Alien69Flow
diff --git a/‎api/_api-key.js‎
Lines changed: 53 additions & 41 deletions b/‎api/_api-key.js‎
Lines changed: 53 additions & 41 deletions
diff --git a/‎api/_api-key.test.mjs‎
Lines changed: 169 additions & 0 deletions b/‎api/_api-key.test.mjs‎
Lines changed: 169 additions & 0 deletions
diff --git a/‎api/_relay.js‎
Lines changed: 1 addition & 1 deletion b/‎api/_relay.js‎
Lines changed: 1 addition & 1 deletion
@@ -1,70 +1,82 @@
+import { isSessionTokenShape, validateSessionToken } from './_session.js';
+
 const DESKTOP_ORIGIN_PATTERNS = [
   /^https?:\/\/tauri\.localhost(:\d+)?$/,
   /^https?:\/\/[a-z0-9-]+\.tauri\.localhost(:\d+)?$/i,
   /^tauri:\/\/localhost$/,
   /^asset:\/\/localhost$/,
 ];
 
-const BROWSER_ORIGIN_PATTERNS = [
-  /^https:\/\/(.*\.)?worldmonitor\.app$/,
-  /^https:\/\/worldmonitor-[a-z0-9-]+-elie-[a-z0-9]+\.vercel\.app$/,
-  ...(process.env.NODE_ENV === 'production' ? [] : [
-    /^https?:\/\/localhost(:\d+)?$/,
-    /^https?:\/\/127\.0\.0\.1(:\d+)?$/,
-  ]),
-];
-
 function isDesktopOrigin(origin) {
   return Boolean(origin) && DESKTOP_ORIGIN_PATTERNS.some(p => p.test(origin));
 }
 
-function isTrustedBrowserOrigin(origin) {
-  return Boolean(origin) && BROWSER_ORIGIN_PATTERNS.some(p => p.test(origin));
-}
-
-function extractOriginFromReferer(referer) {
-  if (!referer) return '';
-  try {
-    return new URL(referer).origin;
-  } catch {
-    return '';
-  }
+function isValidEnterpriseKey(key) {
+  if (!key) return false;
+  const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
+  return validKeys.includes(key);
 }
 
-export function validateApiKey(req, options = {}) {
+// Note: HTTP headers like Origin / Referer / Sec-Fetch-Site are entirely
+// client-controlled at the wire level (see issue #3541 / closed PR #3554).
+// Trusting any of them as a "this is a real browser" signal is forgeable by
+// curl in one line. The previous Referer-origin fallback and Origin-pattern
+// no-key trust path are both gone. Browsers now authenticate via:
+//   1. A short-lived wms_-prefixed session token (HMAC-signed by /api/wm-session).
+//      Kind: 'session'. Anonymous; satisfies basic gate, but downstream
+//      entitlement / premium checks must STILL run (a session token is freely
+//      mintable by anyone who can hit /api/wm-session — it is NOT proof of a
+//      paying user). Rejected when forceKey=true.
+//   2. A wm_-prefixed user API key (validated against the user-key table by gateway).
+//      Kind: 'user'. Returns required:true/valid:false here so the gateway's
+//      fallback at server/gateway.ts:~440 triggers validateUserApiKey().
+//   3. An enterprise key (WORLDMONITOR_VALID_KEYS). Kind: 'enterprise'. The
+//      ONLY kind that bypasses entitlement checks (operator-issued).
+// Tauri desktop continues to authenticate via enterprise key.
+//
+// Async because session validation uses Web Crypto (crypto.subtle.sign).
+// All call sites await this — see grep for migration history.
+export async function validateApiKey(req, options = {}) {
   const forceKey = options.forceKey === true;
   const key = req.headers.get('X-WorldMonitor-Key') || req.headers.get('X-Api-Key');
-  // Same-origin browser requests don't send Origin (per CORS spec).
-  // Fall back to Referer to identify trusted same-origin callers.
-  const origin = req.headers.get('Origin') || extractOriginFromReferer(req.headers.get('Referer')) || '';
+  const origin = req.headers.get('Origin') || '';
 
-  // Desktop app — always require API key
+  // Desktop app — always require an enterprise key.
   if (isDesktopOrigin(origin)) {
     if (!key) return { valid: false, required: true, error: 'API key required for desktop access' };
-    const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
-    if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
-    return { valid: true, required: true };
+    if (!isValidEnterpriseKey(key)) return { valid: false, required: true, error: 'Invalid API key' };
+    return { valid: true, required: true, kind: 'enterprise' };
   }
 
-  // Trusted browser origin (worldmonitor.app, Vercel previews, localhost dev) — no key needed
-  if (isTrustedBrowserOrigin(origin)) {
-    if (forceKey && !key) {
-      return { valid: false, required: true, error: 'API key required' };
+  // Browser anonymous session: HMAC-signed token from /api/wm-session.
+  // Validation is purely cryptographic — no DB lookup, no header trust.
+  if (isSessionTokenShape(key)) {
+    // Anonymous session tokens are NOT proof of any specific user identity
+    // — anyone can mint one via POST /api/wm-session. Reject when the caller
+    // demands a "real" key (premium / tier-gated endpoints set forceKey=true
+    // exactly because they need user-bound auth or a Pro-grade Bearer JWT).
+    if (forceKey) {
+      return { valid: false, required: true, error: 'Pro authentication required' };
     }
-    if (key) {
-      const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
-      if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
+    if (await validateSessionToken(key)) {
+      return { valid: true, required: false, kind: 'session' };
     }
-    return { valid: true, required: forceKey };
+    return { valid: false, required: true, error: 'Invalid session token' };
+  }
+
+  // wm_-prefixed user API keys — gateway re-validates against the user-key
+  // table. We must return required:true / valid:false for the gateway's
+  // fallback at server/gateway.ts:~440 to trigger validateUserApiKey().
+  if (key && key.startsWith('wm_')) {
+    return { valid: false, required: true, error: 'User API key requires gateway validation' };
   }
 
-  // Explicit key provided from unknown origin — validate it
+  // Enterprise key (WORLDMONITOR_VALID_KEYS).
   if (key) {
-    const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
-    if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
-    return { valid: true, required: true };
+    if (!isValidEnterpriseKey(key)) return { valid: false, required: true, error: 'Invalid API key' };
+    return { valid: true, required: true, kind: 'enterprise' };
   }
 
-  // No origin, no key — require API key (blocks unauthenticated curl/scripts)
+  // No credentials at all.
   return { valid: false, required: true, error: 'API key required' };
 }
@@ -0,0 +1,169 @@
+import { strict as assert } from 'node:assert';
+import test from 'node:test';
+
+const SECRET = 'test-secret-must-be-at-least-32-chars-long-xxx';
+const ENTERPRISE_KEY = 'enterprise-test-key-123';
+process.env.WM_SESSION_SECRET = SECRET;
+process.env.WORLDMONITOR_VALID_KEYS = ENTERPRISE_KEY;
+
+const { validateApiKey } = await import('./_api-key.js');
+const { issueSessionToken } = await import('./_session.js');
+
+function makeReq({ origin, referer, secFetchSite, key } = {}) {
+  const headers = new Headers();
+  if (origin) headers.set('origin', origin);
+  if (referer) headers.set('referer', referer);
+  if (secFetchSite) headers.set('sec-fetch-site', secFetchSite);
+  if (key) headers.set('x-worldmonitor-key', key);
+  return new Request('https://api.worldmonitor.app/api/test', { headers });
+}
+
+// ── #3541 regression: header-only signals must NEVER pass ──────────────────
+
+test('#3541: forged Referer alone is rejected', async () => {
+  const r = await validateApiKey(makeReq({ referer: 'https://worldmonitor.app/' }));
+  assert.equal(r.valid, false);
+  assert.equal(r.required, true);
+});
+
+test('#3541: forged Sec-Fetch-Site: same-origin alone is rejected (this was the closed-PR bug)', async () => {
+  const r = await validateApiKey(makeReq({ secFetchSite: 'same-origin' }));
+  assert.equal(r.valid, false);
+});
+
+test('#3541: forged Origin: https://worldmonitor.app alone is rejected (no key, no session)', async () => {
+  const r = await validateApiKey(makeReq({ origin: 'https://worldmonitor.app' }));
+  assert.equal(r.valid, false);
+});
+
+test('#3541: combined forged Origin + Sec-Fetch-Site + Referer all together is still rejected', async () => {
+  const r = await validateApiKey(makeReq({
+    origin: 'https://worldmonitor.app',
+    referer: 'https://worldmonitor.app/',
+    secFetchSite: 'same-origin',
+  }));
+  assert.equal(r.valid, false);
+});
+
+test('#3541: Sec-Fetch-Site: cross-site alone is rejected', async () => {
+  const r = await validateApiKey(makeReq({ secFetchSite: 'cross-site' }));
+  assert.equal(r.valid, false);
+});
+
+test('#3541: Sec-Fetch-Site: none alone is rejected', async () => {
+  const r = await validateApiKey(makeReq({ secFetchSite: 'none' }));
+  assert.equal(r.valid, false);
+});
+
+// ── Anonymous browser session token (the new trust path) ────────────────────
+
+test('valid wms_ session token from any origin is accepted (forceKey=false)', async () => {
+  const { token } = await issueSessionToken();
+  const r = await validateApiKey(makeReq({ key: token }));
+  assert.equal(r.valid, true);
+  assert.equal(r.required, false);
+  assert.equal(r.kind, 'session', 'must tag as session — gateway uses kind to decide entitlement bypass');
+});
+
+test('PR #3557 review: wms_ session token is REJECTED when forceKey=true (premium endpoints)', async () => {
+  // wms_ tokens are anonymous and freely mintable via /api/wm-session — they
+  // are NOT proof of a paying user. forceKey=true means the route demands a
+  // user-bound credential (Pro Bearer JWT, wm_ user key, or enterprise key).
+  const { token } = await issueSessionToken();
+  const r = await validateApiKey(makeReq({ key: token }), { forceKey: true });
+  assert.equal(r.valid, false);
+  assert.equal(r.required, true);
+  assert.match(r.error, /Pro authentication/);
+});
+
+test('PR #3557 review: wms_ result must NOT carry kind=enterprise (gateway entitlement-bypass anti-regression)', async () => {
+  // Gateway skips entitlement check ONLY for kind:'enterprise'. If a future
+  // refactor mislabels wms_ as enterprise, anonymous tokens silently unlock
+  // premium endpoints. Lock the contract here.
+  const { token } = await issueSessionToken();
+  const r = await validateApiKey(makeReq({ key: token }));
+  assert.notEqual(r.kind, 'enterprise');
+});
+
+test('enterprise key carries kind=enterprise (the only key kind that bypasses entitlement)', async () => {
+  const r = await validateApiKey(makeReq({ key: ENTERPRISE_KEY }));
+  assert.equal(r.valid, true);
+  assert.equal(r.kind, 'enterprise');
+});
+
+test('valid wms_ session token works even when Origin is also forged (not redundant — no privilege escalation)', async () => {
+  const { token } = await issueSessionToken();
+  const r = await validateApiKey(makeReq({ origin: 'https://evil.example.com', key: token }));
+  assert.equal(r.valid, true);
+});
+
+test('tampered wms_ token is rejected', async () => {
+  const { token } = await issueSessionToken();
+  const tampered = token.slice(0, -1) + (token.slice(-1) === 'A' ? 'B' : 'A');
+  const r = await validateApiKey(makeReq({ key: tampered }));
+  assert.equal(r.valid, false);
+  assert.equal(r.error, 'Invalid session token');
+});
+
+test('garbage wms_ shape is rejected', async () => {
+  const r = await validateApiKey(makeReq({ key: 'wms_garbage' }));
+  assert.equal(r.valid, false);
+});
+
+// ── Enterprise key (WORLDMONITOR_VALID_KEYS) ────────────────────────────────
+
+test('valid enterprise key is accepted from any origin', async () => {
+  const r = await validateApiKey(makeReq({ origin: 'https://evil.example.com', key: ENTERPRISE_KEY }));
+  assert.equal(r.valid, true);
+  assert.equal(r.required, true);
+});
+
+test('invalid enterprise-shape key is rejected', async () => {
+  const r = await validateApiKey(makeReq({ key: 'random-string' }));
+  assert.equal(r.valid, false);
+});
+
+// ── User API key (wm_-prefix) — gateway handles validation ──────────────────
+
+test('wm_-prefixed user key returns required:true / valid:false so gateway can fall back', async () => {
+  // Gateway code at server/gateway.ts:440 does:
+  //   if (keyCheck.required && !keyCheck.valid && wmKey.startsWith('wm_')) { ...validateUserApiKey... }
+  // So validateApiKey must return that exact shape for wm_ keys to trigger the fallback.
+  const r = await validateApiKey(makeReq({ key: 'wm_user_abc123' }));
+  assert.equal(r.required, true);
+  assert.equal(r.valid, false);
+});
+
+// ── Desktop (Tauri) — always requires enterprise key ────────────────────────
+
+test('desktop Tauri origin without key is rejected', async () => {
+  const r = await validateApiKey(makeReq({ origin: 'tauri://localhost' }));
+  assert.equal(r.valid, false);
+  assert.equal(r.error, 'API key required for desktop access');
+});
+
+test('desktop Tauri origin with valid enterprise key is accepted', async () => {
+  const r = await validateApiKey(makeReq({ origin: 'tauri://localhost', key: ENTERPRISE_KEY }));
+  assert.equal(r.valid, true);
+});
+
+test('desktop Tauri origin with wms_ session token is rejected (desktop must use enterprise key)', async () => {
+  const { token } = await issueSessionToken();
+  const r = await validateApiKey(makeReq({ origin: 'tauri://localhost', key: token }));
+  assert.equal(r.valid, false);
+});
+
+// ── Total absence of credentials ────────────────────────────────────────────
+
+test('completely unauthenticated request is rejected', async () => {
+  const r = await validateApiKey(makeReq({}));
+  assert.equal(r.valid, false);
+  assert.equal(r.required, true);
+});
+
+// ── forceKey option ─────────────────────────────────────────────────────────
+
+// forceKey=true behavior is exercised above:
+//   - wms_ token + forceKey=true → REJECTED (PR #3557 review fix)
+//   - wms_ token + forceKey=false → accepted
+//   - enterprise key + forceKey=true → accepted (covered by enterprise tests)
@@ -72,7 +72,7 @@ export function createRelayHandler(cfg) {
     }
 
     if (cfg.requireApiKey) {
-      const keyCheck = validateApiKey(req);
+      const keyCheck = await validateApiKey(req);
       if (keyCheck.required && !keyCheck.valid) {
         return jsonResponse({ error: keyCheck.error }, 401, corsHeaders);
       }
Original file line number	Diff line number	Diff line change
`@@ -72,7 +72,7 @@ export function createRelayHandler(cfg) {`
`72`	`72`	`}`
`73`	`73`
`74`	`74`	`if (cfg.requireApiKey) {`
`75`		`- const keyCheck = validateApiKey(req);`
	`75`	`+ const keyCheck = await validateApiKey(req);`
`76`	`76`	`if (keyCheck.required && !keyCheck.valid) {`
`77`	`77`	`return jsonResponse({ error: keyCheck.error }, 401, corsHeaders);`
`78`	`78`	`}`