fix(security): only waive TLS verification for loopback health checks

[JustAGhosT]

Closes the danger_accept_invalid_certs issue tracked as baton 8e072344.

The problem

check_service_health (status.rs:40) is a registered #[tauri::command] taking url: String straight from the frontend, and built its reqwest client with danger_accept_invalid_certs(true) unconditionally. The comment said "For localhost self-signed certs" — but nothing enforced that. Certificate validation was disabled for every URL it was handed, including remote https endpoints.

The fix

The waiver is now gated on the target actually being loopback:

• is_loopback() decides from the parsed host alone, so a name that merely resolves to loopback cannot talk deck into skipping validation. Matching on url::Host rather than the host string also covers the alternate IPv4 spellings the parser normalises (http://127.1, http://0x7f.0.0.1) and bracketed IPv6 (http://[::1]).
• Redirects can't carry the waiver off-host. danger_accept_invalid_certs is per-client, not per-request, so it would otherwise cover whatever host reqwest followed a redirect to. Loopback probes get a redirect policy that refuses to leave loopback; a probe that redirects off-host reports unhealthy rather than trusting an unvalidated certificate.
• Non-http(s) schemes and malformed URLs are now caller errors (Err) rather than being reported as an unhealthy service (Ok(false)).

Remote endpoints keep full certificate validation.

Why now

docs/specs/deck-ops-cockpit.md §1.3 (landed in #6) plans new outbound HTTP from Rust to sluice, docket and story-gen, and notes that because deck uses native reqwest rather than the Tauri HTTP plugin, capabilities/default.json does not constrain outbound requests at all — allowlisting has to be enforced in Rust. This gives that work a clean base instead of a pattern worth copying.

Verification

6 tests covering loopback spellings, remote hosts, lookalike hosts (localhost.example.com, localhost@evil.example.com), scheme rejection and malformed input:

running 6 tests
test services::status::tests::http_and_https_urls_are_accepted ... ok
test services::status::tests::loopback_hosts_waive_certificate_validation ... ok
test services::status::tests::malformed_urls_are_rejected ... ok
test services::status::tests::non_http_schemes_are_rejected ... ok
test services::status::tests::remote_hosts_keep_certificate_validation ... ok
test services::status::tests::check_service_health_rejects_non_http_url_before_probing ... ok

test result: ok. 6 passed; 0 failed

cargo fmt --all --check clean. Clippy warning count unchanged at the 6 pre-existing ones documented in .github/workflows/ci.yml; this change adds none.

Provenance

The implementation was written by an earlier background agent whose session died before it could commit — the work survived only as an uncommitted diff in an abandoned worktree, and was recovered rather than rewritten.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved service health checks by validating URLs and accepting only HTTP and HTTPS addresses.
  • Added a two-second timeout to prevent checks from hanging.
  • Strengthened redirect and TLS handling for safer local service connections.
  • Rejected unsupported URL schemes and restricted loopback redirects to loopback destinations.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 85d2c1ed-09fe-4c2d-8b53-419625f4689f

📥 Commits

Reviewing files that changed from the base of the PR and between 5e8c42b and 9056b61.

📒 Files selected for processing (1)

• app/src-tauri/src/services/status.rs

---

📝 Walkthrough

Walkthrough

The service health check now validates HTTP(S) URLs, applies a two-second timeout, limits redirects, and waives TLS validation only for loopback hosts. Tests cover URL and host validation behavior.

Changes

Service health-check security controls

Layer / File(s)	Summary
Validated health probe app/src-tauri/src/services/status.rs	The health check parses HTTP(S) URLs, applies a timeout, restricts TLS bypass to loopback hosts, and limits loopback redirects. Invalid or unsupported URLs return errors.
Health-check validation tests app/src-tauri/src/services/status.rs	Tests cover loopback and remote host classification, valid and invalid URL schemes, malformed URLs, and early rejection of non-HTTP requests.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main security change: limiting TLS verification bypasses to loopback health checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/health-check-tls-loopback-only

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}