fix: remove localhost bypasses from sync authentication and rate limiting, and add write authentication to package update API.

src/app/api/packages/[id]/route.ts

@@ -30,6 +30,15 @@ export async function PUT(
   request: NextRequest,
   { params }: { params: { id: string } }
 ) {
+  // Check auth
+  const auth = await SyncAuth.isWriteAllowed(request)
+  if (!auth.allowed) {
+    return NextResponse.json(
+      { error: auth.reason || 'Unauthorized' },
+      { status: 403 }
+    )
+  }
+
   try {
     const body = await request.json()
     const packageData = await PackageService.update(params.id, body)

src/lib/sync/auth.ts

@@ -37,21 +37,8 @@ export class SyncAuth {
       }
     }
 
-    // Additional check: verify request is from localhost or same server
-    const clientIP = request.headers.get('x-forwarded-for') || 
-                    request.headers.get('x-real-ip') || 
-                    'unknown'
-    
-    const allowedIPs = ['127.0.0.1', 'localhost', '::1']
-    const isLocalRequest = allowedIPs.includes(clientIP.split(',')[0].trim())
-
-    if (!isLocalRequest && secretKey !== this.SYNC_SECRET) {
-      return { 
-        allowed: false, 
-        reason: 'Sync operations only allowed from server in server-only mode' 
-      }
-    }
-
+    // If we reach here, the secret key is valid.
+    // In server-only mode, we strictly require the secret key, so no further checks are needed.
     return { allowed: true }
   }
 
@@ -63,18 +50,11 @@ export class SyncAuth {
     // Always enforce auth for writes
     const secretKey = request.headers.get('x-sync-secret')
 
-    // Check localhost
-    const clientIP = request.headers.get('x-forwarded-for') || 
-                    request.headers.get('x-real-ip') || 
-                    'unknown'
-    
-    const allowedIPs = ['127.0.0.1', 'localhost', '::1']
-    const isLocalRequest = allowedIPs.includes(clientIP.split(',')[0].trim())
-
-    if (isLocalRequest) {
-        return { allowed: true }
-    }
+    // Check localhost - DISABLED FOR SECURITY
+    // We cannot trust X-Forwarded-For headers as they can be spoofed
+    // const clientIP = request.headers.get('x-forwarded-for') || ...
 
+    // Always require secret key for write operations
     if (!this.SYNC_SECRET) {
       return {
         allowed: false,
@@ -83,12 +63,12 @@ export class SyncAuth {
     }
 
     if (secretKey === this.SYNC_SECRET) {
-        return { allowed: true }
+      return { allowed: true }
     }
 
     return {
-        allowed: false, 
-        reason: 'Write operations require authentication' 
+      allowed: false,
+      reason: 'Write operations require authentication'
     }
   }
 

src/middleware.ts

@@ -16,16 +16,9 @@ export async function middleware(request: NextRequest) {
         request.ip ||
         'CACHE_TOKEN'
 
-      // Exempt localhost from rate limiting
-      const isLocalhost = ip === '127.0.0.1' ||
-        ip === '::1' ||
-        ip === 'localhost' ||
-        ip === 'CACHE_TOKEN'
-
-      if (!isLocalhost) {
-        // 50 requests per minute per IP
-        await limiter.check(null, 50, ip)
-      }
+      // Rate limit everyone, including localhost, to prevent spoofing attacks
+      // 50 requests per minute per IP
+      await limiter.check(null, 50, ip)
     } catch {
       return NextResponse.json(
         { error: 'Too Many Requests' },