4bnode 4.2.0 → 4.2.1

package/skeleton/.env.example

@@ -15,13 +15,25 @@ NODE_ENV=development
 RATE_LIMIT_WINDOW_MS=900000
 RATE_LIMIT_MAX=500
 
+# ── API key gate ──
+# Every API route (login and register included) needs a valid x-api-key header.
+# Create / revoke keys in the /_dev dashboard → Security → API keys.
+# API_KEY_REQUIRED:     "off" disables the gate (default: on).
+# API_KEY_PUBLIC_PATHS: comma-separated path prefixes that never need a key
+#                       (/docs is always public), e.g. /health,/webhooks/stripe
+# API_KEY_REQUIRED=on
+# API_KEY_PUBLIC_PATHS=
+
 # ── Bonjour / mDNS service discovery ──
 # The app advertises itself on the local network so other devices can find it by
-# name (http://<host>.local:<port>) without hard-coded IPs. On by default.
-# BONJOUR_ENABLED: "off" disables advertising entirely.
+# name (http://<host>.local:<port>) without hard-coded IPs. Off by default.
+# BONJOUR_ENABLED: "on" turns advertising on (it is OFF by default).
+# BONJOUR_INTERFACE: network to advertise on when several are connected,
+#                   e.g. en0 (Wi-Fi) or en7 (Ethernet). Blank = all networks.
 # BONJOUR_NAME:    custom service name shown to other devices (default: app + host).
 # BONJOUR_TYPE:    service type without the leading underscore (default: "http").
-# BONJOUR_ENABLED=off
+# BONJOUR_ENABLED=on
+# BONJOUR_INTERFACE=en0
 # BONJOUR_NAME=My App
 # BONJOUR_TYPE=http
 
@@ -33,3 +45,11 @@ RATE_LIMIT_MAX=500
 #                       any hosted environment.
 # _4BNODE_DASHBOARD=off
 # _4BNODE_ALLOW_REMOTE=1
+
+# ── Serial devices (Arduino / ESP32) ──
+# Boards are detected when plugged in. An unknown board is added as a device
+# automatically (opening a port resets most boards). Configure in the dashboard.
+# SERIAL_AUTO_ADD:     "off" only lists new boards, without adding them (default: on).
+# SERIAL_DEFAULT_BAUD: baud rate used to identify and connect auto-added boards.
+# SERIAL_AUTO_ADD=on
+# SERIAL_DEFAULT_BAUD=115200

package/skeleton/_gitignore

@@ -3,6 +3,7 @@
 .env.*
 !.env.example
 src/docs-auth.json
+src/api-keys.json
 .4bnode/.passkey
 
 # Dependencies

package/skeleton/index.js

@@ -9,6 +9,7 @@ import rateLimit from "express-rate-limit";
 import { createInterface } from "readline";
 import { notFound, errorHandler } from "./src/middleware/errorHandler.js";
 import { startAdvertising, destroyDiscovery } from "./src/discovery.js";
+import { apiKeyGate } from "./src/middleware/apiKey.js";
 
 // ── Environment ─────────────────────────────────────
 dotenv.config();
@@ -41,6 +42,8 @@ const dashboardEnabled =
 if (dashboardEnabled) {
   try {
     const devApi = await import("./.4bnode/dev-api.js");
+    // In-memory request stats for the dashboard's live overview.
+    if (devApi.requestMetrics) app.use(devApi.requestMetrics);
     app.use("/_dev", devApi.default);
   } catch {}
 }
@@ -84,6 +87,11 @@ app.use(apiLimiter);
 // ── Static Files ────────────────────────────────────
 app.use(express.static(path.join(__dirname, "public")));
 
+// ── API key gate ────────────────────────────────────
+// Every API route (login/register included) needs a valid x-api-key header.
+// Manage keys in the /_dev dashboard → Security. API_KEY_REQUIRED=off disables.
+app.use(apiKeyGate);
+
 // ── Helpers ─────────────────────────────────────────
 function getLocalNetworkIp() {
   const interfaces = os.networkInterfaces();