toga-ai 1.0.820 → 1.0.822

package/knowledge/2.0/apps/api2/architecture.md

@@ -6,7 +6,7 @@ project: API
 client: shared
 type: architecture
 status: active
-updated: 2026-09-01
+updated: 2026-09-16
 owners: [jcardinal, bala, mhammontree, dfranks]
 files:
   - api2/Controller/Index.php
@@ -63,7 +63,22 @@ lands in `api()`.
 ## Front controller — `Controller/Index.php`
 
 `api()` is the protocol router and the **transaction/logging boundary**:
-- **CORS:** permissive `Access-Control-Allow-*`; returns 200 for `OPTIONS` preflight.
+- **CORS (2026-09-16):** **reflects the caller's `Origin` header** back in
+  `Access-Control-Allow-Origin` when `$_SERVER['HTTP_ORIGIN']` is present and matches a strict
+  shape regex `^https?://[A-Za-z0-9.\-]+(:\d+)?$` (with the `D` end-anchor flag); otherwise it
+  falls back to `*`. It also emits `Vary: Origin`. This block sits **before** the `OPTIONS`
+  preflight short-circuit (still 200 for `OPTIONS`). The reflected value must be the **whole
+  origin — `scheme://host[:port]` (e.g. `http://compass.togacommerce`)** — because the browser
+  compares it byte-for-byte; do **not** strip the scheme or "clean" `HTTP_ORIGIN` (it is an
+  origin, not a URL with a path). Why: some higher-security client networks strip or reject a
+  wildcard `*`, so a client's app fails with a CORS "no Access-Control-Allow-Origin" error
+  **inside** their network while working fine outside it. **Security:** reflecting any
+  well-formed origin is effectively equivalent to `*` here because auth is **Bearer-token, never
+  cookies** — no new exposure; the regex is a strict allowlist that blocks header injection, and
+  PHP `header()` also rejects CR/LF. **`Access-Control-Allow-Credentials` is deliberately NOT set
+  — do NOT add it on top of this reflection without a cookie-auth security review; that
+  combination would be a cross-site data-theft hole.** `Vary: Origin` stops a shared cache
+  serving one origin's header to another.
 - **`/health`:** 200 + empty object (EB/LB probe — keep it working).
 - **Sentry:** initialized per request; EC2 instance metadata attached.
 - **Core DB bootstrap (now guarded, 2026-07-23):** registers `Core` (`DB_CORE`), preferring a
@@ -390,9 +405,15 @@ they are the known sharp edges. Do not re-discover these from scratch.
    `Core.Database` row (`id = CORE_LOGS_DATABASE_ID`); a local Logs DB whose actual schema name
    differs throws `Unknown database`. This is environment config, not a code bug — fix the row or
    the local schema name, don't patch the bootstrap.
-5. **CORS is fully permissive.** `Access-Control-Allow-*` is wide open on every route. Acceptable
-   only because auth is bearer-token (not cookie) based — if any cookie/session-backed auth is ever
-   added here, this becomes an exploitable hole and must be tightened first.
+5. **CORS reflects the caller's `Origin`, falling back to `*` (updated 2026-09-16).** The front
+   controller now echoes the request `Origin` into `Access-Control-Allow-Origin` when it matches a
+   strict shape regex, else falls back to `*`, and adds `Vary: Origin` (was a wide-open
+   `Access-Control-Allow-*`). Safe **only** because auth is Bearer-token, never cookie/session —
+   `Access-Control-Allow-Credentials` is intentionally **unset**, and reflecting the origin is
+   effectively equivalent to `*` here (no new exposure). It is a shape check, **not** a trusted-
+   origin allowlist — every well-formed Origin is reflected. If any cookie/session-backed auth is
+   ever added here, do not set credentials and re-tighten CORS to a real hardcoded allowlist first;
+   origin-reflection + credentials would be a cross-site data-theft hole.
 6. **`_underscore` is cloned at build from a moving branch** (`_<ENVIRONMENT>`), not pinned to a
    commit. Two deploys of the same api2 commit can produce different runtime behavior. Check the
    framework branch state when triaging an "it worked yesterday" regression.
@@ -446,6 +467,18 @@ they are the known sharp edges. Do not re-discover these from scratch.
   single-caller branches in `V2.php` as unverified until exercised directly.
 
 ## Change history
+- 2026-09-16 — **CORS now reflects the caller's `Origin`** instead of a wide-open
+  `Access-Control-Allow-*`: the front controller (`Controller/Index.php`, `_Controller_Index::api()`,
+  before the `OPTIONS` short-circuit) echoes the request `Origin` into `Access-Control-Allow-Origin`
+  when `HTTP_ORIGIN` matches `^https?://[A-Za-z0-9.\-]+(:\d+)?$` (`D` flag), else falls back to `*`,
+  and adds `Vary: Origin` (whole origin incl. scheme — browser compares byte-for-byte). Motivation:
+  some higher-security client networks strip/reject a wildcard `*`, so a client failed with a CORS
+  "no Access-Control-Allow-Origin" error inside their network while it worked outside. Retires Known
+  issue #5. `Access-Control-Allow-Credentials` deliberately **NOT** set (auth is Bearer-token, never
+  cookies — reflection is equivalent to `*` here with no new exposure; adding credentials on top
+  would be a cross-site data-theft hole and needs a cookie-auth review). Reviewed clean by
+  php-reviewer (valid PHP 8.2) and cso (SAFE TO SHIP). Note: the code change is a working-tree edit,
+  not yet committed. (jcardinal)
 - 2026-09-01 — Recorded a **sixth EB-`Degraded` cause — a client 4xx BURST**: EB Enhanced Health
   counts application/ELB 4xx toward env health via two default-Enabled `ConfigDocument` rules
   (`ApplicationRequests4xx`, `ELBRequests4xx`, namespace

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.820",
+  "version": "1.0.822",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",