fix(zero):load authz context for queries

surfsense_web/app/api/zero/query/route.ts

@@ -12,45 +12,67 @@ import { schema } from "@/zero/schema";
 // (e.g. http://localhost:8929) does NOT resolve from inside the frontend
 // container and would make every authenticated Zero query fail with a 503.
 const backendURL = SERVER_BACKEND_URL.replace(/\/$/, "");
+const zeroQueryApiKey = process.env.ZERO_QUERY_API_KEY;
+
+function validateZeroCacheRequest(request: Request): NextResponse | null {
+	if (!zeroQueryApiKey) return null;
+	if (request.headers.get("X-Api-Key") === zeroQueryApiKey) return null;
+	return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+}
 
 async function authenticateRequest(
 	request: Request
-): Promise<{ ctx: Context; error?: never } | { ctx?: never; error: NextResponse }> {
+): Promise<
+	| { ctx: Exclude<Context, undefined>; error?: never }
+	| { ctx?: never; error: NextResponse }
+> {
 	const authHeader = request.headers.get("Authorization");
-	if (!authHeader?.startsWith("Bearer ")) {
+	const cookieHeader = request.headers.get("Cookie");
-		return { ctx: undefined };
+	const headers: HeadersInit = {};
+	if (authHeader?.startsWith("Bearer ")) {
+		headers.Authorization = authHeader;
+	} else if (cookieHeader) {
+		headers.Cookie = cookieHeader;
+	} else {
+		return { error: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
 	}
 
 	try {
-		const res = await fetch(`${backendURL}/users/me`, {
+		const res = await fetch(`${backendURL}/zero/context`, {
-			headers: { Authorization: authHeader },
+			headers,
 		});
 
 		if (!res.ok) {
 			return { error: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
 		}
 
-		const user = await res.json();
+		const ctx = (await res.json()) as Exclude<Context, undefined>;
-		return { ctx: { userId: String(user.id) } };
+		return { ctx };
 	} catch {
 		return { error: NextResponse.json({ error: "Auth service unavailable" }, { status: 503 }) };
 	}
 }
 
 export async function POST(request: Request) {
+	const forbidden = validateZeroCacheRequest(request);
+	if (forbidden) {
+		return forbidden;
+	}
+
 	const auth = await authenticateRequest(request);
 	if (auth.error) {
 		return auth.error;
 	}
 
-	const result = await handleQueryRequest(
+	const result = await handleQueryRequest({
-		(name, args) => {
+		handler: (name, args) => {
 			const query = mustGetQuery(queries, name);
 			return query.fn({ args, ctx: auth.ctx });
 		},
 		schema,
-		request
+		request,
-	);
+		userID: auth.ctx.userId,
+	});
 
 	return NextResponse.json(result);
 }

surfsense_web/components/providers/ZeroProvider.tsx

@@ -6,9 +6,16 @@ import {
 	ZeroProvider as ZeroReactProvider,
 } from "@rocicorp/zero/react";
 import { useAtomValue } from "jotai";
-import { useEffect, useMemo, useRef } from "react";
+import { usePathname } from "next/navigation";
+import { useEffect, useMemo } from "react";
 import { currentUserAtom } from "@/atoms/user/user-query.atoms";
-import { getBearerToken, handleUnauthorized, refreshAccessToken } from "@/lib/auth-utils";
+import { useSession } from "@/hooks/use-session";
+import {
+	getBearerToken,
+	handleUnauthorized,
+	isPublicRoute,
+	refreshAccessToken,
+} from "@/lib/auth-utils";
 import { queries } from "@/zero/queries";
 import { schema } from "@/zero/schema";
 
@@ -22,48 +29,74 @@ function getCacheURL() {
 	return "http://localhost:4848";
 }
 
-function ZeroAuthSync() {
+function ZeroAuthSync({ isDesktop }: { isDesktop: boolean }) {
 	const zero = useZero();
 	const connectionState = useConnectionState();
-	const isRefreshingRef = useRef(false);
 
 	useEffect(() => {
-		if (connectionState.name !== "needs-auth" || isRefreshingRef.current) return;
+		if (connectionState.name !== "needs-auth") return;
 
-		isRefreshingRef.current = true;
+		refreshAccessToken().then((newToken) => {
+			if (!newToken) {
+				handleUnauthorized();
+				return;
+			}
 
-		refreshAccessToken()
+			if (isDesktop) {
-			.then((newToken) => {
+				zero.connection.connect({ auth: newToken });
-				if (newToken) {
+			} else {
-					zero.connection.connect({ auth: newToken });
+				zero.connection.connect();
-				} else {
+			}
-					handleUnauthorized();
+		});
-				}
+	}, [connectionState.name, isDesktop, zero]);
-			})
+
-			.finally(() => {
+	useEffect(() => {
-				isRefreshingRef.current = false;
+		if (typeof window === "undefined" || !window.electronAPI?.onAuthChanged) return;
-			});
+		return window.electronAPI.onAuthChanged(({ accessToken }) => {
-	}, [connectionState, zero]);
+			if (accessToken) {
+				zero.connection.connect({ auth: accessToken });
+			}
+		});
+	}, [zero]);
 
 	return null;
 }
 
-export function ZeroProvider({ children }: { children: React.ReactNode }) {
+function AuthenticatedZeroProvider({
-	const { data: user } = useAtomValue(currentUserAtom);
+	children,
-	const cacheURL = useMemo(() => getCacheURL(), []);
+	isDesktop,
+}: {
+	children: React.ReactNode;
+	isDesktop: boolean;
+}) {
+	const { data: user, isLoading } = useAtomValue(currentUserAtom);
 
 	const userId = user?.id;
-	const hasUser = !!userId;
+	const userID = userId ? String(userId) : undefined;
-	const userID = hasUser ? String(userId) : "anon";
-	// getBearerToken() returns a string (a primitive), so it's safe to read
-	// on every render — reference equality holds as long as the token is
-	// unchanged, which keeps the memoized `opts` below stable.
-	const auth = hasUser ? getBearerToken() || undefined : undefined;
 
-	const context = useMemo(
+	if (isLoading || !userID) {
-		() => (hasUser ? { userId: String(userId) } : undefined),
+		return <>{children}</>;
-		[hasUser, userId]
+	}
+
+	return (
+		<ZeroClientProvider userID={userID} isDesktop={isDesktop}>
+			{children}
+		</ZeroClientProvider>
 	);
+}
+
+function ZeroClientProvider({
+	children,
+	userID,
+	isDesktop,
+}: {
+	children: React.ReactNode;
+	userID: string;
+	isDesktop: boolean;
+}) {
+	const cacheURL = useMemo(() => getCacheURL(), []);
+	const auth = isDesktop ? getBearerToken() || undefined : undefined;
+	const context = useMemo(() => ({ userId: userID }), [userID]);
 
 	const opts = useMemo(
 		() => ({
@@ -79,8 +112,37 @@ export function ZeroProvider({ children }: { children: React.ReactNode }) {
 
 	return (
 		<ZeroReactProvider {...opts}>
-			{hasUser && <ZeroAuthSync />}
+			<ZeroAuthSync isDesktop={isDesktop} />
 			{children}
 		</ZeroReactProvider>
 	);
 }
+
+function WebZeroProvider({ children }: { children: React.ReactNode }) {
+	const session = useSession();
+
+	if (session.status !== "authenticated") {
+		return <>{children}</>;
+	}
+
+	return <AuthenticatedZeroProvider isDesktop={false}>{children}</AuthenticatedZeroProvider>;
+}
+
+function DesktopZeroProvider({ children }: { children: React.ReactNode }) {
+	return <AuthenticatedZeroProvider isDesktop>{children}</AuthenticatedZeroProvider>;
+}
+
+export function ZeroProvider({ children }: { children: React.ReactNode }) {
+	const pathname = usePathname();
+	const isDesktop = typeof window !== "undefined" && !!window.electronAPI;
+
+	if (!isDesktop && isPublicRoute(pathname)) {
+		return <>{children}</>;
+	}
+
+	if (isDesktop) {
+		return <DesktopZeroProvider>{children}</DesktopZeroProvider>;
+	}
+
+	return <WebZeroProvider>{children}</WebZeroProvider>;
+}

surfsense_web/types/zero.d.ts

@@ -3,6 +3,7 @@ import type { Schema } from "@/zero/schema/index";
 export type Context =
 	| {
 			userId: string;
+			allowedSpaceIds?: number[];
 	  }
 	| undefined;
 

surfsense_web/zero/queries/authz.ts

@@ -0,0 +1,28 @@
+import type { Context } from "@/types/zero";
+
+type SpaceScopedQuery = {
+	where: (...args: unknown[]) => SpaceScopedQuery;
+};
+
+const DENIED_SPACE_ID = -1;
+
+export function canReadSpace(ctx: Context, searchSpaceId: number): boolean {
+	return !!ctx?.allowedSpaceIds?.includes(searchSpaceId);
+}
+
+export function denySpace<T extends SpaceScopedQuery>(query: T): T {
+	return query.where("searchSpaceId", DENIED_SPACE_ID) as T;
+}
+
+export function constrainToAllowedSpaces<T extends SpaceScopedQuery>(query: T, ctx: Context): T {
+	const allowedSpaceIds = ctx?.allowedSpaceIds ?? [];
+	if (allowedSpaceIds.length === 0) {
+		return denySpace(query);
+	}
+	if (allowedSpaceIds.length === 1) {
+		return query.where("searchSpaceId", allowedSpaceIds[0]) as T;
+	}
+	return query.where(({ cmp, or }: { cmp: (column: string, value: number) => unknown; or: (...args: unknown[]) => unknown }) =>
+		or(...allowedSpaceIds.map((id) => cmp("searchSpaceId", id)))
+	) as T;
+}