@@ -72,6 +72,7 @@ import {
7272shouldAutoApproveNodePairingFromTrustedCidrs,
7373} from "../../node-pairing-auto-approve.js";
7474import { checkBrowserOrigin } from "../../origin-check.js";
75+import { GATEWAY_CLIENT_IDS, GATEWAY_CLIENT_MODES } from "../../protocol/client-info.js";
7576import {
7677buildPairingConnectCloseReason,
7778buildPairingConnectErrorDetails,
@@ -480,6 +481,11 @@ export function attachGatewayWsMessageHandler(params: {
480481const isControlUi = isOperatorUiClient(connectParams.client);
481482const isBrowserOperatorUi = isBrowserOperatorUiClient(connectParams.client);
482483const isWebchat = isWebchatConnect(connectParams);
484+const isNativeAppUi =
485+connectParams.client.mode === GATEWAY_CLIENT_MODES.UI &&
486+(connectParams.client.id === GATEWAY_CLIENT_IDS.MACOS_APP ||
487+connectParams.client.id === GATEWAY_CLIENT_IDS.IOS_APP ||
488+connectParams.client.id === GATEWAY_CLIENT_IDS.ANDROID_APP);
483489if (enforceOriginCheckForAnyClient || isBrowserOperatorUi || isWebchat) {
484490const hostHeaderOriginFallbackEnabled =
485491configSnapshot.gateway?.controlUi?.dangerouslyAllowHostHeaderOriginFallback === true;
@@ -931,6 +937,7 @@ export function attachGatewayWsMessageHandler(params: {
931937 hasBrowserOriginHeader,
932938 isControlUi,
933939 isWebchat,
940+ isNativeAppUi,
934941 reason,
935942});
936943const allowSilentTrustedCidrsNodePairing = shouldAutoApproveNodePairingFromTrustedCidrs(
@@ -1111,9 +1118,19 @@ export function attachGatewayWsMessageHandler(params: {
11111118});
11121119const { platformMismatch, deviceFamilyMismatch } = metadataPinning;
11131120if (platformMismatch || deviceFamilyMismatch) {
1114-logGateway.warn(
1115-`security audit: device metadata upgrade requested reason=metadata-upgrade device=${device.id} ip=${reportedClientIp ?? "unknown-ip"} auth=${authMethod} payload=${deviceAuthPayloadVersion ?? "unknown"} claimedPlatform=${claimedPlatform ?? "<none>"} pinnedPlatform=${pairedPlatform ?? "<none>"} claimedDeviceFamily=${claimedDeviceFamily ?? "<none>"} pinnedDeviceFamily=${pairedDeviceFamily ?? "<none>"} client=${connectParams.client.id} conn=${connId}`,
1116-);
1121+const allowSilentMetadataUpgrade = shouldAllowSilentLocalPairing({
1122+locality: pairingLocality,
1123+ hasBrowserOriginHeader,
1124+ isControlUi,
1125+ isWebchat,
1126+ isNativeAppUi,
1127+reason: "metadata-upgrade",
1128+});
1129+if (!allowSilentMetadataUpgrade) {
1130+logGateway.warn(
1131+`security audit: device metadata upgrade requested reason=metadata-upgrade device=${device.id} ip=${reportedClientIp ?? "unknown-ip"} auth=${authMethod} payload=${deviceAuthPayloadVersion ?? "unknown"} claimedPlatform=${claimedPlatform ?? "<none>"} pinnedPlatform=${pairedPlatform ?? "<none>"} claimedDeviceFamily=${claimedDeviceFamily ?? "<none>"} pinnedDeviceFamily=${pairedDeviceFamily ?? "<none>"} client=${connectParams.client.id} conn=${connId}`,
1132+);
1133+}
11171134const ok = await requirePairing("metadata-upgrade", paired);
11181135if (!ok) {
11191136return;
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。