feat: support private network access without identity headers

src/features/access/policy.server.ts

@@ -1,21 +1,27 @@
-type AccessConfig = { origin: string; allowedLogin: string }
+type AccessConfig = { origin: string } & (
+  | { mode: 'tailscale'; allowedLogin: string }
+  | { mode: 'none' }
+)
 
 export function readAccessConfig(): AccessConfig | null {
   const origin = process.env.TWITTER_LITE_ORIGIN
+  const mode = process.env.TWITTER_LITE_AUTH_MODE ?? 'tailscale'
   const allowedLogin = process.env.TWITTER_LITE_ALLOWED_LOGIN
-  if (!origin || !allowedLogin?.trim()) return null
+  if (!origin || (mode !== 'tailscale' && mode !== 'none')) return null
   try {
     const url = new URL(origin)
     const secure = url.protocol === 'https:'
     const local = url.protocol === 'http:' && url.hostname === '127.0.0.1'
     if ((!secure && !local) || url.origin !== origin) return null
-    return { origin, allowedLogin }
+    if (mode === 'none') return { origin, mode }
+    if (!allowedLogin?.trim()) return null
+    return { origin, mode, allowedLogin }
   } catch {
     return null
   }
 }
 
-/** The backend must bind to loopback; only Serve may supply identity headers. */
+/** Use loopback behind Serve for identity, or a private network for mode none. */
 export function checkAccess(
   request: Request,
   config: AccessConfig | null,
@@ -23,7 +29,10 @@ export function checkAccess(
   if (!config) {
     return new Response('Access configuration is required.', { status: 503 })
   }
-  if (request.headers.get('Tailscale-User-Login') !== config.allowedLogin) {
+  if (
+    config.mode === 'tailscale' &&
+    request.headers.get('Tailscale-User-Login') !== config.allowedLogin
+  ) {
     return new Response('Forbidden', { status: 403 })
   }
   if (

src/features/access/policy.test.ts

@@ -1,15 +1,88 @@
 // @vitest-environment node
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { checkAccess, readAccessConfig } from './policy.server'
 
 const config = {
+  mode: 'tailscale' as const,
   origin: 'https://deck.invalid',
   allowedLogin: '[email protected]',
 }
 
+beforeEach(() => vi.stubEnv('TWITTER_LITE_AUTH_MODE', undefined))
 afterEach(() => vi.unstubAllEnvs())
 
-describe('Serve access boundary', () => {
+describe('access boundary', () => {
+  it.each([
+    undefined,
+    'tailscale',
+  ])('requires an owner in identity mode: %s', (mode) => {
+    vi.stubEnv('TWITTER_LITE_AUTH_MODE', mode)
+    vi.stubEnv('TWITTER_LITE_ORIGIN', config.origin)
+    vi.stubEnv('TWITTER_LITE_ALLOWED_LOGIN', '')
+    expect(readAccessConfig()).toBeNull()
+  })
+
+  it.each([
+    '',
+    'off',
+    'NONE',
+  ])('fails closed for an unknown auth mode: %s', (mode) => {
+    vi.stubEnv('TWITTER_LITE_AUTH_MODE', mode)
+    vi.stubEnv('TWITTER_LITE_ORIGIN', config.origin)
+    vi.stubEnv('TWITTER_LITE_ALLOWED_LOGIN', config.allowedLogin)
+    expect(
+      checkAccess(new Request(config.origin), readAccessConfig())?.status,
+    ).toBe(503)
+  })
+
+  it('allows private-proxy navigation without an identity only when explicitly configured', () => {
+    vi.stubEnv('TWITTER_LITE_AUTH_MODE', 'none')
+    vi.stubEnv('TWITTER_LITE_ORIGIN', config.origin)
+    vi.stubEnv('TWITTER_LITE_ALLOWED_LOGIN', '')
+    const access = readAccessConfig()
+    expect(access).toEqual({ origin: config.origin, mode: 'none' })
+    expect(checkAccess(new Request(config.origin), access)).toBeNull()
+  })
+
+  it('still requires a configured origin without identity authentication', () => {
+    vi.stubEnv('TWITTER_LITE_AUTH_MODE', 'none')
+    vi.stubEnv('TWITTER_LITE_ORIGIN', '')
+    expect(readAccessConfig()).toBeNull()
+  })
+
+  it.each([
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+  ])('requires exact Origin without identity authentication for %s', (method) => {
+    const access = { origin: config.origin, mode: 'none' as const }
+    expect(
+      checkAccess(new Request(config.origin, { method }), access)?.status,
+    ).toBe(403)
+    expect(
+      checkAccess(
+        new Request(config.origin, {
+          method,
+          headers: {
+            Origin: 'https://other.invalid',
+            'Sec-Fetch-Site': 'same-origin',
+          },
+        }),
+        access,
+      )?.status,
+    ).toBe(403)
+    expect(
+      checkAccess(
+        new Request(config.origin, {
+          method,
+          headers: { Origin: config.origin },
+        }),
+        access,
+      ),
+    ).toBeNull()
+  })
+
   it('fails closed when the deployment is not configured', () => {
     vi.stubEnv('TWITTER_LITE_ORIGIN', '')
     vi.stubEnv('TWITTER_LITE_ALLOWED_LOGIN', '')