fix(webapp): guard the scenario kit's app origin like its other hosts

The seed script refused a non-local Redis or ClickHouse host outright, but sent
the target's API key to whatever `APP_ORIGIN` named. All three now go through
one guard, which also fixes it for a bracketed IPv6 host — `URL.hostname` hands
back `[::1]`, which the old set membership never matched.

Author: kathiekiwi

apps/webapp/app/utils/localHostGuard.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+import { checkLocalOrigin, isLocalHost, LOCAL_HOSTS } from "./localHostGuard";
+
+describe("checkLocalOrigin", () => {
+  it("accepts every host the Redis and ClickHouse guards accept", () => {
+    for (const host of LOCAL_HOSTS) {
+      const origin = host === "::1" ? "http://[::1]:3030" : `http://${host}:3030`;
+      expect(checkLocalOrigin(origin)).toEqual({ ok: true, origin });
+    }
+  });
+
+  it("refuses a remote origin, so a seed script can't send an API key off-box", () => {
+    expect(checkLocalOrigin("https://cloud.trigger.dev")).toEqual({
+      ok: false,
+      reason: "non_local",
+      hostname: "cloud.trigger.dev",
+    });
+    expect(checkLocalOrigin("http://10.0.0.7:3030")).toEqual({
+      ok: false,
+      reason: "non_local",
+      hostname: "10.0.0.7",
+    });
+  });
+
+  // "localhost.attacker.example" and "notlocalhost" both end or start with a local name.
+  it("matches the whole hostname, never a prefix or suffix of one", () => {
+    expect(checkLocalOrigin("http://localhost.attacker.example").ok).toBe(false);
+    expect(checkLocalOrigin("http://notlocalhost:3030").ok).toBe(false);
+    expect(isLocalHost("127.0.0.1.attacker.example")).toBe(false);
+  });
+
+  it("refuses what it cannot parse rather than passing it through", () => {
+    expect(checkLocalOrigin("localhost:3030").ok).toBe(false);
+    expect(checkLocalOrigin("").ok).toBe(false);
+  });
+});

apps/webapp/app/utils/localHostGuard.ts

@@ -0,0 +1,30 @@
+/**
+ * The one definition of "local" the dev-only seed scripts stage against. They carry API keys
+ * and destructive writes, so every host they touch — Redis, ClickHouse, the webapp itself —
+ * is checked here rather than each deciding for itself.
+ */
+
+export const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+
+/** `URL.hostname` brackets IPv6, so `::1` arrives as `[::1]`. */
+export function isLocalHost(hostname: string): boolean {
+  return LOCAL_HOSTS.has(hostname.replace(/^\[(.*)\]$/, "$1"));
+}
+
+export type LocalOriginCheck =
+  | { ok: true; origin: string }
+  | { ok: false; reason: "unparseable" | "non_local"; hostname?: string };
+
+/** Never returns the URL in the failure: an origin can carry credentials. */
+export function checkLocalOrigin(origin: string): LocalOriginCheck {
+  let parsed: URL;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    return { ok: false, reason: "unparseable" };
+  }
+  if (!isLocalHost(parsed.hostname)) {
+    return { ok: false, reason: "non_local", hostname: parsed.hostname };
+  }
+  return { ok: true, origin };
+}

apps/webapp/seed-watch-scenarios.mts

@@ -10,14 +10,29 @@ import { randomUUID } from "node:crypto";
 // module's exports only through `default`.
 import dbServer from "./app/db.server";
 import errorFingerprinting from "./app/utils/errorFingerprinting";
+import localHostGuard from "./app/utils/localHostGuard";
 import eventCommon from "./app/v3/eventRepository/common.server";
 
 const { prisma } = dbServer;
 const { calculateErrorFingerprint } = errorFingerprinting;
+const { isLocalHost, checkLocalOrigin } = localHostGuard;
 const { generateTraceId, generateSpanId } = eventCommon;
 
 const APP_ORIGIN = process.env.APP_ORIGIN ?? "http://localhost:3030";
 
+/** Every request to it carries the target's API key, so it is checked like the rest. */
+function appOrigin(): string {
+  const checked = checkLocalOrigin(APP_ORIGIN);
+  if (!checked.ok) {
+    fail(
+      checked.reason === "non_local"
+        ? `Refusing to send an API key to a non-local host: ${checked.hostname}`
+        : "APP_ORIGIN isn't a URL."
+    );
+  }
+  return checked.origin;
+}
+
 const DEFAULT_RUN_SECONDS = 60;
 const DEFAULT_FAIL_TASK = "slow-fail";
 const DEFAULT_SUCCEED_TASK = "slow-succeed";
@@ -174,8 +189,6 @@ type RedisLike = {
 
 const ZADD_BATCH = 1_000;
 
-const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
-
 function envQueueKey(organizationId: string, environmentId: string): string {
   return `engine:runqueue:{org:${organizationId}}:env:${environmentId}`;
 }
@@ -195,7 +208,7 @@ async function openRedis(): Promise<RedisLike> {
   const port = Number(
     process.env.RUN_ENGINE_RUN_QUEUE_REDIS_PORT ?? process.env.REDIS_PORT ?? 6379
   );
-  if (!LOCAL_HOSTS.has(host)) {
+  if (!isLocalHost(host)) {
     fail(`Refusing to stage Redis on a non-local host: ${host}`);
   }
   const { createRedisClient } = await import("@internal/redis");
@@ -267,7 +280,7 @@ function clickhouse(): ClickHouse {
   }
   const parsed = new URL(url);
   // Never echo the URL: it carries credentials.
-  if (!LOCAL_HOSTS.has(parsed.hostname)) {
+  if (!isLocalHost(parsed.hostname)) {
     fail(`Refusing to run against a non-local ClickHouse host: ${parsed.hostname}`);
   }
   parsed.searchParams.delete("secure");
@@ -448,7 +461,8 @@ async function runScenario(
   taskFlag: string | undefined
 ) {
   const taskId = taskFlag ?? (kind === "fail" ? DEFAULT_FAIL_TASK : DEFAULT_SUCCEED_TASK);
-  const response = await fetch(`${APP_ORIGIN}/api/v1/tasks/${taskId}/trigger`, {
+  const origin = appOrigin();
+  const response = await fetch(`${origin}/api/v1/tasks/${taskId}/trigger`, {
     method: "POST",
     headers: {
       "content-type": "application/json",
@@ -457,7 +471,7 @@ async function runScenario(
     body: JSON.stringify({ payload: { seconds } }),
   }).catch((error: unknown) => {
     fail(
-      `Could not reach ${APP_ORIGIN} (${error instanceof Error ? error.message : error}). ` +
+      `Could not reach ${origin} (${error instanceof Error ? error.message : error}). ` +
         `Is the webapp running?`
     );
   });