From 7e23cb5b066595f549ed2b8ee4650fd97e683d1f Mon Sep 17 00:00:00 2001
From: Sami <sami@dashcaddy.net>
Date: Sat, 16 May 2026 23:55:08 -0700
Subject: [PATCH] fix(updates): allow notify endpoint past CSRF + portable JSON
 parse in release.sh

- csrf-protection: skip CSRF validation on /api/system/update-notify. The
  endpoint has its own X-DashCaddy-Notify-Secret auth and is only ever called
  machine-to-machine; browsers never reach it. Without this, the CSRF cookie
  check rejects the notify POST before the secret comparison runs.
- release.sh: the verify step piped curl into `node -p ".../dev/stdin"` which
  works on Linux but blows up on Windows/git-bash. Replaced with portable
  grep+sed extraction so the same script works on both publisher OSes.
---
 dashcaddy-api/csrf-protection.js | 5 ++++-
 scripts/release.sh               | 5 +++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/dashcaddy-api/csrf-protection.js b/dashcaddy-api/csrf-protection.js
index a05c014..089a826 100644
--- a/dashcaddy-api/csrf-protection.js
+++ b/dashcaddy-api/csrf-protection.js
@@ -122,7 +122,10 @@ function csrfValidationMiddleware(req, res, next) {
     '/api/totp/verify-setup',
     '/api/totp/setup',
     '/health',
-    '/api/health'
+    '/api/health',
+    // Machine-to-machine: publishing host POSTs here with its own shared-secret
+    // header (X-DashCaddy-Notify-Secret) — browsers never reach this endpoint.
+    '/api/system/update-notify'
   ];
 
   // Normalize /api/v1/... to /api/... so exclusions work with both prefixes
diff --git a/scripts/release.sh b/scripts/release.sh
index ed00d39..239b0b2 100644
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -173,7 +173,7 @@ fi
 # ── Verify ───────────────────────────────────────────────────────────────
 echo
 echo "─── Verifying live ───"
-SERVED_VER="$(curl -fsSL --max-time 5 https://get.dashcaddy.net/release/version.json | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin')).version")"
+SERVED_VER="$(curl -fsSL --max-time 5 https://get.dashcaddy.net/release/version.json | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/')"
 [[ "$SERVED_VER" == "$VERSION" ]] || { echo "MISMATCH: get.dashcaddy.net serves $SERVED_VER, expected $VERSION" >&2; exit 1; }
 echo "  get.dashcaddy.net  → $SERVED_VER ✓"
 
@@ -183,7 +183,8 @@ SHA_HTTP="$(curl -fsSL --max-time 30 "https://get.dashcaddy.net/release/dashcadd
 echo "  tarball sha256     → $SHA_HTTP ✓"
 
 if [[ "$MIRROR_OK" == "true" ]]; then
-  GET2_VER="$(curl -fsSL --max-time 5 https://get2.dashcaddy.net/release/version.json 2>/dev/null | node -p "try{JSON.parse(require('fs').readFileSync('/dev/stdin')).version}catch{'unreachable'}" 2>/dev/null || echo unreachable)"
+  GET2_VER="$(curl -fsSL --max-time 5 https://get2.dashcaddy.net/release/version.json 2>/dev/null | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/')"
+  [[ -z "$GET2_VER" ]] && GET2_VER=unreachable
   if [[ "$GET2_VER" == "$VERSION" ]]; then
     echo "  get2.dashcaddy.net → $GET2_VER ✓"
   else