Radar from another machine: spectra open's loopback proxy to the pinned server (#24) 01320eefd505

//! Radar from a workstation (spec §8.6): a browser cannot pin the

//! instance's certificate, so `spectra open` serves a loopback proxy that

//! forwards to the pinned server over TLS. It answers only loopback `Host`

//! and `Origin`, so no other site can reach the server through it, and

//! passes responses (the SSE stream included) through as they come.

use crate::client::{Client, Endpoint};

use axum::body::{Body, Bytes};

use axum::extract::{Request, State};

use axum::http::{header, HeaderMap, StatusCode};

use axum::response::{IntoResponse, Response};

use http_body_util::{BodyExt, Full};

use std::sync::Arc;

struct Proxy {

    upstream: Client,

    /// `127.0.0.1:PORT` and `localhost:PORT`.

    hosts: Vec<String>,

}

/// The proxy's routes, forwarding to `upstream` as the browser at

/// `127.0.0.1:port` asks.

pub fn router(upstream: Endpoint, port: u16) -> axum::Router {

    let p = Arc::new(Proxy { upstream: Client::at(upstream, None), hosts: vec![format!("127.0.0.1:{port}"), format!("localhost:{port}")] });

    axum::Router::new().fallback(forward).with_state(p)

}

/// The sign-in link the server made, pointed at the proxy instead.

pub fn local_link(url: &str, port: u16) -> String {

    let rest = url.split_once("://").map(|(_, r)| r).unwrap_or(url);

    let path = rest.find('/').map(|i| &rest[i..]).unwrap_or("/");

    format!("http://127.0.0.1:{port}{path}")

}

fn ours(p: &Proxy, headers: &HeaderMap) -> bool {

    let host = headers.get(header::HOST).and_then(|h| h.to_str().ok()).unwrap_or("");

    if !p.hosts.iter().any(|h| h == host) {

        return false;

    }

    match headers.get(header::ORIGIN).and_then(|o| o.to_str().ok()) {

        None => true,

        Some(o) => p.hosts.iter().any(|h| o == format!("http://{h}")),

    }

}

async fn forward(State(p): State<Arc<Proxy>>, req: Request) -> Response {

    if !ours(&p, req.headers()) {

        return (StatusCode::FORBIDDEN, "this proxy serves its own page only").into_response();

    }

    let (parts, body) = req.into_parts();

    let body: Bytes = match body.collect().await {

        Ok(b) => b.to_bytes(),

        Err(_) => return StatusCode::BAD_REQUEST.into_response(),

    };

    let path = parts.uri.path_and_query().map(|p| p.as_str()).unwrap_or("/");

    let mut up = hyper::Request::builder().method(parts.method.clone()).uri(path);

    for (k, v) in parts.headers.iter() {

        // The proxy has checked the origin itself; hop-by-hop headers stay here.

        if matches!(k.as_str(), "host" | "origin" | "connection" | "keep-alive" | "transfer-encoding" | "upgrade" | "referer") {

            continue;

        }

        up = up.header(k, v);

    }

    let up = match up.header(header::HOST, "spectra").header(header::CONNECTION, "close").body(Full::new(body)) {

        Ok(r) => r,

        Err(_) => return StatusCode::BAD_REQUEST.into_response(),

    };

    match p.upstream.forward(up).await {

        Ok(resp) => {

            let (parts, incoming) = resp.into_parts();

            let mut out = Response::new(Body::new(incoming));

            *out.status_mut() = parts.status;

            for (k, v) in parts.headers.iter() {

                if !matches!(k.as_str(), "connection" | "transfer-encoding" | "keep-alive") {

                    out.headers_mut().append(k, v.clone());

                }

            }

            out

        }

        Err(e) => (StatusCode::BAD_GATEWAY, format!("Spectra on the server did not answer: {e:#}")).into_response(),

    }

}

#[cfg(test)]

mod tests {

    #[test]

    fn the_link_points_at_the_proxy() {

        assert_eq!(super::local_link("http://127.0.0.1:7350/signin?code=abc", 7351), "http://127.0.0.1:7351/signin?code=abc");

    }

}

- **Added: Radar from another machine (#24).** With a server configured, `spectra open` serves Radar on `http://127.0.0.1:7350` (`--port` to change it) through a proxy to the pinned server, and signs you in through it; pages, forms and the live stream all pass through. The proxy answers only its own loopback host and origin, so no other site can reach the server through it. Ctrl-C stops it.

    /// Pass a request through as it is, unsigned, and hand back the

    /// response with its body still streaming (Radar's proxy, spec §8.6).

    pub async fn forward(&self, req: hyper::Request<Full<Bytes>>) -> Result<hyper::Response<hyper::body::Incoming>> {

        let stream = self.io().await?;

        let (mut sender, conn) = hyper::client::conn::http1::handshake(hyper_util::rt::TokioIo::new(stream)).await?;

        tokio::spawn(async move {

            let _ = conn.await;

        });

        Ok(sender.send_request(req).await?)

    }

pub mod proxy;

- [x] #24 Radar from a workstation — done 2026-11-03: spectra open serves a loopback proxy to the pinned server and signs in through it; tests/client.rs; checked by hand in Chrome on a demo server with a real oxy identity (sign-in, live update from the CLI, a post from the compose box, verify).

        /// With Spectra on another machine: the loopback port of the proxy

        /// Radar is served through (spec §8.6)

        #[arg(long, default_value_t = 7350)]

        port: u16,

        Command::Open { owner_home, no_browser, port } => runtime()?.block_on(async {

            if ctx.remote()?.is_some() {

                open::open_remote(&ctx, owner_home, !no_browser, port).await

            } else {

                open::open(&ctx, owner_home, !no_browser).await

            }

        }),

    show(&url, launch);

    Ok(0)

}

fn show(url: &str, launch: bool) {

    println!("  {}", ui::id(url));

            .arg(url)

}

/// `spectra open` with Spectra on another machine (spec §8.6): serve Radar

/// through a loopback proxy to the pinned server, and sign in through it.

pub async fn open_remote(ctx: &Ctx, owner_home_flag: Option<PathBuf>, launch: bool, port: u16) -> Result<i32> {

    let cfg = ctx.remote()?.context("no server configured")?;

    let home = owner_home(ctx, owner_home_flag);

    let listener = tokio::net::TcpListener::bind(("127.0.0.1", port))

        .await

        .with_context(|| format!("binding 127.0.0.1:{port} for Radar (another `spectra open` running? --port picks another)"))?;

    let port = listener.local_addr()?.port();

    let client = ctx.owner_client(&home).await?.context("no server configured")?;

    let r = client.send("POST", "/radar/link", &[], Vec::new()).await?;

    if r.status != 200 {

        bail!("the server refused the sign-in: {}", String::from_utf8_lossy(&r.body));

    }

    let url = r.json()?.get("url").and_then(|u| u.as_str()).map(String::from).context("no link in the answer")?;

    let local = spectra_mcp::proxy::local_link(&url, port);

    println!("{} {}{}{}", ui::done("Serving"), ui::subject("Radar"), ui::sep(), ui::dim(format!("from {} over pinned TLS", cfg.server)));

    println!("{}", ui::kv("radar", format!("http://127.0.0.1:{port}")));

    println!("{} {}", ui::done("Signed"), ui::subject("a one-time link, good for a minute"));

    show(&local, launch);

    println!("  {} {}", ui::note(), ui::dim("Ctrl-C stops the proxy"));

    use std::io::Write;

    std::io::stdout().flush().ok();

    let app = spectra_mcp::proxy::router(cfg.endpoint()?, port);

    axum::serve(listener, app)

        .with_graceful_shutdown(async {

            let _ = tokio::signal::ctrl_c().await;

        })

        .await?;

/// One HTTP/1.1 exchange with the proxy: status, head, body.

fn http(port: u16, method: &str, path: &str, headers: &[(&str, &str)], body: &str) -> (u16, String, String) {

    use std::io::{Read, Write};

    let mut s = std::net::TcpStream::connect(("127.0.0.1", port)).unwrap();

    s.set_read_timeout(Some(Duration::from_secs(10))).unwrap();

    let mut req = format!("{method} {path} HTTP/1.1\r\nconnection: close\r\ncontent-length: {}\r\n", body.len());

    if !headers.iter().any(|(k, _)| k.eq_ignore_ascii_case("host")) {

        req.push_str(&format!("host: 127.0.0.1:{port}\r\n"));

    }

    for (k, v) in headers {

        req.push_str(&format!("{k}: {v}\r\n"));

    }

    req.push_str("\r\n");

    req.push_str(body);

    s.write_all(req.as_bytes()).unwrap();

    let mut out = Vec::new();

    let _ = s.read_to_end(&mut out);

    let text = String::from_utf8_lossy(&out).into_owned();

    let (head, body) = text.split_once("\r\n\r\n").unwrap_or((&text, ""));

    let status = head.split_whitespace().nth(1).and_then(|c| c.parse().ok()).unwrap_or(0);

    (status, head.to_string(), body.to_string())

}

#[tokio::test]

async fn radar_through_the_loopback_proxy() {

    use std::io::BufRead;

    let (sd, cd) = (tempfile::tempdir().unwrap(), tempfile::tempdir().unwrap());

    let (s, c) = (sd.path(), cd.path());

    let (srv, _port) = connected(s, c);

    let mut open = hermetic(c).args(["open", "--no-browser", "--port", "0"]).stdout(Stdio::piped()).spawn().unwrap();

    let out = open.stdout.take().unwrap();

    let (tx, rx) = std::sync::mpsc::channel();

    std::thread::spawn(move || {

        for line in std::io::BufReader::new(out).lines().map_while(Result::ok) {

            if let Some(u) = line.split_whitespace().find(|w| w.contains("/signin?code=")) {

                let _ = tx.send(u.to_string());

            }

        }

    });

    let link = rx.recv_timeout(Duration::from_secs(10)).expect("spectra open printed a link");

    let rest = link.strip_prefix("http://127.0.0.1:").expect("a loopback link");

    let (port, path) = rest.split_once('/').unwrap();

    let port: u16 = port.parse().unwrap();

    // Signing in through the proxy sets the session cookie.

    let (status, head, _) = http(port, "GET", &format!("/{path}"), &[], "");

    assert_eq!(status, 303, "{head}");

    let cookie = head

        .lines()

        .find_map(|l| {

            l.to_ascii_lowercase()

                .starts_with("set-cookie:")

                .then(|| l.split_once(':').unwrap().1.trim().split(';').next().unwrap().to_string())

        })

        .expect("a session cookie");

    // Live and a channel load; the channel's form carries the CSRF token.

    let (status, _, live) = http(port, "GET", "/", &[("cookie", &cookie)], "");

    assert_eq!(status, 200);

    assert!(live.contains("Spectra"), "{live}");

    let (status, _, page) = http(port, "GET", "/c/general", &[("cookie", &cookie)], "");

    assert_eq!(status, 200);

    let csrf = page.split("name=\"_csrf\" value=\"").nth(1).and_then(|r| r.split('"').next()).expect("a CSRF token").to_string();

    // A post from the proxy's own page goes through, as the owner.

    let origin = format!("http://127.0.0.1:{port}");

    let form = format!("_csrf={csrf}&body=hello+from+radar+over+the+proxy");

    let hdrs = [("cookie", cookie.as_str()), ("origin", origin.as_str()), ("content-type", "application/x-www-form-urlencoded")];

    let (status, head, _) = http(port, "POST", "/c/general", &hdrs, &form);

    assert_eq!(status, 303, "{head}");

    let hits = json_of(c, &["search", "--json", "proxy"]);

    assert_eq!(hits.as_array().unwrap().len(), 1, "{hits}");

    assert_eq!(hits[0]["author"], "human");

    // Another site cannot use the proxy: not by Origin, nor by Host.

    let evil = [("cookie", cookie.as_str()), ("origin", "http://evil.example"), ("content-type", "application/x-www-form-urlencoded")];

    assert_eq!(http(port, "POST", "/c/general", &evil, &form).0, 403);

    assert_eq!(http(port, "GET", "/", &[("host", "evil.example"), ("cookie", &cookie)], "").0, 403);

    open.kill().ok();

    open.wait().ok();

    srv.stop();

    let o = run(s, &["admin", "verify"]);

    assert!(o.status.success(), "{}", text(&o));

}