signalk-siparu 0.2.1 → 0.2.2

package/README.md

@@ -111,6 +111,13 @@ commit, names each write route, and an eighth one fails the build.
 | `POST /voyages/:id/merge-previous` | Join this passage to the one before it, when one trip was recorded as two |
 | `POST /voyages/:id/undo-merge` | Separate a passage back into what it was made of |
 
+Those seven, and `GET /pair/status` with them, answer only requests that came from the
+boat's own screen. A browser marks every request with its origin, and one from a page on
+another site gets 403: on a server with security off, which is the default, an advert
+frame in any tab on the boat's network could otherwise unpair her or lift the pairing
+code off the helm. A caller with no browser headers, curl or a script on her own network,
+is not affected. Neither is the reading surface above.
+
 The two voyage edits are reachable from the boat's own network only. What the
 shore can ask her is a closed set of five questions, all of them reads
 (`history`, `snapshots`, `voyages`, `track`, `phases`); nothing on that socket

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signalk-siparu",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Kept aboard, proven ashore. An impartial, timestamped record of every voyage: position, wind, depth and logbook, written on the boat and readable from anywhere. A read-only Signal K plugin with a built-in dashboard.",
   "keywords": [
     "signalk-node-server-plugin",

package/plugin/dist/config-routes.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.allowConfigure = allowConfigure;
 exports.registerConfigRoutes = registerConfigRoutes;
 const pairing_1 = require("./pairing");
+const origin_guard_1 = require("./origin-guard");
 function allowConfigure(app, req) {
     try {
         const ss = app.securityStrategy;
@@ -43,7 +44,7 @@ function registerConfigRoutes(router, deps) {
     router.get('/config/fuel-paths', (_req, res) => {
         res.json(fuelPathsView());
     });
-    router.post('/config/fuel-paths', (req, res) => {
+    router.post('/config/fuel-paths', (0, origin_guard_1.sameOrigin)((req, res) => {
         if (!(0, pairing_1.securityOff)(app, req) && !allowConfigure(app, req)) {
             res.status(403).json({ error: 'admin_required' });
             return;
@@ -66,5 +67,5 @@ function registerConfigRoutes(router, deps) {
             if (!res.headersSent)
                 res.status(500).json({ error: 'internal' });
         });
-    });
+    }));
 }

package/plugin/dist/origin-guard.d.ts

@@ -0,0 +1,5 @@
+import type { Request, Response } from 'express';
+type Handler = (req: Request, res: Response) => void;
+export declare function crossSite(headers: Request['headers'] | undefined): boolean;
+export declare function sameOrigin(handler: Handler): Handler;
+export {};

package/plugin/dist/origin-guard.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.crossSite = crossSite;
+exports.sameOrigin = sameOrigin;
+function crossSite(headers) {
+    const site = header(headers, 'sec-fetch-site');
+    if (site) {
+        return site !== 'same-origin' && site !== 'none';
+    }
+    const origin = header(headers, 'origin');
+    if (!origin)
+        return false;
+    let named;
+    try {
+        named = new URL(origin).host;
+    }
+    catch {
+        return true;
+    }
+    return named !== header(headers, 'host');
+}
+function sameOrigin(handler) {
+    return (req, res) => {
+        if (crossSite(req.headers)) {
+            res.status(403).json({ error: 'cross_site' });
+            return;
+        }
+        handler(req, res);
+    };
+}
+function header(headers, name) {
+    const value = headers?.[name];
+    return typeof value === 'string' ? value.toLowerCase() : undefined;
+}

package/plugin/dist/pairing.js

@@ -6,6 +6,7 @@ exports.maskEmail = maskEmail;
 exports.registerPairRoutes = registerPairRoutes;
 exports.retryPendingUnlinks = retryPendingUnlinks;
 exports.__resetPairingState = __resetPairingState;
+const origin_guard_1 = require("./origin-guard");
 function securityOff(app, req) {
     try {
         const ss = app.securityStrategy;
@@ -68,6 +69,7 @@ async function relay(url, path, body, boatToken) {
     }
 }
 const NOT_YOUR_BOAT = 'That account does not own this boat. She is still linked as before.';
+const BOAT_LIMIT = 'That account already holds as many boats as its plan allows. Make room for her there, then pair again.';
 function maskEmail(email) {
     if (!email)
         return null;
@@ -85,7 +87,7 @@ function registerPairRoutes(router, deps) {
         pairedAt: remote.pairedAt,
         uplink: uplinkStatus() ?? undefined
     });
-    router.get('/pair/status', (req, res) => {
+    router.get('/pair/status', (0, origin_guard_1.sameOrigin)((req, res) => {
         const json = (screen) => {
             const status = { ...screen };
             if (securityOff(app, req))
@@ -139,8 +141,8 @@ function registerPairRoutes(router, deps) {
                 app.debug(`pair status: ${String(e)}`);
             }
         })();
-    });
-    router.post('/pair/start', (_req, res) => {
+    }));
+    router.post('/pair/start', (0, origin_guard_1.sameOrigin)((_req, res) => {
         void (async () => {
             lastError = null;
             try {
@@ -163,8 +165,8 @@ function registerPairRoutes(router, deps) {
                 res.status(502).json({ state: 'error', message: lastError });
             }
         })();
-    });
-    router.post('/pair/approve', (_req, res) => {
+    }));
+    router.post('/pair/approve', (0, origin_guard_1.sameOrigin)((_req, res) => {
         void (async () => {
             if (!deviceCode) {
                 res.status(409).json({ error: 'no_pairing_in_progress' });
@@ -194,17 +196,18 @@ function registerPairRoutes(router, deps) {
             }
             catch (e) {
                 app.error(`pair approve failed: ${String(e)}`);
-                const denied = e instanceof RelayRefused && e.code === 'not_your_boat';
-                if (denied)
+                const answered = e instanceof RelayRefused && (e.code === 'not_your_boat' || e.code === 'boat_limit');
+                if (answered)
                     deviceCode = userCode = expiresAt = null;
-                res.status(denied ? 409 : 502).json({
+                const message = e instanceof RelayRefused && e.code === 'boat_limit' ? BOAT_LIMIT : NOT_YOUR_BOAT;
+                res.status(answered ? 409 : 502).json({
                     state: 'error',
-                    message: denied ? NOT_YOUR_BOAT : 'Could not finish pairing. Try again.'
+                    message: answered ? message : 'Could not finish pairing. Try again.'
                 });
             }
         })();
-    });
-    router.post('/pair/deny', (_req, res) => {
+    }));
+    router.post('/pair/deny', (0, origin_guard_1.sameOrigin)((_req, res) => {
         void (async () => {
             if (deviceCode) {
                 await relay(relayUrl, '/pair/deny', { device_code: deviceCode }).catch(() => { });
@@ -213,8 +216,8 @@ function registerPairRoutes(router, deps) {
             const remote = getRemote();
             res.json(remote ? paired(remote) : { state: 'idle' });
         })();
-    });
-    router.post('/pair/reset', (_req, res) => {
+    }));
+    router.post('/pair/reset', (0, origin_guard_1.sameOrigin)((_req, res) => {
         void (async () => {
             const remote = getRemote();
             if (remote?.boatToken) {
@@ -240,7 +243,7 @@ function registerPairRoutes(router, deps) {
             if (!res.headersSent)
                 res.status(500).json({ state: 'error', message: 'Could not turn off remote viewing.' });
         });
-    });
+    }));
 }
 async function retryPendingUnlinks(relayUrl, getPending, clear, log) {
     for (const pending of getPending()) {

package/plugin/dist/voyage-routes.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerVoyageEditRoutes = registerVoyageEditRoutes;
 const pairing_1 = require("./pairing");
 const config_routes_1 = require("./config-routes");
+const origin_guard_1 = require("./origin-guard");
 const STATUS = {
     not_found: 404,
     no_previous: 409,
@@ -40,6 +41,6 @@ function registerVoyageEditRoutes(router, deps) {
             });
         };
     };
-    router.post('/voyages/:id/merge-previous', edit('merge-previous', mergeWithPrevious));
-    router.post('/voyages/:id/undo-merge', edit('undo-merge', undoMerge));
+    router.post('/voyages/:id/merge-previous', (0, origin_guard_1.sameOrigin)(edit('merge-previous', mergeWithPrevious)));
+    router.post('/voyages/:id/undo-merge', (0, origin_guard_1.sameOrigin)(edit('undo-merge', undoMerge)));
 }