fix: constrain proxy HTTP network policy

Author: thymikee

src/__tests__/daemon-proxy.test.ts

@@ -1,15 +1,28 @@
-import { test } from 'vitest';
+import { test, vi } from 'vitest';
 import assert from 'node:assert/strict';
 import crypto from 'node:crypto';
 import http from 'node:http';
+import { Readable } from 'node:stream';
 import { createDaemonProxyServer } from '../remote/daemon-proxy.ts';
+import { createDaemonHttpServer } from '../daemon/server/http-server.ts';
+import { executeRunScriptHttpRequest } from '../daemon/adapters/maestro/run-script-http-child.ts';
+import {
+  DAEMON_HTTP_NETWORK_ACCESS_HEADER,
+  DAEMON_HTTP_PUBLIC_NETWORK_ACCESS,
+} from '../daemon/http-contract.ts';
 import { DAEMON_RPC_PROTOCOL_VERSION } from '../daemon/http-health.ts';
 import {
   closeLoopbackServer,
   listenOnLoopback,
   skipWhenLoopbackUnavailable,
 } from './test-utils/loopback.ts';
 
+const requestApprovedUrlMock = vi.hoisted(() => vi.fn());
+
+vi.mock('@agent-device/provision-kit/install-source-network-transport', () => ({
+  requestApprovedUrl: requestApprovedUrlMock,
+}));
+
 const PROXY_ARTIFACT_INVENTORY_ENTRY = {
   id: 'shot-1',
   filename: 'shot.png',
@@ -24,6 +37,7 @@ test('daemon proxy forwards rpc requests with upstream daemon token', async (t)
 
   let upstreamAuth = '';
   let upstreamTokenHeader = '';
+  let upstreamNetworkAccess = '';
   let upstreamBody: Record<string, any> | undefined;
   const upstream = http.createServer((req, res) => {
     if (req.url === '/health') {
@@ -34,6 +48,7 @@ test('daemon proxy forwards rpc requests with upstream daemon token', async (t)
     assert.equal(req.url, '/rpc');
     upstreamAuth = String(req.headers.authorization ?? '');
     upstreamTokenHeader = String(req.headers['x-agent-device-token'] ?? '');
+    upstreamNetworkAccess = String(req.headers[DAEMON_HTTP_NETWORK_ACCESS_HEADER] ?? '');
     let body = '';
     req.setEncoding('utf8');
     req.on('data', (chunk) => {
@@ -88,6 +103,7 @@ test('daemon proxy forwards rpc requests with upstream daemon token', async (t)
     });
     assert.equal(upstreamAuth, 'Bearer daemon-secret');
     assert.equal(upstreamTokenHeader, 'daemon-secret');
+    assert.equal(upstreamNetworkAccess, DAEMON_HTTP_PUBLIC_NETWORK_ACCESS);
     assert.equal(upstreamBody?.params?.token, 'daemon-secret');
     assert.equal(upstreamBody?.params?.command, 'devices');
   } finally {
@@ -96,6 +112,95 @@ test('daemon proxy forwards rpc requests with upstream daemon token', async (t)
   }
 });
 
+test('proxy enforces public-only Maestro HTTP policy on a local daemon', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+
+  let loopbackRequests = 0;
+  const loopbackTarget = http.createServer((_req, res) => {
+    loopbackRequests += 1;
+    res.end('loopback-secret');
+  });
+  const env = { ...process.env };
+  delete env.AGENT_DEVICE_HTTP_AUTH_HOOK;
+  delete env.AGENT_DEVICE_HTTP_AUTH_EXPORT;
+  const daemon = await createDaemonHttpServer({
+    token: 'daemon-secret',
+    env,
+    handleRequest: async (request) => {
+      const url = request.positionals[0] ?? '';
+      return {
+        ok: true,
+        data: await executeRunScriptHttpRequest({
+          method: 'GET',
+          url,
+          headers: {},
+          networkAccess: request.internal?.networkAccess ?? 'unrestricted',
+        }),
+      };
+    },
+  });
+  const targetPort = await listenOnLoopback(loopbackTarget);
+  const daemonPort = await listenOnLoopback(daemon);
+  const proxy = createDaemonProxyServer({
+    upstreamBaseUrl: `http://127.0.0.1:${daemonPort}`,
+    upstreamToken: 'daemon-secret',
+    clientToken: 'proxy-secret',
+  });
+
+  try {
+    const proxyPort = await listenOnLoopback(proxy);
+    const post = async (url: string) => {
+      const response = await fetch(`http://127.0.0.1:${proxyPort}/agent-device/rpc`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: 'Bearer proxy-secret' },
+        body: JSON.stringify({
+          jsonrpc: '2.0',
+          id: 'proxy-trust',
+          method: 'agent_device.command',
+          params: {
+            token: 'proxy-secret',
+            command: 'run_script_http',
+            positionals: [url],
+            flags: {},
+          },
+        }),
+      });
+      return { status: response.status, body: (await response.json()) as Record<string, any> };
+    };
+
+    const loopbackResponse = await post(`http://127.0.0.1:${targetPort}/secret`);
+    assert.equal(loopbackResponse.status, 400);
+    assert.equal(loopbackResponse.body.error?.data?.code, 'INVALID_ARGS');
+    assert.match(loopbackResponse.body.error?.message ?? '', /non-public address/);
+    assert.equal(loopbackRequests, 0, 'the proxy path must never reach a loopback target');
+    assert.equal(requestApprovedUrlMock.mock.calls.length, 0);
+
+    requestApprovedUrlMock.mockResolvedValue({
+      statusCode: 200,
+      headers: {},
+      body: Readable.from(['public-response']),
+      close: async () => {},
+    });
+    const publicUrl = 'https://93.184.216.34/public';
+    const publicResponse = await post(publicUrl);
+    assert.equal(publicResponse.status, 200);
+    assert.deepEqual(publicResponse.body.result?.data, {
+      status: 200,
+      body: 'public-response',
+      headers: {},
+    });
+    assert.equal(requestApprovedUrlMock.mock.calls.length, 1);
+    assert.equal(requestApprovedUrlMock.mock.calls[0]?.[0].url.href, publicUrl);
+    assert.equal(requestApprovedUrlMock.mock.calls[0]?.[0].approvedAddress, '93.184.216.34');
+    assert.equal(requestApprovedUrlMock.mock.calls[0]?.[0].family, 4);
+  } finally {
+    requestApprovedUrlMock.mockReset();
+    await closeLoopbackServer(proxy);
+    await closeLoopbackServer(daemon);
+    await closeLoopbackServer(loopbackTarget);
+  }
+});
+
 test('daemon proxy rejects unauthenticated rpc requests', async (t) => {
   if (await skipWhenLoopbackUnavailable(t)) return;
 

src/daemon/http-contract.ts

@@ -1,5 +1,7 @@
 export const DAEMON_HTTP_BASE_PATH = '/agent-device';
 export const DAEMON_HTTP_TENANT_HEADER = 'x-agent-device-tenant';
+export const DAEMON_HTTP_NETWORK_ACCESS_HEADER = 'x-agent-device-network-access';
+export const DAEMON_HTTP_PUBLIC_NETWORK_ACCESS = 'public-only';
 
 export function buildDaemonHttpBaseUrl(baseUrl: string): string {
   return buildDaemonHttpUrl(baseUrl, DAEMON_HTTP_BASE_PATH);

src/daemon/server/http-server.ts

@@ -33,7 +33,7 @@ import {
   shouldStreamRequestProgress,
 } from '../request-progress-protocol.ts';
 import { buildDaemonHealthPayload } from '../http-health.ts';
-import { DAEMON_HTTP_TENANT_HEADER } from '../http-contract.ts';
+import { DAEMON_HTTP_NETWORK_ACCESS_HEADER, DAEMON_HTTP_TENANT_HEADER } from '../http-contract.ts';
 import { sendRestJsonError, statusCodeForNormalizedError } from '../http-errors.ts';
 import { tryHandleUploadHttpRoute } from '../upload-http.ts';
 import { tryHandleDownloadableArtifactHttpRoute } from '../downloadable-artifact-http.ts';
@@ -534,7 +534,6 @@ export async function createDaemonHttpServer(options: {
 }): Promise<http.Server> {
   const environment = options.env ?? process.env;
   const authHook = await loadHttpAuthHook(environment);
-  const trustPolicy = resolveHttpTrustPolicy({ authHookConfigured: authHook !== null });
   const { handleRequest, token, retainArtifacts = false, resolveRequestDiagnosticsPath } = options;
   return http.createServer((req, res) => {
     if (req.method === 'GET' && req.url === '/health') {
@@ -710,7 +709,13 @@ export async function createDaemonHttpServer(options: {
         if (daemonRequest.flags?.tenant !== undefined) {
           daemonRequest.flags = { ...daemonRequest.flags, tenant: tenantTrust.tenantId };
         }
-        daemonRequest = applyHttpTrustPolicy(daemonRequest, trustPolicy);
+        daemonRequest = applyHttpTrustPolicy(
+          daemonRequest,
+          resolveHttpTrustPolicy({
+            authHookConfigured: authHook !== null,
+            networkAccessMarker: req.headers[DAEMON_HTTP_NETWORK_ACCESS_HEADER],
+          }),
+        );
 
         let canceledInFlight = false;
         // Request-scoped cancellation: mark this request canceled whenever its client

src/daemon/server/http-trust-policy.test.ts

@@ -1,5 +1,6 @@
 import assert from 'node:assert/strict';
 import { test } from 'vitest';
+import { DAEMON_HTTP_PUBLIC_NETWORK_ACCESS } from '../http-contract.ts';
 import type { DaemonRequest } from '../types.ts';
 import { applyHttpTrustPolicy, resolveHttpTrustPolicy } from './http-trust-policy.ts';
 
@@ -15,6 +16,25 @@ test('an HTTP server without an auth hook keeps local unrestricted behavior', ()
   });
 });
 
+test('a proxy network marker selects public-only behavior without an auth hook', () => {
+  assert.deepEqual(
+    resolveHttpTrustPolicy({
+      authHookConfigured: false,
+      networkAccessMarker: DAEMON_HTTP_PUBLIC_NETWORK_ACCESS,
+    }),
+    { networkAccess: 'public-only' },
+  );
+});
+
+test('an invalid or ambiguous proxy network marker fails closed', () => {
+  for (const networkAccessMarker of ['unrestricted', ['public-only', 'public-only']]) {
+    assert.throws(
+      () => resolveHttpTrustPolicy({ authHookConfigured: false, networkAccessMarker }),
+      /Invalid daemon HTTP network access marker/,
+    );
+  }
+});
+
 test('the public-only policy rejects every unbacked host path source', () => {
   assert.throws(
     () =>

src/daemon/server/http-trust-policy.ts

@@ -1,11 +1,21 @@
 import { AppError } from '@agent-device/kernel/errors';
 import type { DaemonNetworkAccessPolicy, DaemonRequest } from '../types.ts';
+import { DAEMON_HTTP_PUBLIC_NETWORK_ACCESS } from '../http-contract.ts';
 
 export type HttpTrustPolicy = {
   networkAccess: DaemonNetworkAccessPolicy;
 };
 
-export function resolveHttpTrustPolicy(params: { authHookConfigured: boolean }): HttpTrustPolicy {
+export function resolveHttpTrustPolicy(params: {
+  authHookConfigured: boolean;
+  networkAccessMarker?: string | string[];
+}): HttpTrustPolicy {
+  if (params.networkAccessMarker !== undefined) {
+    if (params.networkAccessMarker !== DAEMON_HTTP_PUBLIC_NETWORK_ACCESS) {
+      throw new AppError('INVALID_ARGS', 'Invalid daemon HTTP network access marker');
+    }
+    return { networkAccess: DAEMON_HTTP_PUBLIC_NETWORK_ACCESS };
+  }
   return { networkAccess: params.authHookConfigured ? 'public-only' : 'unrestricted' };
 }
 

src/remote/daemon-proxy.ts

@@ -7,6 +7,8 @@ import { readNodeHttpRequestBody } from '../utils/node-http.ts';
 import { timingSafeStringEqual } from '../utils/timing-safe-equal.ts';
 import {
   DAEMON_HTTP_BASE_PATH,
+  DAEMON_HTTP_NETWORK_ACCESS_HEADER,
+  DAEMON_HTTP_PUBLIC_NETWORK_ACCESS,
   DAEMON_HTTP_TENANT_HEADER,
   buildDaemonHttpAuthHeaders,
   buildDaemonHttpUrl,
@@ -335,6 +337,9 @@ function buildUpstreamHeaders(
   if (route === '/rpc' && !headers.has('content-type')) {
     headers.set('content-type', 'application/json');
   }
+  if (route === '/rpc') {
+    headers.set(DAEMON_HTTP_NETWORK_ACCESS_HEADER, DAEMON_HTTP_PUBLIC_NETWORK_ACCESS);
+  }
   for (const [name, value] of Object.entries(buildDaemonHttpAuthHeaders(upstreamToken))) {
     headers.set(name, value);
   }