fix(authz): REQUIRE_API_KEY=false never meant "the internet may call this"

[LMPrado-DZ23]

CRITICAL + HIGH from the security audit of this tree. Both were reproduced before being fixed.

The CRITICAL: a published instance is an open LLM relay

The audit sent this to a local instance with a dashboard password set, requireLogin on, and every /api/** route correctly answering 401 — with no credential of any kind:

POST /v1/chat/completions  {"model":"auto","messages":[{"role":"user","content":"hi"}]}
→ 502  "oc/muse-spark-1.2: [402] … oc/big-pickle: [403] …"
   diagnostics: {"poolSize":8,"attempted":6,...}

502, not 401. The request passed authorization, passed routing, and the gateway made six real upstream calls on an anonymous caller's behalf.

requireLogin governs /api/**. /v1/** — the inference surface — is governed by REQUIRE_API_KEY, which ships false. On a public domain that is a free LLM relay billed to the operator, running on their provider credentials and quota, with arbitrary prompts landing in call_logs.

It is inconsistent even inside /v1: GET /v1/models keys on requireLogin and does 401. That is exactly why spot-checking makes the instance look closed. My own 3.8.54 smoke test made that mistake — I probed /api/** and /v1/models, saw 401 everywhere, and reported the image as closed by default.

The fix

The allowed identity was already literally named local. It just was not checked:

if (!isRequireApiKeyEnabled() && isLocalCaller(ctx)) {
  return allow({ kind: "anonymous", id: "local" });
}

isLoopbackRequest / isPrivateLanRequest already exist, are used by the management policy, are proxy-aware and fail closed — a request that arrived through a reverse proxy is never local even though its socket peer is loopback, and an unresolvable peer counts as remote.

So domain → Caddy/nginx/cloudflared → OmniRoute is refused, while localhost and a LAN IDE are untouched. There is deliberately no flag to re-open anonymous remote access: an operator who wants remote callers issues them a key, which is what REQUIRE_API_KEY=true has always been for. A flag to restore the hole is not a feature.

The deployment recipes disagreed, and the public one was wrong

File	Was	Is
docs/ops/VM_DEPLOYMENT_GUIDE.md — "Deployment on VM with Cloudflare"	REQUIRE_API_KEY=false	true, with the reason inline
docker-compose.prod.yml	unset → false	${REQUIRE_API_KEY:-true}
fly.toml	unset → false	"true"
contrib/vps/compose.yaml	already :-true	unchanged
contrib/podman/omniroute.container	already true	unchanged

The VM guide is the one for a public domain, and it printed the open setting two lines below AUTH_COOKIE_SECURE=true, with no warning.

A test had encoded the defect as the contract

tests/unit/authz/route-origin-auth-matrix.test.ts expected ALLOW("anonymous") for a CLIENT_API request from a public origin. That row is corrected, with the reason written down — this is the class of test that makes a vulnerability look intentional.

tests/unit/authz/client-api-anonymous-is-local-only.test.ts pins both directions, because a fix that only closed the hole would break every local and LAN user of the default configuration: loopback (v4 and v6) and private LAN still allowed; public peer and unresolvable peer refused; REQUIRE_API_KEY=true still refuses loopback.

The HIGH: fork PRs execute on the maintainer's LAN runner

# quality.yml, lint-guard
runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-light"]')) || 'ubuntu-latest' }}

No fork clause. It triggers on pull_request against release/** and runs npm ci — without --ignore-scripts — against the fork's own lockfile. That is arbitrary code execution on a persistent machine that keeps state between jobs, and the very next line sets continue-on-error for forks, so it goes green.

The file states that rule in its own comments ("a fork PR must never execute on the LAN runner") and ci.yml's build job implements it. This copies the same own-origin clause.

tests/unit/workflows-self-hosted-fork-guard.test.ts compares every self-hosted runs-on in a pull_request workflow against the guard, and refuses to pass vacuously if the selectors move. Proven failable: reverting the one line takes it from 1 pass to 1 fail.

Gates

Gate	Result
tests/unit/authz/** + fork guard	320 pass / 0 fail
client-api-anonymous-is-local-only	5 pass
typecheck:core	exit 0, 0 errors
eslint --max-warnings=0	exit 0
prettier --check	clean

Six pre-existing tests failed on first run because their policy contexts carried no peer address — the locality helpers correctly fail closed on that. Giving them a loopback peer is the honest fix: a local caller is loopback, and the contexts now resemble the requests they claim to model.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 418bf2d9-3c00-4d4a-8bdb-68966ccbaa7a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}