mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 12:22:14 +03:00
6b0e89fb42
The authz pipeline runs in the Next middleware runtime (proxy.ts -> runAuthzPipeline) where ctx.request is a NextRequest with no .socket/.ip. requestPeerAddress therefore returned null, so isLoopbackRequest was ALWAYS false and every LOCAL_ONLY path 403'd even from loopback (Services/MCP/Traffic-Inspector were unusable). Read the Host header instead — exactly what isLoopbackHost/isPrivateLanHost were built to parse — which restores loopback and, combined with isPrivateLanHost, enables the owner-authorized private-LAN access. Spawn-capable endpoints still require manage-scope auth after this gate.