Skip to content

Harden optional proxy request boundaries #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pH-7 wants to merge 9 commits into
base: main
Choose a base branch
from
Draft

Harden optional proxy request boundaries #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
a4c8ded
Patch vulnerable HTTP dependencies to protect proxy requests
pH-7 Sep 12, 2026
4765d2b
Reject malformed queries before provider execution
pH-7 Sep 12, 2026
adfb224
Validate license resources using their JSON API envelope
pH-7 Sep 12, 2026
679d28b
Retire JWT issuance that proxy authentication never accepts
pH-7 Sep 12, 2026
c89f9ff
Keep private request data out of provider logs
pH-7 Sep 12, 2026
15dca34
Bound Axios generation requests to avoid indefinite waits
pH-7 Sep 12, 2026
4637b71
Enforce HTTP boundaries with explicit proxy trust
pH-7 Sep 12, 2026
7d2e37e
Ignore local environment variants to prevent credential commits
pH-7 Sep 12, 2026
da2121c
Document the optional proxy contract for current clients
pH-7 Sep 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .env.dist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ RATE_LIMIT_MAX=100
# Token and Secret
JWT_SECRET=""
BROWSER_EXTENSION_SECRET=""
JWT_TOKEN_EXPIRY_TIME="3h"


## Mistral AI
Expand Down Expand Up @@ -41,3 +40,6 @@ LLAMA_TIMEOUT_MS=45000
# Lemonsqueezy
LICENSE_CHECK_ENABLED=false
LEMON_SQUEEZY_API_KEY=""

# Leave 0 for direct access; set the exact trusted reverse-proxy hop count when deployed.
TRUST_PROXY_HOPS=0
8 changes: 5 additions & 3 deletions .env.railway.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,11 @@ REQUEST_BODY_LIMIT=64kb
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=100

# Must match Succeed AI/Config.swift apiKey in the signed macOS build.
# Shared opaque token for trusted clients of this optional proxy.
JWT_SECRET=

# Optional secondary token for browser-extension or internal clients.
BROWSER_EXTENSION_SECRET=
JWT_TOKEN_EXPIRY_TIME=3h

# Default production provider.
OPENAI_API_ENABLED=true
Expand All @@ -35,6 +34,9 @@ LLAMA_MODEL=
LLAMA_MAX_COMPLETION_TOKENS=1200
LLAMA_TIMEOUT_MS=45000

# Enable only after Lemon Squeezy license keys are available in the macOS app.
# Enable only for clients that send a verified Lemon Squeezy license header.
LICENSE_CHECK_ENABLED=false
LEMON_SQUEEZY_API_KEY=

# Leave 0 for direct access; set the exact trusted reverse-proxy hop count when deployed.
TRUST_PROXY_HOPS=0
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
# Distribution
dist
.env
.env.*
!.env.dist
!.env.railway.example

# Package manager
node_modules
Expand Down
Loading