fix(security): match client-API aliases case-insensitively in the authz matcher

Next compiles the proxy matcher from `regexp.source` only, dropping
path-to-regexp's case-insensitive flag, so `/v1/:path*` never matched `/V1/...`
while the rewrite layer (flag kept) still routed it to the handler — an
unauthenticated inference bypass via uppercase / mixed-case paths (/V1, /V1BETA,
/CHAT, /RESPONSES, /CODEX, /MODELS). Expressing the casing inside a
path-to-regexp custom group (`([vV]1)`) survives the flag-drop. classify.ts
normalizes the control segment case so uppercase aliases resolve to CLIENT_API
(honoring REQUIRE_API_KEY) instead of the management fallback.

Reported by @Evgeny-SPB via GHSA-jvqc-mp9f-q936.

src/proxy.ts

@@ -24,6 +24,14 @@ export async function proxy(request: NextRequest) {
   return runAuthzPipeline(request, { enforce: true });
 }
 
+// Next compiles the middleware/proxy matcher from `regexp.source` only, dropping
+// path-to-regexp's default case-insensitive flag — so a lowercase literal like
+// `/v1/:path*` never matches `/V1/...`, while the rewrite matcher (flag kept)
+// still routes it to the handler. That skipped the authz pipeline entirely
+// (GHSA-jvqc-mp9f-q936). Expressing the case-insensitivity inside a custom
+// path-to-regexp group (`([vV]1)`) survives the flag-drop because it needs no
+// flag. Keep these in sync with the client-API aliases in
+// next.config.mjs rewrites and src/server/authz/classify.ts.
 export const config = {
   matcher: [
     "/",
@@ -31,15 +39,15 @@ export const config = {
     "/home",
     "/home/:path*",
     "/api/:path*",
-    "/v1/:path*",
-    "/v1",
-    "/v1beta/:path*",
-    "/v1beta",
-    "/chat/:path*",
-    "/responses/:path*",
-    "/responses",
-    "/codex/:path*",
-    "/codex",
-    "/models",
+    "/:v1seg([vV]1)/:path*",
+    "/:v1seg([vV]1)",
+    "/:v1betaseg([vV]1[bB][eE][tT][aA])/:path*",
+    "/:v1betaseg([vV]1[bB][eE][tT][aA])",
+    "/:chatseg([cC][hH][aA][tT])/:path*",
+    "/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])/:path*",
+    "/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])",
+    "/:codexseg([cC][oO][dD][eE][xX])/:path*",
+    "/:codexseg([cC][oO][dD][eE][xX])",
+    "/:modelsseg([mM][oO][dD][eE][lL][sS])",
   ],
 };

src/server/authz/classify.ts

@@ -16,30 +16,39 @@ function normalizePathname(rawPath: string): { path: string; reason?: Classifica
   if (!path.startsWith("/")) path = "/" + path;
   if (path.length > 1 && path.endsWith("/")) path = path.slice(0, -1);
 
-  if (path === "/codex" || path.startsWith("/codex/")) {
+  // Client-API aliases are matched case-insensitively on the control segment.
+  // Next's rewrite layer accepts `/V1/...`, `/CODEX`, etc. and routes them to
+  // the client handler, so the classifier must recognize the same casing —
+  // otherwise an uppercase alias falls through to the management fallback and
+  // the request is treated as a different route class than it is actually
+  // dispatched to (GHSA-jvqc-mp9f-q936). Only the leading control segment is
+  // lowercased for detection; the original-case tail is preserved.
+  const lower = path.toLowerCase();
+
+  if (lower === "/codex" || lower.startsWith("/codex/")) {
     return { path: "/api/v1/responses", reason: "client_api_codex_alias" };
   }
 
-  if (path === "/v1/v1" || path.startsWith("/v1/v1/")) {
+  if (lower === "/v1/v1" || lower.startsWith("/v1/v1/")) {
     const tail = path.slice("/v1/v1".length) || "";
     return { path: "/api/v1" + tail, reason: "client_api_double_prefix" };
   }
 
-  if (path === "/v1beta" || path.startsWith("/v1beta/")) {
+  if (lower === "/v1beta" || lower.startsWith("/v1beta/")) {
     const tail = path.slice("/v1beta".length) || "";
     return { path: "/api/v1beta" + tail, reason: "client_api_alias" };
   }
 
-  if (path === "/v1" || path.startsWith("/v1/")) {
+  if (lower === "/v1" || lower.startsWith("/v1/")) {
     const tail = path.slice("/v1".length) || "";
     return { path: "/api/v1" + tail, reason: "client_api_alias" };
   }
 
   for (const { alias, canonical } of CLIENT_API_ALIAS_PREFIXES) {
-    if (path === alias) {
+    if (lower === alias) {
       return { path: canonical, reason: "client_api_alias" };
     }
-    if (path.startsWith(alias + "/")) {
+    if (lower.startsWith(alias + "/")) {
       return { path: canonical + path.slice(alias.length), reason: "client_api_alias" };
     }
   }

tests/unit/authz/proxy-contract.test.ts

@@ -55,15 +55,19 @@ test("proxy.ts delegates to runAuthzPipeline with enforce: true", () => {
 test("proxy.ts config.matcher covers every /api/* route plus dashboard and v1 aliases", () => {
   const content = fs.readFileSync("src/proxy.ts", "utf8");
   // Required prefixes — drop one and the corresponding routes go unguarded.
+  // The client-API aliases use a case-insensitive path-to-regexp group
+  // (`([vV]1)`) so `/V1/...` reaches the pipeline too — see
+  // GHSA-jvqc-mp9f-q936 and tests/unit/authz/proxy-matcher-case.test.ts for the
+  // semantic (compiled-matcher) coverage assertions.
   const requiredMatchers = [
     '"/api/:path*"',
     '"/dashboard/:path*"',
-    '"/v1/:path*"',
-    '"/v1beta/:path*"',
-    '"/chat/:path*"',
-    '"/responses/:path*"',
-    '"/codex/:path*"',
-    '"/models"',
+    '"/:v1seg([vV]1)/:path*"',
+    '"/:v1betaseg([vV]1[bB][eE][tT][aA])/:path*"',
+    '"/:chatseg([cC][hH][aA][tT])/:path*"',
+    '"/:respseg([rR][eE][sS][pP][oO][nN][sS][eE][sS])/:path*"',
+    '"/:codexseg([cC][oO][dD][eE][xX])/:path*"',
+    '"/:modelsseg([mM][oO][dD][eE][lL][sS])"',
   ];
   for (const matcher of requiredMatchers) {
     assert.ok(

tests/unit/authz/proxy-matcher-case.test.ts

@@ -0,0 +1,77 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+import { createRequire } from "node:module";
+
+import { config } from "../../../src/proxy.ts";
+import { classifyRoute } from "../../../src/server/authz/classify.ts";
+
+// Regression guard — GHSA-jvqc-mp9f-q936 (case-sensitive authz-matcher bypass).
+//
+// Next.js compiles the middleware/proxy matcher from `regexp.source` only,
+// dropping path-to-regexp's default case-insensitive flag, so a lowercase
+// literal like `/v1/:path*` does NOT match `/V1/...`. The rewrite matcher keeps
+// the flag, so `/V1/chat/completions` was still rewritten to the handler while
+// skipping the authz pipeline entirely — an unauthenticated inference bypass.
+//
+// The fix expresses the case-insensitivity inside a path-to-regexp custom group
+// (`/:seg([vV]1)/:path*`), which survives the flag-drop because it needs no
+// flag. This test compiles the matcher exactly the way Next does and asserts the
+// uppercase / mixed-case client aliases are covered.
+
+const require = createRequire(import.meta.url);
+const { tryToParsePath } = require("next/dist/lib/try-to-parse-path.js");
+
+function compiledMatcherRegexes(): RegExp[] {
+  return (config.matcher as string[]).map((entry) => {
+    const parsed = tryToParsePath(entry);
+    // Mirror Next's middleware-route-matcher: source only, no flags.
+    return new RegExp(parsed.regexStr as string);
+  });
+}
+
+function isMatchedByProxy(path: string): boolean {
+  return compiledMatcherRegexes().some((re) => re.test(path));
+}
+
+test("proxy matcher still covers the canonical lowercase client aliases", () => {
+  for (const p of [
+    "/v1/chat/completions",
+    "/v1/models",
+    "/v1beta/models",
+    "/responses",
+    "/codex/x",
+    "/models",
+  ]) {
+    assert.equal(isMatchedByProxy(p), true, `expected proxy matcher to cover ${p}`);
+  }
+});
+
+test("proxy matcher covers uppercase / mixed-case client aliases (GHSA-jvqc-mp9f-q936)", () => {
+  for (const p of [
+    "/V1/chat/completions",
+    "/V1/models",
+    "/V1BETA/models",
+    "/CHAT/completions",
+    "/RESPONSES",
+    "/CODEX/x",
+    "/MODELS",
+    "/Responses/x",
+    "/v1BeTa/models",
+  ]) {
+    assert.equal(
+      isMatchedByProxy(p),
+      true,
+      `uppercase alias ${p} must reach the authz pipeline, not skip it`
+    );
+  }
+});
+
+test("classifyRoute treats uppercase client aliases as CLIENT_API, not management fallback", () => {
+  assert.equal(classifyRoute("/V1/chat/completions", "POST").routeClass, "CLIENT_API");
+  assert.equal(classifyRoute("/V1BETA/models", "GET").routeClass, "CLIENT_API");
+  assert.equal(classifyRoute("/MODELS", "GET").routeClass, "CLIENT_API");
+  assert.equal(classifyRoute("/CODEX", "POST").routeClass, "CLIENT_API");
+  // Lowercase behavior is unchanged.
+  assert.equal(classifyRoute("/v1/chat/completions", "POST").routeClass, "CLIENT_API");
+});