security: harden dDRM pipeline — remove CEK logging, rate limit decrypts, audit trail, CORS, blob cleanup

Pre-media-pipeline security hardening addressing 5 findings from dDRM audit:

- Remove plaintext CEK and decrypted payload logging from media.ts, replace
  with truncated SHA-256 hash (non-reversible, still useful for debugging)
- Add dDRM-specific rate limit scopes (30 decrypt/min, 300 segments/min)
  and move rate limiter before router mounts so decrypt endpoints are covered
- Add /api/storage/lit/secure-view, /api/storage/lit/decrypt, /api/media/init
  to AUDITED_ENDPOINTS with action names for structured audit trail
- Replace CORS wildcard (*) with origin allowlist (localhost, puter.me,
  puter.site, puter.localhost) to prevent cross-origin content exfiltration
- Track and revoke blob URLs in dDRM viewer on page unload to prevent
  decrypted content persisting in browser memory

Made-with: Cursor

Author: SashaMIT

pc2-node/data/lit-actions/non-media-encrypt-chipotle.js

@@ -0,0 +1,24 @@
+/**
+ * Lit Action: Non-Media Asset Encryption (Chipotle/PKP-AES)
+ *
+ * Encrypts the Content Encryption Key (CEK) using Lit.Actions.Encrypt (PKP-AES).
+ * The CEK is passed as a base64 string and encrypted under the specified PKP,
+ * producing a ciphertext that can only be decrypted by the same PKP via
+ * Lit.Actions.Decrypt.
+ *
+ * jsParams expected:
+ *   - plaintext:  The base64-encoded CEK string to encrypt
+ *   - pkpId:      PKP wallet address to encrypt under
+ */
+
+(async () => {
+  try {
+    const encrypted = await Lit.Actions.Encrypt({
+      pkpId: pkpId,
+      message: plaintext,
+    });
+    Lit.Actions.setResponse({ response: JSON.stringify({ ciphertext: encrypted }) });
+  } catch (e) {
+    Lit.Actions.setResponse({ response: JSON.stringify({ error: e.message }) });
+  }
+})();

pc2-node/data/test-apps/ddrm-viewer/viewer.js

@@ -108,6 +108,7 @@
   var viewerState = {
     totalPages: 1,
     pagesLoaded: 0,
+    blobUrls: [],
   };
 
   var zoom = { level: 1, min: 0.25, max: 5, step: 0.25 };
@@ -194,6 +195,7 @@
     })
     .then(function (result) {
       var blobUrl = URL.createObjectURL(result.blob);
+      viewerState.blobUrls.push(blobUrl);
 
       if (isAudioType) {
         showAudioPlayer(blobUrl);
@@ -228,6 +230,7 @@
         })
         .then(function (blob) {
           var blobUrl = URL.createObjectURL(blob);
+          viewerState.blobUrls.push(blobUrl);
           var placeholder = document.getElementById('page-slot-' + pageNum);
           if (placeholder) {
             var img = document.createElement('img');
@@ -589,6 +592,11 @@
     }
   }
 
+  // ── Cleanup: revoke blob URLs on unload ──────────────
+  window.addEventListener('beforeunload', function () {
+    viewerState.blobUrls.forEach(function (url) { URL.revokeObjectURL(url); });
+  });
+
   // ── Go ────────────────────────────────────────────────
 
   init();

pc2-node/src/api/audit.ts

@@ -28,6 +28,10 @@ const AUDITED_ENDPOINTS = [
   '/api/ai/chat',
   // Key-value operations
   '/kv/',
+  // dDRM decrypt operations
+  '/api/storage/lit/secure-view',
+  '/api/storage/lit/decrypt',
+  '/api/media/init',
 ];
 
 /**
@@ -63,6 +67,9 @@ function extractAction(method: string, endpoint: string): string {
     'POST /api/backups/create': 'backup_create',
     'POST /api/backups/restore': 'backup_restore',
     'POST /api/ai/chat': 'ai_chat',
+    'POST /api/storage/lit/secure-view': 'ddrm_secure_view',
+    'POST /api/storage/lit/decrypt': 'ddrm_decrypt',
+    'POST /api/media/init': 'media_session_init',
   };
 
   const key = `${method} ${path}`;

pc2-node/src/api/index.ts

@@ -336,6 +336,10 @@ export function setupAPI(app: Express): void {
     }
   });
 
+  // Apply rate limiting and audit middleware before routers so dDRM endpoints are covered
+  app.use(rateLimitMiddleware());
+  app.use(auditMiddleware);
+
   // Storage usage endpoint
   app.use('/api/storage', storageRouter);
   app.use('/api/media', mediaRouter);
@@ -407,10 +411,6 @@ export function setupAPI(app: Express): void {
     });
   });
 
-  // Apply rate limiting and audit middleware to all routes (after authentication)
-  app.use(rateLimitMiddleware());
-  app.use(auditMiddleware);
-
   // Search endpoint (require auth)
   app.post('/search', authenticate, handleSearch);
 

pc2-node/src/api/media.ts

@@ -1049,9 +1049,8 @@ async function unwrapECDHEnvelope(
   // Verify structure: read keyCount at bodyOffset
   const keyCount = (decrypted[bodyOffset] << 24) | (decrypted[bodyOffset + 1] << 16) |
                    (decrypted[bodyOffset + 2] << 8) | decrypted[bodyOffset + 3];
-  logger.info(`[media/CEK] Unwrapped license: metaSize=${metaSize}, keyCount=${keyCount}, cekStart=${cekStart}, totalDecrypted=${decrypted.length}`);
-  logger.info(`[media/CEK] CEK (hex): ${Buffer.from(cekBytes).toString('hex')}`);
-  logger.info(`[media/CEK] Full decrypted payload (hex): ${Buffer.from(decrypted).toString('hex')}`);
+  const cekHash = crypto.createHash('sha256').update(cekBytes).digest('hex').slice(0, 12);
+  logger.info(`[media/CEK] Unwrapped license: metaSize=${metaSize}, keyCount=${keyCount}, cekLen=${cekBytes.length}, cekSha=${cekHash}`);
   return Buffer.from(cekBytes).toString('base64');
 }
 

pc2-node/src/api/middleware.ts

@@ -444,13 +444,24 @@ export function corsMiddleware(
   res: Response,
   next: NextFunction
 ): void {
-  res.setHeader('Access-Control-Allow-Origin', '*');
+  const origin = req.headers.origin || '';
+  const allowed =
+    !origin ||
+    origin.startsWith('http://localhost') ||
+    origin.startsWith('https://localhost') ||
+    origin.includes('.puter.localhost') ||
+    origin.includes('.puter.me') ||
+    origin.includes('.puter.site');
+
+  if (allowed) {
+    res.setHeader('Access-Control-Allow-Origin', origin || '*');
+  }
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
   res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Range');
   res.setHeader('Access-Control-Expose-Headers', 'Content-Range, Accept-Ranges, Content-Length');
 
   if (req.method === 'OPTIONS') {
-    res.status(200).end();
+    res.status(allowed ? 200 : 403).end();
     return;
   }
 

pc2-node/src/api/rate-limit.ts

@@ -40,6 +40,16 @@ const DEFAULT_LIMITS: Record<string, RateLimitConfig> = {
     windowMs: 60 * 1000,     // 1 minute
     maxRequests: 10,         // 10 requests per minute
   },
+  // dDRM decrypt operations — prevent bulk content extraction
+  ddrm: {
+    windowMs: 60 * 1000,     // 1 minute
+    maxRequests: 30,         // 30 decrypts per minute per wallet
+  },
+  // Media segment fetches — higher limit for smooth HD playback
+  media_segment: {
+    windowMs: 60 * 1000,     // 1 minute
+    maxRequests: 300,        // 300 segments per minute per wallet
+  },
   // Default for unscoped requests
   default: {
     windowMs: 60 * 1000,     // 1 minute
@@ -101,7 +111,16 @@ function getEndpointScope(method: string, path: string): string {
     '/kv/',
   ];
 
-  // Check each category
+  // Check each category — dDRM endpoints first (most specific)
+  const ddrmEndpoints = [
+    '/api/storage/lit/secure-view', '/api/storage/lit/decrypt',
+    '/api/media/init',
+  ];
+  for (const endpoint of ddrmEndpoints) {
+    if (path.startsWith(endpoint)) return 'ddrm';
+  }
+  if (path.startsWith('/api/media/segment')) return 'media_segment';
+
   for (const endpoint of adminEndpoints) {
     if (path.startsWith(endpoint)) return 'admin';
   }