85c0b9a3dc
Reject requests from unrecognised Host headers when running authenticated/private. Adds server middleware, CLI `allowed-hostname` command, config-schema field, and prompt support for configuring allowed hostnames during onboard/configure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
72 lines
2.0 KiB
TypeScript
72 lines
2.0 KiB
TypeScript
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { describe, expect, it } from "vitest";
|
|
import type { PaperclipConfig } from "../config/schema.js";
|
|
import { addAllowedHostname } from "../commands/allowed-hostname.js";
|
|
|
|
function createTempConfigPath() {
|
|
const dir = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-allowed-hostname-"));
|
|
return path.join(dir, "config.json");
|
|
}
|
|
|
|
function writeBaseConfig(configPath: string) {
|
|
const base: PaperclipConfig = {
|
|
$meta: {
|
|
version: 1,
|
|
updatedAt: new Date("2026-01-01T00:00:00.000Z").toISOString(),
|
|
source: "configure",
|
|
},
|
|
database: {
|
|
mode: "embedded-postgres",
|
|
embeddedPostgresDataDir: "/tmp/paperclip-db",
|
|
embeddedPostgresPort: 54329,
|
|
},
|
|
logging: {
|
|
mode: "file",
|
|
logDir: "/tmp/paperclip-logs",
|
|
},
|
|
server: {
|
|
deploymentMode: "authenticated",
|
|
exposure: "private",
|
|
host: "0.0.0.0",
|
|
port: 3100,
|
|
allowedHostnames: [],
|
|
serveUi: true,
|
|
},
|
|
auth: {
|
|
baseUrlMode: "auto",
|
|
},
|
|
storage: {
|
|
provider: "local_disk",
|
|
localDisk: { baseDir: "/tmp/paperclip-storage" },
|
|
s3: {
|
|
bucket: "paperclip",
|
|
region: "us-east-1",
|
|
prefix: "",
|
|
forcePathStyle: false,
|
|
},
|
|
},
|
|
secrets: {
|
|
provider: "local_encrypted",
|
|
strictMode: false,
|
|
localEncrypted: { keyFilePath: "/tmp/paperclip-secrets/master.key" },
|
|
},
|
|
};
|
|
fs.writeFileSync(configPath, JSON.stringify(base, null, 2));
|
|
}
|
|
|
|
describe("allowed-hostname command", () => {
|
|
it("adds and normalizes hostnames", async () => {
|
|
const configPath = createTempConfigPath();
|
|
writeBaseConfig(configPath);
|
|
|
|
await addAllowedHostname("https://Dotta-MacBook-Pro:3100", { config: configPath });
|
|
await addAllowedHostname("dotta-macbook-pro", { config: configPath });
|
|
|
|
const raw = JSON.parse(fs.readFileSync(configPath, "utf-8")) as PaperclipConfig;
|
|
expect(raw.server.allowedHostnames).toEqual(["dotta-macbook-pro"]);
|
|
});
|
|
});
|
|
|