fix(dashboard): Playground Compare tab loading + HTTP method guard (#4024)

randomUUID non-HTTPS fallback + static CompareTab import; raw HTTP TRACE->405 method guard wired into dev + standalone servers. Integrated into release/v3.8.27.

scripts/build/assembleStandalone.mjs

@@ -125,6 +125,11 @@ const EXTRA_MODULE_ENTRIES = [
     src: ["scripts", "dev", "peer-stamp.mjs"],
     dest: ["peer-stamp.mjs"],
   },
+  {
+    label: "HTTP method guard (server-ws.mjs dependency)",
+    src: ["scripts", "dev", "http-method-guard.cjs"],
+    dest: ["http-method-guard.cjs"],
+  },
   {
     label: "responses-ws-proxy (server-ws.mjs dependency)",
     src: ["scripts", "dev", "responses-ws-proxy.mjs"],

scripts/build/pack-artifact-policy.ts

@@ -35,6 +35,7 @@ export const APP_STAGING_ALLOWED_EXACT_PATHS: string[] = [
   ".env.example",
   "BUILD_SHA",
   "docs/reference/openapi.yaml",
+  "http-method-guard.cjs",
   "open-sse/mcp-server/server.js",
   // LLMLingua ONNX worker — esbuild'd standalone .js spawned via worker_threads
   // (the Next.js bundler can't trace the computed Worker path). Kept like the MCP server.
@@ -124,6 +125,7 @@ export const PACK_ARTIFACT_REQUIRED_PATHS: string[] = [
   "dist/server-ws.mjs",
   "dist/responses-ws-proxy.mjs",
   "dist/peer-stamp.mjs",
+  "dist/http-method-guard.cjs",
   "dist/webdav-handler.mjs",
   "bin/cli/program.mjs",
   "bin/mcp-server.mjs",

scripts/build/prepublish.ts

@@ -40,6 +40,7 @@ const ROOT = join(__dirname, "..", "..");
 const NPX_BIN = process.platform === "win32" ? "npx.cmd" : "npx";
 
 const DIST_DIR = join(ROOT, "dist");
+const METHOD_GUARD_REQUIRE = 'require("./http-method-guard.cjs").installHttpMethodGuard();\n';
 
 function walkFiles(dir: string, rootDir: string = dir, files: string[] = []): string[] {
   let entries: string[] = [];
@@ -153,6 +154,20 @@ assembleStandalone({
 });
 console.log("  ✅ Standalone bundle assembled to dist/");
 
+const distServer = join(DIST_DIR, "server.js");
+const methodGuardSrc = join(ROOT, "scripts", "dev", "http-method-guard.cjs");
+const methodGuardDest = join(DIST_DIR, "http-method-guard.cjs");
+if (existsSync(methodGuardSrc)) {
+  cpSync(methodGuardSrc, methodGuardDest);
+}
+if (existsSync(distServer)) {
+  const serverSource = readFileSync(distServer, "utf8");
+  if (!serverSource.includes("installHttpMethodGuard")) {
+    writeFileSync(distServer, METHOD_GUARD_REQUIRE + serverSource);
+    console.log("  ✅ Patched dist/server.js with HTTP method guard.");
+  }
+}
+
 // ── Step 8: Compile + copy MITM cert utilities ─────────────
 const mitmSrc = join(ROOT, "src", "mitm");
 const mitmDest = join(DIST_DIR, "src", "mitm");

scripts/dev/http-method-guard.cjs

@@ -0,0 +1,82 @@
+"use strict";
+
+const http = require("node:http");
+
+const HIGH_RISK_METHOD_RULES = [
+  [/^\/api\/auth\/login\/?$/, ["POST"]],
+  [/^\/api\/auth\/logout\/?$/, ["POST"]],
+  [/^\/api\/keys\/?$/, ["GET", "POST"]],
+  [/^\/api\/keys\/[^/]+\/?$/, ["GET", "PATCH", "DELETE"]],
+];
+
+let installed = false;
+
+function getPathname(req) {
+  const rawUrl = typeof req?.url === "string" && req.url ? req.url : "/";
+  try {
+    return new URL(rawUrl, "http://localhost").pathname;
+  } catch {
+    return rawUrl.split("?")[0] || "/";
+  }
+}
+
+function getAllowedMethods(pathname) {
+  for (const [pattern, methods] of HIGH_RISK_METHOD_RULES) {
+    if (pattern.test(pathname)) return methods;
+  }
+  return null;
+}
+
+function getAllowHeader(pathname) {
+  const methods = getAllowedMethods(pathname);
+  return methods ? methods.join(", ") : null;
+}
+
+function maybeHandleDisallowedMethod(req, res) {
+  const method = typeof req?.method === "string" ? req.method.toUpperCase() : "";
+  const pathname = getPathname(req);
+  const methods = getAllowedMethods(pathname);
+  if (!methods || method === "OPTIONS" || methods.includes(method)) return false;
+
+  res.statusCode = 405;
+  res.setHeader("Allow", methods.join(", "));
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("Content-Type", "application/json; charset=utf-8");
+  res.end(
+    JSON.stringify({
+      error: {
+        code: "METHOD_NOT_ALLOWED",
+        message: `${method || "Method"} is not allowed`,
+      },
+    })
+  );
+  return true;
+}
+
+function wrapRequestListenerWithMethodGuard(listener) {
+  return function methodGuardRequestHandler(req, res) {
+    if (maybeHandleDisallowedMethod(req, res)) return;
+    return listener.call(this, req, res);
+  };
+}
+
+function installHttpMethodGuard() {
+  if (installed) return;
+  installed = true;
+
+  const originalCreateServer = http.createServer.bind(http);
+  http.createServer = function createServerWithMethodGuard(...args) {
+    const lastFnIdx = args.map((arg) => typeof arg === "function").lastIndexOf(true);
+    if (lastFnIdx >= 0) {
+      args[lastFnIdx] = wrapRequestListenerWithMethodGuard(args[lastFnIdx]);
+    }
+    return originalCreateServer(...args);
+  };
+}
+
+module.exports = {
+  getAllowHeader,
+  maybeHandleDisallowedMethod,
+  wrapRequestListenerWithMethodGuard,
+  installHttpMethodGuard,
+};

scripts/dev/run-next.mjs

@@ -9,9 +9,12 @@ import { resolveRuntimePorts, withRuntimePortEnv } from "../build/runtime-env.mj
 import { createOmnirouteWsBridge } from "./v1-ws-bridge.mjs";
 import { createResponsesWsProxy } from "./responses-ws-proxy.mjs";
 import { ensurePeerStampToken, stampPeerIp } from "./peer-stamp.mjs";
+import methodGuard from "./http-method-guard.cjs";
 import { ensureNativeSqlite } from "./ensure-native-sqlite.mjs";
 import { randomUUID } from "node:crypto";
 
+const { maybeHandleDisallowedMethod } = methodGuard;
+
 // Pre-read DATA_DIR from local .env before bootstrap resolves paths
 if (!process.env.DATA_DIR) {
   try {
@@ -83,6 +86,7 @@ async function start() {
   });
 
   const server = http.createServer((req, res) => {
+    if (maybeHandleDisallowedMethod(req, res)) return;
     // Stamp the real TCP peer IP before Next sees the request, so the authz
     // middleware can decide LOCAL_ONLY locality without trusting the Host header.
     stampPeerIp(req);

scripts/dev/standalone-server-ws.mjs

@@ -3,9 +3,11 @@ import { randomUUID } from "node:crypto";
 import { createResponsesWsProxy } from "./responses-ws-proxy.mjs";
 import { ensurePeerStampToken, wrapRequestListenerWithPeerStamp } from "./peer-stamp.mjs";
 import { maybeHandleWebdav } from "./webdav-handler.mjs";
+import methodGuard from "./http-method-guard.cjs";
 
 const originalCreateServer = http.createServer.bind(http);
 const proxiesByPort = new Map();
+const { wrapRequestListenerWithMethodGuard } = methodGuard;
 
 process.env.OMNIROUTE_WS_BRIDGE_SECRET ||= randomUUID();
 // Per-process secret proving the trusted peer-IP stamp came from this server.
@@ -71,9 +73,9 @@ http.createServer = function createServerWithResponsesWs(...args) {
   // createServer; wrap it so the real TCP peer IP is stamped before Next runs.
   const lastFnIdx = args.map((a) => typeof a === "function").lastIndexOf(true);
   if (lastFnIdx >= 0) {
-    // WebDAV intercept wraps outermost (first to run), then peer-stamp, then Next.
-    args[lastFnIdx] = wrapRequestListenerWithWebdav(
-      wrapRequestListenerWithPeerStamp(args[lastFnIdx])
+    // Method guard runs before Next because Next 16 rejects TRACE while constructing requests.
+    args[lastFnIdx] = wrapRequestListenerWithMethodGuard(
+      wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(args[lastFnIdx]))
     );
   }
 
@@ -89,7 +91,9 @@ http.createServer = function createServerWithResponsesWs(...args) {
     if (eventName === "request" && typeof listener === "function") {
       return originalOn(
         eventName,
-        wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+        wrapRequestListenerWithMethodGuard(
+          wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+        )
       );
     }
     return originalOn(eventName, listener);
@@ -102,7 +106,9 @@ http.createServer = function createServerWithResponsesWs(...args) {
     if (eventName === "request" && typeof listener === "function") {
       return originalAddListener(
         eventName,
-        wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+        wrapRequestListenerWithMethodGuard(
+          wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+        )
       );
     }
     return originalAddListener(eventName, listener);