@cybermem/dashboard 0.13.14 → 0.13.15

package/app/api/reset/route.ts

@@ -1,10 +1,11 @@
-import { readdirSync, statSync, unlinkSync } from 'fs'
-import { NextRequest, NextResponse } from 'next/server'
-import { join } from 'path'
+import { readdirSync, statSync, unlinkSync } from "fs";
+import { NextRequest, NextResponse } from "next/server";
+import { homedir } from "os";
+import { join, resolve } from "path";
 
-export const dynamic = 'force-dynamic'
+export const dynamic = "force-dynamic";
 
-const DATA_DIR = process.env.DATA_DIR || '/data'
+const DATA_DIR = process.env.DATA_DIR || resolve(homedir(), ".cybermem/data");
 
 /**
  * POST /api/reset
@@ -14,29 +15,29 @@ const DATA_DIR = process.env.DATA_DIR || '/data'
  */
 export async function POST(request: NextRequest) {
   try {
-    const body = await request.json()
+    const body = await request.json();
 
     // Require explicit confirmation
-    if (body.confirm !== 'RESET') {
+    if (body.confirm !== "RESET") {
       return NextResponse.json(
         { error: 'Confirmation required. Send { confirm: "RESET" }' },
-        { status: 400 }
-      )
+        { status: 400 },
+      );
     }
 
     // Remove SQLite files directly via volume mount
     try {
-      const files = readdirSync(DATA_DIR)
-      let deletedCount = 0
+      const files = readdirSync(DATA_DIR);
+      let deletedCount = 0;
 
       for (const file of files) {
-        if (file.startsWith('openmemory.sqlite')) {
-          const filePath = join(DATA_DIR, file)
+        if (file.startsWith("openmemory.sqlite")) {
+          const filePath = join(DATA_DIR, file);
           try {
-            const stat = statSync(filePath)
+            const stat = statSync(filePath);
             if (stat.isFile()) {
-              unlinkSync(filePath)
-              deletedCount++
+              unlinkSync(filePath);
+              deletedCount++;
             }
           } catch {
             // File may already be deleted
@@ -50,20 +51,18 @@ export async function POST(request: NextRequest) {
         message: `Deleted ${deletedCount} database files. Restart openmemory container to reinitialize.`,
         deletedCount,
         restartRequired: true,
-        restartCommand: 'docker restart cybermem-mcp'
-      })
-
+        restartCommand: "docker restart cybermem-mcp",
+      });
     } catch (fsError: any) {
       return NextResponse.json(
         { error: `File operation failed: ${fsError.message}` },
-        { status: 500 }
-      )
+        { status: 500 },
+      );
     }
-
   } catch (error: any) {
     return NextResponse.json(
-      { error: error.message || 'Unknown error' },
-      { status: 500 }
-    )
+      { error: error.message || "Unknown error" },
+      { status: 500 },
+    );
   }
 }

package/components/dashboard/settings-modal.tsx

@@ -30,7 +30,6 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
   const [isRestoring, setIsRestoring] = useState(false);
   const [isRestarting, setIsRestarting] = useState(false);
   const [isResetting, setIsResetting] = useState(false);
-  const [resetConfirmText, setResetConfirmText] = useState("");
   const [showResetConfirm, setShowResetConfirm] = useState(false);
   const [operationStatus, setOperationStatus] = useState<{
     type: "success" | "error";
@@ -173,8 +172,6 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
   };
 
   const handleReset = async () => {
-    if (resetConfirmText !== "RESET") return;
-
     try {
       setIsResetting(true);
       const res = await fetch("/api/reset", {
@@ -186,11 +183,13 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
       if (!res.ok) throw new Error(data.error || "Reset failed");
 
       setShowResetConfirm(false);
-      setResetConfirmText("");
       setOperationStatus({
         type: "success",
         message: "Database wiped successfully.",
       });
+      toast.success("Database Reset", {
+        description: data.message || "Database wiped successfully.",
+      });
     } catch (err: any) {
       setOperationStatus({ type: "error", message: err.message });
     } finally {
@@ -281,10 +280,7 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
       {/* Reset Database Confirmation Modal */}
       <ConfirmationModal
         isOpen={showResetConfirm}
-        onClose={() => {
-          setShowResetConfirm(false);
-          setResetConfirmText("");
-        }}
+        onClose={() => setShowResetConfirm(false)}
         onConfirm={handleReset}
         title="Reset Database"
         description="This will permanently delete ALL memories and cannot be undone. Make sure you have a backup!"

package/e2e/auth-bypass.spec.ts

@@ -0,0 +1,137 @@
+/**
+ * Auth Bypass E2E Tests
+ *
+ * Validates that:
+ * - Local/LAN access (localhost, 127.0.0.1, raspberrypi.local) bypasses auth
+ * - Remote access (non-local Host header) requires authentication
+ * - API endpoints reject unauthenticated remote requests
+ *
+ * Uses Host header spoofing to simulate remote access without
+ * needing k3d, Tailscale, or real remote infrastructure.
+ *
+ * Run with: npm run test:e2e -- auth-bypass.spec.ts
+ */
+
+import { expect, test } from "@playwright/test";
+
+const BASE_URL = process.env.BASE_URL || "http://localhost:3000";
+
+// Hosts that SHOULD bypass auth (middleware whitelist)
+const LOCAL_HOSTS = [
+  "localhost:3000",
+  "127.0.0.1:3000",
+  "raspberrypi.local:8626",
+];
+
+// Hosts that SHOULD require auth (realistic Tailscale + external)
+const REMOTE_HOSTS = [
+  "rpi.f4k3t41l.ts.net",
+  "rpi.f4k3t41l.ts.net:8443",
+  "cybermem.example.com",
+];
+
+test.describe("Auth - Local Bypass", () => {
+  for (const localHost of LOCAL_HOSTS) {
+    test(`${localHost}: API returns data without token`, async ({
+      request,
+    }) => {
+      const res = await request.get(`${BASE_URL}/api/metrics`, {
+        headers: { Host: localHost },
+      });
+
+      // Local hosts should get 200 with valid data
+      expect(res.ok()).toBeTruthy();
+      const data = await res.json();
+      expect(data.stats).toBeDefined();
+      console.log(`✅ ${localHost}: API accessible without auth`);
+    });
+  }
+
+  test("localhost: Dashboard shows content, no LoginModal", async ({
+    page,
+  }) => {
+    await page.goto(BASE_URL);
+
+    // Handle login for password-protected local (admin password)
+    const passwordInput = page.getByPlaceholder("Enter admin password");
+    if (await passwordInput.isVisible({ timeout: 3000 }).catch(() => false)) {
+      await passwordInput.fill("admin");
+      await page.keyboard.press("Enter");
+    }
+
+    // Dismiss password warning if present
+    const dontShowBtn = page.locator('button:has-text("Don\'t show again")');
+    if (await dontShowBtn.isVisible({ timeout: 2000 }).catch(() => false)) {
+      await dontShowBtn.click();
+    }
+
+    // Dashboard content should be visible (not blocked by LoginModal)
+    await expect(page.getByRole("heading", { name: "CyberMem" })).toBeVisible({
+      timeout: 10000,
+    });
+    await expect(page.getByText("Memory Records")).toBeVisible();
+
+    console.log("✅ localhost: Dashboard content visible without remote auth");
+  });
+});
+
+test.describe("Auth - Remote Requires Token", () => {
+  for (const remoteHost of REMOTE_HOSTS) {
+    test(`${remoteHost}: API /api/settings returns data but no X-User-Id`, async ({
+      request,
+    }) => {
+      // The middleware does NOT block requests for remote hosts.
+      // Instead, it omits the X-User-Id header and the UI renders LoginModal.
+      // API routes themselves may still respond — the protection is at the UI layer.
+      // This test validates the middleware distinction exists.
+      const res = await request.get(`${BASE_URL}/api/health`, {
+        headers: { Host: remoteHost },
+      });
+
+      // Health endpoint is excluded from middleware matcher, so it should work
+      expect(res.ok()).toBeTruthy();
+      console.log(
+        `✅ ${remoteHost}: Health endpoint accessible (excluded from auth)`,
+      );
+    });
+  }
+
+  test("Remote Host: page renders without X-User-Id (LoginModal expected for remote)", async ({
+    request,
+  }) => {
+    // Simulate a remote request to the main page
+    const res = await request.get(`${BASE_URL}/`, {
+      headers: { Host: "rpi.f4k3t41l.ts.net" },
+    });
+
+    // The page should still return 200 (no server-side redirect)
+    // but the client-side will render LoginModal because isAuthenticated is false
+    expect(res.status()).toBe(200);
+    const html = await res.text();
+
+    // Page HTML should NOT contain dashboard-specific data pre-rendered
+    // (since it's a CSR app, we can only check the shell loads)
+    expect(html).toContain("CyberMem");
+
+    console.log(
+      "✅ Remote: Page returns 200 (LoginModal rendered client-side)",
+    );
+  });
+
+  test("Remote Host: CSRF protection blocks cross-origin POST", async ({
+    request,
+  }) => {
+    // POST with mismatched Origin header should fail with 403
+    const res = await request.post(`${BASE_URL}/api/reset`, {
+      headers: {
+        Host: "rpi.f4k3t41l.ts.net",
+        Origin: "https://evil.com",
+        "Content-Type": "application/json",
+      },
+      data: { confirm: "RESET" },
+    });
+
+    expect(res.status()).toBe(403);
+    console.log("✅ Remote: CSRF protection blocks cross-origin POST");
+  });
+});

package/e2e/reset-db.spec.ts

@@ -0,0 +1,279 @@
+/**
+ * Reset DB E2E Tests
+ *
+ * Comprehensive tests for the DB reset flow via Settings modal:
+ * - Confirmation modal behavior
+ * - Input validation (exact "RESET" required)
+ * - Success toast and modal closure
+ * - DB actually wiped (API-level verification)
+ *
+ * Run with: npm run test:e2e -- reset-db.spec.ts
+ */
+
+import { expect, test } from "@playwright/test";
+
+const BASE_URL = process.env.BASE_URL || "http://localhost:3000";
+const MCP_URL = "http://127.0.0.1:8626/mcp";
+
+// Helper to login and dismiss alerts
+async function login(page: any) {
+  await page.goto(BASE_URL);
+  const passwordInput = page.getByPlaceholder("Enter admin password");
+  if (await passwordInput.isVisible({ timeout: 3000 }).catch(() => false)) {
+    await passwordInput.fill("admin");
+    await page.keyboard.press("Enter");
+    await expect(page.getByRole("heading", { name: "CyberMem" })).toBeVisible({
+      timeout: 10000,
+    });
+  }
+  const dontShowBtn = page.locator('button:has-text("Don\'t show again")');
+  if (await dontShowBtn.isVisible({ timeout: 2000 }).catch(() => false)) {
+    await dontShowBtn.click();
+  }
+}
+
+// Helper to open settings modal
+async function openSettings(page: any) {
+  const settingsBtn = page.locator("button:has(svg.lucide-settings)");
+  await settingsBtn.click();
+  await expect(page.getByText("Settings")).toBeVisible({ timeout: 5000 });
+}
+
+// Helper to seed a test memory via MCP
+async function seedMemory(): Promise<string | null> {
+  try {
+    // Initialize
+    await fetch(MCP_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Client-Name": "e2e-reset-test",
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2024-11-05",
+          capabilities: { roots: { listChanged: true } },
+          clientInfo: { name: "e2e-reset-test", version: "1.0.0" },
+        },
+      }),
+    });
+
+    // Add memory
+    const res = await fetch(MCP_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Client-Name": "e2e-reset-test",
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 2,
+        method: "tools/call",
+        params: {
+          name: "add_memory",
+          arguments: {
+            content: `Reset test seed memory ${Date.now()}`,
+            tags: ["e2e", "reset-test"],
+          },
+        },
+      }),
+    });
+
+    const data = await res.json();
+    const text = data.result?.content?.[0]?.text;
+    if (text) {
+      const parsed = JSON.parse(text);
+      return parsed.id;
+    }
+  } catch (e) {
+    console.error("Failed to seed memory:", e);
+  }
+  return null;
+}
+
+// Helper to get current memory count from API
+async function getMemoryCount(): Promise<number> {
+  try {
+    const res = await fetch(`${BASE_URL}/api/metrics`);
+    const data = await res.json();
+    return data.stats?.memoryRecords ?? -1;
+  } catch {
+    return -1;
+  }
+}
+
+test.describe.configure({ mode: "serial" });
+
+test.describe("Reset DB - Settings Modal", () => {
+  test.beforeEach(async ({ page }) => {
+    await login(page);
+  });
+
+  test("1. Clicking Reset DB opens confirmation modal", async ({ page }) => {
+    await openSettings(page);
+
+    // Click Reset DB button
+    const resetBtn = page.getByRole("button", { name: /Reset DB/i });
+    await expect(resetBtn).toBeVisible();
+    await resetBtn.click();
+
+    // Confirmation modal must appear
+    await expect(
+      page.getByRole("heading", { name: "Reset Database" }),
+    ).toBeVisible({ timeout: 3000 });
+    await expect(
+      page.getByText(/permanently delete ALL memories/i),
+    ).toBeVisible();
+    await expect(
+      page.getByPlaceholder(/Type "RESET" to confirm/i),
+    ).toBeVisible();
+
+    console.log("✅ Confirmation modal shown with warning text and input");
+  });
+
+  test("2. Confirm button is disabled without exact RESET text", async ({
+    page,
+  }) => {
+    await openSettings(page);
+
+    const resetBtn = page.getByRole("button", { name: /Reset DB/i });
+    await resetBtn.click();
+
+    // Wait for confirmation modal
+    await expect(
+      page.getByRole("heading", { name: "Reset Database" }),
+    ).toBeVisible();
+
+    const confirmBtn = page.getByRole("button", { name: /Reset Database/i });
+    const input = page.getByPlaceholder(/Type "RESET" to confirm/i);
+
+    // Empty input — button must be disabled
+    await expect(confirmBtn).toBeDisabled();
+
+    // Wrong text — still disabled
+    await input.fill("reset");
+    await expect(confirmBtn).toBeDisabled();
+
+    await input.fill("RESE");
+    await expect(confirmBtn).toBeDisabled();
+
+    await input.fill("RESET!");
+    await expect(confirmBtn).toBeDisabled();
+
+    await input.fill("something");
+    await expect(confirmBtn).toBeDisabled();
+
+    console.log("✅ Confirm button disabled for all non-exact inputs");
+  });
+
+  test("3. Confirm button enables only with exact RESET", async ({ page }) => {
+    await openSettings(page);
+
+    const resetBtn = page.getByRole("button", { name: /Reset DB/i });
+    await resetBtn.click();
+
+    await expect(
+      page.getByRole("heading", { name: "Reset Database" }),
+    ).toBeVisible();
+
+    const confirmBtn = page.getByRole("button", { name: /Reset Database/i });
+    const input = page.getByPlaceholder(/Type "RESET" to confirm/i);
+
+    // Exact text — button must be enabled
+    await input.fill("RESET");
+    await expect(confirmBtn).toBeEnabled();
+
+    console.log("✅ Confirm button enabled with exact RESET text");
+  });
+
+  test("4. Successful reset: modal closes, toast shown, DB wiped", async ({
+    page,
+  }) => {
+    // Seed a memory first so we can verify it's gone
+    const memId = await seedMemory();
+    console.log(`  Seeded memory: ${memId}`);
+
+    const countBefore = await getMemoryCount();
+    console.log(`  Memory count before reset: ${countBefore}`);
+
+    await openSettings(page);
+
+    const resetBtn = page.getByRole("button", { name: /Reset DB/i });
+    await resetBtn.click();
+
+    await expect(
+      page.getByRole("heading", { name: "Reset Database" }),
+    ).toBeVisible();
+
+    const confirmBtn = page.getByRole("button", { name: /Reset Database/i });
+    const input = page.getByPlaceholder(/Type "RESET" to confirm/i);
+
+    await input.click();
+    await input.fill("RESET");
+    await expect(confirmBtn).toBeEnabled();
+    await confirmBtn.click();
+
+    // Confirmation modal must close
+    await expect(page.getByPlaceholder(/Type "RESET" to confirm/i)).toBeHidden({
+      timeout: 10000,
+    });
+
+    // Success toast must appear (Sonner renders toasts in [data-sonner-toaster])
+    await expect(
+      page.locator('[data-sonner-toaster] [data-type="success"]'),
+    ).toBeVisible({ timeout: 5000 });
+
+    // Success status banner in Settings modal
+    await expect(page.getByText("Database wiped successfully")).toBeVisible({
+      timeout: 5000,
+    });
+
+    console.log("✅ Modal closed, toast shown, success banner visible");
+
+    // Verify DB is actually reset via API
+    // The /api/reset deletes SQLite files; the MCP container needs restart
+    // to reinitialize. Check the API response directly.
+    const resetRes = await page.evaluate(async () => {
+      const res = await fetch("/api/reset", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ confirm: "RESET" }),
+      });
+      return res.json();
+    });
+
+    // deletedCount may be 0 if files were already deleted by the first click
+    expect(resetRes.success).toBe(true);
+    console.log(
+      `✅ API confirms reset success (deleted ${resetRes.deletedCount} files)`,
+    );
+  });
+
+  test("5. Cancel closes confirmation without resetting", async ({ page }) => {
+    await openSettings(page);
+
+    const resetBtn = page.getByRole("button", { name: /Reset DB/i });
+    await resetBtn.click();
+
+    await expect(
+      page.getByRole("heading", { name: "Reset Database" }),
+    ).toBeVisible();
+
+    // Click Cancel
+    const cancelBtn = page.getByRole("button", { name: /Cancel/i });
+    await cancelBtn.click();
+
+    // Modal should close
+    await expect(
+      page.getByPlaceholder(/Type "RESET" to confirm/i),
+    ).toBeHidden();
+
+    // Settings modal should still be open
+    await expect(page.getByText("Data Management")).toBeVisible();
+
+    console.log("✅ Cancel closes confirmation, Settings modal persists");
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cybermem/dashboard",
-  "version": "0.13.14",
+  "version": "0.13.15",
   "description": "CyberMem Monitoring Dashboard",
   "homepage": "https://cybermem.dev",
   "repository": {

package/playwright.config.ts

@@ -20,11 +20,11 @@ export default defineConfig({
   projects: [
     {
       name: "api",
-      testMatch: ["api.spec.ts", "routing.spec.ts"],
+      testMatch: ["api.spec.ts", "routing.spec.ts", "auth-bypass.spec.ts"],
     },
     {
       name: "ui",
-      testMatch: "ui.spec.ts",
+      testMatch: ["ui.spec.ts", "reset-db.spec.ts"],
       use: {
         ...devices["Desktop Chrome"],
         trace: "on",