@calimero-network/registry-cli 1.22.3 → 1.22.4

package/dist/index.js

@@ -15,7 +15,7 @@ var DEFAULT_REGISTRY_URL = "https://apps.calimero.network";
 function defaultConfig() {
   return { registry: { url: DEFAULT_REGISTRY_URL } };
 }
-var RemoteConfig = class {
+var RemoteConfig = class _RemoteConfig {
   configPath;
   config;
   constructor() {
@@ -57,7 +57,13 @@ var RemoteConfig = class {
         ...this.config.registry.apiKey ? { apiKey: this.config.registry.apiKey } : {}
       }
     };
-    fs7.writeFileSync(this.configPath, JSON.stringify(configToSave, null, 2));
+    fs7.writeFileSync(this.configPath, JSON.stringify(configToSave, null, 2), {
+      mode: 384
+    });
+    try {
+      fs7.chmodSync(this.configPath, 384);
+    } catch {
+    }
   }
   /**
    * Get registry URL with priority:
@@ -72,9 +78,30 @@ var RemoteConfig = class {
    * Set registry URL
    */
   setRegistryUrl(url) {
+    if (_RemoteConfig.isInsecureRemoteUrl(url)) {
+      console.warn(
+        "\u26A0\uFE0F  Registry URL uses http:// on a non-local host. Your API key would be sent in cleartext \u2014 prefer https:// for remote registries."
+      );
+    }
     this.config.registry.url = url;
     this.saveConfig();
   }
+  /**
+   * True when `url` is http:// to a host other than localhost/loopback, i.e. a
+   * Bearer token would traverse the network in cleartext.
+   */
+  static isInsecureRemoteUrl(url) {
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      return false;
+    }
+    if (parsed.protocol !== "http:") return false;
+    const host = parsed.hostname.toLowerCase();
+    const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".localhost");
+    return !isLocal;
+  }
   /**
    * Get API key with priority:
    * 1. Environment variable CALIMERO_API_KEY