Diffinery

codician/diffinerypublic

Open-source, agent-first GitHub and GitHub Actions alternative that runs on your own Cloudflare account: git hosting, pull requests, code review and drop-in GitHub Actions YAML on Workers, Durable Objects, R2 and Containers.

CLI sign-in: read the country from request.cf only (#195)

* CLI sign-in: read the country from request.cf only
test-bot authored 1 parent 2e055f1commit 12fae42e55e68d8094e8db51c7ace084fd225d2aBrowse files
3 files changed+15−9
modifiedapps/diffinery/src/http/cli-login.ts+1−1View file
@@ -27,7 +27,7 @@
2727 const client = cleanClient((b.client ?? {}) as Record<string, unknown>);
2828 const scope = requireScopeName(b.scope);
2929 const cf = (c.req.raw as { cf?: { city?: string; country?: string } }).cf;
30- const location = [cf?.city, cf?.country ?? c.req.header("cf-ipcountry")].filter(Boolean).join(", ") || undefined;
30+ const location = [cf?.city, cf?.country].filter(Boolean).join(", ") || undefined;
3131 const d = await new CliLogins(c.env, c.get("dir")).startDevice(client, scope, { ip: c.req.header("cf-connecting-ip") ?? undefined, location });
3232 const base = c.env.PUBLIC_URL.replace(/\/$/, "");
3333 return c.json(
modifiedapps/diffinery/src/web/cli-login.tsx+2−1View file
@@ -81,8 +81,9 @@
8181 /** The approval form both flows share: the details, a scope, and Authorize or Cancel. */
8282 const Approve: FC<{ c: AppContext; me: Account; action: string; client: CliClient; scope: TokenScope; hidden: Record<string, string>; from?: { ip: string | null; location: string | null; at: string }; code?: string }> = (p) => {
8383 const t = csrfToken(p.c);
84+ // Only the edge's request.cf: a client can send a CF-IPCountry header of its choosing.
8485 const cf = (p.c.req.raw as { cf?: { country?: string } }).cf;
85- const mismatch = p.from ? placeMismatch(p.from, { ip: p.c.req.header("cf-connecting-ip"), country: cf?.country ?? p.c.req.header("cf-ipcountry") }) : null;
86+ const mismatch = p.from ? placeMismatch(p.from, { ip: p.c.req.header("cf-connecting-ip"), country: cf?.country }) : null;
8687 return (
8788 <Card title="Authorize the Diffinery CLI">
8889 <p class="muted">
modifiedapps/diffinery/test/unit/cli-login.test.ts+12−7View file
@@ -31,8 +31,11 @@
3131 const env = { PUBLIC_URL: ORIGIN, DB, BOOTSTRAP_ADMINS: "" } as unknown as Env;
3232 const waits: Promise<unknown>[] = [];
3333 const ctx = { waitUntil: (p: Promise<unknown>) => void waits.push(p), passThroughOnException() {}, props: {} } as unknown as ExecutionContext;
34- const fetch = async (path: string, init: RequestInit = {}) => {
35- const res = await app.fetch(new Request(`${ORIGIN}${path}`, { redirect: "manual", ...init }), env, ctx);
34+ // `cf` stands in for the edge's request.cf, which a Worker gets and a client can't set.
35+ const fetch = async (path: string, { cf, ...init }: RequestInit & { cf?: Record<string, string> } = {}) => {
36+ const req = new Request(`${ORIGIN}${path}`, { redirect: "manual", ...init });
37+ if (cf) Object.defineProperty(req, "cf", { value: cf });
38+ const res = await app.fetch(req, env, ctx);
3639 await Promise.allSettled(waits);
3740 return res;
3841 };
@@ -265,19 +268,21 @@
265268
266269 it("warns when the device code came from another network or country", async () => {
267270 const t = setup();
268- const r = await t.fetch("/-/cli/device", { method: "POST", headers: { "content-type": "application/json", "cf-connecting-ip": "203.0.113.5", "cf-ipcountry": "NG" }, body: JSON.stringify({ client: { host: "far-away" } }) });
271+ const r = await t.fetch("/-/cli/device", { method: "POST", cf: { city: "Lagos", country: "NG" }, headers: { "content-type": "application/json", "cf-connecting-ip": "203.0.113.5" }, body: JSON.stringify({ client: { host: "far-away" } }) });
269272 const d = (await r.json()) as { user_code: string };
270- const approve = (ip: string, country?: string) =>
273+ const approve = (ip: string, country?: string, header?: string) =>
271274 t.fetch("/login/device", {
272275 method: "POST",
273- headers: { cookie: `__Host-dfy_session=ana-fresh-session-0000000000001; dfy_csrf=${CSRF}`, "content-type": "application/x-www-form-urlencoded", "content-length": String(new URLSearchParams({ _csrf: CSRF, code: d.user_code }).toString().length), origin: ORIGIN, "cf-connecting-ip": ip, ...(country ? { "cf-ipcountry": country } : {}) },
276+ cf: country ? { country } : undefined,
277+ headers: { cookie: `__Host-dfy_session=ana-fresh-session-0000000000001; dfy_csrf=${CSRF}`, "content-type": "application/x-www-form-urlencoded", "content-length": String(new URLSearchParams({ _csrf: CSRF, code: d.user_code }).toString().length), origin: ORIGIN, "cf-connecting-ip": ip, ...(header ? { "cf-ipcountry": header } : {}) },
274278 body: new URLSearchParams({ _csrf: CSRF, code: d.user_code }).toString(),
275279 });
276280 expect(await (await approve("198.51.100.7")).text()).toContain("from a different network (203.0.113.5)");
277281 expect(await (await approve("203.0.113.5")).text()).not.toContain("different network");
278- // The country comes from request.cf, or from the CF-IPCountry header when cf has none.
279- expect(await (await approve("198.51.100.7", "TR")).text()).toContain("asked for from another country</b> (NG)");
282+ // The country comes from the edge's request.cf only; a CF-IPCountry header the client sends is ignored.
283+ expect(await (await approve("198.51.100.7", "TR")).text()).toContain("asked for from another country</b> (Lagos, NG)");
280284 expect(await (await approve("198.51.100.7", "NG")).text()).not.toContain("another country");
285+ expect(await (await approve("198.51.100.7", undefined, "TR")).text()).not.toContain("another country");
281286 expect(placeMismatch({ ip: "1.1.1.1", location: "Lagos, NG" }, { ip: "2.2.2.2", country: "TR" })).toBe("country");
282287 expect(placeMismatch({ ip: "1.1.1.1", location: "TR" }, { ip: "2.2.2.2", country: "TR" })).toBe("network");
283288 expect(placeMismatch({ ip: "1.1.1.1", location: "Istanbul, TR" }, { ip: "1.1.1.1", country: "TR" })).toBeNull();