officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vault: allow the OffVault origin to sign in to the platform

Browse Source 
Scope OFFICER_VAULT_ORIGIN to ['/api/auth', '/api/vault'] instead of
'/api/vault' only. The OffVault app authenticates to the platform first
(/api/auth/signin) and only then reaches the vault proxy — same shape as the
music app's ['/api/auth', '/api/music']. Without /api/auth the signin was
rejected in originScopeMiddleware with "Origin not permitted".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-07-29 01:44:08 +00:00
co-authored by Claude Opus 4.8
parent fcf6715844
commit 4d6975934a
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/_middlewares/origin-validation.ts
+7 -6
View File
@@ -33,9 +33,9 @@ const APP_ORIGINS: string[] = [
// Standalone officer-music app — its own custom-scheme origin. Allowlisted so it can authenticate
// and stream; SCOPED_ORIGINS below restricts it to /api/auth + /api/music only.
MUSIC_APP_ORIGIN,
// OffVault app (Bitwarden-SDK client) — its own custom-scheme origin. Allowlisted so it can reach the
// Vaultwarden reverse-proxy; ORIGIN_RULES below restricts it to /api/vault only. It authenticates to
// Vaultwarden with its own bearer token (not a platform account), so no super-admin rule applies.
// OffVault app (Bitwarden-SDK client) — its own custom-scheme origin. Allowlisted so it can sign in to
// the platform AND reach the Vaultwarden reverse-proxy; ORIGIN_RULES below restricts it to
// /api/auth + /api/vault. Vault access uses its own Bitwarden bearer token (not a platform account).
OFFICER_VAULT_ORIGIN,
].filter((o): o is string => Boolean(o));
@@ -58,9 +58,10 @@ const ORIGIN_RULES: Record<string, OriginRule> = {};
if (PUBLIC_ORIGIN) ORIGIN_RULES[PUBLIC_ORIGIN] = { superAdminOnly: true };
if (OFFICER_APP_ORIGIN) ORIGIN_RULES[OFFICER_APP_ORIGIN] = { superAdminOnly: true };
if (MUSIC_APP_ORIGIN) ORIGIN_RULES[MUSIC_APP_ORIGIN] = { paths: NON_OWNER_PATHS };
// OffVault may reach ONLY the Vaultwarden proxy. No superAdminOnly: its callers hold Bitwarden tokens,
// not platform accounts, so the account backstop above never applies to them (verify() → null → passes).
if (OFFICER_VAULT_ORIGIN) ORIGIN_RULES[OFFICER_VAULT_ORIGIN] = { paths: ['/api/vault'] };
// OffVault signs in to the platform (/api/auth) and reaches the Vaultwarden proxy (/api/vault) — nothing
// else. No superAdminOnly: the owner signs in here, and vault calls carry Bitwarden tokens (not platform
// accounts), so the account backstop never applies to them (verify() → null → passes).
if (OFFICER_VAULT_ORIGIN) ORIGIN_RULES[OFFICER_VAULT_ORIGIN] = { paths: ['/api/auth', '/api/vault'] };
// True when an Origin is reserved for the platform owner (used at signin to reject a non-owner login).
export function isSuperAdminOnlyOrigin(origin: string | undefined): boolean {