toga-ai 1.0.821 → 1.0.822

package/knowledge/2.0/apps/api2/architecture.md

@@ -64,12 +64,21 @@ lands in `api()`.
 
 `api()` is the protocol router and the **transaction/logging boundary**:
 - **CORS (2026-09-16):** **reflects the caller's `Origin` header** back in
-  `Access-Control-Allow-Origin` (per-request echo) instead of a wide-open `*`, and sends
-  `Access-Control-Allow-Credentials: true`; still returns 200 for the `OPTIONS` preflight. A
-  wildcard `*` cannot be combined with credentialed requests, so echoing the Origin is what lets
-  a future cookie/session flow work without reopening the hole — but it is **not** an allowlist:
-  every Origin is still reflected. Tighten to a real allowlist before adding any cookie/session
-  auth here.
+  `Access-Control-Allow-Origin` when `$_SERVER['HTTP_ORIGIN']` is present and matches a strict
+  shape regex `^https?://[A-Za-z0-9.\-]+(:\d+)?$` (with the `D` end-anchor flag); otherwise it
+  falls back to `*`. It also emits `Vary: Origin`. This block sits **before** the `OPTIONS`
+  preflight short-circuit (still 200 for `OPTIONS`). The reflected value must be the **whole
+  origin — `scheme://host[:port]` (e.g. `http://compass.togacommerce`)** — because the browser
+  compares it byte-for-byte; do **not** strip the scheme or "clean" `HTTP_ORIGIN` (it is an
+  origin, not a URL with a path). Why: some higher-security client networks strip or reject a
+  wildcard `*`, so a client's app fails with a CORS "no Access-Control-Allow-Origin" error
+  **inside** their network while working fine outside it. **Security:** reflecting any
+  well-formed origin is effectively equivalent to `*` here because auth is **Bearer-token, never
+  cookies** — no new exposure; the regex is a strict allowlist that blocks header injection, and
+  PHP `header()` also rejects CR/LF. **`Access-Control-Allow-Credentials` is deliberately NOT set
+  — do NOT add it on top of this reflection without a cookie-auth security review; that
+  combination would be a cross-site data-theft hole.** `Vary: Origin` stops a shared cache
+  serving one origin's header to another.
 - **`/health`:** 200 + empty object (EB/LB probe — keep it working).
 - **Sentry:** initialized per request; EC2 instance metadata attached.
 - **Core DB bootstrap (now guarded, 2026-07-23):** registers `Core` (`DB_CORE`), preferring a
@@ -396,13 +405,15 @@ they are the known sharp edges. Do not re-discover these from scratch.
    `Core.Database` row (`id = CORE_LOGS_DATABASE_ID`); a local Logs DB whose actual schema name
    differs throws `Unknown database`. This is environment config, not a code bug — fix the row or
    the local schema name, don't patch the bootstrap.
-5. **CORS reflects the caller's `Origin` (not an allowlist) (updated 2026-09-16).** The front
-   controller now echoes the request `Origin` into `Access-Control-Allow-Origin` and sends
-   `Access-Control-Allow-Credentials: true` (was a wide-open `Access-Control-Allow-*`). This
-   retires the old "wide-open CORS" risk for the current bearer-token auth, but it is **still not
-   a restriction** — every Origin is reflected. If any cookie/session-backed auth is ever added
-   here, replace the Origin echo with a real hardcoded allowlist first; reflecting the Origin
-   while sending credentials would otherwise be an exploitable hole.
+5. **CORS reflects the caller's `Origin`, falling back to `*` (updated 2026-09-16).** The front
+   controller now echoes the request `Origin` into `Access-Control-Allow-Origin` when it matches a
+   strict shape regex, else falls back to `*`, and adds `Vary: Origin` (was a wide-open
+   `Access-Control-Allow-*`). Safe **only** because auth is Bearer-token, never cookie/session —
+   `Access-Control-Allow-Credentials` is intentionally **unset**, and reflecting the origin is
+   effectively equivalent to `*` here (no new exposure). It is a shape check, **not** a trusted-
+   origin allowlist — every well-formed Origin is reflected. If any cookie/session-backed auth is
+   ever added here, do not set credentials and re-tighten CORS to a real hardcoded allowlist first;
+   origin-reflection + credentials would be a cross-site data-theft hole.
 6. **`_underscore` is cloned at build from a moving branch** (`_<ENVIRONMENT>`), not pinned to a
    commit. Two deploys of the same api2 commit can produce different runtime behavior. Check the
    framework branch state when triaging an "it worked yesterday" regression.
@@ -457,13 +468,17 @@ they are the known sharp edges. Do not re-discover these from scratch.
 
 ## Change history
 - 2026-09-16 — **CORS now reflects the caller's `Origin`** instead of a wide-open
-  `Access-Control-Allow-*`: the front controller (`Controller/Index.php`) echoes the request
-  `Origin` into `Access-Control-Allow-Origin` and sends `Access-Control-Allow-Credentials: true`,
-  still returning 200 for the `OPTIONS` preflight. Updated the front-controller CORS bullet and
-  **retired the old "CORS is fully permissive" wide-open risk** (Known issue #5) — reframed to
-  note the header is now a per-request Origin echo, **not** an allowlist, so it must still be
-  replaced with a hardcoded allowlist before any cookie/session-backed auth is added here.
-  (jcardinal)
+  `Access-Control-Allow-*`: the front controller (`Controller/Index.php`, `_Controller_Index::api()`,
+  before the `OPTIONS` short-circuit) echoes the request `Origin` into `Access-Control-Allow-Origin`
+  when `HTTP_ORIGIN` matches `^https?://[A-Za-z0-9.\-]+(:\d+)?$` (`D` flag), else falls back to `*`,
+  and adds `Vary: Origin` (whole origin incl. scheme — browser compares byte-for-byte). Motivation:
+  some higher-security client networks strip/reject a wildcard `*`, so a client failed with a CORS
+  "no Access-Control-Allow-Origin" error inside their network while it worked outside. Retires Known
+  issue #5. `Access-Control-Allow-Credentials` deliberately **NOT** set (auth is Bearer-token, never
+  cookies — reflection is equivalent to `*` here with no new exposure; adding credentials on top
+  would be a cross-site data-theft hole and needs a cookie-auth review). Reviewed clean by
+  php-reviewer (valid PHP 8.2) and cso (SAFE TO SHIP). Note: the code change is a working-tree edit,
+  not yet committed. (jcardinal)
 - 2026-09-01 — Recorded a **sixth EB-`Degraded` cause — a client 4xx BURST**: EB Enhanced Health
   counts application/ELB 4xx toward env health via two default-Enabled `ConfigDocument` rules
   (`ApplicationRequests4xx`, `ELBRequests4xx`, namespace

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.821",
+  "version": "1.0.822",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",