wood-fired-tasks 2.0.3 → 2.0.4

package/CHANGELOG.md

@@ -13,6 +13,26 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 _No changes yet._
 
+## [v2.0.4] - 2026-06-08
+
+### Fixed
+- **Device-flow `verification_uri` now points at the address the client actually
+  connected to, not `localhost`.** `POST /auth/device/code` built the URL the
+  user opens in a browser from a STATIC configured origin (`OIDC_REDIRECT_URI`'s
+  origin), which is typically `http://localhost:3000`. A CLI that reached the
+  server over the LAN (e.g. `http://192.168.x.x:3000`) was told to open a
+  `localhost` URL pointing at its OWN machine — a dead end. The origin is now
+  derived per-request from the `Host` header (honoring `X-Forwarded-Host` /
+  `X-Forwarded-Proto` from a trusted reverse proxy), falling back to the
+  configured origin only when no `Host` is present. This is not a
+  host-header-injection vector: the `verification_uri` is returned only to the
+  same client that made the request. (Note: a Google-backed server whose OAuth
+  callback is `http://localhost` still can't complete the *browser login* leg
+  for a remote client — Google forbids non-`localhost` `http` redirect URIs — so
+  remote clients should use `tasks setup --remote <url> --token <pat>` or an
+  HTTPS domain. This fix makes the verification URL correct for properly
+  routable servers.)
+
 ## [v2.0.3] - 2026-06-08
 
 ### Fixed

package/dist/api/routes/auth/device-code.d.ts

@@ -26,9 +26,15 @@
 import type { FastifyPluginAsync } from 'fastify';
 export interface DeviceCodeRouteOptions {
     /**
-     * Server origin used to build the verification URIs the CLI prints. Plan
-     * 30-08 sources this from `new URL(env.OIDC_REDIRECT_URI).origin`.
-     * Example: `https://woodfiredbugs.local`.
+     * FALLBACK origin for the verification URIs the CLI prints, used only when
+     * the request carries no usable Host header. Plan 30-08 sources this from
+     * `new URL(env.OIDC_REDIRECT_URI).origin`. Example: `https://woodfiredbugs.local`.
+     *
+     * #834: the verification origin is now derived PER-REQUEST from the address
+     * the client actually connected to (see {@link resolveVerificationOrigin}),
+     * because this configured value is typically `http://localhost:3000` and is
+     * unroutable for any client that reached the server over the LAN / a real
+     * hostname. `origin` remains as the no-Host-header fallback.
      */
     origin: string;
     /**
@@ -37,5 +43,25 @@ export interface DeviceCodeRouteOptions {
      */
     expectedClientId: string;
 }
+/**
+ * Resolve the origin (`scheme://host[:port]`) the CLIENT used to reach this
+ * server, for building the device-flow `verification_uri` the user opens in a
+ * browser (#834).
+ *
+ * Previously this was a STATIC configured origin (`OIDC_REDIRECT_URI`'s origin),
+ * which is `http://localhost:3000` on a typical server — so a CLI that connected
+ * over the LAN (e.g. `http://192.168.x.x:3000`) was told to open a localhost URL
+ * pointing at its OWN machine. We instead use the host the request arrived on,
+ * honoring `X-Forwarded-{Host,Proto}` from a trusted reverse proxy.
+ *
+ * Security: this is NOT a host-header-injection vector. The `verification_uri`
+ * is returned ONLY to the same client that sent the request, so a spoofed Host
+ * merely misdirects the spoofer. Falls back to `fallback` (the configured
+ * origin) when no Host header is present at all.
+ */
+export declare function resolveVerificationOrigin(request: {
+    headers: Record<string, string | string[] | undefined>;
+    protocol?: string;
+}, fallback: string): string;
 declare const deviceCodeRoute: FastifyPluginAsync<DeviceCodeRouteOptions>;
 export default deviceCodeRoute;

package/dist/api/routes/auth/device-code.js

@@ -1,5 +1,38 @@
 import { z } from 'zod';
 import { createSession } from '../../../services/device-flow-store.js';
+/** First value of a possibly comma-joined / array-valued HTTP header. */
+function firstHeaderValue(v) {
+    const raw = Array.isArray(v) ? v[0] : v;
+    if (typeof raw !== 'string')
+        return undefined;
+    const first = raw.split(',')[0]?.trim();
+    return first && first.length > 0 ? first : undefined;
+}
+/**
+ * Resolve the origin (`scheme://host[:port]`) the CLIENT used to reach this
+ * server, for building the device-flow `verification_uri` the user opens in a
+ * browser (#834).
+ *
+ * Previously this was a STATIC configured origin (`OIDC_REDIRECT_URI`'s origin),
+ * which is `http://localhost:3000` on a typical server — so a CLI that connected
+ * over the LAN (e.g. `http://192.168.x.x:3000`) was told to open a localhost URL
+ * pointing at its OWN machine. We instead use the host the request arrived on,
+ * honoring `X-Forwarded-{Host,Proto}` from a trusted reverse proxy.
+ *
+ * Security: this is NOT a host-header-injection vector. The `verification_uri`
+ * is returned ONLY to the same client that sent the request, so a spoofed Host
+ * merely misdirects the spoofer. Falls back to `fallback` (the configured
+ * origin) when no Host header is present at all.
+ */
+export function resolveVerificationOrigin(request, fallback) {
+    const host = firstHeaderValue(request.headers['x-forwarded-host']) ??
+        firstHeaderValue(request.headers['host']);
+    if (!host)
+        return fallback;
+    const scheme = firstHeaderValue(request.headers['x-forwarded-proto']) ??
+        (request.protocol && request.protocol.length > 0 ? request.protocol : 'http');
+    return `${scheme}://${host}`;
+}
 /**
  * Body schema for POST /auth/device/code (JSON only — RFC 8628 lets servers
  * pick; the CLI always sends JSON). `scope` is accepted-and-ignored in v1.6
@@ -37,11 +70,15 @@ const deviceCodeRoute = async (fastify, opts) => {
             clientId: client_id,
             hostname: hostname ?? null,
         }, 'device flow started');
+        // #834: build the verification URL from the address the CLIENT connected to
+        // (request Host / X-Forwarded-*), not the static configured origin, so a
+        // remote/LAN client gets a URL it can actually open instead of localhost.
+        const origin = resolveVerificationOrigin(request, opts.origin);
         return reply.code(200).send({
             device_code: session.deviceCode,
             user_code: session.userCode,
-            verification_uri: `${opts.origin}/auth/device`,
-            verification_uri_complete: `${opts.origin}/auth/device?user_code=${session.userCode}`,
+            verification_uri: `${origin}/auth/device`,
+            verification_uri_complete: `${origin}/auth/device?user_code=${session.userCode}`,
             expires_in: 600,
             interval: 5,
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wood-fired-tasks",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "Network-wide task tracking system for Wood Fired Games",
   "keywords": [
     "task-tracker",