openvibers/openvibe.network Commits

openvibe.link: the vhost sends /auth/ to Link's own sign-in (#669)

OP OpenVibers committed 5 days ago · 00eaff2252 · 2 files, +17 −0

* openvibe.link: the vhost sends /auth/ to Link's own sign-in

Network#664 added openvibe.link's sign-in (the link-web client), but the vhost proxies only the paths it names, so
/auth/login and /auth/me fell to the catch-all and 301'd to openvibe.network: Link never signed anyone in.

* link-home test: read the whole /auth/ block

Changes

ddiff --git a/deploy/nginx/parked-domains.conf b/deploy/nginx/parked-domains.conf
iindex de33226f..b6300da8 100644
---- a/deploy/nginx/parked-domains.conf
++++ b/deploy/nginx/parked-domains.conf
@@@ -197,6 +197,20 @@ server {
          proxy_set_header CF-Connecting-IP $remote_addr;
          proxy_set_header X-Forwarded-Proto $scheme;
      }
++    # Link's own sign-in (Network#664: the link-web OAuth client; a host-only session on openvibe.link): login,
++    # the callback, the session read, refresh and the sign-out form. Without it the catch-all sent /auth/* to
++    # openvibe.network, so openvibe.link never signed anyone in (11-08 audit).
++    location ^~ /auth/ {
++        limit_except GET HEAD POST { deny all; }
++        proxy_pass http://127.0.0.1:4000;
++        proxy_http_version 1.1;
++        proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
++        proxy_set_header X-Forwarded-Proto $scheme;
++        add_header Cache-Control "no-store" always;
++    }
      # The IndexNow key file (openvibe-shared/indexnow): /<key>.txt, served by Network when INDEXNOW_KEY is set.
      location ~ "^/[A-Za-z0-9]{8,128}\.txt$" {
          limit_except GET HEAD { deny all; }
ddiff --git a/test/link-home.test.js b/test/link-home.test.js
iindex 851103a0..ca51bd9e 100644
---- a/test/link-home.test.js
++++ b/test/link-home.test.js
@@@ -60,6 +60,9 @@ const SHAPED = {
      // The vhost must send /machines and /pair to the app (which signposts them), not the catch-all to Network.
      const vhost = fs.readFileSync(path.join(__dirname, '..', 'deploy', 'nginx', 'parked-domains.conf'), 'utf8');
      assert.ok(/location ~ \^\/\(\|install\|machines\|pair\|/.test(vhost), 'the vhost proxies /machines and /pair to the Link app');
++    // …and /auth/* to Link's own sign-in (Network#664), or openvibe.link never signs anyone in (11-08 audit).
++    const linkBlock = vhost.slice(vhost.indexOf('    server_name openvibe.link;'));
++    assert.ok(/location \^~ \/auth\/ \{[\s\S]*?proxy_pass http:\/\/127\.0\.0\.1:4000;/.test(linkBlock.slice(0, linkBlock.indexOf('\n}\n'))), 'the openvibe.link vhost proxies /auth/ to Network');
  
      // ── The page: OpenVibe Link, and every fact the Node page had ──
      const html = page.render({ release: first, releaseId: 'rel_test' });