security: stop the Space being an open, credentialed relay to the app API

node_probe.py

@@ -4,8 +4,33 @@ the Space container (userspace Node, no root) and reverse-proxies to it.
 Mounted under /respite/v2/node/*:
   /status  → is the runtime bootstrapped, is the child alive
   /version → runs `node --version` as a child process
-  /proxy   → reverse-proxy <path> (+ query/body/headers) to the Node backend,
+  /proxy   → reverse-proxy an ALLOWLISTED path to the Node backend,
              streaming both ways (SSE included)
+
+── Security note (2026-09-28) ────────────────────────────────────────────────
+This used to forward *any* path to the Node backend and answer every request
+with `Access-Control-Allow-Origin: <whatever the caller sent>` plus
+`Access-Control-Allow-Credentials: true`. In practice that turned the Space
+into an open, credentialed relay to the whole application API: any website on
+the internet could read `/api/auth/me`, `/api/storage`, `/api/stripe/*` and
+`/api/billing/*` through it, from a cross-origin context, because this file —
+not `src/lib/cors.ts` — was the policy the browser actually enforced. The
+app's own CORS code, which deliberately refuses to reflect a wildcard, was
+never consulted.
+
+Two changes close that:
+
+  * `ALLOWED_PROXY_PATHS` — the relay forwards four paths and returns 404 for
+    everything else. Chat, follow-ups, search and fetch are the only surfaces
+    that are meant to be reachable without a session, and the Node app applies
+    its own auth, quota and rate limits to them.
+  * `cors_headers()` — an explicit origin allowlist, no reflection, no
+    wildcard, and no `Allow-Credentials` unless the origin is on it.
+
+The `cookie` header is still forwarded for the allowlisted paths, and that is
+deliberate: it is what lets `/api/chat` identify the caller and apply that
+user's quota. It is forwarded *only* because the allowlist means there is
+nothing else it could be used to reach.
 """
 
 import os
@@ -17,6 +42,25 @@ from fastapi.responses import JSONResponse
 
 import node_runtime
 
+# The only paths this relay will forward. Everything else is a 404 — see the
+# module docstring for why this is an allowlist and not a denylist.
+ALLOWED_PROXY_PATHS = frozenset({
+    "api/chat",
+    "api/followups",
+    "api/search",
+    "api/fetch",
+})
+
+# The app origins allowed to read responses cross-origin. The Space is called
+# by the browser directly, so this cannot simply be "no CORS at all" — but it
+# can be a list, and a list is not a variable the caller supplies.
+ALLOWED_ORIGINS = frozenset({
+    "https://respite.cazyundee.workers.dev",
+    "https://respite.cazyundee.workers.dev/",
+    "http://localhost:3000",
+    "http://127.0.0.1:3000",
+})
+
 
 def _node_path() -> str | None:
     try:
@@ -25,28 +69,58 @@ def _node_path() -> str | None:
         return None
 
 
-CORS_HEADERS = {
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, Accept",
-    "Access-Control-Max-Age": "86400",
-}
+def cors_headers(request: Request | None = None, methods: str = "GET, POST, OPTIONS") -> dict:
+    """Allowlisted CORS. Never reflects the caller's Origin."""
+    headers = {
+        "Access-Control-Allow-Methods": methods,
+        "Access-Control-Allow-Headers": "Content-Type, Authorization, Accept",
+        "Access-Control-Max-Age": "86400",
+        "Vary": "Origin",
+    }
+    origin = (request.headers.get("origin") or "").rstrip("/") if request else ""
+    if origin and origin in ALLOWED_ORIGINS:
+        headers["Access-Control-Allow-Origin"] = origin
+        # Only now, and only for a known origin. Sending this alongside a
+        # reflected origin is what turns a proxy into a credentialed relay.
+        headers["Access-Control-Allow-Credentials"] = "true"
+    return headers
+
+
+def _is_allowed(path: str) -> bool:
+    """Normalise and match against the allowlist.
+
+    Rejects anything that is not already a bare `api/<name>`: traversal
+    segments, encoded separators, absolute URLs and double slashes all fail
+    this test, so they never reach `httpx` with a caller-controlled path.
+    """
+    candidate = path.strip().lstrip("/")
+    if "//" in candidate or "\\" in candidate:
+        return False
+    if ".." in candidate or "%" in candidate or ":" in candidate:
+        return False
+    if candidate not in ALLOWED_PROXY_PATHS:
+        return False
+    return True
 
 
 def register_routes(fa_app):
     @fa_app.options("/respite/v2/node/proxy/{path:path}")
-    async def _proxy_preflight(path: str):
+    async def _proxy_preflight(path: str, request: Request):
         from starlette.responses import PlainTextResponse
-        return PlainTextResponse("", status_code=204, headers=CORS_HEADERS)
+        if not _is_allowed(path):
+            return PlainTextResponse("", status_code=404, headers=cors_headers(request))
+        return PlainTextResponse("", status_code=204, headers=cors_headers(request))
 
     @fa_app.get("/respite/v2/node/status")
     def _status():
+        # Was returning absolute container paths (`/home/user/app/...`) to
+        # anyone who asked. It is a liveness probe; it does not need to tell
+        # a stranger where it lives on disk.
         return JSONResponse({
-            "runtime_dir": node_runtime.RUNTIME_DIR,
+            "runtime": "node",
             "node_bin_exists": os.path.exists(node_runtime.NODE_BIN),
             "backend_ready": node_runtime.node_ready(),
-            "backend_dir": node_runtime.BACKEND_DIR,
-        })
+        }, headers={"Cache-Control": "no-store"})
 
     @fa_app.get("/respite/v2/node/version")
     def _version():
@@ -54,17 +128,29 @@ def register_routes(fa_app):
         if not node:
             return JSONResponse({"error": "node bootstrap failed"}, status_code=500)
         r = subprocess.run([node, "--version"], capture_output=True, text=True, timeout=30)
-        return JSONResponse({"stdout": r.stdout.strip(), "stderr": r.stderr.strip()[:400], "code": r.returncode})
+        return JSONResponse({"stdout": r.stdout.strip(), "code": r.returncode})
 
     @fa_app.get("/respite/v2/node/proxy/{path:path}")
     @fa_app.post("/respite/v2/node/proxy/{path:path}")
     async def _proxy(request: Request, path: str):
-        """Forward method, query string, body and headers to the Node backend
-        on 127.0.0.1:3210. Streaming both ways (SSE included)."""
+        """Forward an allowlisted path to the Node backend on 127.0.0.1:3210,
+        streaming both ways (SSE included)."""
+        if not _is_allowed(path):
+            # 404, not 403: a caller should not be able to probe which paths
+            # exist behind the relay.
+            return JSONResponse(
+                {"error": "Not found"},
+                status_code=404,
+                headers=cors_headers(request),
+            )
         if not node_runtime.node_ready():
             start_ok = node_runtime.start_node_backend()
             if not start_ok:
-                return JSONResponse({"error": "node backend not running"}, status_code=503)
+                return JSONResponse(
+                    {"error": "node backend not running"},
+                    status_code=503,
+                    headers=cors_headers(request),
+                )
         url = f"http://127.0.0.1:{node_runtime.NODE_PORT}/{path}"
         if request.url.query:
             url += "?" + request.url.query
@@ -72,6 +158,9 @@ def register_routes(fa_app):
             k: v for k, v in request.headers.items()
             if k.lower() not in ("host", "connection", "content-length", "accept-encoding")
         }
+        # Forwarded deliberately, and only ever to an allowlisted path: it is
+        # what makes the Node app apply this caller's quota instead of treating
+        # them as anonymous.
         body = await request.body()
         try:
             client = httpx.AsyncClient(timeout=httpx.Timeout(300.0, connect=10.0))
@@ -93,58 +182,23 @@ def register_routes(fa_app):
                     await upstream.aclose()
                     await client.aclose()
 
-            resp_headers.update(CORS_HEADERS)
+            resp_headers.update(cors_headers(request))
             return StreamingResponse(
                 stream_gen(), status_code=upstream.status_code, headers=resp_headers
             )
         except Exception as e:
-            return JSONResponse({"error": str(e)}, status_code=502)
-
-    @fa_app.get("/respite/v2/live-frames")
-    async def _live_frames(q: str = "Write three short paragraphs about rivers."):
-        """TEMP DIAGNOSTIC: open a Live socket, log outputTranscription frame
-        timings/count. Returns only timing metadata — never the API key."""
-        import asyncio, json, time
-        websockets = None
-        try:
-            import websockets as _ws
-            websockets = _ws
-        except ImportError:
-            return JSONResponse({"error": "websockets not installed"})
-        key = os.environ.get("GOOGLE_API_KEY") or os.environ.get("GEMINI_API_KEY")
-        if not key:
-            return JSONResponse({"error": "no google key in env"})
-        url = f"wss://generativelanguage.googleapis.com/ws/google.ai.generativelanguage.v1beta.GenerativeService.BidiGenerateContent?key={key}"
-        frames = [{"t": 0, "note": "route entered"}]
-        t0 = time.monotonic()
-
-        async def run():
-            async with websockets.connect(url, max_size=None) as ws:
-                await ws.send(json.dumps({"setup": {"model": "models/gemini-3.8-live"}}))
-                setup = True
-                while True:
-                    try:
-                        raw = await asyncio.wait_for(ws.recv(), timeout=45)
-                    except asyncio.TimeoutError:
-                        frames.append({"t": round(time.monotonic() - t0, 2), "err": "timeout"})
-                        break
-                    except Exception as e:
-                        frames.append({"t": round(time.monotonic() - t0, 2), "err": repr(e)[:200]})
-                        break
-                    try:
-                        f = json.loads(raw)
-                    except Exception:
-                        continue
-                    if f.get("setupComplete"):
-                        await ws.send(json.dumps({"clientContent": {"turns": [{"role": "user", "parts": [{"text": q}]}], "turnComplete": True}}))
-                        setup = False
-                        continue
-                    frames.append({"t": round(time.monotonic() - t0, 2), "keys": sorted(f.keys()), "raw": json.dumps(f)[:400]})
-                    if len(frames) >= 6:
-                        break
+            _log_safe(e)
+            return JSONResponse(
+                {"error": "upstream unavailable"},
+                status_code=502,
+                headers=cors_headers(request),
+            )
 
-        try:
-            await asyncio.wait_for(run(), timeout=50)
-        except Exception as e:
-            return JSONResponse({"error": str(e), "frames": frames})
-        return JSONResponse({"frames": frames, "count": len(frames), "done": True})
+
+def _log_safe(exc: Exception) -> None:
+    """Log the detail server-side; the caller already got a generic 502.
+
+    The old handler returned `str(e)` to whoever made the request, which for
+    an httpx error can include the full upstream URL and headers.
+    """
+    print(f"[node-probe] upstream error: {type(exc).__name__}", flush=True)