unbound-cli 1.20.0 → 1.20.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.20.0",
+  "version": "1.20.2",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/auth.js

@@ -2,6 +2,7 @@
  * Shared browser-based authentication flow.
  * Used by both `login` and `setup` commands.
  */
+const crypto = require('crypto');
 const http = require('http');
 const os = require('os');
 const { URL } = require('url');
@@ -35,6 +36,8 @@ function warnIfNotStored(stored) {
  */
 async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {}) {
   const server = http.createServer();
+  // One-time nonce: only the redirect the dashboard was handed can complete this login.
+  const state = crypto.randomBytes(16).toString('hex');
   let callbackResolve;
   let callbackReject;
 
@@ -73,7 +76,7 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
   function respondAndShutdown(res, statusCode, html) {
     res.on('finish', shutdownServer);
     res.on('close', shutdownServer);
-    res.writeHead(statusCode, { 'Content-Type': 'text/html; charset=utf-8', 'Connection': 'close' });
+    res.writeHead(statusCode, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Connection': 'close' });
     res.end(html);
   }
 
@@ -84,6 +87,14 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
   let callbackHandled = false;
   let stored;
 
+  // Compare byte lengths, not string lengths: a multi-byte candidate would make timingSafeEqual throw.
+  function stateMatches(candidate) {
+    if (typeof candidate !== 'string') return false;
+    const given = Buffer.from(candidate);
+    const expected = Buffer.from(state);
+    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
+  }
+
   server.on('request', (req, res) => {
     const url = new URL(req.url, `http://localhost`);
 
@@ -93,6 +104,13 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
       return;
     }
 
+    // A request without this login's nonce is not the dashboard's redirect: answer it and keep waiting.
+    if (!stateMatches(url.searchParams.get('state'))) {
+      res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Connection': 'close' });
+      res.end(authPages.failurePage('Invalid login callback'));
+      return;
+    }
+
     if (callbackHandled) {
       res.writeHead(409, { 'Connection': 'close' });
       res.end('Callback already processed');
@@ -103,7 +121,7 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
     const apiKey = url.searchParams.get('api_key');
     const email = url.searchParams.get('email');
     const orgName = url.searchParams.get('org');
-    // The callback is reachable by any local page, so its text is stripped of control characters before display.
+    // Nonce-gated, but the reason is still stripped of control characters before display as defence in depth.
     const reason = (url.searchParams.get('error') || '').replace(/[\u0000-\u001f\u007f-\u009f]/g, '').slice(0, 200);
     // `scope` echoes what the dashboard minted; an older dashboard sends none.
     const grantedScope = url.searchParams.get('scope');
@@ -130,7 +148,8 @@ async function loginWithBrowser(frontendUrl, { open: openFn, scope = {} } = {})
   });
 
   const port = server.address().port;
-  const callbackUrl = `http://localhost:${port}/callback`;
+  // 127.0.0.1 literal: the server binds only IPv4, so a `localhost` redirect could land on a squatter at [::1].
+  const callbackUrl = `http://127.0.0.1:${port}/callback?state=${state}`;
   // `machine` names the login token after this host, so a re-login replaces that token instead of adding one.
   const params = new URLSearchParams({ callback_url: callbackUrl, app_type: 'cli', machine: os.hostname(), ...scope });
   const authUrl = `${frontendUrl}/automations/api-key-callback?${params.toString()}`;

package/src/lib/pack-export.js

@@ -80,6 +80,8 @@ function genericRowToPolicy(row, ref) {
   } else if (
     kind === 'model'
     && ('support_all_models' in config || 'allowed_model_ids' in config || 'excluded_model_ids' in config)
+    // Name patterns have no sugar form; as raw config they cannot read as "allow all".
+    && !('allowed_model_patterns' in config)
     // "allow nothing" has no sugar form; keep it as raw config so the file validates.
     && (config.support_all_models || (config.allowed_model_ids || []).length)
   ) {

package/src/lib/pack-plan.js

@@ -91,9 +91,26 @@ function normalizeModelConfig(config) {
     support_all_models: !!config.support_all_models,
     allowed_model_ids: sortedNumbers(config.allowed_model_ids),
     excluded_model_ids: sortedNumbers(config.excluded_model_ids),
+    // Any match counts, so pattern order is not a change.
+    ...(Array.isArray(config.allowed_model_patterns) && { allowed_model_patterns: [...config.allowed_model_patterns].sort() }),
+    ...(Array.isArray(config.excluded_model_patterns) && { excluded_model_patterns: [...config.excluded_model_patterns].sort() }),
   };
 }
 
+// The backend stores a fixed model list as exact-name patterns when every id resolves to a name one can spell; plan that stored shape so it does not drift.
+function asStoredModelConfig(config, aiModels) {
+  const ids = config && config.allowed_model_ids;
+  if (!config || config.support_all_models !== false || 'allowed_model_patterns' in config || !Array.isArray(ids) || !ids.length || !ids.every(Number.isInteger)) return config;
+  const found = (aiModels || []).filter((m) => ids.includes(Number(m.id)));
+  // An empty list or an id missing from the catalog stays a fixed list, so nothing widens or drops.
+  if (new Set(found.map((m) => Number(m.id))).size !== new Set(ids).size) return config;
+  const names = [...new Set(found.map((m) => m.name))].sort();
+  if (!names.every((name) => /^[A-Za-z0-9._@:-]+$/.test(name))) return config;
+  // Excluded ids never applied to a fixed list, so the backend drops them on conversion too.
+  const { allowed_model_ids: _ids, excluded_model_ids: _excluded, ...rest } = config;
+  return { ...rest, support_all_models: true, allowed_model_patterns: names };
+}
+
 function normalizeConfig(kind, config) {
   if (kind === 'security') return normalizeSecurityConfig(config);
   if (kind === 'model') return normalizeModelConfig(config);
@@ -229,6 +246,8 @@ function genericDesired(policy, ref, where) {
   if (kind === 'security' && policy.guardrails) config = guardrailsToConfig(policy, ref, where);
   else if (kind === 'model' && policy.models) config = modelsToConfig(policy, ref, where);
   else config = policy.config || {};
+  const unconverted = config;
+  if (kind === 'model') config = asStoredModelConfig(config, ref.aiModels);
 
   const scopeIds = resolveIds(ref.userGroups, policy.scope && policy.scope.userGroups, 'user group', { where });
   const toolTypes = [...new Set(policy.scope && policy.scope.toolTypes ? policy.scope.toolTypes : [])].sort();
@@ -260,7 +279,8 @@ function genericDesired(policy, ref, where) {
     label_ids: labelIds,
   };
   if (policy.priority !== undefined) proj.priority = policy.priority;
-  return { table: 'generic', body, proj, mcp: null };
+  const legacyConfig = config !== unconverted ? normalizeConfig(kind, unconverted) : undefined;
+  return { table: 'generic', body, proj, mcp: null, legacyConfig };
 }
 
 /**
@@ -449,7 +469,9 @@ function buildPlan(desired, live, { prune = false } = {}) {
       continue;
     }
 
-    const changes = diffFields(d.proj, liveProj);
+    let changes = diffFields(d.proj, liveProj);
+    // A model list stored as ids before the backend saved patterns is the same policy.
+    if (changes.length && d.legacyConfig && !diffFields({ ...d.proj, config: d.legacyConfig }, liveProj).length) changes = [];
     if (!changes.length) {
       ops.push({ ...base, op: 'unchanged', row, changes: [] });
       continue;

package/test/auth-server-leak.test.js

@@ -64,11 +64,17 @@ function expectConnectionRefused(port) {
   });
 }
 
-// Pulls the callback_url the server told the browser to redirect to, then
-// appends the success params the /callback handler reads (api_key/email/org).
+// Mirrors the dashboard: keep callback_url's own query (the state nonce) and
+// set the success params the /callback handler reads (api_key/email/org).
+function withCallbackParams(callbackUrl, params) {
+  const u = new URL(callbackUrl);
+  for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
+  return u.toString();
+}
+
 function buildSuccessCallback(authUrl) {
   const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
-  return `${callbackUrl}?api_key=sk-test&email=a@b.co&org=Acme`;
+  return withCallbackParams(callbackUrl, { api_key: 'sk-test', email: 'a@b.co', org: 'Acme' });
 }
 
 // Monkeypatch config so no real ~/.unbound write happens. Restored in finally.
@@ -149,13 +155,13 @@ test('loginWithBrowser: duplicate /callback cannot overwrite the stored credenti
 
     const fakeOpen = async (authUrl) => {
       const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
-      await getKeepAlive(agent, `${callbackUrl}?api_key=sk-first&email=a@b.co&org=Acme`);
+      await getKeepAlive(agent, withCallbackParams(callbackUrl, { api_key: 'sk-first', email: 'a@b.co', org: 'Acme' }));
       // Second callback with a different key: teardown is deferred to the
       // response flush, so the server may still be up — it must answer 409
       // without persisting; once down, ECONNREFUSED is equally acceptable.
       // Either way the first credentials must be the only ones stored.
       try {
-        const dup = await getKeepAlive(agent, `${callbackUrl}?api_key=sk-attacker&email=x@y.z&org=Evil`);
+        const dup = await getKeepAlive(agent, withCallbackParams(callbackUrl, { api_key: 'sk-attacker', email: 'x@y.z', org: 'Evil' }));
         assert.equal(dup.statusCode, 409, 'late duplicate must be rejected, not processed');
       } catch (err) {
         if (err.code !== 'ECONNREFUSED') throw err;

package/test/login-scope-callback.test.js

@@ -19,6 +19,13 @@ function get(url) {
   });
 }
 
+// Mirrors the dashboard: `new URL(callback_url)` keeps the state nonce, then the result params are set on it.
+function withCallbackParams(callbackUrl, params) {
+  const u = new URL(callbackUrl);
+  for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
+  return u.toString();
+}
+
 function withStubbedConfig(fn) {
   const saved = { setApiKey: config.setApiKey, writeConfig: config.writeConfig, readConfig: config.readConfig };
   config.setApiKey = () => {};
@@ -33,7 +40,7 @@ test('loginWithBrowser: scope flags ride on the auth URL and the echoed scope co
     const fakeOpen = async (authUrl) => {
       authParams = new URL(authUrl).searchParams;
       const callbackUrl = authParams.get('callback_url');
-      setImmediate(() => get(`${callbackUrl}?api_key=sk-test&email=a@b.co&org=Acme&scope=role%3AAnalytics+Viewer`));
+      setImmediate(() => get(withCallbackParams(callbackUrl, { api_key: 'sk-test', email: 'a@b.co', org: 'Acme', scope: 'role:Analytics Viewer' })));
     };
 
     const result = await auth.loginWithBrowser('http://frontend.invalid', {
@@ -51,7 +58,7 @@ test('loginWithBrowser: control characters in the callback error never reach the
   await withStubbedConfig(async () => {
     const fakeOpen = async (authUrl) => {
       const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
-      setImmediate(() => get(`${callbackUrl}?error=${encodeURIComponent('bad\u001b[31m role\u0007')}`));
+      setImmediate(() => get(withCallbackParams(callbackUrl, { error: 'bad\u001b[31m role\u0007' })));
     };
     await assert.rejects(
       () => auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen, scope: { role: 'x' } }),
@@ -65,7 +72,7 @@ test('loginWithBrowser: the dashboard\'s error reason is the rejection and shows
     let page;
     const fakeOpen = async (authUrl) => {
       const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
-      setImmediate(async () => { page = await get(`${callbackUrl}?error=Unknown+role+%22Policy-Auditor%22`); });
+      setImmediate(async () => { page = await get(withCallbackParams(callbackUrl, { error: 'Unknown role "Policy-Auditor"' })); });
     };
 
     await assert.rejects(
@@ -77,3 +84,128 @@ test('loginWithBrowser: the dashboard\'s error reason is the rejection and shows
     assert.match(page.body, /Unknown role "Policy-Auditor"/);
   });
 });
+
+// WEB-6462: the callback is gated by a per-login `state` nonce and pinned to 127.0.0.1, so a local
+// page or an IPv6 bind-squatter can neither complete the login nor read the dashboard's redirect.
+
+function sleep(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); }
+
+test('loginWithBrowser: callback_url is pinned to 127.0.0.1 and carries a 32-hex state nonce', async () => {
+  await withStubbedConfig(async () => {
+    let callbackUrl;
+    const fakeOpen = async (authUrl) => {
+      callbackUrl = new URL(new URL(authUrl).searchParams.get('callback_url'));
+      setImmediate(() => get(withCallbackParams(callbackUrl, { api_key: 'sk-test' })));
+    };
+    await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(callbackUrl.hostname, '127.0.0.1');
+    assert.equal(callbackUrl.pathname, '/callback');
+    assert.match(callbackUrl.searchParams.get('state'), /^[0-9a-f]{32}$/);
+  });
+});
+
+test('loginWithBrowser: a wrong state gets 400 and the real callback still completes with 200', async () => {
+  await withStubbedConfig(async () => {
+    const storedKeys = [];
+    config.setApiKey = (key) => { storedKeys.push(key); };
+    let forged;
+    let real;
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      setImmediate(async () => {
+        forged = await get(withCallbackParams(callbackUrl, { state: 'f'.repeat(32), api_key: 'sk-attacker' }));
+        // The login settles before this response body flushes, so hold the promise and await it below.
+        real = get(withCallbackParams(callbackUrl, { api_key: 'sk-real', email: 'a@b.co', org: 'Acme' }));
+      });
+    };
+    const result = await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(forged.statusCode, 400);
+    assert.equal((await real).statusCode, 200, 'the forged request must not consume the one-shot callback');
+    assert.deepEqual(result, { email: 'a@b.co', orgName: 'Acme' });
+    assert.deepEqual(storedKeys, ['sk-real']);
+  });
+});
+
+test('loginWithBrowser: a callback without state gets 400 and the login still completes', async () => {
+  await withStubbedConfig(async () => {
+    let bare;
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(new URL(authUrl).searchParams.get('callback_url'));
+      const noState = new URL(callbackUrl); noState.searchParams.delete('state'); noState.searchParams.set('api_key', 'sk-attacker');
+      setImmediate(async () => {
+        bare = await get(noState.toString());
+        await get(withCallbackParams(callbackUrl, { api_key: 'sk-real', email: 'a@b.co', org: 'Acme' }));
+      });
+    };
+    const result = await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(bare.statusCode, 400);
+    assert.deepEqual(result, { email: 'a@b.co', orgName: 'Acme' });
+  });
+});
+
+test('loginWithBrowser: a wrong-state error= neither shows its text nor settles the login', async () => {
+  await withStubbedConfig(async () => {
+    let forged;
+    let callbackUrl;
+    const fakeOpen = async (authUrl) => {
+      callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      setImmediate(async () => {
+        forged = await get(withCallbackParams(callbackUrl, { state: '0'.repeat(32), error: 'ATTACKER-TEXT' }));
+      });
+    };
+    let settled = false;
+    const login = auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen }).finally(() => { settled = true; });
+    await sleep(100);
+    assert.equal(forged.statusCode, 400);
+    assert.doesNotMatch(forged.body, /ATTACKER-TEXT/);
+    assert.equal(settled, false, 'a forged error must not reject the login');
+    // Finish the login so the server does not outlive the test.
+    await get(withCallbackParams(callbackUrl, { api_key: 'sk-real' }));
+    await login;
+  });
+});
+
+test('loginWithBrowser: a 32-char multi-byte state gets 400 instead of crashing the server', async () => {
+  await withStubbedConfig(async () => {
+    let forged;
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      setImmediate(async () => {
+        // Same JS length as the real nonce, different UTF-8 byte length.
+        forged = await get(withCallbackParams(callbackUrl, { state: '\u00e9'.repeat(32), api_key: 'sk-attacker' }));
+        await get(withCallbackParams(callbackUrl, { api_key: 'sk-real', email: 'a@b.co', org: 'Acme' }));
+      });
+    };
+    const result = await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(forged.statusCode, 400);
+    assert.deepEqual(result, { email: 'a@b.co', orgName: 'Acme' });
+  });
+});
+
+test('loginWithBrowser: each login mints a different state', async () => {
+  await withStubbedConfig(async () => {
+    const states = [];
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      states.push(new URL(callbackUrl).searchParams.get('state'));
+      setImmediate(() => get(withCallbackParams(callbackUrl, { api_key: 'sk-test' })));
+    };
+    await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    await auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen });
+    assert.equal(states.length, 2);
+    assert.notEqual(states[0], states[1]);
+  });
+});
+
+test('loginWithBrowser: error= with the correct state still rejects with the dashboard reason', async () => {
+  await withStubbedConfig(async () => {
+    const fakeOpen = async (authUrl) => {
+      const callbackUrl = new URL(authUrl).searchParams.get('callback_url');
+      setImmediate(() => get(withCallbackParams(callbackUrl, { error: 'Role not permitted' })));
+    };
+    await assert.rejects(
+      () => auth.loginWithBrowser('http://frontend.invalid', { open: fakeOpen }),
+      /Role not permitted/,
+    );
+  });
+});

package/test/pack-export.test.js

@@ -67,6 +67,15 @@ test('round trip keeps a disabled guardrail entry disabled', () => {
   assert.deepEqual(ops.map((o) => o.op), ['unchanged']);
 });
 
+test('a model policy stored as name patterns exports as raw config and plans unchanged', () => {
+  const live = { tool: [], generic: [{ ...LIVE.generic[1], config: { support_all_models: true, allowed_model_patterns: ['claude-sonnet'], excluded_model_ids: [] } }] };
+  const doc = exp.liveToPack('base', live, REF);
+  assert.equal(doc.policies[0].models, undefined);
+  assert.deepEqual(doc.policies[0].config, live.generic[0].config);
+  const ops = plan.buildPlan(plan.toDesired(schema.validatePack(doc, 'base.yaml'), REF), live, { prune: true });
+  assert.deepEqual(ops.map((o) => o.op), ['unchanged']);
+});
+
 test('export keeps a loadable file for an empty BLOCK message and an allow-nothing model policy', () => {
   const live = {
     tool: [{ ...LIVE.tool[0], name: 'quiet-block', code_slug: 'quiet-block', custom_message: '' }],

package/test/pack-plan.test.js

@@ -67,6 +67,23 @@ test('buildPlan: in-sync org yields only unchanged ops', () => {
   assert.equal(plan.summarize(ops).drift, 0);
 });
 
+test('buildPlan: an allowed-model list matches the name patterns the backend stores it as', () => {
+  const desired = plan.toDesired(pack([{ ...MODEL, models: { allowed: ['gpt-4o', 'claude-sonnet'] } }]), REF);
+  assert.deepEqual(desired[0].body.config, { support_all_models: true, allowed_model_patterns: ['claude-sonnet', 'gpt-4o'] });
+  const live = { ...LIVE_MODEL, config: { support_all_models: true, allowed_model_patterns: ['claude-sonnet', 'gpt-4o'] } };
+  assert.deepEqual(plan.buildPlan(desired, { tool: [], generic: [live] }).map((o) => o.op), ['unchanged']);
+  const reordered = { ...live, config: { ...live.config, allowed_model_patterns: ['gpt-4o', 'claude-sonnet'] } };
+  assert.deepEqual(plan.buildPlan(desired, { tool: [], generic: [reordered] }).map((o) => o.op), ['unchanged']);
+});
+
+test('toDesired: an empty or partly unknown id list stays a fixed list', () => {
+  for (const ids of [[], [100, 999]]) {
+    const config = { support_all_models: false, allowed_model_ids: ids, excluded_model_ids: [] };
+    const [d] = plan.toDesired(pack([{ id: 'models', kind: 'model', config }]), REF);
+    assert.deepEqual(d.body.config, config);
+  }
+});
+
 test('buildPlan: create, patch-update, orphan and prune', () => {
   const desired = plan.toDesired(pack([{ ...TERMINAL, action: 'AUDIT', customMessage: undefined }, { ...COST, config: { monthly_budget: 250 } }]), REF);
   const live = { tool: [LIVE_TERMINAL, LIVE_MCP], generic: [LIVE_COST] };