@dutodev/cli 0.4.6 → 0.5.0

package/dist/index.js

@@ -33,7 +33,7 @@ var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
 
 // src/index.ts
 import { hostname } from "os";
-import { join as join5, relative } from "path";
+import { join as join6, relative } from "path";
 import cac from "cac";
 
 // src/api.ts
@@ -224,10 +224,142 @@ async function ensureCloudflaredWithProgress(write, opts = {}) {
   }
 }
 
-// src/session/config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+// src/session/allowlist.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { BlockList, isIP } from "net";
 import { dirname, join as join3 } from "path";
-import { isMap, isScalar, LineCounter, parseDocument } from "yaml";
+
+// src/session/allowlist-snapshot.ts
+var ALLOW_SNAPSHOT = {
+  stripe: [
+    "3.18.12.63/32",
+    "3.69.109.8/32",
+    "3.120.168.93/32",
+    "3.130.192.231/32",
+    "13.235.14.237/32",
+    "13.235.122.149/32",
+    "18.211.135.69/32",
+    "35.154.171.200/32",
+    "35.157.207.129/32",
+    "52.15.183.38/32",
+    "54.88.130.119/32",
+    "54.88.130.237/32",
+    "54.187.174.169/32",
+    "54.187.205.235/32",
+    "54.187.216.72/32"
+  ],
+  github: [
+    "9.234.106.48/28",
+    "9.234.98.160/28",
+    "9.234.98.176/28",
+    "192.30.252.0/22",
+    "185.199.108.0/22",
+    "140.82.112.0/20",
+    "143.55.64.0/20",
+    "2a0a:a440::/29",
+    "2606:50c0::/32"
+  ]
+};
+
+// src/session/allowlist.ts
+var ALLOW_NAMES = ["stripe", "github"];
+var CACHE_MS = 24 * 36e5;
+var FETCH_TIMEOUT_MS = 3e3;
+var SOURCES = {
+  stripe: { url: "https://stripe.com/files/ips/ips_webhooks.json", pick: (j) => j?.WEBHOOKS },
+  github: { url: "https://api.github.com/meta", pick: (j) => j?.hooks }
+};
+function splitCidr(raw) {
+  const [ip, p, ...resto] = raw.split("/");
+  if (!ip || resto.length) return null;
+  const v = isIP(ip);
+  if (!v) return null;
+  const max = v === 4 ? 32 : 128;
+  if (p === void 0) return { ip, family: v, prefix: max };
+  if (!/^\d{1,3}$/.test(p)) return null;
+  const prefix = Number(p);
+  return prefix <= max ? { ip, family: v, prefix } : null;
+}
+function parseAllowEntry(raw) {
+  if (ALLOW_NAMES.includes(raw)) return { kind: "name", name: raw };
+  const c = splitCidr(raw);
+  if (!c) return null;
+  return { kind: "cidr", cidr: raw.includes("/") ? raw : `${raw}/${c.prefix}` };
+}
+function blockListOf(cidrs) {
+  const bl = new BlockList();
+  for (const cidr of cidrs) {
+    const c = splitCidr(cidr);
+    if (c) bl.addSubnet(c.ip, c.prefix, c.family === 4 ? "ipv4" : "ipv6");
+  }
+  return bl;
+}
+function readCache(file) {
+  try {
+    const c = JSON.parse(readFileSync2(file, "utf8"));
+    if (typeof c?.fetchedAt === "number" && c.lists && typeof c.lists === "object") return c;
+  } catch {
+  }
+  return null;
+}
+async function fetchRanges(name, f) {
+  const src = SOURCES[name];
+  const res = await f(src.url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), headers: { accept: "application/json" } });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const list = src.pick(await res.json());
+  if (!Array.isArray(list)) throw new Error("formato inesperado");
+  const out = list.filter((x) => typeof x === "string" && splitCidr(x) !== null);
+  if (!out.length) throw new Error("lista vazia");
+  return out.map((x) => x.includes("/") ? x : `${x}/${splitCidr(x).prefix}`);
+}
+async function resolveAllow(entries, o = {}) {
+  const cacheFile = o.cacheFile ?? join3(dutoHome(), "allowlist.json");
+  const f = o.fetch ?? fetch;
+  const now = (o.now ?? Date.now)();
+  const parsed = entries.map((raw) => ({ raw, e: parseAllowEntry(raw) }));
+  const names = [...new Set(parsed.flatMap((p) => p.e?.kind === "name" ? [p.e.name] : []))];
+  const cached = readCache(cacheFile);
+  const fresh = cached && now - cached.fetchedAt >= 0 && now - cached.fetchedAt < CACHE_MS ? cached : null;
+  const lists = {};
+  if (fresh && names.every((n) => Array.isArray(fresh.lists[n]) && fresh.lists[n].length)) {
+    for (const n of names) lists[n] = fresh.lists[n];
+  } else {
+    const net = {};
+    for (const name of names) {
+      try {
+        net[name] = lists[name] = await fetchRanges(name, f);
+      } catch {
+        lists[name] = ALLOW_SNAPSHOT[name];
+      }
+    }
+    if (names.length && Object.keys(net).length === names.length) {
+      try {
+        mkdirSync3(dirname(cacheFile), { recursive: true });
+        writeFileSync3(cacheFile, JSON.stringify({ fetchedAt: now, lists: net }));
+      } catch {
+      }
+    }
+  }
+  const blocks = parsed.flatMap(({ raw, e }) => {
+    if (!e) return [];
+    return [{ reason: e.kind === "name" ? e.name : raw, bl: blockListOf(e.kind === "name" ? lists[e.name] : [e.cidr]) }];
+  });
+  return {
+    match(ip) {
+      if (!ip) return null;
+      const plain = ip.replace(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i, "$1");
+      const v = isIP(plain);
+      if (!v) return null;
+      const fam = v === 4 ? "ipv4" : "ipv6";
+      return blocks.find((b) => b.bl.check(plain, fam))?.reason ?? null;
+    }
+  };
+}
+
+// src/session/config.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
+import { isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
 var ConfigError = class extends Error {
   constructor(message2, line, file = CONFIG_FILES[0]) {
     super(!file ? message2 : line ? `${file}, linha ${line}: ${message2}` : `${file}: ${message2}`);
@@ -240,16 +372,26 @@ var CONFIG_FILES = ["duto.yml", "duto.yaml"];
 var LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
 var HOST_RE = new RegExp(`^${LABEL}(?:\\.${LABEL})*(?::\\d{1,5})?$`);
 var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects"];
+var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "auth", "permitir"];
+var ENV_REF_RE = /\$\{([A-Z_0-9]+)\}/g;
 function parseHost(raw) {
   const host = raw.trim().toLowerCase();
   return HOST_RE.test(host) ? host : null;
 }
+function parseCredential(raw) {
+  const i = raw.indexOf(":");
+  if (i < 0) return { ok: false, reason: "format" };
+  const user = raw.slice(0, i);
+  const password = raw.slice(i + 1);
+  if (user.length < 1 || user.length > 128 || /\s/.test(user)) return { ok: false, reason: "user" };
+  if (password.length < 8 || password.length > 128) return { ok: false, reason: "password" };
+  return { ok: true, cred: { user, password } };
+}
 function portOf(value) {
   const v = isMap(value) ? value.get("port") : isScalar(value) ? value.value : value;
   return typeof v === "number" && Number.isInteger(v) && v >= 1 && v <= 65535 ? v : null;
 }
-function parseConfig(text, file = CONFIG_FILES[0]) {
+function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
   const fail3 = (message2, line) => new ConfigError(message2, line, file);
   const lc = new LineCounter();
   const doc = parseDocument(text, { lineCounter: lc, prettyErrors: false });
@@ -281,7 +423,7 @@ function parseConfig(text, file = CONFIG_FILES[0]) {
       const body = pair.value;
       for (const item of body.items) {
         const key = isScalar(item.key) ? String(item.key.value) : "";
-        if (!TUNNEL_KEYS.includes(key)) throw fail3(`chave desconhecida em "${raw}": ${key} (use port, host, headers ou rewrite_redirects)`, line);
+        if (!TUNNEL_KEYS.includes(key)) throw fail3(`chave desconhecida em "${raw}": ${key} (use port, host, headers, rewrite_redirects, auth ou permitir)`, line);
       }
       const hostNode = body.get("host", true);
       if (hostNode !== void 0) {
@@ -315,6 +457,44 @@ function parseConfig(text, file = CONFIG_FILES[0]) {
         if (!spec.host) throw fail3(`rewrite_redirects de "${raw}" s\xF3 vale junto com host:`, line);
         if (value === false) spec.rewriteRedirects = false;
       }
+      const authNode = body.get("auth", true);
+      if (authNode !== void 0) {
+        if (!isSeq(authNode)) throw fail3(`auth de "${raw}" deve ser uma lista de usuario:senha`, line);
+        const auth = [];
+        for (const item of authNode.items) {
+          const iLine = lineAt(item.range?.[0]) ?? line;
+          const text2 = isScalar(item) && typeof item.value === "string" ? item.value : null;
+          if (text2 === null) throw fail3(`credencial inv\xE1lida em "${raw}": use usuario:senha`, iLine);
+          const expanded = text2.replace(ENV_REF_RE, (_m, name2) => {
+            const val = env[name2];
+            if (val === void 0) throw fail3(`vari\xE1vel de ambiente ${name2} n\xE3o definida (usada em auth de "${raw}")`, iLine);
+            return val;
+          });
+          const parsed = parseCredential(expanded);
+          if (!parsed.ok) {
+            if (parsed.reason === "format") throw fail3(`credencial inv\xE1lida em "${raw}": use usuario:senha`, iLine);
+            if (parsed.reason === "user") throw fail3(`usu\xE1rio inv\xE1lido em "${raw}": de 1 a 128 caracteres, sem espa\xE7o`, iLine);
+            throw fail3(`senha de "${expanded.slice(0, expanded.indexOf(":"))}" em "${raw}" precisa ter de 8 a 128 caracteres`, iLine);
+          }
+          if (auth.some((c) => c.user === parsed.cred.user)) throw fail3(`usu\xE1rio "${parsed.cred.user}" aparece duas vezes em "${raw}"`, iLine);
+          auth.push(parsed.cred);
+        }
+        if (!auth.length) throw fail3(`auth de "${raw}" n\xE3o pode ficar vazia`, line);
+        spec.auth = auth;
+      }
+      const allowNode = body.get("permitir", true);
+      if (allowNode !== void 0) {
+        if (!isSeq(allowNode)) throw fail3(`permitir de "${raw}" deve ser uma lista`, line);
+        if (!spec.auth) throw fail3(`permitir de "${raw}" s\xF3 vale junto com auth:`, line);
+        const allow = [];
+        for (const item of allowNode.items) {
+          const iLine = lineAt(item.range?.[0]) ?? line;
+          const value = isScalar(item) ? String(item.value) : "";
+          if (!parseAllowEntry(value)) throw fail3(`permitir de "${raw}": "${value}" n\xE3o \xE9 um nome conhecido (stripe, github) nem uma faixa de IP`, iLine);
+          allow.push(value);
+        }
+        if (allow.length) spec.allow = allow;
+      }
     }
     if (specs.some((s) => s.name === name)) throw fail3(`o nome "${raw}" aparece duas vezes`, line);
     specs.push(spec);
@@ -324,14 +504,14 @@ function parseConfig(text, file = CONFIG_FILES[0]) {
 function findConfig(cwd) {
   let dir = cwd;
   for (; ; ) {
-    const present = CONFIG_FILES.filter((f) => existsSync3(join3(dir, f)));
+    const present = CONFIG_FILES.filter((f) => existsSync3(join4(dir, f)));
     if (present.length > 1) throw new ConfigError(`${CONFIG_FILES.join(" e ")} na mesma pasta. Apague um dos dois.`, void 0, "");
     if (present.length === 1) {
-      const path = join3(dir, present[0]);
-      return { path, tunnels: parseConfig(readFileSync2(path, "utf8"), present[0]) };
+      const path = join4(dir, present[0]);
+      return { path, tunnels: parseConfig(readFileSync3(path, "utf8"), present[0]) };
     }
-    if (existsSync3(join3(dir, ".git"))) return null;
-    const up = dirname(dir);
+    if (existsSync3(join4(dir, ".git"))) return null;
+    const up = dirname2(dir);
     if (up === dir) return null;
     dir = up;
   }
@@ -359,6 +539,148 @@ async function isPortListening(port, timeoutMs = 500) {
   return results.some(Boolean);
 }
 
+// src/session/auth.ts
+import { createHash as createHash2, createHmac, randomBytes, timingSafeEqual } from "crypto";
+var TUNNEL_COOKIE = "__Host-duto_tunel";
+var QR_TTL_MS = 5 * 6e4;
+var sha = (s) => createHash2("sha256").update(s).digest();
+var same = (a, b) => timingSafeEqual(sha(a), sha(b));
+function splitPair(raw) {
+  const i = raw.indexOf(":");
+  return i < 0 ? null : { user: raw.slice(0, i), password: raw.slice(i + 1) };
+}
+function parseBasic(value) {
+  const m = /^basic +([A-Za-z0-9+/]+={0,2})$/i.exec(value?.trim() ?? "");
+  return m ? splitPair(Buffer.from(m[1], "base64").toString("utf8")) : null;
+}
+var first = (v) => Array.isArray(v) ? v[0] : v;
+var bareHost = (s) => s.replace(/:\d+$/, "").toLowerCase();
+function sameHostOrigin(h) {
+  if (first(h["sec-fetch-site"])?.toLowerCase() === "same-site") return false;
+  const origin = first(h.origin);
+  if (origin === void 0) return true;
+  let host;
+  try {
+    host = new URL(origin).host;
+  } catch {
+    return false;
+  }
+  return host !== "" && bareHost(host) === bareHost(h.host ?? "");
+}
+var TunnelAuth = class {
+  qrUser;
+  tunnel;
+  credentials;
+  allow;
+  now;
+  secret;
+  qr = null;
+  constructor(o) {
+    this.tunnel = o.tunnel;
+    this.credentials = o.credentials;
+    this.allow = o.allow;
+    this.now = o.now ?? Date.now;
+    this.secret = o.secret ?? randomBytes(32);
+    this.qrUser = o.credentials[0]?.user ?? "";
+  }
+  access(h) {
+    if (this.allow) {
+      const ip = first(h["cf-connecting-ip"]);
+      const reason = this.allow.match(ip);
+      if (reason) return { kind: "allow", reason };
+    }
+    const cookieUser = this.cookieUser(h.cookie);
+    if (cookieUser && sameHostOrigin(h)) return { kind: "user", user: cookieUser };
+    const duto = first(h["x-duto-auth"]);
+    const cand = duto !== void 0 ? splitPair(duto) : parseBasic(first(h.authorization));
+    if (cand && this.checkPassword(cand.user, cand.password)) return { kind: "user", user: cand.user };
+    return { kind: "denied" };
+  }
+  checkPassword(user, password) {
+    let ok2 = false;
+    for (const c of this.credentials) {
+      const userOk = same(c.user, user);
+      const passOk = same(c.password, password);
+      if (userOk && passOk) ok2 = true;
+    }
+    return ok2;
+  }
+  loginCookie(user) {
+    return `${TUNNEL_COOKIE}=${this.cookieValue(user)}; Secure; HttpOnly; SameSite=Lax; Path=/`;
+  }
+  logoutCookie() {
+    return `${TUNNEL_COOKIE}=; Max-Age=0; Secure; HttpOnly; SameSite=Lax; Path=/`;
+  }
+  issueQrToken() {
+    this.qr = { token: randomBytes(24).toString("base64url"), expiresAt: this.now() + QR_TTL_MS };
+    return { ...this.qr };
+  }
+  consumeQrToken(token) {
+    const qr = this.qr;
+    if (!qr || !same(qr.token, token)) return false;
+    this.qr = null;
+    return this.now() <= qr.expiresAt;
+  }
+  strip(h) {
+    const out = { ...h };
+    delete out["x-duto-auth"];
+    const basic = parseBasic(first(h.authorization));
+    if (basic && this.checkPassword(basic.user, basic.password)) delete out.authorization;
+    if (h.cookie !== void 0) {
+      const parts = (Array.isArray(h.cookie) ? h.cookie.join("; ") : h.cookie).split(";").map((p) => p.trim()).filter(Boolean);
+      const kept = parts.filter((p) => !p.startsWith(`${TUNNEL_COOKIE}=`));
+      if (kept.length === parts.length) return out;
+      if (kept.length) out.cookie = kept.join("; ");
+      else delete out.cookie;
+    }
+    return out;
+  }
+  // Valor: usuário em base64url + "." + HMAC(túnel, usuário).
+  cookieValue(user) {
+    return `${Buffer.from(user).toString("base64url")}.${this.sign(user)}`;
+  }
+  sign(user) {
+    return createHmac("sha256", this.secret).update(`${this.tunnel}\0${user}`).digest("base64url");
+  }
+  cookieUser(header) {
+    if (header === void 0) return null;
+    const list = (Array.isArray(header) ? header.join("; ") : header).split(";");
+    for (const p of list) {
+      const item = p.trim();
+      if (!item.startsWith(`${TUNNEL_COOKIE}=`)) continue;
+      const [b64, sig, ...resto] = item.slice(TUNNEL_COOKIE.length + 1).split(".");
+      if (!b64 || !sig || resto.length) continue;
+      const user = Buffer.from(b64, "base64url").toString("utf8");
+      if (same(sig, this.sign(user)) && this.credentials.some((c) => c.user === user)) return user;
+    }
+    return null;
+  }
+};
+function isPreflight(method, h) {
+  if (method?.toUpperCase() !== "OPTIONS") return false;
+  if (h.origin === void 0 || h["access-control-request-method"] === void 0) return false;
+  if (h["transfer-encoding"] !== void 0) return false;
+  const len = h["content-length"];
+  return len === void 0 || Number(len) === 0;
+}
+function preflightHeaders(res) {
+  const out = {};
+  for (const [k, v] of Object.entries(res)) if (k.startsWith("access-control-") || k === "vary") out[k] = v;
+  return allowDutoHeader(out);
+}
+function allowDutoHeader(res) {
+  if (res["access-control-allow-origin"] === void 0) return res;
+  const raw = res["access-control-allow-headers"];
+  const cur = (Array.isArray(raw) ? raw.join(", ") : raw ?? "").trim();
+  const tokens = cur.split(",").map((t) => t.trim().toLowerCase());
+  if (tokens.includes("*") || tokens.includes("x-duto-auth")) return res;
+  return { ...res, "access-control-allow-headers": cur ? `${cur}, x-duto-auth` : "x-duto-auth" };
+}
+function cors401(origin) {
+  if (!origin) return {};
+  return { "access-control-allow-origin": origin, vary: "Origin", "access-control-expose-headers": "WWW-Authenticate" };
+}
+
 // src/session/proxy.ts
 import { Agent, createServer, request } from "http";
 import { connect as connect2 } from "net";
@@ -386,16 +708,14 @@ var WAIT_SCRIPT = `
   es.onerror = function () { if (++fails >= 3) { es.close(); poll(); } };
 })();
 </script>`;
-function unavailablePage(o) {
-  const tunnel2 = esc(o.tunnel);
-  const local = `localhost:${o.port}`;
+function pageShell(title, body, css = "") {
   return `<!doctype html>
 <html lang="pt-BR">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="robots" content="noindex">
-<title>Nada respondendo em ${local} \xB7 duto</title>
+<title>${title}</title>
 <style>
 :root{--bg:#f6f6f3;--fg:#0f1110;--muted:#5f6360;--line:#dcddd8;--card:#fff;--signal:#2dd4bf;--signal-text:#0f766e}
 @media (prefers-color-scheme:dark){:root{--bg:#0b0d0c;--fg:#e9ebe7;--muted:#8a8f8b;--line:#222624;--card:#111413;--signal-text:#2dd4bf}}
@@ -410,19 +730,61 @@ code{font:13px ui-monospace,SFMono-Regular,Menlo,monospace;color:var(--fg)}
 h1 code{font-size:.86em;font-weight:600}
 .retry{margin-top:20px;padding-top:14px;border-top:1px solid var(--line);font-size:13px;color:var(--muted)}
 .retry b{color:var(--signal-text);font-weight:600}
-</style>
+${css}</style>
 </head>
 <body>
-<main>
+${body}
+</body>
+</html>
+`;
+}
+function unavailablePage(o) {
+  const tunnel2 = esc(o.tunnel);
+  const local = `localhost:${o.port}`;
+  return pageShell(
+    `Nada respondendo em ${local} \xB7 duto`,
+    `<main>
 <div class="mark"><span class="dot"></span>duto \xB7 ${tunnel2}</div>
 <h1>Nada respondendo em <code>${local}</code></h1>
 <p>O t\xFAnel <code>${tunnel2}</code> est\xE1 no ar, mas o servi\xE7o local n\xE3o respondeu. Suba o servidor na m\xE1quina que abriu o t\xFAnel.</p>
 <p>Se voc\xEA s\xF3 recebeu este link, avise quem o enviou.</p>
 <div class="retry">${o.retry ? `<b>Aguardando o servi\xE7o.</b> A p\xE1gina volta sozinha quando ele responder.<noscript> Recarregue quando o servi\xE7o estiver no ar.</noscript>` : "Recarregue a p\xE1gina quando o servi\xE7o estiver no ar."}</div>
-</main>${o.retry ? WAIT_SCRIPT : ""}
-</body>
-</html>
+</main>${o.retry ? WAIT_SCRIPT : ""}`
+  );
+}
+
+// src/session/authPage.ts
+var CSS = `label{display:block;margin:14px 0 6px;font-size:13px;font-weight:600}
+input{width:100%;padding:9px 10px;border:1px solid var(--line);border-radius:.3rem;background:var(--bg);color:var(--fg);font:inherit}
+input:focus{outline:2px solid var(--signal);outline-offset:1px}
+button{margin-top:18px;width:100%;padding:10px;border:0;border-radius:.3rem;background:var(--fg);color:var(--bg);font:inherit;font-weight:600;cursor:pointer}
+.error{margin:14px 0 0;color:#b42318;font-weight:600}
+@media (prefers-color-scheme:dark){.error{color:#f97066}}
 `;
+function safeVolta(raw) {
+  if (!raw || !raw.startsWith("/") || raw.startsWith("//") || raw.startsWith("/\\")) return "/";
+  return /^[\x21-\x7e]+$/.test(raw) ? raw : "/";
+}
+function loginPage(o) {
+  return pageShell(
+    "Entrar \xB7 duto",
+    `<main>
+<div class="mark"><span class="dot"></span>duto \xB7 ${esc(o.tunnel)}</div>
+<h1>Este t\xFAnel tem senha</h1>
+<p>Pe\xE7a o acesso a quem enviou o link.</p>
+<form method="post" action="/__duto/entrar">
+<input type="hidden" name="volta" value="${esc(o.volta)}">
+<label for="usuario">Usu\xE1rio</label>
+<input id="usuario" name="usuario" autocomplete="username" autocapitalize="none" spellcheck="false" required autofocus>
+<label for="senha">Senha</label>
+<input id="senha" name="senha" type="password" autocomplete="current-password" required>
+${o.error ? `<p class="error" role="alert">Usu\xE1rio ou senha incorretos.</p>
+` : ""}<button type="submit">Entrar</button>
+</form>
+<div class="retry">Voc\xEA continua conectado at\xE9 o t\xFAnel fechar.</div>
+</main>`,
+    CSS
+  );
 }
 
 // src/session/proxy.ts
@@ -506,6 +868,83 @@ function hostOf(req) {
 var DUTO_PREFIX = "/__duto/";
 var WAIT_PATH = "/__duto/espera";
 var WAIT_MAX_MS = 10 * 6e4;
+var LOGIN_PATH = "/__duto/entrar";
+var LOGOUT_PATH = "/__duto/sair";
+var QR_PREFIX = "/__duto/qr/";
+var MAX_FORM = 8 * 1024;
+var DENIED_TEXT = "Este t\xFAnel tem senha. Envie Authorization: Basic ou X-Duto-Auth: usuario:senha.";
+var WS_DENIED = 'HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm="duto"\r\nContent-Length: 0\r\nConnection: close\r\n\r\n';
+function readForm(req, max) {
+  return new Promise((resolve) => {
+    const chunks = [];
+    let size = 0;
+    const onData = (c) => {
+      size += c.length;
+      if (size > max) {
+        req.off("data", onData);
+        req.pause();
+        return resolve(null);
+      }
+      chunks.push(c);
+    };
+    req.on("data", onData);
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", () => resolve(null));
+    req.resume();
+  });
+}
+async function authRoute(req, res, route, auth) {
+  const url = new URL(req.url ?? "/", "http://duto");
+  const page = (status, volta, error) => {
+    res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+    res.end(loginPage({ tunnel: route.tunnel, volta, error }));
+  };
+  const go = (location, cookie) => {
+    res.writeHead(303, { location, "cache-control": "no-store", ...cookie && { "set-cookie": cookie } });
+    res.end();
+  };
+  const { pathname } = url;
+  if (pathname === LOGIN_PATH && req.method === "GET") {
+    page(200, safeVolta(url.searchParams.get("volta")), false);
+    return true;
+  }
+  if (pathname === LOGIN_PATH && req.method === "POST") {
+    const raw = await readForm(req, MAX_FORM);
+    if (raw === null) {
+      res.writeHead(413, { "content-type": "text/plain; charset=utf-8", connection: "close" });
+      res.end("Formul\xE1rio grande demais");
+      return true;
+    }
+    const form = new URLSearchParams(raw);
+    const user = form.get("usuario") ?? "";
+    const volta = safeVolta(form.get("volta"));
+    if (auth.checkPassword(user, form.get("senha") ?? "")) go(volta, auth.loginCookie(user));
+    else page(401, volta, true);
+    return true;
+  }
+  if (pathname === LOGOUT_PATH && req.method === "GET") {
+    go(LOGIN_PATH, auth.logoutCookie());
+    return true;
+  }
+  if (pathname.startsWith(QR_PREFIX) && req.method === "GET") {
+    if (auth.consumeQrToken(pathname.slice(QR_PREFIX.length))) go("/", auth.loginCookie(auth.qrUser));
+    else go(LOGIN_PATH);
+    return true;
+  }
+  return false;
+}
+function deny(req, res, html) {
+  const status = html ? 303 : 401;
+  const out = html ? { location: `${LOGIN_PATH}?volta=${encodeURIComponent(req.url ?? "/")}`, "cache-control": "no-store" } : { "www-authenticate": 'Basic realm="duto"', "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", ...cors401(req.headers.origin) };
+  const body = html || req.method === "HEAD" ? "" : DENIED_TEXT;
+  res.writeHead(status, out);
+  res.end(body);
+  return { status, out, body };
+}
+function delivered(h, route) {
+  const out = rewrite(h, route);
+  return route.auth ? route.auth.strip(out) : out;
+}
 async function isUp(port) {
   return await probe("127.0.0.1", port) || await probe("::1", port);
 }
@@ -547,24 +986,9 @@ async function startProxy(o) {
       await new Promise((r) => setTimeout(r, 50));
     }
   }
-  const server = createServer(async (req, res) => {
-    req.pause();
-    const route = await routeFor(req);
-    if (!route) {
-      res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-      res.end("T\xFAnel n\xE3o encontrado nesta sess\xE3o");
-      return;
-    }
-    if ((req.url ?? "").startsWith(DUTO_PREFIX)) {
-      if (req.url === WAIT_PATH && req.method === "GET") return waitForService(res, route.port, o.waitCheckMs ?? 1e3, o.waitPingMs ?? 25e3);
-      res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-      res.end("Rota reservada do Duto");
-      return;
-    }
+  function record(req, route, headers, websocket, access) {
     const id = nextId++;
     const started = Date.now();
-    const headers = rewrite(req.headers, route);
-    const reqCap = new Capture(TEXT.test(req.headers["content-type"] ?? ""), max);
     o.store.add({
       id,
       tunnel: route.tunnel,
@@ -574,18 +998,59 @@ async function startProxy(o) {
       durationMs: null,
       bytes: 0,
       startedAt: started,
-      websocket: false,
+      websocket,
       reqHeaders: flat(headers),
       resHeaders: {},
       reqBody: null,
       resBody: null,
-      truncated: false
+      truncated: false,
+      ...access && { access }
     });
+    return { id, started };
+  }
+  const server = createServer(async (req, res) => {
+    req.pause();
+    const route = await routeFor(req);
+    if (!route) {
+      res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+      res.end("T\xFAnel n\xE3o encontrado nesta sess\xE3o");
+      return;
+    }
+    if ((req.url ?? "").startsWith(DUTO_PREFIX)) {
+      if (req.url === WAIT_PATH && req.method === "GET") {
+        if (route.auth?.access(req.headers).kind === "denied") return void deny(req, res, false);
+        return waitForService(res, route.port, o.waitCheckMs ?? 1e3, o.waitPingMs ?? 25e3);
+      }
+      if (route.auth && await authRoute(req, res, route, route.auth)) return;
+      res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+      res.end("Rota reservada do Duto");
+      return;
+    }
+    const preflight = !!route.auth && isPreflight(req.method, req.headers);
+    const access = route.auth && !preflight ? route.auth.access(req.headers) : void 0;
+    const headers = delivered(req.headers, route);
+    if (access?.kind === "denied") {
+      const html = wantsHtml(req.headers.accept);
+      const { id: id2, started: started2 } = record(req, route, headers, false, html ? void 0 : access);
+      const { status, out, body } = deny(req, res, html);
+      o.store.update(id2, { status, durationMs: Date.now() - started2, bytes: Buffer.byteLength(body), resHeaders: out });
+      return;
+    }
+    const { id, started } = record(req, route, headers, false, access);
+    const reqCap = new Capture(TEXT.test(req.headers["content-type"] ?? ""), max);
     req.pause();
     const host = await localHost(route.port);
     const upstream = request(
       { host, port: route.port, agent: LOCAL_AGENT, method: req.method, path: req.url, headers },
       (up) => {
+        if (preflight) {
+          const out = preflightHeaders(up.headers);
+          res.writeHead(up.statusCode ?? 502, out);
+          res.end();
+          up.on("end", () => o.store.update(id, { status: up.statusCode ?? null, durationMs: Date.now() - started, bytes: 0, resHeaders: flat(out) }));
+          up.resume();
+          return;
+        }
         const resCap = new Capture(TEXT.test(up.headers["content-type"] ?? ""), max);
         let bytes = 0;
         if (route.host && route.rewriteRedirects !== false && typeof up.headers.location === "string") {
@@ -624,6 +1089,11 @@ async function startProxy(o) {
       } else res.destroy();
       o.store.update(id, { status: 503, durationMs: Date.now() - started, bytes: res.headersSent ? 0 : Buffer.byteLength(msg), error: err.message || err.code || err.name, reqBody: reqCap.text() });
     });
+    if (preflight) {
+      req.resume();
+      upstream.end();
+      return;
+    }
     req.on("data", (c) => reqCap.push(c));
     req.pipe(upstream);
   });
@@ -631,25 +1101,14 @@ async function startProxy(o) {
     client.on("error", () => client.destroy());
     const route = await routeFor(req);
     if (!route) return void client.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
-    const id = nextId++;
-    const started = Date.now();
-    const headers = rewrite(req.headers, route);
-    o.store.add({
-      id,
-      tunnel: route.tunnel,
-      method: req.method ?? "GET",
-      path: req.url ?? "/",
-      status: null,
-      durationMs: null,
-      bytes: 0,
-      startedAt: started,
-      websocket: true,
-      reqHeaders: flat(headers),
-      resHeaders: {},
-      reqBody: null,
-      resBody: null,
-      truncated: false
-    });
+    const access = route.auth?.access(req.headers);
+    const headers = delivered(req.headers, route);
+    const { id, started } = record(req, route, headers, true, access);
+    if (access?.kind === "denied") {
+      client.end(WS_DENIED);
+      o.store.update(id, { status: 401, durationMs: Date.now() - started });
+      return;
+    }
     const target = connect2({ host: await localHost(route.port), port: route.port }, () => {
       let raw = `${req.method} ${req.url} HTTP/${req.httpVersion}\r
 `;
@@ -663,8 +1122,8 @@ async function startProxy(o) {
       target.write(`${raw}\r
 `);
       if (head.length) target.write(head);
-      target.once("data", (first) => {
-        const status = Number(/^HTTP\/\d\.\d (\d{3})/.exec(first.toString("latin1"))?.[1] ?? 0) || null;
+      target.once("data", (first2) => {
+        const status = Number(/^HTTP\/\d\.\d (\d{3})/.exec(first2.toString("latin1"))?.[1] ?? 0) || null;
         o.store.update(id, { status, durationMs: Date.now() - started });
       });
       target.pipe(client);
@@ -696,13 +1155,13 @@ async function startProxy(o) {
 
 // src/session/orphans.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
-var fileOf = (dir, cfPid) => join4(dir, `cloudflared-${cfPid}.json`);
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
+var fileOf = (dir, cfPid) => join5(dir, `cloudflared-${cfPid}.json`);
 function recordCloudflared(dir, cfPid, sessionPid = process.pid) {
   try {
-    mkdirSync3(dir, { recursive: true });
-    writeFileSync3(fileOf(dir, cfPid), JSON.stringify({ sessionPid, cfPid, at: Date.now() }));
+    mkdirSync4(dir, { recursive: true });
+    writeFileSync4(fileOf(dir, cfPid), JSON.stringify({ sessionPid, cfPid, at: Date.now() }));
   } catch {
   }
 }
@@ -720,7 +1179,7 @@ var realProc = {
   },
   isCloudflared(pid) {
     try {
-      if (process.platform === "linux") return readFileSync3(`/proc/${pid}/cmdline`, "utf8").includes("cloudflared");
+      if (process.platform === "linux") return readFileSync4(`/proc/${pid}/cmdline`, "utf8").includes("cloudflared");
       if (process.platform === "darwin") return spawnSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8" }).stdout.includes("cloudflared");
     } catch {
       return false;
@@ -739,10 +1198,10 @@ function reapOrphans(dir, proc = realProc) {
   let killed = 0;
   for (const name of readdirSync(dir)) {
     if (!/^cloudflared-\d+\.json$/.test(name)) continue;
-    const path = join4(dir, name);
+    const path = join5(dir, name);
     let rec;
     try {
-      rec = JSON.parse(readFileSync3(path, "utf8"));
+      rec = JSON.parse(readFileSync4(path, "utf8"));
     } catch {
       rmSync2(path, { force: true });
       continue;
@@ -822,6 +1281,9 @@ var Session = class {
   records = new RecordStore();
   tunnels = [];
   routes = /* @__PURE__ */ new Map();
+  specs = /* @__PURE__ */ new Map();
+  /** Um TunnelAuth por túnel, reaproveitado nas reaberturas para não desconectar quem já entrou. */
+  auths = /* @__PURE__ */ new Map();
   proxy = null;
   child = null;
   token = null;
@@ -866,6 +1328,26 @@ var Session = class {
     const existing = await this.o.api.endpoints().catch(() => []);
     await this.open(t, existing);
   }
+  /** Link para o QR: com senha, um token de uso único; sem senha, só a URL. */
+  qrLink(key) {
+    const t = this.tunnels.find((x) => x.key === key);
+    if (!t?.url) return null;
+    const auth = this.auths.get(key);
+    if (!auth) return { url: t.url, expiresAt: null };
+    const { token, expiresAt } = auth.issueQrToken();
+    return { url: `${t.url}/__duto/qr/${token}`, expiresAt };
+  }
+  /** Cria o TunnelAuth na primeira abertura (precisa do allow resolvido) e o mantém depois. */
+  async authFor(key) {
+    const existing = this.auths.get(key);
+    if (existing) return existing;
+    const spec = this.specs.get(key);
+    if (!spec?.auth?.length) return void 0;
+    const allow = spec.allow?.length ? await (this.o.resolveAllow ?? resolveAllow)(spec.allow) : void 0;
+    const auth = new TunnelAuth({ tunnel: key, credentials: spec.auth, allow });
+    this.auths.set(key, auth);
+    return auth;
+  }
   async stop() {
     if (this.stopped) return;
     this.stopped = true;
@@ -878,7 +1360,8 @@ var Session = class {
     this.emit();
   }
   blank(spec, adHoc) {
-    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
+    this.specs.set(keyOf(spec), spec);
+    return { key: keyOf(spec), name: spec.name, port: spec.port, ...spec.host ? { host: spec.host } : {}, ...spec.headers ? { headers: spec.headers } : {}, ...spec.rewriteRedirects === false ? { rewriteRedirects: false } : {}, ...spec.auth?.length ? { auth: true } : {}, url: null, hostname: null, endpointId: null, status: "opening", error: null, adHoc, requests: 0, errors: 0 };
   }
   async open(t, existing, retrying = false) {
     if (this.stopped) return;
@@ -898,11 +1381,16 @@ var Session = class {
         await withTimeout(this.o.api.closeTunnel(res.endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS);
         return;
       }
+      const auth = await this.authFor(t.key);
+      if (this.stopped) {
+        await withTimeout(this.o.api.closeTunnel(res.endpointId).catch(() => void 0), CLOSE_TIMEOUT_MS);
+        return;
+      }
       t.url = res.url;
       t.hostname = res.hostname;
       t.endpointId = res.endpointId;
       t.error = null;
-      this.routes.set(res.hostname.toLowerCase(), { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects });
+      this.routes.set(res.hostname.toLowerCase(), { tunnel: t.key, port: t.port, host: t.host, headers: t.headers, rewriteRedirects: t.rewriteRedirects, auth });
       t.status = await isPortListening(t.port) ? "live" : "no-listener";
       this.ensureCloudflared(res.tunnelToken);
       this.emit();
@@ -1028,7 +1516,7 @@ function runPlain(session, out) {
     for (const t of session.getState().tunnels) {
       if ((t.status === "live" || t.status === "no-listener") && t.url && !announced.has(t.key)) {
         announced.add(t.key);
-        out(`${paint("signal", "\u25CF")} ${t.key}  ${t.url} \u2192 ${localLabel(t)}`);
+        out(`${paint("signal", "\u25CF")} ${t.key}  ${t.url}${t.auth ? " \u{1F512}" : ""} \u2192 ${localLabel(t)}`);
       }
       if (t.status === "failed" && t.error && !failed.has(t.key)) {
         failed.add(t.key);
@@ -1078,6 +1566,23 @@ function parseHostFlag(raw) {
   if (raw === void 0 || raw === true || raw === "") return void 0;
   return parseHost(String(raw)) ?? fail2("Host inv\xE1lido: use s\xF3 o dom\xEDnio, como meuapp.test");
 }
+function listFlag(raw) {
+  if (raw === void 0) return [];
+  return (Array.isArray(raw) ? raw : [raw]).map((v) => v === true ? "" : String(v));
+}
+function parseAuthFlags(raw) {
+  const out = [];
+  for (const entry of listFlag(raw)) {
+    const r = parseCredential(entry);
+    if (!r.ok) fail2(r.reason === "password" ? "Senha precisa ter de 8 a 128 caracteres" : r.reason === "user" ? "Usu\xE1rio inv\xE1lido: de 1 a 128 caracteres, sem espa\xE7o" : "Credencial inv\xE1lida: use usuario:senha");
+    if (out.some((c) => c.user === r.cred.user)) fail2(`Usu\xE1rio "${r.cred.user}" aparece duas vezes`);
+    out.push(r.cred);
+  }
+  return out;
+}
+function parseAllowFlags(raw) {
+  return listFlag(raw).map((v) => parseAllowEntry(v) ? v : fail2(`"${v}" n\xE3o \xE9 um nome conhecido (stripe, github) nem uma faixa de IP`));
+}
 function wantsUi(flags) {
   if (flags.ui === false) return false;
   if (!process.stdout.isTTY || !process.stdin.isTTY) return false;
@@ -1094,12 +1599,12 @@ async function runSession(specs, source, flags) {
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
-  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname(), cloudflaredPath, source, runDir: join5(dutoHome(), "run") });
+  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-EPWB53EP.js");
-    process.exit(await runFullscreen(session, specs, "0.4.6"));
+    const { runFullscreen } = await import("./fullscreen-DKIFHB6J.js");
+    process.exit(await runFullscreen(session, specs, "0.5.0"));
   }
-  console.log(`${mark()} ${paint("muted", `${"0.4.6"} \xB7 ${source} \xB7 Ctrl+C para encerrar`)}`);
+  console.log(`${mark()} ${paint("muted", `${"0.5.0"} \xB7 ${source} \xB7 Ctrl+C para encerrar`)}`);
   const stopLog = runPlain(session, (l) => console.log(l));
   const stopped = new Promise((resolve) => {
     const onSignal = () => {
@@ -1121,6 +1626,8 @@ async function runSession(specs, source, flags) {
 async function tunnel(rawPort, flags) {
   if (rawPort === void 0) {
     if (flags.host !== void 0) fail2("Use --host junto com a porta (duto 8080 --host meuapp.test) ou host: no duto.yml");
+    if (flags.auth !== void 0) fail2("Use --auth junto com a porta (duto 3000 --auth ana:senha) ou auth: no duto.yml");
+    if (flags.permitir !== void 0) fail2("Use --permitir junto com a porta (duto 3000 --permitir stripe) ou permitir: no duto.yml");
     let found;
     try {
       found = findConfig(process.cwd());
@@ -1145,11 +1652,14 @@ ${paint("signal", "Dica:")} crie um duto.yml com os t\xFAneis do projeto e rode
   const host = parseHostFlag(flags.host);
   const keepRedirects = flags.rewriteRedirects === false;
   if (keepRedirects && !host) fail2("--no-rewrite-redirects s\xF3 vale junto com --host");
-  return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {} }], "linha de comando", flags);
+  const auth = parseAuthFlags(flags.auth);
+  const allow = parseAllowFlags(flags.permitir);
+  if (allow.length && !auth.length) fail2("--permitir s\xF3 vale junto com --auth");
+  return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {}, ...auth.length ? { auth } : {}, ...allow.length ? { allow } : {} }], "linha de comando", flags);
 }
 var cli = cac("duto");
-cli.command("[port]", "Sem porta: abre os t\xFAneis do duto.yml. Com porta: abre um t\xFAnel para ela").option("--name <nome>", "Nome do endere\xE7o fixo (ex.: web \u2192 https://web-<usu\xE1rio>.duto.dev)").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico (ex.: meuapp.test)").option("--no-rewrite-redirects", "Com --host: n\xE3o troca o host local pelo p\xFAblico nos redirecionamentos").option("--no-ui", "Sem tela cheia: s\xF3 um log das requisi\xE7\xF5es (\xFAtil em scripts)").option("--ui", "For\xE7a a tela cheia (no Windows ela vem desligada)").action((port, opts) => tunnel(port, opts));
-cli.command("http <port>", "O mesmo que duto <porta> (para quem vem do ngrok)").option("--name <nome>", "Nome do endere\xE7o fixo").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico").option("--no-rewrite-redirects", "Com --host: mant\xE9m os redirecionamentos como o servi\xE7o mandou").option("--no-ui", "Sem tela cheia").action((port, opts) => tunnel(port, opts));
+cli.command("[port]", "Sem porta: abre os t\xFAneis do duto.yml. Com porta: abre um t\xFAnel para ela").option("--name <nome>", "Nome do endere\xE7o fixo (ex.: web \u2192 https://web-<usu\xE1rio>.duto.dev)").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico (ex.: meuapp.test)").option("--no-rewrite-redirects", "Com --host: n\xE3o troca o host local pelo p\xFAblico nos redirecionamentos").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia: s\xF3 um log das requisi\xE7\xF5es (\xFAtil em scripts)").option("--ui", "For\xE7a a tela cheia (no Windows ela vem desligada)").action((port, opts) => tunnel(port, opts));
+cli.command("http <port>", "O mesmo que duto <porta> (para quem vem do ngrok)").option("--name <nome>", "Nome do endere\xE7o fixo").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico").option("--no-rewrite-redirects", "Com --host: mant\xE9m os redirecionamentos como o servi\xE7o mandou").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia").action((port, opts) => tunnel(port, opts));
 cli.command("login <token>", "Salva o authtoken (pegue em https://duto.dev)").action(async (token) => {
   try {
     const me = await createApiClient({ baseUrl: apiUrl(), token: String(token) }).me();
@@ -1188,7 +1698,7 @@ cli.help(
     body: s.body.replace(/^\s*For more info, run any command with the `--help` flag:/m, "  Mais detalhes de um comando: duto <comando> --help").replace("Display this message", "Mostra esta ajuda").replace("Display version number", "Mostra a vers\xE3o")
   }))
 );
-cli.version("0.4.6");
+cli.version("0.5.0");
 try {
   cli.parse(process.argv, { run: false });
   await cli.runMatchedCommand();