fix(auth): build password-reset links from an operator-set public address, never the Host header (M462 #4981)

buildResetURL used r.Host and r.TLS, so a forgot-password request with a forged Host emailed the victim a real reset token on a link to the attacker's server. Links now come only from network_settings.public_url (migration 0062), and no reset email is sent while it is empty; the response stays the same opaque 200 and the log says why. The address is set on a new "Public address" card under Admin → Integrations, which offers the page's own origin and warns while unset. PUT /api/admin/network-settings takes either field alone, so the proxy card and this one can't overwrite each other. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 09:32:10 -04:00
parent d411693bb2
commit 46194a609d
16 changed files with 433 additions and 26 deletions
@@ -0,0 +1,75 @@
+import { describe, expect, test, vi, beforeEach } from 'vitest';
+import { render, screen, fireEvent, waitFor } from '@testing-library/svelte';
+import PublicAddressCard from './PublicAddressCard.svelte';
+
+const getNetworkSettings = vi.fn();
+const updatePublicUrl = vi.fn();
+
+vi.mock('$lib/api/admin', () => ({
+  getNetworkSettings: () => getNetworkSettings(),
+  updatePublicUrl: (url: string) => updatePublicUrl(url)
+}));
+
+const pushToast = vi.fn();
+vi.mock('$lib/stores/toast.svelte', () => ({
+  pushToast: (...args: unknown[]) => pushToast(...args)
+}));
+
+function settings(publicUrl: string) {
+  return {
+    trusted_proxy_hops: 1,
+    max_hops: 10,
+    detected_client_ip: '198.51.100.7',
+    forwarded_chain: '198.51.100.7',
+    remote_addr: '172.18.0.1:40000',
+    public_url: publicUrl
+  };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe('PublicAddressCard', () => {
+  test('warns that reset emails are not sent while the address is unset', async () => {
+    getNetworkSettings.mockResolvedValue(settings(''));
+    render(PublicAddressCard);
+    expect(await screen.findByText(/password-reset emails are not being sent/i)).toBeTruthy();
+  });
+
+  test('no warning once an address is saved', async () => {
+    getNetworkSettings.mockResolvedValue(settings('https://music.example.com'));
+    render(PublicAddressCard);
+    await screen.findByDisplayValue('https://music.example.com');
+    expect(screen.queryByText(/not being sent/i)).toBeNull();
+  });
+
+  test('offers this page’s own origin and saves it trimmed', async () => {
+    getNetworkSettings.mockResolvedValue(settings(''));
+    updatePublicUrl.mockResolvedValue(settings(window.location.origin));
+    render(PublicAddressCard);
+
+    await fireEvent.click(await screen.findByRole('button', { name: /^Use / }));
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }));
+
+    await waitFor(() => expect(updatePublicUrl).toHaveBeenCalledWith(window.location.origin));
+    expect(pushToast).toHaveBeenCalledWith('Public address saved.');
+  });
+
+  test('shows the server’s reason when an address is refused', async () => {
+    getNetworkSettings.mockResolvedValue(settings(''));
+    updatePublicUrl.mockRejectedValue({
+      code: 'invalid_public_url',
+      message: 'public URL must be an http:// or https:// address',
+      status: 400
+    });
+    render(PublicAddressCard);
+
+    const input = await screen.findByPlaceholderText('https://music.example.com');
+    await fireEvent.input(input, { target: { value: 'music.example.com' } });
+    await fireEvent.click(screen.getByRole('button', { name: /save/i }));
+
+    await waitFor(() => expect(pushToast).toHaveBeenCalled());
+    expect(pushToast.mock.calls[0][1]).toBe('error');
+  });
+});