@delt/claude-alarm 0.9.0 → 0.9.1

package/dist/index.js

@@ -521,6 +521,7 @@ ${previewHtml}${truncNote}`;
   }
   async handleCallbackQuery(query) {
     if (!query.data) return;
+    if (String(query.message?.chat.id) !== String(this.config.chatId)) return;
     if (query.data.startsWith("sess:")) {
       await this.handleSessionSelectCallback(query);
       return;
@@ -784,8 +785,66 @@ function logStartup(context) {
 `);
 }
 
+// src/hub/auth.ts
+import crypto from "crypto";
+var SESSION_COOKIE = "ca_session";
+var COOKIE_MAX_AGE = 30 * 24 * 60 * 60;
+function safeEqual(a, b) {
+  if (typeof a !== "string") return false;
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function dashboardCookieValue(token) {
+  return crypto.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
+}
+function parseCookies(header) {
+  const out = {};
+  for (const part of (header ?? "").split(";")) {
+    const i = part.indexOf("=");
+    if (i <= 0) continue;
+    const raw = part.slice(i + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out[part.slice(0, i).trim()] = value;
+  }
+  return out;
+}
+function sessionCookieHeader(token, secure) {
+  return `${SESSION_COOKIE}=${dashboardCookieValue(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
+function isAuthorized(req, token, allowQueryToken) {
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ") && safeEqual(auth.slice(7), token)) return true;
+  if (safeEqual(parseCookies(req.headers.cookie)[SESSION_COOKIE], dashboardCookieValue(token))) return true;
+  if (allowQueryToken) {
+    const q = new URL(req.url ?? "/", "http://hub").searchParams.get("token");
+    if (safeEqual(q, token)) return true;
+  }
+  return false;
+}
+function isCrossOrigin(req) {
+  const origin = req.headers.origin;
+  if (!origin) return false;
+  try {
+    return new URL(origin).host !== req.headers.host;
+  } catch {
+    return true;
+  }
+}
+function isJsonRequest(req) {
+  return String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json");
+}
+function isSecureRequest(req) {
+  return req.headers["x-forwarded-proto"] === "https";
+}
+
 // src/hub/server.ts
 var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+var MAX_WS_PAYLOAD = 16 * 1024 * 1024;
 var HubServer = class {
   httpServer;
   wssChannel;
@@ -803,6 +862,7 @@ var HubServer = class {
   heartbeatInterval;
   channelAlive = /* @__PURE__ */ new Map();
   // sessionId -> alive flag
+  socketOwners = /* @__PURE__ */ new WeakMap();
   host;
   port;
   token;
@@ -825,22 +885,23 @@ var HubServer = class {
       this.initTelegram(fullConfig.telegram);
     }
     this.httpServer = http.createServer((req, res) => this.handleHttp(req, res));
-    this.wssChannel = new WebSocketServer({ noServer: true });
+    this.wssChannel = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
     this.wssChannel.on("connection", (ws, req) => this.handleChannelConnection(ws, req));
     this.wssChannel.on("error", (err) => logger.warn(`Channel WebSocket server error: ${err.message}`));
-    this.wssDashboard = new WebSocketServer({ noServer: true });
+    this.wssDashboard = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
     this.wssDashboard.on("connection", (ws) => this.handleDashboardConnection(ws));
     this.wssDashboard.on("error", (err) => logger.warn(`Dashboard WebSocket server error: ${err.message}`));
     this.httpServer.on("upgrade", (req, socket, head) => {
       socket.on("error", (err) => logger.debug(`Upgrade socket error: ${err.message}`));
-      const url = new URL(req.url, `http://${req.headers.host}`);
+      const url = new URL(req.url ?? "/", "http://hub");
       const pathname = url.pathname;
-      if (this.token && !this.isLocalRequest(req)) {
-        const wsToken = url.searchParams.get("token");
-        if (wsToken !== this.token) {
-          socket.destroy();
-          return;
-        }
+      if (isCrossOrigin(req)) {
+        this.rejectUpgrade(socket, 403, "Forbidden", pathname, req);
+        return;
+      }
+      if (!this.authorized(req, true)) {
+        this.rejectUpgrade(socket, 401, "Unauthorized", pathname, req);
+        return;
       }
       if (pathname === WS_PATH_CHANNEL) {
         this.wssChannel.handleUpgrade(req, socket, head, (ws) => {
@@ -892,31 +953,28 @@ var HubServer = class {
   }
   // --- HTTP Handler ---
   handleHttp(req, res) {
-    const url = new URL(req.url, `http://${req.headers.host}`);
-    const origin = req.headers.origin;
-    if (origin && (origin.includes("127.0.0.1") || origin.includes("localhost"))) {
-      res.setHeader("Access-Control-Allow-Origin", origin);
-    }
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-    if (req.method === "OPTIONS") {
-      res.writeHead(204);
-      res.end();
+    const url = new URL(req.url ?? "/", "http://hub");
+    if (isCrossOrigin(req)) {
+      this.jsonResponse(res, 403, { error: "Cross-origin request rejected" });
       return;
     }
-    if (url.pathname !== "/" && this.token) {
-      if (!this.isLocalRequest(req)) {
-        const authHeader = req.headers["authorization"];
-        const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-        if (bearerToken !== this.token) {
-          this.jsonResponse(res, 401, { error: "Unauthorized" });
-          return;
-        }
-      }
+    if (req.method === "POST" && !isJsonRequest(req)) {
+      this.jsonResponse(res, 415, { error: "Content-Type must be application/json" });
+      return;
     }
     if (url.pathname === "/" && req.method === "GET") {
-      this.serveDashboard(res);
-    } else if (url.pathname === "/api/sessions" && req.method === "GET") {
+      this.serveDashboard(req, res, url);
+      return;
+    }
+    if (url.pathname === "/api/login" && req.method === "POST") {
+      this.handleLogin(req, res);
+      return;
+    }
+    if (!this.authorized(req, false)) {
+      this.jsonResponse(res, 401, { error: "Unauthorized" });
+      return;
+    }
+    if (url.pathname === "/api/sessions" && req.method === "GET") {
       this.jsonResponse(res, 200, { sessions: this.sessions.getAll() });
     } else if (url.pathname === "/api/status" && req.method === "GET") {
       this.jsonResponse(res, 200, {
@@ -967,7 +1025,13 @@ var HubServer = class {
       this.jsonResponse(res, 404, { error: "Not found" });
     }
   }
-  serveDashboard(res) {
+  serveDashboard(req, res, url) {
+    const linkToken = url.searchParams.get("token");
+    if (linkToken !== null && this.token && safeEqual(linkToken, this.token)) {
+      res.writeHead(302, { Location: "/", "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+      res.end();
+      return;
+    }
     const candidates = [
       path4.join(__dirname, "..", "dashboard", "index.html"),
       // from dist/hub/
@@ -994,6 +1058,20 @@ var HubServer = class {
     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
     res.end("<html><body><h1>claude-alarm</h1><p>Dashboard HTML not found. Reinstall the package.</p></body></html>");
   }
+  async handleLogin(req, res) {
+    const body = await this.readBody(req);
+    if (!this.token) {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    if (typeof body?.token !== "string" || !safeEqual(body.token, this.token)) {
+      this.jsonResponse(res, 401, { error: "Unauthorized" });
+      return;
+    }
+    res.writeHead(204, { "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+    res.end();
+  }
   async handleApiSend(req, res) {
     const body = await this.readBody(req);
     if (!body) {
@@ -1070,6 +1148,22 @@ var HubServer = class {
     });
   }
   handleChannelMessage(ws, isLocal, msg) {
+    if (msg.type === "register") {
+      const id = msg.session.id;
+      const owned = this.socketOwners.get(ws);
+      if (owned && owned !== id) {
+        logger.warn(`Rejected register for ${id}: connection already owns ${owned}`);
+        return;
+      }
+      const holder = this.channelSockets.get(id);
+      if (holder && holder !== ws) {
+        this.socketOwners.delete(holder);
+        holder.terminate();
+      }
+      this.socketOwners.set(ws, id);
+    } else if ("sessionId" in msg && this.socketOwners.get(ws) !== msg.sessionId) {
+      return;
+    }
     switch (msg.type) {
       case "register": {
         const session = msg.session;
@@ -1093,7 +1187,6 @@ var HubServer = class {
         break;
       }
       case "peer_name": {
-        if (this.channelSockets.get(msg.sessionId) !== ws) break;
         const updated = this.sessions.setPeerName(msg.sessionId, msg.peerName);
         if (updated) {
           logger.info(`Peer name for ${msg.sessionId}: ${msg.peerName ?? "-"}`);
@@ -1421,6 +1514,18 @@ var HubServer = class {
     res.writeHead(status, { "Content-Type": "application/json" });
     res.end(JSON.stringify(body));
   }
+  authorized(req, allowQueryToken) {
+    return !this.token || isAuthorized(req, this.token, allowQueryToken);
+  }
+  rejectUpgrade(socket, status, text, pathname, req) {
+    logger.warn(`Rejected ${pathname} upgrade (${status}) from ${req.socket.remoteAddress}`);
+    socket.write(`HTTP/1.1 ${status} ${text}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+    socket.destroy();
+  }
   isLocalRequest(req) {
     const addr = req.socket.remoteAddress;
     return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";