fix(security): protect LiveUAMap operator routes from cross-site requests

frontend/src/__tests__/liveUamapProxyBoundary.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+import type { NextRequest } from 'next/server';
+
+import { proxy } from '@/proxy';
+
+function request(path: string, headers: Record<string, string>): NextRequest {
+  return {
+    nextUrl: { pathname: path },
+    headers: new Headers(headers),
+  } as unknown as NextRequest;
+}
+
+describe('LiveUAMap privileged proxy boundary', () => {
+  it('rejects a cross-site browser opt-in request', async () => {
+    const response = proxy(
+      request('/api/liveuamap/scraper-opt-in', {
+        host: 'localhost:3000',
+        origin: 'https://evil.example',
+        'sec-fetch-site': 'cross-site',
+      }),
+    );
+
+    expect(response.status).toBe(403);
+    await expect(response.json()).resolves.toEqual({
+      detail: 'Cross-origin privileged request denied',
+    });
+  });
+
+  it('allows the same-origin dashboard request without adding page CSP', () => {
+    const response = proxy(
+      request('/api/liveuamap/scraper-opt-in', {
+        host: 'localhost:3000',
+        origin: 'http://localhost:3000',
+        'sec-fetch-site': 'same-origin',
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-security-policy')).toBeNull();
+  });
+
+  it('also protects the provider status endpoint from cross-site browser reads', () => {
+    const response = proxy(
+      request('/api/liveuamap/scraper-status', {
+        host: 'localhost:3000',
+        'sec-fetch-site': 'cross-site',
+      }),
+    );
+
+    expect(response.status).toBe(403);
+  });
+});

frontend/src/proxy.ts

@@ -43,6 +43,8 @@ function isPrivilegedApiPath(pathname: string): boolean {
     path === '/api/debug-latest' ||
     path === '/api/system/update' ||
     path === '/api/layers' ||
+    path === '/api/liveuamap' ||
+    path.startsWith('/api/liveuamap/') ||
     path === '/api/ais/feed' ||
     path === '/api/mesh/infonet/ingest' ||
     path === '/api/mesh/meshtastic/send' ||