gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624)

The forge writes every tarball at its public name and the lab reaches it at
a private address, so npm 12 refused every locked @novox package. The public
name now comes from the mesh's own composition of the forge's route, through
the lab's binding, and the lab compares scheme, host and port.

modules/lab/test/runs.test.ts

@@ -275,7 +275,7 @@ const packument = (tarball: string) => new Response(JSON.stringify({
 
 test("a run names the package registry by the address the registry gives its tarballs", async () => {
   const r = aRegistry(() => packument("https://forge.example.org/api/packages/novox/npm/%40novox%2Fmesh-sdk/-/0.1.14/mesh-sdk-0.1.14.tgz"));
-  const got = await npmRegistry("http://forge.example.org:3000/", r.get);
+  const got = await npmRegistry("http://forge.example.org:3000/", r.get, "https://forge.example.org/api/packages/novox/npm/");
   assert.deepEqual(got, { registry: "https://forge.example.org/api/packages/novox/npm/" });
   assert.deepEqual(r.asked, ["http://forge.example.org:3000/api/packages/novox/npm/@novox%2fmesh-sdk"]);
   // The forge's own scheme is taken too, with its port.
@@ -285,8 +285,8 @@ test("a run names the package registry by the address the registry gives its tar
 });
 
 // What the registry answers may come over plain HTTP, so it never decides where packages come from: only
-// the forge's own host, at https or the forge's scheme, under the npm path, with nothing after it
-// (review of mesh-catalog #275).
+// the forge's public root or its own address, scheme, host and port, under the npm path, with nothing after
+// it (review of mesh-catalog #275, ADR 0346).
 test("a registry that does not give an address the lab takes leaves the forge's, and the reason is said", async () => {
   const sdk = "/api/packages/novox/npm/%40novox%2Fmesh-sdk/-/0.1.14/mesh-sdk-0.1.14.tgz";
   for (const [answer, why] of [
@@ -294,13 +294,13 @@ test("a registry that does not give an address the lab takes leaves the forge's,
     [() => new Response("{}", { status: 200 }), /no tarball/],
     [() => { throw new Error("connect ECONNREFUSED"); }, /ECONNREFUSED/],
     [() => packument(`https://forge.example.org/elsewhere/mesh-sdk-0.1.14.tgz`), /not under \/api\/packages\/novox\/npm\//],
-    [() => packument(`https://attacker.example.net${sdk}`), /attacker\.example\.net, which is not the forge's host novox\.internal/],
+    [() => packument(`https://attacker.example.net${sdk}`), /at https:\/\/attacker\.example\.net, which is neither the forge's public root nor its own address/],
     [() => packument(`https://attacker.example.net/x?u=https://novox.internal${sdk}`), /query or a fragment/],
     [() => packument(`https://novox.internal${sdk}?x=1`), /query or a fragment/],
     [() => packument(`https://novox.internal${sdk}#frag`), /query or a fragment/],
     [() => packument(`https://attacker.example.net/#https://novox.internal${sdk}`), /query or a fragment/],
-    [() => packument(`ftp://novox.internal${sdk}`), /ftp: — neither https: nor the forge's http:/],
-    [() => packument(`file:///api/packages/novox/npm/x.tgz`), /file: — neither/],
+    [() => packument(`ftp://novox.internal${sdk}`), /at ftp:\/\/novox\.internal, which is neither/],
+    [() => packument(`file:///api/packages/novox/npm/x.tgz`), /which is neither/],
     [() => packument(`https://novox.internal/api/packages/novox/npm/\nregistry=https://attacker.example.net/\nallow-remote=all`), /whitespace or a control character/],
     [() => packument(`https://user:pw@novox.internal${sdk}`), /user or password/],
   ] as [() => Response, RegExp][]) {
@@ -319,3 +319,54 @@ test("a run's npm configuration names the registry it was given, and the forge's
   const none = script("/work", "run-x", "http://novox.internal:20000", ["t.test.ts"], {});
   assert.match(none, /'@novox:registry=http:\/\/novox\.internal:20000\/api\/packages\/novox\/npm\/'/);
 });
+
+// The public root the forge serves in the lab's binding (novox/hq ADR 0346) is the one other origin a
+// tarball may come from, by scheme, host and port: the review of #275 found the port ignored.
+import { publicRootOf } from "../tools/runs.ts";
+
+test("a tarball is taken at the forge's public root, and at no other port or scheme of its host", async () => {
+  const sdk = "/api/packages/novox/npm/%40novox%2Fmesh-sdk/-/0.1.14/mesh-sdk-0.1.14.tgz";
+  const root = "https://git.example.org/api/packages/novox/npm/";
+  const at = (tarball: string, publicRoot?: string) =>
+    npmRegistry("http://novox.internal:20000", aRegistry(() => packument(tarball)).get, publicRoot);
+  assert.deepEqual(await at(`https://git.example.org${sdk}`, root), { registry: root });
+  for (const tarball of [`https://git.example.org:8443${sdk}`, `http://git.example.org${sdk}`, `https://example.org${sdk}`]) {
+    const got = await at(tarball, root);
+    assert.equal(got.registry, "http://novox.internal:20000/api/packages/novox/npm/", tarball);
+    assert.match(got.problem ?? "", /neither the forge's public root nor its own address/, tarball);
+  }
+  // Without a public root, the forge's public name is not trusted on its own word.
+  assert.match((await at(`https://git.example.org${sdk}`)).problem ?? "", /neither/);
+  // And the forge's own address only at its own port.
+  assert.match((await at(`http://novox.internal${sdk}`, root)).problem ?? "", /neither/);
+});
+
+test("the public root is read from the binding, and only an https root at the npm path is taken", () => {
+  const dir = mkdtempSync(join(tmpdir(), "lab-root-"));
+  const binding = (root: unknown) => {
+    const f = join(dir, `b-${Math.random()}.json`);
+    writeFileSync(f, JSON.stringify({ provision: "npm-package-registry", at: "home", serves: { scheme: "http", port: 3000,
+      "npm-path": "/api/packages/novox/npm/", ...(root === undefined ? {} : { "public-root": root }) } }));
+    return f;
+  };
+  assert.deepEqual(publicRootOf(binding("https://git.example.org/api/packages/novox/npm/")),
+    { root: "https://git.example.org/api/packages/novox/npm/" });
+  assert.deepEqual(publicRootOf(binding("https://git.example.org:8443/api/packages/novox/npm/")),
+    { root: "https://git.example.org:8443/api/packages/novox/npm/" });
+  for (const [root, why] of [
+    [undefined, /serves no public-root/],
+    ["http://git.example.org/api/packages/novox/npm/", /is not https:\/\/<host>/],
+    ["https://git.example.org/elsewhere/", /is not https:\/\/<host>/],
+    ["https://git.example.org/api/packages/novox/npm/?x=1", /is not https:\/\/<host>/],
+    ["https://u:p@git.example.org/api/packages/novox/npm/", /is not https:\/\/<host>/],
+    ["https://git.example.org/api/packages/novox/npm/\nallow-remote=all", /whitespace or a control character/],
+    ["https://${bound:route:name-web}/api/packages/novox/npm/", /not a URL|is not https/],
+  ] as [unknown, RegExp][]) {
+    const got = publicRootOf(binding(root));
+    assert.equal(got.root, undefined, String(root));
+    assert.match(got.problem ?? "", why, String(root));
+  }
+  assert.match(publicRootOf(join(dir, "none.json")).problem ?? "", /could not be read/);
+  assert.match(publicRootOf(undefined).problem ?? "", /no npm-package-registry binding/);
+  rmSync(dir, { recursive: true, force: true });
+});