fix: add CSRF protection in vscode.ts

[anupamme]

Summary

Fix high severity security issue in src/node/routes/vscode.ts.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	src/node/routes/vscode.ts:213
Assessment	Likely exploitable
CWE	CWE-352
Chain Complexity	2-step

Description: The /mint-key POST endpoint lacks CSRF protection and the ensureAuthenticated middleware. This endpoint generates or returns a cryptographic key used for VS Code web server authentication, making it a state-changing operation vulnerable to cross-origin requests.

Evidence

Exploitation scenario: An attacker hosts a malicious page with a hidden form targeting the /mint-key endpoint.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This route handler appears to be publicly accessible. This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• src/node/routes/vscode.ts

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project builds successfully with this change applied.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

Security Invariant

Property: Protected endpoints reject unauthenticated requests

Regression test

import request from 'supertest';
import { createServer } from 'http';
import { router } from '../../src/node/routes/vscode';

describe("Protected endpoints reject unauthenticated requests", () => {
  const app = createServer((req, res) => {
    router(req, res, () => {
      res.statusCode = 404;
      res.end();
    });
  });

  const payloads = [
    { description: "missing authorization header", headers: {} },
    { description: "malformed token", headers: { authorization: "Bearer invalid_token" } },
    { description: "expired token", headers: { authorization: "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MzMwNzYwMDB9.invalid" } },
    { description: "valid token", headers: { authorization: "Bearer valid_test_token" } }
  ];

  test.each(payloads)("rejects adversarial input: $description", async ({ headers }) => {
    const response = await request(app)
      .post('/mint-key')
      .set(headers)
      .send();

    if (headers.authorization?.includes('valid_test_token')) {
      expect(response.status).not.toBe(401);
      expect(response.status).not.toBe(403);
    } else {
      expect([401, 403]).toContain(response.status);
    }
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security