fix: harden proxy auth and SSRF defenses

lib/stalwart/auth-context.ts

@@ -0,0 +1,75 @@
+import { cookies } from 'next/headers';
+import { decryptPayload, encryptPayload } from '@/lib/auth/crypto';
+import { getCookieOptions } from '@/lib/oauth/cookie-config';
+
+const STALWART_AUTH_CONTEXT_COOKIE = 'jmap_stalwart_ctx';
+
+export interface StalwartAuthContext {
+  serverUrl: string;
+  username: string;
+  authHeader: string;
+}
+
+type CookieStore = Awaited<ReturnType<typeof cookies>>;
+
+export function stalwartAuthContextCookieName(slot: number): string {
+  return slot === 0 ? STALWART_AUTH_CONTEXT_COOKIE : `${STALWART_AUTH_CONTEXT_COOKIE}_${slot}`;
+}
+
+function isValidContext(payload: unknown): payload is StalwartAuthContext {
+  if (!payload || typeof payload !== 'object') {
+    return false;
+  }
+
+  const candidate = payload as Record<string, unknown>;
+  return typeof candidate.serverUrl === 'string'
+    && typeof candidate.username === 'string'
+    && typeof candidate.authHeader === 'string';
+}
+
+function getSessionCookieOptions() {
+  const { maxAge: _maxAge, ...cookieOptions } = getCookieOptions();
+  return cookieOptions;
+}
+
+export function readStalwartAuthContextFromStore(
+  cookieStore: CookieStore,
+  slot: number,
+): StalwartAuthContext | null {
+  const token = cookieStore.get(stalwartAuthContextCookieName(slot))?.value;
+  if (!token) return null;
+
+  const payload = decryptPayload(token);
+  return isValidContext(payload) ? payload : null;
+}
+
+export async function readStalwartAuthContext(slot: number): Promise<StalwartAuthContext | null> {
+  const cookieStore = await cookies();
+  return readStalwartAuthContextFromStore(cookieStore, slot);
+}
+
+export function setStalwartAuthContextInStore(
+  cookieStore: CookieStore,
+  slot: number,
+  context: StalwartAuthContext,
+): void {
+  cookieStore.set(
+    stalwartAuthContextCookieName(slot),
+    encryptPayload(context as unknown as Record<string, unknown>),
+    getSessionCookieOptions(),
+  );
+}
+
+export async function setStalwartAuthContext(slot: number, context: StalwartAuthContext): Promise<void> {
+  const cookieStore = await cookies();
+  setStalwartAuthContextInStore(cookieStore, slot, context);
+}
+
+export function clearStalwartAuthContextInStore(cookieStore: CookieStore, slot: number): void {
+  cookieStore.delete(stalwartAuthContextCookieName(slot));
+}
+
+export async function clearStalwartAuthContext(slot: number): Promise<void> {
+  const cookieStore = await cookies();
+  clearStalwartAuthContextInStore(cookieStore, slot);
+}

lib/stalwart/credentials.ts

@@ -1,7 +1,7 @@
 import { cookies } from 'next/headers';
 import { NextRequest } from 'next/server';
-import { decryptSession } from '@/lib/auth/crypto';
-import { SESSION_COOKIE } from '@/lib/auth/session-cookie';
+import { sessionCookieName } from '@/lib/auth/session-cookie';
+import { readStalwartAuthContextFromStore } from '@/lib/stalwart/auth-context';
 
 export interface StalwartCredentials {
   /** URL for Stalwart management API calls (uses STALWART_API_URL if set, otherwise serverUrl) */
@@ -11,6 +11,7 @@ export interface StalwartCredentials {
   authHeader: string;
   username: string;
   hasSessionCookie: boolean;
+  slot: number;
 }
 
 /**
@@ -30,39 +31,38 @@ function getStalwartApiUrl(jmapServerUrl: string): string {
 /**
  * Extract credentials from the incoming request.
  *
- * Tries the explicit headers first (`Authorization`, `X-JMAP-Server-URL`,
- * `X-JMAP-Username`), then falls back to the encrypted session cookie.
+ * Credentials are read from a verified, httpOnly auth-context cookie that is
+ * populated after a successful JMAP login or token refresh.
  */
+function parseSlot(raw: string | null): number | null {
+  if (raw === null) return null;
+  const slot = parseInt(raw, 10);
+  return Number.isNaN(slot) || slot < 0 || slot > 4 ? null : slot;
+}
+
+function getCandidateSlots(request: NextRequest): number[] {
+  const requestedSlot = parseSlot(request.headers.get('X-JMAP-Cookie-Slot'))
+    ?? parseSlot(request.nextUrl.searchParams.get('slot'));
+
+  return requestedSlot === null ? [0, 1, 2, 3, 4] : [requestedSlot];
+}
+
 export async function getStalwartCredentials(request: NextRequest): Promise<StalwartCredentials | null> {
-  const authHeader = request.headers.get('Authorization');
-  const serverUrl = request.headers.get('X-JMAP-Server-URL');
-  const username = request.headers.get('X-JMAP-Username');
+  const cookieStore = await cookies();
+
+  for (const slot of getCandidateSlots(request)) {
+    const context = readStalwartAuthContextFromStore(cookieStore, slot);
+    if (!context) continue;
 
-  if (authHeader && serverUrl && username) {
-    const cookieStore = await cookies();
-    const hasSessionCookie = !!cookieStore.get(SESSION_COOKIE)?.value;
     return {
-      apiUrl: getStalwartApiUrl(serverUrl),
-      serverUrl,
-      authHeader,
-      username,
-      hasSessionCookie,
+      apiUrl: getStalwartApiUrl(context.serverUrl),
+      serverUrl: context.serverUrl,
+      authHeader: context.authHeader,
+      username: context.username,
+      hasSessionCookie: !!cookieStore.get(sessionCookieName(slot))?.value,
+      slot,
     };
   }
 
-  const cookieStore = await cookies();
-  const token = cookieStore.get(SESSION_COOKIE)?.value;
-  if (!token) return null;
-
-  const credentials = decryptSession(token);
-  if (!credentials) return null;
-
-  const basic = `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString('base64')}`;
-  return {
-    apiUrl: getStalwartApiUrl(credentials.serverUrl),
-    serverUrl: credentials.serverUrl,
-    authHeader: basic,
-    username: credentials.username,
-    hasSessionCookie: true,
-  };
+  return null;
 }