From 4d6975934abbe6897d8a6a9991c384a29074ed87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Wed, 29 Jul 2026 01:44:08 +0000 Subject: [PATCH] vault: allow the OffVault origin to sign in to the platform MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Scope OFFICER_VAULT_ORIGIN to ['/api/auth', '/api/vault'] instead of '/api/vault' only. The OffVault app authenticates to the platform first (/api/auth/signin) and only then reaches the vault proxy — same shape as the music app's ['/api/auth', '/api/music']. Without /api/auth the signin was rejected in originScopeMiddleware with "Origin not permitted". Co-Authored-By: Claude Opus 4.8 --- src/servers/_middlewares/origin-validation.ts | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/servers/_middlewares/origin-validation.ts b/src/servers/_middlewares/origin-validation.ts index f6856485..11a9fac4 100644 --- a/src/servers/_middlewares/origin-validation.ts +++ b/src/servers/_middlewares/origin-validation.ts @@ -33,9 +33,9 @@ const APP_ORIGINS: string[] = [ // Standalone officer-music app — its own custom-scheme origin. Allowlisted so it can authenticate // and stream; SCOPED_ORIGINS below restricts it to /api/auth + /api/music only. MUSIC_APP_ORIGIN, - // OffVault app (Bitwarden-SDK client) — its own custom-scheme origin. Allowlisted so it can reach the - // Vaultwarden reverse-proxy; ORIGIN_RULES below restricts it to /api/vault only. It authenticates to - // Vaultwarden with its own bearer token (not a platform account), so no super-admin rule applies. + // OffVault app (Bitwarden-SDK client) — its own custom-scheme origin. Allowlisted so it can sign in to + // the platform AND reach the Vaultwarden reverse-proxy; ORIGIN_RULES below restricts it to + // /api/auth + /api/vault. Vault access uses its own Bitwarden bearer token (not a platform account). OFFICER_VAULT_ORIGIN, ].filter((o): o is string => Boolean(o)); @@ -58,9 +58,10 @@ const ORIGIN_RULES: Record = {}; if (PUBLIC_ORIGIN) ORIGIN_RULES[PUBLIC_ORIGIN] = { superAdminOnly: true }; if (OFFICER_APP_ORIGIN) ORIGIN_RULES[OFFICER_APP_ORIGIN] = { superAdminOnly: true }; if (MUSIC_APP_ORIGIN) ORIGIN_RULES[MUSIC_APP_ORIGIN] = { paths: NON_OWNER_PATHS }; -// OffVault may reach ONLY the Vaultwarden proxy. No superAdminOnly: its callers hold Bitwarden tokens, -// not platform accounts, so the account backstop above never applies to them (verify() → null → passes). -if (OFFICER_VAULT_ORIGIN) ORIGIN_RULES[OFFICER_VAULT_ORIGIN] = { paths: ['/api/vault'] }; +// OffVault signs in to the platform (/api/auth) and reaches the Vaultwarden proxy (/api/vault) — nothing +// else. No superAdminOnly: the owner signs in here, and vault calls carry Bitwarden tokens (not platform +// accounts), so the account backstop never applies to them (verify() → null → passes). +if (OFFICER_VAULT_ORIGIN) ORIGIN_RULES[OFFICER_VAULT_ORIGIN] = { paths: ['/api/auth', '/api/vault'] }; // True when an Origin is reserved for the platform owner (used at signin to reject a non-owner login). export function isSuperAdminOnlyOrigin(origin: string | undefined): boolean {