feat: finish the ai plugin (B18)

plugins/ai/src/backend/egress.ts

@@ -1,20 +1,20 @@
-import { isIP } from "net";
-import { isBlockedAddress } from "../../../../src/backend/utils/safe-outbound-fetch.js";
-import { createCurrentSettingsRepository } from "../../../../src/backend/database/repositories/factory.js";
+import { BlockList, isIP } from "net";
 
 /**
  * Where the assistant is allowed to send requests.
  *
- * Cloud providers are reached through the SSRF-guarded path, which refuses to
- * resolve to a private address. That guard is exactly what a self-hosted Ollama
- * on localhost trips over, so private destinations are permitted only when an
- * admin has named the host. Without that split, any logged-in user could point
- * a "provider" at an internal service and use the backend as an authenticated
- * probe of the server's own network.
+ * Every provider request goes through ctx.fetch, which refuses private and
+ * loopback addresses (after DNS, too) unless the exact host is listed. That
+ * guard is exactly what a self-hosted Ollama on localhost trips over, so the
+ * admin setting "privateEndpoints" names the hosts that may be private.
+ * Without that split, any logged-in user could point a "provider" at an
+ * internal service and use the backend as an authenticated probe of the
+ * server's own network.
+ *
+ * The checks here only exist to give a useful message before the request is
+ * made. ctx.fetch is the control.
  */
 
-export const AI_PRIVATE_ALLOWLIST_KEY = "ai_private_endpoint_allowlist";
-
 /** Hosts a self-hoster almost certainly wants, and which reach only this machine. */
 export const DEFAULT_PRIVATE_ALLOWLIST = [
   "localhost",
@@ -23,35 +23,53 @@ export const DEFAULT_PRIVATE_ALLOWLIST = [
   "host.docker.internal",
 ];
 
-export function parseAllowlist(raw: string | null): string[] {
-  if (!raw) return [...DEFAULT_PRIVATE_ALLOWLIST];
-  try {
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) return [...DEFAULT_PRIVATE_ALLOWLIST];
-    return parsed
-      .filter((entry): entry is string => typeof entry === "string")
-      .map((entry) => entry.trim().toLowerCase())
-      .filter(Boolean);
-  } catch {
-    return [...DEFAULT_PRIVATE_ALLOWLIST];
+export const PRIVATE_DESTINATION_MESSAGE =
+  "This address is on a private network. An administrator must add its host to the AI endpoint allowlist first.";
+
+/** A bare host, not a URL: no scheme, path, port or whitespace. */
+const HOST_PATTERN = /^[a-z0-9._:-]+$/;
+
+/**
+ * The admin setting is one host per line. Anything that is not a bare host
+ * is ignored rather than failing the whole list.
+ */
+export function parseAllowlist(raw: unknown): string[] {
+  if (typeof raw !== "string") return [...DEFAULT_PRIVATE_ALLOWLIST];
+  const hosts: string[] = [];
+  for (const line of raw.split(/[\r\n,]+/)) {
+    const host = line.trim().toLowerCase();
+    if (host && HOST_PATTERN.test(host) && !hosts.includes(host)) {
+      hosts.push(host);
+    }
   }
+  return hosts;
 }
 
-export async function readPrivateAllowlist(): Promise<string[]> {
-  const raw = await createCurrentSettingsRepository().get(
-    AI_PRIVATE_ALLOWLIST_KEY,
-  );
-  return parseAllowlist(raw);
-}
+const PRIVATE_RANGES = (() => {
+  const list = new BlockList();
+  list.addSubnet("0.0.0.0", 8, "ipv4");
+  list.addSubnet("10.0.0.0", 8, "ipv4");
+  list.addSubnet("100.64.0.0", 10, "ipv4");
+  list.addSubnet("127.0.0.0", 8, "ipv4");
+  list.addSubnet("169.254.0.0", 16, "ipv4");
+  list.addSubnet("172.16.0.0", 12, "ipv4");
+  list.addSubnet("192.168.0.0", 16, "ipv4");
+  list.addAddress("::", "ipv6");
+  list.addAddress("::1", "ipv6");
+  list.addSubnet("fc00::", 7, "ipv6");
+  list.addSubnet("fe80::", 10, "ipv6");
+  return list;
+})();
 
 function normalizeHost(hostname: string): string {
   return hostname.replace(/^\[|\]$/g, "").toLowerCase();
 }
 
 /**
- * True when the URL names a destination the SSRF guard would refuse. A bare
- * hostname that is not an IP literal (e.g. "ollama.internal") is treated as
- * private only if it is "localhost" -- anything else needs DNS resolution.
+ * True when the URL names a destination the outbound guard would refuse. A
+ * bare hostname that is not an IP literal (e.g. "ollama.internal") counts as
+ * private only if it is "localhost"; anything else needs DNS resolution,
+ * which ctx.fetch does.
  */
 export function isPrivateDestination(rawUrl: string): boolean {
   let url: URL;
@@ -62,13 +80,15 @@ export function isPrivateDestination(rawUrl: string): boolean {
   }
   const host = normalizeHost(url.hostname);
   if (host === "localhost" || host.endsWith(".localhost")) return true;
-  if (isIP(host)) return isBlockedAddress(host);
+  const family = isIP(host);
+  if (family === 4) return PRIVATE_RANGES.check(host, "ipv4");
+  if (family === 6) return PRIVATE_RANGES.check(host, "ipv6");
   return false;
 }
 
 export interface EgressDecision {
   allowed: boolean;
-  /** True when the destination needs the allowlisted-private path. */
+  /** True when the destination is an allowlisted private host. */
   isPrivate: boolean;
   reason?: string;
 }
@@ -96,23 +116,19 @@ export function evaluateEgress(
   }
 
   const host = normalizeHost(url.hostname);
-  const isPrivate = isPrivateDestination(rawUrl);
   const normalized = allowlist.map((entry) => entry.trim().toLowerCase());
 
-  // An explicitly allowlisted hostname may resolve to a private address. It
-  // must use the private fetch path; sending it through safeOutboundFetch
-  // would reject it after DNS resolution and make hostname allowlist entries
-  // ineffective. Only administrators can write this list.
+  // An allowlisted hostname may resolve to a private address; ctx.fetch
+  // lets it through because the same list is passed as allowPrivateHosts.
   if (normalized.includes(host)) {
     return { allowed: true, isPrivate: true };
   }
 
-  if (!isPrivate) return { allowed: true, isPrivate: false };
+  if (!isPrivateDestination(rawUrl)) return { allowed: true, isPrivate: false };
 
   return {
     allowed: false,
     isPrivate: true,
-    reason:
-      "This address is on a private network. An administrator must add its host to the AI endpoint allowlist first.",
+    reason: PRIVATE_DESTINATION_MESSAGE,
   };
 }