin", () => {
+    const req = new Request("http://127.0.0.1/ping", {
+      headers: {
+        host: "127.0.0.1",
+        origin: "http://attacker.com",
+      },
+    });
+    expect(checkRequestSecurity(req, allowed)).toEqual({
+      ok: false,
+      reason: "origin",
+    });
+  });
+
+  test("accepts Origin on an allowed host", () => {
+    const req = new Request("http://app.example.com/ping", {
+      headers: {
+        host: "app.example.com",
+        origin: "https://app.example.com",
+      },
+    });
+    expect(checkRequestSecurity(req, allowed)).toEqual({ ok: true });
+  });
+
+  test("rejects opaque null Origin", () => {
+    const req = new Request("http://127.0.0.1/ping", {
+      headers: { host: "127.0.0.1", origin: "null" },
+    });
+    expect(checkRequestSecurity(req, allowed)).toEqual({
+      ok: false,
+      reason: "origin",
+    });
+  });
+});
+
+describe("secureFetch", () => {
+  test("returns 403 before calling inner on bad Host", async () => {
+    let called = false;
+    const wrapped = secureFetch(
+      async () => {
+        called = true;
+        return new Response("ok");
+      },
+      undefined,
+      "127.0.0.1",
+    );
+    const res = await wrapped(
+      new Request("http://attacker.com/", {
+        headers: { host: "attacker.com" },
+      }),
+    );
+    expect(res.status).toBe(403);
+    expect(called).toBe(false);
+    expect(await res.text()).toContain("Host");
+  });
+});
+
+describe("Host/Origin entry points (6530 / 6533 / 6535)", () => {
+  test("every HTTP surface routes through checkRequestSecurity", async () => {
+    /**
+     * Entry-point map (source of truth for §10.1):
+     * - App :6530  → runtime/bun.ts + runtime/web-standard.ts → secureFetch
+     * - Console :6533 → console/server/serve.ts → secureFetch (HTTP)
+     *   and checkRequestSecurity before WebSocket upgrade on /console/live
+     * - MCP :6535 → mcp/server.ts → checkRequestSecurity (same primitive;
+     *   secureFetch is a thin wrapper around it)
+     */
+    const surfaces: ReadonlyArray<{
+      readonly file: string;
+      readonly mustInclude: readonly string[];
+    }> = [
+      {
+        file: `${import.meta.dir}/bun.ts`,
+        mustInclude: ["secureFetch"],
+      },
+      {
+        file: `${import.meta.dir}/web-standard.ts`,
+        mustInclude: ["secureFetch"],
+      },
+      {
+        file: `${import.meta.dir}/../console/server/serve.ts`,
+        mustInclude: ["secureFetch", "checkRequestSecurity"],
+      },
+      {
+        file: `${import.meta.dir}/../mcp/server.ts`,
+        mustInclude: ["checkRequestSecurity", "forbiddenResponse"],
+      },
+    ];
+
+    for (const surface of surfaces) {
+      const text = await Bun.file(surface.file).text();
+      for (const needle of surface.mustInclude) {
+        expect(text.includes(needle)).toBe(true);
+      }
+    }
+
+    // secureFetch is exclusively checkRequestSecurity + forbiddenResponse.
+    const security = await Bun.file(`${import.meta.dir}/security.ts`).text();
+    expect(security).toContain("checkRequestSecurity(request, allowed)");
+    expect(security).toContain("export function secureFetch");
+  });
+});

package/src/runtime/security.ts

@@ -0,0 +1,168 @@
+/**
+ * DNS-rebinding defence — Host and Origin validation (console §10.1).
+ *
+ * Mandatory and on by default for every served request on 6530 / 6533 / 6535.
+ * CVE-2025-66414 and the Vite Host-header flaw are the same class: without
+ * this check, a malicious site can reach a localhost server past the
+ * browser's same-origin policy.
+ */
+
+import type { ServeOptions } from "./types.ts";
+
+/** Loopback names always accepted alongside the listen hostname. */
+const LOOPBACK_HOSTS: readonly string[] = [
+  "localhost",
+  "127.0.0.1",
+  "::1",
+  "[::1]",
+];
+
+/**
+ * Build the effective allow-list: loopback + listen hostname + user extras.
+ *
+ * @param hostname - Listen hostname from {@link ServeOptions}
+ * @param extra - User-supplied `allowedHosts`
+ */
+export function resolveAllowedHosts(
+  hostname: string,
+  extra?: readonly string[],
+): ReadonlySet<string> {
+  const hosts = new Set<string>();
+  for (const h of LOOPBACK_HOSTS) hosts.add(h);
+  const listen = normalizeHost(hostname);
+  if (listen && listen !== "0.0.0.0" && listen !== "::" && listen !== "[::]") {
+    hosts.add(listen);
+  }
+  if (extra) {
+    for (const h of extra) {
+      const n = normalizeHost(h);
+      if (n) hosts.add(n);
+    }
+  }
+  return hosts;
+}
+
+/**
+ * Normalize a Host header value or hostname for comparison.
+ * Strips port, lowercases, keeps IPv6 bracket form as a sibling key.
+ *
+ * @param raw - Raw host or `host:port`
+ */
+export function normalizeHost(raw: string): string {
+  let host = raw.trim().toLowerCase();
+  if (host.length === 0) return "";
+
+  // IPv6 with port: "[::1]:6530"
+  if (host.startsWith("[")) {
+    const end = host.indexOf("]");
+    if (end !== -1) {
+      const bare = host.slice(1, end);
+      return bare;
+    }
+  }
+
+  // Strip :port for host:port (not IPv6)
+  const colon = host.lastIndexOf(":");
+  if (colon !== -1 && host.indexOf(":") === colon) {
+    host = host.slice(0, colon);
+  }
+  return host;
+}
+
+/**
+ * True when `host` is listed or matches a leading-dot suffix entry
+ * (Vite-style `allowedHosts`: `.example.com` allows `a.example.com`).
+ *
+ * @param host - Normalized host
+ * @param allowed - Allow-list
+ */
+export function isHostAllowed(
+  host: string,
+  allowed: ReadonlySet<string>,
+): boolean {
+  if (host.length === 0) return false;
+  if (allowed.has(host)) return true;
+  // Bracketed IPv6 sibling
+  if (allowed.has(`[${host}]`)) return true;
+  for (const entry of allowed) {
+    if (entry.startsWith(".") && (host === entry.slice(1) || host.endsWith(entry))) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/** Result of {@link checkRequestSecurity}. */
+export type SecurityCheck =
+  | { readonly ok: true }
+  | { readonly ok: false; readonly reason: "host" | "origin" };
+
+/**
+ * Validate Host (required) and Origin (when present) against `allowedHosts`.
+ *
+ * @param request - Incoming request
+ * @param allowedHosts - Effective allow-list
+ */
+export function checkRequestSecurity(
+  request: Request,
+  allowedHosts: ReadonlySet<string>,
+): SecurityCheck {
+  const hostHeader = request.headers.get("host");
+  if (hostHeader === null || hostHeader.trim().length === 0) {
+    return { ok: false, reason: "host" };
+  }
+  const host = normalizeHost(hostHeader);
+  if (!isHostAllowed(host, allowedHosts)) {
+    return { ok: false, reason: "host" };
+  }
+
+  const origin = request.headers.get("origin");
+  if (origin !== null && origin.length > 0) {
+    if (origin === "null") {
+      return { ok: false, reason: "origin" };
+    }
+    let originHost: string;
+    try {
+      originHost = normalizeHost(new URL(origin).host);
+    } catch {
+      return { ok: false, reason: "origin" };
+    }
+    if (!isHostAllowed(originHost, allowedHosts)) {
+      return { ok: false, reason: "origin" };
+    }
+  }
+
+  return { ok: true };
+}
+
+/** 403 body for a failed Host / Origin check. */
+export function forbiddenResponse(reason: "host" | "origin"): Response {
+  const message =
+    reason === "host"
+      ? "Forbidden: unexpected Host header"
+      : "Forbidden: unexpected Origin header";
+  return new Response(message, {
+    status: 403,
+    headers: { "content-type": "text/plain; charset=utf-8" },
+  });
+}
+
+/**
+ * Wrap a fetch handler with mandatory Host / Origin validation.
+ *
+ * @param inner - Downstream handler (usually `app.fetch`)
+ * @param options - Serve options (for `allowedHosts` + hostname)
+ * @param hostname - Resolved listen hostname
+ */
+export function secureFetch(
+  inner: (request: Request) => Response | Promise<Response>,
+  options: ServeOptions | undefined,
+  hostname: string,
+): (request: Request) => Promise<Response> {
+  const allowed = resolveAllowedHosts(hostname, options?.allowedHosts);
+  return async (request) => {
+    const check = checkRequestSecurity(request, allowed);
+    if (!check.ok) return forbiddenResponse(check.reason);
+    return inner(request);
+  };
+}