fix(cloud): close P3.3 auth-boundary review findings

- BLOCKER: an unauthenticated request (no Authorization) no longer gets the
  shared companion token injected — the Worker only swaps in the shared token
  for an authenticated caller (shared token or valid invite), so the companion
  still gates /rpc (401) while /v1/health stays public.
- Strip any client-supplied X-Helmor-Member-Id at the very top of fetch()
  (before proxyToSandbox) so the never-client-asserted invariant holds on every
  path, including the SDK preview path — not just the derived proxy hop.
- acceptInvite: fail-closed on an unparseable expires_at, and reject re-accept
  of an already-claimed invite with a different id (409) to block seat takeover.

Re-verified on real CF: no-auth->401, health->200, garbage->401, shared->200,
accepted-invite->200, re-accept-different-id->409.

Author: dohooo

cloud/src/index.ts

@@ -38,20 +38,29 @@ const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
 
 export default {
 	async fetch(request: Request, env: Env): Promise<Response> {
+		// Security (EVERY path): strip any client-supplied X-Helmor-Member-Id up
+		// front — before proxyToSandbox — so the "never client-asserted" invariant
+		// holds on the SDK preview path too, not only the derived proxy hop. The
+		// companion trusts this header as author_id, so a client must never set it.
+		const req = request.headers.has("X-Helmor-Member-Id")
+			? new Request(request, { headers: withoutMemberHeader(request.headers) })
+			: request;
+
 		// Preview-URL passthrough (port-subdomain hostnames). Returns null for
 		// the Worker's own hostname, which we proxy transparently below.
-		const proxied = await proxyToSandbox(request, env);
+		const proxied = await proxyToSandbox(req, env);
 		if (proxied) return proxied;
 
 		// Team registry (`/team/*`): D1-backed JSON routes. Returns null for any
 		// other path, which falls through to the container proxy below.
-		const url = new URL(request.url);
-		const teamResp = await handleTeamRoute(request, env, url);
+		const url = new URL(req.url);
+		const teamResp = await handleTeamRoute(req, env, url);
 		if (teamResp) return teamResp;
 
-		// Derive the member identity for the proxied hop. On a bad token this
-		// short-circuits with 401 (we must not proxy an unknown caller).
-		const forwarded = await deriveForwardedRequest(request, env);
+		// Derive the member identity + companion-token swap for the proxied hop.
+		// Unauthenticated calls pass through unswapped (the companion gates them:
+		// /rpc -> 401, /v1/health stays public); unknown tokens -> 401 (see fn).
+		const forwarded = await deriveForwardedRequest(req, env);
 		if (forwarded instanceof Response) return forwarded;
 
 		const port = Number(env.HELMOR_COMPANION_PORT ?? "8080");
@@ -100,25 +109,36 @@ async function deriveForwardedRequest(
 ): Promise<Request | Response> {
 	const bearer = readBearer(request);
 	let memberId: string | null = null;
-	if (bearer && bearer !== env.HELMOR_COMPANION_TOKEN) {
+	// Only swap in the shared companion token for an AUTHENTICATED caller — admin
+	// (shared token) or a member (valid invite token). An UNauthenticated caller
+	// must NOT receive the shared token (that would bypass the companion's own
+	// bearer auth); pass it through unswapped so the companion gates it
+	// (/rpc -> 401, /v1/health stays public). An unknown token -> 401 here.
+	let injectCompanionToken = false;
+	if (bearer === env.HELMOR_COMPANION_TOKEN) {
+		injectCompanionToken = true; // admin / local (no member id)
+	} else if (bearer) {
 		memberId = await lookupMemberId(env, bearer);
 		if (!memberId) {
 			return new Response(JSON.stringify({ code: "Unauthorized" }), {
 				status: 401,
 				headers: { "content-type": "application/json" },
 			});
 		}
+		injectCompanionToken = true; // member: invite token -> shared token
 	}
 
 	const forwarded = new Request(request, {
 		headers: new Headers(request.headers),
 	});
 	forwarded.headers.delete("X-Helmor-Member-Id"); // never client-asserted
 	if (memberId) forwarded.headers.set("X-Helmor-Member-Id", memberId);
-	forwarded.headers.set(
-		"Authorization",
-		`Bearer ${env.HELMOR_COMPANION_TOKEN}`,
-	);
+	if (injectCompanionToken) {
+		forwarded.headers.set(
+			"Authorization",
+			`Bearer ${env.HELMOR_COMPANION_TOKEN}`,
+		);
+	}
 	return forwarded;
 }
 
@@ -130,6 +150,13 @@ function readBearer(request: Request): string | null {
 	return match ? match[1] : null;
 }
 
+/** Clone request headers with the trusted member-id header removed. */
+function withoutMemberHeader(headers: Headers): Headers {
+	const next = new Headers(headers);
+	next.delete("X-Helmor-Member-Id");
+	return next;
+}
+
 /** Ensure the companion server is up. Fast-path on a health hit; otherwise
  *  launch the boot script and poll until it answers (Xvfb + serve cold start). */
 async function ensureServe(

cloud/src/team.ts

@@ -134,14 +134,24 @@ async function acceptInvite(request: Request, env: Env): Promise<Response> {
 	}
 
 	const invite = await env.DB.prepare(
-		"SELECT expires_at FROM invites WHERE token = ?1",
+		"SELECT expires_at, member_id FROM invites WHERE token = ?1",
 	)
 		.bind(token)
-		.first<{ expires_at: string | null }>();
+		.first<{ expires_at: string | null; member_id: string | null }>();
 	if (!invite)
 		return json({ code: "NotFound", message: "unknown invite" }, 404);
-	if (invite.expires_at && Date.parse(invite.expires_at) < Date.now()) {
-		return json({ code: "Gone", message: "invite expired" }, 410);
+	if (invite.expires_at) {
+		// Fail-closed: an unparseable expires_at counts as expired (Date.parse ->
+		// NaN, and `NaN < now` is false, which would otherwise never expire).
+		const expiry = Date.parse(invite.expires_at);
+		if (!Number.isFinite(expiry) || expiry < Date.now()) {
+			return json({ code: "Gone", message: "invite expired" }, 410);
+		}
+	}
+	// An already-claimed invite may be refreshed by the SAME member, but never
+	// re-bound to a different id — no seat takeover via a leaked invite link.
+	if (invite.member_id && invite.member_id !== githubId) {
+		return json({ code: "Conflict", message: "invite already claimed" }, 409);
 	}
 
 	const avatarUrl = typeof body.avatarUrl === "string" ? body.avatarUrl : null;