security: harden the pre-authentication request surface

[KrasimirKralev]

Part of the ongoing security-hardening sweep (targeting beta).

What this does — narrows what is reachable before a session exists: several privileged /setup-api/* surfaces that play no part in first-boot onboarding are no longer served during the pre-setup window, while the wizard's own routes (including the gateway readiness check) keep working. Also hardens a reflected request-header sink by validating and encoding it before it reaches an inline script.

Authenticated callers and the MCP bearer path are unaffected — the gated routes simply fall through to the normal session checks.

Validation — build + full unit suite on the Jetson; new middleware coverage for the gate (sensitive routes blocked pre-setup, readiness route still open, valid session allowed) passes 59/59 in isolation. The one unrelated failure in the full run is the known updater timing flake (fixed separately in #332).

Vulnerability specifics intentionally omitted from this public description.

Summary by CodeRabbit

• Security
  • Protected sensitive setup API routes with session or bearer authentication, including during initial setup.
  • Added validation for gateway host values and safe handling of generated WebSocket URLs.
• Bug Fixes
  • Kept gateway health checks accessible while requiring authentication for protected setup endpoints.
  • Added coverage for unauthenticated and authenticated access scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7b413724-b62e-40f6-943f-be73f1d89b76

📥 Commits

Reviewing files that changed from the base of the PR and between 4747672 and f73118d.

📒 Files selected for processing (2)

• src/middleware.ts
• src/tests/middleware/middleware.test.ts

---

📝 Walkthrough

Walkthrough

The gateway setup route validates host values and safely serializes WebSocket URLs. Middleware now requires authentication for sensitive setup APIs during setup. Tests cover denied, allowed, and authenticated access paths.

Changes

Setup API security hardening

Layer / File(s)	Summary
Gateway host and WebSocket script safety src/app/setup-api/gateway/route.ts	The route accepts safe hostname or IPv6-literal host values and falls back to clawbox.local. The generated JavaScript uses JSON.stringify for the WebSocket URL.
Sensitive setup API authentication src/middleware.ts, src/tests/middleware/middleware.test.ts	Middleware identifies sensitive setup API paths and applies MCP bearer or session authentication. Tests cover rejected unauthenticated requests, accessible gateway health checks, and valid session access.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant middleware
  participant RouteClassifier
  participant AuthChecks
  Client->>middleware: Request setup API route
  middleware->>RouteClassifier: Classify route sensitivity
  RouteClassifier-->>middleware: Sensitive or non-sensitive
  middleware->>AuthChecks: Check MCP bearer or session
  AuthChecks-->>middleware: Authentication result
  middleware-->>Client: JSON 401 or continue to route

Loading

Suggested reviewers: georgik77, yalexx

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the security hardening changes to the pre-authentication request surface.
Description check	✅ Passed	The description clearly explains the changes, affected routes, security impact, and validation results, but omits the template sections and checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sec-preauth-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🦀 ClawReview

Your friendly reef crab, here with the lay of the land.

Tightens the pre-authentication surface during the first-boot setup window: a list of sensitive desktop/agent backends (file access, browser automation, code workspace, VNC, tunnels, and the gateway token endpoint) are now gated behind a session or MCP bearer even before setup completes, closing a window where those routes were reachable unauthenticated over the open ClawBox-Setup AP. Also hardens the gateway route, which was reflecting the Host header directly into an inline <script> — it now validates the header against an allowlist of hostname/IP characters and wraps the result with JSON.stringify before embedding.

At a glance

• 🔧 Fix · touches middleware auth gate + gateway HTML injection path
• Base branch: beta · +56 source / +58 tests across 3 files
• ✅ base beta matches the beta-first convention
• 🟡 title doesn't follow type: description (feat/fix/chore/docs/…)
• ✅ source changes come with test changes
• ℹ️ touches security-sensitive paths (src/middleware.ts) — review with extra care

Good to know

• 🟡 src/middleware.ts runs on every request on customer hardware — changes here have broad blast radius. The logic is narrow and additive (a new isSensitiveSetupApi guard), but worth a careful read.
• ℹ️ The /setup-api/gateway/health carve-out is intentional: the wizard polls it before setup_complete is written, so it must stay open while the sibling gateway SPA proxy and ws-config are gated.
• ℹ️ 58 lines of new middleware tests cover: each sensitive route blocked pre-setup, the health exception, and an authenticated caller reaching a gated route — solid regression guard for this surface.
• 🟡 Part of a concurrent security sweep (see also fix(security): harden local WS/proxy auth, secret file modes, and agent egress #331, security: tighten Files API path containment #334, security: scope the package-manager sudo grant to exact commands #335, security: authentication & session hardening #336) — reviewers may want to check for interactions between these overlapping middleware/auth changes landing close together.

_{— ClawReview 🦀, your resident reef crab. Just orientation — CodeRabbit does the line-by-line, humans do the merge. Conventions: docs.}

[github-actions]

CI Summary

✅ Tests

• Result: passed
• View run
• Coverage: statements 70.79%, branches 61.14%, functions 66.76%, lines 72.67%

✅ E2E

• Result: passed
• View run

✅ E2E Install

• Result: success
• View run