fix(mcode-webui): round 8 — CORS tightening + cross-origin token-leak fix

[modacker]

Summary

Closes the cross-origin bootstrap-token-disclosure blocker reported by hetaoBackend on 2026-09-01 against PR #23 head 091dec5. Pre-fix, a malicious page at https://evil.example could exfiltrate the operator's auth token from a webui instance running on the same machine via fetch('http://127.0.0.1:PORT/api/settings'). Three combined server properties created the leak; this PR closes all three.

Threat model (3 properties pre-fix)

1. Access-Control-Allow-Origin: * — any cross-origin page could read responses (no CORS preflight needed for simple GET/POST with JSON body)
2. isRequestAuthorized(req) bypassed Gate 3 for isLocalRequest — cross-origin requests over loopback (127.0.0.1) were treated as local and skipped the token check
3. GET /api/settings returned the bootstrap token in the JSON body when tokenAcknowledged === false (the standard "first run" / "after rotation" state)

What this PR changes

Channel	Pre-fix	Post-fix
GET /api/settings	currentToken if !tokenAcknowledged	always "" (field kept for back-compat)
POST /api/settings {resetToken: true}	currentToken: <new-value>	no token field; hint points to stdout + settings.json
SSE state push (per-cid + broadcast + online-count)	currentToken if !tokenAcknowledged	always ""
auth.token_rotated SSE event payload	raw new token (string)	JSON.stringify({rotated:true, at:<ms>})
Access-Control-Allow-Origin	*	per-origin: same-origin OR in MCODE_WEBUI_ALLOWED_ORIGINS env allowlist; otherwise omitted (browser blocks the cross-origin read)
isRequestAuthorized for cross-origin over loopback	bypassed (isLocalRequest)	requires valid token (same check as non-local)
Token delivery channels	stdout + settings.json + HTTP + SSE	stdout + settings.json (HTTP + SSE are out)

UX trade-off

Pre-fix, a token rotation auto-updated the operator's localStorage + live HEADERS via the SSE event payload. The operator did not need to do anything.

Post-fix, the operator must:

1. Trigger the rotation (POST /api/settings or the UI button)
2. Read the new value from server stdout (where settings.js prints it on rotation) OR from ~/.mcode-webui/settings.json
3. Re-open the webui URL with ?token=<new-value> appended

The SPA shows an 8-second toast on the auth.token_rotated event telling the user exactly what to do. The current tab's HEADERS are cleared by the SPA, so the next request gets 401 and the browser re-prompts for credentials.

Test results

$ npm test
ℹ tests 417
ℹ suites ~108
ℹ pass 415
ℹ fail 0
ℹ skipped 2
ℹ duration_ms ~2400

$ npm run lint
✖ 9 problems (0 errors, 9 warnings — all pre-existing in test/)

PoC verification

Independent PoC at poc-csrf.mjs (the script used to report the blocker on 2026-09-01):

$ node poc-csrf.mjs
=== SUMMARY ===
  CORS allows cross-origin read:  NO (safe)
  Local bypass on cross-origin:   NO (401)
  Bootstrap token leak count:     0/2
>>> PoC did not reproduce the blocker (already fixed? re-test)
exit 0

Files changed

M  server/router.js                            (setCorsHeaders helper, no more '*')
M  server/lib/auth.js                          (isCrossOriginRequest + Gate 3 fix)
M  server/lib/settings.js                      (getSettingsSnapshot: currentToken → "")
M  server/lib/state-bus.js                     (4 SSE push + broadcastTokenRotated)
M  server/routes/settings.js                   (POST resetToken: no token in response)
M  references/SECURITY-NOTES.md                (§9 row updated + new §10)
M  public/app/state.js                         (SSE event handler + CustomEvent dispatch)
M  public/app/render.js                        (CustomEvent listener + 8s toast)
M  public/app/i18n.js                          (zh+en 2 new keys)
M  test/router-cors.test.js                    (L279 reversed + setCorsHeaders presence)
M  test/routes-settings.test.js                (resetToken expectation rewritten)
M  test/state-bus.test.js                      (+3 round-8 contract tests)
M  PR_DESCRIPTION.md                           (test count → live + round 8 reference)
R  eslint.config.mjs (upstream/ → mcode-webui/)
+  BASELINE-2026-09-04.md                      (pre-fix snapshot)

Drive-by

eslint.config.mjs was at the upstream/ root and imported @eslint/js + globals, but the devDeps live in plugins/Wzdhehe/mcode-webui/package.json — npm install in the subdir didn't satisfy the upstream-root resolve. Moved the config into the mcode-webui subdir so npm run lint works (0 errors).

Reviewer notes

• No public API removal — currentToken field is kept in the response shape (always "") for back-compat. Existing SPA field references won't break.
• OPTIONS preflight still short-circuits before any gate (regression guard, see router-cors.test.js Gate 3 exemption test).
• Same-origin SPA requests unchanged — Origin: http://127.0.0.1:PORT is echoed back, server-to-server / curl (no Origin header) doesn't get CORS headers at all (browsers don't enforce CORS in these cases).
• hetaoBackend 2026-09-01 report — independently reproduced by poc-csrf.mjs against the pre-fix code; not reproducible post-fix.

References

• BASELINE-2026-09-04.md — pre-fix test/PoC snapshot
• references/SECURITY-NOTES.md §10 — full contract and threat model
• test/csrf-token-disclosure.test.js — the regression guard (3 of 4 blockers were RED pre-fix, all 4 GREEN post-fix)