fix: harden proxy auth and SSRF defenses

lib/stalwart/credentials.ts

@@ -1,7 +1,7 @@
 import { cookies } from 'next/headers';
 import { NextRequest } from 'next/server';
-import { decryptSession } from '@/lib/auth/crypto';
-import { SESSION_COOKIE } from '@/lib/auth/session-cookie';
+import { sessionCookieName } from '@/lib/auth/session-cookie';
+import { readStalwartAuthContextFromStore } from '@/lib/stalwart/auth-context';
 
 export interface StalwartCredentials {
   /** URL for Stalwart management API calls (uses STALWART_API_URL if set, otherwise serverUrl) */
@@ -11,6 +11,7 @@ export interface StalwartCredentials {
   authHeader: string;
   username: string;
   hasSessionCookie: boolean;
+  slot: number;
 }
 
 /**
@@ -30,39 +31,38 @@ function getStalwartApiUrl(jmapServerUrl: string): string {
 /**
  * Extract credentials from the incoming request.
  *
- * Tries the explicit headers first (`Authorization`, `X-JMAP-Server-URL`,
- * `X-JMAP-Username`), then falls back to the encrypted session cookie.
+ * Credentials are read from a verified, httpOnly auth-context cookie that is
+ * populated after a successful JMAP login or token refresh.
  */
+function parseSlot(raw: string | null): number | null {
+  if (raw === null) return null;
+  const slot = parseInt(raw, 10);
+  return Number.isNaN(slot) || slot < 0 || slot > 4 ? null : slot;
+}
+
+function getCandidateSlots(request: NextRequest): number[] {
+  const requestedSlot = parseSlot(request.headers.get('X-JMAP-Cookie-Slot'))
+    ?? parseSlot(request.nextUrl.searchParams.get('slot'));
+
+  return requestedSlot === null ? [0, 1, 2, 3, 4] : [requestedSlot];
+}
+
 export async function getStalwartCredentials(request: NextRequest): Promise<StalwartCredentials | null> {
-  const authHeader = request.headers.get('Authorization');
-  const serverUrl = request.headers.get('X-JMAP-Server-URL');
-  const username = request.headers.get('X-JMAP-Username');
+  const cookieStore = await cookies();
+
+  for (const slot of getCandidateSlots(request)) {
+    const context = readStalwartAuthContextFromStore(cookieStore, slot);
+    if (!context) continue;
 
-  if (authHeader && serverUrl && username) {
-    const cookieStore = await cookies();
-    const hasSessionCookie = !!cookieStore.get(SESSION_COOKIE)?.value;
     return {
-      apiUrl: getStalwartApiUrl(serverUrl),
-      serverUrl,
-      authHeader,
-      username,
-      hasSessionCookie,
+      apiUrl: getStalwartApiUrl(context.serverUrl),
+      serverUrl: context.serverUrl,
+      authHeader: context.authHeader,
+      username: context.username,
+      hasSessionCookie: !!cookieStore.get(sessionCookieName(slot))?.value,
+      slot,
     };
   }
 
-  const cookieStore = await cookies();
-  const token = cookieStore.get(SESSION_COOKIE)?.value;
-  if (!token) return null;
-
-  const credentials = decryptSession(token);
-  if (!credentials) return null;
-
-  const basic = `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString('base64')}`;
-  return {
-    apiUrl: getStalwartApiUrl(credentials.serverUrl),
-    serverUrl: credentials.serverUrl,
-    authHeader: basic,
-    username: credentials.username,
-    hasSessionCookie: true,
-  };
+  return null;
 }