@danieltmn/openbridge 0.3.0 → 0.5.0

package/src/web/server.js

@@ -70,6 +70,13 @@ function securityHeaders(res) {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('Referrer-Policy', 'no-referrer');
     res.setHeader('X-Frame-Options', 'DENY');
+    // La app usa scripts/estilos inline (templates) y data: para imagenes
+    // adjuntas. Igual bloquea origenes externos, frames y objetos.
+    res.setHeader('Content-Security-Policy',
+        "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; "
+        + "script-src 'self' 'unsafe-inline'; connect-src 'self'; worker-src 'self'; "
+        + "manifest-src 'self'; object-src 'none'; base-uri 'none'; "
+        + "frame-ancestors 'none'; form-action 'self'");
 }
 
 async function handle(app, req, res) {

package/src/web/templates/chat.html

@@ -280,6 +280,11 @@
             text-align: center;
             border: 1px solid var(--border);
         }
+        #sidebar .footer .userbadge {
+            flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+            color: var(--muted); font-size: 12px;
+        }
+        #sidebar .footer .userbadge.admin { color: var(--accent); }
         #scrim {
             display: none;
             position: fixed; inset: 0;
@@ -1198,13 +1203,17 @@
             <button data-view="preview" type="button" title="Vista previa del proyecto (túnel)">preview</button>
             <button data-view="procs" type="button" title="Procesos de la sesión">procs</button>
             <button data-view="changes" type="button" title="Cambios del proyecto (git)">cambios</button>
+            <button data-view="mcp" type="button" title="Servidores MCP de opencode">mcp</button>
         </div>
         <div class="footer">
             <div class="row" id="bridgeStatusRow">
                 <span class="dot" id="bridgeDot"></span>
                 <span id="bridgeStatusText">puente: desconocido</span>
             </div>
-            <a class="logout" href="logout.php">salir</a>
+            <div class="row">
+                <span class="userbadge" id="userBadge" title="sesión actual">{{USER_NAME}}</span>
+                <a class="logout" href="logout.php">salir</a>
+            </div>
         </div>
         <div class="resizer" id="sbResizer" title="Arrastrá para ajustar · doble clic para restablecer"></div>
     </aside>
@@ -1277,6 +1286,7 @@
         <div id="viewPreview" class="view" style="display:none"></div>
         <div id="viewProcs" class="view" style="display:none"></div>
         <div id="viewChanges" class="view" style="display:none"></div>
+        <div id="viewMcp" class="view" style="display:none"></div>
 
         <footer id="statusbar">
             <span class="dot" id="sbDot"></span>
@@ -1344,7 +1354,9 @@
             themes: {{THEMES_JSON}},
             sseDisabled: {{SSE_DISABLED}},
             pushEnabled: {{PUSH_ENABLED}},
-            pushKey: "{{PUSH_KEY}}"
+            pushKey: "{{PUSH_KEY}}",
+            userName: "{{USER_NAME}}",
+            userRole: "{{USER_ROLE}}"
         };
     </script>
     <script src="app.js?v={{APPJS_VER}}" defer></script>

package/src/web/templates/login.html

@@ -89,12 +89,12 @@
         (function () {
             var knownThemes = {{THEMES_JSON}};
             var params = new URLSearchParams(location.search);
-            var cookie = document.cookie.match(/(?:^|;\s*)ocx_theme=([^;]+)/);
+            var cookie = document.cookie.match(/(?:^|;\s*)ob_theme=([^;]+)/) || document.cookie.match(/(?:^|;\s*)ocx_theme=([^;]+)/);
             var saved = (params.get('theme') || (cookie && decodeURIComponent(cookie[1])) || document.body.getAttribute('data-theme') || 'terminal');
             if (knownThemes.indexOf(saved) === -1) saved = 'terminal';
             document.body.setAttribute('data-theme', saved);
             document.getElementById('themeStylesheet').setAttribute('href', 'themes/' + saved + '.css');
-            document.cookie = 'ocx_theme=' + encodeURIComponent(saved) + ';path=/;max-age=' + (60 * 60 * 24 * 365) + ';SameSite=Lax';
+            document.cookie = 'ob_theme=' + encodeURIComponent(saved) + ';path=/;max-age=' + (60 * 60 * 24 * 365) + ';SameSite=Lax';
             window.addEventListener('load', function () {
                 var bg = getComputedStyle(document.documentElement).getPropertyValue('--bg').trim();
                 if (bg) document.getElementById('themeColor').setAttribute('content', bg);
@@ -111,7 +111,11 @@
         <input type="hidden" name="csrf" value="{{CSRF}}">
         <label class="field">
             <span class="prompt">❯</span>
-            <input type="password" id="password" name="password" placeholder="contraseña" required autofocus autocomplete="current-password">
+            <input type="text" id="username" name="username" placeholder="usuario" required autofocus autocomplete="username" value="{{USER_PREFILL}}">
+        </label>
+        <label class="field">
+            <span class="prompt">❯</span>
+            <input type="password" id="password" name="password" placeholder="contraseña" required autocomplete="current-password">
             <button type="button" class="peek" id="btnPeek" aria-label="Mostrar u ocultar contraseña" tabindex="-1">👁</button>
         </label>
         <label class="keep" for="keep">