security(#297): lock down dashboard/API — auth, 127.0.0.1 bind, CSRF, OAuth state, CSP

[nolanmak]

Closes #297.

Locks down the unauthenticated Node dashboard (the critical finding).

• Bind 127.0.0.1 by default on both entrypoints (index.ts, dashboard-server.ts); AUGMENTAGENT_BIND_HOST override.
• Always-on auth via a shared requireAuth middleware: Authorization: Bearer/x-api-key for machines, HMAC-signed HttpOnly; SameSite=Strict session cookie for the UI (/login). Local mode is now fail-closed — a key is generated, persisted to the DB config table, and logged once on first run (no more no-op).
• Anti-CSRF / anti-DNS-rebinding: app-wide guard validates Host against an allow-list and rejects cross-origin state-changing requests via Origin/Referer.
• Reddit OAuth state now random per-flow + validated on callback (was hardcoded augmentagent).
• Strict CSP + X-Frame-Options/nosniff/frame-ancestors 'none'.

New file src/security.ts; edits to index.ts, dashboard-server.ts, apiV1.ts.

Verification: npm install + npx tsc --noEmit pass (exit 0). Type-checked only; no runtime test run.

Reviewer note / caveat: UI-router auth currently leans on the app-level Host/Origin guard plus the existing /api/repos* guards; consider adding a one-line router.use(requireAuth) near the top of dashboard.ts (after /login mounts) for token-level auth on every UI route. TLS/reverse-proxy for split mode is config-knob only, not enforced.

🤖 swarm-authored, human-review-required (draft).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6df385cf-f731-4913-8e00-28da3c36dc63

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sec/297-dashboard-lockdown

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}