fix(server): enforce site mode behind proxies

Author: chrisbbreuer

storage/framework/core/server/src/maintenance.ts

@@ -254,12 +254,13 @@ export async function launch(): Promise<void> {
 /**
  * Check if an IP address is allowed during maintenance
  */
-export function isAllowedIp(ip: string, allowed: string[] = []): boolean {
-  // Always allow localhost — including when no allowlist is configured. The
-  // empty-list early-return used to sit above this check, which gated the
-  // developer's own `buddy dev` session behind the coming-soon page.
+export function isAllowedIp(ip: string, allowed: string[] = [], trustLocalhost = true): boolean {
+  // Localhost is convenient in development, but deployed reverse proxies
+  // commonly reach the app over loopback. Production/staging callers must
+  // opt out or every proxied visitor can inherit this bypass when the proxy
+  // does not forward a client-IP header.
   const localhostIps = ['127.0.0.1', '::1', 'localhost']
-  if (localhostIps.includes(ip)) {
+  if (trustLocalhost && localhostIps.includes(ip)) {
     return true
   }
 
@@ -606,7 +607,9 @@ export async function maintenanceGate(req: Request): Promise<Response | null> {
 
   const cookies = parseCookieHeader(req.headers.get('cookie'))
   const hasCookie = !!payload.secret && hasValidBypassCookie(cookies, payload.secret, mode)
-  const ipAllowed = isAllowedIp(clientIp(req), payload.allowed)
+  const appEnv = (process.env.APP_ENV || process.env.NODE_ENV || '').toLowerCase()
+  const trustLocalhost = !['production', 'staging'].includes(appEnv)
+  const ipAllowed = isAllowedIp(clientIp(req), payload.allowed, trustLocalhost)
 
   if (hasCookie || ipAllowed)
     return null

storage/framework/core/server/tests/server.test.ts

@@ -39,6 +39,13 @@ describe('server maintenance', () => {
     expect(isAllowedIp('localhost', ['10.0.0.1'])).toBe(true)
   })
 
+  test('isAllowedIp can reject proxy loopback outside development', async () => {
+    const { isAllowedIp } = await import('../src/maintenance')
+    expect(isAllowedIp('127.0.0.1', [], false)).toBe(false)
+    expect(isAllowedIp('::1', [], false)).toBe(false)
+    expect(isAllowedIp('127.0.0.1', ['127.0.0.1'], false)).toBe(true)
+  })
+
   test('isAllowedIp checks against allowed list', async () => {
     const { isAllowedIp } = await import('../src/maintenance')
     expect(isAllowedIp('10.0.0.1', ['10.0.0.1', '10.0.0.2'])).toBe(true)
@@ -126,6 +133,29 @@ describe('server maintenance', () => {
       process.env.APP_COMING_SOON_SECRET = previousSecret
   })
 
+  test('maintenanceGate does not treat a production proxy as a localhost bypass', async () => {
+    const { maintenanceGate } = await import('../src/maintenance')
+    const previousMode = process.env.APP_COMING_SOON
+    const previousAppEnv = process.env.APP_ENV
+
+    process.env.APP_COMING_SOON = 'true'
+    process.env.APP_ENV = 'production'
+
+    const response = await maintenanceGate(new Request('http://127.0.0.1/'))
+    expect(response?.status).toBe(302)
+    expect(response?.headers.get('Location')).toBe('/coming-soon')
+
+    if (previousMode === undefined)
+      delete process.env.APP_COMING_SOON
+    else
+      process.env.APP_COMING_SOON = previousMode
+
+    if (previousAppEnv === undefined)
+      delete process.env.APP_ENV
+    else
+      process.env.APP_ENV = previousAppEnv
+  })
+
   test('maintenanceHtml includes retry info when provided', async () => {
     const { maintenanceHtml } = await import('../src/maintenance')
     const html = maintenanceHtml({ time: Date.now(), retry: 300 })