@bananacool467/authtics-host 0.0.1-beta.7 → 0.0.1-beta.9

package/README.md

@@ -1,9 +1,11 @@
 # Authtics Host
 
-Version 0.0.1-beta.7
+Version 0.0.1-beta.9
 License: MIT
 
-(NOTE: This version is in BETA, bugs are expected)
+**(UPDATE (Security Update): Now versions, 0.0.1-beta.9 and over now requires DAT (Developer Access Token) restriction to access remote controls such as: Restarting and Shutting Down)**
+
+**(NOTE: This version is in BETA, bugs are expected)**
 
 Authtics Host is a framework inspired by Next.js. Authtics Host supports SSR (Server-Side Rendering) and uses esbuild.
 
@@ -33,14 +35,14 @@ To make your app, with auto paging and auto filing, your file tree should look l
 
 **(NOTE: the public folder is for auto filing)**
 
-index.ts should look like:
+`index.ts` should look like:
 ```ts
 import { App } from "@bananacool467/authtics-host";
 
 const app = new App();
 ```
 
-authtics_host.config.ts should look like:
+`authtics_host.config.ts` should look like:
 ```ts
 import { defineConfig } from "@bananacool467/authtics-host";
 
@@ -55,7 +57,7 @@ export default defineConfig({
 })
 ```
 
-client/pages/index.tsx should look like:
+`client/pages/index.tsx` should look like:
 ```tsx
 export default function Index () {
   return (
@@ -75,7 +77,7 @@ To make your app, without auto paging and auto filing, your file tree should loo
             index.tsx
 ```
 
-index.ts should look like:
+`index.ts` should look like:
 ```ts
 import { App } from "@bananacool467/authtics-host";
 
@@ -83,7 +85,7 @@ const app = new App();
 app.registerApp("client/app.tsx");
 ```
 
-authtics_host.config.ts should look like:
+`authtics_host.config.ts` should look like:
 ```ts
 import { defineConfig } from "@bananacool467/authtics-host";
 
@@ -96,7 +98,7 @@ export default defineConfig({
 })
 ```
 
-client/app.tsx should look like:
+`client/app.tsx` should look like:
 ```tsx
 import { Route } from "@bananacool467/authtics-host";
 import Index from "./pages/index";
@@ -110,7 +112,7 @@ export default function App() {
 }
 ```
 
-client/pages/index.tsx should look like:
+`client/pages/index.tsx` should look like:
 ```tsx
 export default function Index () {
   return (
@@ -119,14 +121,14 @@ export default function Index () {
 }
 ```
 
-## To run the project
+## To Run The Project
 
-Make sure Node 22 is installed:
+Make sure **Node 22** is installed:
 ```
 nvm install 22
 ```
 
-To switch to Node 22 use:
+To switch to **Node 22** use:
 ```
 nvm use 22
 ```
@@ -138,9 +140,9 @@ node --experimental-strip-types index.ts
 
 ## Result
 
-Then when you run your project, you will get a page just saying **"Hello, World!"** and you should see a panel at the bottom-right.
+Then when you run your project, you will get a page just saying **"Hello, World!"** and you should see a clickable Developer Panel at the bottom-right.
 
-## Developer Panel Notes and Warnings And DAT (Developer Access Token)
+## Developer Panel Notes And Warnings And DAT (Developer Access Token)
 
 A DAT (Developer Access Token) is your token that is used to access the Developer Panel.
 
@@ -164,6 +166,6 @@ There isn't any limit of DATs you can add.
 
 **(Warning: Make sure `devMode` is set to `false` in production. If `devMode` is on and DAT restriction is disabled, anyone can access the restart and shutdown endpoints.)**
 
-## Contacting
+## Contacting The Developer Of Authtics Host
 
 If you ever encounter a bug, report it to (or have questions, contact): authtics@proton.me

package/dist/cli.js

@@ -110,6 +110,39 @@ export default class App {
     server;
     constructor() {
         this.server = start();
+        this.post('/__authtics_host_apis__/get-dat-restriction-missing', async (req, res) => {
+            const reqBody = (await getJsonBody(req));
+            let datMatched = false;
+            let datRestrictedEnv = false;
+            if (config_.dat && config_.dat == reqBody.dat)
+                datMatched = true;
+            if (config_.dat == undefined)
+                datMatched = true;
+            if (config_.dat && Array.isArray(config_.dat) && config_.dat.includes(reqBody.dat))
+                datMatched = true;
+            if (datMatched) {
+                if (config_.dat !== undefined)
+                    datRestrictedEnv = true;
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({
+                    enabled: datRestrictedEnv
+                }));
+            }
+        });
+        this.post('/__authtics_host_apis__/get-dat-matching', async (req, res) => {
+            const reqBody = (await getJsonBody(req));
+            let datMatched = false;
+            if (config_.dat && config_.dat == reqBody.dat)
+                datMatched = true;
+            if (config_.dat == undefined)
+                datMatched = true;
+            if (config_.dat && Array.isArray(config_.dat) && config_.dat.includes(reqBody.dat))
+                datMatched = true;
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                isMatching: datMatched
+            }));
+        });
         this.post('/__authtics_host_apis__/get-cpu_memory', async (req, res) => {
             const reqBody = (await getJsonBody(req));
             let datMatched = false;
@@ -166,8 +199,6 @@ export default class App {
             let datMatched = false;
             if (config_.dat && config_.dat == reqBody.dat)
                 datMatched = true;
-            if (config_.dat == undefined)
-                datMatched = true;
             if (config_.dat && Array.isArray(config_.dat) && config_.dat.includes(reqBody.dat))
                 datMatched = true;
             if (datMatched) {
@@ -189,8 +220,6 @@ export default class App {
             let datMatched = false;
             if (config_.dat && config_.dat == reqBody.dat)
                 datMatched = true;
-            if (config_.dat == undefined)
-                datMatched = true;
             if (config_.dat && Array.isArray(config_.dat) && config_.dat.includes(reqBody.dat))
                 datMatched = true;
             if (datMatched) {
@@ -233,6 +262,27 @@ export default class App {
                 }));
             }
         });
+        this.post("/__authtics_host_apis__/get-host-ver", async (req, res) => {
+            const reqBody = (await getJsonBody(req));
+            let datMatched = false;
+            if (config_.dat && config_.dat == reqBody.dat)
+                datMatched = true;
+            if (config_.dat == undefined)
+                datMatched = true;
+            if (config_.dat && Array.isArray(config_.dat) && config_.dat.includes(reqBody.dat))
+                datMatched = true;
+            if (datMatched) {
+                const packageJsonPath = path.join(__dirname, '../package.json');
+                let packageJson;
+                if (fs.existsSync(packageJsonPath))
+                    packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+                const packageJsonVersion = packageJson.version || "Unknown";
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({
+                    version: packageJsonVersion
+                }));
+            }
+        });
         this.post("/__authtics_host_apis__/get-file-by-pathname", async (req, res) => {
             const reqBody = (await getJsonBody(req));
             let datMatched = false;
@@ -245,7 +295,8 @@ export default class App {
             if (datMatched) {
                 const pathname = reqBody.pathname;
                 const pagesDir = config_.autoPage === true ? path.join(process.cwd(), config_.autoPageDir || "") : undefined;
-                const filePath = pagesDir ? path.join(pagesDir, pathname + ".tsx") : undefined;
+                const safePath = path.normalize(pathname).replace(/^(\.\.[\/\\])+/, '');
+                const filePath = pagesDir ? path.join(pagesDir, safePath + ".tsx") : undefined;
                 const fileExists = filePath ? fs.existsSync(filePath) : true;
                 res.writeHead(200, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({

package/dist/devPanel.js

@@ -138,14 +138,14 @@ function installConsoleInterceptor() {
         };
     });
 }
-function PanelButton({ onClick, onClick2, children, style, fullWidth }) {
+function PanelButton({ onClick, onClick2, children, style, fullWidth, disabled }) {
     const [hovered, setHovered] = useState(false);
     const [pressed, setPressed] = useState(false);
     return (_jsx("div", { onClick: (e) => {
-            if (onClick) {
+            if (onClick && !disabled) {
                 onClick();
             }
-            else if (onClick2) {
+            else if (onClick2 && !disabled) {
                 onClick2(e);
             }
         }, onMouseEnter: () => setHovered(true), onMouseLeave: () => { setHovered(false); setPressed(false); }, onMouseDown: () => setPressed(true), onMouseUp: () => setPressed(false), style: {
@@ -194,12 +194,14 @@ export default function DevPanel() {
     const [isSsr, setIsSsr] = useState(false);
     const cpuUsage = useRef(0);
     const heapUsage = useRef(0);
+    const [datMatch, setDatMatch] = useState(false);
     const [compilerType, setCompilerType] = useState("?");
     const [errorDetail, setErrorDetail] = useState(undefined);
     const [httpVersion, setHttpVersion] = useState("v?.?");
     const [errorBoxOpenable, setErrorBoxOpenable] = useState(false);
     const [uptime, setUptime] = useState("00:00:00:00");
     const [requests, setRequests] = useState(0);
+    const [hostVersion, setHostVersion] = useState("Loading...");
     const [users, setUsers] = useState(0);
     const [token, setToken] = useState(null);
     const [tokenLength, setTokenLength] = useState(0);
@@ -211,6 +213,7 @@ export default function DevPanel() {
     const frames = useRef(0);
     const consoleScrollRef = useRef(null);
     const [isAtBottom, setIsAtBottom] = useState(true);
+    const [datRestrictionMissing, setDatRestrictionMissing] = useState(true);
     const [pos, setPos] = React.useState({ x: 20, y: 20 });
     const [dragging, setDragging] = React.useState(false);
     const offset = React.useRef({ x: 0, y: 0 });
@@ -476,6 +479,30 @@ useEffect(() => {
                 setPath(data.filePath);
             }
         };
+        const getDatMatching = async () => {
+            const resp = await fetch('/__authtics_host_apis__/get-dat-matching', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ dat: localStorage.getItem('dat') })
+            });
+            if (resp.status === 200) {
+                const data = await resp.json();
+                setDatMatch(data.isMatching);
+                if (!data.isMatching) {
+                    doc?.getElementById('authtics-dev-panel-root')?.remove();
+                    return;
+                }
+                const resp2 = await fetch('/__authtics_host_apis__/get-dat-restriction-missing', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ dat: localStorage.getItem('dat') })
+                });
+                if (resp2.status === 200) {
+                    const data = await resp2.json();
+                    setDatRestrictionMissing(!data.enabled);
+                }
+            }
+        };
         const isSSR = async () => {
             const resp = await fetch('/__authtics_host_apis__/get-is-ssr', {
                 method: 'POST',
@@ -499,6 +526,17 @@ useEffect(() => {
                 heapUsage.current = data.heapUsed;
             }
         };
+        const getHostVersion = async () => {
+            const resp = await fetch('/__authtics_host_apis__/get-host-ver', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ dat: localStorage.getItem('dat') })
+            });
+            if (resp.status === 200) {
+                const data = await resp.json();
+                setHostVersion(data.version);
+            }
+        };
         const getCompilerType = async () => {
             const resp = await fetch('/__authtics_host_apis__/get-compiler', {
                 method: 'POST',
@@ -559,6 +597,8 @@ useEffect(() => {
             getHttpVersion();
             isSSR();
             userSettings();
+            getHostVersion();
+            getDatMatching();
             setInterval(() => {
                 getUsage();
             }, 250);
@@ -642,17 +682,6 @@ useEffect(() => {
     }, []);
     // Chart tick every 2 seconds — snapshot pending bytes then reset
     useEffect(() => {
-        /*let nE;
-        const navigationEntries = performance.getEntriesByType("navigation");
-      if (navigationEntries.length > 0) {
-        const navigationEntry = navigationEntries[0] as PerformanceNavigationTiming;
-        nE = navigationEntry;
-      }
-        let statusCode = 404;
-        if (nE instanceof PerformanceNavigationTiming) {
-          statusCode = nE.responseStatus;
-        }
-        setStatus(statusCode);*/
         const interval = setInterval(() => {
             const s = pendingSent.current;
             const r = pendingReceived.current;
@@ -1104,7 +1133,7 @@ useEffect(() => {
                                                     border: '1px solid #eee',
                                                     fontSize: '12px',
                                                     color: '#333',
-                                                }, children: [_jsx("span", { style: { fontSize: '12px', color: '#333' }, children: "Version" }), _jsx("span", { style: { fontSize: '12px', color: 'blue' }, children: "v0.0.1-beta.7" })] }), _jsxs("div", { style: {
+                                                }, children: [_jsx("span", { style: { fontSize: '12px', color: '#333' }, children: "Version" }), _jsxs("span", { style: { fontSize: '12px', color: 'blue' }, children: ["v", hostVersion] })] }), _jsxs("div", { style: {
                                                     display: 'flex',
                                                     justifyContent: 'space-between',
                                                     padding: '6px 10px',
@@ -1186,7 +1215,17 @@ useEffect(() => {
                                                         gap: '6px',
                                                         color: '#fff',
                                                         flexDirection: 'row',
-                                                    }, children: [_jsx(CircleX, { size: 12 }), "Invalid Developer Access Token (DAT)"] }) })) : (_jsx(_Fragment, {})), _jsx(PanelButton, { onClick: () => { restart(); }, fullWidth: true, style: { color: '#fff', justifyContent: 'center', height: '32px', background: '#ba4e4e' }, children: _jsx("span", { style: { display: 'flex', alignItems: 'center', gap: '6px', textAlign: 'center' }, children: "Restart App" }) }), _jsx(PanelButton, { onClick: () => { shutDown(); }, fullWidth: true, style: { color: '#fff', justifyContent: 'center', height: '32px', background: '#ba4e4e' }, children: _jsx("span", { style: { display: 'flex', alignItems: 'center', gap: '6px', textAlign: 'center' }, children: "Shut Down App" }) })] })] })) }) }), compilerType !== "?" ? (_jsxs("div", { onClick: () => setOpen(o => !o), style: {
+                                                    }, children: [_jsx(CircleX, { size: 12 }), "Invalid Developer Access Token (DAT)"] }) })) : (_jsx(_Fragment, {})), hostVersion === "0.0.1-beta.9" ? (_jsx(_Fragment, { children: _jsx("div", { style: {
+                                                        display: 'flex',
+                                                        background: 'orange',
+                                                        borderRadius: '10px',
+                                                        padding: '6px 10px',
+                                                        justifyContent: 'left',
+                                                        alignItems: 'center',
+                                                        gap: '6px',
+                                                        color: '#fff',
+                                                        flexDirection: 'row',
+                                                    }, children: "Updates to security. Apps with version 0.0.1-beta.9 and over will now require DAT restriction to access remote features like restarting and shutting down the app." }) })) : (_jsx(_Fragment, {})), _jsx(PanelButton, { onClick: () => { restart(); }, fullWidth: true, style: { color: '#fff', justifyContent: 'center', height: '32px', background: '#ba4e4e' }, disabled: datRestrictionMissing, children: _jsx("span", { style: { display: 'flex', alignItems: 'center', gap: '6px', textAlign: 'center' }, children: "Restart App" }) }), datRestrictionMissing ? (_jsxs("span", { style: { display: 'flex', opacity: 0.5, fontSize: 10, justifyContent: 'center', alignItems: 'center', gap: '4px' }, children: [_jsx(Info, { size: 10 }), "Restarting the app is unavaliable. Set \"dat\" in the Authtics Host config to set restriction."] })) : (_jsx(_Fragment, {})), _jsx(PanelButton, { onClick: () => { shutDown(); }, fullWidth: true, style: { color: '#fff', justifyContent: 'center', height: '32px', background: '#ba4e4e' }, disabled: datRestrictionMissing, children: _jsx("span", { style: { display: 'flex', alignItems: 'center', gap: '6px', textAlign: 'center' }, children: "Shut Down App" }) }), datRestrictionMissing ? (_jsxs("span", { style: { display: 'flex', opacity: 0.5, fontSize: 10, justifyContent: 'center', alignItems: 'center', gap: '4px' }, children: [_jsx(Info, { size: 10 }), "Shutting down the app is unavaliable. Set \"dat\" in the Authtics Host config to set restriction."] })) : (_jsx(_Fragment, {}))] })] })) }) }), datMatch ? (_jsxs("div", { onClick: () => setOpen(o => !o), style: {
                             display: 'flex',
                             flexDirection: 'row',
                             alignItems: 'center',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananacool467/authtics-host",
-  "version": "0.0.1-beta.7",
+  "version": "0.0.1-beta.9",
   "description": "A Next.js-inspired SSR framework for Node.js with TypeScript and JSX support.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",