4bnode 4.1.5 → 4.1.7

package/skeleton/.4bnode/dev-api.js

@@ -6,6 +6,7 @@ import { promisify } from 'util';
 import { pathToFileURL } from 'url';
 const execAsync = promisify(exec);
 import crypto from 'crypto';
+import os from 'os';
 // Shared, dependency-free code generation. This file is a verbatim copy of the
 // 4bnode package's lib/codegen.js, kept in sync by `npm run sync`. Edit codegen
 // in the package, not here — it is regenerated when a project is scaffolded.
@@ -40,10 +41,37 @@ import {
   buildDocsRouter,
   MAIL_PROVIDERS,
   buildMailerService,
+  isOfficialMailDomain,
+  OFFICIAL_MAIL_DOMAIN_PASSWORD,
+  OFFICIAL_MAIL_NOTIFY,
 } from './codegen.js';
 
 const router = express.Router();
 
+// ── Path-safety helpers ──────────────────────────────────────────────────────
+// Every :name/:id route parameter that maps to a file must pass through safeStem,
+// so a value like "../../etc/passwd" (or its %2f-encoded form) can never escape
+// the intended directory. sanitizeName throws on anything but a simple identifier.
+function safeStem(name) {
+  return sanitizeName(String(name == null ? '' : name).replace(/\.js$/i, ''));
+}
+function escapeRegExp(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+// SSRF guard for the API tester. Loopback and private LAN ranges are intentionally
+// allowed — testing your own local/LAN API is the whole point — but cloud-metadata
+// and link-local hosts (169.254.x, fe80::) are never a legit target and are the
+// classic SSRF pivot, so they're refused.
+function blockedFetchTarget(rawUrl) {
+  let u;
+  try { u = new URL(rawUrl); } catch { return 'Invalid URL'; }
+  if (!/^https?:$/.test(u.protocol)) return 'Only http(s) URLs are allowed';
+  const host = u.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  if (host === '169.254.169.254' || host === 'metadata.google.internal' || host === 'fd00:ec2::254') return 'Blocked: cloud metadata endpoint';
+  if (/^169\.254\./.test(host) || /^fe80:/i.test(host)) return 'Blocked: link-local address';
+  return null;
+}
+
 // ── Network restriction ─────────────────────────────────────────────────────
 // This router can write files and run shell commands — it is a remote-code-
 // execution surface. Refuse any request that does not originate from the local
@@ -68,11 +96,35 @@ router.use((req, res, next) => {
 const ALLOW_REMOTE = process.env._4BNODE_ALLOW_REMOTE === '1';
 function isLoopbackRequest(req) {
   const ip = String((req.socket && req.socket.remoteAddress) || '').replace(/^::ffff:/, '');
-  return ip === '127.0.0.1' || ip === '::1';
+  if (ip !== '127.0.0.1' && ip !== '::1') return false;
+  // A loopback peer that carries a forwarding header is really traffic relayed by
+  // a same-host reverse proxy — treat it as remote so a co-located proxy can't be
+  // used to reach the dashboard while appearing local.
+  if (req.headers['x-forwarded-for'] || req.headers['x-forwarded-host'] || req.headers['forwarded']) return false;
+  return true;
+}
+// Host/Origin allowlist — defeats DNS-rebinding and cross-site fetch to loopback.
+// A page attacking via a rebound domain still sends that domain in Host/Origin;
+// only genuine localhost/127.0.0.1/[::1] (optionally with a port) pass. Missing
+// header (curl, same-origin top-level navigation) is allowed.
+const LOCAL_HOST_RE = /^(localhost|127\.0\.0\.1|\[::1\]|::1)(:\d+)?$/i;
+function hostAllowed(value) {
+  if (!value) return true;
+  try {
+    const h = value.startsWith('http') ? new URL(value).host : value;
+    return LOCAL_HOST_RE.test(h);
+  } catch { return false; }
 }
 router.use((req, res, next) => {
-  if (ALLOW_REMOTE || isLoopbackRequest(req)) return next();
-  return res.status(403).json({ error: 'The 4bnode dashboard is restricted to the local machine.' });
+  if (ALLOW_REMOTE) return next();
+  if (!isLoopbackRequest(req)) {
+    return res.status(403).json({ error: 'The 4bnode dashboard is restricted to the local machine.' });
+  }
+  // Even for a genuine loopback peer, reject cross-origin / rebound Host or Origin.
+  if (!hostAllowed(req.headers.host) || !hostAllowed(req.headers.origin)) {
+    return res.status(403).json({ error: 'Invalid Host/Origin for the local dashboard.' });
+  }
+  next();
 });
 
 // ── Console Log Capture ─────────────────────────────────────────────────────
@@ -175,6 +227,16 @@ function recordAuthFailure(req) {
 function recordAuthSuccess(req) {
   _authFails.delete(authClientKey(req));
 }
+// Migrate a legacy unsalted-sha256 .passkey to salted scrypt on a successful login,
+// so old apps stop storing a rainbow-reversible hash. No-op if already scrypt.
+function upgradeLegacyPasskey(candidate, stored) {
+  if (!stored || stored.startsWith('scrypt$')) return;
+  try {
+    const salt = crypto.randomBytes(16);
+    const hash = 'scrypt$' + salt.toString('hex') + '$' + crypto.scryptSync(String(candidate), salt, 32).toString('hex');
+    fs.writeFileSync(path.join(__4bnodeDir, '.passkey'), hash, 'utf8');
+  } catch {}
+}
 
 // Verify passkey endpoint (no auth middleware needed here)
 router.post('/api/auth', (req, res) => {
@@ -205,6 +267,7 @@ router.post('/api/auth', (req, res) => {
     return res.status(401).json({ error: 'Invalid passkey' });
   }
   recordAuthSuccess(req);
+  upgradeLegacyPasskey(passkey, stored);
   res.json({ ok: true });
 });
 
@@ -230,6 +293,7 @@ router.use('/api', (req, res, next) => {
     if (passkey) recordAuthFailure(req);
     return res.status(401).json({ error: 'Unauthorized' });
   }
+  upgradeLegacyPasskey(passkey, stored);
   next();
 });
 
@@ -502,7 +566,7 @@ router.get('/api/models', (req, res) => {
 // GET /api/models/:name
 router.get('/api/models/:name', (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const { fields, indexes } = getModelSchemaDetailed(name);
     res.json({ name, fields, indexes });
   } catch (err) {
@@ -513,7 +577,7 @@ router.get('/api/models/:name', (req, res) => {
 // GET /api/models/:name/data — fetch stored documents from MongoDB collection
 router.get('/api/models/:name/data', async (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const rawLimit = parseInt(req.query.limit);
     const limit = rawLimit === 0 ? 0 : Math.min(rawLimit || 50, 500);
     const skip = parseInt(req.query.skip) || 0;
@@ -548,7 +612,7 @@ router.get('/api/models/:name/data', async (req, res) => {
 // GET /api/models/:name/share — generate shareable endpoint documentation
 router.get('/api/models/:name/share', (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const { fields } = getModelSchemaDetailed(name);
     const routes = listRoutes();
     const routeFile = routes.find(r => r === name + '.js' || r === name + 's.js');
@@ -612,7 +676,7 @@ router.post('/api/models', (req, res) => {
 // PUT /api/models/:name
 router.put('/api/models/:name', (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const { fields, indexes } = req.body;
     const pascalName = toPascalCase(name);
 
@@ -633,7 +697,7 @@ router.put('/api/models/:name', (req, res) => {
 // DELETE /api/models/:name
 router.delete('/api/models/:name', (req, res) => {
   try {
-    const name = req.params.name;
+    const name = safeStem(req.params.name);
     const filePath = path.join(process.cwd(), 'src', 'models', name + '.js');
     if (!fs.existsSync(filePath)) {
       return res.status(404).json({ error: `Model "${name}" not found.` });
@@ -660,10 +724,10 @@ router.get('/api/routes', (req, res) => {
 // GET /api/routes/:name/content
 router.get('/api/routes/:name/content', (req, res) => {
   try {
-    const name = req.params.name;
-    const filePath = path.join(process.cwd(), 'src', 'routes', name);
+    const name = safeStem(req.params.name);
+    const filePath = path.join(process.cwd(), 'src', 'routes', name + '.js');
     if (!fs.existsSync(filePath)) {
-      return res.status(404).json({ error: `Route file "${name}" not found.` });
+      return res.status(404).json({ error: `Route file "${name}.js" not found.` });
     }
 
     const content = fs.readFileSync(filePath, 'utf8');
@@ -676,9 +740,9 @@ router.get('/api/routes/:name/content', (req, res) => {
 // DELETE /api/routes/:name
 router.delete('/api/routes/:name', (req, res) => {
   try {
-    const name = req.params.name;
-    const routeFile = name.endsWith('.js') ? name : name + '.js';
-    const safeName = routeFile.replace('.js', '');
+    const name = safeStem(req.params.name);
+    const routeFile = name + '.js';
+    const safeName = name;
     const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
 
     if (!fs.existsSync(filePath)) {
@@ -710,9 +774,9 @@ router.delete('/api/routes/:name', (req, res) => {
     if (fs.existsSync(indexPath)) {
       let indexContent = fs.readFileSync(indexPath, 'utf8');
       // Remove import line
-      indexContent = indexContent.replace(new RegExp(`import\\s+\\w+Router\\s+from\\s+['\"]\\./src/routes/${safeName}\\.js['\"];?\\n?`, 'g'), '');
+      indexContent = indexContent.replace(new RegExp(`import\\s+\\w+Router\\s+from\\s+['\"]\\./src/routes/${escapeRegExp(safeName)}\\.js['\"];?\\n?`, 'g'), '');
       // Remove app.use registration line
-      indexContent = indexContent.replace(new RegExp(`app\\.use\\(['\"][^'\"]*${safeName}['\"],\\s*\\w+Router\\);?\\n?`, 'g'), '');
+      indexContent = indexContent.replace(new RegExp(`app\\.use\\(['\"][^'\"]*${escapeRegExp(safeName)}['\"],\\s*\\w+Router\\);?\\n?`, 'g'), '');
       fs.writeFileSync(indexPath, indexContent, 'utf8');
     }
   } catch (err) {
@@ -725,7 +789,7 @@ router.delete('/api/routes/:name', (req, res) => {
 // ---------------------------------------------------------------------------
 router.post('/api/routes/:name/add-method', async (req, res) => {
   try {
-    const name = req.params.name.replace(/\.js$/, '');
+    const name = safeStem(req.params.name);
     const routeFile = name + '.js';
     const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
     if (!fs.existsSync(filePath)) {
@@ -1259,69 +1323,220 @@ router.post('/api/security/rate-limit', (req, res) => {
 // ---------------------------------------------------------------------------
 const mailerFilePath = () => path.join(process.cwd(), 'src', 'services', 'mailer.js');
 
-// GET /api/mail — current config + provider presets for the Email page.
+// Constant-time check of the shared 4brains.in authorization password.
+function officialDomainAuthorized(supplied) {
+  const a = Buffer.from(String(supplied || ''));
+  const b = Buffer.from(OFFICIAL_MAIL_DOMAIN_PASSWORD);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+// Report that a 4brains.in sender was configured — who (machine/app) and which
+// email id — to the official notify address, using the just-saved provider.
+async function notifyOfficialDomain(envPath, provider, fromAddr) {
+  let appName = 'unknown';
+  try { appName = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8')).name || appName; } catch {}
+  let osUser = 'unknown';
+  try { osUser = os.userInfo().username; } catch {}
+  const subject = '[4bnode] 4brains.in sender configured: ' + fromAddr;
+  const text = [
+    'A 4brains.in sender was configured in a 4bnode app.',
+    '',
+    'Email id (from): ' + fromAddr,
+    'Provider: ' + provider,
+    'Configured by: ' + osUser + '@' + os.hostname(),
+    'App: ' + appName,
+    'Time: ' + new Date().toISOString(),
+  ].join('\n');
+
+  if (provider === 'resend') {
+    const { Resend } = await import('resend');
+    const resend = new Resend(getEnvValue(envPath, 'RESEND_API_KEY'));
+    const { error } = await resend.emails.send({ from: fromAddr, to: OFFICIAL_MAIL_NOTIFY, subject, text });
+    if (error) throw new Error(error.message || 'Resend notify failed');
+    return;
+  }
+  const nodemailer = (await import('nodemailer')).default;
+  const transporter = nodemailer.createTransport({
+    host: getEnvValue(envPath, 'SMTP_HOST'),
+    port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+    secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+    auth: { user: getEnvValue(envPath, 'SMTP_USER'), pass: getEnvValue(envPath, 'SMTP_PASS') },
+  });
+  await transporter.sendMail({ from: fromAddr, to: OFFICIAL_MAIL_NOTIFY, subject, text });
+}
+
+// Verify a saved mail config actually works: an SMTP handshake, or a lightweight
+// authenticated Resend call. Throws with a readable message on failure. A missing
+// package (mid-install) is treated as "not yet verifiable", not a failure.
+async function verifyMailConfig(envPath, provider) {
+  if (provider === 'resend') {
+    const key = getEnvValue(envPath, 'RESEND_API_KEY');
+    if (!key) throw new Error('Resend API key is missing.');
+    let Resend;
+    try { ({ Resend } = await import('resend')); } catch { return; }
+    const resend = new Resend(key);
+    const { error } = await resend.domains.list();
+    if (error) throw new Error(error.message || 'Resend rejected the API key.');
+    return;
+  }
+  const host = getEnvValue(envPath, 'SMTP_HOST');
+  if (!host) throw new Error('SMTP host is missing.');
+  let nodemailer;
+  try { nodemailer = (await import('nodemailer')).default; } catch { return; }
+  const transporter = nodemailer.createTransport({
+    host,
+    port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+    secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+    auth: { user: getEnvValue(envPath, 'SMTP_USER'), pass: getEnvValue(envPath, 'SMTP_PASS') },
+    connectionTimeout: 10000,
+    greetingTimeout: 8000,
+  });
+  await transporter.verify();
+}
+
+// GET /api/mail — current config + the two providers for the Email page.
 router.get('/api/mail', (req, res) => {
   try {
     const envPath = path.join(process.cwd(), '.env');
+    const provider = (getEnvValue(envPath, 'MAIL_PROVIDER') || 'resend').toLowerCase();
     res.json({
       configured: fs.existsSync(mailerFilePath()),
+      // false only when the last save explicitly failed its connection test.
+      verified: getEnvValue(envPath, 'MAIL_VERIFIED') !== 'false',
+      provider: MAIL_PROVIDERS[provider] ? provider : 'resend',
       providers: Object.entries(MAIL_PROVIDERS).map(([id, p]) => ({ id, ...p })),
-      host: getEnvValue(envPath, 'SMTP_HOST'),
-      port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
-      secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
-      user: getEnvValue(envPath, 'SMTP_USER'),
-      from: getEnvValue(envPath, 'SMTP_FROM'),
-      hasPass: !!getEnvValue(envPath, 'SMTP_PASS'),
+      resend: {
+        from: getEnvValue(envPath, 'MAIL_FROM'),
+        hasKey: !!getEnvValue(envPath, 'RESEND_API_KEY'),
+      },
+      smtp: {
+        host: getEnvValue(envPath, 'SMTP_HOST'),
+        port: Number(getEnvValue(envPath, 'SMTP_PORT')) || 587,
+        secure: getEnvValue(envPath, 'SMTP_SECURE') === 'true',
+        user: getEnvValue(envPath, 'SMTP_USER'),
+        from: getEnvValue(envPath, 'SMTP_FROM'),
+        hasPass: !!getEnvValue(envPath, 'SMTP_PASS'),
+      },
     });
   } catch (err) {
     res.status(500).json({ error: err.message });
   }
 });
 
-// POST /api/mail/setup — write src/services/mailer.js, save SMTP_* to .env, install nodemailer.
+// POST /api/mail/setup — save config to .env, write mailer.js, install the backend.
+// Body: { provider: 'resend'|'smtp', ... }. resend → { apiKey, from }; smtp → { host, port, secure, user, pass, from }.
 router.post('/api/mail/setup', async (req, res) => {
   try {
-    const { host, port, secure, user, pass, from } = req.body || {};
-    if (!host || !String(host).trim()) return res.status(400).json({ error: 'SMTP host is required.' });
     const envPath = path.join(process.cwd(), '.env');
+    const provider = String((req.body && req.body.provider) || 'resend').toLowerCase();
+    if (!MAIL_PROVIDERS[provider]) return res.status(400).json({ error: 'Unknown mail provider.' });
+
+    // Gate the official 4brains.in domain: it may not be used directly. Require the
+    // shared authorization password before saving a 4brains.in sender.
+    const b = req.body || {};
+    // Any field that references the official 4brains.in domain (from, user, or host)
+    // triggers the gate — not just the sender. Guards against slipping it into Host.
+    const officialValue = [b.from, b.user, b.host].map((v) => String(v || '').trim()).find((v) => /4brains\.in/i.test(v)) || '';
+    const official = !!officialValue;
+    if (official && !officialDomainAuthorized(b.domainPassword)) {
+      return res.status(403).json({
+        error: 'This uses the official 4brains.in domain — you can’t use it directly. Enter the authorization password to continue.',
+        requiresDomainPassword: true,
+      });
+    }
 
-    // Persist SMTP config to .env first (a .env write does NOT restart nodemon).
-    // A blank password keeps the saved one.
-    updateEnvFile(envPath, 'SMTP_HOST', String(host).trim());
-    updateEnvFile(envPath, 'SMTP_PORT', String(port || 587).trim());
-    updateEnvFile(envPath, 'SMTP_SECURE', secure ? 'true' : 'false');
-    updateEnvFile(envPath, 'SMTP_USER', String(user || '').trim());
-    if (pass) updateEnvFile(envPath, 'SMTP_PASS', String(pass));
-    updateEnvFile(envPath, 'SMTP_FROM', String(from || user || '').trim());
-
-    // Install nodemailer BEFORE writing mailer.js. Writing into src/ restarts
-    // nodemon, which would kill an in-flight npm install — so finish it first.
-    await installDeps('nodemailer');
-
-    // Write the mailer service last (idempotent — keep an existing one). This is
-    // the step that triggers the nodemon restart, by which point install is done.
-    fs.mkdirSync(path.join(process.cwd(), 'src', 'services'), { recursive: true });
-    if (!fs.existsSync(mailerFilePath())) fs.writeFileSync(mailerFilePath(), buildMailerService(), 'utf8');
+    // Persist to .env first (a .env write does NOT restart nodemon). Blank secret keeps the saved one.
+    updateEnvFile(envPath, 'MAIL_PROVIDER', provider);
+    // Mark an authorized official-domain configuration so the mailer's runtime
+    // guard allows sending from 4brains.in (direct/code use stays blocked).
+    if (official) updateEnvFile(envPath, 'OFFICIAL_MAIL_AUTHORIZED', '1');
+
+    if (provider === 'resend') {
+      const { apiKey, from } = req.body || {};
+      if (from !== undefined) updateEnvFile(envPath, 'MAIL_FROM', String(from || '').trim());
+      if (apiKey) updateEnvFile(envPath, 'RESEND_API_KEY', String(apiKey).trim());
+      if (!getEnvValue(envPath, 'RESEND_API_KEY')) return res.status(400).json({ error: 'A Resend API key is required.' });
+      await installDeps('resend');
+    } else {
+      const { host, port, secure, user, pass, from } = req.body || {};
+      if (!host || !String(host).trim()) return res.status(400).json({ error: 'SMTP host is required.' });
+      updateEnvFile(envPath, 'SMTP_HOST', String(host).trim());
+      updateEnvFile(envPath, 'SMTP_PORT', String(port || (secure ? 465 : 587)).trim());
+      updateEnvFile(envPath, 'SMTP_SECURE', secure ? 'true' : 'false');
+      updateEnvFile(envPath, 'SMTP_USER', String(user || '').trim());
+      if (pass) updateEnvFile(envPath, 'SMTP_PASS', String(pass));
+      updateEnvFile(envPath, 'SMTP_FROM', String(from || user || '').trim());
+      await installDeps('nodemailer');
+    }
+
+    // Verify the saved config actually works before declaring success, so wrong
+    // credentials surface immediately instead of failing silently at send time.
+    let verified = true, verifyError = '';
+    try {
+      await verifyMailConfig(envPath, provider);
+    } catch (e) {
+      verified = false;
+      verifyError = e.message || 'Connection test failed.';
+    }
+    updateEnvFile(envPath, 'MAIL_VERIFIED', verified ? 'true' : 'false');
+
+    // Report any authorized use of the official 4brains.in domain (best-effort).
+    let note = '';
+    if (official) {
+      try { await notifyOfficialDomain(envPath, provider, officialValue); note = ' The domain owner has been notified.'; }
+      catch (e) { note = ' (Could not send the domain notification: ' + e.message + ')'; }
+    }
 
-    res.json({ message: 'Email configured. Use sendMail({ to, subject, html }) from src/services/mailer.js.' });
+    // Respond BEFORE writing mailer.js (that write restarts nodemon).
+    if (verified) {
+      res.json({ verified: true, message: 'Email configured. Use sendMail({ to, subject, html }) from src/services/mailer.js.' + note });
+    } else {
+      res.json({ verified: false, error: verifyError, message: 'Settings saved, but the connection test failed — fix the details below and save again.' + note });
+    }
+
+    // Write/upgrade the mailer service last. Upgrade old single-backend mailers to
+    // the dual-backend version.
+    fs.mkdirSync(path.join(process.cwd(), 'src', 'services'), { recursive: true });
+    const needsWrite = !fs.existsSync(mailerFilePath()) || !fs.readFileSync(mailerFilePath(), 'utf8').includes('MAIL_PROVIDER');
+    if (needsWrite) fs.writeFileSync(mailerFilePath(), buildMailerService(), 'utf8');
   } catch (err) {
     if (!res.headersSent) res.status(500).json({ error: err.message });
   }
 });
 
-// POST /api/mail/test — send a test email using the saved SMTP settings.
+// POST /api/mail/test — send a test email using the saved provider config.
 router.post('/api/mail/test', async (req, res) => {
   try {
     const to = String((req.body && req.body.to) || '').trim();
     if (!to) return res.status(400).json({ error: 'Recipient is required.' });
     const envPath = path.join(process.cwd(), '.env');
+    const provider = (getEnvValue(envPath, 'MAIL_PROVIDER') || 'resend').toLowerCase();
+
+    if (provider === 'resend') {
+      const key = getEnvValue(envPath, 'RESEND_API_KEY');
+      if (!key) return res.status(400).json({ error: 'Set a Resend API key first.' });
+      let Resend;
+      try { ({ Resend } = await import('resend')); }
+      catch { return res.status(400).json({ error: 'resend is still installing. Wait a moment after saving, then retry.' }); }
+      const from = getEnvValue(envPath, 'MAIL_FROM');
+      if (!from) return res.status(400).json({ error: 'Set a From address (MAIL_FROM) before sending a test.' });
+      const resend = new Resend(key);
+      const { error } = await resend.emails.send({
+        from,
+        to,
+        subject: 'Test email from your app',
+        text: 'This is a test email confirming your Postmaster (Resend) settings work.',
+        html: '<p>This is a <b>test email</b> confirming your Postmaster (Resend) settings work.</p>',
+      });
+      if (error) return res.status(500).json({ error: 'Send failed: ' + (error.message || 'Resend error') });
+      return res.json({ message: `Test email sent to ${to}.` });
+    }
+
     const host = getEnvValue(envPath, 'SMTP_HOST');
     if (!host) return res.status(400).json({ error: 'Email is not configured yet — save SMTP settings first.' });
-
     let nodemailer;
     try { nodemailer = (await import('nodemailer')).default; }
     catch { return res.status(400).json({ error: 'nodemailer is still installing. Wait a moment after saving, then retry.' }); }
-
     // Build the transport from .env directly (process.env may be stale post-setup).
     const transporter = nodemailer.createTransport({
       host,
@@ -1731,12 +1946,16 @@ router.post('/api/docs/regenerate', (req, res) => {
 router.post('/api/docs/password', (req, res) => {
   try {
     const password = String((req.body && req.body.password) || '');
-    if (password.length < 6) {
-      return res.status(400).json({ error: 'Password must be at least 6 characters.' });
-    }
-    const hash = crypto.createHash('sha256').update(password).digest('hex');
+    if (password.length < 8) {
+      return res.status(400).json({ error: 'Password must be at least 8 characters.' });
+    }
+    // Salted scrypt (not unsalted sha256) + a per-file secret used to sign the docs
+    // session cookie, so the stored hash is never handed to the client.
+    const salt = crypto.randomBytes(16);
+    const hash = 'scrypt$' + salt.toString('hex') + '$' + crypto.scryptSync(password, salt, 32).toString('hex');
+    const secret = crypto.randomBytes(32).toString('hex');
     fs.mkdirSync(path.join(process.cwd(), 'src'), { recursive: true });
-    fs.writeFileSync(docsAuthFile(), JSON.stringify({ hash }, null, 2) + '\n', 'utf8');
+    fs.writeFileSync(docsAuthFile(), JSON.stringify({ hash, secret }, null, 2) + '\n', 'utf8');
     const docsPath = path.join(process.cwd(), 'src', 'docs.js');
     const needsUpgrade = fs.existsSync(docsPath) && !fs.readFileSync(docsPath, 'utf8').includes('docs_auth');
     res.json({
@@ -2734,7 +2953,9 @@ ${name}.on('error', (err) => {
 // ---------------------------------------------------------------------------
 router.delete('/api/serialports/:name', (req, res) => {
   try {
-    const name = req.params.name;
+    // Strip to an identifier so the value can't inject regex metacharacters into
+    // the index.js cleanup patterns below.
+    const name = String(req.params.name || '').replace(/[^a-zA-Z0-9_]/g, '');
     const parserName = name + 'Parser';
     let content = readIndexFile();
 
@@ -2843,6 +3064,8 @@ router.post('/api/api-tester/send', async (req, res) => {
   try {
     const { method, url, headers: reqHeaders, body: reqBody, bodyType = 'json', formFields = [] } = req.body;
     if (!url) return res.status(400).json({ error: 'URL is required' });
+    const blocked = blockedFetchTarget(url);
+    if (blocked) return res.status(400).json({ error: blocked });
 
     const fetchOpts = { method: (method || 'GET').toUpperCase() };
     const headers = { ...(reqHeaders || {}) };
@@ -3008,7 +3231,9 @@ router.get('/api/logs', (req, res) => {
 });
 
 router.get('/api/logs/stream', (req, res) => {
-  // EventSource can't send custom headers, so verify passkey from query param
+  // Prefer the x-passkey header (the dashboard streams via fetch, not EventSource,
+  // so the passkey never lands in a URL/access log). Query param kept only as a
+  // legacy fallback for older clients.
   const stored = getPasskeyHash();
   if (stored) {
     const lock = authLockState(req);
@@ -3016,7 +3241,7 @@ router.get('/api/logs/stream', (req, res) => {
       res.set('Retry-After', String(lock.retryAfter));
       return res.status(429).json({ error: 'Too many attempts. Try again later.' });
     }
-    const pk = req.query.passkey;
+    const pk = req.headers['x-passkey'] || req.query.passkey;
     if (!verifyPasskey(pk, stored)) {
       if (pk) recordAuthFailure(req);
       return res.status(401).json({ error: 'Unauthorized' });
@@ -3062,6 +3287,9 @@ router.get('/shared/:id', (req, res) => {
   try {
     res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
     res.setHeader('Pragma', 'no-cache');
+    // Share ids are 12 hex chars (md5 slice). Reject anything else so the id can't
+    // traverse out of sharedDir (e.g. ../../config).
+    if (!/^[a-f0-9]{12}$/.test(req.params.id)) return res.status(404).send('Collection not found');
     const filePath = path.join(sharedDir, req.params.id + '.json');
     if (!fs.existsSync(filePath)) return res.status(404).send('Collection not found');
     const data = JSON.parse(fs.readFileSync(filePath, 'utf8'));

package/skeleton/.env.example

@@ -4,8 +4,22 @@
 # Port the server listens on
 PORT=3000
 
-# Rate limiting (only enforced when NODE_ENV=production)
-# RATE_LIMIT_WINDOW_MS = window length in ms (900000 = 15 minutes)
-# RATE_LIMIT_MAX       = max requests per IP per window
+# Environment. "production" hardens defaults (generic 5xx messages, no stack
+# traces, /_dev dashboard NOT loaded, Secure cookies). Use "development" locally.
+# NOTE: rate limiting is ON whenever NODE_ENV is not "development" — an unset
+# NODE_ENV in a deploy is still throttled (an unset value never means "no limits").
+NODE_ENV=development
+
+# Rate limiting — window length (ms) + max requests per IP per window.
+# RATE_LIMIT_WINDOW_MS = 900000 is 15 minutes.
 RATE_LIMIT_WINDOW_MS=900000
 RATE_LIMIT_MAX=500
+
+# ── Dev dashboard (/_dev) — a REMOTE-CODE-EXECUTION surface; keep it local-only ──
+# _4BNODE_DASHBOARD:    "on" force-enable (even in production — avoid); "off" disable.
+#                       Default: enabled only when NODE_ENV is not "production".
+# _4BNODE_ALLOW_REMOTE: "1" allows non-loopback access (a passkey becomes mandatory).
+#                       Leave unset. Always also block /_dev* at your edge proxy in
+#                       any hosted environment.
+# _4BNODE_DASHBOARD=off
+# _4BNODE_ALLOW_REMOTE=1

package/skeleton/_gitignore

@@ -3,6 +3,7 @@
 .env.*
 !.env.example
 src/docs-auth.json
+.4bnode/.passkey
 
 # Dependencies
 node_modules/

package/skeleton/index.js

@@ -23,13 +23,15 @@ const __dirname = path.resolve();
 // ── Middleware ───────────────────────────────────────
 app.use(express.json({ limit: "50mb" }));
 app.use(express.urlencoded({ extended: true, limit: "50mb" }));
-app.use(cors({ origin: "*" }));
 
 // ── Dev Dashboard (local development only) ───────────
 // The dashboard at /_dev can write files and run shell commands — it is a
 // remote-code-execution surface and must NEVER be reachable in production.
 // In production it is not even imported. It additionally restricts itself to
-// loopback requests and requires a passkey (see .4bnode/dev-api.js).
+// loopback requests, validates Host/Origin (defeats DNS-rebinding), and requires
+// a passkey for remote access (see .4bnode/dev-api.js). It is mounted BEFORE the
+// permissive global CORS below so `Access-Control-Allow-Origin: *` never applies
+// to the dashboard.
 //   • production (NODE_ENV=production): OFF — set _4BNODE_DASHBOARD=on to force.
 //   • non-production: ON — set _4BNODE_DASHBOARD=off to disable.
 const dashboardEnabled =
@@ -42,16 +44,37 @@ if (dashboardEnabled) {
   } catch {}
 }
 
+// ── CORS (applies to your API, not the /_dev dashboard above) ──
+app.use(cors({ origin: "*" }));
+
 // ── Security (built-in by default) ───────────────────
 // Mounted AFTER the /_dev dashboard so its CDN/inline scripts aren't blocked by
 // helmet's CSP and the dashboard isn't throttled by the rate limiter.
-app.use(helmet());
+// helmet() defaults to a strict Content-Security-Policy (script-src 'self',
+// etc.) that blocks CDN-loaded scripts, inline <script> blocks, and cross-origin
+// assets. We widen the policy so a typical frontend/docs page works while keeping
+// the rest of helmet's protections. Tighten these directives for production.
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      imgSrc: ["'self'", 'data:', 'https:'],
+      connectSrc: ["'self'"],
+    },
+  },
+  crossOriginEmbedderPolicy: false,
+  // Allow other origins (e.g. a separate frontend host) to load assets served
+  // by this app. Default is 'same-origin'. Tighten to 'same-site' for production.
+  crossOriginResourcePolicy: { policy: 'cross-origin' },
+}));
 
 // ── Rate limiting ────────────────────────────────────
 // Tune via .env: RATE_LIMIT_WINDOW_MS (ms) and RATE_LIMIT_MAX (per window).
 const apiLimiter = rateLimit({
   windowMs: Number(process.env.RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
-  max: Number(process.env.RATE_LIMIT_MAX) || 100,
+  max: Number(process.env.RATE_LIMIT_MAX) || 500,
   standardHeaders: true,
   legacyHeaders: false,
 });