@dbx-tools/cli 0.9.131 → 0.9.136

package/src/tunnel/options.ts

@@ -45,6 +45,9 @@ export const TunnelOptionsSchema = z
     allow: list("Email allow-list patterns.").meta({ env: "TUNNEL_AUTH_ALLOW" }),
     subject: text("Verification email subject.").meta({ env: "TUNNEL_AUTH_SUBJECT" }),
     brandName: text("Verification email brand name.").meta({ env: "TUNNEL_AUTH_BRAND_NAME" }),
+    passkeyNamePrefix: text("Prefix for humanized tunnel passkey names.").meta({
+      env: "TUNNEL_AUTH_PASSKEY_NAME_PREFIX",
+    }),
     message: text("Verification email message.").meta({ env: "TUNNEL_AUTH_MESSAGE" }),
     sessionTtlSeconds: z.coerce
       .number<number>()
@@ -127,6 +130,7 @@ export function resolveTunnelOptions(options: TunnelOptions): ResolvedTunnelOpti
     allow: options.allow,
     subject: options.subject,
     brandName: options.brandName,
+    passkeyNamePrefix: options.passkeyNamePrefix,
     message: options.message,
     // Coerced, not resolved: the plugin owns the env name and the default for
     // these, so the flag is passed through as the `config` value it expects and

package/src/tunnel/proxy.ts

@@ -46,6 +46,8 @@ export interface ProxyOptions {
   gatePaths?: readonly string[];
   /** Brand name for the hosted login page shown on a denied browser navigation. */
   brandName?: string;
+  /** Prefix added before the humanized tunnel subdomain in new passkey names. */
+  passkeyNamePrefix?: string;
   /**
    * Addresses to listen on. Defaults to a single `0.0.0.0` (every interface),
    * the portr/platform case. Pass specific interface IPs to expose the gate on
@@ -77,6 +79,7 @@ async function handleAuthRoute(
   path: string,
   gate: AuthGateApi,
   brandName: string,
+  passkeyNamePrefix?: string,
 ): Promise<boolean> {
   if (!tunnelGate.isAuthPath(path)) return false;
   if (tunnelGate.wantsHostedLogin(request)) {
@@ -84,6 +87,7 @@ async function handleAuthRoute(
     response.end(
       tunnelLoginPage.loginPageHtml({
         brandName,
+        passkeyNamePrefix,
         returnTo: tunnelGate.loginReturnTo(request),
       }),
     );
@@ -126,13 +130,20 @@ export async function startProxy(options: ProxyOptions): Promise<void> {
     void (async () => {
       const path = (request.url ?? "/").split("?")[0] ?? "/";
       const brandName = options.brandName ?? "this app";
-      if (gate && (await handleAuthRoute(request, response, path, gate, brandName))) return;
+      const passkeyNamePrefix = options.passkeyNamePrefix;
+      if (
+        gate &&
+        (await handleAuthRoute(request, response, path, gate, brandName, passkeyNamePrefix))
+      ) {
+        return;
+      }
       if ((await decide(request)) === "deny") {
         // A denied browser navigation gets the hosted login page; anything else
         // (an XHR, a /ws upgrade probe, a non-HTML fetch) gets the 401 JSON.
         if (gate && tunnelGate.wantsLoginPage(request)) {
           const html = tunnelLoginPage.loginPageHtml({
             brandName,
+            passkeyNamePrefix,
             returnTo: tunnelGate.requestReturnTo(request),
           });
           response.writeHead(401, { "content-type": "text/html; charset=utf-8" });