@delt/claude-alarm 0.9.0 → 0.9.1

package/dist/dashboard/index.html

@@ -871,7 +871,7 @@
 <div class="token-overlay hidden" id="tokenOverlay">
   <div class="token-form">
     <h2>Authentication Required</h2>
-    <p>Enter the hub token to connect. Find it by running: <code>claude-alarm token</code></p>
+    <p>Enter the hub token to connect. Run <code>claude-alarm token</code>, or open the login link printed by <code>claude-alarm hub start</code>.</p>
     <input type="text" id="tokenInput" placeholder="Paste token here..." autocomplete="off">
     <button id="tokenSubmit">Connect</button>
     <div class="token-error" id="tokenError">Connection failed. Check your token.</div>
@@ -1026,7 +1026,6 @@
     selectedSession: null,
     messages: {},
     notifications: [],
-    token: null,
     pendingImage: null,
     unread: {},
     waitingReply: {},
@@ -1291,25 +1290,28 @@
   initTheme();
 
   // --- Token handling ---
-  function getToken() {
-    const params = new URLSearchParams(location.search);
-    const urlToken = params.get('token');
-    if (urlToken) {
-      sessionStorage.setItem('claude-alarm-token', urlToken);
-      return urlToken;
+  async function checkAuth() {
+    try {
+      return (await fetch('/api/status')).status !== 401;
+    } catch {
+      return true;
     }
-    return sessionStorage.getItem('claude-alarm-token');
   }
 
   function showTokenForm() { $('#tokenOverlay').classList.remove('hidden'); }
   function hideTokenForm() { $('#tokenOverlay').classList.add('hidden'); }
 
-  $('#tokenSubmit').addEventListener('click', () => {
+  $('#tokenSubmit').addEventListener('click', async () => {
     const token = $('#tokenInput').value.trim();
     if (!token) return;
-    state.token = token;
-    sessionStorage.setItem('claude-alarm-token', token);
+    const res = await fetch('/api/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ token }),
+    }).catch(() => null);
+    if (!res || !res.ok) { $('#tokenError').style.display = 'block'; return; }
     $('#tokenError').style.display = 'none';
+    $('#tokenInput').value = '';
     hideTokenForm();
     connect();
   });
@@ -1320,25 +1322,23 @@
   // --- WebSocket ---
   function connect() {
     const proto = location.protocol === 'https:' ? 'wss' : 'ws';
-    const tokenQuery = state.token ? `?token=${encodeURIComponent(state.token)}` : '';
-    const ws = new WebSocket(`${proto}://${location.host}/ws/dashboard${tokenQuery}`);
+    const ws = new WebSocket(`${proto}://${location.host}/ws/dashboard`);
+    let opened = false;
 
     ws.onopen = () => {
+      opened = true;
       state.ws = ws;
       hideTokenForm();
       $('#connDot').classList.add('connected');
       $('#connLabel').textContent = 'Connected';
     };
-    ws.onclose = () => {
+    ws.onclose = async () => {
       state.ws = null;
       $('#connDot').classList.remove('connected');
       $('#connLabel').textContent = 'Disconnected';
+      if (!opened && !(await checkAuth())) { showTokenForm(); return; }
       setTimeout(connect, 3000);
     };
-    ws.onerror = () => {
-      if (!state.token) { showTokenForm(); } else { $('#tokenError').style.display = 'block'; showTokenForm(); }
-      ws.close();
-    };
     ws.onmessage = (e) => { try { handleMessage(JSON.parse(e.data)); } catch {} };
   }
 
@@ -2128,16 +2128,14 @@
   $('#settingsToggle').addEventListener('click', async () => {
     // Load webhook data
     try {
-      const tokenQuery = state.token ? `?token=${encodeURIComponent(state.token)}` : '';
-      const res = await fetch(`/api/webhooks${tokenQuery}`);
+      const res = await fetch(`/api/webhooks`);
       const data = await res.json();
       webhookData = data.webhooks || [];
     } catch { webhookData = []; }
     renderWebhooks();
     // Load telegram data
     try {
-      const tokenQuery = state.token ? `?token=${encodeURIComponent(state.token)}` : '';
-      const res = await fetch(`/api/telegram${tokenQuery}`);
+      const res = await fetch(`/api/telegram`);
       const data = await res.json();
       const tg = data.telegram || {};
       if (!$('#tgBotToken').value || $('#tgBotToken').value.includes('...')) {
@@ -2172,8 +2170,7 @@
   $('#webhookSave').addEventListener('click', async () => {
     const valid = webhookData.filter(w => w.url.trim());
     try {
-      const tokenQuery = state.token ? `?token=${encodeURIComponent(state.token)}` : '';
-      await fetch(`/api/webhooks${tokenQuery}`, {
+      await fetch(`/api/webhooks`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ webhooks: valid }),
@@ -2248,8 +2245,7 @@
     $('#tgDetectStatus').textContent = 'Detecting...';
     $('#tgChatList').innerHTML = '';
     try {
-      const tokenQuery = state.token ? `?token=${encodeURIComponent(state.token)}` : '';
-      const res = await fetch(`/api/telegram/detect${tokenQuery}`, {
+      const res = await fetch(`/api/telegram/detect`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ botToken }),
@@ -2286,8 +2282,7 @@
     const chatId = $('#tgChatId').value.trim();
     if (!botToken || !chatId) { showTgStatus('Bot Token and Chat ID are required.', false); return; }
     try {
-      const tokenQuery = state.token ? `?token=${encodeURIComponent(state.token)}` : '';
-      const res = await fetch(`/api/telegram/test${tokenQuery}`, {
+      const res = await fetch(`/api/telegram/test`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ botToken, chatId }),
@@ -2306,8 +2301,7 @@
     if (!botToken || !chatId) { showTgStatus('Bot Token and Chat ID are required.', false); return; }
     if (botToken.includes('...')) { showTgStatus('Bot Token is masked. Please enter the full token.', false); return; }
     try {
-      const tokenQuery = state.token ? `?token=${encodeURIComponent(state.token)}` : '';
-      await fetch(`/api/telegram${tokenQuery}`, {
+      await fetch(`/api/telegram`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ telegram: { botToken, chatId, enabled } }),
@@ -2335,8 +2329,7 @@
     document.querySelector('.sessions-panel').classList.add('mobile-active');
   }
 
-  state.token = getToken();
-  connect();
+  checkAuth().then((ok) => (ok ? connect() : showTokenForm()));
 })();
 </script>
 </body>

package/dist/hub/server.js

@@ -521,6 +521,7 @@ ${previewHtml}${truncNote}`;
   }
   async handleCallbackQuery(query) {
     if (!query.data) return;
+    if (String(query.message?.chat.id) !== String(this.config.chatId)) return;
     if (query.data.startsWith("sess:")) {
       await this.handleSessionSelectCallback(query);
       return;
@@ -760,8 +761,66 @@ function logStartup(context) {
 `);
 }
 
+// src/hub/auth.ts
+import crypto from "crypto";
+var SESSION_COOKIE = "ca_session";
+var COOKIE_MAX_AGE = 30 * 24 * 60 * 60;
+function safeEqual(a, b) {
+  if (typeof a !== "string") return false;
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function dashboardCookieValue(token) {
+  return crypto.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
+}
+function parseCookies(header) {
+  const out = {};
+  for (const part of (header ?? "").split(";")) {
+    const i = part.indexOf("=");
+    if (i <= 0) continue;
+    const raw = part.slice(i + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out[part.slice(0, i).trim()] = value;
+  }
+  return out;
+}
+function sessionCookieHeader(token, secure) {
+  return `${SESSION_COOKIE}=${dashboardCookieValue(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
+function isAuthorized(req, token, allowQueryToken) {
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ") && safeEqual(auth.slice(7), token)) return true;
+  if (safeEqual(parseCookies(req.headers.cookie)[SESSION_COOKIE], dashboardCookieValue(token))) return true;
+  if (allowQueryToken) {
+    const q = new URL(req.url ?? "/", "http://hub").searchParams.get("token");
+    if (safeEqual(q, token)) return true;
+  }
+  return false;
+}
+function isCrossOrigin(req) {
+  const origin = req.headers.origin;
+  if (!origin) return false;
+  try {
+    return new URL(origin).host !== req.headers.host;
+  } catch {
+    return true;
+  }
+}
+function isJsonRequest(req) {
+  return String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json");
+}
+function isSecureRequest(req) {
+  return req.headers["x-forwarded-proto"] === "https";
+}
+
 // src/hub/server.ts
 var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+var MAX_WS_PAYLOAD = 16 * 1024 * 1024;
 var HubServer = class {
   httpServer;
   wssChannel;
@@ -779,6 +838,7 @@ var HubServer = class {
   heartbeatInterval;
   channelAlive = /* @__PURE__ */ new Map();
   // sessionId -> alive flag
+  socketOwners = /* @__PURE__ */ new WeakMap();
   host;
   port;
   token;
@@ -801,22 +861,23 @@ var HubServer = class {
       this.initTelegram(fullConfig.telegram);
     }
     this.httpServer = http.createServer((req, res) => this.handleHttp(req, res));
-    this.wssChannel = new WebSocketServer({ noServer: true });
+    this.wssChannel = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
     this.wssChannel.on("connection", (ws, req) => this.handleChannelConnection(ws, req));
     this.wssChannel.on("error", (err) => logger.warn(`Channel WebSocket server error: ${err.message}`));
-    this.wssDashboard = new WebSocketServer({ noServer: true });
+    this.wssDashboard = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
     this.wssDashboard.on("connection", (ws) => this.handleDashboardConnection(ws));
     this.wssDashboard.on("error", (err) => logger.warn(`Dashboard WebSocket server error: ${err.message}`));
     this.httpServer.on("upgrade", (req, socket, head) => {
       socket.on("error", (err) => logger.debug(`Upgrade socket error: ${err.message}`));
-      const url = new URL(req.url, `http://${req.headers.host}`);
+      const url = new URL(req.url ?? "/", "http://hub");
       const pathname = url.pathname;
-      if (this.token && !this.isLocalRequest(req)) {
-        const wsToken = url.searchParams.get("token");
-        if (wsToken !== this.token) {
-          socket.destroy();
-          return;
-        }
+      if (isCrossOrigin(req)) {
+        this.rejectUpgrade(socket, 403, "Forbidden", pathname, req);
+        return;
+      }
+      if (!this.authorized(req, true)) {
+        this.rejectUpgrade(socket, 401, "Unauthorized", pathname, req);
+        return;
       }
       if (pathname === WS_PATH_CHANNEL) {
         this.wssChannel.handleUpgrade(req, socket, head, (ws) => {
@@ -868,31 +929,28 @@ var HubServer = class {
   }
   // --- HTTP Handler ---
   handleHttp(req, res) {
-    const url = new URL(req.url, `http://${req.headers.host}`);
-    const origin = req.headers.origin;
-    if (origin && (origin.includes("127.0.0.1") || origin.includes("localhost"))) {
-      res.setHeader("Access-Control-Allow-Origin", origin);
-    }
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-    if (req.method === "OPTIONS") {
-      res.writeHead(204);
-      res.end();
+    const url = new URL(req.url ?? "/", "http://hub");
+    if (isCrossOrigin(req)) {
+      this.jsonResponse(res, 403, { error: "Cross-origin request rejected" });
       return;
     }
-    if (url.pathname !== "/" && this.token) {
-      if (!this.isLocalRequest(req)) {
-        const authHeader = req.headers["authorization"];
-        const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-        if (bearerToken !== this.token) {
-          this.jsonResponse(res, 401, { error: "Unauthorized" });
-          return;
-        }
-      }
+    if (req.method === "POST" && !isJsonRequest(req)) {
+      this.jsonResponse(res, 415, { error: "Content-Type must be application/json" });
+      return;
     }
     if (url.pathname === "/" && req.method === "GET") {
-      this.serveDashboard(res);
-    } else if (url.pathname === "/api/sessions" && req.method === "GET") {
+      this.serveDashboard(req, res, url);
+      return;
+    }
+    if (url.pathname === "/api/login" && req.method === "POST") {
+      this.handleLogin(req, res);
+      return;
+    }
+    if (!this.authorized(req, false)) {
+      this.jsonResponse(res, 401, { error: "Unauthorized" });
+      return;
+    }
+    if (url.pathname === "/api/sessions" && req.method === "GET") {
       this.jsonResponse(res, 200, { sessions: this.sessions.getAll() });
     } else if (url.pathname === "/api/status" && req.method === "GET") {
       this.jsonResponse(res, 200, {
@@ -943,7 +1001,13 @@ var HubServer = class {
       this.jsonResponse(res, 404, { error: "Not found" });
     }
   }
-  serveDashboard(res) {
+  serveDashboard(req, res, url) {
+    const linkToken = url.searchParams.get("token");
+    if (linkToken !== null && this.token && safeEqual(linkToken, this.token)) {
+      res.writeHead(302, { Location: "/", "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+      res.end();
+      return;
+    }
     const candidates = [
       path4.join(__dirname, "..", "dashboard", "index.html"),
       // from dist/hub/
@@ -970,6 +1034,20 @@ var HubServer = class {
     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
     res.end("<html><body><h1>claude-alarm</h1><p>Dashboard HTML not found. Reinstall the package.</p></body></html>");
   }
+  async handleLogin(req, res) {
+    const body = await this.readBody(req);
+    if (!this.token) {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    if (typeof body?.token !== "string" || !safeEqual(body.token, this.token)) {
+      this.jsonResponse(res, 401, { error: "Unauthorized" });
+      return;
+    }
+    res.writeHead(204, { "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+    res.end();
+  }
   async handleApiSend(req, res) {
     const body = await this.readBody(req);
     if (!body) {
@@ -1046,6 +1124,22 @@ var HubServer = class {
     });
   }
   handleChannelMessage(ws, isLocal, msg) {
+    if (msg.type === "register") {
+      const id = msg.session.id;
+      const owned = this.socketOwners.get(ws);
+      if (owned && owned !== id) {
+        logger.warn(`Rejected register for ${id}: connection already owns ${owned}`);
+        return;
+      }
+      const holder = this.channelSockets.get(id);
+      if (holder && holder !== ws) {
+        this.socketOwners.delete(holder);
+        holder.terminate();
+      }
+      this.socketOwners.set(ws, id);
+    } else if ("sessionId" in msg && this.socketOwners.get(ws) !== msg.sessionId) {
+      return;
+    }
     switch (msg.type) {
       case "register": {
         const session = msg.session;
@@ -1069,7 +1163,6 @@ var HubServer = class {
         break;
       }
       case "peer_name": {
-        if (this.channelSockets.get(msg.sessionId) !== ws) break;
         const updated = this.sessions.setPeerName(msg.sessionId, msg.peerName);
         if (updated) {
           logger.info(`Peer name for ${msg.sessionId}: ${msg.peerName ?? "-"}`);
@@ -1397,6 +1490,18 @@ var HubServer = class {
     res.writeHead(status, { "Content-Type": "application/json" });
     res.end(JSON.stringify(body));
   }
+  authorized(req, allowQueryToken) {
+    return !this.token || isAuthorized(req, this.token, allowQueryToken);
+  }
+  rejectUpgrade(socket, status, text, pathname, req) {
+    logger.warn(`Rejected ${pathname} upgrade (${status}) from ${req.socket.remoteAddress}`);
+    socket.write(`HTTP/1.1 ${status} ${text}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+    socket.destroy();
+  }
   isLocalRequest(req) {
     const addr = req.socket.remoteAddress;
     return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";