Node / ReticulumProjects / MeshChatX.git / files / docs / agents / skills / auth-csrf-ws-security / SKILL.md

Displaying Rendered • View raw • Download

Keep mutating HTTP behind CSRF and T383838window.api. Never move security-boundary settings onto open WebSocket mutators.

• Adding POST/PUT/PATCH/DELETE API routes or frontend callers

• Changing auth, password hash, CSRF, or session cookie behaviour

• Adding WebSocket message types that mutate state

• Touching T383838config.set or settings that affect the HTTP security boundary

• Mutating T383838/api/v1 calls from the UI must use T383838window.api / T383838apiClient.js so CSRF headers attach.

• Raw T383838fetch(..., { method: "POST" }) against the API fails T383838tests/frontend/apiFetchGuard.test.js.

• Prefer CSRF-protected HTTP for anything that changes auth, passwords, or exposure.

Denylist (must not be set via T383838config.set WS):

• T383838auth_enabled

• T383838auth_password_hash

When password auth is enabled, WS mutators require an authenticated session. That includes:

• T383838config.set

• T383838rns.link.open|identify|request|send|close

• Nomad download / archive mutators

• LXMF forwarding rule mutators

• keyboard shortcut set/delete

Public / read types stay limited. See T383838WEBSOCKET_PUBLIC_TYPES, T383838WEBSOCKET_READ_TYPES, and T383838WEBSOCKET_MUTATOR_TYPES in T383838websocket_config_guard.py.

• T383838MESHCHAT_DISABLE_CSRF is tests/dev only. Do not recommend it as a normal fix.

• Password reset is CLI/env: T383838--reset-password / T383838MESHCHAT_RESET_PASSWORD=true.

• T383838meshchatx/src/frontend/js/apiClient.js

• T383838meshchatx/src/frontend/js/csrfToken.js

• T383838meshchatx/src/backend/csrf.py

• T383838meshchatx/src/backend/websocket_config_guard.py

• T383838docs/en/identity-and-security.md

T282828

uv run pytest tests/backend/test_websocket_config_security.py tests/backend/test_websocket_config_guard.py -q --tbTff7b72=short

pnpm Tffa657exec vitest run tests/frontend/apiFetchGuard.test.js